Beiträge Zur Algebra Und Geometrie / Contributions To Algebra And Geometry, Jan 7, 2020
The border basis scheme B O parametrizes all 0-dimensional ideals in K [x 1 ,. .. , x n ], where ... more The border basis scheme B O parametrizes all 0-dimensional ideals in K [x 1 ,. .. , x n ], where K is an arbitrary field, which have a border basis with respect to a given order ideal of terms O. Its vanishing ideal I (B O) is generated by quadratic equations which are easy to describe, and it contains a unique monomial point, namely the point corresponding to the monomial ideal generated by the terms outside O. Based on a detailed study of the generators of I (B O), we describe a K-basis of the cotangent space m/m 2 , where m is the maximal ideal of the monomial point. Moreover, we provide an efficient algorithm to compute such a basis and use it to characterize the regularity of the monomial point.
According to a theorem of Monsky, the Hilbert-Kunz function of a 1-dimensional standard graded al... more According to a theorem of Monsky, the Hilbert-Kunz function of a 1-dimensional standard graded algebra R over a finite field K has, for i 0, the shape HKR(i) = c(R) • p i + ϕ(i), where c(R) is the multiplicity of R and ϕ is a periodic function. Here we study explicit computer algebra algorithms for computing such Hilbert-Kunz functions: the period length and the values of ϕ, as well as a concrete number N ≥ 0 such that the description above holds for i ≥ N .
In this paper we analyze the Habeeb-Kahrobaei-Koupparis-Shpilrain (HKKS) key exchange protocol wh... more In this paper we analyze the Habeeb-Kahrobaei-Koupparis-Shpilrain (HKKS) key exchange protocol which uses semidirect products of groups as a platform. We show that the particular instance of the protocol suggested in their paper can be broken via a simple linear algebra attack.
Beiträge Zur Algebra Und Geometrie / Contributions To Algebra And Geometry, Dec 2, 2016
The Burnside ring B(G) of a finite group G, a classical tool in the representation theory of fini... more The Burnside ring B(G) of a finite group G, a classical tool in the representation theory of finite groups, is studied from the point of view of computational algebra. In the first part (cf. Kreuzer and Patil, Beitr Algebra Geom 58:427-452, 2017) we examined the ring theoretic properties of B(G) using the methods of computer algebra. In this part we shift our focus to important maps between two Burnside rings and make several well-known maps of representation theory explicitly computable. The inputs of all our algorithms are the tables of marks of the two groups, and the outputs are matrices of integers representing the maps via their image in the ghost ring. All algorithms have been implemented in the computer algebra system ApCoCoA and are illustrated by applying them to explicit examples. Especially, we study the restriction and induction maps, the projection and inflation maps, the conjugation isomorphism, and the Frobenius-Wielandt homomorphism.
Beiträge Zur Algebra Und Geometrie / Contributions To Algebra And Geometry, Jul 29, 2016
Given a 0-dimensional subscheme X of a projective space P n K over a field K , we characterize in... more Given a 0-dimensional subscheme X of a projective space P n K over a field K , we characterize in different ways whether X is the complete intersection of n hypersurfaces. Besides a generalization of the notion of a Cayley-Bacharach scheme, these characterizations involve the Kähler and the Dedekind different of the homogeneous coordinate ring of X or its Artinian reduction. We also characterize arithmetically Gorenstein schemes in novel ways and bring in further tools such as the module of regular differential forms, the fundamental class, and the Jacobian module of X. Throughout we strive to work over an arbitrary base field K and keep the scheme X as general as possible, thereby improving several known characterizations.
A differential fault attack framework for the Enocoro family of stream ciphers is presented. We o... more A differential fault attack framework for the Enocoro family of stream ciphers is presented. We only require that the attacker can reset the internal state and inject a random byte-fault, in a random register, during a known time period. For a single fault injection, we develop a differential clocking algorithm that computes a set of linear equations in the in- and output differences of the non-linear parts of the cipher and relates them to the differential keystream. The usage of these equations is two-fold. Firstly, one can determine those differentials that can be computed from the faulty keystream, and secondly they help to pin down the actual location and timing of the fault injection. Combining these results, each fault injection gives us information on specific small parts of the internal state. By encoding the information we gain from several fault injections using the weighted Horn clauses, we construct a guessing path that can be used to quickly retrieve the internal state...
Mathematical Aspects of Computer and Information Sciences, 2017
For solving systems of Boolean polynomials whose zeros are known to be contained in \(\mathbb {F}... more For solving systems of Boolean polynomials whose zeros are known to be contained in \(\mathbb {F}_2^n\), algebraic solvers such as the Boolean Border Basis Algorithm (BBBA) and SAT solvers use very different and possibly complementary methods to create new information. Based on suitable implementations of these solvers and conversion methods from Boolean polynomials to SAT clauses and back, we describe an automatic framework integrating the two solving techniques and exchanging newly found information between them. Using examples derived from cryptographic attacks, we present some initial experiments indicating the efficiency of this combination.
In this paper we analyze the Habeeb-Kahrobaei-Koupparis-Shpilrain (HKKS) key exchange protocol wh... more In this paper we analyze the Habeeb-Kahrobaei-Koupparis-Shpilrain (HKKS) key exchange protocol which uses semidirect products of groups as a platform. We show that the particular instance of the protocol suggested in their paper can be broken via a simple linear algebra attack.
The Freiheitssatz of Magnus for one-relator groups is one of the cornerstones of combinatorial gr... more The Freiheitssatz of Magnus for one-relator groups is one of the cornerstones of combinatorial group theory. In this short note which is mostly expository we discuss the relationship between the Freiheitssatz and corre-sponding results in free power series rings over fields. These are related to results of Schneerson not readily available in English. This relationship uses a faithful representation of free groups due to Magnus. Using this method in free polynomial algebras provides a proof of the Freiheitssatz for one-relation monoids. We show how the classical Freiheitssatz depends on a condition on certain ideals in power series rings in noncommuting variables over fields. A proof of this result over fields would provide a completely dif erent proof of the classical Freiheitssatz.
In [4,5] using faithful complex representations of cyclically pinched and conjugacy pinched one... more In [4,5] using faithful complex representations of cyclically pinched and conjugacy pinched one-relator groups we proved that any limit group has a faithful representation in $PSL(2,C)$. Further this representation can be effectively constructed using the JSJ decomposition. In this note we show that any hyperbolic cyclically pinched one-relator group with maximal amalgamated subgroups in each factor has a 2-dimensional faithful real representation.
In this paper we consider formulas that are conjunctions of linear clauses, i.e., of linear equat... more In this paper we consider formulas that are conjunctions of linear clauses, i.e., of linear equations. Such formulas are very interesting because they encode CNF constraints that are typically very hard for SAT solvers. We introduce a new proof system SRES that works with linear clauses and show that SRES is implicationally and refutationally complete. Algebraically speaking, linear clauses correspond to products of linear polynomials over a ring of Boolean polynomials. That is why SRES can certify if a product of linear polynomials lies in the ideal generated by some other such products, i.e., the SRES calculus decides the ideal membership problem. Furthermore, an algorithm for certifying inconsistent systems of the above shape is described. We also establish the connection with an another combined proof system R(lin).
Hardware implementations of advanced cryptographic schemes gain in importance for emerging cyber-... more Hardware implementations of advanced cryptographic schemes gain in importance for emerging cyber-physical and autonomous systems, and their resistance against physical attacks is becoming a central requirement. This paper studies fault-injection attacks against the private key of the Elliptic Curve ElGamal cryptosystem. It extends previously introduced bit and byte fault models by models that assume faults in arbitrary s -bit portions (subtuples) of the key. We provide a mathematical proof that characterizes the set of subtuple candidates after a fault injection affecting an arbitrary number of bits s . The proof reinforces earlier findings for s = 8 and implies that the number of key subtuple candidates grows exponentially in s . We also report on fault-injection experiments, both on the software level and using an optimized hardware implementation for NIST-recommended elliptic curves.
International Journal of Computer Mathematics: Computer Systems Theory, 2020
ABSTRACT For the stream cipher KCipher-2 of the Japanese e-Government Recommended Ciphers List, w... more ABSTRACT For the stream cipher KCipher-2 of the Japanese e-Government Recommended Ciphers List, we present fault attacks requiring only the possibility to reset the cipher and to inject byte faults into certain registers. For the polynomial systems resulting from an injection sequence into one register, we develop a dedicated algebraic solving technique. Using the Marking Algorithm of Horn Logic and the computation of certain Gröbner bases, we optimize the number and locations of fault injection sequences which allow the recovery of the full state of the cipher. The optimal attack requires only about 21 fault injections and 100 seconds for solving the polynomial systems and finding the internal state.
A fault injection framework for the decryption algorithm of the Niederreiter public-key cryptosys... more A fault injection framework for the decryption algorithm of the Niederreiter public-key cryptosystem using binary irreducible Goppa codes and classical decoding techniques is described. In particular, we obtain low-degree polynomial equations in parts of the secret key. For the resulting system of polynomial equations, we present an efficient solving strategy and show how to extend certain solutions to alternative secret keys. We also provide estimates for the expected number of required fault injections, apply the framework to state-of-the-art security levels, and propose countermeasures against this type of fault attack.
Kehrein and Kreuzer (J Pure Appl Algebra 205(2):279-295, 2006) presented an algorithm, referred t... more Kehrein and Kreuzer (J Pure Appl Algebra 205(2):279-295, 2006) presented an algorithm, referred to as the BorderBasis algorithm, for computing border bases. The main objective of this paper is to improve this computation by applying new structures from the theory of Gröbner bases. In doing so, based on the method developed by Gao et al. (Math Comput 85(297):449-465, 2016), a new variant of the BorderBasis algorithm is proposed to compute simultaneously a border basis and also a Gröbner basis for the syzygy module of the input polynomials (this pair of bases will be called a coupled border basis). The new algorithm, and also the original form of the BorderBasis algorithm, have been implemented in the computer algebra systems Maple and ApCoCoA. We compare the performance of our implementation of these algorithms via a set of benchmark polynomials. Our experiments show that our algorithm performs more efficiently than the original BorderBasis algorithm.
This paper introduces Multi-Stage Fault Attacks, which allow Differential Fault Analysis of block... more This paper introduces Multi-Stage Fault Attacks, which allow Differential Fault Analysis of block ciphers having independent subkeys. Besides the specification of an algorithm implementing the technique, we show concrete applications to LED-128 and PRINCE and demonstrate that in both cases approximately 3 to 4 fault-injections are enough to reconstruct the full 128-bit key.
Key agreement, the Algebraic Eraser$^{TM}$, and lightweight cryptography by I. Anshel, M. Anshel,... more Key agreement, the Algebraic Eraser$^{TM}$, and lightweight cryptography by I. Anshel, M. Anshel, D. Goldfeld, and S. Lemieux Designing key transport protocols using combinatorial group theory by G. Baumslag, T. Camps, B. Fine, G. Rosenberger, and X. Xu Geometric key establishment by A. Berenstein and L. Chernyak Using shifted conjugacy in braid-based cryptography by P. Dehornoy Length-based conjugacy search in the braid group by D. Garber, S. Kaplan, M. Teicher, B. Tsaban, and U. Vishne Towards provable security for cryptographic constructions arising from combinatorial group theory by M. I. Gonzalez Vasco, R. Steinwandt, and J. L. Villar Constructions in public-key cryptography over matrix groups by D. Grigoriev and I. Ponomarenko A practical attack on the root problem in braid groups by A. Groch, D. Hofheinz, and R. Steinwandt An attack on a group-based cryptoraphic scheme by D. Hofheinz and D. Unruh Algebraic problems in symmetric cryptography: Two recent results on highly nonlinear functions by N. G. Leander Inverting the Burau and Lawrence-Krammer representations by E. Lee A new key exchange protocol based on the decomposition problem by V. Shpilrain and A. Ushakov Using the subgroup membership search problem in public key cryptography by V. Shpilrain and G. Zapata.
Beiträge Zur Algebra Und Geometrie / Contributions To Algebra And Geometry, Jan 7, 2020
The border basis scheme B O parametrizes all 0-dimensional ideals in K [x 1 ,. .. , x n ], where ... more The border basis scheme B O parametrizes all 0-dimensional ideals in K [x 1 ,. .. , x n ], where K is an arbitrary field, which have a border basis with respect to a given order ideal of terms O. Its vanishing ideal I (B O) is generated by quadratic equations which are easy to describe, and it contains a unique monomial point, namely the point corresponding to the monomial ideal generated by the terms outside O. Based on a detailed study of the generators of I (B O), we describe a K-basis of the cotangent space m/m 2 , where m is the maximal ideal of the monomial point. Moreover, we provide an efficient algorithm to compute such a basis and use it to characterize the regularity of the monomial point.
According to a theorem of Monsky, the Hilbert-Kunz function of a 1-dimensional standard graded al... more According to a theorem of Monsky, the Hilbert-Kunz function of a 1-dimensional standard graded algebra R over a finite field K has, for i 0, the shape HKR(i) = c(R) • p i + ϕ(i), where c(R) is the multiplicity of R and ϕ is a periodic function. Here we study explicit computer algebra algorithms for computing such Hilbert-Kunz functions: the period length and the values of ϕ, as well as a concrete number N ≥ 0 such that the description above holds for i ≥ N .
In this paper we analyze the Habeeb-Kahrobaei-Koupparis-Shpilrain (HKKS) key exchange protocol wh... more In this paper we analyze the Habeeb-Kahrobaei-Koupparis-Shpilrain (HKKS) key exchange protocol which uses semidirect products of groups as a platform. We show that the particular instance of the protocol suggested in their paper can be broken via a simple linear algebra attack.
Beiträge Zur Algebra Und Geometrie / Contributions To Algebra And Geometry, Dec 2, 2016
The Burnside ring B(G) of a finite group G, a classical tool in the representation theory of fini... more The Burnside ring B(G) of a finite group G, a classical tool in the representation theory of finite groups, is studied from the point of view of computational algebra. In the first part (cf. Kreuzer and Patil, Beitr Algebra Geom 58:427-452, 2017) we examined the ring theoretic properties of B(G) using the methods of computer algebra. In this part we shift our focus to important maps between two Burnside rings and make several well-known maps of representation theory explicitly computable. The inputs of all our algorithms are the tables of marks of the two groups, and the outputs are matrices of integers representing the maps via their image in the ghost ring. All algorithms have been implemented in the computer algebra system ApCoCoA and are illustrated by applying them to explicit examples. Especially, we study the restriction and induction maps, the projection and inflation maps, the conjugation isomorphism, and the Frobenius-Wielandt homomorphism.
Beiträge Zur Algebra Und Geometrie / Contributions To Algebra And Geometry, Jul 29, 2016
Given a 0-dimensional subscheme X of a projective space P n K over a field K , we characterize in... more Given a 0-dimensional subscheme X of a projective space P n K over a field K , we characterize in different ways whether X is the complete intersection of n hypersurfaces. Besides a generalization of the notion of a Cayley-Bacharach scheme, these characterizations involve the Kähler and the Dedekind different of the homogeneous coordinate ring of X or its Artinian reduction. We also characterize arithmetically Gorenstein schemes in novel ways and bring in further tools such as the module of regular differential forms, the fundamental class, and the Jacobian module of X. Throughout we strive to work over an arbitrary base field K and keep the scheme X as general as possible, thereby improving several known characterizations.
A differential fault attack framework for the Enocoro family of stream ciphers is presented. We o... more A differential fault attack framework for the Enocoro family of stream ciphers is presented. We only require that the attacker can reset the internal state and inject a random byte-fault, in a random register, during a known time period. For a single fault injection, we develop a differential clocking algorithm that computes a set of linear equations in the in- and output differences of the non-linear parts of the cipher and relates them to the differential keystream. The usage of these equations is two-fold. Firstly, one can determine those differentials that can be computed from the faulty keystream, and secondly they help to pin down the actual location and timing of the fault injection. Combining these results, each fault injection gives us information on specific small parts of the internal state. By encoding the information we gain from several fault injections using the weighted Horn clauses, we construct a guessing path that can be used to quickly retrieve the internal state...
Mathematical Aspects of Computer and Information Sciences, 2017
For solving systems of Boolean polynomials whose zeros are known to be contained in \(\mathbb {F}... more For solving systems of Boolean polynomials whose zeros are known to be contained in \(\mathbb {F}_2^n\), algebraic solvers such as the Boolean Border Basis Algorithm (BBBA) and SAT solvers use very different and possibly complementary methods to create new information. Based on suitable implementations of these solvers and conversion methods from Boolean polynomials to SAT clauses and back, we describe an automatic framework integrating the two solving techniques and exchanging newly found information between them. Using examples derived from cryptographic attacks, we present some initial experiments indicating the efficiency of this combination.
In this paper we analyze the Habeeb-Kahrobaei-Koupparis-Shpilrain (HKKS) key exchange protocol wh... more In this paper we analyze the Habeeb-Kahrobaei-Koupparis-Shpilrain (HKKS) key exchange protocol which uses semidirect products of groups as a platform. We show that the particular instance of the protocol suggested in their paper can be broken via a simple linear algebra attack.
The Freiheitssatz of Magnus for one-relator groups is one of the cornerstones of combinatorial gr... more The Freiheitssatz of Magnus for one-relator groups is one of the cornerstones of combinatorial group theory. In this short note which is mostly expository we discuss the relationship between the Freiheitssatz and corre-sponding results in free power series rings over fields. These are related to results of Schneerson not readily available in English. This relationship uses a faithful representation of free groups due to Magnus. Using this method in free polynomial algebras provides a proof of the Freiheitssatz for one-relation monoids. We show how the classical Freiheitssatz depends on a condition on certain ideals in power series rings in noncommuting variables over fields. A proof of this result over fields would provide a completely dif erent proof of the classical Freiheitssatz.
In [4,5] using faithful complex representations of cyclically pinched and conjugacy pinched one... more In [4,5] using faithful complex representations of cyclically pinched and conjugacy pinched one-relator groups we proved that any limit group has a faithful representation in $PSL(2,C)$. Further this representation can be effectively constructed using the JSJ decomposition. In this note we show that any hyperbolic cyclically pinched one-relator group with maximal amalgamated subgroups in each factor has a 2-dimensional faithful real representation.
In this paper we consider formulas that are conjunctions of linear clauses, i.e., of linear equat... more In this paper we consider formulas that are conjunctions of linear clauses, i.e., of linear equations. Such formulas are very interesting because they encode CNF constraints that are typically very hard for SAT solvers. We introduce a new proof system SRES that works with linear clauses and show that SRES is implicationally and refutationally complete. Algebraically speaking, linear clauses correspond to products of linear polynomials over a ring of Boolean polynomials. That is why SRES can certify if a product of linear polynomials lies in the ideal generated by some other such products, i.e., the SRES calculus decides the ideal membership problem. Furthermore, an algorithm for certifying inconsistent systems of the above shape is described. We also establish the connection with an another combined proof system R(lin).
Hardware implementations of advanced cryptographic schemes gain in importance for emerging cyber-... more Hardware implementations of advanced cryptographic schemes gain in importance for emerging cyber-physical and autonomous systems, and their resistance against physical attacks is becoming a central requirement. This paper studies fault-injection attacks against the private key of the Elliptic Curve ElGamal cryptosystem. It extends previously introduced bit and byte fault models by models that assume faults in arbitrary s -bit portions (subtuples) of the key. We provide a mathematical proof that characterizes the set of subtuple candidates after a fault injection affecting an arbitrary number of bits s . The proof reinforces earlier findings for s = 8 and implies that the number of key subtuple candidates grows exponentially in s . We also report on fault-injection experiments, both on the software level and using an optimized hardware implementation for NIST-recommended elliptic curves.
International Journal of Computer Mathematics: Computer Systems Theory, 2020
ABSTRACT For the stream cipher KCipher-2 of the Japanese e-Government Recommended Ciphers List, w... more ABSTRACT For the stream cipher KCipher-2 of the Japanese e-Government Recommended Ciphers List, we present fault attacks requiring only the possibility to reset the cipher and to inject byte faults into certain registers. For the polynomial systems resulting from an injection sequence into one register, we develop a dedicated algebraic solving technique. Using the Marking Algorithm of Horn Logic and the computation of certain Gröbner bases, we optimize the number and locations of fault injection sequences which allow the recovery of the full state of the cipher. The optimal attack requires only about 21 fault injections and 100 seconds for solving the polynomial systems and finding the internal state.
A fault injection framework for the decryption algorithm of the Niederreiter public-key cryptosys... more A fault injection framework for the decryption algorithm of the Niederreiter public-key cryptosystem using binary irreducible Goppa codes and classical decoding techniques is described. In particular, we obtain low-degree polynomial equations in parts of the secret key. For the resulting system of polynomial equations, we present an efficient solving strategy and show how to extend certain solutions to alternative secret keys. We also provide estimates for the expected number of required fault injections, apply the framework to state-of-the-art security levels, and propose countermeasures against this type of fault attack.
Kehrein and Kreuzer (J Pure Appl Algebra 205(2):279-295, 2006) presented an algorithm, referred t... more Kehrein and Kreuzer (J Pure Appl Algebra 205(2):279-295, 2006) presented an algorithm, referred to as the BorderBasis algorithm, for computing border bases. The main objective of this paper is to improve this computation by applying new structures from the theory of Gröbner bases. In doing so, based on the method developed by Gao et al. (Math Comput 85(297):449-465, 2016), a new variant of the BorderBasis algorithm is proposed to compute simultaneously a border basis and also a Gröbner basis for the syzygy module of the input polynomials (this pair of bases will be called a coupled border basis). The new algorithm, and also the original form of the BorderBasis algorithm, have been implemented in the computer algebra systems Maple and ApCoCoA. We compare the performance of our implementation of these algorithms via a set of benchmark polynomials. Our experiments show that our algorithm performs more efficiently than the original BorderBasis algorithm.
This paper introduces Multi-Stage Fault Attacks, which allow Differential Fault Analysis of block... more This paper introduces Multi-Stage Fault Attacks, which allow Differential Fault Analysis of block ciphers having independent subkeys. Besides the specification of an algorithm implementing the technique, we show concrete applications to LED-128 and PRINCE and demonstrate that in both cases approximately 3 to 4 fault-injections are enough to reconstruct the full 128-bit key.
Key agreement, the Algebraic Eraser$^{TM}$, and lightweight cryptography by I. Anshel, M. Anshel,... more Key agreement, the Algebraic Eraser$^{TM}$, and lightweight cryptography by I. Anshel, M. Anshel, D. Goldfeld, and S. Lemieux Designing key transport protocols using combinatorial group theory by G. Baumslag, T. Camps, B. Fine, G. Rosenberger, and X. Xu Geometric key establishment by A. Berenstein and L. Chernyak Using shifted conjugacy in braid-based cryptography by P. Dehornoy Length-based conjugacy search in the braid group by D. Garber, S. Kaplan, M. Teicher, B. Tsaban, and U. Vishne Towards provable security for cryptographic constructions arising from combinatorial group theory by M. I. Gonzalez Vasco, R. Steinwandt, and J. L. Villar Constructions in public-key cryptography over matrix groups by D. Grigoriev and I. Ponomarenko A practical attack on the root problem in braid groups by A. Groch, D. Hofheinz, and R. Steinwandt An attack on a group-based cryptoraphic scheme by D. Hofheinz and D. Unruh Algebraic problems in symmetric cryptography: Two recent results on highly nonlinear functions by N. G. Leander Inverting the Burau and Lawrence-Krammer representations by E. Lee A new key exchange protocol based on the decomposition problem by V. Shpilrain and A. Ushakov Using the subgroup membership search problem in public key cryptography by V. Shpilrain and G. Zapata.
Uploads
Papers by Martin Kreuzer