We survey recent work on the elliptic curve discrete logarithm problem. In particular we review index calculus algorithms using summation polynomials, and claims about their complexity.

/pdf/recent-progress-on-the-elliptic-curve-discrete-logarithm-4r9lwgqwre.pdf

Recent progress on the elliptic curve discrete logarithm problem

We initiate the study of multi-user mu security of authenticated encryption AE schemes as a way to rigorously formulate, and answer, questions about the "randomized nonce" mechanism proposed for the use of the AE scheme GCM in TLSi¾?1.3. We 1 Give definitions of mu ind indistinguishability and mu kr key recovery security for AE 2 Characterize the intent of nonce randomization as being improved mu security as a defense against mass surveillance 3 Cast the method as a new AE scheme RGCM 4 Analyze and compare the mu security of both GCM and RGCM in the model where the underlying block cipher is ideal, showing that the mu security of the latter is indeed superior in many practical contexts to that of the former, and 5 Propose an alternative AE scheme XGCM having the same efficiency as RGCM but better mu security and a more simple and modular design.

/pdf/the-multi-user-security-of-authenticated-encryption-aes-gcm-2o62ezj6jm.pdf

The Multi-user Security of Authenticated Encryption: AES-GCM in TLS 1.3

This paper presents Gimli, a 384-bit permutation designed to achieve high security with high performance across a broad range of platforms, including 64-bit Intel/AMD server CPUs, 64-bit and 32-bit ARM smartphone CPUs, 32-bit ARM microcontrollers, 8-bit AVR microcontrollers, FPGAs, ASICs without side-channel protection, and ASICs with side-channel protection.

/pdf/gimli-a-cross-platform-permutation-g0kuljcz1k.pdf

Gimli : A Cross-Platform Permutation

The cryptographic community has widely acknowledged that the emergence of large quantum computers will pose a threat to most current public-key cryptography. Primitives that rely on order-finding problems, such as factoring and computing Discrete Logarithms, can be broken by Shor’s algorithm ([49]).

/pdf/an-efficient-quantum-collision-search-algorithm-and-2cu1r4j9in.pdf

An Efficient Quantum Collision Search Algorithm and Implications on Symmetric Cryptography

At ASIACRYPT 1991, Even and Mansour introduced a block cipher construction based on a single permutation. Their construction has since been lauded for its simplicity, yet also criticized for not providing the same security as other block ciphers against generic attacks. In this paper, we prove that if a small number of plaintexts are encrypted under multiple independent keys, the Even-Mansour construction surprisingly offers similar security as an ideal block cipher with the same block and key size. Note that this multi-key setting is of high practical relevance, as real-world implementations often allow frequent rekeying. We hope that the results in this paper will further encourage the use of the Even-Mansour construction, especially when a secure and efficient implementation of a key schedule would result in significant overhead.

/pdf/multi-key-security-the-even-mansour-construction-revisited-4l2wvvt2sn.pdf

Multi-key Security: The Even-Mansour Construction Revisited

In this paper, we investigate the multi-user setting both in public and in secret-key cryptanalytic applications. In this setting, the adversary tries to recover keys of many users in parallel more efficiently than with classical attacks, i.e., the number of recovered keys multiplied by the time complexity to find a single key, by amortizing the cost among several users. One possible scenario is to recover a single key in a large set of users more efficiently than to recover a key in the classical model. Another possibility is, after some shared precomputation, to be able to learn individual keys very efficiently. This latter model is close to traditional time/memory tradeoff attacks with precomputation. With these goals in mind, we introduce two new algorithmic ideas to improve collision-based attacks in the multi-user setting. Both ideas are derived from the parallelizable collision search as proposed by van Oorschot and Wiener. This collision search uses precomputed chains obtained by iterating some basic function. In our cryptanalytic application, each pair of merging chains can be used to correlate the key of two distinct users. The first idea is to construct a graph, whose vertices are keys and whose edges are these correlations. When the graph becomes connected, we simultaneously recover all the keys. Thanks to random graph analysis techniques, we can show that the number of edges that are needed to make this event occurs is small enough to obtain some improved attacks. The second idea modifies the basic technique of van Oorschot and Wiener: instead of waiting for two chains to merge, we now require that they become parallel.

/pdf/multi-user-collisions-applications-to-discrete-logarithm-3awl44i4oe.pdf

Multi-user Collisions: Applications to Discrete Logarithm, Even-Mansour and PRINCE

Multi-user collisions: Applications to Discrete Logs, Even-Mansour and Prince.

Chaskey is a Message Authentication Code MAC for 32-bit microcontrollers proposed by Mouha et al. at SAC 2014. Its underlying blockcipher uses an Even-Mansour construction with a permutation based on the ARX methodology. In this paper, we present key-recovery attacks against Chaskey in the single and multi-user setting. These attacks are based on recent work by Fouque, Joux and Mavromati presented at Asiacrypt 2014 on Even-Mansour based constructions. We first show a simple attack on the classical single-user setting which confirms the security properties of Chaskey. Then, we describe an attack in the multi-user setting and we recover all keys of $$2^{43}$$243 users by doing $$2^{43}$$243 queries per user. Finally, we show a variant of this attack where we are able to recover keys of two users in a smaller group of $$2^{32}$$232 users.

/pdf/key-recovery-attacks-against-the-mac-algorithm-chaskey-5888dacwhf.pdf

Key-Recovery Attacks Against the MAC Algorithm Chaskey

In this paper, we investigate the multi-user setting both in public and in secret-key cryptanalytic applications. In this setting, the adversary tries to recover keys of many users in parallel more efficiently than with classical attacks, i.e., the number of recovered keys multiplied by the time complexity to find a single key, by amortizing the cost among several users. One possible scenario is to recover a single key in a large set of users more efficiently than to recover a key in the classical model. Another possibility is, after some shared precomputation, to be able to learn individual keys very efficiently. This latter model is close to traditional time/memory tradeoff attacks with precomputation. With these goals in mind, we introduce two new algorithmic ideas to improve collision-based attacks in the multi-user setting. Both ideas are derived from the parallelizable collision search as proposed by van Oorschot and Wiener. This collision search uses precomputed chains obtained by iterating some basic function. In our cryptanalytic application, each pair of merging chains can be used to correlate the key of two distinct users. The first idea is to construct a graph, whose vertices are keys and whose edges are these correlations. When the graph becomes connected, we simultaneously recover all the keys. Thanks to random graph analysis techniques, we can show that the number of edges that are needed to make this event occurs is small enough to obtain some improved attacks. The second idea modifies the basic technique of van Oorschot and Wiener: instead of waiting for two chains to merge, we now require that they become parallel. We first show that, using the first idea alone, we can recover the discrete logarithms of L users in a group of size N in time O( √ NL). We put these two ideas together and we show that in the multi-user Even-Mansour scheme, all the keys of L = N users can be found with N queries for each user (where N is the domain size). Finally, we consider the PRINCE block cipher (with 128-bit keys and 64-bit blocks) and find the keys of 2 users among a set of 2 users in time 2. We also describe a new generic attack in the classical model for PRINCE.

/pdf/multi-user-collisions-applications-to-discrete-logarithm-2kkihw5p4x.pdf

Chrysanthi Mavromati

Papers

Multi-user Collisions: Applications to Discrete Logarithm, Even-Mansour and PRINCE

Multi-user collisions: Applications to Discrete Logs, Even-Mansour and Prince.

Key-Recovery Attacks Against the MAC Algorithm Chaskey

Multi-user collisions: Applications to Discrete Logarithm, Even-Mansour and PRINCE (Full version∗)