On the Concrete Security of Goldreichs PRG Yann Rotella Joint work - PowerPoint PPT Presentation

On the Concrete Security of Goldreich’s PRG Yann Rotella Joint work with Geoffroy Couteau, Aurélien Dupin, Pierrick Méaux and Mélissa Rossi January 31, 2019

Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion PseudoRandom Generators ( x 1 , x 2 , . . . , x n ) ∈ F n Seed: 2 PRG ( y 1 , y 2 , . . . , y n , y n + 1 , . . . , y m ) ∈ F n Output: 2 ( y i ) i ≤ m should be indistinguishable from a random string; it is hard to recover ( x i ) i ≤ n using the knowledge of ( y i ) i ≤ m . 1 / 36

Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Structure of this Talk 1 Introduction 2 A subexponential-time attack 3 Algebraic cryptanalysis Generalization on all predicates 4 Conclusion 5 2 / 36

Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Stretch and locality x 1 x 2 x 3 . . . . . . y j m = n s d = 3 y j + 1 x i y j + 2 . . . . . . x n 3 / 36

Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Theoretical applications Semi Secure computation with constant computational overhead [Ishai et al. STOC 2018, Applebaum et al. CRYPTO 2017] MPC-friendly primitives [Albrecht et al. EC 2015, Canteaut et al. FSE 2016, Méaux et al. EC 2016, Grassi et al. ACM-CCS 2016] Indistinguishability Obfuscation [Sahai and Waters STOC 2014, Lin and Tessaro CRYPTO 2017] Cryptographic Capsules [Boyle et al. ACN-CCS 2017] 4 / 36

Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Description of Goldreich’s PRG Seed ( x 1 , . . . , x n ) σ i σ i d − 1 2 σ i σ i 1 d P ( x σ i 1 , . . . , x σ i d ) ( y i ) 1 ≤ i ≤ m m = n s , s is the stretch. 5 / 36

? ? ? ? Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Parameters Stretch s > 1 Subsets ( σ i ) i ≤ 1 Boolean function (predicate) P Locality d 6 / 36

Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Parameters Stretch s > 1 ? Subsets ( σ i ) i ≤ 1 ? Boolean function (predicate) P ? Locality d ? 6 / 36

Ok if they are chosen uniformly random Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Subsets The subsets should be sufficiently expanding: for some k , every k subsets should cover k + Ω( n ) elements of { 1 , . . . , n } . 7 / 36

Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Subsets The subsets should be sufficiently expanding: for some k , every k subsets should cover k + Ω( n ) elements of { 1 , . . . , n } . Ok if they are chosen uniformly random 7 / 36

A value x of the list can agree on 1 2 n output bits. Final complexity: 2 n 1 s 1 2 d 2 n 0 955 s 1 45 and d 5 Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Generic sub-exponential seed recovery Create a list of all possible values for ( 2 ε ) ∗ n variables. 8 / 36

Final complexity: 2 n 1 s 1 2 d 2 n 0 955 s 1 45 and d 5 Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Generic sub-exponential seed recovery Create a list of all possible values for ( 2 ε ) ∗ n variables. A value x ′ of the list can agree on ( 1 / 2 + ε ) ∗ n output bits. 8 / 36

2 n 0 955 s 1 45 and d 5 Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Generic sub-exponential seed recovery Create a list of all possible values for ( 2 ε ) ∗ n variables. A value x ′ of the list can agree on ( 1 / 2 + ε ) ∗ n output bits. Final complexity: 2 n 1 − ( s − 1 / 2 d ) 8 / 36

Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Generic sub-exponential seed recovery Create a list of all possible values for ( 2 ε ) ∗ n variables. A value x ′ of the list can agree on ( 1 / 2 + ε ) ∗ n output bits. Final complexity: 2 n 1 − ( s − 1 / 2 d ) s = 1 . 45 and d = 5 ⇒ 2 n 0 . 955 8 / 36

Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Predicate criteria degree [Goldreich 2000] rational degree (algebraic immunity) [Applebaum and Lovett STOC 2016] AI ( P ) > s resilience [O’Donnelland Witmer CCC 2014, Applebaum 2015] res ( P ) > 2s 9 / 36

P 5 x 1 x 2 x 3 x 4 x 5 x 1 x 2 x 3 x 4 x 5 Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion locality  degree   ⇒ d ≥ 5 resilience  Siegenthaler  10 / 36

Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion locality  degree   ⇒ d ≥ 5 resilience  Siegenthaler  P 5 ( x 1 , x 2 , x 3 , x 4 , x 5 ) = x 1 + x 2 + x 3 + x 4 x 5 10 / 36

Linearization and Gröbner-based attacks. Generalization of the subexponential attack to all predicates. locality and stretch are linked to the size of the seed. Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Our results A new subexponential-time attack in 2 O ( n 2 − s ) . 11 / 36

Generalization of the subexponential attack to all predicates. locality and stretch are linked to the size of the seed. Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Our results A new subexponential-time attack in 2 O ( n 2 − s ) . Linearization and Gröbner-based attacks. 11 / 36

locality and stretch are linked to the size of the seed. Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Our results A new subexponential-time attack in 2 O ( n 2 − s ) . Linearization and Gröbner-based attacks. Generalization of the subexponential attack to all predicates. 11 / 36

Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Our results A new subexponential-time attack in 2 O ( n 2 − s ) . Linearization and Gröbner-based attacks. Generalization of the subexponential attack to all predicates. locality and stretch are linked to the size of the seed. 11 / 36

Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Plan of this Section 1 Introduction 2 A subexponential-time attack 3 Algebraic cryptanalysis Generalization on all predicates 4 Conclusion 5 12 / 36

Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Cryptanalysis of FLIP [Duval, Lallemand, Rotella CRYPTO 2016] Key Register K PRNG Permutation P i Generator F z i p i c i F ( x ) = x 1 + x 2 + · · · + x k 1 + x k 1 + 1 x k 1 + 2 + · · · + x k 2 − 1 x k 2 + x k 3 + x k 3 + 1 x k 3 + 2 + · · · + x n − 14 · · · x n − 1 x n 13 / 36

Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion FLIP vs Goldreich’s PRG FLIP: overdetermined Goldreich’s PRG: underdetermined P 5 ( x 1 , x 2 , x 3 , x 4 , x 5 ) = x 1 + x 2 + x 3 + x 4 x 5 14 / 36

We get the following linear equation: x 1 x 4 x 8 x 13 x 10 x 3 0 O n 2 s 1 number of collisions c Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Collect linear equations x 1 + x 4 + x 8 + x 9 x 11 = 1 x 14 + x 5 + x 7 + x 1 x 4 = 0 x 13 + x 10 + x 3 + x 11 x 9 = 1 15 / 36

O n 2 s 1 number of collisions c Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Collect linear equations x 1 + x 4 + x 8 + x 9 x 11 = 1 x 14 + x 5 + x 7 + x 1 x 4 = 0 x 13 + x 10 + x 3 + x 11 x 9 = 1 We get the following linear equation: x 1 + x 4 + x 8 + x 13 + x 10 + x 3 = 0 15 / 36

Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Collect linear equations x 1 + x 4 + x 8 + x 9 x 11 = 1 x 14 + x 5 + x 7 + x 1 x 4 = 0 x 13 + x 10 + x 3 + x 11 x 9 = 1 We get the following linear equation: x 1 + x 4 + x 8 + x 13 + x 10 + x 3 = 0 number of collisions c ∈ O ( n 2 ( s − 1 ) ) 15 / 36

For all possible values of the bits: Solve the correponding linear system of n linear equations. Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Guessing phase Choose the ℓ variables that appear the most in the quadratic terms, such that you get n − c − ℓ linear equations. 16 / 36

Solve the correponding linear system of n linear equations. Introduction A subexponential-time attack Algebraic cryptanalysis Generalization on all predicates Conclusion Guessing phase Choose the ℓ variables that appear the most in the quadratic terms, such that you get n − c − ℓ linear equations. For all possible values of the ℓ bits: 16 / 36