MiMC: Efficient Encryption and Cryptographic Hashing with Minimal Multiplicative Complexity

Abstract

Abstract. We explore cryptographic primitives with low multiplicative complexity. This is motivated by recent progress in practical applications of secure multi-party computation (MPC), fully homomorphic encryption (FHE), and zero-knowledge proofs (ZK) where primitives from symmetric cryptography are needed and where linear computations are, compared to non-linear operations, essentially "free". Starting with the cipher design strategy "LowMC" from Eurocrypt 2015, a number of bitoriented proposals have been put forward, focusing on applications where the multiplicative depth of the circuit describing the cipher is the most important optimization goal. Surprisingly, albeit many MPC/FHE/ZK-protocols natively support operations in GF(p) for large p, very few primitives, even considering all of symmetric cryptography, natively work in such fields. To that end, our proposal for both block ciphers and cryptographic hash functions is to reconsider and simplify the round function of the Knudsen-Nyberg cipher from 1995. The mapping F (x) := x 3 is used as the main component there and is also the main component of our family of proposals called "MiMC". We study various attack vectors for this construction and give a new attack vector that outperforms others in relevant settings.Due to its very low number of multiplications, the design lends itself well to a large class of new applications, especially when the depth does not matter but the total number of multiplications in the circuit dominates all aspects of the implementation. With a number of rounds which we deem secure based on our security analysis, we report on significant performance improvements in a representative use-case involving SNARKs.

Correlation Distribution Analysis of a Two-Round Key-Alternating Block Cipher

“…The correlation distribution is obtained completely only for t = 1, but we hope that the used approach will enable the general case to be also solved. As a future work this analysis can be applied to a recently proposed lightweight block cipher MiMC [2] which uses x 3 as a round function. Let X w and Y w be the random binary variables u, x + w, f k (x) = 0 and w, f k (x) + v, F k (x) = 0, respectively.…”

Blockchain-based Firmware Update Scheme Tailored for Autonomous Vehicles

“…We implemented the NP statement in Equation 1 using Zokrates 2 toolbox. MIMC [15] is used for encryption/decryption due to its efficiency with zk-SNARK proofs, and sha256 is used for hashing. The time to generate the proof is 6 seconds, where as, the verification is 5 milliseconds.…”

MPC-Friendly Symmetric Key Primitives

“…This generally favours larger data types like Fp or F2n , and the depth of the circuit is of no concern. MiMC [2] was originally designed for this use case and seems to be the only one in this area. As the depth is not too high either, we choose it for detailed evaluation.…”

“…Two of these are number theoretic in nature (the Naor-Reingold PRF, based on DDH, and a PRF based on the Legendre symbol), whilst MiMC [2] and LowMC [4] are more akin to traditional symmetric block cipher constructions.…”

“…MiMC: This is a very recent class of designs whose primary application domain are SNARKs [2]. In addition to a cryptographic hash function, the design also includes a block cipher which is also usable as a PRF, with up to birthday bound security.…”