On inverting the VMPC one-way function

Transcription

1 On inverting the VMPC one-way function KAMIL KULESZA Department of Applied Mathematics and Theoretical Physics, University of Cambridge, Cambridge, UK Institute of Fundamental Technological Research, Polish Academy of Sciences, Warsaw, Poland

2 On inverting the VMPC one-way function KAMIL KULESZA Department of Applied Mathematics and Theoretical Physics, University of Cambridge, Cambridge, UK Institute of Fundamental Technological Research, Polish Academy of Sciences, Warsaw, Poland Acknowledgement: Prof. Jerzy Browkin, Adrian Orzepowski, participants in the Summer Research Lab Project, Prof. Zbigniew Kotulski

3 Plan of this talk Introduction VMPC function Inverting VMPC Numerical results Conclusions

4 Plan of this talk Introduction VMPC function Inverting VMPC Numerical results Conclusions

5 Introduction Definition (one-way function) A function f from a set X to a set Y is called a one-way function if f (x) is easy to compute for all x X but for essentially all elements y Im( f ), it is computationally infeasible to find any x X such that f ( x) = y.

6 Introduction Comments:. A rigorous notion of the terms "easy" and "computationally infeasible".

7 Introduction Comments:. A rigorous notion of the terms "easy" and "computationally infeasible".. Existence of one-way functions is only conjectured

8 Introduction Comments:. A rigorous notion of the terms "easy" and "computationally infeasible".. Existence of one-way functions is only conjectured. and closely connected with Cook s hypothesis. Roughly speaking, if P is not equal NP such functions could exist.

9 Introduction Comments:. A rigorous notion of the terms "easy" and "computationally infeasible".. Existence of one-way functions is only conjectured. and closely connected with Cook s hypothesis. Roughly speaking, if P is not equal NP such functions could exist.. One-way functions are fundamental for complexity based cryptography.

10 Introduction Example. A popular candidate to be one-way function is based on the conjectured intractability of the integer factorization problem. The Factoring Problem. Let x, y > be f -bit integers. Define: f ( x, y) = x y When x, y are n-bit primes, it is believed that finding x, y from x y is computationally difficult.

11 Introduction Example. A popular candidate to be one-way function is based on the conjectured intractability of the integer factorization problem. The Factoring Problem. Let x, y > be f -bit integers. Define: f ( x, y) = x y When x, y are n-bit primes, it is believed that finding x, y from x y is computationally difficult. Cryptographic applications (examples): RSA cryptosystem, RSA signatures, rely on intractability of the integer factorization problem.

12 Introduction Example. Let G be a group and for by g. g G, let g be the cyclic subgroup generated The Discrete Logarithm Problem. Given g G and a g, find and integer x such that g x = a. Such an integer x is the discreet logarithm of a to the base g.

13 Introduction Example. Let G be a group and for by g. g G, let g be the cyclic subgroup generated The Discrete Logarithm Problem. Given g G and a g, find and integer x such that g x = a. Such an integer x is the discreet logarithm of a to the base g. Cryptographic applications (examples): Diffie-Hellman agreement and ElGamal encryption scheme.

14 Plan of this talk Introduction VMPC function Inverting VMPC Numerical results Conclusions

15 The paper VMPC function B. Zoltak. VMPC One-Way Function and Stream Cipher. Fast Software Encryption 00 The promise VMPC - Variably Modified Permutation Composition Can be computed with one-clock-cycle instructions of an Intel 8086 The challenge The complexity of inverting VMPC for 56 element permutation estimated to be about 60 operations for the -level function. Higher level functions are claimed to have significantly higher inverting complexities (e.g. and for,-level functions).

16 VMPC function Definition of VMPC [Zoltak 00] A k-level VMPC function, referred to as VMPC k, is such a transformation of n-element permutation P into n-element permutation Q, where VMPC k = Q[ x] = P[P k[pk- [:::[P[P[x]]]:::]]] x { 0,,..., n }, k < n, P i is the n-element permutation such that Pi [ x] = fi( P[ x]), where f i is any function such that Pi [ x] P[ x] Pj [ x] for i {,,..., k}, j {,,..., k}, i j. For simplicity of further references f i is assumed to be f i ( x) = x + i

17 VMPC function Definition of VMPC [Zoltak 00] A k-level VMPC function, referred to as VMPC k, is such a transformation of n-element permutation P into n-element permutation Q, where VMPC k = Q[ x] = P[P k[pk- [:::[P[P[x]]]:::]]] x { 0,,..., n }, k < n, P i is the n-element permutation such that Pi [ x] = fi( P[ x]), where f i is any function such that Pi [ x] P[ x] Pj [ x] for i {,,..., k}, j {,,..., k}, i j. For simplicity of further references f i is assumed to be f i ( x) = x + i VMPC = P[P[P[x]] + ] (.) VMPC = P[P[P[P[x]] + ] + ] (.) VMPC = P[P[P[P[P[x]] + ] + ] ] (.) +

18 VMPC function ] P[P[P[x]] + = VMPC (.)

19 VMPC function ] P[P[P[x]] + = VMPC (.) =

20 VMPC function ] P[P[P[x]] + = VMPC (.) = ] ] P[P[P[P[x]] + + = VMPC (.)

21 VMPC function ] P[P[P[x]] + = VMPC (.) = ] ] P[P[P[P[x]] + + = VMPC (.) ] ] ] P[P[P[P[P[x]] = VMPC (.)

22 VMPC function ] P[P[P[x]] + = VMPC (.) A A Q A

23 VMPC function ] P[P[P[x]] + = VMPC (.) A A Q A Let k D denote ) (A VMPC k, then the equation (.) ] P[P[P[x]] + = VMPC, can be be written as = A QA D (.)

24 VMPC function Given D = A QA (.) Similarly, the equation (.) VMPC = P[P[P[P[x]] + ] + ] Can be written as D = A QAQ A D Q A (.) = And, the equation (.) VMPC = P[P[P[P[x]] + ] Can be written as D = A QAQ AQ A D Q + = ] AQ A (.) Given The VMPC k problem: D find A such that VMPC ( A) = D. k k k

25 Plan of this talk Introduction VMPC function Inverting VMPC Numerical results Conclusions

26 Let s concentrate on the VMPC : Inverting VMPC D = A QA (.)

27 Let s concentrate on the VMPC : Inverting VMPC D = A QA (.) Special cases (a.k.a. weak keys). Consider the situation when A = I. (.) In such a case: which yields: D = QA, (.) Q D = A. (.)

28 Let s concentrate on the VMPC : Inverting VMPC D = A QA (.) Special cases (a.k.a. weak keys). Consider the situation when r+ D = Q, (.) where r < n. Then the following solution always exist: r A = Q. (.5)

29 General solution - theoretical considerations Inverting VMPC D = A QA (.) Idea #: commute permutations Q and. Checking the center of n ( Z S n ), since all elements belonging to Z ( S n ) would commute with Q. Unfortunately, it is trivial for all n > ( Z( S n ) = {I} for n > ). S ( ) A

30 General solution - theoretical considerations Inverting VMPC D = A QA (.) Idea #: commute permutations Q and. Checking the center of n ( Z S n ), since all elements belonging to Z ( S n ) would commute with Q. Unfortunately, it is trivial for all n > ( Z( S n ) = {I} for n > ). S ( ). Checking normal subgroups of S n which contains Q. Let s call such a subgroup H. Then for some X H the equation. can be written: Q D = A X. (.6) Fails: the only normal subgroup of S containing Q is A (for odd n). Q n A n

31 General solution - theoretical considerations Inverting VMPC D = A QA (.) Idea #: a homomorphism from S n to some more friendly group Unfortunately, the only such homomorphism for n > is (up to the representation) the homomorphism from S n to Z. All that can be obtained using this is the parity of A. However, A s parity can be calculated in an easier way.

32 General solution - theoretical considerations Inverting VMPC D = A QA (.) Idea #: a homomorphism from S n to some more friendly group Unfortunately, the only such homomorphism for n > is (up to the representation) the homomorphism from S n to Z. All that can be obtained using this is the parity of A. However, A s parity can be calculated in an easier way. CONCLUSION Using methods from classical permutation theory we have not been able to obtain a general solution.

33 In search of a general solution what can be done? Inverting VMPC A s parity D = A QA (.) Multiplying both sides of the equation (.) by Q, to yield D Q = A QAQ, (.7) which can be written as: D Q = A(AQ). (.8) (AQ) is always even, so the parity of A is the same as the parity of DQ.

34 In search of a general solution what can be done? Inverting VMPC A s parity D = A QA (.) Multiplying both sides of the equation (.) by Q, to yield D Q = A QAQ, (.7) which can be written as: D Q = A(AQ). (.8) (AQ) is always even, so the parity of A is the same as the parity of DQ. Knowing A s parity is important, since it reduces the number of possible candidates by a factor of.

35 In search of a general solution what can be done? Inverting VMPC D = A QA (.) n-cycle solutions Recall the idea of commuting Q and A in the equation (.). It amends to finding some X such that: QA = AX. (.9) Such situation occurs when X is made of only one cycle of length n. By substituting equation.9 into equation. one can obtain: D X =. (.0) A

36 In search of a general solution what can be done? Inverting VMPC D = A QA (.) n-cycle solutions Recall the idea of commuting Q and A in the equation (.). It amends to finding some X such that: QA = AX. (.9) Such situation occurs when X is made of only one cycle of length n. By substituting equation.9 into equation. one can obtain: D X = A. (.0) Solving such equations requires checking all n-cycles and solving for A. Although it is not feasible for a head-on attack, it significantly reduces number of possible candidates to search (by factor n).

37 Plan of this talk Introduction VMPC function Inverting VMPC Numerical results Conclusions

38 Numerical results The image of Sn under the VMPC k Theorem VMPC is never one-to-one. k Sketch of the proof : Observe that permutations having specific cycle decompositions cannot be created when VMPC k acts on S n. (general proof due to Prof. Browkin)

39 The image of Sn under the Notation: as the image of S under the D n, k VMPC k Numerical results n VMPC k; D, as the cardinality of, in other words the number of distinct n k D n, k elements of. D n, k ++ D n, k as a set of all elements of more than one permutation A. D, which can be computed from n k

40 The image of Sn under the Notation: as the image of S under the D n, k VMPC k Numerical results n VMPC k; D, as the cardinality of, in other words the number of distinct n k D n, k elements of. D n, k ++ D n, k as a set of all elements of more than one permutation A. D, which can be computed from Numerical experiments We calculated all D n, k for k {,, } and n {,...,}. First, we investigated cardinalities of sets D n, k and compared them with cardinality of. S n n k

41 Numerical results The image of Sn under the VMPC k n S n D n, D n, / S n 0,67 0,67 0,67 0,68 0,60 0,5970 0,5966 0,606 0,608 0,60697 D n, compared with S n for n {,...,}

42 The image of Sn under the 70.00% VMPC k Numerical results VMPC_ VMPC_ VMPC_ 60.00% 50.00% D_n / S_n 0.00% 0.00% 0.00% 0.00% 0.00% n Cardinality of S n s image under the VMPC, VMPC, VMPC as a percentage of S n s cardinality.

43 # D A VMPC VMPC VMPC Number of image elements of S under the VMPC k that can be computed from multiple A.

44 Numerical results The image of Sn under the VMPC k Observations ++. High number of permutations A, such that VMPC k ( A) D n, k, can have far reaching consequences for the difficulty of inversing the VMPC. k

45 Numerical results The image of Sn under the VMPC k Observations ++. High number of permutations A, such that VMPC k ( A) D n, k, can have far reaching consequences for the difficulty of inversing the VMPC. k. For the VMPC we found that permutations A, which fall into special cases, usually yield elements from Dn, with A D >. Hence, the probability of successful attacks making use of weak keys increase, maybe even by an order of magnitude.

46 Numerical results The image of Sn under the VMPC k Conjecture Given two natural numbers k and k such that k k and both have the same parity, two functions VMPC k and VMPC k will produce images of S n with similar characteristics (e.g., the cardinality and the decomposition into A D).

47 Plan of this talk Introduction VMPC function Inverting VMPC Numerical results Conclusions

48 Conclusions Summary and further research We described VMPC in the language of permutation theory.

49 Conclusions Summary and further research We described VMPC in the language of permutation theory. Searching for more weak keys (easily invertible instances)

50 Conclusions Summary and further research We described VMPC in the language of permutation theory. Searching for more weak keys (easily invertible instances) Sn s image under the VMPC k takes up about 0%-60% of S n s cardinality. Further research in this area could focus on the proposed conjecture.

51 Conclusions Summary and further research We described VMPC in the language of permutation theory. Searching for more weak keys (easily invertible instances) Sn s image under the VMPC k takes up about 0%-60% of S n s cardinality. Further research in this area could focus on the proposed conjecture. The future theoretical research: representation theory, computational group theory or so-called algebraic attacks.

52 Remarks on usefulness of VMPC in cryptography Conclusions We have not been able to find a general solution to the VMPC problem and we still do not have an efficient inverting algorithm for every case. However, our results indicate that the VMPC is not a good candidate for a cryptographic one-way function.

53 Remarks on usefulness of VMPC in cryptography Conclusions We have not been able to find a general solution to the VMPC problem and we still do not have an efficient inverting algorithm for every case. However, our results indicate that the VMPC is not a good candidate for a cryptographic one-way function. Reasons: A non-negligible number of weak keys, coupled with the peculiar structure of Sn s image under the VMPC k, which is not fully understood, disqualifies it at present.

54 On inverting the VMPC one-way function Isaac Newton Institute Preprint Series: NI06009-LAA KAMIL KULESZA Department of Applied Mathematics and Theoretical Physics, University of Cambridge, Cambridge, UK Institute of Fundamental Technological Research, Polish Academy of Sciences, Warsaw, Poland s: