On Asymptotic Security Estimates in XL and Gröbner Bases-Related Algebraic Cryptanalysis

Yang, Bo‐Yin; Chen, Jiun-Ming; Courtois, Nicolas T.

doi:10.1007/978-3-540-30191-2_31

Cited by 49 publications

(36 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For example, a system of 256 polynomial equations of degree d = 16 in n = 256 variables over GF (2) is expected to have a unique solution, but in order to find it by linearization we have to increase the number of equations to the number of possible terms in these equations, which is about n d = 2 128 . There are several improved algorithms such as XL and XSL (see [3], [4], [5], [6] and [7]) which reduce the number of required equations and the time and space complexities, but they are still completely impractical for such sizes.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Cube Attacks on Tweakable Black Box Polynomials

Dinur

Shamir

2009

Advances in Cryptology - EUROCRYPT 2009

313

349

View full text Add to dashboard Cite

Abstract. Almost any cryptographic scheme can be described by tweakable polynomials over GF (2), which contain both secret variables (e.g., key bits) and public variables (e.g., plaintext bits or IV bits). The cryptanalyst is allowed to tweak the polynomials by choosing arbitrary values for the public variables, and his goal is to solve the resultant system of polynomial equations in terms of their common secret variables. In this paper we develop a new technique (called a cube attack ) for solving such tweakable polynomials, which is a major improvement over several previously published attacks of the same type. For example, on the stream cipher Trivium with a reduced number of initialization rounds, the best previous attack (due to Fischer, Khazaei, and Meier) requires a barely practical complexity of 2 55 to attack 672 initialization rounds, whereas a cube attack can find the complete key of the same variant in 2 19 bit operations (which take less than a second on a single PC). Trivium with 735 initialization rounds (which could not be attacked by any previous technique) can now be broken with 2 30 bit operations. Trivium with 767 initialization rounds can now be broken with 2 45 bit operations, and the complexity of the attack can almost certainly be further reduced to about 2 36 bit operations. Whereas previous attacks were heuristic, had to be adapted to each cryptosystem, had no general complexity bounds, and were not expected to succeed on random looking polynomials, cube attacks are provably successful when applied to random polynomials of degree d over n secret variables whenever the number m of public variables exceeds d + log d n. Their complexity is 2 d−1 n + n 2 bit operations, which is polynomial in n and amazingly low when d is small. Cube attacks can be applied to any block cipher, stream cipher, or MAC which is provided as a black box (even when nothing is known about its internal structure) as long as at least one output bit can be represented by (an unknown) polynomial of relatively low degree in the secret and public variables.

show abstract

Section: Introductionmentioning

confidence: 99%

“…Third degree polynomials over six variables can have 6 3 + 6 2 + 6 1 + 6 0 = 42 possible terms, and thus there are 2 42 such polynomials over GF (2). To eliminate all the 35 possible nonlinear terms by Gauss elimination, we typically need 35 such polynomials.…”

Section: Introductionmentioning

confidence: 99%

Cube Attacks on Tweakable Black Box Polynomials

Dinur

Shamir

2009

Advances in Cryptology - EUROCRYPT 2009

313

349

View full text Add to dashboard Cite

show abstract

“…By computing the exact value of the regularity degree, the conjectural running time still exceeds the brute force complexity for n = 200; see [1]. The best heuristic bound is of order 1.724 n [27], where the method was combined with variable guessing.…”

Section: Related Methodsmentioning

confidence: 99%

Improved Agreeing-Gluing Algorithm

Semaev

2013

Math.Comput.Sci.

View full text Add to dashboard Cite

Abstract. In this paper we study the asymptotical complexity of solving a system of sparse algebraic equations over finite fields. An equation is called sparse if it depends on a bounded number of variables. Finding efficiently solutions to the system of such equations is an underlying hard problem in the cryptanalysis of modern ciphers. New deterministic Improved Agreeing-Gluing Algorithm is introduced. The expected running time of the Algorithm on uniformly random instances of the problem is rigorously estimated. The estimate is at present the best theoretical bound on the complexity of solving average instances of the problem. In particular, this is a significant improvement over those in our earlier papers [20,21]. In sparse Boolean equations a gap between the present worst case and the average time complexity of the problem has significantly increased. Also we formulate Average Time Complexity Conjecture. If proved that will have far-reaching consequences in the field of cryptanalysis and in computing in general.

show abstract

“…As discussed in [10], [11], and [12], XSL would not be expected to outperform a good Gröbner basis algorithm such as F4. Thus, Magma's builtin F4 algorithm is used, rather than XSL.…”

Section: Gf(2 8 ) Attacksmentioning

confidence: 99%

Algebraic Cryptanalysis of SMS4: Gröbner Basis Attack and SAT Attack Compared

Erickson

Ding

Christensen

2010

Information, Security and Cryptology – ICISC 2009

View full text Add to dashboard Cite

Abstract. The SMS4 block cipher is part of the Chinese WAPI wireless standard. This paper describes the specification and offers a specification for a toy version called simplified SMS4 (S-SMS4). We explore algebraic attacks on SMS4 and S-SMS4 using Gröbner basis attacks on equation systems over GF(2) and GF(2 8 ), as well as attacks using a SAT solver derived from the GF(2) model. A comparison of SAT and Gröbner basis attacks is provided.

show abstract

On Asymptotic Security Estimates in XL and Gröbner Bases-Related Algebraic Cryptanalysis

Cited by 49 publications

References 29 publications

Cube Attacks on Tweakable Black Box Polynomials

Cube Attacks on Tweakable Black Box Polynomials

Improved Agreeing-Gluing Algorithm

Algebraic Cryptanalysis of SMS4: Gröbner Basis Attack and SAT Attack Compared

Contact Info

Product

Resources

About