Lattice Reduction in Cryptology: An Update

Nguyêñ, Phong Q.; Stern, Jacques

doi:10.1007/10722028_4

Cited by 77 publications

(51 citation statements)

References 68 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It has been remarked in Section 2.1 of [8] and then in Section 2.4 of [10] that the following statement holds which is somewhat stronger than that usually used in the literature. …”

Section: Latticesmentioning

confidence: 90%

Security of the most significant bits of the Shamir message passing scheme

Vasco

Shparlinski

2001

Math. Comp.

View full text Add to dashboard Cite

Abstract. Boneh and Venkatesan have recently proposed a polynomial time algorithm for recovering a "hidden" element α of a finite field Fp of p elements from rather short strings of the most significant bits of the remainder modulo p of αt for several values of t selected uniformly at random from F * p . Unfortunately the applications to the computational security of most significant bits of private keys of some finite field exponentiation based cryptosystems given by Boneh and Venkatesan are not quite correct. For the Diffie-Hellman cryptosystem the result of Boneh and Venkatesan has been corrected and generalized in our recent paper. Here a similar analysis is given for the Shamir message passing scheme. The results depend on some bounds of exponential sums.

show abstract

“…It has been remarked in Section 2.1 of [8] and then in Section 2.4 of [10] that the following statement holds which is somewhat stronger than that usually used in the literature. …”

Section: Latticesmentioning

confidence: 90%

Security of the most significant bits of the Shamir message passing scheme

Vasco

Shparlinski

2001

Math. Comp.

View full text Add to dashboard Cite

show abstract

“…Additional information on lattice theory can be found in numerous textbooks, such as [6,17]. For the important topic of lattice-based cryptanalysis, we refer to the recent survey [12].…”

Section: The Boneh-durfee Attackmentioning

confidence: 99%

“…For a discussion and a general exposition of Coppersmith's technique [5], see the recent surveys [2,12]. We describe the technique in the bivariate case, following a simplified approach due to HowgraveGraham [7].…”

Section: The Boneh-durfee Attackmentioning

confidence: 99%

Cryptanalysis of the RSA Schemes with Short Secret Exponent from Asiacrypt ’99

Durfee

Nguyêñ

2000

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. At Asiacrypt '99, Sun, Yang and Laih proposed three RSA variants with short secret exponent that resisted all known attacks, including the recent Boneh-Durfee attack from Eurocrypt '99 that improved Wiener's attack on RSA with short secret exponent. The resistance comes from the use of unbalanced primes p and q. In this paper, we extend the Boneh-Durfee attack to break two out of the three proposed variants. While the Boneh-Durfee attack was based on Coppersmith's lattice-based technique for finding small roots to bivariate modular polynomial equations, our attack is based on its generalization to trivariate modular polynomial equations. The attack is heuristic but works well in practice, as the Boneh-Durfee attack. In particular, we were able to break in a few minutes the numerical examples proposed by Sun, Yang and Laih. The results illustrate once again the fact that one should be very cautious when using short secret exponent with RSA.

show abstract

“…Based on an early attack found by Coppersmith and Shamir [7], however, the underlying hard problem was soon reformulated as a lattice problem. See [22] for an update on how lattices have recently been used both as a cryptanalytic tool and as a potential basis for cryptography.…”

Section: Introductionmentioning

confidence: 99%

Cryptanalysis of the Revised NTRU Signature Scheme

Gentry¹,

Szydlo²

2002

Lecture Notes in Computer Science

115

108

View full text Add to dashboard Cite

Abstract. In this paper, we describe a three-stage attack against Revised NSS, an NTRU-based signature scheme proposed at the Eurocrypt 2001 conference as an enhancement of the (broken) proceedings version of the scheme. The first stage, which typically uses a transcript of only 4 signatures, effectively cuts the key length in half while completely avoiding the intended hard lattice problem. After an empirically fast second stage, the third stage of the attack combines lattice-based and congruence-based methods in a novel way to recover the private key in polynomial time. This cryptanalysis shows that a passive adversary observing only a few valid signatures can recover the signer's entire private key. We also briefly address the security of NTRUSign, another NTRUbased signature scheme that was recently proposed at the rump session of Asiacrypt 2001. As we explain, some of our attacks on Revised NSS may be extended to NTRUSign, but a much longer transcript is necessary. We also indicate how the security of NTRUSign is based on the hardness of several problems, not solely on the hardness of the usual NTRU lattice problem.

show abstract

Lattice Reduction in Cryptology: An Update

Cited by 77 publications

References 68 publications

Security of the most significant bits of the Shamir message passing scheme

Security of the most significant bits of the Shamir message passing scheme

Cryptanalysis of the RSA Schemes with Short Secret Exponent from Asiacrypt ’99

Cryptanalysis of the Revised NTRU Signature Scheme

Contact Info

Product

Resources

About