On the Fast Algebraic Immunity of Majority Functions Pierrick M ÉAUX ICTEAM/ELEN/Crypto Group, Université catholique de Louvain, Belgium Latincrypt 2019— Santiago de Chile Wednesday October 2 1 / 15
Table of Contents Introduction Results from Threshold Functions FAI of Majority Functions Conclusion 2 / 15
Summary Introduction Results from Threshold Functions FAI of Majority Functions Conclusion 3 / 15
Motivation: Why FAI and Majority Functions? A conceptually simple design: x 1 x 2 x 3 x N · · · P i , S i F F ( P i ( S i ( x ))) 4 / 15
Motivation: Why FAI and Majority Functions? A conceptually simple design: x 1 x 2 x 3 x N · · · P i , S i F F ( P i ( S i ( x ))) ◮ Goldreich’s PRG [Gol01]: Pseudorandom generators with polynomial stretch and small locality. Local functions. ◮ FLIP cipher [MJSC16]: stream cipher adapted to frameworks using fully homomorphic encryption. 4 / 15
Motivation: Why FAI and Majority Functions? A conceptually simple design: x 1 x 2 x 3 x N · · · P i , S i F F ( P i ( S i ( x ))) ◮ Goldreich’s PRG [Gol01]: Pseudorandom generators with polynomial stretch and small locality. Local functions. ◮ FLIP cipher [MJSC16]: stream cipher adapted to frameworks using fully homomorphic encryption. Fast Algebraic Immunity? Majority functions? 4 / 15
Motivation: Why FAI and Majority Functions? A conceptually simple design: x 1 x 2 x 3 x N · · · P i , S i F F ( P i ( S i ( x ))) ◮ Goldreich’s PRG [Gol01]: Pseudorandom generators with polynomial stretch and small locality. Local functions. ◮ FLIP cipher [MJSC16]: stream cipher adapted to frameworks using fully homomorphic encryption. Fast Algebraic Immunity? Cryptographic criterion on Boolean functions. → bound on complexity best knowns attacks. Majority functions? Easy to compute, good algebraic properties. → XOR-MAJ predicates of [AL18], filtering function in FiLIP [MCJS19]. 4 / 15
Algebraic System and Attacks b 1 = F ( P 1 ( S 1 ( x ))) b 2 = F ( P 2 ( S 2 ( x ))) b 3 = F ( P 3 ( S 3 ( x ))) . . . Resolution: ◮ SAT solvers , Grobner bases approaches. ◮ Linearization techniques. Example: all equations have the degree of F . 5 / 15
Algebraic System and Attacks b 1 = F ( P 1 ( S 1 ( x ))) b 2 = F ( P 2 ( S 2 ( x ))) b 3 = F ( P 3 ( S 3 ( x ))) . . . Resolution: ◮ SAT solvers , Grobner bases approaches. ◮ Linearization techniques. Example: all equations have the degree of F . Algebraic Attacks [CM03] Let F be the filtering function 1. find g a low algebraic degree function s.t. g and gF has low degree, 2. create T equations with monomials of degree ≤ deg ( g ), 3. linearize the system of T equations in D = � deg ( g ) � N variables, � i =0 i 4. solve the system in O ( D ω ). 5 / 15
Algebraic System and Attacks Algebraic Attacks [CM03] Let F be the filtering function 1. find g a low algebraic degree function s.t. g and gF has low degree, 2. create T equations with monomials of degree ≤ deg ( g ), 3. linearize the system of T equations in D = � deg ( g ) � N variables, � i =0 i 4. solve the system in O ( D ω ). Algebraic Immunity Let F : F N 2 → F 2 , we define: AI( F ) = min { max(deg( g ) , deg( gF ) , g � = 0) } = min { deg( g ) , g � = 0 | gF = 0 or g ( F + 1) = 0 } 5 / 15
Algebraic System and Attacks Algebraic Attacks [CM03] Let F be the filtering function 1. find g a low algebraic degree function s.t. g and gF has low degree, 2. create T equations with monomials of degree ≤ deg ( g ), 3. linearize the system of T equations in D = � deg ( g ) � N variables, � i =0 i 4. solve the system in O ( D ω ). Fast Algebraic Attacks [Cou03] Let F be the filtering function: 1. find g and h of low degree such that gF = h , deg( g ) ≤ AI( F ) < deg( h ). 2. search linear relations in the system to cancel the monomials of degree more that deg( g ), 3. linearize and solve the system of degree deg( g ) ≤ AI( F ). 5 / 15
Algebraic System and Attacks Fast Algebraic Attacks [Cou03] Let F be the filtering function: 1. find g and h of low degree such that gF = h , deg( g ) ≤ AI( F ) < deg( h ). 2. search linear relations in the system to cancel the monomials of degree more that deg( g ), 3. linearize and solve the system of degree deg( g ) ≤ AI( F ). Fast Algebraic Immunity Let F : F N 2 → F 2 , we define: � � FAI( F ) = min 2AI( F ) , 1 ≤ deg( g ) < AI( F ) [deg( g ) + deg( Fg )] min . 5 / 15
Majority Functions Majority function � 0 if w H ( x ) ≤ n 2 , x = ( x 1 , · · · , x n ) ∈ F n MAJ n ( x ) = 2 , 1 otherwise. 6 / 15
Majority Functions Majority function � 0 if w H ( x ) ≤ n 2 , x = ( x 1 , · · · , x n ) ∈ F n MAJ n ( x ) = 2 , 1 otherwise. ◮ Symmetric function, easy to compute. → homomorphic evaluation with multiplexers, quasi additive noise [MCJS19]. ◮ Optimal algebraic immunity [BP05,DMS06], AI(MAJ n ) = ⌊ ( n + 1) / 2 ⌋ . → direct sum F = g + MAJ n provides AI( F ) ≥ AI(MAJ n ) and FAI( F ) ≥ FAI(MAJ n ). 6 / 15
Majority Functions Majority function � 0 if w H ( x ) ≤ n 2 , x = ( x 1 , · · · , x n ) ∈ F n MAJ n ( x ) = 2 , 1 otherwise. ◮ Symmetric function, easy to compute. → homomorphic evaluation with multiplexers, quasi additive noise [MCJS19]. ◮ Optimal algebraic immunity [BP05,DMS06], AI(MAJ n ) = ⌊ ( n + 1) / 2 ⌋ . → direct sum F = g + MAJ n provides AI( F ) ≥ AI(MAJ n ) and FAI( F ) ≥ FAI(MAJ n ). Algebraic properties of MAJ n : ◮ deg, known for all n . ◮ AI, known for all n . ◮ FAI, only bounds. 6 / 15
Related Works and Main Result Notation: n = 2 m + 2 k + ε, m ∈ N ∗ , k ∈ N , k < 2 m − 1 , ε ∈ { 0 , 1 } . 7 / 15
Related Works and Main Result Notation: n = 2 m + 2 k + ε, m ∈ N ∗ , k ∈ N , k < 2 m − 1 , ε ∈ { 0 , 1 } . ◮ [ACGKMR06] Theorem 2, for n ≥ 2: FAI(MAJ n ) ≤ 2 m − 1 + 2 k + 2 . ◮ [TLD16], exact FAI when n = 2 m and n = 2 m + 1. ◮ [CGZ19], exact FAI when n = 2 m + 2 and n = 2 m + 3, since m ≥ 2. 7 / 15
Related Works and Main Result Notation: n = 2 m + 2 k + ε, m ∈ N ∗ , k ∈ N , k < 2 m − 1 , ε ∈ { 0 , 1 } . ◮ [ACGKMR06] Theorem 2, for n ≥ 2: FAI(MAJ n ) ≤ 2 m − 1 + 2 k + 2 . ◮ [TLD16], exact FAI when n = 2 m and n = 2 m + 1. ◮ [CGZ19], exact FAI when n = 2 m + 2 and n = 2 m + 3, since m ≥ 2. This work: Let m ≥ 2, 0 ≤ k < 2 m − 2 , ε ∈ { 0 , 1 } , FAI(MAJ n ) = 2 m − 1 + 2 k + 2 . 7 / 15
Summary Introduction Results from Threshold Functions FAI of Majority Functions Conclusion 8 / 15
Bounding the FAI Threshold Function 0 if w H ( x ) < d , � x = ( x 1 , · · · , x n ) ∈ F n 2 , d ∈ { 0 , · · · , n } , T d ( x ) = 1 otherwise. n even: MAJ n = T n 2 +1 , for n odd MAJ n = T n +1 2 . 9 / 15
Bounding the FAI Threshold Function 0 if w H ( x ) < d , � x = ( x 1 , · · · , x n ) ∈ F n 2 , d ∈ { 0 , · · · , n } , T d ( x ) = 1 otherwise. n even: MAJ n = T n 2 +1 , for n odd MAJ n = T n +1 2 . Threshold and Annihilators Annihilators: AN( f ) = min g � =0 [deg( g ) | fg = 0]. AN(T d ) = n − d + 1 , and AN(1 + T d ) = d . Multiplicative property: 0 < deg( g ) < AN( f ) ⇒ deg( fg ) ≥ AN( f + 1). 9 / 15
Bounding the FAI Threshold and Annihilators Annihilators: AN( f ) = min g � =0 [deg( g ) | fg = 0]. AN(T d ) = n − d + 1 , and AN(1 + T d ) = d . Multiplicative property: 0 < deg( g ) < AN( f ) ⇒ deg( fg ) ≥ AN( f + 1). Lower Bound Let n = 2 m + 2 k + ε , m ≥ 1, 0 ≤ k < 2 m − 1 , and ε ∈ { 0 , 1 } , then: FAI(MAJ n ) ≥ 2 m − 1 + k + 2 . 9 / 15
Bounding the FAI Threshold and Annihilators Annihilators: AN( f ) = min g � =0 [deg( g ) | fg = 0]. AN(T d ) = n − d + 1 , and AN(1 + T d ) = d . Multiplicative property: 0 < deg( g ) < AN( f ) ⇒ deg( fg ) ≥ AN( f + 1). Lower Bound Let n = 2 m + 2 k + ε , m ≥ 1, 0 ≤ k < 2 m − 1 , and ε ∈ { 0 , 1 } , then: FAI(MAJ n ) ≥ 2 m − 1 + k + 2 . 2 m − 1 + k + 2 ≤ FAI(MAJ n ) ≤ 2 m − 1 + 2 k + 2 . Corollary: for n = 2 m + ε, FAI(MAJ n ) = 2 m − 1 + 2. 9 / 15
Algebraic Normal Form of Threshold Functions Algebraic Normal Form n -variable polynomial representation over F 2 i.e. belonging to F 2 [ x 1 , . . . , x n ] / ( x 2 1 + x 1 , . . . , x 2 n + x n ): �� � F ( x ) = � = � a I x I , where a I ∈ F 2 . a I x i I ⊆ [ n ] I ⊆ [ n ] i ∈ I Simplified Algebraic Normal Form for T d : · · · λ 0 λ 1 λ 2 λ n F symmetric: all, or none, monomials of the same degree in the ANF. 10 / 15
Algebraic Normal Form of Threshold Functions Algebraic Normal Form n -variable polynomial representation over F 2 i.e. belonging to F 2 [ x 1 , . . . , x n ] / ( x 2 1 + x 1 , . . . , x 2 n + x n ): �� � F ( x ) = � = � a I x I , where a I ∈ F 2 . a I x i I ⊆ [ n ] I ⊆ [ n ] i ∈ I Simplified Algebraic Normal Form for T d : · · · · · · · · · λ 0 λ 1 λ d λ D 1 2 D · · · d D ℓ D Periodicity, D = 2 ⌈ log d ⌉ 10 / 15
Recommend
More recommend
