Cryptanalysis via Algebraic Spans Adi Ben-Zvi, Arkadius Kalka, and Boaz Tsaban Bar-Ilan University Crypto 2018
PKC foundations are mainly abelian (and quantum insecure)
PKC foundations are mainly abelian (and quantum insecure) DLP in finite fields (1976); Factorization (RSA, 1978). Poor performance vs security tradeoff; no long-term security. Subexp algorithms for DLP in some elliptic curves. Quantum computers break them all.
PKC foundations are mainly abelian (and quantum insecure) DLP in finite fields (1976); Factorization (RSA, 1978). Poor performance vs security tradeoff; no long-term security. Subexp algorithms for DLP in some elliptic curves. Quantum computers break them all. Options: (0) Abelian (DLP/RSA); (1) Lattices; (2) nonabelian groups/structures.
PKC foundations are mainly abelian (and quantum insecure) DLP in finite fields (1976); Factorization (RSA, 1978). Poor performance vs security tradeoff; no long-term security. Subexp algorithms for DLP in some elliptic curves. Quantum computers break them all. Options: (0) Abelian (DLP/RSA); (1) Lattices; (2) nonabelian groups/structures. The nonablian option must be explored. In particular, we need general cryptanalytic tools for nonabelian crypto.
PKC foundations are mainly abelian (and quantum insecure) DLP in finite fields (1976); Factorization (RSA, 1978). Poor performance vs security tradeoff; no long-term security. Subexp algorithms for DLP in some elliptic curves. Quantum computers break them all. Options: (0) Abelian (DLP/RSA); (1) Lattices; (2) nonabelian groups/structures. The nonablian option must be explored. In particular, we need general cryptanalytic tools for nonabelian crypto. Here: Algebraic Span Cryptanalysis.
Conojugation in nonabelian groups
Conojugation in nonabelian groups For a , c ∈ G (nonabelian group), a c := c − 1 ac (conjugation).
Conojugation in nonabelian groups For a , c ∈ G (nonabelian group), a c := c − 1 ac (conjugation). Conjugation is an isomorphism: ( a − 1 ) c = ( a c ) − 1 ( ab ) c = a c · b c . For a word v ( x 1 , . . . , x k ) in the variables x 1 , . . . , x k (e.g., x 7 x − 1 3 x 5 ): v ( a c 1 , . . . , a c k ) = v ( a 1 , . . . , a k ) c .
Commutator KE (Anshel–Anshel–Goldfeld 1999)
� � Commutator KE (Anshel–Anshel–Goldfeld 1999) Alice Public Bob v ( x 1 , . . . , x k ) � a 1 , . . . , a k � ≤ G w ( x 1 , . . . , x k ) a = v ( a 1 , . . . , a k ) � b 1 , . . . , b k � ≤ G b = w ( b 1 , . . . , b k ) b 1 a , . . . , b ka a 1 b , . . . , a kb a − 1 v ( a b 1 , . . . , a b w ( b a 1 , . . . , b a k ) − 1 b k )
� � Commutator KE (Anshel–Anshel–Goldfeld 1999) Alice Public Bob v ( x 1 , . . . , x k ) � a 1 , . . . , a k � ≤ G w ( x 1 , . . . , x k ) a = v ( a 1 , . . . , a k ) � b 1 , . . . , b k � ≤ G b = w ( b 1 , . . . , b k ) b 1 a , . . . , b ka a 1 b , . . . , a kb a − 1 v ( a b 1 , . . . , a b w ( b a 1 , . . . , b a k ) − 1 b k ) k ) = a − 1 a b = a − 1 b − 1 ab = ( b a ) − 1 b = w ( b a a − 1 v ( a b k ) − 1 b 1 , . . . , a b 1 , . . . , b a
Linear equations from conjugations
Linear equations from conjugations Assume G ≤ GL n ( F ) (matrix representations).
Linear equations from conjugations Assume G ≤ GL n ( F ) (matrix representations). Given c = b a ( a , b ∈ G ): b a = a − 1 ba a · b a = ba Linear equations in the entries of the matrix a .
Linear equations from conjugations Assume G ≤ GL n ( F ) (matrix representations). Given c = b a ( a , b ∈ G ): b a = a − 1 ba a · b a = ba Linear equations in the entries of the matrix a . A solution ˜ a is invertible w.h.p. (Schwartz–Zippel). a · b a = b ˜ ˜ a b a = ˜ a − 1 b ˜ a b a = b ˜ a
Algebraic spans
Algebraic spans G ≤ GL n ( F ) , a , b ∈ G . a with b a = b ˜ a by linear equations. Can find ˜
Algebraic spans G ≤ GL n ( F ) , a , b ∈ G . a with b a = b ˜ a by linear equations. Can find ˜ a / ˜ ∈ G ! We can force a ∈ Alg ( G ) = span F ( G ) ⊆ M n ( F ) , ˜ the algebra generated by G (because that’s a vector space.)
Algebraic spans G ≤ GL n ( F ) , a , b ∈ G . a with b a = b ˜ a by linear equations. Can find ˜ a / ˜ ∈ G ! We can force a ∈ Alg ( G ) = span F ( G ) ⊆ M n ( F ) , ˜ the algebra generated by G (because that’s a vector space.) For G = � g 1 , . . . , g k � ≤ GL n ( F ) , finding a basis for Alg ( G ) by repeated multiplication by generators and Gauss elimination is O ( kn 6 ) .
Algebraic Span Cryptanalysis
Algebraic Span Cryptanalysis G 1 , . . . , G k ≤ GL n ( F ) ; g 1 ∈ G 1 , . . . , g k ∈ G k . Given: linear equations on the entries of g 1 , . . . , g k . Need to find f ( g 1 , . . . , g k ) .
Algebraic Span Cryptanalysis G 1 , . . . , G k ≤ GL n ( F ) ; g 1 ∈ G 1 , . . . , g k ∈ G k . Given: linear equations on the entries of g 1 , . . . , g k . Need to find f ( g 1 , . . . , g k ) . Instead of solving subject to g 1 ∈ G 1 , . . . , g k ∈ G k , (infeasible!) solve subject to the linear constraints g 1 ∈ Alg ( G 1 ) , . . . , g k ∈ Alg ( G k ) . Pray (or prove) that every solution ˜ g 1 , . . . , ˜ g k satisfies f (˜ g 1 , . . . , ˜ g k ) = f ( g 1 , . . . , g k ) .
Application: Commutator KEP
Application: Commutator KEP a ∈ � a 1 , . . . , a k � , b ∈ � b 1 , . . . , b k � ≤ G ≤ GL n ( F ) . Need: ( b 1 a , . . . , b ka , a 1 b , . . . , a kb ) �→ a − 1 b − 1 ab .
Application: Commutator KEP a ∈ � a 1 , . . . , a k � , b ∈ � b 1 , . . . , b k � ≤ G ≤ GL n ( F ) . Need: ( b 1 a , . . . , b ka , a 1 b , . . . , a kb ) �→ a − 1 b − 1 ab . a ∈ Alg ( a 1 , . . . , a k ) , ˜ Solving linear equations, we obtain ˜ b ∈ Alg ( b 1 , . . . , b k ) with ˜ b 1 ˜ a b 1 a b a 1 b = a 1 = . . . . ; . . b k ˜ a b ka ˜ = a kb b a k = a = b a . a ˜ b = ˜ a b . Similarly, b ˜ Since ˜ a ∈ Alg ( a 1 , . . . , a k ) , ˜ b = ˜ a b = ˜ a ˜ a − 1 ˜ a ˜ b − 1 ˜ a − 1 ˜ a − 1 ˜ a − 1 b − 1 ˜ ab = ( b ˜ a ) − 1 b = ( b a ) − 1 b = a − 1 b − 1 ab ! ˜ b = ˜
� � Triple Decomposition KE (Kurt 2005) Alice Public Bob A A 1 A 2 X 1 X 2 a , a 1 , a 2 , x 1 , x 2 | | | | ≤ G y 1 , y 2 , b 1 , b 2 , b Y 1 Y 2 B 1 B 2 B ax 1 , x − 1 1 a 1 x 2 , x − 1 2 a 2 b 1 y 1 , y − 1 1 b 2 y 2 , y − 1 2 b a b 1 y 1 a 1 y − 1 1 b 2 y 2 a 2 y − 1 = ax 1 b 1 x − 1 1 a 1 x 2 b 2 x − 1 2 b = ab 1 a 1 b 2 a 2 b 2 a 2 b � �� � K The triple products do not provide linear equations! (And without them we fail!)
Cryptanalysis of Triple Dec KE Alg ( B 1 ) y 1 = Alg ( B 1 ) · b 1 y 1 − 1 Alg ( B 2 ∪ Y 2 ) y 1 = Alg ( B 2 ∪ Y 2 ) · y − 1 2 b − 1 2 y 1 = Alg ( B 2 ∪ Y 2 ) · y − 1 1 b 2 y 2 − 1 Alg ( A 2 ) x 2 = Alg ( A 2 ) · a − 1 2 x 2 = Alg ( A 2 ) · x − 1 2 a 2 Alg ( A 1 ∪ X 1 ) x 2 = Alg ( A 1 ∪ X 1 ) · x − 1 1 a 1 x 2 Pick invertible ˜ y 1 ∈ Alg ( Y 1 ) ∩ Alg ( B 1 ) y 1 ∩ Alg ( B 2 ∪ Y 2 ) y 1 ; ˜ x 2 ∈ Alg ( X 2 ) ∩ Alg ( A 2 ) x 2 ∩ Alg ( A 1 ∪ X 1 ) x 2 . y 1 − 1 · x − 1 x 2 − 1 · ˜ y 1 · y − 1 x 2 · x − 1 2 a 2 · y − 1 ax 1 · b 1 y 1 · ˜ 1 a 1 x 2 · ˜ 1 b 2 y 2 · ˜ 2 b Gives (intricate proof) ab 1 a 1 b 2 a 2 b = K ! (Alternatively, could check empirically.)
Final comments
Final comments Method also applies to: Nonabelian Diffie–Hellman (Ko–Lee–Cheon–Han–Kang–Park 2000), Centralizer KE (Shpilrain–Ushakov 2006), and some more.
Final comments Method also applies to: Nonabelian Diffie–Hellman (Ko–Lee–Cheon–Han–Kang–Park 2000), Centralizer KE (Shpilrain–Ushakov 2006), and some more. Not the end of nonabelian cryptography: 1. Additional nonabelian proposals (Dehornoy et al., Kalka, . . . ). 2. Additional problems (CSP, Multiple CSP,. . . ) to build upon. 3. Groups with no small-dim representations. 4. The application of this method keeps getting harder as new systems emerge (cf. recent cryptanalysis of Algebraic Eraser).
Final comments Method also applies to: Nonabelian Diffie–Hellman (Ko–Lee–Cheon–Han–Kang–Park 2000), Centralizer KE (Shpilrain–Ushakov 2006), and some more. Not the end of nonabelian cryptography: 1. Additional nonabelian proposals (Dehornoy et al., Kalka, . . . ). 2. Additional problems (CSP, Multiple CSP,. . . ) to build upon. 3. Groups with no small-dim representations. 4. The application of this method keeps getting harder as new systems emerge (cf. recent cryptanalysis of Algebraic Eraser). THANK YOU!
Recommend
More recommend
