Cryptanalysis of the Multilinear Map over the Integers

Abstract

The CRT-ACD problem is to find the primes p 1 , . . . , p n given polynomially many instances of CRT (p1,...,pn) (r 1 , . . . , r n ) for small integers r 1 , . . . , r n . The CRT-ACD problem is regarded as a hard problem, but its hardness is not proven yet. In this paper, we analyze the CRT-ACD problem when given one more input CRT (p1,...,pn) (x 0 /p 1 , . . . , x 0 /p n ) forp i and propose a polynomial-time algorithm for this problem by using products of the instances and auxiliary input.This algorithm yields a polynomial-time cryptanalysis of the (approximate) multilinear map of Coron, Lepoint and Tibouchi (CLT): We show that by multiplying encodings of zero with zero-testing parameters properly in the CLT scheme, one can obtain a required input of our algorithm: products of CRT-ACD instances and auxiliary input. This leads to a total break: all the quantities that were supposed to be kept secret can be recovered in an efficient and public manner.We also introduce polynomial-time algorithms for the Subgroup Membership, Decision Linear, and Graded External Diffie-Hellman problems, which are used as the base problems of several cryptographic schemes constructed on multilinear maps.

Zeroizing Without Low-Level Zeroes: New MMAP Attacks and their Limitations

“…Our extension to the attacks from [6] to avoid low-level zero encodings was also observed independently and concurrently by Boneh, Wu, and Zimmerman [4]. We further systematize the new attacks and show that they can overcome recent proposals to "immunize" against them [12,4].…”

“…The most direct consequence of our work is that more hardness assumptions and constructions from the literature are broken. Prior to our work, the attacks of [6] already broke several assumptions and constructions using CLT13 encodings because they provided low-level encodings of zero. Our work extends to new assumptions and constructions, even where no low-level encodings of zero are available.…”

“…The essence of these attacks is using successful zero tests to obtain equations over the base ring (Z or Z[X]/F (X)), then solving these equations to get the desired information. First presented in the context of the GGH13 candidate [10], such attacks were recently extended by Cheon et al [6] also to the CLT13 candidate, where they were shown to be particularly devastating, leading to a total break (when they can be mounted).…”

“…As explicitly discussed in [6], however, these attacks seem to depend on the availability of low-level encoding of zeros. This limits the applicability of these attacks, especially since several high-profile applications of multilinear maps (such as for obfuscation [11]) do not reveal such lowlevel zero encodings.…”

“…In this work we show that it is possible to "zeroize without low-level zeroes": that is, we extend the attacks from [6] and apply them against both CLT13 encodings and a matrix variant of GGH13 encodings, even in settings where no low-level encodings of zero are available to the adversary. Our extension to the attacks from [6] to avoid low-level zero encodings was also observed independently and concurrently by Boneh, Wu, and Zimmerman [4].…”