NTRU Modulo p Flaw. Anas Ibrahim, Alexander Chefranov Computer Engineering Department Eastern Mediterranean University Famagusta, North Cyprus.

Transcription

1 Internatonal Journal for Informaton Securty Research (IJISR), Volume 6, Issue 3, Setember 016 TRU Modulo Flaw Anas Ibrahm, Alexander Chefranov Comuter Engneerng Deartment Eastern Medterranean Unversty Famagusta, orth Cyrus Abstract TRU encryton s astandardzed ublc-key crytosystem whch s consdered faster than RSA and ECC.For encryton, TRU adds theroduct of. h* r to the lantext, where s a redefned ublc arameter, h s the ublc key, and r s a seudo-randomly generated blndng olynomal. For decryton, TRU uses two rvate keys.we rove that for some arameters TRU has the modulo flaw, so TRU-encryted lantext can be dsclosedjust by alyng modulo oeraton to the chertext wthout the need of usng any of TRU secret keys. We rovde also statstcal estmates of the robablty of havng TRU modulo flaw cases for dfferent values of, where s the order of olynomal rng used n TRU. The robabltes show that TRU modulo flaw may take lace rather often. TRU amendment to wthstand the flaw s roosed. 1. Introducton TheTRU s roosed n. [1], and standardzed as IEEE-1363 []. TRU s faster than RSA and ECC n encryton and decryton [3]. TRU moses certan constrants on ts arameters. We show that there exst some cases when TRUencryted lantext can be revealed wthout knowledge of ts rvate keys, just alyng modulo oeraton to the chertext[].the rest of the aer s organzed as follows. In Secton we rovde a bref descrton of TRU and gve an examle of TRU encryton-decryton. In Secton 3 the TRU modulo flaw s shown by examle; exlanatons are gven for the examle. In Secton,we resent statstcs of cases when TRU has modulo flaw for dfferent values. In Secton,TRU amendment s roosed to fx the flaw. In Secton 6, concluson s gven.. TRU Descrton and Examle of Encryton-Decryton We descrbe TRU accordng to[]..1 TRU Descrton TRU has four ostve nteger arameters, (,,, d ),and uses olynomals modulo P ( x) x 1 wth nteger coeffcents from the rng R Z[ x] ( x 1) where Z [ x] s the set of olynomals wth nteger coeffcents. A olynomal, a( x) R, looks as follows: TRU assumes that 1 a( x) a x [ a, a,..., a ] gcd(, ) gcd(, ) 1, (6d 1), s rme, d s an nteger defnng structure of used by TRU olynomals, f(x), g(x), r(x), ntroduced n Subsectons.1.1 and.1. farther. TRU uses subrngs, R R, wth coeffcents restrcted to Z kz, where R k s: where k ( Z/ kz)[ x] Rk, x 1 Z kz s a set of ntegers n the range 0,1,..., k 1 for any ostve k Z. Coyrght 016, Infonomcs Socety 68

2 Internatonal Journal for Informaton Securty Research (IJISR), Volume 6, Issue 3, Setember TRU Prvate and Publc Keys Generaton. For key generaton, TRU uses olynomals from T( d, d ) defned as follows (see (1), ()): 1 e r * h m mod. a has d coeffcents eual to 1, 1 ( d, d ) ( ) : coeffcents eual to -1, 1 a x R a has d the rest coeffcents eual to 0 TRU uses four rvate keys: f ( x), F ( x), F ( x), g( x ). The frst rvate key, f( x ), s generated as follows (see (3), (6)): x f0 f1 1 f ( ) [,,..., f ] ( d1, d). The rvate key (7), f( x ), must have nverses modulo and, that s, F ( x), F ( x), resectvely, used as the second and thrd rvate keys: f * F 1 (mod ) and f * F 1 (mod ) where '*' denotes olynomal multlcaton n R (see ()). The fourth rvate key, g(x), s randomly chosen as follows (see (6)): g( x) ( d, d). The ublc key, hx, ( ) s comuted usng (8), (9) as follows h F * g mod..1.. TRU Encryton.The lantext message mx ( ), s assumed to meet the followng condton:.1.3. TRU Decryton. Decryton n TRU conssts of Stes 1 and descrbed below. Ste 1: The frst rvate key, f( x ), s aled to (13): where (8) and (10) are used. Ste : The second rvate key, (1)after a s center-lfted a f * e mod r * g f * m mod F s aled to m a* F mod where(8) s used and the contrbutor wth factor n (1) vanshes due to the constrants (), (7)-(9), (1) mosed whch guarantee that sum n the rghtmost exresson n (1) s a olynomal wth coeffcents strctly less than, so that mod oeraton, aled last n (1), does not change the coeffcents.. Examle of TRU Key Generaton and Encryton-Decryton Examle 1. Let accordng to (), ; d 1; 3; 3 (6d 1) 1 Let accordng to (7), m( x) R. 3 f ( x) x x 1 [ 1,0,1,1,0] Moreover, the coeffcents of m are assumed to 1 1 be center-lfted,.e. to be n (, ]. For examle, f s odd eual to, then normally the coeffcents are from 0,, but after center-lftng, they are n -,,. And f s eual to, then center-lfted coeffcents are n -1,,. A seudorandomly generated blndng olynomal, rx, ( ) s chosen as follows: r( x) ( d, d). Chertext, ex ( ), s comuted usng (10) -(1) as Then, accordng to (8), F x x 31 F x x Let us check (18) usng (17): f ( x)* F ( x) 3 ( x x 1)( x x 31) 7 6 x x 31x 31x 1 1 mod( x 1) mo d Coyrght 016, Infonomcs Socety 686

3 Internatonal Journal for Informaton Securty Research (IJISR), Volume 6, Issue 3, Setember 016 f ( x)* F ( x) 3 ( x x 1)( x x ) 7 6 x x x x1 1 mod( x 1) mod Let accordng to (9), (11) and (1), gx ( ), rx, ( ) and mx ( ) are selected as, rx ( ) x 1 g( x) x 1 m x x x R ( ) 1 Publc key, h, accordng to (10), (18), (19) s h F * g mod ( x x 31)*( x 1) x 31x x 30x 1 31x x 30x mod( x 1) mod 3 Chertext accordng to (13), (19)-(1), s: e ( r * h m) mod (3.( x 1) * (31x x 30x ) x x 1mod 3 3x 3x x 13x To decryt chertext (), aly Ste 1 (1) usng (17) a f * e mod 3 ( x x 1)( 3x 3x x 13x ) mod 3 x x 3x x 3 In Ste, the message (0) s retreved usng (1), (18), and center-lfted a wth resect to from (3): m F * a mod ( x x ) ( x x 3x 7x 3 ) mod3 x x1 Thus, n (), we get back the lantext, mx ( ), from (0). We see that TRU encryton-decryton rocedure (11)-(1),from[], works correctly n the Examle. 3. TRU Modulo Flaw Examle and Its Exlanaton 3.1. TRU Modulo Flaw Examle Consder agan the Examle 1 of TRU encryton-decryton from Secton.. Frst, we center-lft the chertext () wth resect to 3, e 3x 3x x 13x mod 3x 3x 8x 13x 8mod Then alyng modulo oeraton drectly to the center-lfted chertext (), we also dsclose the orgnal lantext, mx ( ), from(0), as follows m e mod ( 3x 3x 8x 13x 8) mod 3 x x1 Comarng (6) and (0), we see that actually, the lantext s restored wthout any key, by knowledge of the ublc value of ublc arameter only. Thus, the examle reresents TRU flaw that we call modulo flaw. 3.. TRU Modulo Flaw Examle Exlanaton The reason of TRU modulo flaw s that n the encryton (13) t mght haen that the olynomal used for hdng the lantext, mx ( ), from (11), A r * h [,..., ] 0 1 has all ts coeffcents by absolute value less than. for {0,..., 1}, In such a case, modulo oeraton used n (),reserves A beng a multle of that can be elmnated from () just by modulo oeraton aled to the chertext, e, as we exactly made n (6). For the TRU modulo flaw realzaton, we need fndng such nverse of (7) that the roducts (10), (7) used n (13), have coeffcents by absolute value less than (see (8)). Hence, we need fndng deendence of the roducts coeffcents on the coeffcents of (7). It s done n the next Subsecton Then, n Subsecton 3.., we fnd such olynomal (7) that the roduct (7) be more lkely to havecoeffcents by absolute value less than Fndng Inverse of the Polynomal f() x Modulo x 1 Consder fndng of an nverse, 1 f ( x) [ b0, b1,..., b 1], of (7) n R. P ( x) x 1 Coyrght 016, Infonomcs Socety 687

4 Internatonal Journal for Informaton Securty Research (IJISR), Volume 6, Issue 3, Setember 016 By defnton, 1 f ( x) f ( x) c( x) P ( x) 1 c( x) c x 0 f3 f f1 f0 f f f1 f0 f f 3 f1 f0 f f3 f f0 f f3 f f1 f f3 f f1 f 0 From (7), (9) -(31): f jbk x c x c x 0 jk, 0 0 j, k ( ) 1 Euatng coeffcents near resectve owers, we get from (3) the followng system of lnear algebrac euatons wth resect to unknowns b,.., b, c,.., c Determnant of (0), det( ), calculated usng Male 1, s as follows (Fgure 1): Fgure 1. Defnton of matrx (0), and ts determnant, n Male 1 Rght hand sde, RHS, of euatons (37) -(39), for s as follows RHS (0,0,0,1,0) Usng Cramer s rule[6], fnd 1 f jb j c, for,..., j 1 det( ) b, for 0,..., 1, det( ) 1 fb j 1 j 0 j 0 f jb j c, 1,..., j 0 1 f0b0 c0 Preservng b0,.., b 1 only, from (33) -(36), we get 1 f b f b 0, for,..., 1 j j j j j 0 j 1 1 f0b0 f jbj 1 j1 1 f 1 jbj 0 j 0 For, the matrx of coeffcents n (37) -(39) s as follows where the matrx s the matrx wth column relaced by RHS (0, 0, 0,1, 0), whch s the rght sde of(). Dvson n () s made modulo or to fnd or F F from (8) resectvely. For correctness of the dvson n (), determnant n the denomnator shall have multlcatve nverse modulo and, and shall be co-rme to them. For arbtrary determnants, thernverses may be rather large ntegers resultng n large coeffcents b n (), hence, leadng to large coeffcents n h (10), and, thus, to volaton of (8). To mnmze the coeffcents, we need the absolute value of the determnant value, det( ) (see (0)),eual to 1. Such a case s consdered n the next Subsecton 3.. and was used n the Examle1 n Secton Gettng det( ) 1. For the olynomal (17) used n Examle 1 n secton., from (0) and Fgure1, we have, det( ) 1 det( 0) 1;det( 1) 1; det( ) 0; det( ) 0; det( ) 1. 3 By substtutng (3), () nto (1), 1 f x x x ( ) 1 From (8),(), we get (18). Coyrght 016, Infonomcs Socety 688

5 Internatonal Journal for Informaton Securty Research (IJISR), Volume 6, Issue 3, Setember 016. Estmate of the Probablty of TRU Modulo Flaw As dscussed n Secton 3..1, we need the determnant value, det( ), be eual to 1 n order to mnmze coeffcents (). The crucal ueston s how robably a user wll choose ermutaton of 1 coeffcents of (7) that ends u wth det( ) 1 (0), to answer ths ueston we conducted statstcal exerment for ( =,7, and 11), results of whch are shown n Table 1 and Fgure. These robabltes estmate roughly robablty of the TRU modulo flaw snce (8) most lkely mght haen n the cases when (3) holds. However, n Examle below, we show that (8) may be not true and TRU modulo flaw s not alcable for the case of (3) holdng. Table1.Probablty of det( ) 1 o. of ermutatons wth det( ) 1 Total umber of ermutatons Probab -lty 10 0 % % % Probablty 30% % 0% 1% 10% % 0% 7 11 Value of Fgure. Probablty of det( ) 1Deendence on. As we can notce from Table 1 and Fgure, the robablty of choosng ermutaton of 1 coeffcents of (7) that ends u wth (3) holdng s very hgh at low value of, where robablty s % and we see that robablty of (3) holdng dros to 1.% when 11,.e. therobablty of (3) holdng decreases wth the growth of.choosng ermutaton of 1 coeffcents of (7), that ends u wth (3) holdng, doesn t guarantee (8) to hold snce the roduct (7) deends on the value of olynomal (9) used n (10) and olynomal (1) used n (7). In the followng Examle, we show a case when(3) holds but (8) doesn t hold and TRU modulo flaw s not alcable n that case. Examle. Let us consder Examle 1but nstead of (19), gx ( ) and rxare ( ) as follows, rx ( ) x g 3 ( x) x 1 We also udate (16) to be as follows, x ; d 1; 3; 3 (6d 1) 1 We have shown n Secton 3.. that (3) holds for the olynomal f(x) (17) from Examle 1. Publc key, h, accordng to (10), (18), () s h F * g mod ( x x )( x 1) 1x x x 8 ( x x 1x x 1) mod( x 1) mo 3 Chertext accordng to (13), (18), (6), (7) s: e ( r * h m) mod 3 3 (3 ( x x )*( 1x x x ) x x1) mod 3 1x 1x 1x x d3 After obtanng chertext, ex ( ) n (8), we try to aly TRU modulo flaw stes ntroduced n Subsecton3.1. Frst, we center-lft the chertext (8) wth resect to 3, e 1x 1x 1x x mod 9x 11x 8x x mod Then alyng modulo oeraton drectly to the center-lfted chertext (9), we get message, m, that s not same as the lantext message,, mx ( ),from (0), and, hence, the TRU modulo flaw doesn t work n that case: m e mod ( 9x 11x 8x x ) mod 3 3 x x x 1 x x1 Coyrght 016, Infonomcs Socety 689

6 Internatonal Journal for Informaton Securty Research (IJISR), Volume 6, Issue 3, Setember 016 Thus, Examle shows that n ste of (8) holdng, condton (8) for TRU modulo alcablty does not hold, and alyng modulo oeraton to the chertext (9) after center-lftng n (8), we do not get back the lantext (0) n (0).. TRU Amendment to Fx TRU Modulo Flaw TRU constrants () guarantee correctness of decryton rocess (1), (1). But these constrants donot guarantee that at least one of the roduct (7) coeffcents s exceedng the value of n absolute value. To fx the TRU modulo flaw secfed n the resent aer, an amendment must be made so that n addton to (), t s necessary that the followng condton shall hold: M. F [ M0,..., M 1] for {0,..., 1}, M. Thus, the roduct, F, shall have at least one coeffcent exceedng by the absolute value. If condton (1) holds, elmnatng of the roduct, A, from euaton (7) by modulo oeraton s generally not ossble because at least one term n the roduct maybe not a multle of. However, n ste of the condton of alcablty of the modulo flaw s volated f (1) holds, t s not excluded an oortunty that modulo oeraton reveals a lantext, and ths ueston needs further nvestgaton. so that lantext generally cannot be revealed usng modulo oeraton. 7. References [1] Hoffsten, J., J. Pher, and J.H. Slverman, TRU: A rng-based ublc key crytosystem, n Algorthmc umber Theory: Thrd Internatonal Symosun, ATS-III Portland, Oregon, USA, June 1, 1998 Proceedngs, J.P. Buhler, Edtor. 1998, Srnger Berln Hedelberg: Berln, Hedelberg []IEEE Standard Secfcaton for Publc Key Crytograhc Technues Based on Hard Problems over Lattces. IEEE Std , 009:. C1-69. [3]Hermans, J., F. Vercauteren, and B. Preneel, Seed Records for TRU, n Tocs n Crytology - CT-RSA 010: The Crytograhers Track at the RSA Conference 010, San Francsco, CA, USA, March 1-, 010. Proceedngs, J. Perzyk, Edtor. 010, Srnger Berln Hedelberg: Berln, Hedelberg []Chefranov, A. and A. Ibrahm. TRU Mod Flaw. n World Congress on Internet Securty (WorldCIS-016) Infonomcs Socety. htt:// Proceedngs.df []Hoffsten, J., J. Pher, and J.H. Slverman, Lattces and Crytograhy, n An Introducton to Mathematcal Crytograhy. 01, Srnger ew York: ew York, Y [6]Strang, G., Cramer s Rule, Inverses, and Volumes, n Introducton to Lnear Algebra. 016, Wellesley- Cambrdge Press. 6. Concluson In ths aer, we resented TRU modulo flaw by constructon of an examle of a lantext decryton just alyng modulo oeraton to the chertext. We exlaned that the flaw haens when all coeffcents of (7) are less than n absolute value. In ths case, A from (7) has coeffcents that are multles of whch can be elmnated by modulo oeraton. We also resented statstcs of robablty of the determnant (39) absolute value gettng eual to 1 that n many cases allows alcaton of TRU modulo flaw. We consdered deendence of the robablty on, the order of the olynomal (1). These statstcs shows that the robablty decreases wth the growth of.to fx the TRU modulo flaw, we roosed an amendment to TRU by extendng condton () by condton (1) guaranteeng that at least one coeffcent of (7) s exceedng n absolute value Coyrght 016, Infonomcs Socety 690