Fast exhaustive search for polynomial systems in F2

Authors:
Charles Bouillaguet;Hsieh-Chung Chen;Chen-Mou Cheng;Tung Chou;Ruben Niederhagen;Adi Shamir;Bo-Yin Yang
Affiliations:
Ecole Normale Supérieure, Paris, France and Institute of Information Science, Academia Sinica, Taipei, Taiwan;National Taiwan University, Taipei, Taiwan;National Taiwan University, Taipei, Taiwan;National Taiwan University, Taipei, Taiwan and Technische Universiteit Eindhoven, The Netherlands;Ecole Normale Supérieure, Paris, France and Weizmann Institute of Science, Israel;Ecole Normale Supérieure, Paris, France;Institute of Information Science, Academia Sinica, Taipei, Taiwan
Venue:
CHES'10 Proceedings of the 12th international conference on Cryptographic hardware and embedded systems
Year:
2010

Citing 11
Cited 7

QUARTZ, 128-Bit Long Digital Signatures

CT-RSA 2001 Proceedings of the 2001 Conference on Topics in Cryptology: The Cryptographer's Track at RSA
Asymmetric Cryptography with a Hidden Monomial

CRYPTO '96 Proceedings of the 16th Annual International Cryptology Conference on Advances in Cryptology
A new efficient algorithm for computing Gröbner bases without reduction to zero (F5)

Proceedings of the 2002 international symposium on Symbolic and algebraic computation
Algebraic and Slide Attacks on KeeLoq

Fast Software Encryption
ECM on Graphics Cards

EUROCRYPT '09 Proceedings of the 28th Annual International Conference on Advances in Cryptology: the Theory and Applications of Cryptographic Techniques
Hidden fields equations (HFE) and isomorphisms of polynomials (IP): Two new families of asymmetric algorithms

EUROCRYPT'96 Proceedings of the 15th annual international conference on Theory and application of cryptographic techniques
Efficient algorithms for solving overdefined systems of multivariate polynomial equations

EUROCRYPT'00 Proceedings of the 19th international conference on Theory and application of cryptographic techniques
MRHS equation systems

SAC'07 Proceedings of the 14th international conference on Selected areas in cryptography
Flexible partial enlargement to accelerate gröbner basis computation over F2

AFRICACRYPT'10 Proceedings of the Third international conference on Cryptology in Africa
QUAD: a practical stream cipher with provable security

EUROCRYPT'06 Proceedings of the 24th annual international conference on The Theory and Applications of Cryptographic Techniques
Algebraic cryptanalysis of 58-round SHA-1

FSE'07 Proceedings of the 14th international conference on Fast Software Encryption

An improved algebraic attack on Hamsi-256

FSE'11 Proceedings of the 18th international conference on Fast software encryption
Public-key identification schemes based on multivariate quadratic polynomials

CRYPTO'11 Proceedings of the 31st annual conference on Advances in cryptology
General fault attacks on multivariate public key cryptosystems

PQCrypto'11 Proceedings of the 4th international conference on Post-Quantum Cryptography
Public-Key identification schemes based on multivariate cubic polynomials

PKC'12 Proceedings of the 15th international conference on Practice and Theory in Public Key Cryptography
On the complexity of solving quadratic Boolean systems

Journal of Complexity
Solving polynomial systems over finite fields: improved analysis of the hybrid approach

Proceedings of the 37th International Symposium on Symbolic and Algebraic Computation
Cube attack in finite fields of higher order

AISC '11 Proceedings of the Ninth Australasian Information Security Conference - Volume 116

Quantified Score

Hi-index	0.00

Visualization

Abstract

We analyze how fast we can solve general systems of multivariate equations of various low degrees over F2; this is a well known hard problem which is important both in itself and as part of many types of algebraic cryptanalysis. Compared to the standard exhaustive search technique, our improved approach is more efficient both asymptotically and practically. We implemented several optimized versions of our techniques on CPUs and GPUs. Our technique runs more than 10 times faster on modern graphic cards than on the most powerful CPU available. Today, we can solve 48+ quadratic equations in 48 binary variables on a 500-dollar NVIDIA GTX 295 graphics card in 21 minutes. With this level of performance, solving systems of equations supposed to ensure a security level of 64 bits turns out to be feasible in practice with a modest budget. This is a clear demonstration of the computational power of GPUs in solving many types of combinatorial and cryptanalytic problems.