The Hidden Root Problem

Transcription

1 EPFL 2008

2 Definition of HRP

3 Let F q k be a finite field where q = p n for prime p. The (Linear) Hidden Root Problem: let r N0 be given and x F q k hidden access to oracle Ox that given (a, b) F 2 q k returns ξ a,b = (ax + b) r goal: find x given access to oracle Hidden Root Problem: oracle returns ξ ad,a d 1,...,a 0 = (a d x d + a d 1 x d a 0 ) r Subfield HRP: x F q.

4 If gcd(r, q k 1) = 1, then r-th powering is permutation on F q k, so ξ a,b determines (ax + b) uniquely. ax + b = ξ (r 1 mod (q k 1)) a,b Similarly, if d = gcd(r, q k 1), can undo permutation defined by (r/d)-th powering. New definition of HRP: let r N 0 with r (q k 1) be given. Notation: s = (q k 1)/r.

5 What s in a Name? Recall the Hidden Number Problem: hidden x F p for p prime for many random t F p are given MSB l,p (xt) the l most significant bits of xt mod p. goal: recover x. for r (q k 1), r-th powering is an r to 1 mapping on F q k. only getting log 2 (s) bits of information for each query. Heuristically: x determined uniquely after log s (q k ) queries.

6 Let F p be finite field with p > 2 prime. The Legendre symbol is defined as ( ) x = p 1 if x is a quadratic residue mod p 1 if x is a quadratic nonresidue mod p 0 if p divides x Closed expression is ( ) x x (p 1)/2 mod p. p

7 HRP for r = (p 1)/2. For chosen pairs (a i, b i ) F 2 p, are given Goal: find secret x. ( ) ai x + b ξ ai,b i = i = (a i x + b i ) (p 1)/2. p Note: for every query, receive 1 bit of information, so need at least log 2 p queries.

8 Relation with DLP & CDH Let G, be a group of prime order p. DLP: Given a tuple (g, g a ) compute a. CDH: Given a triple (g, g a, g b ) compute g ab. DDH: Given a quadruple (g, g a, g b, g c ) decide if g ab = g c. Well known that DDH P CDH P DLP. Maurer-Wolf: reduction DLP P CDH given an elliptic curve over F p of smooth order.

9 Relation with DLP & CDH If can solve the Legendre symbol HRP, then DLP P CDH. Given h = g x, find x. For random (a i, b i ) compute h i = g (a i x+b i ) as h a i g b i. By calling CDH oracle, can compute in exponent, e.g. CDH(h i, h i ) = g (a i x+b i ) 2 Using CDH-square-multiply can finally compute g (a i x+b i ) (p 1)/2 = g ai x+b i p = g ±1 So we know Legendre symbol of (a i x + b i ). Solving Legendre symbol HRP, then returns DLP x.

10 Solution Set Given ξ a,b = (ax + b) r, the solution set is S a,b = a 1 (ξ 1/r a,b µ r b) where µ r F q k are r-th roots of unity and ξ 1/r a,b a random r-th root. The goal is to find {x} = ai,b i S ai,b i for many (a i, b i ). Note: not good approach since for every equation new unknown...

11 Sampleability Sampleability: need to compute random root ξ 1/r a,b if gcd(r, (q k 1)/r) = 1, then easy since can take ξ (r 1 mod (q k 1)/r) a,b if gcd(r, (q k 1)/r) > 1, then in general exponential in r

12 : version 0.0 Main idea: consider Weil restriction of A 1 (F q k ) over F q and analyze r-th powering as a map on A k (F q ). Write F q k Denote ψ : F q k = F q [z]/(f (z)) with f (z), monic and irreducible. A k (F q ) : a = k 1 i a i z i [a 0,..., a k 1 ]. Note: q i -th powering is linear operator on A k (F q ), i.e. ψ(a qi ) = F i ψ(a) t for an easily computed k k matrix F i.

13 : version 0.0 Write r = k 1 i=0 c iq i k 1 i=0 d iq i with 0 c i, d i q/2. Every pair (a, b) then gives an equation of the form k 1 k 1 (a qi x qi + b qi ) c i = ξ a,b (a qi x qi + b qi ) d i. i=1 i=1 Weil restriction gives system of non-linear equations k equations k unknowns x0,..., x k 1 degree is D = max{ k 1 i=0 c i, k 1 i=0 d i}

14 : version 0.0 Each pair (a, b) gives non-linear system of degree D with k equations in k unknowns Solving overdetermined system of equations is easy using relinearization For each possible monomial introduce new variable and solve (huge) linear system of equations. Total number of monomials in k variables of degree D is ( ) k + D = D (k + D)(k 1 + D) (D + 1) k! Complexity then is O( ( ) k+d ω) D ops in Fq with ω 3

15 : Example Let k = 6 and F p 6 = F p [z]/(z 6 + z 3 + 1) for p 2, 5 mod 9. Recall that x 6 1 = Φ 1 (x)φ 2 (x)φ 3 (x)φ 6 (x). Let r = Φ 1 (p)φ 2 (p)φ 3 (p) = p 4 + p 3 p 1, so r-th powering maps into torus T 6 (F p ). Every pair (a, b) then gives rise to equation (ax + b) p4 (ax + b) p3 = ξ a,b (ax + b) p (ax + b) 6 non-linear equations over F p in 6 unknowns of degree monomials, so would need 5 pairs (a, b) to solve for x.

16 : version 0.0 If we are solving subfield HRP, i.e. where x F q, then method gives k univariate equations of degree D. Simply computing GCD s amongst these gives solution x. Subfield HRP for small D is very easy!

17 : version 0.1 Problem: most r do not have low weight signed expansion in base q. Solution: instead of working with r, use a multiple of r. Recall: x k 1 = m k Φ m(x) with Φ m (x) the m-th cyclotomic polynomial. Since r q k 1, can determine a Π(x) := m k,m S Φ m(x) S index set, subset of divisors of k such that r Π(q) Π(x) has lowest possible D, i.e. lowest possible max of sum of positive coeffs and minus the sum of the neg coeffs If Π(x) x k 1, then succeed!

18 : version 0.1 Let r Π(q) with Π(x) = m k,m S Φ m(x) Each pair now gives equation of the form (ax + b) Π(q) = ξ Π(q)/r a,b Since Π(x) x k 1, the above equation is non-trivial. Can now apply version 0.0 for r = Π(q) which has low Hamming weight! Only fails for r which have Π(x) = x k 1.

19 : version 0.2 Finding sparse (in base q) multiples of r can also be done using LLL. Build lattices generated by vectors re i and ( q i mod r)e 0 + e i for i = 0,..., k 1. The i-th column corresponds to q i and all rows are 0 mod r. Finding short vectors in lattice gives sparse representations. Could do heuristic computations on how sparse...

20 Application to Pairings Pairing = bilinear map e(, ) : G 1 G 2 G T with G 1 E(F q k ), G 2 E(F q ), G T F q. k Have G 1 = G 2 = G T = N Pairing inversion problem: for given P, invert e(p, ). Pairing can be written in form e(p, Q) = f s,p (Q) (qk 1)/N for some function f s,p on curve E (depending on P). For some curves f s,p is extremely simple.

21 Application to Pairings Example: on curves with trace t = 1, the function (P, Q) ( y Q λ(p)x Q ν(p) ) (q k 1)/N defines a non-degenerate pairing on G 2 G 1. Pairing inversion then is variant of HRP! Due to linearity can generate many equations for the same unknown Q. In this case however: N Φ k (q), so Π(x) = x k 1. Need to investigate if (q k 1)/N can ever have sparse representation...

22 Conclusion Defined new (supposedly hard) problem HRP. Related to CDH/DLP and pairing inversion. Solved many instances of HRP over extension fields. Any constructive applications? Find more relations with classical problems?