Practical Cryptanalysis of SFLASH

Lecture Notes in Computer Science

The SFLASH signature scheme stood for a decade as the most successful cryptosystem based on multivariate polynomials, before an efficient attack was finally found in 2007. This attack belongs to a new generation of cryptanalysis which targets geometrical properties of multivariate functions. It works particularly well on SFLASH due to its simple structure but further applications are emerging. Considering these new developments, it occurs that the general design principle of multivariate schemes itself might be questionable : can we effectively hide a specific multivariate function using linear maps ? In this paper, we keep focused on the simple example of SFLASH. We review its recent cryptanalysis and we notice that its weaknesses can all be linked to the fact that the cryptosystem is built on the structure of a large field. As the attack demonstrates, this richer structure can be accessed by an attacker by using the specific symmetry of the core function being used. In fact, this raises the general remark that, since the large field structure is only necessary to perform the secret operations, it indeed should not be encapsulated in the public key. Then, we investigate the effect of restricting this large field to a purely linear subset and we find that the symmetries exploited by the attack are no longer present. At a purely defensive level, this defines a countermeasure which can be used at a moderate overhead. On the theoretical side, this informs us of interesting limitations of the recent attack and provides us with additional elements to answer the general question defined above.

2007

Note: This document specifies the updated final version of the SFLASH signature scheme, slightly modified as allowed in the second stage of Nessie evaluation process, in order to improve the speed and the security. This is therefore the only official ver-sion of SFLASH. In some ...

The idea of using multivariate polynomials as public keys has attracted several cryptographers, SFlash signature scheme is a variant of the Matsumoto and Imai multivariate public Key cryptosystem and selected by NESSIE Consortium. In this paper we describe a hardware implementation of SFlash based on bit-parallel architectures to achieve high speed circuits for operations on Finite Fields which can be efficiently used as an authentication unit in wireless devices, smart cards and RFID networks. We have proposed a new generalization to Karatsuba-Ofman multiplier as the core of the design. An ASIC chip can be realized with 78K gates counts and 2.8 2 mm die size with 0.35 m m CMOS technology, with a maximum clock frequency 140 MHZ, which takes about 21.5 s m to sign 259-Bits data.

2019

Post-quantum cryptography is an important and growing area of research due to the threat of quantum computers, as recognised by the National Institute of Standards and Technology (NIST) recent call for standardisation. FALCON is a lattice-based signature candidate submitted to NIST, which has good performance but lacks in research with respect to implementation attacks and resistance. This research proposes the first fault attack analysis of FALCON and finds its lattice trapdoor sampler is as vulnerable to fault attacks as the GPV sampler used in alternative signature schemes. We simulate the post-processing component of this fault attack and achieve a 100% success rate at retrieving the private-key. This research then proposes an evaluation of countermeasures to prevent this fault attack and timing attacks of FALCON. We provide cost evaluations on the overheads of the proposed countermeasures which shows that FALCON has only up to 30% deterioration in performance of its key generation, and only 5% in signing, compared to runtimes without countermeasures.

Lecture Notes in Computer Science, 2005

In ICICS 2004, Gonzalez-Deleito, Markowitch and Dall'Olio proposed an efficient strong key-insulated signature scheme. They claimed that it is (N −1, N)-key-insulated, i.e., the compromise of the secret keys for arbitrarily many time periods does not expose the secret keys for any of the remaining time periods. But in this paper, we demonstrate an attack and show that an adversary armed with the signing keys for any two time periods can compute the signing keys for the remaining time periods except for some very special cases. In a second attack, the adversary can forge signatures for many remaining time periods without computing the corresponding signing keys. Therefore it is only equivalent to a (1, N)-key-insulated signature scheme. A variant forward-secure signature scheme was also presented in ICICS 2004 and claimed more robust than traditional forward-secure signature schemes. But we find that the scheme has two similar weaknesses. We try to repair the two schemes in this paper. 4 The GMD Forward-Secure Signature Scheme and Its Security 4.1 Review of The GMD Forward-Secure Signature Scheme KeyGen(k, l) n, v and h are selected as same as that in the key-insulated scheme.The user randomly chooses t, u ∈ Z * n , such that u 2 = u 2 8+1 mod n and t 2 = t 2 8+1

Note: This document specifies the updated final version of the Quartz signature scheme, slightly modified as allowed in the second stage of Nessie evaluation process, in order to improve the speed and the security. In some papers that refer to the old version, it is sometimes called Quartz v1 , and Quartz v2 is the new version. This is therefore the only official version of Quartz. We note that the key generation has not changed, the signature computation has changed, and the signature verification has changed slightly. In the Appendix of the present document we summarize all the changes to Quartz, for readers and developers that are acquainted with the previous version. It also includes an explanation why these changes has been made.

Public Key Cryptography – PKC 2008

In this paper, we describe efficient forgery and full-key recovery attacks on the-IC − signature scheme recently proposed at PKC 2007. This cryptosystem is a multivariate scheme based on a new internal quadratic primitive which avoids some drawbacks of previous multivariate schemes: the scheme is extremely fast since it requires one exponentiation in a finite field of medium size and the public key is shorter than in many multivariate signature schemes. Our attacks rely on the recent cryptanalytic tool developed by Dubois et al. against the SFLASH signature scheme. However, the final stage of the attacks requires the use of Gröbner basis techniques to conclude to actually forge a signature (resp. to recover the secret key). For the forgery attack, this is due to the fact that Patarin's attack is much more difficult to mount against-IC. The key recovery attack is also very efficient since it is faster to recover equivalent secret keys than to forge.

Journal of Science and Technology on Information security, 2022

Keyworks-the BLT signature scheme, KSI infrastructure, non-repudiation, Merkle tree. Từ khóa-Lược đồ chữ ký BLT, hạ tầng KSI, giả mạo tồn tại, tính chống chối bỏ, cây băm Merkle.

Open Mathematics

We prove that a variant of the Courtois-Finiasz-Sendrier signature is strongly existentially unforgeable under chosen message attack in the random oracle model, assuming hardness of the Permuted Goppa Syndrome Decoding Problem (also known as the Niederreiter problem). In addition, we explicitly show that security against key substitution attacks can be arranged by a standard technique of Menezes and Smart, hashing the public key.

Polynomial Schemes such as HFE, Quartz and Sflash.” …, 2004

The object of this paper is the concrete security of recent multivariate signature schemes. A major challenge is to reconcile some "tricky" ad-hoc constructions that allow to make short signatures, with regular provable security. The paper is composed of two parts. In the first part of this paper we formalize and confront with the most recent attacks the security of several known multivariate trapdoor functions. For example the signature scheme Quartz is based on a trapdoor function G belonging to a family called HFEv-. It has two independent security parameters, and we claim that if d is big enough, no better method to compute an inverse of G than the exhaustive search is known. This will allow us to formulate our key assumption on which the provable security results can be build. In the second part, we study the security concrete security of signature schemes under our assumption. We study some general constructions, that transform a trapdoor function into a short signature scheme, and in particular these designed to obtain short signatures. On the one hand, we present generic attacks on such constructions. On the other hand, we study the possibility to prove or justify the security with some well chosen assumptions. Unfortunately for Quartz, our lower and upper security bounds do not coincide. Still the best attack known for Quartz is our generic attack using O(2 80 ) computations with O(2 80 ) of memory. We will also propose an alternative way of doing short signatures for which both bounds do coincide. Finally we also apply our results for Flash and Sflash.