Cryptanalysis of PKP: A New Approach

Transcription

1 Cryptanaysis of PKP: A New Approach Éiane Jaumes and Antoine Joux DCSSI 18, rue du Dr. Zamenhoff F Issy-es-Mx Cedex France eiane.jaumes@wanadoo.fr Antoine.Joux@ens.fr Abstract. Quite recenty, in [4], a new time-memory tradeoff agorithm was presented. The origina goa of this agorithm was to count the number of points on an eiptic curve, however, the authors caimed that their approach coud be appied to other probems. In this paper, we describe such an appication and show a new way to attack the Permuted Kerne Probem. This new method is faster than any previousy known technique but sti requires exponentia time. In practice, we find that attacking PKP for the origina size proposed by Shamir in [6] coud be done on a singe PC in 125 years. 1 Introduction The Permuted Kerne Probem was introduced in cryptography by Shamir at Crypto 1989 [6]. This NP compete probem can be stated as foows: Given a m n matrix, a n vector V and a prime p Find a permutation π such that the permuted vector V π is in the kerne of the matrix moduo p. Any instance of the probem with this choice of parameters wi be denoted as a PKP p (m, n) probem. Without oss of generaity, the eft part of m n matrix can be turned into the identity sub-matrix, as expained in [6]. In [6], it was shown that this probem possesses a nice zero-knowedge proof and can thus be turned into an authentification scheme. Moreover, when used in practice the scheme offers a good eve of security using ony simpe computations which can be efficienty impemented, even in sma portabe devices. Since PKP is so simpe, and uses ony basic inear agebra, it is extremey tempting to search for it s weaknesses. This ed to many papers [3,1,2,5], which a concuded that the origina dimension proposed par Shamir are a bit too sma, but the scheme sti resists a known attacks. A the proposed attacks combine exhaustive search with some form of time-memory tradeoff. However, none of the cassica timememory tradeoff techniques seems to appy to this probem, and thus specific methods had to be deveoped in the previous papers. In this paper, we appy a K. Kim (Ed.): PKC 21, LNCS 1992, pp , 21. c Springer-Verag Berin Heideberg 21

2 166 Éiane Jaumes and Antoine Joux new time-memory tradeoff from [4] to the permuted kerne probem. This new technique was originay designed to repace the fina baby-step/giant-step when counting points on eiptic curves using the Schoof-Ekies-Atkies agorithm. 2 Genera Description of the Agorithm In this section, we reformuate the agorithm from [4] in a genera setting, without any reference to the specific probem of point counting on eiptic curve. In our genera setting, we want to sove the foowing probem: Given a n vector P whose entries are primes, four sets S 1, S 2, S 3 and S 4 of n vectors, and n sets D 1,..., D n Find v (1) S 1,v (2) S 2,v (3) S 3,v (4) S 4,d 1 D 1,..., d n 1 D n 1 and d n D n such that: i [1 n] : v (1) i + v (2) i + v (3) i + v (4) i d i (mod P i ) Ceary, this probem, which we note 4SET, can be soved by exhaustivey trying the N 1 N 2 N 3 N 4 possibe vaues of v (1),v (2),v (3) and v (4), where N i denotes the cardinaity of S i. We propose here a time-memory tradeoff that aows to sove this probem faster than exhaustive search. Without oss of generaity, we assume that: D 1 D 2 D n, P 1 P 2 P n where D i denotes the size of D i. Then, et α i = Di P i, choose k a positive integer smaer than n and et k k Ψ = α i and Φ = i=1 The agorithm then consists of a precomputation phase and of a main oop containing two enumeration phases, one invoving v (1) and v (2), the A-phase, and one invoving v (3) and v (4), the B-phase. Agorithm for soving 4SET Precomputation step: Sort the two sets S 2 and S 4, according to the exicographica order on the vector coordinates. In the seque, this wi permit to quicky find vectors in one of these sets given its first k coordinates. Main oop: For M 1 [ P 1 1], M 2 [ P 2 1],... M k [ P k 1] do: A phase: For each Θ D 1 D k, For v (1) S 1 and v (2) S 2 such that the first k coordinates 1 v (1) i + v (2) i match Θ i M i moduo P i, 1 Thanks to the precomputation step, such v (2) can be accessed quicky by computing Θ i M i v (1) i (mod P i) before searching the matching entries in the sorted set S 2. i=1 P i

3 Cryptanaysis of PKP: A New Approach 167 For a >kcompute and store the foowing set: H Θ,v (1),v (2), = {θ v (1) v (2) θ D }. B phase: For each v (3) S 3 and v (4) S 4 such that the first k coordinates v (3) i + v (4) i match M i, If there exists Θ D 1 D k,v (1) S 1 and v (2) S 2 such that for every >k,v (3) + v (4) (mod P )isinh Θ,v (1),v,, (2) Then v (1) i + v (2) + v (3) i + v (4) is a soution of the 4SET probem. Terminate 2.1 Practica Considerations In practice, buiding the sets H Θ,v (1),v (2), in the A-phase and checking their intersections in the B-phase can be done very efficienty. Indeed, a these sets can be stored in a singe array of bits. This array has n =k+1 P ines and one coumn for each pair (v (1),v (2) ). Each ine of this array can aso be seen as a bit string B,τ where τ {,...,P 1}. During the A-phase, we store a1inb,τ in the position corresponding to (v (1),v (2) )ifτ H Θ,v (1),v (2), and a otherwise. Note that a strings B,τ have the same ength, however this ength may vary from one round of the main oop to the next. On average, this ength is ΨN 1 N 2. During the B-phase, to check whether τ = v (3) + v (4) (mod P ) is in H Θ,v (1),v (2), for every and some pair (v (1),v (2) ), we simpy perform a ogica AND between the strings B,τ. If the resuting string is non-ni we have a soution, since any bit equa to 1 in this string corresponds to a pair (v (1),v (2) ) such that v (1) + v (2) + v (3) + v (4) is a soution of the 4SET probem. Note that, when the expected number of soutions of a 4SET probem is much smaer than 1, it is worthwhie not to test the ast conditions. Indeed, in that case, one can simpy remove the useess components and buid a simiar probem with fewer conditions. In fact, this approach was impicity used in [4] since some of the conditions found by the SEA agorithm where discarded for the fina step. On the contrary, PKP probems are usuay buit in such a way that a conditions are usefu and cannot be discarded (see section 4). 2.2 Anaysis of the Agorithm Precomputation step : The number of operations required to sort S 2 is O(N 2 og(n 2 )) and to sort S 4 it is O(N 4 og(n 4 )). Thus the time needed is O(max(N 2,N 4 ) og(max(n 2,N 4 ))). The tota memory required in this precomputation step is O(max(N 1,N 2,N 3,N 4 ) i og(p i)) because S 1 and S 3 must aso be stored, and because each vector can be represented with i og(p i) bits.

4 168 Éiane Jaumes and Antoine Joux Phase A : Ceary, the average number of pairs (v (1),v (2) ) constructed in each execution of phase A is ΨN 1 N 2. To do this construction, we enumerate a possibe vaues of Θ and v (1) and search for matching vaues of v (2). This requires O(N 1 og(n 2 )ΨΦ) operations. Then for each vaid pair (v (1),v (2) ), n k bits are to be set, the tota number of operations for this step is O((n k)ψn 1 N 2 ). A in a, the number of operations required is: O(max(N 1 og(n 2 )ΨΦ,(n k)ψn 1 N 2 )). n The tota memory needed to store a the sets is O(ΨN 1 N 2 i=k P i). Phase B : In each execution of phase B, N 3 N 4 /Φ pairs (v (3),v (4) ) are constructed. This construction requires O(N 3 og(n 4 )) operations. Then for each pair the ogica AND of n k of the strings constructed in phase A is computed. Since on average the ength of the strings is ΨN 1 N 2 the number of operations is O((n k)ψn 1 N 2 N 3 N 4 /Φ). A in a, each iteration of phase B costs : O(max(N 3 og(n 4 ), (n k)ψn 1 N 2 N 3 N 4 /Φ)). In term of memory compexity, phase B does not require any memory not aready used in the precomputation or in phase A. When the choice of parameters is reasonabe, the time compexity is dominated by phase B and can be expressed as : O((n k)ψn 1 N 2 N 3 N 4 ). Without going too far into the anaysis of the parameters, et say that a choice is reasonabe if a the N i are of the same order N, ifψ 1/N and if Φ does not become too arge. Moreover, in that case the memory needed is: O(N n P i ). i=k Note: With the agorithm as presented here Φ shoud not become arger than N 3/2. However, if we sighty modify it be transferring haf of Θ from phase A to phase B, Φ can grow up to N 2. Moreover, this transformation reduces the amount of memory needed, by shortening the sets stored during phase A. Since we sti need to store the sets, the memory requirement becomes: 3 Appication to PKP O(N n og(p i )). i=1 In order to appy the agorithm of the previous section to PKP, we need to buid sets S 1, S 2, S 3, S 4 and D 1, D 2,..., D n from a PKP instance. Before doing

5 Cryptanaysis of PKP: A New Approach 169 that, we wi sighty transform the PKP instance. Foowing [3], we can add one more inear equation to the PKP instance. This new equation stems from the simpe fact that the sum σ of the coordinates of the soution vector does not depend on the permutation π. Appying Gaussian eimination to the extended inear system, we find that the soution vector V π must verify: σ ) (A I m+1 V π =,. where A isa(m+1) (n m 1) matrix and I m+1 is the (m+1) (m+1) identity matrix. Ceary, in order to find a soution to the permuted kerne probem thus written, it suffices to try a the possibe vaues of the components of V π that enters A, to find the remaining components by Gaussian eimination and to check that the vector found is indeed a permutation of V. This agorithm requires n!/(n m 1)! trias. In the seque, we wi refer to it as being the exhaustive search technique for PKP, and we wi competey forget the simpe minded search where one tries a possibe vaues for π, which requires n! trias. We can now divide A into four roughy equa parts, and we find: σ ) (A 1 A 2 A 3 A 4 I m+1 V π =,. where A i isa(m +1) n i matrix and n 1 + n 2 + n 3 + n 4 = n m 1. We then buid the sets S i by computing the product of A i by a possibe choices of the corresponding n i bits. Ceary, the size of S i is N i = n!/(n n i )!. Once these sets are constructed, we can appy the agorithm from section 2. Note: In fact, the agorithm from section 2 can be further refined in the case of PKP. The idea is that whie merging together an eement of S 1 and an eement of S 2 in phase A or an eement of S 3 and an eement of S 4 in phase B, one shoud check their compatibiity, i.e. verify that put together they form a correct subset of V, which is true if and ony if they have no nontrivia intersection (assuming that V contains no doube). This reduces the term N 1 N 2 and N 3 N 4 in the compexities respectivey to n!/(n n 1 n 2 )! and n!/(n n 3 n 4 )!. 4Asymptotica Anaysis In order to make an asymptotica anaysis of our agorithm, we first need to describe an asymptotica version of PKP. For defining this version, we wi foow the two foowing criteria:

6 17 Éiane Jaumes and Antoine Joux Buiding a strong instance of PKP, shoud be easy. More precisey, this means that for any random matrix, finding a kerne vector with distinct coordinates shoud be easy. Since kerne vectors are chosen at random when buiding a PKP probem, this impies that the probabiity of a random kerne vector to have a distinct coordinates shoud not be too ow. Taking in account the birthday paradox, this means that n shoud be no arger that O( p). As expained in [6], the expected number of soutions of a PKP instance shoud be as near to 1 as possibe. This eads to the condition p m n!. Foowing these criteria et p = O(n 2 ), then: m n og n/ og p n/2 Using these two criteria, we propose PKP p (n, n/2 ) as a reasonabe asymptotic choice, where p is a prime near n 2. With this choice of parameters, an exhaustive search attack on PKP takes roughy n!/m! =O((2n/e) n/2 ) trias. For the attack described in section 3, we need to choose the parameter k and thus the vaue of Ψ. A particuary interesting choice is to use the same amount of storage for the sets S i and the strings. Assuming that N 1 = N 2 = N 3 = N 4, this eads to Ψ 1/N 1. Since N 1 = O((((8/7) 7 )(n/e)) n/8 ), we find that the time compexity of the agorithm is O((((8/7) 7 )(n/e)) 3n/8+ε ) and the space compexity is O((((8/7) 7 )(n/e)) n/8+ε ). The vaue ε in the exponent offers a simpe repacement for the non exponentia terms that shoud appear in these two formuas, and permits a simper expression. In fact, if we further take into account the note at the end of section 3, we can somewhat reduce the constant (8/7) 7 appearing in the time compexity. 5 Practica Resuts In practice, it turns out that the previous ideas ead to a faster attack against PKP, than a previousy known techniques. The best previous theoretica attacks against PKP are those from [2] and an impementation of these attacks is described in [5]. In the rest of this section we compare the avaiabe data for this attack with our resuts. In [2], the foowing resuts are found: Resuts from [2] Time needed Memory needed (in tupes) PKP 251 (16, 32) tupes tupes PKP 251 (37, 64)

7 Cryptanaysis of PKP: A New Approach 171 In order to make the same kind of evauation for our agorithm, we first need to compute the size of the sets S 1, S 2, S 3, S 4. Starting with PKP(16, 32), we take n 1 = n 2 = n 4 = 4 and n 3 =3,wefindN 1 = N 2 = N 4 = 8634 and N 3 = In order to have Ψ 1/N 1, we take k = 6 and find Ψ = (24/251) 6. With these choice, the space needed is dominated by the storage of the four sets S i, and 32 (N 1 + N 2 + N 3 + N 4 ) 2 26 bytes are needed. This may seem arger than the 2 24 in the above tabe, however this size was not in bytes but in 1 tupes, and thus both sizes are equivaent. The basic time estimate is ΨN 1 N 2 N 3 N However, recaing the note from section 3 it becomes Ψn! 2 /((n n 1 n 2 )!(n n 3 n 4 )!) Once again, this does not seem better than the vaue 2 52 in the above tabe. However, remember than our basic operation is a bit operation and that on most computers we can pack 32 or even 64 bit operations in a singe word operation, thus owering the compexity to As the size increases, the advantage of the new agorithm becomes much cearer. Indeed, for PKP(37, 64), we can take n 1 = n 3 =6,n 2 = n 4 = 7 and k = 17. Then Ψ = (48/251) k, the space needed becomes and the time needed However, whie better that the estimates from [2], these vaues are competey unreachabe. The foowing tabe shows the resuts of the new attack for various dimensions of PKP. New Resuts k Time needed Memory needed PKP 251 (16, 32) bytes PKP 251 (15, 32) bytes PKP 251 (24, 48) bytes PKP 251 (37, 64) bytes In [5], the attack described in [2] was truy impemented, and experiments were made. At that time, a singe workstation woud have taken 2 years for PKP(16, 32). In a private communication, the author from [5] tod us than on current machines, experiment showed that this estimate was owered to 7 years. The ratio between the two figures is much worse than expected because a these computations heaviy rey on memory usage. Since the speed of memory access did not increase as quicky as the speed of processors, this accounts for the ow ratio. By comparison, on the same machine (Pentium II, 4MHz), the new attack woud take 125 years (at most) to find the secret key of PKP(16, 32). Quite strangey, in a practica impementation, phase A takes proportionay much onger then phase B because in the former case we make random memory access (on singe bits) whie in the atter we read the memory in sequentia order. Consequenty, phase B is cache friendy whie phase A isn t. Moreover, we cannot use the theoreticay optima choice for k, because the code that contros the oop then becomes predominant. Thus our practica choices were n 1 =3, n 2 =4,n 3 =3,n 4 = 5 and k = 4. With these choices, each iteration of the main oop took just under a second, and the tota memory needed was 25 megabytes. Since iterations of the main oop are needed, a tota running time of 125 years is expected.

8 172 Éiane Jaumes and Antoine Joux 6 Concusion In this paper, we showed that the time-memory tradeoff technique for [4] coud be appied to the PKP probem. Very curiousy, this eads to an agorithm which presents simiarities with the agorithm from [2]. In practice, this new agorithm can attack PKP(16,32) about five times faster than a previous attacks. However, this attack woud sti require 125 years on a 45MHz PC. Since the agorithm is straightforward to paraeized, this computation is feasibe and PKP(16,32) can no onger be considered as secure. Moreover, PKP(15,32) which takes about 24 times as ong, is potentiay endangered and shoud no onger be used for ong-term appications. However, sighty arger probems such PKP(24,48) or PKP(37,64) are competey out of reach. References 1. T. Baritaud, M. Campane, P. Chauvaud, and H. Gibert. On the security on the permuted kerne identification scheme. In CRYPTO92, voume 74 of LNCS, pages , P. Chauvaud and J. Patarin. Improved agorithms for the permuted kernem probem. In CRYPTO93, voume 773, pages , J. Georgiades. Some remarks on the security of the identification scheme based on permuted kernes. Journa of Cryptoogy, 5: , A. Joux and R. Lercier. Chinese & Match, an aternative to atkin s match and sort method used in the SEA agorithm. Mathematics of Computation, To appear. 5. G. Poupard. A reaistic security anaysis of identification schemes based on combinatoria probems. European transactions on teecommunications, 8:471 48, A. Shamir. An efficient identification scheme based on permuted kernes. In CRYPTO89, voume 435 of LNCS, pages 66 69, 1989.