Thèse De Doctorat

M Joye

Marc Onespan

Rapporteur M Coron

M Pointcheval

M Pierre-

Alain Fouque

Mme Lysyanskaya

M Preneel

Dirigée Par

David Naccache Soutenue

Marc Beunardeau

Anna Lysanskaya

David Pointcheval

Bart Preneel

Éric Brier

Noémie Cartier

Simon Cogliani

Aisling Connolly

Nathanaël Courant

Rémi Géraud

David Naccache This

Application of cryptographic and verification techniques

to the security and privacy of information systems

The first thing people think of when they hear of cryptography is that it is used for secret communications. While it is not the purpose of this thesis to re-explain in detail cryptography and its applications, we begin by over-viewing several examples of the usage of cryptography. The purpose of this part is to give the non-specialist reader an intuition about what cryptography is, and how large its applications are. We will also seize the occasion to introduce mathematical definitions of the various concepts. Some of these definitions are usually not given, or not discussed in mainstream cryptographic papers, and are therefore not in our chapters. The reasons there are not is usually the limited number of pages in a paper, and the fact that the community implicitly assumes that everybody knows and understand them, or that they do not to use such formalism. However, we enjoy the non-limitation of space in this thesis to go a bit deeper. By doing so it allows the cryptographer to recall precise models such as Turing machines (e.g. Section 1.4.1), and the non-cryptographer to understand more easily subtle notions such as security games and security notions (e.g. Figure 1.3) that are usually left undiscussed in nowadays cryptographic papers. Arguably modern cryptography started with the Kerckhoff's principle [START_REF] Mrdovic | Kerckhoffs' principle for intrusion detection[END_REF] which states that the security of a cryptosystem should only rely on the key's secrecy, not on how this key is used. Before that, security by obscurity (i.e. the way we encrypt is secret) was preferred. It was vulnerable to reverse engineering and leaks from the designers and users of the system. On the other hand, respecting this principle allows two things. First if an encryption device is stolen by the adversary then we simply have to change the key instead of changing the cryptosystem. Second, respecting this principle allows the analysis of cryptosystems by everyone, and therefore better designs. Nowadays the vast majority of cryptosystems respect this principle, and it allowed cryptography to become a science. It still happens that well analysed and efficient solutions are not yet found, which sometimes makes the industry use security by obscurity. This is the case for example in obfuscation and white-box cryptography (because no cryptographic solution exist) and format preserving encryption where proven solutions are inefficient Section 1.5.1.1.

One could also argue that the real start of modern cryptography was the invention of the computer and its ancestors (electro-mechanical machines), that allowed designing and attacking systems with costly computations. The most famous example was probably the enigma machine during the Second World War by the Germans. It could be used easily by German soldiers thanks to an electro-mechanical device and was cryptanalysed by Polish and British cryptographers (notably Alan Turing) thanks to another electro-mechanical device called the cryptologic bomb.

Foreword

This thesis can be seen as a collection of papers that the author co-wrote during his work at ENS and Ingenico. While we did choose not to include all our results here, some of our work being too far from others, it can still be seen as non-standard in the sense that this thesis is not focused on one precise topic. The purpose of this introduction throughout examples is twofold. One is to place the many different works in the different parts of cryptography. The other is to explain how the different papers of this thesis are consistent. The last part (Section 1.5) introduces some of the areas of cryptography, and aims to show how the topics treated in this thesis do not come from the theoretical cryptography. Of course, we do use its results and methodologies, but the topics can be considered as 'practice-oriented', in the sense that our problems are inspired by the real world problems. On the other hand, a part of cryptography aims at more fundamental problems, which could serve a more philosophical or aesthetic purpose, and which should find applications that have not yet been foreseen. An interesting reading that can help the reader to better understand our point of view is Rogaway's positional paper [START_REF] Rogaway | Practice-oriented provable security and the social construction of cryptography[END_REF]. A different view that argues that cryptography takes its roots in a mathematical truth rather than the real world can be found in [START_REF] Goldreich | On post-modern cryptography[END_REF]. Since the author belongs to a security department and working in industry, it is natural that our thesis adopts the first point of view (without denying the interest of the second). Unfortunately, this will not be done by exposing projects done at Ingenico for two reasons: industry projects are outside the scope of a scientific thesis, and disclosing information that should not be is a risk we are not willing to take.

Symmetric Cryptography

Symmetric (or secret key) cryptography is the oldest and simplest form of cryptography. It exists since Antiquity, and until the 70's was the only known form of encryption. It assumes that both parties have agreed beforehand on a shared secret (the secret key). Then they mix the secret with their message, in a reversible way thus allowing decryption. Formally a secret key cryptosystem is a family of permutations on the message space, indexed by the set of secret keys.

Shannon's Principle

The first formalisation of secret key cryptosystem was made by Claude Shanon in 1949 [START_REF] Shannon | Communication theory of secrecy systems[END_REF]. In this article, Shannon introduces two concepts. The first one is information theory. The second one is block ciphers. Historically there have been two types of ciphers. Some use substitution i.e. they replace a message chunk by another one. The correspondence between different chunks constitutes the secret key. For example, if the set of messages is the English language, we can pick a permutation on the alphabet, and replace every message letter by the image of the letters under the chosen permutation. Choosing an appropriate permutation (a randomly chosen one would have a good chance to do the trick) allows complex relation between the key and the message. On the other hand, choosing one that keeps some structure (e.g. changing vowels to vowels and consonants to consonants) will make deciphering easier. For bit strings (which is the most widespread real-world application) the structure can be logical, or arithmetical. However, even with a good permutation, it is not sufficient since the English language (or structured data such as XML documents) has lots of structure (e.g. letters do not have the same frequency). A simple cryptanalysis would be, for example, to guess that the image of 'e' by the secret permutation is the letter appearing the most in the ciphertext. If the guess is correct then the keys space is reduced from 26! to 25! with very little information. The leakage rate is far from optimal.

To avoid this, we need a second kind of ciphers: permutations ciphers. Letting the message space be strings of fixed length n on a fixed alphabet, we choose the secret key to be a permutation σ of {1, • • • , n}. The encryption of a message a 1 • • • a n is simply a σ(1) • • • a σ(n) . This alone is insecure, but combined with substitution ciphers as it is done in modern ciphers, this allows to thwart frequential analysis. Ideally, if one message bit is changed, about half of the bits of the ciphertext are flipped.

Block Ciphers and Stream Ciphers

Moderns ciphers can be divided into two categories: stream ciphers and block ciphers. A stream cipher takes as input a string of any length, whereas a block cipher takes a fixed length input (usually around 128 bits) called the block size. Block ciphers are used as a primitive for modes of operations, which call several time a block cipher, and add padding to encrypt messages longer than the block size, and of length that is not a multiple of the block size. Achieving a goal using primitives, as it is done for a symmetric scheme with a block cipher, is a standard technique 1 in cryptography and in computer science in general. It allows evaluating the efficiency and security of the different components modularly. Apart from specific cases (e.g. [CCF + 16]), block ciphers are generally preferred over stream ciphers.

Examples : DES and AES

Two of the most used block ciphers are the Data Encryption Standard (DES), and the Advanced Encryption Standard (AES), known initially as Rijndael [START_REF] Daemen | Aes proposal: Rijndael[END_REF].

DES DES was introduced by the National Institute of Standards and Technology (NIST) in 1976 as the new standard block cipher. Due to various attacks, and the increase of computational power the original version which using 56 bit keys is now considered insecure. A variant called triple DES that applies two times the DES permutation, with in between the inverse DES permutation, all three with different keys (using therefore a 168 bit key) is still in use in old infrastructure (e.g. the EMV protocol for payment).

AES Due to the weakening of the DES, the NIST launched a competition to create a new symmetric encryption standard in 1997. Four years later Rijndael is chosen and renamed AES. Its structure is based on a Substitution Permutation Network. We give a visual example of such an SPN in Figure 1. 1 The precise AES specifications can be found in [START_REF] Miller | Advanced Encryption Standard[END_REF].

Beyond Encryption

Cryptography is not only about encryption. In this section, we will briefly describe a few other widely used primitives.

Message Authentication Code Message Authentication Codes (MACs) ensure integrity. Since the Internet is open, attackers can do more than simply eavesdrop communications. For example, they can modify messages, which can be catastrophic for security applications. Integrity is the desired property that every modified message is detected as such and discarded by its receiver. When a common secret key sk is shared, this can be achieved with MACs. We attach to the message m a tag t, which is a function of m and sk, such that from the knowledge of multiple m, t one cannot derive m , t such that t is a correct tag for m . Thus modifying a message will result in a rejection by the legitimate receiver.

Authenticated Encryption

The good practice is to use encryption with MAC, to make authenticated encryption. For long confidentiality and integrity were not combined, and authenticated encryption was done 'by hand' combining ciphers and MAC. Due to a lot of misuses (e.g. counterintuitive attacks leveraging reuse of the same secret key for both can be done, or simply not thinking that you need integrity while you do) cryptographers now advocate the use of Authenticated Encryption (AE). Following this paradigm, the CESAER competition was organised, similarly to the AES one, to create a standard authenticated encryption scheme. Details on this competition can be found in https://competitions.cr.yp.to/caesar.html. Nowadays the most utilized scheme is the AES-Galois Counter Mode (AES-GCM), which uses AES as a primitive to build an AE scheme.

Figure 1.1: Illustration of an SPN. First, the key is added to the message with a simple eXclusive OR (XOR). Then the message is divided into small chunks, each being passed through an S-box (a permutation on a {0, 1} x with small x). This step implements confusion: complex non-linear operations can be done efficiently since they are done on small chunks. Then a linear operation implements diffusion: every cipher part now depends on various message and key parts. Our figure describes four rounds with different sub keys all derived from the key. Note that the last permutation is removed, since it can be reversed.

Hash Function A (cryptographic) hash function h : {0, 1} * → {0, 1} n is a deterministic function easy to compute with n usually equal to 256 or a bit less. Their purpose is to remove any pattern linking inputs and outputs. Usually, this is achieved by mixing arithmetic and logical operations, which are both fast to do, and which underlying structures 'destroy' each other. Some of the wanted properties are:

• Pre-image resistance: given h(m) it is hard to compute m

• Second pre-image resistance: given m 1 it is hard to find m 2 = m 1 such that h(m 1 ) = h(m 2 )

• Collision resistance: it is hard to find m 1 , m 2 such that h(m 1 ) = h(m 2 )

• Random Oracle Model (ROM): This is a not a property that hash function can have in real-life. For many proofs, the preceding properties are insufficient, so cryptographers use idealised hash functions. We use and define this model in Section 3.3.

Trivially Collision resistance implies Second pre-image resistance. We reason by contrapositive, assuming second pre-image resistance does not hold, we are given m 1 , and find m 2 such that h(m 1 ) = h(m 2 ). We can then use the same messages m 1 , m 2 to show that collision resistance does not hold. Hash functions can be used to build more complex cryptographic functions. A famous example is the construction a hash function based MAC as introduced in [START_REF] Bellare | Keying hash functions for message authentication[END_REF] and called HMAC. The basic idea is to mix in a particular way the secret key and the message using hash functions. One can notice that the constant length of the output of hash functions are desirable to verify the integrity of long messages rapidly. If h is a hash function, K a secret key, K = h(K), m a message, ipad and opad two constants of size n, a||b is the concatenation of the strings a and b, a⊕b is the bit wise XOR of the strings a and b, then HMAC(K, m) = H((K ⊕opad)||(H(K ⊕ipad)||m).

The security of this construction depends on the security of h and the length of k.

The current recommended hash functions are the Secure Hash Algorithm 2 (SHA-2) family [START_REF]Secure Hash Standard -SHS: Federal Information Processing Standards Publication[END_REF] and the SHA-3 family [START_REF] Bertoni | Keccak specifications[END_REF]. SHA-1 [START_REF] Eastlake | Us secure hash algorithm[END_REF] was introduced by the NSA, and is has recently been fully broken [SBK + 17]. SHA-3 (initially Keccak) was the winner of the SHA competition organised by the NIST.

Asymmetric Cryptography

Asymmetric cryptography or public key cryptography was invented by James H. Ellis in 1970 at the UK Government Communications Headquarters. However, it remained secret until Whitfield Diffie and Martin Hellman rediscovered and published it in [START_REF] Diffie | New directions in cryptography[END_REF]. The purpose of public key cryptography is to solve the problem of key distribution. Using secret key cryptography is possible only if the communicating parties already met and agreed on a common secret. Although it is not handy, such a key distribution scheme was still doable for military or diplomatic applications. However, for Internet communication it is impossible since communicating parties do not know each others in real life. To solve that, a public key algorithm has two keys: one secret, one public. Knowing the public key only allows encrypting, but knowing the secret one allows decrypting. Users publish their public keys so that everybody can send encrypted message to their, and no one but the secret-key owner would be able to decrypt. To enable this, we rely on algebraic relations between the public key and secret key, and trapdoor one-way functions (i.e. functions that do can only be efficiently computed in one way unless one has a specific knowledge called the trapdoor).

Diffie-Hellman

Diffie and Hellman published the first public key algorithm which realised a key exchange: two participants, Alice and Bob, send messages over a public channel (e.g. the Internet), and at the end of the exchange they both have knowledge of a common secret that one cannot derive by eavesdropping.

Discrete Logarithm Diffie-Hellman's function is trapdoor the exponentiation in a finite field. Fixing a prime p and a generator g of the finite field of order p, computing g x mod p is easy (i.e. polynomial time, see Section 1.4.1) by fast exponentiation. The converse, which is finding x given g x mod p is hard. Now to exchange a key, two parties agree on public parameter p and g. Alice generates a random x and sends to Bob g x mod p. Note that nor Bob neither an eavesdropper can infer x. Bob does the same with another random y. After these two messages Alice knows x and Z = g y mod p. She can then compute the exponentiation of z by x, and get z x = (g y ) x mod p = g yx mod p. Bob knows w = g x mod p and y, and can in the same way compute w y = g xy = g xy = z x mod p. They agreed on a common value. The eavesdropper only knows g x mod p and g y mod p. From this, there is no known efficient way allowing him to get the common secret, which can therefor be used to derive a symmetric key.

RSA

The most used public key scheme is RSA, an acronym standing for Rivest, Shamir, Adleman [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF]. RSA is based on a very natural one-way function. If one publishes the product n = pq of two large primes p and q, it will be very difficult to find p and q. It was published in 1978 shortly after Diffie and Hellman's seminal paper and allows in addition to key exchange to construct public key encryption and digital signatures (Section 1.3.3).

The Mathematics of RSA

Uses of RSA's one-way function The knowledge of p and q is used in a more indirect way than in Diffie Hellman. In the finite ring of integer modulo n, it is known by Bézout's identity that an integer x is invertible if and only if it is co-prime with n. A quick computation then shows that there are (p -1)(q -1) such integers with n = pq. Working in the set of invertible equipped with the multiplication we are in a group of order (p -1)(q -1). One can note that assuming it is hard to discover p + q from n, the group's order cannot be computed from n. Now by Lagrange's theorem, for all element x of the invertible group we have x k(p-1)(q-1) = 1 mod n for any integer k.

RSA's specifications

We can now explain how RSA works. Pick an RSA modulus n = pq and an integer e co-prime with (p -1)(q -1) and publish {e, n}. Keep d = e-1 mod (p -1)(q -1) secret. To encrypt a message m compute c = m e mod n. Recall the ed = 1 + k(p -1)(q -1). Therefore with the secret information d, computing c d = (m e ) d mod n = mm k(p-1)(q-1) mod n = m mod n, the receiver can recover n. Note that Recovering m from m e mod n might be done ways different than getting d, or factoring n, but no one could find such way to date, and therefore RSA is still in use. Cryptography had to wait one more year to have a cryptosystem by Rabin [START_REF] Michael | Digitalized signatures and public-key functions as intractable as factorization[END_REF] that cannot be broken unless the adversary can factor n.

Beyond Public Key Encryption

As for the symmetric case, a lot of other primitives are used and explored than mere key exchange or public key encryption. We recall two just for the sake of example.

Digital Signatures A digital signature is the MAC's (Section 1.2.4) public key equivalent. It allows one to prove that he and no one else sent this message. To see the usefulness of it consider the Diffie Hellman key exchange. Assume that an attacker can modify messages sent over the public channel (which is possible in an open network such as the Internet). The attacker can impersonate Alice when talking with Bob (i.e. generate a random x , and replace g x mod p by g x mod p) and vice versa. In the end, Alice and Bob will have a shared secret with the attacker, but not with each other, and the attacker will eavesdrop their communications. To prevent that Alice and Bob can sign their messages. A digital signature scheme has a public key and a private key. The private key allows signing a message, and the public key allows verifying that a signature corresponds to a message. Note that unlike physical signatures, digital signatures differ with each message. Otherwise, one could copy a signature on an old message and forge a signed message. An easy way to create signatures is from the inverse of RSA. The signer 'decrypts' a message m to get a signature (i.e. computes s = m d mod n). To verify this, we take the signature s = m d mod n and encrypt it. We get s e = (m d ) e = m mod n, and check that the decrypted signatures equals the original message.

Key Encapsulation Mechanisms (KEMs)

Beside signatures, an important use of public key cryptography is to exchange (or wrap) symmetric keys. A naive solution would be to encrypt a key using a public key encryption scheme. However most public key schemes taken in their textbook version are insecure for some specific messages, and symmetric keys can fall in this category. For example, symmetric keys are particularly shorts. Typically we find today 3000 bits RSA modulus and 128 bits for AES keys. If k is a 128 bits number, encrypting it with RSA and e = 3 (as it is done in many real life applications), we get k 3 mod n = k 3 . In this case, it is easy to get k from k 3 with a simple cubic root computation. One way to prevent this kind of mistake (which can easily be done by real life developers that are not cryptographers) is to use a modification of RSA that is designed to send keys, a Key Encapsulation Mechanism. RSA is secure if a message is chosen at random (i.e. it has an negligible chance not to be secure). One can check that a 128 bits message has a negligible chance to be picked at random, since it would require 3000 -128 bits chosen at random to be 0's. Therefore we will send a random message m using RSA, this is the encapsulation. Then the receiver decrypts it, uses this m to derive a short symmetric key (e.g. using a hash function Section 1.2.4), this is the decapsulation. The sender then applies himself the same function on the m he generated, and they a have a shared secret.

Formalisation of Security

In this section we will formalise several notions that will allow us to define security notions in cryptography from the very beginning.

Complexity of an algorithm

Turing Machine A Turing machine is an abstract representation of an algorithm. It is a very straightforward model, but is still relevant regarding complexity and calculability. It was introduced in 1936 by Alan Turing [START_REF] Turing | On computable numbers, with an application to the Entscheidungsproblem[END_REF].

Definition 1.1 A Turing machine is a tuple {Q, Γ, B ∈ Γ, Σ ⊂ Γ \ {B}, q 0 ∈ Q, F ⊂ Q, δ : Q \ F × Γ → Q × Γ × {←,
→}, }. Q is the finite set of states, Γ is the finite alphabet (it can be {0, 1, B} without loss of generality), Σ is the set of input letters, q 0 is the initial state, δ is a partial function called the transition function, and F is the set of final states.

A Turing machine consists of:

• An infinite reading tape divided into cells one next to another, starting with a special symbol. Each cell contains a letter from Γ. At the start the Turing machine contains its input (in Σ * ) right after the special symbol, followed by an infinite number of B.

• A head, which is at some position on the tape. In the beginning, the head is at the first letter of the input. The tape can read the letter at its position write and move left or right.

Given a state q, a tape, and a position for the head reading α, the Turing machine will apply if it can the transition function, i.e. if δ(q, α) = (q , α , a ∈ {←, →}) is defined then the states changes to q , the α is replaced by α , and the head goes on cell left or right depending on a. If δ is undefined the Turing machine stops and does not return anything, if q is in F then the Turing machine stops and returns the content of its tape (we can add a special return tape to ease things). Another formalism to return things focuses on acceptance or reject. We can partition the set of final state in the accepting states, and rejecting states. Then the Turing machine can answer a decision problem, a problem which answer is 'yes' or 'no'. If on one input the machine ends in an accepting states, it answered 'yes', otherwise it answered no. We then say that the set of accepted inputs forms the language recognised by the Turing machine. Actually, lots of problems can be decision problems. For example, computing a function f from X to Y is the same as recognising the language {(x, f (x)); x ∈ X}, or deciding if (x, y) is in X for all (x, y)2 .

There are many equivalent definition of the Turing machine, and also other formalism (e.g. circuit, λ-calculus, etc...) that do express the same calculability power, but we simply aim at giving a glimpse at the way things are formalised to the bottom. In practice in cryptography, we do not use as it the Turing machine formalism, but we would be able to write every algorithm in this model, and their complexity would not be fundamentally changed3 .

Probabilistic Turing Machines

Many algorithms that we will consider are probabilistic. Therefore we will use probabilistic Turing machines, which are Turing machines that have a special random tape of fixed length, from which they will read to make random choices. Before launching the probabilistic Turing, every cell of the random tape is filled independently with a uniformly randomly chosen letter of the alphabet. This tape is often called the random coins of the algorithm, and a particular word written on the random tape is called a coin toss. For example, if we want a Turing Machine on the binary alphabet to choose a random number uniformly in {0, • • • , 2 n -1}, we will get a random tape of length n, and read this tape as a n-bits number written in binary. When we formalise the notion of advantage Section 1.4.2, we will talk about probability of events involving a certain number of probabilistic Turing machines. Theses probabilities will be 'taken over the random coins of the algorithm', meaning that they are computed as number of coin tosses such that the evenement happens total number of possible coin tosses .

Interactive Turing Machines

Another type of Turing machines that we do not formalise here are interactive Turing machines. They are used to formalise protocols and therefore are naturally used in cryptography. We need to add communication tapes so that Turing machines can write on each others' communication tapes (i.e. send messages).

Polynomial Time, Non deterministic Polynomial Time

The running time of an algorithm on an input is the number of application to the transition function before it reaches a final state. We say that an algorithm is in polynomial time if there exists a polynomial P such that for all n ∈ N, and for all input of length n then its running time is less than P (n). The set of problems solved by this defines the complexity class P The polynomial time algorithm can be seen as the efficient ones, the one we can run in practice. Of course this is an approximation and it depends on the length of the input, but it is good enough for theoretical work, which has the great pros of being independent of the computer we use and the technological evolutions. However, to evaluate the efficiency of an algorithm we need either a precise polynomial, or even better, to implement it in real life (which allow to take into account practical details of the machine like the number of processors, or the amount of cache memory). On the other hand we can define the class of non-practical algorithms (with the same precision limitation). This is the famous N P (for non deterministic polynomial) class. The only change is that the transition function is non-deterministic, i.e. δ(q, α) is now a subset of (q , α , a ∈ {←, →}). Each input then gives several results. We then say that an input is accepted if and only if at least one of the computation accepts it. We can now define N P , which is the class of languages (or decision problems) that are recognised in polynomial time by a non-deterministic Turing machine. Another way to see NP is the class of problems that are difficult (possibly exponential time), but checking that a solution is indeed a solution is easy. To see this, you can in a polynomial amount of steps make an exponential amount of 'trials' by giving two choices to the transition function, and then you check if one of them is a solution in polynomial time. NP problems are usually considered non-practical (there are some counter-examples). It has not been proven yet that P = N P (nor P = N P ), meaning that we do not know if an N P machine is strictly more powerful than a regular one. In turn it means that our definition of practical and non practical, besides its few 'practicalities' issues, might be unfunded theoretically. The fact that this is not answered yet prevents any formally proven cryptography, since we would like our honest parties to be efficient (in P ), and the dishonest ones that try to break our systems without keys to be impractical (in N P ). This is why we make use of assumptions, of the form 'this problem is not in P ' .

Security Model and Games

In this section, we give a few security definitions. These and more specific one can be found when relevant in the following chapter of this thesis. Our definitions will be game based. This is one of the two paradigms used in cryptography, the other one being simulation based (also called real-world/ideal-world paradigm). It is often argue that simulation based definitions are easier to use when using basic primitives (e.g. encryption, signatures etc...) to form more complex protocols. for example the universal composability (UC) framework of Ran Canetti [START_REF] Canetti | Universally composable security: A new paradigm for cryptographic protocols[END_REF] makes heavy use of simulation. However, since we focus on primitives, it is not a problem for us to use game based definitions. In fact, our game based definitions have well-known equivalents in the real-world/ideal world paradigm. One could also argue that game based definitions are easier to understand intuitively when talking about primitives such as encryption or signatures. A game will specify the rules, i.e. what the adversary can do, and on what condition he wins. We then say our scheme is secure if the adversary almost (the almost is formalised in Section 1.4.2) never wins. In figure Figure 1.2 we give a game based description of the notion of semantic security4 defined by Goldwasser and Micali in [START_REF] Goldwasser | Probabilistic encryption & how to play mental poker keeping secret all partial information[END_REF].

Advantage All our experiments are parametrised with the security parameter λ. The same security parameter is given in unary to the key generation algorithm. Since we require algorithms to be polynomial, this sets the allowed time to generate the keys. First we define the advantage of an adversary against a security game as the probability (as a function of λ) that he wins minus 0.5. Indeed a trivial adversary that answers at random has a probability of 0.5 to win, so we want to measure how the adversary performs compared to this trivial adversary. We now define a negligible functionDefinition 1.2. Definition 1.2 We say that a function f from N to R is negligible if for any polynomial P , there exists an integer N such that for all n ≥ N :

f (n) ≤ 1 P (n)
We need this definition because an adversary could try for example to guess the secret key λ times. If he succeeds then he can easily win the game. Otherwise, he tries at random. Then his advantage would be higher than 0, but we still want to say that the scheme is secure, since this attack is unavoidable, and has very few chances of success. We can now say if a scheme is secure by choosing a game and say that the advantage of any adversary is negligible.

SEM SEC Adv E (1 λ ): (sk, pk) $ ← -E.KeyGen(1 λ ) (m0, m1) ← Adv(pk) b $ ← -{0, 1} Adv ← E.Enc(pk, m b ) return b == b Figure 1.2:
The SEM SEC experiment represents the semantic security game for a (public key) encryption scheme. It is parametrised by the adversary Adv, the encryption scheme E and, the security parameter λ. E.KeyGen is the key generation algorithm of E, and E.Enc is the encryption algorithm of E. The adversary gets the public key, then he chooses a pair of messages m 0 , m 1 . One of this message is chosen at random and its encryption is given to the adversary. Then he tries to guess which one it was. He wins if the game returns true, i.e. if he guessed correctly which message was encrypted. This captures a very strong notion of security, indeed even if the adversary has very little knowledge about the encryption, he can win it easily. Imagine if the adversary knows that the odd messages are encrypted as odd ciphertext, and even messages are encrypted as even ciphertext. This information does not allow decryption of any messages, but by choosing m 0 odd and m 1 even, the adversary wins the game every time. This also means that in the public key setting a randomisation is needed to be semantically secure. This is primordial as the adversary can otherwise encrypt both messages, and see which encryption match the challenge he is given. This is the most basic security game for cryptography. In the following, we will introduce different games that give more power to the adversary Section 1.4.2 and to define the security of signatures Section 1.4.2.

Definition 1.3 (Semantic security)

We say that a (secret key) encryption scheme E is semantically secure if for all polynomial time adversary (Turing machines) Adv, its advantage for the SEM SEC Adv E game Figure 1.2 is a negligible function.

CCA, CPA

In this paragraph, we introduce oracles, which will model how the adversary can access information about the cryptosystem, such as getting access to decrypted ciphertext. First, we define in figure Figure 1.3 the semantic security under a chosen plaintext attack, meaning that the adversary can choose some plaintexts to encrypt. Note that this notion only makes sense in a symmetric setting, in an asymmetric setting the adversary can encrypt anyway since he has access to the public key.

CP A Adv E (1 λ ): L ← ∅ (sk) $ ← -E.KeyGen(1 λ ) (m0, m1) ← Adv Enc(•) (1 λ ) if m0 ∈ L m1 ∈ L b $ ← -{0, 1} Adv ← E.Enc(pk, m b ) return b == b return 0 Enc(m): c $ ← -E.Enc(sk, m) L ← L ∪ {m} return c
Figure 1.3: The chosen plaintext attack semantic security experiment. The Enc(•) in the exponent of the adversary defines an oracle. The adversary can call it at anytime, and gets written the oracle's answer on a special tape. This is a convenient way to give to the adversary 'limited' access to the secret key, in the sense that he can call the oracle to encrypt a message, which uses the secret key, but he cannot do arbitrary computation with the secret key. One could see this as an equivalent of an API. We can also note the use of a global variable L, which stores some information about the call made to the oracle. This is needed so that the adversary cannot challenge on some m 0 or m 1 which has been given to the oracle. We could remove this condition, but by doing so we would need randomisation to get semantic security, as in the public key setting without chosen messages. Since often symmetric scheme, such as block cipher, are deterministic, we choose to present this experiment.

Definition 1.4 (Semantic security under chosen plaintext attack)

We say that a (secret key) encryption scheme E is semantically under chosen plaintext attack is secure if for all polynomial time adversary (Turing machines) Adv, its advantage for the CP A Adv E game Figure 1.3 is a negligible function.

Unforgeability under Chosen Message Attack

As a last example of security notion, we define Section 1.4.2 the security of a signatures scheme Σ with the strong Existantially UnForgeability under Chosen Message Attack (EUFCMA) game, meaning that the adversary can get signatures on messages of his choice, and then he tries to produce a signature on a message of his choice (that he did not queried).

As illustration we briefly state several (weaker) variations of security experiment for digital signatures:

• weak EUFCMA : the adversary can produce a signature σ for m even

if (m, σ ) is in L EUF-CMA Adv Σ (1 λ ): L ← ∅ (sk, pk) $ ← -Σ.KeyGen(1 λ ) (m * , σ * ) ← Adv Sign(•),Verify(•,•),H(•) (1 λ ) if (m * , σ * ) ∈ L return Σ.Verify(pk, m * ) return 0 Sign(m): σ $ ← -Σ.Sign(sk, m) L ← L ∪ {m, σ} return σ Verify(m, σ):
return Σ.Verify(pk, m, σ)

Figure 1.4: The strong EUF-CMA experiment for digital signature schemes.

• EUF : the adversary does not have access to the signing algorithm

• Universal Unforgeability : The adversary does not choose the message for which he tries to forge a signature

Current Research Trends in Cryptography

In this section, we briefly expose some topics with which the cryptography community is interested nowadays so that the reader can have a broader view of where our results are in the field, and why those fields are of interest.

More Adversaries

As exposed in Section 1.4.2 different types of adversaries are considered in cryptography. Knowing that the communicants start their messages by 'hello' gives you access to known plaintext/ciphertext pairs. Cryptography being built on top of Internet protocols allows chosen plaintext/ciphertext attacks, and one could think that this is the worst possible case. This section will expose unintuitive adversaries that are considered in cryptography.

Computers are not Black Box

A hidden assumption in the models presented in Section 1.4.2 is that computations are done in a black box, and the adversary only has access to the public channel (e.g. the Internet). However this doesn't hold when cryptographic devices are used 'in the field' (e.g. IoT devices, smart cards etc...) and computers do leak information others than by the intended Input/Output interface. These unintentional leakage channels are called side channels.

Side Channel Analysis

In its seminal paper [START_REF] Paul | Timing attacks on implementations of Diffie-Hellman, RSA, DSS, and other systems[END_REF] Paul Kocher demonstrated that the time of computation of a computer (or any computing device) is linked to the data it is processing. This allowed to obtain secret key just by measuring how long an RSA encryption took. He later shown in [START_REF] Paul | Differential power analysis[END_REF] that a similar attack could be done with the power consumption. This was then extended in many ways, using, for example, electromagnetic emission, and more advanced statistical methods.

Fault Injection A somewhat similar method to side channel analysis is fault injection. Instead of passively listening to the targeted device, it is possible to perturbate it, so that computations are faulty. This sometimes allows extremely powerful cryptanalysis, as we demonstrate in Section 5.2. Side channels, as well as fault injection models, are sometimes referred as gray box models, since there is some leakage but in a noisy and particular form.

White Box Cryptography

What can be thought of as natural extension of gray box cryptography is white box cryptography. It was introduced in [START_REF] Chow | Whitebox cryptography and an AES implementation[END_REF]. Its purpose is to model an almighty adversary, that can see and modify your source codes. Under this model, one could carry cryptographic computations in an untrusted environment such as an infected smart-phone. However, as of today no secure implementation of a white box cipher are known.

Post Quantum Cryptography

Another hidden assumption in the classical models is the fact that we model our adversary by Turing machines. However, a new type of computer is under development: quantum computers. We will not explain how they work nor what they can do, but it is sufficient for our purpose to know that Schorr's algorithm [START_REF] Shor | Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer[END_REF] can leverage them to efficiently solve factorisation and discrete logarithm (or more generally the hidden subgroup problem). This prevent classical and efficient public key algorithm such as RSA and Diffie-Hellman key exchange to be used, and the community is now looking at cryptosystem based on other assumptions.

NIST Competition

As it is now usual, the NIST launched the first competition for standarisation of post quantum public key algorithms. More information can be found at https: //csrc.nist.gov/Projects/Post-Quantum-Cryptography.

Type of Post Quantum Cryptography

We give as references some paradigms that are considered quantum safe:

• Lattice based: this is the most widely studied. 'A new hope' [START_REF] Alkim | Post-quantum key exchange -a new hope[END_REF] based on the Ring-LWE assumption and 'Frodo' [BCD + 16] based on the LWE assumption are two representatives of it.

• Code based: This is a very old type of cryptography (1978), but was left aside due to efficiency reasons, until it was find out that we needed quantum resistance. The McElice crpytosystem [START_REF] Mceliece | A Public-Key Cryptosystem Based On Algebraic Coding Theory[END_REF] is its principal representative.

• Isogeny based: This is very recent (2011) in its post quantum version [START_REF] De Feo | Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies[END_REF], and is based on the assumption that it is hard to find isogeny between supersingular curves. The assusmption does not hold with non supersingular curves against quantum computers.

• Mersenne prime arithmetic based: This is the most recent type of post quantum cryptography (and the newest public key cryptosystem). We discuss it in Chapter 4, where we present an attack on an early version, as well as a variation of the 'fixed' version. The 'fixed' version is meant to be presented at the NIST competition at the time of the writing of this thesis.

Quantum Cryptography

Like many topics in cryptography (such as elliptic curves or lattice), quantum technologies have raised interest in cryptanalysis, but can also be used to derive new schemes. Even if quantum computers might be found in the market in a foreseeable future, because of cost issues, it is hard to believe that one wants to base a cryptographic scheme on them. However, quantum exchange of information could solve the key exchange problem in a different way than encrypting the key. Indeed exchanging information with quantum means, allows removing the eavesdropper assumption, since unlike in classical physics, observing quantum information changes it. This is the basic idea for quantum key exchange. We investigate the security of such schemes from an information theoretic point of view in Section 5.3.

Optimisations and Usability

While it might not be intuitive, cryptography's most recurrent problems for real world applications do not lie in security proofs or assumptions. Most of the time cryptography is misused or not used at all when it is needed. There are lots of different reasons for that. We give three of them which are performances, usability and lack of awareness. We did work on performances, and give usability and lack of awareness to place our work in a greater context. We give them in decreasing order regarding the general amount of work the community put in these.

Performances Since cryptography is a part of computer science, it was natural for the community to look for algorithmic 'tricks' to speed-up computations. This was further justified by the fact that cryptographic algorithms (especially public keys' one) are costly, and had to be executed in constrained environment such as smart cards. Nowadays processors are much more powerful, and efficiency problems are not as present as they used to be. However, there still are incentives for optimisations, such as:

• Cryptography is used more and more, only because more and more sensitive information is being sent trough various networks. So cryptography needs to be faster.

• This information can be treated by even more constrained environments than smart cards, typically IoT devices.

• Some companies that do not manipulate extremely sensible data can easily choose not to add any cryptographic layer, to improve customer experience thanks to faster reaction from their devices.

Due to these reasons, we became interested in two 'batch' optimisations 5 in Chapter 3. The first, Section 3.2 verifies several digital signatures at the same time, and the second Section 3.3 optimizes the creation of several digital signatures at the same time.

Usability Usability is naturally a less scientific topic and therefore has attracted less interest in the community. However, due to numerous mistakes from general purpose developers, some scientific communities got interested in this topic. [ABF + 17] is an example of a comparative study on the usability of several cryptographic libraries study.

Lack of Awareness This is not a scientific topic either but is nonetheless of crucial importance for the digital world security and privacy. For example [START_REF] Preneel | Privacy and security in an age of surveillance (dagstuhl perspectives workshop 14401)[END_REF] studies real life privacy breaches by governments. This allows to point out breaches in real life defense, as well as advertise the importance of cryptography and computer security so that Snowden's revelations are not forgotten.

Chapter 2

Results and Contributions

Organisation

• Chapter 3 presents two optimisations for digital signature schemes. Section 3.3 improves Schnorr signatures: we show how to securely reuse the nonce, which furthermore enables signing in fewer operations. This paper was published at ESORICS 2017. Section 3.2 introduces the question of optimal batch signature verification with a priori probabilities, for which we provide an analysis, algorithms, and heuristics. This paper is currently under review.

• Chapter 4 presents a practical cryptanalysis of a recent public key cryptosystem proposed by Aggarwal et al. This paper was published at LATINCRYPT 2017. We also present an unpublished variation of this cryptosystem.

• Section 5.2 presents a differential fault analysis of the lightweight cipher PRINCE. This paper was published at CRiSIS 2016.

• Section 5.3 studies the entropy loss when being eavesdropped during a quantum key exchange. This paper is currently under review.

Additional Work

The following research works published during the thesis will not be presented here for thematic alignment reasons.

• In [START_REF] Barbot | Uniform sampling for timed automata with application to language inclusion measurement[END_REF] we study a new probabilistic approach to timed language inclusion (an undecidable problem) based on volumetry. This work was published at QUEST 2016.

• In [START_REF] Beunardeau | Honey encryption for language -robbing shannon to pay turing[END_REF] we study honey encryption, a technique that prevents adversaries from checking the correctness in an attempted decryption, and in turn, achieves security beyond brute force bound. This work was published at MyCrypt 2016.

• In [START_REF] Beunardeau | The case for system command encryption[END_REF] we argue why system commands should be encrypted despite Kerckhoffs' principle, and give guidelines to measure their (in)security. This was an invited talk at AsisaCCS 2017.

• [START_REF] Beunardeau | Fully homomorphic encryption: Computations with a blindfold[END_REF][START_REF] Beunardeau | Cdoe obofsucaitn: Securing software from within[END_REF][START_REF] Beunardeau | White-box cryptography: Security in an insecure environment[END_REF] are three popular science articles on cryptography for IEEE Security and Privacy Magazine. The three articles are about Fully Homomorphic Encryption, Obfuscation, and White-Box Cryptography.

• In [START_REF] Amarilli | Failure is also an option[END_REF] we argue for modifications of the rules to participate in the Nijmeegse Vierdaagse (a famous walking event), where the rules were subsequently changed. This was published in the The New Codebreakers 2016

In addition to scientific publications the author filed 6 patents and participated in the writing of an accepted funded proposal for the Analysis oN BLind Cloud (ANBLIC) project which aim at using Fully Homomorphic encryption and Functional Encryption at an industrial scale (http:// competitivite.gouv.fr/le-24e-appel-a-projets-fui-regions/les-resultats-du-24e-appel-a-projets html).

Chapter 3

Batch Processing in Cryptography

Introduction

Cryptographic operations can be costly, and this is often the case that these costs induce insecurities. Indeed in practice non-critical industries tend to prefer efficiency over security. This can translate into weaker keys or no cryptographic layer at all. In the 70's a number of optimisations were proposed to enable cryptographic applications on smart cards. Nowadays it is argued that the Internet of things will make use of another wave of optimisations, such as lightweight ciphers. We actually leverage two old techniques proposed around the 70's. In Section 3.2 we tackle the issue of verifying a large number of signatures at the same, which is suited for large-scale industrial applications. This has already been done resulting in being able to say if at least one signature is incorrect in a large group. We add a priori probabilities of correctness of signatures and propose batch signatures algorithm leveraging this additional assumption. In Section 3.3 we propose a modification of the Schnorr signature scheme [START_REF] Schnorr | Efficient identification and signatures for smart cards[END_REF] which is well suited with pre computations techniques for exponentiation. We then study how our new scheme compares to the original scheme with different existing pre computations schemes.

Optimal Batch Signatures

Introduction and motivation

Batch cryptography, introduced by Fiat in [START_REF] Fiat | Batch RSA[END_REF][START_REF] Fiat | Batch RSA[END_REF], leverages RSA's homomorphic properties [START_REF] Rivest | A method for obtaining digital signature and public-key cryptosystems[END_REF] to speed-up signature schemes. On the verification side, the product of individual RSA signatures can be checked in a single operation as explained in [START_REF] Bellare | Fast batch verification for modular exponentiation and digital signatures[END_REF]. This idea can be applied to many other schemes enjoying homomorphic properties.

In [START_REF] Naccache | be improved? Complexity trade-offs with the digital signature standard[END_REF], Naccache et al. described the first batch verifier for DSA signatures. Laih and Yen [START_REF] Yen | Improved digital signature suitable for batch verification[END_REF] proposed a batch verification method of DSA and RSA signatures, later broken by [START_REF] Boyd | Attacking and repairing batch verification schemes[END_REF]. Similarly, another construction of Harn for RSA and DSA was soon proven insecure and retracted [START_REF] Hwang | Cryptanalysis of the batch verifying multiple RSA digital signatures[END_REF][START_REF] Hwang | Two simple batch verifying multiple digital signatures[END_REF]. This called for a more systematic approach, where security of batch verification could be modelled and proved.

This question was answered when Bellare, Garay and Rabin [START_REF] Bellare | Fast batch verification for modular exponentiation and digital signatures[END_REF] presented three generic methods for batching modular exponentiations: the random subset test, the small exponents test, and the bucket test. [START_REF] Bellare | Fast batch verification for modular exponentiation and digital signatures[END_REF] showed how to apply these methods to batch verification of DSA signatures.

The problem of bad signature identification arises when at least one signature in the batch is incorrect, in which case the batch test fails1 . The naive approach is then to test individually each signature, which can be costly.

For this reason several solutions were proposed to sieve out bad signatures quickly: At Eurocrypt 1998, Bellare et al. introduced RSA screening [BGR98], soon broken and fixed by Coron and Naccache [START_REF] Coron | On the security of RSA screening[END_REF]; at PKC 2000 Pastuszak et al. described a simple "divide-andconquer" algorithm to identify one incorrect signature in a batch [START_REF] Pastuszak | Identification of bad signatures in batches[END_REF]. Another approach by Law and Matt [LM07], using identity-based signature schemes, also allows identifying invalid signatures in a batch.

Our contribution: This paper departs from the above approaches by assuming the availability of extra information: the a priori probability that each given signature is correct. In practice, we may either assume that such probabilities are given, estimated from signer trust metrics, or are learned from past verifications. We assume in this work that these probabilities are known.

In this paper, we show that it is possible to find incorrect signatures in an optimal way -i.e. by performing on average the minimum number of tests -by exploring the combinatorial and algebraic properties of verification algorithms. This turns out to be faster than RSA screening or divide-and-conquer verifiers in the majority of settings.

On top of cryptographic applications, we note that optimal batch testing can improve the time, cost and reliability of other tests, such as medical screening, traitor-tracing or fraud control in large networks.

Intuition

Before introducing models and general formulae, let us provide the intuition behind our algorithms.

Let us begin by considering the basic case of two signatures. These can be verified individually or together, in a batch. Individual verification claims a minimum of two units of work-check one signature, then check the other. Batch-checking them requires a minimum of one verification. If it is highly probable that both signatures are correct, then batch verification is interesting: If both signatures are indeed correct, we can conclude after one test and halve the verification cost. However, if that fails, we are nearly back to square one: One of these signatures (at least) is incorrect, and we don't know which one.

In this paper, we identify when to check signatures individually, and when to batch-check them instead-including all possible generalizations when there are more than 2 signatures. We assume that the probability of a signature being incorrect is known to us in advance. The result is a testing 'metaprocedure' that offers the best alternative to sequential and individual testing.

To demonstrate: the testing procedure that always works is to verify every signature individually, one after the other: This gives the 'naive procedure', which always performs 2 verifications, as illustrated in Figure 3.1. In this representation, the numbers in parentheses indicate which signatures are being tested at any given point. The leaves indicate which signatures are correct (denoted 1) or incorrect (denoted 0), for instance, the leaf 01 indicates that only the second signature is valid. Note that the order in which each element is tested does not matter: There are thus 2 equivalent naive procedures, namely the one represented in Figure 3.1, and the procedure obtained by switching the testing order of (1) and (2).

(1)

(2) 00 01

(2) 10 11

Figure 3.1: The "naive procedure" for n = 2 consists of testing each entity separately and sequentially.

Alternatively, we can leverage the possibility to test both signatures together as the set {1, 2}. In this case, batching the pair {1, 2} must be the first step: Indeed, testing {1, 2} after any other test would be redundant, and the definition of testing procedures prevents this from happening. If the test on {1, 2} is correct, both signatures are correct and the procedure immediately yields the outcome 11. Otherwise, we must identify which of the signatures 1 or 2 (or both) is responsible for the test's incorrectness. There are thus two possible procedures, illustrated in Figure 3.2.

Intuitively, the possibility that this procedure terminates early indicates that, in some situations at least, only one test is performed, and is thus less costly than the naive procedure. However, in some situations up to three tests can be performed, in which case it is more costly than the naive procedure.

Concretely, we can compute how many verifications are performed on average by each approach, depending on the probability x 1 that the first signature is incorrect, and x 2 that the second is incorrect. To each procedure, naive, batch-left, batch-right, we associate the following polynomials representing the expected stopping time:

• L naive = 2 • L batch-left = (1 -x 1 )(1 -x 2 ) + 2(1 -x 1 )x 2 + 3x 1 (1 -x 2 ) + 3x 1 x 2 • L batch-right = (1 -x 1 )(1 -x 2 ) + 3(1 -x 1 )x 2 + 2x 1 (1 -x 2 ) + 3x 1 x 2
It is possible to see analytically which of these polynomials evaluates to the smallest value as a function of (x 1 , x 2 ). Looking at Figure 3.3, we use these expectations to define zones in [0, 1] 2 where each algorithm is optimal (i.e. the fastest on average). More precisely, the frontier between zones C and B has equation x 1 = x 2 , the frontier between A and B has equation x 2 = (x 1 -1)/(x 1 -2), the frontier between A and C has equation x 2 = (2x 1 -1)/(x 1 -1), and the three zones meet at Having identified the zones, we can write an algorithm which, given x 1 and x 2 , identifies in which zone of Figure 3.3 (x 1 , x 2 ) lies, and then apply the corresponding optimal verification sequence. In the specific case illustrated above, three algorithms out of three were needed to define the zones; however, for any larger scenario, we will see that only a very small portion of the potential algorithms will be considered.

x 1 = x 2 = (3 - √ 5
Our objective is to determine the zones, and the corresponding verification algorithms, for arbitrary n, to identify which signatures in a set are correct and which are not, while minimizing the expected number of verification operations.

Preliminaries

This section will formalize the notion of a testing procedure, and the cost thereof so that the problem at hand can be mathematically described. We aim at the greatest generality, which leads us to introduce 'and-tests', a particular case of which are signatures that can be batch verified.

Testing procedures

We consider a collection of n signatures. Let [n] denote {1, . . . , n}, and Ω = P([n])\{∅}, where P is the power set (ie. P(X) is the set of subsets of X).

Definition 3.1 (Test)

A test is a function φ : Ω → {0, 1}, that associates a bit to each subset of Ω.

We are mainly interested in tests satisfying homomorphic properties. We focus in this work on the following: Definition 3.2 (And-Tests) An and-test φ : Ω → {0, 1} is a test satisfying the following property:

∀T ∈ Ω, φ(T ) = t∈T φ({t}).
In other terms, the result of an and-test on a set is exactly the logical and of the test results on individual members of that set. Elements of Ω can be interpreted as n-bit strings, with the natural interpretation where the i-th bit indicates whether i belongs to the subset. We call selection an element of Ω.

Definition 3.3 (Outcome)

The outcome F φ (T ) of a test φ on T ∈ Ω is the string of individual test results:

F φ (T ) = {φ(x), x ∈ T } ∈ {0, 1} n . When T = [n], F φ will concisely denote F φ ([n]).
Our purpose is to determine the outcome of a given test φ, by minimizing in the expected number of queries to φ. Note that this minimal expectation is trivially upper bounded by n.

Definition 3.4 (Splitting) Let T ∈ Ω be a selection and φ be a test. Let S be a subset of Ω.

The positive part of S with respect to T , denoted S T , is defined as the set

S T = {S|S ∈ S, S ∧ T = T } .
where the operation ∧ is performed element-wise. This splits S into two. Similarly the complement S ⊥ T = S -S T is called the negative part of S with respect to T .

We are interested in algorithms that find F φ . More precisely, we focus our attention on the following:

Definition 3.5 (Testing procedure) A testing procedure is a binary tree T with labelled nodes and leaves, such that:

1. The leaves of T are in one-to-one correspondence with Ω in string representation; Remark It follows from the Definition 3.5 that a testing procedure is always a finite binary tree and that no useless calls to φ are performed. Indeed, doing so would result in an empty S for one of the children nodes. Furthermore, the root node has S = Ω.

Interpreting and representing testing procedures

Consider a testing procedure T , defined as above. T describes the following algorithm. At each node (S, T ), perform the test φ on the selection T of signatures. If φ(T ) = 0, go to the left child; otherwise go to the right child. Note that at each node of a testing procedure, only one invocation of φ is performed. The tree is finite and thus this algorithm reaches a leaf S final in a finite number of steps. By design, S final = F φ .

Remark From now on, we will fix φ and assume it implicitly.

S = Ω, T = (1, 2) (1) (2)
(3) 000 001

(3) Remark We represent a testing procedure graphically as follows: Nodes (in black) are labelled with T , whereas leaves (in blue) are labelled with S written as a binary string. This is illustrated in Figure 3.4 for n = 3. This representation makes it easy to understand how the algorithm unfolds and what are the outcomes: Starting from the root, each node tells us which entity is tested. If the test is positive, the right branch is taken. Otherwise, the left branch is taken. Leaves indicate which signatures tested positive and which signatures tested negative from now on.

Remark

The successive steps of a testing procedure can be seen as imposing new logical constraints. These constraints ought to be satisfiable (otherwise one set S is empty in the tree, which cannot happen). The formula at a leaf is maximal in the sense that any additional constraint would make the formula unsatisfiable. This alternative description in terms of satisfiability of Boolean clauses is in fact strictly equivalent to the one that we gave.

In that case, T is understood as a conjunction T [i]=1 t i , S is a proposition formed by a combination of terms t i , connectors ∨ and ∧, and possibly ¬. The root has S = . The left child of a node labelled (T, S) is labelled S ⊥ T = S ∧ (¬T ); while the right child is labelled S T = S ∧ T . At each node and leaf, S must be satisfiable.

Probabilities on trees

To determine how efficient any given testing procedure is, we need to introduce a probability measure and a metric that counts how many calls to φ are performed.

We consider the discrete probability space (Ω, Pr). The expected value of a random variable X is classically defined as:

E[X] = ω∈Ω X(ω) Pr(ω)
Let T a testing procedure, and let S ∈ Ω be one of its leaves. The length T (S) of T over S is the distance on the tree from the root of T to the leaf S. This corresponds to the number of tests required to find S if S is the outcome of φ. The expected length of a testing procedure T is defined naturally as:

L T = E [ T ] = ω∈Ω T (ω) Pr(ω)
It remains to specify the probabilities Pr(ω), i.e. for any given binary string ω, the probability that ω is the outcome.

If the different tests are independent, we can answer this question directly with the following result: Lemma 3.1 Assume that the events 'φ({i}) = 1' and 'φ({j}) = 1' are independent for i = j. Then, ∀ω ∈ Ω, Pr(ω) can be written as a product of monomials of degree 1 in x 1 , . . . , x n , where

x i = Pr(φ({i}) = 1) = Pr(i-th bit of ω = 1).
Thus L T is a multivariate polynomial of degree n with integer coefficients.

In fact, or-tests provide inherently independent tests. Therefore we will safely assume that the independence assumption holds.

Example 3.2 Let n = 5 and ω = 11101, then Pr(ω) = x 1 x 2 x 3 (1 -x 4 )x 5 .
Remark L T is uniquely determined as a polynomial by the integer vector of length 2 n defined by all its lengths: (T ) = ( T (0...0), . . . , T (1...1)).

Optimal batch verification

We have now introduced everything necessary to state our goal mathematically. Our objective is to identify the best performing testing procedure T (i.e. having the smallest L T ) in a given situation, i.e. knowing Pr(ω) for all ω ∈ Ω.

Generating all procedures

We can now explain how to generate all the testing procedures for a given n ≥ 2.

One straightforward method is to implement a generation algorithm based on the definition of a testing procedure. Algorithm 1 does so recursively by using a coroutine. The complete list of testing procedures is recovered by calling FindProcedure(Ω, Ω \ {∅}).

Algorithm 1: FindProcedure

Input: S ∈ Ω, C ∈ Ω. Output: A binary tree. 1. if |S| == 1 then return S 2. S ⊥ = S = C = ∅ 3. for each T ∈ C 4. S ⊥ = S ⊥ T 5. S = S T 6. if S ⊥ / ∈ S ⊥ and S / ∈ S 7. S ⊥ = S ⊥ ∪ {S ⊥ } 8. S = S ∪ {S } 9. C = C ∪ {T } 10. for i ∈ {1, . . . , |C |} 11. C = C -C [i]
12.

for each

T ⊥ ∈ FindProcedure(S ⊥ [i], C) 13. for each T ∈ FindProcedure(S [i], C) 14. yield (C [i], T ⊥ , T )
We implemented this algorithm in Python. The result of the testing procedure generations for small values of n is summarized in Table 3.1. The number of possible testing procedures grows very quickly with n. An informal description of Algorithm 1 is the following. Assuming that one has an unfinished procedure (i.e. nodes at the end of branches are not all leaves). For those nodes S, compute for each T the sets S T and S ⊥ T . If either is empty, abort. Otherwise, create a new (unfinished) procedure, and launch recursively on nodes (not on leaves, which are such that S has size 1).

Algorithm 1 terminates because it only calls itself with strictly smaller arguments. We will discuss this algorithm further after describing some properties of the problem at hand.

Metaprocedures

Once the optimality zones, and the corresponding testing procedures, have been identified, it is easy to write an algorithm which calls the best testing procedure in every scenario. At first sight, it may seem that nothing is gained from doing so -but as it turns out that only a handful of procedures need to be implemented.

This construction is captured by the following definition:

Definition 3.6 (Metaprocedure) A metaprocedure M is a collection of pairs (Z i , T i ) such that: 1. Z i ⊆ [0, 1] n , Z i ∩ Z j = ∅ whenever i = j and i Z i = [0, 1] n .
2. T i is a testing procedure and for any testing procedure T ,

∀x ∈ Z i , L Ti (x) ≤ L T (x).
A metaprocedure is interpreted as follows: Given x ∈ [0, 1] n find the unique Z i that contains x and run the corresponding testing procedure T i . We extend the notion of expected length accordingly:

L M = min i L Ti ≤ n
One way to find the metaprocedure for n, is to enumerate all the testing procedures using Algorithm 1, compute all expected lengths L T from the tree structure, and solve polynomial inequalities.

Surprisingly, a vast majority of the procedures generated are nowhere optimal: This is illustrated in Table 3.2. Furthermore, amongst the remaining procedures, there is a high level of symmetry. For instance, in the case n = 3, 8 procedures appear 6 times, 1 a procedure appears 3 times, and 1 procedure appears once. The only difference between the occurrences of these procedures -which explains why we count them several times -is the action of the symmetric group S 6 on the cube (see Section 3.2.7 for a complete description).

The metaprocedure for n = 3 cuts the unit cube into 52 zones, which correspond to a highly symmetric and intricate partition, as illustrated in Figures 3.5 to 3.7. An STL model was constructed and is available upon request.

The large number of suboptimal procedures shows that the generate-then-eliminate approach quickly runs out of steam: Generating all procedures for n = 6 seems out of reach with Algorithm 1. The number of zones, which corresponds to the number of procedures that are optimal in some situation, is on the contrary very reasonable.

Lemma 3.2 (Number of naive procedures)

Let n ≥ 1, then there are

P (n) = n k=1 k 2 n-k equivalent naive procedures.
Proof: By induction on n: There are (n + 1) choices of a root node, P (n) choices for the left child, and P (n) choices for the right child. This gives the recurrence P (n + 1) = (n + 1)P (n) 2 , hence the result. This number grows rapidly and constitutes a lower bound for the total number of procedures (e.g. for n = 8 we have P (n) > 2 184 ). On the other hand, the naive procedure is the one with maximal multiplicity, which yields a crude upper bound αP (n) on the number of procedures, where α is the 2 k -th Catalan number.

The zones can be determined by sampling precisely enough the probability space. Simple arguments about the regularity of polynomials guarantee that this procedure succeeds when working with infinite numerical precision. In practice, although working with infinite precision is feasible (using rationals), we opted for floating-point numbers, which are faster. The consequence is that sometimes this lack of precision results in incorrect results on the zone borders -however, this is easily improved by increasing the precision or checking manually that there is no subzone near the borders.

Pruning the generation tree

We now focus on some of the properties exhibited by testing procedures, which allows a better understanding of the problem and interesting optimizations. This in effect can be used to prune early the generation of procedures and write them in more compactly by leveraging symmetries. We consider in this section a testing procedure T .

Lemma 3.3 Let B 0 and B 1 be two binary strings of size n, that only differ by one bit (i.e. B 0 [i] = 0 and B 1 [i] = 1 for some i). Then T (B 0 ) ≤ T (B 1 ).

Proof: First notice that for all T , T , and b, b ∈ { , ⊥} we have (S b T ) b T = (S b T ) b T . We will denote both by S bb T T . We have the following : If there exists k, T 1 , . . . , T k , and β 1 , . . . , β k such that

(Ω) β1•••β k T1•••T k = {B 1 } then there exists i ≤ k such that (Ω) β1•••¬βi•••β k T1•••Ti•••T k = {B 0 }
Indeed there exists i ≤ k such that β i = and T i = {i 0 }∪E where for all j in E, B 0

[j] = B 1 [j] = 0. This yields (Ω) β1•••βi-1βi+1•••β k T1•••Ti-1Ti+1•••T k = {B 0 , B 1 }
and the result follows.

Remark Lemma 3.3 indicates that testing procedures are, in general, unbalanced binary trees:

The only balanced procedure being the naive one.

Lemma 3. 4 If N is the naive procedure, then for any testing procedure T and for all x 1 , . . . , x n such that

x i > 1 2 , L N (x 1 , . . . , x n ) ≤ L T (x 1 , . . . , x n ) .
In other terms {∀i ∈ [n], 1 2 ≤ x i ≤ 1} is contained in the naive procedure's optimality zone.

Proof: An immediate corollary of Lemma 3.3 is that for all i ∈ [n], we have ∂ xi L T (x 1 , . . . , x n ) ≥ 0, where ∂ xi indicates the derivative with respect to the variable x i . Since the native procedure has a constant length, it suffices to show that it is optimal at the point { 1 2 , . . . , 1 2 }. Evaluating the length polynomials at this point gives

L T 1 2 , . . . , 1 2 = 1 2 n ω∈Ω T (ω) = [0,1] n L T dx.
Now, remember that the naive procedure gives the only perfect tree. It suffices to show that unbalancing this tree in any way results in a longer sum in the equation above. Indeed, to unbalance the tree one needs to:

• Remove two bottom-level leaves, turning their root node into a leaf

• Turn one bottom-level leaf into a node

• Attach two nodes to this newly-created leaf

The total impact on the sum of lengths is +1. Hence the naive algorithm is minimal at { 1 2 , . . . , 1 2 }, and therefore, in the region {∀i ∈ [n], 1 2 ≤ x i ≤ 1}. (

(2) 000 010

(2) 001 011

(2) Lemma 3.7 If a node labelled T 1 has two children that are both labelled T 2 , then we can interchange T 1 and T 2 without changing the testing procedure's expected length.

Yet another simple observation allows to reduce the set of subsets T at each step:

Lemma 3.8 Consider a node labelled (T, S). Assume that there is i ∈ [n] such that, for all S in S, i / ∈ S. Then we can replace T by T ∪ {i}.

Proof:

We can easily see that S T = S T ∪{i} and S ⊥ T = S ⊥ T ∪{i} .

Finally we can leverage the fact that the solutions exhibit symmetries, which provides both a compact encoding of testing procedures and an appreciable reduction in problem size.

Lemma 3.9 Let σ ∈ S n be a permutation on n elements. If we apply σ to each node and leaf of T , which we can write σ(T ), then

L σ(T ) (x 1 , . . . , x n ) = L T (σ (x 1 , . . . , x n )) .
Proof: Note that for any S ∈ Ω and T ∈ Ω \ {∅} we have σ S T = S σ(T ) and σ S ⊥ T = S ⊥ σ(T ) , where σ operates on each binary string. It follows that for any leaf S, T (S) becomes T (σ(S)) under the action of σ, hence the result. Lemma 3.10 Let S be a simplex of the hypercube, T a procedure, E = {σ(T )|σ ∈ S n }, then there exists T 0 in E, such that for all x in S, T 1 in E we have

L T0 (x) ≤ L T1 (x).

Moreover we have for all

σ in S n , x in σ(S), T 1 in E L σ(T0) (x) ≤ L T1 (x).

Remark The last two propositions allow us to solve the problem on a simplex of the hypercube (of volume

1/n!) such as {p 1 , . . . , p n | 1 ≥ p 1 • • • ≥ p n ≥ 0}.

Approximation heuristics

The approach consisting in generating many candidates, only to select a few, is wasteful. In fact, for large values of n (even from 10), generating all the candidates is beyond reach, despite the optimizations we described.

Instead, one would like to obtain the optimal testing procedure directly. It is a somewhat simpler problem, and we can find the solution by improving on our generation-then-selection algorithm (see Section 3.2.8). However, if we wish to address larger values of n, we must relax the constraints and use the heuristic algorithms described below, which achieve near-optimal results. This would be useful in real life scenarii for signatures verifications since we would like to verify hundreds or more signatures to have real gain.

Information-Based Heuristic

We first associate a 'cost' to each outcome S, and set of outcomes S:

cost(S, S) = f (S, S) + g(S, S) f (S, S) = #{i ∈ [n] s.t. s[i] = 1 and ∃S ∈ S, S [i] = 0} g(S, S) = 1 if ∃i ∈ {i ∈ [n] s.t. S[i] = 0}, ∃S ∈ S, S [i] = 1 0 otherwise
This function approximates the smallest integer n such that there exists n calls to φ with arguments T 1 , . . . , T n , and β 1 , . . . , β n in {⊥, } with S β1,...,βn T1•••Tn = {S}. This function is used to define a 'gain' function evaluating how much information is gathered when performing a test knowing the set of outcomes:

gain(T, S) = S∈S T 1 - cost(S, S T ) cost(S, S) Pr(S) + S∈S ⊥ T 1 - cost(S, S ⊥ T ) cost(S, S)
Pr(S)

Intuitively, we give higher gains to subsets T on which testing gives more information. Note that, if a call to φ doesn't give any information (i.e. S T or S ⊥ T is empty), then gain(T, S) = 0. This heuristic provides us with a greedy algorithm that is straightforward to implement. For given values x 1 , . . . , x n we thus obtain a testing procedure T H .

Testing the heuristic. We compared numerically T H to the metaprocedure found by exhaustion in the case n = 3. The comparison consists of sampling points at random and computing the sample mean of each algorithm's length on this input. The heuristic procedure gives a mean of 2.666, which underperform the optimal procedure (2.661) by only 1%.

Counter-example to optimality. In some cases, the heuristic procedure behaves very differently from the metaprocedure. For instance, for n = 3, x 1 = 0.01, x 2 = 0.17, x 3 = 0.51, the metaprocedure yields a tree which has an expected length of 1.889. The heuristic however, produces a tree which has expected length 1.96. Both trees are represented in Figure 3.9.

Beyond their different lengths, the main difference between the two procedures of Figure 3.9 begin at the third node. At that node the set S is the same, namely {010, 011, 100, 101, 110, 111}, but the two procedures settle for a different T : The metaprocedure splits S, with T = {1, 3}, into S ⊥ T = {010} and S T = {011, 100, 101, 110, 111}; while the heuristic chooses T = {1} instead, and gets S ⊥ T = {010, 011} and S T = {100, 101, 110, 111}. To understand this difference, first notice that besides 010 and 011, all leaves are associated with a very low probability. The heuristic fails to capture that by choosing T = {1, 3} early; it could later rule out the leaf 010 in one step and 011 in two. There does not seem to be a simple greedy way to detect this early on.

Pairing heuristic

Another approach is to use small metaprocedures on subsets of the complete problem. Concretely, given n objects to test, place them at random into k-tuples (from some small value k, e.g. 5). Then apply the k-metaprocedure on these tuples. While sub-optimal, this approach does not yield worst results than the naive procedure.

In cases where it makes sense to assume that all the x i are equal, then we may even recursively use the metaprocedures, i.e. the metaprocedures to be run are themselves places into k-tuples, etc. By using lazy evaluation, only the necessary tests are performed.

(1,2,3) (1,2,3)

(1,2) (1,3) (1) (2,3) (2) (3)
(1,2) (1)
(2,3)

(3) .9: The optimal metaprocedure tree (left), and heuristic metaprocedure (right) for the same point x = (0.01, 0.17, 0.51). The optimal procedure has expected length 1.889, as compared to 1.96 for the heuristic procedure.

Equivalences and symmetries for n = 3

A procedure can undergo a transformation that leaves its expected length unchanged. Such transformations are called equivalences. On the other hand, Lemma 3.9 shows that some transformations operate a permutation σ on the variables x i -such transformations are called symmetries.

Equivalences and symmetries are responsible for a large part of the combinatorial explosion observed when generating all procedures. By focusing on procedures up to symmetry, we can thus describe the complete set in a more compact way and attempt a first classification.

In the following representations (Figures 3.10 to 3.12), blue indicates fixed parts, and red indicates parts undergoing some permutation. Double-headed arrows indicate that swapping nodes is possible. The number of symmetries obtained by such an operation is indicated under the curly brace below.

(1)

(2)

(3) (3) (2) (3) (3) 2 2 2 2 (1) (2)
(3)

(3) (3) (3) (2,3) (2) (3) (3) 2 2 2 2 (1) (2,3) (2) (3) (3) (2) (3) (3) (3) (3) 2 2 2 2 (1) (2,3) (2) (3) (3) (2,3) (2) (3) (3) 2 2 2 2
Figure 3.10: Trees representation with a grouping by one element on the root. For a fixed element, we have 2 2 possible permutations. Since we have 4 patterns, we get 2 2 × 4 possible permutations for one grouping. Hence, we finally have 2 2 × 4 × 3 for all possible groupings by one element.

(1,2)

(

(2)

(3) (3) (3) 46 45 48 47 (3) 2 (1,2) (1) (2,3) (2) (3) (3) 46 45 (3) 46 45 48 47 (3) 2 (1,2) (2) (1) (3) (3) (3) 46 45 48 47 (3) 2 (1,2) (2) (1,3) (1) (3) (3) 46 45 (3) 46 45 48 47 (3) 2 (1,2) (3) (1) (2) (2) (1) (2) (2) (3) 2 2 2 2 (1,2) (1,3) (1)
(2)

(3) (3) 46 45 46 45 48 47 (3) 2 (1,2) (1,3) (1) (2,3) (2) (3) (3) 46 45 46 45 48 47 (3) 2 (1,2) (1,3) (2) (1) (3) (2) (3) 46 45 48 47 (3) 2 2 2 2 (1,2) (1,3) (2,3) (1)(2)(3) (2)(1)(1) (3)(3)(2) (3) (1) (1) 46 45 46 45 48 47 (3) 2 3 × 2 (1,2) (2,3) (1) (2) (3) (2) (3) 46 45 48 47 (3) 2 (1,2) (2,3) (2) (1) (3) (3) (3) 46 45 48 47 (3) 2 (1,2) (2,3) (2) (1,3) (1) (2) (2) 46 45 46 45 48 47 (3) 2 (1,2) (2,3) (3) (1) (2) (2) (1) 46 (1) 46 45 48 47 (3) 2 (1,2) (2,3) (1,3) (1)(2)(3) (2)(1)(1) (3)(3)(2) (3) (1) (1) 46 45 46 45 48 47 (3) 2 3 × 2 Figure 3
.11: Tree representations with a grouping by two elements on the root. For 10 fixed elements, we have 2 possible permutations, for 2 fixed elements, we have 2 possible permutations, and for 2 possible permutations, we have 6 possible permutations. Hence, we finally have 2 × 10 + 4 × 2 + 6 × 2 for all possible groupings by two elements.

(1,2,3)

(1)(2)(3) (2) (3) (3) 46 45 (2) (3) (5) (3) 2 2 2 2 (1,2,3) (1)(2)(3) (2,3) (2) (3) (3) (3) (2) (3) 45 (3) (3) (3) (3) (3) 2 2 2 2
(1,2,3) All permutations with g = 2 (3) Figure 3.12: Trees representation with a grouping by three elements on the root. For a fixed element at the upper left corner side, we have 2 2 possible permutations. For the upper right corner side, we get 2 2 . We replace the sub-root of the fixed trees and get (2 2 + 2 2 ) × 3. We also have the 40 × 3 trees from the grouping of two. Hence, we have 40 × 3 + (2 2 + 2 2 ) × 3

Best testing procedure at a point

We examine the following problem: Find the testing procedure T for a given k ≤ n, (p i1 , . . . , p i k ) ∈ [0, 1] n , and a selection P ⊆ 2 [k] that satisfies:

• S T = P , • T is optimal at point (p i1 , . . . , p i k )
This can be computed using a dynamic programming technique, by examining the outcome of each possible test that is the root node of the testing procedure T . This approach gives Algorithm 2.

The same dynamic programming algorithm can also be used to compute the number of testing procedures (including those leading to duplicate polynomials) that exist in a given dimension. It is actually even easier (meaning that we can apply the algorithm to an even higher dimension than our solution to the given point problem) since there is a huge number of symmetries that can be exploited to count.

We will introduce the following definition, in use in our algorithm: Definition 3.7 (Decided point) We say that x is a decided point for S a set of selections if either of the following is true:

• x ∈ S for all S ∈ S • x ∈ S for all S ∈ S
In the first case, we will say that x is a positive decided point and a negative decided point in the second case.

We denote by D +

S the set of positive decided points of S, D - S its set of negative decided points, and D S = D + S ∪ D - S its set of decided points.

Algorithm 2: FindOptimal

Input: k ≥ 0, (p1, . . . , p k ) ∈ [0, 1] k , S ⊂ 2 [k] .
Output: The optimal testing procedure T at point (p1, . . . , p k ) which satisfies ST = S.

1. if k == 0 then return the naive algorithm 2. if |DS | > 0 3. U ← {u1, . . . , u } = [k] \ DS 4. R ← {{r1, . . . , rp} | {ur 1 , . . . , ur p } ∪ D + S } 5.
T ← FindOptimal ( , (pu 1 , . . . , pu ), R)

6. replace {t1, . . . , tr} by {ut 1 , . . . , ut r } in T 7. replace { 1, . . . , r } by {u 1 , . . . , u r } ∪ D + S in T 8. else 9. W ← ∅ 10. for each T ⊆ [k] 11. S ⊥ ← S ⊥ T 12. S ← S T 13. if S ⊥ = ∅ or S = ∅ then continue 14. T ⊥ ← FindOptimal(k, (p1, . . . , p k ), S ⊥ ) 15. T ← FindOptimal(k, (p1, . . . , p k ), S ) 16. W ← W ∪ {(T , T ⊥ , T )} 17.
return the best algorithm in W at point (p1, . . . , pn)

Counting the number of algorithms in a given dimension works the same way; the only difference is that there is no need to look at the probabilities, and thus, the resulting Algorithm 3 does fewer recursive calls and is faster. We are not aware of a closed-form formula providing the same values as this algorithm.

Algorithm 3: CountAlgorithms

Input: k ≥ 0, S ⊂ 2 [k] . Output: The number of testing procedures which satisfy ST = S.

1. if k == 0 then return 1 2. if |DS | > 0 3. U ← {u1, . . . , u } = [k] \ DS 4. R = {{r1, . . . , rp} | {ur 1 , . . . , ur p } ∪ D + S } 5.
return CountAlgorithms( , R)

6. c ← 0 7. for each T ⊆ [k] 8. S ⊥ ← S ⊥ T 9. S ← S T 10. if S ⊥ = ∅ or S = ∅ then continue 11. c ⊥ ← CountAlgorithms(k, (p1, . . . , p k ), S ⊥ ) 12. c ← CountAlgorithms(k, (p1, . . . , p k ), S ) 13. c ← c + c c ⊥ 14. return c

Enumerating procedures for n = 3

All the procedures for n = 3 that are optimal at some point, up to symmetries, are represented in Figure 3.13.

Conclusion and open questions

We have introduced the question of optimal batch verification with a priori probabilities, where one is given a set of signatures and must determine in the least average number of operations which signatures are correct, and which are not. We formalized this problem and pointed out several interesting combinatorial and algebraic properties that speed up the computation of an optimal sequence of operations -which we call a metaprocedure. We determined the exact solution for up to 4 objects. For larger values, our approach requires too many computations to be tractable, and thus an exact solution is out of reach; however, we gave several heuristic algorithms that scale well. We showed that these heuristics are sub-optimal in all cases, but they always do better than standard screening. The existence of a polynomial-time algorithm that finds optimal metaprocedures for large values of n is an open question -although there is probably more hope in finding better heuristics. An alternative would be to modify our generation algorithm to kill branches when the resulting expected lengths are all worse than some already-known procedure.

Once the metaprocedure for a given n is known, which only needs to be computed once, implementation is straightforward and only invokes a handful of (automatically generated) cases. Besides the performance gain resulting from implementing metaprocedures for signature verification, the very general framework allows for applications in medical and engineering tests.

50

(1)

(2)

(3) 000 001

(3) 010 011

(2)

(3)

100 101 (3) 110 111 (1,2) (1,3) (1) (2)
(3) 000 001

(3)

010 011 100 101 (3) 110 111 (1,2) (1) (2)
(3) 000 001

(3) 010 011

(3) 100 101

(3) 110 111 (1,2,3) (1,2) (1) (2,3) (2) (3)
(1,2,3) (1,2) (1,3) (2,3) (1) (2) (3)

Reusing Nonces in Schnorr Signatures

Abstract

The provably secure Schnorr signature scheme is popular and efficient. However, each signature requires a fresh modular exponentiation, which is typically a costly operation. As the increased uptake in connected devices revives the interest in resource-constrained signature algorithms, we introduce a variant of Schnorr signatures that mutualises exponentiation efforts.

Combined with precomputation techniques (which would not yield as interesting results for the original Schnorr algorithm), we can amortise the cost of exponentiation over several signatures: these signatures share the same nonce. Sharing a nonce is a deadly blow to Schnorr signatures, but is not a security concern for our variant.

Our scheme is provably secure, asymptotically-faster than Schnorr when combined with efficient precomputation techniques, and experimentally 2 to 6 times faster than Schnorr for the same number of signatures when using 1 MB of static storage. This is joint work with Aisling Connolly, Rémi Géraud, David

Introduction

The increased popularity of lightweight implementations invigorates the interest in resourcepreserving protocols. Interestingly, this line of research was popular in the late 1980's, when smart-cards started performing public-key cryptographic operations (e.g. [START_REF] Fiat | How to prove yourself: Practical solutions to identification and signature problems[END_REF]). Back then, cryptoprocessors were expensive and cumbersome, and the research community started looking for astute ways to identify and sign with scarce resources.

In this work, we revisit a popular signature algorithm published by Schnorr in 1989 [START_REF] Schnorr | Efficient identification and signatures for smart cards[END_REF] and seek to lower its computational requirements assuming that the signer is permitted to maintain some read-only memory. This storage allows for time-memory trade-offs, which are usually not very profitable for typical Schnorr parameters.

We introduce a new signature scheme, which is provably secure in the random oracle model (ROM) under the assumption that the partial discrete logarithm problem (see below) is intractable. This scheme can benefit much more from precomputation techniques, which results in faster signatures.

Implementation results confirm the benefits of this approach when combined with efficient precomputation techniques and enough static memory is available (of the order of 250 couples of the form (x, g x )). We provide comparisons with Schnorr for several parameters and pre-computation schemes.

Intuition and general outline of the idea

Schnorr's signature algorithm uses a large prime modulus p and a smaller prime modulus q dividing p -1. The security of the signature scheme relies on the discrete logarithm problem in a subgroup of order q of the multiplicative group of the finite field Z p (with q | p -1). Usually, the prime p is chosen to be large enough to resist index-calculus methods for solving the discrete-log problem (e.g. 3072 bits for a 128-bit security level), while q is large enough to resist the square-root algorithms [START_REF] Shanks | Class number, a theory of factorization, and genera[END_REF] (e.g. 256 bits for 128-bit security level).

The intuition behind our construction is to consider a prime p such that p -1 has several different factors q i large enough to resist these birthday attacks, i.e. p = 1 + 2 i=1 q i then several "orthogonal" Schnorr signatures can share the same commitment component r = g k mod p. This is not the case with standard Schnorr signatures where, if a k is reused then the secret signing key is revealed.

It remains to find how r can be computed quickly. In the original Schnorr protocol k is picked uniformly at random in Z q . However, to be secure, our construction requires that k is picked in the larger set Z p-1 . which means that a much higher effort is required to compute r. Here we cut corners by generating an r with precomputation techniques, which allow an exponentiation to be sub-linear. The trick is that once the exponentiation is sub-linear, we are more effective in our setting than in the original Schnorr setting.

We start by reminding how the original Schnorr signature scheme works and explain how we extend it assuming that k is randomly drawn from Z p-1 . We then present applications of our construction, by comparing several pre-processing schemes.

Preliminaries

We denote the security parameter by κ ∈ N which is given to all algorithms in the unary form 1 κ . Algorithms are randomized unless otherwise stated, and PPT stands for "probabilistic polynomialtime," in the security parameter. We denote random sampling from a finite set X according to the uniform distribution with x $ ← -X. We also use the symbol $ ← -for assignments from randomized algorithms, while we denote assignment from deterministic algorithms and calculations with the symbol ←. If n is an integer, we write Z n for the ring Z/nZ. We let Z * n the invertible elements of Z n . As is usual, f ∈ negl(κ) denotes a function that decreases faster than the inverse of any polynomial in κ; such functions are called negligible. The set of numbers 1, 2, . . . , k is denoted [k]. Most of our security definitions and proofs use code-based games. A game G consists of an initializing procedure Init, one or more procedures to respond to oracle queries, and a finalizing procedure Fin.

Schnorr's signature scheme

Schnorr signatures [START_REF] Schnorr | Efficient identification and signatures for smart cards[END_REF] are an offspring ElGamal signatures [START_REF] Elgamal | On computing logarithms over finite fields[END_REF] which are provably secure in the Random Oracle Model under the assumed hardness of solving generic instances of the Discrete Logarithm Problem (DLP) [START_REF] Pointcheval | Security proofs for signature schemes[END_REF]. The Schnorr signature scheme is a tuple of algorithms defined as follows:

• Setup(1 κ ): Large primes p, q are chosen, such that q ≥ 2 κ and p -1 = 0 mod q. A cyclic group G ⊂ Z p of prime order q is chosen, in which it is assumed that the DLP is hard, along with a generator g ∈ G. A hash function

H : {0, 1} * → G is chosen. Public parameters are pp = (p, q, g, G, H).
• KeyGen(pp): Pick an integer x uniformly at random from [2, q -1] as the signing key sk, and publish y ← g x as the public key pk.

• Sign(pp, sk, m): Pick k uniformly at random in Z * q , compute r ← g k mod q, e ← H(m, r), and s ← k -ex mod q. Output σ ← {r, s} as a signature.

• Verify(pp, pk, m, σ): Let (r, s) ← σ, compute e ← H(m, r) and return True if g s y e = r, and False otherwise.

Security model

We recall the strong2 EF-CMA security notion:

Definition 3.8 (Strong EF-CMA Security) A signature scheme Σ is secure against existential forgeries in a chosen-message attack (strongly EF-CMA-secure) if the advantage of any PPT adversary A against the EF-CMA game defined in Figure 3.14 is negligible:

Adv EF A,Σ (κ) = Pr EF A Σ (κ) = 1 ∈ negl(κ). EF A Σ (κ): L ← ∅ (sk, pk) $ ← -Σ.KeyGen(1 κ ) (m * , σ * ) ← A Sign(•),Verify(•,•),H(•) (1 κ ) if (m * , σ * ) ∈ L return Σ.Verify(pk, m * ) return 0 Sign(m): σ $ ← -Σ.Sign(sk, m) L ← L ∪ {m, σ} return σ Verify(m, σ): return Σ.Verify(pk, m, σ) Figure 3.14:
The strong EF-CMA experiment for digital signature schemes.

Using multiple q's

Our construction relies on using a prime p of the form mentioned in the introduction. This is not a trivial change and requires care as we discuss below. Technically, our construction is a stateful signature scheme (see e.g. [KL07, Chapter 12]), in which we simultaneously sign only one message and keep a state corresponding to the values k, g k and the index i for the current prime number. However, it is more compact and convenient to describe it as a signature for simultaneous messages.

Our scheme

Similar to the Schnorr signature scheme, our scheme is a tuple of algorithms (Setup, KeyGen, Sign, and Verify), which we define as follows:

• Setup(1 κ ): Generate primes q 1 , . . . , q of size ≥ 2 κ and groups G 1 , . . . , G respectively of order q 1 , . . . q such that the DLP is hard in the respective G i , and such that p = 1 + 2 q i is prime. This is easily achieved by selecting ( -1) primes q i and varying the last one until p is prime.3 Choose a cryptographic hash function H : {0, 1} * → {0, 1} q1 . The hash function will be used to produce elements of Z qi . For this we will denote by H i the composition of H and a conversion function from {0, 1} q1 to Z qi 4 Finally, choose g a generator of the group Z * p of order p -1. The public parameters are therefore

pp = p, {q i } i=1 , H, g, {G i } i=1 .
• KeyGen(pp): The signer chooses x $ ← -Z * p-1 and computes y ← g x mod p. The key sk = x is kept private to the signer, while the verification key pk = y is made public.

• Sign(pp, sk, m 1 , . . . , m ): The signer chooses k $ ← -Z p , such that k = 0 mod q i for all i, and computes r ← g k mod p. The signer can now sign the messages m i as:

ρ i $ ← -{0, 1} κ , e i ← H i (m i , r, ρ i ), and s i ← k -e i x mod q i outputting the signatures σ i = {r, s i , ρ i }-or, in a more compact form, σ = {r, s 1 , . . . , s , ρ 1 , . . . , ρ }.
• Verify(pp, pk, m i , (r, s i , ρ i ), i) : Verifying a signature is achieved by slightly modifying the original Schnorr scheme: First check that s i ∈ {0, . . . q i -1} and compute e i ← H i (m i , r, ρ i ), then observe that for a correct signature5 :

(g si y ei ) p-1 q i = r p-1 q i mod p.
The signature is valid if and only if this equality holds, otherwise the signature is invalid (see Lemma 3.11).

Remark Note that unlike Schnorr, in the Sign algorithm we add a random ρ i for a signature to make the argument of the hash function unpredictable. This will be useful for the proof of Theorem 3.12 in the ROM.

Remark Note also that one almost recovers the original Schnorr construction for = 1-the only differences being in the verification formula, where both sides are squared in our version, and the addition of a fresh random to hash.

Lemma 3.11 (Correctness) Our scheme is correct.

Proof: Let g, y, r, s i , and ρ i be as generated by the KeyGen and Sign algorithms for a given message m i . We check that,

(g si y ei ) si r p-1 q i = 1 mod p.
By the definition of s i , there exists λ ∈ Z such that g si = g k-eix+λqi , hence

g si y ei g -k = g λqi mod p.
Raising this to the power of p-1 qi we get g λ(p-1) = 1 since the order the multiplicative group Z * p is p -1.

Security

To aid in the proof of security, we introduce the following problem which we call the partial discrete logarithm problem (PDLP). Intuitively it corresponds to solving a discrete logarithm problem in the subgroup of our choice. Definition 3.9 (PDLP) Let ≥ 2 be an integer, q 1 , . . . , q distinct prime numbers and q = q 1 . . . q . Let G be a group of order q and g a generator of G. Given g, q, q 1 , . . . , q l , and y = g x , the partial discrete logarithm problem (PDLP) consists in finding i ∈ [ ] and x i ∈ Z qi such that

x i = x mod q i .
In our context, we are chiefly interested in a subgroup of order q of a multiplicative group of a finite field Z * p , where q divides p -1-ideally, q = (p -1)/2. The best known algorithms to solve the PDLP are index-calculus based methods in Z * p and square-root algorithms in subgroups of prime order q i for some i ∈ [ ]. With p of bit-size 3072, q = (p -1)/2, = 12 and q 1 , . . . , q of bit-size 256, we conjecture that solving the PDLP requires about 2 128 elementary operations. In Section 3.3.4, we provide security argument in the generic group model on the intractability of the PDLP for large enough prime numbers q 1 , . . . , q . Theorem 3.12 (Existential unforgeability) Our scheme is provably EF-CMA-secure assuming the hardness of solving the PDLP, in the ROM.

To prove this result, we will exhibit a reduction from an efficient EF-CMA forger to an efficient PDLP solver. To that end, we first show a sequence of indistinguishability results between the output distributions of • Our signature algorithm Sign = Sign 0 on user inputs.

• A modified algorithm Sign 1 (see Figure 3.15), where the hash of user inputs is replaced by a random value. This situation is computationally indistinguishable from the previous one in the ROM.

• A modified algorithm Sign 2 (see Figure 3.15), that has no access to the signing key x. The output distribution of this algorithm is identical to the output of Sign 1 (Theorem 3.13).

Then we use the forking lemma [START_REF] Pointcheval | Security arguments for digital signatures and blind signatures[END_REF][START_REF] Bellare | Multi-signatures in the plain public-key model and a general forking lemma[END_REF] to show that an efficient EF-CMA-adversary against Sign 2 can be used to construct an efficient PDLP solver. Finally, we leverage the above series of indistinguishability results to use an adversary against Sign 0 . Let CRT (for Chinese Remainder Theorem) be the isomorphism that maps

Z q1 × • • • × Z q × Z 2 to Z p-1 .
Theorem 3.13 The output distributions of Sign 1 and Sign 2 are identical.

Proof: This theorem builds on several intermediate results described in Lemmata 3.14 to 3.18. We denote δ the output distribution of Sign 1 and δ the output distribution of Sign 2 . The structure of the proof is the following :

• In Lemma 3.14 we show that the output of Sign 2 is a subset of the output of Sign 1 .

• Lemma 3.15 shows that in Sign 1 there is a unique random tape per output.

• Lemma 3.16 shows that in Sign 2 there are exactly two random tapes per output.

• Lemma 3.18 shows that there are twice as many random tapes possible for Sign 2 than for Sign 1

Sign 1 :

ρ $ ← -{0, 1} κ k $ ← -Zp \ i=1 {qi, 2qi, . . . , p -1} r ← g k mod p for i = 1 to ei $ ← -Zq i si ← k -eix mod qi ρi $ ← -{0, 1} κ
end for return (r, e1, . . . , e , s1, . . . , s , ρ1 . . . , ρ )

Sign 2 : for i = 1 to ei $ ← -Zq i si $ ← -Zq i ρi $ ← -{0, 1} κ end for a $ ← -{0, 1} b $ ← -{0, 1} S ← CRT(s1, . . . , s , a) E ← CRT(e1, . . . , e , b) r ← g S y E for i = 1 to check that r = 1 mod qi,
otherwise abort end for return (r, e1, . . . , e , s1, . . . , s , ρ1 . . . , ρ )

Figure 3.15: The algorithms used in Theorem 3.13, as part of the proof of Theorem 3.12. This demonstrates that by uniformly choosing the random tape, the resulting distributions for Sign 1 and Sign 2 are identical, which is the uniform distribution on the set of valid signatures. Lemma 3.14 Every tuple of δ is a valid signature tuple. Therefore δ ⊆ δ.

Proof: [of Lemma 3.14] Let (r, e 1 , . . . , e , s 1 , . . . , s , ρ 1 , . . . , ρ ) ∈ δ . Let i ∈ [ ]. By the Chinese Remainder Theorem we have: S = s i mod q i and E = e i mod q i . So there exists λ, µ ∈ Z such that S = s i + λq i and E = e i + µq i . Hence:

r p-1 q i = g S y E p-1 q i = g si+λqi y ei+µqi p-1 q i = (g si y ei ) p-1 q i g λ(p-1) y µ(p-1) = (g si y ei ) p-1 q i
The last equality holds since the order of the multiplicative group Z * p is p -1, and this concludes the proof with the fact that r = 1 mod q i . Lemma 3.15 There is exactly one random tape upon which Sign 1 can run to yield each particular tuple of δ.

Proof: [of Lemma 3.15] Let k, e 1 , . . . , e , ρ 1 , . . . , ρ and k , e 1 , . . . , e , ρ 1 , . . . , ρ be random choices of δ that both yield (r, e 1 , . . . , e , s 1 , . . . , s , ρ 1 , . . . , ρ ). It is immediate that e i = e i and ρ i = ρ i for all i ∈ [ ]. Also since g k = g k , g is of order p -1 and since k and k are in [p] then k = k . Lemma 3. 16 There are exactly two random tapes over k, ρ 1 , . . . , ρ , e 1 , . . . , e that output each tuple of δ .

Proof: [of Lemma 3.16] Let e 1 , . . . , e , s 1 , . . . , s , a, b, ρ 1 , . . . , ρ and e 1 , . . . , e , s 1 , . . . , s , a , b , ρ 1 , . . . , ρ be random choices that both give (r, e 1 , . . . , e , s 1 , . . . , s , ρ 1 , . . . , ρ ). It is immediate that e i = e i , s i = s i , and

ρ i = ρ i for all i ∈ [ ].
Let S, S , E, and E be the corresponding CRT images. We have g S y E = g S y E , which is g S+xE = g S +xE , and S + xE = S + xE mod (p -1). Since x is odd (it is invertible mod p -1), it follows that S + E and S + E have the same parity. Therefore a + b = a + b mod 2 and we have two choices: a = b, or a = 1 -b, both of which are correct.

Lemma 3.17 # Z p \ i=1 {q i , 2q i , . . . , p -1} = 2 i=1 (q i -1).

Proof: [of Lemma 3.17] The number of invertible elements modp is i=1 (q i -1) × (2 -1) so the number of invertible mod q i for all i (and not necessarily for 2) is 2 i=1 (q i -1). This is exactly the cardinality of the set

Z p \ i=1 {q i , 2q i , . . . , p -1} ,
Lemma 3.18 There are twice as many possible random choices in δ than in δ.

Proof: [of Lemma 3.18] For the number of random choices in δ we use Lemma 3.17 to count the number of k and then count the number of e i and get 2 i=1 (q i -1) × i=1 q i . For δ , having r = 1 mod q i is equivalent to having s i = -e i x. Therefore it has the same number of random choices as a distribution picking the

s i from Z qi \ {e i x} which is i=1 q i × i=1 (q i -1) × 2 × 2.
It follows from the above results that the two distributions are the same, i.e. the uniform distribution over the set of valid signatures. This concludes the proof of Theorem 3.13. The algorithm R aborts in four possible ways during the simulation (denoted ( ), ( †), ( ‡) and ( §)) in Figures 3.17 and 3.18. We upper-bound the probability of these events in the following list:

• ( ) This occurs with negligible probability since the ρ is a fresh random which is unpredictable by the adversary.

• ( †) This occurs with non overwhelming probability since the adversary is efficient.

• ( ‡) The element is in the list with non negligible probability because if the adversary forges on an unqueried hash in the ROM, it has a negligible chance to succeed.

• ( §) This happens with non overwhelming probability due to the forking lemma [START_REF] Pointcheval | Security arguments for digital signatures and blind signatures[END_REF].

If R does not abort, then g s * y e * p-1

q i * = (r * ) p-1 q i * = g s * y ẽ * p-1
q i * mod p. Then s * + e * x = s * + ẽ * mod q i * . It follows that the value returned by R is equal to x mod q i * . R succeeds with non negligible probability, as explained earlier. The probability of forking is polynomial in the number of queries to the random oracle, the number of queries to the signature R.Init(y = g x , g, p, q1, . . . , q Proof: [of Theorem 3.12] Using Theorem 3.13, we can use Sign 0 instead of Sign 2 as a target for the attacker in Theorem 3.19.

) : set L ← ∅ Σ ← ∅ j ← 1 k ← 0 l ← 0 pk ← y pp ← {p, {qi} i=1 , g} return (pk, pp) R.Fin(pk, pp) : (m * , r * , s * , ρ * , i * ) $ ← -A(pp, pk) e * ← R.Hi * (m * , r * mod qi * , ρ * ) a ← L -1 [((m * , r * mod qi * , ρ * ), e * )] ‡ if not Verify pp,pk (m * , r * , s * , i * ) abort † (m * , r * , s * , ρ * , i * ) $ ← -A (pp, pk) if i * = i * then abort § if r * = r * then abort § e * ← R.Hi * (m * , r * mod qi * , ρ * ) if e * = e * then abort § if not Verify pp,pk (m * , r * , s * , i * ) abort † ∆s ← s * -s * ∆e ← e * -e * return (i * , ∆s/∆e) R.Sign (m) : l ← 0 return Σ.[i] l ← l + 1 R.H(x) : if ∃(x , h ) ∈ L s.t. x = x return h else h $ ← -Zp L ← L ∪ {(x, h)} return h R.H (x) : k ← 0 L ← ∅ if ∃(x , h ) ∈ L s.t. x = x return h else if i ≤ a (x , h ) ← L.[i] return h k ← k + 1 L ← L ∪ {(x, h)} else h $ ← -Zp L ← L ∪ {(x, h)} return h R.Sign(m) : if j = 1 (r, e1, . . . , e , s1, . . . , s , ρ1, . . . , ρ ) $ ← -δ if ∃h s.t. ((m, r mod q1, ρ1), h) ∈ L abort L ← L ∪ {((m, r mod q1, ρ1), e1)} j ← j + 1 mod return (s1, r, ρ1, 1) Σ ← Σ ∪ {(s1, r, ρ1, 1)} else if ∃h s.t. ((m, r mod qj, ρj), h) ∈ L abort L ← L ∪ {(m, r mod qj, ρj), ej} j ← j + 1 mod return (sj, r, ρj, j) Σ ← Σ ∪ {(sj, r, ρj, j)}

Generic security of the partial discrete logarithm problem

In this section, we prove that the partial discrete logarithm problem introduced in Section 3. Proofs in the generic group model provide heuristic evidence of some problem hardness when an attacker does not take advantage of group elements' encoding. However, they do not necessarily say anything about the difficulty of specific problems in a concrete group.

Let be some non-negative integers, let q 1 , . . . , q be some distinct prime numbers and let q = q 1 • • • q . We consider a cyclic group G of (composite) order q generated by g. We assume without loss of generality that q 1 = max(q 1 , . . . , q ). A classical method [START_REF] Pohlig | An improved algorithm for computing logarithms over gf(p) and its cryptographic significance (corresp.)[END_REF] to solve the partial discrete logarithm problem in G given h = g x ∈ G is to compute h q2•••q , an element of order diving q 1 (that belongs to the subgroup generated by g q2•••q ) and to compute its discrete logarithm x 1 in base g q2•••q using a square root method such as Shanks "baby-step giant-step" algorithm [START_REF] Shanks | Class number, a theory of factorization, and genera[END_REF]. It is easy to see that x 1 is equal to x mod q 1 and is obtained within time complexity O(

√ q 1 + log(q 2 • • • q )) group operations.
Our goal is to prove that this time complexity is essentially optimal in the generic group model. Let A be a generic group adversary that solves the partial discrete logarithm problem in G. As usual, the generic group model is implemented by choosing a random encoding σ : G -→ {0, 1} m . Instead of working directly with group elements, A takes as input their image under σ. This way, all A can test is string equality. A is also given access to an oracle computing group multiplication and division: taking σ(g 1 ) and σ(g 2 ) and returning σ(g 1 • g 2 ) and σ(g 1 /g 2 ) respectively. Finally, we can assume that A submits to the oracle only encodings of elements it had previously received. This is because we can choose m large enough so that the probability of choosing a string that is also in the image of σ is negligible.

Theorem 3.20 Let A be a generic algorithm that takes as input two encodings σ(g) and σ(h) (where g is a generator of G and h = g x ∈ G) and makes at most τ group oracle queries, then A's advantage in outputting a partial discrete logarithm (i, x i ) with i ∈ {1, . . . , } and x i = x mod q i is upper-bounded by O(τ 2 /q 1 ).

Proof:

We consider an algorithm B playing the following game with A. Algorithm B picks two bit strings σ 1 , σ 2 uniformly at random in {0, 1} m . Internally, B keeps track of the encoded elements using elements in the ring

Z q1 [X 1 ] × • • • × Z q [X ].
To maintain consistency with the bit strings given to A, B creates a lists L of pairs (F, σ) where F is a polynomial vector in the ring

Z q1 [X 1 ] × • • • × Z q [X
] and σ ∈ {0, 1} m is the encoding of a group element. The polynomial vector F represents the exponent of the encoded element in the group

Z q1 × • • • × Z q . Initially, L is set to {((1, 1, . . . , 1), σ 1 ) , ((X 1 , . . . , X n ), σ 2 )}
Algorithm B starts the game providing A with σ 1 and σ 2 . The simulation of the group operations oracle goes as follows:

Group operation: Given two encodings σ i and σ j in L, B recovers the corresponding vectors F i and F j and computes F i + F j for multiplication (or F i -F j for division) termwise. If

F i + F j (or F i -F j ) is already in L, B returns to A the corresponding bit string; otherwise it returns a uniform element σ R ← -{0, 1} m and stores (F i + F j , σ) (or (F i -F j , σ)) in L.
After A queried the oracles, it outputs a pair (i * , x * i ) ∈ {1 . . . , } × Z q i * as a candidate for the partial discrete logarithm of h in base g. At this point, B chooses uniform random values

x 1 , . . . , x n ∈ Z q1 × • • • × Z q . The algorithm B sets X i = x i for i ∈ {1, . . . , n}.
If the simulation provided by B is consistent, it reveals nothing about (x 1 , . . . , x ). This means that the probability of A guessing the correct value for (i * , x * i ) ∈ {1, . . . , } × Z q i * is 1/q i * . The only way in which the simulation could be inconsistent is if, after we choose values for x 1 , . . . , x n , two different polynomial vectors in L happen to produce the same value.

It remains to compute the probability of a collision happening due to a unlucky choice of values. In other words, we have to bound the probability that two distinct vectors F i , F j in L evaluate to the same value after the substitution, namely

F i (x 1 , . . . , x n ) -F j (x 1 , . . . , x n ) = 0.
This reduces to bound the probability of hitting a zero of F i -F j . By the simulation, this happens only if F i -F j is a vector of polynomials where at least one coordinate -say the k-th -is a non-constant polynomial (and thus of degree one) denoted (F i -F j ) (k) .

Recall that the Schwartz-Zippel lemma says that, if

F is a degree d polynomial in Z q k [X k ] and S ⊆ Z q k then Pr[F (x k ) = 0 mod q k ] ≤ d |S|
where x k is chosen uniformly from S. Going back to our case, we obtain by applying the Schwartz-Zippel lemma :

Pr[(F i -F j ) (k) (x k ) = 0 ∈ Z q k ] ≤ 1/q k ≤ 1/q 1 .
Therefore, the probability that the simulation provided by B is inconsistent is upper-bounded by τ (τ -1)/q 1 (by the union bound) and the result follows.

Provably secure pre-computations

Often the bottleneck in implementations centers around modular exponentiation. In this section, we briefly outline several proposed pre-computation techniques, as well as presenting in more detail two pre-computation schemes which were used in our implementation to compare timings between classical Schnorr and our scheme.

Brief overview

The problem of computing modular exponentiations is well-known to implementers of both DLP-based and RSA-based cryptosystems. In the specific case that we want to compute g x mod p, the following strategies have been proposed but their security is often heuristic:

• Use signed expansions (only applicable to groups where inversion is efficient);

• Use Frobenius expansions or the GLV/GLS method (only applicable to certain elliptic curves);

• Batch exponentiations together, as suggested by M'Raïhi and Naccache [START_REF] David | Batch exponentiation: A fast dlp-based signature generation strategy[END_REF].

The above approaches work for arbitrary values of x. Alternatively, one may choose a particular value of x with certain properties which make computation faster; however, there is a possibility that doing so weakens the DLP:

• Choose x with low Hamming weight as proposed by Agnew et al. [START_REF] Agnew | An implementation for a fast public-key cryptosystem[END_REF];

• Choose x to be a random Frobenius expansion of low Hamming weight, as discussed by Galbraith [Gal12, Sec. 11.3];

• Choose x to be given by a random addition chain, as proposed by Schroeppel et al. [START_REF] Schroeppel | Fast key exchange with elliptic curve systems[END_REF];

• Choose x to be a product of low Hamming weight integers as suggested by Hoffstein and Silverman [START_REF] Hoffstein | Random small hamming weight products with applications to cryptography[END_REF]-broken by Cheon and Kim [START_REF] Hee | Analysis of low hamming weight products[END_REF];

• Choose x to be a small random element in GLV representation-broken by Aranha

The E-BPV pre-computation scheme

E-BPV6 relies on pre-computing and storing a set of pairs (k i , g ki mod p); then a "random" pair (r, g r mod p) is generated by choosing a subset of the k i , setting r to be their sum, and computing the corresponding exponential by multiplying the g ki mod p.

To guarantee an acceptable level of security, and resist lattice reduction attacks, the number n of precomputed pairs must be sufficiently large; and enough pairs must be used to generate a new couple.

(E-)BPV.Preprocessing:

k 1 , . . . , k n $ ← -Z * p L ← ∅ for j ∈ [n] L ← L ∪ {(k j , K j = g kj mod p)} return L E-BPV.GetRandomPair: pick S ⊆ [n] s.t. |S| = k (d i , D i ) $ ← -D r ← 0 R ← 1 for j ∈ S x j $ ← -[h -1] r ← r + k j x j mod φ(p) R ← R • K xj j mod p return(r, R)
Figure 3.19: The E-BPV algorithm for generating random pairs (x, g x mod p). The BPV algorithm is a special case of E-BPV for h = 2.

Nguyen et al. [START_REF] Phong | Distribution of modular sums and the security of the server aided exponentiation[END_REF] showed that using E-BPV instead of standard exponentiation gives an adversary an advantage bounded by

m K n k (h -1) k
with m the number of signature queries by the adversary, (k, n, h) E-BPV parameters, and K the exponent's size. 7 We fix conservatively m = 2 128 . For our scheme, at 128-bit security, we have K = P = 3072. As suggested in [START_REF] Phong | Distribution of modular sums and the security of the server aided exponentiation[END_REF] we set n = k, and constrain our memory:

h k ≥ 2 3400
Optimizing 2k + h under this constraint, we find (h, k) = (176, 455). This corresponds to 1087 modular multiplications, i.e., an amortized cost of 90 multiplications per signature, for about 170 kB of storage.

Alternatively, we can satisfy the security constraints by setting n = 2048, h = 100, k = 320, which corresponds to about 770 kB of storage, giving an amortized cost of 62 modular multiplications per signature.

In the implementation (Section 3.3.6), we solve the constrained optimisation problem to find the best coefficients (i.e., the least number of multiplications) for a given memory capacity.

Remark To achieve the claimed bounds on modular multiplications, one should not compute R ← K xj j mod p directly; instead, an efficient speedup due to Brickell et al. [START_REF] Brickell | Fast exponentiation with precomputation (extended abstract)[END_REF] (BGMW) must be used. To illustrate the importance of this remark, we also give timings for a "naive" implementation in Table 3. 5.

Remark (Halving storage cost)

The following idea can halve the amount of storage required for the couples (x, g x ): instead of drawing the values x at random, we draw a master secret s once, and compute x i+1 ← g xi ⊕ s (or, more generally/securely, a PRF with low complexity x i+1 = PRF s (g xi )). Only s, x 0 , and the values g xi need to be stored; instead of all the couples (x i , g xi ). This remark applies to both BPV and E-BPV.

Lim and Lee precomputation scheme

We also consider a variation on Lim and Lee's fast exponentiation algorithm [START_REF] Hoon | More flexible exponentiation with precomputation[END_REF]. Their scheme originally computes g r for r known in advance, but it is easily adapted to the setting where r is constructed on the fly. The speed-up is only linear, however, which ultimately means we cannot expect a sizable advantage over Schnorr. Nevertheless, Lim and Lee's algorithm is less resource-intensive and can be used in situations where no secure E-BPV parameters can be found (e.g., in ultra-low memory settings).

The Lim-Lee scheme (LL) has two parameters, h and v. In the original LL algorithm, the exponent is known in advance, but it is easily modified to generate an exponent on the fly. Intuitively, it consists in splitting the exponent into a "blocks" of size h, and dividing further each block in b sub-blocks of size v. The number of modular multiplications (in the worst case) is a + b -2, and we have to store (2 h -1)v pairs. The algorithms are given in Figure 3.20.

For a given amount of memory M , it is easy to solve the constrained optimization problem, and we find

h opt = 1 ln(2) 1 + W 1 + M e
7 For Schnorr, the exponent's size is Q; for our scheme, it is P .

where W is the Lambert function. For a memory M of 750 kB, this gives h ≈ 8.6. The optimal parameters for integers are h = 9 and v = 4.8

Remark For LL, Remark 14 on halving storage requirements does not apply, as x need not be stored.

LimLee.Preprocessing(h, v):

g0 ← g L = ∅ for i = 0 to h -1 gi ← g 2 a i-1 for i = 0 to 2 h -1 let i = e h-1 . . . e1 in binary g0,i = g e h-1 h-1 . . . g e 1 1 for i = 0 to 2 h -1 for j = 0 to v -1 gj,i ← g 2 b j-1,i L ← L ∪ {gj,i} return L LimLee.GetRandomPair: R ← 1 r ← 0 for i = b -1 to 0 R ← R 2 r ← r + r for j = v -1 to 0 ri,j $ ← -{0, . . . , 2 h -1} R ← R × gj,r i,j r ← r + ri,j return (r, R)
Figure 3.20: The LL algorithm for generating random pairs (x, g x mod p).

A summary of the properties for the pre-computations techniques E-PBV and LL can be found in Table 3.3.

Algorithm

Storage Multiplications Security

Square-and-multiply 0 1.5 log P Always BPV [START_REF] Boyko | Speeding up discrete log and factoring based schemes via precomputations[END_REF] nP k -1 m

P ( n k ) < 2 -κ E-BPV [NSS01] nP 2k + h -3 m P ( n k )(h-1) k < 2 -κ Lim and Lee [LL94] 2 h × v × P log P h (1 + 1 v ) -3 Always
Table 3.3: Precomputation/online computation trade-offs.

Implementation results

Reschnorr, using the algorithms described in Sections 3.3.3 and 3.3.5, has been implemented in C using the GMP library. In the interest of timing comparison, we have also implemented the classical Schnorr scheme. The results for several scenarios are outlined in Table 3.4 (at 128-bit security) and Table 3.5 (at 192-bit security). Complete source code and timing framework are available upon request from the authors. These experiments show that our scheme is faster than Schnorr when at least 250 pairs (i.e., 750 kB at 128-bit security) have been precomputed. This effect is even more markedly visible at higher security levels: our scheme benefits more, and more effectively, from the E-BPV+BGMW optimisation as compared to Schnorr. The importance of combining E-BPV and BGMW is also visible: E-BPV using naive exponentiation does not provide any speed-up.

Schnorr and our scheme achieve identical performance when using Lim and Lee's optimisation, confirming the theoretical analysis. When less than 1 MB of memory is allocated, this is the better choice.

Heuristic security

Several papers describe server-aided precomputation techniques (e.g., [START_REF] Sabir | Efficient and verifiable algorithms for secure outsourcing of cryptographic computations[END_REF]), which perform exponentiations with the help of a (possibly untrusted) server, i.e., such techniques allow for outsourcing the computation of g x mod n, with public g and n, without revealing x to the server. Interestingly, the most efficient algorithms in that scenario (which of course we could leverage) use parameters provided by Hohenberger and Lysyanskaya [START_REF] Hohenberger | How to securely outsource cryptographic computations[END_REF] for E-BPV. A series of papers took these parameters for granted (including [START_REF] Sabir | Efficient and verifiable algorithms for secure outsourcing of cryptographic computations[END_REF]), but we should point out that these are not covered by the security proof found in [START_REF] Phong | Distribution of modular sums and the security of the server aided exponentiation[END_REF].

Despite this remark, it seems that no practical attack is known either; therefore if we are willing to relax our security expectations somewhat, it is possible to compute the modular exponentiation faster. Namely, a Q-bit exponent can be computed in O(log Q 2 ) modular multiplications.

Our scheme uses an exponent that is times bigger than Schnorr, which is amortized over signatures. Comparing our scheme to Schnorr, the ratio is log(Q) 2 (log Q) 2 . With Q = 256 we get a ratio of approximately 5.7.

Note that as Q increases, so does , and therefore so does the advantage of Our scheme over Schnorr in that regime.

Reduction-friendly moduli

As part of computing g k mod p, a very costly operation is the reduction mod p. An interesting question is whether some particular moduli p can be found, for which reduction is particularly easy.

An example of such moduli are those that start with a 1 followed by many 0.

Example 3.3 For P = 3072 and Q = 256, using (in hexadecimal notation)

∆ i = {12d,

Conclusion

We have introduced a new digital signature scheme variant of Schnorr signatures, that reuses the nonce component for several signatures. Doing so does not jeopardise the scheme's security; attempting to do the same with classical Schnorr signatures would immediately reveal the signing key. However, the main appeal of our approach is that precomputation techniques, whose benefits can only be seen for large enough problems, become applicable and interesting. As a result, without loss of security, it becomes possible to sign messages using fewer modular multiplications.

Our technique is general and can be applied to several signature schemes using several speed-up techniques.

Introduction

Diffie and Hellman introduced Public key cryptography in [START_REF] Diffie | New directions in cryptography[END_REF] in 1976. In Rabin published the first cryptosystem reducible to a known hard problem [START_REF] Michael | Digitalized signatures and public-key functions as intractable as factorization[END_REF]. He showed that if an opponent could decrypt randomly chosen ciphertexts, then he could factorise large composite integers. Since it is believed that no one can efficiently factorise large composite integers, then it follows that no one can computationally break this cryptosystem. Since then it is good practice to reduce any proposed system to well defined hard problems. This practice has become almost mandatory in public key cryptography. Over the past decades a number of hard problems were proposed, and a distinction was made between standard assumptions (the ones that have been studied for a long time and are widely believed to hold) and non standard ones (younger ones whose veracity is douted). In Section 4.2 we deal with a new public key cryptosystem that is reduced to a newly proposed problem. We experimentally showed that this new assumption does not hold. A more precise analysis of our attack followed in [START_REF] Koen De Boer | Attacks on the ajps mersenne-based cryptosystem[END_REF]. A modified version with adjusted parameters of the original cryptosysytem was consequently published in [START_REF] Aggarwal | A new public-key cryptosystem via mersenne numbers[END_REF], and proposed to the post-quantum NIST competition. In Section 4.3 we propose an unpublished variation of this cryptosystem. This version reduces to a similar problem. Unfortunately this new problem does not seem to better resist to the attack we proposed in Section 4.2. We expose it in our thesis as we believe that our variant is of independant conceptual interest.

On the Hardness of the Mersenne Low Hamming Ratio Assumption

Abstract

In a recent paper [START_REF] Aggarwal | A new public-key cryptosystem via Mersenne numbers[END_REF], Aggarwal, Joux, Prakash, and Santha (AJPS) describe an ingenious public-key cryptosystem mimicking NTRU over the integers. This algorithm relies on the properties of Mersenne primes instead of polynomial rings. The security of the AJPS cryptosystem relies on the conjectured hardness of the Mersenne Low Hamming Ratio Assumption, defined in [START_REF] Aggarwal | A new public-key cryptosystem via Mersenne numbers[END_REF].

This work shows that AJPS' security estimates are too optimistic and describes an algorithm allowing to recover the secret key from the public key much faster than foreseen in [START_REF] Aggarwal | A new public-key cryptosystem via Mersenne numbers[END_REF].

In particular, our algorithm is experimentally practical (within reach of the computational capabilities of a large organization), at least for the parameter choice {n = 1279, h = 17} conjectured in [START_REF] Aggarwal | A new public-key cryptosystem via Mersenne numbers[END_REF] as corresponding to a 2 120 security level. The algorithm is fully parallelizable.

This is joint work with Aisling Connolly, Rémi Géraud and David Naccache. The corresponding paper was presented at the 5 th International Conference on Cryptology and Information Security in Latin America, Latincrypt 2017, in La Havana, Cuba; and has been published as [START_REF] Beunardeau | On the hardness of the mersenne low hamming ratio assumption[END_REF].

Introduction

A Mersenne prime is a prime of form 2 n -1, where n > 1 is itself prime.

In a recent paper [START_REF] Aggarwal | A new public-key cryptosystem via Mersenne numbers[END_REF], Aggarwal, Joux, Prakash, and Santha (AJPS) describe an ingenious public-key cryptosystem mimicking NTRU over the integers. This algorithm relies on the properties of Mersenne numbers instead of polynomial rings. This scheme is defined by the following algorithms:

• Setup(1 λ ) → pp, which chooses the public parameters pp = (n, h) so that p = 2 n -1 is prime and so as to achieve a λ-bit security level. In [START_REF] Aggarwal | A new public-key cryptosystem via Mersenne numbers[END_REF] the following lower bound is derived

n -1 h -1 > 2 λ
which for instance is satisfied by λ = 120, pp = (n = 1279, h = 17).

• KeyGen(pp) → (sk, pk), which picks F, G two n-bit strings chosen independently and uniformly at random from all n-bit strings of Hamming weight h, and returns sk ← G and pk ← H = F/G mod (2 n -1).

• Encrypt(pp, pk, b ∈ {0, 1}) → c, which picks A, B two n-bit strings chosen independently and uniformly at random from all n-bit strings of Hamming weight h, then computes

c ← (-1) b (AH + B) mod (2 n -1).
• Decrypt(pp, sk, c) → {⊥, 0, 1}, which computes D = Gc mod (2 n -1) and returns

     0 if D ≤ 2h 2 , 1 if D ≥ n -2h 2 , ⊥ otherwise
We refer the reader to [START_REF] Aggarwal | A new public-key cryptosystem via Mersenne numbers[END_REF] for more details on this cryptosystem which does not require further overview because we directly attack the public key to infer the secret key.

In particular, security rests upon the conjectured intractability of the following problem:

Definition 4.1 The Mersenne Low Hamming Ratio Assumption states that given an n-bit Mersenne prime p = 2 n -1 and an integer h, the advantage of any probabilistic polynomial time adversary attempting to distinguish between F/G mod p and R is at most poly(n) 2 λ , where R is a uniformly random n-bit strings, and (F, G) are independently chosen n-bit strings each having Hamming weight h.

As we will see, we argue that (F, G) can be experimentally computed from H, at least for the parameter choice {n = 1279, h = 17} conjectured in [START_REF] Aggarwal | A new public-key cryptosystem via Mersenne numbers[END_REF] as corresponding to a 2 120 security level.

The full code (Python for partition sampling and Mathematica for lattice reduction) is available from the authors upon request.

Outline of the Analysis

The analysis uses the Lenstra-Lenstra-Lovász lattice basis reduction algorithm (LLL, [START_REF] Klaas Lenstra | Factoring polynomials with rational coefficients[END_REF]). We do not recall here any internal details of LLL but just the way in which it can be used to solve a linear equation with k unknowns when the total size of the unknowns is properly bounded.

Using LLL to Spread Information

Let x 1 , . . . , x k ∈ N * be k unknowns. Let p ∈ N be a modulus and a 0 , . . . , a k ∈ N. Consider the equation:

a 0 = k i=1 a i x i mod p.
All the reader needs to know is that the LLL algorithm will find x 1 , . . . , x k if k i=1 x i < p. In particular, LLL can be adapted to provide any uneven split of sizes between the x i as long as the sum of those sizes does not exceed the size of p. More details on the theoretical analysis of LLL in that setting and variants are given in [NS01, Sec. 3.2] and [Jou09, Chap. 13], in the context of generalised knapsack problems.

Partition and Try

The first observation that attracted our attention is that the size1 of F (and G) has an unusually small expectation σ(n, h):

σ(n, h) = n 1 + (1 -h n ) n+1 -1 h n (n + 1)
The difference in size between n = 1279 and σ(1279, 17) is not huge2 and cannot be immediately exploited. However, the same phenomenon also occurs at the least significant bits and further shortens the expected nonzero parts of F and G by 70 bits.

Similarly, assume that in the key generation procedure, both F and G happen to have bits set to 1 only in their lower halves. When this (rare event) happens, we can directly apply LLL to H to recover F and G. We call this event T .

Is that event rare? Since F and G are chosen at random, T happens with probability at least 2 -2h . While T 's probability is not cryptographically negligible, this pre-attack only allows to target one key out of 2 2h . For the first suggested parameter set (λ = 120), one public key out of 67 million can be attacked in this fashion, and its F and G recovered, i.e., a total break. The question is hence, can this phenomenon be extended to any key? And if so, at what cost? In particular, can we sacrifice work to increase the size of the vulnerable key space? The answers to these questions turn out to be positive, as we will explain hereafter.

Random partitions. Instead of a fixed partition of {0, . . . , n -1}, we can sample random partitions, for instance by sampling (without replacement) m positions, which are interpreted as boundaries between regions of zeros and regions that possibly contain a 1. The total number of regions, m + 1, determines the dimension of the lattice being reduced.

For the sake of simplicity we consider balanced partitions: A randomly sampled partition is not necessarily a balanced partition: we use rejection sampling to ensure the balancing property. 4 The sought-after property of these partitions is the following: Definition 4.3 Let X be a binary string of length n. A partition of X into m/2 type 1 blocks and m/2 + 1 type 2 blocks is correct for X if the type 2 blocks are completely made of zeros.

Figure 4.1 illustrates the partitions that we are interested in on a simple example. Also note that the definition above does not put any constraint on type 1 blocks, which may contain zeros or not; since they are not guaranteed to be zero, we refer to them as "non-zero" blocks. Accordingly, blocks of type 2 in a correct partition is referred to as "zero" blocks.

F f G g Figure 4.
1: An illustration of the partitions that we are interested in: in these diagrams, a black square in F or G represents a 1, while white squares represent 0s. The partitions f and g are balanced and correct for F and G respectively, with "zero" blocks coloured white, and "non-zero" blocks coloured black. The vertical dashed lines show how F and G align with their respective partitions.

The observation at the beginning of this section is that using a balanced partition that is correct for F and another one that is correct for G and we can recover F and G from H.

Since F and G are unknown, we cannot construct a correct partition from them directly; but the probability that a random balanced partition is correct for F (resp. G) is lower bounded5 by 2 -h . Assuming that F and G are independent, which they should be according to the key generation procedure, we found a correct partition for both F and G with a probability of 2 -2h .

Remark

We may also consider imbalanced partitions which allow an extra speed-up for a subtle reason: Given that the unknowns found by LLL have a low Hamming density, the odds that these numbers naturally begin by a sequence of zeros (and are hence shorter than expected) is high. The interesting point is that the total length of such natural gains sums up and allows to unbalance the partition in favor of type 1 blocks. Consider the analogy of a fishing boat that can carry up to 1000 kilograms of fish. The fishermen fishes with 3 nets having maximal capacities of 200, 300 and 500 kilograms each. Because waters are sparse in fish, the nets are expected to catch only 70% of their maximal capacity. Hence, we see that larger nets (285, 428, 714) can be used to optimize the boat's fishing capacity. However, unlike the boat, with LLL fish cannot be thrown back to the water and... excess weight sinks the boat (the attack fails). Hence if this speed-up strategy is used, we need to catch more than normal but not be too greedy. Note as well that if all variables end by at least trailing (LSB) zeros then these m zeros add-up to the gain as well (because there is no constant term in the equation a division of all variables by 2 has no effect on the solution's correctness). We did not exploit nor analyze these tricks in detail.

Trying partitions. The attack then consists in sampling a balanced partition, running LLL, and checking whether the values of F and G obtained from the reduction have the correct Hamming weight and yield H by division. Concretely, the matrix to be reduced is obtained as follows from the partitions f of F and g of G:

1. Compute the size of the each non-zero blocks in f and g, we call these sizes u = {u i } and v = {v i } respectively, with i = 0, . . . , m/2 -1. Let w = max i {u i , v i }.

2. Construct the vector s = s i as follows:

s i = 2 w-vi if i < m/2 2 w-ui if m/2 ≤ i < m
3. Construct the vector a = {a j } as follows: let f i (resp. g i ) denote the starting position of the non-zero blocks in F (rep. G), and set

a j = H × 2 gi mod p if j < m/2 p -2 fi if m/2 ≤ j < m 4.
Choose an integer K, and assemble the matrix M as follows:

M = diag(s) Ka 0 Kp
where diag(x) is the diagonal matrix whose diagonal entries are given by x. The coefficient K is a tuning parameter, which we set to 2 1200 .

5. Finally, we use LLL on M (using the Mathematica command LatticeReduce) and recover the reduced matrix's row that complies with the Hamming density of F and G. This row is expected to give the values of the non-zero blocks of F and G, and we can check its correctness by computing its Hamming weight, and checking that the ratio of the candidate values modulo p give H.

By the above analysis, a given partition is correct with probability 2 -2h , which for λ = 120 is only 2 -34 ; if we can run LLL reasonably fast, which is the case for m = 16, an efficient attack happens to be within reach of a well-equipped organization. Experimental evidence indeed suggests the feasibility of the attack, see Section 4.2.3.

Remark For larger security parameters λ, the ratio h/n deduced from the analysis in [START_REF] Aggarwal | A new public-key cryptosystem via Mersenne numbers[END_REF] asymptotically vanishes. It should be checked if this influences imbalanced partition finding to the attacker's relative advantage for larger values of λ. We did not explore this avenue left to the reader as a potential research question.

Putting it Together

To illustrate the attack feasibility, we fix a random tape in a deterministically verifiable way and implement our algorithm (see Figure 4.2).

Use π as seed Attack's random tape We generated a nothing-up-our-sleeves key with the procedure of Figure 4.3. The sample(S, h) This gives the following (in hexadecimal notation, the zero MSBs have not been written): respectively for F and G, which upon lattice reduction yield candidates of the correct Hamming weight. Their ratio indeed gives H; however one may debate our claim that this partition was found at random and argue that we constructed it from our prior knowledge of F and G.

1. n, h ← pp 2. I1 = {i1, . . . , i h } ← sample({0, . . . , n -1}, h) 3. I2 = {i1, . . . , i h } ← sample({0, . . . , n -1}, h) 4. F ← h i∈I 1 2 i 5. G ← h i∈I 2 2 i 6. return (sk = G, pk = F • G -1 mod p)
I 1 = {33,
To counter this argument and insist that finding partitions is reasonably easy, we derived them deterministically from the same seed as the key. To achieve this, we proceed as follows: we draw two independent sets of m/2 -1 indices in the range [0, n/2], which gives the sizes of the zero blocks and the non-zero blocks. This guarantees that the partitions are balanced. The randomness used for this sampling is obtained by iterating SHA256 as for key generation.

As in the example above, we construct partitions for m = 16 -this choice is not dictated by probability (as the likelihood to find a correct partition is in theory independent of m), but rather by a trade-off between the cost of LLL and the number of partitions explored. It is possible for instance to start with m = 2 partitions, then m = 3, and so forth, but we settled for a random search which is easier to implement.

We found the following partition for F at run #1,152,006 (in 116 s): Finally, note that the task is fully parallelizable and would benefit from running on several independent computers, a remark that we will later use in our final work factor estimates.

f = {27, b2,
Computing the Secret Key By running our program as explained in Section 4.2.2, we recover F , G, and confirm that H = F/G mod p.

Predicting the Total Execution Time

Putting all the above figures together and assuming no further algorithmic improvements, the total expected effort is:

(LLL_Time + 2 × Partition_Time) × Average_Partition_Tries 2 Number_of_Processors
Where in our basic scenario Average_Partition_Tries = 2 h . We performed LLL on Mathematica using the LatticeReduce function, which took less than a second in the worst case on a simple laptop. We safely assume that this figure can be divided by 10 using a dedicated and optimized code. We also assume that a credible attacker can, for example, very easily afford buying or renting 150 TILE-Gx72 multicore processors. Hence, according to the evidence exhibited in this paper, breaking a 1279 bit key takes a week using 150 currently available multicore processors (e.g. TILE-Gx72).

Conclusion

While we did not formally evaluate efficiency nor asymptotic complexities, our quick and dirty experiments clearly suffice to show that key recovery is fast and within reach. An obvious countermeasure consists of increasing parameter sizes. Hence a precise re-evaluation of parameter sizes and safety margins of the Mersenne Low Hamming Ratio Assumption seems in order. More systemic protections may consist in modifying the definition of H (and possibly the underlying cryptosystem), which is a very interesting open problem.

Nonetheless, the beautiful idea of Aggarwal, Joux, Prakash, and Santha exploiting the fact that arithmetics modulo Mersenne numbers is (somewhat) Hamming-weight preserving, is very elegant and seems very rich in possibilities and potential cryptographic applications.

Introduction

In 2017, Aggarwal, Joux, Prakash, and Santha [START_REF] Aggarwal | A new public-key cryptosystem via Mersenne numbers[END_REF][START_REF] Aggarwal | A new public-key cryptosystem via Mersenne numbers[END_REF] introduced a new publickey cryptosystem, inspired by NTRU [START_REF] Hoffstein | NTRU: A ring-based public key cryptosystem[END_REF] but conceptually much simpler, and tentatively immune to some of the most classical attacks against NTRU. Since public-key cryptosystems are relatively rare, Aggarwal et al.'s construction (henceforth AJPS-1, following [START_REF] Ferradi | Integer reconstruction public-key encryption[END_REF]) garnered much attention from the cryptographic community. In a matter of weeks, it was found that AJPS-1's initial security estimates were too optimistic, and a modified scheme with larger parameters was proposed [START_REF] Aggarwal | A new public-key cryptosystem via Mersenne numbers[END_REF]. Section 4.3.2 recalls in further details the construction and history of these cryptosystems, which we refer to as Mersenne-based cryptosystems.

In this paper, we suggest a further modification of the underlying hardness assumption, which enables the construction of similarly-elegant encryption schemes. The new assumption, dubbed "Projected Mersenne", and a corresponding public-key encryption scheme are introduced in Section 4.3.4.

Preliminaries

Notations We denote by x the Hamming weight of x, and by H n,w the set of all n-bit strings of Hamming weight h. The notation x $ ← -X means that x is the result of uniformly sampling from the set X. Unless stated otherwise, log refers to the natural logarithm, whereas log 2 to the base 2 logarithm. The symbols ⊕ and ∧ stand for the binary XOR and AND operations, respectively. We denote the concatenation of x and y by x y. A q-ary error correcting code with block length d, dimension k, and minimum Hamming distance δ will be denoted [d, k, δ] q . Algorithms are given as input the (unary) representation of the security parameter λ. PPT stands for probabilistic polynomial time

Prior Work

The Mersenne Low Hamming Ratio Assumption

Recall that a Mersenne number is an integer of the form 2 n -1 for some n, and that a Mersenne prime is a Mersenne number which is prime.8 Definition 4.4 (Mersenne Low Hamming Ratio Search Problem) Let p = 2 n -1 be a Mersenne prime. 9 Given n, w ∈ N and h ∈ Z p , find f, g ∈ Z p such that f = g = w and f /g = h mod p, under the promise that such a couple exists.

We will refer to the problem in Definition 4.4 as the MLHR problem. A brute-force attack on MLHR tries all possible couples {f, g}, which corresponds to a security level of

λ = n -1 w -1 ≈ w • log n bits.
A quantum variant of this search, exploiting the generic speed-ups provided by Grover's algorithm, correspondingly halves λ. Should these attacks be optimal -as initially suggested by Aggarwal et al. -the MLHR would enable the construction of conceptually-simple and computationallyefficient post-quantum secure public-key cryptosystems.

The Aggarwal-Joux-Prakash-Santha cryptosystem (AJPS-1)

The original AJPS-1 scheme [START_REF] Aggarwal | A new public-key cryptosystem via Mersenne numbers[END_REF] is defined by the following algorithms:

• Setup(1 λ ) → pp. Outputs the public parameters pp = {n, h}, so that in particular p = 2 n -1 is prime. The choice of n and w is such that the cryptosystem achieves some λ-bit security level.

• KeyGen(pp) → {sk, pk}. This algorithm generates the private and public keys. It samples • Dec(pp, sk, C) → {⊥, 0, 1}. This algorithm computes d ← G • C mod p and returns:

{F, G}

     0 if d ≤ 2w 2 , 1 if d ≥ n -2w 2 , ⊥ otherwise.
Table 4.1: Synoptic comparison of NTRU and AJPS-1.

NTRU [HPS98] AJPS-1 [AJPS17c]

Ciphertext space

R = Z[X]/(X N -1) R = F 2 [X]/(X p -1), p = 2 n -1 Message space m ∈ R m m ∈ {0, 1} Private key f ∈ R f F ∈ H n,w Public key h = g/f q mod q (g ∈ R g ) H = G/F (G ∈ H n,w ) Encryption c = prh + m mod q (r ∈ R r ) C = (-1) m (AH + B) (A, B ∈ H n,w ) Decryption m = f -1 p (f c mod q) mod p m =      0 if F C ≤ 2w 2 1 if F C ≥ n -2w 2 ⊥ otherwise
Remark (Similarities with the NTRU cryptosystem) Mersenne-based cryptosystems are reminiscent of NTRU [START_REF] Hoffstein | NTRU: A ring-based public key cryptosystem[END_REF], which owes its name to the polynomial ring R = Z[X]/(X N -1) in which operations are performed. 10 In comparison, Mersenne-based cryptosystems work in Z p F 2 [X]/(X p -1), where p = 2 n -1 is prime. 11 Table 4.1 shows the parallels between the two cryptosystems. Notations for NTRU follow [START_REF] Hoffstein | NTRU: A ring-based public key cryptosystem[END_REF], except R f , R g , R r , R m which are subsets of R having a prescribed number of coefficients set to ±1.

The hard problem underlying NTRU is the Closest-Vector Problem (CVP) in some special convolution modular lattices; namely, f and g form a relatively short vector in a known lattice constructed from q and h. Parameters for NTRU must be chosen to resist lattice reduction attacks (e.g., [START_REF] Coppersmith | Lattice attacks on NTRU[END_REF][START_REF] Kirchner | Revisiting lattice attacks on overstretched NTRU parameters[END_REF]).

In the original version of their paper [AJPS17c], Aggarwal et al. consider and then dismiss two possible types of attack that could be better than brute force, inspired by the crpytanalysis of NTRU: a combinatorial meet-in-the-middle attack, which is claimed to fail due to the presence of "approximate collisions"; and a lattice-based attack, claimed to fail due to the presence of "parasitic vectors".

Beunardeau-Connolly-Géraud-Naccache attack.

The latter claim was rapidly challenged, when a faster experimental attack using lattice reduction was discovered by Beunardeau et al. [START_REF] Beunardeau | On the hardness of the Mersenne low Hamming ratio assumption[END_REF], which successfully recovered private keys for the initially suggested λ = 128 bit security level parameters. This attack runs in time (2 + δ + o(1)) 2w , for some very small constant δ > 0 [dBDJdW17], thereby collapsing the security of the original AJPS construction to about 2w bits.

de Boer-Ducas-Jeffery-de Wolf attack.

The former claim was also challenged by de Boer et al. [START_REF] Koen De Boer | Attacks on the ajps mersenne-based cryptosystem[END_REF], who showed how to circumvent the "approximate collision" problem by leveraging locality-sensitive hashing. This results in a meet-in-the-middle attack, whose complexity is about

n/2 w/2 ≈ n w 1/2 ≈ 1 2 w log n.
10 NTRU stands for N -th Degree Truncated Polynomial Ring Units.

11 Bernstein et al. [START_REF] Daniel | NTRU prime[END_REF] argue against the use of such rings for NTRU.

81

A quantum version of this algorithm has a runtime of

n/3 w/3 ≈ n w 1/3 ≈ 1 6 w log n.
Pointing out similar work for the related NTRU cryptosystem [START_REF]Algorithmic Number Theory, Third International Symposium, ANTS-III[END_REF], de Boer et al. conjecture that a combination of the MITM approach with lattice reduction could lead to an even faster attack, reminiscent for instance of Howgrave-Graham's [START_REF] Howgrave-Graham | A hybrid lattice-reduction and meet-in-the-middle attack against NTRU[END_REF].

Aggarwal-Joux-Prakash-Santha with error correction (AJPS-ECC)

To answer these attacks, Aggarwal et al. proposed a new version of their cryptosystem [START_REF] Aggarwal | A new public-key cryptosystem via Mersenne numbers[END_REF].

The new version accomodates larger parameters and also improves the cryptosystem's bandwidth. As it makes use of an error correction scheme ECC = {D, E}, we refer to it as AJPS-ECC (following [START_REF] Ferradi | Integer reconstruction public-key encryption[END_REF]). The Setup algorithm is unmodified. The other algorithms are modified as follows:

• KeyGen(pp) → {sk, pk}. Sample {F, G} $ ← -H 2 n,w , R $ ← -{0, 1}
n and return:

sk ← F pk ← {R, T } = {R, F • R + G mod p} • Enc(pp, pk, m) → C. Sample {A, B 1 , B 2 } $ ← -H 3 n,w
, and compute

C ← C 1 = A • R + B 1 mod p C 2 = (A • T + B 2 mod p) ⊕ E(m)
• Dec(pp, sk, C) → {⊥, m} is modified accordingly and returns

D((F • C 1 mod p) ⊕ C 2 )
An analysis of the parameter choices for ECC and for the cryptosystem, including some additional discussion irrelevant for our purpose, can be found in Aggarwal et al's updated paper [START_REF] Aggarwal | A new public-key cryptosystem via Mersenne numbers[END_REF]. AJPS-ECC relies for security on another assumption that the hardness of MLHR search; however, Aggarwal et al. point out that slight modifications to Beunardeau et al.'s attack apply to this modified scheme and choose the parameters accordingly.

Ferradi-Naccache (AJPS-FN-BT)

An interesting collection of variants is described by Ferradi and Naccache [START_REF] Ferradi | Integer reconstruction public-key encryption[END_REF]. Noticing that some of the random coins used during encryption may be recovered, Ferradi and Naccache suggest turning this into a feature, thereby increasing the cryptosystem's bandwidth. However, the security of most of these variants is left undiscussed. The core idea can be found in Ferradi and Naccache's "bivariate" variant AJPS-FN-BT2. AJPS-FN-BT2 relies on the availability of an efficient function Solve x,y which finds a low Hamming weight solution to a given Diophantine equation of the form αx + βy + γ = 0 for given parameters α, β, γ. They suggest implementing this function as a heuristic-based backtracking algorithm. Using this, it becomes possible to recover the values A and B used during encryption, which have low Hamming weight. One possibility is to use A and B to design a key-encapsulation mechanism as follows:

• Setup and KeyGen are identical to those of AJPS-1, except that we additionally agree on a block cipher F : {0, 1} λ × {0, 1} λ → {0, 1} λ , a cryptographic hash function H 2 : {0, 1} * → {0, 1} λ , and a cryptographic hash function H 1 : {0, 1} * → H 2 n,w .

• Enc(pp, pk, m) → C is modified as follows. Sample r $ ← -{0, 1} λ and compute {A, B} ← H 1 (r m). Then compute k ← H 2 (A B). Finally, output

C = {C 1 , C 2 } = {AH + B mod p, F k (r m)} • Dec(pp, sk, C) → {⊥, m} is modified as follows: first recover {A, B} ← Solve x,y [GC 1 = F x + Gy mod p] .
In case of failure, return ⊥. Otherwise, compute k ← H 2 (A B), and recover

u ← F -1 k (C 2 ). If H 1 (u) = {A, B} then return ⊥. Otherwise return m.
The correctness of this scheme (and other variants in [START_REF] Ferradi | Integer reconstruction public-key encryption[END_REF]) is not formally analysed but is backed by numerical simulations.

The Projected-Mersenne Cryptosystem

The Projected-Mersenne Assumption

We introduce the following problem: This search problem can be solved by brute-force enumeration much like MLHR, as it suffices to find g, i.e., find one in n-1 w-1 ≈ 2 w log n possibilities. We introduce the following assumption: Definition 4.6 (α-Projected Mersenne Assumption) The α-projected Mersenne assumption 12 states that given a Mersenne prime p = 2 n -1, an integer a in poly(λ), any PPT distinguisher has a negligible chance to distinguish between R/G and R , where

R $ ← -{0, . . . , 2 α -1}, G $ ← -H n,w , and R $ ← -Z p .
where the distinguishing advantage is defined as usual: Definition 4.7 For a PPT distinguisher D that outputs a bit b ∈ {0, 1}, the distinguishing advantage to distinguish between two random variables X and Y is defined as:

∆ D (X; Y ) = |Pr[D(X) = 1] -Pr[D(Y ) = 1]| n bits n -a bits c bits b bits F = random random

Projected-Mersenne Encryption

We now describe our encyption scheme.

• Setup(1 λ ) → pp. Choose p = 2 n -1 a Mersenne prime, and parameters w, a, b, c, d so as to achieve a λ-bit security level. Additional constraints on a, b, c, d to ensure correctness are discussed below. We also agree on an error-correcting code13 ECC = (E, D) with codewords of size d bits.

• KeyGen(pp

) → {sk, pk}. Sample G $ ← -H n,w and a random a-bit number R. Let F ← R • 2 b + 2 c mod p. Note that, in general, F / ∈ H n,
D = 2 n-c Csk = 2 n-c (E(m) • H + B) • G mod p = 2 n-c E(m)F + 2 n-c BG mod p = 2 n-c E(m) • 2 b R + 2 c + 2 n-c BG mod p = E(m) + 2 n+b-c RE(m) + 2 n-c BG mod p Let M = 2 d -1, then the algorithm outputs D(M ∧ D).

Correctness

The correctness of this scheme is based upon two facts. The first is that we can appropriately choose a, b, c, d so that the first and second terms in the expanded expression of D are disjoint (as

d a + d D = E(m) 2 n+b-c RE(m)
2 n-c BG (at most w 2 bits set) M The second key fact is that BG has low Hamming weight, namely at most w 2 . This is not affected by multiplication by a power of 2, and therefore (2 n-c BD) ∧ M has Hamming weight at most η = min(d, w 2 ). 14 If E can correct at least η errors, then the decoding algorithm succeeds.15,16

Semantic Security

As described above, the cryptosystem is vulnerable to a trivial chosen ciphertext attack. Assume the attacker gets a challenge encryption C * of m b with b ∈ {0, 1} being the challenge bit she has to guess. Indeed, we get

C * = E(m) • pk + B mod p
Thanks to the knowledge of the public key she will be able to recover the randomness (and break the semantic security). She computes the encrpytion with the randomness being set to 0.

C 0 = E(m 0 ) • pk mod p C 1 = E(m 1 ) • pk mod p
She then subtract the ciphertexts:

C * -C 0 = (E(m b ) -E(m 0 )) • pk + B mod p C * -C 1 = (E(m b ) -E(m 1 )) • pk + B mod p
One of these equations is equal to B and has low hamming weight, which allows the adversary to distinguish. This phenomenon is common to other cryptosystems, such as the McEliece code-based encryption scheme. Therefore our system is inherently non CCA-secure. We can treat this problem by usign a key encapsulation mechanism which encrypts a random message, and derive the randomness used in the encryption by hashing the random message. AJPS uses the same method, but they only need it for chosen ciphertext attacks.

Key Encapsulation Mechanism

We can treat this problem by usign a key encapsulation mechanism which encrypts a random message, and derive the randomness used in the encryption by hashing the random message. Since the same is done in AJPS, we use the same notation to define KEM to ease comparison.

Definition 4.8 (Key encapsulation Mechanism)

A KEM comprises three algorithms: the key generation algorithm KeyGen, the encapsulation algorithm Encaps, and the decapsulation algorithm Decaps, and a key space K. The KeyGen algorithm outputs a public-key pk, and a secret key sk. The encapsulation algorithm Encaps takes as input a public key pk to produce a ciphertext C and a key K ∈ K. The decapsulation algorithm Decaps takes as input a ciphertext C and sk, and outputs a key K 0 or a special symbol ⊥ indicating rejection. We say that the KEM is

(1 -δ)-correct if P r[Decaps(sk, C) = K : (C, K) $ ← -Encaps(pk)] ≥ 1 -δ
, where the probability is over the randomness of pk, sk and the encapsulation algorithm. Again, we denote the security parameter by λ. All other parameters including key lengths and ciphertext size are given as polynomially bounded functions of λ.

Definition 4.9 (Key Encapsulation Mechanism Semantic Security)

The key-encapsulation mechanism (KeyGen, Encaps, Decaps) is said to be semantically secure if for any probabilistic polynomial time distinguisher, given the public key pk, the advantage for distinguishing (C, K 0 ) and (C, K 1 ), where (C, K 0 ) $ ← -Encaps(pk) and K 1 is uniform and independent of C is negligible in λ.

Definition 4.10 (KEM Semantic Security Under Chosen Ciphertext Attack)

The keyencapsulation mechanism KEM = (KeyGen, Encaps, Decaps) is said to be secure under chosen ciphertext attacks if for any probabilistic polynomial time distinguisher that is given access to the decapsulation oracle and the public key pk, the advantage for distinguishing (C, K 0 ) and (C, K 1 ), where (C, K0) $ ← -Encaps(pk) and K 1 is uniform and independent of C is negligible in λ under the assumption that the distinguisher does not query the oracle with C.

We now describe our KEM. Its purpose is to avoid encrpytion with randomness set to 0 as in the attack against our encyption scheme. To achieve this, we will get a key at random, and use it with random oracle to get randomness to encrpyt the key. Let H be a random oracle from the key space {0, 1} λ to the random tape of our encryption scheme (ie. low hamming weight numbers).

• KeyGen is the same as the encryption scheme.

• Encaps(pk) draws uniformly at random a key K, produces the ciphertext E(K) • pk + H(K) and the key K.

• Decaps(sk, C) produces the key K = Dec(sk, C), reencrypts its own randomness C = E(K ) • pk + H(K ), and checks

C = C . If C = C output ⊥, else output K.
Our KEM is trivially 1 -δ-correct with δ negligible in λ from the correctness of the encryption scheme.

Security analysis

In this section we show that the KEM's semantic security (Definition 4.9) relies on the Projected-Mersenne Assumption (Definition 4.6), and discuss the attacks that can apply to this assumption.

Semantic Security of the Key Encapsulation Mechanism

Theorem 4.1 (Semantic Security) Our KEM is semantically secure (Definition 4.9) under the a-Projected-Mersenne Assumption (Definition 4.6), with a as defined in 4.4.

Before proving Theorem 4.7 we give a few lemmas that we will use later. The main thing to prove is that the public key is indistinguishable from random, which is shown in Lemma 4.5.

Lemma 4.2 Given a PPT computable function f on two random variables X and Y , if there is no PPT distinguisher D that can distinguish between X and Y with non negligible advantage, then there is no PPTdistinguisher D that can distinguish between X and Y with non negligible advantage.

The proof of Lemma Lemma 4.2 is well known and can be found easily.

Lemma 4.3 If x ∈ Z *

p is of hamming weight 1, then x -1 is of hamming weight 1.

Proof: Since the multiplicative group Z * p is of order p -1, we have x -1 = x p-2 . Since we work modulo a Mersenne prime, multipliying by a number of hamming weight 1 is equivalent to shifting. Therefore taking the product of two numbers of hamming weight 1 is of hamming weight 1. Since x -1 is the product of numbers of hamming weight 1, it is itself of hamming weight 1. Lemma 4.4 17 Every bit of the public key is the sum of an average of a/2 bits of R omitting the contribution of the carry 18 .

Proof: First we notice that although 1/G is not random looking (as shown in [START_REF] Beunardeau | On the hardness of the Mersenne low Hamming ratio assumption[END_REF]), it has a random hamming weight (n/2 on average). Indeed 1/G = G p-2 . So its low hamming weight increases since we perform approximately n squarings to come to the inverse. Second, since R is of size a, every bit of the public key is influenced by a copy of R if a bit in the a bits preceding it is set to 1 in 1/G. Combining the two observations gives the result. for some i. Applying 4.4, with overwhelming probability19 , every additional 1 coming from 2 i /G will be in a copy of R. Since there are as many copies of R as there are 1s coming from 2 i /G (this number being ||1/G||, the hamming weight of 1/G), we can rewrite the challenge: 20 We now show that we can replace one R i by R. Since x is taken at random with overwhelming probability an R i is indistinguishable from R since their distributions are statistically close 21

chal = ||1/G|| i=0 2 ui R i for some u i with R i = R + 2 x with x $ ← -0, a -1.
. Indeed R $ ← -[0, 2 a -1] and R i $ ← -[2 x , 2 x + 2 a -1]. X is on average a/2,
← -{0, . . . , 2 a -1}, G $ ← -H n,w and R $ ← -Z p .
Proof: This is shown by applying Lemma 4.2 with f being the modular inversion.

We can now prove our main theorem.

+ ∆ D ((R, E(m)R + B); (R, R )) + ∆ D ((R, R ); (pk, R))
where pk is a public key genrated from KeyGen, m is drawn at random, B $ ← -H n,w , c = E(m)pk+B is a ciphertext, and R, R $ ← -Z p . This suffice to show the semantic security. We now have to show that the three bounding terms are negligible:

• ∆ D ((pk, c); (R, E(m)R + B)).
(X) = (R, X • R + E(m)) we get that ∆ D ((R, E(m)R + B); (R, R • R + E(m))) is negligible. By observing that R • R + E(m) is uniformly distributed, ∆ D ((R, E(m)R + B); (R, R )) is negligible. • ∆ D ((R, R ); (pk, R))
. This is shown to be negligible by Lemma 4.5 and Lemma 4.2 with

f (X) = (X, R) where R $ ← -Z p
This concludes the proof.

Chosen Ciphertext Security

We now show that security holds against chosen ciphertext (Definition 4.10). For this we only need to show that the queries will not help the adversary, and then conclude with semantic security. The key point is that the decapsulation oracle to which the adversary has access will answer with overwhelming probability ⊥ if the ciphertext are not made 'honnestly'. Since once the key is fixed and the random oracle called with it the encapsulation procedure is deterministic, the adversary can simulate it easily. Proof: There are two cases, either the random oracle was called on the answer of a query to the decapsluation mechanism, or it was not (ie. the adversary tries 'malicious' queries).

• If the adversary queries Decaps with a ciphertext, and gets K, which he queried to the random oracle, then he can simulate the query easily.

• The probability of the second event is

P r[K ← Decaps(C $ ← -Adv)] = P r[E(Dec(C)) • pk + H(K) = C $ ← -Adv]
≤ n w since it requires guessing the random oracle response. The second event is therefore negligible.

Attacks on the Underlying Assumption

Due to the similarity with AJPS, it is natural to discuss the attacks that are most efficient against it, and to measure to what extent such attacks apply to our new construction.

Lattice Attacks.

As for the other versions of Mersenne encryption Beunardeau et al.'s attack [START_REF] Beunardeau | On the hardness of the Mersenne low Hamming ratio assumption[END_REF], is also applicable to our scheme and has an experimental cost of finding the right partitions for the low hamming weight. We then set w = lambda.

Brute Force Attacks.

A brute force exhaustion of sk is always possible, and takes an effort of n-1 w-1 . Thus the bare minimum requirement for security is that this quantity exceeds 2 λ .

Meet-in-the-Middle Attacks.

The key result of de Boer et al. is backed by [dBDJdW17, Lemma 3.1], which assumes that F has constant small Hamming weigth w. Without this assumption, the likelihood that a locality-sensitive hash function H is "good" for g does not have a lower bound, so that it the meet-in-the-middle attack is no longer guaranteed to succeed. We can compare simulations from [dBDJdW17, Appendix A.1] with the same experiment on our scheme, which shows that de Boer et al.'s Heuristic 3.2, which is reasonable against AJPS-1, does not hold for our scheme.

Conclusion

Altough our scheme is vulnerable to the same attacks as AJPS, it is simpler in the sense that we do not need two ciphertexts. We hoped that the size of the random R would have twart our lattice attack. This is not the case experimentally, but since the analysis of our attack is not complete, there is still hope that our scheme is of interest. We also think that it is simpler to analyse our assumption than AJPS's.

Introduction

In this chapter, we look at non standard physical models.

In the traditional cryptographic model, the adversary called Eve is an eavesdropper, meaning that she stands between the two (or more) honest parties, and is able to hear (or intercept and modify) conversations between those parties. This is called the black box model, since every computation made by the parties are non-observable, and the result of those computations seems to come from a block box to Eve.

In Section 5.2 we look at a stronger adversary, which is able to get and modify some information from the internal computations of the parties. This model is called grey box since the information she gets is noisy.

This model is useful when cryptographic computations are done on the field as for smart cards, or IoT devices.

An even stronger model named white box was proposed more recently in 2002 in [START_REF] Chow | Whitebox cryptography and an AES implementation[END_REF]. In this model the adversary is all mighty, to model insecure execution environment, such as smart phones, but this is outside of the scope of this thesis.

In Section 5.3 we look at parties that are able to communicate using means that obeys to the laws of quantum physic. In traditional communications, the information is physically sent with a lot of redundancy, to average noise and quantum effects. An undesirable consequence is that an adversary can eavesdrop without being noticed since there is enough information to be split between the adversary and the receiver. For example, one can measure the voltage between two points in an electronic circuit, without interfering with the circuit functionality. Therefore, key exchange requires cryptographic techniques to prevent the key to be intercepted. Quantum key exchange sends keys in the clear but has so little information that anyone listening would prevent the recipient from getting the information thanks to observer effects happening in quantum mechanics. This can be achieved using optic fiber and the polarization of photons to represent the key. Then every measurement from the adversary randomly changes the polarization of the photons.

A New Differential Fault Analysis on PRIDE: from Theory to Practice

Abstract PRIDE is one of the most efficient lightweight block cipher proposed so far for connected objects with high performance and low-resource constraints. In this paper, we describe the first ever complete Differential Fault Analysis against PRIDE. We describe how fault attacks can be used against implementations of PRIDE to recover the entire encryption key. Our attack has been validated first through simulations, and then in practice on a software implementation of PRIDE running on a device that could typically be used in IoT devices. Faults have been injected using electromagnetic pulses during the PRIDE execution, and the faulty ciphertexts have been used to recover the key bits. We also discuss some countermeasures that could be used to thwart such attacks. This is joint work with Benjamin Lac, Anne Canteaut, Jacques Fournier, Renaud Sirdey. This is an extended version of a work presented at the 11 th International Conference Risks and Security of Internet and Systems, CRiSIS 2016 and published as [LBC + 16]

Introduction

With the emergence of the Internet of Things (IoT), new cryptographic primitives are needed to suit the high performance, low power and low resource constraints of IoT devices. Ciphers like AES, which are good enough for devices like smart cards, do not satisfy the constraints of devices like RFID tags or nodes in sensor networks. During the past years, several lightweight block ciphers have been proposed, like for example PRESENT [BKL + 07], PRINCE [BCG + 12], SIMON [BSS + 15] or SPECK [BSS + 15]. Among those, the NSA proposal SPECK is a highly efficient software-oriented cipher, but it does not have any 'linear diffusion layer' implying that it requires a huge number of rounds to guarantee an appropriate security level. In order to keep a small number of rounds, the PRIDE cipher [ADK + 14] exploits an optimal linear layer which provides a high diffusion and has highly efficient implementations. Although hardware implementations are more efficient in terms of clock cycles than software implementations, design and study of software-oriented ciphers is nevertheless important since these implementations are used in practice because they are less expensive and more flexible than hardware implementations. To date, when looking at software implementations, PRIDE is one of the most efficient lightweight cryptographic ciphers as shown the performance comparisons given in [ADK + 14, BS15]. This led us to study the security provided by PRIDE and its resistance to malicious attacks. In terms of security, two of the differential attacks proposed so far in the literature do not allow to recover the entire key [YHS + 15, ZWWD14], while a third one [START_REF] Dai | Cryptanalysis of full PRIDE block cipher[END_REF] does achieve this but under stringent conditions. Since PRIDE is to be used in IoT devices in pervasive environments, we ought to also look at implementation-related issues. In that respect, we propose in this paper the first Differential Fault Analysis (DFA) on PRIDE. DFA is a particular physical attack, in which we compare the results of a correct computation to one which has been disturbed at a precise time, in order to infer information about the key bits used in the algorithm. It is closely related to differential cryptanalysis, but much more efficient since it exploits differential characteristics on very few rounds only.

In this paper, we first present PRIDE before describing the theoretical DFA using different fault models. We then validate our hypotheses and equations using data onto which fault models have been 'simulated'. In order to validate the practical feasibility of our attack, we used electromagnetic pulses to inject faults during the execution of the PRIDE cipher running on an off-the-shelf chip embedding an ARM Cortex-M3 micro-controller and applied our DFA on the corrupted results obtained. So as to taking advantage of the 32-bit architecture of the micro-controller, we have implemented PRIDE in ARM assembly language. Thereby, we show the practical feasibility of our attack from 32-bit random faults. Finally, we discuss countermeasures that can be implemented to thwart such attacks before concluding the paper with some perspectives.

Fault attacks against cryptographic algorithms

Physical attacks

Unlike mathematical attacks which target the actual definition of a cryptographic cipher, physical attacks target the way the cipher is implemented. Physical attacks can be divided into two categories: invasive and non-invasive ones. In this paper, we further focus on non-invasive techniques which mainly consist either in analysing side-channel information leakages or in injecting faults during a cryptographic computation.

Side-Channel Analyses [START_REF] Koeune | A tutorial on physical security and side-channel attacks[END_REF], [START_REF] Mangard | Power analysis attacksrevealing the secrets of smart cards[END_REF] exploit the fact that some physical values or "side channels" such as the power consumption [START_REF] Paul | Differential power analysis[END_REF], the electromagnetic radiation [START_REF] Gandolfi | Electromagnetic analysis: Concrete results[END_REF], [START_REF] Quisquater | Electromagnetic analysis (EMA): measures and counter-measures for smart cards[END_REF] or the computation time [DKL + 98], [START_REF] Paul | Timing attacks on implementations of Diffie-Hellman, RSA, DSS, and other systems[END_REF] of an integrated circuit depends on the operations and data manipulated during a given computation. Information about the internal processes of the chip and the data it is manipulating can be derived by observing such external physical characteristics. Such analyses can be quickly mounted with cheap equipment, without altering the physical integrity of the circuit. This dependency between the side channels and the internal computations can be analysed to infer information about the data manipulated using mathematical tools like correlation [START_REF] Brier | Correlation power analysis with a leakage model[END_REF], mutual information [START_REF] Gierlichs | Mutual information analysis[END_REF], variance [MDF + 09] or entropy [START_REF] Maghrebi | Entropy-based power attack[END_REF] or using architecture-dependant behaviors such as cache accesses [BZB + 05], [START_REF] Page | Theoretical use of cache memory as a cryptanalytic side-channel[END_REF][START_REF] Page | Defending against cache based side-channel attacks[END_REF] or branch predictions [AeKKS07, AKS07].

Fault attacks

Fault Attacks, introduced in [BDL97], consist in disturbing the behavior of the circuit in order to alter the correct progress of the cipher. The faults are injected into the device by various means such as light pulses [START_REF] Skorobogatov | Optical fault induction attacks[END_REF], laser [START_REF] Skorobogatov | Semi-invasive attacks -A new approach to hardware security analysis[END_REF], clock glitches [ADN + 10], spikes on the voltage supply [START_REF] Blömer | Fault based cryptanalysis of the advanced encryption standard (AES)[END_REF] or electromagnetic (EM) perturbations [START_REF] Dehbaoui | Electromagnetic transient faults injection on a hardware and a software implementations of AES[END_REF]. Some of those techniques, like the one using a laser, are invasive requiring the "decapsulation" of the chip using mechanical or chemical means. Lasers allow to target one bit in a given register if well manipulated. However, it is a very costly means of injection. Other techniques are not invasive such as glitches (power, clock, electromagnetic). Clock and voltage glitches disturb the whole component, and many injections have to be made before getting the faults required by theoretical attacks. EM glitches, on the other hand, allow having relatively high spatial and temporal precisions using equipment at "affordable costs" [START_REF] Dehbaoui | Electromagnetic transient faults injection on a hardware and a software implementations of AES[END_REF].

One of the objectives of fault attacks, especially when considering cryptographic ciphers, is to perform a Differential Fault Analysis (DFA). DFA, originally described in [START_REF] Biham | Differential fault analysis of secret key cryptosystems[END_REF], consists in retrieving a cryptographic key by comparing the correct ciphertexts with the faulty ones. DFA techniques have been described and applied to most publicly known cryptographic ciphers going from symmetric-key algorithms like the DES [START_REF] Biham | Differential fault analysis of secret key cryptosystems[END_REF] or the AES [START_REF] Sakiyama | Informationtheoretic approach to optimal differential fault analysis[END_REF] to asymmetric algorithms like RSA [START_REF] Boneh | On the importance of checking cryptographic protocols for faults (extended abstract)[END_REF] or even more complex schemes like pairing-based cryptography [START_REF] Lashermes | Inverting the final exponentiation of Tate pairings on ordinary elliptic curves using faults[END_REF]. In the particular field of lightweight cryptography, differential fault attacks have been proposed against ciphers like PRESENT [ZWG11] (used in conjunction with a cube attack), SPECK [START_REF] Tupsamudre | Differential fault analysis on the families of SIMON and SPECK ciphers[END_REF] (although about a hundred faults are needed which is way more than usual), TRIVIUM [START_REF] Saied | Using SAT solving to improve differential fault analysis of trivium[END_REF] or PRINCE [START_REF] Song | Differential fault attack on the PRINCE block cipher[END_REF]. The latter PRINCE block cipher has an SPN structure similar to PRIDE, and in that respect, the DFA proposed in [START_REF] Song | Differential fault attack on the PRINCE block cipher[END_REF] is quite similar to the one proposed hereafter: in our case, the attack is not only adapted to the PRIDE cipher but has also been validated in practice on an embedded device running PRIDE.

DFA techniques are very efficient in retrieving the keys used during a cryptographic computation, usually requiring a few executions only. It is also quite complex to devise physical countermeasures against such attacks because of the diversity of the possible injection methods and because the usually deployed countermeasures (like masking, redundancy, error-correcting codes etc) have a serious impact on the performance of the targeted cryptographic cipher. For all those reasons, in our approach of analysing the security of implementations of PRIDE, we decided to first focus on its resistance against fault attacks in order to identify possible attack paths and devise the most efficient countermeasures in order to keep the high performance characteristics of the original cipher. + 14] in 2014. It takes as input a 64-bit block and uses a 128-bit key k = k 0 ||k 1 . The first 64 bits k 0 are used for pre-and post-whitening. The last 64 bits k 1 are used by a key schedule to produce the subkeys f r (k 1 ) for each round r. The key schedule simply adds round-constants to parts of the key.

The PRIDE block cipher

PRIDE is an iterative block cipher composed of 20 rounds and introduced by Albrecht & al. [ADK

We denote k 1i the i-th byte of k 1 then

f r (k 1 ) = k 10 ||g (0) r (k 11 )||k 12 ||g (1) r (k 13 )||k 14 ||g (2) r (k 15 )||k 16 ||g (3) r (k 17 )
for round r with

g (0) r (x) =(x + 193r) mod 256
g (1) r (x) =(x + 165r) mod 256
g (2)
r (x) =(x + 81r) mod 256

g (3) r (x) =(x + 197r) mod 256
In this paper, X[n] denotes the n-th nibble (4 bits) of a binary word X while X{b} denotes its b-th bit. Moreover, the bits and nibbles are numbered from left to right starting from 0. The following notation is used for the intermediate values of the state within the round function R of PRIDE (see Figure 5.2): I r the input of the r-th round X r the state after the key addition layer of the r-th round Y r the state after the substitution layer of the r-th round input Z r the state after the permutation layer of the r-th round W r the state after the matrix layer of the r-th round O r the output of the r-th round

The r-th round, 1 ≤ r ≤ 19, of PRIDE is then composed of the following steps (see Figure 5.2). i. Apply the inverse permutation layer P -1 given in Appendix 5.2.8.1 to f r (k 1 ) and XOR the permuted round subkey to the input state: X r = I r ⊕ P -1 (f r (k 1 )),

ii. Apply the S-box S given in Table 5.1 to each of the 16 nibbles of X r (i.e. apply the substitution layer S-layer to X r ): Y r = S-layer(X r ),

iii. Apply the permutation layer P to Y r : Z r = P(Y r ), iv. Multiply vector

   Z r {16i} . . . Z r {16i + 15}    by L i in Appendix 5.2.8.1 for i ∈ {0, • • • , 3}: W r = L 0    Z r {0} . . . Z r {15}    ||L 1    Z r {16} . . . Z r {31}    ||L 2    Z r {32} . . . Z r {47}    ||L 3    Z r {48} . . . Z r {63}   , v.
Apply the inverse permutation P -1 to W r : O r = P -1 (W r ). For the final round, denoted by R , only the first two steps are applied.

In order to encrypt a plaintext M , the cipher applies P -1 to M , then performs an XOR between the result and k 0 . It then applies the 20 rounds as previously described and performs an XOR with k 0 again. Finally, P is applied to the result to obtain the ciphertext C. Figure 5.1 shows the general structure of PRIDE.

M P -1 R ⊕ k 0 f 1 (k 1 ) R f 2 (k 1 ) R f 19 (k 1 ) R f 20 (k 1 ) ⊕ k 0 P C

Differential Fault Analysis of PRIDE

In this subsection, we present a technique adapted from the proposed attack in [START_REF] Song | Differential fault attack on the PRINCE block cipher[END_REF] to retrieve the secret key using fault injections on PRIDE computations. Our analysis aims at minimizing the number of fault injections needed. We use ideal fault models, and we describe how to exploit them to retrieve the key.

General principle

Despite their similarities, a DFA is different from a classical differential analysis. Indeed, for the latter, the differences must be injected into the input of the cipher while for a DFA they can be injected whenever the attacker wants. The DFA that we propose in this paper also differs from most classical DFA since it is not based on statistical methods: it is deterministic. The attack is composed of two stages, one consists in corrupting data manipulated in the penultimate round to retrieve k 0 and the other in attacking the antepenultimate round to retrieve The general structure of the attack is to exploit the diffusion of a 16-bit word within the inverse permutation layer in order to get a known 4-bit difference at the input of each S-box on the following round. Together with the knowledge of the output difference of each S-box, which are derived from the correct and faulty ciphertexts, C and C * , this allows us to retrieve information about the key. To this end, we exploit the difference distribution table of the PRIDE S-box given in Appendix 5.2.8.2. Indeed, obtaining information on k 0 is possible from the following equation:

S S S S S S S S S S S S S S S S R R I r P -1 (f r (k 1 )) X r Y r P Z r W r P -1 O r L 0 L 1 L 2 L 3
∆X 20 = S-layer -1 (P -1 (C) ⊕ k 0 ) ⊕ S-layer -1 (P -1 (C * ) ⊕ k 0 ),
where S-layer = S-layer -1 denotes the substitution layer. We can use this equation for each nibble 0 ≤ i ≤ 15:

x = P -1 (C)[i] ⊕ k 0 [i] and y = P -1 (C * )[i] ⊕ k 0 [i] satisfy x ⊕ y = ∆Y 20 [i] = P -1 (∆C)[i] and S -1 (x) ⊕ S -1 (y) = ∆X 20 [i].
From the knowledge of a nonzero input difference ∆Y 20 [i] and of an output difference ∆X 20 [i] for S -1 , we deduce 2 or 4 candidates for the input value x, because the differential uniformity of S be two differentials with a 1 = a 2 such that the system of two equations

S(x ⊕ a 1 ) ⊕ S(x) = b 1 (5.1) S(x ⊕ a 2 ) ⊕ S(x) = b 2 (5.2)
has at least two solutions. Then, each of the three equations (5.1), (5.2) and

S(x ⊕ a 1 ⊕ a 2 ) ⊕ S(x) = b 1 ⊕ b 2
has at least four solutions.

In other words, if we can find two differentials (a 1 , b 1 ) and (a 2 , b 2 ) such that one out of the three entries in the difference distribution table (a 1 , b 1 ), (a 2 , b 2 ) and (a 1 ⊕ a 2 , b 1 ⊕ b 2 ) equals to 2, then we can guarantee that the input satisfying these two differentials simultaneously is unique.

Note: if one of the three equations does not have any solution, then the system of two equations (5.1) and (5.2) does not have any solution neither.

Once k 0 has been recovered (we will see in the next parts some strategies to achieve this end), X 20 and X * 20 can be computed from the ciphertexts C and C * . Let L denote the whole linear layer, i.e.,

L = P -1 •     L 0 0 0 0 0 L 1 0 0 0 0 L 2 0 0 0 0 L 3     • P.
Then ∆Y 19 can be computed and the following equation

∆X 19 = S-layer -1 (L -1 (S-layer -1 (P -1 (C) ⊕ k 0 ) ⊕ P -1 (f 20 (k 1 )))) ⊕S-layer -1 (L -1 (S-layer -1 (P -1 (C * ) ⊕ k 0 ) ⊕ P -1 (f 20 (k 1 )))),
allows the attacker to recover P -1 (f 20 (k 1 )) and therefore k 1 , with the same method but from fault injections in the 18-th round. Indeed, for 0 ≤ i ≤ 15:

x = L -1 (S-layer -1 (P -1 (C) ⊕ k 0 ) ⊕ P -1 (f 20 (k 1 )))[i] and y = L -1 (S-layer -1 (P -1 (C * ) ⊕ k 0 ) ⊕ P -1 (f 20 (k 1 )))[i] satisfy x ⊕ y = ∆Y 19 [i] = L -1 (S-layer -1 (P -1 (C ⊕ k 0 )) ⊕ S-layer -1 (P -1 (C * ⊕ k 0 )))[i]
and S -1 (x) ⊕ S -1 (y) = ∆X 19 [i].

Ideal fault model

The strategies we propose require at least 2 fault injections for each stage of the attack to retrieve a round key (i.e 4 to retrieve the complete key). For the first stage, whose objective is to find k 0 , one of the following approaches can be used:

(i.) Flip Z 0 19 then Z 3 19 or (ii.) Flip W 0 19 then W 3 19 ,
where Z i r (resp. W i r ) denotes the input (resp. output) of the matrix L i at round r. Then, to retrieve the key k 1 , and so the complete key, the possible fault injections are the same but are carried out on Z 18 or W 18 . A flip of Z 0 r gives us a difference equal to 0xffff on the input of the matrix L 0 . The matrix being linear, we know that the output difference is also 0xffff. The latter being the same value than the one obtained with a flip of W 0 r . The other matrices have differences in input and output equal to zero. Then, the inverse permutation layer also being linear, we know the input difference of each S-box of the substitution layer at round r + 1. These values are equal to 0x8, so we obtain ∆X r+1 [i] = 0x8 for all i ∈ {0, • • • , 15}. Moreover, we recall that the output differences are known from the correct and faulty ciphertexts. propagation of the difference (displayed in red) obtained by a flip of Z 0 19 . In the same way, a flip of Z 3 r or W 3 r yields a difference of 0x1 on each S-box at round r + 1. Finally, with strategy (i.) or (ii.), we obtain pairs of differentials (∆Y

⊕ 0 0 ⊕ 0 1 ⊕ 1 1 ⊕ 1 1 ⊕ 1 1 ⊕ 1 1 ⊕ 1 1 ⊕ 1 1 ⊕ 1 1 ⊕ 1 1 ⊕ 1 1 ⊕ 1 1 ⊕ 1 1 ⊕ 1 1 ⊕ 1 1 ⊕ 1 1 ⊕ 1 1 ⊕ 1 Figure
20 [i], ∆X 20 [i]) 1 = (a 1 , 0x1) and (∆Y 20 [i], ∆X 20 [i]) 2 = (a 2 , 0x8) for all i ∈ {0, • • • , 15}
with a 1 and a 2 known. We get the same pairs for (∆Y 19 [i], ∆X 19 [i]) from faults on the 18-th round. Since 0x1⊕0x8 = 0x9, from the Proposition 5.1 (and the difference distribution table in Appendix 5.2.8.2), there is only one element in the intersection of the two sets of solutions obtained for each nibble. Therefore, we have shown that we get only one candidate for each nibble of x = P -1 (C) ⊕ k 0 from faults on the 19-th round and one candidate for each nibble of

x = L -1 (S-layer -1 (P -1 (C) ⊕ k 0 ) ⊕ P -1 (f 20 (k 1 )))[i].
Finally, from the knowledge of C we retrieve k 0 and from the key schedule, we retrieve k 1 .

The strategies we have presented require 4 fault injections to retrieve the complete key. In case the attacker obtains fewer faults, Table 5.2 shows the time complexity, expressed as a number of encryptions, that an attacker can obtain to retrieve the secret key k with 1 to 3 faults following the ideal fault model. A proof of these values is given in Appendix 5.2.8.5.

Random fault model

In order to achieve the attack, we must flip all the bits of four 16-bit words for the ideal fault model used in the preceding part. However, we can see that reversing one bit provides an active S-box, it is, therefore, enough to inverse all the bits of the desired 16-bit words. Indeed, if we flip the bit i of W 0 19 from one fault, we obtain 4 candidates for the nibble i of the subkey k 0 . Moreover, if we flip the bit i of W 3 19 from another fault, we retrieve (by intersection) the value of the nibble i of k 0 .

It is easy to target a specific instruction from a simple power (or EM) analysis for example in practice. If the instruction is less than 16 bits, we can then reduce the key space from each active S-box, until it is small enough for an exhaustive search. Finally, we will see in the subsection 5 that the attack is still effective from 32-bit faults, only the exploitation of the faults is different.

Properties exploited by our attack

Our attack mainly exploits two properties of the building-blocks of PRIDE:

The design of the linear layer based on the so-called interleaved construction. Indeed, this construction aims at designing a diffusion layer with a high branch number (see Theorem 1 in [ADK + 14]). For a SPN whose substitution layer is composed of n S-boxes over F k 2 , the linear layer obtained by the interleaved construction is defined as L = P -1 • L • P where P is an isomorphism from (F k 2 ) n into (F n 2 ) k . Then, we deduce from the definition of P that flipping the n bits of any word at the input of P -1 in W = (W 1 , • • • , W k ) activates all S-boxes in the next round. Indeed, by construction, the n bits of any W i go to different S-boxes. Hence flipping n consecutive bits in the linear layer of the penultimate round allows the attacker to recover information on all the n nibbles of the subkey used in the last round. The number of candidates for this last-round subkey is upper-bounded by δ(S) n , where δ(S) is the differential-uniformity of the S-box (δ(S) = 4 in the case of PRIDE and of most block ciphers using 4-bit S-boxes).

The differential properties of the S-box, which avoids the existence of differentials with high probability over a large number of rounds. The counterpart of this resistance against classical differential cryptanalysis is that the number of inputs which satisfy two valid differentials simultaneously is usually reduced to a single element. This property enables the attacker to drastically reduce the number of subkey candidates. In the case of PRIDE, two faults, each on n consecutive bits in the linear layer, are enough to obtain a single candidate for the subkey.

Simulation of the DFA on PRIDE

In order to validate our theoretical DFA against PRIDE and test the correctness of the proposed equations, we performed a validation by simulation.

In this section we assume that a device executes PRIDE with a key k = k 0 ||k 1 where k 0 = 0xefcdab8967452301 and k 1 = 0x0123456789abcdef. We further assume that an attacker successfully flips all the bits of Z 0 19 , Z 3 19 , W 0 18 and W 3 18 . Then, she obtains the following ciphertexts from 5 executions of the same plaintext 0xfed-cba9876543210: i. 0xc40f2551f39c63a9 the correct ciphertext, ii. 0xe7f325510dc3b7a8, 0xc40fdaaec89376f7 from a flip of Z 0 19 , Z 3 19 ,

iii. 0x2857589433cbdead, 0x461720d9729c1956 from a flip of W 0 18 , W 3 18 .

The knowledge of the plaintext is not necessary, it is sufficient to ensure that the same plaintext is used for each execution. 1 The attacker obtains the following differentials for the last substitution layer from the first two faulty ciphertexts:

i. (∆X 20 , ∆Y 20 ) 1 = (0x8888888888888888, 0x33a323a88a8aaa23), ii. (∆X 20 , ∆Y 20 ) 2 = (0x1111111111111111, 0x4467656745457776).
From the first differential, she obtains a set of candidates for each nibble of P -1 (C) ⊕ k 0 where C is the correct ciphertext. She can then sectioned a set of candidates for each nibble of k 0 from P -1 (C) = 0xab720c373416ba8d. Table 5.3 shows the obtained sets of candidates.

, ∆Y 20 ) 1 k0[0] k0[1] k0[2] k0[3] k0[4] k0[5] k0[6] k0[7] k0[8] k0[9] k0[10] k0[11] k0[12] k0[13] k0[14] k0[15] 0x5 0x4 0x4 0x5 0x0 0x0 0x0 0x1 0x5 0x5 0x4 0x5 0x0 0x1 0x0 0x1 0x6 0x7 0x6 0x6 0x2 0x3 0x2 0x2 0x6 0x7 0x7 0x7 0x2 0x3 0x2 0x2 0xd 0xc 0xc 0xd 0x8 0x8 0x8 0x9 0xd 0xd 0xc 0xd 0x8 0x9 0x8 0x9 0xe 0xf 0xe 0xe 0xa 0xb 0xa 0xa 0xe 0xf 0xf 0xf 0xa 0xb 0xa 0xa
From the last differential, the attacker obtains another set of candidates for each nibble of k 0 . Table 5.4 shows the resulting candidates.

) 2 k0[0] k0[1] k0[2] k0[3] k0[4] k0[5] k0[6] k0[7] k0[8] k0[9] k0[10] k0[11] k0[12] k0[13] k0[14] k0[15] 0xa 0xa 0xa 0xa 0xa 0xa 0x8 0x8 0x2 0x2 0x0 0x0 0x2 0x2 0x0 0x0 0xb 0xb 0xb 0xb 0xb 0xb 0x9 0x9 0x3 0x3 0x1 0x1 0x3 0x3 0x1 0x1 0xe 0xe 0xc 0xc 0xc 0xe 0xe 0xe 0x6 0x6 0x4 0x4 0x4 0x4 0x6 0x6 0xf 0xf 0xd 0xd 0xd 0xf 0xf 0xf 0x7 0x7 0x5 0x5 0x5 0x5 0x7 0x7
By doing the intersection of the obtained two sets for each nibble, the attacker gets k 0 . Then, with this value of k 0 , she obtains the following differences for the antepenultimate substitution layer from the flip of W 0 18 and W 3 18

: i. (∆X 19 , ∆Y 19 ) 1 = (0x8888888888888888, 0x23a2288338832828), ii. (∆X 19 , ∆Y 19 ) 2 = (0x1111111111111111, 0x7777456474776476).
From the first differential, she obtains sets of candidates for each nibble Nib i of L -1 (S( 5.5 shows the sets of candidates she gets. From the last differential, the attacker obtains other sets of candidates for each nibble Nib i of 5.6 shows the sets of candidates obtained. By intersecting the obtained two sets for each nibble, the attacker gets

P -1 (C)⊕ k 0 ) ⊕ P -1 (f 20 (k 1 ))) with i ∈ {0, • • • , 15}. Table
L -1 (S(P -1 (C) ⊕ k 0 ) ⊕ P -1 (f 20 (k 1 ))) with i ∈ {0, • • • , 15}. Table
L -1 (S(P -1 (C) ⊕ k 0 ) ⊕ P -1 (f 20 (k 1 ))) = 0x8f9806d4f5efa58d.
Then, she computes

S(P -1 (C) ⊕ k 0 ) ⊕ P -1 (f 20 (k 1 )) = 0x24c39cc978f41dd4
and from S(P -1 (C) ⊕ k 0 ) = 0x11c3a9c65f5f772b, she retrieves

P -1 (f 20 (k 1 )) = 0x3500350f27ab6aff.
finally she deduces f 20 (k 1 ) = 0x0137454b89ffcd53, she gets k 1 from the key scheduling and so she retrieves the complete key.

Practical implementation of the DFA on PRIDE

In order to test the feasibility of our attack against the PRIDE block cipher, we have implemented and run the cipher on an STM32 chip embedding an ARM Cortex-M3 micro-controller. That particular chip was chosen because it is quite representative of the off-the-shelf devices used for IoT applications. Note that the chip does not embed any countermeasures against the kind of the fault attacks implemented in this paper. We validated the attack on an implementation in ARM assembly language taking advantage of the 32-bit architecture of the micro-controller. We present in this section the full analysis conducted on this implementation. The source code is given in Appendix 5.2.8.6, and Table 5.7 compares the performances of this implementation with that of the implementation in AVR assembly language whose source code and performances are given in [ADK + 14]. So as to inject exploitable faults into such a chip, we used EM pulses because with this approach we did not need to decapsulate the chip and we were able to inject faults at precise enough instants to target specific instructions of the cipher during its execution. The set-up we used is quite similar to the one described in [START_REF] Dehbaoui | Electromagnetic transient faults injection on a hardware and a software implementations of AES[END_REF], with the difference that we did not need any motorized X-Y stage: injecting faults 'in the center' of the chip was good enough for having a fault model close to a random fault model (one chance over two to flip a bit). Indeed, it is possible to target a precise 32-bit word (more precisely a specific instruction), but the injected faults follow a random pattern. In order to obtain pairs of differentials (∆X

20 [i], ∆Y 20 [i]) (resp. (∆X 19 [i], ∆Y 19 [i])) for i ∈ {0, • • • , 15}
, we injected the faults on the first and the second 32-bit word of the state before the inverse permutation in the 19-th (resp. 18-th) round; injecting as many faults as necessary. Each fault on the first word provided us differences on each nibble of ∆X 20 equal to 0x0, 0x4, 0x8 or 0xc and equal to 0x0, 0x1, 0x2 or 0x3 from each fault on the second word. We validated the attack from these 32-bit faults, we will see that the faults exploitation is different (some pairs of differentials do not allow us a single candidate) but the attack is nevertheless still effective.

In our experiment, we used a key k = k 0 ||k 1 where k 0 = 0xf3f721cb1c882658 and k 1 = 0xe417d148e239ca5d. The plaintext used for all executions was 0x0132546 798badcfe and the correct ciphertext was 0x9aecb37ea45a6c89. We used a simple EM analysis to identify in time the 18-th and 19-th rounds. figure 5.4 shows the curve obtained on the oscilloscope and the 20 rounds are displayed in red. Then we used an electromagnetic pulse generator to disrupt the PRIDE's execution. Table 5.8 (resp. Table 5.9) shows the faults we have obtained from the electromagnetic injection on W 19 (resp. W 18 ) numbered from 1 to 25. For each fault, Table 5.8 (resp. Table 5.9) provides the value of ∆X 20 and ∆Y 20 (resp. ∆X 19 and ∆Y 19 ), only obtained from the correct and the faulty ciphertexts. We denote respectively by θ, β, γ, δ the possible pair of values (0x2,0x3), (0x4,0x8), (0x4,0xc), (0x8,0xc). Indeed, some differences in the output of the S-boxes can be obtained from two distinct differences in input. Finally, we give in each table the fault value computed after retrieving the key.

Remark Out of 2,000 shots, we don't get any cipher for 1,219 cases and we get 247 faulty ciphers including 13 exploitable (i.e. which satisfied the conditions for our DFA). Non exploitable faulty ciphers came from a dysfunction of the UART due to the faults.

We now give, among the obtained faults, those that give as much information as all faults and all sets of candidates that we can extract from each fault. Table 5.10 shows all sets of candidates obtained for each nibble of k 0 from the differentials (∆Y 20 , ∆X 20 ) and with P -1 (C) = 0xe17c93c49ec6fc61 where C is the correct ciphertext. Symbol ∅ means that the fault does not provide any information about the nibble (i.e. the 16 values are possible).

We eventually get 4 possible values for k 0 with k 0 [8] ∈ {0x0, 0x1} and k 0 [10] ∈ {0x8, 0x9}. In order to reduce the number of possible keys, we then used faulty ciphers obtained from fault Table 5.10: Sets of candidates obtained from (∆Y 20 , ∆X 20 )

No. k0[0] k0[1] k0[2] k0[3] k0[4] k0[5] k0[6] k0[7] k0[8] k0[9] k0[10] k0[11] k0[12] k0[13] k0[14] k0[15] 1 0x0 ∅ ∅ ∅ 0x2 ∅ ∅ ∅ 0x0 0x2 0x8 ∅ 0x2 ∅ ∅ 0x4 0x1 0x3 0x1 0x3 0x9 0x3 0x5 0xe 0x4 0x6 0xc 0xc 0x4 0x8 0xf 0x5 0x7 0xd 0xd 0x5 0x9 3 0x0 0x2 ∅ ∅ ∅ ∅ ∅ 0x0 0x1 0x0 0x1 0x8 ∅ ∅ ∅ ∅ ∅ ∅ 0x1 0x3 0x2 0x3 0x2 0x3 0x9 0xe 0x6 0x8 0x9 0x8 0x9 0xc 0xf 0x7 0xa 0xb 0xa 0xb 0xd 6 ∅ ∅ ∅ ∅ ∅ ∅ ∅ ∅ 0x0 0x1 0x8 0x0 0x1 0x0 0x1 0x0 0x1 ∅ 0x4 0x5 0x4 0x2 0x3 0x9 0x2 0x3 0x2 0x3 0x2 0x3 0x6 0x7 0x5 0x8 0x9 0xc 0x8 0x9 0x8 0x9 0x8 0x9 0xc 0xd 0x8 0xa 0xb 0xd 0xa 0xb 0xa 0xb 0xa 0xb 0xe 0xf 0x9 8 0x0 0x0 0x1 0x4 0x5 0x0 0x0 0x1 0x0 0x8 0x4 ∅ 0x2 ∅ ∅ 0x2 0x6 0x4 0x8 0x1 0x2 0x3 0x6 0x7 0x1 0x2 0x3 0x1 0x9 0x5 0x3 0x3 0x7 0x5 0x9 0xe 0x8 0x9 0xc 0xd 0x6 0x8 0x9 0xe 0xc 0xa 0xc 0x4 0xa 0xa 0xe 0xf 0xa 0xb 0xe 0xf 0x7 0xa 0xb 0xf 0xd 0xb 0xd 0x5 0xb 0xb 0xf 11 ∅ 0x1 0x1 0x4 ∅ 0x4 0xa 0x5 0x2 0x3 0x8 0x2 0x0 0x6 0x1 0x6 0x0 0xb 0x1 0x7 0x4 0x4 0x9 0x7 0x1 0x9 0x8 0x2 0x9 0x5 0x8 0xe 0xf 0xb 0xb 0x6 0xc 0xb 0x6 0xb 0xc 0x9 0xb 0x9 0xd 0xf 0xd 0xd 0x9 0xd 0xe 0x7 0xc 0xa 0xc 0xc 0xf 0xb 0xe 0xe 12 0x3 0x1 0x0 ∅ ∅ ∅ ∅ ∅ ∅ ∅ ∅ 0x5 0x3 0x2 0x2 0x1 0x2 0x7 0x4 0x5 0x7 0x4 0x7 0x7 0x7 0x9 0x6 0x7 0xc 0xb 0x8 0xc 0xb 0xd 0x9 0xd 0xd 0xe 0xe 0xf 0xb 0xf
Indeed, from the faulty ciphertext 0xf24690de8df8cc89 obtained from a fault on W 18 , we obtain the 4 following values for ∆Y 19 for each possible value of k 0 :

k 0 f3f721cb0c882658 f3f721cb0c982658 f3f721cb1c882658 f3f721cb1c982658 ∆Y 19 0xc000009022000000 0xe000009022220000 0xc00000b000000000 0xe00000b000220000
and since we know that we injected faults on the last 32 bits of W 18 , we know that each nibble of ∆X 19 is either 0x0, 0x1, 0x2 or 0x3. From the difference distribution table of the S-box, we see that an input difference equal to 0x1, 0x2 or 0x3 can lead to an output difference in {0x4, 0x5, 0x6, 0x7, 0x8, 0xb, 0xc, 0xd, 0xe, 0xf} only. Consequently, we retrieve k 0 (displayed in red).

Then, Table 5.11 shows all sets of candidates obtained for each nibble Nib i of L -1 (S(P -1 (C) ⊕ k 0 ) ⊕ P -1 (f 20 (k 1 ))) with i ∈ {0, • • • , 15}, from differentials (∆Y 19 , ∆X 19 ). We again denote by ∅ when the fault does not provide any information about the nibble (i.e. the 16 values are possible).

Finally, by intersecting sets for each nibble, we deduce 8 candidates for k 1 from k 0 and C and we retrieve the correct value of k by testing all. With this we provide, to the best of our knowledge, the first practical validation of a DFA against PRIDE, even against any lightweight SPN-block cipher.

Remark We observed that injecting 32-bit random faults allows us to have lower complexity than with 16-bit random faults. Indeed, although the differential pairs obtained do not always provide a single candidate in the case of 32-bit faults, the probability to obtain a differential is greater than with 16-bit faults. Finally, we showed that flipping one bit give us a known difference on a nibble, nd so we canlead the attack with faults from 1 to 32 bits.

Countermeasures

In this section, we present and briefly analyze three possible countermeasures. This list of countermeasures is not exhaustive, and any combination of those three can be used in practice to thwart the DFA proposed in this paper.

) No. Nib0 Nib1 Nib2 Nib3 Nib4 Nib5 Nib6 Nib7 Nib8 Nib9 Nib10 Nib11 Nib12 Nib13 Nib14 Nib15 16 ∅ 0x2 ∅ 0x8 0x8 ∅ ∅ ∅ 0x4 0x5 0xa 0x6 0x0 0x1 0x0 0x0 0x1 ∅ 0x0 0x1 0x3 0x9 0x9 0x6 0x7 0xb 0x7 0x2 0x3 0x1 0x2 0x3 0x2 0x3 0x6 0xe 0xe 0xc 0xd 0xc 0xa 0x8 0x9 0x4 0x8 0x9 0x8 0x9 0x7 0xf 0xf 0xe 0xf 0xd 0xb 0xa 0xb 0x5 0xa 0xb 0xa 0xb 17 ∅ 0x2 ∅ 0x4 0x5 0x4 0x5 ∅ ∅ ∅ ∅ 0x6 ∅ 0x2 0x0 ∅ ∅ ∅ 0x3 0x6 0x7 0x6 0x7 0x7 0x3 0x1 0xa 0xc 0xd 0xc 0xd 0xa 0xa 0xe 0xb 0xe 0xf 0xe 0xf 0xb 0xb 0xf 18 0x4 ∅ 0x0 ∅ ∅ 0x0 0x1 0x4 0x5 0x4 0x5 0x4 0x5 ∅ 0x6 ∅ ∅ 0x0 0x1 0x0 0x1 0x0 0x1 0x5 0x1 0x2 0x3 0x6 0x7 0x6 0x7 0x6 0x7 0x7 0x2 0x3 0x2 0x3 0x2 0x3 0x8 0xe 0x8 0x9 0xc 0xd 0xc 0xd 0xc 0xd 0xa 0x8 0x9 0x8 0x9 0x8 0x9 0x9 0xf 0xa 0xb 0xe 0xf 0xe 0xf 0xe 0xf 0xb 0xa 0xb 0xa 0xb 0xa 0xb 20 ∅ ∅ 0x0 0x1 0x1 ∅ 0x3 0x5 0x3 0x0 0x2 0x2 0x3 0x2 0x6 0x6 0x6 0x0 0x1 0x5 0x4 0x0 0x7 0x3 0xa 0x4 0x6 0xa 0xd 0xa 0xb 0x4 0x7 0x7 0xb 0x9 0xc 0xe 0xb 0x8 0xf 0xe 0xf 0x5 0x8 0xc 0xb 0xd 0xa 0xf 0xd 22 ∅ ∅ 0x1 0x1 0x1 0x0 ∅ ∅ 0x0 0x0 0x2 0x8 0x0 0x2 0x2 0x2 0x2 0x3 0x2 0x2 0x3 0x4 0x9 0x1 0x4 0x4 0x5 0x4 0x6 0xa 0x5 0x5 0xc 0x7 0xe 0x4 0x7 0x7 0x7 0xb 0xa 0xe 0x7 0x7 0xc 0xf 0x5 0xc 0xc 0x8 0xd 0xf 0x8 0x8 0xf 0xf 0xf 0xa 0xa 0xa 23 ∅ ∅ ∅ ∅ ∅ ∅ ∅ ∅ ∅ 0x2 0x2 ∅ ∅ 0x3 0x2 0x8 0x4 0x4 0x6 0x4 0x9 0xb 0xb 0xa 0xb 0xe 0xd 0xd 0xf 0xd 0xf 25 ∅ 0x1 0x0 0x1 0x1 ∅ ∅ ∅ ∅ ∅ ∅ ∅ ∅ 0x8 0x2 0x8 0x2 0x2 0x3 0x9 0xa 0x4 0x9 0x5 0x4 0x7 0xe 0xe 0x7 0xe 0x7 0x7 0x9 0xf 0xc 0xf 0x8 0xc 0xb 0xf 0xa 0xf 0xd

Duplication of computations

Description: A simple countermeasure is to make two computations for the last two rounds. We save the state of the cipher W 17 in memory, possibly k times for more security -since we are in lightweight cryptography is seems reasonable to take k = 1 or k = 2. Then we make the computations up to O 20 and save the state again. We repeat the computation with the saved state (W 17 ) and compare with the first result -possibly k times again. If two different computations give different results we trap the cipher and the system produces no output. Otherwise, the execution performs normally. We can also apply a majority vote by duplicating the computations twice, possibly 2k times and give as output one that most appears. 5.5 shows a majority vote using duplication. Cost: This countermeasure uses, for encryption and decryption, two additional matrix layer and three additional substitution layers, subkey updates and subkey additions. The cost can be bounded from above by 15% of the total PRIDE cost.

Desynchronisation

Description: This countermeasure consists in adding time randomisation during the cipher so that the temporal position of the 18-th and the 19-th round will not be the same for each execution. For the time randomisation generation, we can use a simple Linear Feedback Shift Register (LFSR) whose value indicates the 'random' delay time. Those random delay functions can be added before the 18-th round. 5.6 illustrates the countermeasure.

PRNG Init Out Plaintext enc. Wait(Out) enc. Wait(Out) enc.
W 17 Ciphertext enc.

Figure 5.6: Desynchronisation

Cost: The cost depends on the time randomization generation -a simple LFSR implemented in hardware has a low cost with respect to IoT constraints, it also depends on the duration of the 'random delay', and on the time needed to access the random output of the LFSR.

Masking

Description: Another countermeasure proposed by Guilley and al. in [GSDS10] is to add a random mask to the message to prevent two consecutive executions of the same plaintext. More precisely, in its original description, it consists in generating a 64-bit random mask different at each execution, XOR it with the asked plaintext and the ciphertext obtained is sent with the mask.

In our case, we use a simple LFSR defined by a minimal primitive polynomial of degree 64 (X 64 + X 63 + X 61 + X 60 + 1 for example), and by an initialization made public. The LFSR thus generates 2 64 -1 different masks. It must not be again accessible by the user to prevent its reset. For this, it must be correctly implemented in hardware. We apply the mask by an XOR on the input of the 10-th round. This prevents the adversary from getting two encryptions of the same plaintext, and therefore to make a DFA. For decryption, we apply an XOR between the mask and the output of the 10-th round and get the correct plaintext. We then have two options. The first is to send the mask with the ciphertext. Unfortunately, in this case, this method does not protect against an attack on decryption. Indeed, the attacker can choose the same mask on each decryption. However, in the context of IoT it is common that the card is only used for encryption and decryption is carried out on a protected server. The second is to synchronize the encryption and the decryption. They both use the same LFSR with the same initialization and the decryption must be applied in the same order as ciphertexts received. Therefore, the countermeasure protects both the encryption, and the decryption but with an additional synchronisation constraint. 5.7 illustrates the countermeasure. Cost: The cost depends on the choice of the random mask generation. A simple LFSR -like the one we cited -implemented in hardware has a low cost with respect to IoT constraints. Moreover, applying the mask requests an additional cost of an XOR for encryption and the same for decryption in the second case.

PRNG

Conclusion

In this paper, we propose the first differential fault analysis on the block cipher PRIDE. We explain how this attack can be optimized and we demonstrate it, with 4 faults only to retrieve the full secret key. We show that our attack is indeed feasible from 32-bit random faults obtained with electromagnetic injection, which is a low-cost means of injection. We believe that the resistance against DFA is important for a cipher like PRIDE, which is expected to be largely deployed in low-end devices thanks to its lightness. At last we propose some countermeasures which leave the cipher still very efficient for IoT devices. They can be combined to provide more security and are not exhaustive. An optimization of these countermeasures is possible to make them less costly and keep the light side of the cipher. It is also necessary to be careful that the protections to prevent the DFA do not open doors to further attacks. Finally, it appears that our attack applies to any SPN-based block ciphers with a linear layer similar to the one used in PRIDE, like the LS-Designs family introduced by Grosso & al [START_REF] Grosso | LS-designs: Bitslice encryption for efficient masked software implementations[END_REF] in 2014. The details of this generalization will be studied in a future work.

Appendices

Details of PRIDE

This subsection provides permutations and matrices used by PRIDE. Tables 5.12 and 5.13 respectively describe the permutation P and its inverse P -1 used in the round function of PRIDE as well as in the beginning and the end of the cipher. The matrices defining the linear layer of PRIDE are:

L0 =                         
0 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 1 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 1 1 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 1 1 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 0

                         , L1 =                         
1 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 1 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 1 0 0 0

                         L2 =                         
0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 1 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 1

                         , L3 =                         
1 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 1 1 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 1 1 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 1

                         109

Differential properties of the PRIDE S-box

Difference distribution table of the PRIDE S-box

Table 5.14 shows the difference distribution table T of the PRIDE S-box, which is defined by

T (i, j) = # {(x, y) ∈ {0, 1} 4 × {0, 1} 4 | x ⊕ y = i, S(x) ⊕ S(y) = j}.
0 0x9 0 0 0 0 2 2 2 2 0 0 0 0 2 2 2 0xa 0 0 0 0 2 2 2 2 4 0 4 0 0 0 0 0xb 0 0 4 4 0 0 0 0 0 0 0 0 2 2 2 0xc 0 0 2 2 2 2 0 0 0 2 0 2 2 0 2 0xd 0 0 2 2 0 0 2 2 0 2 0 2 0 2 0 0xe 0 0 2 2 0 0 2 2 0 2 0 2 2 0 2 0xf 0 0 2 2 2 2 0 0 0 2 0 2 0 2 0

Proof of Proposition 5.1

We can see that, from the knowledge of a nonzero input (x ⊕ y) and of an output difference (S(x) ⊕ S(y)) for S we deduce 0, 2 or 4 candidates for the input value x. Moreover, we can easily find pairs of differentials (a 1 , b 1 ) and (a 2 , b 2 ) which are satisfied by a single input x. For this, we use Proposition 5.1 that we prove here.

S(x ⊕ a 1 ⊕ a 2 ) ⊕ S(x ⊕ a 2 ) = b 1 = S(x ⊕ a 1 ) ⊕ S(x) implying that S(x ⊕ a 2 ) ⊕ S(x) = S(x ⊕ a 1 ⊕ a 2 ) ⊕ S(x ⊕ a 1 ). Thus, x ⊕ a 1 ∈ D(a 2 , b 2 ) is a contradiction. We have proved that #D(a 2 , b 2 ) = 4. Now, it is clear that any element x in D(a 1 , b 1 ) ∩ D(a 2 , b 2 ) is a solution of S(x ⊕ a 2 ) ⊕ S(x ⊕ a 1 ) = b 1 ⊕ b 2 , i.e., x ⊕ a 1 ∈ D(a 1 ⊕ a 2 , b 1 ⊕ b 2 ) and x ⊕ a 2 ∈ D(a 1 ⊕ a 2 , b 1 ⊕ b 2 ). Suppose now that {x, x ⊕ a 4 } ⊆ D(a 1 , b 1 ) ∩ D(a 2 , b 2
) for some a 4 = 0, we deduce that the four elements x ⊕ a 1 , x ⊕ a 2 , x ⊕ a 1 ⊕ a 4 and x ⊕ a 2 ⊕ a 4 belong to D(a 1 ⊕ a 2 , b 1 ⊕ b 2 ). These four elements are either distinct or satisfy

a 4 = a 1 ⊕ a 2 which implies that x ⊕ a 4 ⊕ a 2 = x ⊕ a 1 belongs to D(a 2 , b 2 ), i.e., x ⊕ a 1 ∈ D(a 1 , b 1 ) ∩ D(a 2 , b 2 ). Therefore, x ⊕ a 1 , x ⊕ a 2 , x and x ⊕ a 1 ⊕ a 2 all belong to D(a 1 ⊕ a 2 , b 1 ⊕ b 2 ) and #D(a 1 ⊕ a 2 , b 1 ⊕ b 2 ) = 4.

Other trade-offs between the number of faults and the time complexity

We have shown that 4 faults with an appropriate strategy enable the attacker to recover the whole key. In this subsection, we evaluate the number of key candidates that an attacker can obtain with fewer faults. This number then corresponds to the time complexity of the complete key recovery. Indeed, if the attacker knows a pair of plaintext-ciphertext, encrypting the known plaintext under each key candidate until the correct ciphertext is recovered leading to a complete key recovery2 . Firstly, the number of remaining candidates for the subkey k 0 (resp. k 1 ) that an attacker can obtain with one fault on the 19-th round (resp. 18-th round) is 2 32 . We now use this result to estimate the cost of the full key recovery from a few faults only.

With a single fault. We want to determine the cost of the key recovery if the attacker can inject a single fault. If this fault is injected in the 19-th round, then the possible values of k 0 is reduced to a list of 2 32 candidates. This corresponds to a total of 2 96 candidates for the whole 128-bit key. If the attacker knows two plaintext-ciphertext pairs, he can then encrypt the first known plaintext under each of these 2 96 key candidates, until the corresponding ciphertext is recovered. Only 2 96-64 = 2 32 key candidates then remain, and the second plaintext-ciphertext pair can then be exploited for recovering the key. The main part of the time complexity in this attack is the cost of the exhaustive search over the 2 96 candidates, which corresponds to 2 96 encryptions.

If the fault is now injected in the 18-th round, then the attack consists in successively examining all 2 64 possible values for k 0 . For each of these 2 64 candidates, the attacker inverts the last encryption round for both the correct and the faulty ciphertexts C and C * . He deduces the value of ∆X 20 , and then of ∆Y 19 . When choosing a random k 0 , ∆X 20 varies in the set of all input differences which can appear when the output difference equals ∆Y 20 . From the difference distribution table of the S-box, the average number of valid input differences corresponding to a fixed output difference is 1 16

(1 + 4 × 2 + 6 × 8 + 8 × 5) = 6.0625.

Therefore, ∆X 20 (and then ∆Y 19 ) takes in average 6.0625 16 = 2 41.6 different values, and each of these differences appears for 2 22.4 values of k 0 in average.

However, the difference ∆X 20 is not valid if the corresponding value of ∆Y 19 does not have the form expected from the value of the fault. As the fault has been injected on Z 0 18 or Z 3 18 , each nibble of ∆X 19 is equal either to 0x1, or to 0x8. Then, the corresponding nibble ∆Y 19 can take 4 values only. Therefore, the proportion of valid values for ∆Y 19 is 4 16 × 2 -64 = 2 -32 . It follows that, among the 2 41.6 values of ∆Y 19 which are obtained from the partial decryption, only 2 9.6 are valid, implying that only 2 32 values of k 0 need to be considered. For each of these 2 32 values of k 0 , the value of the fault, and then of ∆X 19 provides 2 32 candidates for k 1 as proved in the previous subsection. This step then leads to a list of 2 64 candidates for the whole 128-bit key, with a time complexity which mainly corresponds to the cost for decrypting one round of PRIDE 2 64 times. The bottleneck of the attack is then the final key recovery procedure, which consists in testing the 2 64 remaining keys on two plaintext-ciphertext pairs. The overall cost of the attack is then roughly the cost of 2 64 encryption.

With two faults. If the two faults are injected in the 18-th round, then the previously described technique which enables the attacker to eliminate some candidates for k 0 is repeated twice. Only a proportion of 2 -64 values of ∆Y 19 will be valid, implying that only the correct value of ∆Y 19 will remain after this step. As previously explained, each value of ∆Y 19 is obtained for 2 22.4 values of k 0 in average. Therefore, this sieving procedure leads to a list of 2 22.4 candidates for k 0 . Now, exploiting the two faults injected in the 18-th round provides one candidate for k 1 . Therefore, we get 2 22.4 candidates for the whole key. The total time complexity of the attack then corresponds to 2 64 decryption of a single round, and to an exhaustive search among the 2 22.4 remaining keys. The first step is then the bottleneck and its cost is less than the cost of 2 64 /20 = 2 59.7 complete encryptions.

If the first fault is now injected in the 19-th round, then the list of possible values for k 0 is first reduced to a list of size 2 32 as explained in the previous subsection. The second fault, injected on the 18-th round, then enables to reduce this list to 2 32-32 = 1 possible value for k 0 . For this value of k 0 , a list of 2 32 candidates for k 1 is obtained from the second fault. The number of candidates for the whole key, which need to tested, is then 2 32 . The bottleneck of the attack is then the exhaustive search over the 2 32 remaining key candidates, which corresponds to a time complexity equal to the cost of 2 32 encryptions.

With three faults. The best strategy with three faults consists in injecting one fault in the 19-th round, and two in the 18-th round. From the fault in the 19-th round, the attacker gets a list of 2 32 candidates for k 0 . By decrypting the last round under these 2 32 values of k 0 , we roughly get 2 32 pairs of values for ∆Y 19 among which one is expected to be consistent with the two faults injected in the 18-th round. Moreover, these two faults lead to one candidate for k 1 , i.e., one candidate for the whole key. The time complexity of the attack then corresponds to the cost of 2 32 encryptions of a single round, i.e., 2 27.7 full encryptions.

ARM source code

L-layer

Introduction

The original motivation for this work goes back to an analysis of quantum key distribution (QKD) protocols [START_REF] Peter | Enhancements to prepare-and-measure based qkd protocols[END_REF], which among other things, suggested some modifications of the quantum bit error rate (QBER) estimations. These modifications led to an information theory problem that was first investigated in [START_REF] Atashpendar | Information leakage due to revealing randomly selected bits[END_REF].

The mathematical problem encountered in the aforementioned analysis is the following. A random bit string y of length n emitted from a memoryless source is transmitted via an i.i.d. deletion channel such that a shorter bit string x of length m (m ≤ n) is received as a subsequence of y, after having been subject to n -m deletions. Consequently, the order in which the remaining bits are revealed is preserved, but the exact positions of the bits are not known. Given a subsequence x, the question is to find out how much information about y is revealed. More specifically, the quantity we are interested in is the conditional entropy [START_REF] Cover | Elements of information theory[END_REF] over the set of candidate supersequences upon observing x, i.e., H(Y |X = x) where Y is restricted to the set of compatible supersequences as explained below.

The said information leakage is quantified as the drop in entropy [START_REF] Shannon | A mathematical theory of communication[END_REF] for a fixed x according to a weighted set of its compatible supersequences, referred to as the uncertainty set. The uncertainty set, denoted by Υ n,x , contains all the supersequences that could have given rise to x upon n -m deletions. In [START_REF] Atashpendar | Information leakage due to revealing randomly selected bits[END_REF], an alternative proof shows that this set's cardinality is independent of the details of x and that it is only a function of n and m. The weight distribution used in the computation of entropy is given by the number of occurrences or embeddings of a fixed subsequence in its compatible supersequences, i.e., the number of distinct ways x can be extracted from y upon a fixed number of deletions, denoted by ω x (y). Furthermore, in the same work it is conjectured that the constant subsequences consisting of all 1's (or all 0's), x = 11...1, and the alternating 1's and 0's, i.e., x = 1010..., minimize and maximize the said entropy, respectively.

Despite the specific context in which the problem was first encountered, the underlying mathematical puzzle is a close relative of several well-known challenging problems in formal languages, DNA sequencing and coding theory. In fact, the distribution of the number of times a string x appears as a subsequence of y, lies at the center of the long-standing problem of determining the capacity of deletion channels. More precisely, knowing this distribution would give us a maximum likelihood decoding algorithm for the deletion channel [START_REF] Mitzenmacher | A survey of results for deletion channels and related synchronization channels[END_REF]. In effect, upon receiving x, every set of n -m symbols is equally likely to have been deleted. Thus, for a received sequence, the probability that it arose from a given codeword is proportional to the number of times it is contained as a subsequence in the originally transmitted codeword. More specifically, we have p(y|x) = p(x|y) p(y) p(x) = ω x (y)d n-m (1 -d) m p(y) p(x) , with d denoting the deletion probability. Thus, as inputs are assumed to be a priori equally likely to be sent, we restrict our analysis to ω x (y) for simplicity.

In this work, we first study several closely-related counting problems involving (super/sub)sequences and then we revisit the aforementioned entropy question. It is worth pointing out that while questions on the combinatorics of random subsequences requiring closed-form expressions are already quite challenging, the problem tackled in this work and first raised in [START_REF] Atashpendar | Information leakage due to revealing randomly selected bits[END_REF], is further complicated by the dependence of entropy on the distribution of subsequence embeddings, i.e., the number of supersequences having specific embedding weights. To put this in contrast, in a related work [START_REF] Swart | A note on double insertion/deletion correcting codes[END_REF], a closed-form expression is provided for computing the number of distinct subsequences that can be obtained from a fixed supersequence for the special case of two deletions, whereas here we need to account for the entire space of supersequences and characterize the number of times a given subsequence can be embedded in them in order to address the entropy question. Moreover, one would have to work out how these weights (number of embeddings) get shifted across their compatible supersequences when we move from one subsequence to another.

Results and Contributions

We first present an algorithm based on a run-length encoding of strings for counting the number of embeddings of x into y as a subsequence. Similar to how the cardinality of the set of supersequences that can project to a given subsequence, i.e., |Υ n,x |, depends only on their respective lengths, we prove that the number of supersequences that admit an initial embedding of a subsequence such that the last index of their initial embedding overlaps with their last bit, also depends only on |y| = n and |x| = m. We then describe two clustering techniques that give rise to subspaces in Υ n,x whose sizes depend only on n, m and the Hamming weight of x, but not the exact form of x. We derive analytic expressions, as well as a recurrence, for the cardinality of these sets. The approach and methodology used for deriving our clustering results depend heavily on the notion of initial or canonical embeddings of subsequences in their compatible supersequences, which provide further insight into the importance of initial embeddings.

Next, we consider the problem of enumerating supersequences that admit exactly a single occurrence of a subsequence, referred to as singletons, and give an analytic expression for their count. Furthermore, we prove a similar result for the maximization and minimization of the number of singletons by the constant and alternating strings, respectively.

Finally, we revisit the original entropy extremization question and prove the minimal entropy conjecture for the special cases of single and double deletions, i.e., for n = m + 1 and n = m + 2. The entropy result is obtained via a characterization of the number of strings with specific weights, along with an entropy decreasing operation. This is achieved using clustering techniques and a run-length encoding of strings: we identify groupings of supersequences with specific weights by studying how they can be constructed from a given subsequence using different insertion operations, which are in turn based on analyzing how runs of 1's and 0's can be extended or split. The methods used in the analysis of the underlying combinatorial problems, based on clustering techniques and the run-length encoding of strings may be of interest in their own right.

Structure

We begin by providing a survey of related work in Section 5.3.2. In Section 5.3.3, we introduce our notation and describe the main definitions, models, and building blocks used in our study. Next, in Section 5.3.4, we present an algorithm for counting the number of subsequence embeddings, which relies on the run-length encoding of strings. We then explore counting problems and clustering techniques in the space of supersequences including an analysis of a class of supersequences, referred to as singletons, that admit exactly a single embedding of a given subsequence and prove similar extremization results for their count. Finally, we turn to the original entropy question in Section 5.3.5 and prove the minimal entropy conjecture for the special cases of single and double deletions. Finally, we conclude by summarizing our findings and stating some open problems in Section 5.3.6.

Related Work

Studies involving subsequences and supersequences encompass a wide variety of problems that arise in various contexts such as formal languages, coding theory, computer intrusion detection and DNA sequencing to name a few. Despite their prevalence in such a wide range of disciplines, they remain largely unexplored and still present a considerable wealth of unanswered questions. In the realm of stringology and formal languages, the problem of determining the number of distinct subsequences obtainable from a fixed number of deletions, and closely related problems, have been studied extensively in [START_REF] Phillip | Subsequence numbers and logarithmic concavity[END_REF][START_REF] Flaxman | Strings with maximally many distinct subsequences and substrings[END_REF][START_REF] Daniel | Bounds on the number of string subsequences[END_REF][START_REF] Hirschberg | Tight bounds on the number of string subsequences[END_REF]. Perhaps it is worth noting that the same entropy minimizing and maximizing strings conjectured in [START_REF] Atashpendar | Information leakage due to revealing randomly selected bits[END_REF] and characterized in the present work, has been shown to lead to the minimum and maximum number of distinct subsequences, respectively. The problems of finding shortest common supersequences (SCS) and longest common subsequences (LCS) represent two well-known NP-hard problems [JL95, [START_REF] Middendorf | On finding minimal, maximal, and consistent sequences over a binary alphabet[END_REF][START_REF] Middendorf | Combined super-/substring and super-/subsequence problems[END_REF] that involve subproblems similar to our work. Finally, devising efficient algorithms for subsequence combinatorics based on dynamic programming for counting the number of occurrences of a subsequence in DNA sequencing is yet another important and closely related line of research [START_REF] Rahmann | Subsequence combinatorics and applications to microarray production, DNA sequencing and chaining algorithms[END_REF][START_REF] Elzinga | Algorithms for subsequence combinatorics[END_REF].

In coding theory, and more specifically in the context of insertion and deletions channels, similar long-standing problems have been studied extensively, and yet many problems still remain elusive. This includes designing optimal coding schemes and determining the capacity of deletion channels, both of which incorporate the same underlying combinatorial problem addressed in the present work. Considering a finite number of insertions and deletions for designing correcting codes for synchronization errors [Ull67, SF03, KM13] and reconstructing the original string from a fixed subsequence [START_REF] Graham | A binary deletion channel with a fixed number of deletions[END_REF] represent two specific and related research areas. More recent work on the characterization of the number of subsequences obtained via the deletion channel [SD13, SGSD15, LL15], e.g., in terms of the number of runs in a string, shows great overlap with our work. A graph-theoretic approach for deletion correcting codes, closely related to our clustering analysis, including an alternative proof for the Hamming weight clustering given in Theorem (5.6) based on a different approach, is given in [START_REF] Cullina | A coloring approach to constructing deletion correcting codes from constant weight subgraphs[END_REF].

An important body of research in this area is dedicated to deriving tight bounds on the capacity of deletion channels [DMP07, KMS10, RD13, CK14] and developing bounding techniques [START_REF] Ordentlich | Bounding techniques for the intrinsic uncertainty of channels[END_REF].

Perhaps rather surprisingly, the problem of determining the number of occurrences of a fixed subsequence in random sequences has not received the same amount and level of attention from the various communities. The state-of-the-art in the finite-length regime remains rather limited in scope. More precisely, the distribution of the number of occurrences constitutes a central problem in coding theory, with a maximum likelihood decoding argument, which represents the holy grail in the study of deletion channels. A comprehensive survey, which among other things, outlines the significance of figuring out this particular distribution is given by Mitzenmacher in [START_REF] Mitzenmacher | A survey of results for deletion channels and related synchronization channels[END_REF].

Framework

We consider a memoryless source that emits symbols of the supersequence, drawn independently from the binary alphabet Σ = {0, 1}. Given an alphabet Σ = {0, 1}, Σ n denotes the set of all Σ-strings of length n. Let p α denote the probability of the symbol α ∈ Σ being emitted, which in the binary case simplifies to p α = 0.5. This means that the probability of occurrence of a random supersequence y is given by P (y) = n i=1 p yi . The probability of a subsequence of length m is defined in a similar manner. Throughout, we use h(s) to denote the Hamming weight of the binary string s.

Notation We use the notation [n] = {1, 2, . . . , n} and [n 1 , n 2 ] to denote the set of integers between n 1 and n 2 ; individual bits from a string are indicated by a subscript denoting their position, starting at 1, i.e., y = (y i ) i∈[n] = (y 1 , . . . , y n ). We denote by |S| the size of a set S, which for binary strings also corresponds to their length in bits. We also introduce the following notation: when dealing with binary strings, [a] k means k consecutive repetitions of a ∈ {0, 1}.

Subsequences and Supersequences

Given x ∈ Σ m and y ∈ Σ n , let x = x 1 x 2 • • • x m denote a subsequence obtained from y = y 1 y 2 • • • y n with a set of indexes 1 ≤ i 1 < i 2 < • • • < i m ≤ n such that y i1 = x 1 , y i2 = x 2 , .
. . , y im = x m . Subsequences are obtained by deleting characters from the original string and thus adjacent characters in a given subsequence are not necessarily adjacent in the original string.

Projection Masks

We define y π = (y i ) i∈π = x to mean that the string y filtered by the mask π gives the string x. Let π denote a set of indexes {j 1 , . . . , j m } of increasing order that when applied to y, yields x, i.e., x = y j1 y j2 • • • y jm and 1 ≤ j 1 < j 2 • • • j m ≤ n.

Deletion Masks A deletion mask δ represents the set of indexes that are deleted from y to obtain x, i.e., δ i ∈ [n] \ π and |δ| = n -m, whereas a projection mask π denotes indexes that are preserved. Thus, similarly, δ is a subset of [n] and the result of applying a mask δ on y is denoted by y δ = x.

Compatible Supersequences We define the uncertainty set, Υ n,x , as follows. Given x and n, this is the set of y strings that could project to x for some projection mask π. we refer to the number of masks associated with a pair (y, x) as the weight of y, i.e., the number of times x can be embedded in y as a subsequence.

Initial Projection Masks or Canonical Embeddings

Given y π = x, we define π to be initial if there is no lexicographically earlier mask π such that y π = x. π is a lexicographically earlier mask than π if, for some r, the smallest r members of π and π are the same, but the (r + 1)-th of π is strictly smaller than that of π. Throughout, we will use π to denote an initial projection mask. The first embedding of a subsequence x in y is also often referred to as the canonical embedding in the literature. Note that for a fixed mask or embedding π, the members of y up to the last member of π are completely determined if π is initial.

Run-Length Encodings

A substring T of a string Y = y 1 y 2 . . . y n over Σ is called a run of Y if T is a consecutive sequence of the same character (i.e., T ∈ α + for an α ∈ Σ). Let R x,α denote the set of runs of α in x. The notion of run-length encoding will be central to our analysis. Given an n-bit binary string y, its run-length encoding (RLE) is the sequence

r j = (a j , b j ), 1 ≤ j ≤ m, such that y = [a 1 ] b1 [a 2 ] b2 • • • [a m ] bm , m ≤ n.
with a j ∈ {0, 1} and b j ∈ {1, . . . , n}. This encoding is unique if we assume that a i = a i+1 , at which point we only need to specify a single a i (e.g., the first one) to deduce all the others. Thus the RLE3 for a string y is denoted by

y = [a 1 ; b 1 , b 2 , . . . , b m ].
When the value of a 1 is irrelevant, which will often be the case later on4 , we will drop it from the notation. Consecutive zeros or ones in a binary string will be referred to as blocks or runs.

Example 5.1 Let y = 0011010001; then we have y = [0; 2, 2, 1, 1, 3, 1] as the first bit is zero; and we have 2 zeros, 2 ones, 1 zero, 1 one, 3 zeros, 1 one. Alternatively, [2, 2, 1, 1, 3, 1] designates simultaneously 0011010001 and 1100101110.

Entropy For a fixed subsequence x of length m, the underlying weight distribution used in the computation of the entropy is defined as follows. Upon receiving a subsequence x, we consider the set of compatible supersequences y of length n (denoted by Υ n,x ) that can project to x upon n -m deletions. Every y ∈ Υ n,x is assigned a weight given by its number of masks ω x (y), i.e., the number of times x can be embedded in y as a subsequence. We consider the conditional Shannon entropy H(Y |X = x) where Y is confined to the space of compatible supersequences Υ n,x . The total number of masks in Υ n,x is given by

µ n,m = n m • 2 n-m (5.3)
Thus, forming the normalized weight distribution

P x = ω x (y 1 ) µ n,m , . . . , ω x (y n ) µ n,m . ( 5.4)
Finally, for simplicity, we use H n (x) throughout this work to refer to the entropy of a distribution P corresponding to a subsequence x as defined below

H n (x) = - i p i • log 2 (p i ) ( 5
p i = ω x (y i ) µ n,m .

Clustering Supersequences and Counting Subsequences

We now briefly review the results of the entropy analysis presented in [START_REF] Atashpendar | Information leakage due to revealing randomly selected bits[END_REF], in which it is conjectured that the constant/uniform string consisting of all 1's (or all 0's), x = 11...1, and the alternating x string, i.e., x = 1010... minimize and maximize the entropy H n (x), respectively. To illustrate this, the plot given in Figure 5.8 shows the values of the min-entropy (H ∞ ), the second-order Rényi entropy (R) and the Shannon entropy (H) computed for all x strings of length 5, with n = 8. Counting multisets: Throughout, we use the combinatorics of counting multisets, also referred to as the method of stars and bars, to enumerate all possibilities for placing n indistinguishable objects into bins marked by m distinguishable separators such that the resulting configurations are distinguished only by the number of objects present in each bin, which is given by n+m-1 n .

Compatible Supersequences and Subsequence Embeddings

Recall that for a fixed subsequence x of length m; we consider the set of y strings of length n (n ≥ m), referred to as compatible supersequences, that can contain x as a subsequence embedding. The set of compatible supersequences is denoted by Υ n,x . It is known that the cardinality of Υ n,x is independent of the form of x and that it is only a function of n and m.

|Υ n,x | = n r=m n r (5.6)
We provided an alternative proof for this based on a simple recursion in [START_REF] Atashpendar | Information leakage due to revealing randomly selected bits[END_REF]. The original motivation for the clustering scheme presented here was to have a more fine-grained view of the distribution of masks in the space of supersequences. This approach led to the discovery of similar structures in Υ n,x , in that their cardinality does not depend on the form of x, analogous to how |Υ n,x | depends only on n and m.

Counting Subsequence Embeddings via Runs

Efficient dynamic programming algorithms for computing the number of subsequence embeddings are known in the literature, e.g., a recursive algorithm requiring Θ(n × m) operations [START_REF] Elzinga | Algorithms for subsequence combinatorics[END_REF].

Here we provide an alternative algorithm, which is primarily based on the run-length encoding of strings.

Using the RLE notation, there are a few cases in which this question is easy to answer. For instance, if y = [a; k 1 , . . . , k ] and x = [a; k 1 , . . . , k ], with the same value of , i.e., we have the same number of blocks in x and y, then it is easy to see that there is a one-to-one sequential mapping of blocks between x and y. This allows us to enumerate the different masks depending on how they map the blocks to each other as follows: We will now suppose that x and y start with the same character. However, in the general case, this property does not hold and the number of blocks in x, and y can also be different.

ω x (y) = i=1 k i k i . ( 5
Here we describe an algorithm wherein for a fixed pair of x and y strings, we structure and enumerate the corresponding space of masks by accounting for the number of different ways we can delete characters in order to merge blocks/runs such that we can recover the simple case given in Equation (5.7). In the more general case, let y = [k 1 , . . . , k ] and x = [k 1 , . . . , k ]. Definition 5.1 Let S be the set of maps f : [ ] → [ ] that satisfy the following properties: f is strictly increasing and f (i) ≡ i mod 2. A function f will define a subset of masks, by specifying blocks that will have to be completely deleted. We group the masks according to a set of functions f that map indexes of blocks of x to indexes of blocks of y. Intuitively, f maps the i-th block of x to the block of y that contains the last letter of the i-th block of x. Therefore, all blocks of y between f (i) + 1 and f (i) that are not composed of the right letter have to be deleted such that we can recover the simple case in Equation (5.7).

For the subsequent analysis, recall that k i denotes the length of the run at index i, whereas k * i refers to the actual set of indexes of the i-th run.

Definition 5.2 Let k *

i denote the set of indexes belonging to the i-th block of y, i.e., {

i-1 j=1 k j , i-1 j=1 k j + 1, . . . , i j=1 k j }, and F (i) * = {f (i -1) + 2, f (i -1) + 4, . . . , f (i) -1}, then a deletion mask δ corresponds to f if: • ∀i : ∪ j∈F (i) * k * j ⊂ δ • ∀i : k * f (i) ⊂ δ (

this allows us to have a partition)

We call ω f the set of masks corresponding to f . Theorem 5.2 The family (ω f ) f ∈S defines a partition on the set of masks from y to x.

Proof: We first show that for f = f ∈ S, every deletion mask δ corresponding to f is different from every mask δ associated with f (i.e., ω f ∩ ω f = ∅). Since f = f , we have a smallest integer i ∈ [ ] such that f (i) = f (i). We assume without loss of generality that f (i -1) = f (i -1) < f (i) < f (i). Due to the condition on parity, f (i + 1) = f (i). We distinguish between two cases:

• If f (i -1) < f (i + 1) < f (i), then k f (i+1) ⊂ δ, and k f (i+1) ⊂ δ since f (i + 1) ∈ F * (i -1). • Conversely if f (i-1) < f (i) < f (i+1), then k f (i) ⊂ δ , and k f (i) ⊂ δ since f (i) ∈ F * (i+1).
Therefore, we have δ = δ . We now show that ∪ f ∈S ω f is the set of masks from y to x. We will use projection masks here as they are more suitable for this proof. Let π be a projection mask such that y π = x. We let π = {π 1 , . . . , π m }, where the π i are in increasing order. Therefore, we have for all i, y πi = x i . We define φ : [n] → [ ] to be the mapping that takes an index of y and returns the index of the block/run it belongs to, i.e., φ(a) returns the smallest i such that i j=1 k j ≥ a. We define f such that f ∈ S and π is in ω f , by

f (i) = φ(π i j=1 k j
). To prove that f is in S, note that given i:

• We have that f (i) ≤ f (i + 1) since the π i are in increasing order.

• Moreover, π i Therefore, f (i) and f (i + 1) are of opposite parity and f (i) < f (i + 1).

We now prove that π corresponds to f . For a fixed i ∈ [ ], let k * f (i-1) = b k f (i-1) , i.e., the f (i -1)-th block of y is made of letters b. Therefore, k * t = b kt for t ∈ F (i) * , since t has the same parity as f (i -1). Moreover, we have b = x i-1 j=1 k j according to the definition of f . So for every index h between i-1 j=1 k j + 1 and i j=1 k j , x h = y π h = b, and for t ∈ F (i) * , we have k * t ∩ π = ∅ (equivalently with the deletion mask δ, k *

t ⊂ δ). By definition, π i j=1 kj ∈ k * f (i) so π ∩ k * f (i) = ∅ (equivalently with the deletion mask δ, k * f (i) ⊂ δ).

Definition 5.3

We now introduce the quantity Ω f , which is the number of masks corresponding to f for f ∈ S.

Ω f = i=0 j∈F (i) k j k i - j∈F (i)\{f (i)} k j k i (5.8)
where

F (i) = {f (i -1) + 1, f (i -1) + 3, . . . , f (i)} Theorem 5.3 Ω f = |ω f | for all f ∈ S.
≤ c ≤ n -m. Υ c n,x = {y ∈ Υ n,x | h(y) -h(x) = c}.
The set of compatible supersequences is thus broken down into n -m + 1 disjoint sets indexed from 0 to n -m such that strings in cluster c contain h(x) + c 1's:

Υ n,x = n-m c=0 Υ c n,x .
Definition 5.5 Maximal initials represent y strings for which the largest index of their initial mask, π, overlaps with the last bit of y. In other words, the last index of the canonical embedding of x in y overlaps with the last bit of y. Recall that we use π to denote a mask π that is initial.

M n,x = {y ∈ Υ n,x | (∃π)[y π = x ∧ max(π) = |y| = n]} .
Similarly, we define a clustering for maximal initials based on the Hamming weight of the y strings

M c n,x = {y ∈ M n,x | h(y) = h(x) + c}.
Example 5.3 For example, the initial embedding of x = 1011 in y = 110011 given by π = {1, 3, 5, 6} is maximal, whereas its initial embedding in y = 101011 given by π = {1, 2, 3, 5} is not maximal as the last index of π does not overlap with the position of the last bit of y .

A more exhaustive example illustrating these concepts is given in Table 5.15. In addition to the distribution of weights, i.e., the number of masks per y, clusters and maximal initials are indicated by horizontal separators and bold font, respectively.

Theorem 5.4 For given n, the cardinality of M n,x is independent of the exact x.

Proof: It is clear that every n-element sequence that has x as an m-element subsequence has a unique initial mask π that gives x. Furthermore, if we fix π, then the members of y up to the last member of π are completely determined if π is initial. To see this, consider the case i ∈ π, then y i (the i-th member of y) must correspond to x j , where i is the j-th smallest member of π. If i / ∈ π, but smaller than max(π), then the i-th member of y must correspond to x j+1 , where j is the number of members of π smaller than i. The latter follows because if this bit were x j+1 , then the given π would not be initial.

We also need to observe that for a given π, there always exists a y that has x initially in π: suppose that x starts with a 0, we set all the bits of y before π to be 1. For a given value of max(π) -which can range from m to n -there are exactly -1 m-1 π's, one for each selection of the other m -1 members of π amongst the -1 values less than .

Moreover, here we have an additional constraint, namely that the initial masks should be maximal as well, i.e., max(π) = n. This means that = n and so we can count the number of distinct initials for the remaining m -1 elements of x in the remaining (n -1)-long elements of y strings, which is simply given by

|M n,x | = |M n,m | = n -1 m -1 (5.11)
Clearly the cardinality of the set of maximal initials is independent of the form of x and depends only on n and m.

Remark Note that if we extend the analysis in the proof of Theorem 5.

∀x, x ∈ Σ m , h(x) = h(x ) =⇒ |M c n,x | = |M c n,x |.
Proof: We now describe a simple combinatorial argument for counting the number of maximal initials in each cluster indexed by c, i.e., a grouping of all y ∈ Υ c n,x such that h(y) = h(x) + c. Let p and q denote the number of additional 0's, and 1's contributed by each cluster, respectively. Furthermore, let a and b denote the number of 1's and 0's in x, respectively.

Similar to the method used in the proof of Theorem 5.4, due to maximality we fix the last bit of y and x, and consider y = y -tail(y) and x = x -tail(x) where tail(s) denotes the last bit of s. Now the problem amounts to counting distinct initials of length m -1 in (n -1)-long elements in each cluster by counting the number of ways distinct configurations can be formed as a result of distributing c 1's and (n -m -c) 0's around the bars/separators formed by the b 0's and a 1's in x, respectively.

We now need to observe that to count such strings with distinct initials, we can fix the m -1 elements of x as distinguished elements and count all the unique configurations formed by distributing p indistinguishable 0's and q indistinguishable 1's among bins formed by the fixed 1's and 0's of x such that each such configuration is distinguished by a unique initial.

Equivalently, we are counting the number of ways we can place the members of x among n -1 positions comprising p 0's and q 1's without changing the relative order of the elements of x such that these configurations are uniquely distinguished by the positions of the m -1 elements.

Intuitively, the arrangements are determined by choosing the positions of the m -1 bits of x : by counting all the unique distributions of bits of opposite value around the elements of x , we are simply displacing the elements of x in the n -1 positions, thereby ensuring that each configuration corresponds to a unique initial.

Note that this coincides exactly with the multiset coefficient (computed via the method of stars and bars) as we can consider the elements of the runs of x to be distinguished elements forming bins among which we can distribute indistinguishable bits of opposite value to count the number of configurations that are distinguished only by the number of 1's and 0's present in the said bins.

Thus we count the number of unique configurations formed by distributing p 0's and q 1's among the a 1's and b 0's of x, respectively. The total count for each cluster c is given by: p+a-1 p q+b-1 q , which expressed in terms of the Hamming weight of x gives

|M c n,x | = (n -m -c) + h(x) -1 n -m -c c + (m -h(x)) -1 c (5.12)
With the total number of maximal initials in Υ n,x given by

|M n,x | = n-m c=0 |M c n,x | = n -1 m -1 .
|Υ c n,x | = n =m min(c, -m) g=max(0,c-(n-)) |M g ,m | n - c -g (5.13)
Finally, inserting Equation (5.12) into Equation (5.13) gives

|Υ c n,x | = n =m U B g=LB ( -m -g) + h(x) -1 -m -g g + (m -h(x)) -1 g n - c -g . ( 5

.14)

As shown in Equation (5.14), |Υ c n,x | depends on the length and the Hamming weight of x, but it is independent of the exact form of x.

Simple closed form expression for the size of a cluster

We have shown that |Υ c n,x | is independent of the form of x. We can now derive a more simplified analytic expression for this count by considering an x string of the following form: x = 11...11 a 00...0 m , i.e., a 1's followed by b 0's, with a > 0 and b = m -a.

The y strings in each cluster are precisely the strings of length n that have a + c 1's in them (and n -a -c 0's) where the a-th 1 (i.e., the last one in an initial choice for x) occurs before at least b 0's. Clearly, there are n a+c strings with exactly a + c 1's, but some of these will violate the second principle. To find an expression for counting the valid instances, we sum over the positions of the a-th 1, which must be between a and a + z, where z = n -a -b -c is the number of added 0's. Thus we get the following expression

|Υ c n,x | = h(x)+z p=h(x) p -1 h(x) -1 n -p c . ( 5

.15)

With z = n -m -c and p denoting the index of the a-th 1, we thus count the number of ways of picking 1's before p and the c 1's after p. Note that for h(x) = 0, the cardinality of cluster c is simply given by n c .

Recursive expression for the size of a cluster

We present a recurrence for computing the size of a cluster by considering overlaps between the first bits of x and y, respectively. Let • and ε denote concatenation and the empty string, respectively. Moreover, let x be the tail of x (resp. y the tail of y).

• Υ c n,0•x = Υ c n-1,x + Υ c-1 n-1,0•x
-First term: first bit of y is 0, find x in y -Second term: first bit of y is 1 (part of cluster), so we reduce c and find x in y

• Υ c n,1•x = Υ c n-1,x + Υ c n-1,1•x
-Same arguments as above, but for x starting with 1

• Base cases:

-Υ 0 n,0•x = Υ 0 n-1,x -Υ 0 n,1•x = Υ 0 n-1,x + Υ 0 n-1,1•x -Υ c n,ε = n c -if c + |x| > n then return 0 else Υ c n,x
It is worth pointing out that since this recursion depends on the form of x, i.e., whether or not x starts with a 0 or 1, it does not explicitly capture the bijection between clusters of x strings that have the same Hamming weight, as proved in Theorem 5.6.

Enumerating Singletons via Runs

Let singletons define supersequences in Υ n,x that admit exactly a single mask for a fixed subsequence x of length m, i.e.; they give rise to exactly a single occurrence of x upon n -m deletions. We use S n,x to denote this set.

S n,x = {y ∈ Υ n,x | ω x (y) = 1}.
To compute the cardinality of S n,x , we describe a counting technique based on splitting runs of 1's and 0's in x according to the following observations: (i) inserting bits of opposite value to either side of the framing bits in x, i.e., before the first or after the last bit of x, does not alter the number of masks. (ii) splitting runs of 0's and 1's in x, i.e., insertion of bits of opposite value in between two identical bits, does not modify the count. This amounts to counting the number of ways that singletons can be obtained from a fixed x string via weight preserving insertions.

The number of possible run splittings corresponds to the number of distinct ways that c 1's and (n -m -c) 0's can be placed in between the bits of the runs of 0's and 1's in x, respectively. Again, this count is given by the multiset number a+b-1 a , where we count the number of ways a indistinguishable objects can be placed into b distinguishable bins. Note that the number of singletons depends heavily on the number of runs in x and their corresponding lengths. The counting is done by summing over all n -m clusters and computing the configurations that lead to singletons as a function of the runs in x and the number of additional 1's and 0's contributed by each cluster at index c.

In order to do this computation, we first count the number of insertions slots in x as a function of its runs of 1's and 0's, given by ρ 0 (x) and ρ 1 (x), respectively. Let r j i be a run with i and j denoting its first and last index and let ρ α (x) denote the number of insertion slots in x as a function of its runs of α. To compute ρ α (x), we iterate through the runs of α and in x and count the number of indexes at which we can split runs as follows

ρ α (x) = r∈Rx,α f (r) (5.16)
where

f (r) =      |r j i | + 1, if i = 1 ∧ j = n |r j i |, if (i = 1 ∧ j < n) ∨ (i > 1 ∧ j = n) |r j i | -1, otherwise (5.17)
Note that if either the first bit or the last bit of a run overlaps with the first or last bit of x, the number of bars is equal to the length of the run. If the said indexes overlap with neither the first nor the last bit of x, the count is equal to the length of the run minus 1, and finally, if both indexes overlap with the first and last bit of x the count is equal to the length of the run plus 1.

We can now count the total number of singletons for given n and x as follows. Let c and b (b = n -m -c) denote the number of 1's and 0's contributed by the c-th cluster, and the total number of singletons is given by

|S n,x | = n -m + ρ 1 (x) -1 n -m + n-m-1 c=1 b + ρ 1 (x) -1 b c + ρ 0 (x) -1 c + n -m + ρ 0 (x) -1 n -m (5.
18) The first and last terms correspond to the number of singletons in the first and last cluster, respectively, where we insert either 1's or 0's, but not both. The summation over the remaining clusters counts the configurations that incorporate both additional 1's and 0's. Proof: This follows immediately from a maximization and minimization of the number of runs in x, i.e., ρ α (x). In the case of the all 1's x string, which comprises a single run, every index in x can be used for splitting. Conversely, the alternating x has the maximum number of runs |R| = m, where ∀.r ∈ R x : |r| = 1, thus splittings are not possible, i.e., no operations of type (ii), and the insertions are confined to pre-pending and appending bits of opposite values to the first and last bit of x, respectively.

Entropy Minimization

We now prove the minimal entropy conjecture for the special cases of one and two deletions. Our approach incorporates two key steps: first, we work out a characterization of the number of y strings that have specific weights ω x (y). We then consider the impact of applying an entropy decreasing transformation to x, denoted by g(x), and prove that this operation shifts the weights in the space of supersequences such that it results in a lowering of the corresponding entropy. This is achieved using clustering techniques and a run-length encoding of strings: we identify groupings of supersequences with specific weights by studying how they can be constructed from a given subsequence using different insertion operations, which are in turn based on analyzing how runs of 1's and 0's can be extended or split.

Definition 5.6

We now define the transformation g on strings of length m as follows:

g([k 1 , . . . , k ]) = [k 1 + k 2 , k 3 , . . . , k ] if > 1 g([m]) = [m] (5.19)
Hence g is a "merging" operation that connects the two first blocks together. As we shall see, g decreases the entropy. Thus, one can start from any subsequence x and apply the transformation g until the string becomes [m], i.e., [0] m or [1] m . As a result, [m] exhibits minimal entropy and thus the highest amount of leakage in the original key exchange problem. Note that, as indicated implicitly in the definition above, this transformation always reduces the number of runs by one by flipping the first run to its complement.

Thus we avoid cases where merging two runs would lead to connecting to a third neighboring run, thereby resulting in a reduction of runs by two. For example, g transforms the string x = 1001110 = [1; 1, 2, 3, 1] into x = 0001110 = [0; 3, 3, 1], as opposed to x = 1111110 = [1; 6, 1].

The plots shown in Figure 5.9 illustrate the impact of the transformation g on the weight distribution as we move from x = 101010 to x = 000000 (101010 → 001010 → 111010 → 000010 → 111110 → 000000).

Single Deletions

In this subsection, we consider the case of a single deletion. Let x be a fixed string of length m. We study the space of y strings of length n = m + 1 that can be masked to yield x, i.e., Y 1 = {y ∈ {0, 1} n | ∃δ ∈ P([n]), y δ = x and |δ| = 1}. Recall that we associate a weight ω 1 (x, y) to each y ∈ Y 1 , defined as the number of ways that y can be masked into x. Finally, we define the entropy associated to x as the Shannon entropy of the variable Z ∈ {0, 1} n having distribution Pr[Z = y] = 1 µ 1 w x (y).

where µ 1 = y∈Υn,x , which for the case m = n -1 gives ω 1 (x, y) = n m 2 n-m = n n-1 2 n-(n-1) = 2n. Frequency (#y)

Step 6, x = 000000 The first case will be referred to as a "weight increasing insertion", denoted by 1/0, which corresponds to extending runs/blocks. The last three cases will be referred to as "weight preserving insertions", and denoted by 0/1, corresponding to splitting runs or adding a new run of length 1. For the remainder of our discussion, a/b means: "a weight increasing insertions and b weight preserving insertions".

Lemma 5.8 Y 1 is composed of 5 :

• weight increasing insertions, resulting in strings of respective weights k 1 + 1, k 2 + 1, k 3 + 1, . . . , k + 1; and

• m -+ 2 weight preserving insertions, i.e., strings of weight 1. 5 A sanity check can be done to verify that we do not miss any strings, since m+1 m + m+1 m+1 = + m -+ 2.

Minimal Entropy For Single Deletions

Lemma 5.9 The transformation g decreases the entropy H n (x) for single deletions, i.e., m = n -1.

Proof:

The proof consists of computing the difference between the entropy before and after applying g, i.e., ∆ 1 = H n (x) -H n (g(x)), and showing that this difference is positive. From Lemma 5.8, after applying g,

• The weight increasing insertions give -1 strings of respective weights k 1 + 1 + k 2 + 1 -1, k 3 + 1, . . . , k + 1.

• The weight preserving insertions give m + 2 -( -1) strings of weight 1.

We now compute the difference of the entropies thanks to the analyses of [k 1 , k 2 , k 3 , . . . , k ] and [k 1 + k 2 , k 3 , . . . , k ], which after simplification gives ∆ 1 (k 1 , . . . , k ) = (k 1 + 1) log

1 k 1 + 1 + (k 2 + 1) log 1 k 2 + 1 -(k 1 + k 2 + 1) log 1 k 1 + k 2 + 1
To show that this is positive when k 1 ≥ 1 and k 2 ≥ 1, it suffices to compute the partial derivatives along each axis, which are positive, and evaluate the function in k 1 = k 2 = 1, which is also positive. by a series of consecutive g operations, as defined in Definition 5.6. Each such operation can only decrease the entropy, as shown in Lemma 5.9, and thus we get a proof for the fact that H n (x) ≥ H n (0 m ).

Remark It is worth pointing out that for the special case of single deletions, the minimization of entropy by the constant string, x = [m], can also be proved using a simple combinatorial argument as follows. For m = n -1, in cluster c = 1 we get a single y string with maximum weight, ω y (x) = n m , corresponding to y = [n] and x = [m], and the remaining strings in cluster c = 0 are all singletons, ω x (y) = 1. This is clearly the most concentrated distribution and hence the least entropic one.

Double Deletions

In the case of two deletions, there are three types of insertions to consider; using the notation introduced in the previous subsection, these are 2/0, 1/1, and 0/2 insertions. For a fixed string x = [k 1 , . . . , k ], we now analyze each case to account for the corresponding number of supersequences and their respective weights in each cluster. We will then study how this distribution changes when we go from x to g(x) in order to prove the following lemma: Lemma 5.11 The transformation g decreases the entropy H n (x) for single deletions, i.e., m = n -2. Note that while this technique could be applied to a higher number of insertions, the complexity of the analysis blows up already for two deletions, as the next subsection will show.

Clustering Supersequences via Double Insertions

Case 2/0 The case 2/0 corresponds to the situation where the insertions do not create new blocks. This happens when both bits are added to the same block, or when they are added to two different blocks, as follows.

The former corresponds to y = [k 1 , . . . , k i-1 , k i + 2, k i+1 , . . . , k ] for some i ∈ [ ], which has weight ω x (y) = ki+2

2

. There are strings of this type. The latter corresponds to y = [k 1 , . . . , k i-1 , k i + 1, k i+1 , . . . , k j-1 , k j + 1, k j+1 , . . . , k ] for 1 ≤ i < j ≤ , and has weight ω x (y) = (k i + 1)(k j + 1). There are ( -1) 2 strings with this weight. In total, there are ( +1) 2 strings for the case 2/0. Case 0/2 In the 0/2 case, there are only weight preserving insertions, hence all strings have weight 1. Weight preserving insertions may happen in a single block, or in two separate blocks. To ease notation, we introduce

k i = k i -1 if i ∈ [2, -1] k i if i = 1 or i =
The different treatments for "endpoints" 1 and correspond to cases [1, k 1 , . . . , k ] and [k 1 , . . . , k , 1], whereas a weight preserving insertion in the i-th block can happen at only k i -1 places.

• If we insert into the first or the last block, we choose respectively k 1 and k positions, i.e., there are respectively k 1 and k different strings.

• If we insert into any other block i, we choose amongst k i -1 positions, which yields k i -1 different strings.

• If we insert in different blocks, we apply the same analysis twice, independently, which gives k i k j different strings.

• If we insert twice in the same block, we get ki+1 2 different strings.

In the end, the total number of 0/2 insertions is Example 5.5 () For example, for 1 < i < j < l we get for all a 1 , a 2 , b 1 , b 2 > 0 such that a 1 + a 2 = k i and b 1 + b 2 = k j , the string k 1 . . . k i-1 a 1 1a 2 k i+1 . . . k j-1 b 1 1b 2 k j+1 . . . k l . The number of such strings is ( k i )( k j ).

Another example: for the particular cases i = j = 1 we get for all a 1 , a 2 , a 3 ∈ N with a 2 strictly positive such that a 1 + a 2 + a 3 = k 1 , the string a 1 1a 2 1a 3 k 2 k l or (case a 2 = 0) a 1 2a 3 k 2 k l .

The number of such strings is k1+1 2 . Case 1/1 As in the previous case, we choose a block in which we apply a weight increasing insertion, yielding k i + 1 masks; then we choose a block for a weight preserving insertion, yielding k i strings. However, one must be careful: to see why, consider the following string x = 000111 = [3, 3].

• If we insert a weight increasing 0 in the first block, and then a weight preserving 1 in the last-but-one position of the first block, we get the string y = 00010111 = [3, 1, 1, 3]. This string is of weight (3 + 1) + (3 + 1), since we can delete the 0 then one of the four 1, or the 1 then one of the four 0.

• If we insert a weight increasing 1 in the second block, followed by a weight preserving 0 in the second position of the second block, we obtain the same string y = 00010111 = [0; 3, 1, 1, 3].

Hence, there are two ways to get each y. We will, therefore, exercise a preference toward the first situation, where we perform a weight increasing insertion in the first block, followed by a weight preserving insertion in the first block's last-but-one position. Let i ∈ [ ].

• If i = 1, we get j=1 k j (= m -+ 2) strings of weight k 1 + 1, as well as a string of weight k 1 + k 2 + 2. In total, we get m -+ 3 strings.

• If 1 < i < , we perform a weight increasing insertion in the block i, the number of strings we will get is ( i k i ). Indeed the string [k 1 , . . . , k i-1 , 1, 1, k i , k i+1 , . . . , k ] will be counted for the case i -1. Each of these strings has weight k i + 1, except one ([k 1 , . . . , k i , 1, 1, k i+1 , . . . , k ]) which has weight k i + 1 + k i+1 + 1 (the string that we will not count for the next example).

• If i = , we can keep the same formula by introducing k +1 = 0 for the weight of the string [k 1 , . . . , k , 1, 1].

Remark (Sanity check for the number of strings) As in the case of one deletion, we will count the number of strings considered to make sure that we do not miss anything. We have:

• case 2/0 : ( +1) 2

• case 0/2 : 1≤i<j≤ k i k j + i=1 ki+1 2

• case 1/1 : 1 + (m --2)

We give an algebraic proof in Section 5.3.7.2 showing that if there exist positive integers (k i ) i∈{1,..., } such that m = i=1 k i , then we have ( +1) 2

+ 1≤i<j≤ k i k j + i=1 ki+1 2 + 1 + (m --2) = m+2 m
+ m+2 m+1 + m+2 m+2 , to make sure we have not missed or double-counted any strings.

Minimal Entropy For Double Deletions

As in Section 5.3.5.1, we analyze the effects of the merging operation g on entropy. For this, we consider the impact of g(x) = [k 1 + k 2 , k 3 , . . . , k ] on the clustering results developed in Section 5.3.5.2. We will omit the analyses when no insertions are made in the first or second block since we will get the same weight and this will disappear in the difference.

Case 2/0 For x, we had ( +1) 2 strings of this type, we now have ( -1)

2

, there are less strings and -1 that grow bigger. The rest remains the same.

Case 0/2 Similar to x, we have a certain number of strings with weight 1 counted as before

3≤i≤j≤ k i k j + 3≤i≤ k i + 1 2
However, a part of the formula changes:

k 1 + k 2 + 1 2 + (k 1 + k 2 ) 3≤i≤ k i (5.20)
Then, for the part of the analysis of g(x) equivalent with that of x we get

k 1 + 1 2 + k 2 2 + (k 1 + k 2 -1) × 3≤i≤ k i + k 1 (k 2 -1) (5.21)
now we take the difference between Equation (5.20) and Equation (5.21)

3≤i≤ k i + k 1 + k 2 + 1 2 - k 1 + 1 2 + k 2 2 + k 1 (k 2 -1)
After simplifications, we obtain 1≤i≤ k i + 1.

Case 1/1 In the case of x, we had ( -1)

1≤i≤ ( k i -1) + 1≤i≤ k i .
We now have ( -2)( 1≤i≤

( k i -1) + 1) + 1≤i≤ k i + 1.
Taking the difference between now and before we get 1≤i≤ k i +1-l. We have ( 1≤i≤l ( k i -1)+1) weights (the weight increasing insertion in the first block) that grow bigger, the rest stays the same.

Remark (Sanity check)

We can check that the numbers of string is constant:

• Case 0/2: 1≤i≤ k i + 1 more strings

• Case 1/1: ( 1≤i≤ k i + 1 -) less strings

• Case 2/0: less strings. and 1≤i≤ k i + 1 -( 1≤i≤ k i + 1 -) -= 0.

We can now compute the difference of the two entropies. Note that instead of working with the probabilities, we will multiply everything by 4 m+2 m . We can focus on the very few strings that show a change in weight (when an insertion is made in the first or second block). Case 2/0: For x, we have 1 string for each of the weights (k 1 + 1)(k 2 + 1), (k 1 + 1)(k 3 + 1), . . . , (k 1 + 1)(k l + 1), (k 2 + 1)(k 3 + 1), (k 2 + 1)(k 4 + 1), . . . ,

(k 2 + 1)(k l + 1), k 1 + 2 2 k 2 + 2 2
For g(x), we still have 1 string for each of the following weights:

(k 1 + k 2 + 1)(k 3 + 1), (k 1 + k 2 + 1)(k 4 + 1), . . . , (k 1 + k 2 + 1)(k l + 1),

k 1 + k 2 + 2 2
Case 0/2: For g(x), we have 1≤i≤ k i + 1. Case 1/1: For x, the remaining strings are:

Multiplicity Weight i=1 ki k1 + 1 i=1 ki -1 k2 + 1 1 k1 + k2 + 2 1 k2 + k3 + 2
There remains, for g(x), one string for each of the following weights k 3 + 1, k 4 + 1, . . . , k l + 1 and 1≤i≤ k i + 1 strings of weight k 1 + k 2 + 1 along with 1 string of weight k 1 + k 2 + k 3 + 2. The difference of entropies is equal to the difference between A and B defined in the following shed more light on various properties of the space of supersequences and the combinatorial problem of counting the number of embeddings of a given subsequence in the set of its compatible supersequences, the original entropy maximization conjecture remains an open problem. Finally, proving the entropy minimization conjecture for an arbitrary number of deletions as well as a more general characterization of the distribution of the number of subsequence embeddings in supersequences of finite-length present some further open problems. + e((a + b)(a + b -1)). Then we match the sum indexes. We also introduce the notation e i = e(k i + 1).

+ 1 -k 1 k 2 -R(k)e(k 1 + k 2 + 1) -(k 1 + k 2 )e(k 1 + k 2 + 2) -e(k 1 + k 2 + k 3 + 2)
+ e(k 2 + k 3 + 2).

Where

P (k) = -3 + 2 1≤i≤ k i , Q(k) = k 1 + k 2 -2 -1 + 1≤i≤ k i R(k) = -k + -1 + 2 1≤i≤ k i .
The gradient can be computed term by term thanks to linearity, observing that for any polynomial S(k), ∇ ((k j + 1)e(k j + 2)) = -log 2 (k j + 2) + 1 ln(2)

k j + 1 k j + 2 u j ∇(1 -k 1 k 2 ) = -k 2 u 1 -k 1 u 2 -∇ (R(k)e(k 1 + k 2 + 1)) = -R(k)∇e(k 1 + k 2 + 1) -e(k 1 + k 2 + 1)∇R(k) = R(k) log 2 (k 1 + k 2 + 1) + 1 ln(2) (u 1 + u 2 ) -e(k 1 + k 2 + 1)(∂ i R(k)) i=1 = R(k) log 2 (k 1 + k 2 + 1) + 1 ln(2) (u 1 + u 2 ) -e(k 1 + k 2 + 1)(2u 1 + • • • + 2u -1 + u ) -∇(k 1 + k 2 )e(k 1 + k 2 + 2) = -(k 1 + k 2 )∇e(k 1 + k 2 + 2) -e(k 1 + k 2 + 2)∇(k 1 + k 2 ) = (k 1 + k 2 ) log 2 (k 1 + k 2 + 2) + 1 ln(2) (u 1 + u 2 ) -e(k 1 + k 2 + 2)(u 1 + u 2 ) = (k 1 + k 2 ) log 2 (k 1 + k 2 + 2) + 1 ln(2) -e(k 1 + k 2 + 2) (u 1 + u 2 ) -∇e(k 1 + k 2 + k 3 + 2) = log 2 (k 1 + k 2 + k 3 + 2) + 1 ln(2) (u 1 + u 2 + u 3 ) ∇e(k 2 + k 3 + 2) = -log 2 (k 2 + k 3 + 2) + 1 ln(2) (u 2 + u 3 )
As it is clearly visible from the above equations, we only need to consider the components along u 1 , u 2 , u 3 , u , and along u i for any 3 < i < . For the latter, we have Proof: [Proof of Lemma 5.14] It suffices to check that (k 1 +k 2 )(λ+log 2 (k 1 +k 2 +1))-k 2 > 0, that log 2 (k 1 + k 2 + k 3 + 2) -log 2 (k 1 + 2) > 0, and that all the remaining quantities are positive.

k 2 + 1 k 2 + 2 -k 1 + R(
Lemma 5.15 (Sublemma) (∇(A -B)) 2 > 0.

Proof: [Proof of Lemma 5.15]

-(Q(k) -k 2 -1)(log 2 (k 2 + 1) + λ) -λ k 2 + 1 k 2 + 2 -k 1 + i=3 (k i + 1) log 2 (k i + 1) + R(k)(λ + log 2 (k 1 + k 2 + 1)) = λ R(k) -Q(k) + k 2 + 1 - k 2 + 1 k 2 + 2 + R(k) log 2 (k 1 + k 2 + 1) + i=3 (k i + 1) log 2 (k i + 1) -Q(k) log 2 (k 2 + 1) = λ -1 i=2 k i + 3 + 1 - k 2 + 1 k 2 + 2 + i=3 (k i + 1) log 2 (k i + 1) + R(k) log 2 (k 1 + k 2 + 1) -Q(k) log 2 (k 2 + 1).
The last line is positive since in particular R(k) log 2 (k 1 + k 2 + 1) -Q(k) log 2 (k 2 + 1) > (R(k) -Q((k)) log 2 (k 2 + 1).

As a result, we have that A -B > 0 for all k such that k i ≥ 1, which establishes the theorem.

Proof of Remark 24

We prove that for all positive integer sequences (k i ) i∈{1,..., } such that i=1 = m we have :

( + 1) 2 + 1≤i<j≤ k i k j + i=1 k i + 1 2 + 1 + (m --2) = m + 2 m + m + 2 m + 1 + m + 2 m + 2
We fix and m, then proceed by induction on the sequences of (k i ) i∈{1,..., } . We fist show the equality for k 1 = m -+ 1, and k i = 1 for all i > 1.

Proof: We have We now fix a sequence (k i ) i∈{1,..., } , and i 0 ∈ {1, . . . , }. We assume that the equality holds for this sequence and show that it is true for the sequence (k i ) i∈{1,..., } defined as k i = k i if i = i 0 and i = i 0 + 1, k i0 = k i0 -1 and k i0+1 = k i0+1 + 1.

( + 1) 2 + 1≤i<j≤ k i k j + i=1 k i + 1 2 + 1 + (m --2) = ( +

Proof:

We first note that only a part of the formula on the left hand side depends on (k i ) i∈{1,..., } .

Letting F (k i ) i∈{1,..., } = 1≤i<j≤ k i k j + i=1 ki+1 2

, we just have to prove that F (k i ) i∈{1,..., } -F (k i ) i∈{1,..., } = 0.

144

Expanding the above difference, we have:

( k i0 -k i0 )( i0-1 i=1 k i ) + ( k i0+1 -k i0+1 )( i0-1 i=1 k i ) + k i0 k i0+1 -k i0 k i0+1 + ( k i0 -k i0 )( i=i0+1 k i ) + ( k i0+1 -k i0+1 )( i=i0+2 k i ) + k i0 + 1 2 - k i0 + 1 2 + k i0+1 + 1 2 - k i0+1 + 1 2
This is equal to

k i0 k i0+1 -( k i0 -1)( k i0+1 + 1) + k i0+1 + 1 2 k i0 ( k i0 + 1) -( k i0 + 1) k i0 - 1 2 k i0+1 ( k i0+1 + 1) -( k i0+1 + 2) k i0+1 + 1 = -k i0 + k i0+1 + 1 + 1 2 (2 k i0 -2 k i0+1 -2) = 0.
This concludes the proof.

Figure 3 . 2 :

 32 Figure 3.2: Two batching testing procedures having (1, 2) as root.

Figure 3 . 3 :

 33 Figure 3.3: Optimality zones for n = 2. A: naive procedure; B: batching procedure (right); C: batching procedure (left).

2.

  Each node of T which is not a leaf has exactly two children, (S ⊥ , S ), and is labelled (S, T ) where S ⊆ Ω and T ∈ Ω, such that a) S ⊥ ∩ S = ∅ b) S ⊥ S = S c) S ⊥ = S ⊥ T and S = S T .

Figure 3 . 4 :

 34 Figure 3.4: Graphical representation of a testing procedure. The collection is [3] = {1, 2, 3}, Ω = {{1}, {2}, {3}, {1, 2}, {1, 3}, {2, 3}, {1, 2, 3}}, the initial set of selections is S = Ω. Only the T labels are written on nodes. Only the S labels are written for leaves.

Figure 3 . 5 :

 35 Figure 3.5: Slices of the cube decomposition for the n = 3 metaprocedure. The slices are taken orthogonally to the cube's main diagonal, with the origin at the center of each picture. Each color corresponds to a procedure. The symmetries are particularly visible.

Figure 3 . 6 :

 36 Figure 3.6: Slices through the cube at the z = 0.17 (left) and the z = 0.33 (right) planes, showing the metaprocedure's rich structure. The origin is at the top left.

Figure 3

 3 Figure 3.7: A 3D visualisation of the cube. Left: exterior, where it is visible that each face has the same decomposition as the 2D problem; Middle: with the naive algorithm region slightly removed, showing that it accounts for slightly less than half of the total volume; Right: exploded view of the 52 substructures (looking from (-1, -1, -1)).

Figure 3 . 8 :

 38 Figure 3.8: Naive algorithm, where the order of tests are unimportant in the left and right branches.

  Figure3.9: The optimal metaprocedure tree (left), and heuristic metaprocedure (right) for the same point x = (0.01, 0.17, 0.51). The optimal procedure has expected length 1.889, as compared to 1.96 for the heuristic procedure.

Figure 3

 3 Figure 3.13: Optimal procedures (without permutations) for each zone when n = 3.

Figure 3 . 17 :

 317 Figure3.17: An efficient solver R for the PDLP, using a polynomial number of queries to A. R implements the random oracle as R.H and the signing oracle as R.Sign. The rewinded adversary and oracles are indicated with a prime symbol.

Figure 3 .

 3 Figure 3.18: An efficient solver for the PDLP, constructed from an efficient EF-CMA adversary against our scheme.

Figure 4 . 2 :

 42 Figure 4.2: The feasibility demonstration consists in deriving the attack's random tape from a verifiable source in a deterministic way, as well as the keys.

Figure 4 .

 4 Figure 4.3: The KeyGen(pp) procedure.

$

  ← -H 2 n,w , and returns:sk ← G pk ← H = F/G mod p • Enc(pp, pk, m) → C.This algorithm takes as input the public parameters pp, the public key pk, and a message m ∈ {0, 1}. It samples {A, B} $ ← -H 2 n,w , and computes: C ← (-1) m (AH + B) mod p.

Definition 4 . 5 (

 45 Projected-Mersenne Low Hamming RatioSearch Problem) Let p = 2 n -1 be a Mersenne prime. Given n, w, d ∈ N, M = 2 d -1, and h ∈ Z p , find f, g ∈ Z p such that 1. g = w 2. f ∧ M = 1 3. f /g = h mod punder the promise that such a couple exists.

Figure 4 . 4 :

 44 Figure 4.4: An illustration of the structure in F , as used in our KeyGen algorithm: a central region of size n -a contains only a single set bit. Note that this figure and the following are not to scale, we give concrete parameters later.

  w . An illustration of F 's structure is given in Figure 4.4. The KeyGen algorithm returns sk ← G pk ← F/G mod p • Enc(pp, pk, m) → C. Sample B $ ← -H n,w and return C ← E(m) • pk + B mod p. • Dec(pp, sk, C) → {m, ⊥}. First compute D ← 2 n-c C • sk mod p. This should be

Figure 4 .

 4 5 illustrates this process.

Figure 4 . 5 :

 45 Figure 4.5: An illustration of the structure in D, as used in our Dec algorithm. For appropriately chosen parameters, projecting by M only retains a noisy version of E(m).

Lemma 4 . 5

 45 Assuming the a-Projected-Mersenne Assumption (Definition 4.6), given a Mersenne prime p = 2 n -1, an integer a output by Setup, any PPT disinguisher has a negligible chance to distinguish between pk and R where pk is the public key generated from KeyGen and R $ ← -Z p . Proof: Letting pk = 2 b • R/G + 2 c • 1/G mod p. Aplpying 4.2 with f being the division by 2 b , the adversary tries to distinguish chal = R/G + 2 c-b G . By 4.3, 2 c-b is of hamming weight 1. So we can rewrite chal = R+2 i G

Proof:

  [of Theorem 4.7] For any PPT distinguisher D, we have by the triangle inequality: ∆ D ((pk, c); (pk, R)) ≤ ∆ D ((pk, c); (R, E(m)R + B))

Theorem 4 . 7 (

 47 Semantic Security under Chosen Ciphertext Attack) Our KEM is semantically secure under chosen ciphertext attack (Definition 4.10) under the a-Projected-Mersenne Assumption (Definition 4.6), with a as defined in 4.4.

Figure 5 . 1 :

 51 Figure 5.1: The structure of PRIDE

Figure 5

 5 Figure 5.2: The PRIDE round function

Figure 5

 5 ∆O 19 = ∆I 20 P -1 (f 20 (k 1 )) ∆X 20 ∆Y 20 = ∆O 20 k 0 P -1 (∆C)

5 . 3 :

 53 Figure 5.3: Propagation on PRIDE of the difference obtained by a flip of Z 0 19

Figure 5 . 4 :

 54 Figure 5.4: EM curve measured of PRIDE cipher

Figure 5 . 5 :

 55 Figure 5.5: Majority vote using duplication

Figure 5 . 7 :

 57 Figure 5.7: Masking based on that of Guilley

T

  0x0 0x1 0x2 0x3 0x4 0x5 0x6 0x7 0x8 0x9 0xa 0xb 0xc 0xd 0xe 0xf 0x0

Proof:

  [of Proposition 5.1] Let D(a, b) denote the set of solutions of the equation S(x ⊕ a) ⊕ S(x) = b. Let us consider (a 1 , b 1 ) and (a 2 , b 2 ) be two differentials with a 1 = a 2 such that #D(a 1 , b 1 ) ∩ D(a 2 , b 2 ) ≥ 2. Let us first prove that both D(a 1 , b 1 ) and D(a 2 , b 2 ) have at least 4 elements. If these two sets have two elements only, D(a 1 , b 1 ) = {x, x ⊕ a 1 } and D(a 2 , b 2 ) = {x, x ⊕ a 2 }, implying that they cannot be the same since a 1 = a 2 . Then, at least one of the two sets contains at least four elements. Suppose that #D(a 1 , b 1 ) = 4 and #D(a 2 , b 2 ) = 2. Then, x ⊕ a 2 ∈ D(a 1 , b 1 ), with D(a 2 , b 2 ) = {x, x ⊕ a 2 }. Consequently,

Υ

  n,x := {y ∈ {0, 1} n : (∃π)[y π = x]} = {y ∈ {0, 1} n : (∃δ)[y δ = x]} Number of Masks or Embeddings Let ω x (y) denote the number of distinct ways that y can project to x: ω x (y) := |{π ∈ P([n]) : y π = x}| = |{δ ∈ P([n]) : y δ = x}|

. 7 )

 7 If y = [a; k 1 , . . . , k ] and x = [a; k 1 , . . . , k ] do not start with the same character, we have to delete the first block to recover the case y = [a; k 2 , . . . , k ], and x = [a; k 1 , . . . , k ].

  to indexes (of y) of opposite letter (if the first one is a 1, the second is a 0 and vice versa) since i j=1 k j and i+1 j=1 k j correspond to indexes (of x) of opposite letter.

Theorem 5 . 5

 55 4 and let run over the range [m, n], we can count all the distinct initial embeddings in Υ n,x , given by n =m -1 m-1 . Moreover, since the bits beyond max(π) are completely undetermined, for a given π, there are exactly 2 n-max(π) y's that have π in common, which, incidentally, provides yet another proof for the fact that |Υ n,x | is a function of only n and m since |Υ n,x | = n =m -1 m-1 2 n-. This allows us to choose the x comprising m 0's and the result in Equation (5.6) follows immediately. All x strings of length m that have the same Hamming weight, give rise to the same number of maximal initials in each cluster.

Theorem 5 . 6

 56 The size of a cluster is purely a function of n, m, c and h(x)∀x, x ∈ Σ m , h(x) = h(x ) =⇒ |Υ c n,x | = |Υ c n,x | Proof: Let denote the position of the last bit of y ranging from |x| = m to |y| = n. Starting from a fixed x string, we enumerate all y strings in cluster c by considering maximal initials within the range of , i.e., ∈ [m, . . . , n]. Let g denote the number of 1's belonging to the surplus bits in cluster c constrained within the range of the maximal initial, [1, . . . , ]. For each , compute |M g ,x | and count the combinations of choosing the remaining c -g additional bits in the remaining n -bits. Let U B = min(c, -m) and LB = max(0, c -(n -)) and thus we get the following:

Theorem 5 . 7

 57 The constant (i.e., x = 11...1 or x = 00...0) and the alternating x strings maximize and minimize the number of singletons, respectively.

Figure 5 . 9 :

 59 Figure 5.9: Impact of the transformation g on the weight distribution for converting x = 101010 to x = 000000, with n = 8, m = 6.

Corollary 5 .

 5 10 For all n and any subsequence x of length m = n -1, we haveH n (x) ≥ H n ([m]) ,with equality only if x ∈ {0 m , 1 m }. Proof: Given any x = [m] of length m = n -1, it can be transformed into the string [m]

1≤i<j≤ k i k j + i=1 k i + 1 2 Example 5 . 4

 254 If k 1 = • • • = k = 1, so that k 1 = k = 1 and k 2 = • • • = k -1 = 0, we count 3 strings.

4 -=

 4 The proof consists of two steps: first we show that A -B > 0 when k 1 = • • • = k = 1; then we show that ∇(A -B) is positive along all directions, so that an increase in any of the k i , results in an increase of A -B.• Step 1. For k 1 = • • • = k = 1, we have: A = -2≤i≤ 4 log 4 -3 log 3 -3 log 3 -1≤i≤ 2 k i log 2 -4 log -2( -2) -3 log 3 -3 log 3 i=1 k i -5 log 5 -6( -1) log 6 = -2 -6log 6 -3 log 3 + 4 -6 log 3 -5 log 5 + 6 log 6 = -(2 + 6 + 6 log 3 + 3 log 3) + 4 -6 log 3 -5 log 5 + 6 + 6 log 3 = -(8 + 9 log 3) + 10 -5 log 5 Thus, A -B = -6 -6 log 3 -16 -(-(8 + 9 log 3) + 10 -5 log 5) = (2 + 9 log(3)) -26 + 5 log(5) -6 log(3) Therefore, A -B > 0 iif > (26 + 6 log(3) -5 log(5))/(2 + 9 log(3)) ≈ 1.46. For ≥ 2, and k 1 = • • • = k = 1, we therefore have A -B > 0. • Step 2. To simplify computations, we introduce the function e(x) = -x log 2 x. We also use the fact that e(xy) = xe(y) + ye(x), and develop the binomial coefficients: e a+b 2 = a+b 2

∂

  i e i = -log 2 (k 1 + 1) -1 ln(2) ∂ i e j = 0 (i = j) ∇S(k)e j = (e j ∂ i S(k) + S(k)∂ i e j ) i=1Hence, by denoting u 1 , . . . , u the canonical basis, we have:∇P (k)e 1 = (e 1 ∂ i P (k) + P (k)∂ i e 1 ) i=1 = ∂ 1 e 1 P (k)u 1 + e 1 (∂ i P (k)) i=1 = ∂ 1 e 1 P (k)u 1 + 2(u 1 + • • • + u ) = (2 + ∂ 1 e 1 P (k))u 1 + 2u 2 + • • • + 2u ∇Q(k)e 2 = (e 2 ∂ i Q(k) + Q(k)∂ i e 2 ) i=1 = ∂ 2 e 2 Q(k)u 2 + (∂ i S(k)) i=1 = ∂ 2 e 2 Q(k)u 2 + u 1 + u 2 + u 1 + • • • + u = 2u 1 + (2 + ∂ 2 e 2 Q(k))u 2 + u 3 + • • • + u -∇ (k 2 + 1) i=3 e i = -(k 2 + 1)∇ i=3 e i -(∇(k 2 + 1)) i=3 e i = -((k 2 + 1)∂ i e i u i ) i=3 -i=3 e i u 2

(

  ∇(A -B)) i = 2 + 1 -(k 2 + 1)∂ i e i -2e(k 1 + k 2 + 1) = 3 + 2(k 1 + k 2 + 1) log 2 (k 1 + k 2 + 1) + (k 2 + 1) log 2 (k i + 1the very similar u axis, (∇(A -B)) = 2 + 1 -(k 2 + 1)∂ e -e(k 1 + k 2 + 1) = 3 + (k 1 + k 2 + 1) log 2 (k 1 + k 2 + 1) + (k 2 + 1) log 2 (k + 1A -B)) 3 = 2 + 1 -(k 2 + 1)∂ 3 e 3 -2e(k 1 + k 2 + 1) + log 2 (k 1 + k 2 + k 3 + 2) + 1 ln(2) -log 2 (k 2 + k 3 + 2) + 1 ln(2) = 3 + 2(k 1 + k 2 + 1) log 2 (k 1 + k 2 + 1) + (k 2 + 1) log 2 (k 3 + 1) + 1 ln(2) + log 2 (k 1 + k 2 + k 3 + 2) -log 2 (k 2 + k 3 + 2) > 0. Along u 2 , (∇(A -B)) 2 = 2 + 2 + Q(k)∂ 2 e 2 -(k 2 + 1)∂ 2 e 2 -i=3 e i -log 2 (k 2 + 2) + 1 ln(2)

  1) + (m -+ 2)(m -+ 1)) + ( + 1)(m -+ 2

  Contents 3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 3.2 Optimal Batch Signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

3.2.1 Introduction and motivation . . . . . . . . . . . . . . . . . . . . . . . 3.2.2 Intuition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.3 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.4 Optimal batch verification . . . . . . . . . . . . . . . . . . . . . . . . 3.2.5 Pruning the generation tree . . . . . . . . . . . . . . . . . . . . . . . 3.2.6 Approximation heuristics . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.7 Equivalences and symmetries for n = 3 . . . . . . . . . . . . . . . . . 3.2.8 Best testing procedure at a point . . . . . . . . . . . . . . . . . . . . 3.2.9 Enumerating procedures for n = 3 . . . . . . . . . . . . . . . . . . . 3.2.10 Conclusion and open questions . . . . . . . . . . . . . . . . . . . . . 3.3 Reusing Nonces in Schnorr Signatures . . . . . . . . . . . . . . . . . . . . . . 53 3.3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.2 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.3 Using multiple q's . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.4 Generic security of the partial discrete logarithm problem . . . . . . 3.3.5 Provably secure pre-computations . . . . . . . . . . . . . . . . . . . . 3.3.6 Implementation results . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.7 Heuristic security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.8 Reduction-friendly moduli . . . . . . . . . . . . . . . . . . . . . . . . 3.3.9 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Table 3

 3

		.1: Generation results for some small n
	n	Number of procedures	Time
	1	1	0
	2	4	∼ 0
	3	312	∼ 0
	4	36585024	∼ 30 mn

  Naccache, and Damien Vergnaud. This work was presented at the 22 nd European Symposium on Research in Computer Security, ESORICS 2017, Oslo (Norway) and published as [BCF + 17].

  Let A be an attacker that wins the EF-CMA game for our scheme, illustrated in Figure 3.16. We construct in Figures 3.17 and 3.18 an algorithm R that uses A to solve the PDLP. A is equivalent to A (with the same random tape which we omit in the notation), the difference being that it interacts with different oracles. Abusing notation we denote by R.H i the composition of the hash function and the conversion function. If L is a list of pairs, we denote by L -1 [e] the index of the element e in the list, and by L[i] the i-th element of the list. If they cannot (i.e. if e is not in the list, or the list does not have an i-th element) they abort.

		Osign
	pp, pk	A H R.Sign R.Hi R.H i R.Sign R.Init	A A m R R.Fin
	Theorem 3.19 (Security under Chosen Message Attack) An efficient attacker against Sign 2
	can be turned into an efficient PDLP solver in the ROM.

Proof: * , r * , s * , ρ * , i Figure 3.16: An efficient EF-CMA adversary A against our scheme, with random oracle H and a signing oracle O. g x , g, p, q1, . . . , q xi, i

  3.3.2 is intractable in the generic group model. This model was introduced by Shoup[START_REF] Shoup | Lower bounds for discrete logarithms and related problems[END_REF] for measuring the exact difficulty of solving classical discrete logarithm problems. Algorithms in generic groups do not exploit any properties of the encodings of group elements. They can access group elements only via a random encoding algorithm that encodes group elements as random bit-strings.

Table 3 .

 3 4: Timing results for Schnorr and our scheme, at 128-bit security (P = 3072, Q = 256). Computation was performed on an ArchLinux single-core 32-bit virtual machine with 128 MB RAM. Averaged over 256 runs.

	Scheme	Storage	Precomp.	Time (per sig.)
	Schnorr	-	-	6.14 ms
	Schnorr + [NSS01]	170 kB	33 s	105 ms
	Schnorr + [NSS01] + [BGMW93]	170 kB	33 s	2.80 ms
	Schnorr + [NSS01] + [BGMW93]	750 kB	33 s	2.03 ms
	Schnorr + [NSS01] + [BGMW93]	1 MB	34 s	2.00 ms
	Schnorr + [NSS01] + [BGMW93]	2 MB	37 s	2.85 ms
	Schnorr + [LL94]	165 kB	3 s	949 ns
	Schnorr + [LL94]	750 kB	3 s	644 ns
	Schnorr + [LL94]	958 kB	3 s	630 ns
	Schnorr + [LL94]	1.91 MB	3 s	472 ns
	Our scheme	-	-	5.94 ms
	Our scheme + [NSS01]	170 kB	33 s	9.2 ms
	Our scheme + [NSS01] + [BGMW93]	170 kB	33 s	1.23 ms
	Our scheme + [NSS01] + [BGMW93]	750 kB	33 s	426 ns
	Our scheme + [NSS01] + [BGMW93]	1 MB	34 s	371 ns
	Our scheme + [NSS01] + [BGMW93]	2 MB	37 s	327 ns
	Our scheme + [LL94]	165 kB	3 s	918 ns
	Our scheme + [LL94]	750 kB	3 s	709 ns
	Our scheme + [LL94]	958 kB	3 s	650 ns
	Our scheme + [LL94]	1.91 MB	3 s	757 ns

Table 3 .

 3

	Scheme	Storage	Time (/sig.)
	Schnorr	-	35.2 ms
	Schnorr + [LL94]	715 kB	508 ns
	Schnorr + [NSS01] + [BGMW93]	750 kB	2.08 ms
	Schnorr + [NSS01] + [BGMW93]	1.87 MB	1.62 ms
	Schnorr + [LL94]	1.87 MB	476 ns
	Our scheme	-	33.0 ms
	Our scheme + [LL94]	715 kB	486 ns
	Our scheme + [LL94]	1.87 MB	467 ns
	Our scheme + [NSS01] + [BGMW93]	1.87 MB	263 ns

5: Timing results for Schnorr and our scheme, at 192-bit security (P = 7680, Q = 384). Computation was performed on an ArchLinux single-core 32-bit virtual machine with 128 MB RAM. Averaged over 256 runs.

  Definition 4.2 A partition of {0, . . . , n -1} into m/2 type 1 blocks and m/2 + 1 type 2 blocks is balanced if the total size of the type 1 blocks and the total size of the type 2 blocks differ by at most one.3

  At this step, we generate random balanced partitions and try LLL on the resulting decomposition. Doing so we quickly find the following partitions

	47, 8e, 95, a1, 134, 19f, 1ab, 1ac, 1ce, 25d, 301, 30a, 3ee, 444, 46b, 471}
	I 2 = {89, b5, de, 116, 141, 1dd, 1de, 2ae, 322, 37a, 388, 38a, 3f9, 48c, 48d, 4e9, 4f2}
	F = 2080000000010000000000000000000004000000000000000000000000000000
	0000000000000000000000000040200000000000000000000000000000000000
	0000020000000000000000000000000000000000040000000180080000000000
	0000000000000001000000000000000000000000000000000000200204000000
	00000000000800008000000000000
	G = 4020000000000000000000000300000000000000000000000000000000000020
	0000000000000000000000000050004000000000000000000000400000000000
	0000000000000000040000000000000000000000000000000000000000000000
	0000060000000000000000000000000000000000000020000000000400000000
	0000040000000002000000000020000000000000000000000000000000000
	H = 1610fecf11dbd70f5d09da1244a85c3aa7aed7de75a6d1fe4e988b5f66d66e1b
	c27d46afd96800ff8b2b67316dff1046b88d205e620ba78a813c15f47ab8a7d2
	a8f7eb12fe0fcff882307d92d4c0f9296a7cf4390ce3140e11e4b7c802fa67d3
	a8517d30b00980380bdf8992ed6a2d3f74e25f14bae21786672bddae4f2bf897
	f38741cdc10b319f8272d42f738cd296d4907331518c3439621aefad5c3d1a7c
	4.2.3.1 Recovering F and G from H
	Finding a Winning Partition. f = {2a, bf, 134, 1ec, 233, 253, 25a, 270, 2ee, 32d, 3e4, 41e, 42b, 4a7, 4f6, 4fd}
	g = {7c, 142, 1d0, 22a, 289, 2c8, 2de, 2e7, 2eb, 33c, 372, 3a0, 3da, 3ff, 48a, 4fd}

  10e, 13c, 198, 1cf, 24b, 27b, 2ac, 30f, 3e1, 456, 45a, 4ba, 4d6, 4fd} Recovering F alone took about two minutes. 7 Given that we have a totally deterministic random tape, we regard our experiment as legitimately reflecting reality. Because F and G are independent, this brings the total effort to about the square of this number, i.e. about 2 34 attempts to get both partitions with certainty. Each of these attempts must also involve one LLL, which is the main cost factor.

Using the same sequence, #64,249 gave a partition for G too (in 7.6 s):

g = {7b, 11c, 13b,

181, 1cc, 1e1, 284, 2e6, 318, 329, 36f, 3e5, 3f1, 404, 476, 4fd}

  and the statistical distance is a/2. With overwhelming probability the statistical distance is negligible. Since there are polynomially many R i s, one can replace them one by one to get from chal to R/G while staying indistinguishable.

	Lemma 4.6 Assuming the a-Projected Mersenne Assumption (Definition 4.6), given a Mersenne
	prime p = 2

n -1, an integer a, any PPT distinguisher has a negligible chance to distinguish between G/R and R where R $

  By Lemma 4.5 we have that pk is indistinguishable from a

random, applying Lemma 4.2 with f (X) = (X, E(m)X + B) with m a message drawn at random and

B $ ← -H n,w . • ∆ D ((R, E(m)R + B); (R, R )).

By Lemma 4.6 we have that B/R is indistinguishable from a random, applying Lemma 4.2 with f

Table 5

 5

						.1: S-box of the block cipher PRIDE
	x	0x0	0x1	0x2	0x3	0x4	0x5	0x6	0x7	0x8	0x9	0xa	0xb	0xc	0xd	0xe	0xf
	S(x)	0x0	0x4	0x8	0xf	0x1	0x5	0xe	0x9	0x2	0x7	0xa	0xc	0xb	0xd	0x6	0x3

  -1 equals 4 (see the difference distribution table in Appendix 5.2.8.2). Moreover, Proposition 5.1 enables us to exhibit pairs of differentials for the S-box which are simultaneously satisfied for a single element. The proof of this proposition is given in Appendix 5.2.8.2.

Proposition 5.1 Let S be an n-bit S-box with differential uniformity 4. Let (a 1 , b 1 ) and (a 2 , b 2 )

Table 5 .

 5 2: Trade-offs between the time complexity, expressed as a number of encryptions, and the number of faults with the ideal fault model.

	Number of faults	1	2	3
	Time complexity	2 64	2 32	2 27.7

Table 5 .

 5 3: Sets of candidates obtained from (∆X 20

Table 5 .

 5 4: Sets of candidates obtained from (∆X 20 , ∆Y 20

Table 5 .

 5 5: Sets of candidates obtained from (∆X 19 , ∆Y 19 ) 1

	Nib0	Nib1	Nib2	Nib3	Nib4	Nib5	Nib6	Nib7	Nib8	Nib9	Nib10	Nib11	Nib12	Nib13	Nib14	Nib15
	0x0	0x4	0x1	0x0	0x0	0x5	0x5	0x4	0x4	0x5	0x5	0x4	0x0	0x5	0x0	0x5
	0x2	0x7	0x3	0x2	0x2	0x6	0x6	0x7	0x7	0x6	0x6	0x7	0x2	0x6	0x2	0x6
	0x8	0xc	0x9	0x8	0x8	0xd	0xd	0xc	0xc	0xd	0xd	0xc	0x8	0xd	0x8	0xd
	0xa	0xf	0xb	0xa	0xa	0xe	0xe	0xf	0xf	0xe	0xe	0xf	0xa	0xe	0xa	0xe

Table 5 .

 5 6: Sets of candidates obtained from (∆X 19 , ∆Y 19 ) 2

	Nib0	Nib1	Nib2	Nib3	Nib4	Nib5	Nib6	Nib7	Nib8	Nib9	Nib10	Nib11	Nib12	Nib13	Nib14	Nib15
	0x8	0x8	0x8	0x8	0x0	0x2	0xa	0x0	0x8	0x0	0x8	0x8	0xa	0x0	0x8	0xa
	0x9	0x9	0x9	0x9	0x1	0x3	0xb	0x1	0x9	0x1	0x9	0x9	0xb	0x1	0x9	0xb
	0xe	0xe	0xe	0xe	0x4	0x6	0xc	0x4	0xe	0x4	0xe	0xe	0xc	0x4	0xe	0xc
	0xf	0xf	0xf	0xf	0x5	0x7	0xd	0x5	0xf	0x5	0xf	0xf	0xd	0x5	0xf	0xd

Table 5

 5

	.7: Comparison between AVR and ARM assembly implementation
		Time (cycle)	Size (bytes)
	AVR assembly implementation (given in [ADK + 14])	1514	266
	ARM assembly implementation (Appendix 5.2.8.6)	2375	490

Table 5 .

 5 11: Sets of candidates obtained from (∆Y 19 , ∆X 19

Table 5 .

 5

		12: Permutation P of PRIDE
	x	0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
	P(x) 0 16 32 48 1 17 33 49 2 18 34 50 3 19 35 51
	x	16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
	P(x) 4 20 36 52 5 21 37 53 6 22 38 54 7 23 39 55
	x	32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47
	P(x) 8 24 40 56 9 25 41 57 10 26 42 58 11 27 43 59
	x	48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63
	P(x) 12 28 44 60 13 29 45 61 14 30 46 62 15 31 47 63

Table 5 .

 5 13: Permutation P -1 of PRIDE

	x	0 1 2 3 4 5 6 7 8 9 10 11 12 13 14
	P -1 (x) 0 4 8 12 16 20 24 28 32 36 40 44 48 52 56
	x	16 17 18 19 20 21 22 23 24 25 26 27 28 29 30
	P -1 (x) 1 5 9 13 17 21 25 29 33 37 41 45 49 53 57
	x	32 33 34 35 36 37 38 39 40 41 42 43 44 45 46
	P -1 (x) 2 6 10 14 18 22 26 30 34 38 42 46 50 54 58
	x	48 49 50 51 52 53 54 55 56 57 58 59 60 61 62
	P -1 (x) 3 7 11 15 19 23 27 31 35 39 43 47 51 55 59

Table 5 .

 5 14: difference distribution table of the PRIDE S-box

5.3.4.3 From Maximal Initials to Hamming Clusters Definition 5.4

  Let Υ c n,x be the cluster of supersequences that have c extra 1's with respect to x, where 0

Table 5 .

 5 15: Clusters, maximal initial projection masks and distribution of weights.

		x = 110			x = 101
	y	π	ω	y	π	ω
	00110	{3, 4, 5}	1	00101	{3, 4, 5}	1
	01010	{2, 4, 5}	1	01001	{2, 3, 5}	2
	01100	{2, 3, 4}	2	01010	{2, 3, 4}	1
	10010	{1, 4, 5}	1	10001	{1, 2, 5}	3
	10100	{1, 3, 4}	2	10010	{1, 2, 4}	2
	11000	{1, 2, 3}	3	10100	{1, 2, 3}	1
	01101	{2, 3, 4}	1	01011	{2, 3, 4}	2
	01110	{2, 3, 5}	3	01101	{2, 4, 5}	2
	10101	{1, 3, 4}	1	10011	{1, 2, 4}	4
	10110	{1, 3, 5}	3	10101	{1, 2, 3}	4
	11001	{1, 2, 3}	2	11001	{1, 3, 5}	4
	11100	{1, 2, 4}	6	11010	{1, 3, 4}	2
	11011	{1, 2, 3}	1	10111	{1, 2, 3}	3
	11101	{1, 2, 4}	3	11011	{1, 3, 4}	4
	11110	{1, 2, 5}	6	11101	{1, 4, 5}

  i -( -3)e 1 + e(k 1 + k 2 + 2) + e 1 k 1 + e 1 k 2 -e 1 + e 1 k i -( -3)e 2 -e 2 + e 2 k 1 + e 2 k 2 -e 2 + e 2 k + e(k 2 + k 3 + 2)At this point we regroup all terms in e i together:+ k 2 + 2) + (k 1 + 1)e(k 1 + 2) + (k 2 + 1)e(k 2 + 2) + e(k 2 + k 3 + 2)We simplify the expression for B in the same fashion:+ k 2 + k 3 + 2) + (k 1 + k 2 + 1)e(k 1 + k 2 + 2) + (k 1 + k 2 + 2)e -(k 1 + k 2 )e(k 1 + k 2 + 2) -e(k 1 + k 2 + k 3 + 2) + e(k 2 + k 3 + 2) = P (k)e 1 + Q(k)e 2 -(k 2 + 1)

	so that we can now compute the difference:
					
	A -B =	 -3 + 2	k i	 e 1
					1≤i≤	
	A =	 2k 1 + 2k 2 + 2k -3 + 2  +  k 1 + k 2 -2 -1 + 3≤i≤ -1	k i	  e 1 k i  e 2
					1≤i≤	
	Thus we can write: +  2k 1 + 2k 2 + k -2 -1 + -(k 2 + 1) e i	k i	 e 2
					3≤i≤	3≤i≤ -1
			A = + (k 1 + 1) e((k 1 + 1)(k i + 1)) + e + (k 1 + 1)e(k 1 + 2) + (k 2 + 1)e(k 2 + 2) k 1 + 2 2 e i + e 3≤i≤ -1 + 1 -k 1 k 2 2≤i≤l + (k 1 + 1)e  	k 2 + 2 2
			+ e(k 1 + 1) k 1 + 1 2 + + e(k 1 + - -k + -1 + 2 k 2 + 1 2	1≤i≤	k i	 e(k 1 + k 2 + 1)
			+		k 1 + 1 2	+ e((k 1 + 1)(k 1 + 2))
			+		k 2 + 1 2	+ e((k 2 + 1)(k 2 + 2))
	+		+ e(k 1 + 1) k 3≤i≤ -1 3≤i≤ -1 e i + e 1 + (k 2 + 1)e 1 + (k 1 + 1)e 2 + (k 1 + 1)e + (k + 1)e 1 (k i + 1) 3≤i≤ e i 3≤i≤ -1 k 1 + k 2 + 2 2 + e((k 1 + k 2 + 1)(k 1 + k 2 + 2))
	+ = (k 1 + k 2 + 2)	k 1 + 1 3≤i≤ -1 2	+ (k 1 + 2)e 1 + (k 1 + 1)e(k 1 + 2) e i
	+	+  2k 1 + 2k 2 + k + -1 + 2 k 2 + 1 2  + (k 2 + 2)e 2 + (k 2 + 1)e(k 2 + 2)  k i  e(k 1 + k 2 + 1)
			+ e 1	3≤i≤ -1
	3≤i≤ -1 3≤i≤ -1 k 1 + k 2 + 2 + e 2 + e(k 1 + 2

1≤i≤l k i + e(k 1 + k 2 + 2) + e(k 2 + 1) 1≤i≤l ( k i -1) + e(k 2 + k 3 + 2) = 3≤i≤ -1 e((k 1 + 1)(k i + 1)) + e((k 1 + 1)(k 2 + 1)) + e((k 1 + 1)(k + 1)) i + e(k 1 + k 2 + 2) + e(k 1 + 1) k 1 + e(k 1 + 1) k 2 + e(k 1 + 1) k + e(k 2 + 1) 3≤i≤ -1 k i -e(k 2 + 1) + e(k 2 + 1) k 1 + e(k 2 + 1) k 2 + e(k 2 + 1) k + e(k 2 + k 3 + 2) = (k 1 + 1) k k B = 2e(k 1 + k 2 + 1) 3≤i≤ -1 k i + k 1 e(k 1 + k 2 + 1) + k 2 e(k 1 + k 2 + 1) + k e(k 1 + k 2 + 1) + e(k 1 + k 2 + k 3 + 2) + ( -3)e(k 1 + k 2 + 1) + (k 1 + k 2 + 2)

i=3 e i + (k 1 + 1)e(k 1 + 2) + (k 2 + 1)e(k 2 + 2)

  (k 1 + k 2 + k 3 + 2) -log 2 (k 2 + k 3 + 2) -log 2 (k 2 + 2) Finally, along u 1 , (∇(A -B)) 1 = 2 + ∂ 1 e 1 P (k) + 2 -(k 2 + 1)∂ 1 e 1 -log 2 (k 1 + 2) + + k 2 ) log 2 (k 1 + k 2 + 2) + 1 ln(2) -e(k 1 + k 2 + 2) + log 2 (k 1 + k 2 + k 3 + 2) -log 2 (k 1 + 2) +

	k) log 2 (k 1 + k 2 + 1) + + (k 1 + k 2 ) log 2 (k 1 + k 2 + 2) + 1 ln(2) + log 2 (k 1 + k 2 + k 3 + 2) + 1 ln(2) -log 2 (k 2 + k 3 + 2) --2e(k 1 + k 2 + 1) 1 ln(2) -e(k 1 + k 2 + 2) 1 ln(2) = 4 -(Q(k) -k 2 -1) log 2 (k 2 + 1) + 1 ln(2) -1 ln(2) k 2 + 1 k 2 + 2 -k 1 + i=3 (k i + 1) log 2 (k i + 1) + R(k) log 2 (k 1 + k 2 + 1) + 1 ln(2) -2e(k 1 + k 2 + 1) + (k 1 + k 2 ) log 2 (k 1 + k 2 + 2) + 1 ln(2) -e(k 1 + k 2 + 2) ln(2) k 1 + 1 k 1 + 2 -k 2 + R(k) log 2 (k 1 + k 2 + 1) + 1 ln(2) -2e(k 1 + k 2 + 2) + (k 1 + k 2 ) log 2 (k 1 + k 2 + 2) + 1 ln(2) -e(k 1 + k 2 + 2) + log 2 (k 1 + k 2 + k 3 + 2) + 1 ln(2) = 4 -(P (k) -k 2 -1) log 2 (k 1 + 1) + 1 ln(2) -k 2 + R(k) log 2 (k 1 + k 2 + 1) + 1 ln(2) -2e(k 1 + k 2 + 2) + log 2 1 + (k 1 1 ln(2) k 1 + 1 1 -k 1 + 2

Lemma 5.14 (∇(A

-B)) 1 > 0.

Often referred as composition

Some problem complexities can show differences when switching from one formalism to another, but this is outside the scope of this thesis

Even tough that would be extremely painful.

To be precise we actually define here the most used, and equivalent notion of indistinguishability.

optimisations that works when several cryptographic primitives have to be executed

Actually testing two incorrect signatures might answers true due to cancellation: if σ 1 and σ

are correct signatures for m 1 and m 2 , for any α testing σ 1 α × ασ 2 for m 1 × m 2 will yield true. We will ignore this issue since it can only happen either with negligible probabilities or from manipulation from legitimate signatures.

This result helps in identifying redundant descriptions of testing procedures, and can be used to narrow down the generation, by skipping over obvious symmetries as they appear in the naive procedure (see Figure3.8).

In contrast to the weak version, the adversary is allowed to forge for a message that they have queried before, provided that their forgery is not an oracle response.

See Section 3.3.8 for a discussion on some particularly interesting moduli.

This conversion function can read the string as a binary number and reduce it modq i for example.

One can note, p-1q i = 2q 1 • • • q i-1 q i+1 • • • q .

BPV is a special case of E-BPV where h = 2. As such they share the same precomputing step.

In practice, it turns out that h = v = 8 performs slightly better, due to various implementation speed-ups possible in this situation

That is, the length of a number, once its leading zeros are discarded.

1279 -σ(1279, 17) ≈ 75 bits.

Since n is odd, we must accept a ± 1 excess.

There is room for improvement here as well since rejection sampling is a very inefficient approach. Nevertheless, it will be sufficient for our discussion, and any approach to generating such partitions would work without impacting the analysis.

We ignore the fact that we sample without replacement here, as h n. Under this approximation, all the bits are sampled uniformly and independently and may fall with probably 1/2 either in a type 1 or a type 2 block.

Other implementations are of course possible and do not affect the analysis. For other classical sampling without replacement algorithms, the reader may consult[START_REF] Stanton | Constructive combinatorics[END_REF].

Experiments with random partitions show that this number is quite variable and follows a Poisson distribution, with a correct partition being typically found earlier, with an average of 2 17 tries.

In particular, if 2 n -1 is prime, then so is n.

The use of a Mersenne prime is not necessary for the scheme's correctness, and in fact no attack is currently known if p is a Mersenne composite. The conservative choice of a Mersenne prime is recommended to avoid potentially unforeseen attacks exploiting the factorisation of p, cf. [AJPS17d, Section 8].

We choose to explicit only one parameter, namely the random numerator's size. The other parameter is the denominator's Hamming weight, which will be the same throughout our different variants, and therefore will not be explicitly noted.

A possibility is to use BCH codes[START_REF] Hocquenghem | Codes correcteurs d'erreurs[END_REF][START_REF] Nyberg | On a class of error correcting binary group codes[END_REF] which are efficient and give fine control over the code's parameters, or Reed-Solomon codes[START_REF] Reed | Polynomial codes over certain finite fields[END_REF] which are MDS.

If E is a linear code, then ?? implies w 2 ≤ d -k + 1, or in other terms, k ≤ d -w 2 + 1. Therefore, η = d.

Even in the case where E can only correct t < η errors, there is still a non zero probability that Dec successfully recovers m, which corresponds to the events where all η -t bits lay between 2 d and 2 n -1; this probability is roughly (1 -2 d-n ) η-t .

In fact, the noise considered here is additive, and may result in more than w 2 bits being affected due to carry propagation. We may choose a stronger error correction capacity to account for such unlikely events.

This lemma also gives an intuition about our security. For example doing the same computation on the public key of AJPS-1, we would get a much smaller number of contributions (17/2 for 128-bits of security).

We omit the the carry's influence to simplify analysis : we only need a bound.

Here we see that the reduction is not tight : for 128-bits of security the probability is 1 -2 69

The intuition of the security of our scheme is in this lemma. Indeed the message is written using this 2 c in the public key. We basically show that dividing by G makes that the 2 c that will contain the message covered in randoms R.

Once again the reduction is not tight. One could try to make it tighter by choosing which R goes with which 1, to minimize x

If it is not the case, the attacker can mount an attack if she knows, for each faulty ciphertext, the corresponding correct ciphertext -to obtain differentials for the S-boxes. However, the key may not be recovered in this case since the information obtained by the attacker depends on the value of the correct ciphertext.

provided that the number of key candidates is smaller than 2 64 . Otherwise, two plaintext-ciphertext pairs are needed.

The notation [n] is overloaded, but the difference will be clarified when it is not clear from the context.

Indeed, if x = yπ, then x = y π and ωx(y) = ω x (y).

Remerciements

Chapter 4

Post Quantum Public-key based on Mersenne primes

Contents

Public-Key Cryptosystems Based on a New Complexity Assumption

Abstract

In 2017, Aggarwal, Joux, Prakash, and Santha introduced a new public-key cryptosystem relying on the conjectured hardness of an ad hoc but credible indistinguishability game [START_REF] Aggarwal | A new public-key cryptosystem via Mersenne numbers[END_REF]. Subsequent work by Beunardeau et al. [START_REF] Beunardeau | On the hardness of the Mersenne low Hamming ratio assumption[END_REF], and de Boer et al. [START_REF] Koen De Boer | Attacks on the ajps mersenne-based cryptosystem[END_REF], led to a revision of the effective hardness and led Aggarwal et al. to amend substantially their original cryptosystem substantially [START_REF] Aggarwal | A new public-key cryptosystem via Mersenne numbers[END_REF]. A bit later Ferradi and Naccache suggested slightly improved variants [START_REF] Ferradi | Integer reconstruction public-key encryption[END_REF] along with several research directions.

In this paper we introduce a cryptosystem similar in spirit to the original Aggarwal-Joux-Prakash-Santha cryptosystem (AJPS-1) but relying on a different hardness assumption. Unfortunately, lattice reduction (à la Beunardeau et al.) experimentally applies in the same way as it does to AJPS. The resulting construction is conceptually simpler than the "fixed" AJPS cryptosystem (AJPS-ECC) and than Ferradi and Naccache's "high-bandwidth" variant (AJPS-FN-BT). This is joint work with Aisling Connolly, Rémi Géraud and David Naccache.

Chapter 5

Physical Security and Information Theory

Contents

No.

Faulty ciphertext

Value Table 5.9: Faults obtained on the 18-th round injection on the 18-th round. For this, we compute the difference output ∆Y 19 from the remaining 4 candidates for the key. Then we can observe that some differentials (∆X 19 , ∆Y 19 ) are not possible and therefore remove the corresponding candidate.

From Clustering Supersequences to Entropy Minimizing Subsequences for Single and Double Deletions

Abstract

A binary string transmitted via memoryless i.i.d. deletion channel is received as a subsequence of the original input. From this, one obtains a posterior distribution on the channel input, corresponding to a set of candidate supersequences weighted by the number of times the received subsequence can be embedded in them. In a previous work it is conjectured on the basis of experimental data that the entropy of the posterior is minimized and maximized by the constant and the alternating strings, respectively. In this work, we present an algorithm for counting the number of subsequence embeddings using a run-length encoding of strings. We then describe two different ways of clustering the space of supersequences and prove that their cardinality depends only on the length of the received subsequence and its Hamming weight, but not its exact form. Then, we consider supersequences that contain a single embedding of a fixed subsequence, referred to as singletons, and provide a closed form expression for enumerating them using the same run-length encoding. We prove an analogous result for the minimization and maximization of the number of singletons, by the alternating and the uniform strings, respectively. Next, we prove the original minimal entropy conjecture for the special cases of single and double deletions using similar clustering techniques and the same run-length encoding, which allow us to characterize the distribution of the number of subsequence embeddings in the space of compatible supersequences to demonstrate the effect of an entropy decreasing operation.

Proof: Upon the deletion induced by f , we obtain a string of the form [ j∈F (1) k j , . . . , j∈F ( ) k j ]. Therefore, we have the same number of blocks in both the y string as well as the x string, and the number of masks can be computed easily as shown in Equation (5.7). We first count the number of ways to choose k i elements from k F (i) and then subtract the number of combinations not using any of the k f (i) .

Remark We can note that F (i) and F (i) * form a partition of [ ].

Following from the preceding theorems, the total number of masks can be computed as follows

(5.9)

By summing over all f ∈ S, we get the total number Ω of compatible masks. Note that it may happen that Ω f = 0; this happens when we try to trace a large block of x from a smaller block of y.

The Set S: We now determine the size of S, as a function of and . Let this size be denoted by σ( , ). We denote u = ( -)/2 . If f (1) = 1, then we get σ( -1, -1); if f (1) = 3, we get σ( -1, -3), etc. We also know that σ(x, x) = 1 for all x, and that σ(x, y) = 0 for all x, y such that y < x. We, therefore get the following recurrence:

Iterating this recursion, we get

and grouping the terms yields

We now describe a direct combinatorial argument which gives a closed form formula for σ( , ) = |S|. First note that if ≡ mod 2 then cannot be in the image of f . So let ˜ = if ≡ mod 2 and ˜ = -1 if not. Now the problem is to choose [ ] elements from [ ˜ ] such that all the gaps have even width. Equivalently, we are interleaving the chosen elements with u = ( ˜ -)/2 gap-segments of width 2. The number of ways to do this is plainly

where A corresponds to x, and B corresponds to g(x). We are now in a position to conclude the proof of Lemma 5.11.

Lemma 5.12 The transformation g decreases the entropy H n (x) for double deletions, i.e., m = n -2.

Proof: To prove this, it suffices to show that for ≥ 2, A -B > 0. The proof mostly consists of computing partial derivatives to show that the function is increasing. We refer the reader to Section 5.3.7.1 for details.

Corollary 5.13 For all n and any subsequence x of length m = n -2, we have

with equality only if x ∈ {0 m , 1 m }.

Proof: Given any x = [m] of length m = n -2, it can be transformed into the string [m] by a series of consecutive g operations (cf. Definition 5.6). Similar to the single-bit deletion case, each such operation can only decrease the entropy, as proved in Lemma 5.11, and thus we get a proof for the fact that H n (x) ≥ H n (0 m ).

Concluding Remarks

From the original cryptographic motivation of the problem, the minimal entropy case corresponding to maximal information leakage is arguably the case that interests us the most. While our results

Résumé

Mots clés

Sécurité de l'information, sécurité physique, cryptographie à clé publique Abstract This thesis, on the border between information security and cryptography, focuses on the use of information security in computer security. This thesis is divided into three scientifically independent parts, which share the same property of solving problems that are or will be faced by the digital industries. We study the batch processing of signatures, in order to respond to the future omnipresence of devices with low computing power being connected to open networks; and therefore having to authenticate a large number of messages. We then focus on the post-quantum threat, examining a new challenging problem involving low-weight Hamming number ratios. Finally we look at the physical security of symmetric algorithm and quantum key exchange, the former being a long-standing challenge, and the other a possibility for future cryptographic key distribution free from the classic problems of cryptography Keywords Information security, physical security, public key cryptography