Let p be a prime and a be any fixed positive integer such that gcd(a, Phi(p)) = 1. For 0 < x < p, define G(x) = #{m is an element of Z(& lowast;) p : | m-(m(a) mod p ) | < x }, where m(a) mod p is the least nonnegative residue of ma modulo p. We prove that G(x) = 2x-x (2) p(-1) + O ( p(1/2 )log(2) p) . This distribution result has an immediate cryptographic consequence. For RSA having public key (N , e) with small exponent e (such as 3 or 65537), we show that there exist at least Omega(N(3/4 )log(3) N) special plaintext-ciphertext pairs from which N can be factored in time O(log(12)N).
Calderini, Longo, Sala and Villa (Journal of Mathematical Cryptology 2024) proposed a public key encryption with keyword search (PKES) scheme which we call the CLSV scheme. They claim that the scheme provides Ciphertext-Indistinguishability (CI) security where no keyword information is leaked from ciphertexts. In this paper, we demonstrate a concrete attack that obtains keyword information from ciphertexts. We point out that a ciphertext of the CLSV scheme is an ElGamal ciphertext, which is malleable. By employing the malleability, we propose a ciphertext-trapdoor conversion algorithm that allows an CI adversary to generate a trapdoor for the challenge keyword without using the receiver’s secret key. We note that our attack follows a security model called full CI security, i.e., the attack needs an active adversary, and lies outside CI security considered in the CLSV paper. Thus, we do not claim to break the CLSV scheme. Due to this situation, we evaluate the validity of our attack model in light of the design objectives of the CLSV scheme. We also analyze the attack complexity, and show that our attack completes about 100 ms.
Ciphertext-Policy Attribute-Based Encryption (CP-ABE) is a cornerstone technique for fine-grained access control in encrypted data sharing, with pairing-based schemes having established the de facto standard. However, their vulnerability to quantum attacks generated growing interest in alternatives rooted in quantum-secure primitives, with Learning With Errors (LWE) emerging as a prominent candidate. In this work, we present the first direct performance benchmark of lattice-versus pairings-based CP-ABE implementations. We compare two mature, widely adopted implementations - PALISADE-ABE's LWE-based Zhang-Zhang scheme and OpenABE's pairing-based Waters scheme - selected for their comparable development environments and assumptions. Our results highlight the practical trade-offs - both costs and benefits - of each paradigm, quantifying where lattice-based designs offer advantages and where they incur extra overhead. This comparison addresses a critical gap in the literature and provides direction for the design of future post-quantum secure systems.
This work analyzes the probability of collisions in Merkle graphs, with a focus on a specific class of attacks in balanced Merkle trees. To provide a tractable model, each hash function is modeled as an independent random oracle with finite input space. We provided a general methodology for computing collision probabilities in arbitrary Merkle graphs, when an arbitrary amount of leaves is modified. The main finding of this study is the fact that an attack carried out modifying multiple leaves is not necessarily more powerful than the one carried out modifying only one leaf. Specifically, the collision probability depends on the height of the attacked Merkle tree, increasing for higher trees, and on the position of the modified nodes in the tree.
Integer sequences play a pivotal role in cryptography, acting as foundational elements for numerous cryptographic algorithms. This comprehensive investigation examines integer sequences that have significantly impacted the sector in domains such as key generation, hash function design, and encryption protocol development, including their specific implementations. We conduct an unprecedented systematic review of existing literature, analysing fundamental properties of these sequences and detailing their contributions to well-established cryptographic areas. In addition, the research emphasises the various strengths and limitations associated with these sequences, as well as their practical applications in the realm of digital information security. This is accomplished by developing a categorisation framework that facilitates mapping of their contributions. Furthermore, this framework can be used as a reference point for future analyses in this field. In conclusion, this research underscores the potential for further discovery and innovative applications of integer sequences in the cryptographic field.
Bilinear pairings have emerged as a fundamental tool in public-key cryptography, enabling advanced protocols such as identity-based encryption, short signatures, and zero-knowledge proofs. This paper focuses on optimizing pairing computations on curves with embedding degree 2, addressing both theoretical foundations and practical implementations. We propose an optimized double-and-add ladder algorithm that leverages the technique of y-coordinate recovery, achieving superior performance for the Tate pairing on supersingular curves and the Omega pairing on non-supersingular curves. Our method is implemented based on the RELIC cryptographic library, demonstrating significant efficiency improvements over Miller’s algorithm. Specifically, it reduces the number of base field multiplications (respectively CPU clock cycles) by 17.53 % (respectively 13.58 %) for the reduced Tate pairing on supersingular curves with a 1536-bit field size and by 12.37 % (respectively 8.39 %) for the Omega pairing on non-supersingular curves of the same size. This work establishes the first comprehensive implementation framework for cubical-based pairing computations on curves with embedding degree 2, providing quantified optimizations for practical cryptographic deployment.
In the recently emerging field of nonabelian group-based cryptography, a prominently used one-way function is the Conjugacy Search Problem (CSP), and two important classes of platform groups are polycyclic and matrix groups. In this paper, we discuss the complexity of the conjugacy search problem (CSP) in these two classes of platform groups using the three protocols in [10], [26], and [29] as our starting point. We produce a polynomial time solution for the CSP in a finite polycyclic group with two generators, and show that a restricted CSP is reducible to a DLP. In matrix groups over finite fields, we usedthe Jordan decomposition of a matrix to produce a polynomial time reduction of an A-restricted CSP, where A is a cyclic subgroup of the general linear group, to a set of DLPs over an extension of Fq. We use these general methods and results to describe concrete cryptanalysis algorithms for these three systems. In particular, we show that in the group of invertible matrices over finite fields and in polycyclic groups with two generators, a CSP where conjugators are restricted to a cyclic subgroup is reducible to a set of O(n2) discrete logarithm problems. Using our general results, we demonstrate concrete cryptanalysis algorithms for each of these three schemes. We believe that our methods and findings are likely to allow for several other heuristic attacks in the general case.
We analyze the efficiency and security of the inner product functional encryption (IPFE) protocol introduced in 2021 by Debnath, Mesnager, Dey, and Kundu, specifically when instantiated with UOV. While the scheme offers several advantages, including improvements in key generation and encryption/decryption algorithms, along with compact key sizes, the decryption algorithm remains exponential in complexity with respect to the security parameter. To address this limitation, we propose a variant aimed at reducing the decryption cost. However, this alternative remains impractical at present due to the resulting large ciphertext size.
We present two simple zero-knowledge interactive proofs that can be instantiated with many of the standard decisional or computational hardness assumptions. Compared with traditional zero-knowledge proofs, in our protocols, the verifier starts first, by emitting a challenge, and then, the prover answers the challenge.
Post-quantum cryptography deals with the development and analysis of cryptographic schemes that are assumed to be secure even against attackers with access to a powerful quantum computer. Along the main candidates for quantum-safe solutions are cryptographic schemes, whose security is based on classic lattice problems such as the bounded-distance decoding (BDD) problem or the learning with error problem. In this work, we contribute to the analysis of an attack category against these problems called dual attack. In recent years, a lot of notable progress was achieved in this topic. Our first contribution is to provide theoretical counterarguments against a so-called independence assumption, which was used in earlier works on this attack, and which was shown in a previous work to be contradicting practical experiments. Then, we provide estimates on the success probability and the cost of the dual attack against the decisional version of the BDD problem. These estimates are derived both rigorously and heuristically. Finally, we also provide experimental evidence that confirms these results.
We present BTLE (Broadcast Time-Lock Exchange Protocol), a two-step protocol that aims to decentralize exchange of funds between two blockchains in scenarios similar to online exchanges. BTLE leverages time-lock puzzles to achieve that. In the first phase, the BTLE-MA protocol allows for a matching between a market maker and one of the competing market takers. In the second phase, the BTLE-AS algorithm allows the exchange between the market maker and the winning market taker. It is not necessary to use both the BTLE-MA and BTLE-AS algorithms in a decentralized-exchange scenario: existing atomic swaps based on hashed time-lock contract (HTLC) can benefit from BTLE-MA and can be adapted to an exchange where there are multiple possible participants. Moreover, BTLE computations are off-chain, so BTLE can be used in those blockchain pairs where at least one of the two does not have a scripting language or where the pair do not have the same hash function in common. This solves a limitation of HTLC-based atomic swaps. We also propose a new time-lock puzzle based on Pell conic calculations as an alternative to the classical time-lock puzzle of Rivest et al. BTLE has been implemented and tested. Experiments demonstrate that this new time-lock puzzle based on the Pell conic is superior for the intended goal. With an NN-bit modulus of 2,000 bits, the RSW-TL approach resolves the puzzle in approximately 100 s, whereas our BM-TL method requires over 4,000 s, significantly reducing the number of squaring operations needed.
There are many group-based cryptosystems in which the security is related to the conjugacy search problem or the simultaneous conjugacy search problem in their underlying platform groups. In this article, we show that some metabelian groups do not provide strong security for these cryptosystems and so they cannot be chosen as platform groups.
Bidoux and Gaborit introduced a new general technique to improve zero-knowledge (ZK) proof-of-knowledge (PoK) schemes for a large set of well-known post-quantum hard computational problems such as the syndrome decoding, the permuted kernel, the rank syndrome decoding, and the multivariate quadratic (MQ) problems. In particular, the authors’ idea in the study of Bidoux and Gaborit was to use the structure of these problems in the multi-instance setting to minimize the communication complexity of the resulting ZK PoK schemes. The security of the new schemes is then related to new hard problems. In this article, we focus on the new multivariate-based ZK PoK and the corresponding new underlying problem: the so-called DiffMQH{{\mathtt{DiffMQ}}}_{{\rm{H}}}. We present a new efficient probabilistic algorithm for solving the DiffMQH{{\mathtt{DiffMQ}}}_{{\rm{H}}} which is polynomial-time if m−n∈O(1)m-n\in O\left(1). We also present experimental results showing that the algorithm is efficient in practice.
The term “homomorphism” was introduced in cryptography by Rivest, Adleman, and Dertouzos in 1978 to address performing calculations on encrypted data without decryption. Since then, researchers have increasingly aimed to design schemes supporting numerous operations. This article aims to synthesize the current state of the art in the so-called somewhat homomorphic encryption.
Let p>1p\gt 1 be a large prime number, and let ε>0\varepsilon \gt 0 be a small number. The established unconditional upper bounds of the least primitive root u≠±1,v2u\ne \pm 1,{v}^{2} in the prime finite field Fp{{\mathbb{F}}}_{p} have exponential magnitudes u≪p1⁄4+εu\ll {p}^{1/4+\varepsilon }. This note contributes a new result to the literature. It proves that the upper bound of the least primitive root has polynomial magnitude u≤(logp)1+εu\le {\left(\log p)}^{1+\varepsilon } unconditionally.
The condition number of a generator matrix of an ideal lattice derived from the ring of integers of an algebraic number field is an important quantity associated with the equivalence between two computational problems in lattice-based cryptography, the “Ring Learning With Errors (RLWE)” and the “Polynomial Learning With Errors (PLWE)”. In this work, we compute the condition number of a generator matrix of the ideal lattice from the whole ring of integers of any odd prime degree cyclic number field using canonical embedding.
Threshold signatures enable any subgroup of predefined cardinality tt out of a committee of nn participants to generate a valid, aggregated signature. Although several (t,n)\left(t,n)-threshold signature schemes exist, most of them assume that the threshold tt and the set of participants do not change over time. Practical applications of threshold signatures might benefit from the possibility of updating the threshold or the committee of participants. Examples of such applications are consensus algorithms and blockchain wallets. In this article, we present Dynamic-FROST (D-FROST) that combines FROST, a Schnorr threshold signature scheme, with CHURP, a dynamic proactive secret sharing scheme. The resulting protocol is the first Schnorr threshold signature scheme that accommodates changes in both the committee and the threshold value without relying on a trusted third party. Besides detailing the protocol, we present a proof of its security: as the original signing scheme, D-FROST preserves the property of existential unforgeability under chosen-message attack.
Homomorphic encryption allows for computations on encrypted data without exposing the underlying plaintext, enabling secure and private data processing in various applications such as cloud computing and machine learning. This article presents a comprehensive mathematical foundation for three prominent homomorphic encryption schemes: Brakerski–Gentry–Vaikuntanathan (BGV), Brakerski–Fan-Vercauteren (BFV), and Cheon–Kim–Kim–Song (CKKS), all based on the ring learning with errors (RLWE) problem. We align our discussion with the functionalities proposed in the recent homomorphic encryption standard, providing detailed algorithms and correctness proofs for each scheme. In addition, we propose improvements to the current schemes focusing on noise management and optimization of public key encryption and leveled homomorphic computation. Our modifications ensure that the noise bound remains within a fixed function for all levels of computation, guaranteeing correct decryption and maintaining efficiency comparable to existing methods. The proposed enhancements reduce ciphertext expansion and storage requirements, making these schemes more practical for real-world applications.
Let $\mathbb{Q}(\alpha)$ and $\mathbb{Q}(\beta)$ be linearly disjoint number fields and let $\mathbb{Q}(\theta)$ be their compositum. We prove that the first-degree prime ideals of $\mathbb{Z}[\theta]$ may almost always be constructed in terms of the first-degree prime ideals of $\mathbb{Z}[\alpha]$ and $\mathbb{Z}[\beta]$, and vice-versa. We also classify the cases in which this correspondence does not hold, by providing explicit counterexamples. We show that for every pair of coprime integers $d,e \in \mathbb{Z}$, such a correspondence almost always respects the divisibility of principal ideals of the form $(e+d\theta)\mathbb{Z}[\theta]$, with a few exceptions that we characterize. Finally, we discuss the computational improvement of such an approach, and we verify the reduction in time needed for computing such primes for certain concrete cases.
We find an efficient method to solve the semidirect discrete logarithm problem (SDLP) over finite nonabelian groups of order p3{p}^{3} and exponent p2{p}^{2} for certain exponentially large parameters. This implies an attack on SPDH-Sign,Pronounced “SPUD-Sign”. a signature scheme based on the SDLP, for such parameters. In particular, SDLP instances over such groups are parameterised by an n<(p−1)p6n\lt \left(p-1){p}^{6}: we develop a method to solve instances when n≤poly(logp)⋅pn\le {\rm{poly}}\left(\log p)\hspace{0.25em}\cdot p. Letting λ\lambda be the security parameter of SPDH-Sign, which is taken p=expλp=\exp \lambda , we find we may solve instances of SDLP corresponding to SPDH-Sign instances with exponentially large pp. However, for n≈p2n\approx {p}^{2} and larger, our method no longer completely solves the SDLP instances. We also study the linear hidden shift problem for a group action corresponding to SDLP and take a step towards proving the quantum polynomial time equivalence of SDLP and the semidirect computational Diffie–Hellman problem.
