New Definition of Density on Knapsack Cryptosystems

Transcription

1 New Defiitio of Desity o Kasac Crytosystems Noboru Kuihiro The Uiversity of Toyo, Jaa 1/31

2 Kasac Scheme rough idea Public Key: asac: a={a 1, a,, a } Ecrytio: message m=m 1,, m C = i= 1 m i a i Decrytio or Attac: Solve the equatio to recover m 1,, m. Security? /31

3 Subset Sum Problem Iut:asac a={a 1, a,, a } C = i= 1 m a i i, = i= 1 m i Outut: m 1,, m m, m, {0,1} 1, K m Hammig weight of subset Subset sum roblem is NP-hard. So, the asac scheme seem to be difficult to brea. But... 3/31

4 May Kasac Schemes were Broe. Lagarias-Odlyzo itroduced desity : d = log A,whereA=max{a i } ad is a message legth. They roved that if d <0.6463, the asac scheme is broe by lattice attac. low desity attac. Coster et al. imroved the boud to May schemes were broe by low desity attac. 4/31

5 Shortest Vector Problem A lattice is defied by a set of all itegral liear combiatio of liearly ideedet vectors: v 1, v,, v m. r L v 1 r,..., v m r = xiv i= 1 m i : x i Z Shortest Vector Problem SVP: fid a shortest o-zero vector v i L. SVP is NP-hard uder radomized reductios. But, it is ow that some lattice reductio algorithms solve SVP i ractice if the dimesio is moderate. 5/31

6 Remars o Lattice Attac: I our resetatio, a scheme is broe by lattice attac if we ca use the oracle which solves SVP, the asac scheme is broe. NOT totally broe. If the dimesio is high , SVP is ot solvable i ractice. 6/31

7 How to Prevet Low Desity Attac? Some desigers choose to reduce the Hammig weight of messages. By reducig the Hammig weight, the message legth will be log. The desity becomes larger. Remember: d = log A Chor-Rivest roosed low-weight asac scheme. Oamoto-Taaa-Uchiyama OTU also roosed aother tye of low-weight scheme. 7/31

8 Low Weight Kasac Crytosystem uiformly distributed m bit strig bit strig with Hammig weigh, but ot uiformly distributed, whose Shao Etroy is m< Message M1, K, M m ecode m1, K, m ecryt C reversible isecure chael M1, K, M m decode m1, K, m decryt attac C 8/31

9 Security of Low Weight Kasac Scheme By reducig the Hammig weight, desities of Chor-Rivest ad OTU schemes are larger tha 1. Exerimetal results by Schorr-Horer, Omura-Taaa ad Izu et al. show that low weight scheme ca be broe by lattice attac eve if the desity is larger tha 1. Nguye-Ster itroduced aother id of desity: seudo-desity. They theoretically roved that if seudo-desity is low, low weight schemes are broe by lattice attac. 9/31

10 Lattice Attac o Kasac Crytosystem 1. Costruct a lattice from a asac a ad a cihertext C.. Obtai the shortest vector i the lattice by usig LLL etc. Kow Facts 1 desity or seudo-desity is sufficietly low Shortest vector corresod to real solutio of subset sum roblem, that is, message Kow Facts the dimesio is small we ca obtai the shortest vector by LLL algorithm i ractical time. 10/31

11 Motivatio of Our Research What is relatio betwee usual desity ad seudo-desity? If the Hammig weight of message is high, we should use usual desity. If the Hammig weight of message is low, we should use seudo-desity. If the Hammig weight is ot so low ad ot so high, what should we use? If we have uified desity, we do t have to bother which of desity should we use. So, we eed uified desity. We must rewrite coditios for uified desity. 11/31

12 Our Cotributios 1. itroduce ew defiitio of desity D which aturally uifies two desities.. derive coditios for our desity so that a asac scheme is broe by lattice attac D< show that it is quite difficult to costruct a low weight asac scheme which is suorted by a argumet of desity. 1/31

13 Two Variatios of Defiitio of Desity usual desity seudo-desity d = log Lagarias et al. roved that if d < , Coster et al. roved that if d < , a scheme is broe by lattice attac. A κ = log log A for small Nguye-Ster roved that if κ is low, a scheme is broe by lattice attac. 13/31

14 New Defiitio of Desity D = H log A, where Hx is a Etroy fuctio: Hx=-xlog x-1-xlog 1-x. or, sice D m = m log H A 14/31

15 Remars o Our Desity Remar1: Lagarias-Odlyzo also remared that their desity is exlaied as message legth d = cihertext legth that is, so called, iformatio ratio. H / log A Remar: our desity: D = = dh / Ituitively, ormalizatio of the desity by multilyig H/. 15/31

16 Our Defiitio Uifies two Desities Radom message: Suose M i is 0 with robability 1/ ad 1 with rob.1/. 1 Sice =/ with overwhelmig robability by the law of large umbers, H/=H1/=1. So, D=d. Iformatio theoretic meaig True radom strig caot be comressed ay more. So, =m ad D=d. 16/31

17 Low Weight Case Suose <<. 1 H log = log = log log + 1 log 1 log 1 So, D κ Iformatio theoretic meaig Oe easy ecodig for strig with low Hammig weight Bit ositio of 1 is rereseted by log bit. The umber that bit is 1 is. So, we ca rereset this sequece at most log. This ecodig is effective oly for small. 17/31

18 The Coditio for Uique Decrytability The ecessary coditio for uique decrytio is A. The, D = m A log 1+ log log A < 1+ By eglectig a small term, we have D 1. Remar1: This meas that our desity is ormalizatio of d. Remar: Our desities of Chor-Rivest ad OTU are less tha 1. 18/31

19 Coditio for Success of Lattice Attac We have to rewrite the success coditio of lattice attac by usig our desity D. Our aalysis is based o Nguye-Ster Asiacryt005 We will show that If D<0.8677, the scheme is broe by lattice attac. More recisely, if D < g CJ /, the scheme is broe by lattice attac. These coditio is valid for both of radom message case ad low weight message case. 19/31

20 Prelimiaries of Aalysis Defiitio: N, is the umber of iteger oits i the -dimesioal oits shere of radius cetered at the origi. Theorem 4 i Nguye-Ster005 If a lattice is costructed as lie Lagarias-Odlyzo, the robability that the shortest vector is ot equal to ±m is less tha 1/ N, A Remar: is the Hammig weight of message. 0/31

21 Evaluatio of N, Mazo-Odlyzo aalyzed N, i details. N, N, / / L 1.068L If / is costat, N, is exoetial of. But, if is extremely small, we eed aother evaluatio. Lemma1 i NS05 N, + 1 1/31

22 / H Precise Evaluatio of N, for small / / 1 1 H H + We will trasform it ito aother style by usig iequality betwee the umber of combiatio ad Shao Etroy Roughly, Nguye-Ster trasformed the iequality ito!, 1/ e N /31

23 Precise Evaluatio of N, for small cot. The, we have N, + H / + = + + H / + Lettig =/, we have log N, H /1 + f deeds o oly 3/31

24 Coditio for Success of Lattice Attac log Pr < N, log A = f = f H D H D If f -H /D is egative, the shortest vector corresods to the message with high robability. So, i this case, if we ca solve SVP, we ca recover the message with high robability. 4/31

25 1 /1 1 < < D H H Hece, coditio that asac scheme is secure to lattice attac is Iterestigly, the coditio deeds o oly. /1 1 0 g H H f H D D H f LO = < < The, Coditio for Success of Lattice Attac cot. 5/31

26 Imroved Boud based o Coster et al. Nguye-Ster 005 If a lattice is costructed lie as Coster et al., the robability that the shortest vector is ot ±m is less tha 1/ N, / A By the similar aalysis, we have g CJ H H 1/1 + < D 1 6/31

27 Critical Bouds for lattice Attac: g LO ad g CJ g_lo g_cj = g CJ 1/ = g CJ g LO Remar1: mootoously decreasig fuctio Remar: if 0, g LO, g CJ 1 7/31

28 Imortat two cases: Case1: As 0, g CJ 1. Hece, it is imossible or difficult to costruct low weight asac scheme which revets lattice attac. Case: If =1/, g CJ 1 = 1/ / 4H 1/ 5 = This value is smaller tha Coster et al. s boud: The reaso is why our aalysis is based o Lemma1 i NS05, which is ot so tight if is ot small. 8/31

29 Simle Procedure for judgig whether a asac scheme is broe by lattice attac Ste1: Calculate D=H//log A by, ad A. Ste: If D<0.8677, the scheme is broe. Ste3: If D < g CJ /, the scheme is broe. Ste4. If D < H/ / log N, -, the scheme is broe. Otherwise, the scheme is secure agaist lattice attac. I Stes 1-3, we eed ot ay comlicated calculatio. The above rocedure is valid for ay values of Hammig weight ot lie usual desity or seudo-desity. 9/31

30 Alicatio to Chor-Rivest cf. Vaudeay broe CR by ot lattice attac. critical boud of desity A 18bit 185bit 190bit 00bit d κ D g CJ I ay arameters, d > 1, but D < g CJ. So, CR scheme is broe by lattice attac. 30/31

31 Coclusio 1. itroduced a ew defiitio of desity, which aturally uifies the revious desities.. derived coditios for our desity so that a asac scheme is broe by lattice attac. D < H H 1/ showed that if D<1/1/4+5/4H1/5=0.8677, the asac scheme is broe by lattice attac. 4. showed that it is quite difficult to costruct a low weight asac scheme which is suorted by a argumet of desity. 31/31