Algorithmic cryptAnAlysis © 2009 by Taylor and Francis Group, LLC CHAPMAN & HALL/CRC CRYPTOGRAPHY AND NETWORK SECURITY Series Editor Douglas R Stinson Published Titles Jonathan Katz and Yehuda Lindell, Introduction to Modern Cryptography Antoine Joux, Algorithmic Cryptanalysis Forthcoming Titles Burton Rosenberg, Handbook of Financial Cryptography Maria Isabel Vasco, Spyros Magliveras, and Rainer Steinwandt, Group Theoretic Cryptography Shiu-Kai Chin and Susan Beth Older, Access Control, Security and Trust: A Logical Approach © 2009 by Taylor and Francis Group, LLC Chapman & Hall/CRC CRYPTOGRAPHY AND NETWORK SECURITY Algorithmic cryptAnAlysis Antoine Joux © 2009 by Taylor and Francis Group, LLC Chapman & Hall/CRC Taylor & Francis Group 6000 Broken Sound Parkway NW, Suite 300 Boca Raton, FL 33487-2742 © 2009 by Taylor and Francis Group, LLC Chapman & Hall/CRC is an imprint of Taylor & Francis Group, an Informa business No claim to original U.S Government works Printed in the United States of America on acid-free paper 10 International Standard Book Number: 978-1-4200-7002-6 (Hardback) This book contains information obtained from authentic and highly regarded sources Reasonable efforts have been made to publish reliable data and information, but the author and publisher cannot assume responsibility for the validity of all materials or the consequences of their use The authors and publishers have attempted to trace the copyright holders of all material reproduced in this publication and apologize to copyright holders if permission to publish in this form has not been obtained If any copyright material has not been acknowledged please write and let us know so we may rectify in any future reprint Except as permitted under U.S Copyright Law, no part of this book may be reprinted, reproduced, transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented, including photocopying, microfilming, and recording, or in any information storage or retrieval system, without written permission from the publishers For permission to photocopy or use material electronically from this work, please access www.copyright com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc (CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400 CCC is a not-for-profit organization that provides licenses and registration for a variety of users For organizations that have been granted a photocopy license by the CCC, a separate system of payment has been arranged Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used only for identification and explanation without intent to infringe Library of Congress Cataloging‑in‑Publication Data Joux, Antoine Algorithmic cryptanalysis / Antoine Joux p cm (Chapman & Hall/CRC cryptography and network security) Includes bibliographical references and index ISBN 978-1-4200-7002-6 (hardcover : alk paper) Computer algorithms Cryptography I Title III Series QA76.9.A43J693 2009 005.8’2 dc22 Visit the Taylor & Francis Web site at http://www.taylorandfrancis.com and the CRC Press Web site at http://www.crcpress.com © 2009 by Taylor and Francis Group, LLC 2009016989 ` Katia, Anne et Louis A © 2009 by Taylor and Francis Group, LLC Contents Preface I Background A bird’s-eye view of modern cryptography 1.1 1.2 Preliminaries 1.1.1 Typical cryptographic needs Defining security in cryptography 10 1.2.1 Distinguishers 11 1.2.2 Integrity and signatures 16 1.2.3 Authenticated encryption 17 1.2.4 Abstracting cryptographic primitives 21 Elementary number theory and algebra background 23 2.1 Integers and rational numbers 23 2.2 Greatest common divisors in Z 26 2.3 2.4 2.5 2.2.1 Binary GCD algorithm 30 2.2.2 Approximations using partial GCD computations 31 Modular arithmetic 33 2.3.1 Basic algorithms for modular arithmetic 34 2.3.2 Primality testing 38 2.3.3 Specific aspects of the composite case 41 Univariate polynomials and rational fractions 44 2.4.1 Greatest common divisors and modular arithmetic 45 2.4.2 Derivative of polynomials 47 Finite fields 47 2.5.1 The general case 48 2.5.2 The special case of F2n 49 2.5.3 Solving univariate polynomial equations 55 2.6 Vector spaces and linear maps 61 2.7 The RSA and Diffie-Hellman cryptosystems 63 2.7.1 RSA 63 2.7.2 Diffie-Hellman key exchange 65 © 2009 by Taylor and Francis Group, LLC II Algorithms Linear algebra 71 3.1 Introductory example: Multiplication of small matrices over F2 71 3.2 Dense matrix multiplication 77 3.2.1 Strassen’s algorithm 80 3.2.2 Asymptotically fast matrix multiplication 89 3.2.3 Relation to other linear algebra problems 93 Gaussian elimination algorithms 94 3.3.1 Matrix inversion 98 3.3.2 Non-invertible matrices 98 3.3.3 Hermite normal forms 103 3.3 3.4 Sparse linear algebra 105 3.4.1 Iterative algorithms 106 3.4.2 Structured Gaussian elimination 113 Sieve algorithms 4.1 4.2 123 Introductory example: Eratosthenes’s sieve 123 4.1.1 Overview of Eratosthenes’s sieve 123 4.1.2 Improvements to Eratosthenes’s sieve 125 4.1.3 Finding primes faster: Atkin and Bernstein’s sieve 133 Sieving for smooth composites 135 4.2.1 General setting 136 4.2.2 Advanced sieving approaches 148 4.2.3 Sieving without sieving 152 Brute force cryptanalysis 155 5.1 Introductory example: Dictionary attacks 155 5.2 Brute force and the DES algorithm 157 5.2.1 The DES algorithm 157 5.2.2 Brute force on DES 161 5.3 Brute force as a security mechanism 163 5.4 Brute force steps in advanced cryptanalysis 164 5.4.1 Description of the SHA hash function family 165 5.4.2 A linear model of SHA-0 168 5.4.3 Adding non-linearity 171 5.4.4 Searching for collision instances 179 © 2009 by Taylor and Francis Group, LLC 5.5 Brute force and parallel computers The birthday paradox: Sorting or not? 182 185 6.1 Introductory example: Birthday attacks on modes of operation 186 6.2 Analysis of birthday paradox bounds 6.1.1 6.2.1 6.3 6.4 Security of CBC encryption and CBC-MAC 189 Generalizations 190 Finding collisions 192 6.3.1 Sort algorithms 196 6.3.2 Hash tables 207 6.3.3 Binary trees 210 Application to discrete logarithms in generic groups 216 6.4.1 Pohlig-Hellman algorithm 216 6.4.2 Baby-step, giant-step algorithm 218 Birthday-based algorithms for functions 7.1 7.2 7.3 7.4 7.5 186 223 Algorithmic aspects 224 7.1.1 Floyd’s cycle finding algorithm 225 7.1.2 Brent’s cycle finding algorithm 226 7.1.3 Finding the cycle’s start 227 7.1.4 Value-dependent cycle finding 228 Analysis of random functions 231 7.2.1 Global properties 231 7.2.2 Local properties 232 7.2.3 Extremal properties 232 Number-theoretic applications 233 7.3.1 Pollard’s Rho factoring algorithm 233 7.3.2 Pollard’s Rho discrete logarithm algorithm 236 7.3.3 Pollard’s kangaroos 237 A direct cryptographic application in the context of blockwise security 238 7.4.1 Blockwise security of CBC encryption 239 7.4.2 CBC encryption beyond the birthday bound 239 7.4.3 Delayed CBC beyond the birthday bound 240 Collisions in hash functions 242 7.5.1 Collisions between meaningful messages 243 7.5.2 Parallelizable collision search 244 © 2009 by Taylor and Francis Group, LLC 7.6 Hellman’s time memory tradeoff 246 7.6.1 Simplified case 247 7.6.2 General case 248 Birthday attacks through quadrisection 8.1 8.2 8.3 8.4 251 Introductory example: Subset sum problems 251 8.1.1 Preliminaries 252 8.1.2 The algorithm of Shamir and Schroeppel 253 General setting for reduced memory birthday attacks 256 8.2.1 Xoring bit strings 257 8.2.2 Generalization to different groups 258 8.2.3 Working with more lists 262 Extensions of the technique 263 8.3.1 Multiple targets 263 8.3.2 Wagner’s extension 264 8.3.3 Related open problems 265 Some direct applications 267 8.4.1 Noisy Chinese remainder reconstruction 267 8.4.2 Plain RSA and plain ElGamal encryptions 269 8.4.3 Birthday attack on plain RSA 269 8.4.4 Birthday attack on plain ElGamal 270 Fourier and Hadamard-Walsh transforms 9.1 Introductory example: Studying S-boxes 273 273 9.1.1 Definitions, notations and basic algorithms 273 9.1.2 Fast linear characteristics using the Walsh transform 275 9.1.3 Link between Walsh transforms and differential characteristics 279 Truncated differential characteristics 282 9.2 Algebraic normal forms of Boolean functions 9.1.4 285 9.3 Goldreich-Levin theorem 286 9.4 Generalization of the Walsh transform to Fp 9.5 288 9.4.1 Complexity analysis 291 9.4.2 Generalization of the Moebius transform to Fp 293 Fast Fourier transforms 294 9.5.1 Cooley-Tukey algorithm 296 9.5.2 Rader’s algorithm 300 © 2009 by Taylor and Francis Group, LLC References 481 [JG94] Antoine Joux and Louis Granboulan A practical attack against Knapsack based hash functions (extended abstract) In Alfredo De Santis, editor, EUROCRYPT’94, volume 950 of LNCS, pages 58–66, Perugia, Italy, May 9–12, 1994 Springer-Verlag, Berlin, Germany [406] [JL01] Antoine Joux and Reynald Lercier “Chinese & Match,” an alternative to Atkin’s “Match and Sort” method used in the SEA algorithm Mathematics of Computation, 70:827–836, 2001 [267, 268, 269] [JLSV06] Antoine Joux, Reynald Lercier, Nigel Smart, and Frederik Vercauteren The number field sieve in the medium prime case In Cynthia Dwork, editor, CRYPTO 2006, volume 4117 of LNCS, pages 326–344, Santa Barbara, CA, USA, August 20–24, 2006 Springer-Verlag, Berlin, Germany [452, 456, 461] [JMV02] Antoine Joux, Gwenaăelle Martinet, and Frederic Valette Blockwise-adaptive attackers: Revisiting the (in)security of some provably secure encryption models: CBC, GEM, IACBC In Moti Yung, editor, CRYPTO 2002, volume 2442 of LNCS, pages 17–30, Santa Barbara, CA, USA, August 18–22, 2002 Springer-Verlag, Berlin, Germany [238, 239] [JN08] Marc Joye and Gregory Neven, editors Identity-based Cryptography, volume of Cryptology and Information Security Series IOS Press, Amsterdam, 2008 [417] [JNT07] Antoine Joux, David Naccache, and Emmanuel Thom´e When e-th roots become easier than factoring In Kaoru Kurosawa, editor, ASIACRYPT 2007, volume 4833 of LNCS, pages 13–28, Kuching, Malaysia, December 2–6, 2007 Springer-Verlag, Berlin, Germany [439] [JP07] Antoine Joux and Thomas Peyrin Hash functions and the (amplified) boomerang attack In Alfred Menezes, editor, CRYPTO 2007, volume 4622 of LNCS, pages 244–263, Santa Barbara, CA, USA, August 19–23, 2007 Springer-Verlag, Berlin, Germany [182] [Jut01] Charanjit S Jutla Encryption modes with almost free message integrity In Birgit Pfitzmann, editor, EUROCRYPT 2001, volume 2045 of LNCS, pages 529–544, Innsbruck, Austria, May 6–10, 2001 Springer-Verlag, Berlin, Germany [17] [Kah67] David Kahn The Codebreakers: The Comprehensive History of Secret Communication from Ancient Times to the Internet Scribner, 1967 [11] © 2009 by Taylor and Francis Group, LLC 482 Algorithmic Cryptanalysis [Kan83] Ravi Kannan Improved algorithms for integer programming and related lattice problems In Proc 15th Symp Theory of Comp., pages 193–206, 1983 [327, 328, 330] [Ker83] Auguste Kerckhoffs La cryptographie militaire Journal des sciences militaire, IX, 1883 Article in two parts: Jan and Feb issues [4] [Knu94] Lars R Knudsen Truncated and higher order differentials In Bart Preneel, editor, FSE’94, volume 1008 of LNCS, pages 196– 211, Leuven, Belgium, December 14–16, 1994 Springer-Verlag, Berlin, Germany [282, 392] [KPT96] Jyrki Katajainen, Tomi Pasanen, and Jukka Teuhola Practical in-place mergesort Nordic J of Computing, 3(1):27–40, 1996 [201] [Kra01] Hugo Krawczyk The order of encryption and authentication for protecting communications (or: How secure is SSL?) In Joe Kilian, editor, CRYPTO 2001, volume 2139 of LNCS, pages 310– 331, Santa Barbara, CA, USA, August 19–23, 2001 SpringerVerlag, Berlin, Germany [18] [KS99] Aviad Kipnis and Adi Shamir Cryptanalysis of the HFE public key cryptosystem by relinearization In Michael J Wiener, editor, CRYPTO’99, volume 1666 of LNCS, pages 19–30, Santa Barbara, CA, USA, August 15–19, 1999 Springer-Verlag, Berlin, Germany [357] [KVW04] Tadayoshi Kohno, John Viega, and Doug Whiting CWC: A high-performance conventional authenticated encryption mode In Bimal K Roy and Willi Meier, editors, FSE 2004, volume 3017 of LNCS, pages 408–426, New Delhi, India, February 5–7, 2004 Springer-Verlag, Berlin, Germany [17] [Kwa00] Matthew Kwan Reducing the gate count of bitslice DES IACR eprint archive, 2000 Report 2000/051 [163, 183] [Lai94] Xuejia Lai Higher order derivatives and differential cryptanalysis In Communication and Cryptography – Two Sides of One Tapestry, pages 227–233 Kluwer Academic Publisher, 1994 [392] [Lan05] Serge Lang Algebra, volume 211 of Graduate Texts in Mathematics Springer, New York, 2005 Revised third edition [37, 47, 48, 62, 110, 343] [Laz83] Daniel Lazard Grăobner bases, gaussian elimination and resolution of systems of algebraic equations In Computer algebra (London, 1983), volume 162 of LNCS, pages 146–156 SpringerVerlag, Berlin, Germany, 1983 [355] © 2009 by Taylor and Francis Group, LLC References 483 [LG89] Leonid A Levin and Oded Goldreich A Hard-core Predicate for all One-way Functions In D S Johnson, editor, 21th ACM Symposium on Theory of Computing - STOC ’89, pages 25–32 ACM Press, 1989 [286] [LL93] Arjen K Lenstra and Hendrick W Lenstra, Jr., editors The development of the number field sieve, volume 1554 of Lecture Notes in Mathematics Springer-Verlag, Berlin, Germany, 1993 [456, 461] [LLL82] Arjen K Lenstra, Hendrick W Lenstra, Jr., and L´aszl´o Lov´asz Factoring polynomials with rational coefficients Math Ann., 261:515–534, 1982 [319] [LMV05] Yi Lu, Willi Meier, and Serge Vaudenay The conditional correlation attack: A practical attack on bluetooth encryption In Victor Shoup, editor, CRYPTO 2005, volume 3621 of LNCS, pages 97–117, Santa Barbara, CA, USA, August 14–18, 2005 Springer-Verlag, Berlin, Germany [380] [LO85] Jeffrey C Lagarias and Andrew M Odlyzko Solving low-density subset sum problems Journal of the ACM, 32(1):229–246, 1985 [402, 406] [LO91] Brian A LaMacchia and Andrew M Odlyzko Solving large sparse linear systems over finite fields In Alfred J Menezes and Scott A Vanstone, editors, CRYPTO’90, volume 537 of LNCS, pages 109–133, Santa Barbara, CA, USA, August 11–15, 1991 Springer-Verlag, Berlin, Germany [113, 115] [Luc05] Stefan Lucks Two-pass authenticated encryption faster than generic composition In Henri Gilbert and Helena Handschuh, editors, FSE 2005, volume 3557 of LNCS, pages 284–298, Paris, France, February 21–23, 2005 Springer-Verlag, Berlin, Germany [17] [Mar57] Harry M Markowitz The elimination form of the inverse and its application to linear programming Management Science, 3(3):255–269, 1957 [116] [Mat93] Mitsuru Matsui Linear cryptoanalysis method for DES cipher In Tor Helleseth, editor, EUROCRYPT’93, volume 765 of LNCS, pages 386–397, Lofthus, Norway, May 23–27, 1993 SpringerVerlag, Berlin, Germany [273] [Mat94a] Mitsuru Matsui The first experimental cryptanalysis of the data encryption standard In Yvo Desmedt, editor, CRYPTO’94, volume 839 of LNCS, pages 1–11, Santa Barbara, CA, USA, August 21–25, 1994 Springer-Verlag, Berlin, Germany [273] © 2009 by Taylor and Francis Group, LLC 484 Algorithmic Cryptanalysis [Mat94b] Mitsuru Matsui On correlation between the order of S-boxes and the strength of DES In Alfredo De Santis, editor, EUROCRYPT’94, volume 950 of LNCS, pages 366–375, Perugia, Italy, May 9–12, 1994 Springer-Verlag, Berlin, Germany [273] [MG90] Miodrag J Mihaljevic and Jovan Dj Golic A fast iterative algorithm for a shift register initial state reconstruction given the noisy output sequence In Jennifer Seberry and Josef Pieprzyk, editors, AUSCRYPT’90, volume 453 of LNCS, pages 165–175, Sydney, Australia, January 8–11, 1990 Springer-Verlag, Berlin, Germany [380] [MG02] Daniele Micciancio and Shafi Goldwasser Complexity of Lattice Problems: A Cryptographic Perspective, volume 671 of The Kluwer International Series in Engineering and Computer Science Kluwer Academic Publishers, 2002 [311] [Mil04] Victor S Miller The Weil pairing, and its efficient calculation Journal of Cryptology, 17(4):235–261, September 2004 [431] [Mon92] Peter L Montgomery A FFT Extension of the Elliptic Curve Method of Factorization PhD thesis, University of California, Los Angeles, 1992 [236, 435] [Mon95] Peter L Montgomery A block Lanczos algorithm for finding dependencies over GF(2) In Louis C Guillou and Jean-Jacques Quisquater, editors, EUROCRYPT’95, volume 921 of LNCS, pages 106–120, Saint-Malo, France, May 21–25, 1995 SpringerVerlag, Berlin, Germany [112] [MP08] St´ephane Manuel and Thomas Peyrin Collisions on SHA–0 in one hour In Kaisa Nyberg, editor, FSE 2008, volume 5086 of LNCS, pages 16–35, Lausanne, Switzerland, February 10–13, 2008 Springer-Verlag, Berlin, Germany [182] [MS89] Willi Meier and Othmar Staffelbach Fast correlation attacks on certain stream ciphers Journal of Cryptology, 1(3):159–176, 1989 [380] [MSK98] Shiho Moriai, Takeshi Shimoyama, and Toshinobu Kaneko Higher order differential attak of CAST cipher In Serge Vaudenay, editor, FSE’98, volume 1372 of LNCS, pages 17–31, Paris, France, March 23–25, 1998 Springer-Verlag, Berlin, Germany [392] [MT09] Ravi Montenegro and Prasad Tetali How long does it take to catch a wild kangaroo? In Michael Mitzenmacher, editor, 41st ACM STOC, pages 1–10, Bethesda, Maryland, USA, May 31– June 2009 ACM Press [238] © 2009 by Taylor and Francis Group, LLC References 485 [MvOV97] Aldred J Menezes, Paul C van Oorschot, and Scott A Vanstone, editors Handbook of Applied Cryptography CRC Press LLC, Boca Raton, Florida, 1997 [3] [MY92] Mitsuru Matsui and Atsuhiro Yamagishi A new method for known plaintext attack of FEAL cipher In Rainer A Rueppel, editor, EUROCRYPT’92, volume 658 of LNCS, pages 81 91, Balatonfă ured, Hungary, May 24–28, 1992 Springer-Verlag, Berlin, Germany [273] [Niv04] G Nivasch Cycle detection using a stack Information Processing Letter, 90(3):135–140, 2004 [229, 242] [NP99] Wim Nevelsteen and Bart Preneel Software performance of universal hash functions In Jacques Stern, editor, EUROCRYPT’99, volume 1592 of LNCS, pages 24–41, Prague, Czech Republic, May 2–6, 1999 Springer-Verlag, Berlin, Germany [8] [NS05] Phong Q Nguyen and Damien Stehl´e Floating-point LLL revisited In Ronald Cramer, editor, EUROCRYPT 2005, volume 3494 of LNCS, pages 215–233, Aarhus, Denmark, May 22–26, 2005 Springer-Verlag, Berlin, Germany [326] [Odl85] Andrew M Odlyzko Discrete logarithms in finite fields and their cryptographic significance In Thomas Beth, Norbert Cot, and Ingemar Ingemarsson, editors, EUROCRYPT’84, volume 209 of LNCS, pages 224–314, Paris, France, April 9–11, 1985 SpringerVerlag, Berlin, Germany [113] [OST06] Dag Arne Osvik, Adi Shamir, and Eran Tromer Cache attacks and countermeasures: The case of AES In David Pointcheval, editor, CT-RSA 2006, volume 3860 of LNCS, pages 1–20, San Jose, CA, USA, February 13–17, 2006 Springer-Verlag, Berlin, Germany [92] [Pai99] Pascal Paillier Public-key cryptosystems based on composite degree residuosity classes In Jacques Stern, editor, EUROCRYPT’99, volume 1592 of LNCS, pages 223–238, Prague, Czech Republic, May 2–6, 1999 Springer-Verlag, Berlin, Germany [64] [Pan84] Victor Pan How to multiply matrix faster, volume 179 of LNCS Springer-Verlag, Berlin, Germany, 1984 [89] [Pat96] Jacques Patarin Hidden fields equations (HFE) and isomorphisms of polynomials (IP): Two new families of asymmetric algorithms In Ueli M Maurer, editor, EUROCRYPT’96, volume 1070 of LNCS, pages 33–48, Saragossa, Spain, May 12–16, 1996 Springer-Verlag, Berlin, Germany [362, 363] © 2009 by Taylor and Francis Group, LLC 486 Algorithmic Cryptanalysis [PGF98] Daniel Panario, Xavier Gourdon, and Philippe Flajolet An analytic approach to smooth polynomials over finite fields In Third Algorithmic Number Theory Symposium (ANTS), volume 1423 of LNCS, pages 226–236 Springer-Verlag, Berlin, Germany, 1998 [444] [PK95] Walter T Penzhorn and G J Kuhn Computation of lowweight parity checks for correlation attacks on stream ciphers In Cryptography and Coding – 5th IMA Conference, volume 1025 of LNCS, pages 74–83 Springer-Verlag, Berlin, Germany, 1995 [386] [Pol75] John M Pollard A Monte Carlo method for factorization BIT Numerical Mathematics, 15(3):331–334, 1975 [233] [Pom82] Carl Pomerance Analysis and comparison of some integer factoring methods In Jr Hendrik W Lenstra and Robert Tijdeman, editors, Computational methods in number theory – Part I, volume 154 of Mathematical centre tracts, pages 8–139 Mathematisch Centrum, Amsterdam, 1982 [141] [Pri81] Paul Pritchard A sublinear additive sieve for finding prime numbers Communications of the ACM, 24(1):18–23, 1981 [128, 133] [Pri83] Paul Pritchard Fast compact prime number sieves (among others) Journal of algorithms, 4:332–344, 1983 [133] [QD90] Jean-Jacques Quisquater and Jean-Paul Delescaille How easy is collision search New results and applications to DES In Gilles Brassard, editor, CRYPTO’89, volume 435 of LNCS, pages 408– 413, Santa Barbara, CA, USA, August 20–24, 1990 SpringerVerlag, Berlin, Germany [229, 244] [RBBK01] Phillip Rogaway, Mihir Bellare, John Black, and Ted Krovetz OCB: A block-cipher mode of operation for efficient authenticated encryption In ACM CCS 01, pages 196–205, Philadelphia, PA, USA, November 5–8, 2001 ACM Press [15, 17] [RH07] Sondre Rønjom and Tor Helleseth A new attack on the filter generator IEEE Transactions on Information Theory, 53(5):1752– 1758, 2007 [388, 389] [Sch87] Claus-Peter Schnorr A hierarchy of polynomial time lattice basis reduction algorithms Theoretical Computer Science, 53:201–224, 1987 [331] [Sch90] Claus-Peter Schnorr Efficient identification and signatures for smart cards In Gilles Brassard, editor, CRYPTO’89, volume 435 of LNCS, pages 239–252, Santa Barbara, CA, USA, August 20– 24, 1990 Springer-Verlag, Berlin, Germany [67] © 2009 by Taylor and Francis Group, LLC References 487 [Sch91] Claus-Peter Schnorr Efficient signature generation by smart cards Journal of Cryptology, 4(3):161–174, 1991 [10] [Sch93] Oliver Schirokauer Discrete logarithms and local units Phil Trans R Soc Lond A 345, pages 409–423, 1993 [461] [Sch96] Bruce Schneier Applied Cryptography (Second Edition) John Wiley & Sons, 1996 [3] [SE94] Claus-Peter Schnorr and M Euchner Lattice basis reduction: Improved practical algorithms and solving subset sum problems Math Program., 66:181–199, 1994 [326, 328] [Sha49] Claude E Shannon Communication theory of secrecy systems Bell System Technical Journal, 28:656–715, 1949 [4, 337] [Sie84] T Siegenthaler Correlation-immunity of nonlinear combining functions for cryptographic applications IEEE Trans on Information Theory, IT-30:776–780, 1984 [378] [Sie85] T Siegenthaler Decrypting a class of stream ciphers using ciphertext only IEEE Trans Comput., C-34:81–85, 1985 [378] [Sil86] Joseph H Silverman The Arithmetic of Elliptic Curves, volume 106 of Graduate Texts in Mathematics Springer, New York, 1986 [417, 424, 431] [Sim82] Gustavus J Simmons A system for point-of-sale or access user authentication and identification In Allen Gersho, editor, CRYPTO’81, volume ECE Report 82-04, pages 31–37, Santa Barbara, CA, USA, 1982 U.C Santa Barbara, Dept of Elec and Computer Eng [8] [Sim85] Gustavus J Simmons Authentication theory/coding theory In G R Blakley and David Chaum, editors, CRYPTO’84, volume 196 of LNCS, pages 411–431, Santa Barbara, CA, USA, August 19–23, 1985 Springer-Verlag, Berlin, Germany [8] [Sim86] Gustavus J Simmons The practice of authentication In Franz Pichler, editor, EUROCRYPT’85, volume 219 of LNCS, pages 261–272, Linz, Austria, April 1986 Springer-Verlag, Berlin, Germany [8] [Sor98] Jonathan P Sorenson Trading time for space in prime number sieves In Third Algorithmic Number Theory Symposium (ANTS), volume 1423 of LNCS, pages 179–195 Springer-Verlag, Berlin, Germany, 1998 [133] [SS81] Richard Schroeppel and Adi Shamir A T = O(2n/2 ), S = O(2n/4 ) algorithm for certain NP-complete problems SIAM Journal on Computing, 10(3):456–464, 1981 [251] © 2009 by Taylor and Francis Group, LLC 488 Algorithmic Cryptanalysis [Sti02] Douglas Stinson Cryptography: Theory and Practice (Third Edition) CRC Press LLC, Boca Raton, Florida, 2002 [3] [Str69] Volker Strassen Gaussian elimination is not optimal Numer Math., 13:354–356, 1969 [80] [TCG92] Anne Tardy-Corfdir and Henri Gilbert A known plaintext attack of FEAL-4 and FEAL-6 In Joan Feigenbaum, editor, CRYPTO’91, volume 576 of LNCS, pages 172–181, Santa Barbara, CA, USA, August 11–15, 1992 Springer-Verlag, Berlin, Germany [273] [TSM94] Toshio Tokita, Tohru Sorimachi, and Mitsuru Matsui Linear cryptanalysis of LOKI and s2DES In Josef Pieprzyk and Reihaneh Safavi-Naini, editors, ASIACRYPT’94, volume 917 of LNCS, pages 293–303, Wollongong, Australia, November 28 – December 1, 1994 Springer-Verlag, Berlin, Germany [273] [Val91] Brigitte Vall´ee Gauss’ algorithm revisited J Algorithms, 12(4), 1991 [318] [vW96] Paul C van Oorschot and Michael J Wiener Improving implementable meet-in-the-middle attacks by orders of magnitude In Neal Koblitz, editor, CRYPTO’96, volume 1109 of LNCS, pages 229–236, Santa Barbara, CA, USA, August 18–22, 1996 Springer-Verlag, Berlin, Germany [244] [Wag99] David Wagner The boomerang attack In Lars R Knudsen, editor, FSE’99, volume 1636 of LNCS, pages 156–170, Rome, Italy, March 24–26, 1999 Springer-Verlag, Berlin, Germany [182] [Wag02] David Wagner A generalized birthday problem In Moti Yung, editor, CRYPTO 2002, volume 2442 of LNCS, pages 288–303, Santa Barbara, CA, USA, August 18–22, 2002 Springer-Verlag, Berlin, Germany [264, 265] [Was03] Lawrence C Washington Elliptic curves: number theory and cryptography CRC Press LLC, Boca Raton, Florida, 2003 [422] [WC81] Mark N Wegman and Larry Carter New hash functions and their use in authentication and set equality Journal of Computer and System Sciences, 22:265–279, 1981 [8] [Wie90] Michael J Wiener Cryptanalysis of short RSA secret exponents (abstract) In Jean-Jacques Quisquater and Joos Vandewalle, editors, EUROCRYPT’89, volume 434 of LNCS, page 372, Houthalen, Belgium, April 10–13, 1990 Springer-Verlag, Berlin, Germany [414] [Wie04] Michael J Wiener The full cost of cryptanalytic attacks Journal of Cryptology, 17(2):105–124, March 2004 [5] © 2009 by Taylor and Francis Group, LLC References 489 [WYY05a] Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu Efficient collision search attacks on SHA-0 In Victor Shoup, editor, CRYPTO 2005, volume 3621 of LNCS, pages 1–16, Santa Barbara, CA, USA, August 14–18, 2005 Springer-Verlag, Berlin, Germany [179, 182] [WYY05b] Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu Finding collisions in the full SHA-1 In Victor Shoup, editor, CRYPTO 2005, volume 3621 of LNCS, pages 17–36, Santa Barbara, CA, USA, August 14–18, 2005 Springer-Verlag, Berlin, Germany [179, 182] [XM88] Guo-Zhen Xiao and James L Massey A spectral characterization of correlation-immune combining functions IEEE Transactions on Information Theory, 34(3):569–571, 1988 [275] [Yuv79] Gideon Yuval How to swindle Rabin Cryptologia, 3:187–189, 1979 [243] [ZF06] Bin Zhang and Dengguo Feng Multi-pass fast correlation attack on stream ciphers In Eli Biham and Amr M Youssef, editors, SAC 2006, volume 4356 of LNCS, pages 234–248, Montreal, Canada, August 17–18, 2006 Springer-Verlag, Berlin, Germany [380] [Zha05] Fuzhen Zhang, editor The Schur Complement and Its Applications (Numerical Methods and Algorithms) Springer, New York, 2005 [94] [Zhe97] Yuliang Zheng Digital signcryption or how to achieve cost(signature & encryption) < cost(signature) + cost(encryption) In Burton S Kaliski Jr., editor, CRYPTO’97, volume 1294 of LNCS, pages 165–179, Santa Barbara, CA, USA, August 17–21, 1997 Springer-Verlag, Berlin, Germany [20] © 2009 by Taylor and Francis Group, LLC Lists List of Algorithms 2.1 Euclid’s greatest common divisor algorithm 28 2.2 Euclid’s extended algorithm 29 2.3 GCD of a list of numbers 30 2.4 Stein’s binary greatest common divisor algorithm 32 2.5 Addition modulo N 35 2.6 Subtraction modulo N 35 2.7 Multiplication modulo N 36 2.8 Multiplicative inverse modulo N 36 2.9 Exponentiation in Z/N Z, left-to-right version 36 2.10 Exponentiation in Z/N Z, right-to-left version 37 2.11 Shanks-Tonelli algorithm for square roots in Fp 40 2.12 Computation of Jacobi symbols 42 2.13 Stein’s greatest common divisor algorithm for polynomials 46 2.14 Berlekamp-Massey algorithm 56 2.15 Squarefree factorization of polynomials 58 2.16 Distinct degree factorization of a squarefree polynomial 58 2.17 Final splitting of polynomials 60 3.1 Elementary square matrix multiplication 72 3.2 Strassen matrix multiplication (rounding up) 82 3.3 Strassen matrix multiplication (rounding down) 83 3.4 Triangularization of a linear system (simplified, incorrect) 95 3.5 Backtracking to solve a triangular system 95 3.6 Triangularization of a linear system 97 3.7 Matrix inversion 99 3.8 Triangularization of a possibly non-invertible system 101 3.9 Backtracking of a possibly non-invertible triangular system 102 3.10 Hermite normal forms 104 3.11 Lanczos’s algorithm over finite fields 109 491 © 2009 by Taylor and Francis Group, LLC 492 Algorithmic Cryptanalysis 4.1 Eratosthenes’s sieve 124 4.2 Sieve of Atkin and Bernstein for primes ≡ (mod 4) 134 4.3 Two-dimensional sieving for smooth numbers 139 4.4 Walking the multiples with polynomials 145 4.5 Walking the multiples with numbers 146 4.6 Basic line sieve 149 6.1 Generating all collisions in a sorted list 193 6.2 Dichotomy search 195 6.3 Bubble sort 197 6.4 Find minimal element 197 6.5 Selection sort 198 6.6 Insertion sort 199 6.7 Merge sort main procedure 200 6.8 Merge sort wrapper 201 6.9 Quicksort 202 6.10 Radix sort 203 6.11 Heap sort 205 6.12 Insertion in heap procedure 205 6.13 Count sort: Beating the sort lower bound 206 6.14 Collision search using hash tables 209 6.15 Avoiding cache misses with hash tables 211 6.16 Insertion in a binary search tree 214 6.17 Deletion in a binary search tree 215 6.18 Pohlig-Hellman discrete logarithm algorithm 218 6.19 Baby-step, giant-step discrete logarithm algorithm 219 7.1 Floyd’s cycle detection algorithm 225 7.2 Brent’s cycle detection algorithm 226 7.3 Algorithm for recovering a cycle’s start 228 7.4 Nivasch’s cycle detection algorithm 230 7.5 Pollard’s Rho factoring algorithm 235 8.1 Initialization of Shamir and Schroeppel algorithm 255 8.2 Get next knapsack sum with Shamir and Schroeppel algorithm 255 8.3 Generating all solutions to Equation (8.10) 259 8.4 Alternative option to Algorithm 8.3 260 9.1 Algorithm for computing differential characteristics 274 9.2 Algorithm for computing linear characteristics 275 © 2009 by Taylor and Francis Group, LLC Lists 493 9.3 Walsh transform algorithm 276 9.4 Inverse Walsh transform algorithm 277 9.5 Algorithm for truncated differential characteristics 283 9.6 Moebius transform algorithm 286 9.7 Pre-Walsh transform encoding over Fp 291 9.8 Walsh transform algorithm over Fp 292 9.9 Moebius transform algorithm over Fp 295 n 9.10 Fast Fourier transform algorithm on N = values 298 9.11 Core transform of extended Walsh over Fp 301 10.1 Gauss’s reduction algorithm 312 10.2 t-Gauss reduction algorithm 317 10.3 Gram-Schmidt algorithm 320 10.4 LLL algorithm using rationals 322 10.5 Length reduction subalgorithm RED(i, j) 323 10.6 A basic short vector enumeration algorithm 329 10.7 Kannan’s HKZ reduction algorithm 331 11.1 Computation of normal form 349 11.2 Basic version of Buchberger’s algorithm 353 11.3 Reduction of a Gră obner basis 355 11.4 A basic linear algebra based Grăobner basis algorithm 358 12.1 Computing formal expression of LFSR outputs 384 14.1 Miller’s algorithm with double and add 432 14.2 Pollard’s p − factoring algorithm 433 15.1 Compute number of smooth polynomials 466 List of Figures 1.1 Some classical encryption modes 2.1 Ordinary LFSR 50 2.2 Galois LFSR 51 3.1 MMX and SSE instructions 75 3.2 Winograd’s formulas for matrix multiplication 84 3.3 Performance of Strassen’s multiplication over F2 87 3.4 Performance of Strassen’s multiplication over Fp 91 3.5 Principles of cached memory in processors 92 © 2009 by Taylor and Francis Group, LLC 494 Algorithmic Cryptanalysis 3.6 Effect of a pivoting step 96 4.1 Schematic picture of wheel factorization 127 4.2 Multiples of in a wheel of perimeter 30 131 4.3 Set of points a + bα divisible by (11, 5) 137 4.4 Gray codes 143 4.5 Illustration of Algorithm 4.5 147 5.1 Propagation of differences in a local collision of SHA 170 7.1 Rho shape while iterating a random function 224 10.1 A 2-dimensional lattice with a basis 312 10.2 A reduced basis of the same lattice 313 10.3 Applying Gauss’s algorithm 314 10.4 Typical cases of short vectors in 2-dimensional lattices 316 10.5 Computing b∗3 from b3 321 10.6 An elementary reduction step of L in dimension 323 11.1 A sample algebraic system in two unknowns 342 12.1 Noisy LFSR (Binary Symmetric Channel) model 376 List of Programs 2.1 Representation of F232 with a Galois LFSR 51 3.1 Basic C code for matrix multiplication over F2 73 3.2 Matrix multiplication over F2 with compact encoding 74 3.3 Matrix multiplication using fast scalar product 76 3.4 Fast transposition of 32 × 32 matrices over F2 78 3.5 Faster scalar product for multiplying of 32 × 32 matrices 79 3.6 C code for elementary 32n × 32n matrix multiplication over F2 86 3.7 C code for elementary matrix multiplication over Fp 88 3.8 C code for matrix mult over Fp with fewer modular reductions 3.9 Inversion of 32 × 32 matrix over F2 100 4.1 Basic C code for Eratosthenes’s sieve 126 4.2 Small memory code for Eratosthenes’s sieve 129 4.2 Small memory code for Eratosthenes’s sieve (continued) 130 © 2009 by Taylor and Francis Group, LLC 90 Lists 495 4.3 Line sieving with two levels of cache 151 9.1 C code for Walsh transform 278 9.2 C code for Moebius transform 287 List of Tables 3.1 32 × 32 Boolean matmul on Intel Core Duo at 2.4 GHz 80 3.2 Times for (32n) × (32n) Boolean matrix multiplication 86 5.1 DES initial permutation 158 5.2 DES final permutation 158 5.3 Permutation of the round function 159 5.4 Expansion of the round function 160 5.5 S-box S1 160 5.6 S-box S2 160 5.7 S-box S3 160 5.8 S-box S4 160 5.9 S-box S5 160 5.10 S-box S6 161 5.11 S-box S7 161 5.12 S-box S8 161 5.13 Permutation PC-1 of the key bits 162 5.14 Table PC-2 to extract Ki from Ci and Di 162 5.15 Definition of the round functions and constants 167 5.16 Possible expanded bit sequences for local collisions 172 5.17 Case by case behavior of MAJ(x, y, z) 175 5.18 Case by case behavior of XOR(x, y, z) 175 5.19 Case by case behavior of IF(x, y, z) 175 5.20 Case by case behavior of ADD(x, y, z) (carry bit on left) 176 5.21 Interferences of overlapping local collisions 178 9.1 Timings on Intel Core Duo at 2.4 GHz using gcc 4.3.2 278 12.1 Typical probabilities with binomial distributions 379 15.1 Equations (x + u) = (y + v1 ) · (y + v2 ) as triples (u, v1 , v2 ) 450 15.2 Equations (x + u1 ) · (x + u2 ) = (y + v) as triples (u1 , u2 , v) 450 © 2009 by Taylor and Francis Group, LLC 496 Algorithmic Cryptanalysis 15.3 Equations a(x + u1 ) · (x + u2 ) = (y + v1 ) · (y + v2 ) from x + ay + b represented by (a, b) (u1 , u2 , v1 , v2 ) © 2009 by Taylor and Francis Group, LLC 451 ... QA76.9.A43J693 2009 005.8’2 dc22 Visit the Taylor & Francis Web site at http://www.taylorandfrancis.com and the CRC Press Web site at http://www.crcpress.com © 2009 by Taylor and Francis Group, LLC 20090 16989... Approach © 2009 by Taylor and Francis Group, LLC Chapman & Hall /CRC CRYPTOGRAPHY AND NETWORK SECURITY Algorithmic cryptAnAlysis Antoine Joux © 2009 by Taylor and Francis Group, LLC Chapman & Hall /CRC. .. Cataloging‑in‑Publication Data Joux, Antoine Algorithmic cryptanalysis / Antoine Joux p cm (Chapman & Hall /CRC cryptography and network security) Includes bibliographical references and index ISBN 978-1-4200-7002-6