Federated Learning (FL) has emerged as a popular paradigm for collaborative learning among multiple parties. It is considered privacy-friendly because local data remains on personal devices, and only intermediate parameters – such as gradients or model updates – are shared. Although gradient inversion is widely viewed as a common attack method in FL, analytical research on reconstructing input training samples from shared gradients remains limited and is typically confined to constrained settings like small batch sizes. In this paper, we aim to overcome these limitations by addressing the problem from a cryptographic perspective. We mathematically formulate the input reconstruction problem using the gradient information shared in FL as the Hidden Subset Sum Problem (HSSP), an extension of the well-known NP-complete Subset Sum Problem (SSP). Leveraging this formulation allows us to achieve perfect input reconstruction, thereby mitigating issues such as dependence on label diversity and underperformance with large batch sizes that hinder existing empirical gradient inversion attacks. Moreover, our analysis provides insights into why empirical input reconstruction attacks degrade with larger batch sizes. By modeling the problem as HSSP, we demonstrate that the batch size B significantly affects attack complexity, with time complexity reaching 𝒪(B^9). We further show that applying secure data aggregation techniques – such as homomorphic encryption and secure multiparty computation – provides a strong defense by increasing the time complexity to 𝒪(N^9 B^9), where N is the number of local clients in FL. To the best of our knowledge, this is the first work to rigorously analyze privacy issues in FL by modeling them as HSSP, providing a concrete analytical foundation for further exploration and development of defense strategies.

In this article, we propose a new tool to evaluate the security of instances of FiLIP cipher. TooLIP is user friendly, it automatically evaluates the cost of several attacks on user-defined Boolean functions. It allows to test new families of filters that are more homomorphic friendly for recent techniques of evaluations, and is designed to easily add new attacks, or change parameters in the considered attacks. To demonstrate our tool we apply it in three contexts. First we show how the keysize can be reduced for former instances with XOR-Threshold functions when the amount of encrypted plaintext obtained by the adversary is limited. Then, we use TooLIP to determine secure instances with filters in less variables for two new families of Boolean functions, leading to a more efficient evaluation and/or a reduced bandwidth. Finally, we apply it to find other instances with filters where we know only (bounds on) the algebraic immunity and resiliency.

This article introduces the concept of S-0-equivalence class, i.e. , n-variable Boolean functions up to the addition of a symmetric function null in 0(n) and 1(n), and investigates its application to study weightwise perfectly balanced functions. On the one hand, we show that weightwise properties, such as being weightwise perfectly balanced, the weightwise nonlinearity and weightwise algebraic immunity, are invariants of these equivalence classes. On the other hand, we analyze the variation of global parameters inside the same class, and prove, for example, that there is always a function with high degree, algebraic immunity, or nonlinearity in the S-0-equivalence class of a function. Finally, we discuss how these results can be extended to other equivalence relations and their applications in cryptography.

In this article we study the Algebraic Immunity (AI) of Weightwise Perfectly Balanced (WPB) functions. After showing a lower bound on the AI of two classes of WPB functions from the previous literature, we prove that the minimal AI of a WPB n-variables function is constant, equal to 2 for n≥ 4 . Then, we compute the distribution of the AI of WPB function in 4 variables, and estimate the one in 8 and 16 variables. For these values of n we observe that a large majority of WPB functions have optimal AI, and that we could not obtain a WPB function with AI 2 by sampling at random. Finally, we address the problem of constructing WPB functions with bounded algebraic immunity, exploiting a construction from [12]. In particular, we present a method to generate multiple WPB functions with minimal AI, and we prove that the WPB functions with high nonlinearity exhibited in [12] also have minimal AI. We conclude with a construction giving WPB functions with lower bounded AI, and give as example a family with all elements with AI at least n/2-log (n)+1 .

In this article we realize a general study on the nonlinearity of weightwise perfectly balanced (WPB) functions. First, we derive upper and lower bounds on the nonlinearity from this class of functions for all n. Then, we give a general construction that allows us to provably provide WPB functions with nonlinearity as low as 2^n/2-1 and WPB functions with high nonlinearity, at least 2^n-1-2^n/2 . We provide concrete examples in 8 and 16 variables with high nonlinearity given by this construction. In 8 variables we experimentally obtain functions reaching a nonlinearity of 116 which corresponds to the upper bound of Dobbertin’s conjecture, and it improves upon the maximal nonlinearity of WPB functions recently obtained with genetic algorithms. Finally, we study the distribution of nonlinearity over the set of WPB functions. We examine the exact distribution for n=4 and provide an algorithm to estimate the distributions for n=8 and 16, together with the results of our experimental studies for n=8 and 16.

The design of FLIP stream cipher presented at Eurocrypt 2016 motivates the study of Boolean function with good cryptographic criteria when restricted to subsets of F-2(n). Since the security of FLIP relies on properties of functions restricted to subsets of constant Hamming weight, called slices, several studies investigate functions with good properties on the slices, i.e. weightwise properties. A major challenge is to build functions balanced on each slice, from which we get the notion of Weightwise Almost Perfectly Balanced (WAPB) functions. Although various constructions ofWAPB functions have been exhibited since 2017, building WAPB functions with high weightwise nonlinearities remains a difficult task. Lower bounds on the weightwise nonlinearities of WAPB functions are known for very few families, and exact values were computed only for functions in at most 16 variables. In this article, we introduce and study two new secondary constructions of WAPB functions. This new strategy allows us to bound the weightwise nonlinearities from those of the parent functions enabling us to produce WAPB functions with high weightwise nonlinearities. As a practical application, we build several novel WAPB functions in up to 16 variables by taking parent functions from two different known families. Moreover, combining these outputs, we also produce the 16-variable WAPB function with the highest weightwise nonlinearities known so far.

In this article we perform a general study on the criterion of weightwise nonlinearity for the functions which are weightwise perfectly balanced (WPB). First, we investigate the minimal value this criterion can take over WPB functions, deriving theoretic bounds, and exhibiting the first values. We emphasize the link between this minimum and weightwise affine functions, and we prove that for n ≥ 8 no n-variable WPB function can have this property. Then, we focus on the distribution and the maximum of this criterion over the set of WPB functions. We provide theoretic bounds on the latter and algorithms to either compute or estimate the former, together with the results of our experimental studies for n up to 8. Finally, we present two new constructions of WPB functions obtained by modifying the support of linear functions for each set of fixed Hamming weight. This provides a large corpus of WPB function with proven weightwise nonlinearity, and we compare the weightwise nonlinearity of these constructions to the average value, and to the parameters of former constructions in 8 and 16 variables.

At Crypto ’99, Nguyen and Stern described a lattice based algorithm for solving the hidden subset sum problem, a variant of the classical subset sum problem where the n weights are also hidden. As an application, they showed how to break the Boyko et al. fast generator of random pairs ( x, g x (mod p )). The Nguyen-Stern algorithm works quite well in practice for moderate values of n , but its complexity is exponential in n . A polynomial-time variant was recently described at Crypto 2020, based on a multivariate technique, but the approach is heuristic only. In this paper, we describe a proven polynomial-time algorithm for solving the hidden subset-sum problem, based on statistical learning. In addition, we show that the statistical approach is also quite efficient in practice: using the FastICA algorithm, we can reach n = 250 in reasonable time.

Abstract At Crypto 2018, Aggarwal, Joux, Prakash and Santha (AJPS) described a new public-key encryption scheme based on Mersenne numbers. Shortly after the publication of the cryptosystem, Beunardeau et al. described an attack with complexity 𝓞(22h). In this paper, we describe an improved attack with complexity 𝓞(21.75h).

At Crypto ’99, Nguyen and Stern described a lattice based algorithm for solving the hidden subset sum problem, a variant of the classical subset sum problem where the n weights are also hidden. While the Nguyen-Stern algorithm works quite well in practice for moderate values of n, we argue that its complexity is actually exponential in n; namely in the final step one must recover a very short basis of a n-dimensional lattice, which takes exponential-time in n, as one must apply BKZ reduction with increasingly large block-sizes.