Differential Cryptanalysis for Multivariate Schemes

This paper analyzes the security of the RC5 encryption algorithm against differential and linear cryptanalysis. RC5 is a new block cipher recently designed by Ron Rivest. It has a variable word size, a variable number of rounds, and a variable-length secret key. In RC5, the secret key is used to fill an expanded key table which is then used in encryption. Both our differential and linear attacks on RC5 recover every bit of the expanded key table without any exhaustive search. However, the plaintext requirement is strongly dependent on the number of rounds. For 64-bit block size, our differential attack on nine-round RC5 uses 245 chosen plaintext pairs (about the same as DES), while 262 pairs are needed for 12-round RC5. Similarly, our linear attack on live-round RC5 uses 247 known plaintexts (about the same as DES), and the plaintext requirement is impractical for more than six rounds. We conjecture that the linear approximations used in our linear cryptanalysis are optimal. Thus, we conclude that Rivest's suggested use of 12 rounds is sufficient to make differential and linear cryptanalysis of RC5 impractical.

Preface. Conventions and Notations. 1 An Introduction To Maple. 1.1 The Commands . 1.2 Programming. 2 Linear Systems of Equations and Matrices. 2.1 Linear Systems of Equations. 2.2 Augmented Matrix of a Linear System and Row Operations. 2.3 Some Matrix Arithmetic. 3 Gauss-Jordan Elimination and Reduced Row Echelon Form. 3.1 Gauss-Jordan Elimination and rref. 3.2 Elementary Matrices. 3.3 Sensitivity of Solutions to Error in the Linear System. 4 Applications of Linear Systems and Matrices. 4.1 Applications of Linear Systems to Geometry. 4.2 Applications of Linear Systems to Curve Fitting. 4.3 Applications of Linear Systems to Economics. 4.4 Applications of Matrix Multiplication to Geometry. 4.5 An Application of Matrix Multiplication to Economics. 5 Determinants, Inverses and Cramer s Rule. 5.1 Determinants and Inverses from the Adjoint Formula. 5.2 Determinants by Expanding Along Any Row or Column . 5.3 Determinants Found by Triangularizing Matrices. 5.4 LU Factorization. 5.5 Inverses from rref. 5.6 Cramer s Rule. 6 Basic Linear Algebra Topics. 6.1 Vectors. 6.2 Dot Product. 6.3 Cross Product. 6.4 Vector Projection. 7 A Few Advanced Linear Algebra Topics. 7.1 Rotations in Space. 7.2 Rolling a Circle Along a Curve. 7.3 The TNB Frame. 8 Independence, Basis and Dimension for Subspaces of Rn. 8.1 Subspaces of Rn. 8.2 Independent and Dependent Sets of Vectors in Rn. 8.3 Basis and Dimension for Subspaces of Rn. 8.4 Vector Projection onto a Subspace of Rn. 8.5 The Gram-Schmidt Orthonormalization Process. 9 Linear Maps from Rn to Rm. 9.1 Basics About Linear Maps. 9.2 The Kernel and Image Subspaces of a Linear Map. 9.3 Composites of Two Linear maps and Inverses. 9.4 Change of Bases for the Matrix Representation of a Linear Map. 10 The Geometry of Linear and Affine Maps. 10.1 The Effect of a Linear Map on Area and Arclength in Two Dimensions. 10.2 The Decomposition of Linear Maps into Rotations, Reflections and Rescalings in R2. 10.3 The Effect of Linear Maps on Volume, Area and Arclength in R3. 10.4 Rotations, Reflections and Rescalings in Three Dimensions. 10.5 Affine Maps. 11 Least Squares Fits and Pseudoinverses. 11.1 Pseudoinverse to a Non-Square Matrix and Almost Solving an Overdetermined Linear System. 11.2 Fits and Pseudoinverses. 11.3 Least Squares Fits and Pseudoinverses. 12 Eigenvalues and Eigenvectors. 12.1 What Are Eigenvalues and Eigenvectors, and Why Do We Need Them? 12.2 Summary of Definitions and Methods for Computing Eigenvalues and Eigenvectors as well as the Exponential of a Matrix. 12.3 Applications of the Diagonalizability of Square Matrices. 12.4 Solving a Square First Order Linear. System of Differential Equations ... 12.5 Basic Facts About Eigenvalues and Eigenvectors, and Diagonalizability. 12.6 The Geometry of the Ellipse Using Eigenvalues and Eigenvectors. 12.7 A Maple Eigen-Procedure. Bibliography. Indices. Keyword Index. Index of Maple Commands and Packages.

Background. Ultra-Reliable Low Latency Communication (URLLC) as a service offered by fifth and sixth generation (5G/6G) wireless systems is a technological response to the needs of various mission-critical applications that require reliable data transmission with low latency. These applications also include Intelligent Transportation Systems services, which, among other things, provide connectivity and autonomous vehicle control. The combination of high reliability and low latency requirements in URLLC usage scenarios creates a security problem for URLLC data transmission that cannot be solved using conventional complex cryptographic methods based on a secret key. The article discusses in detail the approach to using physical layer security mechanisms (physical layer security - PLS) as a powerful alternative to classical cryptographic security methods for URLLC, and also proposes the application of the wire-tap channel concept in URLLC with an analysis of the efficiency that can be achieved for physical layer security. Objective. The aim of the article is to provide an overview of information security solutions in URLLC usage scenarios, as well as to propose a constructive method for information protection for reliable data transmission with low latency without the use of cryptographic mechanisms based on a secret key. Methods. Theoretical research in the field of the branch channel concept was used to create solutions that allow data protection with information-theoretic stability in URLLC usage scenarios for providing IoT, connected car and autonomous driving services. Results. The article examines in detail the data security issues in ultra-reliable low latency communication (URLLC) as a service offered by fifth and sixth generation (5G/6G) wireless systems. It is determined that URLLC is a technological response to the needs of various critical applications that require reliable signal transmission with low latency, and among these applications are Intelligent Transportation Systems services, which, among other things, provide connectivity and autonomous vehicle control. It is shown that the combination of high reliability and low latency requirements in URLLC scenarios creates a security problem for URLLC data transmission that cannot be solved using conventional complex cryptographic methods based on a secret key. The feasibility of using physical layer security mechanisms (PLS) as a powerful alternative to classical cryptographic security methods for URLLC is substantiated. The approach to applying the concept of a wire-tap channel in URLLC is considered in detail, as well as the results that can be achieved for physical layer security, and the influence of code parameters for probabilistic cryptographic transformations in accordance with the concept of a wire-tap channel on PLS URLLC. Estimates of the effectiveness of PLS URLLC for finite block length codes are provided. Conclusions. An effective way to ensure data security for ultra-reliable low-latency physical layer link (PLS URLLC) of fifth-generation 5G wireless systems in the field of connected cars and vehicles of 4-5 levels of automation can be approaches based on the concept of a tapped channel ("wire-tap channel").

In 1994, Peter Shor published a quantum algorithm capable of factoring large integers and computing discrete logarithms in Abelian groups in polynomial time. Since these computational problems provide the security basis of conventional asymmetric cryptosystems (e.g., RSA, ECC), information encrypted under such schemes today may well become insecure in a future scenario where quantum computers are a technological reality. Fortunately, certain classical cryptosystems based on entirely different intractability assumptions appear to resist Shor’s attack, as well as others similarly based on quantum computing. The security of these schemes, which are dubbed post-quantum cryptosystems, stems from hard problems on lattices, error-correcting codes, multivariate quadratic systems, and hash functions. Here we introduce the essential notions related to each of these schemes and explore the state of the art on practical aspects of their adoption and deployment, like key sizes and cryptogram/signature bandwidth overhead.

In this paper, we describe efficient forgery and full-key recovery attacks on the ℓ-IC− signature scheme recently proposed at PKC 2007. This cryptosystem is a multivariate scheme based on a new internal quadratic primitive which avoids some drawbacks of previous multivariate schemes: the scheme is extremely fast since it requires one exponentiation in a finite field of medium size and the public key is shorter than in many multivariate signature schemes. Our attacks rely on the recent cryptanalytic tool developed by Dubois et al. against the SFLASH signature scheme. However, the final stage of the attacks requires the use of Gröbner basis techniques to conclude to actually forge a signature (resp. to recover the secret key). For the forgery attack, this is due to the fact that Patarin’s attack is much more difficult to mount against ℓ-IC. The key recovery attack is also very efficient since it is faster to recover equivalent secret keys than to forge.KeywordsSignature SchemeTotal BreakForgery AttackBilinear EquationTrivial RelationThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

How to reduce communication complexity is a common important issue to design cryptographic protocols. This paper focuses on authenticated key exchange (AKE). Several AKE schemes have been studied, which satisfy strong security such as exposure-resilience in the standard model (StdM). However, there is a large gap on communication costs between schemes in the StdM and in the random oracle model. In this paper, we show a generic construction that is significantly compact (i.e., small communication cost) and secure in the StdM. We follow an existing generic construction from key encapsulated mechanism (KEM). Our main technique is to use a bounded chosen-ciphertext secure KEM instead of an ordinary chosen-ciphertext secure KEM. The communication cost can be reduced to half by this technique, and we achieve the most compact AKE scheme in the StdM. Moreover, our construction has instantiations under wider classes of hardness assumptions (e.g., subset-sum problems and multi-variate quadratic systems) than existing constructions. This work pioneers the first meaningful application of bounded chosen-ciphertext secure KEM.

Electronic commerce fundamentally requires two different public-key cryptographical primitives, for key agreement and authentication. We present the new encryption scheme MFE, and provide a performance and security review. MFE belongs to the $\mathcal{MQ}$ class, an alternative class of PKCs also termed Polynomial-Based, or multivariate. They depend on multivariate quadratic systems being unsolvable. The classical trapdoors central to PKC’s are modular exponentiation for RSA and discrete logarithms for ElGamal/DSA/ECC. But they are relatively slow and will be obsoleted by the arrival of QC (Quantum Computers). The argument for $\mathcal{MQ}$-schemes is that they are usually faster, and there are no known QC-assisted attacks on them. There are several $\mathcal{MQ}$ digital signature schemes being investigated today. But encryption (or key exchange schemes) are another story — in fact, only two other $\mathcal{MQ}$-encryption schemes remain unbroken. They are both built along “big-field” lines. In contrast MFE uses medium-sized field extensions, which makes it faster. For security and efficiency, MFE employs an iteratively triangular decryption process which involves rational functions (called by some “tractable rational maps”) and taking square roots. We discuss how MFE avoids previously known pitfalls of this genre while addressing its security concerns.

In this paper, we analyze the security of two recently proposed ultra-lightweight block ciphers, SLIM and LCB. SLIM is designed based on the Feistel paradigm, operating on 32-bit blocks and has an 80-bit key. The designers claim that SLIM is immune to differential cryptanalysis after they were only able to find a trail of up to 7 rounds by using a heuristic method. LCB is another ultra-lightweight block cipher with a 32-bit block and instead uses a 64-bit secret key. It was designed based on a hybrid of Feistel and substitution-permutation network structures. Although no concrete security analyses were performed, the designers claim that 10 rounds of the cipher is secure enough against various attacks including differential cryptanalysis. We verify these claims by proposing differential attacks on both ciphers. For SLIM, we first report optimal (i.e., having the best differential probability) trails for up to 32 rounds found using an SMT solver. We then propose practical key recovery attacks on up to 14 rounds that recover the final round key with time complexity \(2^{32}\). Next, a close inspection of LCB’s design revealed a lack of nonlinearity, whereby its S-box could be modelled as a permutation. As such, differential trails that hold with probability 1 can be trivially derived for any number of rounds of the cipher. A trivial distinguishing attack can be performed with just one known-ciphertext. We fix this flaw and go on to show that LCB is actually more secure (against differential cryptanalysis) than SLIM given the same number of rounds. To the best of our knowledge, these are the first third-party cryptanalysis attacks against both ciphers.KeywordsSLIMLCBDifferential cryptanalysisLightweight block cipherSMT

Based on the one-dimensional Sine map and the two-dimensional Henon map, a new two-dimensional Sine-Henon alteration model (2D-SHAM) is hereby proposed. Basic dynamic characteristics of 2D-SHAM are studied through the following aspects: equilibria, Jacobin eigenvalues, trajectory, bifurcation diagram, Lyapunov exponents and sensitivity dependence test. The complexity of 2D-SHAM is investigated using Sample Entropy algorithm. Simulation results show that 2D-SHAM is overall hyperchaotic with the high complexity, and high sensitivity to its initial values and control parameters. To investigate its performance in terms of security, a new 2D-SHAM-based image encryption algorithm (SHAM-IEA) is also proposed. In this algorithm, the essential requirements of confusion and diffusion are accomplished, and the stochastic 2D-SHAM is used to enhance the security of encrypted image. The stochastic 2D-SHAM generates random values, hence SHAM-IEA can produce different encrypted images even with the same secret key. Experimental results and security analysis show that SHAM-IEA has strong capability to withstand statistical analysis, differential attack, chosen-plaintext and chosen-ciphertext attacks.

This advanced textbook on linear algebra and geometry covers a wide range of classical and modern topics. Differing from existing textbooks in approach, the work illustrates the many-sided applications and connections of linear algebra with functional analysis, quantum mechanics and algebraic and differential geometry. The subjects covered in some

Linear Algebra Linear algebra studies linear transformations and vector spaces, or in another language, matrix multiplication and the vector space R n . You should know how to translate between the language of abstract vector spaces and the language of matrices. In particular, given a basis for a vector space, you should know how to represent any linear transformation as a matrix. Further, given two matrices, you should know how to determine if these matrices actually represent the same linear transformation, but under different choices of bases. The key theorem of linear algebra is a statement that gives many equivalent descriptions for when a matrix is invertible. These equivalences should be known cold. You should also know why eigenvectors and eigenvalues occur naturally in linear algebra. Real Analysis The basic definitions of a limit, continuity, differentiation and integration should be known and understood in terms of ∈'s and δ's. Using this ∈ and δ language, you should be comfortable with the idea of uniform convergence of functions. Differentiating Vector-Valued Functions The goal of the Inverse Function Theorem is to show that a differentiable function f : R n → R n is locally invertible if and only if the determinant of its derivative (the Jacobian) is non-zero. You should be comfortable with what it means for a vector-valued function to be differentiable, why its derivative must be a linear map (and hence representable as a matrix, the Jacobian) and how to compute the Jacobian.

Providing of confidentiality of data is the important stage in the process of providing of cyber security of the critical aviation informative systems and aviation industry on the whole. Known methods do not allow to fully provide cyberattacks resistance to linear and differential cryptanalysis and the required speed of cryptographic data processing. Taking into account it, the cryptographic method of defence of the critical aviation information systems is in-process worked out. On the basis of this method, a block symmetric cipher Luna-2k17 was developed and its specification is given in the work. Also, the values of the upper estimates of parameters that characterize its practical stability to cyber attacks of linear and differential cryptanalysis are calculated. At equal terms, experimental studies are undertaken from the estimation of speed characteristics of ciphers, that showed that cipher Luna-2k17 more faster than a cipher GOST 28147-89 approximately in 3,11 times, than ciphers Kalina and AES in 1,271 times.

This paper proposes an image encryption scheme based on chaotic system with changeable parameters depending on plain-image. A generalized Arnold map, whose control parameters are changeable and image-dependent during the iteration procedure, is utilized to generate chaotic orbits applied to permute the pixel positions. A diffusion function is also designed to realize the diffusion effect by piece-wise linear chaotic map. In both the permutation process and the diffusion process, the keystreams generated by chaotic maps are all strongly dependent on plain-image, and thereby can improve the encryption security efficiently. The major merits of the proposed image encryption scheme include a huge key space, good statistical nature resisting statistical analysis attack, differential attack, and good resistance against known-plaintext attack and chosen- plaintext attack, etc. Experimental results have been carried out with detailed analysis to show that the proposed scheme can be a potential candidate for practical image encryption.

In this note we give an elementary proof of a theorem first proved by J. A. Erdos [3]. This theorem, which is the main result of [3], states that every noninvertible n × n matrix is a finite product of matrices M with the property that M = M . (These are known as idempotent matrices. Noninvertible matrices are also called singular matrices.) An alternative formulation of this result reads: every noninvertible linear mapping of a finite dimensional vector space is a finite product of idempotent linear mappings α, linear mappings that satisfy α = α. This result was motivated by a result of J. M. Howie asserting that each selfmapping α of a nonempty finite set X with image size at most |X| − 1 (which occurs precisely when α is noninvertible) is a product of idempotent mappings. We shall see that Erdos’s theorem is a consequence of Howie’s result. Together the papers [3] and [4] are cited in over one hundred articles, dealing with subjects including universal algebra, ring theory, topology, and combinatorics. Since its publication, various proofs of the result in [3] have appeared. For example, a semigroup theoretic proof appears in [1, pp. 121-131] and linear operator theory is used to prove the theorem in [2]. Here we give a new proof using a basic combinatorial argument. Unlike the previous proofs our argument involves only elementary results from linear algebra and one basic result concerning permutations. On the way to proving the main result of this note we provide a short proof of Howie’s result. Throughout this paper X signifies an arbitrary nonempty finite set. If α : A → X, where A is a subset of X, then A is the domain of α; we denote this set by dom(α). Naturally, the set α(A) is called the image of α and is denoted by im(α). Recall that a mapping α is injective (or one-to-one) if α(x) 6= α(y) for all x and y in dom(α) with x 6= y. Let TX denote the set of all mappings from X to X with domain X. We note that this set is closed under composition of mappings and that this composition is associative. We now define one of the most important notions we require in the proofs in this note. For a mapping α : dom(α) → X we say that α is a restriction of an element β of TX if β and α agree on the domain of α. In other words, β(x) = α(x) for all x in dom(α). For x and y in X we denote the transposition that fixes every point of X other than x or y and that maps x to y, and vice versa, by (x y).

With the wide adoption of cloud computing paradigm, it is important to develop appropriate techniques to protect client data privacy in the cloud. Encryption is one of the major techniques that could be used to achieve this goal. However, data encryption at the rest alone is insufficient for secure cloud computation environments. There is also the need for efficient techniques to carry out computation over encrypted data. Fully homomorphic encryption (FHE) and garbled circuits are naturally used to process encrypted data without leaking any information about the data. However, existing FHE schemes are inefficient for processing large amount of data in cloud and garbled circuits are one time programs and cannot be reused. Based on quaternion/octonion algebra and Jordan algebra over finite rings \(\mathbb {Z}_q\), this paper designs efficient fully homomorphic symmetric key encryption (FHE) schemes without bootstrapping (that is, noise-free FHE schemes) that are secure in the weak ciphertext-only security model assuming the hardness of solving multivariate quadratic equation systems and solving univariate high degree polynomial equation systems in \(\mathbb {Z}_q\). The FHE scheme designed in this paper is sufficient for privacy preserving computation in cloud.