Improved Low-Memory Subset Sum and LPN Algorithms via Multiple - PowerPoint PPT Presentation

Improved Low-Memory Subset Sum and LPN Algorithms via Multiple Collision January 2019 , Nancy Claire Delaplace, Andre Esser and Alexander May

About Me Claire Delaplace: Postdoc researcher • Ruhr University Bochum, Germany • Team: Cryptology and IT-Security • Scientific supervisor: Alexander May 2

About Me Claire Delaplace: Postdoc researcher • Ruhr University Bochum, Germany • Team: Cryptology and IT-Security • Scientific supervisor: Alexander May Before that... • University of Rennes, IRISA. Team EMSEC • University of Lille, CRIStAL. Team CFHP • PhD supervisors: Pierre-Alain Fouque & Charles Bouillaguet • Thesis: Linear Algebra Algorithm for Cryptography 2

Research Topic Attacking Underlying Cryptographic Problems 3

Research Topic Attacking Underlying Cryptographic Problems • Generalised Birthday Problem ([B D F2018] + 2 in submission) • ECDLP ([ D M19] + 1 in submission) • LWE variants ([B D FK17,B D EFT18]) • Sparse Linear Algebra ([B D 16,B D V17]) • Subset Sum & LPN ([ D EM19]) 3

Research Topic Attacking Underlying Cryptographic Problems • Generalised Birthday Problem ([B D F2018] + 2 in submission) • ECDLP ([ D M19] + 1 in submission) • LWE variants ([B D FK17,B D EFT18]) • Sparse Linear Algebra ([B D 16,B D V17]) • Subset Sum & LPN ([ D EM19]) 3

Motivations Post-Quantum Cryptography • Popular families of schemes: Lattices & Codes based • Subset-sum & LPN related to Lattices & Codes ? • Better algo for subset-sum & LPN = ⇒ Better algo for Lattices & Codes 4

Motivations Post-Quantum Cryptography • Popular families of schemes: Lattices & Codes based • Subset-sum & LPN related to Lattices & Codes ? • Better algo for subset-sum & LPN = ⇒ Better algo for Lattices & Codes Main drawback HUGE amount of memory these attacks require ⇒ Need for time-memory trade-offs 4

Motivations Post-Quantum Cryptography • Popular families of schemes: Lattices & Codes based • Subset-sum & LPN related to Lattices & Codes ? • Better algo for subset-sum & LPN = ⇒ Better algo for Lattices & Codes Main drawback HUGE amount of memory these attacks require ⇒ Need for time-memory trade-offs This work New time-memory trade-offs for subset-sum & LPN Main tool: Parallel Collision Search algorithm [vOW99] 4

Collisions Search Given: F, G : F n 2 → F n 2 with uniformly random outputs Goal: Find x, y ∈ F n 2 s.t. F ( x ) = G ( y ) x F Birthday Paradox F ( x ) = G ( y ) Recovering one collision: n � 2 � Time: O 2 y G 5

Collisions Search Given: F, G : F n 2 → F n 2 with uniformly random outputs Goal: Find x, y ∈ F n 2 s.t. F ( x ) = G ( y ) x F Birthday Paradox F ( x ) = G ( y ) Recovering one collision: n � 2 � Time: O 2 y G Searching for 2 m collisions • 2 m Birthday method: Time O 2 m + n � 2 � � � • Parallel Collision Search [vOW99]: Time ˜ m + n O 2 2 5

PCS: High level Idea F Collision F F Collision F Search for cycle 6

PCS: High level Idea F F Collision F F F F Collision F F F Search for cycle 6

PCS: High level Idea F Collision F F Collision F Search for cycle 6

PCS: High level Idea F Collision Collision F F Collision Collision F Search for cycle Search for cycle 6

PCS: High level Idea Collision F Collision Search for cycle Search for cycle 6

PCS in a Nutshell Given: F, G : F n 2 → F n 2 with uniformly random outputs Goal: Find 2 m ( x, y ) ∈ ( F n 2 ) 2 s.t. F ( x ) = G ( y ) F 2 m ( x, y ) F ( x ) = G ( y ) PCS G � � n + m T = ˜ M = ˜ O (2 m ) O 2 2 7

1 Application 1: Random Subset-Sum Problem 2 Application 2: LPN 8

1 Application 1: Random Subset-Sum Problem 2 Application 2: LPN 9

Random Subset-Sum (RSS) Problem Definition • a = ( a 1 . . . a n ) ∈ ( Z 2 n ) n • e = ( e 1 . . . e n ) ∈ { 0 , 1 } n wt ( e ) = n unknown 2 • t = � a , e � mod 2 n GOAL: Given ( a , t ) find e ∈ { 0 , 1 } n such that � a , e � = t 10

Random Subset-Sum (RSS) Problem Definition • a = ( a 1 . . . a n ) ∈ ( Z 2 n ) n • e = ( e 1 . . . e n ) ∈ { 0 , 1 } n wt ( e ) = n unknown 2 • t = � a , e � mod 2 n GOAL: Given ( a , t ) find e ∈ { 0 , 1 } n such that � a , e � = t Our Work Two new algorithms • SS-PCS Better than previous work for M < 2 0 . 02 n • SS-PCS 4 Better than previous work for 2 0 . 13 n < M < 2 0 . 2 n 10

Previous Work n • MitM (Folklore algorithm): T = M = 2 2 11

Previous Work n • MitM (Folklore algorithm): T = M = 2 2 n n 2 , M = 2 • [SS81] Schroeppel-Shamir 4-list Algorithm: T = 2 4 11

Previous Work n • MitM (Folklore algorithm): T = M = 2 2 n n 2 , M = 2 • [SS81] Schroeppel-Shamir 4-list Algorithm: T = 2 4 • [H-GJ10] Representation Technique. T = M ≃ 2 0 . 337 n 11

Previous Work n • MitM (Folklore algorithm): T = M = 2 2 n n 2 , M = 2 • [SS81] Schroeppel-Shamir 4-list Algorithm: T = 2 4 • [H-GJ10] Representation Technique. T = M ≃ 2 0 . 337 n • [BCJ11] ◦ Improvement of [H-GJ10]: T = M ≃ 2 0 . 291 n ◦ Memoryless algorithm: T ≃ 2 0 . 71 n 11

Previous Work n • MitM (Folklore algorithm): T = M = 2 2 n n 2 , M = 2 • [SS81] Schroeppel-Shamir 4-list Algorithm: T = 2 4 • [H-GJ10] Representation Technique. T = M ≃ 2 0 . 337 n • [BCJ11] ◦ Improvement of [H-GJ10]: T = M ≃ 2 0 . 291 n ◦ Memoryless algorithm: T ≃ 2 0 . 71 n • [DDKS12] Best 2 0 . 01 n ≤ M < 2 0 . 17 n 11

MitM Algorithm Goal: Find e s.t. � a , e � = t e = e 1 e 2 + � a , e 1 � t − � a , e 2 � 2 n/ 2 2 n/ 2 Collision ⇒ � a , e 1 + e 2 � = t 12

Schroeppel-Shamir [SS81] Goal: Find e s.t. � a , e � = t e = + + + 13

Schroeppel-Shamir [SS81] Goal: Find e s.t. � a , e � = t e = + + + 2 n/ 4 � a , e 1 � � a , e 2 � � a , e 3 � � a , e 4 � 2 n/ 4 13

Schroeppel-Shamir [SS81] Goal: Find e s.t. � a , e � = t e = + + + 2 n/ 4 � a , e 1 � � a , e 2 � � a , e 3 � � a , e 4 � 2 n/ 4 t 1 ∈ L 1 , . . . t 4 ∈ L 4 s.t. � ⇒ � a , e 1 + · · · + e 4 � = t i t i = t 13

Schroeppel-Shamir 4 -list Algorithm 2 n/ 4 14

Schroeppel-Shamir 4 -list Algorithm 2 n/ 4 n 2 n/ 4 R R ′ = t − R mod 2 R ′ 4 n/ 4 14

Schroeppel-Shamir 4 -list Algorithm 2 n/ 4 Collision ⇒ n 2 n/ 4 R R ′ = t − R mod 2 R ′ 4 � i t i = t n/ 4 14

Schroeppel-Shamir 4 -list Algorithm 2 n/ 4 Collision ⇒ n 2 n/ 4 R R ′ = t − R mod 2 R ′ 4 ∀ R ∈ Z 2 n/ 4 � i t i = t n/ 4 14

Schroeppel-Shamir 4 -list Algorithm 2 n/ 4 Collision ⇒ n 2 n/ 4 R R ′ = t − R mod 2 R ′ 4 ∀ R ∈ Z 2 n/ 4 � i t i = t � 2 n/ 2 � T = O � 2 n/ 4 � M = O n/ 4 14

Representations � e i = e n Representation of e : ( e 1 . . . e k ) wt ( e i ) = 2 k ∀ i Example e 1 = (10001000) e ′ 1 = (10000001) e 2 = (01000001) e ′ 2 = (01001000) ( e 1 , e 2 ) and ( e ′ 1 , e ′ 2 ) : representations of e = (11001001) 15

Representations � e i = e n Representation of e : ( e 1 . . . e k ) wt ( e i ) = 2 k ∀ i Example e 1 = (10001000) e ′ 1 = (10000001) e 2 = (01000001) e ′ 2 = (01001000) ( e 1 , e 2 ) and ( e ′ 1 , e ′ 2 ) : representations of e = (11001001) Important remark e ∈ { 0 , 1 } n , wt ( e ) = n/ 2 ≈ 2 n/ 2 representations ( e 1 , e 2 ) of e � n/ 2 � There are n/ 4 15

Representation Technique: Needles and Haystack Subset-sum Find e ∈ { 0 , 1 } n s.t. � a , e � = t mod 2 n 16

Representation Technique: Needles and Haystack Representation Technique [H-GJ10] Find ( e 1 , e 2 ) ∈ { 0 , 1 } n × { 0 , 1 } n s.t. � a , e 1 + e 2 � = t mod 2 n 16

Representation Technique: Needles and Haystack Representation Technique [H-GJ10] Find ( e 1 , e 2 ) ∈ { 0 , 1 } n × { 0 , 1 } n s.t. � a , e 1 + e 2 � = t mod 2 n With Rep. Without Rep. � n � 2 ≈ 2 1 . 623 n � n # search space: � ≈ 2 n � # search space: n/ 4 n/ 2 � n/ 2 � ≈ 2 n/ 2 # solutions: 1 # solutions: � n/ 4 16

BCJ Memoryless Algorithm [BCJ11] • wt ( x ) = n 4 � n 2 r ≈ • g ( x ) = � a , x � mod 2 r , � n/ 4 • g t ( x ) = t − g ( x ) mod 2 r 17

BCJ Memoryless Algorithm [BCJ11] g ( x ) = g t ( y ) • wt ( x ) = n 4 � n 2 r ≈ � • g ( x ) = � a , x � mod 2 r , � n/ 4 � a , x + y � = t mod 2 r • g t ( x ) = t − g ( x ) mod 2 r 17

BCJ Memoryless Algorithm [BCJ11] g ( x ) = g t ( y ) • wt ( x ) = n 4 � n 2 r ≈ � • g ( x ) = � a , x � mod 2 r , � n/ 4 � a , x + y � = t mod 2 r • g t ( x ) = t − g ( x ) mod 2 r BCJ Memoryless Algorithm • Search a collision between g x g and g t • If x + y ∈ { 0 , 1 } n and � a , x + y � = t mod 2 n re- g ( x ) = g t ( y ) turn x + y • Else restart y g t 17

BCJ Memoryless Algorithm [BCJ11] g ( x ) = g t ( y ) • wt ( x ) = n 4 � n 2 r ≈ � • g ( x ) = � a , x � mod 2 r , � n/ 4 � a , x + y � = t mod 2 r • g t ( x ) = t − g ( x ) mod 2 r BCJ Memoryless Algorithm • Search a collision between g x g and g t • If x + y ∈ { 0 , 1 } n and � a , x + y � = t mod 2 n re- g ( x ) = g t ( y ) turn x + y • Else restart # coll. y g t # rep. ≈ 2 r − n/ 2 17