Chosen-Ciphertext Security from Subset Sum

Faust, Sebastian; Masny, Daniel; Venturi, Daniele

doi:10.1007/978-3-662-49384-7_2

Cited by 12 publications

(6 citation statements)

References 40 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The first PKE scheme with CPA security directly based on Subset Sum has been constructed by Lyubashevsky, Palacio, and Segev [LPS10]; their work has recently been extended to the setting of CCA security by Faust, Masny, and Venturi [FMV16]. Subset Sum also found application in the context of outsourced pattern matching [FHV13].…”

Section: Related Workmentioning

confidence: 99%

Naor–Yung paradigm with shared randomness and applications

Biagioni

Masny

Venturi

2017

Theoretical Computer Science

Self Cite

View full text Add to dashboard Cite

The Naor-Yung paradigm (Naor and Yung, STOC '90) allows to generically boost security under chosen-plaintext attacks (CPA) to security against chosen-ciphertext attacks (CCA) for public-key encryption (PKE) schemes. The main idea is to encrypt the plaintext twice (under independent public keys), and to append a non-interactive zero-knowledge (NIZK) proof that the two ciphertexts indeed encrypt the same message. Later work by Camenisch, Chandran, and Shoup (Eurocrypt '09) and Naor and Segev (Crypto '09 and SIAM J. Comput. '12) established that the very same techniques can also be used in the settings of key-dependent message (KDM) and key-leakage attacks (respectively). In this paper we study the conditions under which the two ciphertexts in the Naor-Yung construction can share the same random coins. We find that this is possible, provided that the underlying PKE scheme meets an additional simple property. The motivation for reusing the same random coins is that this allows to design much more efficient NIZK proofs. We showcase such an improvement in the random oracle model, under standard complexity assumptions including Decisional Diffie-Hellman, Quadratic Residuosity, and Subset Sum. The length of the resulting ciphertexts is reduced by 50%, yielding truly efficient PKE schemes achieving CCA security under KDM and key-leakage attacks. As an additional contribution, we design the first PKE scheme whose CPA security under KDM attacks can be directly reduced to (low-density instances of) the Subset Sum assumption. The scheme supports key-dependent messages computed via any affine function of the secret key.

show abstract

Section: Related Workmentioning

confidence: 99%

Naor–Yung paradigm with shared randomness and applications

Biagioni

Masny

Venturi

2017

Theoretical Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…. , a n , t) ∈ Z n+1 ≥0 , the problem is to decide whether there exists S ⊆ [n] such that ∑ i∈S a i = t. In the recent years, provable-secure cryptosystems based on SSUM such as privatekey encryption schemes [LPS10], tag-based encryption schemes [FMV16], etc have been proposed. There are numerous improvements made in the algorithms that solve the SSUM problem in both the classical [BW21, Bri17, JW18, JVW21, EM20] and quantum world [BJLM13,HM18,LL19].…”

Section: Introductionmentioning

confidence: 99%

Efficient reductions and algorithms for variants of Subset Sum

Dutta¹,

Rajasree²

2021

Preprint

View full text Add to dashboard Cite

Given (a 1 , . . . , a n , t) ∈ Z n+1 ≥0 , the Subset Sum problem (SSUM) is to decide whether there exists S ⊆ [n] such that ∑ i∈S a i = t. There is a close variant of the SSUM, called Subset Product. Given positive integers a 1 , . . . , a n and a target integer t, the Subset Product problem asks to determine whether there exists a subset S ⊆ [n] such that ∏ i∈S a i = t. There is a pseudopolynomial time dynamic programming algorithm, due to Bellman (1957) which solves the SSUM and Subset Product in O(nt) time and O(t) space.In the first part, we present search algorithms for variants of the Subset Sum problem. Our algorithms are parameterized by k, which is a given upper bound on the number of realisable sets (i.e., number of solutions, summing exactly t). We show that SSUM with a unique solution is already NP-hard, under randomized reduction. This makes the regime of parametrized algorithms, in terms of k, very interesting.Subsequently, we present an Õ(k • (n + t)) time deterministic algorithm, which finds the hamming weight of all the realisable sets for a subset sum instance. We also give a poly(knt)time and O(log(knt))-space deterministic algorithm that finds all the realisable sets for a subset sum instance.In the latter part, we present a simple and elegant randomized Õ(n + t) time algorithm for Subset Product. Moreover, we also present a poly(nt) time and O(log 2 (nt)) space deterministic algorithm for the same. We study these problems in the unbounded setting as well. Our algorithms use multivariate FFT, power series and number-theoretic techniques, introduced by Jin and Wu (SOSA'19) and Kane (2010).

show abstract

“…Subset sum is one of the most fundamental hard problems in theoretical computer science, with a remarkable history of applications in cryptography [10,12,16,20,23]. Subset sum instances consist of a 1 , .…”

Section: Introductionmentioning

confidence: 99%

Better Sample -- Random Subset Sum in $2^{0.255n}$ and its Impact on Decoding Random Linear Codes

Esser,

May

2019

Preprint

View full text Add to dashboard Cite

We propose a new heuristic algorithm for solving random subset sum instances a1, . . . , an, t ∈ Z2n , which play a crucial role in cryptographic constructions. Our algorithm is search tree-based and solves the instances in a divide-and-conquer method using the representation method. From a high level perspective, our algorithm is similar to the algorithm of Howgrave-Graham-Joux (HGJ) and Becker-Coron-Joux (BCJ), but instead of enumerating the initial lists we sample candidate solutions. So whereas HGJ and BCJ are based on combinatorics, our analysis is stochastic. Our sampling technique introduces variance that increases the amount of representations and gives our algorithm more optimization flexibility. This results in the remarkable and natural property that we improve with increasing search tree depth. Whereas BCJ achieves the currently best known (heuristic) run time 2 0.291n for random subset sum, we improve (heuristically) down to 2 0.255n using a search tree of depth at least 13. We also apply our subset algorithm to the decoding of random binary linear codes, where we improve the best known run time of the Becker-Joux-May-Meurer algorithm from 2 0.048n in the half distance decoding setting down to 2 0.042n .

show abstract

Chosen-Ciphertext Security from Subset Sum

Cited by 12 publications

References 40 publications

Naor–Yung paradigm with shared randomness and applications

Naor–Yung paradigm with shared randomness and applications

Efficient reductions and algorithms for variants of Subset Sum

Better Sample -- Random Subset Sum in $2^{0.255n}$ and its Impact on Decoding Random Linear Codes

Contact Info

Product

Resources

About