Band 9, Heft 3

We consider the generic design of compression functions based on two n -bit permutations and XOR-based mixing functions. It is known that any such function mapping n+α${n+\alpha }$ to α bits, with 1≤α≤n${1\le \alpha \le n}$, can achieve at most min{2α/2,2n/2-α/4}${\min \lbrace 2^{\alpha /2},2^{n/2-\alpha /4}\rbrace }$ collision security. Using techniques similar to Mennink and Preneel [CRYPTO 2012, Lecture Notes in Comput. Sci. 7417, Springer, Heidelberg (2012), 330–347], we show that there is only one equivalence class of these functions achieving optimal collision security, and additionally min{2α,2n/2}${\min \lbrace 2^{\alpha },2^{n/2}\rbrace }$ preimage security. The equivalence class compares well with existing functions based on two or three permutations, and is well-suited for wide-pipe hashing.

In the papers [New features for public key exchange algorithms, in: 18-th International ICWG Meeting (Krakow 2011)], [Strongly asymmetric PKD cryptographic algorithms: An implementation using the matrix model, in: Proceedings ISEC Conference (Shizuoka 2011)] a new scheme to produce public key agreement (PKA) algorithms was proposed and some examples based on polynomials (toy models) were discussed. In the present paper we introduce a non-commutative realization of the above mentioned scheme and prove that non-commutativity can be an essential ingredient of security in the sense that, in the class of algorithms constructed, under some commutativity assumptions on the matrices involved, we can find a breaking strategy, but dropping these assumptions we can not, even if we assume, as we do in all the attacks discussed in the present paper, that discrete logarithms have zero cost.

We investigate security properties of the Anshel–Anshel–Goldfeld commutator key-establishment protocol [Math. Res. Lett. 6 (1999), 287–291] used with certain polycyclic groups described by Eick and Kahrobaei [http://arxiv.org/abs/math.GR/0411077]. We show that despite low success of the length based attack shown by Garber, Kahrobaei and Lam [J. Math. Crypt. 9 (2015), 33–43] the protocol can be broken by a deterministic polynomial-time algorithm.

The learning with errors (LWE) problem has become a central building block of modern cryptographic constructions. This work collects and presents hardness results for concrete instances of LWE. In particular, we discuss algorithms proposed in the literature and give the expected resources required to run them. We consider both generic instances of LWE as well as small secret variants. Since for several methods of solving LWE we require a lattice reduction step, we also review lattice reduction algorithms and use a refined model for estimating their running times. We also give concrete estimates for various families of LWE instances, provide a Sage module for computing these estimates and highlight gaps in the knowledge about algorithms for solving the LWE problem.