Generic attacks and index calculus. D. J. Bernstein University of Illinois at Chicago


 Arthur Martin
 1 years ago
 Views:
Transcription
1 Generic attacks and index calculus D. J. Bernstein University of Illinois at Chicago
2 The discretelogarithm problem Define Ô = Easy to prove: Ô is prime. Can we find an integer Ò ¾ Ô 1 such that 5Ò mod Ô = ? Easy to prove: Ò 5Ò mod Ô permutes Ô 1. So there exists an Ò such that 5Ò mod Ô = Could find Ò by brute force. Is there a faster way?
3 Typical cryptanalytic application: Ô Imagine standard = in the DiffieHellman protocol. User chooses secret key Ò, publishes 5Ò mod Ô = Can attacker quickly solve the discretelogarithm problem? 5Ò Given public key mod Ô, quickly find secret key Ò? (Warning: This is one way to attack the protocol. Maybe there are better ways.)
4 Relations to ECC: 1. Some DL techniques also apply to ellipticcurve DL problems. Use in evaluating security of an elliptic curve. 2. Some techniques don t apply. Use in evaluating advantages of elliptic curves compared to multiplication. 3. Tricky: Some techniques have extra applications to some curves. See Tanja Lange s talk on Weil descent etc.
5 Understanding brute force Can compute successively 5 1 mod Ô = 5, 5 2 mod Ô = 25, 5 3 mod Ô = 125,, 5 8 mod Ô = , 5 9 mod Ô = ,, mod Ô = 1. At some point we ll find Ò with 5Ò mod Ô = Maximum cost of computation: Ô 1 mults by 5 mod Ô; Ô 1 nanoseconds on a CPU that does 1 mult/nanosecond.
6 This is negligible work for Ô But users can standardize a larger Ô, making the attack slower. Attack cost scales linearly: 2 50 mults for Ô 2 50, mults for Ô 2 100, etc. (Not exactly linearly: cost of mults grows with Ô. But this is a minor effect.)
7 Computation has a good chance of finishing earlier. Chance scales linearly: 1 2 chance of 1 2 cost; 1 10 chance of 1 10 cost; etc. So users should choose large Ò. That s pointless. We can apply random selfreduction : choose random Ö, say ; 5Ö compute mod Ô = ; 5Ö Ò compute 5 mod Ô as (5Ò ( mod Ô)) mod Ô; compute discrete log; subtract Ö mod Ô 1; obtain Ò.
8 Computation can be parallelized. One lowcost chip can run many parallel searches. Example, 2 6 e: one chip, 2 10 cores on the chip, each 2 30 mults/second? Maybe; see SHARCS workshops for detailed cost analyses. Attacker can run many parallel chips. Example, 2 30 e: 2 24 chips, so 2 34 cores, so 2 64 mults/second, so 2 89 mults/year.
9 Multiple targets and giant steps Computation can be applied to many targets at once. Given 100 DL targets 5Ò 1 mod Ô, 5Ò 2 mod Ô,, 5Ò 100 mod Ô: Can find all of Ò 1 Ò 2 Ò 100 with Ô 1 mults mod Ô. Simplest approach: First build a sorted table containing 5Ò 1 mod Ô,, 5Ò 100 mod Ô. Then check table for 5 1 mod Ô, 5 2 mod Ô, etc.
10 Interesting consequence #1: Solving all 100 DL problems isn t much harder than solving one DL problem. Interesting consequence #2: Solving at least one out of 100 DL problems is much easier than solving one DL problem. When did this computation find its first Ò? Typically (Ô 1) 100 mults.
11 Can use random selfreduction to turn a single target into multiple targets. Given 5Ò mod Ô: Choose random Ö 1 Ö 2 Ö 100. Compute 5Ö 1 5Ò mod Ô, 5Ö 2 5Ò mod Ô, etc. Solve these 100 DL problems. Typically (Ô 1) 100 mults to find at least one Ö + Ò mod Ô 1, immediately revealing Ò.
12 Also spent some mults to compute each 5Ö mod Ô: lgô mults for each. Faster: Choose Ö = Ö 1 with Ö 1 (Ô 1) 100. Compute 5Ö 1 mod Ô; 5Ö 1 5Ò mod Ô; 5 2Ö 15Ò mod Ô; 5 3Ö 15Ò mod Ô; etc. Just 1 mult for each new lgô + (Ô 1) 100 mults to find Ò given 5Ò mod Ô.
13 Faster: Increase 100 to Ô Ô. Only 2 Ô Ô mults to solve one DL problem! Shanks babystepgiantstep discretelogarithm algorithm. Example: Ô = , 5Ò mod Ô = Compute mod Ô = Then compute 1000 targets: Ò mod Ô = , Ò mod Ô = , Ò mod Ô = ,, Ò mod Ô =
14 Build a sorted table of targets: 2573 = Ò mod Ô, 3371 = Ò mod Ô, 3593 = Ò mod Ô, 4960 = Ò mod Ô, 5218 = Ò mod Ô,, = Ò mod Ô. Look up 5 1 mod Ô, 5 2 mod Ô, 5 3 mod Ô, etc. in this table mod Ô = ; find = Ò mod Ô in the table of targets; so 755 = Ò mod Ô 1; deduce Ò =
15 Eliminating storage Improved method: Define Ü 0 = 1; Ü +1 = 5Ü mod Ô if Ü ¾ 3Z; Ü +1 = Ü 2 mod Ô if Ü ¾ 2 + 3Z; Ü +1 = 5ÒÜ mod Ô otherwise. Then Ü = 5 Ò+ mod Ô where ( 0 0 ) = (0 0) and ( +1 +1) = ( + 1), or ( +1 +1) = (2 2 ), or ( +1 +1) = ( + 1 ). Search for a collision in Ü : Ü 1 = Ü 2? Ü 2 = Ü 4? Ü 3 = Ü 6? Ü 4 = Ü 8? Ü 5 = Ü 10? etc. Deduce linear equation for Ò.
16 The Ü s enter a cycle, typically within Ô Ô steps. Example: , Modulo : Ü 1 = 5Ò = Ü 2 = 5 2Ò = = Ü 3 = 5 2Ò+1 = = Ü 4 = 5 2Ò+2 = = Ü 5 = 5 2Ò+3 = = Ü 6 = 5 2Ò+4 = = Ü 7 = 5 4Ò+8 = = Ü 8 = 5 4Ò+9 = = etc.
17 Ü 1785 = Ò = Ü 3570 = Ò = (Cycle length is 357.) Conclude that Ò Ò (mod Ô 1), so Ò (mod (Ô 1) 6). Only 6 possible Ò s. Try each of them. Find that 5Ò mod Ô = for Ò = (Ô 1) 6, i.e., for Ò =
18 This is Pollard s rho method. Optimized: Ô Ô mults. Another method, similar speed: Pollard s kangaroo method. Can parallelize both methods. van Oorschot/Wiener parallel DL using distinguished points. Bottom line: With mults, distributed across many cores, have chance 2 Ô of finding Ò from 5Ò mod Ô. With 2 90 mults (a few years?), have chance Ô. Negligible if, e.g., Ô
19 Factors of the group order Assume 5 has order. Given Ü, a power of 5: 5 has order, and Ü is a power of 5. Compute = log 5 Ü. 5 has order, and Ü 5 is a power of 5. Compute Ñ = log 5 (Ü 5 ). Then Ü = 5 +Ñ.
20 This PohligHellman method converts an order DL into an order DL, an order DL, and a few exponentiations. e.g. Ô = , Ü = : Ô 1 = 6 where = Compute log 5 6(Ü 6 ) = Compute Ü = Compute log = 3. Then Ü = = Use rho: Ô + Ô mults. Better if factors further: apply PohligHellman recursively.
21 All of the techniques so far apply to elliptic curves. An elliptic curve over FÕ has Õ + 1 points so can compute ECDL using Ô Õ ellipticcurve adds. Need quite large Õ. If largest prime divisor of number of points is much smaller than Õ then PohligHellman method computes ECDL more quickly. Need larger Õ; or change choice of curve.
22 Index calculus Have generated many group elements 5 Ò+ mod Ô. Deduced equations for Ò from random collisions. Index calculus obtains discretelogarithm equations in a different way. Example for Ô = : Can completely factor 3 (Ô 3) as in Q so (mod Ô) so log 5 ( 1) + log log log 5 5 (mod Ô 1).
23 Can completely factor 62 (Ô + 62) as so log log 5 31 log log log log log 5 29 (mod Ô 1). Try to completely factor 1 (Ô + 1), 2 (Ô + 2), etc. Find factorization of (Ô + ) as product of powers of for each of the following s: 5100, 4675, 3128, 403, 368, 147, 3, 62, 957, 2912, 3857, 6877.
24 Each complete factorization produces a log equation. Now have 12 linear equations for log 5 2 log 5 3 log Free equations: log 5 5 = 1, (Ô log 5 ( 1) = 1) 2. By linear algebra compute log 5 2 log 5 3 log (If this hadn t been enough, could have searched more s.) By similar technique obtain discrete log of any target.
25 For Ô ½, index calculus scales surprisingly well: cost Ô where 0. Compare to rho: Ô 1 2. Specifically: searching ¾ 1 2 Ý 2, with lgý ¾ Ç( Ô lgôlg lgô), finds Ý complete factorizations into primes Ý, and computes discrete logs. (Assuming standard conjectures. Have extensive evidence.)
26 Latest indexcalculus variants use the numberfield sieve and the functionfield sieve. To compute discrete logs in FÕ: lg cost ¾ Ç((lgÕ) 1 3 (lg lgõ) 2 3 ). For security: Õ to stop rho; Õ to stop NFS. We don t know any indexcalculus methods for ECDL! except for some curves.
A new probabilistic public key algorithm based on elliptic logarithms
A new probabilistic public key algorithm based on elliptic logarithms Afonso Comba de Araujo Neto, Raul Fernando Weber 1 Instituto de Informática Universidade Federal do Rio Grande do Sul (UFRGS) Caixa
More informationThe DiffieHellman Problem
Chapter 21 The DiffieHellman Problem This is a chapter from version 1.1 of the book Mathematics of Public Key Cryptography by Steven Galbraith, available from http://www.isg.rhul.ac.uk/ sdg/cryptobook/
More informationIs n a Prime Number? Manindra Agrawal. March 27, 2006, Delft. IIT Kanpur
Is n a Prime Number? Manindra Agrawal IIT Kanpur March 27, 2006, Delft Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 1 / 47 Overview 1 The Problem 2 Two Simple, and Slow, Methods
More informationU.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009. Notes on Algebra
U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009 Notes on Algebra These notes contain as little theory as possible, and most results are stated without proof. Any introductory
More informationRevised Version of Chapter 23. We learned long ago how to solve linear congruences. ax c (mod m)
Chapter 23 Squares Modulo p Revised Version of Chapter 23 We learned long ago how to solve linear congruences ax c (mod m) (see Chapter 8). It s now time to take the plunge and move on to quadratic equations.
More informationThe number field sieve
The number field sieve A.K. Lenstra Bellcore, 435 South Street, Morristown, NJ 07960 H.W. Lenstra, Jr. Department of Mathematics, University of California, Berkeley, CA 94720 M.S. Manasse DEC SRC, 130
More informationComputations in Number Theory Using Python: A Brief Introduction
Computations in Number Theory Using Python: A Brief Introduction Jim Carlson March 2003 Contents 1 Introduction 1 2 Python as a calculator 4 3 Case study: factoring 8 4 Loops and conditionals 11 5 Files
More informationCMSC 451 Design and Analysis of Computer Algorithms 1
CMSC 4 Design and Analysis of Computer Algorithms David M. Mount Department of Computer Science University of Maryland Fall 003 Copyright, David M. Mount, 004, Dept. of Computer Science, University of
More informationMining Data Streams. Chapter 4. 4.1 The Stream Data Model
Chapter 4 Mining Data Streams Most of the algorithms described in this book assume that we are mining a database. That is, all our data is available when and if we want it. In this chapter, we shall make
More informationSUBGROUPS OF CYCLIC GROUPS. 1. Introduction In a group G, we denote the (cyclic) group of powers of some g G by
SUBGROUPS OF CYCLIC GROUPS KEITH CONRAD 1. Introduction In a group G, we denote the (cyclic) group of powers of some g G by g = {g k : k Z}. If G = g, then G itself is cyclic, with g as a generator. Examples
More informationGroup Theory via Rubik s Cube
Group Theory via Rubik s Cube Tom Davis tomrdavis@earthlink.net http://www.geometer.org ROUGH DRAFT!!! December 6, 2006 Abstract A group is a mathematical object of great importance, but the usual study
More informationPrivate Set Intersection: Are Garbled Circuits Better than Custom Protocols?
Private Set Intersection: Are Garbled Circuits Better than Custom Protocols? Yan Huang David Evans University of Virginia Jonathan Katz University of Maryland http://mightbeevil.org Abstract Cryptographic
More informationPrimes. Name Period Number Theory
Primes Name Period A Prime Number is a whole number whose only factors are 1 and itself. To find all of the prime numbers between 1 and 100, complete the following exercise: 1. Cross out 1 by Shading in
More informationAnalysis of Nonfortuitous Predictive States of the RC4 Keystream Generator
Analysis of Nonfortuitous Predictive States of the RC4 Keystream Generator Souradyuti Paul and Bart Preneel Katholieke Universiteit Leuven, Dept. ESAT/COSIC, Kasteelpark Arenberg 10, B 3001 LeuvenHeverlee,
More informationWhat Every Computer Scientist Should Know About FloatingPoint Arithmetic
What Every Computer Scientist Should Know About FloatingPoint Arithmetic D Note This document is an edited reprint of the paper What Every Computer Scientist Should Know About FloatingPoint Arithmetic,
More informationA One Round Protocol for Tripartite
A One Round Protocol for Tripartite Diffie Hellman Antoine Joux SCSSI, 18, rue du Dr. Zamenhoff F92131 IssylesMx Cedex, France Antoine.Joux@ens.fr Abstract. In this paper, we propose a three participants
More informationPublic Key Compression and Modulus Switching for Fully Homomorphic Encryption over the Integers
Public Key Compression and Modulus Switching for Fully Homomorphic Encryption over the Integers JeanSébastien Coron 1, David Naccache 2, and Mehdi Tibouchi 3 1 Université du Luxembourg jeansebastien.coron@uni.lu
More informationDesign of Experiments (DOE)
MINITAB ASSISTANT WHITE PAPER This paper explains the research conducted by Minitab statisticians to develop the methods and data checks used in the Assistant in Minitab 17 Statistical Software. Design
More informationIf A is divided by B the result is 2/3. If B is divided by C the result is 4/7. What is the result if A is divided by C?
Problem 3 If A is divided by B the result is 2/3. If B is divided by C the result is 4/7. What is the result if A is divided by C? Suggested Questions to ask students about Problem 3 The key to this question
More informationRobust Set Reconciliation
Robust Set Reconciliation Di Chen 1 Christian Konrad 2 Ke Yi 1 Wei Yu 3 Qin Zhang 4 1 Hong Kong University of Science and Technology, Hong Kong, China 2 Reykjavik University, Reykjavik, Iceland 3 Aarhus
More informationSpeeding up Distributed RequestResponse Workflows
Speeding up Distributed RequestResponse Workflows Virajith Jalaparti (UIUC) Peter Bodik Srikanth Kandula Ishai Menache Mikhail Rybalkin (Steklov Math Inst.) Chenyu Yan Microsoft Abstract We found that
More informationChaCha, a variant of Salsa20
ChaCha, a variant of Salsa20 Daniel J. Bernstein Department of Mathematics, Statistics, and Computer Science (M/C 249) The University of Illinois at Chicago Chicago, IL 60607 7045 snuffle6@box.cr.yp.to
More informationGeneralized compact knapsacks, cyclic lattices, and efficient oneway functions
Generalized compact knapsacks, cyclic lattices, and efficient oneway functions Daniele Micciancio University of California, San Diego 9500 Gilman Drive La Jolla, CA 920930404, USA daniele@cs.ucsd.edu
More informationON THE DISTRIBUTION OF SPACINGS BETWEEN ZEROS OF THE ZETA FUNCTION. A. M. Odlyzko AT&T Bell Laboratories Murray Hill, New Jersey ABSTRACT
ON THE DISTRIBUTION OF SPACINGS BETWEEN ZEROS OF THE ZETA FUNCTION A. M. Odlyzko AT&T Bell Laboratories Murray Hill, New Jersey ABSTRACT A numerical study of the distribution of spacings between zeros
More informationIEEE TRANSACTIONS ON AUDIO, SPEECH, AND LANGUAGE PROCESSING, 2013. ACCEPTED FOR PUBLICATION 1
IEEE TRANSACTIONS ON AUDIO, SPEECH, AND LANGUAGE PROCESSING, 2013. ACCEPTED FOR PUBLICATION 1 ActiveSet Newton Algorithm for Overcomplete NonNegative Representations of Audio Tuomas Virtanen, Member,
More informationPROOFS BY DESCENT KEITH CONRAD
PROOFS BY DESCENT KEITH CONRAD As ordinary methods, such as are found in the books, are inadequate to proving such difficult propositions, I discovered at last a most singular method... that I called the
More informationOn the Practical Exploitability of Dual EC in TLS Implementations
On the Practical Exploitability of Dual EC in TLS Implementations Stephen Checkoway 1, Matthew Fredrikson 2, Ruben Niederhagen 3, Adam Everspaugh 2, Matthew Green 1, Tanja Lange 3, Thomas Ristenpart 2,
More informationMEP Y9 Practice Book A
1 Base Arithmetic 1.1 Binary Numbers We normally work with numbers in base 10. In this section we consider numbers in base 2, often called binary numbers. In base 10 we use the digits 0, 1, 2, 3, 4, 5,
More informationWHAT ARE MATHEMATICAL PROOFS AND WHY THEY ARE IMPORTANT?
WHAT ARE MATHEMATICAL PROOFS AND WHY THEY ARE IMPORTANT? introduction Many students seem to have trouble with the notion of a mathematical proof. People that come to a course like Math 216, who certainly
More informationAn Introductory Course in Elementary Number Theory. Wissam Raji
An Introductory Course in Elementary Number Theory Wissam Raji 2 Preface These notes serve as course notes for an undergraduate course in number theory. Most if not all universities worldwide offer introductory
More information