Band 16, Heft 1

The notion of the confusion coefficient is a property that attempts to characterize confusion property of cryptographic algorithms against differential power analysis. In this article, we establish a relationship between the confusion coefficient and the autocorrelation function for any Boolean function and give a tight upper bound and a tight lower bound on the confusion coefficient for any (balanced) Boolean function. We also deduce some deep relationships between the sum-of-squares of the confusion coefficient and other cryptographic indicators (the sum-of-squares indicator, hamming weight, algebraic immunity and correlation immunity), respectively. Moreover, we obtain some trade-offs among the sum-of-squares of the confusion coefficient, the signal-to-noise ratio and the redefined transparency order for a Boolean function.

The main attack against static-key supersingular isogeny Diffie–Hellman (SIDH) is the Galbraith–Petit–Shani–Ti (GPST) attack, which also prevents the application of SIDH to other constructions such as non-interactive key-exchange. In this paper, we identify and study a specific assumption on which the GPST attack relies that does not necessarily hold in all circumstances. We show that in some circumstances the attack fails to recover part of the secret key. We also characterize the conditions necessary for the attack to fail and show that it rarely happens in real cases. We give a link with collisions in the Charles-Goren-Lauter (CGL) hash function.

Structured linear block codes such as cyclic, quasi-cyclic and quasi-dyadic codes have gained an increasing role in recent years both in the context of error control and in that of code-based cryptography. Some well known families of structured linear block codes have been separately and intensively studied, without searching for possible bridges between them. In this article, we start from well known examples of this type and generalize them into a wider class of codes that we call ℱ-reproducible codes. Some families of ℱ-reproducible codes have the property that they can be entirely generated from a small number of signature vectors, and consequently admit matrices that can be described in a very compact way. We denote these codes as compactly reproducible codes and show that they encompass known families of compactly describable codes such as quasi-cyclic and quasi-dyadic codes. We then consider some cryptographic applications of codes of this type and show that their use can be advantageous for hindering some current attacks against cryptosystems relying on structured codes. This suggests that the general framework we introduce may enable future developments of code-based cryptography.

In previous work, we developed a single evolutionary algorithm (EA) to solve random instances of the Anshel–Anshel–Goldfeld (AAG) key exchange protocol over polycyclic groups. The EA consisted of six simple heuristics which manipulated strings. The present work extends this by exploring the use of hyper-heuristics in group-theoretic cryptology for the first time. Hyper-heuristics are a way to generate new algorithms from existing algorithm components (in this case, simple heuristics), with EAs being one example of the type of algorithm which can be generated by our hyper-heuristic framework. We take as a starting point the above EA and allow hyper-heuristics to build on it by making small tweaks to it. This adaptation is through a process of taking the EA and injecting chains of heuristics built from the simple heuristics. We demonstrate we can create novel heuristic chains, which when placed in the EA create algorithms that out perform the existing EA. The new algorithms solve a greater number of random AAG instances than the EA. This suggests the approach may be applied to many of the same kinds of problems, providing a framework for the solution of cryptology problems over groups. The contribution of this article is thus a framework to automatically build algorithms to attack cryptology problems given an applicable group.

We offer a public key exchange protocol based on a semidirect product of two cyclic (semi)groups of matrices over Z p {{\mathbb{Z}}}_{p} . One of the (semi)groups is additive, and the other one is multiplicative. This allows us to take advantage of both operations on matrices to diffuse information. We note that in our protocol, no power of any matrix or of any element of Z p {{\mathbb{Z}}}_{p} is ever exposed, so standard classical attacks on Diffie–Hellman-like protocols are not applicable.

In recent years, the demand for lightweight cryptographic protocols has grown immensely. To fulfill this necessity, the National Institute of Standards and Technology (NIST) has initiated a standardization process for lightweight cryptographic encryption. NIST’s call for proposal demands that the scheme should have one primary member that has a key length of 128 bits, and it should be secure up to 2 50 − 1 {2}^{50}-1 byte queries and 2 112 {2}^{112} computations. In this article, we propose a tweakable block cipher (TBC)-based authenticated encryption with associated data (AEAD) scheme, which we call mF {\mathsf{mF}} . We provide authenticated encryption security analysis for mF {\mathsf{mF}} under some weaker security assumptions (stated in the article) on the underlying TBC. We instantiate a TBC using block cipher and show that the TBC achieves these weaker securities, provided the key update function has high periodicity. mixFeed {\mathsf{mixFeed}} is a round 2 candidate in the aforementioned lightweight cryptographic standardization competition. When we replace the key update function with the key scheduling function of Advanced Encryption Standard (AES), the mF {\mathsf{mF}} mode reduces to mixFeed {\mathsf{mixFeed}} . Recently, the low periodicity of AES key schedule is shown. Exploiting this feature, a practical attack on mixFeed {\mathsf{mixFeed}} is reported. We have shown that multiplication by primitive element satisfies the high periodicity property, and we have a secure instantiation of mF {\mathsf{mF}} , a secure variant of mixFeed {\mathsf{mixFeed}} .

Rahman and Shpilrain proposed a Diffie–Hellman style key exchange based on a semidirect product of n × n n\times n -matrices over a finite field. We show that, using public information, an adversary can recover the agreed upon secret key by solving a system of n 2 {n}^{2} linear equations.

The SIDH and CSIDH are now the two most well-known post-quantum key exchange protocols from the supersingular isogeny-based cryptography, which have attracted much attention in recent years and served as the building blocks of other supersingular isogeny-based cryptographic schemes. The famous SIKE is a post-quantum key encapsulation mechanism (KEM) constructed on the SIDH, motivated by which, this article presents a new post-quantum KEM-based on the CSIDH, which is thereby named as CSIKE. The presented CSIKE has much higher computation efficiency in the decapsulation part by involving an additional tag in the encapsulation results. The new CSIKE is formally proved to be IND-CCA secure under the standard isogeny-based quantum resistant security assumption. Moreover, by comparing the new CSIKE with the only two existing CSIDH-based KEM schemes, i.e., CSIDH-PSEC-KEM and CSIDH-ECIES-KEM, it can be easily found that the new CSIKE has a slightly longer encapsulation size than CSIDH-PSEC-KEM and CSIDH-ECIES-KEM, but (i) it beats the CSIDH-PSEC-KEM by the improvement of approximately 50% in decapsulation speed, and (ii) it has a certain advantage over the CSIDH-ECIES-KEM in security since in the random oracle model, the security proof for CSIDH-ECIES-KEM needs to rely on the stronger CSI-GDH assumption, while the new CSIKE just needs to rely on the basic CSI-CDH assumption.

In this article, we study the connections between pseudo-free families of computational Ω \Omega -algebras (in appropriate varieties of Ω \Omega -algebras for suitable finite sets Ω \Omega of finitary operation symbols) and certain standard cryptographic primitives. We restrict ourselves to families ( H d ∣ d ∈ D ) \left({H}_{d}\hspace{0.33em}| \hspace{0.33em}d\in D) of computational Ω \Omega -algebras (where D ⊆ { 0 , 1 } ∗ D\subseteq {\left\{0,1\right\}}^{\ast } ) such that for every d ∈ D d\in D , each element of H d {H}_{d} is represented by a unique bit string of the length polynomial in the length of d d . Very loosely speaking, our main results are as follows: (i) pseudo-free families of computational mono-unary algebras with one to one fundamental operation (in the variety of all mono-unary algebras) exist if and only if one-way families of permutations exist; (ii) for any m ≥ 2 m\ge 2 , pseudo-free families of computational m m -unary algebras with one to one fundamental operations (in the variety of all m m -unary algebras) exist if and only if claw resistant families of m m -tuples of permutations exist; (iii) for a certain Ω \Omega and a certain variety V {\mathfrak{V}} of Ω \Omega -algebras, the existence of pseudo-free families of computational Ω \Omega -algebras in V {\mathfrak{V}} implies the existence of families of trapdoor permutations.

The discrete logarithm problem (DLP) in a finite group is the basis for many protocols in cryptography. The best general algorithms which solve this problem have a time complexity of O ( N log N ) O\left(\sqrt{N}\log N) and a space complexity of O ( N ) O\left(\sqrt{N}) , where N N is the order of the group. (If N N is unknown, a simple modification would achieve a time complexity of O ( N ( log N ) 2 ) O\left(\sqrt{N}{\left(\log N)}^{2}) .) These algorithms require the inversion of some group elements or rely on finding collisions and the existence of inverses, and thus do not adapt to work in the general semigroup setting. For semigroups, probabilistic algorithms with similar time complexity have been proposed. The main result of this article is a deterministic algorithm for solving the DLP in a semigroup. Specifically, let x x be an element in a semigroup having finite order N x {N}_{x} . The article provides an algorithm, which, given any element y ∈ ⟨ x ⟩ y\in \langle x\rangle , provides all natural numbers m m with x m = y {x}^{m}=y , and has time complexity O ( N x ( log N x ) 2 ) O\left(\sqrt{{N}_{x}}{\left(\log {N}_{x})}^{2}) steps. The article also gives an analysis of the success rates of the existing probabilistic algorithms, which were so far only conjectured or stated loosely.

In this article, we propose a new approach to the study of lattice problems used in cryptography. We specifically focus on module lattices of a fixed rank over some number field. An essential question is the hardness of certain computational problems on such module lattices, as the additional structure may allow exploitation. The fundamental insight is the fact that the collection of those lattices are quotients of algebraic manifolds by arithmetic subgroups. Functions in these spaces are studied in mathematics as part of the number theory. In particular, those form a module over the Hecke algebra associated with the general linear group. We use results on these function spaces to define a class of distributions on the space of lattices. Using the Hecke algebra, we define Hecke operators associated with collections of prime ideals of the number field and show a criterion on distributions to converge to the uniform distribution, if the Hecke operators are applied to the chosen distribution. Our approach is motivated by the work of de Boer, Ducas, Pellet-Mary, and Wesolowski (CRYPTO’20) on self-reduction of ideal lattices via Arakelov divisors.

A multiplexer generator is a device that accepts two or more inputs and based on some logic sends one of them as output. In a special case when inputs to a multiplexer generator are 2 k {2}^{k} bits and one of them is selected according to the value of a k k -bit number, a multiplexer generator can be regarded as a Boolean function in 2 k + k {2}^{k}+k variables. We call this generator a multiplexer Boolean function. Boolean functions serve as combiners and filters in cryptographic designs. The study of their cryptographic strength attracts the cryptographer because of the extremely simple and cost effective of their design. The study of algebraic attacks on multiplexer generators is another major concern to judging the suitability for its use in cryptographic designs. In this article, we calculate the algebraic immunity of the multiplexer Boolean function, which is not an obvious task in the case of a Boolean function like a multiplexer generator.

In this article, we give a digital signature by using Lindner–Peikert cryptosystem. The security of this digital signature is based on the assumptions about hardness of Ring-LWE and Ring-SIS problems, along with providing public key and signature of compact (1–1.5 kilobytes) size. We prove the security of our signature scheme in the Quantum Random Oracle Model. Our cryptanalysis has been done based on methods of Aggarwal et al. and Chen et al.

As quantum computing advances rapidly, guaranteeing the security of cryptographic protocols resistant to quantum attacks is paramount. Some leading candidate cryptosystems use the learning with errors (LWE) problem, attractive for its simplicity and hardness guaranteed by reductions from hard computational lattice problems. Its algebraic variants, ring-learning with errors (RLWE) and polynomial learning with errors (PLWE), gain efficiency over standard LWE, but their security remains to be thoroughly investigated. In this work, we consider the “smearing” condition, a condition for attacks on PLWE and RLWE introduced in Elias et al. We expand upon some questions about smearing posed by Elias et al. and show how smearing is related to the coupon collector’s problem. Furthermore, we develop an algorithm for computing probabilities related to smearing. Finally, we present a smearing-based algorithm for solving the PLWE problem.

Dougherty et al. introduced the common information (CI) method as a method to produce non-Shannon inequalities satisfied by linear random variables, which are called linear rank inequalities. This method is based on the fact that linear random variables have CI. Dougerthy et al. asked whether this method is complete, in the sense that it can be used to produce all linear rank inequalities. We study this question, and we attack it using the theory of secret sharing schemes. To this end, we introduce the notions of Abelian secret sharing scheme and Abelian capacity. We prove that: If there exists an access structure whose Abelian capacity is smaller than its linear capacity, then the CI method is not complete. We investigate the existence of such an access structure.

We investigate the problem of recovering integer inputs (up to an affine scaling) when given only the integer monotonic polynomial outputs. Given n n integer outputs of a degree- d d integer monotonic polynomial whose coefficients and inputs are integers within known bounds and n ≫ d n\gg d , we give an algorithm to recover the polynomial and the integer inputs (up to an affine scaling). A heuristic expected time complexity analysis of our method shows that it is exponential in the size of the degree of the polynomial but polynomial in the size of the polynomial coefficients. We conduct experiments with real-world data as well as randomly chosen parameters and demonstrate the effectiveness of our algorithm over a wide range of parameters. Using only the polynomial evaluations at specific integer points, the apparent hardness of recovering the input data served as the basis of security of a recent protocol proposed by Kesarwani et al. for secure k k -nearest neighbor computation on encrypted data that involved secure sorting. The protocol uses the outputs of randomly chosen monotonic integer polynomial to hide its inputs except to only reveal the ordering of input data. By using our integer polynomial recovery algorithm, we show that we can recover the polynomial and the inputs within a few seconds, thereby demonstrating an attack on the protocol of Kesarwani et al.

The discrete logarithm problem (DLP) in semigroups has attracted some interests and serves as the foundation of many cryptographic schemes. In this work, we study algorithms and lower bounds for DLP in semigroups. First, we propose a variant of the deterministic algorithm for solving the cycle length of torsion elements and show the lower bound of computing the DLP in a semigroup. Then, we propose an algorithm for solving the multiple discrete logarithm (MDL) problem in the semigroup and give the lower bound for solving the MDL problem by considering the MDL problem in the generic semigroup model. Besides, we solve the multidimensional DLP and product DLP in the semigroup.

All instances of the semidirect key exchange protocol, a generalisation of the famous Diffie-Hellman key exchange protocol, satisfy the so-called telescoping equality; in some cases, this equality has been used to construct an attack. In this report, we present computational evidence suggesting that an instance of the scheme called “MOBS (matrices over bitstrings)” is an example of a scheme where the telescoping equality has too many solutions to be a practically viable means to conduct an attack.

This article makes an important contribution to solving the long-standing problem of whether all elliptic curves can be equipped with a hash function (indifferentiable from a random oracle) whose running time amounts to one exponentiation in the basic finite field F q {{\mathbb{F}}}_{q} . More precisely, we construct a new indifferentiable hash function to any ordinary elliptic F q {{\mathbb{F}}}_{q} -curve E a {E}_{a} of j -invariant 1728 with the cost of extracting one quartic root in F q {{\mathbb{F}}}_{q} . As is known, the latter operation is equivalent to one exponentiation in finite fields with which we deal in practice. In comparison, the previous fastest random oracles to E a {E}_{a} require to perform two exponentiations in F q {{\mathbb{F}}}_{q} . Since it is highly unlikely that there is a hash function to an elliptic curve without any exponentiations at all (even if it is supersingular), the new result seems to be unimprovable.

In this article, the group algebra K [ T ] {\mathcal{K}}\left[{\mathscr{T}}] of the binary tetrahedral group T {\mathscr{T}} over a splitting field K {\mathcal{K}} of T {\mathscr{T}} with char ( K ) ≠ 2 , 3 {\rm{char}}\left({\mathcal{K}})\ne 2,3 is studied and the unique idempotents corresponding to all seven characters of the binary tetrahedral group are computed. Furthermore, the minimum weights and dimensions of various group codes generated by linear and nonlinear idempotents in this group algebra are characterized to establish these group codes.