Ruhr- Universität Bochum Fakultät für Mathematik Informationssicherheit und Kryptologie Solving Systems of Equations with Incompatible Operations CITS – Cryptology and Information Security Fakultät für Mathematik Ruhr-Universität Bochum Magnus Daum

Ruhr- Universität Bochum Fakultät für Mathematik Informationssicherheit und Kryptologie Daum - Solving Systems of Equations with Incompatible Operations2 Overview Motivation Dobbertins Algorithm Solution Graphs Algorithms for Solution Graphs Conclusions

Ruhr- Universität Bochum Fakultät für Mathematik Informationssicherheit und Kryptologie Daum - Solving Systems of Equations with Incompatible Operations3 Systems of Equations Cryptanalysis often uses systems of equations, e.g. –linear equations –quadratic equations (e.g. algebraic attack) But many cryptosystems include different, mathematically incompatible kinds of operations: –integer operations modulo 2 n –bitwise defined functions –bitrotations / -shifts could be also represented by polynomial equations better to have tools for directly solving equations involving such different operations

Ruhr- Universität Bochum Fakultät für Mathematik Informationssicherheit und Kryptologie Daum - Solving Systems of Equations with Incompatible Operations4 Motivation/Application Dobbertins attacks on hash functions: –e.g. solve where f is a bitwise defined function –Idea: X k,…,0 solution for least significant k+1 bit ) X k-1,…,0 solution for least significant k bit –Solve from right to left T-functions (Klimov/Shamir): –f T-function, k-th output bit of f depends only on least significant k-1 input bits –solvable from right to left

Ruhr- Universität Bochum Fakultät für Mathematik Informationssicherheit und Kryptologie Daum - Solving Systems of Equations with Incompatible Operations5 Dobbertins Algorithm tree of solutions

Ruhr- Universität Bochum Fakultät für Mathematik Informationssicherheit und Kryptologie Daum - Solving Systems of Equations with Incompatible Operations6 Dobbertins Algorithm tree of solutions Often possible to stop early Faster than exhaustive search For each solution there exists a leaf in the tree Complexity directly related to the number of solutions Problem: We are mainly interested in equations with many solutions.

Ruhr- Universität Bochum Fakultät für Mathematik Informationssicherheit und Kryptologie Daum - Solving Systems of Equations with Incompatible Operations7 Improvement: Exploiting Redundancy Idea: Combine redundant subtrees Problem: Detect redundancy during the construction of the graph Only the carrybit is relevant for the solution for the third bit Labeling the vertices with the carrybits makes it possible to detect redundancies on the fly tree of solutions

Ruhr- Universität Bochum Fakultät für Mathematik Informationssicherheit und Kryptologie Daum - Solving Systems of Equations with Incompatible Operations8 Example Tree of solutions from Dobbertins algorithm

Ruhr- Universität Bochum Fakultät für Mathematik Informationssicherheit und Kryptologie Daum - Solving Systems of Equations with Incompatible Operations9 Example solution graph

Ruhr- Universität Bochum Fakultät für Mathematik Informationssicherheit und Kryptologie Daum - Solving Systems of Equations with Incompatible Operations10 solution graph Example Compact representation of the set of solutions Can be simplified even more

Ruhr- Universität Bochum Fakultät für Mathematik Informationssicherheit und Kryptologie Daum - Solving Systems of Equations with Incompatible Operations11 Solution Graphs One root and one sink Labelling of the edges describes solutions: Each path from the root to the sink represents a solution (and vice versa) Also possible to consider equations with more than one variable: –E.g. label edges with X i Y i Z i instead of only X i sink root

Ruhr- Universität Bochum Fakultät für Mathematik Informationssicherheit und Kryptologie Daum - Solving Systems of Equations with Incompatible Operations12 Size of Solution Graphs possible to minimize size: –delete dead-ends –merge equivalent vertices Size is hardly predictable in general worst-Case: exponential size here: upper bounds –because of labelling with carrybits –T-functions: narrowness gives upper bound on possible labels

Ruhr- Universität Bochum Fakultät für Mathematik Informationssicherheit und Kryptologie Daum - Solving Systems of Equations with Incompatible Operations13 T-functions: Narrowness general T-function: w-narrow T-function:

Ruhr- Universität Bochum Fakultät für Mathematik Informationssicherheit und Kryptologie Daum - Solving Systems of Equations with Incompatible Operations14 Algorithms for Solution Graphs Solution graphs are closely related to binary decision diagrams (BDDs) Further efficient algorithms from the theory of BDDs deriveable: –computing the number of solutions –choosing random solutions –combining solution graphs (e.g. intersecting two sets of solutions)

Ruhr- Universität Bochum Fakultät für Mathematik Informationssicherheit und Kryptologie Daum - Solving Systems of Equations with Incompatible Operations15 Computing the Number of Solutions Counting the number of ways to reach the sink from each of the vertices Complexity: linear in der size of the graph allows choosing solutions uniformly at random 2+3= = =2 4+5=9 solutions

Ruhr- Universität Bochum Fakultät für Mathematik Informationssicherheit und Kryptologie Daum - Solving Systems of Equations with Incompatible Operations16 Intersection Complexity: roughly quadratic in the sizes

Ruhr- Universität Bochum Fakultät für Mathematik Informationssicherheit und Kryptologie Daum - Solving Systems of Equations with Incompatible Operations17 Generalized Solution Graphs Use variables, which are not represented explicitly in the graph (allows representing 9 Y:...-like statements)

Ruhr- Universität Bochum Fakultät für Mathematik Informationssicherheit und Kryptologie Daum - Solving Systems of Equations with Incompatible Operations18 Generalized Solution Graphs Use variables, which are not represented explicitly in the graph (allows representing 9 Y:...-like statements) Allow similar, but more sophisticated algorithms right bit shifts and bit rotations can be integrated

Ruhr- Universität Bochum Fakultät für Mathematik Informationssicherheit und Kryptologie Daum - Solving Systems of Equations with Incompatible Operations19 Conclusion presented a new data structure, a solution graph closely related to BDDs allows efficient computation and representation of special systems of equations with incompatible operations especially for T-functions with small narrowness

Ruhr- Universität Bochum Fakultät für Mathematik Informationssicherheit und Kryptologie Daum - Solving Systems of Equations with Incompatible Operations20 Thank you! Questions???