Copyright by Shweta Prem Agrawal 2007 Algebraic Attacks: A Survey by Shweta Prem Agrawal, B.E. Thesis Presented to the Faculty of the Graduate School of The University of Texas at Austin in Partial Fulfillment of the Requirements for the Degree of Master of Arts The University of Texas at Austin December 2007 Algebraic Attacks: A Survey Approved by Supervising Committee: For my mother Acknowledgments Many people have contributed in large measure to making this work possible. I want to thank my advisor Anna, for her understanding and support. I have learnt much from working with her- both technically and otherwise. She provided excellent guidance in research but more importantly, she was kind and encouraging during my struggle to get into theory from an unrelated background. I am especially grateful to her for the numerous times she went out of her way to help me, and for the comfortable work environment she helped create. Working with her has been both enjoyable and inspiring. I am deeply indebted to David Zuckerman for the most beautiful introduction to theory that I could have hoped for. My love for both math and research has been largely shaped by my interaction with him. More significant than the math I learnt from him was the spirit of mathematical reasoning, rigor and intuition that I was able to imbibe. I am grateful to everyone I interacted with at UT for an enthusiastic and motivational academic atmosphere. Special thanks is due to members of the theory group, especially Anna, David and Greg for their concern, help and advice. I thank my friends for the long discussions and fun times. Not enough can be said for the love, faith and support of my parents and brother. Across the thousands of miles between us, they have given me comfort, optimism, trust. A special thanks to my mother- without whose love, nothing is possible. v Thanks to Austin for all the experiences I have had here. My time here has created memories that I will cherish all my life. Shweta Prem Agrawal The University of Texas at Austin December 2007 vi Algebraic Attacks: A Survey Shweta Prem Agrawal, M.A. The University of Texas at Austin, 2007 Supervisor: Anna G´al Algebraic attacks have recently acquired great importance in the area of cryptog- raphy, not only due to the ciphers they have been able to break, but more impor- tantly, because the principle of algebraic attacks is very generic and can be applied to break large classes of ciphers. Several ciphers, previously considered secure and widely used in practice were found to be potentially vulnerable to algebraic attacks. In this survey, we examine algebraic attacks against both public and symmet- ric key ciphers. We discuss the Boolean functions used in the design of ciphers from the perspective of algebraic attacks, and consider the ”cryptographic” complexity and explicit construction of these functions. We also briefly look at recently discov- ered methods of solving certain systems of multivariate polynomial equations since algebraic attacks rely on being able to solve such systems of equations efficiently. vii Contents Acknowledgments v Abstract vii Chapter 1 Introduction 1 1.1 Publickeyciphers ............................ 4 1.2 Symmetrickeyciphers . .. .. .. .. .. .. .. 11 1.2.1 Blockciphers ........................... 11 1.2.2 Streamciphers .......................... 17 Chapter 2 Cryptographic Complexity of Boolean Functions 23 2.1 Important cryptographic properties of Boolean functions....... 23 2.2 About the cryptographic complexity of Boolean functions ...... 34 Chapter 3 Algebraic attacks against symmetric key ciphers 40 3.1 Algebraic attacks against stream ciphers . 40 3.1.1 Conventional attacks against stream Ciphers . 40 3.1.2 Setup for algebraic attack . 41 3.1.3 Theproblemofcryptanalysis . 41 3.1.4 Theattack ............................ 41 3.2 Algebraic attacks against block ciphers . 43 3.2.1 Conventional methods of cryptanalysis against block ciphers 43 3.2.2 How block ciphers resist conventional statistical attacks . 44 3.2.3 Algebraic attacks on Block ciphers . 44 viii Chapter 4 Solving systems of multivariate equations 47 4.1 The Quadratic Solvability problem . 47 4.2 Methods of solving systems of multivariate polynomial equations: . 48 4.2.1 Linearization ........................... 48 4.2.2 Relinearization . 49 4.2.3 XLalgorithm ........................... 50 4.2.4 XSLmethod ........................... 51 4.2.5 Gr¨obner basis techniques . 52 4.2.6 SATsolvers............................ 53 4.2.7 ”Gluing” Algorithm . 53 Chapter 5 Explicit Constructions of Boolean functions with Impor- tant Cryptographic Properties 54 5.1 Algebraicconstruction . .. .. .. .. .. .. .. 54 5.2 HeuristicDesign ............................. 57 Chapter 6 Some open problems and concluding remarks 62 Appendix A Useful Definitions 66 A.1 Algebraicdefinitions .. .. .. .. .. .. .. .. 66 A.2 Cryptographicdefinitions . 68 A.3 Fourier-WalshTransforms . 70 Bibliography 74 Vita 93 ix Chapter 1 Introduction The area of algebraic attacks has recently received a lot of attention in cryptographic literature. As is well known, there are two main kinds of encryption: public key encryption and symmetric key encryption. Algebraic attacks are relevant to both kinds. The principle of algebraic attacks is to recover the secret key of the cipher by solving a system of algebraic equations. We will make this more precise sub- sequently. Regardless of the type of cipher used, there are equations that can be set up involving the plaintext bits, ciphertext bits and the key. In particular, you can describe all encryption schemes, whether public key or symmetric key, as repre- sented by the following simple relation: C = E(M, K), where C is the ciphertext, E is the function describing how the ciphertext is obtained from the plaintext and key, M is the plaintext and K is the secret key. Each ciphertext bit ci where i = 1....n is obtained from the plaintext bits x1, ..., xn and the key bits k1, k2..., km considered as input variables, by applying a function f, i.e. ci = f(x1, ..., xn, k1, ..., km). Thus, we can think of the encryption E as a set of functions with the plaintext and key bits as variables. We will consider the case when these functions are polynomials. In the case of Boolean functions, this can always be assumed. Often, the ciphertext C and the polynomials representing the encryption are known publicly, specifically to the attacker. The basis of security of such a setup is the hardness of the problem of solving complex systems of multivariate polynomial equations. In fact, this problem is NP-hard even for the case of quadratic polynomials, and is called the Multivariate Quadratic(abbreviated as MQ) problem. We discuss this problem further in chapter 4. 1 The hardness of MQ is an old and well known result [GJ79]; in fact in his seminal paper in 1949 [Sha49], Shannon wrote that if we could show that breaking a cipher requires at least as much work as ”solving a system of simultaneous equations in a large number of unknowns of a complex type”, then we could think of it as a good cipher. Several cryptosystems, both public and symmetric key, have used the hard- ness of solving appropriately chosen systems of polynomial equations as a basis of their security. For example, in public key ciphers, the public key can be a set of mul- tivariate polynomials, say P = p ; i = 1, ..., m , and the encryption C of an n bit { i } − message M is done by assigning the variables of the polynomials values correspond- ing to the bits of the message, i.e. cj = pi(M). If the polynomials are publicly known, and the ciphertext is also known, (as is usually the case), the secrecy of the 1 encoded message relies on the hardness of computing M = P − (C). However, it recently became known, that several ciphers that use the diffi- culty of the above-mentioned problem for encryption, are vulnerable to what are known as algebraic attacks. Algebraic attacks are those that recover the secret key by solving a system of equations. As mentioned above, all ciphers can be repre- sented by some system of multivariate polynomial equations. We could argue that this should pose no threat, because as we noted, the problem of solving certain sys- tems of equations, is known to be NP hard even for the quadratic case. However, the threat posed by algebraic attacks relies on the fact that not all multivariate quadratic equations are hard to solve; the hardness of solving such a system of equations depends on the choice of equations. It has been shown that most systems of equations produced by or used by ciphers, are very far from random. Such systems of equations often have some alge- braic structure or hidden properties that can be used to solve them efficiently. Let’s make this notion more precise with some examples. In one of the early instances of algebraic attacks, Kipnis and Shamir [KS99] exploit the structure of the cipher to get an overdefined system of equations. By overdefined, we mean that 2 the number of equations is greater than the number of variables. For a long time, the best known method to solve systems of multivariate polynomial equations was by using Buchberger’s algorithm for computing a Gr¨obner basis. Buchberger’s algo- rithm has large exponential complexity and does not exploit the specific structure of the system of equations. But in [KS99], Kipnis and Shamir introduced an algorithm called ”Relinearization” that uses the overdefinedness of the system of equations to solve it very efficiently. Further improvements to this algorithm were discovered later. Faster algorithms for computing Gr¨obner basis also became known and used for cryptanalysis of ciphers, e.g. the HFE cryptosystem [FJ03]. In 2002, Courtois and Pieprzyk in [CP02] came up with another algorithm called ”XSL” that exploits the sparsity of the system of equations to solve it efficiently.