A Heuristic Quasi-Polynomial Algorithm for Discrete Logarithm in Finite Fields of Small Characteristic

Barbulescu, Razvan; Gaudry, Pierrick; Joux, Antoine; Thomé, Emmanuel

doi:10.1007/978-3-642-55220-5_1

Cited by 189 publications

(208 citation statements)

References 15 publications

Supporting

Mentioning

207

Contrasting

Order By: Relevance

“…The main reason of our restriction is that the recent quasi-polynomial attacks on DLP of certain extension fields of small characteristics suggests not to use non-prime finite fields in cryptographic setting [37]. We note that all secure outsourcing algorithms for modular exponentiation (including the algorithms proposed in this paper) can easily be adapted to secure outsourcing algorithms for scalar multiplication of elliptic curve cryptography (ECC) by using a prime order subgroup of E(F p ) instead of the group G. Using these algorithms for scalar multiplications of elliptic curves, one can also obtain hybrid privacy preserving outsourcing algorithms for pairing-based cryptosystems by means of outsourcing private inputs of pairing functions, bilinearity property, and private exponentiations in finite fields for the realization of ID-based cryptography [36].…”

Section: Dlp Casementioning

confidence: 99%

Efficient and verifiable algorithms for secure outsourcing of cryptographic computations

Kiraz

Uzunkol

2015

Int. J. Inf. Secur.

View full text Add to dashboard Cite

Reducing computational cost of cryptographic computations for resource-constrained devices is an active research area. One of the practical solutions is to securely outsource the computations to an external and more powerful cloud server. Modular exponentiations are the most expensive computation from the cryptographic point of view. Therefore, outsourcing modular exponentiations to a single, external and potentially untrusted cloud server while ensuring the security and privacy provide an efficient solution. In this paper, we propose new efficient outsourcing algorithms for modular exponentiations using only one untrusted cloud server. These algorithms cover public-base & private-exponent, private-base & public-exponent, private-base & privateexponent, and more generally private-base & private-exponents simultaneous modular exponentiations. Our algorithms are the most efficient solutions utilizing only one single untrusted server with best checkability probabilities. Furthermore, unlike existing schemes, which have fixed checkability probability, our algorithms provide adjustable predetermined checkability parameters. Finally, we apply our algorithms to outsource Oblivious Transfer Protocols and Blind Signatures which are expensive primitives in modern cryptography.

show abstract

Section: Dlp Casementioning

confidence: 99%

Efficient and verifiable algorithms for secure outsourcing of cryptographic computations

Kiraz

Uzunkol

2015

Int. J. Inf. Secur.

View full text Add to dashboard Cite

show abstract

“…All such pairs will vanish the k-th equation of (9). We can then substitute each possible possible eigenvector in the others equations and solve the linear system involving the remaining unknowns.…”

Section: Theoretical Complexitymentioning

confidence: 99%

“…We know that there is at least one s 2 which leads to a consistent system. If N < n is odd, we can then solve (9) in O(n ω+1 ). When N is even, the situation is very similar.…”

Section: B1 Proof Of Theoremmentioning

confidence: 99%

“…Now, several years later, it seems that there have emerged new important reasons for renewal of the interest in MQ cryptography. First, in the past two years, the algorithms for solving the Discrete Logarithm (DL) problem underwent an extraordinary development (for instance, but not limited to [9]). The confidence in the hardness of the DL problem has been seriously rocked, and finding an algorithm that will show that this problem is in fact easy does not look as impossible as previously believed.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A Polynomial-Time Key-Recovery Attack on MQQ Cryptosystems

Faugère

Gligoroski²,

Perret

et al. 2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. We investigate the security of the family of MQQ public key cryptosystems using multivariate quadratic quasigroups (MQQ). These cryptosystems show especially good performance properties. In particular, the MQQ-SIG signature scheme is the fastest scheme in the ECRYPT benchmarking of cryptographic systems (eBACS). We show that both the signature scheme MQQ-SIG and the encryption scheme MQQ-ENC, although using different types of MQQs, share a common algebraic structure that introduces a weakness in both schemes. We use this weakness to mount a successful polynomial time key-recovery attack. Our key-recovery attack finds an equivalent key using the idea of so-called good keys that reveals the structure gradually. In the process we need to solve a MinRank problem that, because of the structure, can be solved in polynomial-time assuming some mild algebraic assumptions. We highlight that our theoretical results work in characteristic 2 which is known to be the most difficult case to address in theory for MinRank attacks. Also, we emphasize that our attack works without any restriction on the number of polynomials removed from the public-key, that is, using the minus modifier. This was not the case for previous MinRank like-attacks against MQ schemes. From a practical point of view, we are able to break an MQQ-SIG instance of 80 bits security in less than 2 days, and one of the more conservative MQQ-ENC instances of 128 bits security in little bit over 9 days. Altogether, our attack shows that it is very hard to design a secure public key scheme based on an easily invertible MQQ structure.

show abstract

“…In terms of efficiency, Type II pairings compare quite favorably to Type I pairings (especially at higher security levels, and particularly now that low-characteristic pairings are known to be broken [23,9]), and are close to Type III pairings: in fact, a Type II pairing computation can be reduced to a Type III one at the cost of one multiplication in G 1 [17,Note 10]. The size of the representation of elements in G 1 is also the same in the Type II and Type III settings, and usually much smaller than in Type I pairings.…”

Section: Bilinear Groupsmentioning

confidence: 99%

Structure-Preserving Signatures from Type II Pairings

Abe

Groth

Ohkubo³

et al. 2014

Advances in Cryptology – CRYPTO 2014

View full text Add to dashboard Cite

Abstract. We investigate structure-preserving signatures in asymmetric bilinear groups with an efficiently computable homomorphism from one source group to the other, i.e., the Type II setting. It has been shown that in the Type I and Type III settings (with maximal symmetry and maximal asymmetry respectively), structure-preserving signatures need at least 2 verification equations and 3 group elements. It is therefore natural to conjecture that this would also be required in the intermediate Type II setting, but surprisingly this turns out not to be the case. We construct structure-preserving signatures in the Type II setting that only require a single verification equation and consist of only 2 group elements. This shows that the Type II setting with partial asymmetry is different from the other two settings in a way that permits the construction of cryptographic schemes with unique properties. We also investigate lower bounds on the size of the public verification key in the Type II setting. Previous work in structure-preserving signatures has explored lower bounds on the number of verification equations and the number of group elements in a signature but the size of the verification key has not been investigated before. We show that in the Type II setting it is necessary to have at least 2 group elements in the public verification key in a signature scheme with a single verification equation. Our constructions match the lower bounds so they are optimal with respect to verification complexity, signature sizes and verification key sizes. In fact, in terms of verification complexity, they are the most efficient structure preserving signature schemes to date. Depending on the context in which a scheme is deployed it is sometimes desirable to have strong existential unforgeability, and in other cases full randomizability. We give two structure-preserving signature schemes with a single verification equation where both the signatures and the public verification keys consist of two group elements each. One signature scheme is strongly existentially unforgeable, the other is fully randomizable. Having such simple and elegant structure-preserving signatures may make the Type II setting the easiest to use when designing new structure-preserving cryptographic schemes, and lead to schemes with the greatest conceptual simplicity.

show abstract

A Heuristic Quasi-Polynomial Algorithm for Discrete Logarithm in Finite Fields of Small Characteristic

Cited by 189 publications

References 15 publications

Efficient and verifiable algorithms for secure outsourcing of cryptographic computations

Efficient and verifiable algorithms for secure outsourcing of cryptographic computations

A Polynomial-Time Key-Recovery Attack on MQQ Cryptosystems

Structure-Preserving Signatures from Type II Pairings

Contact Info

Product

Resources

About