CHAPMAN & HALL/CRC CRYPTOGRAPHY AND NETWORK SECURITY ALGORITHMIC CR YPTAN ALY51S. Ant nine J aux

Transcription

1 CHAPMAN & HALL/CRC CRYPTOGRAPHY AND NETWORK SECURITY ALGORITHMIC CR YPTAN ALY51S Ant nine J aux (g) CRC Press Taylor 8* Francis Croup Boca Raton London New York CRC Press is an imprint of the Taylor & Francis Group an informa business A CHAPMAN & HALL BOOK

2 Contents Preface I Background 1 A bird's-eye view of modern cryptography Preliminaries Typical cryptographic needs Defining security in cryptography Distinguishes Integrity and signatures Authenticated encryption Abstracting cryptographic primitives 21 2 Elementary number theory and algebra background Integers and rational numbers Greatest common divisors in Z Binary GCD algorithm Approximations using partial GCD computations Modular arithmetic Basic algorithms for modular arithmetic Primality testing Specific aspects of the composite case Univariate polynomials and rational fractions Greatest common divisors and modular arithmetic Derivative of polynomials Finite fields The general case The special case of F 2 n Solving univariate polynomial equations Vector spaces and linear maps The RS A and Diffie-Hellman cryptosystems RSA Diffie-Hellman key exchange 65

3 II Algorithms 3 Linear algebra Introductory example: Multiplication of small matrices over F Dense matrix multiplication Strassen's algorithm Asymptotically fast matrix multiplication Relation to other linear algebra problems Gaussian elimination algorithms Matrix inversion Non-invertible matrices Hermite normal forms Sparse linear algebra Iterative algorithms Structured Gaussian elimination Sieve algorithms Introductory example: Eratosthenes's sieve Overview of Eratosthenes's sieve Improvements to Eratosthenes's sieve Finding primes faster: Atkin and Bernstein's sieve Sieving for smooth composites General setting Advanced sieving approaches Sieving without sieving Brute force cryptanalysis Introductory example: Dictionary attacks Brute force and the DES algorithm The DES algorithm Brute force on DES Brute force as a security mechanism Brute force steps in advanced cryptanalysis Description of the SHA hash function family A linear model of SHA Adding non-linearity Searching for collision instances 179

4 5.5 Brute force and parallel computers The birthday paradox: Sorting or not? Introductory example: Birthday attacks on modes of operation Security of CBC encryption and CBC-MAC Analysis of birthday paradox bounds Generalizations Finding collisions Sort algorithms Hash tables Binary trees Application to discrete logarithms in generic groups Pohlig-Hellman algorithm Baby-step, giant-step algorithm Birthday-based algorithms for functions Algorithmic aspects Floyd's cycle finding algorithm Brent's cycle finding algorithm Finding the cycle's start Value-dependent cycle finding Analysis of random functions Global properties Local properties Extremal properties Number-theoretic applications Pollard's Rho factoring algorithm Pollard's Rho discrete logarithm algorithm Pollard's kangaroos A direct cryptographic application in the context of blockwise security Blockwise security of CBC encryption CBC encryption beyond the birthday bound Delayed CBC beyond the birthday bound Collisions in hash functions Collisions between meaningful messages Parallelizable collision search 244

5 7.6 Hellman's time memory tradeoff Simplified case General case Birthday attacks through quadrisection Introductory example: Subset sum problems Preliminaries The algorithm of Shamir and Schroeppel General setting for reduced memory birthday attacks Xoring bit strings Generalization to different groups Working with more lists Extensions of the technique Multiple targets Wagner's extension Related open problems Some direct applications Noisy Chinese remainder reconstruction Plain RSA and plain ElGamal encryptions Birthday attack on plain RSA Birthday attack on plain ElGamal Fourier and Hadamard-Walsh transforms Introductory example: Studying S-boxes Definitions, notations and basic algorithms Fast linear characteristics using the Walsh transform Link between Walsh transforms and differential characteristics Truncated differential characteristics Algebraic normal forms of Boolean functions Goldreich-Levin theorem Generalization of the Walsh transform to p Complexity analysis Generalization of the Moebius transform to p Fast Fourier transforms Cooley-Tukey algorithm Rader's algorithm 300

6 9.5.3 Arbitrary finite abelian groups Lattice reduction Definitions Introductory example: Gauss reduction Complexity analysis Higher dimensions Gram-Schmidt orthogonalization Lenstra-Lenstra-Loväsz algorithm Shortest vectors and improved lattice reduction Enumeration algorithms for the shortest vector Using shortest vectors to improve lattice reduction Dual and orthogonal lattices Dual of a lattice Orthogonal of a lattice Polynomial systems and Gröbner base computations General framework Bivariate systems of equations Resultants of univariate polynomials Application of resultants to bivariate systems Definitions: Multivariate ideals, monomial orderings and Gröbner bases A simple example: Monomial ideals General case: Gröbner bases Computing roots with Gröbner bases Homogeneous versus affine algebraic systems Buchberger algorithm Macaulay's matrices Faugere's algorithms The F4 approach The F 5 approach The specific case of F Choosing and changing monomial ordering for Gröbner bases Algebraic attacks on multivariate cryptography The HFE cryptosystem 363

7 Experimental Gröbner basis attack Theoretical explanation Direct sparse approach on Macaulay's matrix On the complexity of Gröbner bases computation 367 III Applications 12 Attacks on stream ciphers LFSR-based keystream generators Correlation attacks Noisy LFSR model Maximum likelihood decoding Fast correlation attacks Algorithmic aspects of fast correlation attacks Algebraic attacks Predicting an annihilator polynomial Extension to some non-linear shift registers The cube attack Basic scenario for the cube method Time memory data tradeoffs Lattice-based cryptanalysis Direct attacks using lattice reduction Dependence relations with small coefficients Some applications of short dependence relations Coppersmith's small roots attacks Univariate modular polynomials Bivariate polynomials Extension to rational roots Security of RSA with small decryption exponent Elliptic curves and pairings Introduction to elliptic curves The group structure of elliptic curves Double and add method on elliptic curves Number of points on elliptic curves The Weil pairing Weil's reciprocity law 424

8 The Weil pairing on -torsion points The elliptic curve factoring method Pollard's p- 1 factoring Elliptic curve factoring Index calculus algorithms Introduction to index calculus A simple finite field example Overview A toy example Generalization to finite fields with small enough characteristic Overview of the regular function field sieve Introduction to the number field sieve Factoring with the quadratic sieve Discrete logarithms with the Gaussian integer method Constructing number field sieve polynomials Smoothness probabilities Computing smoothness probabilities for polynomials Asymptotic lower bound on the smoothness probability Smoothness probabilities for integers 467 References 471 Lists 491 Index 497