A Generalized Birthday Problem

Abstract

Abstract. We study a k-dimensional generalization of the birthday problem: given k lists of n-bit values, find some way to choose one element from each list so that the resulting k values xor to zero. For k = 2, this is just the extremely well-known birthday problem, which has a square-root time algorithm with many applications in cryptography. In this paper, we show new algorithms for the case k > 2: we show a cube-root time algorithm for the case of k = 4 lists, and we give an algorithm with subexponential running time when k is unrestricted. We also give several applications to cryptanalysis, describing new subexponential algorithms for constructing one-more forgeries for certain blind signature schemes, for breaking certain incremental hash functions, and for finding low-weight parity check equations for fast correlation attacks on stream ciphers. In these applications, our algorithm runs in O(2 2 √ n ) time for an n-bit modulus, demonstrating that moduli may need to be at least 1600 bits long for security against these new attacks. As an example, we describe the first-known attack with subexponential complexity on Schnorr and Okamoto-Schnorr blind signatures over elliptic curve groups.

A Model-Based Case for Redundant Computation

“…We can not currently provide an analytical proof of this starting from equation 4, but note related results for interested readers [22,23,45]. This can be left for future work, since successive levels of redundancy yield diminishing returns, and even dual-redundant computation is not yet an accepted supercomputing resilience strategy.…”

A Family of Fast Syndrome Based Cryptographic Hash Functions

“…We will survey the results on Information Set Decoding algorithm, which has been studied in [1]. As for Wagner's Generalized Birthday Paradox [19], we will give an extended analysis: first we slightly generalize Wagner's algorithm, then we describe how its complexity is exponential when the length of the hash value goes to infinity.…”

“…We now describe the attack from Coron and Joux [4], which relies on the Generalized Birthday Problem introduced by Wagner [19], who established:…”

“…However, for the practical parameters which have been proposed in [1], there is an efficient attack with a cost as low as 2 43 (or 2 62 depending on the set of parameters), as demonstrated by Coron and Joux [4], using Wagner's method for the generalized birthday problem [19].…”

“…In this article is presented a family of secure hash functions, whose security is directly related to the syndrome decoding problem from the theory of error-correcting codes. Taking into account the analysis by Coron and Joux [4] based on Wagner's generalized birthday algorithm [19] we study the asymptotical security of our functions. We demonstrate that this attack is always exponential in terms of the length of the hash value.…”