Cryptanalytic Applications of the Polynomial Method for Solving Multivariate Equation Systems over GF(2)

In this paper, we construct an optimization problem to solve a system of algebraic equations over a finite field. Given a system of equations over finite field, we derive a system of equations over the real numbers from the given system. We construct a model of an unconstrained optimization problem by using a penalty function. We also show that an optimal solution to the unconstrained optimization problem is the solution of the original system of algebraic equations over a finite field.

Introduction. The problem of mathematical safe arises in the theory of computer games and cryptographic applications. The article considers numerous variations of the mathematical safe problem and examples of its solution using systems of linear Diophantine equations in finite rings and fields. The purpose of the article. To present methods for solving the problem of a mathematical safe for its various variations, which are related both to the domain over which the problem is considered and to the structure of systems of linear equations over these domains. To consider the problem of a mathematical safe (in matrix and graph forms) in different variations over different finite domains and to demonstrate the work of methods for solving this problem and their efficiency (systems over finite simple fields, finite fields, ghost rings and finite associative-commutative rings). Results. Examples of solving the problem of a mathematical safe, the conditions for the existence of solutions in different areas, over which this problem is considered. The choice of the appropriate area over which the problem of the mathematical safe is considered, and the appropriate algorithm for solving it depends on the number of positions of the latches of the safe. All these algorithms are accompanied by estimates of their time complexity, which were considered in the first part of this paper. Conclusions. The considered methods and algorithms for solving linear equations and systems of linear equations in finite rings and fields allow to solve the problem of a mathematical safe in a large number of variations of its formulation (over finite prime field, finite field, primary associative-commutative ring and finite associative-commutative ring with unit). Keywords: mathematical safe, finite rings, finite fields, method, algorithm.

Let G be a simple connected graph with r vertices and t edges. Let d be a positive integer and \(a\in F_{p^n}^{*}\). The associated system of equations S(G, d, p n , a) of G over a finite field \(F_{p^n}^{*}\) is defined to be AX = C, where \(X = (x^d_1, x^d_2,...,x^d_t)^{\top}\), C = (a, a, ..., a) ⊤ , A = (a ij ) is the incidence matrix of G. We show that the solutions of S(G, d, p n , a) has a relation with the number of perfect matchings of G. We also show that the problem of determining the number of solutions to a system of equations over finite field is NP-hard.

Several recently proposed ciphers, for example Rijndael and Serpent, are built with layers of small S-boxes interconnected by linear key-dependent layers. Their security relies on the fact, that the classical methods of cryptanalysis (e.g. linear or differential attacks) are based on probabilistic characteristics, which makes their security grow exponentially with the number of rounds N r r. In this paper we study the security of such ciphers under an additional hypothesis: the S-box can be described by an overdefined system of algebraic equations (true with probability 1). We show that this is true for both Serpent (due to a small size of S-boxes) and Rijndael (due to unexpected algebraic properties). We study general methods known for solving overdefined systems of equations, such as XL from Eurocrypt’00, and show their inefficiency. Then we introduce a new method called XSL that uses the sparsity of the equations and their specific structure. The XSL attack uses only relations true with probability 1, and thus the security does not have to grow exponentially in the number of rounds. XSL has a parameter P, and from our estimations is seems that P should be a constant or grow very slowly with the number of rounds. The XSL attack would then be polynomial (or subexponential) in N r> , with a huge constant that is double-exponential in the size of the S-box. The exact complexity of such attacks is not known due to the redundant equations. Though the presented version of the XSL attack always gives always more than the exhaustive search for Rijndael, it seems to (marginally) break 256-bit Serpent. We suggest a new criterion for design of S-boxes in block ciphers: they should not be describable by a system of polynomial equations that is too small or too overdefined.

The solution of equations and systems of equations over real, complex, rational and integer numbers is a classic topic of research in various areas of mathematics for several thousand years. In the last 20 years, the so-called universal algebraic geometry has been actively developed, in which systems of equations over arbitrary algebraic systems are researched. Many practically important problems on finite graphs, finite fields, and finite orders can be formulated as problems related to solving systems of equations over these systems, which leads to the need to develop algebraic geometry. Many modern models of informational defence represents by graphs and partial orders (posets). This article presents polynomial algorithms for constructing radical and coordinate partial order of systems of equations over finite partial orders in a language without constants.

The security of many recently proposed cryptosystems is based on the difficulty of solving large systems of quadratic multivariate polynomial equations. This problem is NP-hard over any field. When the number of equations m is the same as the number of unknowns n the best known algorithms are exhaustive search for small fields, and a Gröbner base algorithm for large fields. Gröbner base algorithms have large exponential complexity and cannot solve in practice systems with n ≥ 15. Kipnis and Shamir [9] have recently introduced a new algorithm called “relinearization”. The exact complexity of this algorithm is not known, but for sufficiently overdefined systems it was expected to run in polynomial time.In this paper we analyze the theoretical and practical aspects of relinearization. We ran a large number of experiments for various values of n and m, and analysed which systems of equations were actually solvable. We show that many of the equations generated by relinearization are linearly dependent, and thus relinearization is less efficient that one could expect. We then develop an improved algorithm called XL which is both simpler and more powerful than relinearization. For all 0 < ε ≤ 1/2, and m ≥ εn 2, XL and relinearization are expected to run in polynomial time of approximately \( n^{\mathcal{O}(1/\sqrt \varepsilon )} \). Moreover, we provide strong evidence that relinearization and XL can solve randomly generated systems of polynomial equations in subexponential time when m exceeds n by a number that increases slowly with n.KeywordsQuadratic EquationExhaustive SearchAsymptotic ComplexityExact ComplexityMultivariate EquationThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

ON THE DISTURBANCE ATTENUATION FOR INPUT DELAY SYSTEMS

The contemporary advancement in smart technology has led to a greater business prospective. Smart system like cyber-physical system (CPS) has become prevalent in many area of applications. Challenges in integration of CPS with group of network has physical components to sense the state of changes in the real world is paving way towards the introduction of enhanced security mechanism. In this paper, we propose a security framework for group of network is a pseudo-free to communicate with the cyber physical system to assure high security. Pseudo-freeness is a very strong assumption of security used in cryptography. Group is said to be pseudo-free group, if an adversary who is allowed to see group description, is unable to solve non-trivial equations. Non-trivial equations are the equations that have no solution in a free group. The notion of pseudo-freeness was introduced with few open problems whether such groups exists in cryptosystem or not. The conjecture that the RSA group is pseudo-free has been settled for case of static adversary who is given only the group description and its goal is to come up with an equation and solution. Later on the notion of pseudo-freeness has been extended to adaptive adversary for case of univariate equations. In case of adaptive pseudo-free groups, the adversary learns solutions of some non-trivial equations before producing a new equation. Here we make extension to the notion of pseudo-free groups from univariate to multivariate equations and system of equations in face of adaptive adversary. We define and prove the security of adaptive pseudo-free groups for case of multivariate equations and system of equations. According to the results, this framework can be used as a system design for a group to have strong security with cyber physical system.

PRECISE, Photonic hybRid EleCtromagnetIc SolvEr, is a Matlab-based library to model large and complex photonic integrated circuits. Each circuit is modularly described in terms of waveguide segments connected through multi-port nodes. Linear, nonlinear, and dynamical phenomena are simulated by solving the system of differential equations describing the effect to be considered. By exploiting the steady-state approximation of the electromagnetic field within each node device, the library can handle large and complex circuits even on desktop PCs. We show that the steady-state assumption is fulfilled in a broad number of applications and we compare its accuracy with an analytical model (coupled mode theory) and experimental results. PRECISE is highly modular and easily extensible to handle equations different from those already implemented and is, thus, a flexible tool to model the increasingly complex photonic circuits.

We introduce an efficient way of performing polynomial multiplication in a class of finite fields GF(pm) in the frequency domain. The Fast Fourier Transform (FFT) based frequency domain multiplication technique, originally proposed for integer multiplication, provides an extremely efficient method for multiplication with the best known asymptotic complexity, i.e. O(n log n log log n). Unfortunately, the original FFT method bears significant overhead due to the conversions between the time and the frequency domains, which makes it impractical to perform multiplication of relatively short (160 - 1024 bits) integer operands as used in many applications. In this work, we introduce an efficient way of performing polynomial multiplication in finite fields using the FFT. We show that, with careful selection of parameters, all the multiplications required for the FFT computations can be avoided and polynomial multiplication in finite fields can be achieved with only O(m) multiplications in addition to O(m log m) simple shift, addition and subtraction operations. We show that, especially in constrained devices where multiplication is expensive, polynomial multiplication in the suggested finite fields using the FFT outperforms both the schoolbook and Karatsuba methods for practically small finite fields, e.g., relevant to elliptic curve cryptography.

An interactor plays a basic role in the design problems of multivariable control systems, such as the model matching control, decoupling control, adaptive control, and disturbance decoupling control. For example, it is well known that a linear multivariable system is decouplable by the static state feedback if and only if it has a diagonal interactor. But, in general, the interactor is a lower left triangular matrix, which makes the design problems of multivariable control systems complicated. From this point of view, the precompensator such that the total system has a diagonal interactor is important for multivariable control systems to simplify their design procedure. This paper concerns the systematic design method of the precompensator for a diagonal interactor using Markov parameters of the plant. It will also be proved that this compensator is always obtained by the proposed design algorithm. Furthermore, this argument will be a basic idea when this technique is applied to the nonlinear multivariable systems. © 2008 Wiley Periodicals, Inc. Electr Eng Jpn, 163(1): 65–72, 2008; Published online in Wiley InterScience (www.interscience.wiley.com). DOI 10.1002/eej.20599

MDS matrices are used in the design of diffusion layers in many block ciphers and hash functions due to their optimal branch number. But MDS matrices, in general, have costly implementations. So in search for efficiently implementable MDS matrices, there have been many proposals. In particular, circulant, Hadamard, and recursive MDS matrices from companion matrices have been widely studied. In a recent work, recursive MDS matrices from sparse DSI matrices are studied, which are of interest due to their low fixed cost in hardware implementation. In this paper, we present results on the exhaustive search for (recursive) MDS matrices over GL(4, F2). Specifically, circulant MDS matrices of order 4, 5, 6, 7, 8; Hadamard MDS matrices of order 4, 8; recursive MDS matrices from companion matrices of order 4; recursive MDS matrices from sparse DSI matrices of order 4, 5, 6, 7, 8 are considered. It is to be noted that the exhaustive search is impractical with a naive approach. We first use some linear algebra tools to restrict the search to a smaller domain and then apply some space-time trade-off techniques to get the solutions. From the set of solutions in the restricted domain, one can easily generate all the solutions in the full domain. From the experimental results, we can see the (non) existence of (involutory) MDS matrices for the choices mentioned above. In particular, over GL(4, F2), we provide companion matrices of order 4 that yield involutory MDS matrices, circulant MDS matrices of order 8, and establish the nonexistence of involutory circulant MDS matrices of order 6, 8, circulant MDS matrices of order 7, sparse DSI matrices of order 4 that yield involutory MDS matrices, and sparse DSI matrices of order 5, 6, 7, 8 that yield MDS matrices. To the best of our knowledge, these results were not known before. For the choices mentioned above, if such MDS matrices exist, we provide base sets of MDS matrices, from which all the MDS matrices with the least cost (with respect to d-XOR and s-XOR counts) can be obtained. We also take this opportunity to present some results on the search for sparse DSI matrices over finite fields that yield MDS matrices. We establish that there is no sparse DSI matrix S of order 8 over F28 such that S8 is MDS.

Researching post-quantum cryptography has been an important task in cryptography. The section finding problem on algebraic surfaces (AS-SFP) is considered to be intractable also after building quantum computers. Thus AS-SFP is used as a basis of the security of the Algebraic Surface Cryptosystem (ASC), which is a candidate of post-quantum cryptosystems, and it is important for designing parameters which make ASC secure to estimate the complexity of AS-SFP. Solving AS-SFP is reduced to solving certain multivariate equation systems (section equation systems) of high degrees, and one can solve such equation systems by using the Grobner basis technique. Although estimating the complexity of computing a Grobner basis associated with an equation system is difficult in general, it becomes easy if the equation system is semi-regular. In this paper, we experimentally estimate the complexity of AS-SFP. From our experimental results, although we see that section equation systems do not become semi-regular in most cases for small parameters, we can infer parameters closely related to the difficulty of computing Grobner bases associated with section equation systems. According to our inference, we estimate the complexity of AS-SFP and parameters which make ASC 128-bit security against the attack by the Grobner basis technique. We also consider a brute-force attack against AS-SFP and conjecture that the brute-force attack is more efficient than the attack by the Grobner basis technique. Finally, we estimate parameters and sizes of public keys such that ASC has 128-bit security against the brute-force attack. Its size (876 bits) is much smaller than sizes of public keys in other efficient candidates of PQC.

We present zero-knowledge proofs and arguments for arithmetic circuits over finite prime fields, namely given a circuit, show in zero-knowledge that inputs can be selected leading to a given output. For a field GF(q), where q is an n-bit prime, a&lt;br /&gt;circuit of size O(n), and error probability 2^−n, our protocols require communication of O(n^2) bits. This is the same worst-cast complexity as the trivial (non zero-knowledge)&lt;br /&gt;interactive proof where the prover just reveals the input values. If the circuit involves n multiplications, the best previously known methods would in general require communication&lt;br /&gt;of Omega(n^3 log n) bits.&lt;br /&gt;Variations of the technique behind these protocols lead to other interesting applications.&lt;br /&gt;We first look at the Boolean Circuit Satisfiability problem and give zero-knowledge proofs and arguments for a circuit of size n and error probability 2^−n in which there is an interactive preprocessing phase requiring communication of O(n^2)&lt;br /&gt;bits. In this phase, the statement to be proved later need not be known. Later the prover can non-interactively prove any circuit he wants, i.e. by sending only one message, of size O(n) bits.&lt;br /&gt;As a second application, we show that Shamirs (Shens) interactive proof system for the (IP-complete) QBF problem can be transformed to a zero-knowledge proof&lt;br /&gt;system with the same asymptotic communication complexity and number of rounds. The security of our protocols can be based on any one-way group homomorphism with a particular set of properties. We give examples of special assumptions sufficient for this, including: the RSA assumption, hardness of discrete log in a prime order group, and polynomial security of Die-Hellman encryption. We note that the constants involved in our asymptotic complexities are small enough for our protocols to be practical with realistic choices of parameters.

Let 𝔽q stand for the finite field of odd characteristic p with q elements (q = pn, n ∈ ℕ) and [Formula: see text] denote the set of all the nonzero elements of 𝔽q. Let m and t be positive integers. By using the Smith normal form of the exponent matrix, we obtain a formula for the number of rational points on the variety defined by the following system of equations over [Formula: see text] where the integers t &gt; 0, r0 = 0 &lt; r1 &lt; r2 &lt; ⋯ &lt; rt, 1 ≤ n1 &lt; n2 &lt;, ⋯ &lt; nt and 0 ≤ j ≤ t − 1, bk ∊ 𝔽q, ak,i ∊ [Formula: see text] (k = 1, …, m, i = 1, …, rt), and the exponent of each variable is a positive integer. Further, under some natural conditions, we arrive at an explicit formula for the number of 𝔽q-rational points on the above variety. It extends the results obtained previously by Wolfmann, Sun, Wang, Hong et al. Our result gives a partial answer to an open problem raised in [The number of rational points of a family of hypersurfaces over finite fields, J. Number Theory 156 (2015) 135–153].