Skip to main content

Cryptanalysis of Symmetric Primitives over Rings and a Key Recovery Attack on Rubato

  • Conference paper
  • First Online:
Advances in Cryptology – CRYPTO 2023 (CRYPTO 2023)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 14083))

Included in the following conference series:

Abstract

Symmetric primitives are a cornerstone of cryptography, and have traditionally been defined over fields, where cryptanalysis is now well understood. However, a few symmetric primitives defined over rings \(\mathbb Z _q\) for a composite number \(q\) have recently been proposed, a setting where security is much less studied. In this paper we focus on studying established algebraic attacks typically defined over fields and the extent of their applicability to symmetric primitives defined over the ring of integers modulo a composite \(q\). Based on our analysis, we present an attack on full Rubato, a family of symmetric ciphers proposed by Ha et al. at Eurocrypt 2022 designed to be used in a transciphering framework for approximate fully homomorphic encryption. We show that at least 25\(\%\) of the possible choices for \(q\) satisfy certain conditions that lead to a successful key recovery attack with complexity significantly lower than the claimed security level for five of the six ciphers in the Rubato family.

Author list in alphabetical order.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 89.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 119.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    Note that the subspace \(\{x\cdot p + x \in \mathbb Z_{p^2} \mid \forall x\in \mathbb F_p\}\) is invariant if \(S_1=S_2\). However, it is possible to break such invariant subspace via a proper choices of round constants (see e.g. [55, 56] for details).

  2. 2.

    For completeness, we present an equivalent version of Rubato in [39, Appendix G].

  3. 3.

    The code can be found at https://github.com/Simula-UiB/RubatoAttack.

References

  1. Lattigo v4, August 2022. EPFL-LDS, Tune Insight SA. https://github.com/tuneinsight/lattigo

  2. Adams, W.W., Loustaunau, P.: An Introduction to Gröbner Bases, vol. 3. American Mathematical Society (1994)

    Google Scholar 

  3. Albrecht, M.R., et al.: Algebraic cryptanalysis of STARK-friendly designs: application to MARVELlous and MiMC. In: Galbraith, S.D., Moriai, S. (eds.) ASIACRYPT 2019. LNCS, vol. 11923, pp. 371–397. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-34618-8_13

    Chapter  Google Scholar 

  4. Albrecht, M., Grassi, L., Rechberger, C., Roy, A., Tiessen, T.: MiMC: efficient encryption and cryptographic hashing with minimal multiplicative complexity. In: Cheon, J.H., Takagi, T. (eds.) ASIACRYPT 2016. LNCS, vol. 10031, pp. 191–219. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-53887-6_7

    Chapter  Google Scholar 

  5. Aly, A., Ashur, T., Ben-Sasson, E., Dhooghe, S., Szepieniec, A.: Design of symmetric-key primitives for advanced cryptographic protocols. IACR Trans. Symmetric Cryptol. 2020(3), 1–45 (2020)

    Article  Google Scholar 

  6. Ashur, T., Mahzoun, M., Toprakhisar, D.: Chaghri - a FHE-friendly block cipher. In: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, CCS 2022, pp. 139–150. ACM (2022)

    Google Scholar 

  7. Bardet, M., Faugère, J.-C., Salvy, B.: On the complexity of Gröbner basis computation of semi-regular overdetermined algebraic equations. In: Proceedings of the International Conference on Polynomial System Solving, pp. 71–74 (2004)

    Google Scholar 

  8. Baum, C., Braun, L., Munch-Hansen, A., Razet, B., Scholl, P.: Appenzeller to Brie: efficient zero-knowledge proofs for mixed-mode arithmetic and \(\mathbb{Z} _{2^k}\). In: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp. 192–211 (2021)

    Google Scholar 

  9. Baum, C., Braun, L., Munch-Hansen, A., Scholl, P.: Moz\(\mathbb{Z} _{2^k}\)arella: efficient vector-OLE and zero-knowledge proofs over \(\mathbb{Z} _{2^k}\). In: Dodis, Y., Shrimpton, T. (eds.) Advances in Cryptology - CRYPTO 2022. LNCS, vol. 13510, pp. 329–358. Springer, Cham (2022). https://doi.org/10.1007/978-3-031-15985-5_12

  10. Beaulieu, R., Shors, D., Smith, J., Treatman-Clark, S., Weeks, B., Wingers, L.: The SIMON and SPECK lightweight block ciphers. In: Proceedings of the 52nd Annual Design Automation Conference, pp. 175:1–175:6. ACM (2015)

    Google Scholar 

  11. Beierle, C., et al.: Lightweight AEAD and hashing using the SPARKLE permutation family. Submission to the NIST lightweight cryptographic standardization process (Finalist)

    Google Scholar 

  12. Bernstein, D.J.: The Salsa20 family of stream ciphers. In: Robshaw, M., Billet, O. (eds.) New Stream Cipher Designs. LNCS, vol. 4986, pp. 84–97. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-68351-3_8

    Chapter  Google Scholar 

  13. Beyne, T., et al.: Out of oddity – new cryptanalytic techniques against symmetric primitives optimized for integrity proof systems. In: Micciancio, D., Ristenpart, T. (eds.) CRYPTO 2020. LNCS, vol. 12172, pp. 299–328. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-56877-1_11

    Chapter  Google Scholar 

  14. Biham, E., Biryukov, A., Shamir, A.: Cryptanalysis of skipjack reduced to 31 rounds using impossible differentials. In: Stern, J. (ed.) EUROCRYPT 1999. LNCS, vol. 1592, pp. 12–23. Springer, Heidelberg (1999). https://doi.org/10.1007/3-540-48910-X_2

    Chapter  Google Scholar 

  15. Biham, E., Dunkelman, O., Keller, N.: The rectangle attack — rectangling the serpent. In: Pfitzmann, B. (ed.) EUROCRYPT 2001. LNCS, vol. 2045, pp. 340–357. Springer, Heidelberg (2001). https://doi.org/10.1007/3-540-44987-6_21

    Chapter  Google Scholar 

  16. Biham, E., Shamir, A.: Differential cryptanalysis of DES-like cryptosystems. J. Cryptol. 4(1), 3–72 (1991)

    Article  MathSciNet  MATH  Google Scholar 

  17. Biham, E., Shamir, A.: Differential Cryptanalysis of the Data Encryption Standard. Springer, New York (1993). https://doi.org/10.1007/978-1-4613-9314-6

  18. Bogdanov, A., Khovratovich, D., Rechberger, C.: Biclique cryptanalysis of the full AES. In: Lee, D.H., Wang, X. (eds.) ASIACRYPT 2011. LNCS, vol. 7073, pp. 344–371. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-25385-0_19

    Chapter  Google Scholar 

  19. Bosma, W., Cannon, J.J., Fieker, C., Steel, A. (eds.): Gröbner bases over Euclidean rings. In: Magma Handbook, vol. 2.27. Computational Algebra Group, School of Mathematics and Statistics, University of Sydney. https://magma.maths.usyd.edu.au/magma/handbook/text/1259#14396

  20. Bouvier, C., et al.: New design techniques for efficient arithmetization-oriented hash functions: anemoi permutations and Jive compression mode. Cryptology ePrint Archive, Paper 2022/840 (2022). https://eprint.iacr.org/2022/840

  21. Caminata, A., Gorla, E.: Solving multivariate polynomial systems and an invariant from commutative algebra. In: Bajard, J.C., Topuzoğlu, A. (eds.) WAIFI 2020. LNCS, vol. 12542, pp. 3–36. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-68869-1_1

    Chapter  MATH  Google Scholar 

  22. Chen, H., Laine, K., Player, R.: Simple encrypted arithmetic library - SEAL v2.1. Cryptology ePrint Archive, Paper 2017/224 (2017). https://eprint.iacr.org/2017/224

  23. Cho, J., et al.: Transciphering framework for approximate homomorphic encryption. In: Tibouchi, M., Wang, H. (eds.) ASIACRYPT 2021. LNCS, vol. 13092, pp. 640–669. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-92078-4_22

    Chapter  Google Scholar 

  24. Cosseron, O., Hoffmann, C., Méaux, P., Standaert, F.: Towards case-optimized hybrid homomorphic encryption - featuring the Elisabeth stream cipher. In: Agrawal, S., Lin, D. (eds.) Advances in Cryptology - ASIACRYPT 2022. LNCS, vol. 13793, pp. 32–67. Springer, Cham (2022). https://doi.org/10.1007/978-3-031-22969-5_2

  25. Cramer, R., Damgård, I., Escudero, D., Scholl, P., Xing, C.: SPD\(\mathbb{Z}_{2^k}\): efficient MPC mod \(2^k\) for dishonest majority. In: Shacham, H., Boldyreva, A. (eds.) CRYPTO 2018. LNCS, vol. 10992, pp. 769–798. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-96881-0_26

    Chapter  Google Scholar 

  26. Daemen, J., Rijmen, V.: The wide trail design strategy. In: Honary, B. (ed.) Cryptography and Coding 2001. LNCS, vol. 2260, pp. 222–238. Springer, Heidelberg (2001). https://doi.org/10.1007/3-540-45325-3_20

    Chapter  Google Scholar 

  27. Dalskov, A.P., Escudero, D., Keller, M.: Fantastic four: honest-majority four-party secure computation with malicious security. In: USENIX Security Symposium, pp. 2183–2200 (2021)

    Google Scholar 

  28. Dixon, J.D.: Exact solution of linear equations using P-Adic expansions. Numer. Math. 40(1), 137–141 (1982)

    Article  MathSciNet  MATH  Google Scholar 

  29. Dobraunig, C., et al.: Rasta: a cipher with low ANDdepth and few ANDs per bit. In: Shacham, H., Boldyreva, A. (eds.) CRYPTO 2018. LNCS, vol. 10991, pp. 662–692. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-96884-1_22

    Chapter  Google Scholar 

  30. Dobraunig, C., Grassi, L., Guinet, A., Kuijsters, D.: Ciminion: symmetric encryption based on Toffoli-gates over large finite fields. In: Canteaut, A., Standaert, F.-X. (eds.) EUROCRYPT 2021. LNCS, vol. 12697, pp. 3–34. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-77886-6_1

    Chapter  Google Scholar 

  31. Eichlseder, M., et al.: An algebraic attack on ciphers with low-degree round functions: application to full MiMC. In: Moriai, S., Wang, H. (eds.) ASIACRYPT 2020. LNCS, vol. 12491, pp. 477–506. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-64837-4_16

    Chapter  Google Scholar 

  32. Fan, J., Vercauteren, F.: Somewhat practical fully homomorphic encryption. Cryptology ePrint Archive, Paper 2012/144 (2012). https://eprint.iacr.org/2012/144

  33. Faugère, J.-C.: A new efficient algorithm for computing Gröbner bases (F\(_4\)). J. Pure Appl. Algebra 139(1–3), 61–88 (1999)

    Article  MathSciNet  MATH  Google Scholar 

  34. Faugère, J.-C., Gianni, P., Lazard, D., Mora, T.: Efficient computation of zero-dimensional Gröbner bases by change of ordering. J. Symb. Comput. 16(4), 329–344 (1993)

    Article  MATH  Google Scholar 

  35. Ganesh, C., Nitulescu, A., Soria-Vazquez, E.: Rinocchio: SNARKs for ring arithmetic. Cryptology ePrint Archive, Paper 2021/322 (2021). https://eprint.iacr.org/2021/322

  36. Geelen, R., Iliashenko, I., Kang, J., Vercauteren, F.: On polynomial functions modulo \(p^e\) and faster bootstrapping for homomorphic encryption. In: Hazay, C., Stam, M. (eds.) Advances in Cryptology - EUROCRYPT 2023. LNCS, vol. 14006, pp. 257–286. Springer, Cham (2023). https://doi.org/10.1007/978-3-031-30620-4_9

  37. Gopalan, P.: Query-efficient algorithms for polynomial interpolation over composites. SIAM J. Comput. 38(3), 1033–1057 (2008)

    Article  MathSciNet  MATH  Google Scholar 

  38. Grassi, L.: Bounded surjective quadratic functions over \(\mathbb{F} _p^n\) for MPC-/ZK-/HE-friendly symmetric primitives. Cryptology ePrint Archive, Paper 2022/1313 (2022). https://eprint.iacr.org/2022/1313

  39. Grassi, L., Ayala, I.M., Hovd, M.N., Øygarden, M., Raddum, H., Wang, Q.: Cryptanalysis of symmetric primitives over rings and a key recovery attack on Rubato. Cryptology ePrint Archive, Paper 2023/822 (2023). https://eprint.iacr.org/2023/822

  40. Grassi, L., Hao, Y., Rechberger, C., Schofnegger, M., Walch, R., Wang, Q.: Horst meets fluid-SPN: Griffin for zero-knowledge applications. Cryptology ePrint Archive, Paper 2022/403 (2022). https://eprint.iacr.org/2022/403

  41. Grassi, L., Khovratovich, D., Lüftenegger, R., Rechberger, C., Schofnegger, M., Walch, R.: Reinforced concrete: a fast hash function for verifiable computation. In: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, CCS 202, pp. 1323–1335. ACM (2022)

    Google Scholar 

  42. Grassi, L., Khovratovich, D., Rechberger, C., Roy, A., Schofnegger, M.: Poseidon: a new hash function for zero-knowledge proof systems. In: 30th USENIX Security Symposium, USENIX Security 2021, pp. 519–535. USENIX Association (2021)

    Google Scholar 

  43. Grassi, L., Khovratovich, D., Rønjom, S., Schofnegger, M.: The Legendre symbol and the Modulo-2 operator in symmetric schemes over \(\mathbb{F} ^n_p\) preimage attack on full Grendel. IACR Trans. Symmetric Cryptol. 2022(1), 5–37 (2022)

    Article  Google Scholar 

  44. Grassi, L., Lüftenegger, R., Rechberger, C., Rotaru, D., Schofnegger, M.: On a generalization of substitution-permutation networks: the HADES design strategy. In: Canteaut, A., Ishai, Y. (eds.) EUROCRYPT 2020. LNCS, vol. 12106, pp. 674–704. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-45724-2_23

    Chapter  Google Scholar 

  45. Grassi, L., Onofri, S., Pedicini, M., Sozzi, L.: Invertible quadratic non-linear layers for MPC-/FHE-/ZK-friendly schemes over \(\mathbb{F} ^n_p\) application to Poseidon. IACR Trans. Symmetric Cryptol. 2022(3), 20–72 (2022)

    Article  Google Scholar 

  46. Grassi, L., Øygarden, M., Schofnegger, M., Walch, R.: From Farfalle to Megafono via Ciminion: the PRF hydra for MPC applications. In: Hazay, C., Stam, M. (eds.) Advances in Cryptology - EUROCRYPT 2023. LNCS, vol. 14007, pp. 255–286. Springer, Cham (2023). https://doi.org/10.1007/978-3-031-30634-1_9

  47. Ha, J., Kim, S., Lee, B., Lee, J., Son, M.: Rubato: noisy ciphers for approximate homomorphic encryption. In: Dunkelman, O., Dziembowski, S. (eds.) Advances in Cryptology - EUROCRYPT 2022. LNCS, vol. 13275, pp. 581–610. Springer, Cham (2022). https://doi.org/10.1007/978-3-031-06944-4_20

  48. Jakobsen, T., Knudsen, L.R.: The interpolation attack on block ciphers. In: Biham, E. (ed.) FSE 1997. LNCS, vol. 1267, pp. 28–40. Springer, Heidelberg (1997). https://doi.org/10.1007/BFb0052332

    Chapter  Google Scholar 

  49. Keller, N., Rosemarin, A.: Mind the middle layer: the HADES design strategy revisited. In: Canteaut, A., Standaert, F.-X. (eds.) EUROCRYPT 2021. LNCS, vol. 12697, pp. 35–63. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-77886-6_2

    Chapter  Google Scholar 

  50. Kempner, A.J.: Polynomials and their residue systems. Trans. Am. Math. Soc. 22(2), 240–266 (1921)

    Article  MathSciNet  MATH  Google Scholar 

  51. Kipnis, A., Shamir, A.: Cryptanalysis of the HFE public key cryptosystem by relinearization. In: Wiener, M. (ed.) CRYPTO 1999. LNCS, vol. 1666, pp. 19–30. Springer, Heidelberg (1999). https://doi.org/10.1007/3-540-48405-1_2

    Chapter  Google Scholar 

  52. Knudsen, L.R.: Truncated and higher order differentials. In: Preneel, B. (ed.) FSE 1994. LNCS, vol. 1008, pp. 196–211. Springer, Heidelberg (1995). https://doi.org/10.1007/3-540-60590-8_16

    Chapter  Google Scholar 

  53. Koti, N., Pancholi, M., Patra, A., Suresh, A.: SWIFT: super-fast and robust privacy-preserving machine learning. In: USENIX Security Symposium, pp. 2651–2668 (2021)

    Google Scholar 

  54. Lai, X.: Higher Order Derivatives and Differential Cryptanalysis. Springer, New York (1994). https://doi.org/10.1007/978-1-4615-2694-0_23

    Book  MATH  Google Scholar 

  55. Leander, G., Abdelraheem, M.A., AlKhzaimi, H., Zenner, E.: A cryptanalysis of PRINTcipher: the invariant subspace attack. In: Rogaway, P. (ed.) CRYPTO 2011. LNCS, vol. 6841, pp. 206–221. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-22792-9_12

    Chapter  Google Scholar 

  56. Leander, G., Minaud, B., Rønjom, S.: A generic approach to invariant subspace attacks: cryptanalysis of Robin, iSCREAM and Zorro. In: Oswald, E., Fischlin, M. (eds.) EUROCRYPT 2015. LNCS, vol. 9056, pp. 254–283. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-46800-5_11

    Chapter  Google Scholar 

  57. Matsui, M.: Linear cryptanalysis method for DES cipher. In: Helleseth, T. (ed.) EUROCRYPT 1993. LNCS, vol. 765, pp. 386–397. Springer, Heidelberg (1994). https://doi.org/10.1007/3-540-48285-7_33

    Chapter  Google Scholar 

  58. Mohassel, P., Rindal, P.: ABY3: a mixed protocol framework for machine learning. In: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 35–52 (2018)

    Google Scholar 

  59. National Institute of Standards and Technology. FIPS-46: Data Encryption Standard (DES) (1999). https://csrc.nist.gov/csrc/media/publications/fips/46/3/archive/1999-10-25/documents/fips46-3.pdf

  60. Rivest, R.L.: Permutation polynomials modulo \(2^w\). Finite Fields Appl. 2001(7), 287–292 (2001)

    Article  MATH  Google Scholar 

  61. Singh, R.P., Maity, S.: Permutation polynomials modulo \(p^n\). Cryptology ePrint Archive, Paper 2009/393 (2009). https://eprint.iacr.org/2009/393

  62. Singmaster, D.: On polynomial functions (mod m). J. Num. Theory 6(5), 345–352 (1974)

    Article  MathSciNet  MATH  Google Scholar 

  63. Smart, N.: Bootstrapping for dummies. Zama Research Blog (2022). https://www.zama.ai/post/what-is-bootstrapping-homomorphic-encryption

  64. Strassen, V.: Gaussian elimination is not optimal. Numer. Math. 13(4), 354–356 (1969)

    Article  MathSciNet  MATH  Google Scholar 

  65. Vasiliev, N.N., Kanzheleva, O.: Polynomial interpolation over the residue rings \(\mathbb{Z} _n\). J. Math. Sci. 209(6), 845–850 (2015)

    Article  MathSciNet  MATH  Google Scholar 

  66. von zur Gathen, J., Hartlieb, S.: Factoring modular polynomials. J. Symbol. Comput. 26, 583–606 (1998)

    Google Scholar 

  67. Wagh, S., Tople, S., Benhamouda, F., Kushilevitz, E., Mittal, P., Rabin, T.: Falcon: honest-majority maliciously secure framework for private deep learning. Proc. Privacy Enhancing Technol. 2021(1), 188–208 (2021)

    Article  Google Scholar 

  68. Wagner, D.: The boomerang attack. In: Knudsen, L. (ed.) FSE 1999. LNCS, vol. 1636, pp. 156–170. Springer, Heidelberg (1999). https://doi.org/10.1007/3-540-48519-8_12

    Chapter  Google Scholar 

  69. Yu, Y., Wang, M.: Permutation polynomials and their differential properties over residue class rings. Cryptology ePrint Archive, Paper 2013/251 (2013). https://eprint.iacr.org/2013/251

  70. Zheng, Y., Matsumoto, T., Imai, H.: On the construction of block ciphers provably secure and not relying on any unproved hypotheses. In: Brassard, G. (ed.) CRYPTO 1989. LNCS, vol. 435, pp. 461–480. Springer, New York (1990). https://doi.org/10.1007/0-387-34805-0_42

    Chapter  Google Scholar 

Download references

Acknowledgments

Lorenzo Grassi is supported by the German Research Foundation (DFG) within the framework of the Excellence Strategy of the Federal Government and the States - EXC 2092 CaSa - 39078197.

Author information

Authors and Affiliations

Authors

Corresponding authors

Correspondence to Lorenzo Grassi , Irati Manterola Ayala , Martha Norberg Hovd , Morten Øygarden , Håvard Raddum or Qingju Wang .

Editor information

Editors and Affiliations

Rights and permissions

Reprints and permissions

Copyright information

© 2023 International Association for Cryptologic Research

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Grassi, L., Manterola Ayala, I., Hovd, M.N., Øygarden, M., Raddum, H., Wang, Q. (2023). Cryptanalysis of Symmetric Primitives over Rings and a Key Recovery Attack on Rubato. In: Handschuh, H., Lysyanskaya, A. (eds) Advances in Cryptology – CRYPTO 2023. CRYPTO 2023. Lecture Notes in Computer Science, vol 14083. Springer, Cham. https://doi.org/10.1007/978-3-031-38548-3_11

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-38548-3_11

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-38547-6

  • Online ISBN: 978-3-031-38548-3

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics