The Legendre Symbol and the Modulo-2 Operator in Symmetric Schemes over Fnp

Abstract

Motivated by modern cryptographic use cases such as multi-party computation (MPC), homomorphic encryption (HE), and zero-knowledge (ZK) protocols, several symmetric schemes that are efficient in these scenarios have recently been proposed in the literature. Some of these schemes are instantiated with low-degree nonlinear functions, for example low-degree power maps (e.g., MiMC, HadesMiMC, Poseidon) or the Toffoli gate (e.g., Ciminion). Others (e.g., Rescue, Vision, Grendel) are instead instantiated via high-degree functions which are easy to evaluate in the target application. A recent example for the latter case is the hash function Grendel, whose nonlinear layer is constructed using the Legendre symbol. In this paper, we analyze high-degree functions such as the Legendre symbol or the modulo-2 operation as building blocks for the nonlinear layer of a cryptographic scheme over Fnp.Our focus regards the security analysis rather than the efficiency in the mentioned use cases. For this purpose, we present several new invertible functions that make use of the Legendre symbol or of the modulo-2 operation.Even though these functions often provide strong statistical properties and ensure a high degree after a few rounds, the main problem regards their small number of possible outputs, that is, only three for the Legendre symbol and only two for the modulo-2 operation. By fixing them, it is possible to reduce the overall degree of the function significantly. We exploit this behavior by describing the first preimage attack on full Grendel, and we verify it in practice.

Invertible Quadratic Non-Linear Layers for MPC-/FHE-/ZK-Friendly Schemes over Fnp

“…As a direct consequence, no quadratic function over F p for p ≥ 3 is invertible. 2 Other examples of invertible functions over F p for p ≥ 3 have been recently proposed in the literature via the Legendre symbol L p : F p → {−1, 0, 1} defined as L p (x) := x (p−1)/2 (recalled in Definition 3), and they include x → x • (α + L p (x)) where L p (α 2 − 1) = 1 introduced by Shallue [Sha12], x → x d •L p (x) where gcd(d+(p−1)/2, p−1) = 1 introduced by Szepieniec [Sze21], and their generalization proposed in [GKRS22].…”

Security of the Poseidon Hash Function Against Non-Binary Differential and Linear Attacks

“…But if there are several rounds, each with only one S-box, between two rounds with a full S-box layer, we cannot state anything about the number of active S-boxes in these rounds, except that this number is not less than the number of rounds. It should be noted that the authors of [5] did not take this detail into account when constructing security estimates against linear and differential cryptanalysis, and, as a result, incorrect estimates were obtained.…”

“…using statements 1 and 2 of Theorem 1 for powered and inverse S-boxes, respectively. Also in [5] the authors proposed to add two extra full rounds, just for any case. But adding two full rounds (one at the beginning, and one at the end) makes r full odd and does not increase security.…”

“…This number of constraints is quite acceptable, but the question of reducing it still remains relevant. The Poseidon hash function proposed in [5] appeared to be quite a good construction with respect to the number of constraints. For this function, the number of constraints is up to 15 times smaller than for the Pedersen hash function.…”

“…The Poseidon hash function is based upon the SPONGE construction [6] that uses the HADES block cipher algorithm [7] as the inner permutation. For this reason, the main part of the security substantiation for the Poseidon hash function is to show that the HADES algorithm is indistinguishable from The Poseidon hash function [5] uses SPONGE construction [6] with a permutation named HadesMiMC [7] inside it (see Fig. 1).…”