Volume 19, Issue 1

The condition number of a generator matrix of an ideal lattice derived from the ring of integers of an algebraic number field is an important quantity associated with the equivalence between two computational problems in lattice-based cryptography, the “Ring Learning With Errors (RLWE)” and the “Polynomial Learning With Errors (PLWE)”. In this work, we compute the condition number of a generator matrix of the ideal lattice from the whole ring of integers of any odd prime degree cyclic number field using canonical embedding.

We find an efficient method to solve the semidirect discrete logarithm problem (SDLP) over finite nonabelian groups of order p 3 {p}^{3} and exponent p 2 {p}^{2} for certain exponentially large parameters. This implies an attack on SPDH-Sign, Pronounced “SPUD-Sign”. a signature scheme based on the SDLP, for such parameters. In particular, SDLP instances over such groups are parameterised by an n < ( p − 1 ) p 6 n\lt \left(p-1){p}^{6} : we develop a method to solve instances when n ≤ poly ( log p ) ⋅ p n\le {\rm{poly}}\left(\log p)\hspace{0.25em}\cdot p . Letting λ \lambda be the security parameter of SPDH-Sign, which is taken p = exp λ p=\exp \lambda , we find we may solve instances of SDLP corresponding to SPDH-Sign instances with exponentially large p p . However, for n ≈ p 2 n\approx {p}^{2} and larger, our method no longer completely solves the SDLP instances. We also study the linear hidden shift problem for a group action corresponding to SDLP and take a step towards proving the quantum polynomial time equivalence of SDLP and the semidirect computational Diffie–Hellman problem.

Let p > 1 p\gt 1 be a large prime number, and let ε > 0 \varepsilon \gt 0 be a small number. The established unconditional upper bounds of the least primitive root u ≠ ± 1 , v 2 u\ne \pm 1,{v}^{2} in the prime finite field F p {{\mathbb{F}}}_{p} have exponential magnitudes u ≪ p 1 ⁄ 4 + ε u\ll {p}^{1/4+\varepsilon } . This note contributes a new result to the literature. It proves that the upper bound of the least primitive root has polynomial magnitude u ≤ ( log p ) 1 + ε u\le {\left(\log p)}^{1+\varepsilon } unconditionally.

Post-quantum cryptography deals with the development and analysis of cryptographic schemes that are assumed to be secure even against attackers with access to a powerful quantum computer. Along the main candidates for quantum-safe solutions are cryptographic schemes, whose security is based on classic lattice problems such as the bounded-distance decoding (BDD) problem or the learning with error problem . In this work, we contribute to the analysis of an attack category against these problems called dual attack . In recent years, a lot of notable progress was achieved in this topic. Our first contribution is to provide theoretical counterarguments against a so-called independence assumption, which was used in earlier works on this attack, and which was shown in a previous work to be contradicting practical experiments. Then, we provide estimates on the success probability and the cost of the dual attack against the decisional version of the BDD problem. These estimates are derived both rigorously and heuristically. Finally, we also provide experimental evidence that confirms these results.

We present two simple zero-knowledge interactive proofs that can be instantiated with many of the standard decisional or computational hardness assumptions. Compared with traditional zero-knowledge proofs, in our protocols, the verifier starts first, by emitting a challenge, and then, the prover answers the challenge.

The term “homomorphism” was introduced in cryptography by Rivest, Adleman, and Dertouzos in 1978 to address performing calculations on encrypted data without decryption. Since then, researchers have increasingly aimed to design schemes supporting numerous operations. This article aims to synthesize the current state of the art in the so-called somewhat homomorphic encryption.

There are many group-based cryptosystems in which the security is related to the conjugacy search problem or the simultaneous conjugacy search problem in their underlying platform groups. In this article, we show that some metabelian groups do not provide strong security for these cryptosystems and so they cannot be chosen as platform groups.

MinRank is an NP-complete problem in linear algebra whose characteristics make it attractive to build post-quantum cryptographic primitives. Several MinRank-based digital signature schemes have been proposed. In particular, two of them, MIRA and MiRitH, have been submitted to the NIST post-quantum cryptography standardization process. In this article, we propose a key-generation algorithm for MinRank-based schemes that reduces the size of the public key to about 50% of the size of the public key generated by the previous best (in terms of public-key size) algorithm. Precisely, the size of the public key generated by our algorithm sits in the range of 328–676 bits for security levels of 128–256 bits. We also prove that our algorithm is as secure as the previous ones.

This article aims to speed up (the precomputation stage of) multiscalar multiplication (MSM) on ordinary elliptic curves of j -invariant 0 with respect to specific “independent” (also known as “basis”) points. For this purpose, the so-called Mordell–Weil lattices (up to rank 8) with large kissing numbers (up to 240) are employed. In a nutshell, the new approach consists in obtaining more efficiently a considerable number (up to 240) of certain elementary linear combinations of the “independent” points. By scaling the point (re)generation process, it is thus possible to obtain a significant performance gain. As usual, the resulting curve points can be then regularly used in the main stage of an MSM algorithm to avoid repeating computations. Seemingly, this is the first usage of lattices with large kissing numbers in cryptography, while such lattices have already found numerous applications in other mathematical domains. Without exaggeration, MSM is a widespread primitive (often the unique bottleneck) in modern protocols of real-world elliptic curve cryptography. Moreover, the new (re)generation technique is prone to further improvements by considering Mordell–Weil lattices with even greater kissing numbers.

Let Q ( α ) {\mathbb{Q}}\left(\alpha ) and Q ( β ) {\mathbb{Q}}\left(\beta ) be linearly disjoint number fields and let Q ( θ ) {\mathbb{Q}}\left(\theta ) be their compositum. We prove that the first-degree prime ideals (FDPIs) of Z [ θ ] {\mathbb{Z}}\left[\theta ] may almost always be constructed in terms of the FDPIs of Z [ α ] {\mathbb{Z}}\left[\alpha ] and Z [ β ] {\mathbb{Z}}\left[\beta ] , and vice versa . We identify the cases where this correspondence does not hold, and provide explicit counterexamples for each obstruction. We show that for every pair of coprime integers d , e ∈ Z d,e\in {\mathbb{Z}} , such a correspondence almost always respects the divisibility of principal ideals of the form ( e + d θ ) Z [ θ ] \left(e+d\theta ){\mathbb{Z}}\left[\theta ] , with a few exceptions that we characterize. Finally, we establish the asymptotic computational improvement of such an approach, and we verify the reduction in time needed for computing such primes for certain concrete cases.

Threshold signatures enable any subgroup of predefined cardinality t t out of a committee of n n participants to generate a valid, aggregated signature. Although several ( t , n ) \left(t,n) -threshold signature schemes exist, most of them assume that the threshold t t and the set of participants do not change over time. Practical applications of threshold signatures might benefit from the possibility of updating the threshold or the committee of participants. Examples of such applications are consensus algorithms and blockchain wallets. In this article, we present Dynamic-FROST (D-FROST) that combines FROST, a Schnorr threshold signature scheme, with CHURP, a dynamic proactive secret sharing scheme. The resulting protocol is the first Schnorr threshold signature scheme that accommodates changes in both the committee and the threshold value without relying on a trusted third party. Besides detailing the protocol, we present a proof of its security: as the original signing scheme, D-FROST preserves the property of existential unforgeability under chosen-message attack.

We present BTLE (Broadcast Time-Lock Exchange Protocol), a two-step protocol that aims to decentralize exchange of funds between two blockchains in scenarios similar to online exchanges. BTLE leverages time-lock puzzles to achieve that. In the first phase, the BTLE-MA protocol allows for a matching between a market maker and one of the competing market takers. In the second phase, the BTLE-AS algorithm allows the exchange between the market maker and the winning market taker. It is not necessary to use both the BTLE-MA and BTLE-AS algorithms in a decentralized-exchange scenario: existing atomic swaps based on hashed time-lock contract (HTLC) can benefit from BTLE-MA and can be adapted to an exchange where there are multiple possible participants. Moreover, BTLE computations are off-chain, so BTLE can be used in those blockchain pairs where at least one of the two does not have a scripting language or where the pair do not have the same hash function in common. This solves a limitation of HTLC-based atomic swaps. We also propose a new time-lock puzzle based on Pell conic calculations as an alternative to the classical time-lock puzzle of Rivest et al. BTLE has been implemented and tested. Experiments demonstrate that this new time-lock puzzle based on the Pell conic is superior for the intended goal. With an N N -bit modulus of 2,000 bits, the RSW-TL approach resolves the puzzle in approximately 100 s, whereas our BM-TL method requires over 4,000 s, significantly reducing the number of squaring operations needed.

Bidoux and Gaborit introduced a new general technique to improve zero-knowledge ( ZK ) proof-of-knowledge ( PoK ) schemes for a large set of well-known post-quantum hard computational problems such as the syndrome decoding, the permuted kernel, the rank syndrome decoding, and the multivariate quadratic ( MQ ) problems. In particular, the authors’ idea in the study of Bidoux and Gaborit was to use the structure of these problems in the multi-instance setting to minimize the communication complexity of the resulting ZK PoK schemes. The security of the new schemes is then related to new hard problems. In this article, we focus on the new multivariate-based ZK PoK and the corresponding new underlying problem: the so-called DiffMQ H {{\mathtt{DiffMQ}}}_{{\rm{H}}} . We present a new efficient probabilistic algorithm for solving the DiffMQ H {{\mathtt{DiffMQ}}}_{{\rm{H}}} which is polynomial-time if m − n ∈ O ( 1 ) m-n\in O\left(1) . We also present experimental results showing that the algorithm is efficient in practice.