Keywords:

Je souhaite remercier tous ceux qui, par leur soutien, ont contribué à la réussite de cette thèse. Je remercie tout d'abord les membres du Jury d'avoir accepté d'être là aujourd'hui, en particulier ceux qui viennent de l'étranger. Je remercie chaleureusement Joan Daemen et Henri Gilbert, qui ont dû relire un manuscrit plutôt imposant en peu de temps, mais qui l'ont fait avec le sourire.

Cette thèse n'aurait pas été possible sans le soutien financier de la fondation EADS, envers qui je suis évidement très reconnaissant.

Matérialiste convaincu, je mesure le profit que j'ai pu tirer de l'environnement exceptionnel dont Pierre-Alain Fouque m'a fait bénéficier en me faisant entrer dans l'équipe de cryptographie du LIENS. Merci donc aux autres chercheurs de l'équipe qui ont toujours été à l'écoute, c'est-à-dire par ordre alphabétique Michel Abdalla (fournisseur officiel de café) Bruno Blanchet, Vadim Lyubashevsky, David Naccache et les Men-in-Black, Phong NGuyen, David Pointcheval (pour avoir en plus supporté les inconvénients d'être mon directeur de thèse officiel) et Damien Vergnaud (pour avoir prêté son appartement et son frigo). L'ambiance de cette équipe ne serait pas ce qu'elle est sans ses thésards et post-docs, et pour cela je remercie sans ordre particulier Léo Ducas pour nombre de séances de brainstorming souvent peu frucueuses, Qiang Tang, Georg Fuchsbauer et Steven Gay pour le ping-pong de l'après-midi en 2007, Malika Izabachène, Céline Chevalier et Yuan-Mi Chen pour être sympas, Aurore Guillevic (made in Bretagne) pour les mangas, Aurélie Bauer pour être la Gentille Organisatrice et pour avoir créé un séminaire qui a porté brièvement son nom en signe de reconnaissance éternelle, Olivier Blazy pour les produits dérivés Portal, Jérémie Jean parce qu'il a piraté "Questions pour un champion" ou autre un jeu du même style, Dario Fiore et Mario Streffler parce que ce sont de beaux gosses, David Cade parce que je n'avais jamais vu quelqu'un jouer à une sorte de Guitar-Hero en entrant en transe au cours de la partie, et enfin Miriam Paiola parce qu'elle est souriante et que comme elle est assise juste en face de moi c'est elle que je regarde tout le temps.

Je remercie plus particulièrement les thésards avec qui j'ai eu l'occasion de collaborer. Merci donc à Gaëtan Leurent, mon sempai qui plaçait de facto la barre assez haut, à Sébastien Zimmer pour ses petites siestes qui justifiaient les miennes et pour son aide tranquille mais efficace lors de mes débuts, à Elena Andreeva pour avoir initié une collaboration internationale fructueuse et amicale, à Mehdi Tibouchi qui a été mon oracle pour les problèmes de math qui me dépassaient, à Patrick Derbez pour sa créativité et sa souplesse d'esprit (aussi avec les horaires et la rigueur mathématique), et enfin à Joana Treger-Marim pour sa détermination à l'épreuve des balles, sa rigueur et sa jovialité.

Dans l'ensemble, je n'ai lu en détail que les thèses de Vivien Dubois, de Sébastien Kunz-Jacques, de Magali Turrel-Bardet et de Gilles Macario-Rat. Elles ont été pour moi des documents de travail utiles, sur le sérieux desquels je pouvais compter. J'espère juste que la mienne sera aussi bien.

Je remercie Bo-Yin Yang ainsi que Ludovic Perret et Jean-Charles Faugère, qui ont tous les trois instantanément accepté de participer et de s'investir dans les projets que je leur proposais. Antoine Joux, Vincent Rijmen et Adi Shamir et m'ont tous les trois fait le plaisir et l'honneur de travailler avec moi, et je les remercie de la facilité avec laquelle ils partagent leur expérience et en font profiter leur entourage. Au gré des rencontres, j'ai pu en bénéficier à plusieurs reprises.

Cette thèse n'aurait pas non plus été possible sans le soutien indéfectible de l'équipe administrative et technique de l'ENS. Je remercie chaleureusement Jacques Beigbeder, Nasser Bacha et Ludovic Ricardou pour le dévouement, le sérieux et l'efficacité dont ils ont toujours fait preuve face à mes demandes ou à mes appels au secours. Ils ne seront jamais assez remerciés. Merci aussi à Michelle Angely, Lise-Marie Bivard, Isabelle Delais, Joëlle Isnard et Valérie Mongiat, sans lesquelles je n'aurais jamais rien fait. Elles ne seront jamais assez remerciées non plus.

Je remercie aussi Orr Dunkelman, qui en plus de m'avoir fait bénéficier de son talent et de son sens de l'humour sur une base quotidienne lors de son séjour à l'ENS et même au-delà, est aussi un ami personnel. Finalement, je remercie Pierre-Alain Fouque, très certainement la personne qui a joué le rôle le plus important pour moi dans ces années de thèse. Il a supporté de m'avoir dans les jambes tous les jours pendant pratiquement trois ans avec un calme olympien. Il m'a guidé, m'a proposé des pistes utiles qui ont pu déboucher sur des résultats, s'est préoccupé de l'avancement et de l'aboutissement de mes travaux sans être ni laxiste ni autoritaire. Le spectre large de ses domaines de compétence m'a permit de travailler des sujets (multi)variés, et n'ayant même rien à voir entre eux. En gros, il est responsable des résultats que j'ai pu obtenir.

J'en vient à la partie la plus difficile, celle où il faut que je remercie mon amoureuse. Pour les polémiques de mauvaise foi sur "est-ce que la cryptologie est plus ou moins importante que l'influence du changement climatique sur le régime de la Loire moyenne", je ne sais pas si je dois te remercier. Néanmoins, tu as toujours supporté que je me passionne pour des trucs bizarres, et tu as toujours recollé les morceaux quand la déception succédait à l'enthousiasme prématuré. J'ai commencé cette thèse avant de te rencontrer, mais maintenant la thèse est finie et toi, tu es toujours là. Bref, la science c'est bien, mais toi c'est mieux.

Introduction

Le premier chapitre de cette thèse reprend intégralement le texte de la brochure Sommes-nous prisonniers des codes secrets, que j'ai écrite avec Pierre-Alain Fouque, et qui est parue aux Éditions du Pommier en avril 2011. Pour cette raison, il ne peut être distribué sur internet sans violer les droits de mon éditeur... Chapitre

Présentation de mes Travaux

All Computer Science is Algorithms Donald Knuth

Les travaux que j'ai effectués durant ma thèse relèvent surtout du domaine de la cryptanalyse. Ils ne consistent donc pas tant en la construction de nouveaux mécanismes cryptographiques qu'en l'étude et la "démolition" de mécanismes existants.

J'ai commencé ma vie cryptographique à un moment où la concomitance de nouvelles attaques sur les fonctions de hachage usuelles décidait le NIST (le National Institute for Standards and Technology) à lancer une compétition afin de désigner une nouvelle fonction de hachage standardisée. Les nouvelles attaques et la compétition SHA-3 ont créé un regain d'intérêt pour la construction et l'étude de fonctions de hachage. Dans une première phase, j'ai donc travaillé sur quelques nouveaux modes opératoires qui venaient d'être conçus pour la compétition, avec la perspective d'éviter certaines nouvelles attaques. Je me suis intéressé en particulier aux attaques en seconde préimage, et j'en ai conçu une nouvelle en utilisant des techniques originales. J'ai pu l'appliquer à une grande variété de constructions, y compris à un nouveau mode opératoires conçu par Ron Rivest spécifiquement pour résister à ce genre d'attaques.

Au début de mes travaux, mon équipe d'accueil a créé l'évènement en présentant une attaque spectaculaire contre SFLASH, un schéma de signature "multivarié" qui était considéré comme sûr et était en passe d'être standardisé. J'ai par la suite été entraîné dans le courant de la cryptanalyse de schémas multivariés, parallèlement à mes travaux sur les mode opératoires de fonctions de hachage. C'est dans ce contexte que je me suis intéressé plus précisément à une des hypothèses algorithmique "standard" de la cryptographie multivariée, le problème de l'Isomorphisme de Polynômes. J'ai conçu plusieurs nouveaux algorithmes pour résoudre différentes variantes de ce problème, parfois très efficacement.

Enfin, durant ma thèse, un des principaux évènements cryptographiques a été la découverte de nouvelles attaques sur l'AES, notamment une attaque à clef liée plus rapide que la recherche exhaustive sur l'AES-256, ainsi qu'une attaque marginalement plus rapide que la recherche exhaustive sur l'AES-128. Je me suis donc intéressé à mon tour à l'AES, mais plutôt que d'attaquer le plus grand nombre de tours possible, je me suis concentré sur la recherche d'attaques très efficaces sur un petit nombre de tours. Ces attaques, bien qu'elles ne remettent pas en question la sécurité de l'AES, peuvent parfois s'appliquer à d'autres primitives cryptographiques qui utilisent des composants de l'AES. A cette fin, j'ai participé à la construction d'outils automatiques de recherche d'attaques, qui ont trouvé des attaques ayant échappées aux cryptanalystes.

Je me suis donc penché à la fois à la cryptanalyse symétrique (fonctions de hachage, AES) et asymétrique (schémas multivariés). J'ai logiquement été amené à manipuler des méthodes de cryptanalyse variées, à la fois statistiques (probabilités, paradoxe des anniversaires, comportement aléatoire) et algébriques (résolutions de systèmes d'équations polynomiaux, algèbre linéaire, calcul formel). La cryptanalyse symétrique est plus naturellement statistique, et la cryptanalyse asymétrique plus naturellement algébrique, car les schémas cryptographiques à clef secrète n'ont pas de structure algébrique, contrairement à la plupart des schémas à clef publique. Mes résultats les plus intéressants ont cependant été obtenus en utilisant des méthodes algébriques en cryptanalyse symétrique, et des méthodes statistiques en cryptanalyse multivariée.

Ma thèse s'articule en trois parties, en suivant la distinction thématique soulignée plus haut. Toutefois, il semblait plus logique de présenter mes travaux sur l'AES avant mes travaux sur la cryptanalyse multivariée, afin que mes travaux se présent selon la double progression : symétrique → asymétrique statistique → algébrique. Étendre puis découper le message M en r blocs m 0 , . . . , m r de m bits chacun.

3:

soit h -1 l'état interne initial (traditionnellement nommé IV ).

4:

pour chaque bloc de message m i , calculer h i = f (h i-1 , m i ).

5:

renvoyer H f (M ) = h r . 6: end function

f m 0 f m 1 f m 2 f m r h 0 h 1 h 2 H(M ) IV

Etude de modes opératoires pour les fonctions de hachage

Depuis les années 1990 (et même avant, si on y regarde bien), la plupart des fonctions de hachage itèrent une fonction de compression via le mode opératoire de Merkle-Damgård (cf. Figure 2.1). Il est simple, efficace, et bénéficie d'une forme intéressante de sécurité prouvée. Cependant, en 2004Cependant, en , 2005Cependant, en et 2006, trois nouvelles attaques, dues à Joux [START_REF] Joux | Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions[END_REF], Kelsey et Schneier [START_REF] Kelsey | Second Preimages on n-Bit Hash Functions for Much Less than 2 n Work[END_REF], ainsi que Kelsey et Kohno [START_REF] Kelsey | Herding Hash Functions and the Nostradamus Attack[END_REF], sont apparues, visant spécialement ce mode opératoire. Ce sont donc des attaques qui s'appliquent automatiquement à (presque) toutes les fonctions de hachage existantes, et en tout cas à toutes celles qui reposent sur la construction de Merkle-Damgård.

L'attaque en seconde préimage de Kelsey et Schneier est probablement la plus "ennuyeuse" des nouvelles attaques génériques, car elle vise une des propriétés de base des fonctions de hachage cryptographiques, qui est par exemple nécessaire pour les schémas de signature numérique. De plus, elle remettait brutalement en question la croyance que le mode opératoire de Merkle-Damgård offrait un niveau de sécurité de l'ordre de 2 n évaluations de la fonction de compression face aux attaques en seconde préimage, puisqu'elle n'en requiert que 2 n / , où désigne la taille du message donc on cherche une seconde préimage.

Attaque contre le Dithered Hashing de Rivest [ABF + 08]

Pour empêcher l'attaque de Kelsey et Schneier, Ron Rivest a proposé une modification simple du schéma de Merkle-Damgård, qui consiste à ajouter une entrée supplémentaire à la fonction de compression, qu'on appellera le dithering. Le dithering est une technique bien connue qui consiste à introduire volontairement une certaine quantité de "bruit" dans un signal afin d'éviter des effets de seuil ou la formation de motifs. En infographie, la technique est utilisée avec succès pour rendre des images avec peu de couleurs (cf. figure 2.2). L'idée de Rivest était d'introduire un "bruit", qui perturberait le processus de hachage. Si z[0], z [1], . . . est une "séquence de dithering" bien choisie, cela revient à définir :

h i = f (h i-1 , m i , z[i])
image originale noir et blanc par arrondi noir et blanc par dithering

m 0 f 2 f 1 m 1 f 2 f 1 m 2 f 2 f 1 m r f 2 f 1 IV Figure 2.3 -Merkle-Damgård-Again.
L'attaque de Kelsey et Schneier, repose dans le fond sur le fait qu'on peut former un message expansible en trouvant quelques collisions, c'est-à-dire une famille de messages de toutes les tailles produisant le même état interne. La présence du dithering rend ceci impossible, car elle rend le haché d'un bloc de message dépendant non seulement de l'état interne précédent, mais aussi de sa position dans le message global. Même s'il était possible de produire un message de n'importe quelle taille produisant le même haché, la séquence de dithering serait décalée et viendrait tout perturber.

Pour attaquer cette construction, nous forgeons des seconde préimage M qui ne diffèrent de M que sur un très petit nombre de blocs, typiquement n/3. Pour cela, nous utilisons la technique du "herding" de Kelsey et Kohno [START_REF] Kelsey | Herding Hash Functions and the Nostradamus Attack[END_REF]. Nous repérons ensuite la séquence de taille n/3 qui revient le plus souvent dans z, et nous appliquons notre attaque à toutes les positions correspondantes. (Mal)heureusement, la séquence z choisie par Rivest possède un certain nombre de facteurs fréquents, et notre attaque est donc à peine plus coûteuse que celle de Kelsey et Schneier.

Attaque contre Merkle-Damgård-Again [ABDK09]

Une manière simple mais efficace de rendre une fonction de hachage itérée plus résistante consiste à randomiser son état initial. Cela interdit déjà un certain nombre de calculs offline. Plus sophistiqué, il est possible de hacher le message une première fois, de se servir du haché pour redéfinir l'état initial, puis de re-hacher le message une seconde fois. Nous appelons le mode opératoire résultant Merkle-Damgård-Again (il est illustré figure 2.3), et on peut le définir par :

H (M ) = H(H(IV, M ), M )
Cette construction (qui fait partie du folklore) n'est pas facile à attaquer, car modifier le message pour tenter de contrôler ce qui se passe dans l'une des deux itérations aboutit généralement à un résultat incontrôlable dans l'autre itération.

J'ai toutefois trouvé une attaque en seconde préimage contre cette construction folklorique, pour un coût à peine supérieur à celui de l'attaque de Kelsey et Schneier sur Merkle-Damgård. La difficulté consiste à attaquer la seconde itération tout en garantissant que la première produit toujours le même résultat. Cela est encore une fois possible à l'aide de techniques de "herding" qui permettent de contrôler la valeur de chainage dans la première itération. A partir de là, on construit des multicollisions à la Joux, qui donneront de la liberté dans la seconde itération tout en garantissant que le résultat de la première reste constant. Il est ensuite possible de rejouer l'attaque en seconde préimage utilisée contre le dithered hashing dans la seconde itération, "par dessus" les multicollisions.

Preuves de résistance aux attaques en seconde préimage

Face à l'apparition de l'attaque en seconde préimage de Kelsey et Schneier, ainsi que de celle que j'ai proposée, il est naturel de se demander s'il existe des modes opératoires qui résistent prouvablement à ces attaques. Il existait déjà des familles de fonctions de hachage qui résistent à des formes d'attaques en seconde préimage (les Universal One-Way Hash Functions). L'une des plus efficaces est due à Shoup [START_REF] Shoup | A Composition Theorem for Universal One-Way Hash Functions[END_REF], et a un niveau de sécurité prouvé de 2 n / évaluations de la fonction de compression. Plus récemment, Andreeva d'un côté [START_REF] Andreeva | A three-property-secure hash function[END_REF] et Yasuda de l'autre [START_REF] Yasuda | How to fill up merkle-damgård hash functions[END_REF] ont proposé de nouvelles variantes du mode de Merkle-Damgård bénéficiant de résistance prouvée aux attaques en seconde préimage. Mis à part la dernière, ces constructions sont assez peu pratiques, car il s'agit de familles de fonctions de hachage, et non d'une unique fonction de hachage.

Présentation de mes Travaux

f m 0 f m 1 f m 2 f m r -1 f m r h 0 h 1 h 2 h r-1 0 1 2 r -1 -1 H(M ) IV
h i = f (h i-1 , m i , i)
Biham et Dunkelman ont affirmé que calculer des secondes préimages sur Haifa était aussi dur que la recherche exhaustive, mais sans présenter de preuve. J'ai donc mis au point une preuve élémentaire de résistance aux secondes préimages pour Haifa : sous l'hypothèse que la fonction de compression est idéale, alors trouver une seconde-préimage sur son Haifa-itération nécessite environ 2 n évaluations de la fonction de compression. L'argument clef est que chaque fois que l'adversaire évalue la fonction de compression il doit fournir une valeur i du compteur. Dès lors, le résultat de la fonction de compression n'est exploitable que s'il s'agit précisément de h i , et cela arrive avec probabilité 2 -n si la fonction de compression est aléatoire. La même technique de preuve permet au passage de prouver que l'attaque de Kelsey et Schneier est optimale si la fonction de compression est idéale.

L'hypothèse de travail (la fonction de compression est idéale) est très forte, mais il n'est pas évident de l'affaiblir. D'une part, si la fonction de compression est trop faible, le résultat peut ne plus être vrai. D'autre part, cela nécessiterait alors de changer de technique de preuve, et le résultat cesserait probablement d'être élémentaire.

Une perte de sécurité est inévitable dans le modèle standard

La quantité 2 n / est déjà apparue plusieurs fois dans ce résumé : c'est le coût de l'attaque de Kelsey et Schneier, ainsi que de celle que j'ai découverte. C'est aussi le niveau de sécurité prouvée obtenus dans le modèle standard (i.e., sans supposer que la fonction de compression est idéale) par les constructions de Shoup, Andreeva et Yasuda. En fait, il ne s'agit pas d'une coincidence, car ces trois constructions utilisent la même méthodologie pour démontrer leur résistance aux attaques en seconde préimage : il s'agit d'une preuve par réduction en boite noire à la sécurité de la fonction de compression. Plus précisément, il est démontré dans les trois cas qu'un adversaire en seconde préimage contre l'itération avec probabilité de succès ε peut être transformé en un adversaire en seconde préimage contre la fonction de compression avec probabilité de succès ε/ .

Il est possible de démontrer que cette "perte de sécurité" d'un facteur est inévitable, et ce pour pratiquement n'importe quelle construction (dans certaines limites raisonnables). Pour cela, je montre qu'il est possible de construire un environnement autour de la réduction (c'est-à-dire un adversaire contre l'itération et une fonction de compression), dans lequel il est facile de montrer que la réduction ne peut réussir qu'avec probabilité 1/ .

Recherche automatiques d'attaques sur des versions réduites de l'AES

La plupart du temps, lorsqu'ils sont confrontés à un système de chiffrement par bloc, les cryptanalystes cherchent à casser le plus grand nombre de tours possible, tout en utilisant un peu moins de temps que la recherche exhaustive et un peu moins de données que l'ensemble du codebook. Pour aller un peu plus loin, ils se placent parfois dans des modèles plus puissant : chiffrés choisis, clefs liées, sous-clefs liées, clef connue, etc. La signification pratique de ces modèles plus forts reste sujette à caution.

Dans ma thèse, j'ai choisi de m'intéresser à un aspect relativement inexploré de la sécurité des système de chiffrement par blocs : la sécurité d'un petit nombre de tours face à des adversaires disposant de peu de données. Les attaques avec peu de données peuvent parfois servir de "brique de base" dans des attaques plus 2.2. Recherche automatiques d'attaques sur des versions réduites de l'AES sophistiquées (on l'a vu récemment avec la cryptanalyse de GOST [START_REF] Isobe | A single-key attack on the full gost block cipher[END_REF], où une attaque sur les 32 tours est construite à partir d'une attaque sur 8 tours avec deux paires clair/chiffré connues).

La faible quantité de donnée qu'on se restreint à utiliser impose interdit l'usage des techniques de cryptanalyse "statistique" habituelles, telles que la cryptanalyse linéaire ou différentielle. Les attaques algébriques sembleraient à priori plus adaptées, mais elles n'ont jamais réussi à casser même un seul tour d'AES. J'ai donc cherché des attaques de type "guess-and-determine" dans un premier temps, puis des attaques de type "meet-in-the-middle", qui semblent a priori plus puissantes que les premières. Trouver ces attaques à la main est difficile, car il y a beaucoup de "possibilités" à explorer, et il est facile de se tromper à un moment donné. Il était donc naturel de concevoir des outils automatiques pour chercher ces attaques à ma place.

Ces outils travaillent à partir d'une description de l'AES sous forme d'un système d'équations linéaires avec une bijection inerte qui représente la boite-S. Ils exploitent de façon inattendue la structure algébrique de l'AES, notamment le fait que toutes les opérations admettent une description naturelle sur F 2 8 .

Recherche automatique d'attaques "Guess-and-Determine" [BDF11]

Les attaques les plus facile à chercher de manière automatique sont les attaques "guess-and-determine". Dans leurs versions les plus simples, ces attaques consistent à énumérer toutes les valeurs possibles d'une partie des secrets inconnus, puis d'utiliser la description du mécanisme cryptographique pour en déduire la clef secrète, et enfin vérifier si cette clef est bien la bonne. J'ai donc conçu un outil qui énumère tous les sous-ensembles de l'état interne, et détermine si la connaissance de chacun de ces sous-ensembles permet de déduire la clef secrète, et si oui de quelle manière. Pour cela, l'outil cherche si des combinaisons linéaires des équations permettent d'exprimer les parties inconnues de l'état interne en fonction de celles qu'on énumère. Ce processus est exponentiel, mais il suffit de l'exécuter une seule fois pour en déduire un programme qui effectue la récupération de clef.

Ce programme a trouvé des attaques sur 1, 2 et 3 tours complets de l'AES avec une seule paire clair/chiffré connue. Sur 1 tour, l'attaque trouvée, d'une complexité de 2 40 opérations, est plus rapide que la meilleure connue (qui était en 2 48 ). L'attaque sur 3 tours, d'une complexité de 2 120 opérations, était inconnue auparavant.

Cet outil ne parvient pas véritablement à utiliser la donnée de plusieurs paires clair/chiffré, car il n'est pas capable d'utiliser l'idée que si les différence sont connues à l'entrée et à la sortie d'une boite-S, alors les valeurs peuvent être déduites facilement.

Recherche automatique d'attaques "Meet-in-the-Middle" [BDF11]

En partant de ce que la conception de ce premier outil m'avait appris, j'ai pu participer à la construction d'un second outil plus puissant, qui cherche des attaques de type Meet-in-the-middle. Cet outil part de l'idée que s'il existe deux algorithmes permettant d'énumérer efficacement les valeurs que peuvent prendre deux ensembles A et B de variables apparaissant dans la primitive de chiffrement, alors il est peut-être possible d'énumérer A ∪ B, en utilisant les équations qui lient ensemble les variables de A et B pour éliminer les combinaisons "impossibles". La procédure de recherche construit donc par "saturation" des algorithmes qui énumèrent ensembles de variables de plus en plus gros, jusqu'à ce que l'un d'entre eux contienne la clef secrète.

Un des avantages de ce nouvel outil par rapport au précédent est qu'il prend automatiquement en compte les propriétés "différentielles" de la boite-S. Cela lui permet d'exploiter efficacement la présence de plusieurs messages. Cet outil a amélioré (presque) toutes les attaques connues sur un petit nombre de tours d'AES, qu'elles aient précédemment été trouvée manuellement ou automatiquement.

Application

Résultats sur des versions réduites de l'AES [BDD + 10]. Ce deuxième outil a trouvé beaucoup d'attaques sur l'AES lui-même. Il a amélioré l'attaque sur 1 tour avec un seul message (en 2 32 opérations). Il a trouvé une attaque marginalement plus rapide que la recherche exhaustive sur 5 tours avec une seule paire clair/chiffré. Il a également trouvé une attaque en 2 32 opérations sur 2 tours avec deux paires clair/chiffré connues, et en 2 8 opérations avec deux paires clair/chiffré choisies. Il a enfin trouvé une attaque contre 4 tours avec 4 paires clair/chiffré choisies en 2 32 opérations. Dans un autre registre, il a amélioré l'attaque par faute de Piret et Quisquater [START_REF] Piret | A Differential Fault Attack Technique against SPN Structures, with Application to the AES and KHAZAD[END_REF], en réduisant la complexité de 2 32 opérations à 2 24 .

Résultats sur d'autres primitives cryptographiques. L'outil a également donné des résultats sur un MAC basé sur l'AES, Pelican-MAC [START_REF] Daemen | The Pelican MAC Function[END_REF] et sur un système de chiffrement par flot également basé sur l'AES, LEX [START_REF] Biryukov | A New 128-bit Key Stream Cipher LEX[END_REF].

Sur Pelican-MAC, l'outil a aidé à la construction de la meilleure attaque connue à ce jour, en mettant au point une procédure qui révèle l'état interne de la fonction en temps 2 32 une fois qu'une collision sur l'état interne est trouvée. Cela est obtenu en résolvant l'équation AES 4 (x) `AES 4 (x `∆i ) = ∆ o en x, où AES 4 dénote 4 tours complets d'AES sans addition de clef. L'attaque résultante a une complexité de 2 64 requêtes au MAC (pour obtenir la collision).

Sur LEX, l'outil a également été utilisé pour construire une meilleure attaque. Il a d'abord aisément retrouvé tout seul la meilleure attaque connue, de complexité environ 2 100 opérations, puis, avec l'intervention d'un utilisateur, il a produit une attaque de complexité 2 80 , qui utilise 80 tera-octets de key-stream.

Étude de problèmes difficiles en cryptographie multivariée

La cryptographie multivariée est une appellation qui englobe l'ensemble des schémas (essentiellement à clef publique) donc la sécurité repose notamment sur la difficulté de la résolution de systèmes d'équations polynomiaux multivariés sur un corps fini. Quand ces polynômes sont de degré deux, le problème s'appelle MQ, pour Multivariate Quadratic. + 10] Durant mes travaux, j'ai été amené à m'interroger sur la difficulté pratique du problème MQ, afin de déterminer si des jeux de paramètres concrets pour certains schémas pouvaient être cassés avec les moyens matériels restreints à ma disposition. Sur F 2 , la méthode de résolution la plus efficace de MQ reste la recherche exhaustive, qui nécessite 2 n opérations s'il y a n variables. C'est en essayant de programmer une implémentation efficace que j'ai aperçu la possibilité d'améliorations algorithmiques. J'ai donc conçu un algorithme de recherche exhaustive extrêmement efficace, puisqu'il permet de tester entre 2 et 3 solutions par cycle du processeur sur chacun des coeurs d'une machine moderne. Ce nouvel algorithme a également été implémenté sur GPU, permettant d'obtenir des performances plus élevées pour un coût plus faible qu'avec les processeurs habituels. Il est possible de résoudre une instance de MQ avec q = 2 et n = 64 en un jour pour environ $7500 sur le cloud. La technique algorithmique s'adapte également à des systèmes de degré plus grand.

Nouvel algorithme de résolution d'équations polynomiales sur F 2 [BCC

2.3.1.1 Attaque contre un schéma d'identification de Patarin [START_REF] Bouillaguet | Practical cryptanalysis of the identification scheme based on the isomorphism of polynomial with one secret problem[END_REF] En 1996, Patarin avait proposé de construire un schéma d'identification à clef publique basé sur la difficulté de l'équivalence simultanée de paires de formes quadratiques (QFSE pour faire court). Il s'agit, étant donné 4 formes quadratiques f 1 , f 2 , g 1 et g 2 , de trouver une matrice inversible S telle que g 1 = f 1 • S et g 2 = f 2 • S, lorsqu'elle existe. Aucun algorithme plus rapide que la recherche exhaustive n'était connu à ce jour pour résoudre ce problème malgré plusieurs articles lui étant consacré. Le schéma d'identification lui-même s'inspire très directement du schéma plus ancien de Goldreich, Micali et Wigderson reposant sur la difficulté de l'isomorphisme de graphe.

Durant ma thèse, j'ai conçu un algorithme de résolution du problème algorithmique sous-jacent, qui permet de casser en quelques secondes les paramètres proposés par Patarin, et dont le niveau de sécurité attendu était de l'ordre de 2 256 . Cet algorithme fonctionne en faisant apparaître S comme la solution d'un problème d'équivalence de pinceaux matriciels construit à partir de la représentation des formes quadratiques par des matrices symétriques. Il apparaît alors que S vit dans un sous-espace vectoriel de dimension O (n) de l'ensemble des matrices, et qu'elle peut être entièrement déterminée par la résolution d'une (petite) instance de MQ.

Etude du problème de l'équivalence linéaire de polynômes

Une partie de la cryptographie multivariée repose dans le fond sur une procédure d'obfuscation assez simple. On choisit une fonction f : (F q )

n → (F q ) n qu'on sait facilement inverser, et qui admet une représentation par des polynômes quadratiques. Ensuite, on la "cache" en définissant PK = T • f • S, où S et T sont des matrices inversibles secrètes. La clef publique PK (un vecteur de polynômes quadratiques multivariés) est alors une version "masquée" de f , qu'on espère impossible à inverser. Le problème de l'équivalence linéaire de polynôme (PLE pour faire court) consiste à retrouver S et T étant donné PK et f . La difficulté déduire la clef secrète de la clef publique dans un certain nombre de schémas multivariés repose donc sur le caractère difficile de ce problème. Ce problème se présente en deux variantes assez différentes, selon que f et PK sont formés de polynômes homogènes (cas dur) ou inhomogènes (cas facile).

Nouveaux algorithmes pour le problème IQMLE

Faugère et Perret avaient déjà observé en 2006 que le problème de l'équivalence linéaire de polynômes quadratiques inhomogènes (IQMLE) était (empiriquement) soluble en temps O n 9 . Néanmoins, leur assertion ne reposait pas sur une preuve mathématique rigoureuse, mais sur l'observation du comportement d'un algorithme de calcul de base de Gröbner.

J'ai mis au point deux algorithmes de résolution de IQMLE. Le premier, assez heuristique et inspiré de la méthode "To-n-Fro" de Patarin, Goubin et Courtois, fonctionne en temps O n 3 , et échoue parfois de manière surprenante. Le second fonctionne en temps O n 6 en moyenne, et s'applique à la (large) fraction des instances qui satisfont une certaine condition. Ce deuxième algorithme fonctionne également en faisant apparaître S et T comme solutions d'un problème d'équivalence de pinceaux matriciels, ce qui permet là encore de démontrer qu'elles vivent dans un espace vectoriel de dimension O (n). Récupérer S et T revient alors à résoudre un système de ≈ n 3 équations quadratiques en n variables, ce qui est possible en temps polynomial si les équations sont linéairement indépendantes.

Le caractère inhomogène de l'instance est crucial pour construire les pinceaux équivalents, et donc faire marcher l'ensemble de la technique.

Nouveaux algorithmes pour le problème QMLE

Je me suis enfin intéressé au cas difficile où les polynômes sont homogènes (le problème QMLE), et où les techniques précédentes ne s'appliquent pas. Dans cette configuration, la méthode "To-n-Fro" de Patarin, Goubin et Courtois a une complexité au moins aussi grande que q 2n . La complexité de l'algorithme de Faugère et Perret, qui repose sur un calcul de base de Gröbner, est globalement inconnue, mais pourrait être de l'ordre de O 2 18n si un certain système d'équation quadratique a un comportement "régulier".

J'ai conçu deux algorithmes, l'un s'exécutant en O q 2/3n opérations, et l'autre, valable uniquement quand q = 2, s'exécutant en 2 n/2 opérations. Les deux algorithmes fonctionnent en tentant de déterminer l'image de S en un point, ce qui permet de se ramener au cas inhomogène facile. Pour accomplir cet objectif plus vite que la recherche exhaustive, les deux algorithmes reposent sur le paradoxe des anniversaires et s'inspirent de la méthode de Weisfeiler-Lehman pour l'isomorphisme de graphe. Une pair de graphes est construite, et S est un isomorphisme transformant l'un en l'autre. Pour trouver l'image de S en un point, on échantillonne des noeuds dans le graphe et on explore la topologie de leur voisinage, qui est préservée par l'isomorphisme. Une collision entre la "forme" de deux voisinages indique alors la possibilité d'une relation de la forme y = S • x. Le premier algorithme ne regarde que les voisins immédiats de chaque noeud, tandis que le second algorithme explore des voisinages plus gros.

Attaque d'une classe de clefs faibles dans HFE [BFJT09]

HFE est un schéma de chiffrement/signature proposé par Patarin en 1996. Il repose aussi sur l'idée de l'obfuscation d'une fonction aisément inversible, mais cette fois-ci la fonction obfusquée est gardée secrète. La sécurité de HFE ne repose donc pas sur la difficulté de problème d'équivalence linéaires de polynôme. Patarin avait proposé, pour diminuer la taille des clefs, l'utilisation d'une variante "sous-corps". Dans ce cas-précis, le Frobenius commute avec la fonction aisément inversible f , et il existe en fait une paire de matrices (U, V ) telle que PK = U • PK • V . Récupérer U et V revient à résoudre une instance de QMLE, et ensuite, reconstruire la clef secrète à partir de U et V est faisable en pratique (et nous conjecturons que cela peut se faire en temps polynomial). Cette attaque permet, sur la variante sous-corps de HFE, de récupérer en pratique la clef secrète de HFE à partir de la clef publique pour les paramètres proposés par Patarin.

Mes publications

La liste de mes publications scientifiques figure dans les tables 2.1 et 2.2. Je suis également l'auteur de deux textes de vulgarisation. J'ai écrit une postface au roman Le code de Cambridge de Tony Gheeraert, paru en mars 2010 aux éditions Le Pommier, dans laquelle les idées et les techniques liées à la cryptographie apparaissant dans le roman sont détaillées. Je suis également l'auteur d'un petit livre de vulgarisation de la cryptographie intitulé Sommes-nous prisonniers des codes secrets ?, également paru aux éditions du Pommier en avril 2011, dans laquelle je discute les tenants et les aboutissants de la cryptographie dans la vie quotidienne de monsieur tout-le-monde.

[BFJT09]

A

Part One

Modes of Operations of Hash Functions Introduction

A hash function is "any well-defined procedure or mathematical function that converts a large, possibly variable-sized amount of data into a small datum, usually a single integer that may serve as an index to an array" [START_REF] Wikipedia | Hash function -wikipedia, the free encyclopedia[END_REF]. When used to accelerate data lookup in databases or associative arrays, the most interesting properties of hash functions are probably the speed at which they can be computed, and the uniformity of the output distribution on more-or-less arbitrary inputs.

Cryptographic Hash Function Security

To be used in a cryptographic environnment, a hash function must of course be efficiently computable and uniformly distributed, but this is hardly sufficient; a cryptographic hash function must also offer more features. An easily-invertible, very malleable 1 function is of little use in cryptography, but, on the other hand, "secret-protecting" functions can serve a handful of purposes. The usual intuition is that a cryptographic hash function is such that H(M ) reveals nothing useful about M . We briefly discuss several possible applications of a cryptographic hash functions H, highlighting the various features required therefrom.

Password Storage. User accounts are very often protected by passwords in multi-user computing environments or online services. Directly storing these passwords is a bad practice: as a result of a misconfiguration, for instance, users could possibly read the file containing all passwords. A mischievous user could try to boot his colleague's computer using an alternate media (such as bootable USB stick), then observe the content of the hard-drive, and steal his colleague's password. Lastly, online servers could be hacked, again resulting in password theft.

Hash functions can be used to securely store passwords in a variety of contexts. Instead of directly storing a password p, we store the hash of p. As long as H is a one-way hash function (also called preimageresistant hash functions), then reading the password file neither reveals the actual passwords nor "equivalent" passwords that have the same hash. It is still possible to verify that users enter their passwords correctly, by evaluating H on a user's input and comparing the result with H(p).

Faster and Smaller Digital Signatures. In most electronic signature applications, it is beneficial to sign the hash of a document rather than signing the document itself. Signature schemes tend to be slow (the RSA signature algorithm is typically cubic in the size of the modulus, which has to be longer than the message to sign), and it is desirable to keep the signatures as small as possible. Thus, instead of signing a document M , we instead sign H(M ). This practice can apparently be traced back down to [START_REF] Williams | A modification of the rsa public-key encryption procedure[END_REF].

Doing so introduces the possibility that adversaries cheat the system without breaking the signature algorithm, but instead by attacking the hash function. If the hash function is not collision-resistant, i.e., if it is possible to find two distinct messages M 1 and M 2 such that H(M 1 ) = H(M 2 ), then a frauder could repudiate his own signatures: he could compute a colliding pair M 1 , M 2 such that H(M 1 ) = H(M 2 ), sign M 1 (e.g. his electronic tax forms), and then later on pretend that he signed M 2 , since they have the same hash, and therefore the same signature.

If the hash function is not second-preimage-resistant, then a third party could forge signatures and try to impersonate a legitimate signer. Suppose Mélanie signs a message M , which is subsequently made public. The signature algorithm has been applied to H(M ), and if Victor (the Vilain) is able, given M , to find another message M such that H(M ) = H(M ), then he could exhibit a legitimate signature of M by Mélanie, even though Mélanie herself never signed it.

Note that in this scenario two different flaws in the hash function lead to two different breakages of the signature scheme. If the hash function is not collision-resistant but only second-preimage resistant, then the signature scheme is secure against malicious outsiders, but not against malicious users.

Timestamping. Suppose we would like to set up a secure timestamping web service. The users would like to have a guarantee that they were in possession of a given file at a certain point in time. For instance, an inventor could want to prove that she owned a description of her invention before making it public. On the other hand, the users do not want us (the web service), or the general public to learn the content of their files. Cryptographic hash functions solve this problem nicely: users send us the hashes of their files, and we publish the hashes along with the times at which we received them. If the hash function is one-way, then no information about the users's files is leaked (the web service is "hiding").

In order to be reliable, for instance to stand up in a court of law, our timestamps should resist forgeries, in other words it must be binding: it must not be possible to send us a hash, and then, at a later point in time, to forge a file, with a partially chosen content, yielding this particular digest (the users really commit to their files). Here is a typical example in which such forgeries could be exploited: a con man could pretend to be a medium and to be able to predict the future. To prove his point, he would tell everyone that he had written down his prediction in a file and he would commit it to the timestamping web service. In fact, he would perform some kind of precomputation and commit a carefully chosen hash h f raud to the web service. Then, after the actual event takes place, he would write down a description of what happened (let us call this "message" M event ) and he would try to find a suffix M f orgery such that H(M event M f orgery ) = h f raud . If he succeeded, the con man could pretend that his prediction has been fulfilled, and reveal M event M f orgery to prove his point. Of course his prediction file would contain a little bit of rubbish at the end, but who cares?

Observe that the relevant security notion of the hash function is a bit more sophisticated than what we have seen before. If H is collision-resistant, then of course the timestamping is secure, but this condition is not necessary. One-wayness is not sufficient, because the game played by the adversary is a priori easier than just inverting the hash function. The right notion is Chosen Target Forced Prefix Collision resistance [START_REF] Kelsey | Herding Hash Functions and the Nostradamus Attack[END_REF].

How to Make it Simple

Hash functions are the swiss army knife of contemporary cryptography, and if we examined more and more common usages of hash functions (entropy extraction, key derivation, forward security, MACs, etc.) we would likely come up with a few more security notions that a hash function should satisfy. This is going to result in a (long) list of more-or-less natural security notions that a "good" hash function should satisfy to be used in all the known cryptographic contexts.

On the one hand, it is good to know precisely what cryptographers expect from hash functions, as this sets the objective hash function designers should try to achieve. On the other hand this leads to a horrible and unsatisfactory definitional mess. What if tomorrow the killer application of hash functions requires a completely new and unrelated security property? A possible way to simplify the theory of hash function would be to come back to the initial intuition and to observe that, in essence, a public function without any exploitable structure could be used every time a cryptographic hash function is required. In addition, this definition of cryptographic hash functions could very likely be considered as reasonable by most cryptographers. Unfortunately, this intuitive idea does not lend itself well to any useful kind of mathematical formulation, which prevents its effective use in security proofs. The problem originates from the fact that it is difficult, if not impossible, to formalize the notion of "not having any exploitable structure" or, equivalently, of "not having any bad property" in a satisfactory way. This would further require a precise definition of what a "bad" property is.

A satisfying way to create a function that does not have any "bad" property and that does not have any "exploitable structure" is to simply pick it at random. Indeed, one can easily check that a random function satisfies all the security notions outlined above. Furthermore, random functions are "usual" mathematical objects having well-understood properties.

The Random Oracle Model

The observation that random functions would make great hash functions has led to the developpement of the Random Oracle methodology, a computational model in which a "truly" random function (called the Random Oracle) from {0, 1}

* to {0, 1} n , for some n large enough (say n = 256), can be queried by everyone via some kind of public interface.

The Random Oracle Model (ROM) had been implicitly used in the 1980's, but was made explicit, formalized, and advocated by Bellare and Rogaway in [START_REF] Bellare | Random Oracles are Practical: A Paradigm for Designing Efficient Protocols[END_REF]. It was quickly found to be a very powerful method to formally prove many protocols secure. For instance, standardized public-key schemes, such as RSA-PSS [START_REF] Bellare | The Exact Security of Digital Signatures -How to Sign with RSA and Rabin[END_REF] and RSA-OAEP [START_REF] Bellare | Optimal Asymmetric Encryption[END_REF] are only proved secure in the ROM. In fact, there are so many papers proving a construction secure in the ROM that it is impossible to list them all: [Cor02a, Cor02b, KW03, BGH07, Ber08, GPV08], etc.

The Random Oracle Model is practical, but has been the object of much (and heated) debate. Assuming the existence of a public random function leads to a nice theory, but raises a burning problem in practice: how to implement the Random Oracle in real life? It is indeed not very realistic to assume the existence of a public random function from {0, 1}

* to {0, 1} n . For instance, the Random Oracle is an infinite source of statistically independent random bits (i.e., it contains an infinite amount of statistical entropy). This means that a random function from {0, 1}

* to {0, 1} n does not admit any finite description, while a hash function is just a fixed piece of code. This fact has been used by Canetti, Goldreich and Halevi to build a signature scheme that is provably secure in the Random Oracle Model, but that cannot be securely instantiated using any hash function [START_REF] Canetti | The random oracle methodology, revisited[END_REF]. Yet, in "real life", the Random Oracle often turns out to be implemented with a cryptographic hash function.

Of course, there would be some other ways to address this issue. A world-wide organization could build a somewhat-secure hardware random number generator and use it to run a Random Oracle Web Service:

1: function Random-Oracle-Web-Service(Query)

2: if Log[Query] = ⊥ then Log[Query] $ ← -{0, 1}
n (using physical device)

3:

return Log[Query] 4: end function Countless technical problems would occur though, a major one being that the amount of storage required to operate the random oracle web service (i.e., the space required to store the query log) would be ever growing. A funny denial-of-service attack would then consist in repeatedly querying the random oracle on pseudo-random junk. In addition, this would force every cryptographic primitive to be connected to the internet to operate. Any similar way to implement the Random Oracle without using a fixed hash function that everyone can evaluate independently would very likely turn out to be as impractical as this Web Service.

Theory and Practice

So, when a cryptographic scheme proved secure in the Random Oracle Model is about to be implemented and deployed, then the public random function that does not actually exist has to be replaced by something, usually by a hash function. This creates a detrimental gap between theory and practice, because the Random Oracle is better than hash function can possibly be. Leurent and Nguyen for instance investigated the quality of instantiations of the Random Oracle in various situations and the consequences of hash function failure on ROM-secure schemes [START_REF] Leurent | How risky is the random-oracle model?[END_REF]; they found that some de facto classical Random Oracle instantiations were fairly weak (much weaker than the hard problem the public-key scheme where they are used relies on). In the worst case, the implementations of the Random Oracle by hash functions could lead to provably secure protocols becoming practically insecure when implemented. The example of Canetti et al. is fairly unnatural, but is sufficiently real to make cryptographers suspicious. In addition, a much less contrived example, due to Ristenpart, Shacham and Shrimpton recently attracted some attention [START_REF] Ristenpart | Careful with composition: Limitations of the indifferentiability framework[END_REF].

Consider a secure storage web service. Users upload their precious files, and the web service stores them reliably, typically using redundant storage. The users can be assured that their data will not be lost in the event their computer fails or is stolen. However, the web service must not fail either. To gain the trust of the users, the web service has set up an audit procedure that supposedly convince the users that their files are still properly stored. To verify whether the web service still has an unaltered copy of a given file, a user challenges the web service with an arbitrary string S, and the web service returns H(F S), where F denotes the file's content. In the Random Oracle Model, the web service cannot cheat, and cannot possibly answer the challenge correctly without fully knowing F . However, as soon as H is instantiated by any secure but iterated hash function (this includes the MD and SHA family, as well as the future SHA-3), then the web service may cheat: it may store the internal state of the hash function after processing F , and use it later on to compute H(F S), even if the actual content of F has been erased. This is a simple and natural example of a cryptographic construction that is secure in the ROM, but that blatantly fails when using any reasonable hash function.

The assimilation of hash functions with public random functions certainly simplifies protocol design, but the extension of this paradigm has consequences on hash function design. Hash function designers are told: "create something that resembles a random function". For all reasons advocated above, this objective is vague and it is not really a meaningful job assignment. In addition, this is very likely more difficult than designing (say) one-way functions or randomness extractors. Besides, the resulting multi-purpose hash functions are likely to be slower than their more specialized counterpart. An example: to extract a 128-bit session key from a Diffie-Hellman element g xy mod n, a possible solution is to hash the bitstring representation of the group element. However, Chevalier, Fouque, Pointcheval and Zimmer have shown in [START_REF] Chevalier | Optimal randomness extraction from a diffie-hellman element[END_REF] that it is sufficient to truncate (instead of hashing) the bitstring representation of the group element to obtain sufficiently many random bits! If, instead of relying on the existence of a public random function, protocol designers could instead rely on the existence of a single function (or eventually of a family of functions) enjoying a well-defined security property such as collision-resistance, one-wayness, . . . then their protocols would be secure in the standard model, and the problem would go away. There is a trend that tries to avoid the Random Oracle in security proofs [Sho00b, BB04, BF05, Can97, MRV99], but this is complicated, often results in less efficient schemes... and is sometimes provably impossible [Nie02, PV05, DOP05, KP09]. Let us nevertheless keep in mind that a possible way to avoid problems related to the Random Oracle is to try not to use it, but instead to use a function offering a more precise security property.

Let us look at the same problem from a different angle. The Random Oracle Model, by advocating "one hash function for everything" puts more stress on the single hash function that gets to be used for everything. This makes life simpler for protocol designers, as they do not have to determine precisely what security property is required from the hash function in their particular scheme. However, the problem is precisely that it is sometimes unclear what exact properties are required from the hash function. Sometimes, the security proof crucially rely on the fact that the Random Oracle can generate random bits, something that cannot be done by a hash function. A hash function supposed to simultaneously satisfy any possible security notion, including those that are impossible to satisfy (e.g. randomness) and those its designers did not think about, is more likely to have problems, than a merely collision-resistant function for instance. The situation may become more complicated once problems happen, because the Random Oracle-substitute provably does not satisfy some security notion, and the security of every scheme using it "as a random oracle" must be re-assessed with respect to the new vulnerability. For instance, all public-key schemes would not break as badly, and not in the same way, if collisions could be found for the standard hash function [START_REF] Leurent | How risky is the random-oracle model?[END_REF]. Ciphertext distinguishability would not be as bad as key-recovery, for instance.

On the Difficulty of Public Life

Like all other cryptographic constructions, the description of hash functions are public. Most other cryptographic constructions are expected to show some cryptographic strength against adversaries from which some information is kept secret (e.g., secret key in a block cipher, PRNG seed, etc.). In strong contrast with nearly all the other cryptographic primitives, hash functions are expected to show cryptographic strength without secret. This is an endless source of difficulties, both in practice and in theory. In practice, because usually the existence of secret informations (the key of a MAC, the internal state of symmetric cipher, etc.) seriously complicates the attackers's life. On the contrary, no such obstacle lies in front of adversaries trying to find a collision on a hash function: they have full knowledge of everything, all input, output and internal state bits of the hash function. Adversaries against hash function are more powerful than most others, they have more control. This resulted in many standard hash functions getting broken, sometimes in practice (this is the case of MD4, MD5, SHA-0). Attacks have been found against MD4 [Dob98, WLF + 05, Leu08a], MD5 [dBB93, Dob96, WY05, Kli06, SLdW07, Leu08b, SA09, SSA + 09], SHA-0 [CJ98, WYY05b, BCJ + 05, dCR08, JP07, MP08] and SHA-1 [START_REF] Wang | Finding Collisions in the Full SHA-1[END_REF][START_REF] De | Finding SHA-1 Characteristics: General Results and Applications[END_REF][START_REF] De Cannière | Collisions for 70-Step SHA-1: On the Full Cost of Collision Search[END_REF], to mention only the widely used hash functions existing prior to the SHA-3 competition. Practical breaks of widelydeployed block ciphers are extremely rare by comparison.

Let us try to briefly explore the theoretical difficulties now. A well-established methodology to formally define the security of a cryptographic primitive is to define an ideal version thereof, and then to compare actual versions of the primitive with the ideal version. The maximum advantage of any distinguisher (with bounded ressources) between the ideal and the actual versions is then a relevant security indicator. This methodology have been used with great success for block ciphers, stream ciphers, pseudo-random functions, pseudo-random number generators, etc.

For hash functions, we have seen that the ideal primitive would be a public random function, and the actual primitives would be small and public pieces of code. This discrepancy makes it impossible to define the security of hash functions via a distinguishing game, where a distinguisher would have to tell apart a random function H * and some actual hash function H. Because H * can only be accessed via an external interface, then our distinguishing game would see a distinguisher connected to a black box containing either H * or H, and trying to tell which one it is. However, because the description of H is public, the distinguisher can evaluate H by itself, and it is therefore able to predict the output of H on any input. The predictions will only be satisfied by the random function with a negligible chance, and the distinguisher will succeed with overwhelming probability after a single query.

So, while random functions are nice "ideal version" of hash functions, we do not know how to measure the security of an actual hash function, namely to measure how close is our hash function to a random function 2 . It is not clear at all that such a measurement makes sense, or even exist. To conclude this introduction on the Random Oracle, we point out that several Oracle instantiations have been proposed in the past, see Figure 2.5a and 2.5b. Querying these oracles can be done as shown in Figure 2.5c.

Iterated Hashing

Compressing an arbitrary quantity of data into a small fingerprint can be achieved in a natural way by an iterated process, as first suggested in 1978 by Rabin [START_REF] Michael | Digitalized signatures[END_REF]: split the arbitrarily large input into a certain number of small chunks of a fixed size and process these chunks one at a time. These small chunks are usually called the message blocks, and are processed using an "inner" hash function that compresses a finite amount of data into a smaller amount.

Iterated hash functions maintain an internal state, which is initialized to a default value called the Initialization Vector (IV), and updated each time a message block is processed. The typical hash function Introduction to part I is therefore defined mathematically by a process of the form:

x -1 = IV x i = f (x i-1 , m i ) ,
where the m i 's are the message blocks. After all the message blocks have been processed, a finalization function (possibly the identity) extracts the hash value from the internal state. The function f is the compression function. If the internal state is n-bit wide and the message blocks are m-bit wide, then f compresses n + m bits into just n. Of course, if the length (in bits) of the "message" to be hashed is not a multiple of m, then a padding scheme will add bits to the last block so that it reaches a length of m bits.

This construction is practical: its time complexity is linear in the message size (which is optimal if the hash actually depends on every input bits), it requires a modest amount of memory, and it does not requires the whole message to be stored in a fast memory so that it can be applied "on-the-fly" to data streams. In addition, designing a compression function seems much simpler than designing a full-blown hash function from scratch. Most existing hash functions are built on the same approach: a compression function is used in some way to process the message, one chunk at a time. Thus, a hash function is formed of two essential components, the compression function, and the mode of operation that describes how the compression should be used. We usually denote the compression function by f , and the mode of operation by H. The full hash function obtained by combining the compression function with the mode of operation is denoted by H f , or simply H when unambiguous.

Another trend in hash function design consist in iterating a weak function or permutation over a large internal state which is not completely under the control of the adversary. The security of the whole iteration then does not rely on any cryptographic strength of the underlying iterated construction. The sponge paradigm [START_REF] Bertoni | On the indifferentiability of the sponge construction[END_REF] is an implementation of this idea.

Modes of Operations

This way of building hash function raises interesting questions: what properties should the compression function satisfy? Can a secure hash function be obtained from a weak compression function? Conversely, is it possible to turn a good compression function into a good hash function? Are the security properties of H f related to those of f ? These question are central in hash function theory. This research area has been very active in the first decade of the twenty-first century, mainly because the usual, standard mode of operation (implemented in MD4, MD5, SHA-0, SHA-1, in all the SHA-2's, etc.) turned out to have unexpected and surprising problems. The preparation of the SHA-3 competition further stimulated research in modes of operation, because all the hash function designers of the world had to give some thoughts to this issue at some point. We even witnessed some candidates getting kicked out of the competition because of problems in their mode of operation.

Attacks against the modes of operation are special in many aspects. They apply to H f for any choice of f , making them particularly irritating for any hash function designer investing a lot of time in the design of a secure compression function. They often require only simple tools (basic algorithms and discrete probabilities), but can become fairly intricate.

On the other hand, modes of operations admit a nice theory, and some form of "provable security". For instance, it does make sense to define the security of a mode of operation H by setting up a distinguishing game where a distinguisher would have to tell apart the Random Oracle and H f , where f is a random compression function. A mode of operation not capable of resisting distinguishers up to a high number of queries should very likely be thrown away. As a matter of fact, the mode of operation of MD4, MD5, SHA-0, SHA-1 fails this test after two queries! It thus appear that the random oracle model is a friendly framework to discuss the security of modes of operations. Assuming that the compression function is a public random function, it is sometimes possible to prove lower-bounds on the number of queries issued by the distinguisher to achieve a reasonable advantage. A proof that a mode of operation offer some security property "in the Random Oracle Model" (i.e., assuming that the compression function is random) does not offer any guarantee that extends to the standard model, but it gives a good indication that the mode of operation is not inherently flawed: no attack can break it when the compression function is unbreakable.

Organization of the Part. Chapter 3 describes the mainstream mode of operation of hash function, the Merkle-Damgård construction, as well as the numerous generic attacks that have been discovered prior to this work. Variants of the Merkle-Damgård construction that have been designed with the explicit objective of preventing some of these attacks are also described, and known security results are recalled when they exist. Chapter 4 present a new generic second-preimage attack that applies to the Merkle-Damgård construction, as well as to some of its variants. It generic second preimage attacks. Chapter 5 present new generic attacks on concatenated hashes and some non-streaming modes of operations. It culminates with a generic second preimage attack on the folklore mode of operation that consists in hashing two concatenated copies of the message, and a new generic attack on the Merkle-Damgård mode of operation, the "Trojan message attack". We have publicly demonstrated the latter with the MD5 hash function. This was made possible because collisions have become so easy to find. Chapter 6 discusses how Time-Memory-Data Trade-offs can be applied to generic second preimage attacks. It allows for instance to attack shorter messages than the normal versions of the corresponding attacks, at the expense of some large precomputation. In chapter 7 we present several security proofs for modes of operation. We prove for instance that there are easy ways to repair the Merkle-Damgård construction to make it provably secure against generic second preimage attacks. We also prove that it is possible to iterate "weak" compression functions in a provably secure way, for a certain notion of weakness that includes the existence of symmetries and differential paths.

1 -e -n(n-1)

2m ≤ P [C] ≤ n(n -1) 2m
From this theorem, we deduce that if H is a random oracle, and if we keep hashing arbitrary but distinct inputs, we will get a collision with probability close to 1/2 after 2 n/2 queries. After 4 • 2 n/2 queries, the probability that a collision has been found is greater than 99.9%. It is often also interesting to estimate the probability that two random subsets of {0, 1}

n have a common element. A more colorful version of the previous theorem does exactly that. Theorem 3.2 [START_REF] Vaudenay | A Classical Introduction to Cryptography: Applications for Communications Security[END_REF]). θ 1 √ N red balls and θ 2 √ N blue balls are thrown independently in a uniformly random way into N bins. Let E be the event that no bin simultaneously contain red and blue balls. Then

P [E] -----→ N →+∞ e -θ1θ2
In the sequel, we will often make use of these two theorems without mentioning them, and sometimes neglecting (small) constants factors, as is commonly done in the field.

The above security definitions are informal, and any attempt to make the definition of Collision-Resistance formal runs into difficulties. It is for instance useless to measure the smallest running time of any adversary returning a collision, because there always exist trivial adversaries that contain a precomputed hard-coded collision, print it and terminate in constant time. This difficulty can be removed by considering hash function families, or equivalently, keyed hash functions. The collision adversaries could then be challenged with the key, and cannot contain precomputed collisions for every possible keys 1 . The drawback is that in practice keyed hash function are only seldom used.

We will now give formal definitions of these informal security notions for keyed hash functions. Let M denotes the space of all possible messages and K denotes the set of all possible keys. If A is an adversary and if Adv(A) is a measure of its advantage, then we write Adv(t) to mean the maximal value of Adv(A) over all possible adversaries A running in time t. We usually measure adversarial advantage by the success probability of the adversaries. We are now ready to speak of the difficulty with which an adversary finds collisions or (second-)preimages. The following definitions have been given by Rogaway and Shrimpton in [START_REF] Rogaway | Cryptographic Hash-Function Basics: Definitions, Implications, and Separations for Preimage Resistance, Second-Preimage Resistance, and Collision Resistance[END_REF], and are now standard. Let K denote the space of possible keys (typically {0, 1}

k ) and M denotes the space of possible messages (typically {0, 1} m ). We write x

An interesting attempt to formalize collision-resistance in the standard model that does not involve keyed hash functions has been given by Rogaway in [START_REF] Rogaway | Formalizing human ignorance[END_REF]. His idea is to consider a secure cryptographic protocol using a hash function H, and to build an explicitly reduction, i.e., an efficient program that may interract with an adversary against the protocol, and that outputs a collision on H with essentially the same advantage as the attacker against the protocol. Thus, as long as mankind does not "know" any collision on H, then the protocol cannot be broken by hash functions collisions.

Indistinguishability and Indifferentiability

A reasonable way to reason about the security of modes of operations is to instantiate the inner primitive (typically the compression function) by an ideal version thereof (an ideal block cipher, a random function or permutation), and to see how the combination "mode of operation + ideal inner primitive" differs from the Random Oracle. A Turing Machine H (implementing a mode of operation) with oracle access to an ideal primitive f is said to be (t, q, ε)-indistinguishable from a Random Oracle if for any distinguisher D it holds that:

P D H = 1 -P D RO = 1 < ε The distinguisher runs in time at most t and makes at most q queries. Figure 3.1a illustrates this scenario. Informally, a mode of operation H is indistinguishable from a Random Oracle if no efficient algorithm D connected to either H or RO, is able to decide whether it is interacting with H or RO. It makes sense to require indistinguishability, since a hash function is not supposed to exhibit any "structure" that would make it different from a random function.

A good mode of operation should therefore not admit any distinguisher making only a polynomial number of queries, for instance. While this security notion is simple and natural, it assumes that the distinguisher D has black-box access to the hash function H, which implies in particular that D cannot access the compression function f nor query it on chosen inputs. This assumption does not make much sense, because in practice the description of the compression function is public. This flaw in the indistinguishablility framework has led to the definition of a more refined setting, the indifferentiability framework, by Maurer, Renner and Holenstein [START_REF] Ueli | Indifferentiability, Impossibility Results on Reductions, and Applications to the Random Oracle Methodology[END_REF]. Definition 3.4. A Turing Machine H (implementing a mode of operation) with oracle access to an ideal primitive f is said to be (t S , t D , q, ε)-indifferentiable from a Random Oracle if there exist a simulator S, such that for any distinguisher D it holds that:

P D H,f = 1 -P D RO,S = 1 < ε
The simulator has access to the Random Oracle and runs in time at most t S . The distinguisher runs in time at most t and makes at most q queries. Figure 3.1b illustrates this new framework. The idea is to let the distinguisher query not only the hash function H, but also the compression function f . However, we must then put something in place of f in the "Random Oracle" world, hence the need of a simulator that plays the role of f for the distinguisher. Of course, since the answers of f and H are correlated, then the answers of the simulator must be correlated to those of the Random Oracle, and it is necessary to let the simulator query the Random Oracle.

We note that if a hash function H is indifferentiable up to q queries, then no generic attacks can break H in less than q queries, otherwise the attack could be used as a distinguisher. Indifferentiability proofs are therefore proofs that there are no generic attacks. We conclude by observing that an indistinguishable mode of operation is by definition indifferentiable.

The Merkle-Damgård construction and its Security

The Merkle-Damgård mode of operation used to be (and is still, at the time of this writing) the most mainstream and most widely implemented mode of operation of hash functions. The Merkle-Damgård mode of operation constructs a full hash function H f : {0, 1} * → {0, 1} n by iterating a compression function f : {0, 1}

n × {0, 1} m → {0, 1} n . The hash process is described and illustrated in Algorithm 3.1. The common padding rule, referred to as the Merkle-Damgård strengthening, appends to the original message a single '1' bit followed by as many '0' bits as needed to complete an m-bit block after embedding the message length at the end.

It is worth observing that a hash function family can easily be derived from the Merkle-Damgård construction, by letting the IV be the key. In the sequel, unless mentioned otherwise, H denotes the Merkle-Damgård Pad and split the message M into r blocks m 0 , . . . , m r of m bits each.

3:

let h -1 be the initialization value IV .

4:

for each message block m i compute h i = f (h i-1 , m i ).

5:

return H f (M ) = h r . 6: end function

f m 0 f m 1 f m 2 f m r h 0 h 1 h 2 H(M ) IV
mode of operation instantiated with any compression function, and Pad denote the padding scheme. When M = m 0 , . . . , m r is a message whose length is a multiple of the message block length, we denote by f * (h, M ) the value f (f (. . . f (f (h, m 0 ), m 1 ) . . . , m r-1 ), m r ), i.e., the result of setting the internal state to h and hashing M without padding. It follows that H(M ) = f * (IV, Pad(M )).

Effect of the "Strengthening"

Merkle [START_REF] Ralph | One Way Hash Functions and DES[END_REF] and Damgård [START_REF] Damgård | A Design Principle for Hash Functions[END_REF] proved independently in 1989 that this innocent-looking padding rule has a very interesting consequence in terms of security, as it makes the scheme collision resistance preserving, in the sense that a collision on the hash function H f implies a collision on the compression function f . Theorem 3.3 [START_REF] Ralph | One Way Hash Functions and DES[END_REF][START_REF] Damgård | A Design Principle for Hash Functions[END_REF]). The Merkle-Damgård mode of operation is Collision-Resistance Preserving, i.e., there is an algorithm that given two messages M = M such that H(M ) = H(M ) finds two pairs (h, m) = (h , m ) such that f (h, m) = f (h , m ) and whose running time is linear in the size of M .

Proof. Suppose we have two messages M = M such that H f (M ) = H f (M ). We will show that it is easy to derive a collision on f from M and M .

-Either |M | = |M |. In this case, by definition of the padding scheme, the inputs of the last invocation of the compression are not the same when hashing M and M , and because M and M collide, we have found a collision on f (on its last invocation). -Or |M | = |M |. Suppose that the compression function is invoked r times in both cases. In this case, there are again two possibilities. Either (h r-1 , m r ) = (h r-1 , m r ), and we have a collision since h r = h r , or (h r-1 , m r ) = (h r-1 , m r ). The argument repeats. Either we find a collision along the way, or we reach the conclusion that m i = m i , for all i, which is impossible.

Adding the message length in the last block, the so-called "strengthening", is the crucial ingredient in establishing the collision-resistance preservation of Merkle-Damgård. As an illustration of the well-known fact that the devil is in the details, we show that many other natural padding schemes would lead to a handful of security problems. Consider the padding scheme Pad 0 that simply pads the last message block with zeroes: it would fall to a very simple generic collision attack consisting in adding a single "0" bit at the end of the message.

This could be avoided with a more sophisticated padding scheme Pad 10 that adds a single "1" bit and then pads the current block with zero bits. Sadly, this padding scheme would fall to a simple second-preimage attack called the long message attack [MvOV]. Given a (long) message M = M 1 , . . . , M k , an adversary could hash random messages M until the hash of M is equal to one of the intermediate chaining values (say h i ) obtained in hashing M . She could replace the beginning of M , up to the i-th block, with M , and she would end up with as second preimage. The expected number of queries is 2 n /k.

As a side effect, the strengthening defines a limit on the maximal length for admissible messages. In most deployed hash functions, this limit is 2 64 bits, or equivalently 2 55 512-bit blocks. However, in SHA-384 and SHA-512, as well as in some SHA-3 candidates, this limit has been increased to 2 128 bits, or equivalently 2 118 1024-bit blocks. In the sequel, we denote the maximal number of admissible blocks by 2 κ .

Blockcipher-based Compression Functions

With a reasonable mode of operation such as Merkle-Damgård, the problem of designing a (good) hash function is reduced to that of designing a (good) compression function. One of the most succesful approaches is to turn a block cipher into a compression function, with an appropriate mode of operation for compression functions. There are countless ways to perform this task, so we only mention the most popular, the Davies-Meyer constructions, that sets

f (h, m) = E m (h)

`h

This construction is used in many standardized hash functions (MD4, MD5, all the SHA's, etc.). It is simple and efficient, since the complexity of evaluating the compression function is vastly the complexity of the block cipher itself. In addition, amongst all symmetric cryptographic primitives, block ciphers are probably the best understood, with the caveat that in the Davies-Meyer construction the adversary has full control over the key, which means to some extent that the block cipher E has to be secure against related-keys attacks. Winternitz first showed that the Davies-Meyer compression functions are optimally collision and preimage resistant when the block cipher is an ideal cipher, i.e., a key-indexed collection of independent random permutations [START_REF] Winternitz | A Secure One-Way Hash Function Built from DES[END_REF].

A noticeable property of the Davies-Meyer construction is related to fixed points. Given a message block m, it is straightforward to find a chaining value h * such that h * = f (h * , m): the value of h * is by definition E -1 m (0). It follows that for any m, the fixed point h * can be found for the cost of one compression function evaluation. This is mostly not a problem, because the attackers usually do not control the chaining value, but we will see in §3.3.3 that this can be leveraged into a second preimage attack.

Many other block-cipher based modes of operations have been described by Preneel, Govaerts and Vandewalle [START_REF] Preneel | Hash functions based on block ciphers: A synthetic approach[END_REF], and have been analyzed in the Ideal Cipher Model by Black, Rogaway and Shrimpton [START_REF] Black | An analysis of the blockcipher-based hash functions from pgv[END_REF]. Black, Cochran and Shrimpton proved that it is impossible to build a secure compression function with a single evaluation of a n-bit fixed permutation (i.e., a block cipher under a fixed key) [BCS05]2 . Shrimpton and Stam proved that it is possible with three calls to three different n-bit fixed permutations [START_REF] Shrimpton | Building a collision-resistant compression function from non-compressing primitives[END_REF].

Collisions on the Compression function

Finding collisions against H can be acheived by finding collisions on the compression function, i.e., by finding pairs (h, m) = (h , m ) such that f (h, m) = f (h , m ). This can always be done by brute force, with about 2 n/2 evaluations of the compression function, even when the attacker only has black-box access to f . There are several kinds of collision-finding algorithms: the chaining values h and h can be chosen by the attacker, or may be imposed upon her. In addition, it may be required that h = h. This lead to four possible kinds of adversaries, shown in Algorithm 3.2. All these algorithms terminate after about 2 n/2 iterations if f is a random function. In practice, when dealing with concrete hash functions, the complexity of finding the various kinds of collisions are not completely identical. For instance, on MD5, there exist a version of Collision that terminates in time equivalent to 2 16 compression function evaluations, but the fastest equivalent of Dual-IV-Collision requires 2 41 compression function evaluations [SSA + 09]. To conclude on this subject, we note that the collision-finding techniques decsribed in Algorithm 3.2 have a high memory complexity, but it is possible to search for collisions without any memory, using cycle-finding techniques such as the algorithms of Floyd, Brent or Nivasch [START_REF] Nivasch | Cycle detection using a stack[END_REF].

Generic Attacks Against Merkle-Damgård

Because of its simplicity and of its nice security properties, the Merkle-Damgård mode of operation has been widely deployed. However, more than 15 years after its introduction,it started to exhibit weird properties, and to fall to nastier and nastier generic attacks.

The Length Extension Attack

The length extension attack is simple and dangerous, because it can be carried out without extensive computational resources. It allows to distinguish the Merkle-Damgård construction from a Random Oracle using only two queries.

Theorem 3.4 (length-extension attack).

There is an adversary that, given only the size of a message M and its hash H(M ), but not M itself, is capable of computing H(Pad(M ) S) in time O (|S|), for any suffix S. If H were a random oracle, achieving the same thing would require about 2 n queries.

Algorithm 3.2 Generic Brute-Force collision-finding algorithms function Collision(IV ) T ← ∅ loop m $ ← -{0, 1} m h ← f (IV, m) if T [h] = m then return (m, m ) T [h] ← m end loop end function function Pseudo-Collision( ) T ← ∅ loop m $ ← -{0, 1} m x $ ← -{0, 1} n h ← f (x, m) if T [h] = (x , m ) then return (x, m, x , m ) T [h] ← (x, m) end loop end function function Dual-IV-Collision(IV 1 , IV 2 ) T 1 ← ∅ T 2 ← ∅ loop m $ ← -{0, 1} m h 1 ← f (IV 1 , m) h 2 ← f (IV 2 , m) if T 2 [h 1 ] = m then return (m, m ) if T 1 [h 2 ] = m then return (m, m ) T 1 [h 1 ] ← m T 2 [h 2 ] ← m end loop end function function Dual-IV-Pseudo-Collision( ) T 1 ← ∅ T 2 ← ∅ loop m $ ← -{0, 1} m x 1 $ ← -{0, 1} n x 2 $ ← -{0, 1} n h 1 ← f (x 1 , m) h 2 ← f (x 2 , m) if T 2 [h 1 ] = (x , m ) or T 1 [h 2 ] = (x , m ) then return (x, m, x , m ) T 1 [h 1 ] ← (x 1 , m) T 2 [h 2 ] ← (x 1 , m) end loop end function
Here is how the attack works. We first observe that Pad(M ) ends at a block boundary (by definition of the padding scheme). Let k therefore denote the length of Pad(M ) in blocks. We observe what happens during the process of hashing M = Pad(M ) S. First, the padding scheme is applied to M , resulting in a sequence of message blocks m 0 , . . . , m t . Provided that S is more than m bits long, then generating m t can be accomplished knowing only |M | and S. Then by definition of the Merkle-Damgård construction, H(M ) = f * (IV, m 0 , . . . , m t ). It then follows from the previous consideration that m 1 , . . . , m k = Pad(M ), so that H(M ) = f (H(M ), m k+1 , . . . , m t ).

Prefix-MAC. One of the simplest possible ways to build a MAC from a hash function is probably the Prefix-MAC construction, defined by: prefix-MAC(K, M ) = H(K M ). The length-extension attack makes it completely insecure when H is any Merkle-Damgård hash function. Indeed, after querying the MAC on M , an adversary would be able to forge the MAC on Pad(M ) S, for any suffix S. This problem led to the definition of more complicated hash-based MAC constructions such as HMAC [START_REF] Krawczyk | HMAC: Keyed-Hashing for Message Authentication[END_REF]. Candidates for the SHA-3 competition were required to be immune to the length-extension attack.

Countermeasures. The attack can be avoided without modifying the Merkle-Damgård construction too much in several ways. A first possibility is to apply a prefix-free encoding to the messages before hashing them, i.e., a function pf (•) such that pf (M ) cannot be a strict prefix of pf (M ), for any choice of M = M (a possibility is to include the message length at the begining, or to use a special "last block" bit in every message block). Another, but essentially equivalent option is to apply a one-way finalization function to the internal state before returning it, i.e., to define H(M ) = F (h r ), where F should preferably be a permutation, otherwise there could be a loss of entropy.

When the length-extension attack is thwarted, for instance by the use of a prefix-free encoding, then the resulting Prefix-free-Merkle-Damgård mode of operation is indifferentiable from a random oracle up to 2 n/2 queries, as shown by Coron, Doodis, Malinaud and Puniya [START_REF] Coron | Merkle-Damgård Revisited: How to Construct a Hash Function[END_REF].

IV h 0 h 1 h 2 h k m0 m 0 m1 m 1 m2 m 2

Joux's Multicollision Attack

I wish I had the idea...

An anonymous reviewer

The multicollision attack on Merkle-Damgård discovered by Joux in 2004 is fairly general and applies more generally to (most) iterated hash functions [START_REF] Joux | Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions[END_REF]. The point is to find a k-way multicollision, i.e., a set of k messages M 1 , . . . , M k all hashing to the same value, much faster than exhaustive search.

Theorem 3.5 ([Jou04]

). There exist an adversary that finds a k-way multicollision on H, for any k, with a time and memory complexity equivalent to that of running the generic Collision algorithm (or any ad hoc equivalent) log 2 k times. If H were a random oracle, this should require about 2 n(k-1)/k evaluations of H.

For instance, finding a 4-way multicollision requires 2 3n/4 queries on the random oracle, but can be achieved with only 2 • 2 n/2 evaluations of the compression function for any Merkle-Damgård hash function. The main idea of multicollision is shown in Figure 3.2. First compute two colliding message blocks:

(m 0 , m 0 ) ← Collision(IV )
and let h 0 = f (IV, m 0 ) denote their common hash. Now, starting from h 0 , we again compute two colliding message blocks:

(m 1 , m 1 ) ← Collision(h 0 )
At this stage, we already have a 4-way collision: the four messages (m 0 , m 1 ), (m 0 , m 1 ), (m 0 , m 1 ) and (m 0 , m 1 ) result in the same intermediate chaining value h 1 = f (h 0 , m 1 ). By finding a third pair (m 2 , m 2 ) of message blocks colliding from h 1 , we could build an 8-way multicollision, by appending either m 2 or m 2 at the end of our 4-way multicollision, and so on and so forth. The multicollision attack is very difficult to avoid, because it is very general: it works for any padding scheme, and only exploit the fact that the hash function is iterated. For instance, it applies to the Prefixfree-Merkle-Damgård mode of operation, allowing it to distinguish it from a random oracle by constructing a 4-way multicollision, using about 4 • 2 n/2 queries. This shows for instance that Prefix-Free-Merkle-Damgård cannot be indifferentiable from a Random Oracle beyond 2 n/2 queries, so that the proof of Coron et al. is tight [START_REF] Coron | Merkle-Damgård Revisited: How to Construct a Hash Function[END_REF].

Dean's Second Preimage Attack

As discussed in §3.2.1, the Merkle-Damgård strengthening prevents the long message second preimage attack: because the original message and the forgery do not have the same length, the padding scheme makes the last blocks different in Pad(M ) and Pad(M ), and even though the penultimate chaining values are the same, the last ones are extremely likely to be different because the last message blocks are different.

A possible way to mount a successful second preimage attack on Merkle-Damgård is to bypass the strengthening by forging preimages of the same size as the original message. In his PhD thesis [START_REF] Drews | Formal Aspects of Mobile Code Security[END_REF], Dean found a way to do this under the assumption that it is possible to find fixed points of the compression function.

Theorem 3.6 ([Dea99]

). If f is a Davies-Meyer compression function, then there is an adversary A that finds second preimages of -blocks messages for H f with 2 n / compression function evaluations, after a preprocessing phase of complexity 2 n/2 . If H were a Random Oracle, this would require 2 n compression function evaluations. This result is, to the best of our knowledge, only present in Dean's dissertation and has not been submitted to any refereed publication. It therefore received very little publicity and the cryptographic community was apparently unaware of it until several years later. This is a bit surprising, since this result is in fact quite strong: the most widely used construction of a hash function out of a block cipher has a non-trivial security flaw that nobody was aware of before.

Offline Phase. The adversary first tries to find two message blocks m and m * such that f (IV, m ) = h * and f (h * , m * ) = h * . If the compression function were an arbitrary random function, then there would not be any way of finding these faster than exhaustive search. However, when f is a Davies-Meyer compression function, then m and m * can be found after 2 n/2 compression function evaluation, even when the underlying block cipher is ideal:

1. Construct a table T 1 of 2 n/2 entries (h 1 , m 1 ) where m 1 $ ← -{0, 1} m and h 1 = f (IV, m 1 ). 2. Construct a table T 2 of 2 n/2 entries (h 2 , m 2 ) where m 2 $ ← -{0, 1} m and h 2 = E -1 m2 (0). 3. Find (m , m * ) such that there exist h * ∈ {0, 1} n with (h * , m ) ∈ T 1 and (h * , m * ) ∈ T 2 .
Theorem 3.2 tells us that the probability to find the actual collision in the two lists is 1 -1/e, and that this probability can be made arbitrarily large by slightly increasing the size of the two tables.

Online Phase. Presented with a (padded) challenge message M = m 0 , . . . , m , the adversary hashes random messages blocks m until f (h * , m ) = h i , where h i = f * (IV, m 0 , . . . , m i ) is the i-th intermediate chaining value obtained while hashing M . We expect the adversary to find this "connecting" message block after 2 n / evaluations of the compression function. The adversary can then forge a second preimage M that has the same size as M by replacing the first i blocks of M . This yields:

M = m , m * , m * , . . . , m * , m , m i+1 , . . . , m
It is then easy to check that H(M ) = H(M ). They key idea of the attack is to replace a prefix of M by something of the same length that hashes to the same value.

Kelsey and Schneier's Second Preimage Attack

Dean's attack was in fact rediscovered independently by Kelsey and Schneier in 2005, and at this point reached the general crypto community. Building on Joux's multicollision attack, Kelsey and Schneier found a more general second preimage attack that applies to any compression function [START_REF] Kelsey | Second Preimages on n-Bit Hash Functions for Much Less than 2 n Work[END_REF].

Theorem 3.7 ([KS05]

). There is an adversary A that finds second preimages of -blocks messages for H f with 2 n / compression function evaluations, after a preprocessing phase of complexity κ • 2 n/2 . If H were a Random Oracle, this would require 2 n compression function evaluations.

Dean's trick to bypass the Merkle-Damgård strengthening was, after the right fixed point has been found, to be able to build a message of any length hasing to the internal chaining value h * . Kelsey and Schneier observed that this is in fact a huge multicollision containing (at least) a message for any possible length in some interval. They called such a multicollision an expandable message. To build expandable messages, Kelsey and Schneier adapted Joux's multicollision technique: instead of finding collisions between single messages blocks, they find collisions between a single message block and a longer message.

Offline Phase. From a practical point of view, an expandable message is a datastructure M generated by a preprocessing step, associated with a hash value h * . Then an instantiation procedure takes M and an integer , and forges an -block message M such that f * (IV, M ) = h * . Pseudo-code for both steps are shown in Algorithm 3.3.

The complexity of Generate-Expandable-Message is equivalent to that of finding κ collisions generically. An algorithm of the type Dual-IV-Collision could be used to find M i and M i at each step: choose arbitrarily the first 2 i blocks of M i , and simultaneously find M i and the last block of M i by running Dual-IV-Collision(h, f * (h, M i )). As a consequence, expandable messages could be built in practice for MD5.

Online Phase. A second preimage attack can be carried out without too much trouble once an expandable message has been constructed. The pseudo-code is shown in Algorithm 3.4. The same argument used to establish the correctness of Dean's attack also applies here: the attack uses the expandable message to replace a prefix of M by something of the same length and that hashes to the same thing. We expect 2 n / iterations of the repeat...until loop.

The Herding attack

The "herding attack" (also known as the "Nostradamus attack", or the "con man" attack, as mentionned in the introduction) was described by Kelsey and Kohno in 2006 [START_REF] Kelsey | Herding Hash Functions and the Nostradamus Attack[END_REF]. It is a chosen-target forced prefix preimage attack: an adversary commits to a public digest value h. After the commitment phase, the Algorithm 3.3 Expandable messages: a multicollision between messages of different lengths.

1: function Generate-Expandable-Message( )

2:
h ← IV

3:

for i = 0 to κ do 4:

Find (M i , M i ) such that f * (h, M i ) = f (h, M i ), |M i | = 2 i + 1 and |M i | = 1 5:
end for 6:

return M = (M 0 , M 0 ), . . . , (M κ , M κ ) 7: end function The notation |m| denotes the size of the m in message blocks.

IV h 0 h 1 h 2 M0 M 0 M1 M 1 M2 M 2 |M0|=2 0 +1 |M1|=2 1 +1 |M2|=2 2 +1 |M 0 |=1 |M 1 |=1 |M 2 |=1 1: function Instantiate-Expandable-Message(M, ) 2:
b κ , . . . , b 0 ← binary writing of ( -κ)

3:

M ← ∅

4:

for i = 0 to κ do 5:

if b i = 1 then M ← M M i else M ← M M i 6:
end for adversary is challenged with a prefix P which she has no control over, and she is to produce a suffix S for which h = H(P S). Of course, h is specifically chosen after a precomputation phase by the adversary. This attack is reminiscent of (and can certainly be seen as) an attack against the eSec security notion.

(M ) h -1 ← IV for i = 0 to do h i ← f (h i-1 , m i ) M ← Generate-Expandable-Message() h * ← f * (IV, M 0 , . . . , M κ ) repeat m $ ← -{0, 1} m until f (h * , m ) = h i for some i ≥ κ return Instantiate-Expandable-Message(M, i) m i+1 , . . . , m end function h * IV H(M ) M h i m m i+1 , . . . , m Instantiate-Expandable-Message(M,i)

Theorem 3.8 ([KK06]

). There exist an adversary that chooses a hash value h after a precomputation phase of complexity 2 n/2+ /2+2 , and which is then capable of finding messages S such that h = H(P S), for any prefix P , in 2 n-compression function evaluations. If H were a Random Oracle, this would require 2 n queries.

Offline Phase. The main idea behind this attack is to build a special data structure known as a 2 -diamond structure 3 , and shown in Figure 3.3a. It contains 2 distinct chaining values D = x 1 , . . . , x 2 from which the adversary knows how to reach a common chaining value h . To construct this data structure, which is in fact a tree, the adversary picks about 2 n/2-/2+1/2 single-block messages m j , and evaluates f (x i , m j ) for all i and j. Due to the large number of values, it is expected that collisions occur, and it is expected that the adversary will find for each of the x i 's a corresponding message block m α(i) such that the set f x i , m α(i) contains only 2 -1 distinct values. The process is then repeated -1 more times until a final digest value h is found. The complexity of the first step should dominate the whole computation, so that the complexity of building the diamond structure is roughly 2 n/2+ /2+2 compression functions evaluations. We are aware that this construction algorithm is a bit vague, and that this complexity analysis is not rigorous. We essentially reproduced the description and analysis given in [START_REF] Kelsey | Herding Hash Functions and the Nostradamus Attack[END_REF]. An improved and more rigorous analysis [START_REF] Blackburn | On the complexity of the herding attack and some related attacks on hash functions[END_REF] revealed that the announced complexity is underestimated by a factor √ . Because it is more convenient, and because the difference is not so large, we stick with the old complexity estimates.

Online Phase. In the online phase of the attack, the adversary is challenged with a prefix P , and she has to find a suffix S so that H(P S) = h . To this end, the adversary hashes random message blocks m until f * (P m ) = x i ∈ D for some i. Once P is "connected", via m , to the diamond structure, it is possible to follow the path connecting x i to h (which is at the "root" of the diamond) and produce the required suffix S. Figure 3.3b illustrates the process.

The total time complexity of the attack is about 2 n/2+ /2+2 offline compression function evaluations, and 2 n-online compression function evaluations. Choosing = n/3 minimizes the total cost of the attack, resulting in a total complexity of about 2 2n/3 compression function evaluations.

Close Relatives of the Merkle-Damgård Construction

we have seen in §3.3 that in 2204, 2005 and 2006 many unexpected and disturbing generic attacks were discovered on the venerable Merkle-Damgård mode of operation. This stimulated the cryptographic community to research alternative new modes of operations, and led to a flourishing of new designs, some of which were explicitly aiming at preventing the generic attacks. In this section we survey the design that are sufficiently close to the original Merkle-Damgård.

HAIFA : a HAsh Iterative FrAmework

Haifa is a collection of simple tweaks to Merkle-Damgård proposed by Biham and Dunkelman in 2006 [Eli06, BD07]. We will not describe the full Haifa, because some details are irrelevant to us (for instance, Haifa has a built-in salt mechanism that we deliberately ignore). A Haifa hash function H : {0, 1} * → {0, 1} n is built by iterating a compression function

f : {0, 1} m × {0, 1} n × {0, 1} κ → {0, 1} n .
The precise mode of operation is described in Algorithm 3.5 (and Pad denotes the usual Merkle-Damgård padding). The ability to "copy, cut, and paste" blocks of messages here and there is a fundamental ingredient in the generic second preimage attacks, and the inclusion of a "round counter" in the compression function seems very effective at preventing them, although Biham and Dunkelman did not give any security proof.

Haifa is immune to the length extension attack because of the "last-block" special padding, and is thus provably indifferentiable up to 2 n/2 queries. However, the multicollision and the herding attack both apply, thus showing that this bound is tight. We will show in §7. Pad and split the message M into r blocks m 0 , . . . , m r of m bits each.

3:

let h -1 be the initialization value IV .

4:

for each message block m i , i < r compute h i = f (h i-1 , m i , i).

5:

compute h r = f (h r-1 , m r , -1).

6:

return H f (M ) = h r . 7: end function f m 0 f m 1 f m 2 f m r -1 f m r h 0 h 1 h 2 h r-1 0 1 2 r -1 -1 H(M ) IV

Rivest's Dithered Hashing

Even before Haifa had been presented to the community, Rivest had come out with the idea of using a counter to make the hashing process more "irregular". However he was concerned about the loss of efficiency that this would incur. When a "normal" compression function is used in a Haifa hash function, then κ bits of its input would be dedicated to the round counter (which is about 10% of the total input in the MD and SHA family), leading in a corresponding decrease in hashing speed. If a compression were to be designed from scratch to accommodate the counter, then there would still be more input bits to mix together.

To avoid this problem, Rivest suggested in 2005 to use Dithered hashing [START_REF] Ronald | Abelian Square-Free Dithering for Iterated Hash Functions[END_REF]. Instead of dedicating κ bits of compression-function input to a counter, we would still perturbate the hash process by an additional input to the compression function, but we would try to make this additional input as small as possible. Rivest's idea was to use the consecutive elements of a fixed dithering sequence. If the dithering sequence is well-chosen, then this would still make the hash of a message block dependent on its position in the whole message.

Since the dithering sequence has to be at least as long as the maximal number of blocks in any message that can be processed by the hash function, it makes sense to consider infinite potential dithering sequences. Let A be a finite alphabet, and let the dithering sequence z be an eventually infinite word over A. Let z[i] denote the i-th element of z. The dithered Merkle-Damgård construction iterates a compression function

f : {0, 1} n × {0, 1} * × A → {0, 1} n , by setting h i = f (h i-1 , m i , z [i]
) in the definition of the original Merkle-Damgård scheme.

Words and Sequences. Let ω be a word over a finite alphabet A. We use the dot operator to denote concatenation. If ω can be written as ω = x.y.z (where x,y, or z can be empty), we say that x is a prefix of ω and that y is a factor of ω. A finite non-empty word ω is a square if it can be written as ω = x.x, where x is not empty. A finite word ω is an abelian square if it can be written as ω = x.x where x is a permutation of x (i.e., a reordering of the letters of x). A word is said to be square-free (respectively, abelian square-free) if none of its factors is a square (respectively, an abelian square). Note that abelian square-free words are also square-free.

Sequences Generated by Morphisms. We say that a function τ : A * → A * is a morphism if for all words x and y, τ (x.y) = τ (x).τ (y). A morphism is then entirely determined by the images of the individuals letters. A morphism is said to be r-uniform (with r ∈ N) if |τ (x)| = r • |x| for any word x. If, for a given letter α ∈ A, we have τ (α) = α.x for some word x, then τ is non-erasing for α. Given a morphism τ and an initialization letter α, let u n = τ n (α) denote the n-th iterate of τ over α. If τ is r-uniform (with r ≥ 2) and non-erasing for α, then u n is a strict prefix of u n+1 , for all n ∈ N. Let τ ∞ (α) denote the limit of this sequence: it is the only fixed point of τ that begins with the letter α. Such infinite sequences are called uniform tag sequences [START_REF] Cobham | Uniform Tag Seqences[END_REF] or r-automatic sequences [START_REF] Allouche | Sur la complexité des suites infinies[END_REF].

An Infinite Abelian Square-Free Sequence. Infinite square-free sequences have been known to exist since 1906, when Axel Thue exhibited the Thue-Morse word over a ternary alphabet (there are no square-free sequences of size greater than four on a binary alphabet).

The question of the existence of infinite abelian square-free sequences was raised by 1961 by Erdös, and was solved by Pleasants [START_REF] Pleasants | Non-repetitive sequences[END_REF] in 1970: he exhibited an infinite abelian square-free sequence over a five-letter alphabet. In 1992, Keränen [START_REF] Veikko Keränen | Abelian Squares are Avoidable on 4 Letters[END_REF] exhibited an infinite abelian square-free sequence k over a four-letter alphabet (there are no infinite abelian square-free words over a ternary alphabet). In the sequel, we call this infinite abelian square-free word the Keränen sequence. Before describing it, let us consider the permutation σ over A defined by:

σ(a) = b, σ(b) = c, σ(c) = d, σ(d) = a
Surprisingly enough, the Keränen sequence is defined as the fixed point of a 85-uniform morphism τ , given by:

τ (a) = ω a , τ (b) = σ (ω a ) , τ (c) = σ 2 (ω a ) , τ (d) = σ 3 (ω a ) ,
where ω a is some magic string of size 85 (given in [START_REF] Veikko Keränen | Abelian Squares are Avoidable on 4 Letters[END_REF][START_REF] Ronald | Abelian Square-Free Dithering for Iterated Hash Functions[END_REF]).

Keränen-DMD. In [START_REF] Ronald | Abelian Square-Free Dithering for Iterated Hash Functions[END_REF] Rivest suggests to directly use the Keränen sequence as a source of dithering inputs. The dithering inputs are taken from the alphabet A = {a, b, c, d}, and can be encoded by two bits. The introduction of dithering thus only increases number of data bits in the input of the compression function by only two bits, which improves the hashing efficiency (compared to longer encodings of dither inputs). It is possible to generate the Keränen sequence online, one symbol at a time, in logarithmic space and constant amortized time.

Rivest's Concrete Proposal. To speed up the generation of the dithering sequence, Rivest proposed a slightly modified scheme, in which the dithering symbols are 16-bit wide. Rivest's concrete proposal, which we refer to as DMD-CP (Dithered Merkle-Damgård-Concrete Proposal) reduces the need to generate the next letter from the Keränen sequence. If the message M is r blocks long, then for 1 ≤ i < r the i-th dithering symbol has the form: 0, k i/2 13 , i mod 2 13 ∈ {0, 1} × A × {0, 1} 13 The idea is to increment the counter for each dithering symbol, and to shift to the next letter in the Keränen sequence, only when the counter overflows. This "diluted" dithering sequence can essentially be generated 2 13 times faster than the Keränen sequence. The last dithering symbol has a different form (recall that m is the number of bits in a message block):

(1, |M | mod m) ∈ {0, 1} × {0, 1} 15
The dithered Merkle-Damgård construction seems immune to the generic second preimage attacks of Dean ( §3.3.3) and Kelsey and Schneier ( §3.3.4), but the multicollision and herding attack do apply as-is. We also give a second-preimage attack in §4.2.

Shoup's Universal One-Way Hash Function.

As mentioned in §3.1, a Universal One-Way Hash Function (UOWHF for short) is a keyed function H : K × {0, 1} * → {0, 1} n required to satisfy the eSec security notion. The best possible UOWHFs will resist eSec adversaries up to 2 n queries.

Bellare and Rogaway studied the construction of variable input length UOWHF from fixed input length UOWHFs (i.e., eSec-secure keyed compression functions) [START_REF] Bellare | Collision-Resistant Hashing: Towards Making UOWHFs Practical[END_REF]. They also demonstrated that UOWHFs are sufficient for a number of signature applications. Shoup [START_REF] Shoup | A Composition Theorem for Universal One-Way Hash Functions[END_REF] improved on the former constructions by proposing a simpler scheme that also yields shorter keys (by a constant factor). It is a Merkle-Damgård-like mode of operation, but before every compression function evaluation in the iteration, the state is updated by XORing one out of a small set of possible masks into the chaining value. The number of masks is logarithmic in the length of the hashed message, and the order in which they are used is carefully chosen to maximize the security of the scheme. This is reminiscent of dithered hashing, except that here the dithering process does not decrease the bandwidth available to actual data (it just takes a few more operations). let (k, µ 0 , . . . , µ κ ) = K (the key of the iterated function)

3:

pad and split the message M into r blocks m 0 , . . . , m r of m bits each.

4:

let h -1 be the initialization value IV .

5:

for each message block m i compute

h i = f k h i-1 `µν2(i) , m i . 6:
return H K (M ) = h r . 7: end function Shoup's construction works just like Merkle-Damgård by iterating an eSec-secure compression function family

f k : {0, 1} n × {0, 1} m → {0, 1}
n , as described in Algorithm 3.6, to obtain a variable input length UOWHF.

The scheme uses a set of masks µ 0 , . . . , µ κ-1 (where 2 κ -1 is the length of the longest possible message), each one of which is a random n-bit string. The key of the whole iterated function consists of k and of these masks. The order in which the masks are applied is defined by a specified sequence over the alphabet A = {0, . . . , κ -1}. The scheduling sequence is z

[i] = ν 2 (i), for 1 ≤ i ≤ 2 κ ,
where ν 2 (i) denotes the largest integer ν such that 2 ν divides i. Similarly to the Merkle-Damgård construction, Shoup's UOWHF enjoys a nice security property. Theorem 3.9 ([Sho00a]). If an adversary is able to break the eSec[λ] notion of H f with probability ε in time T , then one can construct an adversary that breaks the eSec notion of f in time T + O (λ), with probability ε/λ.

In a nutshell, if no adversary can break the eSec property of f in time less than 2 n queries, then no adversary can break the eSec property of H f in time less than 2 n-κ queries. In other words, Shoup's hash function family is reasonably close to the original Merkle-Damgård construction yet provably enjoys a flavor of second-preimage resistance in the standard model. We give an eSec-attack on the UOWHF in §4.3, showing in passing that the security bound is tight.

An intriguing connection between Shoup's and Rivest's hash functions shows up as soon as we notice that the scheduling sequence z chosen by Shoup is abelian square-free. In fact, one year after Shoup's construction was published, Mironov proved that an even stronger notion of repetition-freeness was necessary: z is, and has to be, even-free [START_REF] Mironov | Hash functions: From merkle-damgård to shoup[END_REF]. A word is even-free if all of its non-empty factors contain at least one letter an odd number of times. It is easy to see that even-free words are abelian square-free.

The Wide-Pipe Construction

Faced with the ever-more worrying flow of new generic attacks, Lucks suggested in 2005 a completely different approach [START_REF] Lucks | A Failure-Friendly Design Principle for Hash Functions[END_REF]. His idea is quite simple: most generic attacks rely on the ability to find internal state collisions, and exploit these collisions in a clever way. If finding these collisions is impossible in the first place, then there would not be any generic attack. Making internal state collisions impossible to find in less than 2 n compression function evaluations is simply achieved by doubling the size of the internal state. To produce n-bit hash values, a compression function f : {0, 1}

2n × {0, 1} m → {0, 1} 2n is iterated, resulting in a 2n-bit final internal chaining value which is subsequently brought down to n bits by a finalization function g (which usually discards half of the bits). This is illustrated by Figure 3.4. When g is simply a truncation, then the resulting scheme is sometimes called "Chop-Merkle-Damgård". From a historical perspective, CELLHASH and Subterranean, two earlier designs of Daemen are "wide-pipe" and thus predate by about 15 years the more systematic proposal of Lucks.

m 0 f 2 f 1 m 1 f 2 f 1 m 2 f 2 f 1 m r f 2 f 1 h 2 1 h 1 1 h 2 2 h 1 2 h 2 3 h 1 3 IV 1 IV 2 Figure 3.5: Concatenated hashing.
Intuitively, all the attacks of §3.3 cannot be replayed, because finding collisions on the compression function takes longer than inverting the full hash function. More formally, it is shown in [START_REF] Lucks | A Failure-Friendly Design Principle for Hash Functions[END_REF] that any k-way multicollision (resp. second preimage) on H results in either a collision on f or a k-way multicollision on g • f (resp. a collision on f or a second preimage on g • f ), which shows that as long as f and g • f are secure, then H is free of multicollision and second-preimage adversaries.

It is possible to make an even stronger point in the indifferentiability framework. Coron et al. have shown that the double-pipe is indifferentiable up to 2 n/2 queries, which does not discard multicollision and second-preimage attacks, but Chang and Nandi proved that the mode of operation is in fact indifferentiable up to 2 n /n queries, thus showing that no generic attack applies below this bound [START_REF] Chang | Improved Indifferentiability Security Analysis of chopMD Hash Function[END_REF]. This bound was subsequently improved to 2 n /2 queries -which is asymptotically tight-by Bertoni, Daemen, Peeters and Van Assche in [START_REF] Bertoni | Sufficient conditions for sound tree and sequential hashing modes[END_REF], and by Daemen, Dusenge and Van Assche in [START_REF] Daemen | Sufficient conditions for sound hashing using a truncated permutation[END_REF]. These authors describe several sufficient conditions that a mode of operation must meet to be covered by their result, which is therefore very general.

The wide-pipe mode of operation is therefore provably secure against all generic attacks. It also enjoys some other theoretical advantages. For instance, consider the Merkle-Damgård iteration of a compression function f . If f falls to a pseudo-preimage attack of time complexity T (given y, an attacker can find h and m such that f (h, m) = y), then the full H is susceptible of a Meet-in-the-Middle preimage attack of complexity √ 4T • 2 n/2 . This is for instance how a break of the MD4 compression function led to a break of the full hash function [START_REF] Leurent | Md4 is not one-way[END_REF]. Such a lifting is impossible on double-pipe hash functions.

Concatenated Hashing

A simple way to build a hash function would simply be... to concatenate the output of two existing hash functions. The implicit hope is that even if one of the hash function breaks, the other one would resist (or, at the very least, not break in the same way). This idea was apparently first suggest by Preneel in his PhD thesis [START_REF] Preneel | Analysis and design of cryptographic hash functions[END_REF], and variants thereof made their ways into several standards. For instance, in TLS a pseudo-random function family is created by considering the XOR of SHA-1 and MD5 [START_REF] Dierks | The MD5 message-digest algorithm[END_REF]. We consider the concatenation CH of k Merkle-Damgård hash function (resulting in a bigger Merkle-Damgård hash): We describe the collision attack of [START_REF] Joux | Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions[END_REF] against the concatenated hash CH with two pipes. Starting from two fixed chaining values IV 1 and IV 2 in the two pipes, the adversary first finds a 2 n/2 -way multicollision (using the attack of §3.3.2) for the first hash function H f1 . The adversary then evaluates H f2 on the 2 n/2 messages of the multicollision, all yielding the same chaining value for H f1 , while yielding a set of 2 n/2 chaining values for H f2 , as shown in Figure 3.6. The adversary then looks for the expected collision in this set. To construct a 2 -multicollision on the two pipes, just replay Joux's attack using the two-pipe collision finding algorithm described above times.

CH (M ) = H f1 (IV 1 , M ) H f2 (IV 2 , M ) . . . H f k (IV k , M ).
Joux also shows that this idea can be extended to find (multi)collisions in the concatenation of an arbitrary number k of hash functions. To build a collision on k parallel pipes, the adversary proceeds inductively: first construct a 2 n/2 -way multicollision on the first k -1 pipes and hash the 2 n/2 messages in the last pipe. Then, by the birthday bound, a collision is expected amongst the set of 2 n/2 values generated in the last pipe. This collision is present in all the previous k -1 pipes, and hence results in a full collision on all the k pipes.

The cost of building a collision on k pipes is the cost of building the multicollision, plus the cost of hashing the 2 n/2 messages of length (n/2) k-1 . Solving the recurrence yields a time complexity of k • (n/2) k-1 • 2 n/2 compression function calls. More generally, the complexity of building a 2 -way multicollision on k pipes is exactly times the preceding expression, or

• k • (n/2) k-1 • 2 n/2
. Preimages on the concatenation can also be found for roughly 2 n compression function evaluations using similar techniques [START_REF] Joux | Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions[END_REF]. We give a herding attack in §5.1.

Some Form of Provable Security

The intuition that the concatenation CH = H f1 H f2 might be secure even when f 1 and f 2 are very badly broken compression functions contains some truth. Hoch and Shamir have studied the security of this concatenation under the assumption that f 1 and f 2 are weak compression functions [START_REF] Hoch | On the Strength of the Concatenated Hash Combiner When All the Hash Functions Are Weak[END_REF]. In this setting, f 1 and f 2 are public random functions, but the adversary has access to inversion oracles that finds preimages in unit time for either f 1 or f 2 . More specifically the adversary has access to the following oracles:

-

(h, ?, y) → m such that f 1 (h, m) = y -(h, ?, y) → m such that f 2 (h, m) = y -(?, m, y) → h such that f 1 (h, m) = y -(?, m, y) → h such that f 1 (h, m) = y
The oracles return ⊥ if no solution exist, otherwise they choose uniformly at random a possible answer. Observe that H f1 and H f2 are both very badly broken when taken individually. Using the inversions oracle, an attacker can forge preimages for the iterated hash functions in unit time. Their concatenation is nevertheless much more secure.

Theorem 3.10 ([HS08]

). Let denote any group operation (including concatenation on the free group), and let f 1 , f 2 be two weak compression functions. Then the concatenated hash function defined by H(M ) = H f1 (M ) H f2 (M ) is indifferentiable from a random oracle with q 2 n/2 queries, even in the presence of the inversion oracles.

The attack of Joux spun a wider interest in hash function combiners, i.e., simple ways of turning several hash functions into a single and potentially strong one in a black-box way. Boneh and Boyen first considered the case of H 1 H 2 , and showed in 2006 that any secure construction that evaluates H 1 and H 2 once cannot output fewer bits than simply concatenating their outputs [START_REF] Boneh | On the impossibility of efficiently combining collision resistant hash functions[END_REF]. They left as an open problem to study the combination of hash functions amongst which k are collision resistant. The concatenation of the output of k + 1 of them is collision resistant by definition, and Pietrzak showed that no secure combiner can output less bits [START_REF] Pietrzak | Non-trivial black-box combiners for collision-resistant hash-functions don't exist[END_REF]. Lastly, Lehmann and Fischlin observed that restricting the input domain of H 1 H 2 to messages of at most n/4 blocks thwarts Joux's attack [START_REF] Fischlin | Security-amplifying combiners for collision-resistant hash functions[END_REF]. They showed that in this case, any adversary allowed to find a polynomial number of collisions on the compression functions cannot find a collision on the concatenation. The limitation on the input domain can be mitigated by using hash trees (cf §3.5.1).

Other Hash Function Modes of Operation

We move on to the "Oddities Museum" section of our hash function modes of operation zoo. We describe some hash function modes of operation that are not very similar to Merkle-Damgård.

Tree Hashes

Tree hashes were first suggested in [START_REF] Ralph | One Way Hash Functions and DES[END_REF]. Let f : {0, 1}

n × {0, 1} n → {0, 1} n be a compression function used in the tree hash H f . An -bit message M is initially padded with a single "1" bit and as many "0" bits as needed to obtain pad TH (M ) = m 1 , m 2 , . . . , m L , where each m i is n-bit long, L = 2 κ for κ = log 2 ( + 1)/n . Consider the resulting message blocks as the leaves of a full binary tree of depth κ. Then, the compression function is applied to any two leaves with a common ancestor, and its output is assigned to the common ancestor. This procedure is followed in an iterative manner. A final compression function is applied to the output of the root and an extra final strengthening block, normally containing the length of the input message M . The resulting output is the final tree hash. Formally, the tree hash function H f (M ) is defined by Algorithm 3.7. The main advantage of tree hashes is that the hash function can be evaluated in parallel. Tree hashes are inherently victims of a long-message second preimage attack, unless specific countermeasures prevent it.

Algorithm 3.7 Tree Hashing function Tree-Hash(M ) m 1 , m 2 , . . . , m L ← pad TH (M ) for j = 1 to 2 κ-1 do compute h 1,j = f (m 2j-1 , m 2j ) for i = 2 to κ do for j = 1 to 2 κ-i do compute h i,j = f (h i-1,2j-1 , h i-1,2j ) end for return H f (M ) = f (h κ,1 , |M |). end function

Merkle-Damgård-Again

Hash twice, double the fun!

Hash function folklore

The "Hash-Twice" constructions, aka Merkle-Damgård-Again, is a folklore non-streamable mode of operation, meaning that the whole message must be present in memory during the whole hash process. The idea is quite simple: hash a message using the Merkle-Damgård iteration of some compression function, then define the IV to be the resulting hash value, and hash the message again! Formally, we define

H = f * f * (IV, M ), M ,
where M is appropriately padded. Figure 3.7 illustrates the construction. This construction does not enjoy any security result that we are aware of, but it seems remarkably resistant: none of the generic attacks described in §3.3 apply as-is. However, a generalized version of Joux's multicollision does apply [START_REF] Hoch | Breaking the ice -finding multicollisions in iterated concatenated and expanded (ice) hash functions[END_REF][START_REF] Nandi | Multicollision attacks on some generalized sequential hash functions[END_REF] with essentially the same complexity. In addition, we describe a herding attack in §5.2 and a second preimage attack in §5.3, with essentially the same complexity as their Merkle-Damgård counterparts.

The Zipper hash

The "Zipper" mode of operation has been proposed by Liskov in 2006, and is also a non-streamable mode of operation quite similar to Merkle-Damgård-Again. Let f 1 , f 2 be two compression functions, and let M 3.5. Other Hash Function Modes of Operation

m 0 f 2 f 1 m 1 f 2 f 1 m 2 f 2 f 1 m r f 2 f 1 h 2 0 h 1 0 h 2 1 h 1 1 h 2 2 h 1 2 IV Figure 3.7: Merkle-Damgård-Again.
an appropriately padded message. We denote by M the message M in which the blocks are written in the opposite order. The zipper hash ZH is defined as:

ZH (M ) = f * 2 f * 1 (IV, M ), M .
Liskov proved that this apparently bad construction enjoys a very interesting security feature, similar to that of the concatenated hashing (cf. §3.4.5), namely that the construction is secure even if the two compression functions are very weak. Theorem 3.11 ([Lis06]). Let f 1 , f 2 be two weak compression functions. Then the Zipper hash function ZH is indifferentiable from a random oracle with q 2 n/2 queries, even in the presence of the inversion oracles.

This bound cannot be improved because the generalized variant of Joux's multicollision attack does apply [START_REF] Hoch | On the Strength of the Concatenated Hash Combiner When All the Hash Functions Are Weak[END_REF][START_REF] Nandi | Multicollision attacks on some generalized sequential hash functions[END_REF]. We also give a herding attack in §5.2.1.

Chapter 4 New Generic Second Preimage Attacks

In this chapter we present a new generic second preimage attack against the Merkle-Damgård mode of operation and some derivatives. This new attack in particular breaks Rivest's Dithered hashing, which was specifically designed to avoid generic second preimage attacks. This work led to a joint publication at EUROCRYPT 2008, along with Elena Andreeva, Orr Dunkelman, Johnathan Hoch, John Kelsey, Adi Shamir and Sebastien Zimmer [ABF + 08]. Andreeva, Dunkelman and Kelsey had in fact independently discovered the attack at the exact same time we did.

This chapter describes a new generic second preimage attack against Merkle-Damgård. It relies heavily on the diamond structure introduced by Kelsey and Kohno [START_REF] Kelsey | Herding Hash Functions and the Nostradamus Attack[END_REF] and described in §3.3.5. On the plain Merkle-Damgård construction, the new attack does not really improve on the previously-known generic second preimage attacks of Dean [START_REF] Drews | Formal Aspects of Mobile Code Security[END_REF] and Kelsey-Schneier [START_REF] Kelsey | Second Preimages on n-Bit Hash Functions for Much Less than 2 n Work[END_REF]. The new attack is however much more flexible, and can be applied to a broader spectrum of hash functions. We first describe the new attack in its simplest form against the plain Merkle-Damgård mode of operation in §4.1. We then show that it breaks Rivest's dithered hashing in §4.2, and that it matches the provable security bound on Shoup's UOWHF in §4.3. A refined, more sophisticated version of the attack breaks the folklore Merkle-Damgård-again mode of operation, but as this require some more machinery, we delay its exposition to chapter 5.

A New Generic Second Preimage Attack Against Merkle-Damgård

Our new technique to find second preimages on Merkle-Damgård hash functions relies on the "diamond structure" of the herding attack that was described in §3.3.5.

The idea of the attack can be summarized as follows. Assume we have performed the offline phase of the herding attack, and have computed a diamond structure with 2 "leaves" (or external nodes) and such that the chaining value at the root is h . This can be done with about 2 n/2+ /2+2 compression function evaluations. Then, given a target message M of length 2 κ blocks, connecting h to one of the 2 κ chaining values encountered during the computation of H(M ) takes only 2 n-κ compression function calls. Then, connecting an arbitrary prefix P of the right size to the diamond structure takes time 2 n-, and leads to a successful second preimage forgery, since all the steps have complexity less than 2 n . The attack is illustrated and more precisely described in Algorithm 4.1.

Complexity. The first step allows for precomputation and its time and space complexity is about 2 (n+ )/2+2 (see §3.3.5). The second step of the attack is carried out online with 2 n-κ work, and the third step takes 2 n- work. The total time complexity of the attack is then 2 (n+ )/2+2 precomputation and 2 n-κ + 2 n-online computations and their sum is minimal when = (n -4)/3 for a total of about 5 • 2 2n/3 + 2 n-κ computations.

Comparison with Previously Existing Generic Attacks. The attacks of [START_REF] Drews | Formal Aspects of Mobile Code Security[END_REF][START_REF] Kelsey | Second Preimages on n-Bit Hash Functions for Much Less than 2 n Work[END_REF] are slightly more efficient than ours. We present the respective offline and online complexities for the old and new variants of the attack in Table 4.1 and we compare the attacks for MD5 (n = 128, κ = 55), SHA-1 (n = 160, κ = 55), SHA-256 (n = 256, κ = 118), and SHA-512 (n = 512, κ = 118) in Table 4.2. Still, our technique gives the adversary more control over the second preimage. She may choose a large chunk of the forgery, typically one half. For example, she could choose to reuse most of the target message, leading to a second preimage that differs from the original by only + 2 blocks.

The main difference between the older techniques and ours is that the previous attacks build on the use of expandable messages. We note that our attack just offers a short patch. At the same time, our attack can also be viewed as a new, more flexible technique to build expandable messages, by choosing a prefix of the appropriate length and connecting it to the collision tree. This can be done in time 2 (n+ )/2+2 + 2 n-. Although it is more expensive, this new technique can be adapted to work even when an additional dithering input is given, as we shall now demonstrate. 1. Construct a collision tree of depth with a final chaining value at the root h .

2. Connect h to some intermediate chaining value in the target message M . This is done by generating random message blocks B, until f (h , B) = h i for some i, such that + 1 ≤ i < M . Let B be the message block satisfying this condition.

3. Generate an arbitrary prefix P of size i --2 blocks, and assume that it hashes to h P , then "connect" it to the diamond. This can be done by generating random message blocks B, until f (h P , B) = x j , where x j is a chaining value labeling a leaf of the diamond. Let B denote this block, and let T be the chain of blocks traversing the diamond from x j to h .

Form a message

M = P ||B ||T ||B ||m i+1 , . . . , m 2 κ -1 . h x1 x3 x4 x2 x5 x6 blocks IV h i H(M ) M B m i+1 , . . . , m 2 κ -1 h P P B f h , B = h i f h P , B = x j Attack Complexity Avg. Patch Message Offline Online Memory Size Length Dean 2 n/2+1 2 n-κ 2 2 κ-1 2 κ Kelsey-Schneier κ • 2 n/2+1 + 2 κ 2 n-κ 2 • κ 2 κ-1 2 κ New 2 (n+ )/2+2 2 n-+ 2 n-κ 2 +1 + 2 2 κ Using TMDTO 2 (n+ )/2+2 + 2 n-λ 2 n-+ 2 2λ 2 +1 + 2 n-2λ + 2 2 λ ( §. 6.
2) -This attack assumes the existence of easily found fixed points in the compression function

Application to Dithered Hashing

In this section we describe a generic second preimage attack against Rivest's Dithered Hashing. This mode of operation was explicitly designed to avoid the existing second preimage attack (this was the motivation for choosing an abelian square-free dithering sequence). Before describing the attack itself, we investigate several properties of the dithering sequence.

More Sequence Background

The number of distinct factors of a given size of an infinite word gives an intuitive notion of its complexity: a sequence is more complex (or richer) if it possesses a large number of different factors. We denote by F act z ( ) the number of factors of size of the sequence z. Because they have a very strong structure, r-uniform sequences have special properties, especially with regard to their complexity. Theorem 4.1 (Cobham, 1972, [Cob72]). Let z be an infinite sequence generated by an r-uniform morphism, and assume that the alphabet size A is finite. Then z has linear complexity bounded by: The values were optimized for minimal online complexity. TMDTO values were optimized for equal online and memory complexities. Memory and patches are measured in blocks. Length is given for cases where the message length may be shorter than 2 κ . Table 4.2: Comparison of the long-message second preimage attacks on real hash functions A polynomial algorithm which computes the exact set of factors of a given length can be deduced from the proof of this theorem. It is worth mentioning that similar results exist in the case of sequences generated by non-uniform morphisms [START_REF] Ehrenfeucht | Subword Complexities of Various Classes of Deterministic Developmental Languages without Interactions[END_REF][START_REF] Pansiot | Complexité des facteurs des mots infinis engendrés par morphismes itérés[END_REF], although the upper bound can be quadratic in . The bound given by this theorem, although attained by certain sequences, is relatively rough. For example, since the Keranen sequence is 85-uniform, the theorem gives F act k ( ) ≤ 1360 • . For = 50, this gives F act k (50) ≤ 68000, while the factor-counting algorithm reveals that F act k (50) = 732. Hence, for small values of , the following more ad hoc upper bound may be tighter: Lemma 4.2. Let z be an infinite sequence over the alphabet A generated by an r-uniform morphism τ . For all , 1 ≤ ≤ r, we have :

F act z ( ) ≤ r • |A|
F act z ( ) ≤ • F act z (2) -|A| + (r + 1) • |A| -F act z (2) .
Proof. If ≤ r, then any factor of z of size falls in one of these two classes:

-Either it is a factor of τ (α) for some letter α ∈ A. There are no more than |A| • (r -+ 1) such factors.

-Or it is a factor of τ (α).τ (β), for two letters α, β ∈ A (and is not a factor of either τ (α) or τ (β)). For any given pair (α, β), there can only be -1 such factors. Moreover, α.β must be a factor of size of z.

So F act z ( ) ≤ |A| • (r -+ 1) + F act z (2) • ( -1).
For the particular case of the Keränen sequence k, we have r = 85, A = 4 and F act k (2) = 12 (all non-repeating pairs of letters). This yields F act k ( ) ≤ 8 • + 332 when ≤ 85, which is tight, as for = it gives: F act k (50) ≤ 732.

Factor Frequency

Formally, let us denote by N ω (x) the number of occurrences of ω in x (which is expected to be a finite word), and by z[1..i] the prefix of z of size i. The frequency of a given word ω in the sequence z is the limit of N ω (z[1..i])/i when i goes to +∞.

We will see later on that we will have to choose a given factor of the Keränen sequence in the course of our attack against Dithered Hashing, and that the complexity of the attack will depends on the frequency this factor. If the frequency of the various factors is non uniform, then the attack should exploit this bias (just like any cryptographic attack).

We denote by 2 -H∞(z, ) the frequency of the most frequent factor of length in the sequence z. It follows immediately that H ∞ (z, ) ≤ log 2 F act z ( ). Hence, when the computation of H ∞ (z, ) is infeasible, log 2 F act z ( ) can be used as an upper-bound. It is however possible to determine precisely the frequency of certain words in sequences generated by uniform morphisms. For instance, it is easy to compute the frequency of individual letters in the sequence generated by a morphism τ : if x is some finite word and α ∈ A, then by definition we find:

N α (τ (x)) = β∈A N α (τ (β)) • N β (x) (4.1)
In this formula, N α (τ (β)) is easy to determine from the description of the morphism τ . We define:

A = {α 1 , . . . , α k } U s = N αj (τ s (a)) s 1≤j≤|A| M = N αi (τ (α j )) 1≤i,j≤|A|
It follows from equation (4.1) that:

U s+1 = M • U s .
The frequency of individual letters is given by the vector U ∞ = lim s→∞ U s . Fortunately, this vector lies in the kernel of M -I k (and is such that its component sum up to one). For instance, for the Keränen sequence, and because of the very symmetric nature of τ , we find that M 1 is a circulant matrix:

85 • M =    
   
We quickly obtain: U ∞ = 1 4 (1, 1, 1, 1), meaning that no letter occurs more frequently than the other. The frequencies of digrams (i.e., two-letters words) are slightly more complicated to compute, as the digram formed from the last letter of τ (α) and the first letter of τ (β) is automatically a factor of τ (αβ) but is not necessarily a factor of either τ (α) or τ (β) individually. We therefore need a new version of equation (4.1) that takes this fact into account. Let us define Ω 2 = {ω 1 , . . . , ω r }, the set of factors of size two of z. If ω is such a factor, we obtain:

N ω (τ (x)) = γ∈A N ω (τ (γ)) • N γ (x) + ωj ∈Ω2 N ω (τ (ω j )) -N ω (τ (ω j [1])) -N ω (τ (ω j [2])) • N ωj (x) (4.2)
Again, in order to obtain a system of linear relations, we define:

V s = N ωi (τ s (a)) s 1≤i≤|Ω2| M 1 = N ωi (τ (α j )) 1≤i≤|Ω2|,1≤j≤|A| M 2 = N ωi (τ (ω j )) -N ωi (τ (ω j [1])) -N ωi (τ (ω j [2])) 1≤i,j≤|Ω2|
and equation (4.2) implies:

V s+1 = M 1 • U s + M 2 • V s
Again, we are interested in the limit V ∞ of V s when s goes to infinity, and this vector is a solution of the equation:

V ∞ = M 2 • V ∞ + M 1 • U ∞ .
For the Keränen sequence k, where Ω 2 = {ab, ac, ad, ba, bc, bd, ca, cb, cd, da, db, dc} , Because the magic string that defines the Keränen sequence begins and ends with an "a", then the digram formed by the last letter of τ (α) and the first letter of τ (β) is more precisely α.β. Thus, M 2 is in fact 1/85 times the identity matrix. We can then compute V ∞ , and we find: Here, a discrepancy is visible, with "ba" being nearly 15% more frequent than "ab". Computing the frequency of factors of size less than is not harder, and the reasoning for factors of size two can be used as-is. In fact, equation (4.2) holds even if ω is a factor of z of size less than . Let us define:

S = N ω (τ (α j )) 1≤j≤|A| , T = N ω (τ (ω j )) -N ω (τ (ω j [1])) -N ω (τ (ω j [2])) 1≤j≤|Ω2| .
Equation (4.2) then brings:

N ω τ s+1 (a) s+1 = S • U s + T • V s
And the frequency of ω in z is then

S • U ∞ + T • V ∞ .
The frequency of any word could be computed using this process recursively, but we will conclude here, as we have set up the machinery we need later on.

Description of the Attack

We now try to adapt the attack of §4.1 to the Dithered Hashing, assuming that there is an arbitrary dithering sequence z. The first problem arises in the offline phase, because in order to construct the diamond structure we must evaluate the compression function, and to evaluate the compression we must choose dithering letters. A simple solution is to use the same dithering symbol for all the edges at the same depth in the tree, as shown in Figure 4.1. A word of letters is then required to build a diamond structure with 2 external nodes. We also need an additional letter to connect the "root" of the diamond structure to the message M . To summarize, in order to build a diamond structure of depth , we have to fix a word ω of size + 1, use ω[i] as the dithering symbol at depth i, and use the last letter of ω to realize the connection to the given message. Let us denote this customized diamond structure by D ω .

The dithering sequence makes the hash of a block dependent on its position in the whole message. Therefore, the diamond structure D ω can be connected to its target only at certain positions, namely, at the positions where ω and z match. The set of positions in the message where this is possible is then given by:

Range(z, ω) = i ∈ N + 1 ≤ i ∧ z[i -] . . . z[i] = ω .
The attack is precisely described in Algorithm 4.2. The adversary tries random message blocks m , computing f (h , m , ω[ ]), until some h i is encountered. If i ∈ Range(z, ω), then the second preimage attack may carry on. Otherwise, another block m needs to be found. Therefore, the goal of the adversary is to build the diamond structure with a word ω which maximizes the cardinality of Range(z, ω).

To attain this objective, ω should be the most frequent factor of z. Its frequency, also known as the min-entropy of z, is therefore very important in computing the complexity of our attack. In the worst case, all factors of size + 1 appear in z with the same frequency, and the probability that a randomly chosen factor of size + 1 in z is the word ω is 1/F act z ( + 1). However, when it is possible to actually compute

a b a c h IV M H(M) d z[1] z[2]
a b a c d 2. Build a collision tree of depth using the first symbols of ω as the dithering symbols in all the leaf-to-root paths. Let h be the target value of the tree.

3. Connect h to some intermediate chaining value in the target message M (say h i ), by using ω[ ] as the dithering letter. Repeat until i ∈ Range(z, ω), where

Range(z, ω) = i ∈ N + 1 ≤ i ∧ z[i -] . . . z[i] = ω .
Let m be a message block satisfying this condition, i.e.,

h i = f (h , m , ω[ ]).
4. Generate an arbitrary prefix P of size i --2 blocks, and assume that it hashes to h P , then "connect" it to the diamond. This can be done by generating random message blocks B, until f (h P , B, z[i --1]) = x j , where x j is a chaining value labeling a leaf of the diamond. Let m denote such a block, and let T be the chain of blocks traversing the diamond from x j to h .

Form a message M

= P m T m m i+1 , . . . , m 2 κ -1 .
the min-entropy of z, better results can be achieved. In any case, the cost of finding the second preimage for a given sequence z is

2 n/2+ /2+2 + 2 H∞(z, +1) • 2 n-κ + 2 n-,
where H ∞ (z, + 1) is the min-entropy of + 1 words in the sequence z. In most "good sequences" (where the probability of all factors is roughly the same) or when the computation of the exact H ∞ (z, + 1) is infeasible, we can give an upper bound for the attack:

2 n/2+ /2+2 + F act z ( + 1) • 2 n-κ + 2 n-.

The Multi-Diamond Attack

So far, we only used a single diamond D ω , built using a single factor ω of the dithering sequence. As mentioned earlier, this diamond can only be used at specific locations, corresponding to the set of locations of z where ω appears. We note that while the locations to connect into the message are determined by the dithering sequence, the complexity of connecting to the diamond structure depends (mostly) on the parameter , which can be chosen by the adversary. Hence, to make the attack faster, we could try to enlarge the range of our herding device at the expense of a more costly precomputation and more memory.

Let ω 1 .β.α and ω 2 .γ.α be two factors of size + 2 of the dithering sequence both ending by a given letter α, with α, β, γ ∈ A (so that ω 1 and ω 2 are made of letters). We can build two independent diamonds D ω1 and D ω2 using ω 1 and ω 2 , respectively, to feed the dithering symbols. Assume that the root of D ω1 (respectively, D ω2 ) is labelled by h 1 (respectively, h 2 ). Now, we could find a colliding pair (m 1 , m 2 ) such that f (h 1 , m 1 , β) = f (h 2 , m 2 , γ). Let us denote by h the resulting chaining value. Figure 4.2 illustrates this. This last node can be connected to the message using α as the dither symbol. We have "herded" together two diamonds with two different dithering words, and the resulting "multi-diamond" is more useful than any of the two diamonds separately. This claim is justified by the fact that the range of the new multi-diamond is the union of the two ranges of the two separate diamonds. This technique can be used twice, as exemplified by Figure 4.3 to provide an even bigger range, as long as there is a set of four factors of z of size + 3 that can be written:

ω 1 ω 2 h 1 h 2 h β γ α Figure 4.2: A "Multi-diamond" with 2 words. ω 1 ω 2 ω 3 ω 4 h 1 h 2 h 3 h 4 h 1 h 2 δ ε ζ η β γ h α
{ω 1 .δ.β.α, ω 2 .ε.β.α, ω 3 .ζ.γ.α, ω 4 .η.γ.α} ,
where |ω i | = and α, β, γ, δ, ε, ζ, η ∈ A. A total number of 3 colliding pairs are needed to assemble the 4 diamonds together into this new multi-diamond.

Let us generalize this idea. We say that a set of 2 k words is suffix-friendly if all the words end by the same letter, and if after chopping the last letter of each word, the set can be partitioned into two suffix-friendly sets of size 2 k-1 each. A single word is always suffix-friendly, and thus the definition is well-founded. Of course, a set of 2 k words can be suffix-friendly only if all the words are of length greater than k. If the set of factors of size + k + 1 of z contains a suffix-friendly subset of 2 k words, then the technique described here can be recursively applied k times.

An apparently tricky problem is to determine the biggest k such that a given set of words, say Ω, contains a suffix-friendly subset of size 2 k . This is fortunately doable in time polynomial in the sizes of Ω and A.

Also, given a word ω, we define the restriction of a multi-diamond herding tree to ω by removing nodes from the original until all the paths between the leaves and the root are labelled by ω. For instance, restricting the multi-diamond of Figure 4.3 to ω 1 .δ.β.α means keeping only the first sub-diamond and the path h 1 → h 1 → h . Now, assume that the set of factors of size + k + 1 of z contains a suffix-friendly subset of size 2 k denoted by Ω = {ω 1 , . . . , ω 2 k }. The multi-diamond formed by herding together the 2 k diamonds corresponding to the ω i 's can be used in place of any of them, as mentioned above. Therefore, its "frequency" is the sum of the frequency of the ω i . However, once connected to the message, only its restriction to the + k + 1 letter of z before the connection can be used. This restriction is a diamond with 2 leaves (followed by a "useless" path of k nodes).

The cost of building a 2 k -multi-diamond is 2 k the time of building a diamond of size plus the cost of finding 2 k -1 collisions. The cost of connecting the prefix to the multi-diamond is still 2 n-(this step is the same as in our original attack). Lastly, the cost of connecting the multi-diamond to the message depends on the frequency of the factors chosen to build it, which ought to be optimized according to the actual dithering sequence.

Cryptanalysis of Keränen-DMD

The cost of the single-diamond attack against Keränen-DMD depends on the properties of the sequence k that have been outlined in §4.2.1. Let us emphasize again that since it has a very regular structure, k has an unusually low complexity, and despite being strongly repetition-free, the sequence offers an extremely weak security level against our attack. Following the ideas of §4.2.1, the min-entropy of k for words of size ≤ 85 can be computed precisely: for 29 ≤ ≤ 85, the frequency of the most frequent factor of size + 1 is 1/(4 • 85) = 2 -8.4 (if all the factors of length, say, 50 were equally frequent, this would have been 1/732 = 2 -9.5 ). We thus have H ∞ (z, + 1) = 8.4, and the cost of our attack on Keränen-DMD, assuming that 29 ≤ ≤ 85, is:

2 n/2+ /2+2 + 2 n-κ+8.4 + 2 n-.
If n is smaller than 3κ -8.4, the optimal value of is reached by fixing = (n -4)/3. For n in the same order as 3κ, all the terms are about the same (for n > 3κ, the first term can be ignored). Hence, to obtain the best overall complexity (or to optimize the online complexity) we need to fix such that 2 n-κ+8.4 = 2 n-, i.e., = κ -8.4. For example, for κ = 55 the optimal value of is 46.6. The online running time (which is the majority of the cost for n > 3κ) is in this case 2 n-46.6 which is much smaller than 2 n in spite of the use of dithering. For larger values of , i.e., 85 ≤ < 128, we empirically measured the min-entropy to be H ∞ (k, + 1) = 9.8 so that = κ -9.8 can be used when n ≈ 3κ.

We also successfully applied the multi-diamond attack to Keränen-DMD. We determined the smallest such that the set of factors of size of the Keränen sequence k contains a From this table we conclude that our choice of k we will most likely be 6, since choosing 7 would require us to choose ≥ 109, which is going to unbalance the cost of the two online connections steps. Amongst all the possible suffix-friendly sets of size 2 6 found in the factors of size about 50 of k, we chose one having a high frequency using a greedy algorithm making use of the ideas exposed in §4.2.1. We note that checking whether this yields optimal multi-diamonds is out of the scope of this work. In any case, we found that the frequency of our multi-diamond, shown in Figure 4.4, is 2 -3. 97 .

If n is sufficiently large (for instance, n = 256), the offline part of the attack is still of negligible cost. Then, the minimal online complexity is obtained when 2 n-κ+3.97 = 2 n-, i.e., = κ -3.97. The complexity of the attack is then roughly 2 • 2 n-κ+4 for sufficiently large values of n. This represents a speed-up of about 21 compared to the single-diamond attack.

Cryptanalysis of DMD-CP

We now apply our attack to Rivest's concrete proposal. We first need to evaluate the complexity of its dithering sequence. Recall from §3.4.2 that it is based on the Keränen sequence, but that we move on to the next symbol of the sequence only when a 13-bit counter overflows (we say that it results in the dilution of k with a 13-bit counter). The original motivation was to reduce the cost of the dithering, but it has the unintentional effect of increasing the resulting sequence complexity. It is possible to study this dilution operation generically, and to see to which extent it makes our attack more difficult. Lemma 4.3. Let z be an arbitrary sequence over A, and let d denote the sequence obtained by diluting z with a counter over i bits. Then for every not equal to 1 modulo 2 i , we have:

F act d ( ) = 2 i -( mod 2 i ) + 1 • F act z • 2 -i + mod 2 i -1 • F act z ( -1) • 2 -i + 1
Proof. The counter over i bits splits the diluted sequence c into chunks of size 2 i (a new chunk begins when the counter reaches 0). In a chunk, the letter from z does not change, and only the counter varies. To obtain the number of factors of size , let us slide a window of size over d. This window overlaps at

least

• 2 -i chunks (when the beginning of the window is aligned at the beginning of a chunk), and at most (l -1) • 2 -i + 1 chunks (when the window begins just before a chunk boundary). These two numbers are equal if and only if ≡ 1 mod 2 i . When this case is avoided, then these two numbers are consecutive integers.

This means that by sliding this window of size over d we observe only factors of z of size • 2 -i and • 2 -i + 1. Given a factor of size • 2 -i of z, there are 2 i -( mod 2 i ) + 1 positions of a window of size that allow us to observe this factor with different values of the counter. Similarly, there are mod 2 i -1 positions of the window that contain a given factor of z of size • 2 -i + 1.

By taking 2 ≤ ≤ 2 i , we have that • 2 -i = 1. Therefore, only the number of factors of length 1 and 2 of z come into play. The formula can be further simplified into:

F act d ( ) = • F act z (2) -F act z (1) + (2 i + 1) • F act z (1) -F act 2 (z).
For the Keränen sequence with i = 13, this gives: F act d ( ) = 8 • + 32760. Diluting over i bits makes the complexity 2 i times higher, but it does not change its asymptotic expression: it is still linear in , even though the constant term is bigger due to the counter. The cost of the attack is therefore:

2 n 2 + 2 +2 + (8 • + 32760) • 2 n-κ + 2 n-.
At the same time, for any ≤ 2 i , the most frequent factor of d is (α, 0), (α, 1), . . . , (α, -1) when α is the most frequent letter of the Keränen sequence. However, as shown in section 4.2.1.1, all the letters have the same frequency, so most frequent factor of the diluted Keränen sequence d has a frequency of 2 -15 . Hence, the cost of the above attack is:

2 n/2+ /2+2 + 2 n-κ+15 + 2 n-.
This is an example where the most frequent factor has a frequency which is very close to the inverse of the number of factors (2 -15 vs. 1/(8 • + 32760)). In this specific case it may seem that the gain of using the most frequent element is small. As before, if n is greater than 3κ (in this specific case n ≥ 3κ -41), the optimal value of is κ -15, and the complexity of the attack is then approximately 2 • 2 n-κ+15 . For settings corresponding to SHA-1, a second preimage can be found in expected time of 2 120 (for 40 < < 78).

Countermeasures

We just observed that the presence of a counter increases the complexity of the attack. If we simply use a counter over i bits as the dithering sequence, the number of factors of size becomes F act( ) = 2 i (as long as i ≤ ). The complexity of the attack would then become:

2 n/2+ /2+2 + 2 n-κ+i + 2 n-.
By taking i = κ, we obtain a scheme which is resistant to our attack. This is essentially the choice made by the designers of Haifa, but such a dithering sequence consumes κ bits of bandwidth. Using a counter (i.e., a big alphabet) is a simple way to obtain a dithering sequence of high complexity. Another, somewhat orthogonal, possibility to improve the resistance of Rivest's dithered hashing to our attack is to use a dithering sequence of high complexity over a small alphabet (to preserve bandwidth).

Abelian Square-Free Sequences of Exponential Complexity. It is possible to construct an infinite abelian square-free sequence of exponential complexity, although we do not know how to do it without slightly enlarging the alphabet.

We start with the abelian square-free Keranen sequence k over {a, b, c, d}, and with another sequence u over {0, 1} that has an exponential complexity. For example, such a sequence can be built by concatenating the binary encoding of all the consecutive integers. Then we can create a sequence z over the union alphabet A = {a, b, c, d, 0, 1} by interleaving k and u:

z = k[1].u[1].k[2].u[2]. . . .
The resulting shuffled sequence inherits both properties: it is still abelian square-free, and has a complexity of order Ω 2 /2 . Using this improved sequence, with = 2κ/3, the total cost of the online attack is about 2 n-2κ/3 (assuming n > 8κ/3). Even with this exponentially complex dithering sequence, our attack is still more efficient than brute-force in finding second preimages. Although it may be possible to find square-free sequences with even higher complexity, it is probably very difficult to achieve optimal protection, and the generation of the dithering sequences is likely to become more and more complex.

Pseudorandom Sequences. Another possible way to improve the resistance of Rivest's construction against our attack is to use a pseudo random sequence over a small alphabet. Even though it may not be repetitionfree, its complexity is almost maximal. Suppose that the alphabet has size A = 2 i . Then the expected number of -letter factors in a pseudo random word of size 2 κ is lower-bounded by: 2 i• • 1 -exp -2 κ-i• (refer to [START_REF] Janson | On average sequence complexity[END_REF], theorem 2, for a proof of this claim). The total optimal cost of the online attack is then at least 2 n-κ/(i+1)+2 and is obtained with = κ/(i + 1). With 8-bit pseudorandom dithering symbols and κ = 55, the complexity of our attack is about 2 n-5 , which still offers a small advantage over exhaustive search.

To conclude, we note that we show how to perform some attacks on dithering sequences over small alphabet in the precomputation model in §6.3 (i.e., when a one-time precomputation of complexity 2 n subsequently allows to find arbitrary second preimages faster than exhaustive search).

Application to Shoup's UOWHF

We now adapt the attack of §4.1 to Shoup's UOWHF. To the best of our knowledge, no previous attack on this construction was known. The complexity of the attack matches the lower bound given in Shoup's security proof (cf §3.4.3), thus showing that both the attack and the proof are optimal.

We first give an alternate definition of the dithering sequence z used in Shoup's UOWHF. In fact, the alphabet over which the sequence z[i] = ν 2 (i) is built is not finite, as it is the whole N. In any case, we define:

u i = 0 if i = 1, u i-1 .(i -1).u i-1 otherwise.
As an example, we have u 4 = 010201030102010. The following facts about z are easy to establish:

i) |u i | = 2 i -1
ii) The number of occurrences of u i in u j (with i < j) is 2 j-i .

iii) The frequency of u i in the (infinite) sequence z is 2 -i .

iv) The frequency of a factor is the frequency of its highest letter. v) Any factor of z of size contains a letter greater or equal to log 2 ( ) .

Let us consider a factor of size of z. It follows from the previous considerations that its frequency is upper-bounded by 2 -log 2 ( ) -1 , and that this bound is reached by a prefix of size of z. The frequency is lower-bounded by the nicer expression 1/(2 • ).

Our attack can be applied against the eSec property of H as described above. Choose at random a (long) target message M . Once the key is chosen at random, build a collision tree using a prefix of z of size , and continue as described in §4.2.2. The cost of the attack is then upper-bounded by:

T = 2 n/2+ /2+2 + 2 • • 2 n-κ + 2 n-.
The attack breaks the target collision resistance with a constant success probability (of about 63%). Therefore, with Shoup's security reduction, one can construct an adversary against f with running time T and probability of success 0.63/2 κ . If f is a black box, the best attack against the eSec property of f is exhaustive search. Thus, the best adversary in time T against f has a success probability of T /2 n . When n ≥ 3κ, T (2κ + 2) • 2 n-κ (with = κ -1), and thus the best adversary running in time T has success probability O (κ/2 κ ) while the success probability of our attack is 0.63/2 κ . This implies that there is no attack better than ours by a factor greater than O (κ) or, in other words, there is only a factor O (κ) between Shoup's security proof and our attack.

We note that in this case, there is a very large gap between the frequency of the most frequent factor and the upper-bound provided by the inverse of the number of factors. Indeed, it can be seen that:

F act ui ( ) =      0 if |u i | < 2 i - if |u i-1 | < ≤ |u i | + F act ui-1 ( ) if |u i-1 | ≥
And the expression of the number of factors follows:

F act uκ ( ) = 2 log 2 ( +1) + κ -log 2 ( + 1) -1 •
Hence, if all of them would appear with the same probability, the time complexity of the attack would have been

T = 2 n 2 + 2 +2 + 2 log 2 ( +1) + κ -log 2 ( + 1) -1 • • 2 n-κ + 2 n-,
which is roughly κ times bigger than the previous expression.

Application of the Multi-Diamonds Attack

To apply the multi-diamond attack of §4.2.3, we need to identify a big enough suffix-friendly subset of the factors of z of a given size, and to compute its frequency.

We choose to have end diamonds of size = 2 2 i -1 . Let us keep in mind that and κ must generally be of the same order to achieve the optimal attack complexity, which suggest that i should be close to log 2 log 2 κ. Now, we need to identify a suffix-friendly set of factors of z in order to build a multi-diamond. In fact, we focus on the factors that have u i as a suffix. It is straightforward to check that they form a suffix-friendly set. It now remains to estimate its size and its frequency. Lemma 4.4. let Ω j be the set of words ω of size = 2 2 i -1 such that ω.u i is a factor of u j . Then:

i) If κ ≥ 2 i , then |Ω κ | = κ -2 i + 1 • 2 2 i -i-1
ii) There are 2 2 i -i-1 (distinct) words in Ω κ whose frequency is 2 -j (with 2 i ≤ j ≤ κ).

Proof. We first evaluate the size of Ω, and for this we define f i (κ), the number of factors of u κ that can be written ω.u i , with |ω| = 2 2 i -1 . We find:

|Ω κ | = 0 if 2 κ < 2 2 i -1 + 2 i |Ω κ-1 | + 2 2 i -i-1 if 2 κ ≥ 2 2 i -1 + 2 i (4.3)
The first case of this equality is rather obvious. The second case stems from the following observation: let x be a factor of u j , for some j. Then either x is a factor of u j-1 , or u contains the letter "j -1" (both , then u i appears 2 κ-i times in u κ , at indices that are multiples of 2 i . The unique occurrence of letter "κ -1" in u κ is at index 2 κ-1 -1. Thus, elements of Ω κ containing the letter "κ -1" are present in u κ at indices 2 κ-1 -2 2 i -1 + α • 2 i , with 0 ≤ α < 2 2 i -i-1 . Therefore, there are exactly 2 2 i -i-1 distinct elements of Ω κ containing "κ -1" in u κ (they are necessarily distinct because they all contain "κ -1" only once and at different locations). Now that (4.3) is established, we can unfold the recurrence relation. We note that we have for i ≥ 1, log 2 2 2 i -1 + 2 i = 2 i , and thus we obtain (assuming that κ ≥ 2 i ):

|Ω κ | = κ -2 i + 1 • 2 2 i -i-1
Also, for 2 i ≤ j ≤ κ, Ω κ contains precisely 2 2 i -i-1 words whose greatest letter is "j -1", and thus whose frequency in z is 2 -j .

By just selecting the factors of Ω κ of the highest frequency, we would herd together

2 2 i -i-1 = / (1 + log 2 )
diamonds, each one being of frequency 1/(2 ). The frequency of the resulting multi-diamond then becomes 1/ (2 + 2 log 2 ). The cost of the multi-diamond attack is thus roughly:

1 + log 2 • 2 (n+ )/2+2 + 2 n 2 + (1 + log 2 ) • 2 n-κ+1 + 2 n-.
If n 3κ, the preprocessing will be negligible compared to the online time, and the cost of the attack is O (log κ • 2 n-κ ). Therefore, with the same reasoning as before, we can show that there is a factor O (log κ) between Shoup's security proof and our attack. Note that, depending on the parameters, this improved version of the attack may be worse than the basic version.

We outline the complexities out our attacks (the regular and the multi-diamond ones) against MD5, SHA-1, SHA-256, and SHA-512 in Table 4.3.

Chapter 5 Other Generic Attacks on Other Constructions

In this chapter we give more generic attacks on less standard modes of operations. Our results culminate with a generic second preimage attack on Merkle-Damgård-Again. This work has led to a joint publication with Elena Andreeva, Orr Dunkelman and John Kelsey at SAC 2009 [START_REF] Andreeva | Herding, second preimage and trojan message attacks beyond merkle-damgård[END_REF].

Iterated-Concatenated-Expanded (ICE) hash functions generalize the Merkle-Damgård mode of operation in a natural way, by allowing an arbitrary number of permuted copies of the message to be hashed sequentially. The resulting construction is obviously non-streamable. the Merkle-Damgård-Again construction and the Zipper Hash are easily seen to be particular cases of this more general framework. A very general result of Hoch and Shamir [START_REF] Hoch | Breaking the ice -finding multicollisions in iterated concatenated and expanded (ice) hash functions[END_REF], generalizing a preliminary result of Nandi and Stinson [START_REF] Nandi | Multicollision attacks on some generalized sequential hash functions[END_REF], states that any ICE hash function is susceptible to a generalization of Joux's multicollision attack, with essentially the same complexity.

In this chapter we aim at breaking some ICE hash functions using either a herding attack or a second preimage attack. In §5.1 we build the main tool that helps us achieve these goals, namely the ability to perform the herding attack on concatenated hashes. We then use this tool to find herding attacks on the Zipper Hash and on Merkle-Damgård-Again in §5.2. Building on this result we extend the second preimage attack of chapter 4 to Merkle-Damgård-Again in §5.3, combining Joux's multicollisions, Kelsey and Scheier's expandable messages and Kelsey and Kohno's diamond structure in a single attack, arguably the most sophisticated generic attack on hash functions so far. We conclude this chapter by presenting in §5.4 the Trojan Message Attack, a new kind of generic attack. Like Joux's multicollision attack, the trojan message attack only requires a few collisions, and is therefore practical on some legacy hash functions such as MD5. We did a public demonstration of this attack at the rump session of CRYPTO 2009.

Herding Concatenated Hashes

We start by showing how to adapt the herding attack to concatenated hashes. The main idea behind the new attack is to construct multi-pipe diamond structures, which can be done "on top" of multicollisions. We recall that a multicollision on (k -1) pipes can be used to construct a collision on k pipes. In the same vein, we succeed in herding k pipes by building a k-pipe diamond using a (k -1)-pipe diamond and a (k -1)-pipe multicollision.

Assume that the adversary succeeded in herding k -1 pipes. Then, she faces the problem of herding the last pipe. Now, if the adversary tries to connect to a diamond structure in the k-th pipe with a random message block, she is very likely to lose the control over the previous pipes. However, if she uses a "block" which is part of a multicollision on the first k -1 pipes, she still maintains the control over the previous pipes, while offering enough freedom for herding the last pipe. The attack is described recursively, and the recurrence stops when there is only a single hash function left, in which case it is sufficient to apply the "normal" herding attack.

Precomputation Phase

In the precomputation phase, the adversary starts with the (k -1)-diamond which is already known and aims at building the k-diamond that would allow herding the k pipes. Figure 5.1 depicts the process for k = 2.

Randomization

Step. Given the concatenated chaining values, the adversary constructs a 2 n--multicollision on the first k -1 pipes. Let the resulting chaining value be h 1 , h 2 , . . . , h k-1 . This multicollision allows to randomize the chaining value in the last pipe while keeping the first k -1 pipes under full control. ), the adversary computes the new chaining values, expecting to reach enough collisions, such that for any h k i , there exists a "message" m α(i) (i.e., a sequence of message blocks in the multicollision) such that

f k * h k i , m α(i) : i ∈ 1, . . . , 2 = 2 -1 .
After this step, the same process is repeated as in the "normal" herding attack, until a fully converging tree has been built.

Running Time. The running time is dominated by the generation of the diamond structure in the last pipe. First, we need to generate a 2 n-+n /2 -multicollision on k -1 pipes, which requires:

n -+ n 2 • (k -1) • n 2 k-2 • 2 n/2
compression function calls. Then, we need to "hash" 2 values under 2 n-+1 2 message sequences (for the last layer of the diamond structure). While at a first glance it may seem that we need a very long time for each message sequence, it can be done efficiently if we take into consideration the fact that there is no need to recompute all the chaining values only if the last block was changed. Hence, the actual time required to construct the diamond structure is 2 • 2 n/2+ /2+2 (twice the time needed for a classic diamond structure). In total, the complexity of the preprocessing is:

n -+ n 2 • (k -1) • n 2 k-2 • 2 n/2 + (2 • k -1) • 2 n+ 2 +2 .
One may ask what is the reason for the randomization step. As demonstrated in the online phase of the attack, the need arises from the fact that herding the values in the first k -1 pipes fixes the value in the k-th pipe. Hence, we need enough "freedom" to randomize this chaining value, without affecting the already solved pipes.

Online Phase

The online phase of the herding attack is illustrated when k = 2 in Figure 5.2. Given a precomputed k-diamond structure, it is possible to apply the herding attack to k concatenated hash functions. The adversary is given a prefix P , and tries various message blocks m 1 until f 1 * IV 1 , P m 1 gives one of the 2 chaining values in D 1 (the diamond structure on the first pipe). Then, the adversary traverses the first diamond structure to its root, finding the first part of the suffix S 1 . Note that so far all computations have been done in the first pipe. At this point, the adversary computes f 2 * (IV 2 , P m 1 S 1 m 2 ) for all the 2 n-messages m 2 of the multicollision in the randomization path, until one of them hits one of the 2 values in D 2 (the diamond on the second pipe). The adversary can then use the paths inside this second diamond to reach h 2 in the second pipe, while the first pipe reaches h 1 . This process can start again (with a randomization part, and traversing the diamond structure) until all k pipes were herded correctly.

We note that once a pipe is herded, there is no longer a need to evaluate it (as the multicollision predicts its value), and then it is possible to start analyzing the next pipe. In each new pipe, we need to evaluate 2 n-"messages" (for all pipes but the first one, these messages are multicollisions on the previous pipes), Hence, the online time complexity of the attack is

1 block blocks n -blocks • n/2 blocks h 1 h 2 h 1 h 1 h 2
2 n-• [1 + 2 • (k -1)] = (2k -1) • 2 n-
compression function calls, essentially 2k times more than the normal herding attack.

Herding Some Non-Streamable Modes of Operations

In this section, we adapt the herding attack from the previous section to the Zipper Hash and to Merkle-Damgård-Again. This is not very difficult once these two construction are seen as the concatenation of two hash functions (where the IV in the second pipe is not fixed a priori).

Herding the Zipper Hash Function

We begin by observing that the "regular" herding attack is not feasible on the Zipper Hash, because the last message block going into the compression function is the first message block of the challenge. It follows that an adversary capable of doing the herding attack could be used to invert the compression function. This makes the Zipper Hash provably resistant to the Herding attack.

We therefore consider a variant of the herding attack where the challenge is placed at the end: the adversary commits to a hash value h , then she is challenged with a suffix S and has to produce a prefix P such that ZH (P S) = h . If the hash function were a Random Oracle, this would obviously require 2 n queries.

Because each message block enters the hashing process twice, choosing a message block in the second pass may change not only the chaining value going out the second pass but also the chaining value going in the second pass. Choices of the message intended to affect the second pass must thus be done in a way that does not randomize the result of the first pass. This can be done using the techniques developed for the concatenation of two hash functions. The attack is illustrated by Figure 5.3.

Offline Phase

1. Starting from the IV , build a 2 n /2+n--multicollision that yields a chaining value h 1 . , where the order of colliding messages in the multicollision is reversed). The chaining value at the root of the second diamond is h .

IV h c h e h 1 h 2 h c h e h 2 r challenge 1 1st diamond n - • n 2 2nd diamond
3. Commit to h .

Online Phase

1. Given a challenge suffix S, compute the chaining value after the two copies of the challenge:

h m = f 2 * f 1 * (h 1 , S) , S .
2. From h m , find a connecting path in the part of the (reversed) multicollision that is just before the diamond (in the second run) yielding a chaining value h e that belongs to the diamond structure (h e ∈ D 1 ). Then find a path inside the (reversed) diamond structure towards the committed hash h .

We note that the fact that two different compression functions f 1 and f 2 are used in the two passes has no impact on our results, as the attack technique is independent of the actual functions used. The precomputation phase takes 2 • 2 (n+ )/2+2 + (n -+ n 2 ) • 2 n/2 compression function evaluations, and the online computation takes 2 • 2 n-compression function calls.

More Herding: Merkle-Damgård-Again

The attack is essentially the same as the one against the concatenation of two hash functions, as shown in figure 5.4. The adversary commits to h 2 , and is then being challenged with an unknown prefix P . Hashing the prefix yields a chaining value h c . Starting from h c , she chooses a message block m 1 connecting to a chaining value h e which is one of the starting points of the first diamond, then a path S 1 inside it yields the chaining value h 1 on the first pass, from which we traverse a precomputed 2 n-+n /2 -multicollision, producing h 2 as the input chaining value to the second pass. Starting from h 2 , the challenge prefix P leads to a random chaining value h c in the second pass. Then, the second pass can be herded without losing control of the chaining value in the first pipe thanks to the diamond built on top of the multicollision. Amongst the 2 n-messages in the multicollision following the first diamond, we expect one to connect to the chaining value h e in the starting points of the second diamond. We can then follow a path inside the second diamond, which is also a path in the multicollision of the first pipe, that yields the chaining value at the root of the second diamond, namely h 2 .

The offline complexity of the attack is the time required for generating a diamond structure of 2 starting points (which takes 2 (n+ )/2+2 ), finding (n -) + n • /2 collisions (which takes [(n -) + n • /2] • 2 n/2 ), and constructing a two-pipe diamond (which takes 2 • 2 (n+ )/2+2 ). The total offline complexity is therefore 3 • 2 (n+ )/2+2 compression function evaluations.

The online complexity is composed of finding two connecting "messages". The first search takes 2 n-, while the second takes 2 • 2 n-, or a total of 3 • 2 n-.

Attacks on Merkle-Damgård-Once-More. It is relatively clear that the attack can be generalized to the case where the message is hashed three or more times (by using multicollisions on 3 pipes, or the respective number of passes). The complexity of the attack becomes polynomially higher, though.

A Generic Second Preimage Attack on Merkle

-Damgård-Again m IV H(M ) IV h a h b h h i 2 k n - • n/2 2 k -i (a) First online step M ex i -(n -) -• n/2 -1 n - • n/2 1 2 k -i m IV H(M ) h a h b h c h d h e h h i (

A Generic Second Preimage Attack on Merkle-Damgård-Again

If a construction is susceptible to the herding attack, then it is natural to ask whether the second preimage attack of chapter 4 is applicable. Recall that the general idea of this attack is to connect the root of the diamond structure to some chaining value encountered during the hashing of the target message, and then connect into the diamond structure (either from the corresponding location in the original message or from a random prefix). This ensures that the new message has the same length (foiling the Merkle-Damgård strengthening).

In this section, we present a second preimage attack against the Merkle-Damgård-Again construction. The general strategy is to build a diamond structure, and try to connect it to the challenge message (in the second pass). Some complications appear, because the connection may happen anywhere, and the diamond only works on top of a multicollision that has to be located somewhere in the first pass. However, we can use an expandable message (cf. §3.3.4) to move the multicollision (and therefore the diamond) around. Here is a complete description of the attack. Let us assume that the adversary is challenged with a message M of 2 κ blocks.

The offline procedure is as follows:

1. Generate an expandable message which can take any length between κ and 2 κ + κ -1, starting from the IV and yielding a chaining value h a . 2. Starting from h a , generate a multicollision of length (n-)+ •n/2 blocks, yielding a chaining value h b . 3. Build a diamond structure on top of the multicollision. It yields a chaining value h . It is used to herd the second pass. The online phase, given a message M , is as follows (depicted in Figure 5.5):

1. Given h , select at random message blocks m until f (h , m ) equals to a chaining value h i appearing in the second pass. 2. To position the end of the diamond at the i-th block of M , generate the instance of the expandable message of length in • /2 -(n -) blocks, and let us denote it by M ex . Note that we have

h a = f * (IV, M ex ). 3. Let h c = f * (h b , m i+1 , m i+2 , . . . , m 2 κ -1
). Compute the second pass on the expandable message, until h d is reached:

h d = f * (h c , M ex )
. Now, using the freedom in the first nblocks of the multicollision, find a message m that sends h d to a chaining value h e occurring in the starting points of the diamond in the second pass. 4. Find a path T inside the diamond in the second pass (this is also a path inside the multicollision of the first pass). It yields the chaining value h at the root of the diamond in the second pipe. 5. Let M = M ex m T m m i+1 , . . . , m 2 κ -1 . We readily find that H(M ) = H(M ). Note that the message forged by assembling the right parts has the same length as M , therefore the padding scheme act the same way on both. The offline complexity of the attack is the mostly dominated by the need to construct a diamond structure on two pipes, i.e., 2 • 2 (n+ )/2+2 . The online time complexity is 2 n-κ for finding m, and 2 • 2 n-connecting to the diamond structure. Hence, the total online time is 2 n-κ + 2 n+1-, essentially the same as the attack on the regular Merkle-Damgård mode of operation.

The Trojan Message Attack

Do not trust the horse, Trojans. Whatever it is, I fear the Greeks even when they bring gifts Virgil's Aeneid, Book 2,19 BC In this section, we introduce a new generic attack on many hash function constructions, called the Trojan Message attack. A Trojan message is a string S which is produced offline by an attacker, and is then provided to a victim. The victim then selects some prefix P from a constrained set of choices, and hashes P S. However, due to the way S was chosen, the attacker is now able to find a second preimage of H(P S).

Given a Merkle-Damgård hash for which collisions may be found, Trojan messages may be produced. In general, the Trojan message requires at least one message input block, and one collision search, per possible value of P . If there are 1024 possible values of P , an attacker may produce a 1024-block Trojan message, requiring 1024 collision searches.

One can imagine a Trojan message attack being practical against applications which use MD5, and which permit an attacker to provide the victim with "boilerplate" text for the end of his document, while imposing a relatively constrained set of choice for his part of the document.

Against Merkle-Damgård hashes, Trojan message attacks take two forms:

1. If only the Collision procedure from algorithm 3.2 is available, second preimages for the full message keep the victim's choice of P , but introduce a limited change in S. That is, the attacker finds S = S such that H(P S) = H(P S ). 2. If however the Dual-IV-Colliision procedure is also practical, second preimages for the full message give the attacker a choice of P , and leave S mostly unchanged. That is, the attacker finds P and S such that H(P S) = H(P S ). Let P = {P 1 , . . . , P N } be a set of N known prefix messages and h i 0 = f * (IV, P i ) be the intermediate chaining value resulting from the computation of P i . Note, that without loss of generality, we can assume that all the prefixes have the same length (otherwise, we just consider padded versions). Therefore, we safely disregard strengthening and padding issues.

Collision-Variant

The collision variant of the Trojan message attack makes use of the Collision procedure of Algorithm 3.2 (or any ad hoc equivalent), which takes a chaining value as parameter and produces a pair of messages colliding from this chaining value. The attack proceeds as follows:

5.4. The Trojan Message Attack 1. A computes N colliding message pairs (S i , T i ) using Algorithm 5.1.

2.

A sends B a suffix message S = S 1 . . . S N .

3. B commits to h = H f (P i S) where P i belongs to P.

4.

A finds out P i through exhaustive search amongst the N possible choices and outputs:

M = P i S 1 . . . T i . . .
h 0 ← IV 3:
for i = 1 to N do 4:

(S i , T i ) ← Collision h i i-1
5:

for j = 1 to N do 6:

h j i ← f h j i-1 , S i 7:
end for 8:

end for 9:

return (S 1 , T 1 ), . . . , (S N , T N ) 10: end function

h 1 0 h 1 1 h 1 2 h 1 3 h 1 4 h 2 0 h 2 1 h 2 2 h 2 3 h 2 4 h 3 0 h 3 1 h 3 2 h 3 3 h 3 4 h 4 0 h 4 1 h 4 2 h 4 3 h 4 4 T 1 S 1 T 2 S 2 T 3 S 3 T 4 S 4 S 2 S 3 S 4 S 1 S 3 S 4 S 1 S 2 S 4 S 1 S 2 S 3
We indeed verify that H f (M ) = h. The hash of P i S and P i S differs only when T i replaces S i , but because these two blocks collide, then the two hash processes do not diverge.

The only non-trivial part of the attack for A is the first step where she precomputes N collisions for each prefix from the set P (in time N • 2 n/2 ), and evaluates the compression function N 2 times. If finding a collision for the hash function is easy, for instance on legacy hash functions such as MD5, then the attack can even be practical. It has recently been shown that finding a collision in MD5 takes about 2 16 evaluations of the compression function [SSA + 09]. For instance, one can forge in a matter of seconds a suffix S of 46720 bytes permitting to find second preimages for MD5 if the prefix set P is the set of the days of the year.

The Herding Trojan Attack

The herding variant of the trojan message attack is stronger, and allows for more freedom for the attacker. In exchange, the preprocessing and the online running times are larger.

Let K denote the length of all possible prefixes in P. We can extend K to be as large as we wish. The herding variant of the Trojan message attack makes use of a different, more sophisticated "chosen-prefix" procedure Dual-IV-Collision(h 1 , h 2 ) from Algorithm 3.2, which returns two messages m 1 and m 2 , such that f (h 1 , m 1 ) = f (h 2 , m 2 ). In some specific cases this collision is harder to find (for instance in MD5, such collision takes 2 41 compression function evaluations [SSA + 09]).

Another difference between this variant and the previous one, is that in this variant, the adversary is challenged by a second prefix P , not controlled by him, which he has to herd to the same value as H f (P i S). The attack proceeds as follows:

1. A computes a diamond structure with 2 entry points, denoted by D 1 = {x i }, converging to the hash value h 0 , with the constraint that < K -2.

2.

A generates N colliding message pairs using Algorithm 5.2. for i = 1 to N do 3:

(S i , T i ) ← Dual-IV-Collision h i i-1 , h i-1
4:

for j = 1 to N do 5:

h i j ← f h i-1 j , S i 6:
end for 7:

h i ← f h i-1 , S i 8:
end for 9: end function

h 1 0 h 1 1 h 1 2 h 1 3 h 1 4 h 2 0 h 2 1 h 2 2 h 2 3 h 2 4 h 3 0 h 3 1 h 3 2 h 3 3 h 3 4 h 4 0 h 4 1 h 4 2 h 4 3 h 4 4 h 0 h 1 h 2 h 3 h 4 S 1 S 2 S 3 S 4 S 1 S 2 S 3 S 4 S 1 S 2 S 3 S 4 S 1 S 2 S 3 S 4 S 1 S 2 S 3 S 4 x 1 x i0 x 2 m i0 5.
A is challenged with an arbitrary prefix P of size at most K --1 blocks, not necessarily in the known prefix set.

6.

A finds (by random trials) a connecting message C of size K --|P | blocks such that

x i0 = f * (P C) ∈ D 1 . 7. A forges a new prefix Q = P C m i0 , which is such that f * (Q) = h 0 .

As in the collision version,

A outputs Q S 1 . . . T i . . . S N .
As in the collision variant, we have that H f (Q S ) = h. The reasoning to establish this fact is essentially the same. The workload of the attack is step one where A constructs a diamond structure with 2 starting points and N collisions for each prefix from the set P . Thus, the precomputation complexity is of order 2 n/2+ /2+2 + N • 2 n/2 . The online cost is the connection step for computing the prefix P and is of order 2 n-.

Applications of the Trojan Attacks

The trojan attack can be highly useful in instances with a set of predictable prefixes, and where the attacker is able to suggest a suffix to introduce to the message. Such a case is the X.509 certificate, where the adversary may generate a second certificate (with the same identification) but with different public keys. Another possible application is a time stamping service, which signs H(ts, M ) where ts is a time stamp and M is the document. In the "standard" Time-Memory tradeoff (TMTO) discovered by Hellman [START_REF] Hellman | A cryptanalytic time-memory trade off[END_REF], the objective is to invert an arbitrary function H : {0, 1} * → {0, 1} n . For this puprose, a precomputation requiring 2 n evaluations of H is used to generate a special data-structure of size 2 2n/3 , which subsequently allows to find a preimage of most points of {0, 1}

n with only 2 2n/3 evaluations of H. This general technique allows, after an enormous precomputation, to find preimages (and thus second-preimages) of any message in (online) time 2 2n/3 . However, it cannot take advantage of the length of the target message.

We show in §6.2 that Time-Memory Tradeoffs can be applied to speed up all the known generic second preimage attacks: after a preprocessing of complexity 2 n-κ , the adversary is able to find second preimages of long messages in online time 2 2(n-κ)/3 . We finally turn our attention to Rivest's Dithered Hashing again in §6.3, and we derive attacks capable of coping with arbitrary dithering sequences after a precomputation of order 2 n .

Hellman's Time-Memory Tradeoff Attack

Time-memory Tradeoff attacks (TMTO) were first introduced in 1980 by Hellman [START_REF] Hellman | A cryptanalytic time-memory trade off[END_REF]. The idea is to improve brute force attacks by trading the online time for memory and precomputation when inverting a function f : {0, 1} n → {0, 1} n . Suppose we have an image element y and we wish to find a pre-image x such that f (x) = y. One extreme would be to go over all possible elements x until we find one such that f (x) = y, while the other extreme would be to precompute a huge table containing all the pairs (x, f (x)) sorted by the second element. Hellman's idea is to consider what happens when applying f iteratively. We start at a random element x 0 and compute x i+1 = f (x i ) for t steps saving only the start and end points of the generated chain (x 0 , x t ). We repeat this process with different initial points and generate a total of c chains. Given an input y, we start generating a chain starting from y and checking if we reached one of the saved endpoints. If we have, we generate the corresponding chain, starting from the suggested starting point and hope to find a preimage of y. Notice that as the number of chains, c, increases beyond 2 n /t 2 , the contribution (i.e., the number of new values that can be inverted) from additional chains decreases. To counter this birthday paradox effect, Hellman suggested to construct a number of tables, each using a slightly different function f i , such that knowing a preimage of y under f i implies knowing such a preimage under f . Hellman's original suggestion, which works well in practice, is to use f i (x) = f (x `i). Thus, if we create d = 2 n/3 tables each with different f i 's, such that each table contains c = 2 n/3 chains of length t = 2 n/3 , about 80% of the 2 n points will be covered by at least one table. Notice that the online time complexity of Hellman's algorithm is t • d = 2 2n/3 while the memory requirements are d • c = 2 2n/3 .

It is worth mentioning, that when multiple targets are given for inversion (i.e., a set of possible targets

y i = f (x i ))
, where it is sufficient to identify only one of the preimages (x i for some i), one could offer better trade off curves. For example, given m possible targets, it is possible to reduce the number of tables stored by a factor of m, and trying for each of the possible targets, the attack (i.e., apply the chain). This reduces the memory complexity (without affecting the online time complexity or success rate), as long as m ≤ d (see [START_REF] Biryukov | Cryptanalytic Time/Memory/Data Tradeoffs for Stream Ciphers[END_REF] for more details concerning this constraint).

Time-Memory-Data Tradeoffs For Second Preimage Attacks

All known generic second preimage attacks (including that of chapter 4) assume that the target message is very long (2 κ blocks). This enables the connection to the target message to be done with about 2 n-κ compression function calls by exhaustive search. This "connection" step can be seen as finding the inverse of a function.

Recall that in the second preimage attack of chapter 4, we search for a message block m such that f (h , m ) = h i . Something very similar happens in the attacks of Dean and Kelsey-Schneier. As there are 2 κ targets (and finding the preimage of only one h i 's is sufficient), then we can run a time-memory-data tradeoff attack with a search space of N = 2 n , D = 2 κ available data points, time T , and memory M such that N 2 = T M 2 D 2 , after P = N/D preprocessing (and T ≥ D 2 ). Let 2 x be the online complexity of the time-memory-data tradeoff, with the constraint that 2 x ≥ 2 2κ , and the memory consumption is 2 n-κ-x/2 blocks of memory. The resulting overall complexities are 2 n/2+ /2+2 + 2 n-κ preprocessing, 2 x + 2 n-online complexity, and 2 +1 + 2 n-κ-x/2 memory, for messages of 2 x/2 blocks.

Given the constraints on the online complexity (i.e., x ≥ 2κ), it can possibly be beneficial to consider shorter messages, e.g., message of 2 λ blocks (with λ ≤ κ). For such cases, the offline complexity is 2 n/2+ /2+2 + 2 n-λ , the online complexity is 2 x + 2 n-, and the memory consumption is 2 n-λ-x/2 + 2 +1 .

We can balance the online and memory complexities (as commonly done in time-memory-data tradeoff attacks) by picking x such that 2 x + 2 n-≈ 2 n-λ-x/2 + 2 +1 . By picking λ = n/4, x = 2λ = n/2, and = n/2, the online complexity is 2 n/2+1 , the memory complexity is 3 • 2 n/2 , and the offline complexity is 5 • 2 3n/4 . This of course holds as long as n/4 = λ ≤ κ, or equivalently n ≤ 4κ.

We can for instance find a second preimage for a 2 40 -block long message in SHA-1, with an online time of 2 81 operations, 2 81.6 blocks of memory, and 2 120 steps of precomputation. The equivalent Kelsey-Schneier attack takes 2 120 online steps (and about 2 71 offline computation). The standard time-memory tradeoff for finding preimages on an n-bit function allows, after a preprocessing of complexity 2 n , to find preimages using time 2 x and memory 2 n-x/2 . Hence, for the same 2 40 -block message and 2 81.6 blocks of memory, the online computation is about 2 156.8 SHA-1 compression function calls, only marginally faster than exhaustive search.

Second Preimage Attack with Multiple Targets

The existing generic second preimage attacks can be applied efficiently to multiple target messages. The work needed for these attacks depends on the number of intermediate hash values of the target message, as this determines the work needed to find a linking message from the data structure used to forge a prefix of the challenge. A set of 2 R messages, each of 2 κ blocks, has the same number of intermediate hash values as a single message of 2 R+κ blocks, and so the difficulty of finding a second preimage for one of a set of 2 R such messages is no greater than that of finding a second preimage for a single 2 R+κ block target message. In general, for the older second preimage attacks, the total work to find one second preimage falls linearly in the number of target messages; for our attack, it falls also linearly as long as the total number of message blocks, 2 S , satisfies S < (n -4)/3.

Consider for example an application which has used SHA-1 to hash 2 30 different messages, each of 2 20 message blocks. Finding a second preimage for a given one of these messages using the attack of Kelsey and Schneier requires about 2 141 work. However, finding a second preimage for one of these of these 2 30 target messages requires 2 111 work. (Naturally, the adversary cannot control for which target message he finds a second preimage.)

This works because we can consider each intermediate hash value in each message as a potential target to which the root of the collision tree (or an expandable message) can be connected, regardless of the message it belongs to, and regardless of its length. Once we connect to an intermediate value, we have to determine to which particular target message it belongs. Then we can compute the second preimage of that message.

This observation is important for two reasons: first, simply restricting the length of messages processed by a hash function is not sufficient to block the long-message attack. Second, this observation allows longmessage second preimage attacks to be applied to target messages of practical length. A second preimage attack which is feasible only for a message of 2 50 blocks has no practical relevance, as there are probably no applications which use messages of this length. A second preimage attack which can be applied to a large set of messages of, say, 2 24 blocks each, might have some practical impact. While the computational requirements of these attacks are still infeasible, this observation shows that the attacks can apply to messages of practical length. Moreover, for hashes which use the same dithering sequence z in all invocations, this has an affect on the frequency of the most common factors (especially when the most common factor is relatively in the beginning of the dithering sequence, e.g., Shoup's UOWHF with the same set of keys).

Dealing with High Complexity Dithering Sequences

As discussed before, a possible improvement to the Dithered Hash that would prevent our second preimage attack would be to use a very-high complexity sequence. In this section, we give several attacks against Dithered Hashing in the precomputation model, and whose complexity is independent of the dithering sequence. In the precomputation model, the adversary is allowed to perform a very expensive precomputation, whose complexity may be of order 2 n , after which she may store a data-structure of size strictly less than 2 n . When presented with a challenge, the adversary may make use of this data-structure to find a solution faster. The idea is that the precomputation may be amortized over any number of subsequent forgeries.

We explore various techniques to break arbitrary dithering sequences. We start with a simple generalization of our proposed attack. We follow with two new attacks which have an expensive precomputation, in exchange for a much faster online phase: The kite generator and a variant of Dean's attack tailored to these settings.

Generalization of the Attack on Dithered Merkle-Damgård

The main limiting factor of our attack on Dithered Hashing is the fact that the diamond structure can only be positioned in specific locations of the target message. Once the sequence is of high enough complexity (and assuming that there is no real bias in the factor distribution), then there are not enough "good" positions where the attack can be performed. To overcome this difficulty, a possible solution is to build a more powerful herding device that works at all the possible locations in the target message.

To build this "dithering-oblivious" diamond structure, we generate a converging tree in which each node is a 2|A|-collision. Specifically, for a pair of starting points w 0 and w 1 we find a 2|A|-collision under different dithering letters, i.e., we find m 1 0 , . . . , m

|A| 0 and m 1 1 , . . . , m |A| 1
such that:

f (w 0 , m 1 0 , α 1 ) = f (w 0 , m 2 0 , α 2 ) = • • • = f w 0 , m |A| 0 , α |A| = f (w 1 , m 1 1 , α 1 ) = f (w 1 , m 2 1 , α 2 ) = • • • = f w 1 , m |A| 1 , α |A|
This way, we can position the diamond structure in any position, unrelated to the actual dithering sequence, as we are assured that there is a path from any leaf to the root labeled by any possible combination of letters.

To build the required diamond structure we propose the following algorithm: first for each starting point (out of the 2 ) find a |A|-collision (under the different dithering letters). Now, it is possible to find collisions between different starting points (just like in the original diamond structure, where we use a |A|-collision rather than one message). Hence, the total number of |A|-collisions which are needed from one specific starting point (in order to build the next layer of the collision tree) is 2 n/2-/2 . The cost for building this number of |A| collisions is 2 2|A|-1 2|A| n-2|A| , or a total of 2 2|A|-1 2|A| (n+ )+2 for the preprocessing step. After the computation of the diamond structure (which may take more than 2 n ), one can connect to any point in the message, independent of the used dithering letter. Hence, from the root of the diamond structure we try the most common dithering letter, and try to connect to all possible locations (this takes time 2 n-κ+H∞(z,1) ≤ A • 2 n-κ ). Connecting from the message to the diamond structure takes 2 n-as before.

The memory required for storing the diamond structure is O |A| • 2 . We note that the generation of the |A|-collision can be done using the results of [START_REF] Joux | Improved Generic Algorithms for 3-Collisions[END_REF], which allow balancing between the preprocessing's time and its memory consumption.

The Kite Generator-Dealing with Small Dithering Alphabets

Even though the previous attack could handle any dithering sequence, its online complexity is about the same as that of the simpler second preimage attacks on Merkle-Damgård. We could in addition try to leverage the huge precomputation required by the attack to further reduce the online complexity. To this end, we introduce a new technique, the kite generator. The kite generator shows that a small dithering alphabet is an inherent weakness, and after a O (2 n ) preprocessing, second preimages can be found for messages of length 2 κ ≤ 2 n/4 in O 2 2•(n-κ)/3 time and space for any dithering sequence (even of maximal complexity). Second preimages for longer messages can be found in time max O 2 k , O 2 n/2 and memory O A • 2 n-k .

Outline of the Attack.

The kite generator uses a different approach, where the connections to and from the message are done for free, regardless of the dithering sequence.

During the precomputation phase the adversary builds a static data structure, the kite generator: she picks a set of 2 A toy "Kite-Generator" with 16 nodes over a binary alphabet. Edges are labelled with a message block and a letter. Hard edges correspond to the first letter, and dashed edges to the second letter. This big straw ball unfolds into kites! letter α ∈ A, the adversary finds two message blocks m x,α,1 and m x,α,2 , such that both f (x, m x,α,1 , α) and f (x, m x,α,2 , α) belong to B. The adversary then stores all m x,α,1 and all m x,α,2 in the data structure. Figure 6.1 shows a toy kite generator.

In the online phase of the attack, given a message M , the adversary computes H(M ), and finds with high probability (thanks to the birthday paradox) an intermediate chaining value h i ∈ B (for 2 κ > i > nκ). The next step of the attack is to find a sequence of i blocks from the IV that leads to this h i . This is done in two steps. In the first step, the adversary perform a random walk in the kite generator, by just picking random m x,α,i one after the other (in conformance with the dither sequence), until h i-(n-κ) is computed (this h i-(n-κ) is independent of the value found in the computation of H(M )). At this point, the adversary stops her random walk, and computes from h i-(n-κ) all the possible 2 (n-κ)/2 chaining values reachable through any sequence of m x,α,1 or m x,α,2 (which agrees with the dithering sequence)-this amounts to consider all the paths starting from where the random walk stopped inside the kite generator and trying all the paths whose labels agree with the dithering sequence. Then, the adversary computes the "inverse" tree, starting from h i , and listing the expected 2 (n-κ)/2 values 1 that may lead to it following the dither sequence. If there is a collision between the two lists (which happens with high probability due to the birthday paradox), then the adversary just found the required path-she "connected" the IV to h i . Figure 6.2 illustrates the process.

The precomputation takes

O A • 2 n-κ • 2 κ = O A • 2 n .
The memory used to store the kite generator is O A • 2 n-κ . The online phase requires O (2 κ ) compression function calls to compute the chaining values associated with M , and O 2 (n-κ)/2 memory and time for the meet-in-the-middle phase. 2 We conclude that the online time is max O (2 κ ) , O 2 (n-κ)/2 and the total used space is O A • 2 n-κ . For the SHA-1 parameters of n = 160 and κ = 55, the time complexity of the new attack is 2 55 , which is just the time needed to hash the original message. However, the size of the kite generator for the above parameters exceeds 2 110 .

To some extent, the "converging" part of the kite generator can be treated as a diamond structure (for each end point, we can precompute this "structure"). Similarly, the expanding part, can be treated as the IV H(M ) h i M MitM Figure 6.2: A "Kite" connected to and from the message. The "tail" is the random walk inside the kite generator. Then comes the divergent tree and the convergent tree (which is very reminiscent of a diamond structure) leading to h i , the intermediate chaining value occurring in both M and in the kite generator. There exist a path between both trees with high probability. trials to connect to this diamond structure from h i-(n-κ) .

We note that the attack can also be applied when the IV is unknown in advance (e.g., when the IV is time dependent or nonce), with essentially the same complexity. When we hash the original long message, we have to find two intermediate hash values h i and h j (instead of IV and h i ) which are contained in the kite generator and connect them by a properly dithered kite-shaped structure of the same length.

The main problem of this technique is that for the typical case in which κ < n/2, it uses more space than time, and if we try to equalize them by reducing the size of the kite generator, we are unlikely to find any common chaining values between the given message and the kite generator.

A Variant of Dean's Attack for Small Dither Alphabet

In fact, the kite generator can be seen as an expandable message tolerating the dithering sequence, and we can use it in a more "traditional" way. We first pick a special chaining value N in the kite generator. From this N we are going to connect to the message (following the approaches suggested earlier, as if N were the root of a diamond structure). Then, it is possible to connect from the IV to N inside the kite generator, for any possible dithering sequence For a kite containing 2 points, the offline complexity is O A • 2 n , and the online complexity is

2 n-κ+H∞(z,1) + 2 κ + 2 /2+1 .
The memory required for the attack is O 2 . It follows that we have nothing to lose to setting = 0, and interestingly this degenerate case of the kite generator can be considered as an adaptation of Dean's attack to the case of a small dithering alphabet. Assume that the kite generator contains only one chaining value, namely, IV . For each dither letter α, we find x α such that f (IV, x α , α) = IV . Then, we can "move" from IV to IV under any dithering letter. At this point, we connect from the IV to the message (either directly, or using time-memory-data tradeoff), and "traverse" the degenerate kite generator under the different dithering letters.

Hence, a standard implementation of this approach would require O A • 2 n precomputation and 2 n-κ+H∞(z,1) online computation (with A memory). A time-memory-data variant can reduce the online computation to 2 2(n-t-κ+H∞(z,1)) in exchange for 2 t memory (as long as t ≤ n -2(κ -H ∞ (z, 1))). Table 6.1 compares all the techniques suggested for dithered hashing.

Attack Complexity Avg. Offline Online Memory Patch Single-( §4.2.2) 2 (n+ )/2+2 2 n-κ+H∞(z, +1) + 2 n- 2 +1 + 2 Multi-( §4.2.3) 2 k (2 (n+ )/2+2 + 2 n/2 ) 2 n-κ+H k ∞ (z, +1) + 2 n- 2 k+ +1 k + + 2 general. ( §6.3.1) 2 2 A -1 2 A •(n+ )+2 2 n-κ+H∞(z,1) + 2 n- A • 2 +1 + 2 Kite gen. ( §6.3.2) A • 2 n 2 κ + 2 (n-κ)/2+1 A • 2 n-κ+1 2 κ-1 "Self-loop" ( §6.3.3) A • 2 n 2 n-κ+H∞(z,1) A 2 κ-1 H k ∞ (z, + 1)
-the maximal sum of probabilities for 2 k suffix-friendly set of length + 1. This chapter presents some results on the provable security of hash function modes of operation. This is the result of a joint work with Gaëtan Leurent and Sébastien Zimmer. The results of §7.3 have been published at SAC'2010 [START_REF] Bouillaguet | Security analysis of simd[END_REF].

The previous chapters presented several generic attacks against hash functions, i.e., attacks on their modes of operation. This chapter concludes our study modes of operation of hash function by looking at them from the provable security angle. One of the most distinctive feature of the Merkle-Damgård mode of operation is that it provably promotes a collision-resistant compression function into a collision-resistant hash function. The situation is very different for second-preimage resistance, since even when the compression function is ideal, the generic second preimage attacks of Dean, Kelsey and Schneier, and our own (chapter 4) show that the iteration is not as secure as a Random Oracle.

The exact resistance of Merkle-Damgård to generic second preimage attacks is thus unknown. The known attacks give an upper-bound of order 2 n / for messages of size , above the birthday paradox, and the fact that a second preimage is also a collision gives a birthday lower-bound (because of the collision-resistance preservation). In addition, the resistance of Haifa to generic second-preimage attacks lies somewhere between 2 n/2 and 2 n compression function evaluations, since no attack faster than exhaustive search is known.

Closing the Gap. It would be desirable to close this gap between attacks and proofs. But how? Recently, the indifferentiability framework has had some success in proving the absence of generic attacks, in particular by allowing to prove that hash function with an internal state of 2n bits resist all possible generic attacks up to 2 n /n queries [START_REF] Chang | Improved Indifferentiability Security Analysis of chopMD Hash Function[END_REF]. Unfortunately, this proof technique cannot be used for our purpose. First of all, it cannot say anything about Merkle-Damgård: this venerable mode of operation is not even indistiguishable from a Random Oracle, because of the length extension attack. More fundamentally, indifferentiability can only be proved up to the birthday bound when the internal state is n-bit large, so that we cannot hope to obtain interesting results on Haifa. This follows from the fact that once a collisions on the compression function has been found, then it can often be used to build efficiently several pairs of colliding message by exploiting the iterated nature of the process, and thus allowing a distinguisher to tell apart the iteration from a random function. Obtaining provable security against second preimage adversaries therefore requires an ad hoc approach. In §7.1, we prove lower-bounds on the resistance of Merkle-Damgård and Haifa to second preimage attacks under the assumption that the compression function is a random function. More precisely, an adversary querying the compression function q times can find a second-preimage of an -block message on Merkle-Damgård (resp. Haifa) with probability q /2 n (resp. 2q/2 n ). This shows that the upper-bounds given above are tight, and that the known generic attacks are optimal.

Moving to the Standard Model. These results rely crucially on the assumption that the compression function is random. This shows that any attack beating the bounds of our proofs must exploit in a way or another a bias in the compression function, as it could be used to "distinguish" the compression function from a random function, inasmuch as this means anything. While this guarantees that the modes of operation are free of some bad flaw, does it mean that it will result in a secure hash function when an actual compression function will be plugged in? Results such as the collision-resistance preservation of Merkle-Damgård are stronger, as they result in an actual break of a well-defined security notion of the compression function when the full hash function is broken. Thus, as long as the compression function is secure, then the iteration is secure.

Are there modes of operation provably resistant to second preimage attacks beyond the birthday bound in the standard model? The answer is yes: the wide-pipe hash of Lucks achieves that (cf. §3.4). Are there non-wide-pipe modes of operation provably resistant to second preimage attacks in the standard model? The answer is again yes: UOWHFs are precisely keyed hash functions provably achieving second preimage resistance in the standard model. Shoup's UOWHF resists eSec adversaries up to 2 n / queries when the compression function is as good as it gets. In addition, it is noteworthy that two other modes of operation were presented in 2008, which obtain beyond-birthday second preimage security up to 2 n / queries in the standard model: Yasuda's split-padding [START_REF] Yasuda | How to fill up merkle-damgård hash functions[END_REF] as well as Andreeva and Preneel's Three-property-secure hash function [START_REF] Andreeva | A three-property-secure hash function[END_REF].

Unavoidable Security Loss. It seems that all narrow-pipe provably second-preimage resistant constructions only achieve security up to 2 n / queries for messages of blocks, even when the compression function is ideal. On all these constructions, this follows from the fact a generic second preimage attack applies, be it either that of Kelsey and Schneier or our own. This is not completely the end of the story though, because these constructions could easily be patched to avoid generic second preimage attacks (by adding a round counter as in Haifa), yet it would not be possible to prove them secure above 2 n / queries. We believe that this is caused by the proof technique itself: we show in §7.2 that any narrow-pipe mode of operation (belonging to a large and natural class) whose second-preimage resistance is reduced to the second-preimage resistance of the compression function cannot be provably secure beyond O (2 n / ) elementary operations (it might be more secure, but not provably). In other terms, there is an unavoidable security loss in second-preimage resistance proofs by black-box reductions.

Coping With Broken Compression Functions. As mentionned above, indifferentiability proofs are great because they guarantee the absence of generic attacks. In these proofs, the compression function is assumed to be ideal. What happens when the compression function turns out to have a flaw, or a specific property making it "obviously" different from a random function? For instance, what happens if there exist two differences ∆ i and ∆ o such that f (x `∆i ) = f (x) `∆o for all possible x's? Can the iteration of such a compression function be secure? Researchers exhibiting "distinguishers" (whatever this means) for the compression functions often argue that their findings voids the security proof of the full hash function. Following the ideas of the SHABAL team [BCCM + 09] we show in §7.3 that this is not necessarily true, and that the Prefix-Free-Merkle-Damgård iteration of a non-ideal compression function can be indifferentiable from a Random Oracle. The security level assured by the proof degrades when the compression function deviates more and more from a random function.

In this whole chapter, we will assume that the maximal size of hashed messages, 2 κ blocks, is much smaller than 2 n/2 . This allows us to assume that all the intermediate chaining values are different with very high probability.

Second-Preimage Resistance in the Random Oracle Model

The proofs presented in this section assume that the compression function is an ideal primitive (i.e., a fixed-input length Random Oracle), to which computationally unbounded adversaries have oracle access. The only obstacle they are facing is the randomness of the query responses. The number of queries sent to the primitive is then a meaningful complexity measure, because the adversary cannot obtain any kind of advantage by computation alone without querying the random function. In any case, it gives a lower-bound on the time complexity of the adversary. This setting is very similar to the analysis of block cipher-based constructions in the ideal cipher model by Black, Rogaway and Shrimpton [START_REF] Black | Black-Box Analysis of the Block-Cipher-Based Hash-Function Constructions from PGV[END_REF].

We usually denote by q the number of queries sent to the compression function f by an adversary A. For the sake of convenience, we enforce second preimage adversaries not to abort, to always return a message M , even if they do not win the security game, and to evaluate H f (M ) before terminating, by issuing the corresponding queries to the compression function. We also enforce adversaries not to ask the same query twice. We say that an adversary (q, , ε)-breaks a hash function H f if the adversary is being challenged with an -block message, issues q queries to f and succeeds in finding a second preimage with probability ε.

The main idea common to all the proofs presented here is almost directly adapted from the existing generic second preimage attacks: we lower-bound the complexity of one particular step common to all these attacks, namely when some kind of a possible prefix has to be "connected" to the target message.

The Existing Attacks Against Merkle-Damgård are Optimal

We now prove that known generic second preimage attacks against Merkle-Damgård, whose complexity is of order 2 n / for messages of length , are optimal. Theorem 7.1. Let f be a random compression function, H f be the Merkle-Damgård iteration of f , and A be a second preimage adversary against H f which (q, , ε)-break H f . Then ε ≤ q • /2 n . Proof. Consider an adversary A that (q, , ε)-breaks the second preimage resistance of H f . We denote by h i , for 1 ≤ i ≤ , the chaining values obtained while hashing M , according to the description in Algorithm 3.1. If A succeeds in finding a second preimage, then in particular A has found a collision. As argued in §3.2.1, 7.1. Second-Preimage Resistance in the Random Oracle Model in the presence of the Merkle-Damgård strengthening, this implies a collision on the compression function f . In our case, there exists an index i such that one of the colliding chaining value is h i . This collision on f is therefore actually a second preimage of h i for f . Note that because f is a random function, all the chaining values are random. 1Every time A submits a new query to the oracle, it receives a uniformly-distributed random value. The probability that A wins thanks to this particular query is upper-bounded by the probability that this random value is one of the h i 's, and this probability is exactly • 2 -n . Since A sends at most q queries, A wins with probability at most q • • 2 -n .

It must be noted that this proof is fairly general, because it reduces the problem of finding a second preimage for H f to the problem of finding a second preimage of one out of many random chaining values for f . It actually covers nearly all the existing iterated hash functions.

The Round Counter Prevents Generic Second Preimage Attacks

The inventors of Haifa claimed that Haifa has optimal resistance against generic second preimage attacks but they did not prove it. The bound given by theorem 7.1 is also not strong enough to back up their claim. A slightly more involved proof technique is required to prove that Haifa achieves optimal second preimage resistance. The key ingredient of Haifa that makes it more secure than Merkle-Damgård is the round counter.

Theorem 7.2. Let f be a random compression function, H f be the Haifa-iteration of f , and A be a second preimage adversary that (q, , ε)-break H f . Then ε ≤ q/2 n-1 .

Proof. We simulate the execution of the adversary A, and bookmark the queries sent by A to f : it is a set S of tuples (x, m, c, y), with y = f (x, m, c). We suppose that A evaluates H f (M ), so A sends the corresponding queries to the oracles at some point. Let us denote these particular queries

(h i-1 , m i , c i , h i ) 1≤i≤ . In particular, H f (M ) = h .
Suppose now that A wins. Then one of the two following situations arises:

1. If M = M , then the values of the counter entering the compression function in its last invocation are different. Therefore, A has found a second preimage of h on f . Each query has a probability 2 -n to realize this event, because f is a random function.

2. Otherwise, M = M . This means that A has found a collision with M .

Because of the round-counter, collisions now have a special property.

Lemma 7.3. Let H f be the Haifa iteration of an arbitrary compression function f . If there are two messages M and M such that H f (M ) = H f (M ) with M = M and M = M , then there is a collision on f , with the same value of the counter entering f .

Proof. let us write the two (padded) messages M = x 1 , . . . , x r and M = x 1 , . . . , x r , the two initialization vectors h -1 = h -1 = IV , and for i ≥ 0, the chaining values

h i = F (h i-1 , x i , i) and h i = f (h i-1 , x i , i).
Since h r = h r , either there is a collision on f (with counter value r), or (x r , h r-1 ) = (x r , h r-1 ). In the latter case, either there is a collision for f (with counter value r-1) or we again find that (x r-1 , h r-2 ) = (x r-1 , h r-2 ). This argument repeats. Since M = M , then either there is a collision for f at some point (with the same counter value), or x i = x i , for all i, 1 ≤ i ≤ r. In the latter case, M = M , which is impossible. This completes the proof of the lemma. This lemma means that if the adversary finds a second preimage of M , then there is in S a query (x, m, i 0 , h i0 ) for a given value of i 0 (recall that h i0 is the i 0 -th chaining value obtained in the process of hashing M ), and such that (x, m) = (h i0 , m i0 ). We now upper-bound the probability that this event is realized.

When A submits its i-th query to the compression function, a random value is chosen and returned to A. Our event is realized if and only if this value is h i , and this happens with probability 2 -n . This query may also allow A to invert h with probability 2 -n . Each query allows A to win with probability 2 -(n-1) , and there are q queries, which completes the proof.

Unavoidable Security Loss in Black-Box Reductions

Theorems 7.1 and 7.2 give lower-bounds on the complexity of generic attacks, i.e., attacks that apply even when the attacker only has black-box access to the (ideal) compression function. Security against generic attacks is certainly a nice feature of modes of operations, but as we argued before it is not entirely satisfactory. In particular, it does not formally shows that there does not exist actual adversaries against the hash function. For instance, theorems 3.3 and 3.9 are stronger statements, as they show that any Turing Machine breaking a security property of the actual hash function can be transformed into another Turing machine that breaks a security property of the compression function. Thus, security of the iteration with respect to a well-defined security property relies on a well-defined security property of the compression function (as opposed to its "randomness"), hence the label "provable security in the standard model".

In this section, we will focus our attention on the Sec security notion, but our reasoning carries over to the other second-preimage resistance notions. In the standard model, time is the right measure of complexity. We will say that an adversary (t, ε)-break a (keyed) function F if given M and K, the adversary returns a message M such that M = M and F K (M ) = F K (M ) with probability ε. To compare such adversaries, the relevant measure is the ratio t/ε: it tells us how much time do we have to wait before actually seeing the adversary succeed.

We are aware of at least three narrow-pipe modes of operation that provably resist second preimage adversaries beyond the birthday bound in the standard model: we already know Shoup's UOWHF, but there are also Andreeva and Preneel's Three Property Secure Hash Function [START_REF] Andreeva | A three-property-secure hash function[END_REF], and Yasuda's Split Padding [START_REF] Yasuda | How to fill up merkle-damgård hash functions[END_REF]. These three constructions use the same proof technique: they give an explicit black-box reduction R(•, •) that, given an adversary A H against the full hash function and a compression function f , yields an adversary R(f, A H ) against f . Thus, if the full hash function gets broken, the compression function gets broken as well. It is striking in the three modes of operation mentioned above, R(f, A H ) only succeeds with probability 1/ (the inverse of the number of blocks of the challenge message), even when the adversary A H always succeeds. The main result of this section is to show that this is not a coincidence, and that any such reduction cannot achieve a better success probability. Because this statement is very general, we begin by defining a whole class of modes of operations that we wish to take into account in out reasoning.

Abstract Narrow-Pipe Modes of Operations

We will consider that a narrow-pipe mode of operation H (•) is a circuit that takes as its input M (the full message), K (the key, if present), h i (the current chaining value) and i (the block counter). This circuit is responsible for preparing the input to the compression function. The next chaining value h i+1 is the output of the compression function on the input prepared by the circuit. The output of the whole hash function is the output of the compression function on its last invocation. The circuit activate a special wire "last call" to indicate that the hash process is terminated. We will assume that the number of calls to the compression function does not depend on the input of the hash function (i.e., on M and K).

The incoming chaining value is set to a predefined value (say, zero) on the first invocation. This particular class of modes of operation imposes that the output of the full hash function comes out of the compression function without post-treatment, in particular without truncation. This, coupled with the fact that the circuit has no internal memory makes it a narrow-pipe mode of operation. Appart from that, H may include a "final transformation", or process each message block multiple times. Formally, the hash process works according to the pseudo-code shown in Algorithm 7.1.

Algorithm 7.1 Formal definition of the hash process with an abstract mode of operation function

Abstract-Mode-Of-Operation(M, K) h -1 ← 0 i ← 0 while not finished do x i ← H (•) (M, K, i, h i-1 ) h i ← f (x i ) i ← i + 1 end while return h i-1 end function
There are constructions that are apparently not narrow-pipe, but that still fit in this framework, such as the GOST hash function (the checksum can be computed in the last invocation, and do not need to be transmitted between each invocation of the compression function).

Note that by choosing H (•) to be a circuit, we implicitly admit the existence of an upper-bound on the size of the messages (if only because the block counter comes on a finite number of wires). In the sequel, by "mode of operation", we implicitly mean "a narrow-pipe mode of operation that fits the above framework". We are not aware of any narrow-pipe construction that does not fit the above definition though.

Collision-Resistance Preserving Modes of Operation

While we tried to make the definition of a mode of operation as generic as it gets, we are not interested in really bad modes of operation. We are not interested in non-collision resistant constructions, for instance. In this section, we characterize a few properties modes of operation should have not to be totally worthless.

We say that a mode of operation is strengthened if the binary encoding of the size of the processed message is contained in the input to the last invocation of the compression function. It is well-known that the Merkle-Damgård mode of operation is strengthened, which is the key in establishing its important collision-resistance preservation (theorem 3.3). However, in general, being strenghtened is not completely sufficient to be collision-resistance preserving. Some further technicalities are required.

We say that a mode of operation is message-injective if for all functions f and all keys K, the function that maps the message M to the sequence of compression-function inputs (x i ) is injective. This implies that hashing two different messages M and M cannot generate the same sequence of inputs (x i ). This property is necessary for collision-resistance preservation: if H is not message-injective, there there exist a function f and a key K such that there exist two colliding messages M and M generating the same hash, without causing a collision in the compression function.

We also say that a mode of operation is chaining-value-injective if for all f and all K, there exist a (deterministic...) function that maps x i to h i-1 . The combination of these three properties is sufficient to ensure collision-resistance preservation Lemma 7.4. A mode of operation H simultaneously message-injective, chaining-value-injective and strengthened is collision-resistance preserving. This is essentially a more abstract version of theorem 3.3, and because the proof is awfully similar, we omit it. Because of lemma 7.4, we call a mode H "collision-resistance preserving" if it satisfies these three conditions.

Some particular Provably Second-Preimage Secure Modes of Operations

We briefly describe the three modes of operations mentionned in the introduction, and we show that they fit in out framework. In passing, we will argue that they satisfy two more properties: they allow for embedding and they are suffix-clonable. Definition 7.1. A mode of operation H (•) (K, M, i, h) allows for embedding if it is always possible (and computationally easy) to forge M and K such that the input of the i-th invocation of the compression function takes a chosen value (i.e., if x i 's takes a specified value in Algorithm 7.1). Definition 7.2. A mode of operation is suffix-clonable if given an ( + 1)-block message M , a key K and an integer 0 ≤ i ≤ it is always possible to find a different ( + 1)-block message M such that if i > 0:

H (•) (K, M, i -1, h i-2 ) = H • (K, M , i -1, h i-2 )
and always:

∀j ∈ {i, . . . , }, H (•) (K, M, j, h j-1 ) = H (•) (K, M , j, h j-1 )
Shoup's UOWHF. We have already described Shoup's UOWHF in §3.4.3. This construction promotes the eSec security of the compression function to that of the whole hash function. The key of the iterated hash function is logarithmic in the maximal size of the messages that can be hashed. In our framework, this construction is simple to describe:

1: function Shoup-UOWHF(M, K, i, h i-1 ) 2: let (k, µ 0 , . . . , µ κ ) ← K 3: let (m 0 , . . . , m ) ← Pad(M ) 4:
return k, h i-1 `µν2(i) , m i 5: end function It is not easy to see that Shoup's UOWHF allows for embedding, and we refer the reader to [START_REF] Shoup | A Composition Theorem for Universal One-Way Hash Functions[END_REF] (the key idea is that at all points in the iteration there is always a mask that has been used only once). In addition, this construction is also easily seen to be suffix-clonable: it suffices to leave K untouched an to modify the begining of M . The security of the construction is guaranteed by theorem 3.9.

The Backwards Chaining Mode. Andreeva and Preneel described in [START_REF] Andreeva | A three-property-secure hash function[END_REF] the Backwards chaining mode which promotes the second-preimage resistance of an unkeyed compression function to the Sec security of the (keyed) iterated hash function. We will assume for the sake of simplicity that the message block and the chaining values have the same size, and in addition that a simplified padding scheme is applied: the last block is padded with zeroes, and the message length in bits is included in an extra block. The iteration is keyed, and the key is formed by a triplet (K 1 , K 2 , K 3 ) of n-bit strings (note that its size is independent of κ).

1: function BCM(M, K, i, h i-1 )

2: let (K 1 , K 2 , K 3 ) ← K 3: let (m 0 , . . . , m ) ← Pad(M ) 4: if 0 ≤ i < -1 then return (h i-1 `mi+1 , m i ) 5: if i = -1 then return (h -2 `m `K2 , m `K1 ) 6: if i = then return (h -1 `K3 , m `K2 )
7: end function The backwards chaining mode allows for embedding. To embed at any index smaller than -1, just choose m i and m i+1 with care. To embed at index -1 or , pick the message at random and choose K 1 , K 2 and/or K 3 accordingly (the keys are necessary to embed in the last blocks because of the padding scheme). Again, this construction is also easily seen to be suffix-clonable, with the same argument as before.

Theorem 7.5 ([AP08]

). If an adversary is able to break the Sec[ ] notion of H f with probability ε in time T , then one can construct an adversary that breaks the Spr notion of f in time T + O ( ), with probability ε/ .

The Split Padding. Yasuda's Split Padding [START_REF] Yasuda | How to fill up merkle-damgård hash functions[END_REF] is a minor tweak to the Merkle-Damgård-strenghtening. For the sake of simplicity, we will assume that the message block is twice bigger than the chaining values (i.e., it is 2n-bit wide). The tweak ensures that any message block going into the compression function contains at least n bits from the original message (this is not necessarily the case in the last block of the usual Merkle-Damgård padding scheme).

It promotes a kind of eSec security of the compression function to the Spr security of the (unkeyed) iteration. More precisely, the security notion required of the compression function is the following: the adversary chooses a chaining value h and the first n bits of the message block m 1 , and is then challenged with the last n bits of the message block m 2 . She has to find a new pair (h , m ) = (h, m 1 m 2 ) such that f (h, m 1 m 2 ) = f (h , m ). To some extent, this is the eSec security notion, but here the "key" of the compression function is the last n bits of the message block.

Theorem 7.6 ([Yas08]

). If an adversary is able to break the Spr[ ] notion of H f with probability ε in time T , then one can construct an adversary that breaks the eSec-like notion of f in time T + O (λ), with probability ε/ .

The split-padding easily fits in our framework, because besides the padding scheme it is just the normal Merkle-Damgård mode.

1: function Split-padding(M, K, i, h i-1 ) 2: let (m 0 , . . . , m ) ← Special-Pad(M ) 3: return (h i-1 , m i ) 4: end function
The split-padding does not allows for our previous definition of embedding, but it allows to embed n bits of message block into any block. It is easily suffix-clonable, as it suffices to change a prefix of the message.

Proofs by Reduction

Resistance against second preimage attacks in the standard model of a mode of operation H (•) is often announced by theorem formulated similar to the following.

Theorem (typical).

There exist a black-box reduction R(•, •) such that R(f, A H ) is an adversary against the compression function f that (t + t , α • ε + β)-breaks f , for all compression functions f and all adversaries A H that (t, ε)-break H f . Theorems 3.9, 7.5 and 7.6 are clearly instances of this general setting. Note that the reduction is given black-box access to both the adversary and the compression function f . This is a way of formalizing that the reduction must work for any adversary and any compression function. For the sake of simplicity, we allow the reduction to issue only one query to the adversary. To some extent, this narrows our study a little, but all the reductions we are aware of (in [Sho00a, Yas08, AP08]) fit into this category.

In the setting of the security theorem above, there are three parties: the challenger, the reduction and the adversary. The challenger sends the reduction a challenge made of an input x to f , and a "key" k for f , whatever this means (chaining value or additional input). The reduction has to find a distinct input x such that f k (x) = f k (x ). For this purpose, the reduction may use the A H adversary: the reduction sends the adversary a challenge made of a message M of at most message blocks, and a key K. The adversary may either returns a message M such that H f (K, M ) = H f (K, M ) or fail. The precise sequence of interactions is the following:

Challenger x,k --→ Reduction Reduction M,K ---→ Adversary Reduction M ← --Adversary M = M H K (M ) = H K (M ) Challenger x ← -Reduction x = x f k (x) = f k (x )
Reductions are generally assumed to have to simulate the legitimate input challenge distribution the adversary is normally expecting. In our case, this means that the distribution of the challenges M, K must be indistinguishable from random. Note that if M, K were biased, then the adversary could detect that it is "being used", and fail deterministically. In any case, when we mention the success probability ε of the adversary A H , we assume that its input distribution is uniformly random.

The interest of such reductions is that if the compression function f is secure, then for any adversary

A H against H f , one must have: (t + t )/(α • ε + β) ≥ 2 n ,
and therefore the global complexity of A H is lower-bounded by:

t ε ≥ 2 n α + 2 n β -t ε . (7.1)
The right-hand side of equation ( 7.1) is the provable security level that the reduction offers. Note that it bizarrely depends on the success probability of the adversary, but this seems unavoidable. When considering a single run of the reduction, its success probability should depends very much on whether the adversary succeeds or not. Therefore, it makes sense to write:

P [R succeeds] = ε • P R succeeds A H succeeds + (1 -ε) • P R succeeds A H fails
This justifies why we assumed the success probability of the reduction to be of the form α • ε + β, and in fact we have:

α = P R succeeds A H succeeds -P R succeeds A H fails β = P R succeeds A H fails
Now, while our objective is to understand what happens when A H succeeds, it is easier to get a glimpse of what happens when A H fails. In this setting, the reduction is just a randomized turing machine trying to find second preimage resistance on an arbitrary black-box function, which cannot be done faster than exhaustive search. For instance, f could be a Pseudo-Random Function with a randomly-chosen secret key. We could even use our Random Oracle Web Service to simulate a "truly" random function. In any case, it follows that β ≤ t /2 n . The provable security level offered by a reduction is thus upper-bounded by α • 2 n . We will thus say that a reduction is useable if α > t /2 n , as this implies that the reduction offers a provable security level better than that of exhaustive search (or equivalently, that the reduction actually makes use of the adversary).

How do Reductions Use the Adversary ?

In the sequel, we will make the natural assumption that the A H adversary the reduction has access to has non-zero success probability. We will also restrict our attention to useable reductions. By doing so we rule out modes of operation for which no useable reduction is known such as the Merkle-Damgård construction.

Let us consider a provably secure mode mode of operation H also satisfying the hypotheses of lemma 7.4 (i.e., injective, extractable and strengthened). We will also assume that it is suffix-clonable. Since the mode is provably secure, there exist a reduction R with a reasonably high success probability. Our objective, and the main technical contribution of this section, is to show the following theorem: Theorem 7.7. We always have α ≤ 1/ + t /2 n . It follows that the provable security level offered by R cannot be higher than 2 n / + t .

The remaining of this section is devoted to the proof of this result. The general idea of the proof is to built an environnment around the reduction R that simulates a legitimate "world" for R, but in which it is easy to see that R has a low success probability. Then because R has to work in all legitimate environments, it follows that in general R cannot succeed with higher probability.

Connection Point. Before going any further, let us observe what happens when the adversary finds a second preimage. Let us denote by x i and h i (resp. x i and h i ) the inputs and the outputs of f while evaluating H f (M ) (resp. H f (M )). Since M and M collide, and because H satisfies the hypotheses of lemma 7.4, then a second preimage of one of the x i input values can be readily obtained from M . Let us take a look back at the proof of theorem 3.3. If M = M , then we obtain a second preimage of f on the last invocation. Otherwise, there exist an index i such that f (x i ) = f (x i ) and x i = x i . In the sequel, we call this particular index i the "connection point", and we note that at this particular index a second preimage of x i for f is revealed, which we call "the second preimage at connection point".

Embedding. The strategy used by all the reductions we are aware of consists in embedding the small challenge (x, k) into the big challenge (M, K). Following our definition, we say that (x, k) is embedded into (M, K) at location i if and only if f k (x) is evaluated during the i-th iteration of the main loop of Algorithm 7.1 during the evaluation of H k (K, M ). We will show that the second preimage returned by the adversary can only be used by the reduction if the second preimage at connection points directly gives a solution to the small challenge. Let us denote by ♣ the condition "the second preimage at connection point is a second preimage of the small challenge sent by the Challenger to R". Formally, this means that:

P [♣] = P ∃i. x i = (x, k) in Algorithm 7.1 ∧ (x i = x i ) ∧ (h i = h i )
We can then write:

P R succeeds A succeeds = P R succeeds A succeeds ∧ ♣ • P [♣] + P R succeeds A succeeds ∧ ¬ ♣ • P [¬ ♣] (7.2)
We first argue that the challenge cannot be embedded more than once. If the challenge were embedded twice or more, the input distribution of the adversary would not be random, because we would have x i = x j for i = j in Algorithm 7.1, something that is highly unlikely when M and K are drawn at random. This is not allowed in the first place, and the adversaries could straightforwardly detect it and abort.

Next, we claim that in order to be usable, a reduction must embed the challenge (x, k) into (M, K). This is consistent with our observation that the three schemes of interest all allow some form of embedding. To establish this result, we show that a legitimate world with various interesting properties can be built around the reduction. When we argued that β is small, we used the (informal) argument that f could be implemented by a Random Function simulator similar to the "Random Oracle Web Service" of the introduction, and that inverting such a function faster than exhaustive search is impossible. We now make this argument more formal, with the additionnal feature that we will be able to choose whether the adversary succeeds or fails, and where it connects.

Simulation. The easy case is when we want A H to fail, as it is sufficient to let f simulate an arbitrary random function, and let A H return some random junk. The more interesting case is when we want A H to succeed. The difficulty comes from the fact that the view of the reduction must be consistent: after having received M from the A H , the reduction must be able to check that H K (M ) = H K (M ) by querying f . This is in fact quite easy to achieve, by programming the function f . Here is how we simulate the execution of the reduction:

Algorithm 7.2 A dummy random function simulator function f -Simulator(x, k) if Log[x, k] = ⊥ then Log[x, k] $ ← -{0, 1} n return Log[x, k] end function 1.
Before R sends its query (M, K) to A H , we simulate f by generating random answers and storing them (for consistency), "implementing" f with Algorithm 7.2

We acknowledge that there is a negligible probability of failure in the third step, but it does not really matter. What matters is that the view of the reduction is consistent and legitimate. In this environment, we are able to choose the connection point at will. For instance, we can make sure that the ♣ event never happens. In this case, the reduction, even though it knows a collision on f , cannot find a second preimage on f faster than exhaustive search (because each new query to f returns an independent random answer, and thus each query yields a second preimage with probability 2 -n ).

It follows that if a reduction does not embed its challenge, then it cannot be usable. We conclude that a usable reduction must embed its challenge exactly once with non-zero probability. As a matter of fact, the reductions of the three schemes considered in the introduction published in the litterature embed their challenge with probability one. Equation (7.2) then gives:

P R succeeds A succeeds ≤ P R succeeds A succeeds ∧ ♣ • P [♣] + t 2 n (7.3)
Now, to prove theorem 7.7, we upper-bound the probability that the ♣ condition occur. The reduction cannot control "where" the adversary will "connect" to the big challenge M . Conversely, if the adversary could guess where the challenge is embedded, then she could systematically refuse to connect precisely there. In fact, we need not even worry about this complication, since the adversary can foil all the reduction's plan by connecting randomly. In our simulation procedure, if we choose the connection point uniformly at random between 0 and , then the ♣ event only happens with probability 1/ . Combining this with equation (7.3) yields:

P R succeeds A H succeeds ≤ 1 + t 2 n
And this is exactly what we needed to complete the proof of theorem 7.7. We conclude by pondering on this intringuing situation, where some narrow-pipe modes of operations are provably resistant to generic second preimage attacks, yet this cannot be shown in the standard model...

Indifferentiability in the Presence of Distinguishers

In this final section, we discuss the security of the prefix-free Merkle-Damgård iteration of non-ideal compression functions. While our primary objective was to show that the distinguisher found by Leurent [START_REF] Bouillaguet | Security analysis of simd[END_REF] for the compression function of SIMD [START_REF] Leurent | SIMD Is a Message Digest[END_REF] did not void the security proof of SIMD, the reasoning and the proof presented here are pretty general and could very well be adapted to other functions.

Here, H = {0, 1} n still denotes the set of chaining values, M = {0, 1} m still denotes the set of message blocks, and F denotes the set of all functions H × M → H. Let f ∈ F be a compression function taking as input an n-bit chaining value and an m-bit message block.

The Prefix-Free-Merkle-Damgård mode has been shown to be indifferentiable from a random oracle up to the birthday bound by Coron, Dodis, Malinaud and Puniya [START_REF] Coron | Merkle-Damgård Revisited: How to Construct a Hash Function[END_REF]. This is done by constructing a simulator S such that any distinguisher D cannot tell apart (H f , f ) and (RO, S) without a considerable effort, where RO is a variable-input-length random oracle (VIL-RO, for short). Informally, if f is ideal, then H f is (supposedly) secure up to the level offered by the indifferentiability proof. More precisely, if H (•) is (t D , t S , q S , q 0 , ε)-indifferentiable from a VIL-RO when the compression function is assumed to be a Fixed Input Length Random Oracle (FIL-RO), then this means that there exists a simulator running in time t S , such that any distinguisher running in time t D and issuing at most q S (resp. q 0 ) queries to the FIL-RO (resp. VIL-RO) has success probability at most ε.

A drawback of this methodology is that it is not very "failure-friendly", because the security argument offered by the indifferentiability proof becomes vacuous as soon as the compression function used in a hash function "turns out" to be non-ideal. For instance, distinguishers exhibiting a "non-random" behavior of the compression function are usually advertised by their authors to nullify the security proof of the full hash function.

This problematic situation was first tackled by the designers of Shabal, who provided a security proof taking into account the existence of an efficient distinguisher on the internal permutation of their proposal [BCCM + 09]. We will follow their track and demonstrate that the security of Prefix-Free Merkle-Damgård can be proved despite the existence of an efficient distinguisher on its compression function.

Let H f therefore denote the prefix-free-Merkle-Damgård iteration of f . Formally, the function g : {0, 1} * → M * is a prefix-free encoding if for all x, x , g(x) is not a prefix of g(x ). The mode of operation H (•) simply applies the Merkle-Damgård iteration of f to the prefix-free encoding of the message. Theorem 7.8 (ideal case, [START_REF] Coron | Merkle-Damgård Revisited: How to Construct a Hash Function[END_REF]). The Prefix-Free-Merkle-Damgård mode of operation is (t D , t S , q S , q O , ε)indifferentiable from a VIL-RO when the compression function is modeled by a FIL-RO, for any running time t D of the distinguisher, and

t S = O (q O + • q S )
2 where is an upper-bound on the size of the queries sent to the VIL-RO. If q = q S + 2 κ • q O + 1, where 2 κ is again an upper-bound on the size (in block) of hashed message, then the success probability of the distinguisher is upper-bounded by:

ε = 8 • q 2
2 n To restore the security argument damaged by the existence of distinguishers, we will show that the prefixfree iteration of a non-ideal compression function is to some extent still indifferentiable from a VIL-RO.

Deterministic Distinguishers for the Compression Function

Let us consider a non-ideal compression function f . -For instance, it may have weak states, that are such that querying f thereon with a well-chosen message block produces a "special" output allowing to distinguish f from random in one query. Known examples include for instance the symmetry on the compression function of Lesamnta [START_REF] Bouillaguet | Another Look at the Complementation Property[END_REF] and SIMD [START_REF] Bouillaguet | Security analysis of simd[END_REF], as well as on the internal permutation of CubeHash [ABM + 09, FLM10]. -But f can also have bad second-order properties, meaning that the output of f on correlated input states (with well-chosen message blocks) produces correlated outputs, allowing to distinguish f from random in two queries. A notable example of this property include the existence of differential paths with probability one in the compression function of Shabal [START_REF] Aumasson | More on Shabal's permutation[END_REF]. Symmetry properties also give second order relations, which means that Lesamnta, CubeHash and SIMD have bad second-order properties as well.

Relational Constraints. Following the methodology introduced in [BCCM + 09], we model this situation by saying that there are two relations R 1 and R 2 such that:

∀(h, m) ∈ H × M : R 1 (h, m, f (h, m)) = 1 ∀(h 1 , h 2 , m 1 , m 2 ) ∈ H 2 × M 2 : R 2 (h 1 , m 1 , h 2 , m 2 , f (h 1 , m 1 ), f (h 2 , m 2 )) = 1
We denote by R the relation formed by the union of R 1 and R 2 , and we will denote by F[R] the subset of F such that the above two equations hold. We require the relations to be efficiently checkable, i.e., that given h, m and h , it is efficient to check whether R 1 (h, m, h ) = 1. The relation can thus be used as an efficient distinguishing algorithm that tells F[R] apart from F.

A weak state is a state on which it is possible to falsify the relation R 1 . We formally define the set of weak states for R 1 in the following way:

W = {h ∈ H | ∃m, h ∈ M × H such that R 1 (h, m, h ) = 0}
The set of weak states W should be a relatively small subset of H because the loss of security will be related to the size of W. Moreover, we require that the IV is not in W.

In the same vein, a weak pair is a pair of states on which it is possible to falsify the relation R 2 . We therefore define the set of weak pairs for R 2 by an undirected graph G R2 = (H, WP), where the set of edges WP is defined by:

WP = h 1 ↔ h 2 | ∃m 1 , m 2 , h 1 , h 2 ∈ M 2 × H 2 such that R 2 (h 1 , m 1 , h 2 , m 2 , h 1 , h 2 ) = 0
Similarly, WP should be a relatively small subset of H 2 because the security loss will be related to the size of WP. For the sake of expressing things conveniently, we define a variant of the same graph, G R2 = (H × M, WP ), where WP is defined by:

WP = (h 1 , m 1 ) ↔ (h 2 , m 2 ) | ∃h 1 , h 2 ∈ H 2 such that R 2 (h 1 , m 1 , h 2 , m 2 , h 1 , h 2 ) = 0
To simplify the proof, we also require that the connected component of G R2 have size at most two. This rules out some second-order relations, but it includes for instance the existence of a differential path with probability one with a non-zero difference in the input chaining value, as well as the symmetry in the compression function of SIMD or Lesamnta. This restriction is somewhat artificial and could likely be lifted, but there will be a loss of security related to the square of the size of connected components.

We also require the existence of sampling algorithms for R, namely of two efficient algorithms Sampler 1 and Sampler 2 such that:

Sampler 1 (h, m) : f $ ← -F[R]; return f (h, m) Sampler 2 (h 1 , m 1 , h 2 , m 2 , h 1 ) : f $ ← -{f ∈ F[R] : f (h 1 , m 1 ) = h 1 } ; return f (h 2 , m 2 )
Informally, the sampling algorithms should produce an output that looks as if it were produced by a random function constrained to conform to R. There are several ways to measure the constraint put on f by R.

Examples include:

1. The advantage of R to distinguish F[R] from F 2.
The ratio between the cardinality of F[R] and that of F 3. The advantage with which the output of the samplers can be predicted

|W| and |WP|.

All these quantities are related, and in this section, we will use the cardinality of W and WP, as it appears naturally in our results.

Adapting the Indifferentiability Proof to Non-Ideal Compression Functions

We now assume that the compression function is a public function chosen uniformly at random in F[R], and for the sake of convenience we will call it a "biased FIL-RO". We show that the prefix-free iteration of biased FIL-RO is indifferentiable from a VIL-RO. In fact, we extend Theorem 7.8 to the case where the compression function is biased. Theorem 7.9 (biased case). Prefix-Free-Merkle-Damgård is (t D , t S , q S , q O , ε)-indifferentiable from a VIL-RO, when the compression function is modeled by a biased FIL-RO conforming to the relation R, for any running time t D of the distinguisher, and

t S = O (q O + • q S )
2 where is an upper-bound on the size of the queries sent to the VIL-RO. If q = q S + 2 κ • q o + 1, where 2 κ is an upper-bound on the size of hashed messages, then the probability of success of the distinguisher is upper-bounded by:

ε = 16 • q 2 2 n + 4 • |W| • q 2 n , + 4 • |WP| • q 2 (2 n -q) 2
The first term of the expression of ε is similar to the result given in Theorem 7.8, when the compression function is ideal (up to a factor two that could be avoided by making the argument slightly more involved). The two other terms reflect the fact that the compression function is biased. The relation induces a loss in provable security if |W| is at least of order 2 n/2 , or if |WP| is at least of order 2 n . Informally, it seems possible to iterate compression functions having a relatively high bias in a secure way.

Free-start Differential Attacks. Let us assume that the compression function is weak because of the existence of a good differential path with a non-zero difference in the input chaining value. Even if the probability of the differential path is 1, this has a very limited effect on the security of the hash function: this leads to W = ∅ and |WP| = 2 n-1 . The advantage of the distinguisher is at most twice as high, compared to the iteration of an ideal FIL-RO.

SIMD.

In SIMD-256 (resp. SIMD-512), the internal state has n = 512 bits (resp. n = 1024 bits), and the distinguisher given in [START_REF] Bouillaguet | Security analysis of simd[END_REF]

yields |W| = 2 n/2+16 , |WP| = 2 n+32 (resp. |W| = 2 n/2+32 , |WP| = 2 n+64 ).
Therefore the advantage of any distinguisher in telling apart SIMD-256 from a VIL-RO with q queries is upper-bounded by:

ε = 16 • q 2 2 n + 4 • 2 n/2+16 • q 2 n + 4 • 2 n+32 • q 2 (2 n -q) 2
The mode of operation of SIMD-256 is then secure against generic attacks up to roughly 2 256-16 queries, even if the attacker is able to exploit the symmetries of the compression function. Similarly, for SIMD-512, the bound goes up to 2 512-32 queries.

Lesamnta. Lesamnta uses the prefix-free Merkle-Damgård mode of operation due to its special finalization function. An efficient distinguisher based on symmetries was shown in [START_REF] Bouillaguet | Another Look at the Complementation Property[END_REF], with |W| = 2 n/2 and |WP| = 2 n-1 . According to Theorem 7.9, the advantage of any distinguisher in telling apart Lesamnta-256 from a random oracle with q queries is upper-bounded by:

ε = 16 • q 2 2 n + 4 • 2 n/2 • q 2 n + 4 • 2 n-1 • q 2 (2 n -q) 2 ≈ 22 • q 2 n/2
Our result shows that Lesamnta remains secure against generic attacks up to the birthday bound. This is the best achievable proof for Lesamnta, since it does not behave as a good narrow-pipe hash function beyond that bound: a dedicated herding attack based on the symmetry property is shown in [START_REF] Bouillaguet | Another Look at the Complementation Property[END_REF], with complexity 2 n/2 .

To establish theorem 7.9, we will proceed in two steps. We will first give a proof of theorem 7.8 (dealing with the case where the compression function is ideal). Only then we will give a proof of theorem 7.9, by "patching" the proof of the ideal case. We now show that the prefix-free iteration of an ideal compression function is indifferentiable from a random oracle, thus proving Theorem 7.8. The content of this section borrows very much to the proof in the extended version of [START_REF] Coron | Merkle-Damgård Revisited: How to Construct a Hash Function[END_REF].

We consider a simulator S, which has oracle access to a random oracle RO : {0, 1} * → {0, 1} n , and whose task is to simulate a random compression function. The pseudo-code of the simulator is shown in Algorithm 7.3, and here are a few comments. The simulator maintains a log of the queries it has answered to. This knowledge is maintained under the form of a graph G = (V, E), where the set of vertices V is a subset of H, and where the edges are labelled by message blocks from M. The meaning of this graph is that there is an edge labelled by m between h and h if the simulator lets the distinguisher know that f (h, m) = h . We denote this by h m -→ h . Initially, the graph contains only a single vertex IV . The simulator also maintains a subset of V denoted by Reach, consisting of the vertices that are reachable from IV . It also associates to each vertex v in Reach an ancestor in Reach. This allows, given v, to efficiently reconstruct the sequence of message blocks that maps IV to v. We will note IV M -→ * v when there is such a path between IV and v. At the beginning, Reach only contains the IV .

Algorithm 7.3 Pseudo-code of the Simulator S 1: function FreshValue(h, m) 2: if IV M -→ * h ∈ Reach then 3:
if there exist M such that M m = g(M ) then

4: h ← RO(M ) 5: else 6: h $ ← -H 7:
end if

8: Reach ← Reach ∪ h m -→ h 9: else 10: h $ ← -H 11: end if 12: V ← V ∪ {h, h } 13: E ← E ∪ h m -→ h 14:
return h 15: end function end if 23: end function Let f be a random compression function. Now, a distinguisher D interacts with either H f and f (we say that it is in the "construction world"), or with RO and S (and we say that it is in the "random oracle world"), and it has to tell in which world it is. More formally, D is a Turing machine that has two interfaces. It should output "1" if H f and f are answering its oracle queries, and "0" if RO and S are. Our objective is to show that the following holds for a small ε:

P D H f ,f = 1 -P D RO,S = 1 ≤ ε
The proof uses a hybrid argument through a sequence of games. We will denote by q S and q O the number of queries sent to the Simulator and the Oracle respectively, by the distinguisher.

Game 1:

The distinguisher is in the random oracle world. It has access to RO and S. Let G 1 be the event that D outputs "1" in this setting:

P [G 1 ] = P D RO,S = 1
Game 2: We introduce a dummy relay algorithm T , which has oracle access to RO. Given a random oracle query from the distinguisher, T just send the query to RO, and transmits the answer of RO back to D.

Let G 2 be the event that D outputs "1" in this case. Since the view of D is left unchanged, we have:

P [G 2 ] = P D T RO ,S = 1 = P [G 1 ]
Game 3: In this game, we modify the simulator S. In particular, we restrict the responses of the simulator such that they never satisfy certain specific failure conditions. If the simulator comes up with a response that would result in an inconsistent state, then it fails explicitly instead of sending that response. The failure conditions describe certain situations that could be exploited by the distinguisher, such as collisions on the internal state. We replace the FreshValue function by the one shown in Algorithm 7.4. if

IV M -→ * h ∈ Reach then 3: if there exist M such that M m = g(M ) then 4: h ← RO(M ) 5: else 6: h $ ← -H 7:
end if

8: if h ∈ V then 9:
Abort 10:

end if 11: Reach ← Reach ∪ h m -→ h 12: else 13: h $ ← -H 14: end if 15: V ← V ∪ {h, h } 16: E ← E ∪ h m -→ h 17:
return h 18: end function It should be clear that until no abort occur, the subgraph Reach is in fact a tree rooted in IV . This follows from the fact that the simulator aborts as soon as a collision in the internal state is detected. The new value h is always drawn uniformly at random. It should be clear that as long as the simulator does not abort, the number of nodes in V is upper-bounded by 2q S + 1.

Therefore, for a given query, the probability of failure is upper-bounded by (2q S + 1)/2 n . For all the q S queries sent by the distinguisher to the simulator, the probability of failure is therefore less than q S • (2 • q s + 1)/2 n . Let G 3 be the event that D outputs "1" in this case. Since the view of D only changes when the simulator aborts, we have:

|P [G 3 ] -P [G 2 ]| ≤ 2 • (q S + 1) 2
2 n In the sequel, we denote the patched simulator by S 0 .

Game 4: In this game, we modify the relay algorithm and leave the simulator unchanged. The underlying idea is to make the responses of the relay algorithm directly dependent on the simulator. Thus, instead of giving the new relay algorithm T 1 an oracle access to the random oracle RO, it is now given oracle access to the simulator S 0 . On a random oracle query X, the relay algorithm T 1 computes g(X), the prefix-free encoding of X. It then applies the Merkle-Damgård construction to g(X) and queries the simulator S 0 to evaluate the compression function. Thus the relay algorithm T 1 is essentially the same as the random oracle construction pf-MD, except that it is based on the simulator S 0 instead of random function f . Let G 4 denote the event that the distinguisher D outputs "1" when given oracle access to T 1 and S 0 in this game. Thus, we know that P [G 4 ] = P D T1,S0 = 1 Before going further, we establish two key properties of S 0 . Let us consider the sequence Q of queries (h i , m i , h i ) sent to S 0 , where h i is the answer and (h i , m i ) is the question. We say that the IV is reachable, and at a given point in the simulation h i is reachable if there has been a previous query (h i , m i , h i ) where h i was reachable. Then: (i) Until S 0 fails, Reach precisely describes the set of reachable chaining values.

(ii) Until S 0 fails, Reach describes a tree.

These two properties are easy to establish by induction on the number of queries. When the simulator detects that h i is reachable, it puts its answer h i in Reach. What guarantees that our two properties hold is that S 0 aborts if h i was already "known". Thus, the set of reachable values can only be extended by one element, namely h i , and Reach is updated accordingly.

Next, we claim that the following three statements hold:

(i) In Game 3, i.e., when D interacts with T RO , S 0 , the answers of S 0 are consistent with those of RO as long as S 0 does not abort.

(ii) In Game 4, i.e., when D interacts with

T pf -M D(S0) 1
, S 0 , the answers of S 0 are consistent with those of RO as long as S 0 does not abort.

(iii) T RO and T pf -M D(S0) 1

give the same answers until the simulator aborts.

From these three points, we can deduce that the view of the distinguisher D remains unchanged from game 3 to game 4 if the simulator S 0 does not fail in either of the two games.

Proof. (i)

To detect an inconsistency between S 0 and RO, one has to build a chain of queries corresponding to a valid message, and compare with the output of RO with the last query of the chain. Note that if the chain is built out-of-order, then the simulator will abort. Therefore the last query to be sent to S 0 is the final block of the prefix free encoding of M . When S 0 detects the final block of a message, it queries RO on the decoded message, which is unique because Reach is a tree. The answers of RO and S 0 are thus consistent. (ii) The justification is the same as in the previous point. The fact that T 1 sends extra queries does not change the fact that S 0 answers are consistent with the Random Oracle.

(iii) Since S 0 is consistent with the VIL-RO, the relay algorithm T 1 does in fact return RO(M ) by applying the pf-MD construction with S 0 .

We can finally complete the argument by observing that if the maximum length of the prefix-free encoding of a random oracle query made by D is blocks, then,

|P [G 4 ] -P [G 3 ]| ≤ P [S 0 fails in Game 3] + P [S 0 fails in Game 4] ≤ 2 • (q S + 1) 2 + (q S + • q O + 1) 2 2 n
Game 5: In this game, we modify the simulator S 0 so as to make its responses independent of the random oracle RO. For this purpose, we remove the random oracle RO from this game entirely and the new simulator S 1 always chooses a random n-bit response itself, even in situations where S 0 would have consulted RO. We also remove all the failure conditions from the new simulator S 1 . More precisely, we replace the FreshValue function by the one in Algorithm 7.5

Algorithm 7.5 Patched simulator for Game 5

1: function FreshValue(h, m) 2: h $ ← -H 3: V ← V ∪ {h, h } 4: E ← E ∪ h m -→ h 5:
return h 6: end function The responses of these two simulators are identical except from the failure conditions which are used by S 0 and not by S 1 : even when S 0 consults the random oracle, its responses are still uniformly distributed. Thus, the distinguisher does not notice a difference between these games if in game 4, the simulator S 0 does not fail.

Let G 5 denote the event that the distinguisher D outputs "1" in game 5, so that

P [G 5 ] = P D T1,S1 = 1
Then we can deduce that:

|P [G 5 ] -P [G 4 ]| ≤ P [S 0 fails in game 4] ≤ 2 • (q S + • q O + 1) 2 2 n
Game 6: This is the final game of our argument. Here we finally replace the simulator S 1 with the random function f . Since the relay algorithm T 1 simply implemented the prefix-free Merkle-Damgård construction, then the view of the distinguisher is in fact the construction world. Now, by combining games 1 to 6, we can show that

P D H f ,f = 1 -P D RO,S = 1 ≤ 4 • (q S + 1) 2 + (q S + • q O + 1) 2 2 n
7.3.4 Non-Ideal Case: Proof of Theorem 7.9

Algorithm 7.6 Pseudo-code of the Simulator S 0 for the non-ideal case, with abort conditions 1: function Simulator(h, m)

2:
if there exist a vertex h ∈ V and an edge h

m -→ h in E then 3:
return this h 4:

else 5:
return FreshValue(h, m)

6:
end if 7: end function

8: function FreshValue(h, m) 9: if there exist (u, v) ↔ (h, m) ∈ G R2 then (h, m) ← (u, v) 10: if IV M -→ * h ∈ Reach then Swap (h, m) and (h, m) (only if h is defined) 11: if IV M -→ * h ∈ Reach then 12:
if there exist M such that M m = g(M ) then end if

17: h ← Sampler 2 h, m, h, m, h (only if h is defined) 18: if h ∈ W or h ∈ V or Reach ∪ {h } covers an edge of G R2 then Abort 19: Reach ← Reach ∪ h m -→ h 20: else 21: h ← Sampler 1 (h, m) 22: h ← Sampler 2 h, m, h, m, h (only if h is defined) 23:
end if

24:

V ← V ∪ h, h , h, h (only add h and h if defined)

25:

E ← E ∪ h m -→ h , h m -→ h idem.

26:

return h (or h if they were swapped in line 10) 27: end function

The proof proceed in the same way as the proof of Theorem 7.8. The simulator is shown in Figure 7.6. The pseudo-code shows S 0 with the failure conditions. Before going further, a few comments on S 0 are in order. When it receives a query (h, m), it checks whether there exist a symmetric query h, m , that would trigger the symmetry relation (i.e., it checks whether the node (h, m) is connected to something in G R2 ). If such a query exist, then both are treated simultaneously in a "symmetric" way. In particular, if either one of these concerns a reachable state, then it is treated specially, even if it not the original query, but the "symmetric" one. The first two games are identical to those of the ideal case.

Game 3: Let us discuss the probability that S 0 fails. It can only happen if h is reachable, which in turn means that h is randomly distributed in H. S 0 aborts when h ∈ W, h ∈ V or when Reach ∪ {h } covers an edge of G R2 . The probability that h ∈ W is |W|/2 n , and the probability that h ∈ V is upper-bounded by (4 • q S + 1)/2 n , since |V | ≤ 4 • q s + 1. Let us now discuss the probability that an edge of G R2 is covered by Reach.

A simple induction on the number of queries shows that the chaining values in Reach are all randomly and independently distributed in H (this is because Reach is always extended by h on line 19, and h is itself always generated randomly). If we ignore the abort conditions, Reach is a random subset of H of size k ≤ q s + 1 after q S queries. There are 2 n k such subsets, and amongst these 2 n k-2 cover a given edge. The probability that at least one edge out of

|WP| is covered is thus upper-bounded by |WP| • 2 n k-2 / 2 n k , which it itself upper-bounded by |WP| • k 2 /(2 n -k) 2 .
After q s queries, the probability of failure is therefore bounded by:

|P [G 3 ] -P [G 2 ]| ≤ 4 • (q S + 1) 2 2 n + |W| • q S + 1 2 n + |WP| • q S + 1 2 (2 n -q S -1)
2 Game 4: We claim that the following four statements hold: (i) In Game 3, i.e., when D interacts with T RO , S 0 , the answers of S 0 are consistent with those of RO as long as S 0 does not abort.

(ii) In Game 4, i.e., when D interacts with

T pf -M D(S0) 1
, S 0 , the answers of S 0 are consistent with those of RO as long as S 0 does not abort.

(iii) T RO and T pf -M D(S0) 1

give the same answers until the simulator aborts.

(iv) As long as it does not abort, the answer of S 0 always comply with the relation R.

Consistency with the VIL-RO. Establishing the first three points can be done in the same as it was done in the ideal case. The simulator relies on the fact that Reach is a tree, and that it exactly describes the reachable chaining values in V . This can be established by arguing that if S does not abort, then h is the only new reachable chaining value created by the current invocation of FreshValue. Note that h, if it exists, is not reachable.

Conformance to the Relation. The main point is that the relation can never be falsified on reachable states, and that the samplers are used on non-reachable states to ensure that the answers are consistent with the relation. More precisely, the simulator aborts as soon as a state in W becomes reachable, or a pair of states in WP becomes reachable.

Let us assume that the distinguisher can find a query (h, m, h ) with h m -→ h such that R 1 (h, m, h ) does not hold. Then we have h ∈ W by definition of W, therefore h cannot be reachable and h has necessarily been build by Sampler 1 . By definition of Sampler 1 , R 1 (h, m, h ) must hold.

Similarly, let us assume that the distinguisher finds

h 1 m1 --→ h 1 and h 2 m2 --→ h 2 such that R 2 (h 1 , m 1 , h 2 , m 2 , h 1 , h 2 )
does not hold. By definition of WP we have (h 1 , h 2 ) ∈ WP therefore h 1 and h 2 cannot both be reachable. Moreover, we have (h 1 , m 1 ) ↔ (h 2 , m 2 ) ∈ G R2 . Without loos of generality, we assume that h 2 is not reachable. When the first query involving (h 1 , m 1 ) or (h 2 , m 2 ) was sent to S 0 , the simulator built the second query. If h 1 was reachable, h 1 has been built by calling the VIL-RO and h 2 has been built by Sampler 2 , with assures that R 2 (h 1 , m 1 , h 2 , m 2 , h 1 , h 2 ) holds. Similarly, if h 1 is not reachable, h 1 has been built by Sampler 1 , and h 2 by Sampler 2 . We note that if h 1 was not reachable at the time when it was queried, it cannot become reachable later without causing the simulator to abort.

Finally, we obtain that the view of the distinguisher does not change as long as the simulator does not abort:

|P [G 4 ] -P [G 3 ]| ≤ P [S 0 fails in Game 3] + P [S 0 fails in Game 4] ≤ 2 • P [S 0 fails in Game 4] ≤ 8 • (q S + κ • q O ) 2 2 n + 2|W| • q S + κ • q O 2 n + 2|WP| • (q S + κ • q O ) 2 (2 n -q S -κ • q O ) 2
And we conclude:

ε = P D H F ,F = 1 -P D RO,S = 1 ≤ |P [G 1 ] -P [G 6 ]| ≤ 4P [S 0 fails in Game 4] ≤ 16 • (q S + κ • q O ) 2 2 n + 4 • |W| • q S + κ • q O 2 n + 4 • |WP| • (q S + κ • q O ) 2 (2 n -q S -κ • q O ) 2

Conclusion

Our work on hash functions modes of operations was mostly centered on second preimage attacks, and provable second preimage resistance. These questions are essentially of theoretical interest, because generic attacks are usually unlikely to ever become practical. This applies in particular to second preimage attacks which do not just rely on a black-box collision finder that could efficient with the passage of time. The Trojan Message Attack is a rare example of a generic attack becoming practical.

The complexity of generic attacks is usually above the birthday bound, but it is striking that as soon as the adversary is allowed to perform at least 2 n/2 operations, where n denotes the size of the internal state of the hash function, uncontrollable phenomena happen. This is typically exemplified by the generic attacks on concatenated or iterated hashes, where sophisticated herding techniques allows to keep an arbitrary large number of parallel hash processes under control.

All-in-all, the avalanche of generic attacks on the Merkle-Damgård construction stimulated the search for alternatives. From a theoretical standpoint, this question has been settled: the wide-pipe mode of operation and the sponge construction both offers unquestionable benefits over Merkle-Damgård, most notably the provable absence of generic attacks. The SHA-3 competition has also demonstrated that they can be efficient and practical.

There might nevertheless be some practical scenario (e.g., very constrained memory) where narrow-pipe constructions could be a better fit. In addition, investigating the properties of narrow-pipe hash functions is more interesting, because the situation is much less clear. We have shown that there are narrow-pipe hash function modes of operations immune to generic second preimage attacks. Are there narrow-pipe modes of operation provably resistant against herding attacks? The Zipper Hash seems to be a promising candidate, but it is very unpractical.

The designers of new hash function modes of operation will have to justify their work in light of the existence of provably secure and decently practical constructions. We thus believe that these new modes will have to provide some additional feature, e.g., stronger provable security in the standard model. The sponge paradigm [START_REF] Bertoni | On the indifferentiability of the sponge construction[END_REF] is a striking example: it provides more features than most other constructions (it can produce digests of any sizes, for instance). It has already gained respectability even though it only appeared three years ago, because it was demonstrated that it could be simultaneously quite practical and yield apparently secure constructions.

Finally, the interplay between attacks and security proofs is a fascinating subject. Our proofs of resistance to second preimage attacks directly exploit the way the attacks work. Constructing simulators for indifferentiability proofs is often a (challenging) trial-and-error process, where the designer, sometimes with the help of a few colleagues, puts her own algorithm to the test of carefully crafted distinguishers. An important phase of the elaboration of the security proof therefore consists in the elaboration of attacks...

Introduction

The field of block cipher design has advanced greatly in the last two decades. New strategies of designing secure block ciphers were proposed, and following the increase in computing power, designers could offer larger security margins with reduced performance penalties. As a result, practical attacks on block ciphers became extremely rare, and even "certificational attacks" (that is, attacks which are not practical but are still faster than exhaustive key search on the full version of the cipher), are not very common. As we already argued in the introduction of part I, the situation of hash functions (and also stream ciphers) is dramatically different. Several commonly used hash functions were practically broken in recent years [SSA + 09, MP08], and practical attacks on new stream cipher designs appear every several months [START_REF] Stankovski | An efficient state recovery attack on x-fcsr-256[END_REF][START_REF] Hell | Breaking the stream ciphers f-fcsr-h and f-fcsr-16 in real time[END_REF].

This led to two approaches in the block-cipher cryptanalysis community. The first is to concentrate on attacking reduced-round variants of block ciphers, where the usual goal of the adversary is to maximize the number of rounds that can be broken, using less data than the entire codebook and less time than exhaustive key search. This approach usually leads to attacks with extremely high data and time complexities, such as those shown in [START_REF] Demirci | A meet-in-the-middle attack on 8-round aes[END_REF][START_REF] Lu | New impossible differential attacks on aes[END_REF]. The second approach is to allow the adversary more degrees of freedom in his control. Examples of this approach are attacks requiring adaptive chosen plaintext and ciphertext queries, the related-key model, the related-subkey model, and even the known-key model [START_REF] Biryukov | Related-Key Cryptanalysis of the Full AES-192 and AES-256[END_REF][START_REF] Orr Dunkelman | A practical-time related-key attack on the kasumi cryptosystem used in gsm and 3g telephony[END_REF][START_REF] Knudsen | Known-key distinguishers for some block ciphers[END_REF]. This approach allows to achieve practical complexities even against widely used block ciphers such as the AES, but the practicality of the models themselves in real-life situations can be questioned.

Attacks following each of these approaches are of great importance, as they ensure that the block ciphers are strong enough, almost independently of the way in which they are deployed. Moreover, they help to establish the security margins offered by the ciphers. A block cipher which is resistant to attacks when the adversary has a strong control and almost unrestricted resources offers larger security margins than a block cipher which does not possess this resistance.

At the same time, concentrating the cryptanalytic attention only on such attacks may prove insufficient to truly understand the security of the analyzed block cipher. It seems desirable to also consider other approaches, such as restricting the resources available to the adversary in order to adhere to "real-life" scenarios. For example, one may study the maximal number of rounds that can be broken with practical data and time complexity, as considered for instance in [BDK + 10] with respect to the related-key model.

Low Data Complexity Attacks. In this second part we pursue this direction of research, but we concentrate on another restriction of the adversary's resources. In the attacks we consider, the time complexity is not restricted (besides the natural bound of exhaustive search), but the data complexity is restricted to only a few known or chosen plaintexts. At first glance, this scenario may seem far fetched. However, it makes sense to question whether it is easier in practice for an attacker to perform 2 50 elementary operations or to acquire 50 plaintext/ciphertext pairs. We are inclined to believe that in many actual-life situations, performing the computation is easier. In addition, the EMV protocol for credit cards specifies that at most 2 16 signatures shall be issued by a given chip, which practically restricts the quantity of available data. It also turns out that this setup is very natural in the context of several classes of attacks:

-Slide attacks [BW99]: This class of attacks is especially designed against block ciphers whose rounds are very similar to each other. The main feature of slide attacks is that they are independent of the number of rounds, and thus, the common countermeasure of increasing the number of rounds is not effective against them. Since most other attack techniques can be easily undermined by adding a few rounds, this makes the slide attacks one of the most powerful attacks against modern block cipher designs. The main idea of the slide attacks is to reduce the attack on the entire block cipher to an attack on a single round, where the data available to the adversary is only two known plaintext/ciphertext pairs. Hence, the scenario considered in our paper is exactly the one faced by the adversary in the slide attack. We note that several variants of slide attacks suggested methods to increase the amount of data available to the adversary [BW00, [START_REF] Biham | Improved slide attacks[END_REF][START_REF] Furuya | Slide attacks with a known-plaintext cryptanalysis[END_REF]. However, all these methods either require the knowledge of large portion of the codebook or perform in the adaptively chosen plaintext model. -Attacks based on fixed point properties [START_REF] Courtois | Algebraic and slide attacks on keeloq[END_REF]: In this class of attacks, the adversary looks for a fixed point of some part of the encryption process. For such a fixed point, the cipher is reduced to a smaller variant, which can (sometimes) be attacked efficiently. Since usually the number of fixed points is extremely small (e.g., one or two), the adversary's goal is to attack a reduced-round variant of the cipher given a few known plaintexts. -Side channel attacks: In this class of attacks, the adversary has access to some information on the internal states during the encryption process. Usually, due to practical restrictions, the amount of data available to the adversary is extremely low. In the (somewhat unlikely) case where the information available to the adversary is the full intermediate state after a few rounds, the scenario the adversary faces is exactly the one considered in our paper. We note that the complementary scenario, where the adversary has access to a small part of the internal state in multiple encryptions, was studied in [START_REF] Dinur | Side channel cube attacks on block ciphers[END_REF]. -Building block in more complex attacks: As we demonstrate on the example of AES, an attack on 2round AES with two known plaintexts can be leveraged to a known plaintext attack on 6-round AES.

The attack uses a meet-in-the-middle approach combined with a low probability differential. Also, the block cipher GOST was recently broken by such an attack, where an attack against the full 32 rounds is reduced to an attack against 8 rounds using four known plaintext [START_REF] Isobe | A single-key attack on the full gost block cipher[END_REF]. We expect that such "leveraging" attacks are applicable against other block ciphers as well. -Attacks on other primitives based on the block cipher : In recent years, many designs of stream ciphers (e.g., Sosemanuk [BBAC + 05]), hash functions (e.g., Hamsi [START_REF] Küçük | The Hash Function Hamsi[END_REF]), MACs (e.g., ALPHA-MAC [START_REF] Daemen | A New MAC Construction ALRED and a Specific Instance ALPHA-MAC[END_REF]), etc., use a small number of rounds of a block cipher as one of their components. Some of these constructions can be broken when internal collisions are found and thus the attackers are in a setting in which they have to exploit a very limited quantity of data (the colliding inputs).

The attacks we consider can be used against these primitives, once collisions are found (which may require a large quantity of data though).

The AES, a Natural Target. In order to make our results concrete, we have chosen to concentrate on a single block cipher -the AES, the Advanced Encryption Standard [START_REF]Advanced Encryption Standard (AES)[END_REF]. The AES is a 128-bit block cipher with a variable key length (128, 192, and 256-bit keys are supported). Since its selection, AES gradually became one of the most widely used block ciphers and received a great deal of cryptanalytic attention, both during the AES process, and even more after its selection. Studying reduced-round versions of AES is also motivated by the recent blossom of many AES-based primitives for hashing or authentication, such as the Grøstl, ECHO, SHAVite-3 and LANE hash functions, the LEX [START_REF] Biryukov | The Design of a Stream Cipher LEX[END_REF] stream cipher, or the Alpha-MAC [START_REF] Daemen | A New MAC Construction ALRED and a Specific Instance ALPHA-MAC[END_REF] and Pelican-MAC [START_REF] Daemen | The Pelican MAC Function[END_REF] message authentication codes. In these construction, AES rounds (and sometimes the full AES) are used as internal permutations. A possible explanation of this fancy is that the AES enjoys very interesting security properties against statistical attacks: two rounds achieve full diffusion, and there exist very good differential and linear lower bounds for the best differential on four rounds [START_REF] Keliher | New Method for Upper Bounding the Maximum Average Linear Hull Probability for SPNs[END_REF][START_REF] Keliher | Improving the Upper Bound on the Maximum Average Linear Hull Probability for Rijndael[END_REF][START_REF] Keliher | Refined Analysis of Bounds Related to Linear and Differential Cryptanalysis for the AES[END_REF]. It results that in some applications (such as authentication or hashing), only a small number of AES rounds are sufficient to yield a reasonable internal permutation. The relative weakness of the permutation is then usually compensated by the fact that the internal state is either hidden from the adversary (in MACs, because of the secret key), or only partially accessible to the adversary (because only certain parts can be seen and modified). Furthermore, in some particular attacks, such as side-channel attacks, only a small number of rounds of the cipher needs to be studied [START_REF] Piret | A Differential Fault Attack Technique against SPN Structures, with Application to the AES and KHAZAD[END_REF][START_REF] Biryukov | Two New Techniques of Side-Channel Cryptanalysis[END_REF]. Lastly, much attention has been recently devoted to the AES block cipher as a by-product of the NIST SHA-3 competition. The low diffusion property of the key schedule has been used to mount several relatedkey attacks [BKN09, BK09, BDK + 10, KBN09] and differential characteristic developed for hash functions have been used to also improve single-key attacks [START_REF] Orr Dunkelman | Improved single-key attacks on 8-round aes-192 and aes-256[END_REF]. The AES is therefore a relevant and interesting case study to demonstrate our techniques.

Algebraic Structure. Since the introduction of the AES in 2001, it has been questioned whether its simple algebraic structure could be exploited by cryptanalysts. Soon after its publication as a standard [NIS01], Murphy and Robshaw showed in 2002 an interesting algebraic property: the AES encryption process can be described only with simple algebraic operations in GF 2 8 [START_REF] Murphy | Essential Algebraic Structure within the AES[END_REF]. Such a result paved the way for multivariate algebraic techniques [START_REF] Courtois | Cryptanalysis of block ciphers with overdefined systems of equations[END_REF][START_REF] Cid | Some Algebraic Aspects of the Advanced Encryption Standard[END_REF] since the AES encryption function can also be described by a very sparse overdetermined multivariate quadratic system over GF (2). However, so far this approach has not been so promising [START_REF] Monnerat | On Some Weak Extensions of AES and BES[END_REF][START_REF] Cid | An analysis of the xsl algorithm[END_REF], and the initial objective of this simple structure, providing good security protections against differential and linear cryptanalysis, has been fulfilled.

Techniques. Our concentration on attacks with an extremely small data complexity affects the techniques available to us. The small amount of available data makes the usual statistical attacks, such as differential and linear cryptanalysis, almost irrelevant. Algebraic attacks seem to be more well-suited, even though it seems that they perform better when a lot of data is available. Anyway, such attacks using either SAT solvers or Gröbner basis algorithms [MR02, BPW06], have never been able, so far, to endanger even very reduced versions of the AES. These attacks encode the problem into a system of equations, then feeds the equations to a generic, sometimes off-the-shelf equation solver, such as a SAT-solver or a Gröbner basis algorithm2 . The main obstacle in these approaches is the non-linear component of the AES (the S-box), that only admits "bad" representations (for instance, it is a high degree polynomial over the AES finite field), and increases the complexity of the equations, even though low degree implicit equations may also exist.

Our attacks have an algebraic flavor, but are mostly based on the meet-in-the-middle approach, combined with guess-and-determine and differential-type ideas, as well as vast exploitation of the key schedule of the analyzed block cipher (a not-so-common feature in single-key attacks). Automated Tools. Because of their special nature, finding low data complexity attacks "by hand" is difficult. A guess and determine attack against three AES rounds for instance involves about 50 deduction steps. Even on a single AES rounds, where attacks should be easier to find, some subtle shortcuts are not easy to find at all. To alleviate the task of cryptanalyst, a natural solution is to create automated tools tailored to find an attack of some kind on a given primitive. This approach has been successful many times: nice examples include the cryptanalyses of Grindhal by Peyrin [START_REF] Peyrin | Cryptanalysis of grindahl[END_REF] and of RadioGatùn by Fuhr and Peyrin [START_REF] Fuhr | Cryptanalysis of radiogatún[END_REF]: in both case a custom-made program found a truncated or symmetric differential characteristic leading to a collision. Biryukov and Nikolić designed a tool to automatically find related-key attacks in the AES [START_REF] Biryukov | Automatic Search for Related-Key Differential Characteristics in Byte-Oriented Block Ciphers: Application to AES, Camellia, Khazad and Others[END_REF], and along with Khovratovich they designed a tool to search for collision attacks on byteoriented hash functions [START_REF] Khovratovich | Speeding up Collision Search for Byte-Oriented Hash Functions[END_REF]. Much earlier, Matsui designed a tool to find differential characteristics and linear approximations [START_REF] Matsui | Linear cryptoanalysis method for des cipher[END_REF]. Leurent developed a tool to find good differential paths in MD4 and MD5 [START_REF] Fouque | Full key-recovery attacks on hmac/nmac-md4 and nmac-md5[END_REF], while De cannière and Rechberger developed a tool to find good differential characteristics in SHA-1 [START_REF] De | Finding sha-1 characteristics: General results and applications[END_REF], etc.

This part devoted to low data complexity attacks is made of two chapters. In chapter 8 we describe two tools we designed to find low-data complexity attacks against the AES. Both tools outperformed (wellknown) human cryptanalysts in several occasions. In chapter 9, we present a collection of low-data complexity attacks reduced-round versions of the AES, and against AES-based primitives such as LEX, Alpha-MAC or Pelican-MAC [START_REF] Daemen | The Pelican MAC Function[END_REF]. Some of these attacks were found by hand, and some others were found by our automated tool. Chapter

Automated Tools For Low Data Complexity Attacks on AES Derivatives

This chapter presents two software tools we have designed to find low-data complexity attacks. These results are the product of a joint effort with Patrick Derbez, and they have been published at CRYPTO'2011 [START_REF] Bouillaguet | Automatic Search of Attacks on Round-reduced AES and Applications[END_REF].

In this chapter, we describe two automated tools we designed to find low data complexity attacks on the AES. The global strategy is to encode the cryptanalytic problem at hand (key-recovery, state-recovery, differential pair-finding, etc.) as a system of equations over F 2 8 . Our tools can then be seen as equation solvers of a special kind, because they take the equations describing the problem and try to find all the solutions of these equations in an efficient way. The tools are thus somewhat generic, as they are not specialized to a particular block cipher.

This approach is yet quite different from the usual algebraic attacks. Our tools do not try to solve the equations using a generic "one-size-fits-all" equation solver, but they first run a search for an ad hoc solver tailored for the equations to solve. The tools generate the source code of this solver, build it (using standard compilers) and run it in order to obtain the actual solutions. The resulting standalone program is, in fact, the attack. It can be run independently of the tools that were used to find it. While the complexity of the tools seems difficult to upper-bound, the tools give a decently precise approximation of the expected run-time of the attacks they produce.

These tools can be applied to systems of linear equations containing non-linear permutations of the field, such as bijective S-boxes. Our idea is to consider the S-box as a black box permutation. We only use few properties of this function and our attacks work for any good instantiation of the S-box.

This approach is reminiscent of the ideas used by Khovratovich, Biryukov and Nicolić to find collisions in an AES-based hash function (more precisely, a hash function using a large version of Rijndael in Davies-Meyer mode) [START_REF] Khovratovich | Speeding up Collision Search for Byte-Oriented Hash Functions[END_REF]. They first found a "good" colliding truncated differential path, and they were facing the problem of finding a conforming pair to obtain an actual collision. The basic strategy for finding a message pair conforming to a differential characteristic consists in exhaustively trying all possible input values and checking if the constraints are satisfied. In order to speed up the collision search, these authors used a message modification technique: they described the hash function using a system of linear equations with an S-box, and added equations to enforce that the message and chaining value follow their truncated differential characteristic inside the function. Solving the equations would yield a collision, and the approach they proposed is to look automatically for constraints that could be satisfied by setting a particular variable to a particular value without violating other constraints. To this end, they use linear algebra, and essentially consider x and S(x) to be independent variables, and then greedily satisfy constraints. This method is however limited in that when the greedy strategy aborts, i.e., when no easily-satisfiable constraints remain, then probabilistic trials is the only fallback.

Our tools exploit the algebraic simplicity of the AES, or, more precisely, the fact that none of its operations interact in a disastrous way with the algebraic structure of F 2 8 . The S-box operates on a single element of F 2 8 , and the only operation that involves more than one element of the field is the XOR, which is precisely the addition of the field. The situation would be much less algebraically "clean" if, for instance, each column were rotated by one bit: this particular operation is difficult to describe over F 2 8 .

We also exploit the fact that the cipher can be described by sparse equations over F 2 8 . Both features stems from the fact that the AES is an (efficient) byte-oriented cipher. We believe that it is the first time that the algebraic simplicity of the AES is effectively harnessed by cryptanalysts.

Techniques. Our tools try to find attacks automatically by searching some classes of guess-and-determine and meet-in-the-middle attacks. They take as input a system of equations describing the cryptographic primitive and some constraints on the plaintext and ciphertext variables (e.g., a differential relation). They

k i x i y i z i w i
Hello, here is some text without a meaning. This text should show, how a printed text will look li will get no information. Really? Is there no information? Is there a difference between this text and Kjift -Never mind! A blind text like this gives you information about the selected font, how the lett look. This text should contain all letters of the alphabet and it should be written in of the original contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look li will get no information. Really? Is there no information? Is there a difference between this text and Kjift -Never mind! A blind text like this gives you information about the selected font, how the lett look. This text should contain all letters of the alphabet and it should be written in of the original contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look li will get no information. Really? Is there no information? Is there a difference between this text and Kjift -Never mind! A blind text like this gives you information about the selected font, how the lett look. This text should contain all letters of the alphabet and it should be written in of the original contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look li will get no information. Really? Is there no information? Is there a difference between this text and Kjift -Never mind! A blind text like this gives you information about the selected font, how the lett look. This text should contain all letters of the alphabet and it should be written in of the original contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look li will get no information. Really? Is there no information? Is there a difference between this text and Kjift -Never mind! A blind text like this gives you information about the selected font, how the lett look. This text should contain all letters of the alphabet and it should be written in of the original contents, but the length of words should match to the language. then solve the equations by first running a (potentially exponential) search for a customized solver for the input system. The solver is built, run, and the solutions are computed.

We describe two tools. Our preliminary tool uses a depth-first branch-and-bound search to find "good" guess-and-determine attacks. It has been used to generate some of the attacks published in [BDD + 10] and described in the next chapter, and outperformed human cryptanalysts in several occasions. The class of attacks searched for by this preliminary tool is quite restricted, and it fails to take into account important differential properties of the S-box. It is therefore mostly suited to the case where a single known plaintext is available.

Many ideas developed for this preliminary tool could be reused in our second, more advanced tool, which finds more powerful attacks, such as Meet-in-the-Middle attacks. For instance, this improved tool automatically exploits the useful fact that an input and output difference on the S-box determine uniquely on average the actual input and output values. Because the search procedure of our improved tool is essentially a saturation procedure, the algorithmic techniques we use are reminiscent of (and inspired by) the Buchberger algorithm [START_REF] Buchberger | Ein Algorithmus zum Auffinden der Basiselemente des Restklassenringes nach einem nulldimensionalen Polynomideal[END_REF], as well as many techniques used in automated theorem proving.

We have applied these algorithms to reduced-round versions of the AES, to the stream cipher LEX, to Pelican-MAC, to the block cipher SQUARE [START_REF] Daemen | The block cipher square[END_REF], to SkipJack, etc. Some of the attacks found by these algorithms are described in chapter 9. Once given a very little bit of human knowledge, our tools automatically rediscover the best known attacks on Alpha-MAC and LEX. They also discovered the best known attack on Pelican-MAC (a different attack with the same complexity was independently discovered at about the same time by Dunkelman, Keller and Shamir [START_REF] Orr Dunkelman | Alred blues: New attacks on aes-based mac's[END_REF]). The tools also helped us to find the best known attack on the LEX stream cipher. The tools can output the source code of a program performing the attack, but can also provide a somewhat human-readable description of the attack procedure, which was used in some cases to understand and describe the attacks.

Description of the AES

The Advanced Encryption Standard [START_REF]Advanced Encryption Standard (AES)[END_REF] is a Substitution-Permutation network that supports key sizes of 128, 192, and 256 bits. A 128-bit plaintext (resp. a 128-bit key or internal state) is treated as a byte matrix of size 4 × 4, where each byte represents a value in F 2 8 . An AES round applies four operations to the state matrix:

-SubBytes (SB) -applying the same 8-bit to 8-bit invertible S-box 16 times in parallel on each byte of the state, -ShiftRows (SR) -cyclic shift of each row (the i'th row is shifted by i bytes to the left), -MixColumns (MC) -multiplication of each column by a constant 4 × 4 matrix over F 2 8 , and -AddRoundKey (ARK) -XORing the state with a 128-bit subkey. We outline an AES round in Figure 8.1. Before the first round, an additional AddRoundKey operation (using a whitening key) is applied, and in the last round the MixColumns operation is omitted. The number of rounds depends on the key length: 10 rounds for 128-bit keys, 12 rounds for 192-bit keys, and 14 rounds for 256-bit keys. We use the round numbers 1, . . . , N r, where N r is the number of rounds (N r ∈ {10, 12, 14}). We only consider the AES with 128-bit keys and 10 rounds. Because the final AES round is different from the others, we use the term "r.5 rounds AES" to denote the AES reduced to (r +1) rounds, including the final round. We use "r rounds AES" to denote the AES reduced to r identical full rounds. In our terminology, the "normal" 128-bit AES has 9.5 rounds.

Let F 2 8 denote the finite field with 256 elements used in the AES, namely F 2 [X]/X 8 + X 4 + X 3 + X + 1. We denote the S-box of the SubBytes transformation by S : F 2 8 → F 2 8 . In a 4 × 4 matrix, we use the following numbering of bytes: byte zero is the top-left corner, the first column is made of bytes 0-3, while the last column is made of bytes 12-15, with byte 15 in the bottom-right corner (this is illustrated by Figure 8 As we consider only the AES with 128-bit key, we shall describe only its key schedule algorithm. The key schedule of the other variants can be found in [START_REF]Advanced Encryption Standard (AES)[END_REF]. The key schedule of AES-128 takes the 128-bit master key k 0 and extends it into 10 subkeys k 1 , . . . , k 10 of 128 bits each using a key-schedule algorithm described by the following equations:

KS i :            k i [j] + k i [j -4] + k i-1 [j] = 0, j = 4, . . . , 15 k i [0] + k i-1 [0] + S (k i-1 [13]) + RCON i = 0 k i [1] + k i-1 [1] + S (k i-1 [14]) = 0 k i [2] + k i-1 [2] + S (k i-1 [15]) = 0 k i [3] + k i-1 [3] + S (k i-1 [12]) = 0
We denote by x i the internal state entering round i (i.e., before SubBytes), by y i the internal state between the SubBytes and ShiftRows operations, while z i and w i denote the internal state before and after the MixColumns operation, respectively. The plaintext is denoted by P , and the ciphertext is denoted by C. One round is represented by these equations:

R i :                y i + S(x i ) = 0 w i +    
    ×     y i [0] y i [4] y i [8] y i [12] y i [5] y i [9] y i [13] y i [1] y i [10] y i [14] y i [2] y i [6] y i [15] y i [3] y i [7] y i [11]     = 0 x i+1 + w i + k 1+i = 0
It is straightforward to form the system of equations E describing the full encryption process along with the key schedule: we just have to concatenate some KS i 's and some R i 's (without forgetting the initial key addition). Since the right-hand side of all these equations are zero, we stop representing it from now on.

These equations are extremely sparse, containing at most 5 terms. Each variable occurs in at most 3 equations. These equation form a constrained linear system, where the constraints are that for all variables, the values of x and S(x) are not independent.

Let us denote by V (X) the vector space spanned by 1, x, S(x) for all x ∈ X, for any set of variables X. If we denote by X the set of all key and internal state variables, then the cipher equations span a subspace of V (X). Any basis of this subspace describes an equivalent system of equations. Therefore, by an abuse of notation we identify the set of equations describing the block cipher with the vector space formed by all the linear combinations of the equations, and we still denote it by E. We also introduce the notation S(E) to denote the set of solutions of the equations E.

In some cases, we are interested in interchanging the order of the MixColumns and AddRoundKey operations. As these operations are linear they can be interchanged, by first XORing the data with an equivalent key and only then applying the MixColumns operation. We denote the equivalent subkey for the altered version by:

u i = M C -1 (k i ) =     0e 0b 0d 09 09 0e 0b 0d 0d 09 0e 0b 0b 0d 09 0e     × k i 8.

A preliminary Tool for Simple Guess-And-Determine Attacks

Confronted with a system of equations in V (X) (possibly describing a cryptographic problem), the most naive way to obtain its solutions consists in enumerating all the possible values of the variables and retaining only the combinations satisfying all the equations. However, equations in V (X) are such that, in a given equation, once all the terms but one are known then the last one can be found efficiently. This is especially useful when the equations are sparse (efficient cryptographic primitives usually result in sparse equations). This enables more or less efficient guess-and-determine techniques to solve the equations. In a cryptographic setting, guess-and-determine attacks are often found when data is very scarce, and statistic attacks are therefore impossible. Guess-and-determine attacks can be more or less sophisticated, but the simplest ones typically take the following form:

1: for all values of some part of the (unknown) internal state do

2:

Compute the full internal state if match available data then return secrets 6: end for

The difficulty in finding such an attack is to find which parts of the internal state to enumerate, and to find how to recover the rest. In this section, we present a preliminary tool that finds such attacks automatically. It takes as an input a system of equations E ⊂ V (X) and a set K 0 ⊂ X of initially known variables-these are the variables corresponding to the available data, for instance the plaintext, the ciphertext, the keystream, etc. The preliminary tool returns a C++ function (the "solver") which enumerates the solutions of E (using negligible memory), given the actual values of the known variables. The tool also returns the exact number of elementary operations the solver performs in the worst case.

This preliminary tool has been developed while performing the research that led to the results presented in the next chapter, and which have been published in [BDD + 10]. The preliminary tool has for instance been used to find one known plaintext attacks against 1, 1.5, 2, 2.5 and 3 AES rounds, systematically beating the best results found manually. For instance, prior to the publication of [BDD + 10], the best attack on one (full) AES round was a guess-and-determine attack with complexity 2 48 described in [START_REF] Dunkelman | The effects of the omission of last round's mixcolumns on aes[END_REF]. The preliminary tool found in less than a second an attack of complexity 2 40 and generated its implementation, which we verified to be correct.

Knowledge Propagation.

The core idea of this preliminary tool is quite simple: if there is a linear combination of the equations in which the values of all terms are known except one, then the value of this last term can be determined efficiently.

When applied to the AES, this simple procedure automatically harnesses the simple and clean algebraic structure of the cipher. It automatically exploits the linear relations existing in the key-schedule, as well as the MDS property of the MixColumns operation: if y = MixColumns(x) then knowlege of any four bytes in (x, y) is sufficient to recover the remaining four efficiently.

An "Algebraic" Point of View. The acquisition of further knowledge, either by "guessing" or "determining" has a simplifying effect on the equations (it removes an active variable whose value is unknown from the problem). This simplification of the original equations in fact has a clean algebraic description.

Let K ⊂ X be a set of variables whose values are known. If we substituted the values of known variables into the original equations E, we would indeed get a system with less variables. In fact, this reduced system is essentially the quotient space of E by V (K): starting from an equation f ∈ E, its equivalence class [f ] in the quotient contains a representative where all the variables in K have disappeared. Alternatively, the variable x can be deduced from K if either [x] or [S(x)] belong to the quotient of E by V (K), and we will write x ∈ Propagate(K) when it is the case. To see why, observe that

[x] ∈ V (E) /V (K) (or [S(x)] ∈ V (E) /V (K))
means that there exists k ∈ V (K) such that x + k ∈ V (E). In other terms, there is a linear combination of the equations E that can be written x + k (respectively, S(x) + k). It follows that in any solution of the equations E, the value of x is the value of k. There is therefore a straight-line program of size O (|K|) that uniquely determines the value of x given the values of the variables in K-it just has to evaluate k.

Observe in passing that it is not difficult to check whether x ∈ Propagate: it comes down to solving a system of 2|X| linear equations in |E| variables over F 2 8 .

Automatic Search for a Minimal Number of Guesses

Given a set of "known" variables K = K 0 , we may propagate knowledge and obtain the value of new variables, yielding a new set of known variables K 1 . But it may turn out that new variables may again be obtained from K 1 . We therefore define the function Propagate * (X) which returns the least fixed point of Propagate containing X:

Propagate * (X) = let Y = Propagate(X) in if X = Y then return Y else return Propagate * (Y )
Note that this definition is well-founded, because Propagate is both monotonic and bounded. Indeed, it is very easy to check that X ⊆ Y implies Propagate(X) ⊆ Propagate(Y ). It also follows that Propagate * is also monotonic.

A guess-and-determine solver has been found as soon as we have found a set G of "guesses" such that Propagate * (G) = X. In that case, we will say that G is sufficient. The problem thus comes down to automatically finding a sufficient set of minimal size.

The process of exhaustively searching such a guess-and-determine attack can be seen as the exploration of a Directed Acyclic Graph (DAG) whose nodes are sets of variables. The starting node is the set K 0 , and the terminal node is X. For any set of variables X, and any variable y / ∈ X there is an edge X y -→ X ∪ {y}, meaning that we may always choose to "guess" the value of y to gain knowledge. Finally, for any set of Each descendant has one more guess than its parent. variables X, there is an edge X → Propagate * (X), symbolizing the fact that increase our knowledge by propagation.

In this setting, the objective of the preliminary tool is to find a path from K to X going through a small (if not the smallest) number of "guess" edges. Indeed, the cost of the resulting attack is exponential in the number of traversed "guess edges". The problem is that the size of the DAG is exponential in the number of variables.

The search works in a depth-first branch-and-bound fashion reminiscent of the DPLL procedure implemented in many SAT-solvers. The pseudo-code of the search procedure is shown in Algorithm 8.1. The function Explore(K, G, B)1 returns a minimal set of variables to guess in order to be able to recover the entire internal state. Here K denotes the set of currently known variables (i.e., the current node of the DAG), G denotes the set of variables that have been guessed so far, and B denotes the set of variables that have been guessed in the best known solution. This implicit assumption is that |G| < |B|, and that the result of Explore has cardinality smaller than or equal to B. Evaluating Explore(K 0 , ∅, X) returns a minimal solution.

Pruning Strategies

An obvious way to speed up the DAG exploration is to avoid guessing a permutation of a set of guesses previously tested. This can be easily enforced by choosing a total order relation < X between variables and only guessing variables in increasing order. In order to further speed-up the search procedure, we used several pruning strategies that remove "guess" edges from the DAG without modifying its reachability properties. These pruning strategies appear in Algorithm 8.1 under the form of the FilterGuesses function, which only returns a subset of its argument.

Algorithm 8.1 Pseudo-code of the Preliminary Tool.

1: function Explore(K, G, B)

2: if K = X then return G 3: if K → Propagate * (K) then 4:
return Explore(Propagate * (K), G, B)

5: if |G| = |B| -1 then return B 6:
for all x ∈ FilterGuesses(K) do

7: recursive ← Explore(K ∪ {x}, G ∪ {x}, B) 8: if |recursive| < B then B ← recursive 9: if |G| = |B| -1 then return B 10:
end for 11:

return B 12: end function Local Pruning. In simple words, if we need to guess the value of a new variable, and if guessing the value of x allows to deduce the value of y, then it is always better to guess x instead of y. More formally, we see that if y ∈ Propagate * (K ∪ {x}), then:

Propagate * (K ∪ {y}) ⊆ Propagate * (K ∪ {x})
Given a set of known variables, this translates to a partial order relation on variables:

x ¥ K y if and only if y ∈ Propagate * (K ∪ {x}).
From this order relation we extract a strict order relation:

x ¡ K y ⇐⇒ x ¥ K y and x ¦ K y. The pruning strategy informally described above amounts to consider only maximal elements for ¡ K . We call this strategy "local pruning" because it only requires a local exploration of the DAG around the current node K.

Global Pruning. A somewhat surprising consequence of the fact that Propagate * is monotonic brings in a interesting result, enabling us to further discard some bad guesses in a very powerful way. Lemma 8.1. Let V X be an insufficient set of variables, and let G ⊆ X be a sufficient set of variables. Then:

G ∩ (X -Propagate * (V )) = ∅
Proof. Let us reason by contradiction and assume that G ∩ (X -Propagate * (V )) = ∅. Then, because G is a subset of X, then G ⊆ Propagate * (V ). By monotonicity and idempotence of Propagate * we find:

X = Propagate * (G) = Propagate * (V ) = X.
If G denotes a sufficient set of minimal size, then Lemma 8.1 gives us a priori knowledge on G, and it enables to choose the first guess of the search procedure in X -Propagate * (V ) without risking to throw the best solution away.

It is possible to exploit lemma 8.1 even further for more pruning. Assume that in the exploration process we currently know the variables in K, and that we have guessed the variables in G, so that K = Propagate * (G). Let B be a sufficient set of minimal size such that G ⊆ B, i.e., the best we may hope to find from the current state. Lemma 8.1 tells us that B ∩ (X -Propagate * (V )) = ∅. This reveals us some variables in B, and could be used to direct the exploration towards B. However, if V is badly chosen then it may very well be that all the interesting variables we learn to be in B are already known, in which case we would not learn anything.

However, choosing V to be a superset of K ensures that K ∩ (X -Propagate * (V )) = ∅, and thus removes the previous problem. We may safely choose our next guess in X -Propagate * (V ) when K ⊆ V . The problem remains to (efficiently) find insufficient sets of variables V such that Propagate * (V ) is as big as possible. At each step of the DAG exploration, there is a tradeoff between spending more time pruning the graph and spending more time exploring it. We have found a simple greedy heuristic to be quite successful to build a good set V . It is shown in Algorithm 8.2, along with other the pruning strategies we have implemented.

Algorithm 8.2 Pruning Strategies for Algorithm 8.1.

1: function GreedyGlobalPruning(V )

2: Find variable x ∈ X -V such that |Propagate * (V ∪ {x})| is minimal 3: if Propagate * (V ∪ {x}) = X then return V 4:
return GreedyGlobalPruning(V ∪ {x}) return LocalPruning(Candidates) 23: end function Linearly Occurring Variables. Since the equations E describing a good cryptographic primitive cannot be completely linear, then some variables appear both linearly, and under the S-box. However, some variables may appear only linearly (this is for instance the case of the last round key in the AES). If a variable x occurs only linearly, then it can be eliminated from all the equations except one by taking linear combinations of the other equations. Taking apart the single equation containing x, we obtain a new system of equations E with one less equation and one less variable. The search procedure can safely be run on E .

Computing and Testing Solutions

If x i ∈ Propagate(K), then there exist a vector α i such that [E • α i ] = [x i ] (resp. [S(x i )]
), where the square brackets again denotes the equivalence class in the quotient by V (K). The vector α i can be computed using straightforward linear algebra given x i and K, as mentioned in §8.2.1. Once a sufficient set G has been found, and all the vectors α i have been computed, we consider the subspace P spanned by E • α i for all vectors α i corresponding to "propagated" variables in X -G. All the equations belonging to this subspace P are satisfied by definition once the variables in X -G are "determined" from those (in G) whose values have been guessed.

It is therefore interesting to consider a supplementary C of P in V (E): it describes equations that are (linearly) independent from those used for the "determine" step of the attack. To check whether a given choice of values for the guessed variables is correct, it suffices to a) determine the values of the other variables and b) check whether the equations in C hold. The complexity of the resulting procedure is roughly 256 |G| encryptions.

Implementation Details

Writing a proof-of-concept implementation of Algorithm 8.1 is not very complicated, but writing an efficient version thereof is a bit more challenging. The only non-trivial part in the implementation of the search procedure is the Propagate function. To make it efficient, we exploited the sparsity of the equations E. Recall from §8.2.1 that Propagate tries to solve the equation in α:

[E • α] = [x] (8.1)
The problem boils down to solving systems of linear equations. This is much more efficient if the equations come in some kind of triangular form. We therefore first echelonize the equations E, and then use a sparse triangular solver with sparse right-hand-side, i.e., a sparse linear algebra subroutine that solves A • x = y when A is triangular and sparse, and y is also sparse. The interest of this procedure is that it may perform sensibly less than n operations when A and y are sparse enough (see [START_REF] Davis | Direct Methods for Sparse Linear Systems (Fundamentals of Algorithms 2)[END_REF] for more details). The quotient operation in fact removes rows from the matrices and the vectors it is applied to. So, when a new variable x becomes "known", we have to remove the rows x and S(x) from the matrix representing the equations. If one of these rows was pivotal, then removing it may leave the matrix in a non-echelonized state. This can be fixed through a simple column permutations in some cases. In some other cases, a new column has to be recomputed, using a variant of the sparse triangular solver. All in all, removing rows and re-echelonizing the matrix represent a negligible fraction of the running time, because the matrix representing E is stored in a special sparse data-structure: non-zero entries are stored column-wise and rowwise in doubly-linked lists. This allows to efficiently remove rows and columns. Removed entries are kept in memory, and can be efficiently restored when backtracking. An array stores the pivot column for each (pivotal) row. A useful optimization follows the from the observation that equation (8.1) only has a solution if x (resp. S(x)) is a pivotal row in the matrix.

The code has been written in the OCaml language, and weights about 5000 lines, more than 1500 of them devoted to the linear algebra. Debugging the sparse linear algebra subroutines was a bit challenging because of the unusual data-structure holding the matrix. Parallelizing the DAG exploration is not difficult, and we developed a distributed version of Algorithm 8.1 using a customized version of the MapReduce framework [START_REF] Dean | Mapreduce: a flexible data processing tool[END_REF] built on top of Leroy's OcamlMPI library (and building on ideas by Filliâtre and Kalyanasundaram [START_REF] Filliâtre | Functory: A Distributed Computing Libraryfor Objective Caml[END_REF]). We used it to run our program on two types of platform:

-Roughly 100 Intel cores of various speeds (between 2 and 3 Ghz) in parallel using all the desktop computers of the lab during the night. -400 MIPS-like cores in a server containing 8 Tilera TilePRO64 CPUs with 50 available cores each (unfortunately, the OCaml compiler cannot generate native MIPS assembly, and hence generated bytecode. Interpreting the bytecode causes a tenfold performance penalty). On the second platform, exploring the graph for one full round takes about a minute. For 1.5 rounds, it takes 18 minutes (and finds an attack with 7 guessed bytes). For 2 full rounds, it takes 67 minutes. For 2.5 rounds, it takes 3 weeks. We did not have the patience to wait a few weeks for the exhaustive search to terminate on 3 rounds (a solution faster than exhaustive search was found, but we have no guarantee that it is the fastest attack of this class of attacks). At the very least, we hope that we demonstrated that it is possible to parallelize the search process at will.

Limitations

The main limitation of this approach is that it completely fails to take into account the differential properties of the S-box. For instance, it cannot exploit the fact that when the input and output differences of the S-box are fixed and non-zero, then at most 4 possible input values are possible. Therefore, this approach alone does not bring useful results when more than one plaintext is available. However, it can be used as a sub-component in a more complex technique. We now move on to describe such a generalization that allows to find more powerful attacks.

An Improved Tool for Meet-In-The-Middle Attacks

The equations describing the AES enjoy an interesting and important property. Let us consider a partition of the set of variables, X = X 1 ∪X 2 . Then any equation f ∈ E can be written f = f 1 +f 2 , with f 1 ∈ V (X 1 ) and f 2 ∈ V (X 2 ). In some sense, these equations are separable. We will see that this allows a "divide-and-conquer" meet-in-the-middle approach.

Solving Subsystems Recursively

The simple algebraic structure of the equations allows us to efficiently extract from a system E a subsystem containing only certain variables (say X 1 ), by simply computing the vector space intersection E ∩ V (X 1 ). In the sequel we will denote it by E (X 1 ). We note that a solution of E is also a solution of E(X 1 ), for any X 1 X, but that the converse is not true in general. Now let us be given a partition X = X 1 ∪ X 2 and two black-box solvers A 1 and A 2 that find all the solutions of E(X 1 ) and E(X 2 ), respectively. We then seek to use the two sub-solvers A 1 and A 2 to find the solutions S(E) of the full problem. An obvious way is to compute the solutions S 1 of E(X 1 ) and S 2 of E(X 2 ), and to test all the solutions in the Cartesian product S 1 ×S 2 . This would require checking

|S 1 |•|S 2 | candidates against the equations.
However, it is possible to do better. First, we observe that the vectors in S 1 × S 2 automatically satisfy the equations in E(X 1 ) + E(X 2 ). Therefore we first compute a supplementary of E(X 1 ) + E(X 2 ) inside E (let us denote it by M). The solutions of E are in fact the elements of S 1 × S 2 satisfying the equations of M.

This already makes less constraints to check. Second, sieving the elements satisfying these constraints can be done in roughly |S 1 | + |S 2 | operations, using variable separation and a table. Let (f i ) 1≤i≤m be a basis of M, and f i = g i + h i with g i ∈ V (X 1 ) and h i ∈ V (X 2 ). If the values of all the variables in X 1 (resp. X 2 ) are available, then the g i 's (resp. h i ) may be evaluated. We denote by G (resp. H) the function that evaluates all the g i (resp. h i ) on its input. If = |X 1 |, then:

G : (x 1 , . . . , x ) → g 1 (x 1 , . . . , x ), . . . , g m (x 1 , . . . , x )
We build two tables:

L 1 ←-{(G(x 1 ), x 1 ) | x 1 solution of E(X 1 )} L 2 ←-{(H(x 2 ), x 2 ) | x 2 solution of E(X 2 )}
Then, the solutions of E are the pairs (x, y) for which there exist a z such that (z, x) ∈ L 1 and (z, y) ∈ L 2 . They can be identified efficiently by various methods (sorting the tables, using a hash index, etc.). We have just combined A 1 and A 2 to form a new solver, A = A 1 A 2 , that enumerates the solutions of E.

Complexity of the Combination. Given a partition X = X 1 ∪ X 2 , and two sub-solvers A 1 and A 2 , respectively, computing S(E(X 1 )) and S(E(X 2 )), the complexity and the properties of A 1 A 2 are easy to determine. Let us denote by T (A) the running time of A, by M (A) its memory consumption, by V (A) the set of variables occurring in the corresponding equations, and by S(A) the set of solutions of the corresponding equations. The number of operations performed by the combination is the sum of the number of operations produced by the sub-solvers, plus the number of solutions (the time required to scan the tables, namely

|S 1 | + |S 2 |
, is in the worst case of the same order as the running time of the two sub-solvers). However, we use the following approximation

T (A 1 A 2 ) = max T (A 1 ), T (A 2 ), |S(E(V (A 1 ) ∪ V (A 2 )))|
It is possible to store only the smallest table, and to enumerate the content of the other "on the fly", while looking for a collision. This reduces the memory complexity to the maximum of the memory complexity of the sub-solvers, and the size of the smaller table. This yields:

M (A 1 A 2 ) = max M (A 1 ), M (A 2 ), min |S(A 1 )| , |S(A 2 )|
Heuristic Assumption On the Number of Solutions. Evaluating the complexity of a given (possibly recursive) combination requires evaluating the number of solutions of various sub-systems. This is a difficult problem in general, and in order to be able to quickly evaluate the properties of a combination, we use the following heuristic assumption:

log 256 S(E(X)) ≈ |X| -dim E(X)
This heuristic assumption introduces a risk of failure, or of wrong estimation of the complexity. To protect ourselves against this risk, we have tried, when possible, to run an implementation of the solvers and check whether this assumption holds. A difficulty that we encountered in practice stems from the following "differential" system:

x + y = ∆ i S(x) + S(y) = ∆ o
If S is the S-box of the AES, then this system has one solution on average (over the random choice of the differences), and the hypothesis holds. However, in degenerate situations, for instance when ∆ i = ∆ o = 0, then the system has 2 8 solutions... Surprisingly, an S-box with very bad differential properties would make life more difficult for our tool. This follows from the fact that in a good S-box, there are very few pairs of input/output values that generate a given input/output difference, and this makes our assumption more likely to hold in "differential" situations. On the other hand, an S-box with bad differential properties would have many impossible differentials, and this could also be exploited by the tool (for example by assuming that an input and output difference can only coexist with small probability).

In any case, this assumption makes it very easy to evaluate the performance of the combination of two sub-solvers: it boils down to computing a vector-space intersection.

Automatic Search for Recursive Combinations of Solvers

Given a system of equations, we would like to build an efficient solver by breaking the problem down to smaller and smaller subsystems, recursively generating efficient sub-solver for the sub-problems and combining them back.

Note that E({x}) (the intersection of the vector space E with x, S(x), 1 cannot be further broken down because {x} cannot be partitioned anymore. It is a "base case" of the decomposition, and it can be dealt with in two ways:

-Either E({x}) = ∅, so that we cannot easily determine how the variable x is constrained by the equations. In that case, the "solutions" of E({x}) are in fact the whole field F 2 8 . -Or E({x}) = ∅, so that we know an equation involving only x and S(x). In that case, the set of all solutions of E({x}) is very likely to have very few elements, which can be precomputed and returned as a list. The case where a single variable remains is a base case of the decomposition, and we will say that it is dealt with by "base solvers", implementing one of the above strategies. Combining base solvers in various ways yields solving trees of various shapes. In such a tree, the leaves are the "base solvers" associated to variables of X, and the nodes are combinations of solvers. A tree describes a valid solver for E as long as all the variables of E appear as the leaves of the tree.

Note that the guess-and-determine attacks discussed in the previous section form a particular case of this more general framework. They can be described by a recursive combination where X 2 always contains a single variable. However, it turns out that allowing more general tree shape results in better attacks.

Comparing Solvers. It is always possible to construct several solving trees that solve the same problem in different ways, and sometimes more or less efficiently. We therefore want to be able to compare solvers in a meaningful way. We want A 1 A 2 if A 1 is overally more interesting (works faster, finds solution of a bigger system). We also want the order relation to be compatible with the combination operation (i.e., A 1 A 2 implies A 1 A 3 A 2 A 3 ). We thus define:

A 1 A 2 ⇐⇒    T (A 1 ) ≤ T (A 2 ) V (A 1 ) ⊇ V (A 2 ) |S (A 1 ) | ≤ |S (A 2 ) |
Just like any other partial order, this order relation induces an equivalence relation:

A 1 ≡ A 2 if and only if A 1 A 2 and A 2 A 1 .
This equivalence relation also carries an interesting meaning: if A 1 ≡ A 2 then A 1 and A 2 offer essentially the same functionality with the same performance. The equivalence relation is also compatible with the combination operation. We observe that given a set of variables X 1 , there can be only one maximal solver (up to equivalence) for E(X 1 ). Thus, our objective is now clearly identified: find a maximal (i.e., the best) solver for E (up to equivalence).

Exhaustive Search for the Best Recursive Solver. The procedure ExhaustiveSearch in Algorithm 8.3 computes the set of all maximal solvers for all sub-systems of a given system of equations E (up to equivalence). In particular, it will construct a maximal solver for E itself. The algorithm is reminiscent of (and inspired by) the Buchberger algorithm for Gröbner bases [START_REF] Buchberger | Ein Algorithmus zum Auffinden der Basiselemente des Restklassenringes nach einem nulldimensionalen Polynomideal[END_REF]. More generally Algorithm 8.1 is a saturation procedure, and this also makes it similar to many automated deduction procedures (such a Resolution-based theorem provers or the Knuth-Bendix completion algorithm). At each step, the algorithm maintains a list G of solvers for subsystems of the original system E. It also maintains a list P of pairs of solver that remain to be processed. When a new solver is found, all the solvers that are worse are removed from G (and all pairs containing it are removed as well). Then, new pairs containing the new solver are scheduled for processing.

The complexity of this algorithm seems difficult to evaluate. It depends on the equations, and on the order in which the combinations are performed. In any case, the size of its ouput is upper bounded by 2 |X| (because it will return only one maximal solver for each subset of X). The parameter T up allows the user to enforce an upper-bound on the time complexity of the generated solvers (by discarding the ones that are too slow). For small values of T up , this may for instance allow to prove the non-existence of recursive solvers with complexity lower than a threshold. The running time of the exhaustive search also gets smaller with lower values of T up .

In practice, what dominates the execution of this algorithm is the computation of the dimension of the combination C, and the bookkeeping required to update G and P. A nice improvement is to use the Propagate * function from §8.2.2: each time a new solver C is constructed, we could check whether V (C) is stable by Propagate * . If not, we could combine it with the base solvers in Propagate * (V (C)) -V (C), thus improving it without increasing its running time.

Algorithm 8.3 Exhaustive Search for a good recursive solver

1: function Update-Queue(G, P, A)

2: if A § A for all A ∈ G then 3: G ← {A ∈ G | A § A } ∪ {A} 4: P ← (A i , A j ) ∈ P : A i ¦ A and A j ¦ A ∪ (A, A ) : A = A ∈ G 5: end if 6:
return (G, P) 7: end function

8: function ExhaustiveSearch(E, T up ) 9: G ← BaseSolver(x) : x ∈ X 10: P ← (G i , G j ) : 1 ≤ i < j ≤ |G|} 11: while P = ∅ do 12:
Pick (A i , A j ) ∈ P and remove it from P 13:

C ← G i G j 14: if T (C) ≤ T up then (G, P) ← Update-Queue(G, P, C) 15:
end while 16:

return G 17: end function Randomized Search. The complexity of the exhaustive search is inherently exponential, and exploring the whole space might not be feasible. In that case, a non-exhaustive randomized search might find good results, without offering the guarantee that they are the best possible. The procedure RandomizedSearch on Algorithm 8.4 shows a possible randomized search that we have found to give good results. The idea is again quite simple: at each step, we choose a random set of variables Y , we build a solver for E(Y ), and if it is not subsumed by any previously known solver, we include it in the current solver list, and we try to combine it with all the solvers we know. It would make sense to choose Y with some care, for instance using the pruning strategies discussed in §8.2.3.

There are many possible other ways to perform such a randomize search: Choose the size of the random subsets of X according to some distribution, periodically restart the procedure, periodically flush "bad" solvers from G, run the exhaustive search for a while, fill G, then switch to randomized search, etc. This presently seems to be more of an art than a science. Y ← random subset of X, of size T up 6:

(x i1 , x i2 , . . . , x i ) ← Propagate * (Y ) 7: B ← BaseSolver(x i1 ) BaseSolver(x i2 ) . . . BaseSolver(x i ) 8:
(G, P) ← Update-Queue(G, P, B)

9:
while P = ∅ do 10:

Pick (A i , A j ) ∈ P and remove it from P 11:

C ← A i A j 12: if T (C) > T up then drop C 13: if V (C) = X then return C 14:
(G, P) ← Update-Queue(G, P, C) the dimension of a vector-space intersection. Various tricks can also be used to speed this operation up (using a sparse representation, precomputing partially echelonized forms, not computing an intersection but a sum, etc. The program is 10'000 lines long, the majority of which is dedicated to linear algebra subroutines.

When an interesting solver for E is found by the search procedure, it is not particularly complicated to recursively generate a C++ implementation thereof (i.e., a function that takes as input the "known" variables, and returns the solutions of the system of equations), or a text file that describes which variables to enumerate, which tables to join, in a nearly human-readable language. The generated C++ files typically have ≥ 10k lines, with thousands of more-or-less dummy functions. They seem to be good torture tests for current compilers... We emphasize again that this method is strictly more general than that presented in the previous section, because any attack that could be discovered by the preliminary tool can also be found by Algorithms 8.3 and 8.4. The next chapter show multiple examples of attacks found by both tools. Chapter

A Collection of Low Data Complexity Attacks on AES-Derivatives

We present a collection of low-data complexity attacks on round-reduced versions of the AES, as well as attacks on several other cryptographic algorithms derived from the AES. These attacks have been found in the course of a joint work with Derbez, Dunkelman, Keller and Rijmen, during which the automated tools of the previous chapter have been developed. Some of these results led to the submission of a journal paper [BDD + 10], while some others were presented in [START_REF] Bouillaguet | Automatic Search of Attacks on Round-reduced AES and Applications[END_REF]. During the course of 2009 and 2010, Dunkelman and Keller announced in several occasions that they were investigating low-data complexity attacks against the AES, and announced interesting results. We developed the automated tools described in the previous chapter hoping to catch up on their results. This effort has been gratifying, as the tools could often improve on the manually-found attacks. When it is the case, it is interesting to compare both the manually-found and the automatically-found attacks. Our results on round-reduced versions of the AES are summarized in Table 9.1.

Because our tools are somewhat generic, they are not restricted to the AES as a block cipher, and we used them to find new attacks on the message authentication code Pelican-MAC [START_REF] Daemen | The Pelican MAC Function[END_REF], and to the stream cipher LEX [START_REF] Biryukov | A New 128-bit Key Stream Cipher LEX[END_REF]. The tools found the fastest known attacks on these two constructions, again a gratifying result. This demonstrates in a concrete way that low-data complexity attacks can be leveraged into actual attacks on full versions of some primitives. Our results on AES-based primitives are summarized in Table 9.2.

This chapter is organized as follows: several useful observations on the AES are presented in §9.1. Then, attacks on one, two, three and four AES rounds are given in §9.2, §9.3, §9.4, and §9.5 respectively. A new attack on 6 AES rounds in the known-plaintext model is given in §9. 6. The best known attack on Pelican-MAC is given in §9.7, and the best known attack against LEX is given in §9.8.

Observations on the Structure of AES

In this section we present well-known observations on the structure of AES, that we use in our attacks. We first consider the propagation of differences through SubBytes, which is the only non-linear operation in AES.

Property 9.1 (the SubBytes property). Consider pairs (α = 0, β) of input/output differences for a single S-box in the SubBytes operation. For 129/256 of such pairs, the differential transition is impossible, i.e., there is no pair (x, y) such that x `y = α and S(x) `S(y) = β. For 126/256 of the pairs (α, β), there exist two ordered pairs (x, y) such that x `y = α and S(x) `S(y) = β, and for the remaining 1/256 of the pairs (α, β) there exist four ordered pairs (x, y) that satisfy the input/output differences. Moreover, the pairs (x, y) of actual input values corresponding to a given difference pattern (α, β) can be found instantly from the difference distribution table of the S-box. We recall that the time required to construct the table is 2 16 evaluations of the S-box, and the memory required to store the table is about 2 17 bytes.

The second observation uses the linearity of the MixColumns operation, and follows from the structure of the matrix used in MixColumns: The third observation is concerned with the key schedule of AES, and exploits the fact that most of the operations in the key schedule algorithm are linear. It allows the adversary to get relations between bytes of non-consecutive subkeys (e.g., k r , k r+3 and k r+4 ), while "skipping" the intermediate subkeys.

u = RotBytes(SubBytes(k r [12..15])) `RCON[r + 1] v = RotBytes(SubBytes(k r+1 [12..15])) `RCON[r + 2] w = RotBytes(SubBytes(k r+2 [12..15])) `RCON[r + 3] x = RotBytes(SubBytes(k r+3 [12..15])) `RCON[r + 4]
Then, the subkeys k r+1 , k r+2 , . . . can be represented as linear combinations of (a, b, c, d) (the columns of k r ) and the 32-bit words u, v, w, x, as shown in the following table :   Round

k[0..3] k[4..7] k[8..11] k[12..16] r a b c d r + 1 a `u a `b `u a `b `c `u a `b `c `d `u r + 2 a `u `v b `v a `c `u `v b `d `v r + 3 a `u `v `w a `b `u `w b `c `v `w c `d `w r + 4 a `u `v `w `x b `v `x c `w `x d `x
i) k r+2 [0..3] `kr+2 [8..11] = k r [8..11], ii) k r+2 [4..7] `kr+2 [12..15] = k r [12..15], iii) k r+2 [4..7] `v = k r [4..7], iv) k r+4 [12..15] `x = k r [12..15], v) k r+3 [12..15] = k r [8.
.11] `kr [12..15] `w.

Attacks on One-Round AES

We start our analysis with the simplest case, an adversary who seeks to break one full round of AES (a sequence of AddRoundKey, SubBytes, ShiftRows, MixColumns, and AddRoundKey operations).

Two Known Plaintexts

We first describe a simple but suboptimal attack. It starts by applying SR -1 • M C -1 to the ciphertext difference, to obtain the output differences of all the S-boxes. Since the input differences of the S-boxes are equal to the plaintext difference in the respective bytes, the adversary can consider each S-box independently, go over the 2 8 possible pairs of inputs whose difference equals the plaintext difference, and find the pairs suggesting the "correct" output difference. In each S-box, the expected number of suggested pairs is two, and each such pair gives a suggestion of one byte in the subkey k 0 . 1 Thus, the adversary gets 2 16 suggestions for the entire subkey k 0 , which can be checked by trial encryption.

This attack, whose time complexity is 2 16 encryptions, can be further improved using the relation between the subkeys k 0 and k 1 . If the adversary checks the S-boxes in bytes 0, 5, 10, and 15, she can use the 2 4 = 16 suggestions of output values of these S-boxes to get 16 suggestions for the column k 1 [0..3], along with bytes 0, 5, 10, 15 of k 0 . Similarly, checking bytes 3, 4, 9, 14 yields 16 suggestions for the column k 1 [4..7], along with bytes 3, 4, 9, 14 of k 0 . Combining the suggestions, the adversary obtains 256 suggestions for two columns of k 1 and eight bytes of k 0 . At this stage, the adversary can use the relation k 1 [4] = k 0 [4] `k1 [0], which holds by the AES key schedule, as a consistency check. Only a single suggestion is expected to remain. The value of the remaining 8 bytes of k 0 can be obtained similarly by examining the other eight S-boxes. This improvement reduces the time complexity of the attack to 2 12 S-box applications.

One Known Plaintext

If the data available to the adversary is only a single plaintext, then the attack must use the relation between the two subkeys k 0 and k 1 . If the subkeys were independent, then the information available to the Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you read this will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Huardest Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the impress look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no need for contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you read this will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Huardest Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the impress look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no need for contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you read this will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Huardest Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the impress look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no need for contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you read this will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Huardest Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the impress look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no need for contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you read this will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Huardest Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the impress look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no need for contents, but the length of words should match to the language. adversary would not be sufficient to retrieve the key uniquely. Since any relation between the plaintext and the ciphertext involves the MixColumns operation, it seems likely that any such attack should require the guess of a full column, and thus have complexity of at least 2 32 encryptions. 2 In this setup, the best attack found manually is a guess-and-determine attack by Dunkelman and Keller [START_REF] Dunkelman | The effects of the omission of last round's mixcolumns on aes[END_REF] that has a running time equivalent to that of 2 48 encryptions. The preliminary tool of §8.2 found a faster attack with time complexity of 2 40 encryptions and a negligible memory requirement, while the tool of §8.3 found an even faster attack with time complexity of 2 32 encryptions, and memory requirement of 2 25 bytes. Thus, it seems that we are closing on to the optimum for this variant.

The Preliminary Tool's Attack

The first attack, depicted in Discovering Property 9.4 below is the key step in finding the attack. Given this observation, (human) cryptanalysts would have no problem completing the attack. Yet finding the Property was difficult, and was only "achieved" by the preliminary tool (we mere humans had a hard time figuring out what was going on). The Property shows that the knowledge of a single column in one of the subkeys, along with the input and output values of the round, allows the retrieval of the value of a few "unexpected" additional subkey bytes.

Property 9.4. The knowledge of P, C and the column k 0 [12..15] allows to retrieve two additional bytes of k 0 , namely k 0 [1] and k 0 [8].

The main idea behind this observation is that the linearity of the MixColumns operation interacts with the almost linear key schedule of the AES. This allows to apply the MixColumns operation to the XOR of two columns, and to move backwards one round in the key-schedule where the same column-XOR appears.

Proof. The derivation of the two additional bytes is performed as follows. It is possible to compute z [12] using the knowledge of k 0 [12] as:

z [12] = S(P [12] `k0 [12]).

(9.3)

2. We note that the problem of attacking one round AES without the MixColumns operation with a single known plaintext is studied in [START_REF] Dunkelman | The effects of the omission of last round's mixcolumns on aes[END_REF]. It is shown that 2 16 encryptions are sufficient to retrieve the key. Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you read this tex will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Huardest gefb Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the impression look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no need for a s contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you read this tex will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Huardest gefb Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the impression look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no need for a s contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you read this tex will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Huardest gefb Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the impression look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no need for a s contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you read this tex will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Huardest gefb Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the impression look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no need for a s contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you read this tex will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Huardest gefb Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the impression look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no need for a s contents, but the length of words should match to the language. Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you read this te will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Huardest gef Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the impression look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no need for a contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you read this te will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Huardest gef Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the impression look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no need for a contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you read this te will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Huardest gef Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the impression look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no need for a contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you read this te will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Huardest gef Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the impression look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no need for a contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you read this te will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Huardest gef Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the impression look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no need for a contents, but the length of words should match to the language. Then, the value of z [8] can be retrieved by combining Equations (9.1), (9.2) and (9.3). From z [8] it is possible to compute the subkey byte k 0 [8] using:

k 0 [8] = P [8] `x[8] = P [8] `S-1 (z[8]).
It is possible to use a similar procedure to obtain the value z [13], and retrieve the subkey byte k 0 [1] as:

k 0 [1] = P [1] `x[1] = P [1] `S-1 (z[13]).
We note that if the adversary knows also the value k 0 [2], a similar strategy allows her to retrieve the value k 0 [6]. This derivation is used in the attack described just above. We also note that similar statements hold if the adversary knows k 0 [4..7] or k 0 [8..11].

The Improved Tool's Attack

The second attack, depicted in Figure 9.2, is based on Property 9.5 below. In the first phase of the attack, the adversary guesses the column k 1 [0..3], and retrieves the value of seven additional subkey bytes. This phase is shown in Figure 9.2a, where steps 6 and 10 are based on key schedule arguments, and the rest of the steps use the application of known operations on known values. The second phase of the attack, depicted in Figure 9.2b, starts with retrieving the possible values of bytes k 0 [7] and k 0 [8] using Property 9.5. Steps 6, 7, 8, and 15 use the key schedule, steps 13 and 19 use Property 9.2, and the rest of the steps follow the application of AES' operations to known values.

Again, the key step of the attack is the discovery of Property 9.5. It is even more sophisticated than the previous one and was "found" by the improved tool of §8.3. We went though the output produced by the tool to write a readable description of the solver's steps.

Property 9.5. The knowledge of P, C, and the column k 1 [0..3] allows one to retrieve bytes k 0 [7] and k 0 [8] by a table look-up to a precomputed table of size 2 24 . For each value of k 1 [0..3], there are at most 12 values of (k 0 [7], k 0 [8]), and on average a single value. The time complexity required to generate the table is 2 32 operations.

The proof of this property is slightly more complex than that of the previous property, and is based on obtaining two nonlinear 8-bit relations involving two key bytes (given that other bytes of the key and the state are known). In such a case, we expect on average one solution to these equations (and as our test shows, in reality the maximal number of solutions is 12). Moreover, as there are 2 32 possible systems, one can precompute the acceptable solutions and store them.

Proof. First, we note that the knowledge of the column k 1 [0..3] along with the plaintext and the ciphertext allows us to retrieve one additional byte of k 1 and six bytes of k 0 , as shown in Figure 9.2a.

We denote a = y [8] and b = y [7], and express several other bytes in terms of a, b, and known bytes (from the plaintext, the ciphertext and k 1 [0..3]). Our goal is to obtain a system of two equations in a and b, and to solve it using a precomputed table. This system is constructed in 5 steps.

1. First, note that the third column of k 1 can be expressed as: `k0 [13]), S(P [2] `k0 [2]), b .

k 1 [8..11] = C[8..
(9.4)

In this expression, bytes 2 and 13 of k 0 can be deduced from the 4 guessed bytes in k 1 after the first phase of the attack, as shown in Figure 9.2a.

2.

Let us now turn our attention towards the second column of k 1 . Note that k 1 [5] can be computed following the procedure shown in Figure 9.2a, and the remaining three bytes of k 1 [4.

.7] can be expressed as: [8] `S-1 (a) `P[8], k 1 [6] = k 1 [10] `k0 [10], k 1 [7] = k 1 [3] `S-1 (b) `P [7].

   k 1 [4] = k 1
Again, k 0 [10] (appearing in the expression of k 1 [6]) can be derived from the guessed bytes.

3. Next, we will turn our attention away from the key-schedule, to the second column of z, and in particular to z [4] and z [5]. We first express it in function of the plaintext. It follows from the definition of the encryption and schedule algorithm that:

z[4] = S P [4]
`k0 [4] = S P [4] `k1 [0] `k1 [4] z [5] = S(P [9] `k0 [9]) = S(P [9] `k1 [9] `k1 [5]), (

It must be noted that all key bytes occurring in these expression can be readily derived from a, b and the four guessed key bytes.

4. On the other hand, the whole column z[4..7] can be expressed as a function of the ciphertext:

z[4..7] = M C -1 (w[4..7]) = M C -1 C[4.
.7] `k1 [4..7] .

(9.7)

5. Identifying z [4] and z [5] in (9.6) and (9.7), and exploiting (9.4) and (9.5) results in a system of two equations in the unknowns a, b, and the known plaintext, ciphertext, and bytes that can be derived from k 1 [0..3]. These equations can be written in the form:

∆ 1 = f 1 (a, b) `S(f 2 (a, b) + ∆ 3 ), ∆ 2 = f 3 (a, b) `S(f 4 (a, b) + ∆ 4 ), (9.8)
where f 1 , f 2 , f 3 , and f 4 are fixed known functions, and ∆ 1 , ∆ 2 , ∆ 3 , and ∆ 4 are one-byte parameters depending on the plaintext, the ciphertext, and the guessed subkey bytes. The actual expressions are not given, as they are a bit lengthy, but they can be found in [START_REF] Derbez | Rapport de Stage[END_REF].

Equation (9.8) allows to perform the following two-phase procedure:

Offline Phase: for each of the 2 32 possible values of (a, b, ∆ 3 ∆ 4 ), evaluate the right-hand in (9.8), and find the values of ∆ [7] and k 0 [8] using the equations: [8] `x [8] = P [8] `S-1 (a), k 0 [7] =P [7] `x [7] = P [7] `S-1 (b).

k 0 [8] =P
(9.9)

Reducing the Memory Complexity: We can reduce the 2 32 memory required for storing the solutions to only 2 24 . This is done by fixing ∆ 1 , such that we can deal only with the equations relevant to this specific ∆ 1 in each step of the attack. The specific expression of ∆ 1 makes it easy to enumerate the 2 24 possible first columns of k 1 leading to this specific value of ∆ 1 . The outcome of such an approach is the ability to reduce the number of possible systems that we need to consider in a given time to 2 24 , which reduces the memory complexity without affecting the time complexity. Going into the details would require giving the actual expressions of the ∆'s and the f 's, which the interested reader will find in [START_REF] Derbez | Rapport de Stage[END_REF].

Attacks on Two-Round AES

In this section we consider attacks on two rounds of AES, denoted by rounds 1 and 2. First we present attacks on two full rounds with two known plaintexts. We then study the interesting case of two chosen plaintext. In both settings, the tools vastly outperformed human cryptanalysts. We then look at the case of a single known plaintext. We conclude by presenting an improved attack with two known plaintexts that can be applied if the MixColumns operation in round 1 is omitted (i.e., if we are facing 1.5 rounds). This attack is used as a procedure in our attack on 6-round AES presented in §9.6.

Two Known Plaintexts

The Manually-Found Attack. We first describe an attack found manually by Dunkelman and Keller. This attack with two known plaintexts, depicted in Figure 9.3, is based on Property 9.1. As in the one-round attack with two known plaintexts, we observe that the ciphertext difference allows us to retrieve the intermediate difference after the SubBytes operation of round 2. This observation is used in both phases of the attack. We also "swap" the order of the MixColumns and the AddRoundKey operations of the second round. This can be done since both operations are linear, as long as the subkey k 2 is replaced by the equivalent subkey

u 2 = M C -1 (k 2 ).
In the first phase of the attack, the adversary guesses bytes 0, 5, 10, 15 of k 0 , which allows her to retrieve the intermediate difference in x 2 [0..3] (i.e., just before the SubBytes operation of round 2). Then, Property 9.1 can be applied to the four S-boxes in that column, yielding their actual input/output values in both encryptions. This in turn allows us to obtain k 1 [0..3] (as the values before the AddRoundKey with k 1 are known). At this stage, the adversary tries to deduce and compute as many additional bytes as she can.

In the second phase of the attack, the adversary guesses two additional subkey bytes (k 0 [7] and k 0 [8]) which are sufficient to retrieve the intermediate difference in x 1 [8..11]. Then, Property 9.1 can be applied to the four S-boxes in bytes 8-11 of round 2.

We note that the while the first phase of the attack allows us to obtain several bytes in u 2 , the knowledge of these bytes cannot be combined directly with the knowledge of bytes in k 1 and k 0 , since u 2 does not satisfy the equations of the key schedule algorithm. Hence, in the second phase of the attack, we obtain bytes in both u 2 and k 2 in parallel, and apply Property 9.2 to the relation between k 2 and u 2 , since they are the input and output of a MixColumns operation.

In Phase 1 of the attack, depicted in the top half of Figure 9.3, step 5 is based on Property 9.1, steps 9 and 13 exploit the key schedule, and the rest of the steps are performed using encryption/decryption. In the second phase, depicted in the bottom half of the figure, step 5 is based on Property 9.1, step 12 uses Property 9.2 applied to the relation between k 2 and u 2 , steps 9, 10, 11, and 13 exploit the key schedule, and the rest of the steps are performed using encryption/decryption.

The time complexity of the attack is determined by the fact that 6 subkey bytes are guessed, and for each guess a few simple analysis steps are performed. Hence, the time complexity of the attack is 2 48 .

The Automatically-Found Attack. The improved tool of §8.3 has found an attack with time and memory complexity 2 32 in this setting, vastly outperforming human cryptanalysts. The attack is a meet-in-the-middle whose main ingredient is the possibility to isolate a set of about 2 32 candidates for both k 1 [0..3] and k 1 [12..15] with only 2 32 operations. These 8 bytes are then sufficient to recover the full key instantly.

First, we assume that x 1 [12..15] is known, and we try to derive the value of some other bytes. We can easily obtain the differences in x 1 [12..15]. Then, by linearity of the MixColumns operation, we obtain the Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language.

(a) First half of the attack: The difference in the bytes marked is guessed. The bytes marked by 5 are found using the known input and output differences. Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language.

k 2 ARK k 0 SB SR MC ARK k 1 SB SR ARK u 2 MC M C -1 M C 2
Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like (b) Second Half: The difference in the bytes marked in black is guessed. The bytes marked by 5 are found using the known input and output differences. The bytes marked by 12 are found using the relation between the keys k 2 and u 2 .

Figure 9.3:

The attack with two known plaintexts on two round AES differences in w 0 [12..15]. Using Property 9.1, we also obtain the values and the differences in byte 1, 6, 11 and 12 of x 0 (and thus of k 0 ). Note that the values of w 0 [12..15] and k 1 [12..15] are revealed in the process. Let us denote by A the set of bytes that can be obtained from x 1 [12..15].

Similarly, if the value of x 1 [0..3] is known, then the values (and differences) in byte 0,2, 5,10, 13 and 15 of x 0 and k 0 , as well as w 0 [0..3] and k 1 [0..3] could be recovered. Let us denote these bytes by B.

Even though the bytes in A ∪ B can take 2 64 values, this can efficiently be narrowed down to 2 32 . There exist (at least) 4 linear relationships between bytes of A and those of B:

f 1 (A) = g 1 (B) f 2 (A) = g 2 (B) f 3 (A) = g 3 (B) f 4 (A) = g 4 (B)
Thanks to these relations, a tuple of values from A is associated to a single tuple of values of B on average: for each one of the 2 32 tuples of values in A, evaluate the f i 's and store the result in a hash table. Then for each one of the of the 2 32 tuples of values in B, evaluate the g i 's, and loop-up the corresponding value(s) in A.

Two of these linear relations can be obtained very simply: given k 1 [0..3] and k 1 [12..15], we deduce k 2 [0..3]. From there, it is also possible to compute bytes 0, 5, 10 and 15 from x 1 by partial decryption. Amongst these, x 1 [15] occurs in A while x 1 [0] occurs in B. This already gives two linear equations connecting A and B.

Two other constraints can be obtained in a more sophisticated way. First, we notice that given the key bytes in A and B, it is possible to retrieve the full k 2 except byte 4, 8 and 12 by just exploiting the key-schedule and Property 9.3. Focusing on the last two columns of w 1 , we find that 3 bytes are known in each column in w 1 and two bytes are known in each column of z 1 . Thanks to Property 9.2, this gives a linear relation for between the known bytes of each column.

A Three Known Plaintext Variant

We note that if the adversary is given three known plaintexts, then a simpler attack can be applied, with the same complexity, namely 2 32 encryptions. The adversary applies the first phase of the manually-found attack twice (for the pairs (P 1 , P 2 ) and (P 1 , P 3 )), and uses the values of k 1 [0..3] retrieved in that phase for a consistency check. Since for the correct guess of bytes 0, 5, 10, 15 of k 0 , both pairs suggest the same value of the four bytes of k 1 , and for an incorrect guess, the two pairs suggest the same value only with probability 2 -32 , this allows us to discard most of the wrong guesses. Then, the adversary performs the second phase of the attack only for the remaining guesses, and thus the time complexity of the attack is dominated by the first step, whose complexity is 2 32 encryptions.

A Two Chosen Plaintext Variant

If the adversary is given two chosen plaintexts, then the time complexity can be reduced. We first describe an attack found manually by Dunkelman and Keller, with a complexity of 2 28 encryptions. We will next describe an attack found by the improved tool, with complexity 2 8 (!).

The Manually-Found Attack. In order to improve on the known-plaintext scenario, the adversary asks for the encryption of two plaintexts which differ only in four bytes composing one column. Figure 9.4 shows the difference pattern. In this case, at the end of round 1, there are exactly 127 possible differences in each column. For each such difference, the adversary can apply Property 9.1 to the four S-boxes of the column, and obtain one suggestion on average for the actual values after the SubBytes operation of round 2. Combining the values obtained from all four columns, the adversary gets about 2 28 suggestions for the entire state after the SubBytes operation of round 2, and each such suggestion yields a suggestion of the subkey k 2 . Thus, the time complexity of the attack is 2 28 encryptions.

The Automatically-Found Attack. The adversary also asks for the encryption of two plaintexts which differ only in four bytes composing one column. The attack relies on Property 9.6 below, which cleverly uses the linearity in the key-schedule of the AES. Property 9.6. For all i ≥ 1 we have the following equations: ii) z i-1 [8..11] `zi [4..7] `zi [8..11] = M C -1 x i [8..11] `xi+1 [4..7] `xi+1 [8..11] iii) z i-1 [12..15] `zi [8..11] `zi [12..15] = M C -1 x i [12..15] `xi+1 [8..11] `xi+1 [12..15] Proof. Here again the theme is to exploit the interaction between the linearity of MixColumns and the linear operations in the key-schedule. We only prove the first equation (the proofs of the other two is quite similar). Expressing y in terms of w gives:

i) z i-1 [4..7] `zi [0..3] `zi [4..7] = M C -1 x i [4..7] `xi+1 [0..3] `xi+1 [4..7]
z i-1 [4..7] = M C -1 (w i-1 [4..7])
We can relate w i-1 to x i thanks to the AddRoundKey operation: 7] `xi [4..7])

z i-1 [4..7] = M C -1 (k i [4..
And there, we can exploit the linearity of the key-schedule: 3] `ki+1 [4..7] `xi [4..7])

z i-1 [4..7] = M C -1 (k i+1 [0..
The subkeys can then be expressed back in terms of w and x: 3] `wi+1 [4..7] `xi+1 [4..7] `xi [4..7])

z i-1 [4..7] = M C -1 (w i+1 [0..3] `xi+1 [0..
And then, the linearity of MixColumns can be exploited as well: 3] `zi [4..7] `MC -1 (x i [4..7] `xi+1 [0..3] `xi+1 [4..7]) .

z i-1 [4..7] = z i [0..
Assume that x 0 [0] is known: it is possible to deduce therefrom the value (and the difference) in z 0 [0], and finally the difference in x 1 [0..3] (by Property 9.2). Because the difference in y 1 [0..3] can be deduced from the ciphertexts, it follows that the actual values in x 1 [0..3] can be deduced thanks to Property 9.1. This also reveals bytes 0,7,10 and 13 of z 1 (observe Figure 9.4). It follows that if x 0 [0..3] were known, then the key could easily be deduced. The attack works by constructing a set of possibles values of x 0 [0..3] of expected size 256 in which the actual solution is guaranteed to be found. This process has a complexity of the order of 256 encryptions, and therefore dominates the complexity of the attack. A pseudo-code of the attack is shown in Algorithm 9.1. The attack works in 3 stages, each one using property 9.6 in a different way.

1. We first show that once x 0 [1] is known, then x 0 [0] can be determined using Property 9.6, item iii).

The equation is:

z 0 [12..15] `z1 [8..11] `z1 [12..15] = M C -1 x 1 [12..15] `C[8..11] `C [12..15] ,

We enumerate the possible values of x 0 [1] and compute all the bytes marked "1" in Figure 9.4. At this stage, the right-hand side the equation is fully known. In the left-hand side, z 0 [13] and z 1 [9] are known, and therefore z 1 [13] can be deduced by projecting the (vector) equation on the second component. The actual values and the differences can then be deduced in x 1 [1], which reveals the difference in z 0 [0] (by Property 9.2). The actual values in x 0 [0] can then be deduced by Property 9.1. We expect on average one possible value of x 0 [0] per value of x 0 [1].

Algorithm 9.1 Pseudo-code of the attack on 2 rounds using 2 chosen plaintexts.

let i = z 0 [10] `(0d, 09, 0e, 0b) • u in 6: T 2 [i] ← T 2 [i] ∪ {x 0 [2]} 7:
end for let i = z 0 [7] `(0b, 0d, 09, 0e) • u in 12:

T 3 [i] ← T 3 [i] ∪ {x 0 [3]} 13:
end for 14:

for all x 0 [1] ∈ F 2 8 do
Retrieve the key 15:

Compute z 0 [13], x 1 [12..15], z 1 [3], z 1 [6], z 1 [9]
, z 1 [12] 16:

Compute z 1 [13] Using property 9.6

17:

Compute x 1 [1], the difference in z 0 [1], and x 0 [0]

18:

Compute z 0 [0], x 1 [0..3], z 1 [0], z 1 [7]
and z 1 [10] 19:

Read possible value(s) of x 0 [2] in T 2 z 1 [6] `z1 [10] 20:

Read possible value(s) of x 0 [3] in T 3 z 1 [3] `z1 [7] 21:

Compute k 2 and check for correctness

22:
end for 23: end function

The third coordinate of the right-hand side can be entirely deduced from x 0 [2]. We can therefore build a table yielding x 0 [2] from the third coordinate of the right-hand side of (♣), as shown in Algorithm 9.1, lines 2-7. We perform the same operations with x 0 [3], using Property 9.6, equation i):

z 1 [0..3] `z1 [4..7] = z 0 [4..7] `MC -1 x 1 [4..7] `C[0..3] `C[4..7] , (♥)
Here, the fourth coordinate of the right-hand side can be entirely deduced from x 0 [3]. We therefore build a table yielding x 0 [3] from the third coordinate of the right-hand side of (♥) (as shown in Algorithm 9.1, lines 8-13).

3. Once the two tables T 2 and T 3 have been built, we are ready to derive x 0 [2] and x 0 [3]. For this purpose, we enumerate the values of x 0 [1], derive x 0 [0] as explained above. The third component of equation (♣) and the fourth component of (♥) can be computed, and thanks to T 2 and T 3 the corresponding values of x 0 [2] and x 0 [3] can be retrieved in constant time, resulting in an average of 256 suggestion for the first column of x 0 . From there, k 2 can be deduced, and the key-schedule can be inverted to retrieve k 0 .

One Known Plaintext

Both Dunkelman and Keller, and the preliminary tool of §8.2 independently found a 1 known-plaintext attack against two full rounds. One possible version of the attack, depicted in Figure 9.5, is based mainly on Property 9.3 (the "jumps" in the key-schedule) and on many simpler key schedule considerations.

In the first phase of the attack, the adversary guesses nine subkey bytes (marked in black in the upper part of the figure). Step 7 uses Property 9.3(3), step 8 uses Property 9.3(2), steps 5, 6, and 9 use the key schedule, and the remaining steps are computed using the AES algorithm.

In the second phase of the attack, the adversary guesses one state byte (marked in black in the lower part of the figure). Steps 9 and 13 are based on Property 9.3(1), steps 1, 5, 29, and 32 use Property 9.2, steps 3,7,8,10-12, and 21-24 use the key schedule, and the remaining steps are performed by applying AES' operations on known values.

The time complexity of the attack is determined by the amount of bytes which are guessed. Namely, as the adversary guesses 10 bytes, the time complexity of the attack is 2 80 encryptions. Because the automated tools are quite flexible, we could check without any effort that the SQUARE [START_REF] Daemen | The block cipher square[END_REF] block cipher was a bit less strong than its successor (the AES): in the same setup, the preliminary tool finds an attack with 9 guessed bytes, i.e., a time complexity of 2 72 encryptions. Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language.

ARK k 0 SB SR MC ARK k 1 SB SR MC ARK k 2 1 1 1 1 1 1 2 2
Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language. Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y

A Time-Memory Tradeoff

The time complexity can be reduced at the expense of enlarging the memory complexity, using non-linear equations and a precomputed table as in Property 9.5. This improved attack was found by the improved tool of §8.3. In order to achieve this reduction, the adversary performs the following precomputation: Let bytes 4 and 14 of k 0 be denoted by b and c. 3 It is possible to represent all the bytes found during the attack procedures in terms of b, c, the plaintext, the ciphertext, and the other 8 key bytes which are guessed in the original attack procedure. At the end of the deduction procedure, after a suggestion for the full subkey k 2 (in terms of b and c) is obtained, the adversary decrypts the ciphertext through the last round and obtains a suggestion for bytes 4 and 5 of k 1 . These bytes can be used as a consistency check, as they can be retrieved independently by the key schedule algorithm, using the suggestion of k 2 . This consistency check supplies two non-linear equations in b and c, and it turns out that the equations are of the following form:

a 5 =f 0 (b, c, a 0 , a 1 , a 2 , a 3 , a 4 ), a 7 =f 1 (b, c, a 0 , a 1 , a 2 , a 4 , a 6 ), (9.10)
where f 0 and f 1 are fixed known functions, and a 0 , a 1 , . . . , a 7 are one-byte parameters depending on the plaintext, the ciphertext, and the eight additional subkey bytes guessed in the original attack. Since the values of a 0 , a 1 , . . . , a 7 are very cumbersome, we do not present them in this paper, and refer the reader to [START_REF] Derbez | Rapport de Stage[END_REF]. Hence, it is possible to compute in advance the values of (b, c) corresponding to each value of (a 0 , a 1 , . . . , a 7 ), and store them in a table. In the online phase of the attack, the adversary guesses only 8 subkey bytes (instead of 10), computes the values of (a 0 , a 1 , . . . , a 7 ), and uses the table in order to retrieve b and c. The rest of the attack is similar to the original attack.

The time complexity of the resulting attack is reduced to 2 64 , but on the other hand, the attack requires 2 65 bytes of memory.

The memory requirement can be further reduced to 2 49 bytes by observing that the knowledge of a 1 , a 4 , and the six subkey bytes k 0 [6], k 0 [11], k 0 [12], k 1 [8], k 1 [13], k 1 [15] allows one to deduce the value of the two remaining subkey bytes guessed in the modified attack. Using this observation, the attack procedure can be slightly changed as follows: The adversary starts with guessing the values of a 1 and a 4 , and prepares the table for the given value of a 1 , a 4 . In the online phase of the attack, the adversary guesses the six subkey bytes k 0 [6], k 0 [11], k 0 [12], k 1 [8], k 1 [13], k 1 [15], deduces the value of the two additional required subkey bytes, and performs the original attack. This change reduces the memory complexity to 2 49 bytes (since the table is constructed according to 6 byte parameters instead of 8), while the time complexity remains unchanged at 2 64 .

Improved Attack When the Second MixColumns is Omitted

In §9.6 we present a differential attack on 6-round AES which uses as a subroutine a 2-round attack on AES. In the attack scenario, the two rounds attacked in the subroutine are the last two rounds of AES, i.e., a full round and a round without the MixColumns operation. In this section we present an improved variant of the attack with two known plaintexts presented above that applies in this scenario. We note that this attack gives another evidence to the claim made in [START_REF] Dunkelman | The effects of the omission of last round's mixcolumns on aes[END_REF] that the omission of the the last MixColumns operation in AES reduces the security of the cipher.

The attack, presented in Figure 9.6, consists of two phases. In the first phase, the first 13 steps are identical to the first 13 steps of the attack on two full rounds presented in §9.3.1 above. Steps 14-20 and 25 exploit the key schedule, and the rest of the steps apply AES' operations to known values.

The second phase uses Property 9.3 and simpler key schedule observations. Step 1 uses Property 9.3(1,2), step 20 uses Property 9.3(1), step 9 uses Property 2, steps 2-4,11,12,16-19, and 25 use the AES key schedule, and the remaining steps are performed using partial encryption or decryption.

Attacks on Three-Round AES

In this section we consider attacks on three rounds of AES, denoted by rounds 1-3. First we present a simple attack with two chosen plaintexts, then we present a bit more complex meet-in-the-middle attack with 9 known plaintexts, and finally we present a very time-consuming attack with a single known plaintext. Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language. Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and look. This text should contain all letters of the alphabet and it should be written in of the original language. There is contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If y will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like

Two Chosen Plaintexts

The 2-round attack of §9.3.3 can easily be leveraged into a 3-round attack of complexity 2 16 , thus improving on an attack found manually by Dunkelman and Keller with complexity 2 32 , and described in [BDD + 10].

In this improved attack, the adversary asks for the encryption of two plaintexts which differ only in the first byte. By guessing k 0 [0], the adversary obtains the differences in x 1 [0..3]. This is sufficient to apply the attack of §9.3.3 to rounds 2 and 3. The complexity of the process is therefore 2 16 encryptions.

Improvement to the Piret-Quisquater Fault Attack

In the Piret-Quisquater fault attack, against the full AES, an unknown difference is introduced in byte 0 of the internal state x 7 . The adversary observes the output difference, and recovers the secret key in time 2 32 [START_REF] Piret | A Differential Fault Attack Technique against SPN Structures, with Application to the AES and KHAZAD[END_REF]. We show an improved procedure (found by the improved tool of §8.3) that recovers the key after the equivalent of 2 24 encryptions.

The attack considers the last three rounds (rounds 8, 9 and 10), but to be consistent with the other three-round attack, we number the attacked rounds 1, 2 and 3. In this setting, the plaintext is unknown, and the only information is that there is a non-zero difference δ in x 0 [0]. For the sake of simplicity, we describe the attack assuming that the final MixColumns operation has not been removed. The attack can be replayed without it, but some details become significantly messier.

One possible way to view this attack would be to guess the "fault" difference δ, to guess the actual value of x 0 [0], to derive the difference in x 1 [0..3], and to apply the two-round attack of §9.3.3 to rounds 2-3. However, it is possible to give a more direct yet pleasantly simple description of the key-recovery.

guesses subkey material in k 0 and k 3 , and obtains a consistency check on the intermediate difference after the ShiftRows operation of round 2.

Concretely, denote the intermediate values in byte 0 after the ShiftRows operation of round 2 by X 1 , X 2 , . . . , X 9 . In the first phase of the attack, the adversary guesses bytes 0, 7, 10, 13 of the equivalent subkey u 3 and partially decrypts the ciphertexts through the last round (obtaining the actual values in x 3 [0..3]). Then, using the linearity of the MixColumns operation, the adversary computes the differences X 1 `X2 , X 1 `X3 , . . . , X 1 `X9 , and stores their concatenation (a 64-bit vector) in a hash table. In the sec- ond phase of the attack, the adversary guesses bytes 0, 5, 10, 15 of k 0 and byte k 1 [0] and by partial encryption of the plaintexts, obtains the values of X 1 `X2 , X 1 `X3 , . . . , X 1 `X9 , and checks whether their concatena- tion appears in the hash table. This consistency check is a 64-bit filtering, and thus only 2 72 • 2 -64 = 2 8 key suggestions are expected to remain. By repeating the procedure with the three other columns, the adversary obtains about 2 32 suggestions for the full subkey k 0 (along with many other subkey bytes), which can be checked by exhaustive key search. The time complexity of the attack is about 2 40 encryptions, and the memory requirement is 2 35 bytes of memory.

One Known Plaintext

The preliminary tool of §8.2 found a guess-and-determine attack with a single known plaintext, depicted in Figure 9.8. The attack consists of two phases.

In the first phase (shown in the top part of the figure) the adversary guesses 15 subkey bytes, and uses key schedule considerations deduce numerous additional subkey bytes in the four subkeys k 0 , k 1 , k 2 , and k 3 .

Step 4 of the deduction uses Property 9.3 (1), and the other steps use the key schedule algorithm directly.

The second phase (shown in the bottom part of the figure) is the meet-of-the-middle part of the attack. Using the known subkey bytes, the adversary partially encrypts the plaintext and decrypts the ciphertext and obtains sufficient information in order to apply Property 9.2 to the MixColumns operations of rounds 2 and 3. Steps 13 and 17 of this part use Property 9.2, and the other steps use AES' operations and the knowledge obtained in previous steps.

Since the adversary guesses 15 key bytes, the time complexity of the attack is 2 120 encryptions. As in the single-plaintext attacks on one-round and two-round AES, the adversary can reduce the time complexity at the expense of enlarging the memory requirement, using non-linear equations and a precomputed table. The time complexity of the resulting attack is 2 104 encryptions, and the memory requirement is 2 49 bytes. Since the technique is similar to the improvement of the 2-round attack presented in §9.3.4, and the obtained equations are quite cumbersome, we do not present the improvement here and refer the reader to [START_REF] Derbez | Rapport de Stage[END_REF].

Attacks on Four-Round AES

In this section we consider attacks on 4-round AES. The improved tool of §8.3 found a single knownplaintext attack of complexity approximately 2 120 operations. It is unclear that this "attack" can be implemented faster than exhaustive search, and our (limited) efforts to describe it in a human-readable way have failed so far.

No other known plaintext attacks could be found manually, so we turned our attention to chosen-plaintexts attacks. The well-known "square" attack on 4 rounds requires 256 chosen plaintexts and the equivalent of 2 14 encryptions. Dunkelman and Keller manually found attacks with 10,5 or 2 chosen plaintexts with respective time complexities 2 40 , 2 64 and 2 104 . The improved tool of §8.3 automatically found a practical attack using four plaintext differing only in one byte, of complexity about 2 32 .

We note that these attacks can be transformed into known plaintext attacks using the standard birthdaybased transformations, but these usually result in a high data complexity. We do not present the attacks on 2 and 4 chosen plaintext as they are quite complex. The attacks using 5 and 10 chosen plaintexts are used in §9.8.3 below to give attacks on a modified version of the LEX stream cipher.

Ten Chosen Plaintexts

The attack with 10 chosen plaintexts is similar to the 3-round attack with 9 known plaintexts presented in §9.4.3. The adversary asks for the encryption of ten plaintexts which differ only in bytes 0,5,10,15. Then she guesses subkey material in the subkeys k 0 , k 1 and the equivalent subkeys u 3 and u 4 , and obtains a consistency check on some intermediate difference after the MixColumns operation of round 2.

Let us denote the intermediate values in byte 0 after the MixColumns operation of round 2 by X 1 , X 2 , . . . , X 10 . In the first phase of the attack, the adversary guesses bytes 0, 7, 10, 13 of the equivalent subkey u 4 and byte 0 of the equivalent subkey u 3 and partially decrypts the ciphertexts through the last two rounds obtaining the actual values in the byte x 3 [0]. (Note that reversing the order of the MixColumns and AddRoundKey Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you r will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Hu Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no n contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you r will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Hu Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no n contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you r will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Hu Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no n contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you r will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Hu Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no n contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you r will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Hu Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no n contents, but the length of words should match to the language.

(a) The first half of the attack only uses the key-schedule. All bytes but one are guessed in k 3 (marked in black), and the diagram shows in which order other subkey bytes can be deduced using the key relations.

ARK

k 0 Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you r will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫H Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no contents, but the length of words should match to the language.

SB SR MC ARK k 1 SB SR MC ARK k 2 SB SR MC ARK k 3 1 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2
Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you r will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫H Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you r will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫H Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the operations in the two last rounds allows her to obtain this intermediate value by guessing only 40 subkey bits). Then, using the linearity of the AddRoundKey operation, the adversary computes the differences X 1 `X2 , X 1 `X3 , . . . , X 1 `X10 , and stores their concatenation (a 72-bit vector) in a hash table.

In the second phase of the attack, the adversary guesses bytes 0, 5, 10, 15 of k 0 and the byte k 1 [0]. By the structure of the chosen plaintexts, this allows her to compute the differences between pairs of intermediate values w 2 [0..3] (since the actual values in byte 0 before the MixColumns operation of round 2 are known by partial encryption, and the difference in bytes 1, 2, 3 is zero). Thus, the adversary obtains the values of X 1 `X2 , X 1 `X3 , . . . , X 1 `X10 , and checks whether their concatenation appears in the hash table. This consistency check is a 72-bit filtering, and thus only 2 80 • 2 -72 = 2 8 key suggestions are expected to remain. By repeating the procedure with the three other columns (from the ciphertext side), the adversary obtains about 2 32 suggestions for the full equivalent subkey u 4 (along with many other subkey bytes), which can be checked by exhaustive key search. The time complexity of the attack is about 2 40 encryptions, and the memory requirement is about 2 43 bytes of memory.

Five Chosen Plaintexts

If only five chosen plaintexts are available to the adversary, she can perform a variant of the attack described above, at the expense of enlarging the time and memory complexities. The plaintexts are chosen as before, but more key material is guessed: from the ciphertext side, the adversary guesses bytes 0, 7, 10, 13 of u 4 and bytes 0, 1, 2, 3 of u 3 , and from the plaintext side, the adversary guesses bytes 0, 5, 10, 15 of k 0 and bytes 0, 1, 2, 3 of k 1 . This allows her to get a consistency check on the intermediate difference at the end of round 2 in bytes 0, 5, 10, 15 (instead of only byte 0), and thus, the four pairs which can be extracted from the data supply a 128-bit filtering and only the correct key suggestion is expected to remain. Finally, the adversary repeats the attack procedure with three other columns from the ciphertext side, and obtains a single suggestion (or a few suggestions) for the full equivalent subkey u 4 . The time complexity of the attack is about 2 64 encryptions, and the memory requirement is about 2 68 bytes.

Four Chosen Plaintexts

The improved tool of section 8.3 found a practical attack requiring only 4 chosen plaintexts and the time equivalent of about 2 32 encryptions. The four plaintext only differ in byte 0 of the plaintext (but they must be pairwise different). We use the notation x (j) i to denote the j-th message. In a first phase, we construct 16 hash tables T 0 , . . . , T 15 , which are subsequently used in the remaining steps of the attack. The table T is constructed according to the following steps:

y (0) 2 [ ] `y(1) 2 [ ], y (0) 2 [ ] `y(2) 2 [ ], y (0) 2 [ ] `y(3) 2 [ ] → x (0) 0 [0], x (0) 1 [r 1 ]
in the hash table T .

The hash tables are now used in the following way: enumerate the values of x (0) 3 [0..3], compute the differences in byte 0, 5, 10 and 15 of y 2 , and use the differences to look-up in T 0 , T 5 , T 10 and T 15 . Only keep values of x 3 [0..3] that suggest the same value of x (0) 0 [0] (there should be about 2 8 of them). We implemented the attack, and we could indeed verify in practice that this procedure isolates a set of about 2 8.5 candidates for the first column of x 3 . It can then be repeated for the other three columns, and we are left with about 2 34.5 candidates for the full x 3 , each one of which suggest a full key (partial encryption reveals w 3 , which in turns reveal k 4 and the key-schedule can be inverted back to k 0 ).

This could be refined a little bit by only considering the quadruplets of columns that suggest the same values of x 1 [0..3] (0) (and there should very likely be very few of them). This would avoid testing 2 32 Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you read this text, you will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Huardest gefburn≪. Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the impression of the look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no need for a special contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you read this text, you will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Huardest gefburn≪. Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the impression of the look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no need for a special contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you read this text, you will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Huardest gefburn≪. Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the impression of the look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no need for a special contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you read this text, you will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Huardest gefburn≪. Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the impression of the look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no need for a special contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. If you read this text, you will get no information. Really? Is there no information? Is there a difference between this text and some nonsense like ≫Huardest gefburn≪. Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written and the impression of the look. This text should contain all letters of the alphabet and it should be written in of the original language. There is no need for a special contents, but the length of words should match to the language.

Differential Attack on 6-Round AES

The design of AES follows the wide trail design strategy, which assures that the probability of differentials is extremely low, even for only four rounds of the cipher. For example, it was proved in [PSC + 02, PSLL03], that any 4-round differential of AES has probability of at most 2 -110 . Hence, it is widely believed that no regular differential attack can be mounted on more than 5 rounds of AES. Furthermore, the best currently known differential attack on AES-128 is on only four rounds, and all known attacks on 5 and more rounds use "more sophisticated" techniques like impossible differentials, boomerangs, or Squares.

In this section we show that the low data complexity attack on 2-round AES presented in §9.3.6 can be leveraged to a differential attack on 6-round AES. Although the data complexity of the resulting attack is high, the data complexity of its known plaintext variant is still smaller than the data complexity of the best known attack on 6-round AES in the known plaintext model. While our attack certainly does not threaten the security of AES, it shows that its security with respect to conventional differential attacks is lower than expected before.

As in most published attacks on reduced-round variants of AES, we assume that the MixColumns operation in the last round is omitted, like in the full AES. We were not able to extend the attack to the case where the last MixColumns operation is not omitted. This gives another evidence to the claim made in [START_REF] Dunkelman | The effects of the omission of last round's mixcolumns on aes[END_REF] that the omission of the last round MixColumns affects the security of AES.

Our 6-round attack is based on the following 3-round truncated differential: The input difference in all bytes except for byte 0 is zero, and the output difference in all bytes except for bytes 0, 5, 10, 15 is zero. We depict the differential in Figure 9.9. A pair satisfying the input and output requirements of the differential in rounds 2-4 is called a right pair.

Consider a right pair (P, P ). By the structure of AES, the intermediate difference at the input of round 3 is zero in all bytes except for 0, 1, 2, 3. Thus, there are at most 2 32 possible differences in the input of the SubBytes operation of round 4. On the other hand, since the difference at the output of round 4 is zero in all bytes except for 0, 5, 10, 15, there are only 2 32 possible differences after the SubBytes operation of round 4. Note that by Property 9.1, the input and output differences of a SubBytes operation yield a single suggestion (on average) for the actual values. Therefore, if (P, P ) is a right pair, then there are only 2 64 possibilities of the corresponding actual values after the SubBytes of round 4 (or equivalently, for the actual values after the MixColumns operation of round 4).

This observation allows us to mount the following known plaintext attack:

1. Ask for the encryption of 2 3. For each of the remaining pairs, assume that it is a right pair, and for each of the 2 64 possible actual values after the MixColumns operation of round 4, apply the attack presented in §9.3.6 on rounds 5-6. Note that the 2-round attack requires that the difference in the four bytes x 2 [0..3] in the attacked variant is non-zero, and this condition is indeed satisfied in our attack (for the state x 6 which corresponds to x 2 in the two-round attack).

Since the time complexity of the 2-round attack presented in §9.3.6 is 2 32 encryptions, the overall complexity of the attack is 2 24 • 2 64 • 2 32 = 2 120 encryptions. The data complexity of the attack is 2 108.5 known plaintexts, which is smaller than the data complexities of the previously known attacks in the known plaintext model (see, e.g., [CKK + 01]).

A Forgery Attack Against Pelican-MAC

Pelican-MAC [START_REF] Daemen | The Pelican MAC Function[END_REF] is a Message Authentication Code designed by Daemen and Rijmen in 2005. It is an instance of the more general ALRED construction by the same authors, which is reminiscent of CBC-MAC but aims at greater speed [START_REF] Daemen | A New MAC Construction ALRED and a Specific Instance ALPHA-MAC[END_REF]. MACs derived from the ALRED construction enjoy some level of provable security: it is shown that breaking an ALRED MAC requires breaking the underlying block cipher or generating an inner collision, which presumably requires at least 2 n/2 queries if the block cipher is n-bit wide. Pelican-MAC works as follows:

1. The internal state (an AES state) is initialized to x 0 = AES K (0).

2. The message is split in 16-byte chunks, and each chunk is processed in two steps: it is XORed to the internal state, and 4 keyless AES rounds are applied (the AddRoundKey operation is skipped).

3. Finally, the full AES is applied with the key K to the internal state, which is then truncated and returned as the tag.

In this construction, recovering the internal state x 0 is sufficient to perform nearly-universal forgeries: first the adversary asks the MAC of an arbitrary message. Given her knowledge of x 0 , she can compute the internal state x last just before the full AES is applied and the tag T is returned. Then, given an arbitrary message M , she computes the internal state x M after M has been fully processed. Then, she knows that Pelican-MAC K (M x M `xlast ) = T , without querying the MAC (the extra message block sets the internal state to x last , which is known to result in the tag T ).

The best published attacks against Alpha-MAC (another ALRED construction) and Pelican-MAC has been recently found by Zheng Yuan, Wei Wang, Keting Jia, Guangwu Xu, Xiaoyun Wang [YWJ + 09] and aim at recovering the initial secret internal state. For Alpha-MAC, after having found an internal state collision (this requires 2 65 queries), the internal state is recovered with a guess-and-determine attack that makes about 2 64 simple operations. For Pelican-MAC, an impossible differential attack recovers the internal state with data and time complexity 2 85. 5 .

The general idea of our attack on Pelican-MAC is to find a single collision in the internal state, found by injecting message blocks following a fixed truncated differential characteristic. Then, the state recovery problem has been encoded in equations and given to the improved tool of §8.3. It must be noted that an attack with the same global complexity has been independently found time by Dunkelman, Keller and Shamir [START_REF] Orr Dunkelman | Alred blues: New attacks on aes-based mac's[END_REF], using impossible differential techniques. The "state-recovery" phase presented here is faster though. However, these authors also give attacks against 5-round and 6-round Pelican-MAC.

Our Attack. We now present our attack against Pelican-MAC, with time and data complexity 2 64 . We pick an arbitrary message block M 1 and query the MAC with 2 64 random two-block messages M 1 M 2 , and store the (message,tag) pair in a table. Then, we query the MAC on (M 1 `∆) M 2 , where ∆ is zero everywhere except on the first byte, and M 2 is random. When the tags collide, we check whether there is also a collision in the internal state by checking if:

MAC K (M 1 M 2 M 3 ) = MAC K (M 1 `∆) M 2 M 3
for several random message blocks M 3 . If all the resulting tags collide, then we known that an internal collision occurred after the first two blocks with overwhelming probability, and we have:

AES 4 (x 0 `M1 ) `M2 = AES 4 (x 0 `M1 `∆) `M 2
In other terms, the input difference ∆ goes to the output difference M 2 `M 2 though 4 keyless AES rounds.

The most likely differential characteristic is the one shown in Figure 9.10, even though there could be accidental difference cancellations with small probability.

We then write down the state-recovery problem as a system of equations: two unknown states with a known one-byte difference yields two unknown states with a known (full) difference. The improved tool of §8.3 quickly found 4 an attack that runs in time and space about 2 32 , and which is summarized by Figure 9.10. Property 9.2 tells us that if α, β, γ and δ denote the differences in z 1 , then the differences in x 2 are:

    02α β γ 03δ α β 03γ 02δ α 03β 02γ δ 03α 02β γ δ    
The state-recovery proceeds as follows:

1-a. Guess the values in x 3 [0..3] and obtain the differences (thanks to the output difference).

1-b. Partially decrypt to get suggestions for α, β, γ and δ (using Property 9.2).

4. it also found an attack with a smaller memory consumption 2 24 , but the improved attack is much more complicated to describe

Odd Round Even Round

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. I will get no information. Really? Is there no information? Is there a difference between this text and some nonsense li Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written a look. This text should contain all letters of the alphabet and it should be written in of the original language. There contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. I will get no information. Really? Is there no information? Is there a difference between this text and some nonsense li Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written a look. This text should contain all letters of the alphabet and it should be written in of the original language. There contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. I will get no information. Really? Is there no information? Is there a difference between this text and some nonsense li Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written a look. This text should contain all letters of the alphabet and it should be written in of the original language. There contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. I will get no information. Really? Is there no information? Is there a difference between this text and some nonsense li Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written a look. This text should contain all letters of the alphabet and it should be written in of the original language. There contents, but the length of words should match to the language.

Hello, here is some text without a meaning. This text should show, how a printed text will look like at this place. I will get no information. Really? Is there no information? Is there a difference between this text and some nonsense li Kjift -Never mind! A blind text like this gives you information about the selected font, how the letters are written a look. This text should contain all letters of the alphabet and it should be written in of the original language. There contents, but the length of words should match to the language. 1-c. Store bytes 0-3 of x 3 in a hash table T 0 indexed by (α, β, γ, δ) 2. Repeat the process with the second column of x 3 . Store bytes 4-7 of x 3 in a table T 1 indexed by (α, β, γ, δ).

3. Repeat the process with the third and fourth column of x 3 . Build tables T 2 and T 3 4. Enumerate (α, β, γ, δ). Look-up T 0 , T 1 , T 2 and T 3 and retrieve the parts of x 3 corresponding to (α, β, γ, δ), if present.

5. if (α, β, γ, δ) occurs in the 4 tables, then we get a complete suggestion for x 3 . Decrypt 3 rounds and recover x 0 . Check if the input difference is right.

Alpha-MAC. Obviously, we cannot overally improve on the attack of [YWJ + 09], since finding the internal state collision dominates the running time of their attack. However, it is noteworthy that the tool found a state-recovery procedure that requires only 2 32 elementary operations and memory, when the first input message difference contains only one active byte. This is much more efficient than its counterpart in [YWJ + 09].

A Key-Recovery Attack Against LEX

LEX is a stream cipher presented by Biryukov as an example of the leak extraction methodology of stream cipher design [START_REF] Biryukov | A New 128-bit Key Stream Cipher LEX[END_REF][START_REF] Biryukov | The Design of a Stream Cipher LEX[END_REF]. In this methodology, a block cipher is used in the OFB mode of operation, where after each round of the cipher, some part of the intermediate encryption value is output as part of the key stream. LEX itself uses the AES as the block cipher.

In the initialization step of LEX, the publicly known IV is encrypted by AES under the secret key K to obtain S = AES K (IV ). Actually, LEX uses a tweaked version of AES where the AddRoundKey before the first round is omitted, and the MixColumns operation of the last round is present. Then, S is repeatedly encrypted in the OFB mode of operation under K, where during the execution of each encryption, 32 bits of the internal state are leaked in each round. These state bits compose the key stream of LEX. The state bytes used in the key stream are shown in Figure 9.11. After 500 encryptions, another IV is chosen, and the process is repeated. After 2 32 different IVs, the secret key is replaced. It follows that with a given key LEX can only generate 2 46.3 bytes of keystream.

Prior Art

LEX was submitted to the eSTREAM competition (see [START_REF] Biryukov | A New 128-bit Key Stream Cipher LEX[END_REF][START_REF] Biryukov | The Tweak for LEX-128[END_REF]). Due to its high speed (2.5 times faster than the AES in counter mode), fast key initialization phase (a single AES encryption), and expected security (based on the security of AES), LEX was considered a very promising candidate and selected to the third (and final) phase of evaluation. However, it was not selected to the final portfolio of eSTREAM due to an attack with data complexity of 2 36.3 bytes of key stream and time complexity of 2 112 encryptions found by Dunkelman and Keller a few weeks before the end of the eSTREAM competition [START_REF] Dunkelman | A New Attack on the LEX Stream Cipher[END_REF]. These authors subsequently improved their own result, and the best published attack on LEX requires about 2 40 bytes of keystream and the time equivalent of 2 100 AES encryptions [START_REF] Dunkelman | Cryptanalysis of the Stream Cipher LEX[END_REF]. .12: Gray squares are leaked to form the key-stream. The differences are null in squares with a 0. The differences in the hatched squares can be deduced from the leaked bytes and the existence of zero differences.

Their attack is illustrated by Figure 9.12. The key idea is to find a pair of internal states, potentially obtained with different IVs, and after different numbers of encryptions, that partially collide after 4 rounds. More precisely, the objective is to find a pair of state yielding the same bytes in x 4 [4..7] and x 4 [12..15]. Because this is a collision on 64 bits, the birthday paradox guarantees that 2 32 distinct internal states are necessary. In fact, the attack is not restricted to "start" at the first round of an AES encryption cycle, but can be applied (with minor variations) to rounds 1, . . . , 8. Thus, only 2 64 /8 = 2 61 pairs of encryptions are necessary for the collision to occur. This number of pairs can be obtained from 2 31 distinct encryptions, and thus from 2 32 • 10 • 4 = 2 36.3 keystream bytes.

One of the problems is that the collision needed for the attack cannot be fully detected just by observing the keystream: it can be detected on bytes 4,6,12 and 14, but we have no way of detecting whether bytes 5,7,13 and 15 collide or not. The only solution is to assume that the full collision occurred and to run the next steps of the attack. In case of failure, we know a posteriori that the full collision did not occur. Thus, the remaining steps of the attacks have to be carried out on average 2 32 times in order for a full collision to occur.

In the first attack of Dunkelman and Keller (given in [START_REF] Dunkelman | A New Attack on the LEX Stream Cipher[END_REF]), the collision is exploited by a guess-anddetermine attack that guesses 10 bytes. Their second attack (given in [START_REF] Dunkelman | Cryptanalysis of the Stream Cipher LEX[END_REF]) uses an improved key-ranking procedure that filters the guesses and discards unlikely candidates.

Revisiting the Existing Attacks. The key-recovery problem can be encoded as a system of equations and given to the tools. The improved tool of §8.3 found that Dunkelman and Keller first attack was sub-optimal, as the guess-and-determine part of the attack could be dealt with in 2 64 elementary operations (versus 2 80 previously). This yields an attack with time complexity about 2 96 and data complexity 2 36.3 , marginally improving on their second attack.

A New Attack

It turns out that the tool can be used to mount a different, more efficient attack. This new attack proceeds in 3 phases. The first phase is similar to the existing attacks. However, instead of looking for a pair of states colliding on bytes 4-7 and 12-15 in x 4 , we look for 3-way collisions on these bytes (i.e., a triplet of states all having the same values in these bytes). The advantage of working with 3 messages instead of just two is that observation 9.1 generalizes nicely to this case: if 4 differences α, β, γ, δ are randomly chosen in F 2 8 , then the probability that S(x `α) `S(x) = γ and S(x `β) `S(x) = δ is 2 -9.5 . Thus, in most cases, no single value of x satisfies these constraints.

Phase 1: Finding the 3-Collision. Finding the 3-collision requires 2 128 /8 = 2 125 triplets of encryptions, which can be obtained from 2 42.5 distinct encryptions. This makes 2 47.8 bytes of key-stream, about three times the maximally allowed quantity for a given key. This means that in the normal setting where LEX is restricted to produce 2 46.3 bytes of key stream (80 terabytes), then out attack will only succeed with probability ≈ 1/32. Indeed, under the normal restrictions, only 500 × 2 32 encryptions are allowed, leading to 2 120.3 triplets. Because each triplet leads to a 3-collision with probability 2 -125 , it follows that the probability that the 3-collision exists is about 1/32. Our attack thus targets on average one key over 32.

The problem of detecting the 3-collision is even more acute than previously, because it can only be partially observed. The strategy is again to repeat the last two phases of the attack on the expected 2 64 triplets matching on the observable 32 bits. The subsequent steps require about 2 24 simple operations, yielding a total time complexity of 2 88 .

Phase 2: Exploiting the 3-Collision. First of all, by exploiting the zero-difference bytes and the known key-stream bytes, it is possible to reconstruct the differences between the 3 concurrent processes in vast portions of the internal state. Figure 9.12 shows the situation.

-The differences in bytes 0, 2, 8 and 10 of w 4 are given by the leakage in x 5 . Also, the differences are known to be zero in bytes 1, 3, 9 and 11 of z 4 . Thus, thanks to observation 9.2n the differences can be found in bytes 0-3 and 8-11 of both z 4 and w 4 . -It is also known that the differences are zero in bytes 4-7 and 12-15 of both z 3 and w 3 , and these zero differences propagate to x 3 and w 2 . Accordingly, using Property 9.2 in z 2 and w 2 yields the missing differences in x 3 , w 2 and z 2 . The second phase of the attack obtains the value of bytes 0-3 and 8-11 in x 2 , as well as bytes 5,7,13 and 15 in x 3 and bytes 0,2,8 and 10 in x 4 . This requires 2 18 simple operations, and is illustrated by Figure 9.13. In fact, four independent processes could be run in parallel: 1-a. Guess bytes 7 and 13 of x 3 (these are the dotted squares). This enables to find the actual values in the 3 concurrent states in bytes 8-11 of z 3 and w 3 , because the differences in x 3 are known. This also yields the differences in bytes 8-11 of x 4 . 1-b. In both x 4 and y 4 , the differences are now known in bytes 8 and 10. Only a fraction 2 -9.5 of the differences are consistent in each byte. Thus, we expect to sieve all the wrong guesses in the previous step, and to be left with only the right value. In addition, the actual values in bytes 8 and 10 of x 4 are revealed. 2-a. Guess bytes 5 and 15 of x 3 (cross-hatched squares). This yields the differences in bytes 0-3 of x 4 . 2-b. Using the same sieving technique allows us to filter just the right value for the two guesses, and to get bytes 0 and 2 in 4 . 3-a. Guess bytes 1 and 3 in x 2 (cross-hatched squares). This yields the corresponding differences in w 1 .

Then, the differences in bytes 0-3 of w 1 and x 2 can be found thanks to Property 9.2. 3-b. The differences are known in bytes 0 and 2 in both x 2 and y 2 . Therefore, the sieving technique yields the only feasible value for bytes 0-3 of x 2 . 4. Guess bytes 9 and 11 in x 2 (dotted squares). Use the same difference propagation and sieving to recover the only value of bytes 8-11 in x 2 .

Phase 3: a Guess-and-determine Finish. The third phase of the attack is a standard guess-and-determine procedure that guesses 2 bytes in order to completely recover k 3 , and thus the master key. It requires 2 16 simple operations, and is summarized by Figure 9.14. The actual values are known (from the previous phase) in gray squares. Hatched squares denotes known differences. The bytes are numbered in the order in which they can be computed. Circled bytes numbered 11 are guessed. In fact, some key bytes can be determined from the result of the second phase without guessing anything.

Step 1,5,10,13 and 17 result from the knowledge of both w i and x i+1 .

Step 2,6,7,14 and 18 exploit the key-schedule equations, and bytes obtained in previous steps. Steps 3,8 and 15 are just partial encryptions/decryptions. Step 4,9,12 and 16 use Property 9.2.

An Attack on a Variant of LEX

In order to study the leak extraction design methodology, we consider a modified variant of LEX, in which instead of extracting 32 bits of the state after every AES round, the cipher outputs the entire state after every four rounds. In this case, the core cipher is reduced to 4-round AES (without the initial key whitening), but due to the stream cipher environment, the adversary is restricted to 2 46.3 known plaintext bytes (as after that amount of key material, the stream cipher is rekeyed). It turns out that while 4-round AES is considered very weak due to the Square attack which can break it with only 2 8 chosen plaintexts, all the previously known attacks on AES have very high data complexity when transformed to the known plaintext model, and thus cannot be applied in our scenario. Thus, a priori, it is not clear whether this variant of LEX is less secure than the original LEX. However, using the attacks on reduced-round AES presented in the previous sections, we can show that this variant is practically insecure, and that even a stronger variant in which the full state is output every 5 rounds is still less secure than the original LEX.

Note that four-round AES without the initial key whitening step is equivalent to three full AES rounds (since the adversary can encrypt all the plaintexts through the first round without knowledge of the key). Thus, the attack on 3-round AES with nine known plaintexts, described in §9.4.3, applies directly to this variant and allows to break it with only 360 bytes of keystream (obtained from 9 AES invocations), time complexity of 2 40 encryptions, and 2 43 bytes of memory.

Similarly, if the full state is output every 5 rounds, then the underlying cipher is equivalent to four full AES rounds. In this case, our low complexity attacks perform only in the chosen plaintext model, and thus we use transformation to the known plaintext model, based on collecting a sufficient number of known plaintexts, until enough pairs with the required input difference are encountered.

We consider the attack with five chosen plaintexts presented in §9.5.2. A set of 2 49.5 plaintexts picked at random is expected to contain 2 98 • 2 -96 = 4 pairs with zero difference in the 12 input bytes required in the chosen plaintext attack, and thus the attack can be applied with data complexity of 2 54.5 keystream bytes, time complexity of 2 64 encryptions and memory requirement of 2 68 bytes.

It is possible to reduce the data complexity of this attack to 2 33.5 known plaintexts at the expense of enlarging the time complexity, by slightly changing the underlying chosen plaintext attack. Instead of considering only pairs of plaintexts with zero difference in 12 bytes of the state, the adversary uses pairs with zero difference in only eight bytes: 2, 3, 4, 7, 8, 9, 13, and 14. The adversary guesses bytes 0, 1, 5, 6, 10, 11, 12, 15 of k 0 and bytes 0, 15 of k 1 , and obtains the intermediate difference in w 2 [0..3] (i.e., at the output of round 2). On the other hand, the guess of bytes 0, 7, 10, 13 of u 4 and byte 0 of u 3 is sufficient to obtain the intermediate difference in byte 0 at the end of round 2, which can be used as a consistency check. The rest of the attack is similar to the chosen plaintext attack on 4-round AES with ten chosen plaintexts presented in §9.5. Since the filtering is on 8 bits, 15 pairs with the required input difference are sufficient to discard most of the wrong key guesses. Thus, the data complexity is 2 33.5 known plaintexts, or 2 38.5 bytes of keystream. The memory requirement is 2 44 bytes, and the time complexity is 2 80 encryptions.

Implementations

We have implemented and verified attacks (or parts thereof) in practice. This brief section mentions some of the technique we used and the result we obtained. The source code of some of these attack is available at: http://www.di.ens.fr/~bouillaguet/implementation.html Several attacks are meets-in-the-middle that require hash tables containing 2 32 entries, each entry being 2 or 4-byte long. The main difficulty in implementing these attacks was memory management (how to represent and store the tables). Careful and "low-level" memory management, e.g., using mmap, was necessary for the attack to be somewhat practical. The standard techniques for hash tables (storing buckets as linked lists) incurs an important space overhead in our case, because the pointers are 64-bit wide, and are impractical.

We also observed that the distribution of the number of entries in each bucket roughly follows a Poisson law of expectation 1, so that the maximum number of entries in a bucket can be represented by an 8-bit number. We thus use three arrays to store the hash table :  -An array A c stores the size of each bucket in 8-bit entries (size = 4Gbyte) -An array A h stores the content of all the buckets (size=16Gbyte) -An array A i stores the location of each bucket in the previous array (size=16Gbyte)

The last array is useful to access the hash table in O (1) time, but it needs not be stored, which means that such a hash table can be stored in a 20Gbyte file. We then used a two-pass approach: first count the number of entries with the same key in the table and update A c . Then computes the entries in A i . Lastly, perform a second pass and stores the actual data in A h . This way, the peak memory consumption is 36Gbyte.

1 AES Round / 1 Known Plaintext. The code of a purely guess-n-determine attack that enumerates all the possible value of 5 bytes has been generated by the preliminary tool of §8.2. We easily parallelized the code by inserting some OpenMP statements at the right positions. This way, the attack runs in about 18 hours using 8 Intel Xeon E5440 cores at 2.83GHz.

The code of a meet-in-the-middle attack has been generated by the improved tool, and runs in a few minutes.

2 AES Rounds / 2 Known Plaintext. The meet-in-the-middle part attack has been implemented manually in C. Using the above techniques, it uses 52Gbyte of RAM, and isolates a set of about 2 32 candidates for the first and last column of x 1 in about two hours. We checked that the set of candidates actually contains the correct solution, and that the number of candidates was consistent with our estimates.

2 AES Rounds / 2 Chosen Plaintext. The automated tools generated an implementation of this attack, which allowed us to test it. The automatically-generated C file is 110Kbyte long. On average, there are 2 8.65 candidates for x 0 [0..3], which is very close to our hypothesis.

Piret-Quisquater Fault Attack. We implemented this attack manually in C and validated it in practice. It terminates in a couple of seconds on a laptop and finds the right solution. In particular, we could check that the actual number of tested candidates was consistent with the expected number.

4 AES Rounds / 4 Chosen Plaintext. We implemented the meet-in-the-middle part of the attack manually in C++. Our implementation uses the above techniques for representing the hash tables, and each one of the 16 tables requires 112Mbyte. The attack therefore runs on a laptop and uses less than 1.8Gbyte of RAM. The total running time of the meet-in-the-middle phase is about 2 hours on a single core (the code is easily parallelized is easy using OpenMP, and actually runs in 14 minutes using eight Xeon E5520 cores at 2.27Ghz).

Pelican-MAC. We implemented the state-recovery part of the attack (the collision-finding would not be feasible in practice for us) and validated it experimentally. The program, written in C++ is 650 lines long. Building the 4 tables took little less than 3 hours on one core of the above machine. Scanning the tables looking and testing the candidates took half an hour. The number of tested candidates is consistent with the expected number (2 32 ). We used C++ templates to write a single version of the function that generates the table, indexed by the number of the table to generate ; this way, the compiler does a good job of customizing the function for each table, while we only had to write it once.

LEX. We used our automatic code-generator to generate an implementation of phases 2 and 3 of the attack. On average, some bytes are assigned 2 20.3 times, which is higher than our assumption. But their number is very small and finally, the overall complexity is close to 2 16 encryptions.

Conclusion

We have only had a limited experience with these tools so far, yet it is possible to draw a few preliminary observations.

Using the tools requires some knowledge of the primitive under scrutiny. For instance, the tools cannot are not designed to find good truncated differential paths. They can exploit such a path, for instance by finding a conforming pair efficiently, but the path has to be found by the user (or by a different tool). In this specific context, it is also up to the user to find a path that can be exploited by the tool. For instance, on two AES rounds, two truncated differential paths with probability one yield two very different results: if the 4 active byte are on the same column, the tool finds an attack of complexity about 2 8 , whereas if the active bytes are on a diagonal, the best attack found by the tool has complexity 2 32 .

The tools can be used to quickly verify high-level ideas or intuitions, while taking care of the low-level and nasty details". For instance, the idea "let us try to attack LEX with a 3-collision" could quickly be found to be effective, even though the concrete details of the attack took some time to be fully worked out.

In their present forms, the tools are suited to situations where all the solutions of the given equations are wanted. If there are much more variables than equations, the number of solutions will be overwhelming, and returning them all will be very expensive (and often unnecessary). A typical example is the case of collisions in hash functions (there are many, yet a single one is sufficient). A possible workaround would be to arbitrary fix some of the variables, but this requires human intervention, and it is not clear how to obtain good results this way. Another possibility would be to design a new set of tools tailored to find at least one solution to the given equations. This would likely require different strategies though (i.e., no expensive precomputation). This seems to be an interesting topic for future work, since AES-based hash functions seem to be a natural target for automated techniques.

Part Three

Introduction

Public-key cryptography crucially relies on hard problems. Recall that in this setting the public key contains enough information to encrypt or verify a signature in polynomial time, while the secret-key contains enough information to perform the converse operations (decrypting or generating signatures) efficiently. The two keys are usually, if not always, related by a hard problem: the public key completely defines an instance of a computational problem whose solutions form the set of corresponding secret keys. In the well-known RSA cryptosystem [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF] for instance, the public-key n is the product of two large secret prime numbers p and q. Retrieving the two primes from their product (i.e., factorizing the public modulus) is probably the most classical hard problem in cryptography. Similarly, in the ElGamal encryption/signature scheme [START_REF] El | A public key cryptosystem and a signature scheme based on discrete logarithms[END_REF], the public key is g x , where g is a known element of some group, and x is a secret exponent. Retrieving x from g and g x is known as the discrete logarithm problem, and is hard in some groups. The list of hard problems used in cryptography is ever growing and is already too long to be quoted extensively.

Security Proofs and Hardness Assumptions. The current trend in cryptographic design is to give mathematical proofs that any attacker able of breaking a cryptographic scheme is in fact capable of solving instances of a hard problem. This argument is usually made formal by exhibiting reductions, i.e., programs supposed to solve the hard problem efficiently, and that for this purpose may use the attacker by sending it challenges to break, and exploit the corresponding answers. The security of the cryptographic scheme is therefore reduced to the hardness of the hard problem. The "security proofs" do not prove that the cryptographic scheme is unconditionally secure, but they prove that it is secure as long as solving instances of the hard problem requires too much computation to be possible in practice.

Of course, we must then trust the hard problem to be hard enough. The fact that they remain hard after decades of intense scrutiny is probably a good indicator that they will remain hard for the years to come. This seems somewhat unsatisfactory, but rigorous lower bounds on the complexity of solving computational problems are notoriously hard to obtain (just consider the P vs. NP issue). In fact, there is no provably hard problem known to date, in the sense that we do not know any function family that could be evaluated with a polynomial number of operations, but that provably could not be inverted with a polynomial number of operations.

The security of public key schemes therefore relies on the validity of hardness assumptions, whose formulation often looks similar to: "solving any instance of size n of problem P requires at least f (n) operations", where f is a fast-growing, typically (sub)exponential function. Under such an assumption, choosing n big enough such that f (n) operations is vastly beyond the current computational power of mankind guarantees that the cryptographic scheme at hand is secure. Of course, not all instances of the hard problem are necessarily hard, and weak instances must be avoided.

Hardness assumptions can be falsified by the discovery of new algorithms for solving the hard problem. This was for instance the case when the Number Field Sieve [START_REF] Lenstra | The number field sieve[END_REF] was invented, and when the security of factorization-based schemes, such as RSA, had to be re-evaluated.

A universal Hardness Assumption. Consider any cryptographic primitive F taking as input a plaintext and a key, and producing something dependent on both (for instance F can be the RSA encryption, the AES, etc.). It is standard to assume that the description of F is known to the attacker, who is then able to synthesize a boolean circuit evaluating F . Since F is efficient, the circuit size is polynomial in the security parameter. In turn, from the boolean circuit, it is possible to derive a system of boolean equations in the input and output variables of F , as well as in some internal state variables. The size of this system is also polynomial in the security parameter. Given sufficiently input-output pairs so that the key is uniquely determined, retrieving the key amounts to solve the boolean equations in the key variables.

Cryptography would badly break down if solving large systems of boolean equations were feasible. It is therefore implicitly assumed that this is a very hard problem. Shannon pointed out in 1949 [START_REF] Shannon | Communication theory of secrecy systems[END_REF] that lower-bounding the complexity of breaking a cryptographic scheme by that of solving a (complicated) system of boolean equations would be satisfying, because in any case there would not be any efficient cryptography if this were generically feasible.

From Boolean functions to Multivariate Polynomials. Solving systems of boolean equations is essentially equivalent to solving systems of polynomial multivariate equations over F 2 (the field with two elements). Indeed, the multiplication in F 2 is the AND operation between individual bits, and the addition is the XOR. Adding one then amounts to negate a boolean variable. Any system of boolean equations can be rewritten to contain only ANDs, XORs, and constants, with at most a polynomial blowup.

In turn, any system of multivariate polynomial equations can be transformed into a system of multivariate quadratic equations with the exact same solutions, by introducing new variables and new equations, with again an at most polynomial blowup. So, our slogan could be that "solving quadratic multivariate systems of equations over F 2 is as hard as everything in cryptography" (but we know that this is a little exaggerated).

Note that this shows in passing that the problem of solving quadratic multivariate systems of equations over F 2 is NP-complete, with an obvious reduction to SAT [START_REF] Garey | Computers and Intractability, A Guide to the Theory of NP-Completeness[END_REF]. This is also true over any finite field. The problem of solving Multivariate Quadratic equations (MQ for short) is thus fundamental, besides being mathematically natural and simple to understand.

In addition, no quantum algorithm is known to solve it faster than in the classical world, in contrast to some number-theoretic problems, such as factorization, to which Shor's polynomial-time algorithm [START_REF] Shor | Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer[END_REF] would apply if quantum computer were available. It therefore makes sense to argue that cryptographic schemes relying on the hardness of MQ would survive in a world where efficient quantum computers exist.

Multivariate Cryptography. It was therefore natural to design cryptographic schemes whose security explicitly relies on the hardness of MQ. This resulted in "multivariate cryptography", a brand that encompasses all such cryptographic constructions. Multivariate polynomials have been used in cryptography as early as 1984 [OSS84a, OSS84b, FD85], mostly with the purpose of designing RSA variants with faster decryption. However, even before that, a group of Japanese researchers around Imai and Matsumoto designed the first public-key scheme explicitly based on the hardness of MQ. In fact, they built several, but only one (their "Scheme A") made it to the general crypto community, and was presented at Eurocrypt'88 [START_REF] Matsumoto | Public Quadratic Polynominal-Tuples for Efficient Signature-Verification and Message-Encryption[END_REF] under the name C * .

Several years later, Patarin [START_REF] Patarin | Cryptoanalysis of the Matsumoto and Imai Public Key Scheme of Eurocrypt[END_REF] found a devastating attack against C * , allowing to decrypt and to forge signatures very efficiently, but not to recover the secret key from the public key. Soon after, he proposed a new multivariate trapdoor one-way function called Hidden Field Equations (HFE), on top of which reasonably efficient signature and encryption schemes could be built [START_REF] Patarin | Hidden fields equations (hfe) and isomorphisms of polynomials (ip): Two new families of asymmetric algorithms[END_REF].

The decade starting with the introduction of HFE retrospectively looks like the golden age of multivariate cryptography. Many multivariate scheme have been proposed (we know at least 20 of them), including a plethora of bogus and vainly complicated proposal with a short lifespan. Three constructions stood out and received more attention than the others, because of their simplicity and their elegance:

-HFE [Pat96b] is a generalization of C * , retains its simplicity, but looks much more solid. Decryption is a bit more complicated and less efficient though. HFE has been the object of much scrutiny and cryptanalysis [KS99, FJ03, WP05b, GJS06, DGS06, DG10b], and we discuss its security at length in chapter 19. The most notable result on HFE is the practical break of an HFE challenge supposed to offer 80 bits of security by Faugère [START_REF] Faugère | Algebraic Cryptanalysis of Hidden Field Equation (HFE) Cryptosystems Using Gröbner Bases[END_REF]. Because of that, the cryptographic community vastly perceives HFE as broken, while the truth is apparently more complex. -The Unbalanced Oil and Vinegar (UOV) signature scheme [START_REF] Kipnis | Unbalanced Oil and Vinegar Signature Schemes[END_REF] has been proposed in 1999 by Kipnis, Patarin and Goubin, as an improvement of the older "Oil and Vinegar" [START_REF] Patarin | The Oil and Vinegar signature scheme[END_REF] proposed in 1997 by Patarin. The original OV scheme turned out to be vulnerable to the "Rank-Attack" of Kipnis and Shamir [START_REF] Kipnis | Cryptanalysis of the oil & vinegar signature scheme[END_REF], but UOV is immune to it, and remains unbroken to this day despite its simplicity. -The SFLASH signature scheme [START_REF] Patarin | Flash, a fast multivariate signature algorithm[END_REF] ], and all possible hopes of making it secure disappeared with a subsequently improved attack of Macario-Rat and Fouque [START_REF] Macario-Rat | Cryptanalyse de schémas multivariés et résolution du problème Isomorphisme de Polynômes[END_REF]. The demise of SFLASH, coming after the practical break of the 80-bit HFE challenge, marks the end of the golden age of multivariate cryptography. It shattered the hopes, and trust, of the cryptographic community at large in multivariate cryptography, and at some point it was not unrealistic to say that multivariate cryptography was dead. In any case, it seems to be a less active field of research than what it was a decade ago.

Multivariate Cryptanalysis. The blossom of multivariate cryptanalysis is a consequence of that of multivariate cryptography. The cryptanalysis of multivariate schemes has a particular "flavor", compared to cryptanalysis of number-theoretic constructions, for instance.

Breaking the newly designed multivariate schemes required new and ad hoc cryptanalysis techniques and tools that it is impossible to exhaustively mention. Linear algebra and Gröbner basis [Buc65, CLO91] compu-tations are the main tools of multivariate cryptanalysts. They even designed their own algorithms to tackle MQ and challenge its hardness assumption: first the relinearization technique [START_REF] Kipnis | Cryptanalysis of the HFE Public Key Cryptosystem by Relinearization[END_REF] for overdetermined systems, then the eXtended Linearization (XL for short) [START_REF] Courtois | Efficient Algorithms for Solving Overdefined Systems of Multivariate Polynomial Equations[END_REF], the linear method [KJ07], the eXtended Sparse Linearization (XSL) [START_REF] Courtois | Cryptanalysis of block ciphers with overdefined systems of equations[END_REF] and their numerous variants. XL was claimed to be subexponential, but the claim turned out to be bogus [START_REF] Diem | The xl-algorithm and a conjecture from commutative algebra[END_REF]. In the same vein, XSL was claimed to break the AES, but the claim was debunked in [START_REF] Cid | An analysis of the xsl algorithm[END_REF]. In addition, XL was eventually found [AFI + 04] to be a rediscovery of an old Gröbner basis computation algorithm by Lazard [START_REF] Lazard | Gröbner-bases, gaussian elimination and resolution of systems of algebraic equations[END_REF], which made it theoretically inferior to the most recent algorithms designed for this task, such as Faugère's F 4 [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases (F4)[END_REF] and F 5 [START_REF] Faugère | A New Efficient Algorithm for Computing Gröbner Bases Without Reduction to Zero (F5)[END_REF]. The linear method is essentially an independent reformulation of "matrix-F 5 ", a simplification of F 5 described in [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF].

Some multivariate cryptanalysts also tried to use their new tools and techniques to attack symmetric primitives. The main ingredient of algebraic attack is to write down a system of multivariate quadratic equations describing the cryptographic primitive, and try to recover the secret key by solving it using generic solvers. Multivariate cryptanalysts first tried to attack real-life block ciphers, such as the AES [Cou04, CP02], without success, except maybe on very reduced versions of the DES [START_REF] Courtois | Algebraic cryptanalysis of the data encryption standard[END_REF]. Weak block ciphers have been broken this way though, such as Toyocrypt [START_REF] Courtois | Higher order correlation attacks, xl algorithm and cryptanalysis of toyocrypt[END_REF] and Keelock [START_REF] Courtois | Algebraic and slide attacks on keeloq[END_REF]. This kind of attack turned out to be a more serious thread against stream ciphers, as they could generically apply to whole families of designs [START_REF] Courtois | Algebraic attacks on stream ciphers with linear feedback[END_REF][START_REF] Courtois | Fast algebraic attacks on stream ciphers with linear feedback[END_REF][START_REF] Courtois | Practical algebraic attacks on the hitag2 stream cipher[END_REF]. In addition, algebraic techniques can be used as a sub-component of otherwise statistical attacks (for example to perform various kinds of "message modification"), as demonstrated for instance by [SKPI07, BF08, KMNP11].

Multivariate Trapdoor One-Way Functions. In multivariate public-key schemes, the public key is very often a family of quadratic polynomials f 1 , . . . , f m in n variables, with coefficients in a finite field F q . Encrypting a given vector x ∈ (F q )

n is done by simply evaluating the m polynomials over x. An attacker, given the public key (the equations) and a ciphertext (the result of the evaluation of the polynomials), could try to recover the plaintext by solving the equations, i.e., by solving an instance of MQ-which is supposedly intractable.

To make decryption possible, the polynomial equations must have a special structure enabling the legitimate user, aware of this special structure, to solve the equations in polynomial time. This is essentially achieved by taking an easily invertible system of polynomial equations, and performing a random linear change of coordinates, as well as a random linear combination of the equations. This could be seen as an obfuscation technique, because the public key is essentially an obscured representation of an easily-invertible system of quadratic equations. The implicit assumption is that knowing the two secret linear maps involved in the obfuscation process is the only way to access the easily-invertible core.

A seemingly insurmountable problem with this way of building multivariate trapdoor one-way function is that the public key is then provably not a uniformly distributed system of quadratic equations. As a consequence it is paradoxically impossible to prove that these schemes rely on the average-case hardness of MQ, because they only rely on the hardness of specific instances of the problem. This explains why a reasonably-sized HFE challenge could be broken: we do not know how to solve "generic" system of quadratic equations over F 2 faster than exhaustive search, but HFE public keys turned out to be much easier to solve than "generic" systems.

Hardness assumptions in Multivariate

Cryptography. An adversary could also attack multivariate schemes by trying to recover the secret linear change of coordinates from the public key. Multivariate schemes thus do not only rely on the hardness of MQ, but also on the hardness of another problem, that of retrieving the secret key from the public key. For C * , this problem has a relatively simple algebraic formulation in terms of equivalence of quadratic maps. Even after Patarin broke C * , the C * key-recovery problem looked quite difficult. This prompted Patarin to promote it as a hardness assumption of its own, somewhat unfortunately called the Isomorphism of Polynomials (IP) problem.

Besides MQ, IP is the most widely spread hardness assumption in multivariate cryptography, and a lot of work has been devoted to understand its exact hardness [PGC98b, GMS03, dVP03, Per05, FP06]. A third hard problem, MinRank, is sometimes used in multivariate cryptography [START_REF] Courtois | Efficient zero-knowledge authentication based on a linear algebra problem minrank[END_REF] and cryptanalysis [START_REF] Kipnis | Cryptanalysis of the HFE Public Key Cryptosystem by Relinearization[END_REF]. While MQ and MinRank are NP-complete [START_REF] Buss | The Computational Complexity of Some Problems of Linear Algebra[END_REF], the status of IP however turned out to be much less clear.

Contributions. The third part of this dissertation is devoted to the study of hardness assumptions in multivariate cryptography. Chapter 10 describes our cryptanalytic toolbox. In chapter 11, we describe a new exhaustive-search algorithm for MQ with very good practical performances. Chapters 12 to 18 form a comprehensive study of the IP problem. The problem is defined in chapter 12, where its relevant subcases are determined and its cryptographic uses are also surveyed. Prior art in IP solving is reviewed in chapter 13. In chapter 14 we introduce the generic technique that we will use in the subsequent chapters to design new IP algorithms. We apply this generic technique to four subcases: to the Quadratic Forms Simultaneous Equivalence problem (aka "Isomorphism of polynomial with One secret", or IP1S) in chapter 15, to the Cubic Form Equivalence problem (aka cubic IP1S) in chapter 16, to the Inhomogeneous Quadratic Maps Linear Equivalence problem (aka inhomogeneous IP) in chapter 17 and finally to the (homogeneous) Quadratic Maps Linear Equivalence problem (aka full IP) in chapter 18. We conclude by presenting an application of these new polynomial equivalence algorithms to the cryptanalysis of HFE in chapter 19. Chapter

A Toolbox for Multivariate Cryptanalysis

This chapter collects the mathematic preliminaries and useful results that are used throught the last part of this dissertation. Most of these results are known or well-known, with the exception of some results on the properties of random matrices presented in §10.7 that are, to the best of our knowledge, original.

In this chapter, we expose the main ideas, techniques and notions used in multivariate cryptography and cryptanalysis. We recall very basic facts about finite fields and linear algebra. We next introduce our main object of study, namely multivariate polynomials, and we define useful derived notions. In particular we recall the usual theory of quadratic forms over odd-characteristic fields, and the less usual theorey of quadratic forms over a characteristic-two field. This leads us to consider the set of common roots of a family of multivariate polynomial, and the associated algebraic structures, the ideal they span. We then present Gröbner bases, and some of the mainstream algorithms used to compute them. We conclude by establishing some results on random matrices by counting the number of linear maps meeting various conditions over a given finite field.

Finite Fields and Vector Spaces

When f 1 , . . . , f k belong to a vector space, we denote by f 1 , . . . , f k the subspace they span. We denote by e 1 , . . . , e n the canonical basis of a finite vector space of dimension n.

Let K be a finite field and L an extension of K of degree n > 1. Recall that L is essentially the quotient of K[X] by the principal ideal generated by P (X), an irreducible polynomial of degree n over K[X]. L is isomorphic to K n via an application ϕ. For the sake of convenience, it can be specified that ϕ returns the only polynomial of each equivalence class of degree less than n. Hence, any application A defined over L can be seen as an application over K n and conversely (just consider ϕ -1 • A • ϕ). Recall that any application over L is a polynomial of L[X]. Lastly, given a fixed element a ∈ L, the application x → a • x is linear, and thus can be represented over K n by a matrix M a . Lastly, we denote by M i• the i-th row of the matrix M , and by M •j the j-th column.

The Frobenius Map. The application F : X → X q over L is called the Frobenius map. It is an automorphism of L that fixes any element of K. As a consequence, F can also be seen as a matrix F ∈ GL n (K). A polynomial P ∈ L[X] commutes with F if and only if its coefficients are in K.

Endomorphisms We denote by M n (K) the set of all n × n matrices over the field K. It is well-known that matrices represent linear maps, and that square n × n matrices in particular represent endomorphisms of K n . As usual, GL n (K) denotes the set of all invertible n × n matrices over K. The identity matrix of order n is denoted by I n . Two matrices A, B are said to be similar (resp. congruent) if there exist P ∈ GL n (K) such that A = P -1 × B × P (resp. A = t P × B × P ). We recall the rank-nullity theorem: given an endomorphism of K n , then the dimension of its image plus the dimension of its kernel equals n.

Symmetric and Skew-Symmetric matrices. A matrix M is said to be symmetric if it is equal to its transpose ( t M = M ). A matrix M is skew-symmetric (also called anti-symmetric) if t M = -M and the diagonal coefficients of M are all zero. Symmetric and skew-symmetric matrices are usually very different objects. However, over fields of characteristic two, where 1 = -1, the distinction is much less clear. The condition that the diagonal of a skew-symmetric matrix should be zero is not redundant in characteristic two, where skew-symmetric matrices are precisely the symmetric matrices with null diagonal. We will say that a matrix is non-skew symmetric if it is symmetric but not skew-symmetric (i.e., if it has a non-zero element on the diagonal). The following theorems recall some elementary results on these objects.

Theorem 10.1 ([Alb38], theorem 1, 3, 4 and 6). Over any field, i) The rank of a skew-symmetric matrix is always even.

ii) Every matrix congruent to a skew-symmetric matrix is skew-symmetric.

iii) Every n × n skew-symmetric matrix of rank 2r is congruent to:

  0 -I r 0 I r 0 0 0 0 0   iv)
Two skew-symmetric matrices are congruent if and only if they have the same rank.

Theorem 10.2 ([Alb38], theorem 2 and 6). Over any field, we have:

1. Every matrix congruent to a non-skew symmetric matrix is non-skew symmetric.

2. Every non-skew symmetric matrix is congruent to a diagonal matrix.

Multivariate Polynomials

The ring of all polynomials in n variables with coefficients over a finite field, conventionally denoted by F q [x 1 , . . . , x n ] plays a central role in multivariate cryptography. Definition 10.1. If f ∈ F q [x 1 , . . . , x n ], then the homogeneous component of degree d of f , denoted by f (d) , is the sum of all monomials of degree d occuring in f . A degree-d polynomial is said to be homogeneous if it only contains monomials of degree d.

A distinctive property of degree-d homogeneous polynomials is that if

α ∈ K, then f (α • x) = α d • f (x).

Quadratic Forms and Associated Bilinear Forms

Since multivariate quadratic polynomials play a special role in multivariate cryptography, we investigate some of their properties in more detail. A particularly important class of quadratic polynomials is formed by quadratic forms. Definition 10.2. A quadratic form f : K n → K is a homogeneous multivariate polynomial of degree two:

f = n i=1 n j=1 a ij • x i x j
It is customary to represent a quadratic form by the matrix A = (a ij ) 1≤i,j≤n . This representation is however redundant: it is not difficult to verify that if N is a skew-symmetric matrix, then A and A + N both represent the same quadratic form form (in fact, all the possible representations of a given f can be written this way). It follows that a quadratic form can be uniquely represented by a (upper/lower) triangular matrix. In odd characteristic, a quadratic form can be uniquely represented by a symmetric matrix, and this more convenient representation is often prefered. It is also deeply connected, as we shall see below, to another standard object, the polar form.

Definition 10.3. If f is a quadratic form then φ(x, y) = f (x + y) -f (x) -f (y) is a symmetric bilinear form called the polar form of f .
We are aware that the usual definition of the polar form is φ(x, y) = 1 2 (f (x + y) -f (x) -f (y)). The advantage of the usual definition is that in odd characteristic f (x) = φ(x, x). However, the inconvenient is that the polar form is undefined in characteristic two. Our definition is such that f (x) = 1 2 φ(x, x) in odd characteristic. In even characteristic, we have φ(x, x) = 0, and in fact φ is then a skew-symmetric bilinear form.

Bilinear forms are also conveniently represented by matrices: if (e i ) 1≤i≤n is a basis of K n , and if we consider the matrix A defined by A = (φ(e i , e j )) 1≤i,j≤n , then φ(x, y) = t x • A • y. We denote by P (f ) the matrix of the polar form of f in the canonical basis. The following lemma is straightforward, and links the polar form with the matrix representation of the corresponding quadratic form. Lemma 10.3. If a quadratic form f is represented by a matrix A, then P (f ) = A + t A. Definition 10.4. Two quadratic forms f and g are said to be equivalent if there exist a matrix S ∈ GL n (K) such that f = g • S.

The equivalence of quadratic forms has an immediate counterpart on their polar forms. It is easy to check that if S is a n × n matrix, and g = f • S, then P (g) = t S × P (f ) × S. Equivalent bilinear forms thus have congruent representations, and vice-versa.

We may now leverage our knowledge on symmetric matrices. Let K be a field of odd characteristic from now on. We therefore know that 2f (x) = t x • A • x for some symmetric matrix A. By theorem 10.2, A = t S × D × S, where S ∈ GL n (K) and D = Diag(d 1 , . . . , d n ) is a diagonal matrix. Thus, f is equivalent, via S, to:

g(x) = n i=1 d i • x 2 i
We have just established the classical result: "any quadratic form is equivalent to a diagonal form". Note that if d i = 0 in the expression of g, then f is equivalent to a quadratic form with (at least) one less variable.

Definition 10.5. The rank of a quadratic form f is the smallest integer r such that f is equivalent to a quadratic form in r variables. If the rank of f is strictly smaller than n, then f is said to be degenerate (otherwise it is regular).

It is straightforward that the rank of f is the number of non-zero d i 's in the expression of g. It follows that the rank of f is also the rank of its polar form, and of its symmetric matrix representation (but not of any matrix representation).

In characteristic two, this beautiful and practical theory unfortunately completely breaks down. The polar form is still congruent to a diagonal matrix, but this no longer implies that the corresponding quadratic form is equivalent to a diagonal form. In addition, diagonal forms are particularly uninteresting. First of all, since the Frobenius map is linear, the diagonal quadratic forms are in fact linear. In addition, they are all equivalent.

Lemma 10.4. Any two non-zero diagonal quadratic forms are always equivalent over

F 2 k . Proof. Let f (x) = n i=1 a i • x 2
i be a diagonal quadratic form. We assume w.l.o.g. that a 11 = 1, and we define:

S =        1 √ a 2 √ a 3 • • • √ a n 0 1 0 • • • 0 0 0 1 • • • 0 . . . . . . . . . . . . . . . 0 0 0 • • • 1       
Note that the square root is always well-defined and unique, since the Frobenius map is a bijection. Now, we set g = f • S. Then g is clearly equivalent to f , and we find:

g(y) = g y 1 + n i=2 √ a i • y i , y 2 , . . . , y n = y 1 + n i=2 √ a i • y i 2 + n i=2 a i • y 2 i = y 2 1
Since this applies to any f , the result is established.

Lastly, theorem 10.1 implies that a non-diagonal quadratic form cannot be equivalent to a diagonal quadratic form. This follows from the fact that in characteristic two, the polar form is skew-symmetric, and thus cannot be congruent to a non-skew symmetric matrix. So, in characteristic two, diagonal forms are certainly not the nice canonical form they are in odd characteristic.

Another problem is that while the function that maps a quadratic form to its polar form is bijective in odd characteristic, this is no longer the case in characteristic two (the "diagonal terms" are lost in the process).

Quadratic Maps

In most cryptographic contexts, it is difficult to do much with a single polynomial. However, quadratic functions (i.e., vectors of quadratic polynomials) are more interesting objects. Definition 10.6. A quadratic map is a vector of n polynomials in n variables with coefficients over K. The map itself is seen as a function from K n to K n , where each coordinate is a quadratic expression of the input coordinates.

While a quadratic map is naturally a vector of quadratic polynomials, it can also be seen as a single quadratic polynomial whose coefficients are vectors in K n :

5x 2 + 7xy -3y 2 x 2 -3xy + 2y 2 5 1 x 2 + 7 -3 xy + -3 2 y 2
Most, if not all, usefull notions for quadratic polynomials translate nicely to quadratic maps, except maybe the pleasant representation by a single matrix with coefficients in K.

Differentials and Derivatives

For instance, the polar form is easily adapted to quadratic maps. In the existing cryptographic litterature, this object has been called the differential, for reasons we explain below.

Definition 10.7. The (discrete) differential of a quadratic map a is the symmetric bilinear map: Da : (x, y) → a(x + y) -a(x) -a(y) + a(0) Given a vector x ∈ K n , the differential of a in x, denoted by D x a, is the endomorphism of K n that maps y to Da(x, y).

The name ("differential") comes from the analogy with the notion of the same name in calculus: if f a is (real) function from R n to R m , then we say that f is differentiable at p ∈ R n if there is a linear map df p : R n → R m , called the differential, such that for any ε > 0, there is a neighbourhood N (p) of p such that for x ∈ N (p):

|f (x) -f (p) -df p (x -p)| < ε • |x -p|
So, in calculus, the differential is a linear map associated to a point p, and expressing how a multivariate function varies around that point. Our discrete differential has similar properties. As the name suggests, this is reminiscent of the notion of derivation. However, the usual derivatives from "calculus I" make little sense over finite fields. We again have a related, ad hoc discrete notion.

Definition 10.8. The (discrete) derivative ∂f ∂x of a quadratic map a with respect to a vector x ∈ K n is:

∂a ∂x : y → a(x + y) -a(y).
The (discrete) derivative ∂a ∂i of a with respect to its i-th variable is ∂a ∂ei .

Just like the usual derivative, if a is a polynomial map of total degree d, then ∂a ∂x is a polynomial map of degree d -1. In particular, if a is a quadratic map, then ∂a ∂x is an affine function whose homogeneous linear component is D x a. It is also useful to note that:

f (x + e i ) = f (x) + ∂f ∂i (x) (10.1)
It is also important to notice that if K is a field of characteristic two, then for any x ∈ K n , D x a is singular, since it vanishes on x.

Ideals and Varieties

Multivariate cryptography is built on the hardness of solving simultaneous polynomial equations over finite fields. While this can always be done in finite (exponential) time by exhaustive search, the inherently algebraic formulation of the problem leads to inherently algebraic algorithms. The theory of multivariate polynomial systems is fascinating, deep and elegant. In this section we briefly examine some selected aspects of the problem. The interested reader should consult [START_REF] Cox | Ideals, Varieties, and Algorithms: An Introduction to Computational Algebraic Geometry and Commutative Algebra[END_REF] for a more detailed exposition. While our objective is only to discuss the complexity of finding the solutions of a system, we will be dragged quite far.

Consider a system S of linear equations over K, and the set X ⊂ K n of all its solutions. Take any linear combinations of the equations: it also vanishes on X. A linear combination of the original equation is a new equation that "follows" from the original equations. The set of all the linear equations that can be derived from S is precisely the set of all possible linear combinations of the equations of S, and it is a vector space. What is nice is that any other linear system generating this vector space has exactly the same solutions as S.

With polynomial systems, the situation is more complex. Consider now a system S of multivariate polynomials in K[x 1 , . . . , x n ], and let X ⊂ K n be the set of its solutions. Take any polynomial combination of the original equations (i.e., a sum of products of an initial equation and an arbitrary polynomial): we obtain a new polynomial that also vanish on X , i.e., a new equation that "follows" from the original equations. The set of all polynomial equations that can be derived from S is an ideal of K[x 1 , . . . , x n ]. Recall that an ideal of K[x 1 , . . . , x n ] is a subset I ⊂ K[x 1 , . . . , x n ], such that if f, g ∈ I then f + g ∈ I, and if f ∈ I, g ∈ K[x 1 , . . . , x n ], then f g ∈ I. Any other system of polynomials generating the same ideal will have the same solutions, but the converse is not true in general (the polynomial systems (x, y) and (x 2 , y 2 ) have the same solutions, namely {(0, 0)}, but they generate different ideals). More precisely, the sequence of polynomials f 1 , . . . , f m span the ideal1

f 1 , . . . , f m = m i=1 P i • f i , with P 1 , . . . , P m ∈ K[x 1 , . . . , x n ]
The affine variety associated to an ideal I is the subset of (F q )

n over which all the polynomials in the ideal vanish:

V (I) = {x ∈ K n | ∀P ∈ I, P (x) = 0}
It is also possible to associate an ideal to a variety:

I (V ) = {P ∈ K[x 1 , . . . , x n ] | ∀x ∈ V, P (x) = 0}
The ideal I (V ) is therefore by definition the largest ideal whose associated variety is V . For instance, continuing on the previous example, V ({(0, 0)}) = {x, y}.

Solving a system of polynomial equations essentially amounts to determine the variety of the ideal generated by the polynomials. Solving systems of linear equations is (usually) achieved by computing an equivalent system with a special shape, from which the solutions can be easily deduced, for instance a triangular system. The global strategy to solve polynomial equations is similar, and the key step is to compute a "nice" equivalent system.

Homogeneous Ideals

Definition 10.9. A homogeneous ideal of K[x 1 , . . . , x n ] is an ideal which is generated only by homogeneous polynomials (however it does not only contains homogeneous polynomials).

Homogeneous ideals are very convenient to express certain results, and overall their theory is easier than that of general ideals. Given an ideal I, we may "homogenize" it using an extra dummy homogenization variable.

Definition 10.10. Let f ∈ K[x 1 , . . . , x n ] be a degree-d polynomial. The homogenized version of f , denoted by f h , is the homogeneous polynomial of degree d of K[x 1 , . . . , x n , h] defined by

f h (x 1 , . . . , x n ) = h d • f x 1 d , . . . , x n d
Homogenized polynomials can be de-homogenized: f (x 1 , . . . , x n ) = f h (x 1 , . . . , x n , 1). We may therefore work with homogeneous ideals without lost of (much) generality. Given an ideal I = f 1 , . . . , f n , we may consider its homogenized version

I h = f h 1 , . . . , f h n .
As expected, the image of I h through the function that sets the last variable to 1 is indeed I [BKW93, lemma 10.53].

It must be noted that homogenizing a system of polynomial equation may introduce solutions "at infinity", i.e., solutions with h = 0 that cannot be solutions of the original system and are thus parasitic.

Linearization

Before discussing techniques to solve multivariate systems of polynomial equations into further detail, we describe a folklore method for solving very overdetermined systems of multivariate quadratic polynomials. Given (at least) (n + 1)(n + 2)/2 linearly independent quadratic equations in n variables, a standard strategy is to consider each one of the n+2 2 monomial as an independent variable, and to solve the system of linear equations obtained this way. We therefore obtain the value of each monomial. When the system is inhomogeneous, this directly reveals the value of the variables. When the system is homogeneous, we only find the values of the quadratic monomials, but the actual values of the variables can be easily determined.

Gröbner Bases

A Gröbner basis of an ideal is a generating set enjoying additional properties making it nice to work with. They are the nice form of polynomial systems, from which the solutions of the polynomial equations can be easily read off, to which we previously alluded to. They serve a handful of other purposes though, such as deciding the Ideal Membership problem (i.e., testing if a given polynomial belongs to a given ideal). Our exposition is vastly inspired by [START_REF] Cox | Ideals, Varieties, and Algorithms: An Introduction to Computational Algebraic Geometry and Commutative Algebra[END_REF].

Monomial Orderings

In a univariate polynomial ring K[x], there is a natural (strict) total order relation between monomials: 1 < x < x 2 < x 3 < . . . . This order is well-founded, and enjoy the additional property that if m 1 , m 2 and m 3 are monomials such that m 1 < m 2 , then m 1 m 3 < m 2 m 3 . Moving on to multivariate polynomials, several such orders exist. Monomial orderings of the ring K[x 1 , . . . , x n ] are in one-to-one correspondance with orderings of N n (the bijection is examplified by

x 3 yz 7 ↔ (3, 1, 7) in K[x, y, z]).
Definition 10.11. Let α = (α 1 , . . . , α n ) and β = (β 1 , . . . , β n ). The lexicographic ordering > lex is such that α > lex β if, in the vector difference αβ ∈ Z n , the leftmost non-zero entry is positive.

It follows that in K[x, y, z], we have x > lex y > lex z, but also x > lex y 5 z 10 , and in fact any variable dominates any monomial involving only smaller variables. The lexicographic order thus completely ignores the degree of the monomials. This feature can somewhat be bothersome, but there fortunately exist ordering that refine the degree (they are also called graded orderings). For instance, compare monomials according to their degree, and use the lexicographic ordering to break ties. In practice one of the most useful ordering is a twisted version of this one. Definition 10.12. Let α = (α 1 , . . . , α n ) and β = (β 1 , . . . , β n ). The graded reverse lexicographic order

> grevlex is such that α > grevlex β if |α| = n i=1 α i > |β| = n i=1 β i
or |α| = |β| and the rightmost nonzero entry of αβ ∈ Z n is negative.

We can again check that x > grevlex y > grevlex z. The grevlex order looks at the rightmost variable and favors the smallest power: x 5 yz > grevlex x 4 yz 2 .

Given a multivariate polynomial f and a monomial ordering, we may sort the monomial occuring in the polynomial. The greatest one will be denoted by LM (f ), and is called the leading monomial. The coefficient of the leading monomial in f , denoted by LC(f ) is called the leading coefficient. The product LC(f ) • LM (f ) forms the leading term of f , denoted by LT (f ).

Multivariate Polynomial Division

In the univariate case, it is a well-know result that K[x] is a principal ring, meaning that all its ideals have a unique generator. Given an ideal I = f , a polynomial g ∈ K[x] belongs to I if and only if it is a multiple of f . This gives an easy algorithm to decide Ideal Membership: compute the euclidean division of g by f , and check whether the remainder is zero. Recall that the division algorithm works by repeatedly subtracting to g a suitable multiple of f , so that at each step the leading term of g is canceled out. The remainder cannot be affected in this way by f , because it is of strictly smaller degree.

It is quite tempting to extend this process to the multivariate setting. Algorithm 10.1 works the same way: given an (ordered) sequence of polynomials f 1 , . . . , f t and a polynomial g ∈ K[x 1 , . . . , x n ], repeatedly substract to g products m • f i , where m is a carefully chosen monomial such that LT (m • f i ) = LT (g). This algorithm shows that given our sequence of polynomials, every polynomial g ∈ K[x 1 , . . . , x n ] can be written as:

g = a 1 f 1 + • • • + a t f t + r
where a i , r ∈ K[x 1 , . . . , x n ], and either r = 0, or r is a linear combination with coefficients in K, of monomials, non of which is divisible by any of LT (f 1 ), . . . , LT (f s ). The problem is that, as opposed to what happens in the univariate case, the remainder r is not uniquely defined by this process. This may happen, for instance, if f i and f j have the same leading term, and could both be used at some point to cancel the leading term of g. This process cannot be used to test ideal membership because of the non-uniqueness of the remainder r. while p = 0 do 5:

i ← 1

a i ← a i + LT (p) LT (f i ) 10: p ← p - LT (p) LT (f i ) • f i 11:
division-occured ← true

Definition of Gröbner Bases

Given an ideal I ⊂ K[x 1 , . . . , x n ] other than {0}, we consider the set LT (I) of leading terms of elements of I. Thus,

LT (I) = {LT (f ) | f ∈ I}
The ideal of leading terms of I is the ideal spanned by LT (I). By a slight abuse of notation, we write it LT (I) . In general, given an ideal I = f 1 , . . . , f m , the ideal of leading terms of I is not necessarily equal to LT (f 1 ), . . . , LT (f m ) , as the former may be strictly bigger than the latter.

Definition 10.13. Fix a monomial order <. A finite subset G = {g 1 , . . . , g t } of an ideal I is said to be a Gröbner basis for I with respect to < if:

LT (g 1 ), . . . , LT (g t ) = LT (I)

Proposition 10.5. If G = {g 1 , . . . , g s } is a Gröbner basis of I ⊂ K[x 1 , . . . , x n ], then I = G .
A Gröbner basis is thus a "good" generating set of an ideal. In the remaining of this section, we shall explore further what good properties they have, and why there are so useful.

Proposition 10.6. Let I ⊂ K[x 1 , . . . , x n ], < a monomial order, and G a finite subset of I. Then G is a Gröbner basis with respect to < if for all f ∈ I, there exists g ∈ G such that LT (g) divides LT (f ).

The Hilbert Basis Theorem [CLO91, chapter 2, §2, theorem 4] states that every ideal of K[x 1 , . . . , x n ] admits a Gröbner basis. This shows in passing that all multivariate ideals are finitely generated, a nonobvious, powerful and strong mathematical result. One of the crucial features of Gröbner bases is that the result of the multivariate division algorithm is uniquely defined when dividing by a Gröbner basis.

Lemma 10.7. Let G = {g 1 , . . . , g s } be a Gröbner basis for an ideal I ⊂ K[x 1 , . . . , x n ] and let f be a polynomial in K[x 1 , . . . , x n ]. Then there is a unique r ∈ K[x 1 , . . . , x n ] such that:

(i) No term of r is divisible by any of LT (g 1 ), . . . , LT (g s ).

(ii) There is g ∈ I such that f = g + r.

We give the proof of this result (taken from [START_REF] Cox | Ideals, Varieties, and Algorithms: An Introduction to Computational Algebraic Geometry and Commutative Algebra[END_REF]), as it illustrates the connection between the definition of Gröbner bases and the division algorithm, besides being relatively simple.

Proof. The existence of such an r is guaranteed by the division algorithm. To prove uniqueness, suppose that f = g + r = g + r both satisfy the conditions of the lemma. Then rr = gg ∈ I, so that if r = r , then LT (rr ) ∈ LT (I) = LT (g 1 ), . . . , LT (g s ) (because G is a Gröbner basis). Now LT (I) is a monomial ideal (i.e., an ideal generated solely by monomials), and it is not difficult to check that the monomials belonging to a monomial ideal are precisely the multiples of the generators. This means that LT (rr ) is a multiple of some LT (g i ), but this is impossible because no terms of r, r is divisible by one of LT (g 1 ), . . . , LT (g s ). Thus, rr must be zero.

Note that the uniqueness of the remainder means that provided we know a Gröbner basis of an ideal I, we may use it to decide the Ideal Membership problem (but we do not know with which complexity yet).

For various reasons, it is often very convenient to work with homogeneous ideals. We have already seen that considering the homogenized version of an ideal I, we may revert to the original by fixing the extra variable to one. The good thing is that this operation preserves Gröbner bases.

Theorem 10.8 ([BKW93], lemma 10.57, (vii)). Let I be an ideal of K[x 1 , . . . , x n ], I h its homogenized version and G h a Gröbner basis of I h . Then setting the last variable of all the polynomials of G h to 1 yields a Gröbner basis of I.

It is natural to question the unicity of Gröbner bases. In vector spaces, bases are not unique, but echelonized bases are unique. Gröbner bases are not unique, and can even be somewhat redundant. However, while the situation is again a bit more complicated, it is possible to define an analogous notion of "echelonized" Gröbner basis. Definition 10.14. A minimal Gröbner basis for a polynomial ideal I is a Gröbner basis such that:

(i) LC(p) = 1 for all p ∈ G. (ii) For all p ∈ G, LT (p) / ∈ LT (G -{p}) .
To compute a minimal Gröbner basis, we may simply compute a Gröbner basis and remove from it all the polynomials not matching the criterion. Even like that, there may be several minimal Gröbner bases, but it is possible to single one out. Definition 10.15. A reduced Gröbner basis for a polynomial ideal I is a Gröbner basis such that: (i) LC(p) = 1 for all p ∈ G.

(ii) For all p ∈ G, no monomial of p lies in LT (G -{p}) .

If I = {0} is a polynomial ideal, then given a monomial order, I has a unique reduced Gröbner basis [CLO91, chapter 2, §7, proposition 6]. Most computer algebra systems compute reduced Gröbner bases. This is convenient, if only because then comparing the reduced Gröbner bases allows to decide whether two ideals are equal.

Gröbner Bases as "Linear" Bases

Following [START_REF] Lazard | Gröbner-bases, gaussian elimination and resolution of systems of algebraic equations[END_REF], we outline the connection between Gröbner basis and Gaussian elimination. Consider an ideal I = f 1 , . . . , f t . It can be seen as a K-vector space of infinite dimension, spanned by m • f i when i ranges across 1, . . . , t and m ranges across all monomials. As a vector space, I does not have a finite basis, but it is possible to write down a program that returns in finite time a sparse representation of the i-th vector of the basis. On the (infinite) basis of K[x 1 , . . . , x n ] consisting of all the monomials, the generators of I define an infinite matrix, each row of which represent a given m • f i . Each row thus has a finite number of non-zero entry (as many as f i ). On the column corresponding to some monomial m, the only coefficient that appear are those in m f i , where m divides m. This shows that they are also in finite number.

This finiteness property makes it possible to triangulate the matrix by row operations. This is a finite process for each pivot, which enumerates a basis of I as a vector space. Another way of expressing the same idea would be to say that a the list of basis vectors of I is coinductive and can be enumerated by a corecursive function. The whole list cannot be generated in finite time, but the "next" basis vector can be obtained in finite time. However, while a "linear" basis of I (i.e., a basis of I seen as a vector space) is not finite, it admits a finite description, and (big surprise!) Gröbner bases are showing up again. Notice the connection between the following result and proposition 10.6. Proposition 10.9 [START_REF] Lazard | Gröbner-bases, gaussian elimination and resolution of systems of algebraic equations[END_REF]). G = {g 1 , . . . , g s } is a Gröbner basis of the ideal I = f 1 , . . . , f t if and only if the following set of polynomials is a basis of I seen as a vector space

{mf i | 1 ≤ i ≤ t, m is a monomial, LT (mf i ) is not a multiple of LT (f j ) for j < i}

Solving Polynomial Systems Using Gröbner Bases

Given a set of polynomial equations, the killer tool to derive its solution is a Gröbner basis of the ideal spanned by the equations with respect to the lexicographic order. This is notably due to the following theorem.

Theorem 10.10 (The Elimination Theorem). Let I ⊂ K[x 1 , . . . , x n ] be an ideal and let G be a Gröbner basis of I with respect to lexicographic order

x 1 > x 2 > • • • > x n . Then, for every 0 ≤ ≤ n, the set G = G ∩ K[x , . . . , x n ]
is a Gröbner basis of the -th elimination ideal

I = I ∩ K[x , . . . , x n ].
Given a Gröbner basis G for an ideal I = f 1 , . . . , f s with respect to the lexicographic order, G ∩ K[x n ] is a Gröbner basis of the (potentially empty) univariate ideal I ∩ K[x n ]. All the solutions of f 1 = 0, . . . , f s = 0 in particular satisfy the univariate polynomial equation(s) in x n contained in the n-th elimination ideal G ∩ K[x n ]. If this last ideal is not empty, then we can find all the possible values of the last variable by determining the roots of univariate polynomial(s). We can then substitute these values in the bivariate equations in G ∩ K[x n-1 , x n ], thus making them univariate. Solving in x n-1 will reveal all the possible values of both x n-1 and x n . The process can be repeated with x n-2 , then x n-3 , . . . , x 1 . The only problem is that at some point the -th elimination ideals may not reveal more information than the previous ones, so that we would not be able to determine the possible values of the -th variable. We would then get stuck.

Zero-Dimensional Ideals

This issue is nicely resolved when the equations have a finite number of solutions. Generally speaking, it is possible to associate a notion of dimension to ideals and affine varieties that generalizes the usual notion in linear algebra, but we do not want to get into too much detail. The important point is that affine varieties associated to ideals of dimension zero only contain a finite number of points in the algebraic closure of the field. Conversely, the affine variety associated to a positive-dimensional ideal has an infinite number of points in the algebraic closure of the field. Most if not all polynomial systems we will encounter in the next chapter are zero-dimensional. The Gröbner bases of such ideals have special properties, resolving the above problem.

Theorem 10.11 ([BKW93], theorem 6.54). Let I ⊂ K[x 1 , . . . , x n ] be a proper ideal, and K be algebraically closed. Then the following conditions are equivalent:

(i) V (I) is finite (ii) I is of dimension zero (iii)
For every ordering and every Gröbner basis G of I with respect to the chosen ordering there exist, for each

1 ≤ i ≤ n, g i ∈ G with LT (g i ) = X νi i , for some 0 < ν i ∈ N.
This guarantees that G ∩ K[x , . . . , x n ] always contains an equation of the form x ν + . . . . Therefore, substituting the possible values of x +1 , . . . , x n into the -th elimination ideal does result in (at least) one polynomial equation(s) in x , which thus yields the set of possible values of x .

If K is finite, then any system of polynomial equations has a finite number of solutions, but it does not mean that the ideal spanned by the equations is zero-dimensional, because the field is obviously not algebraically closed. We may of course always embed our equations in the algebraic closure of K, but then the number of solutions may become infinite. Theorem 10.11 tells us that when the number of solutions in the algebraic closure is finite, then we may expect any Gröbner basis to have the nice shape property from item (iii). Note that the number of solutions in the algebraic closure may very well be exponentially bigger than the number of solutions in the base field. This is essentially a problem when using the FGLM order-changing algorithm discussed below.

When K = F q is a finite field, it is possible to enforce that the solutions in the algebraic closure are exactly those over the ground field. This is achieved by adding to the system the so-called field equations, i.e., the equations x q i -x i = 0, where q is the cardinality of the field. If L is an overfield of F q , then the only elements of L satisfying x qx = 0 are the elements of F q . Therefore, any ideal containing the field equations is guaranteed to be zero-dimensional.

Adding the field equations is usually beneficial to the complexity of Gröbner basis computations when the field is "not too big" compared to the degree of the polynomials reached during the computation. When q = 2, it often speeds up Gröbner basis computations quite a lot. When q is large (say q = 256), it may however slow them down.

Worst-Case Complexity of Gröbner Bases Computation

We will not describe algorithms to compute Gröbner bases. First of all, the description of the simplest one, Buchberger's algorithm [START_REF] Buchberger | Ein Algorithmus zum Auffinden der Basiselemente des Restklassenringes nach einem nulldimensionalen Polynomideal[END_REF] 2 , can be found in any good textbook [START_REF] Cox | Ideals, Varieties, and Algorithms: An Introduction to Computational Algebraic Geometry and Commutative Algebra[END_REF][START_REF] Becker | Gröbner bases: a computational approach to commutative algebra[END_REF]. The descriptions of the more sophisticated ones, Faugère's F 4 and F 5 can be found in [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases (F4)[END_REF][START_REF] Faugère | A New Efficient Algorithm for Computing Gröbner Bases Without Reduction to Zero (F5)[END_REF]. Our main reason not to describe these algorithms is that it actually reflects the way we have been thinking about them: we used them as black-boxes in a more general polynomial system-solving procedure. Their only property that matters to us is their running time.

We will discuss this delicate issue more in-depth later, and we first mention some general results for the sake of completeness. Ideal Membership is EXPSPACE-complete over Q [START_REF] Mayr | Membership in plynomial ideals over q is exponential space complete[END_REF]. In addition, there are infinite families of ideals, over any field, such that any Gröbner basis thereof contains a polynomial of degree 2 2 Ω (n) (resp. contains 2 2 Ω (n) polynomials) [START_REF] Mayr | The complexity of the word problems for commutative semigroups and polynomial ideals[END_REF][START_REF] Huynh | A superexponential lower bound for gröbner bases and church-rosser commutative thue systems[END_REF] 3 . Later on, Kühnle and Mayr gave an exponential-space (but completely impractical) algorithm to compute Gröbner bases [START_REF] Kühnle | Exponential space computation of gröbner bases[END_REF], thereby matching the space lower-bound.

When dealing with homogeneous ideals (i.e., ideals generated by homogeneous polynomials), things are a bit better, since Homogeneous Ideal Membership is "only" PSPACE-complete [START_REF] Mayr | On polynomial ideals, their complexity, and applications[END_REF]. Unfortunately, computing a Gröbner basis provably requires exponential space (thus doubly exponential time) in this case.

These alarming results are worst-case results though, and they do not fully reflect the "average" behavior of Gröbner basis algorithm. The oldest and simplest Gröbner basis algorithm was designed by Buchberger [START_REF] Buchberger | Ein Algorithmus zum Auffinden der Basiselemente des Restklassenringes nach einem nulldimensionalen Polynomideal[END_REF], and can be practical under certain circumstances (but may take more than exponential space under some others). Faugère's F 4 algorithm [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases (F4)[END_REF] is essentially an smart reformulation of Buchberger's algorithm using efficient linear algebra to perform polynomial reductions in the spirit of Lazard [START_REF] Lazard | Gröbner-bases, gaussian elimination and resolution of systems of algebraic equations[END_REF]. It is often several orders of magnitude faster than Buchberger's algorithm when implemented with care, and several implementations of very high quality are available commercially, most notably in the MAGMA computer algebra system [BCP97]. Faugère's F 5 algorithm [START_REF] Faugère | A New Efficient Algorithm for Computing Gröbner Bases Without Reduction to Zero (F5)[END_REF] is somewhat different, and uses a more sophisticated criterion than its predecessors to avoid useless computations. Only toy implementations of F 5 are available for cryptographic purposes though. A simplified version of F 5 is very cleanly described in Bardet's thesis [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF], but is less efficient than the full-fledged algorithm.

D-Gröbner Bases

Sometimes the computation of a full Gröbner basis is not necessary to work with a given ideal. When dealing with homogeneous ideals, a satisfying notion of "partial Gröbner Basis" is available. Definition 10.16. A finite subset G of a homogeneous ideal I is a D-Gröbner basis if for any f of degree at most D, LT (f ) is divisible by LT (g i ) for some g i ∈ G (or equivalently if the division of every polynomial f of degree at most D in I by G always yields a zero remainder).

Thus, a D-Gröbner basis is capable of deciding the Ideal Membership problem for polynomials of degree at most D. In addition, D-Gröbner bases can be computed in time polynomial in n D , for instance, by dropping any computation with polynomial of degree higher than d in Buchberger's Algorithm. In fact, looking a bit into proposition 10.9 results in an algorithm to compute a D-Gröbner basis of the homogeneous ideal f 1 , . . . , f t [Laz83, Bar04]: Given a homogeneous ideal I and a monomial ordering, there is a degree D max such that a D max -Gröbner basis of I is in fact a "normal" Gröbner basis of I. This D max can be chosen to be the highest degree of any polynomial in a Gröbner basis of I with respect to the ordering. It follows that using the above Gaussianelimination technique, a full Gröbner basis can be computed in time O (n + D max )

Dmax .

Looking at his algorithm reveals why the XL algorithm [START_REF] Courtois | Efficient Algorithms for Solving Overdefined Systems of Multivariate Polynomial Equations[END_REF] invented by cryptographers is in fact essentially a Gröbner basis computation algorithm known for about twenty years, as was pointed out in [AFI + 04].

Hilbert Function and the Degree of Regularity

To understand the complexity of Gröbner basis computation, it seems important to look into this degree D max defined just above. The set of all homogeneous polynomials of degree exactly d is not a vector space because it misses zero. We therefore consider the following set:

K[x 1 , . . . , x n ] d = {0} ∪ f ∈ K[x 1 , . . . , x n ] | f is homogeneous of degree = d
And K[x 1 , . . . , x n ] d is a vector-space. This allows us to define the vector space of homogeneous polynomials of degree d in I:

I d = I d ∩ K[x 1 , . . . , x n ]
When I is homogeneous, then I d is the row-space of the Macaulay matrix of degree d. This matrix has

n+d d
columns, because this is the number of degree-d monomials on n variables. Yet, its rank is dim I d , independently of the number of rows. There are indeed often non-trivial linear dependencies between the rows of the Macaulay matrices: if f i = α k m k and f j = β k m k are both degree-d generators of I, where the m k 's are monomials, then

f i f j = α k m k f j = β k m k f i .
As a consequence, we find that α k m k f j -β k m k f i = 0 in the Macaulay matrix of degree 2d. Gauss-Reducing the Macaulay matrices is thus an inefficient way to compute Gröbner bases, as it will often produce zero rows (just like Buchberger's algorithm will reduce S-polynomials to zero).

Definition 10.17. The Hilbert function of an homogeneous ideal I ⊂ K[x 1 , . . . , x n ] is the function on the nonnegative integers d defined by

HF I (d) = dim K[x 1 , . . . , x n ] d -dim I d = n + d d -dim I d
When I is a monomial ideal (i.e., an ideal generated by monomials only), then the Hilbert function counts the number of monomials of degree d not contained in I. It is known that the Hilbert function coincide with a certain polynomial for sufficiently large values of d. This polynomial is called the Hilbert polynomial. It follows from proposition 10.11 that when I is a homogeneous ideal of dimension zero, then the Hilbert polynomial is identically zero.

Definition 10.18. The degree of regularity of I (also called index of regularity) is the smallest integer s 0 such that for all s ≥ s 0 the Hilbert function is equal to the Hilbert polynomial. We denote it by H(I) in the sequel (but note that it depends on the ordering).

It plays a crucial role in the complexity of many algorithms operating on ideals. Proposition 10.12. A reduced H(I)-Gröbner basis of a zero-dimensional homogeneous ideal I is in fact a full Gröbner basis of I.

Proof. Let G be the reduced Gröbner basis of I, f be a polynomial of G of maximum degree, and d be its degree. Let us reason by contradiction and assume that d > H(I). We will show that LT (f ) belongs to LT (G -{f }) , thus contradicting the fact that G is minimal (and reduced).

Because I is zero-dimensional, its Hilbert Polynomial is identically zero, and therefore I H(I) is in fact equal to K[x 1 , . . . , x n ] H(I) . As a consequence, there is in I H(I) a polynomial g whose leading monomial divides that of f . By definition of I d , g can be written as a polynomial combination of G -{f } (because f is of greater degree than g). This shows that LT (g) ∈ LT (G -{f } , and contradicts the minimality of G.

Generic Properties

The depressing worst-case results mentioned above suggest that H(I) can become exponential in some cases. However, the situation is generically better than what the worst-case result suggest. Definition 10.19. Consider the vector space K m . A property P is generically true over K m if it is true on all points of K m except on a given proper affine variety (or, equivalently, a property is generic if it is true on a Zariski open set of K m ).

The intuition is that generic properties are true "most" of the time. A non-trivial but interesting example: n × n matrices are generically invertible over any field K. Indeed, non-invertible matrices have a zero determinant, and the determinant is a polynomial in the matrix coefficients. This means that "most" matrices are invertible, and this result is consistent with our expectations: invertible matrices over R form a dense subset of all the matrices over R. Indeed, if we choose "at random" the coefficients of a matrix over R, the probability that the polynomoial equation det = 0 holds is negligible.

A funny consequence of the definition of generic properties, is that over an infinite field, if a given property is true except on an algebraic variety, then it suffices to show that it is true on one point to show that it is true almost everywhere.

This reasoning clearly does not extend to finite fields. The fact that a generic property holds almost everywhere is clearly not true, because the algebraic variety over which the property is not true represent a fixed fraction of the sampling space. A Generic property is thus true with some (unknown) probability. This is examplified again by invertible matrices: over F 2 8 , more than 99.5% of all matrices are invertible, yet over F 2 , on the other hand, only 28.88% of the matrices are invertible.

This example illustrates simultaneously the power and the limitations of this concept: the result about invertible matrices is mostly valid and makes sense, but we may have to be cautious, especially over small finite field. In this latter case, we expect generic property to hold with a non-negligible probability, but in general this is the best we can say.

Generic Behavior of Gröbner Bases

We are now ready to discuss the generic properties of Gröbner bases. Theorem 10.13 ([Laz83], theorem 1). Let I = f 1 , . . . , f k ⊂ K[x 1 , . . . , x n ] be a homogeneous ideal of dimension zero, where f i is of degree d i and k ≤ n. Then after a generic change of variables, every Gröbner base for the lexicographic order contains a polynomial of degree

d 1 d 2 . . . d k Theorem 10.14 ([Laz83], theorem 2). Let I = f 1 , . . . , f k ⊂ K[x 1 , . . . ,
x n ] be a homogeneous ideal of dimension zero, where f i is of degree d i and k ≤ n. Then after a generic change of variables, the elements of any minimal reduced Gröbner base for the grevlex ordering have degree at most

k i=1 d i -n + 1.
The bound of the second theorem was first given by Macaulay in the context of his work on multivariate resultants. Theorem 10.14 tells us that computing a Gröbner basis is in fact simply exponential "most of the time" when dealing with homogeneous ideals of dimension zero. This comes from the fact that we may obtain an actual Gröbner basis with respect to the grevlex order by computing only a D-Gröbner basis of the ideal, where D is the bound of the second theorem. When dealing with with n quadratic equations in n variables, theorem 10.14 tells us that we can (generically) compute a Gröbner basis by crunching polynomials of degree at most 2k -n + 1. This is less than n + 1, and the bound is reached when we have k = n equations.

Influence of the Ordering

The two previous theorems suggest that the choice of the ordering has a deciding influence on the complexity of computing a Gröbner basis. Consider for instance the ideal:

I = x 5 + y 4 + z 3 -1, x 3 + y 3 + z 2 -1
A Gröbner basis of I with respect to the grevlex order is:

G = y 6 + xy 4 + 2y 3 z 2 + xz 3 + z 4 -2y 3 -2z 2 -x + 1, x 2 y 3 -y 4 + x 2 z 2 -z 3 -x 2 + 1, x 3 + y 3 + z 2 -1
A Gröbner basis of I with respect to the lexicographic order, on the other hand, is too messy to be shown. One of its polynomial has 282 terms, total degree 25, and a largest coefficient of 170255391... In most cases, the preferred strategy to compute a (more useful) lexicographic Gröbner basis is to first compute a Gröbner basis for the grevlex order, and then use an ad hoc to change the order of the Gröbner basis.

Order Changing Algorithms

There are two algorithms to change the order of an already-computed Gröbner basis: the FGLM algorithm [START_REF] Faugère | Efficient Computation of Zero-Dimensional Gröbner Bases by Change of Ordering[END_REF] and the Gröbner Walk [START_REF] Collart | Converting bases with the gröbner walk[END_REF]. The former only applies to zero-dimensional ideals, while the latter can always be used. However, except in very special cases its complexity is unknown, while the complexity of FGLM is well-understood.

Theorem 10.15 ([FGLM93]

). Let I be a zero-dimensional ideal, G 1 a reduced Gröbner basis of I with respect to < 1 . There is an algorithm that, given G 1 , computes a Gröbner basis of I with respect to < 2 with O n • D 3 arithmetic operations in K, where D is the number of solutions of I in the algebraic closure of K.

Over finite fields, adding the field equations helps keeping D as low as possible, and thus makes the FGLM algorithm work faster.

Regular and Semi-Regular Sequences

What makes the behavior of the usual Gröbner basis algorithms difficult to understand is the possibility that the sequence of actions taken by the algorithm depends very much on the coefficients of the input polynomial system. This dependency also exist in, say, the euclidean algorithm to compute the Greatest Common Divisor, or in the Gaussian algorithm to put a matrix in row-echelon-form, but these cases the dependency less critical (i.e., the Gaussian algorithm will perform O n 3 operations no matter what the actual coefficients of the matrix are). In particular, algebraic relations between the coefficients of the polynomial may lead to unpredictable numerical cancellation in the course of the algorithm, or unpredictable polynomial relations where there should not be any.

Regular Sequences.

However, the behavior of the usual algorithms is better understood when these unfortunate events are guaranteed not to happen. This lead to the definition of sequence of polynomials that "behave".

Definition 10.20. Let R = K[x 1 , . . . , x n ]. The sequence f 1 , . . . , f m ∈ R is a regular sequence if: (i) f 1 , . . . , f m = R
(ii) for all 1 ≤ i ≤ m, and all g ∈ R, then

gf i ∈ f 1 , . . . , f i-1 =⇒ g ∈ f 1 , . . . , f i-1
This is equivalent to say that f k must not be a zero divisor in R/ f 1 , . . . , f k-1 , or that multiplication by f k must be injective on the quotient.

The notion of regular sequence of polynomials generalizes that of linearly independent sequence of vectors. If a family of vectors x 1 , . . . , x t are linearly independent, then there are no non-trivial linear relations of the form α 1 x 1 + • • • + α t x t = 0. If f 1 , . . . , f m is a regular sequence, then there are no "non-trivial" polynomial relations between the f i 's. Of course the situation is more complicated, because some polynomial relations always exist: if we pick P k ∈ f 1 , . . . , f k-1 , then by definition of ideals P k f k ∈ f 1 , . . . , f k-1 , and there exist a sequence of polynomials P 1 , . . . , P k-1 such that

P 1 f 1 + • • • + P k-1 f k-1 + P k f k = 0.
Such relations always exist, and are therefore "trivial".

If the f i 's are regular, then all polynomial relations between the f i 's are "trivial". More precisely, if there exist a sequence of P i 's such that

P 1 f 1 + • • • + P k-1 f k-1 + P k f k = 0, then by definition of ideal P k f k belongs to f 1 , . . . , f k-1 .
In other terms, P k f k is congruent to zero modulo this ideal. Because multiplication by f k is injective in the quotient, then P k itself is necessarily congruent to zero, ergo P k belongs to f 1 , . . . , f k-1 , and the polynomial relation is trivial. Regular sequences enjoy many additional nice properties, summarized in the following theorem.

(ii) The Hilbert Series of f 1 , . . . , f m is ∞ d=0 HF I (d) • z d = m i=1 1 -z di (1 -z) n
and reciprocally, every sequence of polynomials having this Hilbert series is a regular sequence (iii) The degree of regularity of I is k i=1 (d i -1) + 1 (Macaulay's bound) (iv) An arbitrary sequence of m polynomials is generically regular.

We have seen that linearization is capable of dealing with very overdetermined systems in polynomial time, which suggests that overdetermined systems are easier to solve, for instance by having a lower degree of regularity. The framework of generic sequences unfortunately cannot be used to explore this aspect of Gröbner basis complexity. The first item of the theorem indeed implies that a regular sequence cannot have more than n elements (observe again the analogy with linearly independent families of vectors). This is further annoying because most systems encountered in cryptography are overdetermined.

Semi-Regular Sequences: Dealing With Overdetermined Systems

To overcome this difficulty, Bardet and Faugère extended the notion of regular sequence to overdetermined systems.

Definition 10.21. Let R = K[x 1 , . . . , x n ]. The sequence of homogeneous polynomials f 1 , . . . , f m ∈ R is a semi-regular sequence if: (i) I = f 1 , . . . , f m = R
(ii) for all 1 ≤ i ≤ m, and all g ∈ R, then

gf i ∈ f 1 , . . . , f i-1 and deg(gf i ) < H(I) =⇒ g ∈ f 1 , . . . , f i-1
Informally speaking, semi-regular sequences behave like regular sequences "up to the degree of regularity". The polynomials in a semi-regular sequence are thus "as independent as possible".

Theorem 10.17 [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF]). The sequence f 1 , . . . , f m of homogeneous polynomials of respective degrees d 1 , . . . , d m in K[x 1 , . . . , x n ] is semi-regular if and only if the Hilbert series of the corresponding ideal is

m i=1 1 -z di m (1 -z) n ,
where a i z i = b i z i with b i = a i when a j > 0 for all j ≤ i, and b i = 0 otherwise.

It is shown in [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF] that the set of semi-regular sequences of m polynomial in K[x 1 , . . . , x n ] is a Zariski open set. The problem is to show that it is non-empty for any value of n and m. An explicit example is known when m = n + 1 [Frö85], but no general example are known for other values of m. In addition, generic properties has little meaning other the finite fields that interest us. It is conjectured, on the basis of extensive experiments, in [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF] that the proportion of semi-regular systems becomes 1 when n goes to +∞. Therefore, we will often assume that for large n a random system is almost surely semi-regular (which is certainly not a best-case assumption, as it means that the system is not easier to solve than the average).

It follows from theorem 10.17 that when f 1 , . . . , f m are homogeneous and form a semi-generic sequence, then the degree of regularity of f 1 , . . . , f m is the smallest degree d such that the coefficient of degree d in the series expansion of m i=1 1 -z di m /(1 -z) n is not strictly positive. This property enables an explicit computation of the degree of regularity of semi-regular sequences for given values of m and n, thus allowing to determine the complexity of computing a Gröbner basis.

Furthermore, Bardet et al. [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF][START_REF] Bardet | Asymptotic Behaviour of the Degree of Regularity of Semi-Regular Polynomial Systems[END_REF] give asymptotic developments of the expression of the degree of regularity in the case of α • n equations in n variables, for any constant α greater than 1. When there are α • n semi-regular quadratic equations in n variables, [START_REF] Bardet | Asymptotic Behaviour of the Degree of Regularity of Semi-Regular Polynomial Systems[END_REF] gives:

D reg = n α - 1 2 -α(α -1) - a 1 2(α(α -1)) 1 6 n 1 3 -2 - 2α -1 4 α(α -1) + O 1/n 1/3 ,
with a 1 ≈ -2.33811. (10.2)

Complexity of Gröbner Bases Computation

These results on semi-regular sequences enable us to estimate the complexity of a Gröbner basis computation without actually running it.

We have seen that the computation of a Gröbner basis essentially amounts to echelonize a sparse matrix with M columns and potentially many more rows, where M is the number of monomials of degree D reg in n variables. The F 5 algorithm tries very hard to reduce the number of rows to the minimum, and it is shown in [START_REF] Faugère | A New Efficient Algorithm for Computing Gröbner Bases Without Reduction to Zero (F5)[END_REF][START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF] that on a regular or semi-regular sequence it produces matrices without linear dependencies between the rows. The complexity of echelonizing these matrices is roughly the equivalent of performing O n ω•Dreg arithmetic operations in K, with 2 < ω ≤ 3 being the linear algebra constant, and n the number of variables of ideal considered. Because the matrices are very sparse, it is not unreasonable to consider that ω = 2. A distinctive feature of Gröbner basis computation as a way of solving multivariate polynomial systems is that the complexity of computing a Gröbner basis is vastly independent from the cardinality of the field. Exhaustive search, on the other hand, becomes quickly very impractical when the size of the field increases.

In her PhD thesis [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF], Bardet determined that a simplified version of the F 5 algorithm computes a Gröbner basis of a regular sequence of n quadratic polynomial in n variables in 2 4.295n arithmetic operations in K. For the sake of comparison, echelonizing the Macaulay matrix of degree given by the Macaulay bound requires about 2 6n field operations. This suggests that exhaustive search is an asymptotically faster way to solve a system of n quadratic equations in n variables over F q if and only if q ≤ 20. If q is bigger, then computing a Gröbner basis will be faster. With more than n equations, Macaulay's bound is improved by equation (10.2). In any case, the exact degree of regularity can always be read off the Hilbert series. Figure 10.1 shows how the complexity of computing a Gröbner basis of a semi-regular sequence of quadratic polynomials evolves with the parameters.

The Case of very Overdetermined Systems

The linearization technique is capable of solving in time O n 6 systems of ≈ n 2 /2 equations in n variables. It unfortunately breaks down if we have (say) only n 2 /3 equations. How hard is this particular case? It is particularly relevant for multivariate cryptanalysis, because it is one of the rare situations where Gröbner basis computations might solve systems of multivariate quadratic equations that would not be tractable by exhaustive search or any other technique. We may always use the Hilbert series to determine the degree of regularity of corresponding semi-regular sequences and derive the complexity of a Gröbner basis computation. This for instance enables us to draw the points on Figure 10.1.

While we are well-aware that it is not theoretically justified (because equation (10.2) is established for a constant α), we now set α = βn, and express d reg as a function of β in (10.2). This yields

d reg (β) = 1 8β - a 1 2β 1/3 - 3 2 + O (1/n) . (10.3)
We compared the result predicted by this equation to the actual values (given by the Hilbert series), for sufficiently big n. Figure 10.2 shows both values. We (empirically) found the constant term of ( 10.3) to be inaccurate (the best fit seems to be 1/3). We therefore estimate that given α • n 2 semi-regular quadratic equations in n variables we should expect for n big enough a degree of regularity of:

D reg = 1 8α - a 1 2α 1/3 + 1 3

Finite Vector Spaces Combinatorics

We conclude this "toolbox" chapter by determining the probability that a uniformly random endomorphism of (F q )

n , potentially conditioned on meeting certain conditions, satisfies some given properties. The probability that a random endomorphism is invertible is well-known. The probability that a random endomorphism has a given rank is less well-known but is readily found in the literature [START_REF] Cooper | On the distribution of rank of a random matrix over a finite field[END_REF], even in the case where the entries of the matrix are not uniformly distributed. The probability that a given vector belongs to the image of a random linear map is (apparently) less well-known and much less readily available in the existing litterature. We also investigate the probability that a random endomorphism satisfies combinations of these events. We establish all these results by counting the number of endomorphisms meeting the conditions at hand. The results presented here are heavily inspired by Dubois's PhD thesis [START_REF] Dubois | Cryptanalyse de Schémas Multivariés[END_REF].

Goldman and Rota first counted the number of subspaces of a vector space over F q [START_REF] Goldman | The number of subspaces of a vector space[END_REF]. After that, the analogy between set combinatorics and finite vector space combinatorics has been investigated by many researchers. The toolbox of combinatoricians, including Möbius inversion [START_REF] Bender | On the applications of mobius inversion in combinatorial analysis[END_REF] and the exclusioninclusion principle [START_REF] William | q-analogs of the inclusion-exclusion principle and permutations with restricted position[END_REF], has been progressively adapted to finite vector spaces, as q-analogs of their set-combinatorics counterparts. q-Analogs. We will try to express our results using the formalism of q-analogs. A q-analog is "a mathematical expression parameterized by a quantity q that generalizes a known expression and reduces to the known expression in the limit q → 1" [Wei]. The starting point is the observation that:

lim q→1 1 -q n 1 -q = n
This leads to the definition of [n] q (read: "the q-bracket of n"), which is the q-analog of the integer n:

[n] q = 1 -q n 1 -q
It is then possible to define q-analogs of the usual combinatorial quantities.

q-Factorial. It seems natural to define the q-factorial to be:

[n] q ! = [1] q [2] q . . . [n -1] q [n] q
We readily verify that we recover the usual factorial when q → 1, but the analogy is in fact deeper. For instance, [n] q ! is the number of complete flags of (F q ) n , i.e., of sequences of subspace S 0 , . . . , S n with the strict inclusions:

0 = S 0 ⊂ S 1 ⊂ • • • ⊂ S n = (F q ) n
This result is easy to establish by induction on n [START_REF] Stanley | Enumerative combinatorics[END_REF]: given such a flag,

0 = S 1 /S 1 ⊂ S 2 /S 1 ⊂ • • • ⊂ S n /S 1 ∼ = (F q ) n-1
is a complete flag of (F q ) n-1 . There are [n] q possibles choices for S 1 : a one-dimensional vector space is fully specified by the choice of a non-zero vector, which makes q n -1 possibilities, but q -1 colinear vectors span the same subspace. When q → 1, we recover the usual result that n! is the number of sequences of n subsets of [1; n] such that:

∅ = S 0 ⊂ S 1 ⊂ • • • ⊂ S n = [1; n]
Such sequences in fact define a total ordering of [1; n], or, in other terms, a permutation.

q-Binomial. Armed with the q-factorial, we may define the q-binomial coefficient just like the usual thing:

n k q = [n] q ! [k] q ![n -k] q ! It is well-known that n k is the number of k-element subsets of [1; n].
We claim that n k q is the number of k-dimensional subspaces of (F q ) n . To see why, let E k be a subspace of dimension k, and observe that [n] q ! is the product of the number of k-dimensional subspaces and of the number of complete flags of (F q )

n such that S k = E k . Such a complete flag completely determines (and is completely determined by) two complete flags:

0 = S 0 ⊂ S 1 ⊂ • • • ⊂ E k ∼ = (F q ) k 0 = E k /E k ⊂ S k+1 /E k ⊂ • • • ⊂ S n /E k ∼ = (F q ) n-k
Therefore, the number of complete flags of (F q ) n such that

S k = E k is [k] q ![n -k] q !,
and the expression of the q-binomial coefficient is established. A different but equally interesting way to establish the same result would be to remark that

n k = #sequences of k distinct elements in an n-set #sequences of k distinct elements in a k-set ,
and showing that:

n k q = #sequences of k independent vectors in (F q ) n #sequences of k independent vectors in (F q ) k .
It is also notable that the q-binomial coefficients enjoy q-analog versions of the usual identities:

n k q = n n -k q n k q = q n -1 q k -1 n -1 k -1 q n k q = q k n -1 k q + n -1 k -1 q n k q = n -1 k q + q n-k n -1 k -1 q
Automorphisms of (F q ) n . The number of automorphisms of (F q ) n is easy to derive from the q-analogs. An automorphism L determines in a unique way a complete flag of (F q ) n , by setting S i = S i-1 + L(e i ) . However, the converse is not true, and many possible L's generate the same flag. Given a complete flag, we consider the n one-dimensional subspaces L i of (F q )

n such that L i is a supplementary of S i-1 in S i , for i = 1, 2, . . . , n (the L i 's are not unique but we choose some). The image of L on e i must be the sum of a non-zero vector of L i and of any vector of S i-1 . There are therefore (q -1)q i-1 choices for L(e i ). This shows that:

|GL n (F q ) | = [n] q ! • q n(n-1)/2 • (q -1) n
The q-analogy is not as satisfying as we would like, because it would seem natural that the number of automorphisms (i.e., the linear permutations of an n-dimensional vector space) of (F q ) n degenerates to n! (i.e., the number of actual permutation of an n-element set) when q → 1, yet it is not the case. We therefore introduce an ad hoc notation for the number of automorphisms of (F q ) n :

n q ! = |GL n (F q ) | = [n] q ! • q n(n-1)/2 • (q -1) n
It must be noted that expanding this expression yields the expected:

n q ! = n i=1 q n -q i
This product is usually derived in the following way: since all the L(e i ) must be non-zero and linearly independent, then L(e i ) must be chosen in (F q ) n -L(e 1 ), . . . , L(e i-1 ) , and this set has q nq i elements.

Injective Linear Maps From (F q ) k to (F q )

n . An injective linear map f from (F q ) k to (F q ) n uniquely determines a k-dimensional subspace E of (F q )

n (its image). In turn, any basis of E determines f completely. Note that there is a one-to one correspondance between the bases of (F q )

n and its automorphisms. This

shows that the number of injective linear maps from (F q ) k to (F q ) n is k q ! n k q .

Endomorphisms of a Given Rank. We wish to count the number of endomorphisms of (F q ) n whose kernel is of dimension k and contains a given subspace F (of dimension smaller than k). This result is well-known, and our exposition is vastly plagiarized from [START_REF] Dubois | Cryptanalyse de Schémas Multivariés[END_REF]. We proceed in two steps, punctuated by the two following lemma.

Lemma 10.18. The number of subspaces of (F q )

n of dimension k containing a subspace F of dimension s ≤ n is n-s k-s q .

Proof. The idea is that subspaces of (F q ) n of dimension k containing F are in one-to-one correspondance with the subspaces of dimension ks of the quotient (F q ) n /F . Let us verify this assertion. Let G be a subspace of (F q )

n containing F , and let H be a supplementary of F in G, so that G = H F , and H has dimension ks. The point is that the image of F in the quotient is the trivial subspace, while the image of H is isomorphic to H (hence the one-to-one correspondance).

So, the number we are interested in is also the number of subspaces of dimension ks in the quotient, which has dimension ns, and we know that this is n-s k-s q .

Lemma 10.19. The number of endomorphisms of (F q ) n whose kernel a) is of dimension k and b) contains a given subspace F of dimension s ≤ k is:

D(n, k, s) = n -s k -s q n k q n -k q !
Proof. Let U be a subspace of (F q ) n of dimension k containing F , and V a complementary subspace. Any endomorphism of (F q )

n is uniquely defined by its restriction to U and V . An endomorphism admits U as its kernel if and only if it vanishes on U and is injective on V . We have seen that there are n n-k q nk q ! injective linear maps from V to (F q ) n . By lemma 10.18 there are n-s k-s subspaces U of dimension k containing F . The result of the lemma is the product of these two quantities (via an easy q-binomial identity), as U and the image on V can be chosen independently.

Probability to be Invertible. The probability that a random endomorphism is invertible is a widely used result. It follows from the expression of D(n, 0, 0) that:

P [f ∈ GL n (F q )] = n q ! q n 2 = n i=1 1 - 1 q i 162 10.

Finite Vector Spaces Combinatorics

Throughout the next chapters, we denote this probability by λ(n). As a function of n, this quantity is positive and decreasing, thus it reaches a finite limit when n → ∞. It is quite easy to obtain a reasonable approximation thereof:

log λ(n) = log n i=1 1 - 1 q i = n i=1 log 1 - 1 q i ≈ - n i=1 1 q i ≈ 1 1 -q And thus: lim n→∞ λ(n) ≈ e 1/(1-q)
This suggest that for large values of q, a random endomorphism is invertible with probability close to one.

An alternate, more rigorous, and apparently less well-known way to obtain a much better approximation is to turn the infinite product into an infinite sum without using the logarithm, but instead through Euler's pentagonal number theorem [START_REF] Bell | A summary of euler's work on the pentagonal number theorem[END_REF]:

∞ i=1 1 - 1 q i = +∞ i=-∞ (-1) i • q -i(3i+1)/2 (10.4)
Considering the partial sums yields a close approximation of the asymptotic probability, for any value of q.

In particular, we find:

lim n→∞ λ(n) = 1 - 1 q + 1 q 2 + 1 q 5 + 1 q 7 - 1 q 12 + O 1 q 15
In the same vein, we deduce from lemma 10.19 the probability that a random endomorphism vanishing on a subspace F has a kernel of dimension k ≥ dim F :

P dim ker L = k F ⊆ ker F = D(n, k, s) q n(n-s) = λ(n)λ(n -s) λ(k)λ(k -s)λ(n -k) q -k(k-s) (10.5)
The interest of this expression is that the ratio of the λ expressions lives in a small interval, independently of q, n, k and s, so that the probability is of order q -k(k-s) .

Expected Cardinality of the Kernel. A more sophisticated result, and less readily available in the available litterature, is the expected cardinality of the kernel of a random endomorphism, and its variance.

Lemma 10.20. Let f be a uniformly random endomorphism of (F q ) n , vanishing on a subspace F of (F q ) n , with dim F = s. Then:

E | ker f | F ⊆ ker f = q s + 1 - 1 q n-s
This result is quite strong, as it states that a random endomorphism known to vanish on q k points in fact vanish on average on q k + 1 points, even for large k.

Proof. By definition the expectation is:

E n = E | ker f | F ⊆ ker f = n k=s D(n, k, s) q n(n-s) q k
A combinatorial and/or elementary argument completely eluded us. We therefore use the method of "creative telescoping" to establish the result by induction on n. First, we notice that the announced results holds when n = s. Let us therefore assume n > s. We denote by T (n, k, s) the hairy term under the sum. It is a qhypergeometric term because if we set X = q n and Y = q k , we see that the two following ratios are rational functions of X and Y :

T (n + 1, k, s) T (n, k, s) = q 2 X 2 -(q + q s+1 )X + q s q 2 X 2 -qXY T (n, k + 1, s) T (n, k, s) = q s+2 X + Y X (qY -q s ) (qY -1)
We thus used the q-analog of Zeilberger's algorithm [START_REF] Wilf | An algorithmic proof theory for hypergeometric (ordinary and "q") multisum/integral identities[END_REF] (as implemented in Maple [MGH + 05]), and it found the nice recurrence relation:

a • T (n + 1, k, s) -b • T (n, k, s) = g(n, k + 1, s) -g(n, k, s) ( )
Partly Specified Endomorphisms. Being able to estimate the probability that a random endomorphism is invertible is useful, but there are situations where this result cannot be applied, for instance when the endomorphisms are known to be singular. We therefore move on to count the number of endomorphisms whose image has certain properties, without requiring that the kernel is trivial. The natural question we would like to answer is: "what is the probability that a random endomorphism contains a given vector in its image?". This question is much less frequently addressed in the literature. The only related result we could find is: Theorem 10.22 ([CR92], example 2.4). Let U and W be subspaces of (F q )

n of respective dimensions and m. The number X n ( , m) of endomorphisms f of (F q )

n such that for any 0 = u ∈ U, f (u) / ∈ W is:

X n ( , m) = k≥0 (-1) k q ( k 2 ) q n(n-k) q mk l k q
We initially hoped that with U = (F q ) n and W = x , X n (n, 1) would count the number of endomorphism such that f (y) = x. Unfortunately, this is not what X n ( , m) counts. The problem is that 0 ∈ W , since W is a vector space, and therefore X n ( , m) counts the number of endomorphism that are injective on U , but avoid W . This means that setting U = (F q )

n is useless, because then we would be counting permutations of (F q )

n , and they cannot avoid W . We thus resorted to an ad hoc reasoning.

Lemma 10.23. Let F and G be two subspaces of (F q ) n of dimensions s and t respectively. The number of endomorphisms f of (F q ) n such that:

1. The kernel of f has dimension k (with s ≤ k ≤ n -t),
2. F is contained in the kernel of f and

3. G is contained in the image of f , is: n -s k -s q n -t k q n -k q !
Proof. Let us fix the the kernel of f : let us call it U , and assume that it is of dimension k, with s ≤ k ≤ nt. By lemma 10.18, there are n-s k-s q possible kernels of dimension k. Let V be a supplementary of U . The endomorphisms f are uniquely determined by their restriction f V to V . Because G is contained in the image of f , then G is also contained in the image of f V . The question then boils down to: "how many injective maps from V to (F q )

n whose image contains G are there?". By lemma 10.18 there are n-t n-k-t q possible images of f V . However, f V determines a particular basis of its image, so there are therefore n-t n-k-t q • nk q ! possible choices of f V . Multiplying by the number of possible kernels yields the result.

Interestingly, the same arguments yields dual results, when the inclusions are reversed. A duality argument has eluded us, and we therefore give a direct counting argument. Lemma 10.24. Let F and G be two subspaces of (F q )

n of dimensions (ns) and (nt) respectively. The number of endomorphisms f of (F q ) n such that the kernel of f has dimension k and is contained in F , and the image of f is contained in G is:

n -s k q n -t k -t q n -k q !
Proof. Let us first count such endomorphisms with a k-dimensional kernel, with t ≤ k ≤ ns. There are n-s k q possible kernels of dimension k. For each one, there are n-t n-k q nk q ! possible injective maps from a supplementary of the kernel to G, and thus we obtain the result by multiplying these two numbers and doing some easy "q-binomial" manipulations.

As an immediate corollary, we may remove the condition on the dimension of the kernel by summing over all admissible kernel dimensions.

Corollary 10.25. Let F and G be two subspaces of (F q ) n of dimensions s and t respectively.

i) The number of endomorphisms f of (F q ) n such that F is contained in the kernel of f and G is contained in the image of f is:

I(n, s, t) = n-t k=s n -s k -s q n -t k q n -k q ! (10.6)
ii) The number of endomorphisms f of (F q ) n such that the kernel of f is contained in F and the image of f is contained in G is I(n, nt, ns).

We conclude by establishing two useful recurrence relations for I(n, 0, 1) and I(n, 1, 1). Lemma 10.26. For any n ∈ N, we have:

i) I(n, 0, 1) = (q n -1) • q (n-1) 2 + q n-1 -1 • I(n -1, 0, 1)
ii) I(n, 1, 1) = q n(n-1) -1 q n -1

• I(n, 0, 1).

Proof. i) We first show that I(n, 0, 1) is governed by the relatively simple recurrence relation announced in the statement of the lemma. Let M be the matrix representation (in any basis) of an endomorphism f such that e 1 ∈ Im f . The first row of M is then non-zero. There are thus q n -1 possible first rows, and we may assume w.l.o.g. that that M has the following shape:

M =         1 0 C D        
Indeed, given an arbitrary first row, we may choose a particular basis of (F q ) n such that the matrix representation of f in this basis has this particular shape. There are then two cases: either C = 0, and in that case f (e 1 ) = e 1 so that D is not constrained, and there are q (n-1) 2 possible D's. Or C = 0, and D must not be arbitrary. To deal with this more complicated case, we observe that there are q n-1 -1 possible choices for C, and we consider a given choice. In this setting, e 1 belongs to the image of f if and only if -C belongs to the image of D. Thus we have established the recurrence relation:

I(n, 0, 1) = (q n -1) • q (n-1) 2 + q n-1 -1 • I(n -1, 0, 1) ( )
ii) We now prove that the number of matrices whose kernel contains a given non-zero vector x and whose image does not contain a given non-zero vector y is I(n, 0, 1)/(q n -1), and this will establish the second part of the lemma. We choose two bases of (F q ) n , B 1 = (x, x 2 . . . , x n ), and B 2 = (y, y 2 . . . , y n ), and we consider the matrix representation of an endomorphism meeting our requirements, with the input coordinates expressed in B 2 and expressing the output coordinates in B 1 . Because it vanishes on x, M necessarily has the following shape:

M =         0 A 0 B        
In order to have x / ∈ Im M , we can either have A = 0, or have A = 0 and ker B ⊆ ker A. If A = 0, then B can be arbitrary and this yields q (n-1) 2 choices. If A is non-zero there are q n-1 -1 possible choices for A, and the kernel of A kernel has dimension n -2. By corollary 10.25, the number of possible B such that ker B ⊆ ker A is I(n -1, 0, 1) Thus we have found:

q n(n-1) -I(n, 1, 1) = q (n-1) 2 + q n-1 -1 • I(n -1, 0, 1)
Then, using ( ), we find:

I(n, 1, 1) = q n(n-1) - 1 q n -1 • I(n, 0, 1)
Asymptotic Probability that a Given Vector is Contained in the Image. The probability p n that a given vector x of dimension s is contained in the image of a random linear map is simply I(n, 0, 1)/q n 2 . This probability converges to a finite limit different from 0 and 1 when n → +∞ (in fact, this probability is greater than the probability that a random matrix is invertible, obviously). We have not been able to demonstrate any definitive result, but we have a fairly good idea of what is going on.

Conjecture 10.1. If f is a random endomorphism of (F q ) n , then:

lim n→∞ P [e 1 ∈ Im f ] = lim n→∞ I(n, 0, 1) q n 2 = ∞ k=0 (-1) k q -k(k+1)/2
We now give evidence that the conjecture is true. We check that I(1, 0, 1) = q -1, and we set:

J n = I(n, 0, 1) q n 2 -q n 2 -n ,
and we find out that lemma 10.26, item i) translates to:

J n+1 = q -n + 1 -q -n 2 J n
With J 1 = 1. We therefore define the sequence of polynomials:

P 1 = 1 P n+1 = X n + (1 -X n ) 2 P n
and it is obvious that J n = P n (1/q). It is also quite obvious that P n+1 -P n is a multiple of X n . This naturally extends by induction, so that P n -P n0 is a multiple of X n0 for any n > n 0 . This means that P n (1/q) approximates the limit of I(n, 0, 1)/q n 2 with precision q -n . The key (empirical) observation is that P n coincides with (-1) k X k(k-1)/2 up to degree n -1 (i.e., all the terms of P n of degree less than n are correct). For instance:

P 10 = 1 -X + X 3 -X 6 + . . . P 30 = 1 -X + X 3 -X 6 + X 10 -X 15 + X 21 -X 28 + . . . P 60 = 1 -X + X 3 -X 6 + X 10 -X 15 + X 21 -X 28 + X 36 -X 45 + X 55 + . . . P 100 = 1 -X + X 3 -X 6 + X 10 -X 15 + X 21 -X 28 + X 36 -X 45 + X 55 + X 78 -X 91 . . .
We thus in fact conjecture that:

lim n→∞ P n (1/q) = ∞ k=0 (1) k q -k(k+1)/2
The problem remains to find a proof that the first terms of P n actually coincide with those of (1) k q -k(k+1)/2 . A proof of this assertion precisely remains to be found...

Sums of Singular

Endomorphisms. We conclude this section by counting the number of pairs of endomorphisms vanishing on certain points, and whose sum is singular.

Lemma 10.27. Let x be a non-zero vector of (F q ) n . The number of pairs of endomorphisms f, g of (F q ) n such that f (x) = 0, g / ∈ GL n (F q ), and f + g / ∈ GL n (F q ) is:

q 2n(n-1) • 1 + (q n -1) • (1 -λ(n -1)) 2
Proof. Without loss of generality, we assume that x = e 1 . Let A and B be matrix representations of f and g. If B • x = 0, then the sum A + B vanish on x and is thus singular. This already makes q 2n(n-1) pairs of matrices. Now, if B • x = 0, then we fix the image of B on x (q n -1 choices), and we assume that it is e 1 . This yields:

A =         0 A 1 0 A 2         B =         1 B 1 0 B 2        
Since B has a non-trivial kernel, then B 2 necessarily has a non-trivial kernel as well. For the same reason, the dimension of the kernel of the sum A + B is in fact the dimension of the kernel of A 2 + B 2 :

A + B =         1 A 1 + B 1 0 A 2 + B 2        
Thus, A 1 and B 1 are arbitrary (q n-1 choices for each). The submatrix B 2 is a arbitrary but non-singular (and there are q (n-1) 2 -n -1 q ! of those), and for each possible choice of B 2 , the number of possibles A 2 is precisely the number of non-singular matrices of dimension n -1, because M → M + B 2 is a permutation of M n-1 (F q ). Putting things together we find:

N n = q 2n(n-1) • 1 + (q n -1) • (1 -λ(n -1)) 2 10.7.

Random Quadratic Forms

We conclude by quickly investigating a few properties of random quadratic forms, i.e., of quadratic forms whose coefficient have been uniformly chosen at random in F q . We start by discussing the probability that a random quadratic forms f is non-degenerate. In odd characteristic (resp. in characteristic two), the polar form is a random symmetric matrix (resp. skew-symmetric). We therefore use the two following results about random (skew-)symmetric matrices.

Lemma 10.28 ([Mac69], theorem 2). Let N (n, r) denote the number of symmetric matrices of size n × n over F q and of rank r.

N (n, 2s) = s i=1 q 2i q 2i -1 • 2s-1 i=0 q n-i -1 N (n, 2s + 1) = s i=1 q 2i q 2i -1 • 2s i=0 q n-i -1
Lemma 10.29 ([Mac69], theorem 3). Let N 0 (n, r) denote the number of skew-symmetric matrices of size n × n over F 2 k and of rank 2s.

N 0 (n, 2s) = s i=1 q 2i-2 q 2i -1 • 2s-1 i=0 q n-i -1 N 0 (n, 2s + 1) = 0
In odd characteristic, lemma 10.28 is the tool we need, as non-degenerate quadratic forms are in one-toone correspondance with non-singular symmetric matrices.

P [f non degenerate] = q -n(n+1) 2 • n/2 i=1 q 2i q 2i -1 • n i=1 q i -1 = λ(q, n) λ (q 2 , n/2) (10.7)
We find thanks to equation (10.4) that:

lim n→+∞ P [f non degenerate] = 1 - 1 q - 1 q 3 + 1 q 4 + O 1 q 5 (10.8)
In characteristic two, if n is odd, then the quadratic forms are necessarily degenerate. On the other hand, if n is even, then lemma 10.29 tells us something nice:

P [f non degenerate] = q -n(n-1) 2 • n/2 i=1 q 2i-2 q 2i -1 • n-1 i=0 q n-i -1 = λ(q, n) λ (q 2 , n/2)
We also determine, when q is even and n is odd, the probability that the polar form of a random quadratic form is of maximal rank (i.e., n -1).

P rank f = n -1 n = 1 mod 2 = q -n(n-1) 2 • (n-1)/2 i=1 q 2i-2 q 2i -1 • n i=2 q i -1 = λ(q, n) λ(q 2 , (n -1)/2) • 1 1 -1/q Chapter 11

Exhaustive Search for Boolean Equations

In this chapter we discuss the practical complexity of the problem of solving multivariate quadratic equations over F 2 . Over such a small field, Gröbner basis algorithms are usually less efficient than exhaustive search. We revisit this venerable technique and push it to its limits. This joint work with Hsieh-Chung Chen, Chen-Mou Cheng, Tung Chou, Ruben Niederhagen, Adi Shamir and Bo-Yin Yang resulted in a publication at CHES'2010 [BCC + 10].

Solving a system of m polynomial equations in n variables over F q is a natural mathematical problem that has been investigated by several research communities.

The hardness of this problem, and in particular the fact that its random instances seems as hard as they get, has been used by cryptographers to design many public-key cryptographic schemes [MI88, Pat96b, PGC98a, KPG99, PCG01a, PCG01b, WHL + 05, DWY07, GMK08, BCD08, CBD + 09], but also symmetric primitives, such as the stream cipher QUAD [START_REF] Berbain | QUAD: A practical stream cipher with provable security[END_REF] or the hash function MQ-Hash [START_REF] Billet | On building hash functions from multivariate quadratic equations[END_REF].

Conversely, from a cryptanalytic point of view, it is sometimes possible to attack cryptosystems by writing down a system of equations and finding its solutions using off-the-shelf generic solvers (such as SAT solvers or Gröbner basis algorithms). The AES has been claimed to be broken this way [START_REF] Courtois | Cryptanalysis of block ciphers with overdefined systems of equations[END_REF], but the claim has been debunked in [START_REF] Cid | An analysis of the xsl algorithm[END_REF]. However, KeeLoq [START_REF] Courtois | Algebraic and slide attacks on keeloq[END_REF] and some other weak block ciphers can be broken this way. Furthermore, an algebraic technique is claimed to yield a faster collision attack on SHA-1 reduced to 58 rounds [START_REF] Sugita | Algebraic cryptanalysis of 58-round sha-1[END_REF], as well as on the Hamsi hash function [START_REF] Dinur | An improved algebraic attack on hamsi-256[END_REF].

Since the pioneering work of Buchberger [START_REF] Buchberger | Ein Algorithmus zum Auffinden der Basiselemente des Restklassenringes nach einem nulldimensionalen Polynomideal[END_REF], Gröbner basis techniques have been the most prominent tool for solving systems of polynomial equations, especially after the emergence of faster algorithms such as F 4 or F 5 [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases (F4)[END_REF][START_REF] Faugère | A New Efficient Algorithm for Computing Gröbner Bases Without Reduction to Zero (F5)[END_REF], which broke the first HFE challenge [START_REF] Patarin | Hidden fields equations (hfe) and isomorphisms of polynomials (ip): Two new families of asymmetric algorithms[END_REF][START_REF] Faugère | Algebraic Cryptanalysis of Hidden Field Equation (HFE) Cryptosystems Using Gröbner Bases[END_REF]. Cryptographers independently rediscovered some of the ideas underlying several Gröbner basis algorithms under the form of the XL algorithm [START_REF] Courtois | Efficient Algorithms for Solving Overdefined Systems of Multivariate Polynomial Equations[END_REF] and its "mutant" variants. They also introduced techniques to deal with special cases, particularly that of sparse systems [START_REF] Raddum | New technique for solving sparse equation systems[END_REF][START_REF] Semaev | On solving sparse algebraic equations over finite fields (part ii)[END_REF][START_REF] Raddum | Mrhs equation systems[END_REF].

One of the striking features of Gröbner basis algorithms is that their complexity is only marginally affected by the size of the field. In her PhD thesis [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF], Bardet determined the number of field operations performed by a simplified version of the F 5 algorithm to compute the Gröbner basis of an ideal spanned by n quadratic equations in n variables. She finds this number to be of order 2 4.295n , independently of the size of the field. Therefore, as soon as q ≥ 20, running a Gröbner basis algorithm should be asymptotically faster than exhaustive search. When q = 2, conversely, we expect Gröbner basis algorithm to be slower than exhaustive search. This is illustrated in a dazzling way by the following example: the implementation of F 4 in MAGMA-2.16 [START_REF] Bosma | The Magma Algebra System I: The User Language[END_REF], often cited as the best Gröbner-basis solver commercially available at the time of this writing1 , will completely use up all the available RAM (64 GB) to solve "just" 25 cubic equations in as many variables over F 2 , and eventually fail. Exhaustive search on the other hand takes 0.001 seconds to solve the same problem. This also illustrates the fact that the computation of a Gröbner basis is often a memory-bound process. Since memory is usually a scarce resource, sophisticated techniques can be inferior in practice to exhaustive search, which uses almost no memory (and is parallelizable at will). This is not completely the end of the story though. In particular, we know from §10.6.1 that Gröbnerbasis methods have an advantage on overdetermined systems (with man more equations than unknowns) and on systems with certain algebraic "weaknesses", such as HFE public keys.

All-in-all, small fields, in particular F 2 , are an unfavorable setting for Gröbner basis algorithms, and a favorable setting for brute force. It is also an interesting setup, because field operations in F 2 are particularly simple to implement, making it a tempting ground to design new cryptographic primitives both in hardware and software. Multivariate public-key cryptography has often been advertized to be easy to implement on smartcards.

Questions. Our purpose in this chapter is to investigate, theoretically and practically, how fast we can solve systems of multivariate polynomial equations over F 2 . We focus our study on exhaustive search, i.e., algorithms that essentially enumerate (F 2 )

n and check whether each individual assignment of the variable satisfies all the equations. The question we answer are: how fast can it get in practice? is it possible to improve on the folklore exhaustive search techniques? Can we get better performance using different hardware such as GPUs? Is it possible to solve in practice, with a modest budget, a system of 64 equations in 64 unknowns over F 2 ? Less than 15 years ago, this was considered so difficult that it even underlied the security of a particular signature scheme [START_REF] Patarin | Asymmetric cryptography with a hidden monomial[END_REF].

To illustrate our point, let us consider the recent algebraic attack against Hamsi of Dinur and Shamir [START_REF] Dinur | An improved algebraic attack on hamsi-256[END_REF]. The attack critically relies on the ability to enumerate all the possible values of 62 degree-6 polynomials in 32 variables in less time than required to evaluate the Hamsi compression function 2 32 times, which would require 2 45 bit operations (because one compression function evaluation requires 10500 bit operations). If this polynomial evaluation were done (very) naively, it would require 62 • 32 6 • 2 32 = 2 57 bit operations, and there would be no attack. Using an optimized Moebius transform (see §11.2), Dinur and Shamir bring this cost down to 62 • 7 • 2 32 = 2 40.7 bit operations, and their procedure is faster than exhaustive search on the compression function. This illustrates that there are several, more-or-less optimal ways to perform the exhaustive search on boolean polynomial, and that the speed of exhaustive search does matter.

Contributions. Our contribution is twofold. On the theoretical side, we present a new type of exhaustive search algorithm which is both asymptotically and practically faster than existing techniques (but competes, probably in a favorable way, with [START_REF] Dinur | An improved algebraic attack on hamsi-256[END_REF]). In particular, we show that finding all the zeroes of a single degree-d polynomial in n variables over F 2 requires just d • 2 n bit operations. We then extend this technique and show how to find all the common zeroes of m random quadratic polynomials in log 2 n•2 n+2 bit operations, which is only slightly higher. Surprisingly, this complexity is independent of the number of equations m.

On the practical side, we have implemented our new algorithms on x86 CPUs and on NVIDIA GPUs. Our CPU implementation is fairly optimized, and is capable of testing a bit more than two (F 2 )

n -vectors per CPU cycle. Yet our GPU implementation running on one single NVIDIA GTX 295 graphics card runs up to 9 times faster than the CPU implementation using all four cores of an Intel Core i7 at 3 GHz, one of the fastest CPUs available at the time of this study (summer 2010). We can solve 48+ quadratic equations in 48 binary variables using just an NVIDIA GTX 295 graphics card in 21 minutes. This device is presenlty available for about $500. It would be 36 minutes for cubic equations and two hours for quartics.

To evaluate the practical relevance of this level of performance, we determine the budget necessary to solve several size of instances on the cloud (more precisely, on the Amazon Elastic Compute Cloud using GPU instances). At the time of this writing, each "GPU instance" (on the EC2 Cloud) is equipped with 8 Xeon core at 2.93Ghz and two NVIDIA Tesla M2050 GPUs (which are at least as fast as the NVIDIA GTX 295 that we tested). Such an instance is thus capable of testing about 2 39 candidate per second, and is available at the rate of $0.74 per hour. It follows that the 64-bit signature challenge [START_REF] Patarin | Asymmetric cryptography with a hidden monomial[END_REF] can thus be broken in 9320 computing hours, with a budget of $7000. This computation may be completed in a single month using 12 instances in parallel. This show with a concrete example that (relatively simple) computations requiring 2 64 operations could be carried out in practice with readily available hardware and a modest budget.

More interestingly, let us consider a quadratic system of 80 equations in 80 variables over F 2 , supposedly offering 80 bits of security, which is the standard security level as of 2011. Solving this system requires 610 millions computing hours, which is certainly large, and which would cost about 450 millions of dollars. It would nevertheless require a bit more than 20 years to a present actual supercomputer (the Tiahne-1A) to solve the problem... In addition, our results show that the performance/price ratio of the GPU implementation running on an NVIDIA GTX 295 board is three times better than that of the CPU implementation running on the most price-efficient CPU (an AMD Phenom). We also highlight the fact that GPUs can been used successfully by the cryptographic community to obtain very efficient implementations of combinatorial algorithms or cryptanalytic attacks, in addition to the more numeric-flavored cryptanalysis algorithm demonstrated by the implementation of the ECM factorization algorithm on GPUs [BCC + 09].

Lastly, our implementations are (by some orders of magnitude) the fastest existing generic solvers for (low-degree, dense) systems of polynomial equations over F 2 .

Generalities

In this chapter, we will mostly be working over the finite vector space (F 2 )

n . The canonical basis is denoted by (e 0 , . . . , e n-1 ). We use `to denote addition in (F 2 ) n , and + to denote integer addition. We use i k (resp. i k) to denote binary left-shift (resp. right shift) of the integer i by k bits.

i

Gray Code

Gray Codes play a crucial role in this chapter. Recall that a Gray Code is binary numeral system where two successive values differ in only one bit (or equivalently, a permutation of (F 2 )

n such that two consecutive vectors differ in only one bit). There are many Gray Codes with various properties, but we will use the most "standard" one Definition 11.1. GrayCode (i) = i `(i 1). Table 11.1 shows the first 8 numbers of the Gray Code. It requires some thinking to get convinced that definition 11.1 actually yields a Gray Code. However, it is a fairly standard construction therefore we will not elaborate further.

Let us denote by b k (i) the index of the k-th lowest-significant bit of i set to 1, or -1 if the hamming weight of i is less than k

. For example, b k (0) = -1, b 1 (1) = 0, b 1 (2) = 1 and b 2 (3) = 1.
The following property is also standard (this could be an alternate definition).

Proposition 11.1. For i ∈ N, GrayCode (i + 1) = GrayCode (i) `eb1(i+1) .
Gray Codes have other useful properties. For instance, it easily follows from the definition that GrayCode (i `j) = GrayCode (i) `GrayCode (j). The following result expresses how the Gray Code behaves with respect to left-shifting. Lemma 11.2. For j ∈ N:

GrayCode 2 k + j • 2 k+1 = GrayCode 2 k `(GrayCode (j) (k + 1)) if j is even GrayCode 2 k `(GrayCode (j) (k + 1)) `ek if j is odd.
Proof. It should be clear that 2 k +j•2 k+1 and 2 k `j•2 k+1 in fact denote the same number. Also, GrayCode is a linear function on (F 2 )

n . Thus it remains to establish that GrayCode j • 2 k+1 = GrayCode (j) k + 1 (resp. e k `(GrayCode (j) k + 1)) when j is even (resp. odd). Again, j • 2 k+1 = j (k + 1), and by definition we have:

GrayCode j • 2 k+1 = GrayCode (j (k + 1)) = (j (k + 1)) `((j (k + 1)) 1)
Now, we have :

(j k + 1) 1 = (j 1) k + 1 when j is even ((j 1)
k + 1) `ek when j is odd and the result follows.

A Framework for Enumeration Algorithms

We are interested in enumeration algorithms, i.e., algorithms that evaluate a polynomial f over all the points of (F 2 )

n to find its zeroes. Such an enumeration algorithm is composed of two functions:

Init and Next. Init (f, x 0 , k 0 ) returns a State containing all the information the enumeration algorithm needs for the remaining operations. The resulting State is configured for the evaluation of f over State ← Init(f, 0,

x 0 `(GrayCode(i) k 0 ),
for i from 0 to 2 n -1 do 4:

if State.y = 0 then State.x is a zero of f 5:

Next(State)

6:
end for 7: end procedure Finding all the zeroes of f is then achieved with Algorithm 11.1. In this chapter, most functions are described in an "object-oriented" way: Init and Next explicitly handle States, and all the (global) variables occuring inside a function are in fact part of the state. This allows to unambiguously run several copies of the enumeration algorithm on (say) different polynomials, and disambiguates some intricate recursive situations. We could have made the dependence on the state explicit:

1: function Some-Function(State) 2:
State.x ← 2State.x + √ State.y -1

3: end function But for the sake of less cumbersome notations, we make this dependence implicit:

1: function Some-Function(State)

2:

x ← 2x + √ y -1

3: end function

Known Techniques for Quadratic Polynomials

We briefly discuss the enumeration techniques we know of.

Naive Evaluation.

The simplest way to implement an enumeration algorithm is to evaluate the polynomial f from scratch at each point of (F 2 )

n . If f is of degree d, this requires (d -1) AND per monomial, and nearly one XOR per monomial. Since the evaluation takes place many times for the same f with different values of the variables, we will usually assume that the polynomial can be hard-coded, and that multiplication of a monomial by its coefficient comes for free. Each call to Next would then require at most d • n d bit operations, 1/d of which being XORs and the rest being ANDs (not counting the cost of enumerating (F 2 ) n , i.e., incrementing a counter). This can be improved a bit, using what is essentially a multivariate Hörner evaluation technique. If f is quadratic, it can be written:

f (x) = c `n-1 i=0 x i •   c j `n-1 j=i+1 a ij • x j   (11.1)
If f is cubic, it can be written:

f (x) = c `n-1 i=0 x i •   c j `n-1 j=i+1 x j •   c ij `n-1 k=j+1 a ijk • x k    
And so on and so forth. The required numbers of operations in this representation is given by:

N AN D = d-1 k=1 n k N XOR = d k=1 n k
This naive method is not without its advantages, chiefly (a) insensitivity to the order in which the points of (F 2 ) n are enumerated, and (b) we can bit-slice and get a speed up of nearly ω, where ω is the maximum width of the CPU logical instructions.

The Folklore Differential Technique.

It was pointed out in §10.2.3 that once f (x) is known, computing f (x `ei ) amounts to compute ∂f ∂i (x), and then perform an addition. If f is quadratic, and in this case only, this derivative happens to be an affine function which can be efficiently evaluated by computing a vector-vector product and a few scalar additions. This strongly suggests to evaluate f on (F 2 )

n using a Gray Code, and leads to Algorithm. 11.2.

Algorithm 11.2 The Folklore differential enumeration algorithm.

1: function Init(f, k 0 , x 0 ) 2:
i ← 0 3:

x ← x 0 4:

y ← f (x 0 ) 5:
for all 0 ≤ k ≤ n -1 do 6:

D k ← D e k f 7: c k ← f (0) `f(e k ) 8:
end for x ← x `ek+k0

i ← i + 1 13: let k = b 1 (i) in 14: let z = DotProduct (D k , x) `ck

17: end function

We believe this technique to be folklore (it was told to us by J.-C. Faugère), and in any case it appears more or less explicitly in the existing literature [START_REF] Berbain | Efficient implementations of multivariate quadratic systems[END_REF]. Each call to Next requires n ANDs, as well as n + 2 XORs, which makes a total bit operation count of 2(n + 1). This is about n/4 times less than the naive method applied to a quadratic f .

A Fast Fourrier Transform for Boolean Functions : the Moebius Transform

Any boolean function f : (F 2 )

n → F 2 can be represented by a multivariate polynomial in n variables with coefficients in F 2 . This particular representation of f is usually called the algebraic normal form of f . Other representations of f would be possible, for instance by its truth table. In algebraic normal form, f can be written:

f (x 1 , . . . , x n ) = a∈(F2) n g(a 1 , . . . , a n ) n i=1 x ai i
The function that given the truth table of f returns the truth table of g (or equivalently the coefficients of the ANF of f ) is called the Moebius transform (observe the analogy with the Discrete Fourier Transform). Unlike the usual DFT on polynomials, the Moebius transform is involutive (i.e., it is its own inverse), and just like the DFT it can be computed by a "fast" algorithm with

O (n • 2 n ) XOR operations, given in [Jou09b, § 9.2]
. Algorithm 11.3 shows the pseudo-code. Note that this is not an enumeration algorithm, but can be used for this purpose (in the g-to-f direction). Its total (time) complexity is n • 2 n XOR operations on one bit, plus n • 2 n integers additions, and its total space complexity is 2 n bits. This algorithm can be implemented with decent efficiently (see [START_REF] Joux | Algorithmic Cryptanalysis[END_REF]), but we suspect that its performances are affected by the available memory bandwidth. Also, it cannot take advantage of the possibility that the degree of f is small (i.e., that g is mostly zero). Dinur and Shamir subsequently proposed in [START_REF] Dinur | An improved algebraic attack on hamsi-256[END_REF] an improved version of the Moebius Transform, which is degree-aware and offer better performances on quadratic polynomials.

A Faster Enumeration Algorithm

In this section, we present a new algorithm which is both asymptotically and practically faster than other known exhaustive search techniques in evaluating a polynomial of any degree on all the points of (F 2 )

n .

Algorithm let Sz = 2 i and P os = 0 in 3:

while P os < 2 n do 4:

for j from 0 to Sz -1 do 5:

f [P os + Sz + i] ← f [P os + Sz + j] `f[Pos + j] 6:
end for 7:

P os ← P os + 2 • Sz 8:

end while 9: end for

Faster Enumeration in Degree Two

In Algorithm 11.2, the dominating part is the dot product computed in Next (on line 14). It would be great if it were possible to exploit the fact that x is only slightly changed between two calls to Next. The problem is that k (defined on line 13) is never the same in two consecutive iterations. Now assume we modify the function, by storing the last value of z computed with each value of k:

1: function Next(State) 2: i ← i + 1 3: let k = b 1 (i) in 4: z[k] ← DotProduct (D k , x) `ck 5: x[k] ← x 6: y ← y `z[k] 7:
x ← x `ek 8: end function

In the modified function, on line 4, the previous value of z [k], when it exists, is still available, and this value is the dot product of D k with x[k] (which is the previous value of x for the same value of k). Thus,

the new value of z[k] is going to be z[k] `Dk • (x `x[k]).
The key observation is proposition 11.3 below, as its consequence is that the computation of the scalar product can be done in constant time, with two ANDs and one XOR. We will need to discuss the values of some variables inside functions, and in order to avoid any ambiguity, we denote by x the value of x at the begining of the function (before any instruction is exectued). Proof. x[k 0 ] is only accessed and modified when b 1 i + 1 = k 0 , for any given k 0 . The integers u such that b 1 (u) = k 0 are precisely the integers written u = 2 k0 + j • 2 k0+1 , for j ≥ 0. Then, if we consider the values of the variables at the beginning of the function, by invariant ii, we have for some j:

x = GrayCode 2 k + (j + 1) • 2 k+1 x[k] = GrayCode 2 k + j • 2 k+1
Thus, it follows from lemma 11.2 that just before line 1 is executed, we have:

x `x[k] = e k `(GrayCode(j) (k + 1)) `(GrayCode(j + 1) (k + 1)) = e k `((GrayCode (j) `GrayCode (j + 1)) (k + 1))
and by lemma 11.1,

x `x[k] = e k `ek+1+b1(j+1) (11.2)
By looking closely at the proof of proposition 11.3, we can write an optimized differential algorithm. However, before that, a few details still need to be addressed.

-The first time that b 1 (i) = k, then z[k] is not defined. In this case, we in fact know that i = 2 k . Therefore, special care must be taken to initialize z[k] when b 2 (i) = -1, which is equivalent to saying that the hamming weight of i is less than two. In that case, by invariant ii, we have:

x = e 0 if i = 1 e k `ek-1 if i = 2 k and k > 0 x `x[k] = e k1 `ek2
And thus,

DotProduct(D k1 , x `x[k 1 ]) = D k1 [k 1 ] `Dk1 [k 2 ]
This last formula can be further simplified by observing that D k1 [k 1 ] = 0. All these considerations lead to Algorithm 11.4. Note that the conditional statement could be removed by unrolling the loop carefully. The critical part of the algorithm is therefore an extremely reduced section of the code, that performs two XORs, increment a counter, and evaluate b 1 as well as b 2 . The cost of maintaining i, k 1 and k 2 can again be reduced greatly by unrolling the loop.

Algorithm 11.4 An optimized differential enumeration algorithm for quadratic polynomials.

1: function Init(f, k 0 , x 0 )

2:

i ← 0 3:

x ← x 0 4:

y ← f (x 0 ) 5:
for all 0 ≤ k ≤ n -1 do 6:

D k ← D e k f 7: c k ← f (0) `f(e k ) 8:
end for 9:

z[0] ← c 0 10: for all 1 ≤ k ≤ n -1 do 11: z[k] ← D k [k -1] `ck 12:
end for 13: end function

i ← i + 1 16: k 1 = b 1 (i) 17: k 2 = b 2 (i) 18: if k 2 = -1 then z[k 1 ] ← z[k 1 ] `Dk1 [k 2 ] 19: y ← y `z[k 1 ] 20:
x ← x `ek0+k1 21: end function

Recursive Generalization to Any Degree

It is possible to generalize Algorithm 11.4 so that it handles polynomials of any degree. The core idea is that in this algorithm, a given derivative is evaluated on the consecutive points of something that looks very much like a Gray code. This suggest using the technique recursively.

To make this thing explicit, we introduce a new State for each of the derivatives of f used in the enumeration of f . Instead of storing x[k] and z[k], we will access Derivative[k].y and Derivative[k].y. Also, Derivative[k].i will count the number of times b 1 (k) happened. We now reformulate our new algorithm in this framework. However, now, the x 0 and k 0 parameters appearing in invariant ii will play a more important role. Algorithm 11.5 works for polynomials f of any degre. The two functions Init [d] and Next [d] are designed to handle degree-d polynomials.

Correctness

At first glance, it may not seem trivial that the combination of algorithms 11.1 and 11.5 results in a method for finding all the zeroes of f . We thus prove by induction on d (the degree of f ) that the two functions Init [d] and Next [d] of Algorithm 11.5 maintain and preserve the three invariants of enumeration algorithms, defined in §11.1.2. The base case is when f is a constant polynomial (i.e., d = 0). we hope that the reader will be convinced that the "base case" of the algorithm correctly enumerates the values of a constant polynomial... In the recursive case where f is not constant, it is not difficult to check that the three invariants are enforced at the end of Init [d] . Let us now assume that f has degree d ≥ 1. Let us assume that we are in the middle of the main loop, and that the invariants defining our enumeration algorithm hold at the beginning of Next [d] . Our objective is to show that they still hold at the end, and that the state has been updated Algorithm 11.5 The recursive differential enumeration algorithm for all degrees.

1: function Init [d] (f, k 0 , x 0 ) 2: i ← 0 3: x ← x 0 4: y ← f (x 0 ) 5: if d > 0 then 6: Derivative[0] ← Init [d-1] ∂f ∂k 0 , k 0 + 1, x 0 7: for k from 1 to n -k 0 -1 do 8: Derivative[k] ← Init [d-1] ∂f ∂k + k 0 , k + k 0 + 1, x 0 `ek0+k-1 9:
end if 10: end function

11: function Next [d] (State) 12: i ← i + 1 13: let k = b 1 (i) in 14:
x ← x `ek+k0 15:

if d > 0 then 16: y ← y `Derivative[k].y 17: Next [d-1] (Derivative [k]) 18:
end if 19: end function correctly. Let us then focus on the Next [d] part of algorithm 11.5. Invariant iii is easily seen to be enforced by line 12, while invariant ii follows from line 14, and from lemma 11.1. The non-trivial part is to show that invariant i holds. The three following lemma are devoted to this task. We will always denote by x (resp.

x ⊥ ) the value that the x variable had at the begining of the execution of the function (resp. at the end).

Lemma 11.4. After k is updated on line 13 of Next [d] , we have:

i + 1 = 2 k + Derivative[k].i × 2 k+1 .
Proof. It is not difficult to see that the -th value of j such that b 1 (j) = k is 2 k + × 2 k+1 . The statement of the lemma is equivalent to saying that Derivative[k].i counts the number of time where b 1 (i) = k happened since the beginning of the main loop (not counting i + 1). This simply follows from the fact that Derivative[k].i counts the number of times Next [d-1] (Derivative[k]) has been called.

Lemma 11.5. Let Π : (F 2 ) n → (F 2 )
n denote the projection that sets the (k + k 0 )-th coordinate to zero. After k is updated on line 13, and before x is updated on line 14 of Next [d] , we have:

Π x `Derivative[k].x = 0
Proof. By assuming that invariant ii holds for the current state at the entry of Next [d] , we have:

x = x 0 ` GrayCode i k 0 .
Because after line 13, k is set to b 1 i + 1 , it follows from lemma 11.1 that:

x = x 0 ` GrayCode i + 1 `ek k 0 = x 0 `ek+k0 ` GrayCode i + 1 k 0
Then, because lemma 11.4 grants us:

i + 1 = 2 k + Derivative[k].i × 2 k+1
, this becomes:

x = x 0 `ek+k0 ` GrayCode 2 k + Derivative[k].i × 2 k+1 k 0
Applying lemma 11.2 gives:

Π x = Π x 0 ` GrayCode 2 k k 0 ` GrayCode(Derivative[k].i ) (k 0 + k + 1)
We now distinguish two cases.

-Either k > 0, and since ∂f ∂k+k0 is of strictly smaller degree than f , then by induction hypothesis on Derivative[k], invariant ii grants:

Derivative[k].x = x 0 ` GrayCode Derivative[k].i k + k 0 + 1 `ek+k0-1
And thus:

Π x `Derivative[k].x = Π GrayCode 2 k k 0 `ek+k0-1 = Π e k+k0 `ek+k0-1 `ek+k0-1 = 0
-Or k = 0, and by induction hypothesis invariant ii yields:

Derivative[0].x = x 0 ` GrayCode Derivative[0].i k 0 + 1 Next, Π x `Derivative[0].x = Π GrayCode 2 k k 0 = Π (e k0 ) = 0
Lemma 11.6. We have y ⊥ = f (x ⊥ ). In other terms, invariant i is preserved.

Proof. By induction hypothesis on Derivative[k], invariant i :

Derivative[k].y = ∂f ∂k + k 0 (Derivative[k].x )
However, because we are in characteristic two, we have: ∂f ∂k+k0 = ∂f ∂k+k0 • Π, and lemma 11.5 in fact grants us:

Derivative

[k].y = ∂f ∂k + k 0 x
So, this yields (using lemma 11.1):

y ⊥ = y `∂f ∂k + k 0 x = f x `f x `f x + e k+k0 = f x ⊥

Time and Space Complexity Considerations

It should be clear from the description of Next [d] that it has complexity O (d). Therefore, the complexity of enumerating all the values of f on (F 2 )

n can be done with complexity O (d • 2 n ). What is the space requirement of the algorithm? The answer to this question is twofold: there is an internal state that gets modified by the algorithm, and that correspond to the y field of all the non-constant derivatives. There is also an array of constants, which is only read from the memory, and that correspond to the y field of degree-d derivatives.

Init stores one bit per degree-d derivative ∂f /∂i 1 ∂i 2 . . . ∂i d , with 1

≤ i 1 < i 2 < • • • < i d ≤ n.
The number of such tuples (i 1 , i 2 , . . . , i d ) is known to be n d-1 . This yields the following result:

Proposition 11.

An iterative Version

Algorithm 11.5 is (relatively) easy to prove correct, but does not lend itself well to an efficient implementation. We therefore move on to writing an iterative version of Algorithm 11.5. This iterative version allows more optimization, such as the removal of extra useless work, and is generally easier to think about with performance in mind. i ← i + 1

3:

let k = b 1 (i) in 4: if i = 2 k then Next 2 (Derivative [k]) 5:
x ← x `ek+k0 ). It does exactly the same thing as Next, but in a slightly different way. Instead of calling Next at the end, it calls it at the beginning, except the first time a given value of k is reached (to avoid calling it an extra time at the begining). We can therefore work on Next 2 from now on. A first remark is that maintaining x is required by the invariants, but is otherwise useless for the actual computation. A first step is to completely remove x from the algorithm. Less obviously, we can also avoid maintaining i. To see that, we first need an equivalent of lemma 11.4 adapted to Next 2 , the proof of which is left to the reader. Lemma 11.8. After k is updated on line 3 of Next 2 , we have:

i + 1 = 2 k + Derivative[k].i + 1 × 2 k+1 .
It is an easy consequence of lemma 11.8 that in Next 2 , after k is updated on line 3, we have for any j:

b j (Derivative[k].i + 1) = b j+1 (i + 1).
Thus, it is possible to avoid storing the i values, except in the main loop, and to re-generate them onthe-fly by evaluating b j on the index of the main loop. These computations, although taking amortized constant time, can be made negligible by unrolling. To make notations less heavy, we introduce the following shorthand:

D[k 1 , k 2 , . . . , k ] := State.Derivative[k 1 ].Derivative[k 2 ] . . . .Derivative[k ].y
With this notation, Algorithm 11.7 is just an unrolled version of the Algorithm 11.5 in which all the useless operations have been removed. Algorithm 11.7 Iterative algorithm for all degrees.

1: procedure Zeroes(f )

2:
State ← Init [d] (f, 0, 0)

3:

for i from 0 to 2 n -1 do 4: if State.y = 0 then GrayCode(i) is a zero of f 5: let k 1 = b 1 (i + 1) in 6: let k 2 = b 2 (i + 1) in 7:
. . .

8:

let

k d = b d (i + 1) in 9: if k d > -1 then D [k 1 , . . . , k d-1 ] ← D [k 1 , . . . , k d-1 ] `D [k 1 , . . . , k d-1 , k d ] 10:
. . .

11: if k 3 > -1 then D [k 1 , k 2 ] ← D [k 1 , k 2 ] `D [k 1 , k 2 , k 3 ] 12: if k 2 > -1 then D [k 1 ] ← D [k 1 ] `D [k 1 , k 2 ]
13:

y ← y `D [k 1 ] 14:
end for 15: end procedure

Finding the Common Zeroes of Several Multivariate Polynomials

In the previous section, we discussed how to enumerate a single polynomial. We now move on to the enumeration of several polynomial simultaneously.

We will use several time the following simple idea: all the techniques we discussed previously perform a sequence of operations that is independent of the coefficients of the polynomials. Therefore, m instances of Algorithm 11.7 could be run in parallel on f 1 , . . . , f m . All the parallel runs would execute the same instruction on different data, making the parallel combination efficiently implementable on any architectures with registers, not to mention vector or SIMD units. In each iteration of the main loop, it is easy to check if all the polynomials vanished on the current point of (F 2 )

n . Evaluating all the m polynomials in parallel using Algorithm 11.7 would require roughly m • d • 2 n bit operations. The point of this section discussion is that it is possible to do better than this.

Note that if m > n, we can focus on the first n equations, since a system of n randomly chosen multivariate polynomial equations in n variables of constant degree d is expected to have a constant number of solutions, which can in turn be checked against the remaining equations efficiently. If m < n, then we can specialize mn variables, and solve the m equations in m variables for any possible values of the specialized variables. All-in-all, the interesting case is when m = n.

Let us first introduce a useful notation. Given an ordered set U , we denote the common zeroes of

f 1 , . . . , f m belonging to U by Z([f 1 , . . . , f m ], U ). Let us also denote Z 0 = (F 2 )
n , and

Z i = Z ([f i ], Z i-1
). It should be clear that Z = Z m is the set of common zeroes of the polynomials, and therefore the object we wish to obtain.

A General Technique: Splitting the Problem

A possible strategy is to compute the Z i recursively: first Z 1 , then Z 2 , etc. However, while the algorithms of §11.3 can be used to compute Z 1 , they cannot be used to compute Z 2 from Z 1 , because they intrinsically enumerate all (F 2 )

n . In practice, the best results are in fact obtained by computing Z k , for some well-chosen value of k, using k parallel runs of Algorithm 11.7, and then computing Z m using a secondary algorithm. Computing Z k requires d • k • 2 n bit operations. It then remains to compute Z m from Z k , and to find the best possible value of k.

Also note that while it makes sense to choose k according to the targeted hardware platform (e.g., k = 32 if 32-bit registers are available), it is an interesting theoretical problem choose k in order to minimize the global number of bit operations. We now move on to discuss several secondary algorithms to compute Z m from Z k , and discuss their relative merits.

Naive Secondary Evaluation

The simplest possibility is to compute Z i+1 from Z i using naive evaluation, for k ≤ i ≤ n -1. It is clear that the expected cardinality of Z i for random polynomial equations is 2 n-i . We will assume for the sake of simplicity that evaluating a degree-d polynomial requires n d bit op., following the reasoning of §11.2. Computing Z i+1 then requires about n d • 2 n-i bit ops. The expected cost of computing Z is then approximately:

n i=k n d • 2 n-i ≈ n d • 2 n-k+1 bit operations.
Minimizing the global cost means solving the equation:

k • d • 2 n = n d • 2 n-k+1 .
which is easily seen to be equivalent to:

(k • ln 2) • exp(k • ln 2) = 2 • n d • ln 2 d Now, the Lambert W function is such that W (x) • exp(W (x)) = x.
Thus, the solution of our equation is:

k = W n d • 2 • ln 2 d / ln 2
Using the known fact [dB61] that when x goes to infinity:

W (x) = ln x -ln ln x + o(ln ln x)
we find that when n → ∞:

k = 1 + log 2 n d • 1 d + O (ln ln n)
The full cost of the algorithm is then approximately d 2 • log 2 n • 2 n+1 bit operations.

Differential Secondary Evaluation

We only describe the quadratic case, but this could be extended to higher degrees. We can efficiently evaluate Z i+1 from Z i using an easy consequence of equation (10.1): given f (x), computing f (x + ∆) takes 2|∆| • n bit operations, where |∆| denote the hamming weight of ∆, by computing |∆| dot products with the derivatives. Let us order the elements of Z i by writing: Z i = x i 1 , . . . x i qi (the elements are ordered using the usual lexicographic order), and ∆ i j = x i j+1 `xi j . Computing Z i+1 therefore requires approximately:

2n • qi-1 j=1 |∆ i j | bit operations.
Now, let us consider the ∆ i j as integer number between 0 and 2 n -1. The x i j+1 are the zeroes of a set of i random polynomials, and under the assumption that each point of (F 2 )

n has one chance over 2 i to be such a zero, then the difference ∆ i j between two such consecutive zeros follows a geometric distribution of parameter 2 -i , and thus has expectation 2 i . The hamming weight |∆ i j | is upper-bounded by log 2 ∆ i j (considered as an integer), and therefore |∆ i j | has expectation less than i. Computing Z i+1 therefore requires on average 2n • i • 2 n-i bit op. Finally, computing Z from Z k requires on average:

2n • n-1 i=k i • 2 n-i ≤ 4n • (k + 1) • 2 n-k bit operations
An approximately optimal value of k would then satisfy

2k • 2 n = 4n • (k + 1) • 2 n-k
which is approximately k = 1 + log 2 n. The complexity of the whole procedure is then 4 log 2 n • 2 n . However, implementing this technique efficiently looks like a lot of work for at best a 2× gain.

Practical Considerations

Choosing the "optimal" value of k is not only of theoretical interest, but may have a practical significance if a very ad hoc circuit were to be designed from scratch. Even in the software implementations we are concerned with in this paper, it provides a guideline. However, when implemented in software on processors with registers, the logical operation width of the hardware becomes a determinant argument in the actual choice of k. If operations are always performed on ω-bit registers, then it is likely that the best choice of k is precisely ω. In all our implementations, we used the "Early-abort + Naive Evaluation" strategy with k = 32. This enables us to make use of the full register width, while keeping the "naive evaluation" time negligible. However, this means that the enumeration process must store 32 times more data in fast memory, compared to the evaluation of only one polynomial.

Spatial and Temporal Proximity

The critical loop of Algorithm 11.7 is very short, since it performs only d logical operations. Implementing it very efficiently is nevertheless a bit tricky. For instance, it accesses the memory d + 1 times, which suggests that memory bandwith will be an actual performance bottleneck.

The remaining of this chapter is devoted to the issue of efficiently implementing Algorithm 11.7. In § 11.6, we will show that the memory-bandwidth problem present itself again, yet differently, when we try to parallelize the algorithm on shared-memory architectures. In this section, we argue that the algorithm is cache-efficient, i.e., that is uses the cache efficiently regardless of its size. This shows that the algorithm has good spatial and temporal proximity, and cannot be really improved in this respect.

Spatial and Temporal Proximity

Cache Model. We will study the behavior of the algorithm in the Ideal Cache Model [START_REF] Frigo | Cacheoblivious algorithms[END_REF]. This model considers a computer with a two-level memory hierarchy consisting of an ideal (data) cache of Z words and an arbitrarily large main memory. The cache is partitioned into cache lines, each consisting of L consecutive words that are always moved together between cache and main memory. The processor can only reference words that reside in the cache. If the referenced word belongs to a line already in cache, a cache hit occurs, and the word is delivered to the processor. Otherwise, a cache miss occurs, and the line is fetched into the cache. The ideal cache is fully associative: cache lines can be stored anywhere in the cache. If the cache is full, a cache line must be evicted. The ideal cache uses the optimal off-line strategy of replacing the cache line whose next access is farthest in the future, and thus it exploits temporal locality perfectly. An algorithm with an input of size n is measured in the ideal-cache model in terms of the usual number of operation performed by the processor, but also in terms of its Cache Complexity Q(n, Z, L) -the number of cache misses it incurs as a function of Z and L. We now move on to evaluate the cache complexity of the enumeration algorithm, as show in fig. 11.7. We will assume that the "memory cells" accessed by the algorithm have the same size as the a word in the cache (if this were not the case, it would only incur a constant multiplicative loss, and we are mostly interested in an asymptotic result).

Cyclic Memory Accesses in Algorithm 11.7. The memory words accessed in the algorithm belong to arrays of various dimension, and are accessed with indices of variable length. It should be clear from the description of the algorithm that for all k ≤ d, the memory location of index [i 1 , . . . , i k ] is accessed at step s if b j (s) = i j , for all j ≤ k. This memory access pattern is in fact very regular. We say that a memory word is accessed with period T if, when it is accessed at iteration i, it is also accessed at iteration i + T , but not in-between. Lemma 11.9. For all k ≤ d, the memory location of index [i 1 , . . . , i k ] is accessed with period 2 i k +1 .

Proof. We associate with an index

[i 1 , . . . , i k ] the set Ω i1,...,i k of integers n such that b 1 (n) = i 1 , . . . , b k (n) = i k .
The problem amounts to show that the difference between two consecutive elements of this set is 2 i k +1 . But it is easily seen that if n ∈ Ω i1,...,i k , then n + j • 2 i k +1 ∈ Ω i1,...,i k for any positive integer j. This follows from the fact that b j (n) = b j (n + 2 ) if > j, and establishes the result.

It should be clear that all the memory location accessed with period exactly T are accessed in the first T iteration of the main loop. Moreover, they are accessed in a certain order. For instance, memory words with period 8 are accessed in this order in the first 8 iterations: [2], [0, 2], [1,2]. By definition of the period, this access pattern is reproduced without modifications in the next T iterations. Thus, memory words with period T are accessed in a cyclic fashion.

The algorithm easily defines a total order relation on the memory locations it accesses: x ≤ y if and only if the first access to x takes places before the first access to y. Let us assume that the actual memory addresses are compatible with this order relation. Then, more frequently accessed words are stored with the lowest addresses, and words with the same access frequency are stored contiguously in memory. There are min(d-1,k) i=0 k i memory locations that are accessed with period 2 k+1 .

Critical Period. This being said, we will focus on the case where all the d i=0 n i memory words accessed by the algorithm do not fit into the cache, to avoid studying the trivial case. Let us define the critical period 2 Tc+1 to be the biggest integer such that all the memory words accessed with period 2 Tc+1 fit in the cache:

Tc k=0 min(d-1,k) i=0 k i ≤ Z -1
Under the (mild) assumption that the cache contains Z ≥ 2 d words, and thus that T c is greater than d, this condition becomes:

2 d -1 + Tc k=d d-1 i=0 k i ≤ Z -1
This is the summation in a rectangle inside Pascal's triangle, then by applying Pascal's rule recursively, we may simplify this expression, and find that it is equivalent to:

d i=0 T c + 1 i ≤ Z
T c can be easily expressed as a function of Z when d is small:

d = 2 → T c + 1 = √ 8Z -7 -1 2 d = 3 → T c + 1 = 3 • (Z -1) + Z 2 -2Z + 368/243 2 3 -15 3 • (Z -1) + Z 2 -2Z + 368/243 1 3
The important point is that all memory words with period 2 Tc+1 fit in the cache and do not leave it. This fact is almost true by definition of T c : the optimal off-line cache strategy will not evict a cache line that will be accessed in T steps if it can evict a cache line that will only be accessed in 2T steps. And there will always be a cache line not containing a word accessed with period 2 Tc+1 or less. Note that this shows that the cache complexity of the algorithm is essentially independent of L in the ideal cache model. This being said, we can state our result: Theorem 11.10. Under the assumption that T c ≥ 2d, the following two inequalities hold:

i) Q(n, d, Z, L) ≤ 2 n-2-Tc • (d + 1) • T c + 1 d -1 ii) Q(n, d, Z, L) ≤ 2 n-2-Tc • d • (d + 1) T c + 2 -d • Z
Proof. The second inequality is a nearly-direct consequence of the first one, and of the definition of T c . Let us thus focus on the first one. By definition of T c , the algorithm may make a cache miss every time it accesses a memory location whose index contain a coordinate bigger than T c . Such memory words have period greater than 2 Tc+2 , so each of them is accessed at most 2 n-Tc-2 times. Multiplying this by the number of such memory words yields the total number of cache misses:

Q(n, d, Z, L) = n k=Tc+1 2 n-1-k • d-1 i=0 k i ≤ 2 n-1 d-1 i=0 +∞ k=Tc+1 2 -k • k i It is well-known that k k i x k = x i /(1 -x) i+1
. Thus, we find with x = 1/2:

+∞ k=0 2 -k • k i = 2
We can therefore rewrite

Q(n, d, Z, L) ≤ 2 n-1 • d-1 i=0 2 - Tc k=0 2 -k • k i Now we claim that 2 - Tc k=0 2 -k • k i = 2 -Tc • i j=0 T c + 1 j .
It is not particularly difficult to establish this by induction on i, by using Pascal's rule. Going back to the expression of Q(n, d, Z, L), we find:

Q(n, d, Z, L) ≤ 2 n-Tc-1 • d-1 i=0 i j=0 T c + 1 j ≤ 2 n-1-Tc • d-1 j=0 (d -j) • T c + 1 j 11.6. Parallelization-Related Issues And since n k = n k n-1
k-1 , we obtain:

Q(n, d, Z, L) ≤ 2 n-1-Tc •   d • d-1 j=0 T c + 1 j -(T c + 1) • d-1 j=1 T c j -1  
We next claim that by applying Pascal's rule recursively, we obtain:

2 • d-1 j=1 T c j -1 = T c d -2 + d-2 j=0 T c + 1 j
Substituting this into Q(n, d, Z, L) yields:

Q(n, d, Z, L) ≤ 2 n-1-Tc •   d • d-1 j=0 T c + 1 j - T c + 1 2 •   T c d -2 + d-2 j=0 T c + 1 j     ≤ 2 n-1-Tc •   d • T c + 1 d -1 + 2d -T c -1 2 • d-2 j=0 T c + 1 j - T c + 1 2 • T c d -2   ≤ 2 n-1-Tc •   (d + 1)(T c + 1) 2(d -1) • T c d -2 + 2d -T c -1 2 • d-2 j=0 T c + 1 j   ≤ 2 n-1-Tc •   d + 1 2 • T c + 1 d -1 + 2d -T c -1 2 • d-2 j=0 T c + 1 j  
And under the (again mild) assumption that T c ≥ 2d, we find:

Q(n, d, Z, L) ≤ 2 n-2-Tc • (d + 1) • T c + 1 d -1
Numerical Application. Let us consider a polynomial in 64 variables. If we assume an incredibly small cache of Z = 2 10 bits and that our polynomial is of degree 2, then T c = 44 and the enumeration will make about 2 25 cache misses, for a running time of at least 2 65 . If we assume that our polynomial is of degree 4, and that the cache is 2 14 -bit large, then T c = 24, and there will be 2 52 cache misses, for more than 2 66 attempted memory accesses.

Transforming the Equations to do Less Work

We conclude this section by presenting a ruse allowing to cut off a fraction 1/(d • 2 d ) of the work in some cases. This is mostly interesting when d = 2, where it reduces the workload by 12.5%. The most frequently accessed constant is D[0, 1, 2, . . . , d -1]. If this constant were equal to zero, then we could just remove the code that XORs it. This constant is accessed with period 2 d , and there are d • 2 d XOR between two accesses to this constant. Now, how can we force D[0, 1, 2, . . . , d -1] to be zero? Suppose we want to find the solutions of a polynomial system (f 1 , f 2 ), and that the first step is to find all the zeroes of f 1 . The constant has a 50% chance to be zero by itself, but if it is not, we can always first enumerate f 2 . If the constant is again non-zero when enumerating f 2 , we can enumerate f 1 + f 2 instead without affecting the solution set, but this time the constant will be zero by linearity of the differential (i.e., D(f + g) = Df + Dg). This easily generalizes to more than two polynomials (one must however be carefull to perform an invertible linear combination of the polynomials).

Parallelization-Related Issues

Parallelizing Algorithm 11.7 is awfully easy, as the problem is "embarrassingly parallel". It simply comes down to partitioning the search space into the number of available cores. For instance, the main loop of Algorithm 11.1 can be split in independent chunks, as illustrated by Algorithm 11.8. On distributed-memory Algorithm 11.8 Parallel enumeration, assuming one processing unit capable of running 2 T threads.

procedure Dumb-Parallel-Zeroes(f, T ) parallel-for

t from 0 to 2 T -1 do State[t] ← Init (f, 0, GrayCode (t • 2 n-t )) for i from 0 to 2 n-t -1 do if State[t].y = 0 then State[t].x is a zero of f Next(State[t]
) end for end parallel-for end procedure architectures, this would be perfectly fine. However, on shared-memory architectures, the problem of any parallelization is that it will put even more pressure on the memory subsystem than the sequential version. Recall from §11.3.4 that the State is made of a read-write part (the "internal state") and of a read-ony part (the "constants"). That each thread needs its own internal state makes perfect sense. However, that each thread needs its own copy of the constants seems wasteful, because these constants are functions of the enumerated polynomial(s), and all threads enumerate the same. However, in Algorithm 11.8, the constants also depends on the "starting point" of the enumeration (the third argument of Init), and therefore they are different in all threads.

This seems suboptimal, if only because it cannot exploit shared caches in an efficient way (most modern multi-core CPUs have a large Level-3 cache shared between all the cores). The memory bandwidth problem becomes even more pressing on some parallel architectures, such as GPUs, or the Cell, in which the "fast" memory available to each core is fairly restricted, and main memory is relatively slow and/or inaccessible. Even on a single-core of a desktop CPUs it is possible to run several parallel copies of Algorithm 11.7 using SIMD instructions, but if multiple instances compete for the caches and try to access the main memory simultaneously, then the pressure on the memory subsystem should increase.

In addition, in some parallel architecture there are no caches, but instead a small "scratch pad" of fast memory that must be explicitly managed by the program (as opposed to caches that are managed by the CPU itself). This means we will need to decide, given its size, what goes in the (fast) scratch pad, and what remains in the (slow) main memory. This can be made even more complicated by the fact that the scratch pad is shared between multiple threads). Note that the previous section gives reasonably good guidelines to deal with this problem.

Sharing Constants. While the increased memory consumption of running multiple instances of any enumeration algorithm cannot be completely avoided, because each copy needs its own internal state, the problem can be partially alleviated by sharing the constants between all the threads. This is essentially achieved by splitting the main loop of algorithm 11.7 in chunks of a given size (say, 2 L ) that can be processed concurrently. This results in Algorithm 11.9. Enumerating a chunk of size 2 L is comparable to enumerating a polynomial in L variables (it makes the same number of calls to Next).

Internal State. The full sequential process stores and maintains an internal state of

d-1 i=0 n i = O n d-1
bits. However, when processing a chunk of size 2 L , a smaller internal state is sufficient. Counting the number of reachable internal state bits amounts to counting the number of possible tuples (k 1 , k 2 , . . . , k d-1 ) that will be generated in the loop.

Our first observation is that as soon as the hamming weight of i + 1 is greater than d, then all the k j 's will be smaller than L. When all the k indices are smaller than L, only d-1 i=0 L i bits of internal state can be addressed. Now, let us assume that HammingWheight(i + 1) = w < d. In this case, we find

k j = b j (i + 1) when j ≤ w L + b j-w (i 0 ) otherwise
So, when w < d, then the value of k j (j > w) is uniquely determined by i 0 , and is greater than L. Thus, in a given thread, for a given value of w, the number of possible tuples (k 1 , k 2 , . . . , k d-1 ) is precisely the number of possible values of i with hamming weight w. parallel-for t from 0 to 2 T -1 do 5:

initialize S t (the internal state of thread t)

6:

let i 0 = b + t • 2 n-T -L • 2 L in 7:
for i from 0 to 2 L -1 do 8:

if y t = 0 then GrayCode(i 0 + i) is a zero of f 9: let k 1 = b 1 (i 0 + i + 1) in 10: let k 2 = b 2 (i 0 + i + 1) in 11:
. . .

12:

k d = b d (i 0 + i + 1) in 13: let if k d > -1 then S t [k 1 , . . . , k d-1 ] ← S t [k 1 , . . . , k d-1 ] `C [k 1 , . . . , k d-1 , k d ] 14:
. . .

15:

if

k 3 > -1 then S t [k 1 , k 2 ] ← S t [k 1 , k 2 ] `St [k 1 , k 2 , k 3 ] 16: if k 2 > -1 then S t [k 1 ] ← S t [k 1 ] `St [k 1 , k 2 ]
17:

y t ← y t `St [k 1 ] 18:
end for

19:

end parallel-for 20:

end for 21: end procedure Synchronous Behavior. Let us consider for a moment than all the 2 T threads are executed synchronously (on an SIMD unit for instance). In this setting it is an advantage that all the threads behave similarly: if they access the same memory location, then often it can be read once and broadcast to all the threads. Conversely, if they access contiguous memory locations, then the queries can sometimes be coalesced and served with only one request from the main memory.

When the hamming weight of i is greater than d, then the tuple (k 1 , . . . , k d ) depends only on i, and therefore is the same in all the thread. This places us in the favorable situation described above. In fact, this favorable case presents itself a bit more often. For instance, if HammingWheight(i + 1) = w < d and if b has hamming weight at least dw, then all the threads will end up having the same k j 's. In fact, this situation does not happen only when b • 2 L i + 1 has hamming weight less than d, and it is easy to see that the number of times this happens is

d-1 i=0 n -T i = O (n -T ) d-1 . (11.3)
This means that even though the algorithm performs an exponential number of steps, all the 2 T threads behave synchronously except in a polynomial number of steps. This feature is interesting, because on some architecture penalties apply when threads do not behave synchronously. The SSE instruction set includes Loads and Stores (to/from xmm registers, memory -both aligned and unaligned, and traditional registers), Packing/Unpacking/Shuffling, Logical Operations (AND, OR, NOT, XOR, Shifts Left, Right Logical and Arithmetic -bit-wise on units and byte-wise on the entire xmm register), and Arithmetic (add, substract, multiply, max-min) with some or all of the arithmetic widths. The interested reader is referred to Intel and AMD's manuals for details on these instructions, and to references such as [START_REF] Fog | Instruction Tables[END_REF] for throughput and latencies. 11.2: Enumeration with n = 7, in chunks of L = 2 3 elements with 4 batches of T = 4 concurrent threads. The tick marks ( ) means that the 4 threads do not access the same constant. In conformance with (11.3), there are 1 + (7 -2) = 6 non-broadcast memory accesses.

i 0 L i + 1 k 1 k 2 i 0 L i + 1 k 1 k 2 i 0 L i + 1 k 1 k 2 i 0 L i + 1 k 1 k 2
G2xx-series Graphics Processing Units from NVIDIA. We choose NVIDIA's G2xx GPUs as they have the least hostile GPU parallel programming environment called CUDA (Compute Unified Device Architecture). In CUDA, we program in the familiar C/C++ programming language plus a small set of GPU extensions.

An NVIDIA GPU contains anywhere from 2-30 streaming multiprocessors (MPs). There are 8 ALUs (streaming processors or SPs in market-speak) and two super function units (SFUs) on each MP. A top-end "GTX 295" card has two GPUs, each with 30 MPs, hence the claimed "480 cores". The theoretical throughput of each SP per cycle is one 32-bit integer or floating-point instruction (including add/subtract, multiply, bitwise AND/OR/XOR, and fused multiply-add), and that of an SFU 2 floating-point multiplications or 1 special operation. The arithmetic units have 20+-stage pipelines.

Main memory is slow and forms a major bottleneck in many applications. The read bandwidth from memory on the card to the GPU is only one 32-bit read per cycle per MP and has a latency of > 200 cycles. To ease this problem, the MP has a register file of 64 KB (16,384 registers, max. of 128 per thread), a shared memory of 16 KB, and an 8-KB cache for read-only access to a declared "constant region" of at most 64 KB. Every cycle, each MP can achieve one read from the constant cache, which can broadcast to many thread at once.

Each MP contains a scheduling and dispatching unit that can handle a large number of lightweight threads. However, the decoding unit can only decode once every 4 cycles. This is typically 1 instruction, but certain common instructions are "half-sized", so two such instructions can be issued together if independent. Since there are 8 SPs in an MP, CUDA programming is always on a Single Program Multiple Data basis, where a "warp" of threads (32) should be executing the same instruction. If there is a branch which is taken by some thread in a warp but not others, we are said to have a "divergent" warp; from then on only part of the threads will execute until all threads in that warp are executing the same instruction again. Further, as the latency of a typical instruction is about 24 cycles, NVIDIA recommends a minimum of 6 warps on each MP, although it is sometimes possible to get acceptable performance with 4 warps.

Implementations Details

Preliminary implementations have been written in C (using the compiler's "intrinsics" to generate SSE instructions), and using the CUDA tools for GPUs. We used the fact that both GT2xx and x86 are essentially SIMD units processing several 32-bit registers at the same time to enumerate the first 32 polynomials simultaneously using algorithm 11.9. We then expect 2 n-32 points of (F 2 )

n satisfying the first 32 equations, that have to be checked against the remaining n -32 equations. This is done using a bitsliced version of the naive evaluation strategy.

The inner loop of algorithm 11.9 was unrolled 2 8 times to avoid explicitly computing the k j indices. On GPUs it is useful to run more threads than the number of hardware cores, to amortize the latency of the arithmetic units and of the memory. There is however a delicate tradeoff: running more threads gives the scheduler an opportunity to run instructions from other threads while some threads are waiting for the (slow) main memory, yet more threads consumme more memory, causing more frequent access to the main memory, and more waiting time... We chose to run 2 7 threads on each MP, and 2 16 threads in total. On CPUs, we used SIMD instructions to run 4 threads simultaneously. Each thread enumerates a chunk of L ≈ 2 30 elements.

Practical Results

Tables 11. 3 and 11.4 shows what our preliminaries implementations are capable of. They are currently the fastest software for solving (generic, dense) systems of multivariate quadratic equations over F 2 . Table 11.4 in particular shows that on modern CPUs equiped with efficient SIMD units, our implementation checks on average more than two vectors of (F 2 )

n in one CPU cycle. We consider this to be a decent achievement in terms of implementation quality.

Performances degrade when the degree increases because of the increased pressure on the cache and memory subsystem. The impact on the GPUs (where fast memory is scarce) is clearly visible. The impact is also greater on Phenom CPUs, because they have less cache than the others. The benchmarked Intel CPUs are more "efficient" than their AMD counterpart because they can dispatch one more SSE instructions per cycle (3 instead of 2). Writing efficient implementations is challenging. It is very time-con summing, as it requires many experiments. It also requires a quite deep understanding of the underlying hardware. For instance, developing these implementations lead us to discover an undocumented feature of G2xx series GPUs: the CUDA compiler (nvcc) reliably generates conditional move instructions, that are executed by the SPs and the SFUs very efficiently.

Time (minutes)

Testing platform #cores n = 64 in 1 month This chapter introduces the polynomial linear equivalence problem(s) we are concerned with. We discuss its cryptographic relevance, and provide a classification of instances. The equivalence of linear maps is a standard notion of linear algebra. Geometrically speaking, two linear maps are said to be equivalent if they describe the same transformation, but with input and output coordinates expressed in different bases. In algebraic terms, two matrices A and B represent equivalent linear maps if there exist two invertible matrices S and T such that B = T × A × S. Here, S changes the basis in which the input coordinates are expressed, while T changes the basis of the output space.

d = 2 d = 3 d = GHz
It is well-known that S and T exist if and only if A and B have the same rank. Therefore, there is an efficient algorithm for the decision problem, namely the problem of testing whether two given matrices are equivalent: it suffices to check whether the ranks of A and B are equal. The search problem, i.e., actually finding S and T if they exist, is a bit more complicated, but efficient algorithms are nevertheless available.

This equivalence relation lends itself to a natural generalization, wich is the equivalence of polynomial maps. Two polynomial maps a and b are said to be (linearly) equivalent if there exist two bijective endomorphisms S and T such that b = T • a • S. The analogy with the usual matrix equivalence is blatant, and it carries the same geometrical meaning: two equivalent polynomial maps describe the same transformation, but with coordinates expressed in potentially different bases. We observe that it is equivalent, and much more convenient, to work with the following definition of S and T :

T • b = a • S (12.1)
The equivalence of polynomial maps naturally raises algorithmic issues. There is again a decision problem ("Are a and b equivalent ?") and a search problem ("Given the promise that a and b are equivalent, what are S and T ?"). We will forget about the decision problem and focus on the search problem, which we call Polynomial Linear Equivalence (PLE), as it does not seem any easier, and is more relevant. Also, the degreetwo case is special enough to give it a name of its own. The Quadratic Maps Linear Equivalence problem (QMLE) refers to the special subclass of PLE where the total degree of the polynomials defining the maps is two.

The equivalence of polynomial maps will look familiar to anyone who has been taught the usual theory of quadratic forms. Recall from §10.2 that two quadratic forms f and g are said to be equivalent if there exist a invertible matrix S such that f = g • S. When n = 2, the equivalence classes are formed of parabolas, hyperbolas, etc. Again, the equivalence notion has a geometic interpretation: equivalent quadratic forms define the same "kind of curve". We have seen that testing the equivalence of quadratic forms is easy, even in characteristic two, because of the existence of easily-computable canonical forms.

The equivalence of quadratic forms also lend itself to several natural generalizations. We are interested in particular in the equivalence of higher-degree forms, and most notably the Cubic Form Equivalence (CFE) problem. In an orthognal direction, an interesting problem is to test the simultaneous equivalence of more than one pair of quadratic forms: given two pairs of quadratic forms f, f , g and g , is there an invertible matrix S such that f = g • S and f = g • S?

Example 12.1. Let us consider the curve of R 3 formed by all the points over which the two quadratic polynomials a 1 = y 2 -x and a 2 = (x + z) 2 -y vanish. Now, let us pick an invertible random change of coordinates:

S =   7 2 -4 6 7 -3 -5 -9 1  
By construction, the zeroes of b = a • S describe the same curve as those of a, but in a linearly transformed space (or, equivalently, with coordinates expressed in a different basis). We easily compute b:

b 1 = 4x 2 + 28xy -36xz + 49y 2 -126yz + 81z 2 -7x -6y + 5z b 2 = 9x 2 + 18xy -24xz + 9y 2 -24yz + 16z 2 -2x -7y + 9z
By construction, a and b are made of two simultaneously equivalent quadratic polynomials.

Of course, we are not restricted to the equivalence of two pairs of quadratic forms, and we could check the equivalence of an arbitrarily high number. We call the corresponding search problem the Quadratic Forms Simultaneous Equivalence (QFSE) problem.

Related Problems

The most well-known related problem is probably Graph-Isomorphism (GI). Given two graphs G 1 and G 2 , the problem is to decide whether G 1 is equal to G 2 , up to a relabelling of the vertices. This particular problem is special in many aspects. After more than 40 years of research there is still no wost-case polynomial time algorithm for GI. On the other hand, GI is unlikely to be NP-complete, since this would make the polynomial hierarchy collapse.

A related problem is the following: suppose you have oracle access to two boolean functions f, g : {0, 1}

n → {0, 1}. They are said to be isomorphic if they are equal up to a permutation of the inputs. How many queries to the oracles are required in the worst case to decide if f and g are isomorphic? Alon and Blais show in [START_REF] Alon | Testing boolean function isomorphism[END_REF] that the query complexity of the problem is Θ q n/2 . They also show that if f is known, then the complexity of the problem drops to Θ (n) for almost all functions f . 12.1 Cryptographic Usage PLE has been (quite badly) called the"Isomorphism of Polynomials"(IP) problem by Patarin in 1996 [START_REF] Patarin | Hidden fields equations (hfe) and isomorphisms of polynomials (ip): Two new families of asymmetric algorithms[END_REF] and has received some attention from the cryptographic community. The hardness of the problem indeed underlied the security of several quadratic multivariate trapdoor one-way function. In addition, Patarin proposed to build an identification scheme out of it.

Building Trapdoor-One-Way Function

During the blossom of multivariate cryptography, many Trapdoor One-Way Functions were proposed, based on the following idea: the public-key is a quadratic map, and evaluating the trapdoor one-way function essentially amounts to evaluate the quadratic map. The intuitive security argument is that inverting arbitrary quadratic maps (i.e., solving an instance of MQ) is well-known to be NP-complete (cf. chapter 10). The trapdoor is that these quadratic maps are built with a special structure allowing the owner of the secret key to invert them. Usually, the idea was to choose an easily-invertible internal quadratic map f as well as two random invertible matrices S and T , and to "obfuscate" the easy-to-invert f by composing it with S and T . One would then hope that PK = T • f • S looks random, and therefore should be as hard-to-invert as random quadratic maps. The public-key is then an "obscure representation" of some special, easily-invertible function f . After breaking C * [Pat95], and while introducing HFE [START_REF] Patarin | Hidden fields equations (hfe) and isomorphisms of polynomials (ip): Two new families of asymmetric algorithms[END_REF], Patarin brought the attention of the crypto community to QMLE as a hardness assumption of its own, on the hardness of which other schemes could be based. The underlying reasoning was that while C * had succumbed to a decryption attack, it had so far resisted all attempts to mount a key-recovery attack. A successful key-recovery attack would implicitly find the solution of an instance of QMLE. This seemed hard, so why not build a new hardness assumption out of it? More generally, if the public-key is formed by the composition: PK = T • f • S and if f is public, then recovering the secret key amounts to solving an instance of QMLE.

Subsequent multivariate public-key schemes relying on the hardness of QMLE include the Hidden Matrix (HM) encryption scheme [START_REF] Patarin | c * -+ and hm: Variations around two schemes of t. matsumoto and h. imai[END_REF], the SFLASH [PCG01a] signature scheme, the traceable block cipher of Billet and Gilbert [START_REF] Billet | A traceable block cipher[END_REF], the Tractable Rational Map Signatures (TRMS) [WHL + 05], the -IC signature scheme [START_REF] Ding | -invertible cycles for multivariate quadratic public key cryptography[END_REF], the Multivariate Quadratic Quasigroup encryption scheme (MQQ) [START_REF] Gligoroski | Multivariate quadratic trapdoor functions based on multivariate quadratic quasigroups[END_REF], as well as the SQUARE [CBD + 09] and SQUARE-Vinegar [START_REF] Baena | Square-vinegar signature scheme[END_REF] encryption schemes. We do not wish to waste time and space by discussing the superabundant and mostly uninteresting variants of the Tame Transformation Signature scheme (TTS) or of the Stepwise Triangular System (STS).

It is worth remarking that all the schemes relying on the hardness of QLME have been broken: a keyrecovery attack against C * can be found in [START_REF] Fouque | Key Recovery on Hidden Monomial Multivariate Schemes[END_REF], HM is broken in [START_REF] Faugère | Cryptanalysis of the hidden matrix cryptosystem[END_REF], a decryption attack against SFLASH is given in [START_REF] Dubois | Cryptanalysis of SFLASH with Slightly Modified Parameters[END_REF][START_REF] Dubois | Practical Cryptanalysis of SFLASH[END_REF], and a key-recovery attack can be found in [START_REF] Macario-Rat | Cryptanalyse de schémas multivariés et résolution du problème Isomorphisme de Polynômes[END_REF]. The traceable block cipher is broken in [START_REF] Fouque | Key Recovery on Hidden Monomial Multivariate Schemes[END_REF], an early version of TRMS is broken in [START_REF] Joux | Cryptanalysis of the tractable rational map cryptosystem[END_REF], and a revised version is broken in [START_REF] Bettale | Cryptanalysis of the trms signature scheme of pkc'05[END_REF], the -IC signature are broken in [START_REF] Fouque | Total break of the -ic signature scheme[END_REF], MQQ is broken in [START_REF] Mohamed | Algebraic attack on the mqq public key cryptosystem[END_REF], while SQUARE and SQUARE-Vinegar are broken in [START_REF] Billet | Cryptanalysis of the square cryptosystems[END_REF].

We are led to believe that basing the security of a multivariate public-key primitive on the hardness of QMLE seems unsound per se. In fact, a more detailed study of the abundant literature mentioned above shows that in all these cases, the corresponding QMLE instances that were broken had a special structure: 12.1. Cryptographic Usage indeed, the problem was to find S and T such that PK = T • f • S, where f had to be easily invertible by the legitimate user. For this reason, the internal map f could not be arbitrary, and the adversaries were facing special, easier, instances of QMLE.

Revisiting a Venerable Identification Scheme

In the same paper in which he introduced QMLE (we mean [START_REF] Patarin | Hidden fields equations (hfe) and isomorphisms of polynomials (ip): Two new families of asymmetric algorithms[END_REF]), Patarin also suggested to base an identification scheme on the hardness of arbitrarily chosen instances of QMLE. This is interesting, because we may avoid the structured instances that turned out to be weak.

In an identification scheme, a prover, who has generated a pair of private/public keys (P K, SK), wants to prove her identity to a verifier who knows P K. In fact the provers wants to prove that she knows SK, but without revealing any information about SK to the verifier, or to anybody else. This is essentially a zero-knowledge proof of knowledge.

Zero-Knowledge proofs were introduced in 1985 by Goldwasser, Micali and Rackoff in [START_REF] Goldwasser | The knowledge complexity of interactive proof-systems (extended abstract)[END_REF]. The next year, two notable and now-classical identification schemes appeared, making use of zero-knowledge proofs. Fiat and Shamir [START_REF] Fiat | How to prove yourself: Practical solutions to identification and signature problems[END_REF] proposed to use the hardness of Quadratic-Residuosity, while Goldreich, Micali and Wigderson [START_REF] Goldreich | Proofs that yield nothing but their validity and a methodology of cryptographic protocol design (extended abstract)[END_REF] built an elegant zero-knowledge proof system for GI and used it to build their identification scheme. The latter is illustrated by Algorithm 12.1. It is straightforwardly zero-knowledge: Peggy only reveals ρ (a random permutation), or ρ • σ -1 (the composition of the secret σ with a random permutation, i.e., a random permutation). If she actually knows σ, then Peggy is able to convince Victor in all cases. If Isabelle (the Impostor), who only knows G 1 and G 2 but not σ tries to play the game with Victor, she fails with probability 1/2. If she chooses a permutation π and set G 3 = π(G 1 ), she succeeds in convincing Victor if he picks tails (because she can just reveal π), and she fails if Victor picks heads (because she does not know the isomorphism between G 2 and G 3 ). Symmetrically, if Isabelle sets G 3 = π(G 2 ), she succeeds in convincing Victor if he picks heads (she reveals π), but she fails if he picks tails (because she does not know the isomorphism between G 1 and G 3 ). Victor is very playful and asks her partner to play with him again and again, so that the probablity that Isabelle succeeds in convinving him that she is in fact Peggy becomes exponentially small. 2. Victor (the Verifier) knows G 1 and G 2 (he found them in a public directory), and he wants Peggy to prove him that she knows σ.

3. Peggy chooses a random vertex-permutation ρ and computes G 3 = ρ(G 1 ). She sends G 3 to Victor.

4. Victor flips a coin. If heads (resp. tails) come out, he asks Peggy to reveal ρ (resp. ρ • σ -1 ).

5. Peggy kindly complies.

Victor checks that

G 3 = ρ(G 1 ) (resp. G 3 = ρ • σ -1 (G 2 )).
On the (slightly more) practical side, the difficulty in coming up with a concrete realization of the GIbased identification scheme is that most instances of GI are extremely easy to solve. For instance, there is an algorithm that solves random instances in expected linear time (see the survey [START_REF] Fortin | The graph isomorphism problem[END_REF] for more details). So far, this is not so bad: random integers are easy to factor, but RSA is still there, because we know how to generate hard instances of the factorization problem. With GI the situation is much worse, because generating hard instances of GI is extremely delicate: many powerful heuristics have to be fooled simultaneously.

Patarin's idea was to simply replace GI by QMLE in Algorithm 12.1. The main reason one would want to do this is that it seems easier to generate hard instances of QMLE -choosing them uniformly at random seems essentially sufficient. Under the assumption that random QMLE is hard, then the resulting identification scheme could even reach decent key sizes.

In order to further improve performance and key size, QMLE could even be replaced by QFSE. The resulting scheme is then competitive with the state of the art in terms of key sizes, as discussed below. In terms of security, it seems that using QFSE instead of GI cannot worsen the (asymptotic) security level: Courtois, Patarin and Goubin indeed established that QFSE is GI-hard. They proved that any instance of GI could be transformed into a (polynomially bigger) instance of QFSE, the solution of which would reveal the solution of the original GI instance. Ergo, replacing GI with QFSE could in theory only lead to a security improvement, while making hard instance generation much easier. A drawback is that it has also been shown that QFSE was also unlikely to be NP-complete, as it would also make the polynomial hierarchy collapse [START_REF] Patarin | Improved Algorithms for Isomorphisms of Polynomials[END_REF][START_REF] Faugère | Polynomial Equivalence Problems: Algorithmic and Theoretical Aspects[END_REF].

Comparison With Other Identification Schemes. Many other identification schemes appeared after the aforementioned works of Fiat-Shamir and Goldreich-Micali-Wigderson. While some of them rely on the hardness of number-theoretic assumptions, some cryptographers took a different line of research, and tried to design identification scheme from different computational assumptions, not relying on number theory, but instead on the NP-hardness of some specific combinatorial problems. We highlight that Patarin's QFSEbased identification scheme does not look too shabby in terms of key size.

One of the very-first combinatorial identification scheme was proposed by Shamir [START_REF] Shamir | An efficient identification scheme based on permuted kernels (extended abstract)[END_REF], and relied on the hardness of the Permuted Kernel Problem (PKP). Later on, Stern proposed in [START_REF] Stern | A new identification scheme based on syndrome decoding[END_REF] a scheme based on the intractability of Syndrome Decoding (SD), a hard problem from coding theory, and in [START_REF] Stern | Designing identification schemes with keys of short size[END_REF] a scheme based on the intractability of Constrained Linear Equations (CLE). Pointcheval [START_REF] Pointcheval | A new identification scheme based on the perceptrons problem[END_REF] proposed a scheme related to the hardness of the Perceptron problem, originating from the area of learning theory. Very recently, Sakumoto, Shirai and Hiwatari [START_REF] Sakumoto | Public-key identification schemes based on multivariate quadratic polynomials[END_REF] proposed a clever scheme based on the average-case hardness of MQ. All these problems are NP-complete (as opposed to QFSE). The designers proposed practical parameters, aiming for a security level of 2 64 or more, which are summarized in table 12.1. It must be noted that several cryptanalytic results may apply to these parameters [START_REF] Baritaud | On the security of the permuted kernel identification scheme[END_REF][START_REF] Georgiades | Some remarks on the security of the identification scheme based on permuted kernels[END_REF][START_REF] Patarin | Improved algorithms for the permuted kernel problem[END_REF][START_REF] Knudsen | Cryptanalysis of an identification scheme based on the permuted perceptron problem[END_REF].

In all these schemes, it is required that all users share a public common string, usually describing an instance of the hard problem at hand. For instance, in number-theoretic problems, the description of the curve, or of the group over which a discrete logarithm problem is considered is a common public information. While this information is not a "key" stricto sensu, it must nevertheless be stored by the prover and by the verifier, leading to higher memory requirements. However, in some case it can be chosen randomly, or generated online from a small seed using a PRNG.

Scheme

Common On the contrary, the QFSE-based identification scheme proposed by Patarin in [START_REF] Patarin | Hidden fields equations (hfe) and isomorphisms of polynomials (ip): Two new families of asymmetric algorithms[END_REF][START_REF] Patarin | Hidden Fields Equations (HFE) and Isomorphisms of Polynomials (IP): Two New Families of Asymmetric Algorithms[END_REF] does not need the prover and the verifier to share additional information (except maybe the description of the finite field, which is very small). The PKP and SD schemes lead to bigger keys than QFSE, while the Perceptron scheme leads to comparable key-sizes, and CLE yields smaller keys, if we neglect the additional memory requirement imposed by the common string shared between all the participants.

Additionnaly, the QFSE-based identification scheme does not make use of either hash functions or commitment schemes. This is in strong contrast with all the other proposals.

As a final note, let us mention that Lyubashevsky recently proposed in [START_REF] Lyubashevsky | Lattice-based identification schemes secure under active attacks[END_REF] to build an identification scheme using the hardness of lattice problems, but did not propose concrete parameters.

Taxonomy

A complete study of Polynomial Linear Equivalence problems is difficult, because many characteristics of the instances influence the performance of the various algorithms. We have already identified three relevant subproblems: QFSE, CFE and QMLE. In this section we try to refine this classification, and to isolate the relevant (sub-)subproblems. Ideally, this classification would help understand and express the performance of corresponding algorithms. Bits and pieces of this classification were done by the authors of the various existing PLE algorithms, but no complete picture was available up to date. Presence of T . While it may sound kind of obvious, QMLE and QFSE are different problems. Of course, QMLE algorithms should apply "as-is" to QFSE, but this is rarely optimal.

Number of Polynomials. When we introduced QMLE at the beginning of this chapter, it was more or less implicit that we considered quadratic maps over (F q ) n , i.e., vectors of n quadratic polynomials. However, when we introduced QFSE, we explicitly stated that we could deal with an arbitrary number of quadratic forms. Let us therefore denote by u the number of polynomials at hand. Key-recovery problems for encryption schemes often yield instances of QMLE with u = n (u < n is impossible, otherwise the ciphertext would contain less information than the plaintext, and u > n is possible but bad in terms of bandwidth). For this reason (amongst others), QMLE has exclusively been studied with u = n. We also believe the other cases to be much harder. At the very least, it seems that most QMLE algorithms break down when u = n, and cannot be fixed in a simple way. Informally, the instance contains O u • n 2 units of information, and the solution that has to be recovered contains O u 2 + n 2 units of information, so the problem is maximally overdetermined when u = n. The situation is essentially the same for QFSE, except that there is no cryptographic motivation pushing to study in particular the case u = n. In fact, the exact opposite is true: in the identification scheme, choosing u as small as possible reduces the key size and the communication complexity. It also apparently makes the scheme more secure: we will show in chapter 13 that the existing algorithms have an exponential running-time when u ≪ n. Note that u = 2 is the lowest admissible value, because we already discussed that the equivalence of single quadratic forms is easy. If a and b are of higher degree, then it would make sense to consider u = 1 though.

Bijectivity of S and T . The definition of PLE problems makes it very clear that S and T should be invertible. If we drop this requirement, we face a completely different problem, also somewhat unfortunately termed the Morphism of Polynomial (MP) problem by [START_REF] Patarin | Improved Algorithms for Isomorphisms of Polynomials[END_REF]. This other problem is much harder, as it easy to show that it is NP-complete. Interestingly enough, finding the minimum number of field multiplications required to multiply two n × n matrices reduces to an instance of MP. It is known that this number is 7 for n = 2, but it is still unknown for n ≥ 3. See [START_REF] Patarin | Improved Algorithms for Isomorphisms of Polynomials[END_REF] for more details regarding MP.

Degree. Certainly the most important parameter of PLE instances is the degree of the polynomial maps. Because of their cryptographic applications, most of our work is devoted to the quadratic case. However, since Patarin proposed to use cubic polynomials in his identification scheme, we investigate this particular matter in chapter 16.

The way in which the degree affects the complexity of solving instances depends of the algorithm used. Some algorithms, including the ones we present in chapters 17 and 18, only work on quadratic instances. The "to-n-fro" algorithm, presented in §13.1 is essentially degree-independent, while the complexity of the Gröbner-basis approach presented in §13.2 increases with the degree.

Homogeneous vs Inhomogeneous. The second most important characteristic of a PLE instance is whether the polynomials are homogeneous or not. This was (to the best of our knowledge) first observed in [START_REF] Levy | Polynomial Equivalence Problems and Applications to Multivariate Cryptosystems[END_REF], in which it was shown that (linear) inhomogeneous QFSE with u = n was solvable in polynomial time. Homogeneous instances are always harder (sometimes exponentially). The following result (vastly plagiarized from [START_REF] Faugère | Polynomial Equivalence Problems: Algorithmic and Theoretical Aspects[END_REF]) expresses the fundamental reason behind this. Lemma 12.1. If T • b = a • S, with S, T ∈ GL n (F q ), then for all i ∈ N, we have:

T • b (i) = a (i) • S.
In more concrete terms, lemma 12.1 states that when dealing with an inhomogeneous instance, S and T are simultaneously the solutions of homogeneous instances corresponding to each lower-degree homogeneous component. What becomes very interesting is then to look at the homogeneous components of degree zero and one. We find:

T × b (1) = a (1) × S, T × b (0) = a (0) .
These two relations degenerate to 0 = 0 in the homogeneous case, but otherwise reveal an important amount of information on S and T , and play a crucial role in the new algorithms we present in chapter 17. Prior to this work, Faugère and Perret proposed in [START_REF] Faugère | Polynomial Equivalence Problems: Algorithmic and Theoretical Aspects[END_REF] the first algorithm that (empirically) runs in polynomial time on inhomogeneous instances of any degree.

In general, we could summarize the difference between the homogeneous and inhomogeneous cases by saying that "there is no free lunch1 in the homogeneous case". As shown above, there are various ways to obtain "free" information on S and T in the inhomogeneous case, but none of these are applicable to the homogeneous case. To emphasize the difference between the homogeneous and the inhomogeneous case of the QMLE problem, we distinguish between Inhomogeneous QMLE (IQMLE) and the standard (homogeneous) QMLE.

Linear vs Affine. We stress that it is only possible to take advantage of the inhomogeneity of an instance if S and T are linear (as opposed to affine) bijections. While bringing in affine transformations is not in the spirit of the generalization of matrix equivalence we started with, it is very natural if the purpose of S and T is to obfuscate the representation of some quadratic map (in an encryption/signature context). In the presence of affine transformation, equation (12.1) becomes:

T • b(x) + d = a (S • x + c) ,
with S, T ∈ GL n (F q ) , and c, d ∈ (F q ) n (12.2)

Affine instances were thought to be harder, and the strategy proposed in [START_REF] Patarin | Improved Algorithms for Isomorphisms of Polynomials[END_REF] was to guess c and d before doing anything else. It is in fact possible to do better, and the starting point is to adapt lemma 12.1 to the affine case. The result is unfortunately less appealing. • S.

In particular, if d is the degree of a and b, then b

(d) = T • a (d) • S.
Proof. Starting from equation (12.2) we have:

T • b(x) + d = a (S • x + c) = a (S • x) + ∂a ∂c (S • x)
The first statement of the lemma follows from applying lemma 12.1 to the leftmost and rightmost sides of this equation. The second statement follows from the fact that deg ∂a ∂c = deg a -1.

Lemma 12.2 has three important consequences.

1. When facing an affine instance, the linear part of the solution (S and T ) is amongst the solutions of the linear homogeneous instance formed by considering only the homogeneous component of highest degree. Thus, c and d do not need to be guessed beforehand if the homogeneous problem can be cracked down.

2. If a and b are quadratic and homogeneous, then the value of c and d can be retrieved efficiently, as observed in [START_REF] Geiselmann | Attacking the Affine Parts of SFLASH[END_REF]. Because b is homogeneous, then b (1) is identically zero. This means that ∂a ∂c

(1)
is identically zero as well. Because a is quadratic, the function that maps c to ∂a ∂c is linear. Thus ∂a ∂c = 0 in fact yields n 2 linear equations on the n coordinates of c, and c can be retrieved in polynomial-time by straightforward linear algebra. Once c has been recovered, d comes for free.

3. The same reasoning applies to quadratic affine inhomogeneous instances, but S and T must be known before c and d can be recovered.

To summarize, when dealing with affine instances, the procedure is the following: solve the linear homogeneous instance obtained by looking only at the homogeneous component of highest degree. Once S and T have been retrieved, recover c and d in polynomial time.

This shows that the linear homogeneous case is complete, in the sense that if we know how to solve it efficiently, then we will know how to deal with all the other cases. This was already observed in the context of QFSE by Perret in [START_REF] Perret | A Fast Cryptanalysis of the Isomorphism of Polynomials with One Secret Problem[END_REF]. So, the study of QMLE in fact boils down to two cases: the (easy) linear inhomogeneous case, and the (difficult) linear homogeneous case.

Parity of q and n. In some algorithms, the parity of the characteristic of the field plays a role. This happens for essentially two reasons: firstly, D x always vanish on x when q is even. Secondly, in characteristic two, the theory of quadratic forms comes in a specific "flavor". For instance, the sets of symmetric and skew-symmetric matrices nearly coincide, with funny consequences.

The algorithms often have to be analyed differently in characteristic two and in odd characteristic, and some of their properties are different (it is often trickier in characteristic two). In addition, in characteristic two, the parity of n sometimes also plays a role, notably because when n is odd, symmetric matrices with zeroes on the diagonal are always singular. This particular problem manifests itself in the Jacobian algorithm for QFSE presented below, and in the QFSE algorithm we present in chapter 15.

Bijectivity of a and b, and Other Properties. There are some pre-existing algorithms where the fact that a and b are bijective quadratic maps makes the algorithm faster and the analysis simpler. In the same way, some specific algorithms may depend on particular properties of the quadratic maps. When it is the case, it is important that these properties are clearly stated. Chapter

13

Revisiting Prior Algorithms for PLE We describe and discuss the pre-existing algorithms for all variants of PLE.

In this chapter we describe and discuss the features of five pre-existing algorithms. Essentially two non-trivial algorithms have been proposed so far for QMLE: the "To-and-Fro" approach of Courtois, Goubin and Patarin [START_REF] Patarin | Improved Algorithms for Isomorphisms of Polynomials[END_REF] on the one hand, and the "Gröbner Basis" approach of Faugère and Perret [START_REF] Faugère | Polynomial Equivalence Problems: Algorithmic and Theoretical Aspects[END_REF] on the other hand. While the former is historically the first algorithm to improve on exhaustive search, its complexity is greater than q n . The authors of the latter conjectured, without giving any supporting evidence, that their technique is subexponential, and observed that it empirically terminates in polynomial on random inhomogeneous instances, thereby providing the first concrete evidence that these instances were easy.

To our knowledge, the first algorithm dedicated to QFSE was given in 2003 by Geiselmann, Meier and Steinwandt [START_REF] Geiselmann | An Attack on the Isomorphisms of Polynomials Problem with One Secret[END_REF], and because it needs a name, we call it the "columnwise sieve". Soon after, Levydit-Vehel and Perret [START_REF] Levy | Polynomial Equivalence Problems and Applications to Multivariate Cryptosystems[END_REF] suggested to replace the "exhaustive search" component of the columnwise sieve by the computation of a Gröbner basis, resulting in the "algebraic columnwise sieve". Both algorithms are exponential by nature, and their complexity was not even vaguely known. A breakthrough took place in 2005, when Perret [START_REF] Perret | A Fast Cryptanalysis of the Isomorphism of Polynomials with One Secret Problem[END_REF] proposed a new algorithm, that we call the "Jacobian" algorithm because its distinctive feature is the use of Jacobian matrices. This algorithm is polynomial when the number u of polynomials in a and b is equal to the number of variables n. Recall that in the context of QFSE and CFE, a and b have u polynomials, and that we do not enforce u = n a priori.

While we originally intended to do a quick survey of the state of the art, doing it turned out to be surprisingly challenging and disappointing. The algorithms were often quite vaguely described, with room for interpretation and without pseudo-code. In addition, their success probability, and/or their running time, were often not discussed. We thus give our own complexity analysis for four of the five algorithms under review.

Going To-and-Fro

Informal Description. The first non-trivial algorithm for QMLE, given in 1998 by Courtois, Goubin and Patarin [START_REF] Patarin | Improved Algorithms for Isomorphisms of Polynomials[END_REF]. It has been independently rediscovered five years later by Biryukov, De Cannière, Braeken and Preneel [START_REF] Biryukov | A toolbox for cryptanalysis: Linear and affine equivalence algorithms[END_REF], under the form of an algorithm to test the linear equivalence of S-boxes.

The to-n-fro algorithm is based on the following informal observation: if we know the value of S on a few linearly independent points, then we can efficiently "amplify"our knowlegde of S into an exponentially bigger knowledge of T . Let F = f 1 , . . . , f r be a subspace of (F q )

n over which S is known. Then for any

x ∈ F , it is no big surprise that:

T • b (x) = a (S • x) .
This reveals T over the q r points forming the image of F by b. Since b is by definition non-linear, we may legitimately hope to discover T on a subspace of (F q ) n of dimension greater than r. The second idea underlying the algorithm is that knowledge of T can be "transferred" back into knowledge of S, yet doing so is very expensive. Following its inventors, we will assume that a and b are bijective quadratic maps (we will try to drop this assumption later on). The point is that for all x ∈ (F q )

n we have:

a -1 (T • x) = S b -1 (x) (13.1)
So, from the equality y = T • x, involving only T , we deduce the equality a -1 (y) = S b -1 (x) , involving only S. Solving two instances of the MQ problem thus reveals the image of S on a point. On some points of G, the preimage will not belong to F , and our knowledge of S will then be increased, allowing us to re-iterate the procedure, until S and T have been completely determined.

More In-Depth Study. The inventors of this algorithm did not give any in-depth complexity analysis, and did not give pseudo-code. Instead, they illustrated their algorithm on a toy example. Algorithm 13.1 shows our attempt at writing a rigorous description. if dim G = dim F then report failure 8:

for all x ∈ Gb(F ) do Enlarge F

9:

u ← b -1 (x)

10:

v ← a -1 (T • x)

11:

F ← F + u 12:
remember that S • u = v 13:

end for 14:

until dim F = n 15:

Fully determine T 16:

return S and T 17: end function Looking at the pseudo-code, we realize that the algorithm may fail. In that case, it must be restarted with an enlarged F (which means that the image of S on one more point must be found). The algorithm fails on line 7 if b(F ) is a vector space. Note that this will always happen if dim F = 1, q = 2 and the polynomials are homogeneous. Under the same conditions, if F = u, v , q = 2 then failure would mean that b(u + v) = b(u) + b(v). If b were a random permutation we could assert that this happens with probability 2 -n (over the random choice of b). We can in fact check that this is true even though b is a random bijective quadratic map, but we skip the details.

It therefore seems clear that the "Bijective to-n-fro" will find the solution with high probability given one (resp. two) known relation in F when q is greater than two (resp. equal two). In both cases, 2n instances of the MQ problem will have to be solved.

Giving Up on Bijectivity. It seems natural to try to drop the bijectivity requirement, as a random QMLE instance is not bijective with overwhelming probability. This is in fact surprisingly challenging, and there are many possible ways to adapt the bijective algorithm. The main issue is that there may now be zero, one, or more than one preimages. The simplest option is probably to ignore the cases when there is not a single preimage. This however creates a non-negligible possibility of failure: for instance, if q = 2, F = x, y and the polynomials are homogeneous, then if everything goes well we will have G = b(x), b(y), b(x + y) , and Gb(F ) contains 4 elements. We know the distribution of the number of preimages of b from §10.2, and the probability that none of these 4 elements has a single preimage is (1 -1/e) 4 ≈ 16%. Algorithm 13.2 shows our attempt at getting rid of the bijectivity constraint.

The case where there are more than one preimage could be dealt with by "guessing" the right permutation of the preimages and going on, but this then yields a more complicated backtracking algorithm, and it is unclear that the result will be more efficient. In any case, the number of MQ instances that we need to solve in order to find a point of G having a single preimage follows a geometric distribution of parameter 1/e. Therefore, we expect, all-in-all to have to solve 3.7n instances of the MQ problem.

To conclude, we note that the method generally has problems with non-bijective instances of QMLE, but its failure probability goes down when the size of the field grows. Lastly, it is inherently exponential, as it assumes the possibility to invert the quadratic maps. Moreover, since the image of S must be known on at least one point (two when q = 2), then the full algorithm has a complexity of order O n • q 2n when q > 2, and O n • q 3n when q = 2 (in conformance with the claims of Courtois, Goubin and Patarin).

The Gröbner-Basis Algorithm

Let us take a look back at equation (12.1): if dim G = dim F then report failure end for 16:

T • b = a • S
until dim F = n 17:

Fully determine T 18:

return S and T 19: end function This is an equation between two vectors of multivariate polynomials. If we pick a random vector x ∈ (F q )

n , we observe that T • b(x) -a(S • x) = 0. In this equality the coefficients of S and T appear with degree two and one, respectively. We thus have n quadratic equations in 2n 2 variables. But nothing prevents us to generate a different vector of n quadratic equations in these same variables by choosing a different random vector x. In fact, repeating this process 2n 3 times would yield 2n 4 quadratic equations in 2n 2 unknowns, and it would be possible to solve the resulting system by linearization in time O n 6 .

This approach, while very tempting and independently rediscovered many times, in fact fails miserably. The reason is that the number of linearly independent equations that can be generated that way is in fact upper-bounded by n 2 • (n -1)/2 in the homogeneous case (this is n times the number of monomials in n variables of degree exactly two), and by n • (n + 2) • (n + 1)/2 in the inhomogeneous case (this is n times the number of monomials in n variables of degree at most two), as shown in [START_REF] Faugère | Polynomial Equivalence Problems: Algorithmic and Theoretical Aspects[END_REF].

Directly Obtaining The Interesting Equations. Faugère and Perret demonstrated that it is easy to directly acquire a basis of the vector space spanned by these equations. If we rewrite (12.1) into T •b-a•S = 0, then the multivariate polynomials on the left are identically zero, and therefore the coefficient of each monomial must be zero. These coefficients are themselves quadratic polynomials in the entries of S and T . So, this coefficient-wise identification yields one quadratic equation in the entries of S and T for each occurrence of each monomial in a or b, and this makes precisely n • n+2 2 equations. So, a possible QMLE algorithm consists in:

1. Acquiring the n • n+2 2 quadratic equations in S and T resulting from (12.1).

2. Computing a Gröbner basis of the corresponding ideal.

3. Actually finding all the solutions of these equations using the Gröbner basis.

Properties of the Equations. First of all, the system of equations obtained that way is overdetermined. As a consequence, even without adding the field equations we find that the existence of solutions in the algebraic closure besides those in F q is extremely unlikely, which suggests that the properties of this QMLE algorithm are relatively independent from the size of the field. This concurs to make this remarkable method unique.

Additionnaly, when a and b are homogeneous, then I is a bi-homogeneous ideal of positive dimension (most likely one). The coefficients of T only occur linearly, while the coefficients of S appear in monomials having the same degree as a, thus the ideal is bi-homogeneous. Some specialized Gröbner basis algorithm could then possibly be applied [START_REF] Faugère | Gröbner bases of bihomogeneous ideals generated by polynomials of bidegree (1, 1): Algorithms and complexity[END_REF].

When there is a solution, there is in fact an infinite family of solutions in the algebraic closure of the field, because if (S, T ) is a solution, then (λ • S, λ 2 • T ) is also a solution. This justifies in passing that the ideal is of positive dimension.

Theoretical and Practical Complexity

Faugère and Perrey empirically observed that when applied to quadratic random inhomogeneous instances, the degree of the polynomials handled by the Gröbner basis computation was always less than or equal to three. This means, according to the discussion in §10.4, that the complexity of computing the Gröbner basis is O n 9 . They also observed that in this particular case, the running time of the whole procedure was dominated by the cost of constructing the equations, and not by that of their resolution! This motivates a little more in-depth investigation of the matter.

Generating the Equations. A first observation is that if we have to generate O n 3 quadratic equations in O n 2 variables, then our system of equation can have up to O n 7 non-zero coefficients in the worst case. Were we to use a dense representation to store our equations, the time needed to generate them would then obviously be Ω n 7 . The only way this bound could be beaten would be to exhibit some kind of pattern in the equations and to use a sparse representation, as shown below.

We will focus, for the sake of simplicity, on the homogeneous case. Suppose then that we are given a (resp b) as a collection of n quadratic forms, each represented by an upper-triangular n × n matrix over F q denoted by A [i] (resp. B [i] ). If we look at the k-th coordinate of equation ( 12.1), we see:

T k• • b(x) = a k (S • x)
It is not incredibly difficult to work out that this translates as:

n i=1 n j=i n =1 T k • B [ ] ij • x i x j = n i=1 n j=1 n =1 n m= S i • A [k] m • S mj • x i x j
Identifying the coefficients of the x 2 i monomials yields:

n =1 T k • B [ ] ii = n =1 n m= S i • A [k] m • S mi (13.2)
And doing the same with the x i x j monomials gives:

n =1 T k • B [ ] ij = n =1 n m= (S i + S j ) • A [k] m • (S mi + S mj ) (13.3)
And our system of n 2 (1 + n) quadratic equations S quad is formed by assembling (13.2) and (13.3) for all 1 ≤ k ≤ n, 1 ≤ i ≤ n and i < j ≤ n. More interestingly, if we look at an individual equation, we find that only the coefficients of S •i , S •j and T k• occur. Thus the generators of S quad are indeed sparse, and the complete set of equations can be represented with O n 5 non-zero coefficients. In addition, these coefficients can be obtained without any arithmetic operations, with just some shuffling around of the coefficients of a and b.

Solving the Equations. The equations in S quad are certainly not random-looking. This can be seen with an informal information-theoretic argument: a random system of O n 3 equations in O n 2 variables cannot be described by less that O log q • n 7 bits, while S quad is completely characterized by only O log q • n 3 bits (this is the size of a complete description of a and b).

The authors of [START_REF] Faugère | Polynomial Equivalence Problems: Algorithmic and Theoretical Aspects[END_REF] considered two distinct settings and evaluated their algorithm in both: the inhomogeneous case in which random homogeneous components of all degrees are present, and the semi-homogeneous case, where only the quadratic and linear homogeneous components are present, but not the constant one. It is also interesting to take a look at the (fully) homogeneous case.

Let us assume, for the sake of the argument, that S quad is a semi-regular system (cf. §10.5). In the homogeneous case, we only have quadratic equations, so we directly compute the degree of regularity using the Hilbert series, assuming the presence of 2n 2 variables and n 2 (n+1)/2 equations. In the semi-homogeneous case, we note that there are n 2 linear equations in the system, which amounts to remove n 2 variables. We therefore compute the degree of regularity assuming the presence of n 2 variables and n 2 (n + 1)/2 quadratic equations. In the inhomogeneous case, we assume that the degree of regularity is 3, as observed by Faugère and Perret. These degrees of regularity are shown in Figure 13.1a and the corresponding complexities are shown in Figure 13.1b. In the inhomogeneous case, we find a polynomial complexity, as expected. In the semi-homogeneous case, we find a complexity of order O 2 6n , and in the (fully) homogeneous case, a complexity of order O 2 18n .

We note that this directly contradicts [START_REF] Faugère | Polynomial Equivalence Problems: Algorithmic and Theoretical Aspects[END_REF], in which it was conjectured that the Gröbner basis computation would be subexponential in the semi-homogeneous case. Our complexity estimates are established under the debatable assumption that quite structured systems of quadratic equations are semi-regular. Thus, determining the complexity of this algorithm is an essentially open problem.

Experimental Results

log log log is known to grow to infinity, but it has never been observed doing so...

Don Coppersmith

We could not obtain definitive results on the complexity of the algorithm from a theoretical point of view, but we still have a chance to study it in practice. It would be interesting to compare our estimates with the actual behavior of the algorithm. Getting a complete picture of the practical behavior of the algorithm is nevertheless not very simple, for two reasons: a) many parameters influence the behavior of the algorithm, and b) the time and space complexity quickly becomes so high that only very small values of the parameteres can be considered in practice. This makes it close to impossible to check whether the asymptotic estimates are meaningful. For instance, in the fully-homogeneous case over F 2 8 , the algorithm terminates in 30s when n = 5 but runs for more than 2 weeks when n = 6.

We could try to benchmark the performance of the algorithm, but we would in fact vastly be benchmarking a particular implementation of a particular Gröbner basis algorithm, specifically, the implementation of F 4 in the MAGMA [BCP97] computer algebra system. We therefore quote the numbers from [START_REF] Faugère | Polynomial Equivalence Problems: Algorithmic and Theoretical Aspects[END_REF] in Table 13.1.

The "Columnwise Sieve" Algorithm

In [START_REF] Geiselmann | An Attack on the Isomorphisms of Polynomials Problem with One Secret[END_REF] Geiselmann, Meier and Steinwandt presented a nice and simple algorithm for QFSE. Their objective was to tackle the affine case, but for the sake of simplicity we will consider their ideas in the linear case.

The initial idea is quite simple, and consists in sieving the individual columns of S. Since we have b = a • S, then evaluating over a vector of the canonical basis of (F q )

n yields: b(e i ) = a (S •i ). Therefore, the set of possible candidates for the i-th column can be restricted to:

C i = {x ∈ (F q ) n | b(e i ) = a (x)}
Next, if we have sieved the possible candidate for columns i and j of S, we can sieve further, by noting that for all α, β ∈ F q , we should have: b(α

• e i + β • e j ) = a (α • S •i + β • S •j
). If the equation does not hold, then we know that the combination (S •i , S •j ) is wrong. In other terms, we extend our candidate sets to pairs of columns:

C ij = {x, y ∈ (F q ) n | ∀α, β ∈ F q , b(α • e i + β • e j ) = a (α • x + β • y)}
We could extend our definition of candidate sets to more than two columns in the same way ; we illustrate this with the extension to three columns: A Simplified Version. We are now ready to build a simplified version of the columnwise sieve. Algorithm 13.3 is the result of a compromise between faithfulness to the ideas of [START_REF] Geiselmann | An Attack on the Isomorphisms of Polynomials Problem with One Secret[END_REF] and simplicity. We stress that there are countless ways to improve our presentation of the algorithm, but we do not elaborate further. for all x ∈ (F q ) n do for i from 2 to n do 6:

C ijk = {x, y, z ∈ (F q ) n | ∀α, β, γ ∈ F q , b(α • e i + β • e j + γ • e k ) = a (α • x + β • y + γ • z)} type n q F 5 running
C i ← ∅ Compute C i 7:
for all x ∈ (F q ) n do 8:

if b(e i ) = a(x) then C i ← C i ∪ {x}

for all (k 1 , . . . , k i ) ∈ (F q ) i do 12: if b (k 1 • e 1 + • • • + k i • e i ) = a (k 1 • x 1 + • • • + k i • x i
) then jump to line 14 return C 1,2,...,n 17: end function After regretting that the complexity analysis we are going to sketch is absent from [START_REF] Geiselmann | An Attack on the Isomorphisms of Polynomials Problem with One Secret[END_REF], we begin with a few remarks. First of all, Algorithm 13.3 always succeeds, and returns the set of all possible S. Secondly, just computing C 1 , C 2 , . . . , C n makes its complexity Ω (n • q n ). Taking into account the time (and space) complexity of what happens in line 9-14 is a bit more troublesome, as it cannot be done without (at least) estimating the sizes of the various sets handled by the algorithm.

It is reasonable to expect |C i | = q n-u . On the other hand, the usual complications appear as soon as we try to estimate the size of C ij : it depends on whether a and b are homogeneous or not. Indeed, a given pair (x, y) must satisfy q 2 conditions to belong to C i (one condition per pair (α, β) in the definition of C i ). The point is that some of these conditions are always satisfied, such as the condition with α = 0, β = 0, which says nothing about x and y.

-If a and b are inhomogeneous, this is the only always-satisfied condition, and therefore:

|C ij | ≈ q 2•n-u•(q 2 -1)
-If a and b are homogeneous, then the conditions (α, β) and (α • γ, β • γ) are equivalent if γ = 0. To see why, observe that: b(γ

• α • e i + γ • β • e j ) = γ 2 • b(α • e i + β • e j )
Something similar holds for a. Thus, we may restrict α to be equal to either zero or one without loss of generality, and when α = 0 we may safely restricts ourselves to β = 1. This leaves q + 1 non-trivial conditions, and we find:

|C ij | ≈ q 2•n-u•(q+1)
So, as usual, things are worse in the homogeneous case. Having noted this fact, we switch back to the inhomogeneous case that was the prime concern of [START_REF] Geiselmann | An Attack on the Isomorphisms of Polynomials Problem with One Secret[END_REF]. By extending the above reasoning, we expect that:

|C i1,...,i | ≈ q •n-u•(q -1)
To measure the spatial complexity of the algorithm, we would need to measure the maximal size reached by C 1,...,i during the course of the computation. It is not particularly difficult to verify that the maximum cardinality is reached for i max = log q (n/(u ln q)), and that the maximum cardinality itself is roughly:

q u • n u • ln q n • e -n
So, the number of times line 12 is executed when i = i max is:

T 12 = |C i1,...,imax | • |C imax | • q imax = q u • n u • ln q n • e -n • q n-u • n u ln q = n u • ln q • n • q e • u • ln q n So
all-in-all, the complexity of algorithm 13.3 is approximately:

T columnwise = max n • q n , n u • ln q • n • q e • u • ln q n (13.4)
Figure 13.2 illustrates how the complexity of is influenced by q, n and u. It appears that increasing u makes the algorithm more efficient. Interestingly enough, u = 1 and u = 2 looks like the worst-cases, yet these settings yield the smallest keys in the identification scheme of §12.1.2.

Possible Improvements Using Extension Fields. The authors of this algorithm proposed several nontrivial improvements to the simple version that we presented. The intuition behind our definition of C i is that b(e i ) = a(S •i ). One improvement is that this equality can be quantified over F q : for all λ ∈ F q , we have b(λ • e i ) = a(λ • S •i ). We could therefore extend a bit our definition of C i , by considering:

x ∈ (F q ) n | ∀λ ∈ F q , b(λ • e i ) = a (λ • x)
Note that when q = 2, then quantifying over all F 2 does not improve anything. However, as the authors of [START_REF] Geiselmann | An Attack on the Isomorphisms of Polynomials Problem with One Secret[END_REF] pointed out, this problem can be circumvented by embedding F q in a suitably large field extension (say, F q k , with q k ≥ d + 1), and setting:

C [k] i = x ∈ (F q ) n | ∀λ ∈ F q k , b(λ • e i ) = a (λ • x)
One may even hope that the cardinality of C

[k] i would be a decreasing function of k. Of course, we always have C

[k]

i ⊆ C i . Introducing this new set of candidates would only be interesting if C

[k] i were quite smaller than C i . Again, we must be very careful that when a and b are homogeneous, then

C i = C [k]
i (for reasons we in fact discussed above). However, in the inhomogeneous case this might work and sensibly reduce the size of the candidate sets. The following lemma will help us figure by how much, and generally clarifies things. The complexity is smaller than indicated by each line on the left, and greater on the right. The lines become vertical when n•q n dominates the complexity, and increasing u no longer helps in making T columnwise smaller in equation (13.4) smaller.

Lemma 13.1. Let α be a primitive element in F q k , and let β 1 , . . . , β d be d distinct non-zero elements of F q k . Consider the set:

C [k] i = {x ∈ (F q ) n | b(β 1 • e i ) = a (β 1 • x) , . . . , b(β d • e i ) = a (β d • x)} C [k] i = {x ∈ (F q ) n | b(α • e i ) = a (α • x)} When k ≥ d, then we have: C [k] i = C [k] i = C [k] i .
Proof. Let f be an arbitrary polynomial of total degree d in n variables, and let x be a non-zero vector in (F q ) n . Let us define the degree-d polynomial over F q k [X]:

P f ,x (X) = d i=0 f (i) (x) • X i
We obviously have: f (λ • x) = P f ,x (λ). Therefore, we may reformulate the definition of C

[k] i :

C [k] i = u j=1 x ∈ (F q ) n | ∀λ ∈ F q k , P bj ,ei (λ) = P aj ,x (λ)
But it now becomes clear that if P bj ,ei and P aj ,x (which are are degree-d polynomials) coincide on d + 1 points, then they are in fact equal coefficient-wise, and will coincide on the whole F q k . And since we always have P bj ,ei (0) = P aj ,x (0), we find that it is in fact sufficient to check d distinct values of λ (as opposed to type q n u degree predicted complexity Linear inhomogeneous q k ). This shows that C

[k] i = C

[k]

i . We observe that as soon as q ≥ d + 1, then there is no gain in using a field extension, since we may very well choose the β i in F q .

It remains to show that if k ≥ d, then

C [k] i = C [k]
i . Let us thus assume that k ≥ d, and that P bj ,ei (α) = P aj ,x (α). Applying the Frobenius map to both sides of this equation yields:

P bj ,ei (α) q = P aj ,x (α) q d k=0 α q•k • b (k) j (e i ) = d k=0 α q•k • a (k) j (x)
P bj ,ei (α q ) = P aj ,x (α q ) This argument repeats, and we find that for any integer 1 ≤ k ≤ d, P bj ,ei α q k = P aj ,x α q k . This shows that C

[k] i ⊆ C [k]
i (with β i = α q i ), and establishes the result.

In [START_REF] Geiselmann | An Attack on the Isomorphisms of Polynomials Problem with One Secret[END_REF], it was suggested to choose a somewhat large extension, with the underlying hope that the bigger the extension is, the smaller C

[k] i would get. Lemma 13.1 shreds this hope to pieces. Making use of an extension field is only useful if q ≤ d (typically, when q = 2). In the quadratic case, with q = 2, a degree-two extension is sufficient, and testing only one well-chosen value of λ is also sufficient. It also makes it reasonable to expect |C

[k] i | ≈ q n-d•u , as soon as q k ≥ d + 1.
Achievements. To conclude, we report in Table 13.2 the parameter ranges that have been broken in practice in [START_REF] Geiselmann | An Attack on the Isomorphisms of Polynomials Problem with One Secret[END_REF]. The star ( ) indicates that the running time should be dominated by the computation of the C i .

We have extrapolated how much time would the Columnwise Sieve require to break the challenges, and show the result in Table 13.3. We first conclude that it should clearly be able to break the linear inhomogeneous legacy challenges B 1 and D 1 with roughly 2 27 operations. It seems plausible that it would also have broken the affine variants. The challenges with greater n are more difficult: we project that the algorithm would perform 2 53 evaluations of a and store 2 35 candidates to solve A 1 . These figures grow to 2 70 operations and 2 50 candidates for challenge C 1 . The affine cases should be even harder. Table 13.4: Parameters solved in practice in [START_REF] Levy | Polynomial Equivalence Problems and Applications to Multivariate Cryptosystems[END_REF]. In all these cases, the running time of algorithm 13.3 would be dominated by the computation of the C i .

q n u (
Moving on to the updated challenges, it seems plausible that the algorithm would break B 2 and D 2 (in 2 35 operations). Breaking B 3 seems theoretically possible, but would be challenging (2 52 operations are required), and breaking D 3 seems quite impractical (2 58 operations required). All the other challenges are out of reach.

The "Algebraic Columnwise Sieve" Algorithm

In [START_REF] Levy | Polynomial Equivalence Problems and Applications to Multivariate Cryptosystems[END_REF], Perret and Levy-dit-Vehel proposed a reformulation of the columnwise sieve in more algebraic terms. It is indeed clear that:

C i = a -1 (b(e i ))
Let us try to move to a more algebraic framework. Let us consider the ring R = F q [x 1 , . . . , x n ], and let I q = x i qx i 1≤i≤n be the "field ideal" whose variety is precisely (F q ) n . It is not hard to express C i as a variety:

C i = V I q + b j (e i ) -a j (x) 1≤j≤u
The same goes for the more sophisticated version C i , which quantifies over F q :

C i = V I q + b j (α • e i ) -a j (α • x) 1≤i≤n α∈Fq, α =0
Interestingly, the discussion of lemma 13.1 has a counterpart here: in the inhomogeneous case, C i contains only d • u linearly independent equations (and not q • u).

The first algorithm given in [START_REF] Levy | Polynomial Equivalence Problems and Applications to Multivariate Cryptosystems[END_REF] essentially amounts to compute C 1 , C 2 , . . . , C n trough a Gröbner basis computation, and then to exhaustively search their cartesian product. The point is that for big values of q, computing C i this way is going to be more efficient than by exhaustive search. However, if nu is big, searching the cartesian product will be prohibitivey expensive. As it seems that Levy-dit-Vehel and Perret mostly had the u = n case in mind, we also stick to this case. In this setting, then computing C i amounts to solve a system of d • n equations of degree d in n variables. In the case where d = 2, we find that the degree of regularity of a system of 2n semi-regular quadratic equations in n variables is (thanks to (10.2)):

D reg = 0.0858n + 1.041n 1/3 -1.50
Using this, we may estimate, more or less precisely, the complexity determining C i . Figure 13.3 shows an asymptotic improvement over exhaustive search when q ≥ 3. The practical signification of this asymptotic result is not completely clear though.

Achievements. We report in Table 13.4 the parameter ranges that were broken in practice in [START_REF] Levy | Polynomial Equivalence Problems and Applications to Multivariate Cryptosystems[END_REF]. Again, we note that the improvement over [START_REF] Geiselmann | An Attack on the Isomorphisms of Polynomials Problem with One Secret[END_REF] is not breathtaking. On the other hand, the difference would probably be more visible on bigger fields, where Gröbner bases have a greater edge over exhaustive search.

13.5 A Revolution in the QFSE World : the Jacobian Algorithm De l'audace, encore de l'audace, toujours de l'audace ! Georges Jacques Danton (1759-1794)

equations in the coefficients of S. As soon as n 2 linearly independent such equations have been obtained, then S can be fully reconstructed with usual linear algebra, in time O n 6 . The value of is therefore the critical parameter of the algorithm. Let us denote by ⊥ the minimal possible value (assuming no unfortunate linear dependency occurs), as a function of n and u. In the inhomogeneous case, equation (13.5) brings in u • n equations, the relations bring • n equations, and using the Jacobian matrix (by fixing x in lemma 13.2) the relations give birth to an additional • u • n equations. Therefore, if all the linear equations we obtain are independant, we will need to acquire at least ⊥ = (nu)/(u + 1) relations. In the homogeneous case, a similar argument yields ⊥ ≥ n/(u + 1) .

Selective Exhaustive Search

The relations are found thanks to a so-called "selective exhaustive search" that exploits the idea that S transforms ker J a (0) into ker J b (0), as implied by equation (13.5). It also exploits the similar fact that S transforms the kernel of P (a i ) into that of P (b i ). The exhaustive search process can therefore be restricted to these subspaces of (F q )

n , assuming that they are not reduced to the zero vector, and hoping that they are not too big.

We will try to derive some useful results on the complexity of the Selective Exhaustive Search, assuming that instances are randomly chosen. This will enable us to derive complexity bounds on the full algorithm.

In the inhomogeneous case, we will assume that u ≤ n. Indeed, if u ≥ n, then J a (0) has full rank with high probability and it should be possible to deduce S from equation (13.5) in nearly all cases. If u = n, we will assume that det J a (0) = 0, for the same reason. We will focus on the inhomogeneous case, and we will distinguish between two situations: u = n and u ≥ n/2.

Case u = n. If J a (0) is invertible, then S can be deduced from (13.5) in time O n 3 , and this happens with probability λ(n). In the other case, we see that ⊥ = 1, so we will focus on obtaining one relation. For the sake of simplicity, we forget about the polar forms, since we are guaranteed to find our relation in the kernel of the jacobian matrix. We thus pick an arbitrary x ∈ ker J a (0), and we try all the possible y ∈ J b (0). The expected number of tries is the expected cardinality of ker J a (0), which is a uniformly distributed random matrix as argued above. Lemma 10.20 then tells us that the expected number of tries is q + O (1/q). Therefore we conclude that finding the single needed relation is very efficient, and the algorithm should run in expected polynomial time, even if the Jacobian matrix is non-invertible.

Case u ≥ n/2. It is easy to deduce from the expression of ⊥ that n/2 is the smallest value of u such that a single relation will be neeed. However, the kernel of J a (0) will then contains q n-u elements, and searching it is expensive. We therefore turn our attention to the kernels of the polar forms, hoping that they will not all be trivial. We have determined the probablity that P (a i ) is non-singular in §10.7.1. Since the original presentation of the algorithm assumed q to be odd, we will stick to this choice, and then the probability that will find at least one relation without searching ker J a is exactly:

1 - λ(q, n) λ(q 2 , n/2) n ≈ 1 -e -n/q
We observe that this estimate is surprisingly accurate. All-in-all, we conclude that as long as u ≥ n/2, the expected running time of the algorithm is:

E [running time] = n 6 + e -n/q • q n-u (13.6)
Homogeneous Case. In the homogeneous, ker J a (0) = (F q ) n , and searching it is no longer an option. The only way the selective exhaustive search could perform better than an actual exhaustive search is by exploiting the kernels of the P (a i )'s. However, we have seen that with they will all be trivial with probability about e -n/q . When u = n, in which case only one relation is required, the expected complexity is therefore O n 6 + e -q/n • q n . Achievements. We report in Table 13.5 the parameter ranges that were broken in practice in [START_REF] Perret | A Fast Cryptanalysis of the Isomorphism of Polynomials with One Secret Problem[END_REF].

Because of its ability to solve instance with arbitrarily large values of n, the Jacobian algorithm is an actual milestone in QFSE solving. This is made possible by the use of different techniques, such as the Jacobian matrix, and by the idea to make S appear as the solution of a system of linear equations that must be built during the course of the algorithm. Because the algorithm is plainly exponential when u ≪ n, the Jacobian algorithm unfortunately cannot tackle the challenges.

Note that from a historical perspective, the Jacobian is the determinant of the Jacobian matrix, named after Carl Gustav Jacob Jacobi (1804-1851). It is not to be mistaken with the Jacobins, the most radical 13.5: Parameters solved in practice in [START_REF] Perret | A Fast Cryptanalysis of the Isomorphism of Polynomials with One Secret Problem[END_REF]. The instances are linear and inhomogeneous.

q n u
political fraction of the National Convention during the French Revolution. Along with their political Leader, Maximilien Robespierre, they are often associated with the Reign of Terror (September 1793-July 1794), the most "intense" and critical period of the Revolution. As for QFSE instances, they shall be terrorized some more in chapter 15.

Chapter 14

A General Method for Quadratic PLE: Matrix Pencils

In this chapter we introduce a generic method to solve some classes of polynomial equivalence problems efficiently. This general method naturally has to be specialized for each particular case.

Our method is based on pencils of matrices. The key idea is that the solutions of an instance of the polynomial equivalence problem at hand are also generally solutions of a certain matrix pencil equivalence problem. Before going into the details, let us quickly define what these objects are. Definition 14.1. An n×n matrix pencil P λ,µ over K is an n×n matrix whose coefficients are homogeneous polynomials of degree one in two variables (usually denoted by λ and µ). It can also be written P λ,µ = λ • A + µ • B where A and B are matrices over K. The dependency in the two variables is often omitted. Definition 14.2. Two matrix pencils P and Q are said to be equivalent if there exist two invertible matrices S and T such that:

T × P = Q × S, S, T ∈ GL n (K) (14.1)
This is an obvious generalization of the usual notion of matrix equivalence to matrix pencils. In addition, we remark that if

P = λ • A + µ • B and Q = λ • C + µ • D, then: T × P = Q × S ⇐⇒ T × A = C × S T × B = D × S (14.2)
Definition 14.3. A Matrix pencil P λ,µ is said to be regular if the determinant det P λ,µ , which is in fact a homogeneous bivariate polynomial in K[λ, µ], is not identically zero. A non-regular pencil is said to be singular.

The interest of making this distinction is that when dealing with regular pencils, we may without loss of generality assume that one of the two matrices is invertible. Suppose that two pencils P = λ • A + µ • B and Q = λ • C + µ • D are equivalent, and let V(P, Q) denote the set of pairs (S, T ) such that T ×P = Q×S. We introduce a "change of coordinates" in the parameters:

λ = α 1 λ + α 2 μ µ = β 1 λ + β 2 μ α 1 β 2 -α 2 β 1 = 0
And we express the two pencils using the new parameters:

P = λ (α 1 A + β 1 B) + μ (α 2 A + β 2 B) Q = λ (α 1 C + β 1 D) + μ (α 2 C + β 2 D)
Because α 1 β 2 -α 2 β 1 = 0, the change of coordinates is reversible, and (P, Q) can be obtained back from ( P, Q) after an other related change of coordinates. Under this condition, the change of coordinates preserves the equivalence, and V(P, Q) = V( P, Q). Since P is regular, there exists a pair (α 1 , β 1 ) such that det α 1 A + β 1 B = 0, and α 2 , β 2 can be chosen so that the constraint α 1 β 2 -α 2 β 1 = 0 is satisfied. However, α 1 , β 1 , α 2 and β 2 may only live in a suitable field extension of F q , and not in F q itself. This requires embedding the whole problem in a larger field, but does not modifies the set of solutions.

The Pencil Equivalence Problem. The matrix pencil equivalence problem is easy, as it essentially amounts to solve a system of 2n 2 homogeneous linear equations in 2n 2 unknowns. It has been extensively studied in the second half of the 19th century: Weierstraß established necessary and sufficient conditions for two regular pencils to be equivalent in 1867, and Kronecker extended these results to the singular case in 1890. They also demonstrated that these pencils, just like regular matrices, admit nearly unique canonical forms that can be computed in time O n 3 , over any field. The system of matrix equations on the right-hand-side of (14.2) is called a coupled generalized Sylvester equation, after James J. Sylvester (1814-1897), who incidentally also invented the term "matrix". These equations appear frequently in the resolution of generalized eigenproblems, where given A and B the point is to find vectors x such that A • x = λB • x (see [vL00] for more background).

Coming back to polynomial equivalence, our idea is that, given an instance (a, b) of a polynomial equivalence problem, it is sometimes possible to find two matrix pencils P and Q such that the solutions of the polynomial equivalence problem are also solutions of the pencil equivalence problem:

T • b = a • S =⇒ T • P = Q • S
The converse will not be true in general, because pencil equivalence is an inherently linear problem while PLE problems are non-linear. Our strategy is to compute a basis of the vector space V(P, Q) in which the solutions of the pencil equivalence problem are living. The point is that the dimension of this vector space will generally be much smaller than 2n 2 , and knowing that S and T live in V(P, Q) dramatically reduces the quantity of information that remains to be found. To see why is this useful, let us consider an instance of an (unspecified) PLE problem:

T • b = a • S
and the (unspecified) associated matrix pencil equivalence:

T × P = Q × S
We build the pencils so that solutions of the PLE problem are also solutions of the pencil equivalence problem. Let = dim V(P, Q) and S [1] , T [1] , . . . , S [ ] , T [ ] be a basis thereof. Let us also consider the polynomial ring F q [x 1 , . . . , x ]. Because all the solutions of the PLE instance belong to V(P, Q), there is a one-to-one correspondance between them and the solutions in x 1 , . . . , x of the following equation:

i=1 x i • T [i] • b = a • i=1 x i • S [i] ( )
Following the ideas of Faugère and Perret, we obtain an equivalent system S quad of quadratic equations in x 1 , . . . , x by identifying coefficient-wise both side of ( ). Compared to the "direct" method exposed exposed in §13.2, we have as many equations, but we hope to have much less variables. The implicit hope is that in most (non-completely degenerate) situations the dimension of V(P, Q)) is going to be approximately n, rather than 2n 2 . We will show in §14.3 below that this hope is quite reasonable.

If the equations composing S quad were linearly independent, then it would be plausible to determine its solutions efficiently, either by plain linearization or by a Gröbner basis computation.

The rest of this chapter is organised as follows: in §14.2 we express the dimension of V(P, Q) in terms of the invariants of the pencil, and we estimate this dimension when the pencils are random in §14.3. We then discuss how to determine a basis of the solution space in §14.4, and how to generate the quadratic equations of S quad in §14.5.

More Linear Algebra Background

A λ-matrix is a matrix whose entries are polynomials in λ. Given any rank-r (eventually rectangular) λ-matrix A(λ), we denote by D j (λ) the greatest common divisor of all the minors of order j of A(λ) (we assume it is unitary). It is (said to be) easy to see that in the series D r (λ), D r-1 (λ), . . . , D 1 (λ), D 0 (λ) := 1 each polynomial is divisible by the preceding one. The corresponding quotients will be denoted by i 1 (λ), . . . , i r (λ):

i r (λ) = D r (λ) D r-1 (λ) , . . . , i 1 (λ) = D 1 (λ) D 0 (λ) (14.3)
Definition 14.4. The polynomials i 1 (λ), . . . , i r (λ) defined by (14.3) are called the invariant polynomials of A(λ). Given a "normal" matrix M with entries in F q , the invariant polynomials of M (also called invariant factors or similarity invariants) are the n invariant polynomial of the λ-matrix Mλ • I n .

The important result is that two square matrices are similar if and only if they have the same invariant polynomials. The equivalence classes for the similarity relation are thus formed of all matrices sharing the same the invariant polynomials.

In addition, if i n (λ), . . . , i 1 (λ) are the invariant polynomial of M , then i n is the minimal polynomial of M , the product i n × • • • × i 1 is the characteristic of M , and i k divides i k+1 .

Commutativity

It is well-known that matrix multiplication is not commutative. However, it sometimes happen that A × B = B × A. For instance, all powers of A commute with A. Definition 14.5. Given an n × n matrix A, the set of all matrices B such that A × B = B × A forms a vector space called the commutant of A.

The commutant is a classical object of linear algebra, and the equation A × X = X × A has been the object of much study. For instance, when the minimal and characteristic polynomial of a matrix coincide, then all the powers of A are linearly independent, and the commutant is at least of dimension n. This fact is in fact more generally true.

Theorem 14.1. The commutant of any matrix is of dimension greater than or equal to n.

Another classical result relates the exact dimension of the commutant of a matrix A to its invariant polynomials. The following theorem in fact tells us, for instance, that in the case where the minimal and characteristic polynomial of a matrix coincide, then the commutant is of dimension exactly n (i.e., as small as it gets). where i k (λ) is the k-th invariant factor of A.

Dimension of Matrix Pencils Solution Spaces.

We now move on to discuss the dimension of V(P, Q) under the assumption that the pencils P and Q are regular. If P and Q are not equivalent, then the problem is not very interesting, and we will therefore assume that they are equivalent. The following theorem seems to be a standard result, altough it is apparently not very well-known. Theorem 14.3. Let P = λA + µB and Q = λC + µD be two n × n regular and equivalent pencils, where in addition A and C are (without loss of generality) non-singular. Let i s (λ), . . . , i 1 (λ) be the invariants polynomials of C = B × A -1 . Then we have

n ≤ dim V = dim Commutant(C) = s k=1 (2s -2k + 1) • deg i k (λ)
Proof. Exploiting the non-singularity of A and C, it is possible to express S as a function of T in a unique way:

S = C -1 • T • A
Substituting this new expression of S in T × P = Q × S yields the equivalent equation:

T × B × A -1 = D × C -1 × T (14.4)
Next, we make use of our particular solution (S 0 , T 0 ). Because T 0 is a solution of (14.4), then this very equation is equivalent to:

B × A -1 × T 0 -1 × T = T 0 -1 × T × B × A -1
From there it is easy to see that the solution space of equation (14.1) is isomorphic to the commutant of C = B × A -1 . The theorem then follows from theorems 14.1 and 14.2.

Expected Dimension of V.

As discussed above, the interest of considering a matrix pencil is to discover, without expensive computation, as "small" subspace in which the solutions of a PLE problem live. But how small does it gets on average? If we pick up a random regular pencil, then C = B × A -1 is a random matrix (we implicitly assume that A is invertible, as we may make it invertible when the pencils are regular).

As seen in §14.1, the solution space of the pencil equivalence problem is as small as possible as possible when the minimal polynomial of C is in fact also its characteristic polynomial. Definition 14.6. A matrix whose minimal and characteristic polynomials coincide is said to be a cyclic matrix.

This name comes from the observation that given a cyclic matrix A, there is a vector x such that, A i • x for i = 1, . . . , n, is a basis of (F q )

n . In fact, most matrices are cyclic.

Theorem 14.4 ([Ful01], theorem 1). Let c(n, q) be the proportion of cyclic n × n matrices. We have:

1 q 2 (q + 1) < 1 -c(n, q) < 1 (q 2 -1)(q -1)
And asymptotically, we have:

lim n→∞ c(n, q) = q 5 -1 q 2 (q -1)(q 2 -1) • ∞ i=1 1 - 1 q i
This is particularly interesting, because when C is cyclic, then theorem 14.3 tells us that the dimension of the solution space of the pencil equivalence problem reaches its smallest possible value (namely, n). Combining theorem 14.4 with equation (10.4) yields: lim n→∞ P [a random n × n matrix is cyclic] = 1 -q -3 -q -4 -2q -5 -q -6 + O q -7 (14.5)

It follows that C is cyclic with a not-at-all negligible probability of order 1 -1/q 3 . We deduce therefrom that things only need to be " random enough" for this approach to yield its full potential. As suggested by the non-asymptotic statement of the theorem, c(n, q) seems to only weakly depend on n, and quickly converges to its limit. Figure 14.1 shows that the actual probability coincides quite well with its limit. In general, if the instance of the PLE problem is randomly chosen, then dim V may be seen as a random variable, and its distribution -which is specific to the way P and Q are built-depends on the parameters of the problem. If C is random though, then as argued above dim V will often be minimal. This makes this approach quite promising.

Computational Cost of Determining V

Let M φ denote the 2n 2 × 2n 2 matrix representing the following linear operator:

φ : (F q ) 2n 2 → (F q ) 2n 2 (X, Y ) → Y × A -B × X Y × C -D × X
The Kernel of M φ is thus the vector space V(P, Q) above. Since M φ has dimensions 2n 2 × 2n 2 , then it seems that constructing it and determining its kernel should take time O n 6 . The matrix M φ is however quite sparse, and quite structured, so that there are shortcuts allowing most operations to be faster than in the generic case. The matrix in fact has a nice expression in terms of tensor products (also called Kronecker products in the context of matrices).

Lemma 14.5. M φ has the following 2 × 2 block structure:

M φ = I n ⊗ t A -B ⊗ I n I n ⊗ t C -D ⊗ I n
We omit the proof of this result, as it is both elementary and tedious. Here is an "expanded view" of what the matrix looks like:

φ(X, Y ) =           t A -B 11 • I n • • • -B 1n • I n . . . . . . . . . . . . t A -B 1n • I n • • • -B nn • I n t C -D 11 • I n • • • -D 1n • I n . . . . . . . . . . . . t C -D 1n • I n • • • -D nn • I n           •           X 1• . . . X n• Y 1• . . . Y n•          
We will not dig too deeply into the issue of computing V as fast as possible, for several reasons:

a) It is rarely the most expensive step in practice.

b) Intelligent linear algebra codes will exploit the fact that φ M has only O n 3 non-zero entries instead of O n 4 . c) One could always reduce the pencils P and Q to Kronecker Canonical Form in time O n 3 . We would then be dealing with a simplified case where A, B, C and D are (block-)diagonal, and ultra-sparse, with typically O (1) entries in each line (note that we would find conjugates of the solution, but this is not a problem).

Complexity of Generating The Resulting Polynomial Equations

We now discuss how to turn the following equation into an equivalent system S quad of quadratic equations.

i=1 x i • T [i] • b = a • i=1 x i • S [i]
We will assume that a and b are homogeneous (and in any case, the linear and constant components are much easier to deal with). We will also assume that the quadratic forms a i and b i are represented by upper-triangular matrices. Our starting point is:

i=1 x i • T [i] m • b i (y) = a m i=1 x i • S [i] • y
We will denote by A [m] (resp. B [m] ) the (upper-triangular) matrix representation of a m (resp. b m ). Expanding the definitions of a, b and the matrix-vector product with y yields:

n u=1 n v=u r=1 n i=1 T [r] mi • B [i] uv x r • y u y v = n u=1 n v=1   r=1 t=1   n i=1 n j=i A [m] ij • S [r] iu • S [t] jv   • x r x t   • y u y v
We observe that the nested structure of F q [x 1 , . . . , x ][y 1 , . . . , y n ] is clearly visible. In any case, identifying the coefficients of the y u y v monomials yields two sets of equations:

S quad = r=1 n i=1 T [r] mi • B [i] uu x r - r=1 t=1   n i=1 n j=i S [r] iu • A [m] ij • S [t] ju   • x r x t 1≤u≤n 1≤m≤n S quad = r=1 n i=1 T [r] mi • B [i] uv x r - r=1 t=1   n i=1 n j=i A [m] ij • S [r] iu • S [t] jv + S [r] iv • S [t] ju   • x r x t 1≤u<v≤n 1≤m≤n
It seems that determining S quad would take time Ω n 7 if done naively, which seems suboptimal. However, there is a lot of structure in these expressions, that begs to be exploited. We may indeed factor some computation out by observing that the innermost double-sum is in fact the expression of a given coefficient in a matrix-matrix-matrix triple product. To take advantage of this, we define

M [m,r,t] = t S [r] × A [m] × S [t] ,
and we find out:

S quad = r=1 n i=1 T [r] mi • B [i] uu x r - r=1 t=1 M [m,r,t] uu • x r x t 1≤u≤n 1≤m≤n S quad = r=1 n i=1 T [r] mi • B [i] uv x r - r=1 t=1 M [m,r,t] uv + M [m,r,t] vu • x r x t 1≤u<v≤n 1≤m≤n
At this point, the equations can just be obtained by dispatching the coefficients of the M [m,r,t] matrices. So, S quad can be computed in time O 2 • n 4 , and we really hope that this is O n 6 .

Chapter 15

Simultaneous Equivalence of Quadratic Forms

In this chapter we discuss the algorithm we have designed for the QFSE problem. The results of this chapter have been the object of an article presented at PKC'11 [START_REF] Bouillaguet | Practical cryptanalysis of the identification scheme based on the isomorphism of polynomial with one secret problem[END_REF], along with those of the next chapter.

Recall that an instance of the QFSE problem is formed by two vectors a and b of u quadratic forms over F q [x 1 , . . . , x n ], along with the promise that there exist S ∈ GL n (F q ) such that:

b = a • S, (15.1)
Solving the QFSE instance means solving the above equation in S, i.e., finding all the possible bijective changes of coordinates transforming a in b.

In this chapter, we present a pencil-based algorithm for QFSE, and we try to understand its behavior. This algorithm is deterministic and returns all the possible solutions. On the practical side, it is quite efficient, and empirically solves classes of random instance of the problem in time polynomial in n. Its most distinctive feature compared to the prior state of the art is that this polynomial behavior persists when u = 2 in some cases. For instance, we are able to solve the case q = 2, u = 2, n = 128 in about one hour. We have seen in chapter 13 that all the other algorithms have an exponential complexity in that case.

The cryptographic implication of these result is that using the QFSE-based identification scheme with random instances is no longer secure, as the secret-key would be recovered in very practical time from the public-key. Unfortunately, the hope that random instances of the problem were hard was the main motivation for suggesting to replace GI by QFSE in the identification scheme of Goldreich, Micali and Wigderson [START_REF] Goldreich | Proofs that yield nothing but their validity and a methodology of cryptographic protocol design (extended abstract)[END_REF]. However, it might remain possible to choose hard instances of the problem, while still getting an advantage over GI.

On the theoretical side, we try to justify this empirically good behavior of the algorithm. We study its complexity under the assumption that the input instance has been uniformly chosen at random amongst the set of instances that have a solution. We are aware that there must be hard instances that the algorithm is not capable of solving in polynomial time (otherwise, we would have GI ∈ P). We nevertheless indentify a (large) class of instances over which the algorithm should perform well, and then estimate the probablity that a random instance belongs to this class. In these favorable cases the problem reduces to that of solving a system of quadratic equations. This in turn appears to be surprisingly tractable for wide and interesting ranges of parameters.

Specializing the Pencil Strategy

We wish to recover the change of coordinates S between a = (a 1 , . . . , a u ) and b = (b 1 , . . . , b u ). Let A 1 , . . . , A u , B 1 , . . . , B u be matrix representations of the respective quadratic forms, and let us define

M i = B i -t S × A i × S.
Then by definition, (15.1) is equivalent to saying that M i is skew-symmetric for all 1 ≤ i ≤ u. This can be reformulated in an equivalent way in saying that for all i, M i + t M i = 0 (and in addition the diagonal coefficients must be zero). And, by our definition of the polar form, we find that (15.1) is equivalent, regardless of the characteristic of the field, to:

     P (b 1 ) = t S × P (a 1 ) × S . . . . . . . . . P (b u ) = t S × P (a u ) × S (15.2)
At this point, let us observe that if u ≥ 3, then (15.2), is easily converted (by left-multipling by t S -1 ) into a very overdetermined system of u • n 2 linear equations in the 2n 2 coefficients of S, S -1 , and these equations are extremely likely to have only one solution. Thus, roughly 15 years after its introduction, we find out with about 10 lines of elementary algebraic manipulations that QFSE with u ≥ 3 can be solved in time O n 6 .

We will therefore focus our attention on the case where u = 2, which seem to be the hardest one, and which is the most cryptographically relevant one. When u = 2, then for any value of q, equation (15.2) becomes:

P (b 1 ) = t S × P (a 1 ) × S P (b 2 ) = t S × P (a 2 ) × S
This looks very much like a pencil equivalence problem, and it can be reformulated as such:

t S -1 ×   λ • P (b 1 ) + µ • P (b 2 ) Q    =   λ • P (a 1 ) + µ • P (a 2 ) P   × S (15.
3) Theorem 14.3 tells us that if the pencils are regular, then equation (15.3) admits at least q n solutions, which makes it hopeless to try them one-by-one. We note in passing that this contradicts the idea more-or-less clearly expressed in [PGC98b, section 9]. Let us denote by V the vector space spanned by the solutions of (15.3), and let = dim V and let us consider S [1] , U [1] , . . . , S [ ] , U [ ] , a basis of V. Let us also consider the ring F q [x 1 , . . . , x ]. We set:

S = i=1 x i • S [i]
There is then a one-to-one correspondance between the solutions of (15.1) and those of:

b = a • S
This last equation is a set of equality between polynomials and following the idea of Faugère and Perret, we identify the two sides of the equation coefficient-wise, and this gives a set S quad of of n(n + 1) quadratic equations in x 1 , . . . , x . To recover all the solutions of (15.1), we find all the solutions of S quad by computing a Gröbner basis of the ideal it spans, and we determine the corresponding variety. Algorithm 15.1 shows a pseudo-code of the method we outlined. let M φ denote the 2n 2 × 2n 2 matrix representing:

φ : (F q ) 2n 2 → (F q ) 2n 2 (X, Y ) → Y × B 1 -A 1 × X Y × B 2 -A 2 × X 3: let V = ker M φ 4: let = dim V and S [i] , U [i]
1≤i≤ be a basis of V 5: return the image of V (I) by ψ :

consider the two rings R ⊥ ← F q [x 1 , . . . , x ] and R ← F q [x 1 , . . . , x ][y 1 , . . . , y n ] 6: let S = i=1 x i • S [i]
(u i ) 1≤i≤ → i=1 u i • S [i]
12: end function Sketch of a Complexity Analysis. The only step of the algorithm whose complexity is not easily predictible is the Gröbner basis computation involved in determining the solutions of S quad . An additional problem is that while there is always n(n + 1) equations in S quad , the number of variables depends on the choice of the instance.

To analyze our algorithm, we will consider dim V as a random variable, taken over the random choice of the input. We will try to obtain enough information about its distribution to argue that the Gröbner basis computation should terminate quickly with high probability. The key tool to obtain information on dim V is theorem 14.3, but it only applies if the pencils are regular. We therefore begin by investigating the probability that it is the case. However, several steps of the analysis differ according to the parities of q and n.

Complexity Analysis for Odd q

De la musique avant toute chose, Et pour cela préfère l'Impair Plus vague et plus soluble dans l'air, Sans rien en lui qui pèse ou qui pose.

Art Poétique, Paul Verlaine

It now remains to estimate the complexity of the Gröbner basis computation. For this purpose, we need to investigate the distribution of dim V for our special case.

Regularity of the Pencils. We note that as soon as one of the polar form has full rank, then the pencil is regular. As seen is section 10.7.1, a (random) polar form is non-singular with probability λ(q, n)/λ(q 2 , n/2). We conclude that the probability that at least one of the polar form is non-singular is:

P [P is regular] ≥ 1 -1 - λ(q, n) λ(q 2 , n/2) 2
And asymptotically (using equation (10.4)) we find:

lim n→∞ P [P is regular] ≥ 1 -q -2 -2q -4 + 2q -5 + O q -6 (15.4)
Distribution of dim V. Under the assumption that the pencil is regular, we may make use of theorem 14.3. This will boil down to analyzing the matrix C occuring in the statement of the theorem. We will assume w.l.o.g. that P (a 1 ) is invertible, so that C = P (a 2 ) × P (a 1 ) -1 . Since the inverse of a symmetric matrix is also a symmetric matrice, then C is the product of two random symmetric matrices (one of them being invertible). Unfortunately, C is provably not a uniformly distributed matrix: it has the rank distribution of symmetric matrices (given by theorem 10.28), while if it were random it would have the "normal" rank distribution (given by equation (10.5)). So, unfortunately, the nice results regarding the invariant factors of random matrices cannot be used.

One could hope that the distribution of dim V we obtain is close to what it is when C is uniformly chosen at random. We compared the two distributions experimentally, and Figure 15.1 shows the outcome of our little experience. While the probability that dim V = n seems close in the two cases, things are visibly not as nice for the other values of dim V. We will therefore focus our attention where we might expect a nice behavior, and we consider the two sequences: u q = P dim V = n P from algorithm (15.2), and regular v q = P dim V = n P chosen at random over F q (amongst regular pencils) Fig 15.2a and 15.2b show that u q and v q are quite close. What is more surprising is the great precision with which we could verify that:

v q -u q ≈ 1 q 2 - 1 q 3 - 1 q 4 + 1 q 5
This, in conjunction with lemma 14.4 (giving the expression of v q ) lead us to conjecture an expression for the probability of dim V = n in the algorithm.

Conjecture 15.1. In algorithm 15.1, when the pencils are regular, then the probability that C is cyclic (which is also the probability that dim V = n) is:

P dim V = n P is regular = 1 - 1 q 2 - 3 q 5 + O q -6
We checked that this conjecture holds for q ≥ 3 (q odd) up to a precision of about 10 -4 (which is in fact smaller than 3 -6 ).

Putting Things Together. So, we may now estimate the probability that dim V = n over the random choice of the instance. we find:

P [dim V = n] = P dim V = n P is regular • P [P is regular] ≥ 1 - 2 q 2 - 1 q 4 - 1 q 5 + O 1 q 6 221 15
.1: Distribution of dim V when C is generated at random vs. when C is the product of a nonsingular random symmetric matrix and a random symmetric matrix. The parameters were n = 13 and q = 3. A discrepancy is visible, but the log-scale may make it look worse than it really is. q v q -u q q -2 -q -3 -q -4 + q -5 (b) Log scale Figure 15.2: Comparison between the probability of C being cyclic in algorithm 15.1 (u q ) and the probability that a random matrix is cyclic (v q ). All the values of 2 ≤ n ≤ 32 have been considered; the graphs shows the minimum, the average, and the maximum over the range of n.

v q -u q q -2 -q -3 -q -4 + q -5 (

Analysis for even q

When q is even, the situation is quite different, and overally more complicated. Things start to go bad when n is odd. In that case, the prencil is singular, since P λ,µ is a skew-symmetric matrix (and thus cannot have rank n, when n is odd, in virtue of lemma 10.1).

We will therefore focus on the nicer case where n is even, and try to replay the analysis of the previous section. We have seen in §10.7.1 that the probability that a random polar form is invertible is the same as when q is odd. Therefore, the result of equation (15.4) still holds when n and q are even.

The next problem we have to deal with is the distribution of dim V. Earlier we empirically studied the probability that C is cyclic to obtain an interesting result. This time, when q is even, C is the product of two skew-symmetric matrices. Things get from bad to worse, because the product of two skew-symmetric matrices is very far from being random, and C is in fact cyclic with probability zero. We also observed that dim V was always greater than 2n (and that this also was the most frequent value). This phenomenon puzzled us quite a bit, but it turns out to be a consequence of a property of the product of skew-symmetric matrices. The following theorem was stated (in a particular case) in 1919 by Bennet [START_REF] Bennett | Products of skew-symmetric matrices[END_REF], and then in a more general setting by Stenzen in 1922 [START_REF] Stenzen | Über die darstellbarkeit einer matrix als produkt von zwei symmetrischer matrizen, als produkt von zwei alternierenden matrizen und als produkt von einer symmetrischen und einer alternierenden matrix[END_REF]. According to [START_REF] Kh | On the product of two skew-hamiltonian or two skewsymmetric matrices[END_REF], from where we quote it, it has been rediscovered in 1952, in 1974, in 1984, in 1991 and in 1997. b) Let λ m1 , λ m2 , . . . , λ ms be the elementary divisors of M corresponding to its zero eigenvalue and let:

m 1 ≥ m 2 ≥ • • • ≥ m s Then: m 2i-1 -m 2i ≤ 1, i = 1, 2, . . . (if s is odd, we set m s+1 = 0).
While it is not completely obvious, this theorem implies that the minimal polynomial of the product of two skew-symmetric matrices has degree at most n/2, and that the characteristic polynomial is a square. Here is the relevant consequence in our setting.

Corollary 15.2. If q and n are even, then dim V ≥ 2n.

Proof. Since C is the product of two skew-symmetric matrices, we know that C meets the condition of theorem 15.1. We now argue that C has at least two invariant factors. If the minimal polynomial of C is not x k for some k, then by condition a), it occurs at least twice. If the minimal polynomial is x k , then it cannot be the only invariant factor, because of condition b).

So, the minimal polynomial appears twice in the invariant factors of C. If there are no other invariant factors, then it is of degree n/2, and theorem 14.3 tells us that dim V = 2n. If C has more invariants, dim V can only get higher.

What we would in fact need to know is the probability that V is exactly of dimension 2n. According to the proof of corollary 15.2, this would mean that C has only two similarity invariants, which implies that it has a minimal polynomial of maximal degree (a property reminiscent of cyclic matrices). It seems plausible that C is unlikely to have a very high number of similarity invariants. We could not compute explicitly this probability that dim V = 2n.

We measured it experimentally, under the assumption that the pencils are regular. For q = 256 and n = 12, 16, computing the Gröbner basis is feasible, but converting it to a suitable monomial order is much longer. We therefore decided to resort to hybrid solving, by enumerating all the values of a given variable and computing q Gröbner bases. This turn out to be much faster. In table 15.3, we marked with a star ( ) the lines where we used this technique. The table shows that for n = 12, q = 256 this yields an important speedup.

To conclude, the case where q = 2, 3 seems practical for any (reasonable) value of n. The cases where n ≤ 20 also seems tractable, but in some cases the complexity of the whole process will be proportional to q.

Implementation and Practical Results

We implemented the algorithm described in this chapter using the computer algebra system MAGMA [START_REF] Bosma | The Magma Algebra System I: The User Language[END_REF]. The code (which is in the public domain) is available at: http://www.di.ens.fr/~bouillaguet/implem/qfse.magma This implementation is only 50 lines long. It breaks random instances of QFSE in very practical time when q or n are "small". For instance, all the challenges presented in §12.3 are solved in a few seconds. The (legacy) challenge A 1 , in particular, is broken in 1.1s on a laptop. If we double n ("safer challenge" A 3 ), the running time of the algorithm goes up to 20s. MAGMA is apparently not particularly good at manipulating lowdegree dense multivariate polynomials. When q = 2 and n is large, the running time of the implementation is dominated by the formation of S quad . Actually solving the resulting quadratic equations turns out to be easier than generating them.

In our implementation, the Gröbner basis is computed using the off-the-shelf implementation F 4 [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases (F4)[END_REF] algorithm present in MAGMA. Converting the Gröbner-basis to the lexicographic order is done using either the FGLM algorithm [START_REF] Faugère | Efficient Computation of Zero-Dimensional Gröbner Bases by Change of Ordering[END_REF] or using the Gröbner Walk [START_REF] Collart | Converting bases with the gröbner walk[END_REF], at MAGMA's own discretion. It turns out that if a little bit of information about the final solution is available, then computing a Gröbner basis of I a,b becomes much easier. Let the n × n matrix S = ( s ij ) over F q be a particular solution of (16.1), and let J denote the following ideal:

J s 1j -s 1j | j = 1, . . . , n .
If the first row of the particular solution S is known, then the ideal J is known, and we may try to compute a Gröbner basis of I a,b + J . In fact, this Gröbner basis computation is extremely efficient.

Theorem 16.1. The degree of regularity of I a,b + J is 2. Therefore, computing a Gröbner basis of this ideal takes time O n 6 .

Before giving the proof of this theorem, we discuss its implications. We could enumerate all the possible first rows of S, and then for each of them compute a Gröbner basis of I a,b . If the resulting ideal is non-empty, then we have found an actual solution of the problem. This requires O q n • n 6 field operations to solve the whole instance. For small values of q, this may be asymptotially faster than computing a Gröbner basis of I a,b , as Figure 16.1 suggests. Moreover, it is easily parallelizable, and requires only a modest amount of memory, which makes it more practical.

The biggest proposed cubic CFE challenge (Challenge C in Table 12.2) has u = 1, n = 16 and q = 2. Given that J is known, the computation of a Gröbner basis of I a,b + J takes 90 seconds on a 2.8Ghz Xeon CPU using the publicly available implementation of F 4 in MAGMA. Since this has to be repeated 2 15 times, we conclude that the whole process should take about one CPU-month, so that it can be carried out in practice.

Proof of the Theorem

We use the fact, established by Lazard in 1983 [START_REF] Lazard | Gröbner-bases, gaussian elimination and resolution of systems of algebraic equations[END_REF], that the degree of regularity of an ideal is generically left invariant by any linear change of the variables or generators. In particular, we consider the ideal I a,b generated by all the coefficients in K[x 1 , . . . , x n , y 1 , . . . , y n ] of the equations:

Da(S 0 (S + I n )x, y) -Db(x, (U + I n )S -1 0 y) = 0, U • S = 0 n , S • U = 0 n .
It is clear that I a,b is obtained from I a,b by replacing S (resp. U ) by S 0 (I n + S) (resp. (U + I n )S -1 0 ). Thus, the degree of regularity of I a,b and I a,b are equal. Using the same transformation, the ideal J becomes J = s 1,j | j = 1, . . . , n .

We now estimate the degree of regularity of the ideal I a,b + J . For a reason which will become clear in the sequel, it is more convenient to work with I a,b + J . In what follows, F will denote the set of the generators of I a,b + J . We will show that many new linear equations appear when considering equations of degree 2. To formalize this, we introduce some definitions related to the F 4 algorithm [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases (F4)[END_REF]. In particular, we will denote by I d,k the linear space generated during the k-th step of F 4 when considering polynomials of degree d.

Definition 16.1. We have the following recursive definition of I d,k :

I d,0 (F ) = F I d,1 (F ) = s i,j • f | 1 i, j n and f ∈ I d,0 (F ) + u i,j • f | 1 i, j n and f ∈ I d,0 (F ) I d,k (F ) = s i,j • f, u i,j • f | 1 i, j n and f ∈ I d,k-1 (F ) and deg(f ) ≤ d -1
Roughly speaking, the index k is the number of steps in the F 4 / Ffive algorithm to compute an element f ∈ I d,k (F ). We show that I 2,1 (F ) contains exactly n 2 + 2n linear equations. This means that we have already many linear equations generated during the first step of a Gröbner basis computation of F . Lemma 16.2. I 2,1 (F ) contains the following linear equations:

{u 1,j | j = 1, . . . , n}. (16.3)
Proof. From the first row of the following zero matrix S • U we obtain the following equations:

               s 1,1 u 1,1 + s 1,2 u 2,1 + s 1,3 u 3,1 + • • • + s 1,n u n,1 = 0, s 1,1 u 1,2 + s 1,2 u 2,2 + s 1,3 u 3,2 + • • • + s 1,n u n,2 = 0, s 1,1 u 1,3 + s 1,2 u 2,3 + s 1,3 u 3,3 + • • • + s 1,n u n,3 = 0, • • • s 1,1 u 1,n + s 1,2 u 2,n + s 1,3 u 3,n + • • • + s 1,n u n,n = 0
Using the equations s 1,j = 0 from the ideal J , we obtain u 1,1 = 0, u 1,2 = 0, . . . , u 1,n = 0.

We can also predict the existence of other linear equations in I 2,1 (F ).

Lemma 16.3. For all (i, j) ∈ {1, . . . , n} 2 the coefficient of y 1 y i x j in Da(S 0 (S + I n )x, y) -Db(x, (U + I n )S -1 0 y) is a non zero 1 linear equation modulo the equations of the ideal J and modulo equation (16.3). Among these equations, there are n which depend only of the variables {s k, | 1 ≤ k, ≤ n}.

Proof. We consider the coefficient of the monomial m = y 1 y i x j in the expression

∆ = Da(S 0 (S + I n )x, y) ∆a -Db(x, (U + I n )S -1 0 y) ∆ b .
Since the monomial m is linear in x j it is clear that the corresponding coefficient in ∆ a is also linear in the variables s i,j ; moreover this coefficient is non zero. We have now to consider the coefficient of m in ∆ b . Since Db(x, y) is the differential of an homogeneous polynomial of degree 3 we can always write:

Db(x, y) = n i=1 n j=i i,j (y 1 , . . . , y n ) x i x j + n i=1 q i (y 1 , . . . , y n )x i (16.4)
where i,j (resp. q i ) is a polynomial of degree 1 (resp. 2). Consequently, the coefficient of m in Db is also the coefficient of y 1 y i in q j ((U + I n )S -1 0 y). That is to say, in q j (y) we now have to replace y = (y 1 , . . . , y n ) by ((U + I n )S -1 0 y). Thus, modulo the equations of the ideal J and modulo equation ( 16.3), we can write the product ((U + I n )S -1 0 y) as:

=       y 1 . . . . . . y n       ×      1 0 0 0 u 2,1 • • • • • • u 2,n . . . • • • • • • . . . u n,1 • • • • • • u n,n      ×     * * * * * * * * * * * * * * * *     =       y 1 . . . . . . y n       ×      * * * * ( * u 2,1 + • • • + * u 2,n ) • • • • • • ( * u 2,1 + • • • + * u 2,n ) . . . • • • • • • . . . ( * u n,1 + • • • + * u n,n ) • • • • • • ( * u 2,1 + • • • + * u n,n )      =      * y 1 + ( * u 2,1 + • • • + * u 2,n )y 2 + • • • + ( * u n,1 + • • • + * u n,n )y n * y 1 + ( * u 2,1 + • • • + * u 2,n )y 2 + • • • + ( * u n,1 + • • • + * u n,n )y n . . . * y 1 + ( * u 2,1 + • • • + * u 2,n )y 2 + • • • + ( * u n,1 + • • • + * u n,n )y n     
Hence the coefficient of y 1 y i in q j ((U + I n )S -1 0 y) is linear in the variables u k,l when i = 1 and the coefficient of y 2 1 is a constant.

To summarize:

Lemma 16.4. I 2,1 (F ) contains exactly n 2 + 2n linear equations.

Proof. In I 2,1 (F ), we have n linear equations from lemma 16.3, n linear equations from the very definition of J , and n 2 linear equations from lemma 16.3.

As explained before, we obtain n 2 + 2n linear equations for I 2,1 (F ). However, we have 2n 2 variables. So, we have to consider I 2,2 (F ), i.e., the equations generated at degree 2 during the second step. Thanks to lemma 16.4, we can reduce the original system to a quadratic system in 2n 2 -(2n + n 2 ) = (n -1) 2 . variables. Without loss of generality we can assume that we keep only the variable u i,j where 2 ≤ i, j ≤ n. Let F be the system obtained from F after substituting the 2n + n 2 linear equations of lemma 16.4. All the monomials in K[x 1 , . . . , x n , y 1 , . . . , y n ] of Da(S 0 (S + I n )x, y) -Db(x, (U + I n )S -1 0 y) have the following shape:

x i y j y k or y i x j x k with 1 ≤ i, j, k ≤ n.

Hence the number of such monomials is 2n n(n+1)

2

= n 2 (n + 1) ≈ n 3 , which implies that the number of equations in F is also n 3 .

Thanks to this remark, we will now prove that we can linearize F . Let T (F ) be the set of all monomials occurring in F . We can assume that T

(G ) = [t 1 < t 2 < • • • < t N ]. It is important to remark that t 1 = u 2,2
up to t (n-1) 2 = u n,n are in fact variables. Now, let M be the matrix representation of G w.r.t. T (G ). Since we know precisely the shape of the equations from the proof of lemma 16.3, it is possible to establish that:

1. most of the equations are very sparse, namely each equation contains about n 2 non-zero terms.

2. all the variables t 1 , . . . , t (n-1) 2 occur in all the equations After a Gaussian elimination of the matrix M , we obtain the following shape:

M =       1 (n-1) 2 0 0 0 0 × • • • • • • 0 × . . . . . . 0 × • • • . . .      
Hence, we obtain after a second step of computation in degree 2 the equations:

u 2,2 = • • • = u n,n = 0.
This means that after 2 steps of computation at degree 2, we obtain (n -1) 2 + 2n + n 2 = 2n 2 linear equations in 2n 2 unknowns. This explains why the maximum degree reached during the Gröbner basis computation of I a,b + J is bounded by 2, and concludes the proof of theorem 16.1.

An Interesting Failure

We conclude this section with a simple idea that could have lead to an improvement, by efficiently giving the image of S on one point, but which fails in an interesting manner. Let us denote by Z a (resp. Z b ) the set of zeroes of a (resp. b). We have:

S x∈Za x = y∈Z b y
This yields a relation on S, which is enough to use theorem 16.1. a and b may be assumed to have about q n-1 zeroes. Finding them requires time O (q n ). The complexity of the attack could thus be improved to O n 6 + q n . Surprisingly, this trick fails systematically, and this happen to be consequence of the Chevalley-Warning theorem .

Theorem 16.5 (Chevalley-Warning [START_REF] Chevalley | Démonstration d'une hypothèse de M. Artin[END_REF][START_REF] Warning | Bemerkung zur vorstehenden Arbeit von Herrn Chevalley[END_REF]). Consider a system of polynomial equations P j (x 1 , . . . , x n ) = 0, j = 1, . . . , r, where the P j are polynomials with coefficients in a finite field K and such that the number of variables satisfies n > d 1 + • • • + d r , where d j is the total degree of P j .

The characteristic of K divides the number of solutions in K of the polynomial system (which is always finite because K is finite).

Corollary 16.6. The sum of the zeroes of a cubic form on 5 variables or more over F q is always zero.

Proof (found by Mehdi Tibouchi). Let us consider the elements of Z a having α as their first coordinate, and let us denote by n α their number. These are in fact the common zeroes of (a, x 1 -α). By the Chevalley-Warning theorem, if a has at least 5 variables, then the characteristic of the field divides n α . Therefore, their sum has zero on the first coordinate. Applying this result for all values of α shows that the sum of zeroes of a has a null first coordinate. We then just consider all coordinates successively.

Chapter 17 Linear Equivalence of Inhomogeneous Quadratic Maps

In this chapter we present two algorithms for the IQMLE. This problem was empirically known to be solvable in polynomial time, however these new algorithms are much faster than their predecessors. We give strong arguments to justify that they terminate in polynomial time with high probability.

In this chapter we study the IQMLE problem (equivalence of inhomogeneous quadratic maps). Given two inhomogeneous quadratic maps a and b, along with the promise that there exist two matrices S, T ∈ GL n (F q ) such that:

T • b = a • S, (17.1)
the problem is to find S and T (given just a and b). The maps a and b are inhomogeneous if they contain linear and constant terms. As we discussed in §13.2, random instances of this problem were empirically found to be solvable in polynomial time by the Gröbner-based technique of Faugère and Perret. After running series of experiments, they conjectured that the running time of their algorithm was at most O n 9 .

We present two improved algorithms. The first one is in fact a variation of the "to-n-fro" algorithm, that uses the presence of a linear component to circumvent the need to invert the quadratic maps. It provably runs in time O n 3 and heuristically succeed with high probability probability as soon as the homogeneous components of degree one of a and b are invertible.

The second algorithm we present is an instanciation of the matrix-pencil strategy outlined in chapter 14. It is more robust than our first algorithm, as it may succeed on classes of instances where the other one would fail deterministically. We show that it runs in time O n 6 on a constant fraction of the instances, and that it succeeds on another constant fraction 1 -1/q of the instances.

Both algorithm have been implemented, and we report on their practicality at the end of the chapter.

To-and-Fro Without Exponentially-Expensive Inversions

There are two sources of exponentially high costs in the to-n-fro algorithm of Courtois, Goubin and Patarin, that we presented in §13.1. On one hand, we need to know the image of S on one (and sometimes two) points, and it was originally suggested to exhaustively try all the possibilities (cost: q n or q 2n ). On the other hand, the quadratic maps have to be inverted at least n times, and each inversion has an exponential cost, be it done by exhaustive search or through a Gröbner basis computation.

It turns out that in the inhomogeneous case both problems can be circumvented. Ironically, the solution was almost entirely contained in some remarks of Faugère and Perret [START_REF] Faugère | Polynomial Equivalence Problems: Algorithmic and Theoretical Aspects[END_REF], the authors of the only other algorithm for QMLE prior to this work. Indeed, the observation at the heart of the new technique is lemma 12.1, which is directly taken from [START_REF] Faugère | Polynomial Equivalence Problems: Algorithmic and Theoretical Aspects[END_REF]. This lemma yields in particular:

T × b (1) = a (1) × S (17.2) T × b (0) = a (0) (17.3)
It follows immediately that in the linear inhomogeneous case we have a priori knowledge1 on T , because of equation (17.3). In some cases this knowledge can be "transferred" to S without inverting b, but instead using equation (17.2): assume that b(0) = b (1) • x and a(0) = a (1) • y, it follows that y = S • x. This removes the need to know time image of S on one point prior to running the algorithm. If a (1) and b (1) are invertible and if a(0) = 0, then this much less expensive knowledge transfer always succeeds. It can even be used in all the subsequent iterations of the to-n-fro algorithm, thus removing the need for exponentially costly inversions of the quadratic maps. The complete pseudo-code is shown in Algorithm 17.1.

Complexity. The complexity of this procedure is O n 3 : inverting both a (1) and b (1) can be done once for all. The matrix-vector products take O n 2 and there are n of them. Lastly, reconstructing S and T takes only O n 3 , because in the basis (x i ) i≤n , S is made of the y i 's. Changing the basis amounts to performing one matrix inversion and two matrix-matrix products. For all realistic ranges of parameters, the algorithm either fails or terminates in less than a second, even for parameters that were taking several minutes to the Gröbner-based algorithm. if a (1) is non-invertible or a (0) = 0 then abort 3:

x 1 ← a(0)

4:

y 1 ← b(0) 5:
for i = 1 to n do At this point one has y i = T • x i 6:

y i ← a (1) -1 • x i 7:
x i ← b (1) -1 • y i And we obtain

y i = S • x i 8: if x i ∈ x 1 , . . . , x i-1 then abort 9: y i+1 ← b (x i ) 10:
x i+1 ← a (y i )

11:

end for

12:

Reconstruct S from the pairs (x i , y i ) and T from the pairs (x i , y i ).

13:

return (S, T ) 14: end function Success Probability. It is easy to evaluate the probability that the algorithm fails because its prerequisite are not met on line 2. We have seen in §10.7 that a random n×n matrix is invertible with probability greater than λ(n). This tells us that for a random inhomogeneous instance, the probability that a (1) is invertible is about 0.288 when q = 2 (this quickly grows to one for higher values of q) and the probability that a(0) = 0 is 1 -1/q n . Again, q = 2 looks like a worst case.

Deterministic Failure in Degenerate Cases. To highlight the danger of relying on heuristic assumptions and unfinished analysis, we point out that it is quite easy to cook up a class of instances satisfying the two prerequisites but on which the algorithms fails deterministically, since these conditions are necessary but not sufficient. In particular, it may fail unexpectedly if a and b are not "random" enough. Indeed, the non-linearity of a and b plays a crucial role in making each new relation on S and T linearly independent from the previous ones, as is it required for the algorithm to work.

For example, this algorithm cannot be used to determine the automorphism group of a quadratic map a, namely the set of pairs (S, T ) such that T • a = a • S. In this special case, the initial "bootstraping" relation T • a(0) = a(0) describes a fixpoint of T , and we have x 1 = y 1 . It is not difficult to check that we will always have x i = y i and x i = y i . The algorithm in fact only discovers the images of S and T over their respective invariant subspaces. Thus, it cannot fully discover S and T , unless both were... the identity matrix! This particular class of instances is not a contrived example. We will see in chapter 19 that problems of this kind arise naturally when studying a variant of HFE.

A Pencil-Based Approach

We now present an instanciation of the general matrix pencil strategy outlined in chapter 14 in the case of IQMLE. The problem is to find a matrix pencil equivalence problem that is satisfied by the solutions of the IQMLE equation (17.1).

Obtaining a Related Pencil Equivalence Problem

Equation (17.2) already gives us a matrix equation, between S and T , but we would need another one to have a full pencil equivalence problem. It is possible to obtain this second matrix equation by differentiating both sides of (17.1). However, in order to carry out this operation, the image of S must be known on one point. We have seen in the previous section that with some luck, this much knowledge about S can in fact be deduced from equations (17.2) and (17.3): if there exist y be such that a (0) = a (1) • y, then there also exist x such that b (0) = b (1) • x and we find that y = S • x.

The two vectors x and y can only be identified uniquely if a (1) (and therefore b (1) ) is invertible. Otherwise, if dim ker a (1) = r > 1, a possible solution is to choose arbitrarily a particular solution for x, and then try the q r possible values of y until a match is found -the possible x and y can be computed by straightforward linear algebra.

Given a "right pair" y = S • x, we obtain as announced above a new matrix equation by differentiating equation (17.1). It follows from the definition of the differential that if y = S • x:

T × D x b = D y a × S.
Putting things together, we have found that S and T are the solutions of a matrix pencil equivalence problem: let x be particular solution of b (1) • x = b (0) . If no solution exist then abort.

T •   λ • b (1) + µ • D x b P   =   λ • a (1) + µ • D y a Q    • S ( 17

3:

let y 0 be a particular solution of a (1) • y = a (0)

4:

let Sols = ∅

5:

for all y ∈ y 0 + ker a (1) do 6:

let M φ denote the 2n 2 × 2n 2 matrix representing:

φ : M n (F q ) × M n (F q ) → M n (F q ) × M n (F q ) (X, Y ) → Y × b (1) -a (1) × X Y × Dxb -D y a × X 7: let V = ker M φ 8:
let = dim V and S [1] , T [1] , . . . , S [ ] , T [ ] be a basis of V 9:

if ≥ n then 10:

consider the two rings R ⊥ ← F q [x 1 , . . . , x ] and R ← F q [x 1 , . . . , x ][y 1 , . . . , y n ] 11: let S = i=1 x i • S [i] and T = i=1 x i • T [i]
12:

let y = (y 1 , . . . , y n ) compute U = V (I) ∩ (F q ) by first computing a Gröbner basis of I. 17:

Sols ← Sols ∪ i=1 u i • S [i] , i=1 u i • T [i] (u 1 , . . . , u ) ∈ U 18: end if 19:
end for 20:

return Sols 21: end function Unfolding the general pencil technique outlined in chapter 14 and adapting the details yields Algorithm 17.2. We will say that an instance of the problem over which the algorithm does not fail on line 2 is nice. On a nice instance, then in at least one iteration of the loop we will actually have y = S • x, and thus the matrix pencil equivalence problem will actually have solutions that include the actual solutions of the IQMLE problem. In this case, these solutions will be found and the algorithm will eventually return them. Note that in this iteration, the dimension of V is necessarily greater than or equal to n (as per theorem 14.3). This allows the "if" on line 9 to discard bad choices of y very efficiently. It remains to compute the fraction of nice instances, the expected number of iterations of the loop, the expected dimension of V, and the expected running time of the Gröbner basis computation. Failure Probability. If an instance is random, then b (1) is a random linear map, while b (0) is a random vector. The probability that the latter is non-zero is simply 1-q -n . The probability that a specified non-zero vector belongs to the image of a random linear map can be derived from equation (10.6), and is shown in Table 17.1. The probability that a random instance is nice is essentially P nice = 1 -1/q + 1/q 3 + O 1/q 6 . When q = 2, where this probability is minimal, the algorithm is capable to deal with only 61% of all the instances.

Expected Number of Iterations of the Loop. The number of iterations of the loop is the expected cardinality of ker b (1) , which is a uniformly random matrix. Therefore, lemma 10.20 tells us that this expectation is 2 + O (1/q n ). In addition, we can easily obtain an interesting deviation bound using lemma 10.19 and equation (10.4), by observing that the probability that there will be at most q iterations is:

p = D(n, 0, 0) + D(n, 1, 0) q n 2 ≤ λ(n) • 1 + q (q -1) 2 = 1 - 1 q 4 + O 1 q 5
As soon as we try to figure out anything about dim V, the usual complications pop up.

Analysis In Odd Characteristic

Regularity of the Pencil. Exactly as in chapter 15, we observe that the pencil is regular as soon as one of the two matrices it is made from is invertible. The linear component b (1) are easy to deal with: since it is uniformly random, it is invertible with probability λ(n). The other matrix, D x b is a priori a bit tougher to handle, since we do not know what it looks like. Fortunately, it is in fact plainly random, as the next lemma shows.

Lemma 17.1. Let F q be a field of odd characteristic. Given a matrix M ∈ M n (F q ) and a non-zero vector y ∈ (F q )

n , then the number of quadratic maps f such that D y f = M is independent from L and y. Therefore, the differential of a random quadratic map at a given point is a random matrix.

Proof. We first note that D y f depends only on y and on the quadratic homogeneous component of f . The linear and constant terms of f play no role here, thus we will assume f to be homogeneous. Let us therefore represent f as:

f = n i=1 n j=i f ij • x i x j , f ij ∈ (F q ) n .
Let us also be given a matrix M represented as:

M • x = n i=1 M •i • x i
We want to find all the possible assignments of f ij such that M = D y f . It follows from the bilinearity of the differential that this is equivalent to:

n i=1 M •i • x i = n i=1   i-1 j=1 f ji • y j + 2f ii • y i + n j=i+1 f ij • y j   • x i
Since this equation holds for all values of x, we deduce that:

M •i = i-1 j=1 f ji • y j + 2f ii • y i + n j=i+1 f ij • y j , i = 1, . . . , n
This can be represented as a nice "generalized" linear system, where the matrix of the "polar form" of f appears:

     M •1 M •2 . . . M •n      =      2f 11 f 12 • • • f 1n f 12 2f 22 • • • f 2n . . . . . . . . . . . . f 1n f 2n • • • 2f nn      •      y 1 y 2 . . . y n     
Anyway, since y = 0, we can assume w.l.o.g. (up to renumbering) that y n = 0. We then find two necessary and sufficient conditions for D y f = M :

f in = 1 y n   M •i - i-1 j=1 f ji • y j -2f ii • y i - n-1 j=i+1 f ij • y j   , 1 ≤ i < n f nn = 1 2y n   M •n - n-1 j=1 f jn • y j   ,
To summarize, the f ij can be chosen arbitrarily for j < n, and these choices determine the the f in in a unique way. This shows that the number of possible quadratic maps f is always the same. In turn, this ensures that D y f is uniformly distributed as long as f itself is uniformly distributed. So, coming back to the regularity of the pencils, lemma 17.1 tells us that D x b is in fact a random matrix. It must be noted that this matrix is statistically independent from b (1) (because it depends only on the quadratic terms of b). The pencil is therefore regular with probability:

P [P is regular] ≥ 1 -(1 -λ(n)) 2 = 1 - 1 q 2 - 2 q 3 + O 1 q 4
Distribution of dim V. Since we argued that the pencil is uniformly random, we will be able to directly make use of the results presented in chapter 14, notably of lemma 14.4, under the assumption that the pencil is regular. This yields:

P [dim V = n] ≥ P [a random n × n matrix over F q is cyclic] • P [P is regular]
Thus when n goes to +∞, we find:

P [dim V = n] ≥ 1 - 1 q 2 - 3 q 3 - 2 q 4 - 1 q 5 + O 1 q 6

Analysis in Characteristic Two

Regularity of the Pencil. The situation is a bit different in characteristic two, since D x b always vanishes on x (it is then not uniformly random). The pencil is always regular if b (1) , which is still uniformly distributed, is non-singular:

P [P is regular] ≥ λ ∞ (q) = 1 - 1 q + O 1 q 2
This lower-bound is looser than the one we obtained using similar a similar reasoning in the odd case. To improve on this result, we must also take the matrix D x b into account. For this purpose, we first need an analogous of lemma 17.1 in the even case.

Lemma 17.2 ([Dub07], theorem 2). Let F q be a field of characteristic two. Given a matrix M ∈ M n (F q ) and a vector y such that M • x = 0, then the number of quadratic maps f , such that D y f = M is independent from M and y. Therefore, the differential of a random quadratic map on a given point is a random matrix vanishing at that point.

Proof. The proof is quite similar to that of lemma 17.1 (in fact, the proof of lemma 17.1 is heavily inspired by this one, which was originally given by Dubois). The reasoning is essentially the same, except that the "diagonal" terms are gone:

M •i = i-1 j=1 f ji • y j + n j=i+1 f ij • y j , i = 1, . . . , n (17.5)
And again, as a "generalized" linear system:

     M •1 M •2 . . . M •n      =      0 f 12 • • • f 1n f 12 0 • • • f 2n . . . . . . . . . . . . f 1n f 2n • • • 0      •      y 1 y 2 . . . y n     
Lemma 14.4 tells us that the probability that the minimal polynomial of U has degree n-1, and therefore that the the degree of MinPoly(C) is at least n -1, is c(n, q). Assuming that deg MinPoly(C) ≥ n -1, there are two possible cases. Either C is cyclic, and it has one similarity invariant, MinPoly(C), which is of degree n. In this case, dim ker S = n. Or C has two similarity invariants: X, and MinPoly(C), which is of degree n -1, and dim ker S = n + 2.

Assembling all the pieces, we find:

P [dim V ≤ n + 2] ≥ P [a random (n -1) × (n -1) matrix over F q is cyclic] • P [P is regular]
Thus when n goes to +∞, we find:

P [dim V ≤ n + 2] ≥ 1 - 2 q 3 - 4 q 4 - 5 q 5 + O 1 q 6
17.2.4.1 Summary

We have seen that regardless of the parity of q, the dimension of V is of order n (resp. n + 2) with a probability of order 1 -1/q 2 . The set of equations S quad is therefore made of O n 3 equations in O (n) variables with high probability, a situation where we expect to be able to solve the equations in polynomial time by linearization if they are linearly independent. The pathetic failure of this hypothesis in chapter 15 has made us cautious. This time the problem is less structured, and we do not expect to observe the same funny behavior. Experiments confirm this intuition, and we have observed that we are always able to solve S quad by linearization in time O n 6 .

The main obstacle in a possible extension of the analysis is that it is difficult to control the dimension of V without assuming that the linear part of the instance is invertible. However, one may expect that if it is of rank, say, n -1, then the situation is not very different in practice.

An IQMLE Library in MAGMA

We have implemented the two algorithms described in this chapter using the MAGMA computer algebra system, as well as the Gröbner-basis algorithm of Faugère and Perret (described in §13.2). Given an instance of the problem, the most natural strategy seems to first try the fastest algorithm (the inversion-free to-n-fro), and in case of failure to fall back on the second fastest algorithm (the pencil-based strategy). In case of a second failure, we would then use the Gröbner-basis algorithm, that never fails. We again rely on MAGMA's efficient implementation of Gröbner basis algorithms. Our implementation is in the public-domain, and is available at: http://www.di.ens.fr/~bouillaguet/implem/iqmle.magma Chapter 18

Linear Equivalence of Homogeneous Quadratic Maps

In this chapter we present several new algorithms for the (homogeneous) QMLE problem. All known techniques are exponential in this case. Our algorithms rely on the birthday paradox to improve on naive exhaustive search. When possible, we establish a rigorous upper-bound on the time complexity of these algorithms. This analysis is the result of a joint work with Amandine Véber.

We conclude our study of polynomial linear equivalence problem by presenting new algorithms for the hard (i.e., homogeneous) case of QMLE. The method designed in the previous chapter for IQMLE cannot be directly applied in the homogeneous case for obvious reasons. However, the fact that IQMLE is easy is of utmost importance, because the most promising strategy to tackle QMLE is apparently to reduce it to one or several instances of IQMLE.

Let us recall that given two homogeneous quadratic maps a and b, the problem is to find two bijective endomorphisms of (F q )

n , S and T such that:

T • b = a • S (18.1)
In this chapter, we propose two Monte-Carlo algorithms for QMLE. The first one is simpler and runs in time equivalent to Poly(n) • q 2n/3 arithmetic operations in F q . Our second algorithm is more sophisticated and runs in time equivalent to Poly(n)•q n/2 field operations, yet so far it is only applicable when q = 2. Recall that the to-n-fro algorithm (Algorithm 13.1) has a complexity of O n • q 2n , and that in the homogeneous setting standard estimates suggest that the Gröbner-based algorithm of §13.2 has a complexity of order O 2 18n

Interestingly, while all our other algorithms are deterministic, these ones are probabilistic, and an essentially algebraic problem is addressed by essentially statistical methods. These algorithms sometimes fail to detect that two quadratic maps are equivalent (there are false negatives), but never wrongly claim that they are equivalent. In addition, when they do not explicitly fail, the algorithms explicitly determine S and T , which can be used to certify the result. For the sake of simplicity, in this whole chapter we will assume that q is even, and we will discuss how the techniques we present can be adapted to fields of odd characteristic.

Dehomogenization.

Our key idea when dealing with QMLE is to dehomogenize the problem: if the image of S is known on a given vector x, then we can explicitly determine the two related inhomogeneous quadratic maps a (z) = a(z + S • x) and b (z) = b(z + x). The solutions of equation (18.1) are then precisely the solutions of the inhomogeneous instance: T • b = a • S. We expect to be able to solve the IQMLE instance in practical time, so that the whole problem boils down to acquiring the image of S on (at least) one point. This already leads to a semi-trivial algorithm: fix a non-zero vector x, enumerate all the q n -1 possible non-zero vectors y, dehomogenize the problem assuming that y = S • x, and solve the resulting IQMLE instance using the techniques of chapter 17. We discuss this semi-trivial approach a bit further in §18.1.

Main Ideas. Our global strategy to improve on the (semi-)trivial approach is to first discover the image of S on a single point faster than exhaustive search, then to dehomogenize the problem and turn it into an instance of IQMLE. The intuitions behind our techniques to recover the image of S are nicely explained in a graph-theoretic framework. Consider the pair of undirected graphs G a = (V, E a ) and G b = (V, E b ), where the common set of vertices is V = F q -{0}, and the edges are such that (x, y) ∈ E a if and only if x ∈ ker D y a (the same goes for E b ). Figure 18.1 shows a "medium-sized" connected component of such a graph. It is striking that the graph is formed by small triangles, but is otherwise tree-like. The presence of the small triangles follows from the vector-space structure of the kernel: if there are edges x ↔ y and x ↔ z, then there is necessarily an edge x ↔ (y + z). In particular, a node is always connected to itself, so that Figure 18.1: A "large" connected component of G a , with q = 2 and n = 64. Self-edges are not shown. as soon as there is an edge x ↔ y, there is also an edge x ↔ (x + y), and an edge (x + y) ↔ y, forming a triangle. The interest of these graphs is that they nicely capture the action of S on a and b.

Lemma 18.1. The secret matrix S is a permutation of V that, when seen as a graph isomorphism, transforms

G b into G a .
This result is an easy consequence of the fact that S transform ker D x b into ker D (S•x) a, which is itself an easy consequence of the "differential" equation:

T × D x b = D (S•x) a × S (18.2)
This equation can be obtained by "differentiating" equation (18.1) at x, as was done in the previous chapter. The usual algorithms for Graph Isomorphism cannot really be used to recover the isomorphism between G a and G b , since they are at least linear in the size of the graph. In addition, recovering the full isomorphism (whose size is exponential) is not necessary, as knowing how the isomorphism transforms a single vertex is sufficient to completely retrieve it by dehomogenization and usage of an IQMLE solver.

Recall that the distance between two nodes x, y ∈ V is the minimal number of edges that must be crossed to move from x to y. If x and y do not belong to the same connected component, then the distance between them is +∞. The neighborhood of radius k of a given node x is the set of all nodes y such that the distance between x and y is less than or equal to k. The Weisfeiler-Lehman method for Graph Isomorphism exploit Figure 18.2: A breadth-first exploration of the top part of the graph shown in Figure 18.1. The exploration starts from the black node. Thin red edges are "backwards" and will not appear in the tree. Thick edges form the BFS tree.

the fact that the size of neighborhoods are preserved by the isomorphism. This can be used to restrict the number of possible images in G a of a given node in G b : their neighborhoods of all possible radii must have the same size. A quite direct and simple application of this idea yields a simple algorithm faster than exhaustive search. Theorem 18.2. There is a Monte-Carlo QMLE algorithm that makes O q 2n/3 calls to an external IQMLE solver, after a preprocessing of complexity O q 2n/3 . This algorithm is the object of §18.3. It works by isolating nodes having degree q √ n/3 in G a and G b . It can be estimated that there are O q 2n/3 such nodes, and therefore after building two sets U and V of O q n/3 nodes with q √ n/3 neighbors in G a and G b respectively, we are guaranteed by the birthday paradox to find a "right pair" in U × V , i.e., a pair (x, y) such that y = S • x. The O q 2n/3 pairs in U × V can be tested using the available IQMLE algorithms.

Theorem 18.3. When q = 2, there is a heuristic Monte-Carlo QMLE algorithm that makes O (1) calls to an external IQMLE solver, after a preprocessing of complexity O 2 n/2 . This second algorithm, which is the object of §18.4, reduces the number of candidate pairs to O (1), by using the ideas of the Weisfeiler-Lehman method more in-depth. The point is that our first algorithm only exploits the fact that the isomorphism preserves the number of adjacent nodes. Our second algorithm exploit the fact that the isomorphism preserves the actual topology of neighborhoods. One of the problems is to represent the topological structure of the neighborhoods in a way that is both independent from the labels of the vertices, and practical to deal with (e.g., deterministic).

The main point is that the two graphs G a and G b are very sparse, as each node only has a single neighbor on average (besides itself). We thus do not expect to find other cycles than the triangles while exploring only a small fraction of the full graph. Starting a polynomial-radius Breadth-First Search from any point of the graph and removing "backwards" edges (i.e., edges pointing to an already explored node) yields an unordered tree, as illustrated by Figure 18.2. These tree are somewhat random, and the distribution of the number of children of each node is known (and it is the same for all nodes). We can thus associate a random-looking unordered, unlabeled, tree T (f , x) to a quadratic map f and a vector x of (F 2 ) n . It is then possible to show that these trees are valid encoding of the topology of neighborhoods, since T (b, x) = T (a, S • x).

Because most connected components in G a and G b are very small, and thus do not provide enough interesting information, we restrict our attention to nodes with having "large" neighborhoods (more precisely, to nodes whose neighborhood is turned into a "high" tree by the BFS), as these neighborhoods are nearly all pairwise distinct. We thus select two sets U and V of 2 n/2 nodes with large neighborhoods in G a and G b respectively, and the birthday paradox guarantees that there will be a right pair in U × V . Because the topology of the neighborhoods contain more informtion than the degree, it can be used to efficiently identify the right pair in a nearly-unique way. We analyze the behavior of this algorithm under the heuristic assumption that the trees resulting from the Breadth-First Searches are critical Galton-Watson trees. The assumption that q = 2 is critical, as it ensures that the graph has a certain shape, and that trees can easily be found by a BFS. Rank Distributions. Two probability distributions are ubiquitous in this chapter. Let N be smaller than q n , x 1 , . . . , x N be non-zero distinct points of (F q )

n , and let f be a uniformly random quadratic map. We pay special attention to the family of random variables:

X i = dim ker D xi f
Next, let L 1 , . . . , L N a sequence of independent and uniformly distributed random endomorphisms of (F q ) n such that L i • x i = 0. We also pay special attention to the sequence of random variables:

Y i = dim ker L i
We will show in §18.2 that the X i and the Y i have the same distribution. However, the Y i are independent, while the X i are not even pairwise independent. We will however show in §18.2.2 that the bias is extremely small, and that no algorithm can distinguish (X 1 , X 2 ) from (Y 1 , Y 2 ) with advantage better than 1/q n . This leads us to state the following conjecture.

Conjecture 18.1. No algorithm with running time O P oly(n) • q n/2 can distinguish with non-negligible advantage between X 1 , . . . , X q n/2 and Y 1 , . . . , Y q n/2 . This computational conjecture supports the heuristic assumption that the trees obtained by locally exploring the graphs are indeed independent random trees.

The Global Strategy: Dehomogenization

As argued in the introduction of this chapter, dehomogenizing a homogeneous instance requires the knowledge of the image of S on one point. Indeed, if y = S • x 1 , then we define a (z) = a(z + y) and b (z) = b(z + x), and we have T • b = a • S. Lemma 12.2 allows us to easily compute a and b , while ensuring that they are inhomogeneous with overwhelming probability:

a (1) = D y a a (0) = a(S • x) b (1) = D x b b (0) = b(x)
This immediately shows that dehomogenized instances are not random inhomogeneous instances. First of all, their linear and quadratic homogeneous components are correlated. Much worse, since we assume q to be a power of two, their linear homogeneous components are always singular. This means for instance that the inversion-free to-n-fro algorithm (aka Algorithm 17.1) cannot successfully solve them, and that the pencil-based algorithm (aka Algorithm 17.2) has a lower success probability on dehomogenized instances than on random instances. It is possible to make the pencil-based IQMLE algorithm work smoothly in this context though. The problem is that the algorithm will only work if the dehomogenized instance is nice (as defined in §17.2). It is fortunately not difficult to make the dehomogenized instances nice. We will say that x is nice with f if f (x) is non-zero and belongs to the image of D x f . The dehomogenized instance is therefore nice when b is nice with x. In this case, we can run the pencil-based IQMLE algorithm on the dehomogenized instance, and we know that it will eventually succeed. It is therefore sufficient to choose a vector x that is nice with b. This results in algorithm 18.1.

This algorithm is almost easy to analyze, and the only question not quickly receiving an obvious answer is the number of iteration of the first loop (that selects x). We will assume that x and b being random, b(x) should be non-zero with probability 1 -q -n . Lemma 17.2 tells us that D x b is a random linear map vanishing on x, and lemma 10.26 combined with conjecture 10.1 gives us the probability that each one contains b(x) in its image. Therefore the expected number of iterations of this loop is:

E [#iterations] = q - 1 q + 1 q 3 - 1 q 4 + 1 q 5 + O 1 q 6
This shows that with overwhelming probability, the cost of determining x in Algorithm 18.1 is negligible in front of that of invoking Pencil-IQMLE about q n -1 times. The same reasoning carries over with minor tweaks to fields of odd characteristic. x ← random element of (F q ) return L 10: end function It remains to estimate the complexity of the patched RankList function, and that of Pencil-IQMLE on the corresponding instances. The parameters of the algorithm will then be modified to minimize the total running time.

Complexity of the Patched RankList. When q is a power of two, the differential of a random quadratic map at a random non-zero point x is a random linear map vanishing on x. The number of linear maps whose kernel has dimension k and contains a given vector, and whose image contains another fixed vector is given by lemma 10.23 (with s = t = 1), and is:

n -1 k -1 q n -1 k q n -k q !
Exploiting the fact that n-1 k q has order q k(n-k) reveals that the expected cardinality of R k (a) is essentially q n-k 2 , up to small constant multiplicative factors. It also follows that for each iteration of the outer loop of the patched RankList, there will be on average q k 2 iterations of the inner loop.

As previously, we choose the size of U and V to be the square root of the expected cardinality of R k , for some value of k that we will determine. The complexity of building U and V is therefore O q n/2+k 2 /2 matrix operations.

Complexity of Pencil-IQMLE. When the homogeneous linear component has a kernel of dimension k, then the main loop of Pencil-IQMLE performs q k iterations. We will therefore assume that the complexity of running Pencil-IQMLE on these particular instances is that of q k matrix operations (this is a somewhat crude approximation). Testing all the q nk 2 pairs in U × V therefore costs roughly O q n-k 2 +k matrix operations.

Adapting the Parameters. To minimize the total running time, we must therefore choose k such that:

n 2 + k 2 2 ≈ n -k 2 + k
And the solution is:

k = n/3 - 1 3 + o(1)
Leading to a total complexity of roughly O q 2n/3+ √ 25n/27 matrix operations.

Practical Results.

We have implemented the combination of Algorithm 18.2 with Pencil-IQMLE inside the MAGMA computer algebra system, running on one core of a 2.8 Ghz Xeon machine. As shown in Table 18.1, we found out that in practice it is difficult to balance the cost of the two parts of the algorithm because k can only take √ n integer values. We could nevertheless verify in practice that the complexity of building the lists and the expected number of right pairs in them is consistent with our theoretical results. The source code is in the public domain, and is available at: x ← random element of (F 2 ) n 6:

T ← Tree [n log n] (f , x)

7:

until Height(T ) = n log n 8:

and SpineDecomp(T, n √ log n) a random subset of (F 2 ) n composed of vectors x such that Tree [n log n] (f , x) has height n log n and has a unique spine decomposition up to height n √ log n. It seems natural to question how good a discriminating function Tree [k] is, or, more precisely, how often do we have Tree [k] (b, x) = Tree [k] (a, y) when y = S • x. In Algorithm 18.4, this directly influences the cardinality of P, and thus the number of inhomogeneous instances to discharge to the IQMLE solver. In §18.4.1 we will show that when x is randomly chosen, then Tree [k] (b, x) = ∅ with high probability, making the discriminating function essentially useless over the whole (F 2 ) n . This is why in TreeList we restrict our attentions to the following subset of (F 2 )

n :

H(f ) =    x ∈ (F 2 ) n T ← Tree [n log n] (f , x), Height(T ) = n log n, SpineDecomp T , n √ log n = true   
We will show in §18.4.3 that sampling a random tree from H(f ) can be done in expected time O n 2 log 2 nq 3 , which makes it reasonable to consider this particular subset of (F 2 ) n . We will next show in §18.4.4 that Tree [n log n] is nearly injective on R(f ). This makes Tree [n log n] a nearly-optimal discriminating function, when restricted to H(f ). This allows us to show in §18.4.5 that the expected cardinality of P is O (1). The proofs of these claims are the pièce de résistance of this chapter. Theorem 18.3 (from the introduction) follows from these claims by combining the ingredients together.

Discriminating with Random Trees

We may consider Tree [k] (f , x) as a random variable when f is randomly chosen, and we will now try to derive useful information on its distribution. We argue that the trees produced by Tree [k] in fact result from a branching process, because the number of children of each node in the tree is random and follows the same fixed distribution (except at the root). This in turn follows from the fact that the number of descendants of a given node is a function of the rank of the differential of a or b on the corresponding point of (F 2 )

n .

We therefore use the standard terminology of branching processes to describe the output of Tree [k] . We focus on the usual properties of the random trees produced by Tree [k] : what is the offspring distribution (number of children of each node)? the average progeny (mean number of children per node)?

We unfortunately cannot directly use the distribution of the X i 's to answer these questions, for the following reason: by definition of Node [k] (f , x, y), we always have y ∈ ker D x f , so that by symmetry of the differential, ker D y f always contains x. Except when x = 0 at the root of the tree, this means that dim ker D y f is always greater than or equal to two, and thus does not follow the distribution of the X i 's.

Lemma 18.7. The offspring distribution of every non-root node is: n (i) = P [a given particle produces i offspring] = p n,k when i = q kq 2 0 otherwise where p n,k = λ(n)λ(n -2) λ(k)λ(k -2)λ(nk)

• q -k(k-2)

The expected progeny of each node is:

µ = n k=2 q k -q 2 • p n,k = 1 - 1 q n-2
And the variance of the offspring distribution is:

σ 2 = n k=2
2 kq 2 2 • p n,k -µ 2 = q 2 (q -1) 1 -q 2 + 1 q n + q 2 q 2n

Proof. It is clear that the number of descendants of each node can only be of the form q kq 2 , for some k. This k is precisely the dimension of ker D x f , conditionned on y ∈ ker D x f . The expression of p n,k is then a direct consequence of lemma 10.19 (via an implicit use of lemma 17.2). Next, by linearity of the expectation and because the p n,k add up to one, we find that

µ = n k=2 q k • p n,k -q 2 .
In this expression, the value of the sum is given by lemma 10.20. The variance can be established in the same way. Expanding its expression yields:

σ 2 = n k=2 q 2k • p n,k -2q 2 n k=2 q k • p n,k + q 4 -µ 2
The second sum is equal to (µ + q 2 ), and therefore the previous equation simplifies to:

n k=2 q 2k • p n,k -(q 2 + µ) 2
This is exactly the expression of the variance of the cardinality of the kernel of a random endomorphism conditioned to vanish on two given points, and its value is given by lemma 10.21.

Before any further considerations, we note that the probability that a node has no children is:

P [no offspring] = p n,2 = λ(n) λ(1) ----→ n→∞ 1 - 1 q 2 + O 1 q 3
In particular, this shows that Tree [k] returns the empty tree with high probability, making it a seemingly pretty lousy discriminating function (as previously advertized). We shall see that it is possible to get much more from Tree [k] .

Does Tree [k] Produces Random Trees? We will analyze the algorithm under the heuristic assumption that the output of Tree [k] is a (truncated) Galton-Watson tree with offspring distribution n . This is very convenient because these objects are well-known and have been extensively studied.

If the graph were a random graph with degree distribution n , then it would be possible to argue that a connected component is a tree asymptotically almost surely, and that Tree [k] does return a random tree with offspring distribution n . The problem is that the graph is not random, if only because of the triangles. Removing backwards edges in the BFS takes care of the triangles, but this does not mean that the resulting tree is random, because the graphs are deterministic products of a and b.

Our (heuristic) assumption that Tree [k] produces Galton-Watson trees with law n (i.e., trees where the number of descendants of each node is chosen independently according with law n ) relies on two arguments.

First, the offspring distribution of trees produced by Tree [k] is actually n , and it is the same for each node, as long as no cycles are encountered. Second, Conjecture 18.1 means that it is impossible to detect if the number of descendants of each node in the trees are correlated. The running time of Algorithm 18.4 (yet to be established) is too short to allow a successful detection of the correlation. We shall therefore assume in the sequel that for all useful purposes the output of Tree [k] is a truncated Galton-Watson tree with offspring distribution n .

Slightly More Advanced Properties of the Trees. Let us denote by P n the law of Galton-Watson trees with offspring distribution n . Figure 18.5 shows a random tree sampled according to this distribution (we chose a big one). Because µ ≤ 1, the trees are finite with probability one [AN72, chapter I, part A, section 5,theorem 1].

In addition, the probability that a tree sampled according to P n has height greater than h is equivalent to 2/(hσ 2 ) ≈ 2/(h • q 3 ) [AN72, chapter I, part B,section 9, theorem 1]. A first consequence is that sampling a tree of height n log n requires sampling O q 3 • n log n trees on average. Another consequence is that the expected height of trees sampled according to P n is not finite; this justifies why we restrict the height of the result of Tree. It is also known that the expected total number of nodes after h generation is h + 1 [START_REF] Pakes | Some limit theorems for the total progeny of a branching process[END_REF], so that computing Tree [k] requires on average O (k) matrix operations. This means that the complexity of finding a vector x such that Tree [n log n] (f , x) has height at least n log n is essentially the same as that of performing O q 3 • n 2 log 2 n rank computations on n × n matrices.

The probability that two random Galton-Watson trees are equal is easy to determine, however this would be useless here, because Galton-Watson trees are ordered trees (i.e., sibling nodes are distinguished, there is a leftmost brother and a rightmost brother for instance). We could not find in the available literature the probability that two Galton-Watson trees are isomorphic (i.e., equal if considered as unordered trees, where sibling nodes are indistinguishable). Figure 18.6 shows two trees that are distinct if considered as ordered trees, but isomorphic and thus equal if considered as unordered (and unlabeled) trees. We address this issue using the spine decomposition.

The Spine Decomposition in Detail

For any n ≥ 3, let T n be a tree sampled according to P n , and let P H n be the law of T n conditioned to have height at least n log n (without loss of generality, we write n log n instead of n log n ). In fact, P H n [•] stands for P n • Height(T n ) ≥ n log n , and allows to make notations less cumbersome.

We need a criterion to decide whether two conditioned trees are isomorphic or not, and we need it to be simple enough so that we may evaluate the probability that it holds. The criterion we will use is the following: two isomorphic trees with a unique spine decomposition must have empty subtrees emanating from the backbone at the exact same heights. Of course, if the spine decomposition is unique up to height h, then this holds only up to height h. This will intuitively show that two random trees with a unique spine decomposition up to height h are isomorphic with a probability that gets exponentially small in h. We will make this intuition formal later, but we must first introduce some properties of the spine decomposition.

We decompose a conditioned tree (i.e., a tree of law P H n ) into a backbone (or spine) going from the root to height n log n, on which we graft a given number of unconditioned Galton-Watson trees at each of its nodes. Looking at all nodes of height n √ log n, if only one of them has descendants at height n log n then the spine up to height n √ log n is uniquely determined: necessarily, it is the path in the tree going from the root to this node (Figure 18.4 illustrates this).

Let us work for a moment with ordered Galton-Watson trees. That is, we also record who is the descendant of each parent and offspring are ordered (so that we can talk about brothers to the left or to the right of an individual). In [START_REF] Geiger | Elementary new proofs of classical limit theorems for Galton-Watson processes[END_REF], Geiger shows that if we define the sequence of independent random variables (V n m , Y n m ) , m ∈ N by

P V n m = j, Y n m = k = P n [Height(T n ) ≥ m -1] P n [Height(T n ) ≥ m] • P n [Height(T n ) < m -1] j-1 • n (k), 1 ≤ j ≤ k < ∞, (18.3)
then T n conditioned to have height at least h has the same law as the random tree constructed inductively as follows:

-The root (i.e., the first node of the spine) has Y n h offspring. -To each of the V n h -1 first offspring node we graft a Galton-Watson tree with offspring distribution n and conditioned to have height (strictly) less than h -1. These V n h -1 trees are independent of each other (and of the rest of the construction). These subtrees are on the left of the backbone on Figure 18.7. ). This shows the Galton-Watson tree conditionned on non-extinction at generation n and n + 1 respectively. GW (k) denotes a Galton-Watson tree conditioned to be extinct at generation k. The subtrees to the right of the line of descent of the left-most particle are ordinary Galton-Watson trees.

-To each of the Y n h -V n h last offspring, we graft an unconditioned Galton-Watson tree with offspring distribution n (again, these trees are independent of each other and of the rest of the construction). These subtrees are on the right of the backbone on • n (y), (18.4) which is 0 if y = 0 or if y is not of the form q kq 2 for some k ∈ {3, . . . , n}. Hence, the spine can be seen as a "prolific" line of descent that survives up to generation h by producing a biased number of offspring, while the other individuals of the population reproduce essentially according to the initial offspring distribution (we refer to [START_REF] Geiger | Elementary new proofs of classical limit theorems for Galton-Watson processes[END_REF] for an explanation of the fact that trees emanating from brothers to the left of the spine are conditioned not to have descendants at generation h).

Sampling in H(f ) Takes Polynomial Time

We are ready to show that our random trees, when conditioned to have height n log n, have a spine decomposition up to height n √ log n with very high probability.

Theorem 18.8. There exists a constant C such that the probability that a random tree sampled according to P H n has a spine decomposition up to height n √ log n is greater than 1 -C/ √ log n.

Before proving this theorem, we review its implications. Informally speaking, it means that when Tree [n log n] produces a tree of height n log n, then this tree has a unique spine decomposition up to height n log √ n asymptotically almost surely. In the auxiliary function TreeList, only a negligible fraction of the trees will be rejected because it does not meet the unique spine decomposition condition. Therefore, the number of iterations of the inner loop of TreeList is O n 2 • q 2 , which is the number required to sample a sufficiently high tree. In addition, this shows that, by linearity of the expectation, that:

2q n σ 2 • n log n 1 - C n √ log n ≤ E [|H(f )|] ≤ 2q n σ 2 • n log n . (18.5)
proof of theorem 18.8. We show that under P H n , with high probability only one path from the root to height n √ log n extends to a path reaching height n log n. Call this event A n . Since this property is purely topological, then it does not matter whether the tree is ordered or not. We obtain the desired result by bounding from below the probability of A n by the probability that all trees emanating from the spine under height n √ log n are of height less than n(log n -√ log n). The independence of this family of trees, together with the fact (easy to check) that for every integer i in the interval {1, . . . Now, as n → +∞, all the p n,k (for k ∈ {3, . . . , n}) converge to a finite limit p ∞,k , and we also have µ n → 1 (recall that µ n < 1 for every n) and σ 2 n → q 3 -q 2 =: σ 2 . The last two convergences happen exponentially fast in n, therefore the same proof as that of Theorem 3.1 in [START_REF] Geiger | Elementary new proofs of classical limit theorems for Galton-Watson processes[END_REF] (in which µ n = 1 for all n) shows that whenever (m n ) n≥1 tends to infinity at most polynomially, we have Furthermore, we have the following lemma.

Lemma 18.9. There exist C 3 , C 4 > 0 such that for every n ≥ 3,

P   n √ log n-1 i=0 Y n n log n-i > C 3 • n log n   ≤ C 4 n √ log n .
We postpone the proof of Lemma 18.9 until the end of the proof of Theorem 18.8. Armed with (18.7) and Lemma 18.9, we can come back to (18.6) and write for every n Note that for the third inequality, use the fact that 1 -x ≥ e -2x for every x ∈ [0, 1/2]. What (18.8) shows is that for every n ≥ 3, if we sample a Galton-Watson tree T n according to P H n , then with probability at least 1 -C 7 / √ log n there will be a unique spine decomposition under height n √ log n.

proof of lemma 18.9. We use Markov's inequality (in a Chebychev-like fashion) as follows: if C 3 > 0, we have for each n ≥ 3 Let us show that the numerator in the right-hand side of (18.9) is of order n √ log n, while the denominator is of order n 2 log n whenever C 3 > 0 is large enough. These two points rely on appropriate bounds on the first two moments of all Y n n log n-i 's (observe that the numerator is in fact the sum of the variances of the Y n n log n-i 's). Indeed, recall from (18.4) that for every k ∈ {3, . . . , n}, P Y n n log n-i = q kq 2 = 1 -P n [Height(T n ) < n log ni -1]

q k -q 2 P n [Height(T n ) ≥ n log n -i] • p n,k
and these are the only possible values for Y n n log n-i . Because 1 -e -x ≤ x for all x ≥ 0, we can write for every i ≤ n √ log n -1 :

1 -P n [Height(T n ) < n log n -i -1] q k -q 2 ≤ -q k -q 2 log P n [Height(T n ) < n log n -i -1]
≤ -q kq 2 log P n Height(T n ) < n log nn log n -2 .

We thus have for every such integer i

1 -P n [Height(T n ) < n log n -i -1]
q k -q 2 (q kq 2 ) • Moreover, because λ(•) is decreasing,

λ(n)λ(n -2) λ(k)λ(k -2)λ(n -k) ≤ lim n→∞ 1 λ(n) =: C q .
Combining the above, we arrive at P Y n n log n-i = q kq 2 ≤ -

log P n Height(T n ) < n log n -n √ log n -2 P n [Height(T n ) ≥ n log n] • C q • q k -q 2 q -k(k-2)
for every n ≥ 3 and k ∈ {2, . . . , n}. This yields

E Y n n log n-i ≤ - log P n Height(T n ) < n log n -n √ log n -2 P n [Height(T n ) ≥ n log n] • C q • n k=3 q k -q 2 2 q -k(k-2) E Y n n log n-i 2 ≤ - log P n Height(T n ) < n log n -n √ log n -2 P n [Height(T n ) ≥ n log n] • C q • n k=2 q k -q 2 3 q -k(k-2)
Now, by (18. q kq 2 2 q -k(k-2) =: m 1 < ∞ and ∞ k=3 q kq 2 3 q -k(k-2) =: m 2 < ∞.

As a consequence, there exists C > 0 such that for every n ≥ 3, we have This completes the proof of Lemma 18.9.

18.4.4 Near-injectivity of Tree [n log n] over H(f ).

Our key argument to establish the properties of Algorithm 18.4 is that Tree [n log n] is close to injective over H(f ).

Theorem 18.10. There is a constant κ ∈]0; 1[ such that if two trees sampled according to P H n have a unique spine decomposition up to height n √ log n, then the probability that they are isomorphic is upper-bounded by κ n √ log n .

Over H(f ), our discriminating function Tree [n log n] produces random trees meeting the conditions of the theorem, which then tells us that the result of two distinct invocations of Tree [n log n] are non-isomorphic with overwhelming probability. Brother to the right or to the left does not matter here since the condition at the denominator is stronger than Height(T ) < n log ni -1 for our range of integers i. Let us use (18.10) to obtain some bounds (away from 0 and 1), uniform in n and i ≤ n √ log n -1, for the probability that all of the Y n n log n-i -1 brothers of the i-th node of the spine have zero offspring. Because n (0) = p n,2 and using (18.7), the right-hand side of (18.10) is equivalent as n → ∞ to

n (0) 1 -2/(σ 2 • n log n) n→∞ lim n→∞ λ(n) λ (2)
=: e ∈]0, 1[. (18.11) Thus, if we denote α = PH n [no nephews at height i], then by definition α ≥ P Y n n log n-i = q 3 -q 2 • (e n ) q 3 -q 2 -1

Using (18.4) and (18.7), We have implemented Algorithm 18.4 using MAGMA, and we found out that it works well in practice, as Table 18.2 shows. The experiment clearly shows that |P| is constant. This justify our heuristic assumption a posteriori. The implementation is also in the public domain and is available at: http://www.di.ens.fr/~bouillaguet/implem/branching-qmle.magma Possible improvement. Our current implementation stores the whole trees. It would be possible to save some memory by hashing the trees on-the-fly. For instance, to hash the trees to 128-bit digests (suitable with q n up to 2 128 ), pick up two 128-bit random primes p 1 and p 2 , and let: 1] (f, y, z i ) mod 2 128 z = ker D y fx, y

α ≥ 1 -1 - 2 σ 2 (n log n -i -1) + o 1 n log n q 3 -q 2 2 σ 2 (n log n -i) + o 1 n log n • p n,2 • (e n ) q 3 -q 2 -
Tree [k] (f , x) = Node [k] (f , 0, x) Node [k] (f , x, y) = p 2 + i p 1 i • Node [k-
Node [0] (f , x, y) = p 2 18.4.7 Getting Rid of the q = 2 Limitation So far, our best algorithm is restricted to the case where q = 2. One of the problems when q > 2 is that the vector space structure of the kernels creates cycles of length 4 in the graph. For instance, with q = 3, when there is an edge x ↔ y, there is also an edge x ↔ 2y, and there are also two edges y ↔ 2x and 2y ↔ 2x. This complicates (if it does not simply prevents) using the same methodology to encode the topological structure of neighborhoods into trees. All hope is not lost though, because many decompositions of graphs into tree may be used for this purpose. For instance, the modular decomposition introduced by Gallai in 1967 comes to mind, as it would likely pack together collinear vector in a single "module" of the graph. In addition, it can be computed in linear time [START_REF] Tedder | Simpler linear-time modular decomposition via recursive factorizing permutations[END_REF]. Chapter

A Class of Weak Keys in HFE

In this chapter we present a new cryptographic application of QMLE algorithms. A class of weak keys for HFE is identified, the security of which reduces to the hardness of QMLE. Ironically, the use of such weak keys was suggested as a way to reduce key sizes. In that case the attack described in this chapter recovers the secret key in practice. This joint work with Antoine Joux and Joana Treger-Marim resulted in a publication in the Journal of Mathematical Cryptology.

The HFE cryptosystem has been proposed in 1996 by Patarin in [START_REF] Patarin | Hidden fields equations (hfe) and isomorphisms of polynomials (ip): Two new families of asymmetric algorithms[END_REF] in order to avoid his own attack on the C * cryptosystem [START_REF] Matsumoto | Public Quadratic Polynominal-Tuples for Efficient Signature-Verification and Message-Encryption[END_REF][START_REF] Patarin | Cryptoanalysis of the Matsumoto and Imai Public Key Scheme of Eurocrypt[END_REF]. The latter basically hides the power function X → X 1+q θ in an extension field of degree n over F q , using two secret linear bijections S and T . In order to invert it, it suffices to remark that this power function, as the RSA power function, can be easily inverted provided that 1 + q θ is invertible modulo (q n -1). In [START_REF] Patarin | Hidden fields equations (hfe) and isomorphisms of polynomials (ip): Two new families of asymmetric algorithms[END_REF], Patarin proposed to change the internal known monomial into a secret polynomial f of small degree. The legitimate user can still easily invert the public key since she knows S and T , and can invert the small degree polynomial using the Berlekamp algorithm for instance.

Related Work. From the adversary point of view, the action of S and T transforms the secret internal polynomial into a very sparse univariate polynomial of very high degree, as shown for instance by Kipnis and Shamir in [START_REF] Kipnis | Cryptanalysis of the HFE Public Key Cryptosystem by Relinearization[END_REF].

A possible decryption attack would consist in inverting or factorizing this polynomial. However, there are no efficient algorithms to perform these tasks (an attempt1 can be found in [START_REF] Sidorenko | The Weak Keys For HFE[END_REF]), and merely deciding the existence of roots is in fact NP-complete [START_REF] Kipnis | Cryptanalysis of the HFE Public Key Cryptosystem by Relinearization[END_REF].

HFE belongs to the category of public-key cryptosystems based on the hardness of computing a functional decomposition: given the composition of two functions f and g, can one identify the two components? Other examples include C * , SFLASH [START_REF] Patarin | Flash, a fast multivariate signature algorithm[END_REF], FAPKC [START_REF] Ren | Two varieties of finite automaton public key cryptosystem and digital signatures[END_REF], 2R [START_REF] Patarin | Asymmetric cryptography with s-boxes[END_REF] and McEliece [START_REF] Mceliece | A Public-Key Cryptosystem Based on Algebraic Coding Theory[END_REF]. With the exception of the latter, the former have all been broken because computing a functional decomposition was not as hard as expected. In the context of HFE, computing such a decomposition is related to decomposing the univariate representation of the public key, in order to recover the secret internal polynomial f as well as polynomial representations of S and T . Computing polynomial decompositions is a simple and natural mathematical problem which has a long history, going back to the works of Ritt and Ore in 1922 and 1930 respectively [START_REF] Ritt | Prime and Composite Polynomials[END_REF][START_REF] Ore | Contributions to The Theory of Finite Fields[END_REF]. Today, polynomial decomposition algorithms exist for some classes of polynomials over finite fields [vzG90a, vzG90b], but no such algorithm is applicable to HFE. One step of the attack presented in this article amounts to computing a polynomial decomposition, and makes use of Gröbner bases.

The complexity of existing attacks gainst HFE, which all amount to solving systems of quadratic equations, depends on the degree d of the secret internal polynomial. When this degree is fixed, their complexity is polynomial in the security parameter n, although the exponent can be ridiculously large. In order for decryption to be polynomial, d must grow at most polynomially in n, and in that case the attacks are no longer polynomial. We consider this setting to be the most natural one and we will then suppose in the remaining of the chapter that d is polynomial in n.

A simple decryption attack against HFE consists, given a ciphertext, in trying to solve the equations given by the public key. In 2003, Faugère and Joux experimentally showed that the HFE equations are not random systems of multivariate equations, because computing a Gröbner basis for these equations is much easier than the corresponding problem with random quadratic equations [START_REF] Faugère | Algebraic Cryptanalysis of Hidden Field Equation (HFE) Cryptosystems Using Gröbner Bases[END_REF]. This allowed a custom implementation of the F 5 algorithm [START_REF] Faugère | A New Efficient Algorithm for Computing Gröbner Bases Without Reduction to Zero (F5)[END_REF] to break the first HFE challenge, for which the public key has 80 quadratic equations in 80 unknowns over F 2 . Later, Granboulan et al. [START_REF] Granboulan | Inverting HFE Is Quasipolynomial[END_REF] showed that specific algebraic properties of the HFE equations make the complexity of inverting HFE subexponential, in O exp log 2 n when q = 2.

In general, the hardness of recovering the secret key of HFE from the public key is unrelated to PLE problems, unless the internal polynomial is made public. A key recovery attack in the usual case where this polynomial is secret was presented in [START_REF] Kipnis | Cryptanalysis of the HFE Public Key Cryptosystem by Relinearization[END_REF] and turns the problem of recovering T into an instance of the MinRank problem, the decisional version of which is NP-Complete [START_REF] Buss | The Computational Complexity of Some Problems of Linear Algebra[END_REF]. Solving this instance of MinRank can be done by solving an overdetermined system of about n 2 quadratic equations in about (n • log d) variables. The complexity of solving these equations is subexponential in O exp log 3 n . This is too high to be practical, even for parameters corresponding to the HFE challenge that was broken.

These results show that HFE is not as robust as expected. However, can we consider that HFE is really completely broken? Is it still a viable alternative to RSA?

The cryptographic community often perceives HFE as broken, because of the practical attacks on some instances, and vastly lost both trust and interest in it. We would like to argue that the situation of HFE is slightly more complex. The complexity of some Gröbner basis algorithms, such as F 5 , is better understood [START_REF] Bardet | Asymptotic Behaviour of the Degree of Regularity of Semi-Regular Polynomial Systems[END_REF] and allows to estimate the complexity of the decryption attacks, which remains relatively high for general instances. Moreover, standard modification-such as removing some equations from the public key-destroy the algebraic structure exposed by the public key and that was exploited by Gröbner basis algorithms. HFE with removed public equations is often called HFE -, and seems suitable as a signature scheme. No attack against HFE -faster than exhaustive search have been found (yet). In particular, the second HFE cryptanalytic challenge, with removed public equations, is currently far from being broken. Furthermore, Dubois and Gama have studied the degree of regularity of various classes of HFE instances in [START_REF] Dubois | The degree of regularity of hfe systems[END_REF]. While they only provide an upper-bound on the complexity of computing a Gröbner basis of the public key, their result show that there are wide ranges of parameters that are not provably broken by the direct Gröbner attack. If their upper-bound were tight (this is a small leap of faith), then many interesting ranges of HFE parameters would be secure.

All in all, HFE is comparatively in better shape than the SFLASH signature scheme for which polynomial time algorithms are known both to invert [DFS07, DFSS07] and to recover equivalent private keys [START_REF] Fouque | Key Recovery on Hidden Monomial Multivariate Schemes[END_REF]. SFLASH is based on C * , hence has a single internal monomial. The attacks against SFLASH exploit the fact that multiplication matrices commute in some way with this internal monomial. Using this property, it is possible to recover conjugates of the multiplications by the secret matrix S using simple linear algebra on the differential of the public key [START_REF] Fouque | Key Recovery on Hidden Monomial Multivariate Schemes[END_REF]. However, for general HFE, the multiplications no longer commute with the secret polynomial. Another issue is that we also need to recover the internal secret polynomial.

In this chapter, we consider the key recovery problem on a class of weak keys for HFE. As opposed to the decryption attack of Faugère and Joux [START_REF] Faugère | Algebraic Cryptanalysis of Hidden Field Equation (HFE) Cryptosystems Using Gröbner Bases[END_REF], we recover an equivalent representation of the secret key that subsequently allows to inverse the trapdoor with the same complexity as the legitimate user. The weak instances we attack have an internal polynomial with coefficients in the ground field and not in the extension field as it was originally specified, or instances that are reducible to these specific ones (by considering equivalent transformations S and T , see §19.2). Some instances belonging to this category were proposed by Patarin himself in [START_REF] Patarin | Hidden Fields Equations (HFE) and Isomorphisms of Polynomials (IP): Two New Families of Asymmetric Algorithms[END_REF] (an extended version of [START_REF] Patarin | Hidden fields equations (hfe) and isomorphisms of polynomials (ip): Two new families of asymmetric algorithms[END_REF]) with the aim of reducing the size of the HFE public key (the so-called "subfield" variant). However, notice that the family of weak keys described here does not reduce to this subfield variant, and choosing the coefficients of the secret polynomial in the base field could be used to reduce the secret-key size. While in general, the hardness of the key-recovery does not depend on the hardness of QMLE, we show that on weak keys, the key-recovery problem can be reduced to an instance of the QMLE problem, and that the solutions of this problem allow us to efficiently recover all the secret elements (or equivalent data). Our QMLE algorithms allow to solve the instances in practice for realistic parameter sets.

Coming back to the subfield variant, other schemes, including UOV [START_REF] Kipnis | Unbalanced Oil and Vinegar Signature Schemes[END_REF] for instance, also have subfield variants, and the default in the design of an older version of SFLASH (v1) was to choose the secrets in a subfield. These schemes, or their subfield variants have all been broken: SFLASH v1 was attacked by Gilbert and Minier in [START_REF] Gilbert | Cryptanalysis of SFLASH[END_REF], and subfield-UOV was shown to be insecure as well [START_REF] Braeken | A Study of the Security of Unbalanced Oil and Vinegar Signature Schemes[END_REF]. Although SFLASH and HFE share a similar structure, the Gilbert-Minier attack against SFLASH v1 cannot be applied to subfield-HFE, since it is based on Patarin's attack against C * . Because this latter attack has no equivalent for HFE, there is no known attack against the subfield variant of HFE.

As mentioned above, the complexity of nearly all existing attacks on HFE depends on the degree of the internal secret polynomial. Even the most concrete and realistic threat, namely computing a Gröbner basis of the public-key, will become unrealistic if this degree is chosen high enough (a drawback is that decryption then becomes slower). A nice feature of the attack presented in this paper is that its asymptotic complexity is only marginally affected by the degree of the internal polynomial. As such, it be applied in practice to HFE instances on which existing attacks would be completely intractable. We also argue that under standard conjectures on the complexity of Gröbner basis computation, it is possible to establish that the complexity of our remains polynomial when the degree of the internal polynomial grows polynomially with n.

Hidden Field Equations

The HFE scheme was designed in [START_REF] Patarin | Hidden fields equations (hfe) and isomorphisms of polynomials (ip): Two new families of asymmetric algorithms[END_REF] by Patarin. Note that specific variations of HFE exist, but we will focus on the basic HFE scheme. Let us briefly recall its mechanism.

Let K = F q . The HFE secret key is made up of an extension L of degree n over K, a low-degree polynomial f over L, and two invertible affine mappings S and T over K n . The secret polynomial f has the following particular shape: f (X) = 0≤i,j≤n q i +q j ≤d a i,j • X q i +q j + 0≤k≤n

q k ≤d b k • X q k + c, (19.1)
with the a i,j , the b k and c lying in L. Polynomials with the same shape as f are called HFE polynomials. Note that these polynomials were also studied much earlier in a completely different context by Dembowski and Ostrom [START_REF] Dembowski | Planes of Order n with Collineation Groups of Order n 2[END_REF], so they are sometimes referred to as D-O polynomials in the literature. Because decryption requires to invert f , the maximum degree of f , denoted by d, has to be chosen so that the factorization of f over L is efficient. All known algorithms for factorizing over finite fields are at least quadratic in the degree of the polynomial, which restricts d to values smaller than about 2 16 . It also makes sense to consider degree bounds of the form d = 2 • q D , because in equation ( 19.1), we may then consider the sum over values of i and j smaller than D. Because the iterates of the Frobenius are K-linear, then f , seen as a transformation of K n , can be represented by a vector of n quadratic polynomials in n variables over K. This property extends to the public key of the basic HFE scheme, defined by PK = T • f • S. In order to offer non-trivial encryption, f must logically be non-linear. Also, because HFE was designed specifically to circumvent the attack that destroyed C * , we will assume that the internal polynomial always has at least two non-linear terms. Note that when K = F 2 , we may assume a i,i = 0, by choosing b i+1 accordingly. As such, there are D(D + 5)/2 + 3 terms in f when q = 2 and (D + 2)(D + 1)/2 + 2 terms when q = 2.

Equivalent Keys for HFE

In HFE, the public key can be derived from the secret key in polynomial time by an algorithm PKGen that takes as argument T, f , S and L (i.e., the irreducible polynomial P defining L and the correspondance ϕ between L and K n ). Two secret keys are equivalent if they yield the same public key. For instance, it was shown in [START_REF] Wolf | Large Superfluous Keys in Multivariate Quadratic Asymmetric Systems[END_REF] that an HFE public-key is always generated by a secret key in which S and T are linear (as opposed to affine). The affine part of S and T can be removed by changing the constant component of f . Next, if α, β ∈ L, then it is possible to simultaneously replace T by T • M α and S by M β • S. It is sufficient to replace f by α • f (β -1 • X) in order for the public key to remain the same, and this allows to choose the values of both S and T on one point.

As a consequence, a set of q 2n • (q n -1) 2 equivalent secret keys is identified (this number assumes that L is fixed). It was not formally established that all the equivalent secret keys belong to this set, even though this seems likely when f is a randomly-chosen HFE polynomial.

Irrelevance of Keeping the Extension Field Secret

While the original description of HFE [START_REF] Patarin | Hidden fields equations (hfe) and isomorphisms of polynomials (ip): Two new families of asymmetric algorithms[END_REF] explicitly specifies that the extension field L must be part of the secret key, the same paper notes that this does not improve the security of the trapdoor, because there always exist equivalent secret keys for all the possible descriptions of L. As a matter of fact, the specifications of both Quartz [START_REF] Patarin | QUARTZ, 128-Bit Long Digital Signatures[END_REF] and SFLASH [START_REF] Patarin | Flash, a fast multivariate signature algorithm[END_REF] make the extension field public. In any case, it is possible to generate the same public key from the same secret polynomial, while fixing an arbitrary irreducible polynomial P defining L, and an arbitrary correspondence between L and K n . It simply requires slight modifications on S and T . Indeed, recall that any isomorphism between K n and L must be an invertible K-linear map [START_REF] Lidl | Finite fields[END_REF]. We will use this in the following proposition to justify our point: Proposition 19.1. Let SK = (T, f , S, P, ϕ) be an HFE secret key. Then for any choice of an extension field L = K[X]/P (X) of degree n, and for any choice of an isomorphism ϕ between L and K n , there exist two affine bijections S and T such that SK = (T , f , S , P , ϕ ) is equivalent to SK (i.e., generates the same public key).

Proof. It is well-known [START_REF] Lidl | Finite fields[END_REF] that all finite fields of the same cardinality are isomorphic. Therefore let us consider a field isomorphism ζ : L → L . Recall that ϕ : K n → L and ϕ : K n → L are both isomorphisms as well. The notation PK = T • f • S is unambiguous when the extension field L is clearly defined. Here we will write: Let us solve PK = PK for S and T . Because the two internal polynomial in PK and PK are the same, we can write:

PK = T • ϕ -1 • f L • ϕ • S PK = T • ϕ -1 • f L • ϕ • S K n K n K n K n S f
ϕ • T -1 • PK • S -1 • ϕ -1 = ζ -1 • ϕ • T -1 • PK • S -1 • ϕ -1 • ζ
And it follows that in order to enforce PK = PK it is sufficient to have:

T = T • ϕ -1 • ζ • ϕ -1 S = S • ϕ -1 • ζ • ϕ
And since ϕ -1 •ζ•ϕ is an automorphism of K n , we have S , T ∈ GL n (K). Thus the secret key (T , f , S , P , ϕ ) is equivalent to (T, f , S, P, ϕ).

Thus, keeping the representation of L secret does not improve the resistance of HFE to key-recovery attacks. Would the extension be secret, one could just arbitrarily fix its own and be guaranteed that an equivalent secret key exists. As a consequence, throughout the sequel, we assume that the description of L is public.

Linear Polynomials

Let f be an endomorphism of K n . It can be represented by a matrix M over K n , but also as a polynomial over L. Such K-linear (or "additive") polynomials only have monomials of degree q i , for 0 ≤ i ≤ n -1. In the sequel, we will always identify an endormophism of (F q )

n with its polynomial representation over L, and we will refer to the polynomial representation over L of such an endomorphism. The set of matrices commuting with F over M n (K) is the K-vector space of dimension n generated by F 0 , F, . . . , F n-1 .

A Specific Family of HFE Secret Polynomials

Similarly to the attacks against C * or SFLASH, the main idea we exploit is that some HFE secret polynomials may commute with some special functions. This commutativity property can then in turn be used to acquire informations on the secret elements.

A Commutativity property for Some HFE Secret Polynomials. Let us first consider the à la C * case, where the secret polynomial f over L is just a monomial a • X q i +q j , with a ∈ L. Then the public key PK = T • f • S can also be written as (T • M a ) • X q i +q j • S, by "absorbing" the multiplication by the constant a into the outer secret linear transformation. As a consequence, without loss of generality, we can assume that a = 1.

This secret monomial has very special commutativity properties, which were used in [DFS07, DFSS07] to break SFLASH. More precisely, composing it on the right hand size by multiplications M x by an element x ∈ L is equivalent to composing it on the left hand size by M x q i +q j . Another property, not used in [START_REF] Dubois | Cryptanalysis of SFLASH with Slightly Modified Parameters[END_REF][START_REF] Dubois | Practical Cryptanalysis of SFLASH[END_REF], is that it also commutes with the Frobenius map F (and hence with the iterates of the Frobenius map).

When we consider an arbitrary HFE secret polynomial, the two commutation properties no longer hold in general. However, if we restrict the HFE polynomials to have their coefficients in K (instead of the extension field L), we lose commutativity with multiplications but commutativity with the Frobenius map still remains. In the sequel, we show how this specific property can be exploited to perform a key-recovery attack, described in §19.3. Therefore, we will say the the secret keys in which the internal polynomial has coefficients in K are weak secret keys. Such instances of HFE are illustrated by Figure 19.1.

Our key-recovery attack could also apply to monomial instances of HFE, but this is not the point of this paper, as it has already been efficiently done [DFS07, [START_REF] Dubois | Practical Cryptanalysis of SFLASH[END_REF][START_REF] Fouque | Key Recovery on Hidden Monomial Multivariate Schemes[END_REF].

Corresponding Public Keys. The attack we discuss recovers a useful secret key by exploiting only knowledge of the public key, and it works at the sole condition that the public key can be generated by a weak secret key. Therefore, we will say that such public keys are weak public keys. We note that a weak public key has not necessarily been generated by a weak secret key. For instance, let f be an HFE polynomial with coefficients in K, and let a, b ∈ L. Then let us define f : x → a • f (b • x). This HFE polynomial has coefficients in L. Now let S, T ∈ GL n (K), and consider the HFE secret key (T, f , S). It does not fall into our definition of weak secret keys, because f / ∈ K[X], but it generates a weak public key: it is straightforward that it is equivalent to (T • M a , f , M b • S). To summarize, our attack will be applicable whenever the internal polynomial has the following shape: f (X) = 0≤i,j≤n q i +q j ≤d a • u i,j • b q i +q j

• X q i +q j + 0≤k≤n

q k ≤d a • v k • b q k • X q k + a • c, (19.2)
with u i,j , v k , c ∈ K, a, b ∈ L. Notice that legitimate users could easily check whether their secret key generates a weak public key by checking if their internal polynomial can be written as in equation (19.2).

An Estimation of the Cardinality of this Family

We now show that the probability that the uniform random choice of a secret key yields a weak public key is by all means negligible. This unfortunate event happens if and only if the internal polynomial f has the shape given by equation (19.2). We therefore go on to count the number of such polynomials (we will call them "weak polynomials" for the sake of brevity). Let us denote their number by #W P , and the number of HFE polynomials of degree d over L by #HF E(d, n, L). An obvious upper-bound is found by assuming that for any choice of α, β ∈ L * and f ∈ K[X], M α • f • M β is a distinct polynomial. This yields: #W P ≤ (q n -1) 2 • #HF E(d, n, K)

However this bound can be improved, because some polynomials are counted several times. For instance, if π ∈ K and Π ∈ L, then Π • f = Π • π -1 • (π • f ). The same goes for right-composition. The bound therefore improves to: #W P ≤ q n -1 q -1 2

• #HF E(d, n, K)

In the simpler case where d = 2q D and q = 2, then we have #HF E(d, n, K) = q D(D+5) 2

+3 , and therefore the probability of randomly generating a weak public key is upper-bounded by:

#W P #HF E(d, n, L) = q n -1 q -1 2 • q D(D+5) 2 +3 -(n-1) = O q 2-D 2 /2 n-1
This shows that the probability of generating a weak key out of bad luck is exponentially small in the security parameter. In the same vein, we could obtain a fairly obvious lower-bound on this probability by counting only the polynomials of the form M α • f . Indeed, nothing rules out the existence of several pairs (α, β) and (α , β ) such that

M α • f • M β = M α • f • M β ,
and for this reason our upper-bound is not necessarily a lower-bound. Their number is delicate to estimate, because it depends on the shape and coefficients of f .

The Key-Recovery

We now describe a key-recovery attack against the class of weak keys described in §19.2. In the sequel, we then assume that the internal secret polynomial f has coefficients in K.

As the attack is a bit complex, let us first give an overview. A pseudo-code of the attack is given in Algorithm 19.1. First, we show that the representation of L can be supposed to be public. Then, as already mentioned in §19.2, we use the commutation of the Frobenius map with the secret polynomials considered, which propagates to the public key PK. This key property allows us to recover applications closely related to S and T . An interpolation of PK combined with these applications then gives us a polynomial over K from which we recover f or an equivalent low-degree polynomial by computing a functional decomposition. In any case, we obtain the original secret key or an equivalent one that allows us to decrypt as efficiently as the secret key owner. All these assertions are made explicit and justified in this section. Let U, V ∈ GL n (K) be a (random) solution to the IP problem: U • PK = PK • V . 3: until there exist P, Q ∈ GL n (K) such that U = P • F • Q 4: for all i 0 in [1; n -1] co-prime with n do 5:

Let k = i 0 -1 mod n 6:

Compute S, T such that

F = S • V k • S -1 = T -1 • U k • T 7:
Interpolate g = T -1 • PK • S -1 .

8:

if g has all coefficients in K then

9:

Compute F 1 , F 2 ∈ GL n (K) and f 2 ∈ K[X], such that deg f 2 ≤ deg f and g

• F 1 = F -1 2 • f 2 .
10:

return T • F -1 2 , f 2 , F -1 1 • S 11:
end if 12: end for

A Useful Property of HFE Secret Polynomials Lying in K[X]

Recall from §10.1 that because f has coefficients in K, then it commutes with F:

f • F(X) = F • f (X) (19.3)
Patarin left as an open problem whether this property has security implications or not. We shall demonstrate that it does indeed. Most importantly, this property is detectable in the public-key. Proposition 19.2. There exist non-trivial endomorphisms L such that L • PK = PK • L. More precisely, the invertible map ψ defined below transforms a matrix M that commutes with f into a solution of the above equation:

ψ : M → T • M -1 • T -1 , S -1 • M • S
As a consequence, ψ(F ), . . . , ψ F n-1 are non-trivial automorphisms of PK.

Proof. Let M be a matrix such that f • M = M • f . Then we get:

PK • (S -1 • M • S) = T • f • S • S -1 • M • S = T • M • f • S = (T • M • T -1 ) • PK ⇔ PK = (T • M • T -1 ) -1 • PK • (S -1 • M • S)
Then, because of (19.3), ψ(F ), . . . , ψ F n-1 are automorphisms of the public key.

The existence of other solutions besides those mentioned in proposition 19.2 is extremely unlikely, unless the situation is very degenerate. Indeed, this would imply the existence of other linear applications commuting with the (non-linear) internal polynomial. However, besides the monomial instances, where multiplication matrices commute in some sense with f , we are not aware of instances that would verify such a property. Thus, if we consider a particular solution of the problem of retrieving an automorphism of the public-key, we can assume that it is ψ F i0 , for some unknown power i 0 .

Hardness of the QMLE Problem. Determining the automorphisms of the public key can be done by running a PLE algorithm. We will be able to use IQMLE algorithms when:

i) The secret transformations S and T are linear (as opposed to affine).

ii) The K-linear coefficients b k of (19.2) are not all zero.

iii) The constant coefficient c of (19.2) is non-zero. The first condition can only be satisfied if choosing linear S and T was a deliberate decision (otherwise it will only happen with negligible probability). There are good reasons of doing so: first it reduces a bit the size of the private key. Second, as shown in §19.1.1, S and T can be assumed to be linear, because of the existence of equivalent keys. However, we stress that this last fact is no longer true if the internal polynomial f is chosen in K[X] instead of L[X]. Series of bad design decisions could still lead to the combination of a restricted f and linear S and T .

The second condition will always be satisfied with high probability, and the third will be satisfied with probability 1/q. It must be noted that if S and T are linear, and if c = 0 in (19.1), then the public-key sends zero to zero, which might not be desirable.

In the case where S and T are affine, the situation is much more painful, as we are facing a homogeneous instance of QMLE, and our best shot is algorithm 18.4, that has a workload of q n/2 . In the case of the "subfield variant" though, all the numerical quantities lie in a subfield F q of F q , where q is quite small (the typical value is q = 2). This makes breaking the QMLE instances feasible in practice for the subfield variant (we discuss this issue further in §19.4).

Retrieving "nearly S" and "nearly T " Applications

Let us assume that we have found an automorphism (U, V ) = ψ F i0 of the public-key, for some unknown integer i 0 in the interval [1; n -1]. The whole point of the attack is to "extract" enough information about S and T from this automorphism. For this purpose, the value of i 0 has to be known, and it is required that i 0 and n are relatively prime. This latter condition can be easily checked for: F i and F j are similar if and only if gcd(i, n) = gcd(j, n). Therefore, i 0 is relatively prime with n if U and F are similar. If this turns out not to be the case, we take another automorphism of PK, until it passes the test. Since there are φ(n) values of i 0 that are prime with n, we expect to check n/φ(n) = O (log log n) candidates.

To derive the actual value of i 0 , we simply guess its value, and check whether the remaining steps of the attack are carried out successfully. Fortunately, there is a way to discard bad guesses systematically before the most computationally expensive step of the attack, as we will explain in §19. Proof. The first point follows from the fact that U and V are both similar to F i0 . Thus U k and V k are both similar to F i0•k = F. Regarding the second point, let us consider the case of S (something similar holds for T ). We have:

F = S • V k • S -1 = S • S -1 • F i0•k • S • S -1 = S • S -1 • F • S • S -1
And thus F • S • S -1 = S • S -1 • F. This commutation property directly implies the announced result on the polynomial representations (cf. §10.1).

In practice, S and T can be found very efficiently through linear algebra, given that i 0 is known. Note that for now, this proposition cannot be used to test whether our current guess for i 0 is correct, since we do not know S.

Building an Equivalent Secret Key

The information about S (resp. T ) contained in S (resp. T ) can be used to cancel the action of S and T on the public key. It follows from proposition 19.3 that F 1 = S •S -1 and F 2 = T -1 • T are linear combinations over K of powers of F, because they commute with F. We immediately obtain that:

T -1 • PK • S -1 = F -1 2 • T -1 • T • f • S • S -1 • F -1 1 = F -1 2 • f • F -1 1 . (19.4)
We therefore define:

g = T -1 • PK • S -1 mod X q n -X (19.5)
Because the HFE polynomials are stable by left and right composition by additive polynomials and by reduction modulo X q n -X, the "peeled off" polynomial g is still an HFE polynomial. Thus g has O n 2 coefficients, and that they can be uniquely determined in polynomial time by interpolation (this was noted in [START_REF] Kipnis | Cryptanalysis of the HFE Public Key Cryptosystem by Relinearization[END_REF]. Note that there would not be a unique solution if we did not perform the modular reduction of g). By doing so, we obtain an equivalent secret key, namely T , g, S .

By itself, this equivalent key is not particularly useful, since the degree of g is typically q n , and we are therefore still facing our initial task of factorizing a sparse polynomial of very high degree. However, g has a very important property which brings us one step closer to the original secret-key: Proposition 19.4. The coefficients of g are in K (and not in L). proof of lemma 19.5. If the polynomial representation of M has coefficients in K, then M commutes with F. This implies that M -1 also commutes with F, which in turn implies that the polynomial representation of M -1 has coefficients in K.

K n K n K n K n K n K n S f T PK S T F 1 F 2 g
This and (19.4) shows that T -1 • PK • S -1 has coefficients in K. From there, it is straightforward that g has coefficients in K.

The result of proposition 19.4 is illustrated in figure 19.2. This figure also helps remembering how the applications introduced so far intervene. This proposition can be used to verify if our guess for i 0 was right. Indeed, if g is found not to be in K[X], then the guess was wrong. We are aware that the fact that g ∈ K[X] does not rigorously prove that we have found the right value of i 0 . However, it does not matter, as g ∈ K[X] is sufficient for the subsequent step to work.

Recovering a Low-Degree Equivalent Secret Key

To be useful, an equivalent secret key must have an internal polynomial of low degree. We now show how to obtain one, by actually computing the decomposition given by equation (19.4). This is in fact a much easier problem than computing the equivalent decomposition on the original public key, because we deal with applications whose coefficients belong to K. They are then left invariant by the Frobenius (hence by F 1 and F 2 ), which implies that the problem of finding the decomposition reduces to finding a solution of an overdetermined system of quadratic equations. This system can be solved in practical time by computing a Gröbner basis, as we now show. To this end, we introduce the following notations, where all the coefficients in the expressions are now known to lie in K:

F 1 (X) = n-1 k=0 x k X q k F -1 1 (X) = n-1 k=0 y k X q k F 2 (X) = n-1 k=0 z k X q k F -1 2 (X) = n-1 k=0
t k X q k g(X) = q i +q j <q n a ij X q i +q j + n-1 i=0 b i X q i + c f 2 (X) = q i +q j ≤d e ij X q i +q j + q i ≤d f i X q i + g

Then, we consider the following polynomial equation, also represented by figure 19.3, obtained by composing both sides of equation (19.4) with F 1 :

g • F 1 = F -1 2 • f 2 . (19.6) K n K n K n K n f 2 F 1 F 2 g Figure 19.3: g = F -1 2 • f 2 • F -1 1 .
Broken arrows stand for applications with unknown coefficients.

Let us now substitute the expression of F 1 and g in the left-hand-side of (19.6). We find:

g • F 1 = q i +q j <q n a ij n-1 k=0
x k X q k q i +q j x k X q k q i + c = k,l∈{0,...,n-1} q i +q j <q n

a ij • x k • x l • X q i+k +q l+j + i,k∈{0,...,n-1} b i • x k • X q i+k + c,
We observe that g • F 1 is a polynomial whose coefficients are quadratic polynomials in the coefficients of F 1 . Now, let us substitute the expression of F -1 2 and f 2 in the right-hand-side of (19.6). We find:

F -1 2 • f 2 = n-1 k=0 t k   q i +q j ≤d
e ij X q i +q j + q i ≤d f i X q i + g   q k = k∈{0,...,n-1} q i +q j ≤d t k • e ij • X q i+k +q j+k + q i ≤d k∈{0,...,n-1}

t k • f i • X q i+k + g • n-1 k=0 t k
We again find that F -1 2 • f 2 is a polynomial whose coefficients are quadratic polynomials in the coefficients of both f 2 and F -1 2 . This shows that (19.6) is equivalent to a system of multivariate quadratic equations over K with O n2 quadratic equations and O n + D 2 unknowns, the unknowns being the coefficients of F 1 , F -1 2 and f 2 . This system can be generated by reducing both sides of (19.6) modulo X q n -X and identifying the coefficients of the monomials in X. The problem of computing the decomposition of equation (19.6) is therefore reduced to that of solving an overdetermined system of quadratic equations.

However, equation (19.6) admits many parasitic solutions (for example, F 1 = f 2 = 0, F -1 2 being arbitrary). To avoid these trivial solutions, we in fact consider an extended system:

   F 1 • F -1 1 = Id F 2 • F -1 2 = Id g • F 1 = F -1 2 • f 2 (19.7)
This new system avoids the parasitic solutions by forcing F 1 and F 2 to be invertible. We now argue that (19.7) is also equivalent to a system of quadratic equations, whose unknowns are the coefficients of F 1 , F -1 1 , F 2 , F -1 2 and f 2 . The third equation has already been shown to be translatable to multivariate quadratic equations. Substituting the definitions of F 1 and F -1

1 in F 1 • F -1 1 yields: n-1 k=0 n-1 =0 (x k • y ) • X q +k = X
We observe that the coefficients of the left-hand side are quadratic in the x k 's and y k 's, therefore we obtain n quadratic equations by reducing the LHS modulo X q n -X and equating the coefficients on both sides of the equation. The same goes for F 2 • F -1 2 = Id. All in all, assuming that the degree of f is d = 2q D , this yields n(n+3)/2+1 equations in 4n+D(D+5)/2+4 variables, not counting eventual field equations (one per variable). The existence of at least one solution is guaranteed, because of equation (19.4), as long as we picked the right power of the Frobenius matrix in §19.3.1. In fact, even though we just need one, we know that many solutions exist: for instance because the Frobenius commutes with everything in equation (19.6), we can take a particular solution, compose both It turns out that these equations can be solved efficiently, even though the number of variables is higher than what is usually tractable, because it is very overdetermined: we have O n 2 equations in O n + D 2 variables, and D has to be small for decryption to be efficient (i.e., D = O (log n)). In this setting, computing a Gröbner basis turns out to be feasible in practice.

F -1
Conjecture 19.1. The Gröbner basis of a system of random quadratic equations with the same number of variable and polynomials as our equations can be computed by manipulating polynomials of degree at most 8. Thus, it can be computed in time at most O n 24 by the F 5 algorithm. This is true if D is fixed, or even if grows polynomially with log n.

Justification of the Conjecture. This conjecture is in fact equivalent to assuming that our system of quadratic equations forms a semi-regular sequence. Under this assumption, we might make use of the results on the complexity of solving very overdetermined systems stated in §10.6.1. We are indeed dealing with n(n + 3)/2 + 1 quadratic equations in 4n + D(D + 5)/2 + 4 variables, so we let β = n(n + 3)/2 + 1 (4n + D(D + 5)/2 + 4) 2 , and we realize that we are dealing with β • n 2 equations in n variables. When n grows to infinity, then β converges to 1/32, even if D = log n. Thus, as soon as n gets big enough, the degree of regularity of the corresponding equations should become close to its finite limit. Equation (10.3) and Figure 10.2 tells us that this limit is 8. This shows that computing a Gröbner basis of n(n + 3)/2 + 1 semi-regular equations in 4n + D(D + 5)/2 + 4 variables is (asymptotically) polynomial. The actual degrees of regularity, computed using the Hilbert series, are shown in Figure 19.4 for various values of n and D.

Comments and Practical Results. While the above conjecture means that computing the polynomial decomposition we are dealing with should be polynomial, some remarks are in order. First, our equations are not random, not to mention semi-regular. This follows from the fact that they admit many solutions, while a random overdetermined system has no solutions with overwhelming probability. Next, our experiments (for various values of n and D) indicate that a Gröbner basis can be computed by manipulating polynomials of degree at most 3, leading to an empirical complexity of O n 9 . Our equations are thus easier to solve than random systems with the same parameters.

Applications and Experiments

Once the equations are solved, we recover an equivalent secret-key T • F -1 2 , f 2 , F -1 1 • S , which allows us to decrypt with the same time complexity as the legitimate user, since f 2 has essentially the same degree as f .

Applications and Experiments

We have implemented the HFE key-generation and encryption, as well as the attack, in the MAGMA computer-algebra system. In Table 19.1, we give five different sets of parameters. The first three sets A, B and C show that HFE with weak keys can be broken for realistic choices of parameters when S, T are linear. Parameter set D (resp. E) is the original parameter set of [START_REF] Patarin | Hidden Fields Equations (HFE) and Isomorphisms of Polynomials (IP): Two New Families of Asymmetric Algorithms[END_REF] (resp. twice the original). All the experiments were run on one core of an Intel 2.3Ghz Xeon "Nehalem" computer with 74 Gbyte of RAM. We tested our attack on several sets of parameters described below. We forged the solution of the IP instance from the knowledge of the secret S and T .

Weak Keys

We first tested the attack on realistically-sized weak keys, corresponding to parameter sets A,B and C. The chosen parameters allows the encryption or signature of 256, 134 and 97 bits respectively. We choose the degree of the internal polynomial very conservatively (i.e., much higher than what was proposed for the HFE challenges, and high enough to make decryption painfully slow). To make the QMLE part of the attack feasible, we choose the secret bijections S and T to be linear (as opposed to affine). Then solving the QMLE instance is a matter of seconds with the techniques presented chapter 17. We emphasize that none of the existing attack can be close to being practical on parameter sets A and B. On the other hand, parameter set C succumbs to the direct Gröbner basis attack (computing a Gröbner basis of the public key takes a bit less than a day).

Patarin's "Subfield" Variant of HFE

In order to reduce the size of the public key, Patarin suggested in [START_REF] Patarin | Hidden Fields Equations (HFE) and Isomorphisms of Polynomials (IP): Two New Families of Asymmetric Algorithms[END_REF] a "subfield" variant of HFE, in which the coefficients of the quadratic equations of PK live in a subfield k of K. If K = F 256 and k = F 2 , this reduces the size of the public key by a factor of 8. To achieve this, the coefficients of S and T , the coefficients of the defining polynomial of the extension field L, and the coefficients of the internal polynomial f have to be chosen in k (instead of K or L for the latter). The linear masks S and T will be affine, so the IQMLE algorithms do not apply in this case.

In order for the reduction of the public key size to be effective, K has to be relatively big and k relatively small. The former implies that D cannot be very large, otherwise decryption is impractical, while the latter means little entropy in the internal polynomial. This opens a possible way of attack, consisting in guessing f and then solving the QMLE problem to recover S and T . We shall compare the attack presented in this paper with this simple one.

Patarin's "concrete proposal" is parameter set D in Table 19.1. For practical decryption, we have to choose D = 2 (yielding an internal polynomial of degree at most 131072), and decryption can take at most 4 minutes on our machine. The internal polynomial has at most 10 terms with coefficients in F 2 . The simple "guess-f -then-QMLE" key recovery attack therefore needs to solve 2 10 affine QMLE instances for which q = 2 and n = 29. Such instances are in fact tractable even with older techniques (though no one ever noticed it), for instance using the "to-and-fro" algorithm of [START_REF] Patarin | Improved Algorithms for Isomorphisms of Polynomials[END_REF]. In that case, the "guess-then-QMLE" attack has a workload of 2 68 . With the new attack presented in this chapter, and the more advanced QMLE techniques described chapter 18, solving the QMLE instance takes about one second, and our attack takes less than one hour.

To show that the "subfield" variant is broken beyond repair, we show that it is possible to attack in practice parameters twice as big as the concrete proposal. This is parameter set E. The internal polynomial now has 21 terms, so the simple attack requires breaking 2 21 affine instances of QMLE with q = 2 and n = 59. The exact workload required to break these instance is not precisely known, but we note that solving a system of 59 quadratic equations over F 2 using the techniques described in chapter 11 would take about one month using inexpensive hardware. As was shown in §18.1, this is sometimes sufficient to solve a QMLE instance, otherwise Algorithm 18.4 has a smaller asymptotic complexity, but probably a greater practical complexity for such values of n. In any case, the "guess-then-QMLE" attack is here clearly impractical with a runningtime of at least 2 21 months. Our attack requires about one month to break the QMLE instance, plus about 4 hours for the remaining steps.

Conclusion

We have studied in practice the hardness of the MQ problem over F 2 . Algorithmic improvement and careful implementations on parallel platforms enables us to push further the boundary between intractable and feasible computation. We have shown for instance that solving a quadratic system of 64 equations over F 2 would be possible in practice with a modest budget and readily available hardware. However, sightly increasing the parameters would make any existing method intractable, thus making MQ an interesting hardness assumption to build new schemes.

We have also studied in detail several relevant cases of the "Isomorphism of Polynomials" problem. In two cases (QFSE and IQMLE) we could design very practical algorithms, leading to the practical break of an identification scheme. Even in the hardest case, we have shown that it is possible to improve on exhaustive search in some cases.

Challenging the hardness these problems requires a rather wide-spectrum toolbox, from Gröbner bases to matrix pencils, finite vector spaces combinatorics, random trees and graph theory. This makes it a rather difficult but fun problem to work on. In our experience, inventing new algorithms was not obvious, but trying to understand their behavior and analyzing their running time and success probability was the most challenging part. The analysis of previous algorithms was often sketchy or heuristic as well.

We believe that the existence of a generic algorithm (Algorithm 18.4) faster than exhaustive search for the most difficult case of QMLE shows that constructing multivariate Trapdoor One-Way Function by obfuscating an easily-invertible function with linear masks is an unsound approach. Moreover, in actual schemes, the fact that one of the two polynomial maps is easily invertible is likely to give additional options to the attacker. As an illustration, many schemes relying on the hardness of a structured variant of QMLE have been broken. Random homogeneous instances of QMLE are hard to deal with, but it is difficult to build efficient encryption and/or signature schemes out of the corresponding problem.

Comparatively, schemes such as HFE or UOV, where the internal (easily-invertible) map is kept secret, seem to be in better shape, and no ad hoc QMLE algorithm applies (yet). It is noticeable that in the case of HFE, keys from a weak class leak some information which can be retrieved by solving an instance of QMLE, leading to a practical key-recovery attack.

Overall, it is still tempting to use the hardness of MQ to build new cryptographic schemes, but it is not obvious to come up with constructions that are provably secure under the hardness of MQ. Some preliminary proposals are appearing at the time of this writing, and this is an exciting research topic.

11 2 .

 2 Présentation de mes Travaux 1: function Merkle-Damgård (M ) 2:

Figure 2 . 1 -

 21 Figure 2.1 -Le mode opératoire de Merkle-Damgård. La fonction de compression f , compresse n + m bits en n bits.

Figure 2 . 2 -

 22 Figure 2.2 -Illustration du "dithering" en infographie

Figure 2 . 4 -

 24 Figure 2.4 -Le mode opératoire Haifa.

  Buonarroti Simoni, The Delphic Sibyl (1510) (b) John Collier, Priestess of Delphi (1891) (c) J.W. Waterhouse, Consulting the Oracle, (1884)

Figure 3 . 1 :

 31 Figure 3.1: The distinguishing games involved in the study of modes of operations

Algorithm 3 . 1

 31 The Merkle-Damgård mode of operation. 1: function Merkle-Damgård (M ) 2:

Figure 3 . 2 :

 32 Figure 3.2: Joux's multicollision attack.

4

 4 The Kelsey-Schneier Second Preimage Attack. function Second-Preimage(M ) m 0 , . . . , m ← Pad

Figure 3 . 3 :

 33 Figure 3.3: The Herding Attack

Algorithm 3 . 6

 36 Shoup's Universal One-Way Hash Function 1: function Shoup(K, M ) 2:

Figure 3 . 4 :

 34 Figure 3.4: The "double-pipe" Merkle-Damgård hash function.

Fig 3 . 5

 35 Fig 3.5 illustrates the construction with k = 2. Unfortunately, concatenating two iterated n-bit hash functions does not result in anything near a secure 2n-bits hash function.

Figure 3 . 6 :

 36 Figure 3.6: Joux's attack against concatenated hashes

Algorithm 4 . 1

 41 Summary of our new attack on the plain Merkle-Damgård construction.

Figure 4 . 1 :Algorithm 4 . 2

 4142 Figure 4.1: A diamond built on top of a factor of the dithering sequence, connected to the message.

Figure 4 . 3 :

 43 Figure 4.3: A "Multi-diamond" with 4 words.

Figure 4 . 4 :

 44 Figure 4.4: A suffix-friendly set of 32 factors of size 50 from the Keränen sequence.

Figure 5 . 2 :Figure 5 . 3 :

 5253 Figure 5.2: The Online Phase of the Herding Attack for k = 2

Figure 5 . 4 :

 54 Figure 5.4: Herding Merkle-Damgård-Again

b) Online steps 2 to 5 Figure 5 . 5 :

 555 Figure 5.5: Second preimage attack on Merkle-Damgård-Again

Figure 6 . 1 :

 61 Figure 6.1: A toy "Kite-Generator" with 16 nodes over a binary alphabet. Edges are labelled with a message block and a letter. Hard edges correspond to the first letter, and dashed edges to the second letter. This big straw ball unfolds into kites!

7. 3 . 3

 33 In the Ideal Case : Proof of Theorem 7.8

16 :

 16 function Simulator(h, m) 17: if there exist a vertex h ∈ V and an edge h m -→ h in E then 18:

Algorithm 7 . 4

 74 Patched simulator for Game 3 1: function FreshValue(h, m) 2:

Figure 8 . 1 :

 81 Figure 8.1: An AES round

  .1). We denote the four columns of a 4 × 4 matrix M by M [0..3], M [4..7], M [8..11] and M [12..15] respectively. 100 8.2. A preliminary Tool for Simple Guess-And-Determine Attacks

3 :the secrets 4 :

 34 RetrieveCheck compatibility of secrets with available data 5:

  root

Figure 8 . 2 :

 82 Figure 8.2: The possible sets of guessed variables explored by the tool to find an attack one full AES round. Each descendant has one more guess than its parent.

Algorithm 8 . 4

 84 Randomized Search for a good recursive solver 1: function RandomizedSearch(E, T up )

  17: end function 8.3.3 Usage Algorithms 8.3 and 8.4 have been developed and implemented in C by Patrick Derbez. The running time is dominated by the computation of the time-complexity of a combination of solvers, which involves computing

Property 9 . 2 (

 92 the MixColumns property). Consider a pair (a, b) of 4-byte vectors, such that a = M C(b), i.e., the input and the output of a MixColumns operation applied to one column. Denote a = (a 0 , a 1 , a 2 , a 3 ) and b = (b 0 , b 1 , b 2 , b 3 ) where a i and b j are elements of F 2 8 . The knowledge of any four out of the eight bytes (a 0 , a 1 , a 2 , a 3 , b 0 , b 1 , b 2 , b 3 ) is sufficient to uniquely determine the value of the remaining four bytes.

Figure 9 . 1 :

 91 Figure 9.1: A 2 40 time attack on one round AES given one known plaintext. Bytes marked by black are guessed, bytes marked by gray are known.

Figure 9 . 1 ,

 91 is based on Property 9.4 below. The adversary guesses five bytes of the subkey k 0 -the column k 0 [12..15] as well as an additional byte, k 0 [0]. The steps in the key derivation are shown in the figure, where the number in each cell denotes the step in which its value is retrieved. Steps 1 and 13 are based on Property 9.4, steps 5, 9, 17, 21, and 22 exploit the key schedule, steps 7, 19, 24, and 25 are based on Property 9.2, and the rest of the steps are performed using the application of known operations on known values.

  (b) Second half of the attack

Figure 9 . 2 :

 92 Figure 9.2: An attack on one round AES given one known plaintext with time complexity of 2 32 and memory complexity of 2 24 . Bytes marked by gray are known (from previous steps of analysis). Bytes marked with tilted lines have at most 12 possible values by Property 9.5.

Figure 9 . 4 :

 94 Figure 9.4: Two chosen plaintexts attack on two AES rounds. Gray bytes indicate the presence of a difference, and hatched bytes indicate the presence of a known difference. If byte i is known in x 0 , then the actual values of all the bytes with the same number can be found.

8 : 3 9 : 10 :

 83910 for all x 0 [3] ∈ F 2 8 do Build T compute z 0 [7]and x 1 [4..7] let u = x 1 [4..7] `C[0..3] `C[4..7] in 11:

  (a) First half of the attack: the value of the bytes marked in black is guessed. The bytes marked by 7 and 8 are found using Property 9

( b )

 b The bytes marked is black are guessed. The bytes marked by 9 and 13 are found using Property 9.3(1).

Figure 9 . 5 :

 95 Figure 9.5: The attack with one known plaintext on two round AES.

Figure 9 . 6 :

 96 Figure 9.6: The attack on two rounds of AES without the second MixColumns using two known plaintexts. Bytes marked in black are guessed, and bytes marked in gray are known at this phase of the attack.

3 Figure 9 . 7 :

 397 Figure 9.7: Fault attack against the AES. Gray square indicates the presence of a difference. The number indicates the step of the attack in which the value of each byte is discovered.

9. 5 .

 5 Attacks on Four-Round AES

  (b) Second half of the attack: deduction of the remaining subkey bytes. Known bytes are marked in gray.

Figure 9 . 8 :

 98 Figure 9.8: The attack on three rounds of AES using one known plaintext

1 .

 1 First, enumerate all the possible values of x (0) 0 [0]. Because the differences in x 0 are known, then x (i) 0 [0] can be deduced for i = 1, 2, 3. This in turn allows to determine the differences in y 0 [0], and also in x 1 [0..3]. 2. Define c 2 = /4 and r 1 = σ(c 2 ), where σ denotes the permutation (0321). 3. Next, enumerate x (0) 1 [r 1 ]. Because the differences in this byte are known, then the values in x (i) 1 [r 1 ] can be deduced for i = 1, 2, 3. This allows to find the differences in y 1 [r 1 ], and then in x 2 [4c 2 ..4c 2 + 3]. 4. Finally, enumerate the values of x (0) 2 [ ]. Again, recover x (i) 2 [ ] for i = 1, 2, 3, and thus recover the differences in y 2 [ ]. 5. Store the association

Figure 9 . 9 :

 99 Figure 9.9: The 3-Round Truncated Differential Used in the 6-round Differential Attack.

3 Figure 9 . 10 :

 3910 Figure 9.10: Truncated Differential characteristic used in the attack against Pelican-MAC. Gray squares denote the presence of a difference. Hatched squares denote a known difference.

Figure 9 . 11 :

 911 Figure 9.11: State Bytes which Compose the Output in Odd and Even Rounds of LEX. The gray bytes are the leaked bytes.

5 Figure 9

 59 Figure 9.12: Gray squares are leaked to form the key-stream. The differences are null in squares with a 0. The differences in the hatched squares can be deduced from the leaked bytes and the existence of zero differences.

5 Figure 9 . 13 : 5 Figure 9 .

 591359 Figure 9.13: LEX: second stage of the attack.

Algorithm 10 . 1

 101 Multivariate Polynomial Division. 1: function MultivariateDivision(f, f 1 , . . . , f s )

1 . 2 .

 12 Construct the Macaulay matrix of degree d, i.e., the matrix M d whose rows are the products m • f i of degree at most d (where m ranges across all the monomials of the right degree) Compute its reduced row-echelon form M d 3. Define G d to be the set of polynomials found on the rows of M d whose leading monomial does not match that of the same line of M d . 4. Then G = D d=0 G d is a D-Gröbner basis

Theorem 10 .

 10 16 ([Bar04]). Let f 1 , . . . , f m be a regular sequence of homogeneous polynomials of respective degree d i in K[x 1 , . . . , x n ], with m ≤ n, and let I = f 1 , . . . , f m .(i) I has dimension nm.

10. 6 .Figure 10 . 1 :

 6101 Figure 10.1: Projected number of field operations required to compute a Gröbner basis of a semi-regular sequence of m quadratic polynomials in n variables. The graph shows iso-complexity lines (top-left is lower, bottom-right is higher).

Figure 10 . 2 :

 102 Figure 10.2: Degree of regularity (for n sufficiently big) of α • n 2 semi-regular quadratic polynomials in n variables.

  in

Proposition 11 . 3 .

 113 At the beginning of the function, x `x[k] has hamming weight two.

14 :

 14 function Next(State) 15:

Algorithm 11 . 6

 116 An equivalent version of Next. 1: function Next 2 (State) 2:

6 :y

 6 ← y `Derivative[k].y 7: end function But first, we introducce the function Next 2 (Algorithm 11.6

Proposition 11 . 11 . 2 : 3 :

 111123 An internal state of 2 • d-1 i=0 L i = O L d-1 bits is sufficient for each thread. Algorithm 11.9 Parallel Iterative algorithm for all degrees. 1: procedure Smart-Parallel-Zeroes(f, L, T ) initialize C (the constants shared by all the threads) for b from 0 to 2 n-L-T -1 do 4:

3 :d = 2 d

 32 Performance results for n = 48 and projected budgets for solving n = 64 in one month (as of summer 2010) = 3 d = 4 d = 2 d = 3 d = 4 d = 2 d = 3 d = 4

Algorithm 12 . 1

 121 Identification scheme based on Graph Isomorphism 1. Peggy (the Prover) generates a graph G 1 , chooses a random vertex-permutation σ, and computes G 2 = σ(G 1 ). She publishes (G 1 , G 2 ) and keeps σ secret.

Lemma 12 . 2 .

 122 If T • b(x) + d = a (S • x + c), with S, T ∈ GL n (F q ) and c, d ∈ (F q ) n , then for all k ≥ 1 we have b (k) = T • a + ∂a ∂c (k)

Algorithm 13 . 1 5 :

 1315 Bijective to-n-fro algorithm for QMLE. 1: function Bijective-To-n-Fro(a, b, F ) S is initially known on F remember that T • b(x) = a(S • x)

200 13 . 2 . 5 :

 1325 The Gröbner-Basis Algorithm Algorithm 13.2 General (non-bijective) to-n-fro algorithm for QMLE. 1: function General-To-n-Fro(a, b, F ) S is initially known on F remember that T • b(x) = a(S • x)

8 :F ← F + u 13 :

 813 for all x ∈ Gb(F ) do Enlarge F remember that S • u = v

  Estimated Complexity of GB computation

Figure 13 . 1 :

 131 Figure 13.1: Properties of semi-regular systems with the same number of equations and variables as S quad .

Algorithm 13 . 3 A

 133 simplified version of the columnwise-sieve algorithm. 1: function Columnwise-Sieve(a, b)

4 :

 4 if b(e 1 ) = a(x) then C 1 ← C 1 ∪ {x} 5:

= 5 Figure 13 . 2 :

 5132 Figure 13.2: Iso-complexity lines of Algorithm 13.3 (in the inhomogeneous case) for various values of q. The complexity is smaller than indicated by each line on the left, and greater on the right. The lines become vertical when n•q n dominates the complexity, and increasing u no longer helps in making T columnwise smaller in equation(13.4) smaller.

Theorem 14 . 2 (

 142 [START_REF] Gantmacher | The Theory of Matrices[END_REF],chapter VIII, §2, theorem 2). The dimension of the commutant of a given matrixA is r k=1 (2k -1) deg i k (λ),

Figure 14 . 1 :

 141 Figure 14.1: Probability to not be cyclic, observed with n = 32 for various values of q and a large number of samples.

Algorithm 15 . 1

 151 Pseudo-code of the pencil-based QFSE algorithm. 1: function Pencil-QFSE(a, b) 2:

7 : 8 : 9 :

 789 let y = (y 1 , . . . , y n ) let z(y) = b(y) -a S • y z belongs to R 2 let S quad be the set of coefficients of z 1 and z 2 S quad ⊆ R ⊥ 10:let I be the ideal of R ⊥ spanned by S quad 11:

Theorem 15 . 1 (

 151 Bennet, Stenzen et al.). An n × n matrix M is the product of two skew-symmetric matrices if and only if the following conditions are fulfilled: a) Every elementary divisor 1 corresponding to a non-zero eigenvalue of M occurs an even number of times.

Figure 15 . 3 :

 153 Figure 15.3: Time complexity of solving the QFSE problem for pairs of quadratic forms.

Figure 16 . 1 :

 161 Figure 16.1: Comparison between the various possible methods, including: running the Gröbner-based algorithm on (16.1), computing a Gröbner-basis of I a,b , and enumerating all the possible first rows of S, then computing a Gröbner basis of I a,b + J . The complexity of computing a Gröbner Basis of I a,b seems to be O (8 n ).

Algorithm 17 . 1 A

 171 variant of the "To-and-Fro" algorithm without exponential inversions 1: function Inhomogeneous-To-n-Fro(a, b) 2:

13 : 14 :

 1314 let z(y) = T • b(y) -a S • y z belongs to R n let S quad be the set of coefficients of z 1 , . . . , z n S quad ⊆ R ⊥ 15:let I be the ideal of R ⊥ spanned by S quad 16:

  q

Figure 17 .Figure 17 . 1 :

 17171 Figure 17.1 shows the running time of our implementation of Pencil-IQMLE. The actual running time of the function seems to be cubic.

Algorithm 18 . 3

 183 this problem, we patch the RankList function so that it only selects vectors x making the dehomogenized instances nice. The patched function is shown in Algorithm 18.3. The corresponding patched definition of R k is:R k (f ) = {x ∈ (F q ) n | dim ker D x f = k and f (x) = 0 and f (x) ∈ Im D x f } Specialized function for Pencil-IQMLE. 1: function RankList(f , , k)

n 6 :

 6 until dim ker D x f = k and b(x) = 0 and b(x) ∈ Im D x f

Algorithm 18 . 4

 184 Branching Process Based Algorithm. 1: function TreeList(f , )

9 :Figure 18 . 4 :

 9184 Figure 18.4: A Tree of height n log n with a spine decomposition up height n √ log n (there has a unique path starting from the root and reaching height n √ log n that extends to a path of maximal length).

Figure 18 . 5 :

 185 Figure 18.5: A random Galton-Watson tree with distribution P (the leaves are not drawn). 255

Figure 18 . 6 :

 186 Figure 18.6: Two distinct, but isomorphic trees. Both are represented as unordered trees by { {∅, { {∅, ∅} }} }.

Figure 18 . 7 :

 187 Figure 18.7: Illustration of the spine decomposition (this is Figure1from[START_REF] Geiger | Elementary new proofs of classical limit theorems for Galton-Watson processes[END_REF]). This shows the Galton-Watson tree conditionned on non-extinction at generation n and n + 1 respectively. GW (k) denotes a Galton-Watson tree conditioned to be extinct at generation k. The subtrees to the right of the line of descent of the left-most particle are ordinary Galton-Watson trees.

  Figure 18.7. -The V n h -th offspring node continues the spine. It has Y n h-1 offspring, the first V n h-1 ones are the roots of i.i.d. Galton-Watson trees conditioned to have height less than h -2, the last Y n h-1 -V n h-1 are the roots of i.i.d. unconditioned Galton-Watson trees and the spine carries on with the V n h-1 -th offspring, which has Y n h-2 offspring nodes, and so on. Observe that the marginal distribution of Y n m is given by P [Y n m = y] = 1 -P n [Height(T n ) < m -1] y P n [Height(T n ) ≥ m]

√ log n- 1 i=0E 1 ≥

 11 , n √ log n -1}P n Height(T n ) < n(log nlog n) Height(T n ) < n log ni ≥ P n Height(T n ) < n(log nlog n) ,enables us to writeP H n [A n ] ≥ n P n Height(T n ) < n(log nlog n) Y n n log n-i -E P n Height(T n ) < n(log nlog n)

  lim n→∞ m n • P n [Height(T n ) ≥ m n ] = 2 σ 2 . (18.7)

  P H n [A n ] ≥ E P n Height(T n ) < n(log nlog n)

  log n-i -E Y n n log n-i > C 3 • n log n -

- 2 P

 2 P n [Height(T n ) ≥ n log ni] ≤ -log P n Height(T n ) < n log nn √ log n n [Height(T n ) ≥ n log n] .

  7) we have lim n→∞ -log P n Height(T n ) < n log nn √ log n -2 P n [Height(T n ) ≥ n log n] = 1,and furthermore, ∞ k=3

  n log n-i ≤ Cm 1 n log n, and (using the independence of all Y n m 's) n log n-i ≤ C n log n, for a constant C > 0 depending on m 1 and m 2 . Choosing C 3 > Cm 1 and coming back to (18.9), we obtain the existence of C 4 > 0 such that for every n ≥ 3,

proof of theorem 18 . 10 .

 1810 Let us use again T n (from §18.4.2) and its spine decomposition under the additional conditioning that all trees emanating from the spine under height n √ log n are of height smaller than n(log n-√ log n). We write PH n for the law of this tree. By construction, each brother of the i-th node of the spine (0 ≤ i ≤ n √ log n -1) has no offspring with probabilitye n := P n T n = ∅ Height(T n ) ≤ n(log nlog n) = P n [T n = ∅] P n Height(T n ) ≤ n(log n -√ log n) = n (0) P n Height(T n ) ≤ n(log n -√ log n) . (18.10)

T PKFigure 19 . 1 :

 T191 Figure 19.1: Description of weak keys. The broken arrow indicates that f has coefficients in K.

Algorithm 19 . 1

 191 Pseudo-code of the attack Require: An HFE public key PK, generated by (T, f , S) such that f ∈ K[X]. Ensure: An equivalent secret key: (T , f , S ), with deg f ≤ deg f . 1: repeat 2:

3 . 3 .

 33 With the preceding notations, we have the following result:Proposition 19.3. Let (U, V ) = ψ F i0 , with gcd(i 0 , n) = 1. Let k be such that k • i 0 = 1 mod n. i) There exist S, T in GL n (K) such that F = S • V k • S -1 and F = T -1 • U k • T .ii) Both S • S -1 and T • T -1 commute with F, hence their polynomial representations over L are in fact polynomials with coefficients in K.

Figure 19 . 2 : 1 : 19 . 5 .

 1921195 Figure 19.2:PK = T • f • S = T • g • S.Broken arrows stand for applications with coefficients in K.

Figure 19 . 4 :

 194 Figure 19.4: Degree of regularity of semi-generic systems of n(n + 3)/2 + 1 quadratic equations in 4n + D(D + 5)/2 + 4 variables.

  allows to break a proposal by Ron Rivest that explicitly aimed at preventing

			Hellman's
	chapter 3		TMDTO	chapter 6
	Multicollision		TMDTO for 2nd Preimages	Kite Generator
	2nd Preimage Attack		chapter 4	on Dithered Hash 2nd Preimage Attack
	Herding Attack		New 2nd Preimage Attack	2nd Preimage Attack on Shoup's UOWHF
	Trojan Message	Herding Concatenated	2nd Preimage
	Attack		Hashes	on Hash-Again
	Herding the Zipper	chapter 5	Herding Hash-Again
	Figure 2.5: Overview of part I

  1.2 that Haifa is in fact provably resistant to generic second preimage attacks up to 2 n queries. Haifa has had a great success, and it is implemented in five second round SHA-3 candidates: BLAKE, ECHO, Shabal, SHAvite-3 and Skein.

Algorithm 3.5

The Haifa mode of operation.

1: function Haifa(M )

2:

Table 4 . 1 :

 41 Comparison of Long Message Second Preimage Attacks

  2

  • .

	Function		MD5	SHA-1	SHA-256	SHA-512
	(n, κ)		(128,55)	(160,55)	(256,118)	(512,118)
	Dean	Offline:	2 65	2 81	2 129	2 257
		Online:	2 73	2 105	2 138	2 394
		Memory:	2	2	2	2
		Patch:	2 54	2 54	2 117	2 117
	Kelsey-Schneier Offline:	2 71	2 87	2 136	2 264
		Online:	2 73	2 105	2 138	2 394
		Memory:	110	110	234	234
		Patch:	2 54	2 54	2 117	2 117
	New	Offline:	2 93.5	2 109.5	2 189	2 317
		Online:	2 74	2 106	2 139	2 395
		Memory:	2 56	2 56	2 119	2 119
		Patch:	57	57	120	120
	First connection Offline:	2 98.3	2 122.3	2 194.3	2 394
	with TMDTO Online:	2 65	2 81	2 129	2 257
		Memory:	2 65.6	2 81.6	2 129.6	2 257.6
		Patch:	66	82	130	258
		Length:	2 32	2 40	2 64	2 118

  Actual Diamond Construction. The adversary picks at random 2 values for D k = {h k i }. Then, she generates a set of further 2 n/2 -multicollisions on the first k -1 pipes, starting from the intermediate val-

	blocks	n -blocks	• n/2 blocks
		h 1
	2		h 1
		2	h 2
		Figure 5.1: Diamond Structure on two pipes
	ues (h 1 , h 2 , . . . , h k-1 ). The diamond in the last pipe will be built on top of this multicollision. For each
	possible message in the multicollision, and each starting point (h k 1 , h k 2 , . . . , h k 2

  S N

	Algorithm 5.1 Trojan Message Attack, Collision Variant
	1: function Collision-Trojan-Suffix(P 1 , . . . , P N )
	2:

  n-κ chaining values, B, that contains the IV . For each chaining value x ∈ B and any dither

	h 11
	h 12	h 10
	h 13	h 9
	h 14	h 8
	IV	h 7
	h 0	h 6
	h 1	h 5
	h 2	h 4
	h 3

Table 6 .

 6

	1: Comparison of Long Message Second Preimage Attacks on Dithered Hashing

  if there exist y ∈ G such that x < X y then Candidates ← Candidates -{x}

	5: end function
	6: function LocalPruning(K, V )
	7:	Bad ← ∅
	8:	for all x ∈ V do
	9:	if x / ∈ Bad then
	10: for all y ∈ Propagate 12: end for
	13:	end if
	14:	end for
	15:	return V -Bad
	16: end function
	17: function FilterGuesses(K)
	18:	Candidates ← GreedyGlobalPruning(K)
	19:	for all x ∈ Candidates do
	20:
	21:	end for
	22:

* (K ∪ {x}) do 11: if y = x then Bad ← Bad ∪ {y}

Table 9 .

 9 The observation extends previous observations of the same nature made in [FKL + 00, DK10a]. 1: Summary of our Proposed Attacks on AES-128 Property 9.3 (the key-schedule properties). Consider a series of consecutive subkeys k r , k r+1 , . . . , and denote k r = (a, b, c, d) and:

		Attacks on round reduced version of the AES-128
			Complexity
	#Rounds	Data	Time	Memory Description	Found by
	1	1 KP	2 48	1	[DK10b]	human beings
	1	1 KP	2 40	1	§9.2.2	preliminary tool
	1	1 KP	2 32	2 24	§9.2.2	improved tool
	1	1 KP	2 32	2 16		improved tool
	1.5	1 KP	2 56	1		preliminary tool
	1.5	2 KP	2 24	2 16		improved tool
	2	1 KP	2 80	1	§9.3.4	human beings,preliminary tool
	2	1 KP	2 64	2 48	§9.3.5	improved tool
	2	2 KP	2 48	1	§9.3.1	human beings
	2	2 KP	2 32	2 24	§9.3.1	improved tool
	2	3 KP	2 32	1	§9.3.2	human beings
	2	2 CP	2 28	1	§9.3.3	human beings
	2	2 CP	2 8	2 8	§9.3.3	improved tool
	2.5	1 KP	2 96	1		preliminary tool
	2.5	1 KP	2 88	2 88		improved tool
	2.5	2 KP	2 80	2 80		improved tool
	2.5	2 CP	2 24	2 16		improved tool
	3	1 KP	2 120	1	§9.4.4	preliminary tool
	3	1 KP	2 96	2 96		improved tool
	3	9 KP	2 40	2 35	§9.4.3	human beings, improved tool
	3	2 CP	2 32	1	[BDD + 10]	human beings
	3	2 CP	2 16	2 8	§9.3.3	improved tool
	4	1 KP	2 120	2 120		improved tool
	4	2 CP	2 104	1	[BDD + 10]	human beings
	4	2 CP	2 80	2 80		improved tool
	4	5 CP	2 64	2 68	§9.5.2	human beings
	4	4 CP	2 32	2 24	§9.5.3	improved tool
	4	10 CP	2 32	2 24	§9.5.1	human beings
	4.5	1 KP	2 120	2 120		improved tool
	KP -Known plaintext, CP -Chosen plaintext,
	Time complexity is measured in approximate encryption units.
	Memory complexity is measured approximately

Table 9 .

 9 2: Summary of our Proposed Attacks on Primitives based on AESAs a result, we have the following useful relations between subkeys

		Attacks on Primitives based on AES
	Primitive	Complexity		Where	Found by
		Data	Time Memory
	Pelican-MAC	2 85.5 queries 2 85.5	2 85.5	[YWJ + 09] human beings
	Pelican-MAC	2 64 queries	2 64	2 64	§9.7	improved tool
	Pelican-MAC	2 64 queries	2 64	2 64	§[DKS11] human beings
	Alpha-MAC	2 65 queries	2 64	2 64	[YWJ + 09] human beings
	LEX	2 36.3 bytes	2 112	2 36	[DK08]	human beings
	LEX	2 40 bytes	2 100	2 64	[DK10a]	human beings
	LEX	2 36.3 bytes	2 96	2 80	§9.8.1	improved tool
	LEX	2 48 bytes	2 88	2 48	§9.8.2	improved tool
	LEX	2 48 bytes	2 80	2 48		improved tool
	modified LEX	360 bytes	2 40	2 43	§9.8.3	human beings
	AES-128	1 fault	2 32	2 32	[PQ03]	human beings
	AES-128	1 fault	2 24	2 16	§9.4.2	improved tool
	Time complexity is measured in approximate encryption units.
	Memory complexity is measured approximately

  Consider the 32-bit value w[8..11]ẁ [12..15]. By the key schedule, we have:

	=	C[8..11] `C[12..15] `k0 [12..15].	(9.1)
	Following the linearity of MixColumns, we obtain that:

w[8..11] `w[12..15] = C[8..11] `C[12..15] ` k 1 [8..11] `k1 [12..15] z[8..11] `z[12..15] = M C -1 (w[8..11]) `MC -1 (w[12..15]) = M C -1 w[8..11] `w[12..15] . (9.2)

  11] `w[8..11] = C[8..11] `MC(z[8..11]) = C[8..11] `MC a, S(P [13]

  Online phase: once the values of P, C are known, and for each guess of k 1[4..7], compute the value (∆ 1 , ∆ 2 , ∆ 3 ∆ 4 ), and obtain from the precomputed table the corresponding values of (a, b). Then deduce the subkey bytes k 0

1 and ∆ 2 . Store the pair (a, b) in a data-structure (typically an array of linked lists, or a hash table) indexed by (∆ 1 , ∆ 2 , ∆ 3 , ∆ 4 ). It turns out that the maximal number of solutions for given values of (∆ 1 , ∆ 2 , ∆ 3 , ∆ 4 ) is 12, and the average number is 1. Hence, we can construct a table of the solutions in 2 32 time and 2 32 memory.

  keys.

					9.6. Differential Attack on 6-Round AES
	∆x 1	∆x 2	∆x 3
	SB,SR	SB,SR	2 32	SB	2 32	SR,MC
	MC,ARK	MC,ARK	differences		differences	ARK
					∆y 3	∆x 4
	128

  108.5 plaintexts P i under the unknown key, and denote the corresponding ciphertexts by C i .2. Insert (Pi , C i ) into a hashtable indexed according to bytes 1-4,6-9,11-14 of P i and bytes 1-6,8,9,11,12,14,15 of C i , and consider only the colliding pairs in the hash table (which are the only pairs which may be right). The number of remaining pairs is 2 216 • 2 -192 = 2 24 .

  designed in 2001 by Courtois, Goubin and Patarin, is famous for having been considered by the NESSIE consortium to be suitable for signature in constrained environments. It is essentially the original C * with a crucial tweak that prevents Patarin's attack. SFLASH has been very badly broken in 2007 by Dubois et al. [DFS07, DFSS07

Table 11 .

 11 1: First 8 numbers in our "usual" Gray Code.

		GrayCode (i)
	0	000
	1	001
	2	011
	3	010
	4	110
	5	111
	6	110
	7	100
	8	101

  ii) State.x = x 0 `(GrayCode(State.i) k 0 ). iii) Next(State).i = State.i + 1.Algorithm 11.1 Main loop common to all enumeration algorithms.

for increasing values of i. Next(State) advances to the next value and updates State. Three values can be directly read from the state: State.x, State.y and State.i. These are linked at all times by the following three invariants: i) State.y = f (State.x) 1: procedure Zeroes(f ) 2:

  11.3 Moebius Transform algorithm. Require: Input truth table of the boolean function f , with 2 n entries Ensure: Overwrites the input with Moebius transform of f .

1: for i from 0 to n -1 do 2:

  7. The algorithm allocates

	d-1 i=0	n i	bits of internal state and	n d	bits of constants

Numerical Results. For instance, to enumerate 64 quadratic polynomials in 64 variables simultaneously, 520 bytes of internal state and 16128 bytes of constants are needed. For the Hamsi algebraic attack, where 62 degree-6 polynomials in 32 variables are enumerated, 1.8 Megabytes of internal state and 6.7 Megabytes of constants are required.

Table 11

 11 .2 shows how the algorithm can be run with 4 threads and obtain the number of non-broadcasts advertised The most prevalent SIMD (single instruction, multiple data) instruction set today is SSE2, available on all current Intel-compatible CPUs. SSE2 instructions operate on 16 architectural xmm registers, each of which is 128-bit wide. We use integer operations, which treat xmm registers as vectors of 8-, 16-, 32-or 64-bit operands.

	11.7 Implementations
	11.7.1 A Brief Description of the Hardware Platforms
	Vector Units on x86-64.

Table 11 .

 11

				Arch. Name	cost	(#used)	budget
	1217	2686	2.2	K10	Phenom 9550	$120	4(1)	$54,000
	1157 142	1992 240	2.3 2.3	K10+ Opteron 2376 K10+ Opteron 2376×2 $368 $184	4(1) 8(8)	$113,316
	780	1364	2.4	C2	Xeon X3220	$210	4(1)	$60,720
	671 179	1176 294	2.83 C2+ 2.83 C2+	Core2 Q9550 Core2 Q9550	$225 $225	4(1) 4(4)	$55,575
	761 95	1279 154	2.26 Ci7 2.26 Ci7	Xeon E5520 Xeon E5520×2	$385 770	4(1) 8(8)	$78,720
	41	73	1.3	G200	GTX 280	n/a	240	n/a
	21	36	1.25 G200	GTX 295	$500	480	$15,500

Table 11 . 4

 114

	1.26 1.50 2.2 K10 Phenom9550	0.98 1.32 2.3 K10+ Opteron2376	0.70 0.93 2.4 C2 Xeon X3220	0.71 0.94 2.83 C2+ Core2 Q9550	0.62 0.89 2.26 Ci7 Xeon E5520	4.82 17.95 1.296 G200 GTX280	4.57 15.97 1.242 G200 GTX295
	0.57	0.57	0.40	0.41	0.37	2.72	2.69
	1.27 1.43	0.98 1.31	0.70 0.94	0.71 0.94	0.65 0.91	4.62 17.94	4.62 15.54
	0.57	0.57	0.40	0.41	0.38	2.69	2.70
	1.41	0.91 1.32	0.65 0.95	0.66 0.96	0.66 1.00	4.66 15.01	4.90 14.76
		0.57	0.40	0.40	0.50	2.87	2.93

: Efficiency comparison: cycles per (F 2 ) n -vector tested on one core Chapter 12 "Isomorphism of Polynomials" problems

Table 13 .

 13 1: Practical performance of the Gröbner basis algorithm, using MAGMA's F 4 .

	time (s)

  , x 2 , . . . , x i-1 ) ∈ C 1,2,...,i-1 and x i ∈ C i do

	9:	C 1,2,...,i ← ∅	Compute C 1,2,...,i
	10: for all (x 1 11:

13 :

 13 C 1,2,...,i ← C 1,2,...,i ∪ {(x 1 , x 2 , . . . , x i )}

	14:	end for
	15:	end for
	16:

  Table 13.3: Projected complexity of the Columnwise Sieve on the challenges.

		7	7	1	cubic	2 24
		16 6 2 16 7 6 quadratic	2 27 2 22
		16 6	3
	Affine inhomogeneous	3 10 3 2 16 8	quadratic	n.a.
		2	8	2
	Table 13.2: Parameters solved in practice in [GMS03]. Our reasoning does not cover the affine variant of
	the algorithm.
	challenge n	q	u predicted complexity
	A 1	16 2	2	2 52.9
	A 2	20 2	2	2 72
	A 3	32 2	2	2 135
	B 1	6 16 2	2 26.6
	B 2	8 16 2	2 35
	B 3	12 16 2	2 51.6
	C 1	16 2	1	2 69.9
	C 2	20 2	1	2 93
	C 3	32 2	1	2 168.3
	D 1	6 16 1	2 26.6
	D 2	8 16 1	2 35
	D 3	12 16 1	2 58.2

Table

			resolution time (quadratic) projected resolution time (cubic)
	2	70 70
	2 2	70 65 70 60	10s	poly.	5min
	2	70 55
		60 60	0.2s	poly.	10s
		60 55 60 50	2min	2 9.5 2 26.5	1h
	257 50 50	0.2s	poly.	10s
	257 50 45	3min	2 40	6h

  . Simultaneous Equivalence of Quadratic Forms

		1			product of two random symm. mat
							random matrix
		0.1
	Experimental Probability	0.0001 0.001 0.01
		1e-05
		1e-06
		13	31	33	35	37	55	57	59
					Dimension

Table 15 .

 15 1: Experimentally observed probability that dim V = 2n under the condition that the pencils are regular. The experiment involves one million random trials.

	15.3. Analysis for even q

Table 15 .

 15 The results are shown in table15.1, and lead us to state the following conjecture: 2: Number of linearly independent equations in S quad , in the most favorable cases (i.e., it can sometimes be less).

	15.5. Implementation and Practical Results

Table 15 .

 15 3: Complexity of computing a Gröbner basis of the ideal spanned by S quad and S quad .

Table 17 .

 17 1: Probability that the pencil-based algorithm succeeds on random instances.

		2	3	4	5	6	7	8	16	256	65536
	P nice	0.610 0.703 0.765 0.808 0.838 0.860 0.877 0.937 0.996 0.999985

Table 18 .

 18 2: Experimental results on Branching-QMLE 18.4.6 Practical Results.

	1

Table 19 .

 19

	Parameter set	A	B	C	D	E
	block size (bits)	256	134	97	232	236
	q	256	4	2	256	16
	n	32	67	97	29	59
	deg f	131072	131072	128	131072	131072
	coefficients of f in	F 256	F 4	F 2	F 2	F 2
	S and T	linear	linear	linear	affine	affine
	coefficients of S, T in	F 256	F 4	F 2	F 2	F 2
	Terms in f	10	54	29	10	21
	size of PK (bits)	143'616	314'364	461'138	13'485	107'970
	IP		polynomial		≈ 1s	≈ 4 weeks
	Interpolation of g (once)	79s	30 min	140 min	51s	23min
	Gröbner	7h	1 day	1 week	45s	3h
	Variables / Equations	136 / 593 322/4947 423/10028	124 / 494	253 / 1889
	Memory required	2.1Gbyte	45Gbyte	180Gbyte	350Mbyte	13.9Gbyte
	Order Change	15s	30 min	4h	0s	30s

1: Timings for the Attack

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Présentation de mes Travaux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

We note that although it makes sense to play a distinguishing game between a block cipher where the key is randomly chosen and a random permutation, it does not make sense to play a distinguishing game between a particular block cipher and the ideal cipher...

it is standard to assume that the time complexity of a program includes the time of reading a full description thereof, for instance to load it into memory prior to execution. Thus, an adversary with an exponentially large description has an exponential complexity.

More precisely, they proved that there exist information-theoretic adversaries issuing a small number of queries to the fixed permutation

We find this name somewhat unfortunate, but since it has been adopted we keep using it. We assume it has something to do with "Lucy in the Sky with Diamonds", as nothing else explains this name.

We note that this claim is not necessarily true when the message is long and there are collision between the various chaining values. However, as this has a non-negligible probability only when ≥ O(2 n/2 ), we allow ourselves to disregard such very long messages.

When R sends its query (M, K) to A H , we choose a uniformly random integer i ∈ {0, . . . , } (this will be the connection point), and we use the suffix-clonability property of the mode of operation to generate a different message M = M satisfying the conditions of definition 7.2.

We evaluate H f (M ) in a special way. On the first i -1 iterations we use Algorithm 7.2 in place of f . On the i-th iteration we program f so that f (x i ) = h i , thus "connecting" M to M in iteration i.

We return M as the answer of A H to the reduction, and keep simulating f .

Gröbner Bases will be discussed more in-depth in part III

no pun intended

We note that this step can be performed only if the differences in all S-boxes are non-zero. However, since in the known plaintext attack model it is common to assume that the plaintexts are chosen at random, it is expected that two known plaintexts have non-zero difference in all the 16 bytes with probability (255/256)16 = 0.939.

We then seek to extend this procedure to x 0 [2] and x 0[3]. To this end, we still use Property 9.6, equation ii): z 1[4..7] `z1[8..11] = z 0[8..11] `MC -1 x 1 [8..11] `C[4..7] `C[8..11] , (♣)

We note that in this subsection we use notations which are somewhat different from the notations in the rest of the paper, in order to be consistent with the reference[START_REF] Derbez | Rapport de Stage[END_REF], in which this improvement is described in detail.

we extend our notation for the linear span to the "ideal" span.

By the way, Buchberger named the objects computed by his algorithm algorithm after his advisor Wolfgang Gröbner

While this apparently contradicts the fact that the problem is decidable in EXPSPACE, the contradiction is only apparent. In the model of space-bounded computation, an exponentially-space-bounded Turing machine is allowed to take doubly-exponential time to write a result of doubly-exponential size to the output tape, while using only a simply exponential working memory.

no competitive implementation of F 5 is publicly available

in reference to[START_REF] Wolpert | No Free Lunch Theorems for Optimization[END_REF]

A General Method for Quadratic PLE: Matrix Pencils

A quick reminder on elementary divisors is available in §10.1

more precisely, generically non zero.

Patarin, Goubin and Courtois actually pointed out that this is cheating.

i.e., non-isomorphic

unsuccessful, as far as we understand

and F 1 with the Frobenius, and obtain a new solution.

Remerciements

Part Two

Computer-Aided Cryptanalysis of Byte-Oriented Primitives

where: a = q n+1 + q n+s+1 -q s+1 b = q n+1 + q n+1+s -q s g(n, k, s) = q kq s q k -1 q n+s+1 -q n+s+2 -q k+s + q n+k+1 + q n+k+s+1 q 2k (q n+1 -q k ) T (n, k, s)

The point is that summing ( ) over k = s, . . . , n -1 yields:

a (E n+1 -T (n + 1, n + 1, s) -T (n + 1, n, s)) -b (E n -T (n, n, s)) = g(n, n, s) -g(n, s, s)

At this point, it is easy to find that g(n, s, s) = 0, and we check (using a computer algebra system!) that:

g(n, n, s) + a • (T (n + 1, n + 1, s) + T (n + 1, n, s)) + b • T (n, n, s) = 0 Thus, we have established that:

Thus, if the result holds at rank n, then it also holds at rank n + 1.

Variance of the Cardinality of the Kernel. Using the same proof technique, we also obtain the variance of the cardinality of the kernel of a random endomorphism conditioned to vanish on a fixed subspace.

Lemma 10.21. Let f be a uniformly random endomorphism of (F q )

n , vanishing on a subspace F of (F q ) n , with dim F = s. Then the variance of the cardinality of its kernel is:

q s (q -1) 1 -q s + 1 q n + q s q 2n

Before giving the proof, we observe that coupled with lemma 10.20, this result enables the use of Chebychev's inequality: the probability that the kernel of a random endomorphism known to vanish on a subspace of dimension s is quite concentrated around q s . Proof. We will use the same proof technique. The variance is:

q n(n-s) q 2k Un -q s + 1 -1 q n-s 2 We will first demonstrate by induction on n ≥ s that:

U n = q 2s + 1 + (1 + q) q s -1 q n-s -1 q n-2s + 1 q 2n-1-2s (♣)

When n = s, we should have U n = q 2n , and looking at (♣) carefully reveals that our expression of U n simplifies to this value. Let us therefore assume n > s, and let us again denote by T (n, k, s) the hairy term under the sum. It is again a q-hypergeometric term, and running the q-analog of Zeilberger's algorithm yields:

where: a = -q n+s+2 + q s+1+2n + q 1+2n + q 2s+2 -q 2s+n+1 -q s+1+n -q 2s+2+n + q 2s+2n+1 + q s+2+2n b = -q 1+2n + q n+s -q s+1+2n + q s+1+n -q 2s + q 2s+n+1 + q 2s+n -q 2s+2n+1 -q s+2+2n

g is a complicated term with a singularity when n + 1 = k. We again notice that g(n, s, s) = 0 and that:

So that summing ( ) over k = s, . . . , n -1 and exploiting the previous equation yields:

By induction hypothesis, (♣) holds at rank n. Plugging the expression of U n into this recurrence relation and simplifying shows that (♣) holds at rank n + 1 -please use a computer algebra system if you really want to verify this. Moving back to the expression of V n , it is not difficult to verify that the result of the lemma holds. Table 12.2: Patarin's challenges [START_REF] Patarin | Hidden Fields Equations (HFE) and Isomorphisms of Polynomials (IP): Two New Families of Asymmetric Algorithms[END_REF], along with the corresponding key-sizes for the identification scheme of section 12.1.2.

Challenges

We have identified three pre-existing algorithms for QFSE [START_REF] Perret | A Fast Cryptanalysis of the Isomorphism of Polynomials with One Secret Problem[END_REF][START_REF] Levy | Polynomial Equivalence Problems and Applications to Multivariate Cryptosystems[END_REF][START_REF] Geiselmann | An Attack on the Isomorphisms of Polynomials Problem with One Secret[END_REF], and two algorithms for QMLE [START_REF] Patarin | Improved Algorithms for Isomorphisms of Polynomials[END_REF][START_REF] Faugère | Polynomial Equivalence Problems: Algorithmic and Theoretical Aspects[END_REF]. We survey all of them in chapter 13. Unfortunately though, comparing these algorithms based on their theoretical features is close to impossible. Some may fail with a given probability, while the others always succeed, but with uncertain complexity. Their inventors sometimes identified classes of instances that their algorithm solve efficiently (i.e., in polynomial-time), but it is not always the case, and more often than not is just an empirical observation. Besides, these classes do not really intersect.

The authors of PLE algorithms thus measured the efficiency of their techniques in practice, by trying to break wider and wider ranges of parameters (except for the authors of [START_REF] Patarin | Improved Algorithms for Isomorphisms of Polynomials[END_REF] who did not measure the efficiency of their algorithms in practice). Patarin did the right thing by proposing concrete challenges in [START_REF] Patarin | Hidden Fields Equations (HFE) and Isomorphisms of Polynomials (IP): Two New Families of Asymmetric Algorithms[END_REF]. He did not provide actual instances, but he specified several parameter sets that he believed were more and more secure. These challenges can be used as milestones to measure the progress accomplished since their introduction. The corresponding parameter sets are shown in Table 12.2.

A few words of commentary. The QFSE/CFE challenges use the smallest number of polynomials that makes sense, which seems to make the problem as hard as is gets. The QMLE challenges have affine transformations S and T , which makes them belong to the hardest class of the problem. They were designed to require a workload of at least O (q n ) operations. To illustrate the difference in behavior between homogeneous and inhomogeneous instances, we will consider linear inhomogeneous variants of the challenges, and we will denote them by A 1 , B 1 , . . . These challenges were apparently designed, 15 years ago, to provide a security level of roughly 2 64 elementary operations. According to Moore's law, the available computing power has been multiplied by about 1000 since that time. These challenge are therefore legacy challenges (let us denote them by A 1 , B 1 , etc). It would make sense to increase n by at least 25%, to form updated challenges (A 2 , B 2 , . . . ), and to even double n to form safer challenges (A 3 , B 3 , . . . ). Some of these challenges could be broken by the algorithms published prior to this work, however, the authors of the corresponding papers did not realize it, or did not advertize it. These challenges are marked with a dagger ( †) in the table. This section is devoted to the aglorithm described by Perret in [START_REF] Perret | A Fast Cryptanalysis of the Isomorphism of Polynomials with One Secret Problem[END_REF]. We call it the "Jacobian Algorithm", since one of its distinctive features is that it makes use of Jacobian matrices. This algorithm clearly improves on its predecessors, since it terminates in time polynomial in n, under the condition that u ≈ n. We first recall the definition of Jacobian matrices. Definition 13.1. Let f : (F q )

n → (F q ) u be an arbitrary function. The Jacobian matrix of f is the u × n matrix:

where ∂f ∂x1 denotes the usual high-school "Calculus I" derivative.

The following result is a generalization to the multivariate setting. Lemma 13.2 ( [Per05], theorem 1). For all x ∈ (F q ) n , we have:

A particularly interesting consequence is that evaluating the Jacobian matrix on the null vector does not require prior knowledge of S, and yet yields u • n linear equations on the entries of S:

Intuitively, it is visible that if u = n then this nearly completely reveals S. More precisely, it does reveal S if the Jacobian matrix is nonsingular. In fact, J a (0) is exactly the matrix formed by the coefficients of the linear terms in a, thus it is fully random if a is random. Therefore when u = n, the probability that equation (13.5) completely specifies S is λ(n) (cf. §10.7) . Therefore, bigger values of q makes it more likely to be able to terminate in polynomial time when u = n. We remark that, as usual, nothing comes for free when a is homogeneous: in that case, the entries of its Jacobian matrix are also homogeneous, and thus J a (0) is... the null matrix. Now, let us turn the idea of using the Jacobian matrix into a full algorithm. The approach described in [START_REF] Perret | A Fast Cryptanalysis of the Isomorphism of Polynomials with One Secret Problem[END_REF] is to find relations y i = S • x i on S, and then use lemma 13.2 to obtain • u • n additional linear Conjecture 15.2. When q and n are even, then:

To conclude, we assemble the pieces:

So, the best we can hope for, dim V = 2n, hopefully happens frequently.

Solving the Quadratic Equations

L'ignorance qui se sait, qui se juge et qui se condamne, ce n'est pas une entière ignorance : pour l'être, il faut qu'elle s'ignore soi-même.

Essais, Montaigne

If a and b are represented by upper-triangular matrices A [1] , A [2] , B [1] and B [2] , then following what we did in §14.5, we let M [i,r,t] = t S [r] × A [i] × S [t] , and we find out:

Observe that the equations can be obtained by dispatching the coefficients of the M [i,r,t] matrices, so that these equations be computed in time O 2 • n 3 , and we argued that this is O n 5 with high probability. It follows from the previous reasonings that there are essentially three different scenarios to discuss: a) q odd, ≈ n b) q even, n even, ≈ 2n c) q even, n odd, ≈ n + 1

In all these cases, S quad should be composed of n(n + 1) quadratic equations in O (n) variables, and we would expect to be able to solve this very overdetermined system of quadratic equations either by plain linearization, or via a very quick Gröbner basis computation. This implicitly assumes that the quadratic equations in S quad and S quad are linearly independent, but it makes sense to challenge this crucial assumption.

And this assumption turns out to be plainly false. In all cases, there are in fact only O (n) linearly independent equations in S quad + S quad , as Table 15.2 shows. This means that we cannot argue that solving these equations is doable in polynomial time. An explanation of this phenomenon has eluded us so far. In particular, we have not been able to directly determine a basis of the vector space spanned by the equations.

However, when q is odd, it seems that in most cases, the linear spans of S quad and S quad are equal. When q is even, these are two distinct linear spaces. Fully understanding this phenomenon is a fascinating subject for future work.

If the quadratic equations in S quad + S quad were semi-regular, then solving them would be plainly exponential. We note that even in this (pessimistic) setting, then our algorithm would still outperform all its predecessors.

Fortunately, the equations in S quad + S quad are much easier to solve than semi-regular equations. When n is small enough, then the Gröbner basis computation would be feasible even with semi-regular equations. However, when q is small, the maximal degree reached by polynomials during the Gröbner basis computation is unexpectedely small. Table 15.3 shows the corresponding complexities. For instance, when q = 2 and n = 128, we are solving a system of 256 quadratic equations in 256 variables over F 2 . When the equations are random, this is completely infeasible. In our case, it just takes 3 minutes! We have no clear explanation of this phenomenon. It appears that many linear equations appear in the first steps of the Gröbner basis computation, thus reducing the complexity of the whole process dramatically.

Chapter 16 Equivalence of Cubic Forms

This chapter presents an algorithm for the equivalent cubic forms problem. It is inspired by the method of the previous chapter, that cannot apply when polynomials are cubic. The original idea was found by Ludovic Perret while discussing the algorithm of the previous chapter. Later on, Ludovic Perret and Jean-Charles Faugère proved the main theorem. The results of this chapter, along with those of the previous one, were published at PKC'11 [START_REF] Bouillaguet | Practical cryptanalysis of the identification scheme based on the isomorphism of polynomial with one secret problem[END_REF].

In this chapter, we focus on the case where a and b are composed of a single cubic polynomial:

and we are promised that there exist an (unknown) invertible n × n matrix S such that:

The problem is to recover S given a and b. The techniques developed previously for the quadratic case unfortunately cannot be directly applied in this setting. Indeed, cubic forms are no longer represented by matrices. However, it is still possible to define an equivalent of the polar form:

This yields a symmetric "biquadratic" form (of total degree 3). There are no easily available matrix involving S here. However it is fairly obvious that for all vectors x and y:

Applying the Gröbner-based algorithm to this equation does not result in anything better than applying it directly to (16.1). However, if we set y = S -1 • z, then we find:

This equation is more interesting than the previous one, because the coefficients of S and S -1 occur with degree 2. Identifying coefficient-wise both sides of (16.2) results in n 3 + n 2 quadratic equations in 2n 2 variables, to which we could add 2n 2 quadratic equations expressing the fact that S -1 is both the left-and and right-inverse of S. More formally, let R be the ring F q [s 1,1 , . . . , s n,n , u 1,1 , . . . , u n,n ]. We consider the algebra A s of all n × n matrices over R. Let S = (s i,j ) and U = (u i,j ) in A s be symbolic matrices. We denote by I a,b the ideal generated by all the coefficients in R of the equations:

A possible solution is to directly compute a Gröbner basis of I a,b . Under the (debatable) assumption that the equations spanning I a,b form a semi-regular sequence, the degree of regularity (and the projected complexity) can be derived from the results of §10.5. From fig. 16.1, it seems that the complexity of this Gröbner basis computation is of order O (8 n ), which might be feasible for small values of n. Indeed, for q = 16, n = 5, computing a Gröbner basis of I a,b terminates in degree 3, after 6s of computation. When n = 6, the computation also terminate in degree 3, and takes 411s. When n = 7, it requires 17630s, uses 3GB of RAM, and still terminates in degree 3. However, when n = 8, after echelonizing a 555 829 × 355 546 matrix for a couple days, the Gröbner basis computation started crunching degree-4 polynomials, and died after using the 74Gbytes of available RAM.

Since y = 0, we again assume w.l.o.g. that y n = 0. This time, we find that a necessary and sufficient condition for D y f = M is:

These values are chosen to satisfy equation (17.5) for 1 ≤ i < n. We readily verify that (17.5) holds even when i = n, because M vanishes on y:

To summarize, the f ij can again be chosen arbitrarily for j < n, while the f in are determined by the choice of the others.

Back to our pencil regularity problem, lemma 17.2 tells us that D x b is uniformly distributed amongst the matrices that vanish at x. To obtain a tighter lower-bound on the probability that the pencils are regular, we observe that if b (1) + D x b is non-singular, then the pencil is regular. We will thus compute the probability that b (1) + D x b is non-singular when b (1) is singular. This probability is in fact given by lemma 10.27:

All-in-all we find:

And when n goes to infinity, we find:

This improved bound seems better than the one we derived in the odd case. This is not very surprising, as we did a somewhat deeper analysis, taking into account the interaction between the two matrices of the pencil.

Dimension of V. Under the assumption that the pencil is regular, we may as usual use theorem 14.3. However, we cannot use lemma 14.4 as in the odd case, because C = D x b × b (1) -1 is always singular (and thus not random). It is in fact still possible to use lemma 14.4, but we must first circumvent the singularity of C.

Theorem 17.3. Let p = P dim V ≤ n + 2 P is regular . Then p is greater than the probability that a random (n -1) × (n -1) matrix over F q is cyclic. Thus:

Proof. When P is regular, theorem 14.3 tells us that the dimension of V is the dimension of the commutant of C = D x b × b (1) -1 , and this dimension in turn only depends on the similarity invariants of C. Let P ∈ GL n (F q ) be such that P • e 1 = x, and define C = P -1 × C × P . By definition, C and C have the same similarity invariants, thus dim V is a function of C . Next, we claim that C is uniformly distributed amongst the matrices that have a first null column: lemma 17.2 tells us that D x b is uniformly distributed amongst the matrices vanishing at x. Because b (1) -1 is a bijection, then the product C is uniformly distributed amongst the matrices that vanish at x. The conjugation by P is a permutation of the set of matrices that transforms matrices vanishing at x into matrices with a null first column.

Let U be the (n -1) × (n -1) submatrix of C obtained by removing the first row and the first column. It is clear from the previous point that U is a uniformly random matrix (to which lemma 14.4 may be applied). Also, it is easy to see that CharPoly(C) = X • CharPoly(U ), and that MinPoly(U ) divides MinPoly(C).

if solution found then return (S, T ) end for return "Not Equivalent" end function

Distribution of the Rank of the Differential

In this section we study the distributions of the two families of random variables X i and Y i defined in the introduction of this chapter. It follows from lemma 10.19 (with s = 1) and lemma 17.2 that when q is even,

The X i and Y i have the same distribution because given any non-zero vector x, and any linear map L vanishing on x, the number of quadratic maps f such that D x f = L is independent from the choice of x and L (as per lemma 17.2).

Correlation between the X i 's

If the X i were independent, we would have

It is unfortunately not the case, and the bias comes from the symmetry of the differential: x i ∈ ker D xj f is equivalent to x j ∈ ker D xi f , and therefore the two random variables X i and X j are correlated. It is nevertheless possible to compute the joint distribution.

Lemma 18.4. When q is a power of two, then for all r, s ∈ [1; n]:

1 -q r + q s -2q q nq + q n q nq • q r+s -q r+1 -q s+1 + q 2 q nq

Proof. The proof proceeds in two steps. First, we claim that if x = y are both non-zero, then the distribution of (dim ker D x f , dim ker D y f ) when a is random is the same as the distribution of (dim ker L, dim ker L ) where (L, L ) are random linear maps such that L(x) = 0, L (y) = 0 and L(y) = L (x). This assertion is in fact demonstrated in [START_REF] Dubois | An efficient provable distinguisher for hfe[END_REF] (and it is lemma 12 in [START_REF] Dubois | Cryptanalyse de Schémas Multivariés[END_REF]). Next, we determine the distribution of (dim ker L, dim ker L ) where (L, L ) are random linear maps such that L(x) = L (y) = 0 and L(y) = L (x). First of all, there are q n(2n-3) such pairs (L, L ). It remains to count the number of pairs satisfying the rank conditions. Recall from §10.7 that we denote by D(n, k, s) the set of all n × n matrices with a kernel of dimension k containing a fixed subspace of dimension s.

We first observe that there are D(n, r, 2)•D(n, s, 2) pairs such that both L and L vanish on both x and y. Next, we count the pairs such that L(y) = L (x) = 0. The first member of the pair can be chosen arbitrarily as long as it is of rank r, that L(x) = 0 and that L(y) = 0. There are therefore D(n, r, 1) -D(n, r, 2) possible choices. For L , the image of L on x is fixed, therefore only a fraction 1/(q n -1) of the matrices with rank s vanishing on y and non-vanishing on x are admissible.

All-in-all this yields:

It follows from lemma 10.19, using easy q-binomial manipulations that:

This allows the "simplification":

Now, we know that P [X(x) = r] = D(n, r, 1)•q -n(n-1) . Therefore we find after some other manipulations:

1 -q r + q s -2q q nq + q n q nq • q r+s -q r+1 -q s+1 + q 2 q nq

Distinguishing the two distributions

The bias between the X i 's and the Y i 's seems quite small. To formalize this notion, we consider the following game, parametrized by an integer N :

1 We first note that given N = 1 sample, no adversary can do better than random guessing, because what she receives always has the same distribution. However, given N = 2 samples, an adversary can try to detect the eventual presence of a correlation between the two samples thanks to her knowledge of lemma 18.4. It is however possible to show that when N = 2, all adversaries only achieve a very small advantage over random guessing. To establish this fact, we build an optimal Neyman-Pearsons (maximumlikelihood) distinguisher D 2 between (X 1 , X 2 ) and (Y 1 , Y 2 ), and we upper-bound its success probability. It follows from lemma 18.4 that:

Proof. The generic expression of the success probability is given by:

Let us assume that D 2 receives the pair of integers (r, s). Taking into account the description of D 2 gives:

Exploiting the knowledge of b yields:

Now, exploiting the independence of the Y i , lemma 18.4, and the fact that the X i 's and Y i 's have the same distribution, we find:

To lighten the notational burden, let us write α = P [Y i = 1]. We thus have:

This can be further simplified into:

Using this identity, we obtain :

Factoring α and simplifying (a lot!) yields:

Lemma 10.19 tells us that α = λ(n)/λ(1) = λ(n) q q-1 . The announced result follows.

Justification of Conjecture 18.1 Building a provably efficient distinguisher between the two tuples (X 1 , . . . , X N ) and (Y 1 , . . . , Y N ) seems difficult. However, the distinguisher D 2 could be run on the N 2 pairs, and it seems plausible that the advantage of doing so would scale linearly with the number of pairs. In view of lemma 18.5, an advantage of order one should be achieved with q n pairs, and these can be obtained with N = q n/2 samples. However, processing the q n pairs should require at least q n elementary operations. Conjecture 18.1 relies on the idea that if even if the right amount of data is available, it cannot be processed in the limited amount of time allowed.

Sieving With Adjacent Vertices

In this section we discuss Algorithm 18.2. It is made of an auxiliary function, RankList and a main function Rank-QMLE. The function RankList(f , , k) generates by rejection sampling an -element random subset of (F q ) n composed of vectors x satisfying dim ker D x f = k. For the sake of convenience, let us define:

Thus, RankList(f , , k) returns a uniformly random subset of R k (f ) of cardinality . The main function, Rank-QMLE, first uses RankList to generate two random subsets U and V of R k (b) and R k (a) respectively (with k = n/3), of cardinality 2q n/3 . It then enumerates all the pairs (x, y) ∈ U × V , and checks whether y = S • x by building the corresponding inhomogeneous instance (a , b ) and sending it to an external IQMLE solver. The IQMLE solver will at some point return a (valid) solution as soon as there is a right pair (i.e., such that the relation y = S • x actually holds) in U × V . In the remaining of this section, we will first prove theorem 18.2 by showing that Rank-QMLE returns a correct pair (S, T ) when a and b are equivalent with probability greater than 1 -1/e ≈ 63%. We will then attempt to replace the generic IQMLE-Solver by Pencil-IQMLE (i.e., Algorithm 17.2). We will adapt Algorithm 18.2 accordingly, discuss the complexity of the resulting combination and present practical results.

Proof of Theorem 18.2 : Generic Analysis

When a and b are not equivalent, the derived inhomogeneous instance cannot have a solution, and thus Rank-QMLE always returns "probably not equivalent". When a and b are equivalent, on the other hand, Rank-QMLE will only find a valid solution if there is a pair (x, y) in U × V such that y = S • x.

The core idea the algorithm relies on is that equation (18.2) implies that the two linear maps D x b and D S•x a have the same rank. In other terms, for any k, the unknown (invertible) matrix S maps the elements of R k (b) to those of R k (a), which means that we may restrict our attention to one of the R k (a) for a well-chosen value of k. Another way of expressing the same idea would be to say that we restrict our attention to vertices of G a and G b having exactly q kq 2 adjacent nodes. x ← random element of (F q ) n 6: if solution is found then return (S, T )

19:

end for 20:

return "Probably not equivalent" 21: end function

The sets R k (a) form a partition of (F q )

n when k ranges across [1; n], and interestingly they have different sizes. By linearity of the expectation, we find that

and the distribution of the X i 's then gives us the expected cardinality of R k (•). If a is a random quadratic map, then:

It follows that when k = n/3, the expected cardinality of R k (a) is less than 2 • q 2n/3 (up to rounding errors). The two random subsets U and V defined in Rank-QMLE both contain √ 2 • q n/3 elements, and this is precisely the square root of the (upper-bound on the) expected size of R k (a).

Both U and V have more than |R k (a)| elements, and thus lemma 3.2 ensures that Algorithm 18.2 succeeds with probability greater than 1 -1/e (the blue balls are the images of the vectors in U by S, while the red balls are the vectors in V ).

Let us now complete the proof of theorem 18.2. We remark that U × V contains O q 2n/3 elements, so that the main loop invokes the external IQMLE solver O q 2n/3 times. It remains to show that determining U and V can be done with O q 2n/3 operations. Turning our attention to RankList, we first argue that as long as does not exceed |R k (f )|, then the number of iterations of the outer loop will be O ( ). Indeed, the inner-loop of lines 4-6 chooses a random vector x ∈ R k (f ), and "collisions" inside R k (f ) are unlikely before |R k (f )| random vectors are sampled. We also find that the number of iterations of the inner loop follows a geometric distribution of parameter |R k (f )|/q n ≈ q -n/3 , so that the expected number of iterations of the inner loop is O q n/3 . This means that in average each of the two invocations of RankList will perform O q 2n/3 matrix operations.

Specialization to Pencil-IQMLE

We now move on to replace the abstract and generic IQMLE-Solver of line 17 by our best candidate for the job, namely Pencil-IQMLE (Algorithm 17.2). This raises certain problems though. First of all, the inhomogeneous instances are not random, if only because the kernel of the linear component has dimension n/3. Note that this rules out the inversion-free to-n-fro algorithm, which would fail systematically. It is quite difficult to say anything meaningful regarding the performance of the Gröbner-basis algorithm of [START_REF] Faugère | Polynomial Equivalence Problems: Algorithmic and Theoretical Aspects[END_REF] on these special instances, but we have all reasons to believe that it would be slower than on random instances, even if we do not know by how much. We thus stick to Pencil-IQMLE, because it should be faster and we understand it better.

Still, the failure probability of Pencil-IQMLE should be much higher on these "low-rank" instances than on random instances. Some specific counter-measures have to be adopted, otherwise Pencil-IQMLE might fail on the probably-single right-pair of U × V , and the whole process would fail.

Sieving Using Whole Neighborhoods

In the remaining of this chapter, we assume that q = 2, and we investigate Algorithm 18.4, which is more efficient and more sophisticated. Note that we still use the notation q, as it helps distinguishing numerical constants depending on the size of the field and "accidental" ones.

Rank-QMLE used the rank of the differential as a discriminating function that could tell apart wrong pairs y = S • x. However, this discriminating function splits (F q )

n in only √ n classes, resulting in many false positives, and an exponential number of candidate pairs have to be tested. To improve on the previous approach, we seek a more precise discriminating function in order to partition the search space into exponentially many classes. A possible solution consists in exploring larger neighborhoods of G a and G b than the immediately adjacent nodes. However, representing this more complex topological structure is more difficult than just storing the number of neighbors. Our new discriminating function performs a radius-k BFS starting from a given node x, and generates the corresponding tree (assuming no cycle occurs and removing backwards edges). It has the following recursive definition, where the double-brace notation denotes a multiset:

After noting that Tree [k] can be evaluated in finite time for any given value of k, we claim that it can be used as a discriminating function.

Lemma 18.6. For all k ∈ N and 0 = x ∈ (F 2 ) n , we have Tree [k] (b, x) = Tree [k] (a, S • x).

Proof. We show by induction on k that Node [k] (b, x, y) = Node [k] (a, S • x, S • y), as this implies the result of the lemma. This is trivially true when k = 0, and when k > 0, equation (18.2) implies that ker D y b is transformed into ker D S•y a by S. This means that it is possible to write ker D y b = {u 1 , . . . , u } and ker D S•y a = {v 1 , . . . , v } such that v i = S • u i . Then:

In the definition of the second multiset, the condition

and the two multisets are in fact equal.

The purpose of the condition "z / ∈ x, y " in the definition of Node is to keep the multisets as small as possible without discarding relevant information. For instance, zero always belong to ker D x f , just because the kernel is a vector space, yet this does not help in discriminating (this is why zero was removed from the graphs). In addition, because the differential is symmetric, then y ∈ ker D x f implies that x ∈ ker D y f . Finally, since q = 2, we always have x ∈ ker D x a. We thus remove from the multisets values that we know would be here independently of a and b. It is equivalent to say that we do not record self-edges in G a and G b , that the graph is undirected, and that we do not want to follow "backwards" edges during the BFS. U ← TreeList a, q n/2 / √ n 15:

V ← TreeList b, q n/2 / √ n 16:

for all (x, y) ∈ P do if solution is found then return (S, T )

22:

end for 23:

return "Probably not equivalent" 24: end function

The connection between the nested multisets returned by Tree [k] and the trees resulting for locally breadth-first searching the graphs is that the nested multisets are naturally represented by unordered tree. For instance, { {∅, ∅ { {∅} } { {∅} } , { {∅, ∅, { {{ {∅} }} }} }} } is the tree of height 4 with 13 nodes shown in Figure 18.3 (with the convention that the root has height 0). We denote by Height the function that returns the height of a tree.

We say that a tree has a unique spine decomposition (or unique backbone decomposition) if there is a unique path starting from the root that reach a leaf of maximal height (this implies that there is a unique leaf of maximal height). We also say that a tree has a unique spine decomposition up to height k if there is a unique path starting from the root and reaching height k that extends to a path reaching nodes of maximal height. Figure 18.4 shows a tree with a spine decomposition up to a certain level. The predicate SpineDecomp(T, k) returns true if and only if the tree T admits a unique spine decomposition up to height k. Note that this predicate can easily be evaluated in linear time.

Algorithm 18.4 makes use of an auxiliary function, TreeList(f , ), which generates by rejection sampling

The fraction is equal to q 3 -q 2 + o(1/(n log n)), and given the expression of p n,3 as well as (18.11), the lower bound on α is equivalent to

PH n [at least one nephew at height i] ≥ P Y n n log n-i = q 3 -q 2 1 -(e n ) q 3 -q 2 -1

(1 -e q 3 -q 2 -1 )

Hence, since these two probabilities belong to ]0, 1[ for all n ≥ 3 and i ≤ n √ log n -1, and belong to a smaller interval of ]0, 1[ bounded away from 0 and 1 whenever n is large enough, this provides the existence of κ l , κ u ∈]0, 1[ such that for every n ≥ 3 and i ∈ {0, . . . , n

Now, let T n , T n be two trees of height at least n log n and such that their spine decompositions are unique under height n √ log n. For every i ∈ {0, n √ log n -1}, let γ n i (resp. γ n i ) be the indicator function of the event that all brothers of the i-th node of the spine have no offspring. It follows from the properties of the spine decomposition that for every n ≥ 3, {γ n i , 0 ≤ i ≤ n √ log n -1} form a family of independent random variables and by (18.12), we have

Comparing the absence or presence of nephews of the spine in T n and in T n , and defining the constant κ = max(κ l , κ u ) < 1, we obtain:

PH

18.4.5 Back to Algorithm 18.4: Proof of Theorem 18.3

Armed with theorems 18.8 and 18.10, we are ready to show that Algorithm 18.4 lives up to the expectations we expressed in theorem 18.3. Note that thanks to lemma 3.2, there will be a right pair in U × V with probability 1 -1/e, as claimed. We must still investigate the complexity of building U and V , and the number of pairs in P that will have to be tested.

Corollary 18.11. Let = √ 2/( √ n log n) • q n/2-1 , (x 1 , . . . , x ) and (y 1 , . . . , y ) be two collections of distinct vectors in H(f ). Define U i = Tree [n log n] (a, x i ) and V i = Tree [n log n] (b, y i ).

All the U i 's (resp. V i 's) are pairwise non-isomorphic with otherwheling probability. In addition, the U i 's are pairwise non-isomorphic from the V i 's with overwhelming probability.

Proof. Observe that the U i 's and V i 's are unlabeled and unordered trees sampled according to P H n and with spine decomposition up to height n √ log n. The number of collisions between the U i 's and the V i 's is

If all the U i 's are different 1 -it is a worst-case assumption-, then applying Markov's inequality to N and using theorem 18.10 yields:

Since κ < 1, then q n κ n √ log n converges to zero faster than the inverse of any polynomial, regardless of the value of q. The exact same reasoning shows that the U i (resp. V i ) are pairwise non-isomorphic with the same probability.

Corollary 18.11 is all we need to conclude the study of Algoritm 18.4. It shows that in TreeList all the trees selected by the inner loop will be pairwise non-isomorphic, so that the total number of iterations of the outer loop is O ( ). It also shows that with overwhelming probability only the right pairs will remain in P. As a last remark, note that P can be formed in time O q n/2 by various methods (hash-table, sorting, . . . ). This completes the proof of theorem 18.3, under the assumption that Tree [n log n] produces independent random trees.

List of Figures

Résumé

La cryptanalyse, anciennement l'art de déchiffrer les codes secrets, est aujourd'hui comprise dans un sens plus large, qui consiste à trouver toute sorte de défauts, des plus légers jusqu'au plus graves, dans des constructions cryptographiques. Cette thèse s'articule en trois partie, chacune consacrée à une famille de primitives cryptographiques.

Les fonctions de hachage sont généralement des constructions itérées, où une brique de base est utilisée de façon répétée, conformément à mode opératoire. En 2004, 2005 et 2006, l'apparition d'attaques génériques, visant spécialement le mode opératoire de Merkle-Damgård, le plus répandu, a suscité des propositions de modes opératoires alternatifs. Les attaques génériques exploitent principalement le fait que l'état interne des fonctions de hachage a la même taille que leur sortie, ce qui permet de trouver et d'exploiter des collisions internes. Nos résultats tendent à montrer que cette difficulté est difficile à lever, car nous parvenons à monter des attaques en seconde préimage contre des tentatives, parfois exotiques, de "réparer" la construction de Merkle-Damgård.

Dans une deuxième partie, nous nous intéressons à la cryptanalyse du système de chiffrement par bloc le plus répandu (l'AES). Nous nous plaçons dans un modèle assez restrictif où la quantité de paires clair/chiffré disponible pour l'attaquant est très faible. Cela nous condamne à étudier des versions fortement réduites de l'AES, mais cela rend les attaques obtenues plus facilement réutilisables dans d'autres contextes. Nous avons construit des outils automatiques pour nous assister dans la recherche d'attaques par test d'hypothèses partielles et d'attaques par le milieu. Ces outils ont découverts des attaques surprenantes, qui sont plus efficaces que celles qui avaient été trouvées manuellement par d'autres chercheurs. Nous obtenons ainsi la meilleure attaque connue contre la fonction d'authentification Pelican-MAC et contre le système de chiffrement par flot LEX.

La dernière partie de cette thèse est consacrée à la cryptanalyse de schémas multivariés, c'est-à-dire reposant explicitement sur la difficulté de résoudre des systèmes polynomiaux en plusieurs variables. Certains de ces schémas reposent aussi sur une autre hypothèse algorithmiques, la difficulté problème de l'Equivalence Linéaire de Polynômes (PLE). En combinant des outils de l'algèbre linéaire et de la géométrie algébrique avec des techniques statistiques et combinatoires, nous construisons de nouveaux algorithmes plus efficace pour PLE. Ceci montre qu'un schéma dont la sécurité reposerait sur PLE ne peut pas exhiber un niveau de sécurité optimal. Ces algorithmes permettent également de casser en pratique la variante "sous-corps" de HFE.

Abstract

Cryptanalysis, formerly known as the art of deciphering secret codes, is now understood in a broader sense: it consists in finding flaws of all kinds, either harmless or severe, in cryptographic constructions. This thesis is made of three parts, devoted to the study of different families of cryptographic primitives.

Hash functions are usually iterated constructions, where a building block is used in a repeated way, as specified by a mode of operation. In 2004, 2005 and 2006, the discovery of several generic attacks, targeting the ubiquitous Merkle-Damgård mode of operation, prompted researchers to design alternative modes of operations. Generic attacks exploit the fact that the internal state of the hash functions has the same size as the digests. This allows the attackers to find internal collisions and exploit them. Our results tend to show that this problem is difficult to avoid in general: in the first part of this thesis, we describe several generic second preimage attacks against proposals to repair or patch the Merkle-Damgård construction in order to precisely avoid generic attacks.

In the second part, we focus on the cryptanalysis of the AES, the most popular block cipher. We consider a somewhat restrictive attack model where the attacker only has access to very few plaintext/ciphertext pairs. We are thus condemned to attack only highly reduced version of the full cipher, but the attacks we find in this model can sometimes be reused in other contexts. We have built software tools to assist us in finding guess-and-determine as well as meet-in-the-middle attacks. These tools found surprising attacks that are more efficient than those found manually by other cryptanalysts. For instance, we find the best known attacks against the Message Authentication Code Pelican-MAC, and against the stream cipher LEX.

The last part of this thesis is devoted to the cryptanalysis of multivariate schemes. This label covers all the schemes whose security explicitly relies on the hardness of solving systems of polynomial equations in several unknowns. Some multivariate scheme also rely on another hardness assumption, namely the hardness of the Polynomial Linear Equivalence (PLE) problem. We build new algorithms to solve PLE problems by combining tools from linear algebra and algebraic geometry with combinatorial and statistical techniques. Our algorithms show that a multivariate scheme relying on the hardness of PLE cannot exhibit an optimal security level. These algorithms also allow to break in practice the "subfield" variant of HFE.