Attacks on the AJPS Mersenne-Based Cryptosystem

Abstract

Aggarwal, Joux, Prakash and Santha recently introduced a new potentially quantum-safe public-key cryptosystem, and suggested that a brute-force attack is essentially optimal against it. They consider but then dismiss both Meet-in-the-Middle attacks and LLL-based attacks. Very soon after their paper appeared, Beunardeau et al. proposed a practical LLL-based technique that seemed to significantly reduce the security of the AJPS system. In this paper we do two things. First, we show that a Meet-in-the-Middle attack can also be made to work against the AJPS system, using locality-sensitive hashing to overcome the difficulty that Aggarwal et al. saw for such attacks. We also present a quantum version of this attack. Second, we give a more precise analysis of the attack of Beunardeau et al., confirming and refining their results.

The Mersenne Low Hamming Combination Search Problem Can Be Reduced to an ILP Problem

“…In [1], the authors suggest to choose N and h to be such that N −1 h−1 ≥ 2 λ and 4h 2 < N , for a desired λ-bit security level. After the publications of the attacks by Beunardeau et al [6] and De Boer et al [7], the authors revised the choice of the parameters ( [2]) to be such that h = λ and 10h 2 < N .…”

“…Meet-in-the-Middle attack De Boer et al [7] showed that a Meet-in-the-Middle attack to MLHRatioSP is possible using locality-sensitive hashing with complex-…”

“…Even if Beunardeau et al showed that this attack practically hits the security estimations in [1], they did not present any clear asymptotic analysis of its complexity. However, de Boer et al [7], computed the complexity of this attack.…”

“…There the attack is performed via a series of calls to an SVP-oracle. Its complexity has been estimated by de Boer et al in [7]. They also showed that a Meet-in-the-Middle attack is possible using locality-sensitive hashing, which improves upon brute force.…”

The necessary security requirements for the values used by the AJPS cryptosystem

“…It is considered that this problem is hard for solving. MLHRSP is resistant to many known attacks, namely Meet-in-the-middle attacks, Guess and Win, Latticebased attacks etc [8,9,10]. Therefore, it is possible to build a cryptosystem, the security of which will be based on complexity of MLHRSP.…”