Startseite Remarks on a Tropical Key Exchange System
Artikel Open Access

Remarks on a Tropical Key Exchange System

  • Dylan Rudy und Chris Monico EMAIL logo
Veröffentlicht/Copyright: 20. Dezember 2020
Veröffentlichen auch Sie bei De Gruyter Brill

Abstract

We consider a key-exchange protocol based on matrices over a tropical semiring which was recently proposed in [2]. We show that a particular private parameter of that protocol can be recovered with a simple binary search, rendering it insecure.

MSC 2010: 15A80; 94A60

1 Introduction

Let S be any nonempty subset of ℝ which is closed under addition. Define two operations ⊕ and ⊗ on S by

a b = min { a , b } , a b = a + b .

Both operations are associative and commutative and ⊗ distributes over ⊕, and hence S is a commutative semiring, called a tropical semiring. The set M = Matk×k(S) of k × k matrices over S is therefore a semiring with the induced operations

( a i j ) ( b i j ) = ( a i j b i j ) , ( a i j ) ( b i j ) = ( c i j ) ,  where  c i j = ( a i 1 b 1 j ) ( a i 2 b 2 j ) ( a i k b k j ) .

In [1], the authors proposed two key exchange protocols based on the structure M . Shortly after, an effective attack was given on one of those protocols in [3]. Subsequently, a new key exchange protocol was proposed in [2] (in fact, two new protocols, but they are very closely related to each other). It is this protocol that we consider in this paper.

In [2], the authors give two semigroup operations on M × M each arising as a semidirect product induced by a specified action of these matrices on themselves. The two semigroup operations are given by

(1) ( M , G ) ( S , H ) = ( M S H ( M H ) , G H ( G H ) ) ,
(2) ( M , G ) ( S , H ) = ( ( H M T ) ( M T H ) S , G H ) .

Note that for each of these operations, the first component of the product does not depend on G. This fact plays a key role in the two key exchange protocols they then propose (one corresponding to each operation):

  1. Alice and Bob agree on public matrices M, H M whose entries are integers in the range [−N, N], and they agree on a positive integer K. Alice selects a private positive integer m < 2K and Bob selects a private positive integer n < 2K.

  2. Alice computes (M, H)m = (A, PA) and sends A to Bob.

  3. Bob computes (M, H)n = (B, PB) and sends B to Alice.

  4. Alice determines the first component of (M, H)m+n = (M, H)n(M, H)m = (B, PB)(A, PA) from her knowledge of A, PA, and B (knowledge of PB is not necessary for either of the operations (1) or (2).

  5. Bob similarly determines the first component of (M, H)m+n = (M, H)m(M, H)n = (A, PA)(B, PB) from his knowledge of B, PB, and A.

In the next section, we show that an eavesdropper can find a positive integer m′ for which the first component of (M, H)m′ is A; she can then use this m′ to compute the shared secret key in essentially the same way as Alice. Furthermore, such an m′ can be found using 𝒪(K2) operations (1) or (2).

2 The attack

Since addition of matrices in M is idempotent, i.e., GG = G, we have a partial order on M defined by

X Y  if  X Y = X .

Clearly we have that XY iff xijyij for all i, j ∈ {1, 2, . . . , k}. Furthermore, this partial order respects both operations on M ; if XY and Z M , then XZYZ and XZYZ.

Proposition 2.1

Consider the semigroup M × M equipped with either of the two operations defined by (1) and (2). Let (M, H) ∈ M × M , and for each positive integer let (M, H) = (M, H). Then the sequence {M} is monotonically decreasing: M1M2M3. . . .

Proof. Let ≥ 2. For the operation ∘ we have

( M , H ) = ( M 1 , H 1 ) ( M , H ) = ( M 1 M H ( M 1 H ) , H 1 H ( H 1 H ) ) ,

so that M = M−1MH ⊕ (M−1H). In particular, MM−1 = M, and hence MM−1.

Similarly, for the operation * we have that

( M , H ) = ( M , H ) ( M 1 , H 1 ) = ( ( H 1 M T ) ( M T H 1 ) M 1 , H H 1 ) ,

and hence M = (H−1MT) ⊕ (MTH−1) ⊕ M−1. Again, MM−1 = M, so that MM−1.

The problem alluded to at the end of the introduction is now easily solved with a binary search. Let M, H M × M and (M, H) = (M, H). Suppose A M × M satisfies A = Mm for some positive integer m < 2K. First, obtain an upper bound on m by computing successive squares

M 1 , M 2 , M 4 , M 8 ,

until finding a positive integer t for which AM2t . Since it is then known that 1 ≤ m ≤ 2t, a simple binary search will find an integer m′ for which Mm′ = A. The sequence M1, M2, . . . is generally strictly decreasing, in which case m′ = m. However, even if m′m, finding such an integer m′ is enough for the eavesdropper to recover the shared secret key. Let π1 : M × M M be the map π1(C, D) = C. Suppose (M, H)n = (B, PB), (M, H)m = (A, PA) and (M, H)m′ = (A, PE). Then for each of the operations (1) and (2), the shared secret key satisfies

π 1 ( ( M , H ) m + n ) = π 1 ( ( M , H ) m + n ) .

This is clear, since this shared secret key can be expressed in terms of A, B, and PB only, but it may also be explicitly verified. For example, with the operation (1),

π 1 ( ( M , H ) m + n ) = π 1 ( ( A , P A ) ( B , P B ) ) = A B P B ( A P B ) = π 1 ( ( A , P E ) ( B , P B ) ) = π 1 ( ( M , H ) m + n ) .

In particular, the eavesdropper may recover the shared secret key via

π 1 ( ( M , H ) m + n ) = π 1 ( ( M , H ) n ( M , H ) m ) = π 1 ( ( B , P B ) ( A , P E ) ) = B A P E ( B P E ) .

Finding t as described above requires at most K semigroup operations in M × M . The binary search, done in the most obvious way, would compute K powers of (M, H), each of which requires no more than 2K semigroup operations in M × M , for a total complexity of at most 2K2 + K operations in M × M . This can be reduced to K2 + K by storing the successive squares (M1, H1), (M2, H2), (M4, H4), . . . and using them to compute each power of (M, H) during the binary search phase.

Addition of k × k matrices can be accomplished with 𝒪(k2) integer max operations, and multiplication accomplished using 𝒪(k3) integer addition and max operations. Therefore this attack requires 𝒪(K2k3) integer operations. We argue below that the typical entry of A has about K bits. In that case, each integer addition and max operation requires no more than K bit operations, for a total of 𝒪(K3k3) bit operations. If we let α denote the number of bits required to represent A (i.e., the key size) it follows that αKk2, and this attack requires 𝒪(α3) bit operations, a polynomial-time function of the input size. If K is fixed, as in our experiments, then it requires 𝒪(α1.5) bit operations.

We coded this method in C, and performed some experiments on a single core of an i7 CPU at 3.10GHz. Using M = Matk×k(S) for various values of k, and the parameters N = 1000, K = 200 suggested in [2], we performed 40 experiments for each value of k. In each experiment, we generated random matrices M, H and chose random positive integers m, n < 2K and measured the time to recover an m′ as described above. The results of these experiments are summarized in Table 1. For reference, we also report the average number of bits α in the matrix A that would be shared by Alice, and the values t/k3 and t/α1.5 for comparison with the asymptotic runtime estimates given above.

Table 1

Average number of bits α to represent A (Alice’s matrix, from Section 1), and average time t (in seconds) to recover m′ for various sized (k × k) matrices, with N = 1000 and K = 200.

k α t t/k3 t/α1.5
5 5222 0.12 0.00096 3.2e−7
10 20885 0.66 0.00066 2.2e−7
15 47025 2.43 0.00072 2.4e−7
20 83710 4.76 0.00060 2.0e−7
25 130594 10.53 0.00067 2.2e−7
30 188145 17.75 0.00066 2.2e−7
35 256484 24.05 0.00056 1.9e−7
40 334040 40.92 0.00064 2.1e−7
45 422111 45.80 0.00050 1.7e−7
50 523312 78.33 0.00063 2.1e−7
55 631091 98.19 0.00059 2.0e−7
60 752490 122.57 0.00057 1.9e−7

We would like to make one final remark about the key sizes in this system. With the notation as above and the operation (1), for example, we have

M + 1 = M M H ( M l H ) .

Since M2M and M2H and M+1M2 for all ≥ 2, it follows that

M + 1 = M ( M H ) ,  for  2.

This means that, on average, the entries of M+1 decrease from those of M by an approximately constant amount, proportional to the size of the entries of H. With Alice’s m ≈ 2K, this means that the entries of A are on the order of −c × 2K, or about K bits each. With the parameter sizes K = 200, k = 30, N ≈ 1000 suggested in [2], one would have M and H consisting of about 9000 bits each and A with about 30×30×200 = 180, 000 bits.

3 Conclusion

The attack presented here exploits the fact that the sequence {(M, H)} is linearly ordered. It is quite effective and practical against the protocols described in [2]. For those protocols, Alice and Bob must do approximately 𝒪(K) operations in the semigroup M × M . and this attack requires about 𝒪(K2) operations in that same semi-group, so an increase of parameter sizes does not help.

We thank the referees for their thoughtful reading of this manuscript and their feedback.

References

[1] Dima Grigoriev and Vladimir Shpilrain. Tropical cryptography. Comm. Algebra 42(6):2624–2632, 2014.10.1080/00927872.2013.766827Suche in Google Scholar

[2] Dima Grigoriev and Vladimir Shpilrain. Tropical cryptography II: extensions by homomorphisms. Comm. Algebra 47(10):4224–4229, 2019.10.1080/00927872.2019.1581213Suche in Google Scholar

[3] Matvei Kotov and Alexander Ushakov. Analysis of a key exchange protocol based on tropical matrix algebra. J. Math. Cryptol. 12(3):137–141, 2018.10.1515/jmc-2016-0064Suche in Google Scholar

Received: 2019-11-22
Accepted: 2020-09-08
Published Online: 2020-12-20

© 2020 D. Rudy and C. Monico, published by De Gruyter

This work is licensed under the Creative Commons Attribution 4.0 International License.

Artikel in diesem Heft

  1. Regular Articles
  2. Secret sharing and duality
  3. On the condition number of the Vandermonde matrix of the nth cyclotomic polynomial
  4. On the equivalence of authentication codes and robust (2, 2)-threshold schemes
  5. Pseudo-free families of computational universal algebras
  6. Lattice Sieving in Three Dimensions for Discrete Log in Medium Characteristic
  7. Attack on Kayawood protocol: uncloaking private keys
  8. The circulant hash revisited
  9. On cryptographic properties of (n + 1)-bit S-boxes constructed by known n-bit S-boxes
  10. Improved cryptanalysis of a ElGamal Cryptosystem Based on Matrices Over Group Rings
  11. Remarks on a Tropical Key Exchange System
  12. A note on secure multiparty computation via higher residue symbols
  13. Using Inclusion / Exclusion to find Bent and Balanced Monomial Rotation Symmetric Functions
  14. The Oribatida v1.3 Family of Lightweight Authenticated Encryption Schemes
  15. Isogenies on twisted Hessian curves
  16. Quantum algorithms for computing general discrete logarithms and orders with tradeoffs
  17. Stochastic methods defeat regular RSA exponentiation algorithms with combined blinding methods
  18. Sensitivities and block sensitivities of elementary symmetric Boolean functions
  19. Constructing Cycles in Isogeny Graphs of Supersingular Elliptic Curves
  20. Revocable attribute-based proxy re-encryption
  21. MathCrypt 2019
  22. Editor’s Preface for the Second Annual MathCrypt Proceedings Volume
  23. A trade-off between classical and quantum circuit size for an attack against CSIDH
  24. Towards Isogeny-Based Password-Authenticated Key Establishment
  25. Algebraic approaches for solving isogeny problems of prime power degrees
  26. Discretisation and Product Distributions in Ring-LWE
  27. Approximate Voronoi cells for lattices, revisited
  28. (In)Security of Ring-LWE Under Partial Key Exposure
  29. Towards a Ring Analogue of the Leftover Hash Lemma
  30. The Eleventh Power Residue Symbol
  31. Factoring with Hints
  32. One Bit is All It Takes: A Devastating Timing Attack on BLISS’s Non-Constant Time Sign Flips
  33. A framework for reducing the overhead of the quantum oracle for use with Grover’s algorithm with applications to cryptanalysis of SIKE
Heruntergeladen am 21.10.2025 von https://www.degruyterbrill.com/document/doi/10.1515/jmc-2019-0061/html
Button zum nach oben scrollen