Analysis of the Sliding Window Powering Algorithm

Recently S. D. Cohen resolved a conjecture of Chowla and Zassenhaus (1968) in the affirmative by showing that, if f ( x ) f(x) and g ( x ) g(x) are integral polynomials of degree n ≥ 2 n \geq 2 and p is a prime exceeding ( n 2 − 3 n + 4 ) 2 {({n^2} - 3n + 4)^2} for which f and g are both permutation polynomials of the finite field F p {F_p} , then their difference h = f − g h = f - g cannot be such that h ( x ) = c x h(x) = cx for some integer c not divisible by p. In this note we provide a significant generalization by proving that, if h is not a constant in F p {F_p} and t is the degree of h, then t ≥ 3 n / 5 t \geq 3n/5 and, provided t ≤ n − 3 t \leq n - 3 , t and n are not relatively prime. In a sense this measures the isolation of permutation polynomials of the same degree over large finite prime fields.

Concretely efficient interactive oracle proofs (IOPs) are of interest due to their applications to scaling blockchains, their minimal security assumptions, and their potential future-proof resistance to quantum attacks.Scalable IOPs, in which prover time scales quasilinearly with the computation size and verifier time scales poly-logarithmically with it, have been known to exist thus far only over a set of finite fields of negligible density, namely, over “FFT-friendly” fields that contain a sub-group of size \(2^\mathsf{{k}} \).Our main result is to show that scalable IOPs can be constructed over any sufficiently large finite field, of size that is at least quadratic in the length of computation whose integrity is proved by the IOP. This result has practical applications as well, because it reduces the proving and verification complexity of cryptographic statements that are naturally stated over pre-defined finite fields which are not “FFT-friendly”. Prior state-of-the-art scalable IOPs relied heavily on arithmetization via univariate polynomials and Reed–Solomon codes over FFT-friendly fields. To prove our main result and extend scalability to all large finite fields, we generalize the prior techniques and use new algebraic geometry codes evaluated on sub-groups of elliptic curves (elliptic curve codes). We also show a new arithmetization scheme that uses the rich and well-understood group structure of elliptic curves to reduce statements of computational integrity to other statements about the proximity of functions evaluated on the elliptic curve to the new family of elliptic curve codes.

For a vector space \({\mathbb{F}^n}\) over a field \(\mathbb{F}\), an (η, β)-dimension expander of degree d is a collection of d linear maps \({\Gamma _j}:{\mathbb{F}^n} \rightarrow {\mathbb{F}^n}\) such that for every subspace U of \({\mathbb{F}^n}\) of dimension at most ηn, the image of U under all the maps, ∑ dj=1 Γj(U), has dimension at least α dim(U). Over a finite field, a random collection of d = O(1) maps Γj offers excellent “lossless” expansion whp: β≈d for η ≥ Ω(1/d). When it comes to a family of explicit constructions (for growing n), however, achieving even modest expansion factor β = 1+ ε with constant degree is a non-trivial goal.We present an explicit construction of dimension expanders over finite fields based on linearized polynomials and subspace designs, drawing inspiration from recent progress on list decoding in the rank metric. Our approach yields the following: Lossless expansion over large fields; more precisely β ≥ (1 − ε)d and \(\eta \ge {{1 - \varepsilon} \over d}\) with d = Oε(1), when \(\left| \mathbb{F} \right| \ge \Omega \left(n \right)\). Optimal up to constant factors expansion over fields of arbitrarily small polynomial size; more precisely β ≥ Ω(δd) and η ≥ Ω(1/(δd)) with d = Oδ(1), when \(\left| \mathbb{F} \right| \ge {n^\delta}\). Previously, an approach reducing to monotone expanders (a form of vertex expansion that is highly non-trivial to establish) gave (Ω(1), 1 + Ω(1))-dimension expanders of constant degree over all fields. An approach based on “rank condensing via subspace designs” led to dimension expanders with \(\beta \mathbin{\lower.3ex\hbox{$\buildrel>\over {\smash{\scriptstyle\sim}\vphantom{_x}}$}} \sqrt d \) over large finite fields. Ours is the first construction to achieve lossless dimension expansion, or even expansion proportional to the degree.

In Chen-Cramer Crypto 2006 paper \cite{cc} algebraic geometric secret sharing schemes were proposed such that the Fundamental Theorem in Information-Theoretically Secure Multiparty Computation by Ben-Or, Goldwasser and Wigderson \cite{BGW88} and Chaum, Crepeau and Damgard \cite{CCD88} can be established over constant-size base finite fields. These algebraic geometric secret sharing schemes defined by a curve of genus $g$ over a constant size finite field ${\bf F}_q$ is quasi-threshold in the following sense, any subset of $u \leq T-1$ players (non qualified) has no information of the secret and any subset of $u \geq T+2g$ players (qualified) can reconstruct the secret. It is natural to ask that how far from the threshold these quasi-threshold secret sharing schemes are? How many subsets of $u \in [T, T+2g-1]$ players can recover the secret or have no information of the secret? In this paper it is proved that almost all subsets of $u \in [T,T+g-1]$ players have no information of the secret and almost all subsets of $u \in [T+g,T+2g-1]$ players can reconstruct the secret when the size $q$ goes to the infinity and the genus satisfies $\lim \frac{g}{\sqrt{q}}=0$. Then algebraic geometric secret sharing schemes over large finite fields are asymptotically threshold in this case. We also analyze the case when the size $q$ of the base field is fixed and the genus goes to the infinity.

A simple probabilistic algorithm is presented to find the irreducible factors of a bivariate polynomial over a large finite field. For a polynomial f ( x , y ) f(x,y) over F q {F_q} of total degree n , our algorithm takes at most \[ n 4.89 log 2 n log ⁡ q {n^{4.89}}{\log ^2}n\log q \] operations in F q {F_q} to factor f ( x , y ) f(x,y) completely. This improves a probabilistic factorization algorithm of von zur Gathen and Kaltofen, which takes \[ O ( n 11 log ⁡ n log ⁡ q ) O({n^{11}}\log n\log q) \] operations to factor f ( x , y ) f(x,y) completely over F q {F_q} . The algorithm can be easily generalized to factor multivariate polynomials over finite fields. We shall give two further applications of the idea involved in the algorithm. One is concerned with exponential sums; the other is related to permutational polynomials over finite fields (a conjecture of Chowla and Zassenhaus).

Cryptographic schemes, such as authentication, confidentiality, and integrity, rely on computations in very large finite fields, whose hardware realization may require millions of logic gates. In a straightforward design, even a single fault in such a complex circuit is likely to yield an incorrect result and may be exploited by an attacker to break the cryptosystem. In this regard, we consider computing over finite fields in presence of certain faults in multiplier circuits. Our work reported here deals with errors caused by such faults in polynomial basis multipliers over finite fields of characteristic two and presents a scheme to correct single errors. Towards this, pertinent theoretical results are derived, and both bit-parallel and bit-serial fault tolerant multipliers are proposed.

This paper reviews some of the known algorithms for factoring polynomials over finite fields and presents a new deterministic procedure for reducing the problem of factoring an arbitrary polynomial over the Galois field GF(p m) to the problem of finding the roots in GF(p) of certain other polynomials over GF(p). The amount of computation and the storage space required by these algorithms are algebraic in both the degree of the polynomial to be factored and the logarithm of the order of the finite field. Certain observations on the application of these methods to the factorization of polynomials over the rational integers are also included.

In this paper, we present a method to compute all the irreducible and primitive polynomials of degree m over a finite field. We also describe two concrete implementations of our method with respective time complexities O(m2 + m log m) and O(m2 + log m). These implementations, using in parallel different devices introduced to operate in these fields [1], [7], allows us to reduce the time complexity of our method below that of the best previously known methods [3]. Our algorithm is especially well-suited for applications using large finite fields.

The main topic of this thesis is related to the state of the art in designing cryptographic primitives from a hardware point of view. A special emphasis is dedicated to low-power/low-energy CMOS design. A set of solutions is proposed including an LFSR based stream cipher with self-synchronizing capabilities, a new memory-less Rijndael block cipher architecture and a public key scheme in the class of discrete logarithm. The former is based on arithmetic in large finite field, mainly Galois extension field GF(2‴). These solutions are droved using low-energy techniques, in order to decrease both the switching activity and the total delay. The fundamental motivation supporting this work, is to demonstrate that practical solutions can be obtained for implementing such complex primitives in large scaled circuits, that arc at once, high performance architectures (low-power, high-speed) and cryptographicaly strong, using the well known trade-off between area-speed or area-power. Security constraint has been duly considered, mainly by increasing the key-size. In this work, we explore the general aspects of designing the above mentioned cryptographic functions. We give an extensive survey of some cryptographic primitives from the hardware point of view and expose their security properties. The thesis favours stream cipher and public-key schemes, as currently the most promising advance to capture the notion of key generation and establishment and data bulk encryption. One contribution is the convenient notation for expressing cryptographic self-synchronizing stream ciphers SSSC schemes and our SSMG proposal, a scheme based on packet fingerprint identification, that relies on keyed cryptographic hash function to achieve the security requirements. We maintain an important distinction between hardware implementation and algorithm's security, because the security of cryptographic primitives cannot be based on mathematically strong functions only but requires an extensive cryptanalysis at different levels including the application. This causes a concern for a formalization of the security of an implemented cryptographic primitive. Nevertheless, while some schemes arc well known to be secure such as DL based public key schemes and enough cryptanalyzed such as the new standard Rijndael, some security aspects of the SSMG are discussed. A part of this work studies the specific aspects related to hardware implementation of Rijndael block cipher, the new standard designed to be a substitute for DES. An efficient architecture is developed targeting FPGA implementation, by simply avoiding memory blocks dedicated to the implementation of S-boxes and replacing them by on-chip forward computation using composite Galois field. This technique helps to reduce considerably the amount of hardware required at the cost of little increase of the switching activity. The main conclusion is that, while security constraint of cryptographic primitives increases the hardware complexity and reduces the performances, practical solutions exist for reducing such complexities while keeping or increasing the level of security. Nevertheless, major open questions remain both for a firm theoretical foundation and the proper cryptanalysis of certain solutions.

Introduction. The problem of mathematical safe arises in the theory of computer games and cryptographic applications. The article considers numerous variations of the mathematical safe problem and examples of its solution using systems of linear Diophantine equations in finite rings and fields. The purpose of the article. To present methods for solving the problem of a mathematical safe for its various variations, which are related both to the domain over which the problem is considered and to the structure of systems of linear equations over these domains. To consider the problem of a mathematical safe (in matrix and graph forms) in different variations over different finite domains and to demonstrate the work of methods for solving this problem and their efficiency (systems over finite simple fields, finite fields, ghost rings and finite associative-commutative rings). Results. Examples of solving the problem of a mathematical safe, the conditions for the existence of solutions in different areas, over which this problem is considered. The choice of the appropriate area over which the problem of the mathematical safe is considered, and the appropriate algorithm for solving it depends on the number of positions of the latches of the safe. All these algorithms are accompanied by estimates of their time complexity, which were considered in the first part of this paper. Conclusions. The considered methods and algorithms for solving linear equations and systems of linear equations in finite rings and fields allow to solve the problem of a mathematical safe in a large number of variations of its formulation (over finite prime field, finite field, primary associative-commutative ring and finite associative-commutative ring with unit). Keywords: mathematical safe, finite rings, finite fields, method, algorithm.

In this paper, we present Microblaze-based parallel architectures of Elliptic Curve Scalar Multiplication (ECSM) computation for embedded Elliptic Curve Cryptosystem (ECC) on Xilinx FPGA. The proposed implementations support arbitrary Elliptic Curve (EC) forms defined over large prime field ([Formula: see text]) with different security-level sizes. ECSM is performed using Montgomery Power Ladder (MPL) algorithm in Chudnovsky projective coordinates system. At the low abstraction level, Montgomery Modular Multiplication (MMM) is considered as the critical operation. It is implemented within a hardware Accelerator MMM (AccMMM) core based on the modified high radix, [Formula: see text] MMM algorithm. The efficiency of our parallel implementations is achieved by the combination of the mixed SW/HW approach with Multi Processor System on Programmable Chip (MPSoPC) design. The integration of multi MicroBlaze processor in single architecture allows not only the flexibility of the overall system but also the exploitation of the parallelism in ECSM computation with several degrees. The Virtex-5 parallel implementations of 256-bit and 521-bis ECSM computations run at 100[Formula: see text]MHZ frequency and consume between 2,739 and 6,533 slices, 22 and 72 RAMs and between 16 and 48 DSP48E cores. For the considered security-level sizes, the delays to perform single ECSM are between 115[Formula: see text]ms and 14.72[Formula: see text]ms.

Dense matrix-matrix multiplication over small finite fields is a common operation in many application domains, such as cryptography, random numbers, and error correcting codes. This paper shows that FPGAs have the potential to greatly accelerate this time consuming operation, and in particular that systolic array based approaches are both practical and efficient when using large modern devices. A number of finite-field specific architectural optimisations are introduced, allowing n×n matrices to be processed in O(n) cycles, for matrix sizes up to n=350. Comparison with optimised software implementations on a single-core CPU shows that an FPGA accelerator can achieve between 80x and 700x speed-up over a Virtex-7 XC7V200T for GF(2k), but for GF(3) and larger finite fields can provide practical speed-ups of 1000x or more.

We introduce Four $$\mathbb {Q}$$ , a high-security, high-performance elliptic curve that targets the 128-bit security level. At the highest arithmetic level, cryptographic scalar multiplications on Four $$\mathbb {Q}$$ can use a four-dimensional Gallant-Lambert-Vanstone decomposition to minimize the total number of elliptic curve group operations. At the group arithmetic level, Four $$\mathbb {Q}$$ admits the use of extended twisted Edwards coordinates and can therefore exploit the fastest known elliptic curve addition formulas over large prime characteristic fields. Finally, at the finite field level, arithmetic is performed modulo the extremely fast Mersenne prime $$p=2^{127}-1$$ . We show that this powerful combination facilitates scalar multiplications that are significantly faster than all prior works. On Intel’s Haswell, Ivy Bridge and Sandy Bridge architectures, our software computes a variable-base scalar multiplication in 59,000, 71,000 cycles and 74,000 cycles, respectively; and, on the same platforms, our software computes a Diffie-Hellman shared secret in 92,000, 110,000 cycles and 116,000 cycles, respectively.

In this paper, we describe many improvements to the number field sieve. Our main contribution consists of a new way to compute individual logarithms with the number field sieve without solving a very large linear system for each logarithm. We show that, with these improvements, the number field sieve outperforms the gaussian integer method in the hundred digit range. We also illustrate our results by successfully computing discrete logarithms with GNFS in a large prime field.

The GLV method of Gallant, Lambert, and Vanstone (CRYPTO 2001) computes any multiple kP of a point P of prime order n lying on an elliptic curve with a low-degree endomorphism ? (called GLV curve) over $\mathbb{F}_{p}$ as $$kP = k_1P + k_2\varPhi(P) \quad\text{with } \max \bigl\{ |k_1|,|k_2| \bigr\} \leq C_1\sqrt{n} $$ for some explicit constant C 1>0. Recently, Galbraith, Lin, and Scott (EUROCRYPT 2009) extended this method to all curves over $\mathbb{F}_{p^{2}}$ which are twists of curves defined over $\mathbb{F}_{p}$ . We show in this work how to merge the two approaches in order to get, for twists of any GLV curve over $\mathbb{F}_{p^{2}}$ , a four-dimensional decomposition together with fast endomorphisms ?,? over $\mathbb{F}_{p^{2}}$ acting on the group generated by a point P of prime order n, resulting in a proven decomposition for any scalar k?[1,n] given by $$kP=k_1P+ k_2\varPhi(P)+ k_3\varPsi(P) + k_4\varPsi\varPhi(P) \quad \text{with } \max_i \bigl(|k_i| \bigr) 0. Remarkably, taking the best C 1,C 2, we obtain C 2/C 1<412, independently of the curve, ensuring in theory an almost constant relative speedup. In practice, our experiments reveal that the use of the merged GLV---GLS approach supports a scalar multiplication that runs up to 1.5 times faster than the original GLV method. We then improve this performance even further by exploiting the Twisted Edwards model and show that curves originally slower may become extremely efficient on this model. In addition, we analyze the performance of the method on a multicore setting and describe how to efficiently protect GLV-based scalar multiplication against several side-channel attacks. Our implementations improve the state-of-the-art performance of scalar multiplication on elliptic curves over large prime characteristic fields for a variety of scenarios including side-channel protected and unprotected cases with sequential and multicore execution.