Cryptanalysis of GGH Map

Cryptanalysis of GGH15 Multilinear Maps

“…As discussed in the previous section, it likely follows that there exists a polynomial time quantum attack (and a subexponential classical attack) that recovers the secret element g from I. The second attack [HJ16] builds upon the first attack and classically breaks the key agreement. We recall the two attacks below.…”

“…Now, on a classical computer, recovering g from I takes at least subexponential time. We describe below a classical polynomial-time attack of Hu and Jia against the key-agreement protocol [HJ16]. First assume that we recovered I as in the previous attack.…”

“…Unfortunately, these candidates do not rely on well-established hardness assumptions, and recent months have witnessed a number of attacks (including [CHL + 15], [CGH + 15], [HJ16], [BGH + 15], [PS15], [CFL + 16]) showing that they fail to meet a number of desirable security requirements, and that they cannot be used to securely instantiate such and such protocols. Some attempts to protect against these attacks have also known a similar fate [CLT15, BGH + 15].…”

Zeroizing Without Low-Level Zeroes: New MMAP Attacks and their Limitations

“…For GGH13, the graded decisional Diffie-Hellman assumption from [10] was broken by Hu and Jia [18], in the same settings for which the initial zeroizing attack [10] applies (i.e., in the presence of low-level encodings of zero).…”

“…This attack was called in [10] a "weak discrete-log attack". Recently, this attack was used by Hu and Jia [18] as a component in a new attack that breaks the key-exchange protocol from [10].…”