Polynomial Time Attack Research Articles

Attacking trapdoors from matrix products

Recently, Geraud-Stewart and Naccache proposed two trapdoors based on matrix products. In this paper, we answer the call for cryptanalysis. We explore how using the trace and determinant of a matrix can be used to attack their constructions. We fully break their first construction in a polynomial-time attack. We show an information leak in the second construction using characteristic polynomials, and provide two attacks that decrease the bit security by about half.

RT-PPS: Real-time privacy-preserving scheme for cloud-hosted IoT data

The Internet of Things (IoT) is a rapidly growing network of devices that can communicate with each other and with cloud-based services. These devices generate vast amounts of data that can be used to provide valuable insights into user behavior, environmental conditions, and other important factors. However, as this data is collected and processed by cloud-hosted services, there is a growing concern about privacy and security. Without adequate protection, sensitive information could be exposed to hackers or other malicious actors, putting both individuals and organizations at risk. To address this challenge, real-time privacy-preserving techniques can be used to protect IoT data without compromising its value. This paper introduces an efficient Real-time privacy-preserving scheme (RT-PPS) for cloud-hosted IoT data. RT-PPS employs multi-authority attribute-based encryption on a hybrid cloud environment to keep data secure and private, while still allowing it to be processed and analyzed by cloud-hosted services. RT-PPS has efficient response time and resource consumption, which gives it the ability to handle a huge number of concurrent users at the same time without notable delay. The proposed RT-PPS has been validated through extensive experimental evaluation on a variety of configurations. Moreover, the proposed scheme has been computationally compared with the state-of-the-artwork. RT-PPS has shown excellent performance, effectiveness, and efficiency. The RT-PPS encryption time for a 1 GB dataset while considering 1024 slices is approximately 1000 ms. Also, the RT-PPS decryption time for a 1 GB ciphertext while considering 1024 slices are approximately 235 ms. Finally, RT-PPS is proven secure against any polynomial-time attacks and their variations that have at most a negligible advantage in the introduced security model. Moreover compared to most of the state-of-the-artwork, RT-PPS reduced the ciphertext size and lowered the computations in the encryption, key generation, decryption, and ciphertext update while assuring their security. By implementing RT-PPS, organizations can take advantage of the benefits of IoT data while protecting the privacy of their users and maintaining the security of their systems.

Polar code-based secure transmission with higher message rate combining channel entropy and computational entropy

The existing physical layer security schemes, which are based on the key generation model and the wire-tap channel model, achieve security by utilizing channel reciprocity entropy and noise entropy, respectively. In contrast, we propose a novel secure transmission framework that combines noise entropy with reciprocity entropy, achieved by inserting reciprocity entropy into the frozen bits of polar codes. Note that in real-world scenarios, when eavesdroppers employ polynomial-time attacks, the bit error rate (BER) increases due to the introduction of computational entropy. To achieve indistinguishability security, we convert the practical physical layer security metric, BER, into the average min-entropy, a widely accepted concept in cryptography. The simulation results demonstrate that the eavesdropper’s BER can be significantly increased without compromising the communication performance of the legitimate receiver. Under concrete parameters we selected, when compared to the joint scheme of physical layer key generation and one time pad, the modular semantically-secure scheme based on the wire-tap channel model, and the simple channel entropy combination scheme, our scheme achieves a message rate approximately 1.2 times, 3.8 times, and 1.4 times better, respectively. Experimental testing validates the feasibility of our scheme.

TrES: Tropical Encryption Scheme Based on Double Key Exchange

Shor’s quantum algorithm establishes a polynomial time attack on the discrete logarithm problem in any group. Recent announcements of progress in building quantum computers highlight the need for new concepts to create cryptosystems that are resistant to quantum attacks. In this paper, we present а new message encryption scheme. To enhance the security of the scheme, we suggest double key-exchange protocol (KEP). The first stage of the key exchange uses a matrix power function (MPF) in a tropical semiring. These functions are based on the action of a matrix semiring acting on some matrix set. MPFs can be considered as one-way functions because they are based on some generalized satisfiability problems that are potentially NP-complete. The obtained shared secret key at the first stage of the key exchange serves as an input for the second stage. The security of the second phase relies on the difficulty of the semiring action problem. In our protocol, we suggest using left or right action of the tropical semiring (which can be both min-plus and max-plus) on the group of commutative matrices (circulant matrices, in our case). The fact that the key-exchange protocol works in two phases contributes to its security, since an attacker needs to solve two difficult problems in order to break it. The main advantages of the presented protocol are: the increased efficiency and improved security.

Cryptanalysis of FRS obfuscation based on the CLT13 multilinear map

The authors present a classical polynomial-time attack against the branching program obfuscator of Fernando–Rasmussen–Sahai (for short FRS, Asiacrypt’17) (with one zerotest parameter), which is robust against all known classical cryptanalyses on obfuscators when instantiated with the CLT13 multilinear map. The first step is to recover a plaintext modulus of the CLT13 multilinear map. To achieve the goal, the Coron and Notarnicola (Asiacrypt’19) algorithm is applied. However, because of parameter issues, the algorithm cannot be used directly. In order to detour the issue, the authors convert an FRS obfuscator into a new programme containing a small message space. Through the conversion, the authors obtain two zerotest parameters and encodings of zero except for two non-zero slots. Then, they are used to mitigate parameter constraints of the message space recovering algorithm. Then, a cryptanalysis of the FRS obfuscation based on the recovered message space is proposed. The authors show that there exist two functionally equivalent programmes such that their obfuscated programmes are computationally distinguishable. Thus, the FRS scheme does not satisfy the desired security without any additional constraints.

On “Practical and secure outsourcing algorithms for solving quadratic congruences in IoTs” from IEEE IoT journal

Secure outsourced computation enables IoT devices to offload resource-intensive computations to a more resourceful server while keeping the inputs secret to the server. Recently, Zhang et al. put forth two outsourcing algorithms for solving quadratic congruences (Zhang et al., 2020). We observe that both the algorithms do not achieve the claimed security guarantees: a polynomial-time attack reveals the secret inputs to a passive adversary. As a consequence of the insecure outsourcing, the factorization of the RSA modulus is also revealed and hence leads to the total compromise of the security of the underlying scheme which makes use of the Zhang et al. outsourcing algorithms for solving quadratic congruences. Interestingly, we propose corrective measures for the Zhang et al. algorithm and prove that the resulting algorithm enables secure and verifiable delegation of solving quadratic congruences in IoTs.

Exploiting the security of N = prqs through approximation of ϕ(N)

This paper reports new techniques that exploit the security of the prime power moduli [Formula: see text] using continued fraction method. Our study shows that the key equation [Formula: see text] can be exploited using [Formula: see text] as good approximation of [Formula: see text]. This enables us to get [Formula: see text] from the convergents of the continued fractions expansion of [Formula: see text] where the bound of the private exponent is [Formula: see text] which leads to the polynomial time factorization of the moduli [Formula: see text]. We further report the polynomial time attacks that can break the security of the generalized prime power moduli [Formula: see text] using generalized system of equation of the form [Formula: see text] and [Formula: see text] by applying simultaneous Diophantine approximations and LLL algorithm techniques where [Formula: see text] and [Formula: see text].

(In)security of concrete instantiation of Lin17’s functional encryption scheme from noisy multilinear maps

Functional encryption (FE) is a novel cryptographic paradigm. In comparison to conventional encryption schemes, FE allows producing secret keys $$sk_f$$ corresponding to a function f that decrypt encryptions of $$x_0$$ to $$f(x_0)$$ . Recently, Lin proposed FE for arbitrary degree polynomials from the SXDH assumption to an exact multilinear map (CRYPTO’17). However, there is no concrete instantiation of the scheme in the absence of an exact multilinear map. Although Lin’s FE can be instantiated by noisy multilinear maps such as the GGH13, CLT13, and GGH15 schemes, the security of FE instantiated by noisy multilinear maps is unclear. In this paper, we point out the weakness of the Lin’s FE when it is instantiated by well-known candidates of noisy multilinear maps. In other words, we present a polynomial time attack of the FE on each noisy multilinear map. In the proposed method, our attack captures Lin’s FE for arbitrary degree polynomials instantiated by GGH13 and CLT13 and is also applicable to FE for polynomials of degree $$O(\log _2 \lambda )$$ when instantiated by GGH15 under the current parameters where $$\lambda $$ is the security parameter.

O2MD²: A New Post-Quantum Cryptosystem With One-to-Many Distributed Key Management Based on Prime Modulo Double Encapsulation

Polynomial-time attacks designed to run on quantum computers and capable of breaking RSA and AES are already known. It is imperative to develop quantum-resistant algorithms before quantum computers become available. Computationally hard problems defined on lattices have been proposed as the fundamental security bases for a new type of cryptography. The National Institute of Standards and Technology (NIST) recently hosted the Post-Quantum Cryptography Standardization project, aiming to create a roster of innovative post-quantum cryptosystems. These candidates have been publicly available for testing since early 2017. As they are currently under analysis, new proposals are still desirable. As such, we use the ring learning with errors (RLWE) problem combined with arithmetic functions to propose the O2MD <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> cryptosystem, which provides a one-to-many private/public key architecture having a distributed key refresh for a network of users while working on multiple polynomial rings over different prime order fields. Our solution has three different frameworks that reach AES-256 equivalent security, and provides message integrity and message authenticity verifications. We compare our solution's speed against the speed of the twenty-six different implementations from seven popular candidates in the NIST project, and our cryptosystem performs from 2 to 4 orders of magnitude faster than them. We also propose six different implementations that reach the security levels 1, 3 and 5 proposed in the NIST competition. Finally, we used the NIST Statistical Test Suite to verify the indistinguishability of our produced ciphertexts against randomly generated noise.

Polynomial Time Attacks for Modulus N = p^2 q^2

Polynomial Time Attacks for Modulus N = p^2 q^2

POLYNOMIAL-TIME PLAINTEXT-RECOVERY ATTACK ON THE MATRIX-BASED KNAPSACK CIPHER

The aim of the present paper is to propose a polynomial-time plaintext-recovery attack on the matrix-based knapsack cipher. The aforesaid algorithm uses only public information and has time complexity O(t1.34), where t is the decryption time of the attacked cryptosystem. The matrix-based knapsack cipher is a novel additively homomorphic asymmetric encryption scheme, which is a representative of group-based knapsack ciphers. This cryptosystem is based on the isomorphic transformation’s properties of the inner direct product of diagonal subgroups of a general linear group over a Galois field. Unlike the classical knapsack cryptoschemes, the cryptographic strength of the aforesaid cipher depends on the computational complexity of the multidimensional discrete logarithm problem. Due to the attack proposed in the given paper, the matrix-based knapsack cipher can be considered broken and should not be used as a privacy tool. However, this cryptosystem is still suitable for educational purposes as an example of the application of linear and abstract algebras in asymmetric cryptography.

Cryptanalysis of the Ivanov-Kabatiansky-Krouk-Rumenko Cryptosystems

Recently, Ivanov, Kabatiansky, Krouk, and Rumenko (IKKR) proposed three new variants of the McEliece cryptosystem (CBCrypto 2020, affiliated with Eurocrypt 2020). In this letter, it is shown that one of the IKKR cryptosystems is equal to the McEliece cryptosystem. Furthermore, a polynomial-time attack algorithm for the other two IKKR cryptosystems is proposed. The proposed attack algorithm utilizes the linearity of IKKR cryptosystems. Also, an implementation of the IKKR cryptosystems and the proposed attack is given. The proposed attack algorithm finds the plaintext within 0.2 sec that is faster than the elapsed time for legitimate decryption.

Privately Outsourcing Exponentiation to a Single Server: Cryptanalysis and Optimal Constructions

We address the problem of speeding up group computations in cryptography using a single untrusted computational resource. We analyze the security of two efficient protocols for securely outsourcing (multi-)exponentiations. We show that the schemes do not achieve the claimed security guarantees and we present practical polynomial-time attacks on the delegation protocols which allow the untrusted helper to recover part (or the whole) of the device’s secret inputs. We then provide simple constructions for outsourcing group exponentiations in different settings (e.g. public/secret, fixed/variable bases and public/secret exponents). Finally, we prove that our attacks are unavoidable if one wants to use a single untrusted computational resource and to limit the computational cost of the limited device to a constant number of (generic) group operations. In particular, we show that our constructions are actually optimal in terms of operations in the underlying group.

On the security of a Loidreau rank metric code based encryption scheme

We present a polynomial time attack of a rank metric code based encryption scheme due to Loidreau for some parameters.

Optimal shattering of complex networks

We consider optimal attacks or immunization schemes on different models of random graphs. We derive bounds for the minimum number of nodes needed to be removed from a network such that all remaining components are fragments of negligible size.We obtain bounds for different regimes of random regular graphs, Erdős-Rényi random graphs, and scale free networks, some of which are tight. We show that the performance of attacks by degree is bounded away from optimality.Finally we present a polynomial time attack algorithm and prove its optimal performance in certain cases.

Cryptanalysis of a public key cryptosystem based on Diophantine equations via weighted LLL reduction

Researching post-quantum cryptography is now an important task in cryptography. Although various candidates of post-quantum cryptosystems (PQC) have been constructed, sizes of their public keys are large. Okumura constructed a candidate of PQC whose security is expected to be based on certain Diophantine equations (DEC). Okumura analysis suggests that DEC achieves the high security with small public key sizes. This paper proposes a polynomial time-attack on the one-way property of DEC. We reduce the security of DEC to finding special short lattice points of some low-rank lattices derived from public data. The usual LLL algorithm could not find the most important lattice point in our experiments because of certain properties of the lattice point. Our heuristic analysis leads us to using a variant of the LLL algorithm, called a weighted LLL algorithm by us. Our experiments suggest that DEC with 128 bit security becomes insecure by our attack.

Polynomial-time key recovery attack on the Faure–Loidreau scheme based on Gabidulin codes

Encryption schemes based on the rank metric lead to small public key sizes of order of few thousands bytes which represents a very attractive feature compared to Hamming metric-based encryption schemes where public key sizes are of order of hundreds of thousands bytes even with additional structures like the cyclicity. The main tool for building public key encryption schemes in rank metric is the McEliece encryption setting used with the family of Gabidulin codes. Since the original scheme proposed in 1991 by Gabidulin, Paramonov and Tretjakov, many systems have been proposed based on different masking techniques for Gabidulin codes. Nevertheless, over the years most of these systems were attacked essentially by the use of an attack proposed by Overbeck. In 2005 Faure and Loidreau designed a rank-metric encryption scheme which was not in the McEliece setting. The scheme is very efficient, with small public keys of size a few kiloBytes and with security closely related to the linearized polynomial reconstruction problem which corresponds to the decoding problem of Gabidulin codes. The structure of the scheme differs considerably from the classical McEliece setting and until our work, the scheme had never been attacked. We show in this article that for a range of parameters, this scheme is also vulnerable to a polynomial-time attack that recovers the private key by applying Overbeck’s attack on an appropriate public code. As an example we break in a few seconds parameters with 80-bit security claim. Our work also shows that some parameters are not affected by our attack but at the cost of a lost of efficiency for the underlying schemes.

Cryptanalysis of a key exchange protocol based on the ring $$E_p^{(m)}$$ E p ( m )

An extension of Bergman’s ring (Israel J Math 18:257–277, 1974) was introduced by Climent et al. (Appl Algebra Eng Commun Comput 23:347–361, 2014). For this ring called \(E_p^{(m)}\), they established that only a negligible fraction of elements are invertible, and then proposed a key exchange protocol based on this property. Shortly afterwards, they constructed another key agreement protocol for multicast over this ring (WIT Trans Inf Commun Technol 45:13–24, 2013). In this paper, we introduce a polynomial-time attack to these two protocols without using invertible elements.

Cryptanalysis of McEliece Cryptosystem Based on Algebraic Geometry Codes and Their Subcodes

We give polynomial time attacks on the McEliece public key cryptosystem-based either on algebraic geometry (AG) codes or on small co-dimensional subcodes of AG codes. These attacks consist in the blind reconstruction either of an error correcting pair (ECP) , or an error correcting array (ECA) from the single data of an arbitrary generator matrix of a code. An ECP provides a decoding algorithm, that corrects up to $(({d^{*}-1-g})/{2})$ errors, where $d^{*}$ denotes the designed distance and $g$ denotes the genus of the corresponding curve, while with an ECA the decoding algorithm corrects up to $(({d^{*}-1})/{2})$ errors. Roughly speaking, for a public code of length $n$ over $ \mathbb {F}_{q}$ , these attacks run in $O(n^{4}\log (n))$ operations in $\mathbb F_{q}$ for the reconstruction of an ECP and $O(n^{5})$ operations for the reconstruction of an ECA. A probabilistic shortcut allows to reduce the complexities respectively to $O(n^{3+\varepsilon } \log (n))$ and $O(n^{4+\varepsilon })$ . Compared with the previous known attack due to Faure and Minder, our attack is efficient on codes from curves of arbitrary genus. Furthermore, we investigate how far these methods apply to subcodes of AG codes.

An algorithm for NTRU problems and cryptanalysis of the GGH multilinear map without a low-level encoding of zero

Let$\mathbf{f}$and$\mathbf{g}$be polynomials of a bounded Euclidean norm in the ring$\mathbb{Z}[X]/\langle X^{n}+1\rangle$. Given the polynomial$[\mathbf{f}/\mathbf{g}]_{q}\in \mathbb{Z}_{q}[X]/\langle X^{n}+1\rangle$, the NTRU problem is to find$\mathbf{a},\mathbf{b}\in \mathbb{Z}[X]/\langle X^{n}+1\rangle$with a small Euclidean norm such that$[\mathbf{a}/\mathbf{b}]_{q}=[\mathbf{f}/\mathbf{g}]_{q}$. We propose an algorithm to solve the NTRU problem, which runs in$2^{O(\log ^{2}\unicode[STIX]{x1D706})}$time when$\Vert \mathbf{g}\Vert ,\Vert \mathbf{f}\Vert$, and$\Vert \mathbf{g}^{-1}\Vert$are within some range. The main technique of our algorithm is the reduction of a problem on a field to one on a subfield. The GGH scheme, the first candidate of an (approximate) multilinear map, was recently found to be insecure by the Hu–Jia attack using low-level encodings of zero, but no polynomial-time attack was known without them. In the GGH scheme without low-level encodings of zero, our algorithm can be directly applied to attack this scheme if we have some top-level encodings of zero and a known pair of plaintext and ciphertext. Using our algorithm, we can construct a level-$0$encoding of zero and utilize it to attack a security ground of this scheme in the quasi-polynomial time of its security parameter using the parameters suggested by Garg, Gentry and Halevi [‘Candidate multilinear maps from ideal lattices’,Advances in cryptology — EUROCRYPT 2013(Springer, 2013) 1–17].