Factoring pq 2 with Quadratic Forms: Nice Cryptanalyses

Transcription

1 Factoring pq 2 with Quadratic Forms: Nice Cryptanalyses Phong Nguyễn & ASIACRYPT 2009 Joint work with G. Castagnos, A. Joux and F. Laguillaumie

2 Summary Factoring A New Factoring Method for N=pq 2 Binary Quadratic Forms Coppersmith s root-finding method Breaking NICE Cryptosystems

3 In a Nutshell Castagnos and Laguillaumie broke the main NICE cryptosystem at EUROCRYPT Here, a new key-recovery attack on the whole NICE family: a factoring algorithm for N=pq 2.

4 Factoring

5 Factoring Perhaps the most famous computational problem in cryptology. Input: an integer N Output: the prime factors of N Any breakthrough could kill RSA.

6 Main Factoring Algorithms Exponential Methods Brute-force: Õ(N 1/2 ) Pollard s p-1, etc. : Õ(N 1/4 ) Schoof-Shanks: Õ(N 1/5 ) Subexponential Methods based on smoothness ECM, Quadratic Sieve: L(1/2) = eõ( log N) Number Field Sieve: L(1/3) = eõ( log N)

7 Crypto Modulus N=pq like RSA N=pq 2 for efficiency or special properties ESIGN (1980s). NICE (1990s), based on quadratic fields. Okamoto-Uchiyama s homomorphic encryption (1998).

8 Is N=pq 2 easier? No breakthrough: Linear speed-up of ECM [PO96, Per01]. Õ(N 1/9 ) if p and q are balanced [BDH99] Math. Significance: finding the square-free part is poly-time equivalent to determining the ring of integers of a number field.

9 This Talk A New Factoring Method for N=pq 2 Exponential in the worst case: Õ(N 1/6 ) if p and q are balanced. Poly-time if the regulator of Q( p) is unusually small, or if one is given a good quadratic form.

10 Overview We combine two methods: Lagrange s reduction of binary quadratic forms, to find a good form. A new homogeneous variant of Coppersmith s root-finding methods [Cop96]: applied to any good form, it discloses the prime factor q.

11 Concretely We first find three integers a,b,c s.t. there exist small coprime integers x and y with q 2 =ax 2 +bxy+cy 2. Then we recover such integers x and y, which discloses the prime q.

12 Binary Quadratic Forms

13 Binary Quadratic Forms It s a triplet [a,b,c] of integers, which corresponds to F(x,y) = ax 2 +bxy+cy 2 over Z 2. Its discriminant is Δ=b 2-4ac: Δ<0: imaginary case, F definite F constant sign Δ>0: real case, F indefinite F s sign varies

14 Representation by Quadratic Forms Recall F(x,y) = ax 2 +bxy+cy 2 over Z 2 An integer k is (properly) represented by [a,b,c] if coprime (x,y) Z 2 s.t. F(x,y)=k. Ex: Any prime 1 mod 4 is represented by x 2 +y 2 (Fermat).

15 Factoring N=pq 2 by Representation Find a form F (with Δ=±N) that represents q 2 with small coefficients: q 2 =F(x,y) with x and y coprime and small. Then recover q 2 by finding x and y using a homogeneous gcd variant of Coppersmith s theorem on small roots.

16 Reduction of Binary Quadratic Forms Input: Form [a,b,c] of disc. Δ. Output: A reduced form [a,b,c ] of disc. Δ it represents the same integers as [a,b,c] a,b and usually c are small, say Δ. Lagrange s algorithm finds a reduced form in quadratic time.

17 Unicity of Reduction? Two cases: Imaginary: reduced forms are essentially unique. Real: there are many reduced forms, but they form a cycle.

18 Factoring pq 2 with Quadratic Forms

19 Representing q 2 Let N=pq 2. Among the forms with Δ=±N, some represent q 2 : for any odd integer k, consider [q 2,kq,(k 2 ±p)/4] with x=1,y=0: Δ=(kq) 2-4q 2 (k 2 ±p)/4 = ±pq 2

20 Size of Representation Assume one has a reduced form [a,b,c] with Δ=±N representing q 2. Then: q 2 =ax 2 +bxy+cy 2 where heuristically, a,b,c = Θ( Δ ) = Θ(N 1/2 ) And q 2 =Θ(N 2/3 ): if we re lucky, then x and y are O((N 2/3 /N 1/2 ) 1/2 ) = O(N 1/12 )

21 New Problem Now, we know N=pq 2 and [a,b,c] s.t. q 2 =ax 2 +bxy+cy 2 for some small coprime integers x and y: maybe as small as O(N 1/12 ). Can we find x and y, and therefore q?

22 Finding Small Roots using Lattices

23 Coppersmith s Small Roots In 1996, Coppersmith solved two problems in polynomial time: Given a monic polynomial F Z[X] and N Z, find all small x Z s.t. F(x) 0 (mod N). Given an irreducible polynomial F Z[X,Y], find all small (x,y) Z 2 s.t. P(x,y) = 0.

24 Yet a New Variant We developed another provable variant: Given a homogeneous bivariate F Z[X,Y] and N Z, find all small coprime x and y such that gcd(f(x,y),n) is large. For F(x,y)=ax 2 +bxy+cy 2 and gcd(f(x,y),n)=q 2, we obtain the bound N 1/9 for x and y, while we only needed N 1/12.

25 The Trick Very similar to the univariate case, because a homogeneous bivariate polynomial can be written as y d f(x/y).

26 Applications to NICE Cryptosystems

27 Something Missing How do we find a form representing q 2? This is related to NICE cryptosystems, which use quadratic fields, either imaginary or real.

28 Imaginary-NICE We obtain an attack different from [CL09]. The public key discloses a reduced form [a,b,c] with Δ=-pq 2 that represents q 2, and with high proba, coprime x and y s.t. q 2 =ax 2 +bxy+cy 2 and x, y O(N 1/12+ε ). Such x and y can be recovered by our homogeneous variant.

29 Real-NICE The public key is N=pq 2, but p is special: the regulator of Q( p) is unusually small. reg. = log of the smallest non-trivial unit (of the ring of integers). See Pell s equation: x 2 -py 2 =1. Instead of Θ( p log p), it is poly(log p).

30 Attacking Real-NICE There is a trivial form representing q 2 : the principal form [1, N,( N 2 -N)/4]. But its representation coeffs won t be small. So, we walk along its cycle of reduced forms: all such forms represent q 2, and hopefully, some with small coeffs. But how many?

31 Attacking Real-NICE reduction [q 2,kq,(k 2 -p)/4] reduction [q 2,k q,(k 2 -p)/4] Principal cycle good reduced form On the cycle, we expect at least q reduced forms to be good the density is Ω(1/R) where R = regulator of Q( p).

32 Experiments The attack works very well in practice for both imaginary-nice and real- NICE. Ex: a 768-bit real-nice modulus is factored in 1 min... faster than key generation.

33 CONCLUSION

34 Conclusion We presented a new factoring method tailored to N=pq 2. In the general case, it is exponential but rather different from other methods. In presence of hints, it becomes polynomial. This provides the first full cryptanalysis of NICE.

35 Heuristics? The method works in practice, but it was initially heuristic. Now fully provable thanks to good bounds on the coefficients of the representation of q 2. See [FullVersion] for the imaginary case. Recently announced by [BeGa09] for the real case.

36 Factoring N=pq 2 The general algorithm has complexity O(regulator of Q( p))*polytime. This regulator is usually Θ( p log p) but can be small: poly(log p) for Real-NICE. The Cohen-Lenstra heuristics predict that such p s with small regulator are negligible.

37 Open Problem Generalize the factoring algorithm: Can we factor more numbers of the form N=pq 2? Can we factor all of them (ESIGN)?

38 Thank you for your attention... Any question(s)?