Flexible Partial Enlargement to Accelerate Gr¨ obner Basis Computation over F 2 Johannes Buchmann*, Daniel Cabarcas † , Jantai Ding † , Mohamed Saied Emam Mohamed* *Technische Universit¨ at Darmstadt † University of Cincinnati Africacrypt 2010 Stellenbosch, South Africa, May 2010 Mohamed Saied Emam Mohamed The MGB Algorithm 1
Outline Motivation Gr¨ obner Basis Algorithms for Computing GB Enlargement Flexible Partial Enlargement MGB Algorithm Experimental Results Future Work Mohamed Saied Emam Mohamed The MGB Algorithm 2
Motivation Multivariate Cryptography Factoring and discrete logarithm: insecure under the assumption that quantum computer with enough Qbits exist Multivariate based cryptosystems: potential to resist the quantum computer attacks Mohamed Saied Emam Mohamed The MGB Algorithm 3
Motivation Multivariate Cryptography Factoring and discrete logarithm: insecure under the assumption that quantum computer with enough Qbits exist Multivariate based cryptosystems: potential to resist the quantum computer attacks Algebraic Cryptanalysis Breaking a good cipher should require “as much work as solving a system of simultaneous equations in a large number of unknowns” (Shannon 1949) Mohamed Saied Emam Mohamed The MGB Algorithm 3
Motivation The MQ Problem Given finite set of quadratic polynomials P in X = { x 1 , . . . , x n } over finite field F Find v ∈ F n , p ( v ) = 0 ∀ p ∈ P , for example: x 1 x 2 + x 1 x 3 + x 2 x 3 = 0 x 1 x 3 + x 2 x 3 + x 1 + 1 = 0 x 1 x 2 + x 1 x 3 + x 2 x 3 + x 1 + x 2 + 1 = 0 General MQ is NP-hard even if P is over F 2 Mohamed Saied Emam Mohamed The MGB Algorithm 4
Motivation Algebraic Attacks Cryptosystem → MQ Polynomial equations system Solving MQ polynomial equations system → Recovering the secret Mohamed Saied Emam Mohamed The MGB Algorithm 5
Motivation Algebraic Attacks Cryptosystem → MQ Polynomial equations system Solving MQ polynomial equations system → Recovering the secret Attacking MPKCs PK is a set of MQ Polynomial equations Encryption = Evaluation Decryption = Inversion Multivariate encryption scheme Multivariate systems → Decrypting a ciphertext using PK Multivariate signature scheme Multivariate systems → Signing a message using PK Mohamed Saied Emam Mohamed The MGB Algorithm 5
Motivation Attacking Block Cipher Using the pair of (known) plaintext-ciphertext values, the secret key and a large number of intermediate variables arising in the cipher Solving the resulting multivariate system is equivalent to recovering the secret key Mohamed Saied Emam Mohamed The MGB Algorithm 6
Motivation Attacking Block Cipher Using the pair of (known) plaintext-ciphertext values, the secret key and a large number of intermediate variables arising in the cipher Solving the resulting multivariate system is equivalent to recovering the secret key Attacking Stream Cipher Set up system of polynomial equations in unknown K and known keystream bits z t f 1 ( K , Z ) = 0 , · · · , f N ( K , Z ) = 0 Solving the multivariate system to get K Mohamed Saied Emam Mohamed The MGB Algorithm 6
Motivation The key question How to solve multivariate polynomial systems efficiently? Mohamed Saied Emam Mohamed The MGB Algorithm 7
Motivation The key question How to solve multivariate polynomial systems efficiently? Experiments Dense random systems HFE systems of different univariate degrees Mohamed Saied Emam Mohamed The MGB Algorithm 7
Gr¨ obner Basis Gr¨ obner basis algorithms are the best known techniques for solving multivariate systems Definition: A Gr¨ obner basis is a finite subset G of an ideal I satisfying: � LT(G) � = LT( I ) Properties: Computing the variety of I Membership Problem Mohamed Saied Emam Mohamed The MGB Algorithm 8
Algorithms for Computing GB Matrix-based algorithms F 4 algorithm F 5 algorithm XL algorithm (single solution) MutantXL algorithm (single solution) MXL 3 algorithm Mohamed Saied Emam Mohamed The MGB Algorithm 9
Algorithms for Computing GB Matrix-based algorithms F 4 algorithm F 5 algorithm XL algorithm (single solution) MutantXL algorithm (single solution) MXL 3 algorithm Mohamed Saied Emam Mohamed The MGB Algorithm 9
Algorithms for Computing GB Input: P ( x ) = 0 Output: G a Gr¨ obner basis of � P ( x ) � repeat Echelonize( P ) G = Gr¨ obner( P ) if termination criterion satisfied then return G terminate Enlarge( P ) Mohamed Saied Emam Mohamed The MGB Algorithm 10
Algorithms for Computing GB Echelonize( P ): Linearize(P) Gaussian Elimination Problem → very large matrix and computation time Mohamed Saied Emam Mohamed The MGB Algorithm 11
Algorithms for Computing GB Termination Criterion: F 4 ,F 5 → No more pairs exist Mohamed Saied Emam Mohamed The MGB Algorithm 12
Algorithms for Computing GB Termination Criterion: F 4 ,F 5 → No more pairs exist XL,MutantXL → Computing univariate equations Mohamed Saied Emam Mohamed The MGB Algorithm 12
Algorithms for Computing GB Termination Criterion: F 4 ,F 5 → No more pairs exist XL,MutantXL → Computing univariate equations MXL 3 → Saturation Criterion Computing G with highest degree d : G contains all terms of degree d as leading terms If H = G ∪ { t · g : g ∈ G deg( t · g ) ≤ d + 1 } No new t ∈ HT( � H ) and deg( t ) ≤ d Mohamed Saied Emam Mohamed The MGB Algorithm 12
Enlargement Enlarge( P ): Extends P by multiplying a selected set of polynomials by monomials Affects on the size of the constructed matrix and the memory t 1 t 2 1 . . . p 1 × × × . . . p 2 × × × . . . . . . . ... . . . . . . . . p m × × × . . . Mohamed Saied Emam Mohamed The MGB Algorithm 13
Enlargement Enlarge( P ): Extends P by multiplying a selected set of polynomials by monomials Affects on the size of the constructed matrix and the memory t 1 t 2 1 . . . p 1 × × × . . . p 2 × × × . . . . . . . ... Enlarge . . . . − − − − → . . . . m ji · p i p m × × × . . . Mohamed Saied Emam Mohamed The MGB Algorithm 13
Enlargement Enlarge( P ): Extends P by multiplying a selected set of polynomials by monomials Affects on the size of the constructed matrix and the memory t 1 t 2 1 s 1 s 2 s 3 1 . . . . . . . . . p 1 × × × f 1 × × × × . . . . . . . . . p 2 × × × f 2 × × × × . . . . . . . . . . . . . ... Enlarge f 3 × × × × . . . . . . . . . . − − − − → . . . . . . . . . ... ... m ji · p i . . . . . . . . . . p m × × × . . . . . . . . ... ... . . . . . . . . . . f k × × × × . . . . . . Mohamed Saied Emam Mohamed The MGB Algorithm 13
Enlargement Selection Strategy: F 4 ,F 5 algorithms → S-Polynomials Selecting a subset of Critical pairs based on the degree of LCM of the pair Mohamed Saied Emam Mohamed The MGB Algorithm 14
Enlargement Selection Strategy: F 4 ,F 5 algorithms → S-Polynomials Selecting a subset of Critical pairs based on the degree of LCM of the pair XL algorithm → No selection Enlarge the system by multiplying P by all monomials up to a certain degree D Mohamed Saied Emam Mohamed The MGB Algorithm 14
Enlargement Selection Strategy: F 4 ,F 5 algorithms → S-Polynomials Selecting a subset of Critical pairs based on the degree of LCM of the pair XL algorithm → No selection Enlarge the system by multiplying P by all monomials up to a certain degree D MutantXL algorithm → Mutant Criterion Mohamed Saied Emam Mohamed The MGB Algorithm 14
Enlargement Mutants Echelonize process yields polynomials of smaller degree than expected at a current degree D of the algorithm (mutants) Using them to enlarge the system before the degree goes up Mohamed Saied Emam Mohamed The MGB Algorithm 15
Enlargement Mutants Echelonize process yields polynomials of smaller degree than expected at a current degree D of the algorithm (mutants) Using them to enlarge the system before the degree goes up p 1 = x 1 x 2 + x 2 x 3 + x 2 x 4 + x 3 x 4 + x 1 + x 3 + 1 p 2 = x 1 x 2 + x 1 x 3 + x 1 x 4 + x 3 x 4 + x 2 + x 3 + 1 p 3 = x 1 x 2 + x 1 x 3 + x 2 x 3 + x 3 x 4 + x 1 + x 4 + 1 p 4 = x 1 x 3 + x 1 x 4 + x 2 x 3 + x 2 x 4 + 1 Mohamed Saied Emam Mohamed The MGB Algorithm 15
Enlargement Mutants Echelonize process yields polynomials of smaller degree than expected at a current degree D of the algorithm (mutants) Using them to enlarge the system before the degree goes up p 1 = x 1 x 2 + x 2 x 3 + x 2 x 4 + x 3 x 4 + x 1 + x 3 + 1 p 2 = x 1 x 2 + x 1 x 3 + x 1 x 4 + x 3 x 4 + x 2 + x 3 + 1 p 3 = x 1 x 2 + x 1 x 3 + x 2 x 3 + x 3 x 4 + x 1 + x 4 + 1 p 4 = x 1 x 3 + x 1 x 4 + x 2 x 3 + x 2 x 4 + 1 p 1 = x 1 x 2 + x 2 x 3 + x 2 x 4 + x 3 x 4 + x 1 + x 3 + 1 � p 2 = � x 1 x 3 + x 1 x 4 + x 2 x 3 + x 2 x 4 + x 1 + x 2 p 3 = � x 1 x 4 + x 2 x 3 + x 1 + x 2 + x 3 + x 4 p 4 = � x 1 + x 2 + 1 Mohamed Saied Emam Mohamed The MGB Algorithm 15
Recommend
More recommend
