Combinatorics in Algebraic and Logical Cryptanalysis Monika Trimoska To cite this version: Monika Trimoska. Combinatorics in Algebraic and Logical Cryptanalysis. Cryptography and Security [cs.CR]. Université de Picardie - Jules Verne, 2021. English. tel-03168389 HAL Id: tel-03168389 https://hal.archives-ouvertes.fr/tel-03168389 Submitted on 13 Mar 2021 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Th`ese de Doctorat Mention Informatique pr´esent´ee`al'Ecole´ Doctorale en Sciences, Technologie, Sant´e(ED 585) `al'Universit´ede Picardie Jules Verne par Monika Trimoska pour obtenir le grade de Docteur de l'Universit´ede Picardie Jules Verne Combinatorics in Algebraic and Logical Cryptanalysis Soutenue le 14 janvier 2021 apr`esavis des rapporteurs, devant le jury d'examen : Antoine Joux, Professeur Pr´esident Pierrick Gaudry, Directeur de Recherche Rapporteur Laurent Simon, Professeur Rapporteur Martin R. Albrecht, Professeur Examinateur Laure Brisoux Devendeville, Ma^ıtrede Conf´erences Examinateur Gilles Dequen, Professeur Directeur de th`ese Sorina Ionica, Ma^ıtrede Conf´erences Co-encadrant Cette th`esea ´et´eeffecut´eedans le cadre du projet CASSPair. Le projet CASSPair est cofinanc´epar l'Union europ´eenneavec le Fonds europ´eende d´eveloppement r´egional. 2 To my parents 3 Acknowledgements The greatest thank you goes out to my supervisors Gilles Dequen and Sorina Ionica, that have worked with me on crypto problems for the past five years. This work would not have been possible without their guidance and creative ideas. They have been very mindful about letting me become an independent researcher while, at the same time, making sure my work stays in the right direction. Any success I hopefully have in the future will also be a result of the skills that they have transferred to me. Gilles, thank you, first, for giving me that initial idea and inspiring me to go into research when my dream was to be a Java architect. For having advice on matters that go beyond the science, teaching me how to sort which things are important and not to worry about those that are not. It was a pleasure to work with you and I hope that we have a lot of brainstorming sessions in front of us. Sorina, thank you for always insisting I do my best work and being an example of the academic that I wish to become. For working till late in the evening with me on submissions, for being kind and patient when explaining technical matters that I still was not very good at, and for thinking (and acting) in advance about what is best for my professional development. Your support is, and has always been, greatly appreciated. I big thank you to all of the other professors from the CS department that have played a huge role in my development, both by their strong encouragements and by enthusiastically showing me numerous hard problems to think about. Some of them have later become my colleagues at MIS, where the day always starts with joy and laughter during our morning coffee break. On that note, a shout out to Juliette for making administration problems magically disappear. The other PhD students, who have become my friends are the reason why I have enjoyed coming to work every day. A big thanks to those that were here before me, Clement, Jordan, Romuald, and Richardson, for all their help at the beginning and throughout my thesis. I would also like to mention Fabien, Olivier, Cl´emence,S´ebastien, and Pierre for the fun we have at the office and the way we help each other, as well as our neighbors from the PR team. I also extend my thanks to all my friends in Amiens and Skopje for being there for me and for their encouragement. I am very grateful to the reviewers for taking the time to review my work and for asking such thoughtful questions during my defense. A big thank you to Pierrick Gaudry, for reading the manuscript with such attention to detail and for giving valuable insight on the subject of elliptic curves and index calculus attacks. Secondly, I thank Laurent Simon, for giving his honest feedback and praise that was indispensable to reassure us in our counter-intuitive findings on cdcl techniques. I should also like to extend my thanks to the examiners Antoine Joux and Martin R. Albrecht for their valuable comments, and finally, to Laure Brisoux Devendeville, who I have known for a very long time and was particularly happy to have as an examiner for this thesis. Special thanks to Antoine Joux for coming in person for my thesis defense in spite of the traveling difficulties that arise due to the current health crisis. I thank my parents for their support, in every meaning of the word, and for always putting me first. I am lucky to have parents that are such different people and thus, to be able to inherit the best of both. My pursuit for excellence in education comes from my 4 mother, as well as my privilege to pursue it, since she has made sure I start off with all the skills I need, early on. My courage for taking on bigger challenges than I think I can handle comes from my father, for setting such an example and encouraging me to do so as well. This thesis is dedicated to them. I also wish to make an honorable mention to their respective spouses, and, of course, to my younger brother and sister to whom I wish all the happiness and success in the world. To my grandparents and my other grandmother, I am very grateful for being the best cheerleaders anyone can have. I often feel like they are even more excited than I am about my accomplishments. My final thanks go to Aleksandar, to whom I owe my happiness. Your never-ending support makes life enjoyable and smooth, which in turn lets me be my best creative self. For this, and a list of reasons that can never be exhaustive, you play a huge hidden part in all of my accomplishments. 5 Contents R´esum´e 8 Glossary 14 1 Introduction 16 2 Boolean Polynomial Systems 21 2.1 Algebraic solving techniques.......................... 22 2.1.1 Gr¨obnerbasis algorithms........................ 22 2.1.2 Linearization and the XL family.................... 26 2.1.3 Exhaustive search............................ 27 2.1.4 Hybrid methods............................. 27 2.1.5 Algorithms for sparse systems..................... 28 2.2 Applications in cryptography......................... 28 I SAT as a tool 30 3 The Satisfiability problem 31 3.1 Preliminaries.................................. 31 3.2 Solving techniques............................... 33 3.3 Applications in cryptography......................... 36 3.3.1 Deriving a SAT model from a Boolean polynomial system..... 37 4 The WDSat Solver 41 4.1 Core algorithm................................. 42 4.2 Three reasoning modules............................ 44 4.2.1 CNF module.............................. 44 4.2.2 XORSET module............................ 47 4.2.3 XORGAUSS module.......................... 49 4.3 Extending the XORGAUSS module...................... 53 4.4 Complexity discussion............................. 58 II Cryptographic applications 60 5 ECDLP Preliminaries 61 5.1 Applications in cryptography......................... 63 5.1.1 Diffie-Hellman key exchange...................... 63 5.1.2 ElGamal encryption.......................... 64 5.1.3 Pairing-based cryptography...................... 65 5.2 Known attacks................................. 66 6 CONTENTS 5.2.1 Generic attacks............................. 66 5.2.2 Attacks on specific families....................... 67 6 Parallel Collision Search 69 6.1 Background................................... 70 6.1.1 Solving discrete logarithms....................... 71 6.1.2 Many collision applications : the multi-user setting......... 72 6.1.3 Many collision applications : meet-in-the-middle attacks...... 74 6.1.4 Computational model and data structure............... 74 6.2 Time complexity................................ 75 6.2.1 Finding one collision.......................... 75 6.2.2 Finding many collisions......................... 77 6.3 The multi-user setting............................. 80 6.4 Our approach for the data structure...................... 83 6.4.1 Radix tree structure.......................... 83 6.4.2 Packed Radix-Tree-List......................... 85 6.5 Implementation and benchmarks....................... 87 6.5.1 PRTL implementation......................... 87 6.5.2 PRTL vs. hash table........................... 88 6.5.3 ECDLP implementation details and scalability............ 91 6.5.4 Multi-collision search computation................... 92 7 Index Calculus 94 7.1 Background................................... 95 7.1.1 Classical index calculus......................... 95 7.1.2 Index calculus for ECDLP....................... 98 7.2 Model description................................ 100 7.2.1 The Algebraic Model.......................... 101 7.2.2 The CNF-XOR Model......................... 102 7.2.3 The CNF Model............................ 103 7.3 Symmetry breaking technique......................... 104 7.4 Branching order................................. 105 7.4.1 MVC and summation polynomials................... 108 7.5 Complexity