In this note, we provide proven estimates for the complexity of the SupportMinors Modeling, mostly confirming the heuristic complexity estimates contained in the original article (Bardet (2020) Improvements of algebraic attacks for solving the rank decoding and MinRank problems. In: Advances in cryptology. Springer, pp 507–536).

SNOVA is a post-quantum digital signature scheme based on multivariate polynomials. It is a second-round candidate in an ongoing NIST standardization process for post-quantum signatures, where it stands out for its efficiency and compactness. Since its initial submission, there have been several improvements to its security analysis, both on key recovery and forgery attacks. All these works reduce to solving a structured system of quadratic polynomials, which we refer to as SNOVA system. In this work, we propose a polynomial solving algorithm tailored for SNOVA systems, which exploits the stability of the system under the action of a commutative group of matrices. This new algorithm reduces the complexity of solving SNOVA systems over generic ones. We show how to adapt the reconciliation and direct attacks in order to profit from the new algorithm. Consequently, we improve the reconciliation attack for all SNOVA parameter sets with speedup factors ranging between 2 and 2(20). We also show how to use similar ideas to carry on a forgery attack. In this case, we use experimental results to estimate its complexity, and we discuss its impact. The empirical evidence suggests that our attack is more efficient than previous attacks, and it takes some SNOVA parameter sets below NIST's security threshold.

Multivariate public key cryptography (MPKC) is one of the most promising alternatives to build quantum-resistant signature schemes, as evidenced in NIST’s call for additional post-quantum signature schemes. The main assumption in MPKC is the hardness of the Multivariate Quadratic (MQ) problem, which seeks for a common root to a system of quadratic polynomials over a finite field. Although the Crossbred algorithm is among the most efficient algorithms to solve MQ over small fields, its complexity analysis stands on shaky ground. In particular, it is not clear for what parameters it works and under what assumptions. In this work, we provide a rigorous analysis of the Crossbred algorithm over any finite field. We provide a complete explanation of the series of admissible parameters proposed in previous literature and explicitly state the regularity assumptions required for its validity. Moreover, we show that the series does not tell the whole story, hence we propose an additional condition for Crossbred to work. Additionally, we define and characterize a notion of regularity for systems over a small field, which is one of the main building blocks in the series of admissible parameters.

The edit distance is a metric widely used in genomics to measure the similarity of two DNA chains. Motivated by privacy concerns, we propose a 2PC protocol to compute the edit distance while preserving the privacy of the inputs. Since the edit distance algorithm can be expressed as a mixed-circuit computation, our approach uses protocols based on secret-sharing schemes like Tinier and SPD ℤ_2^k ; and also daBits to perform domain conversion and edaBits to perform arithmetic comparisons. We modify the Wagner-Fischer edit distance algorithm, aiming at reducing the number of rounds of the protocol, and achieve a flexible protocol with a trade-off between rounds and multiplications. We implement our proposal in the MP-SPDZ framework, and our experiments show that it reduces the execution time respectively by 81

In this paper, we study the complexity of solving generic over-determined bilinear systems over a finite field $\mathbb{F}$. Given a generic bilinear sequence $B \in \mathbb{F}[\mathbf{x},\mathbf{y}]$, with respect to a partition of variables $\mathbf{x}$, $\mathbf{y}$, we show that, the solutions of the system $B= \mathbf{0}$ can be efficiently found on the $\mathbb{F}[\mathbf{y}]$-module generated by $B$. Following this observation, we propose three variations of Gr\"obner basis algorithms, that only involve multiplication by monomials in they-variables, namely, $\mathbf{y}$-XL, based on the XL algorithm, $\mathbf{y}$-MLX, based on the mutant XL algorithm, and $\mathbf{y}$-HXL, basedon a hybrid approach. We define notions of regularity for over-determined bilinear systems,that capture the idea of genericity, and we develop the necessary theoretical tools to estimate the complexity of the algorithms for such sequences. We also present extensive experimental results, testing our conjecture, verifying our results, and comparing the complexity of the various methods.

The Support-Minors (SM) method has opened new routes to attack multivariate schemes with rank properties that were previously impossible to exploit, as shown by the recent attacks of [9,40] on the Round 3 NIST candidates GeMSS and Rainbow respectively. In this paper, we study this SM approach more in depth and we propose a greatly improved attack on GeMSS based on this Support-Minors method. Even though GeMSS was already affected by [40], our attack affects it even more and makes it completely unfeasible to repair the scheme by simply increasing the size of its parameters or even applying the recent projection technique from [36] whose purpose was to make GeMSS immune to [40]. For instance, our attack on the GeMSS128 parameter set has estimated time complexity 2(72), and repairing the scheme by applying [36] would result in a signature with slower signing time by an impractical factor of 2(14). Another contribution is to suggest optimizations that can reduce memory access costs for an XL strategy on a large SM system using the Block-Wiedemann algorithm as subroutine when these costs are a concern. In a memory cost model based on [7], we show that the rectangular MinRank attack from [9] may indeed reduce the security for all Round 3 Rainbow parameter sets below their targeted security strengths, contradicting the lower bound claimed by [41] using the same memory cost model.

Rank Decoding (RD) is the main underlying problem in rank-based cryptography. Based on this problem and quasi-cyclic versions of it, very efficient schemes have been proposed recently, such as those in the ROLLO and RQC submissions, which have reached the second round of the NIST Post-Quantum competition. Two main approaches have been studied to solve RD: combinatorial ones and algebraic ones. While the former has been studied extensively, a better understanding of the latter was recently obtained by Bardet et al. (EUROCRYPT20) where it appeared that algebraic attacks can often be more efficient than combinatorial ones for cryptographic parameters. This paper gives substantial improvements upon this attack in terms both of complexity and of the assumptions required by the cryptanalysis. We present attacks for ROLLO-I-128, 192, and 256 with bit complexity respectively in 70, 86, and 158, to be compared to 117, 144, and 197 for the aforementionned previous attack. Moreover, unlike this previous attack, ours does not need generic Gr\obner basis algorithms since it only requires to solve a linear system. For a case called overdetermined, this modeling allows us to avoid Gr\obner basis computations by going directly to solving a linear system. For the other case, called underdetermined, we also improve the results from the previous attack by combining the Ourivski-Johansson modeling together with a new modeling for a generic MinRank instance; the latter modeling allows us to refine the analysis of MinRank's complexity given in the paper by Verbel et al. (PQC19). Finally, since the proposed parameters of ROLLO and RQC are completely broken by our new attack, we give examples of new parameters for ROLLO and RQC that make them resistant to our attacks. These new parameters show that these systems remain attractive, with a loss of only about 50\% in terms of key size for ROLLO-I.

Rank Decoding is the main underlying problem in rank-based cryptography. Based on this problem and quasi-cyclic versions of it, very efficient schemes have been proposed recently, such as those in the ROLLO and RQC submissions, which have reached the second round of the NIST Post-Quantum Cryptography Standardization Process. Two main approaches have been studied to solve the Rank Decoding problem: combinatorial ones and algebraic ones. While the former has been studied extensively, a better understanding of the latter was recently obtained by Bardet \emph{et al.} (EUROCRYPT 2020) where it appeared that algebraic attacks can often be more efficient than combinatorial ones for cryptographic parameters. In particular, these results were based on Gr\"obner basis computations which led to complexity bounds slightly smaller than the claimed security of ROLLO and RQC cryptosystems. This paper gives substantial improvements upon this attack in terms both of complexity and of the assumptions required by the cryptanalysis. We present attacks for ROLLO-I-128, ROLLO-I-192, and ROLLO-I-256 with bit complexity respectively in 70, 86, and 158, to be compared to 117, 144, and 197 for the aforementionned previous attack. Moreover, unlike that previous attack, the new one does not rely on Gr\"obner basis computations and thus does not require any assumption concerning the behavior of the so-called solving degree. This improvement relies upon a modeling slightly different from the one used in Bardet \emph{et al.} (EUROCRYPT 2020). For a case called ``overdetermined'', this modeling allows us to avoid Gr\"obner basis computations by going directly to solving a linear system. For the other case, called ``underdetermined'', we also improve the results from the previous attack by combining the Ourivski-Johansson modeling together with a new modeling for a generic MinRank instance; the latter modeling allows us to refine the analysis of MinRank's complexity given in the paper by Verbel \emph{et al.} (PQCrypto 2019). MinRank is a problem of great interest for all multivariate-based cryptosystems, including GeMSS and Rainbow, which are at the second round of the aforementionned NIST competition. Finally, since the proposed parameters of ROLLO and RQC are completely broken by our new attack, we give examples of new parameters for ROLLO and RQC that make them resistant to our attacks. These new parameters show that these systems remain attractive, with a loss of only about 50\% in terms of key size for ROLLO-I.

Recently, the Rainbow team was notified by Ray Perlner and Daniel Smith-Tone from the NIST PQC team of a new refined analysis of the Rainbow Band Separation (RBS) Attack using the natural variable partition of the polynomial system generated by the attack. (A) Cryptology ePrint Archive: Report 2020/702 Rainbow Band Separation is Better than we Thought, Ray Perlner and Daniel Smith-Tone This new analysis makes full use of the polynomial structure and therefore gains a few bits in terms of attack efficiency. Since the parameters of the submitted Rainbow instance were chosen almost exactly according to the NIST requirement, we have to modify the parameters of the scheme slightly to address this new refined analysis. Furthermore, the Rainbow team has been paying close attention to the recent development of a new method to improve the MinRank attack. This line of work started with a paper coauthored by the NIST team, too: (1) Javier A. Verbel, John Baena, Daniel Cabarcas, Ray A. Perlner, Daniel Smith-Tone: On the Complexity of ”Superdetermined” Minrank Instances. PQCrypto 2019: 167-186. Before of that, the methods used to evaluate the complexity of the MinRank attack mainly relied on the paper: (2) Jean-Charles Faugere, Francoise Levy-dit-Vehel, Ludovic Perret: Cryptanalysis of MinRank. CRYPTO 2008: 280-296, in which the authors claimed that they proved the best attacking method is to use the minors of the matrix generated by a linear combination of given matrices.

In this paper, we show how to significantly improve algebraic techniques for solving the MinRank problem, which is ubiquitous in multivariate and rank metric code based cryptography. In the case of the structured MinRank instances arising in the latter, we build upon a recent breakthrough [ 11 ] showing that algebraic attacks outperform the combinatorial ones that were considered state of the art up until now. Through a slight modification of this approach, we completely avoid Gröbner bases computations for certain parameters and are left only with solving linear systems. This does not only substantially improve the complexity, but also gives a convincing argument as to why algebraic techniques work in this case. When used against the second round NIST-PQC candidates ROLLO-I-128/192/256, our new attack has bit complexity respectively 71, 87, and 151, to be compared to 117, 144, and 197 as obtained in [ 11 ]. The linear systems arise from the nullity of the maximal minors of a certain matrix associated to the algebraic modeling. We also use a similar approach to improve the algebraic MinRank solvers for the usual MinRank problem. When applied against the second round NIST-PQC candidates GeMSS and Rainbow, our attack has a complexity that is very close to or even slightly better than those of the best known attacks so far. Note that these latter attacks did not rely on MinRank techniques since the MinRank approach used to give complexities that were far away from classical security levels.

Imitation Learning (IL) is a machine learning approach to learn a policy from a set of demonstrations. IL can be useful to kick-start learning before applying reinforcement learning (RL) but it can also be useful on its own, e.g. to learn to imitate human players in video games. Despite the success of systems that use IL and RL, how such systems can adapt in-between game rounds is a neglected area of study but an important aspect of many strategy games. In this paper, we present a new approach called Behavioral Repertoire Imitation Learning (BRIL) that learns a repertoire of behaviors from a set of demonstrations by augmenting the state-action pairs with behavioral descriptions. The outcome of this approach is a single neural network policy conditioned on a behavior description that can be precisely modulated. We apply this approach to train a policy on 7,777 human demonstrations for the build-order planning task in StarCraft II. Dimensionality reduction is applied to construct a low-dimensional behavioral space from a high-dimensional description of the army unit composition of each human replay. The results demonstrate that the learned policy can be effectively manipulated to express distinct behaviors. Additionally, by applying the UCB1 algorithm, the policy can adapt its behavior - in-between games - to reach a performance beyond that of the traditional IL baseline approach.

En la actualidad, el intercambio de información a través de dispositivos con características diversas es un proceso que ha incrementado de manera exagerada, lo que implica la necesidad de preservar diferentes servicios de seguridad en la información que se transmite entre ellos. Dado que el poder de cómputo sigue evolucionado a pasos agigantados, en un futuro cercano las computadoras cuánticas presentarán una gran amenaza, ya que dichas computadoras son capaces de realizar millones de operaciones en paralelo, se comprometerá la integridad de los algoritmos que preservan servicios de seguridad y, como consecuencia, los escenarios en donde son utilizados. En este trabajo, se presenta un acercamiento a la línea del tiempo que mantienen los algoritmos criptográficos, y se discute una lista de desafíos que estarían enfrentando los algoritmos del futuro, también llamados postcuánticos.

The public-key operation in multivariate encryption and signature schemes evaluates m quadratic polynomials in n variables. In this paper we analyze how fast this simple operation can be made. We optimize it for different finite fields on modern architectures. We provide an objective and inherent efficiency measure of our implementations, by comparing their performance with the peak performance of the CPU. In order to provide a fair comparison for different parameter sets, we also analyze the expected security based on the algebraic attack taking into consideration the hybrid approach. We compare the attack's efficiency for different finite fields and establish trends. We detail the role that the field equations play in the attack. We then provide a broad picture of efficiency of MQ-public-key operation against security.

The Minrank (MR) problem is a computational problem closely related to attacks on code- and multivariate-based schemes. In this paper we revisit the so-called Kipnis-Shamir (KS) approach to this problem. We extend previous complexity analysis by exposing non-trivial syzygies through the analysis of the Jacobian of the resulting system, with respect to a group of variables. We focus on a particular set of instances that yield a very overdetermined system which we refer to as "superdetermined". We provide a tighter complexity estimate for such instances and discuss its implications for the key recovery attack on some multivariate schemes. For example, in HFE the speedup is roughly a square root.

In this work we analyze the security of cubic cryptographic constructions with respect to rank weakness. We detail how to extend the big field idea from quadratic to cubic, and show that the same rank defect occurs. We extend the min-rank problem and propose an algorithm to solve it in this setting. We show that for fixed small rank, the complexity is even lower than for the quadratic case. However, the rank of a cubic polynomial in n variables can be larger than n, and in this case the algorithm is very inefficient. We show that the rank of the differential is not necessarily smaller, rendering this line of attack useless if the rank is large enough. Similarly, the algebraic attack is exponential in the rank, thus useless for high rank.

At PQCRYPTO 2014, Porras, Baena and Ding introduced ZHFE, an interesting new technique for multivariate post-quantum encryption. The scheme is a generalization of HFE in which a single low degree polynomial in the central map is replaced by a pair of high degree polynomials with a low degree cubic polynomial contained in the ideal they generate. We present a key recovery attack for ZHFE based on the independent discoveries of the low rank property of ZHFE by Verbel and by Perlner and Smith-Tone. Thus, although the two central maps of ZHFE have high degree, their low rank property makes ZHFE vulnerable to the Kipnis-Shamir (KS) rank attack. We adapt KS attack pioneered by Bettale, Faugère and Perret in application to HFE, and asymptotically break ZHFE.

In this paper we present a new algorithm to construct the keys of the multivariate public key encryption scheme ZHFE. Constructing ZHFE's trapdoor involves finding a low degree polynomial of q-Hamming-weight-three, as an aid to invert a pair of q-Hamming-weight-two polynomials of high degree and high rank. This is done by solving a large sparse linear system of equations. We unveil the combinatorial structure of the system in order to reveal the hidden structure of the matrix associated with it. When the system's variables and equations are organized accordingly, an almost block diagonal shape emerges. We then exploit this shape to solve the system much faster than when ZHFE was first proposed. The paper presents the theoretical details explaining the structure of the matrix. We also present experimental data that confirms the notable improvement of the key generation complexity, which makes ZHFE more suitable for practical implementations.

En este artículo se presenta una visión general del estado del arte del voto electrónico como opción para llevar a cabo elecciones populares. Se discuten requerimientos prototípicos, historia, efectos en la opinión pública, retos y oportunidades del voto electrónico. Se hace un especial énfasis en los retos criptográficos y en las tecnologías existentes.

Commitment schemes are among cryptography's most important building blocks. Besides their basic properties, hidingness and bindingness, for many applications it is important that the schemes applied support proofs of knowledge. However, all existing solutions which have been proven to provide these protocols are only computationally hiding or are not resistant against quantum adversaries. This is not suitable for long-lived systems, such as long-term archives, where commitments have to provide security also in the long run. Thus, in this work we present a new post-quantum unconditionally hiding commitment scheme that supports (statistical) zero-knowledge protocols and allows to refreshes the binding property over time. The bindingness of our construction relies on the approximate shortest vector problem, a lattice problem which is conjectured to be hard for polynomial approximation factors, even for a quantum adversary. Furthermore, we provide a protocol that allows the committer to prolong the bindingness property of a given commitment while showing in zero-knowledge fashion that the value committed to did not change. In addition, our construction yields two more interesting features: one is the ability to convert a Pedersen commitment into a lattice-based one, and the other one is the construction of a hybrid approach whose bindingness relies on the discrete logarithm and approximate shortest vector problems.

The world increasingly depends on archives to store digital documents, such as land registers and medical records, for long periods of time. For stored documents to remain trustworthy, archives must provide proofs that a document existed on a certain date and has not been changed since. In addition, in many cases, the origin of the document must be verifiable and the originator must not be able to repudiate that she is the originator. In this paper, we survey the solutions that provide the above protection goals in the long term. We analyze and compare the solutions with respect to their functionalities (which protection goals do they achieve?), the trust assumptions they require, and their performance. From this analysis and comparison, we deduce deficiencies of the current solutions and important research problems that must be solved in order to come up with protection solutions that are even more satisfactory.