Band 18, Heft 1

The hidden subgroup problem (HSP) is a cornerstone problem in quantum computing, which captures many problems of interest and provides a standard framework algorithm for their study based on Fourier sampling, one class of techniques known to provide quantum advantage, and which succeeds for some groups but not others. The quantum hardness of the HSP problem for the dihedral group is a critical question for post-quantum cryptosystems based on learning with errors and also appears in subexponential algorithms for constructing isogenies between elliptic curves over a finite field. In this article, we give an updated overview of the dihedral hidden subgroup problem as approached by the “standard” quantum algorithm for HSP on finite groups, detailing the obstructions for strong Fourier sampling to succeed and summarizing other known approaches and results. In our treatment, we “contrast and compare” as much as possible the cyclic and dihedral cases, with a view to determining bounds for the success probability of a quantum algorithm that uses m m coset samples to solve the HSP on these groups. In the last sections, we prove a number of no-go results for the dihedral coset problem (DCP), motivated by a connection between DCP and cloning of quantum states. The proofs of these no-go results are then adapted to give nontrivial upper bounds on the success probability of a quantum algorithm that uses m m coset samples to solve DCP.

Transparency order ( TO {\mathcal{TO}} ) is one of the indicators used to measure the resistance of ( n , m ) \left(n,m) -function to differential power analysis. At present, there are three definitions: TO {\mathcal{TO}} , redefined transparency order ( ℛTO {\mathcal{ {\mathcal R} TO}} ), and modified transparency order ( ℳTO {\mathcal{ {\mathcal M} TO}} ). For the first time, we give one necessary and sufficient condition for ( n , m ) \left(n,m) -function reaching TO = m {\mathcal{TO}}=m and completely characterize ( n , m ) \left(n,m) -functions reaching TO = m {\mathcal{TO}}=m for any n n and m m . We find that any ( n , 1 ) \left(n,1) -function cannot reach TO = m {\mathcal{TO}}=m for odd n n . Based on the matrix product, the necessary conditions for ( n , m ) \left(n,m) -function reaching ℳTO = m {\mathcal{ {\mathcal M} TO}}=m or ℛTO = m {\mathcal{ {\mathcal R} TO}}=m are given, respectively. Finally, it is proved that any balanced ( n , m ) \left(n,m) -function cannot reach the upper bound on TO {\mathcal{TO}} (or ℛTO {\mathcal{ {\mathcal R} TO}} , ℳTO {\mathcal{ {\mathcal M} TO}} ).

We use tropical algebras as platforms for a very efficient digital signature protocol. Security relies on computational hardness of factoring one-variable tropical polynomials; this problem is known to be NP-hard. We also offer countermeasures against recent attacks by Panny and by Brown and Monico.

Let N = p q N=pq be the product of two balanced prime numbers p p and q q . In Elkamchouchi et al. ( Extended RSA cryptosystem and digital signature schemes in the domain of Gaussian integers . In: ICCS 2002. vol. 1. IEEE Computer Society; 2002. p. 91–5.) introduced an Rivest-Shamir-Adleman (RSA)-like cryptosystem that uses the key equation e d − k ( p 2 − 1 ) ( q 2 − 1 ) = 1 ed-k\left({p}^{2}-1)\left({q}^{2}-1)=1 , instead of the classical RSA key equation e d − k ( p − 1 ) ( q − 1 ) = 1 ed-k\left(p-1)\left(q-1)=1 . Another variant of RSA, presented in Murru and Saettone ( A novel RSA-like cryptosystem based on a generalization of the Rédei rational functions . In: NuTMiC 2017. vol. 10737 of Lecture Notes in Computer Science. Springer; 2017. p. 91–103), uses the key equation e d − k ( p 2 + p + 1 ) ( q 2 + q + 1 ) = 1 ed-k\left({p}^{2}+p+1)\left({q}^{2}+q+1)=1 . Despite the authors’ claims of enhanced security, both schemes remain vulnerable to adaptations of common RSA attacks. Let n n be an integer. This article proposes two families of RSA-like encryption schemes: one employs the key equation e d − k ( p n − 1 ) ( q n − 1 ) = 1 ed-k\left({p}^{n}-1)\left({q}^{n}-1)=1 for n > 0 n\gt 0 , while the other uses e d − k [ ( p n − 1 ) ( q n − 1 ) ] ⁄ [ ( p − 1 ) ( q − 1 ) ] = 1 ed-k\left[\left({p}^{n}-1)\left({q}^{n}-1)]/\left[\left(p-1)\left(q-1)]=1 for n > 1 n\gt 1 . Note that we remove the conventional assumption of primes having equal bit sizes. In this scenario, we show that regardless of the choice of n n , continued fraction-based attacks can still recover the secret exponent. Additionally, this work fills a gap in the literature by establishing an equivalent of Wiener’s attack when the primes do not have the same bit size.

The idea of extending the classical RSA protocol using algebraic number fields was introduced by Takagi and Naito (Construction of RSA cryptosystem over the algebraic field using ideal theory and investigation of its security. Electron Commun Japan Part III Fund Electr Sci. 2000;83:19–29). Recently, Zheng et al. proposed the use of the ring of algebraic integers of an algebraic number field and the lattice theory to present a high-dimensional form of RSA. The authors claim that their proposal is post-quantum and is significant both from the theoretical and practical point of view. In this article, we prove that the security of Zheng et al.’s scheme is still based on the factorization problem, and we present a practical quantum attack on this proposed scheme, our attack is a quantum polynomial time algorithm that employs Shor’s algorithm as a subroutine.

Given that the tropical Stickel protocol and its variants are all vulnerable to the generalized Kotov–Ushakov attack, we suggest employing the max-min semiring and, more generally, max- T T semiring where the multiplication is based on a T T -norm, as a framework to implement the Stickel protocol. While the Stickel protocol over max-min semiring or max- T T semiring remains susceptible to a form of Kotov–Ushakov attack, we demonstrate that it exhibits significantly increased resistance against this attack when compared to the tropical (max-plus) implementation.

A chameleon hash function is a type of hash function that involves a trapdoor to help find collisions, i.e., it allows the rewriting of a message without modifying the hash. For some applications, it is important to have the feature of revoking the rewriting privilege of the trapdoor holder. In this paper, using lattice-based hard problems that are considered quantum-safe, we first introduce a lattice-based chameleon hash with an ephemeral trapdoor ( CHET ) \left({\mathsf{CHET}}) and then a revocable attribute-based encryption ( RABE {\mathsf{RABE}} ) scheme that is adaptively indistinguishable. We also give security analyses of our schemes and compare our RABE {\mathsf{RABE}} scheme to two relevant schemes proposed recently. Furthermore, we combine our CHET {\mathsf{CHET}} and RABE {\mathsf{RABE}} to design a new revocable policy-based chameleon hash.

The authors introduced a new family of cryptographic schemes in a previous research article, which includes many practical encryption schemes, such as the Feistel family. Given a finite field of order q q , any n > m ≥ 0 n\gt m\ge 0 , the authors described a new way to extend discrete functions with domain size q m {q}^{m} and range size q n − m {q}^{n-m} to a permutation over q n {q}^{n} elements using theory from linear error correcting codes. The authors previously showed that the knowledge about the differentials and correlations of the resulting permutation reduces solely to those of the extended discrete function. We show how the perfect secrecy of extended nonlinear functions transfers to the family of bijective linear extensions. We investigate how the concrete security of the family of nonlinear functions relates to the family of permutations obtained by such a type of linear extension. We also explore how the interplay between the entropy and the total variation distance (near-perfect secrecy with unbounded adversary) affects the mixing rate (number of iterations of the feedback linear extensions) with respect to the uniform distribution of the permutations over q n {q}^{n} elements. We give a new proof that a distribution close to the uniform distribution has a large entropy.

Let C C be a linear code of length n n and dimension k k over the finite field F q m {{\mathbb{F}}}_{{q}^{m}} . The trace code Tr ( C ) {\rm{Tr}}\left(C) is a linear code of the same length n n over the subfield F q {{\mathbb{F}}}_{q} . The obvious upper bound for the dimension of the trace code over F q {{\mathbb{F}}}_{q} is m k mk . If equality holds, then we say that C C has maximum trace dimension. The problem of finding the true dimension of trace codes and their duals is relevant for the size of the public key of various code-based cryptographic protocols. Let C a {C}_{{\boldsymbol{a}}} denote the code obtained from C C and a multiplier vector a ∈ ( F q m ) n {\boldsymbol{a}}\in {\left({{\mathbb{F}}}_{{q}^{m}})}^{n} . In this study, we give a lower bound for the probability that a random multiplier vector produces a code C a {C}_{{\boldsymbol{a}}} of maximum trace dimension. We give an interpretation of the bound for the class of algebraic geometry codes in terms of the degree of the defining divisor. The bound explains the experimental fact that random alternant codes have minimal dimension. Our bound holds whenever n ≥ m ( k + h ) n\ge m\left(k+h) , where h ≥ 0 h\ge 0 is the Singleton defect of C C . For the extremal case n = m ( h + k ) n=m\left(h+k) , numerical experiments reveal a closed connection between the probability of having maximum trace dimension and the probability that a random matrix has full rank.

We characterize the possible groups E ( Z ∕ N Z ) E\left({\mathbb{Z}}/N{\mathbb{Z}}) arising from elliptic curves over Z ∕ N Z {\mathbb{Z}}/N{\mathbb{Z}} in terms of the groups E ( F p ) E\left({{\mathbb{F}}}_{p}) , with p p varying among the prime divisors of N N . This classification is achieved by showing that the infinity part of any elliptic curves over Z ∕ p e Z {\mathbb{Z}}/{p}^{e}{\mathbb{Z}} is a Z ∕ p e Z {\mathbb{Z}}/{p}^{e}{\mathbb{Z}} -torsor, of which a generator is exhibited. As a first consequence, when E ( Z ∕ N Z ) E\left({\mathbb{Z}}/N{\mathbb{Z}}) is a p p -group, we provide an explicit and sharp bound on its rank. As a second consequence, when N = p e N={p}^{e} is a prime power and the projected curve E ( F p ) E\left({{\mathbb{F}}}_{p}) has trace one, we provide an isomorphism attack to the elliptic curve discrete logarithm problem, which works only by means of finite ring arithmetic.

We address the problem of user fast revocation in the lattice-based Ciphertext Policy Attribute-Based Encryption (CP-ABE) by extending the scheme originally introduced by Zhang and Zhang [Zhang J, Zhang Z. A ciphertext policy attribute-based encryption scheme without pairings . In: International Conference on Information Security and Cryptology. Springer; 2011. p. 324–40. doi: https://doi.org/10.1007/978-3-642-34704-7_23.]. While a lot of work exists on the construction of revocable schemes for CP-ABE based on pairings, works based on lattices are not so common, and – to the best of our knowledge – we introduce the first server-aided revocation scheme in a lattice-based CP-ABE scheme, hence being embedded in a post-quantum secure environment. In particular, we rely on semi-trusted “mediators” to provide a multi-step decryption capable of handling mediation without re-encryption. We comment on the scheme and its application, and we provide performance experiments on a prototype implementation in the Attribute-Based Encryption spin-off library of Palisade to evaluate the overhead compared with the original scheme.

From the work by Laguillaumie and Vergnaud in ICICS’04, it has been widely believed that multi-designated verifiers signature scheme (MDVS) can be constructed from ring signature schemes in general. However, in this article, somewhat surprisingly, we prove that it is impossible to construct an MDVS scheme from a ring signature scheme in a black-box sense (in the standard model). The impossibility stems from the difference between the definitions of unforgeability of the two schemes. To the best of our knowledge, existing works demonstrating the constructions do not provide formal reductions from an MDVS scheme to a ring signature scheme, and thus, the impossibility has been overlooked for a long time.

The notion of public-key encryption with keyword search (PEKS) was introduced to search over encrypted data without performing any decryption. In this article, we propose a PEKS scheme in which both the encrypted keyword and the trapdoor are randomized so that the cloud server is not able to recognize identical queries a priori . Our scheme is Ciphertext-Indistinguishabiltity secure in the single-user setting and Trapdoor-Indistinguishability secure in the multi-user setting with a stronger security, i.e., with multi-trapdoor .

The use of alternative operations in differential cryptanalysis, or alternative notions of differentials, is lately receiving increasing attention. Recently, Civino et al. managed to design a block cipher that is secure with respect to the classical differential cryptanalysis performed using XOR-differentials, but weaker with respect to the attack based on an alternative difference operation acting on the first s-box of the block. We extend this result to parallel alternative operations, i.e. acting on each s-box of the block. First, we recall the mathematical framework needed to define and use such operations. After that, we perform some differential experiments against a toy cipher and compare the effectiveness of the attack with respect to the one that uses XOR-differentials.

In this article, Algebraic-Geometric (AG) codes and quantum codes associated with a family of curves that includes the famous Suzuki curve are investigated. The Weierstrass semigroup at some rational point is computed. Notably, each curve in the family turns out to be a Castle curve over some finite field and a weak Castle curve over its extensions. This is a relevant feature when codes constructed from the curve are considered.

Boomerang attacks were introduced in 1999 by Wagner (The boomerang attack. In: Knudsen LR, editor. FSE’99. vol. 1636 of LNCS. Heidelberg: Springer; 1999. p. 156–70) as a powerful tool in differential cryptanalysis of block ciphers, especially dedicated to ciphers with good short differentials. They have been generalized to the related-key case by Biham et al. (Related-key boomerang and rectangle attacks. In: Cramer R, editor. Advances in Cryptology - EUROCRYPT 2005, 24th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Aarhus, Denmark, May 22–26, 2005, Proceedings. vol. 3494 of Lecture Notes in Computer Science. Springer; 2005. p. 507–25. doi: 10.1007/11426639_30). In this article, we show how to adapt the model proposed in 2020 by Delaune et al. (Catching the fastest boomerangs application to SKINNY. IACR Trans Symm Cryptol. 2020;2020(4):104–29) for related-key boomerang attacks on the block cipher SKINNY to the Rijndael case. Rijndael is composed of 25 instances that could be seen as generalizations of the Advanced Encryption Standard. We detail our models and present the results we obtain concerning related-key boomerang attacks on Rijndael. Notably, we present a nine-round attack against Rijndael-128-160, which has 11 rounds and beats all previous cryptanalytic results against Rijdael-128-160.

In this note, we assess the efficiency of a supersingular isogeny Diffie-Hellman (SIDH)-based digital signature built on a weaker variant of a recent identification protocol proposed by Basso et al. Despite the devastating attacks against (the mathematical problem underlying) SIDH, this identification protocol remains secure, as its security is backed by a different (and more standard) isogeny-finding problem. We conduct our analysis by applying some known cryptographic techniques to decrease the signature size by about 70% for all parameter sets (obtaining signatures of approximately 21 kB for SIKE p 434 {\mathsf{SIKE}}{\mathsf{p}}434 ). Moreover, we propose a minor optimisation to compute many isogenies in parallel from the same starting curve. Our assessment confirms that determining the most efficient methods for isogeny-based signature schemes, including optimisations such as those presented in this paper, is still a open problem, with much more work to be done.

Continuous and context-aware authentication mechanisms have been proposed as complementary security mechanisms to password-based authentication for computer devices that are handled directly by humans, such as smart phones. Such authentication mechanisms incur some privacy issues as user-dependent features are revealed to the authentication server, which is assumed to be untrusted. Domingo-Ferrer et al. proposed a privacy-preserving protocol for context-aware user authentication on the basis of private set intersection and Paillier homomorphic encryption. This approach enables user authentication based on establishing the number of similarities between sampled user context data and reference context data, without revealing any plaintext data to either party. The authors claim that their scheme is secure against malicious adversaries. In this article, we show that Domingo-Ferrer et al.’s scheme is insecure by means of two undetectable attacks that reveal all user information despite the encryption. The Paillier encryption primitive has a homomorphic property that we observe not only lacks relevance but, indeed, incurs a vulnerability that is exploited in the proposed cryptanalysis. This means that special care needs to be taken considering homomorphic properties of cryptographic primitives used in cryptographic protocols. Our cryptanalysis may therefore have a general interest regarding the design of cryptographic protocols.