David Pointcheval

Bart Preneel

Ron Rivest

Amit Sahai

Ehsan Aerabi

Antoine Amarilli

A Elhadi Amirouche

Arash Atashpendar

Feng Bao

Hadrien Barral

Fabrice Benhamouda

Marc Beunardeau

Éric Brier

Romain Campigotto

Noémie Cartier

Jean-Michel Cioranesco

Simon Cogliani

Aisling Connolly

Jean-Sébastien Coron

Nathanaël Courant

Alix Desforges

Frédérick Douzet

Houda Ferradi

Éric Freyssinet

Aude Géry

Florentin Guth

Kavé Salamatian

Mirko Koscina

Georges-Axel Jaloyan

Paul Lenczner

Tancrède Lepoint

Kévin Limonier

Diana Maimuţ

David Mestel

Matthias Minihold

David Naccache

Rodrigo Portella Do Canto

Tomas Rigaux

Jérémy Robine

A W " Bill

" Roscoe

Răzvan Roşie

Martin Ruffel

Peter Y A Ryan

David Saulpic

Emil Simion

Assia Tria

Damien Vergnaud

Jean Vuillemin

Guilin Wang

Amaury De Wargny

Hang Zhou

Lionel Zoubritzky

Fabrice

Florian

Pierrick Rafael Geoffroy

Răzvan ; Céline

Damien Michel

David

Jérémie, Simon Marc

Aisling, Chanez, Petra Thibaut

Daniel J Berstein

Geoffroy Couteau

Carl Ellison

Becca Kreuter

Tanja Lange

Kristin Lauter

Christof Paar

Tom Roeder

Mike Rosulek

Eran Tromer

Hiba Koudoussi

Isabelle David

Fabrice Et Iain

Annie Et Aurélie

Weber

Zayer Denny

La sécurité de l'information repose sur la bonne interaction entre différents niveaux d'abstraction : les composants matériels, systèmes d'exploitation, algorithmes, et réseaux de communication. Cependant, protéger ces éléments a un coût ; ainsi de nombreux appareils sont laissés sans bonne couverture. Cette thèse s'intéresse à ces différents aspects, du point de vue de la sécurité et de la cryptographie. Nous décrivons ainsi de nouveaux algorithmes cryptographiques (tels que des raffinements du chiffrement de Naccache-Stern), de nouveaux protocoles (dont un algorithme d'identification distribuée à divulgation nulle de connaissance), des algorithmes améliorés (dont un nouveau code correcteur et un algorithme efficace de multiplication d'entiers), ainsi que plusieurs contributions à visée systémique relevant de la sécurité de l'information et à l'intrusion. En outre, plusieurs de ces contributions s'attachent à l'amélioration des performances des constructions existantes ou introduites dans cette thèse.

⊃ ⊃ × ∩ ⊗ ≥ ⊃ ⊃ ± ÷ ∩ ⊗ ⊗ > + = A B C D E F G H I J K L M N O P Q R S T U V W X Y Z • ? ! ± ∓ × ÷ † ‡ ∩ ∪ ∨ ∧ ⊕ ⊗ = < > ≤ ≥ ⊂ ⊃ Γνώμων vi

A brief prelude

While it is not the subject of this thesis to recall the long and convoluted history of Cryptology1,2 , it is important that our discussion starts with the pioneering work of Claude Shannon. Shannon gave in 1948 the first precise and quantitative definition of information as information entropy 3 -a concept measuring uncertainty, originally borrowed from Physics: a message bringing unexpected news carries much information, whereas a message that is completely predictable carries no information. In essence, for Shannon, Information measures the amount of surprise caused by receiving a given message.

Measuring information enabled Shannon to prove, for the first time, the security of a cryptographic system: it suffices to show that an adversary learns no information when eavesdropping. The ability to provide mathematical security guarantees is at the heart of modern cryptology and distinguishes its tools and methods from earlier approaches. We recall this result in modern language in Section 1. 5.

Incidentally, Shannon had met during his training as a cryptographer a young British mathematician named Alan Turing. Amongst the topics they discussed around a cafeteria table 4 , Turing presented to Shannon his work on precisely and quantitatively measuring computation. 5 The potential of automated computation in cryptology was not lost on Turing, who constructed the first ever code-breaking machine to attack the German E . 6The tireless effort of machines meant that they could try a vast number of combinations, until eventually the correct one was found. As a countermeasure, cryptographers used longer and longer secrets, increasing the number of possible combinations to be checked. But this came at a price: This long secret now had to be shared with whomever the intended recipient was. Notwithstanding the risks of interception or misuse (both of which happened), it meant that highly-sensitive material had to be transported, sometimes across the world, which is simply impractical. During the Cold War, the Washington-Moscow Direct Communications Link (better known as the "red telephone", although it never was a telephone) relied on diplomats from the respective embassies to carry around suitcases containing the one-time-use secret keys [START_REF] Kahn | The Codebreakers: The story of secret writing[END_REF].

This particular problem was solved in 1978 by Whitfield Diffie and Martin Hellman. Their solution is still in use today on the Internet, and consists in having a different key for the sender and the receiver. Techniques building on the same ideas are called asymmetric or public-key cryptography: The "public" key allows one party to encrypt a message; only the corresponding "private" key can decrypt this message. A large proportion (about 2/3) of this thesis is dedicated to public-key constructions, for which Section 1.3 provides a more technical introduction.

The potential of public-key cryptography was quickly realised, in terms of security guarantees and versatility; thus it quickly bred a vibrant ecosystem of solutions to a flurry of real-world problems. By the early 1980's, many encryption and digital signature schemes were developed, some of which are still considered standard today. As a result, despite its military origins, cryptography has now entered everyday life, enabling such technology as electronic payment, commerce and communication over the Internet, with a mathematical beauty of its own.

One of the perhaps most counter-intuitive uses of public-key constructions is the design of zero-knowledge (ZK) protocols: such protocols enable a prover to convince a verifier that some statement is true, without revealing anything more that this bare fact (i.e., the statement's truth). ZK protocols are still marginal as of today, but slowly infuse into the industrial world.

One downside of public-key cryptography is that it typically requires extensive computations, and is therefore relatively slow. While improvements in technology and algorithms (some of which we introduce in this thesis) boost the performance of public-key primitives, this sluggishness is unacceptable in many applications.

Therefore, in practice, public-key cryptography is chiefly used for key exchange, signature and identification, while more "traditional" symmetric ciphers are used to exchange messages confidentially. Symmetric, or "secret-key" constructions are order of magnitudes faster, and sometimes easier to implement; but their security is much harder to estimate. We will use secret-key primitives as "black boxes" -see Section 1.2 for a high-level overview.

Finally, all these constructions aim at protecting against some adversary, a virtual ennemy that may be more or less powerful, and who should always fail in the security game against us. These themesinformation, computation, performance, adversary -run throughout this thesis.

Secret-key cryptography 1.2.1 At the origins of cryptology

The need for protecting information predates history, and it is no surprise then that the first unquestionable indications of secret-key cryptographic usage date back to Antiquity. Controlling a vast and hostile territory, the Roman armies had to convey orders quickly and stealthily. After the failures of steganographic attempts -whereby one would hide the message somewhere the enemy wouldn't look, e.g., on the shaven head of a slave -military leaders had to make the message itself incomprehensible to their adversaries.

A famous early adopter (if not inventor) of cryptography is Roman general and emperor Julius Caesar. During the Gallic wars, as Cicero was held by the Nervii army, Caesar sent a Gaul messenger with a letter of encouragement. Writing in the third person, he describes: "Graecīs cōnscrīptam litterīs mittit, nē interceptā epistolā nostra ab hostibus cōnsilia cōgnōscantur." -[Cae17, Book V.48] That is, he had to write "in Greek letters", for fear that the enemy would intercept the letter and get acquainted with its contents. 7 That being said, it is not very likely that Caesar literally used Greek letters, for we know from Caesar himself [Cae17, Book I.29, Book VI.14] that the Greek characters were well understood in Gaul.

Many commenters pointed out Caesar's extensive use of ciphers, including a now-lost work of the grammarian Probus credited with writing a reference on the subject, On the Secret Meaning of the Letters Appearing in the Epistles of Gaius Caesar. According to Suetonius [START_REF] Suetonius Tranquillus | In: The Lives of the Caesars[END_REF], Caesar and later his nephew Augustus, used a rather simple method, known today as Caesar's cipher. To encode a message, instead of writing a letter from the alphabet, one writes the letter that is 3 places below in the alphabet. And to decode, "If anyone wishes to decipher these, and get at their meaning, he must substitute the fourth letter of the alphabet, namely D, for A, and so with the others" - [START_REF] Suetonius Tranquillus | In: The Lives of the Caesars[END_REF]p. 56] Visually, encryption proceeds as in Figure 1.1, replacing each letter from the original letter by another letter.

X Y Z A B C D E F G H I K L M N O P Q R S T V X Y Z A B C D E F G H I K L M N O P Q R S T V X Y Z A B C
Figure 1.1: Caesar's cipher, according to Suetonius, on the 23 letters of the Latin alphabet.

In the military realm, Caesar's cipher was still in use as late as 1915 [START_REF] Kahn | The Codebreakers: The story of secret writing[END_REF]p. 631]. Such codes, where one replaces a letter by another, or by a symbol, are appropriately called substitution ciphers. Variants of Caesar's cipher are ubiquitous, and can be found in many recreational problems -and some more serious cases. 8Another type of early cipher, rumoured to be of Spartan invention, is the scytale 9 (or skytale). It designates a large cylindrical rod, around which one winds a thin parchment strip. A message is then written on the parchment, which is subsequently unrolled. The message is decoded by the recipient simply by winding up the parchment around an identical scytale. Unlike substitution ciphers, this approach consists in shuffling letters, and therefore constitutes an example of transposition cipher. Such ciphers were still in ubiquitous use as late as the Second World War.10

Block and stream ciphers

All these constructions are called secret-key (or symmetric) because whoever can decode can also encode, using the same information and method. Historically, two main branches came out of these early constructions: refinements of Caesar's cipher, ultimately leading to the one-time pad (OTP, see below), and to modern stream ciphers; and combinations of substitution and transposition, of which E and modern block ciphers such as AES are examples.

The one-time pad is analoguous to Caesar's cipher, in that every letter's rank in the alphabet is changed. Unlike Caesar's cipher however, the shift varies for every position in the message. The shift for each position is the secret key that enables encoding and decoding. It is the cipher whose Shannon proved unbreakability, assuming that the key is random and used only once (hence the name: one-time pad). Using the same key twice immediately reveals information (or even the key itself, if a portion of the underlying message is known), a mistake that was made. 11 The one-time pad belongs to a large family of encryption techniques, known as stream ciphers; they allow the on-the-fly encryption of an unlimited stream of bits. Stream ciphers are thus particularly well-suited to telephony or digital content streaming.

Combinations of substitution and transpositions12 are called block ciphers: They operate on a fixedlength input. In 2000, after a three-year international competition, the United States National Institute of Standards and Technology (NIST) selected the Rijndael block cipher as its flagship Advanced Encryption Standard (AES). The design of AES, a topic in itself beyond the scope of this thesis, has received careful scrutiny and intensive review from the cryptographic community. AES is a substitution-permutation network, i.e., a combination of several rounds of transposition and substitution operations (see Figure 1.2). In this work, we will always assume that block ciphers behave as pseudorandom permutations, i.e., for a randomly chosen secret key k, block ciphers are functions E k which are indistinguishable from a randomly chosen permutation, and for which an efficient inverse D k = E -1 k exists. 13At the time of writing, all known attacks on AES do not compromise its security as an elementary building block, i.e., it is secure in the sense given above. However using AES is not in itself a guarantee of security, the same way that wearing a safety belt in a submarine does not prevent from drowning.

More generally, a secure block cipher is only suitable for the encryption of a single block under a fixed key. In practice, most messages are either shorter, or longer than a block. To encrypt such messages, we first pad them by adding bits until the message's length is a multiple of the blocksize; at that point we can slice the message m into block-sized pieces m 0 , . . . , m t-1 . Then one must specify how to encrypt each piece, the mode of operation.

For instance, one may encrypt each piece independently, a mode known as ECB 14 and depicted in Figure 1. 3. It turns out that this is not a secure mode of operation; indeed, each block is encoded independently with the same key. The result of trying to encrypt structured information with AES in ECB mode is illustrated in the middle part of Figure 1.6.

Alternatively, one may use the previous block's output to derive the next block's input, as in the CBC15 mode illustrated in Figure 1. [START_REF] Step | [END_REF]. The effect is to propagate any variation to subsequent blocks, and to randomise encryption by the choice of a random "initialisation vector" (IV). As a result, identical input blocks are encoded differently, as illustrated in the second part of Figure 1.6. In some scenarios however, the CBC mode can be abused by padding attacks, whereby an attacker uses a "padding oracle" to recover the message [START_REF] Vaudenay | Security Flaws Induced by CBC Padding -Applications to SSL, IPSEC, WTLS[END_REF]. Such an "oracle" tells the attacker whether a message padding is correct or not -such a scenario might seem far-fetched, but it has real-world consequences, as demonstrated by successful attacks on both hardware [BFK + 12] and Internet communications (POODLE attack against TLS 1.0 to 1.2). Furthermore, CBC's chaining mechanism is inefficient in hardware, as the previous block must be encrypted or decrypted before the next block can be processed.

E K m i c i D K c i m i
For these reasons, system designers may prefer using block ciphers in counter mode (CTR, Figure 1.5) or Galois counter mode (GCM), which are much faster and immune to padding oracle attacks. These modes rely on a cryptographic nonce, a "number used only once", usually (but not necessarily) chosen at random and transmitted along with the ciphertext.

Hash functions

New usages of cryptography also required the introduction of additional constructions, such as hash functions. Intuitively, a hash function takes some input m and returns a fixed-size output that is the "fingerprint" (or"digest") of m. Such functions have a ubiquitous use in Computer Science, for instance in the implementation of efficient data structures such as hash tables [START_REF] Knuth | The Art of Computer Programming, Volume III: Sorting and Searching[END_REF] and Bloom filters [START_REF] Burton | Space/Time Trade-offs in Hash Coding with Allowable Errors[END_REF].

In cryptography, hash functions are typically required to be "one way", in the sense that it should be hard, given some output, to recover a candidate input. Denoting by h the hash function, we thus define • Preimage resistance. Given y, it is hard to find x such that h(x) = y;

• Collision resistance. It is hard to find x, x such that h(x) = h(x );

E k c 0 m 0 IV ⊕ E k c 1 m 1 ⊕ E k c 2 m 2 ⊕ • • • E k c t-1 m t-1 ⊕ • • • D k c 0 m 0 IV ⊕ D k c 1 m 1 ⊕ D k c 2 m 2 ⊕ • • • D k c t-1 m t-1 ⊕ • • • Figure 1.4:
The CBC mode of operation for encryption (above) and decryption (below), uses a chaining mechanism and an initialisation vector (IV) which is transmitted in clear.

E k nonce i c i m i ⊕ E k nonce i m i c i ⊕ Figure 1.5:
The counter (CTR) mode of operation uses the block cipher's output as a keystream; in particular encryption and decryption use the same block E k , and an identical nonce transmitted in clear along the ciphertext.

Figure 1.6: Left: Original image; Middle: Image encrypted using AES-ECB with a random key; Right: Image encrypted using AES-CBC using a random key.

• Second preimage resistance. Given x, it is hard to find x = x such that h(x) = h(x ).

A solution to these tasks is always exists, although effectively finding it may require to exhaust a infeasibly large portion of all possible inputs/outputs. The term "hard" means essentially that no better strategy exists. 16Cryptographic hash functions were introduced in the late 1970's at a component of digital signatures [START_REF] Preneel | The First 30 Years of Cryptographic Hash Functions and the NIST SHA-3 Competition (Invited Talk)[END_REF]. The latest NIST international competition selected Keccak as its flagship Secure Hash Algorithm (SHA-3) after a complete break of NSA-borne SHA-0 [START_REF] Chabaud | Differential Collisions in SHA-0[END_REF], a substantial reduction of the security margin of SHA-1 to the point that practical collisions can be found [SBK + 17], and doubts about SHA-2 which is a very minor modification of SHA-1. Keccak was chosen after a 5 year process that ended in 2012, and is now referred to as SHA-3.

Keccak itself is constructed from a permutation f using the "sponge" construction (see Figure 1.7). 0 0 . . .

0 ⊕ f m 0 ⊕ f m 1 ⊕ f m 2 • • • • • • ⊕ f m t-1 f z 0 f z 1 f z 2 • • • • • • "absorb" "squeeze"
Figure 1.7: The sponge construction, at the heart of SHA-3/Keccak, relies on the iteration of a permutation f and of mixing with blocks of the padded message during an "absorb" phase. Output blocks are then extracted during the "squeeze" phase. In SHA-3/Keccak only one block is extracted.

While technically not "secret key" primitives, in that they are keyless, hash functions follow similar design principles and can be used to construct other secret-key primitives such as MACs, and can themselves be constructed from block ciphers.

Public-key cryptography

Even with secure block ciphers, used in secure modes of operation, the problem of generating, and sharing, a secret key between the emitter and the receiver remains. The key distribution issue bears on two aspects: first, one must ensure that these keys are not intercepted, stolen, or lost; second, the number of keys to be managed increases quadratically. As an example of the latter, assume that a group of n friends wants to communicate on a 1-to-1 basis; they need a unique key for each pair of individuals in the group, i.e. a total of n(n -1)/2 keys. For even a small-sized group of 10 persons, this requires the generation of 45 keys, with each individual storing several keys. Since users obviously cannot send their keys over an insecure channel, every pair would have to meet in person to decide and share each key.

The first proposed solution was devised in 1974 by Merkle [START_REF] Ralph | Secure Communications Over Insecure Channels[END_REF] and marks the mainstream17 beginning of public-key cryptography. Merkle makes use of small "puzzles", e.g. easy cryptograms that are meant to be solved reasonably quickly. Each of these puzzles contains an identifier and a key. When two persons -Alice and Bob, as is traditional -want to communicate using an insecure channel, they would play the following game:

• Alice and Bob agree on the total number N of puzzles.

• Bob generates N puzzles, {P 1 , . . . , P N }, each of which containing a unique identifier and a unique, randomly generated key. The collection pk = {P 1 , . . . , P N } is known as Bob's public key.

• Alice chooses a puzzle at random from this collection, and solves it. She recovers the identifier and key corresponding to that puzzle. She sends the identifier to Bob, and encrypts every subsequent communication with the puzzle's key.

• Bob receives the identifier and decrypts any subsequent communication with the corresponding key.

What is remarkable about this scheme is that all the communication happens on an insecure channel, which means that an eavesdropper -Eve, as per tradition -has perfect knowledge of all the exchanges between Alice and Bob. The only thing that Eve ignores is which puzzle Alice decided to solve; she only sees the identifier that Alice sends. To recover the secret key, Eve must therefore solve all the puzzles, until she finds the one containing this identifier. In other terms, the adversary is faced with a difficult problem despite knowing all communications. 18In attempting to solve a similar problem, Diffie and Hellman discovered the yet-unpublished work of Merkle. Their intuition was that the essential tool for constructing efficient public-key cryptosystems was a hard to invert problem. In the case of Merkle, the problem is that of recovering which puzzle was solved. Diffie and Hellman settled on a version of the following [START_REF] Diffie | New Directions in Cryptography[END_REF] : Definition 1.1 (Computational Diffie Hellman, CDH) Let G be a group, and g be a generator of G. Given g x and g y , compute g xy .

At the time of writing, the best approach to solving this problem is by using a solution to the following: Definition 1.2 (Discrete Logarithm Problem) Let G be a group, and g be a generator of G. Given y ∈ G, find x such that g x = y.

The discrete logarithm problem (DLP) is currently at the heart of a vast proportion of modern public-key cryptography.

Modern public-key cryptography. Fast-forward forty years, one can classify public-key constructions as:

• Key exchange protocols, whereby two players decide a new key together over an insecure channel, but such that channel eavesdroppers cannot learn the key.

• Identification or proof protocols, whereby an entity establishes its knowledge of a secret, without revealing this secret to either eavesdroppers or the verifier.

• Digital signature schemes, using which an entity can bind its identity to a message, a fact that is then publicly verifiable and furthermore guarantees the message's integrity.

• Encryption schemes, using which it is possible to confidentially send a message to a receiver over an insecure channel.

The rationale is that these constructions build from some "hardness assumption": a problem thought to be difficult to solve. The DLP is such a problem, but we discuss other possibilities below. Modern cryptography is characterised by the presence of mathematical proofs, which establish security against a variety of adversaries, capturing a large gamut of real-world scenarios.

Diffie-Hellman key exchange

The construction from Diffie and Hellman solves the key distribution problem by negotiating a shared, secret key, over an insecure channel. Their solution leverages the assumed hardness of CDH in a given group G with generator g:

• Alice chooses a secret random integer a, computes A ← g a and sends A to Bob;

• Bob chooses a secret random integer b, computes B ← g b , and sends B to Alice;

• Alice computes K a = B a . Bob computes

K b = A b .
At the last step, we have in fact K a = K b , since (g a ) b = g ab = (g b ) a . Thus Alice and Bob have agreed on a shared secret K = K a = K b , from which they can derive a secret key for further communication.

Diffie-Hellman key exchange is still by far the leading key negotiation mechanism used on the Internet and in most applications. Early implementations used finite fields to implement G, but as we discuss later on, doing so requires adequately large parameters, and popular modern implementations use for G the group of rational points of an elliptic curve instead.

In any case, textbook key exchange is vulnerable to so-called man-in-the-middle attacks, whereby an adversary intercepts messages between two entities, essentially establishing a secure channel with each of them (but not between them directly), unbeknownst to both of them. To prevent such attacks, conversations must be authenticated, for instance by the use of digital signatures.

Digital signature schemes

A digital signature scheme is a collection of four algorithms S = (Setup, KeyGen, Sign, Verify).

The Setup algorithm takes a unary representation 1 κ of the expected security parameter κ, and computes by scaling them appropriately the sizes and other parameters necessary to ensure the scheme's security. KeyGen generates a key-pair (sk, pk); the user then keeps the secret (or signing) key sk, and reveals the public (or verifying) key pk to everyone. The Sign algorithm uses a message, and the secret key, to output a signature σ. The Verify algorithm takes a signature σ, a message, and a public key, and confirms or denies whether this particular signature is valid for this message with respect to this public key. Mathematically, Verify(pk, m, Sign(sk, m)) = True, with (sk, pk) ← KeyGen(Setup(1 κ )).

The main concern about signatures is forgery, i.e. a signature that is accepted by the verifier, but was generated by an adversary, without using the secret key. Since signatures are by nature public, adversaries can generally access a vast quantity of message-signature pairs; in some scenarios they can even ask their targets to sign well-crafted documents. Despite having access to all this information, adversaries should not be able to produce forgeries.

RSA signatures

The key exchange from Diffie and Hellman, and Merkle's puzzle (and later knapsack) were unsuccessful at providing a full-fledged non-interactive public-key cryptosystem, in which for instance one could encrypt and decrypt messages using the cryptosystem itself. The challenge was resolved by Rivest, Shamir, and Adleman in 1977 [START_REF] Rivest | A Method for Obtaining Digital Signature and Public-Key Cryptosystems[END_REF], and relies on the following hard problem:

Definition 1.3 (RSA problem) Let n, x, e be integers. Compute y such that y e = x mod n.

One way to solve this problem 19 is by factoring n:

Definition 1.4 (Integer factorisation) Let n = pq with p, q prime. Find p.

We discuss in detail how to choose parameters in Section 1.4 so that this problem is intractable. Rivest, Shamir, and Adleman's signature scheme, now widely known as the RSA signature scheme, works as follows:

• KeyGen(1 κ ) → (sk, pk). Choose two large20 prime numbers p, q, and a power e so that the RSA problem is hard. Release the public key pk = {n, e}; compute d ← e -1 mod φ(n), 21 keep the private (or signing) key sk = d.

• Sign(sk, m) → σ. Given a message m, return σ ← µ(m) d mod n.

• Verify(pk, σ, m) → {True, False}. Given a message m with associated signature σ, compute m ← σ e mod n. If µ(m ) = µ(m) return True; otherwise return False.

Note that it is not the message m itself which is used, but the result of applying a padding function µ on m. This function is meant to destroy RSA's natural homomorphic structure 22 , by introducing randomness and redundancy into the message. Provably secure padding functions include PSS and OAEP [CJN + 02; BR96; BR95].

DLP-based signatures

ElGamal introduced in 1984 the first DLP-based signature scheme [START_REF] Elgamal | A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms[END_REF]. It inspired the slightly more efficient Schnorr signature scheme [START_REF] Schnorr | Efficient Identification and Signatures for Smart Cards[END_REF], for which a security proof is known in the random oracle model assuming the hardness of DLP [START_REF] Pointcheval | Security Arguments for Digital Signatures and Blind Signatures[END_REF]. Schnorr's scheme was initially encumbered by patents, which had the effect of limiting its diffusion. All these schemes can be implemented on elliptic curves (EC), to decrease parameter size and improve performance.

The NSA developed its own Digital Signature Algorithm (DSA), a variant of Schnorr's, around this patent. However, DSA's modifications break the security proof, and despite some results in the generic group model [START_REF] Daniel | Generic Groups, Collision Resistance, and ECDSA[END_REF], this signature algorithm is very brittle (see, e.g., [AFG + 14]).

Identification or proof protocols

A proof protocol is played between a prover and a verifier. The prover's goal is to convince the verifier that some statement is true. Concretely, it has to be complete (if the statement is true, then there is a way to convince the verifier) and sound (if the verifier is convinced, then the prover knows that the statement is true).

Maybe one of the most fascinating, and useful, family of such protocols are those that enable the prover to convince the verifier of the truth of some statement, without revealing anything else. In particular, the prover does not provide the verifier with a witness that the statement is true, so that the verifier cannot transfer this proof to a third party. Protocols that reveal nothing but the truth of a statement to a verifier are called zero-knowledge. 23Zero-knowledge protocols (ZKPs) are very powerful primitives, that have found many uses in cryptography. One typically distinguishes interactive ZKPs [GMR89a; GMW91b] from non-interactive ZKPs (NIZK, [START_REF] Groth | Efficient Non-interactive Proof Systems for Bilinear Groups[END_REF][START_REF] Ghadafi | Groth-Sahai Proofs Revisited[END_REF]). There are many constructions for such protocols, but we focus on only two of them: Σ-protocols [START_REF] Damgård | On Σ Protocols[END_REF] and smooth projective hash functions24 [START_REF] Cramer | Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure Public-Key Encryption[END_REF].

Extensive details about Σ-protocols and their applications are given later on in Chapter 3. An informal description of these protocols is that they challenge the prover on a problem that they are able to consistently solve if and only if they know a witness. Σ-protocols use three rounds, played alternatively by the prover and the verifier: commitment, challenge, response. The zero-knowledge property of such constructions is established by exhibiting a simulator, i.e., an algorithm that produces outputs which are indistinguishable from the prover's and verifier's outputs; since the simulator does not know the witness or any secret material, its existence implies that no information can be extracted from analysing the protocol's exchanges.

Smooth projective hash functions (SPHFs) provide two ways to compute the hash of a value x: one can either use a secret hash key hk, or a public projective key hp, the latter depending on a witness that x belongs to a given language L. 25 The secret path allows computing the hash of x for any x, whereas the public path only works for x ∈ L.

An SPHF is the data of four algorithms (HashKeyGen, ProjKeyGen, Hash, ProjHash), which satisfy the following properties:

• Correctness: For c ∈ L and w, for all hash keys hk $ ← -HashKeyGen(pk, aux), we have Hash(hk, pk, aux, c) = ProjHash(hp, pk, aux, c, w) where h = ProjKeyGen(hk, pk, aux, c).

• Smoothness: For c / ∈ L, g = Hash(hk, pk, aux, c) is statistically indistinguishable from random, and does not depend on hp, pk, aux or c.

• Pseudo-randomness: For c ∈ L, without knowing a witness w of this statement, g = Hash(hk, pk, aux, c) is computationally indistinguishable from random.

One of the key interests of SPHFs is that they allow composition; it is possible to assemble SPHFs for conjunctions and disjunctions of languages. Another appeal of this framework is that it provides a unified language for many commitment schemes and authenticated key-exchange protocols (see e.g. [START_REF] Abdalla | A Scalable Password-Based Group Key Exchange Protocol in the Standard Model[END_REF][START_REF] Katz | Forward Secrecy in Password-Only Key Exchange Protocols[END_REF]).

Encryption schemes

An encryption scheme is a collection of four algorithms E = (Setup, KeyGen, Encrypt, Decrypt).

The Setup algorithm takes as input 1 κ and outputs public parameters pp that are used by the other algorithms to guarantee a concrete security level of at least κ bits. KeyGen generates a keypair (sk, pk) containing a secret key sk and a public key pk. The public key is meant to be shared with everyone, which can then use the Encrypt algorithm on a message, along with the public key, to produce a ciphertext. The Decrypt algorithm takes as input a ciphertext and the secret key, and returns the decrypted message.

The security requirements for encryption are somewhat more nuanced than, say, for signature -see Section 1.5 below for a more in-depth treatment. Historically, one would focus on confidentiality, ensuring that adversaries cannot learn even one bit of an encrypted message. But this leaves open the possibility that an adversary purposefully alters a message, even if decryption is beyond their capacity; this is called a malleability attack.

Interestingly, one can take two attitudes regarding malleability: fight it, or embrace it. Fighting it, by ensuring integrity at the encryption level, leads to very strong primitives (IND-CCA2, see infra) and authenticated encryption schemes. Embracing malleability leads to homomorphic encryption, using which one can securely delegate computation on data, without revealing the data itself (see, e.g., [BCG + 16b]). The appropriate notion of security thus depends on the context.

RSA encryption

RSA encryption is the dual of RSA signatures. The role of private and public exponents is reversed, resulting in a ciphertext that only the private key's owner can decrypt. As for RSA signatures, directly encrypting the message exposes the parties to malleability attacks; furthermore, deterministic encryption cannot be secure against chosen-plaintext attacks (cf. Section 1.5). For these reasons, RSA in encryption mode is generally used with a randomised padding function µ, which is efficiently invertible, such as OAEP or PSS [CJN + 02; BR96; BR95].

• KeyGen(pp) → (sk, pk). Generate a κ-bit security RSA modulus n = pq, e coprime with φ(n), and d ← e -1 mod φ(n). 26 Set pk = (e, n) and sk = d.

• Encrypt(pp, pk, m) → c. Compute c $ ←µ(m) e mod n.

• Decrypt(pp, sk, c) → m. Compute m ← µ -1 c d mod n .

The security of RSA encryption relies on the RSA problem being hard (see Section 1.4). Additional security guarantees coming from the use of padding functions may rely on additional hypotheses, such as the random oracle for PSS (see Section 1.5.2.1).

ElGamal and Cramer-Shoup encryption

The ElGamal cryptosystem [START_REF] Elgamal | A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms[END_REF] is an early construction based on the hardness of computing discrete logarithms (see Section 1.4). Unlike RSA, which is not randomised by default, ElGamal encryption produces inherently randomised ciphertexts.

• Setup(1 κ ) → pp. Pick a cyclic group G of order q such that the DLP in G provides κ-bit security, and a generator g of G. Set pp = (G, q, g).

• KeyGen(pp) → (sk, pk). Pick x $ ← -Z q , and set sk = x, pk = g x .

• Encrypt(pp, pk, m ∈ G) → c. Pick y $ ← -Z q . Compute s ← pk y , then c 1 ← g y and c 2 ← ms. Set c = (c 1 , c 2 ).

• Decrypt(pp, sk, c) → m. Let (c 1 , c 2 ) ← c, then the message is recovered as m ← c 2 c -sk 1 .

However, ElGamal encryption is heavily malleable, allowing an adversary to alter ciphertexts in a meaningful way without ever decrypting; as a result, this cryptosystem is not secure against chosen-ciphertext attacks (see Section 1.5). 27 A variant introduced by Cramer and Shoup [START_REF] Cramer | A Practical Public Key Cryptosystem Provably Secure Against Adaptive Chosen Ciphertext Attack[END_REF] results in a DLP-based cryptosystem that resists attacks even against adaptive chosen-ciphertext attacks (see Section 1.5), and relies critically on the use of a universal one-way hash function H. 28 The Cramer-Shoup cryptosystem was historically the first practical cryptosystem provably secure against these attacks.

• Setup(1 κ ) → pp. Pick a cyclic group G of order q such that the DLP in G provides a security of κ bits, and two generators g 1 , g 2 of G. Pick H from a universal one-way hash family. Set pp = (G, q, g 1 , g 2 , H).

• KeyGen(pp) → (sk, pk). Pick x 1 , x 2 , y 1 , y 2 $ ← -Z q ; compute c ← g x1 1 g x2 2 , d ← g y1 1 g y2 2 , and h = g z 1 . Set pk = (c, d, h) and sk = (x 1 , x 2 , y 1 , y 2 , z).

• Encrypt(pp, pk, m ∈ G) → c. Pick k $ ← -Z q , compute u i ← g k i for i = 1, 2, e ← h k m, α ← H(u 1 , u 2 , e), v ← c k d kα . Set c = (u 1 , u 2 , e, v).
• Decrypt(pp, sk, c) → m. Let (u 1 , u 2 , e, v) ← c, compute α ← H(u 1 , u 2 , e), and verify that

u x 1 u x 2 (u y1 1 u y2 2 ) α = v
otherwise return ⊥ and terminate. Return m = eu -z 1 .

Note that decryption may fail, e.g., if the ciphertext was tampered, with the Decrypt algorithm returning ⊥.

Linear encryption

Linear encryption [START_REF] Boneh | Short Group Signatures[END_REF] was introduced as a variant of ElGamal encryption, which can be used in settings where the DDH assumption is known not to hold 29 :

• Setup(1 κ ) → pp. Pick a group G or order q, with generator g 3 .

• KeyGen(pp) → (sk, pk). Pick x 1 , x 2 $ ← -Z * q , x 1 and x 2 coprime to φ(q), compute g 1 ← g

1/x1 3 and g 2 ← g 1/x2 3

. Set pk = (g 1 , g 2 , g 3 ) and sk = (x 1 , x 2 ).

• Encrypt(pp, pk, m ∈ G) → c. Pick r 1 , r 2 $ ← -Z * q , and set c = (g r1 1 , g r2 2 , mg r1+r2

3

).

27 To be absolutely precise, the problem is not with ElGamal encryption per se, rather with the fact that we use multiplication; using e.g. c 2 ← AESs(m) would result in a non-malleable variant. 28 A universal hash function family (h i ) i∈{0,1} d with h i : {0, 1} n → {0, 1} k is such that for any x, y ∈ {0, 1} n such that x = y, we have Pr[h i (x) = h i (y)] ≤ 2 -k for all i ∈ {0, 1} d . See e.g. [START_REF] Barhum | UOWHFs from OWFs: Trading Regularity for Efficiency[END_REF] for explicit constructions. It is typical to use a given i by fixing a common reference string (see Section 1.5.2.1), and use that the distribution of h i (x) for uniformly random x is indistinguishable from uniformly random -this is a particular form of the leftover hash lemma [IZ89; HIL + 99]. 29 A typical setting where this occurs is bilinear groups.

• Decrypt(pp, sk, c) → m. Let (c 1 , c 2 , c 3 ) ← c, then set m = c 3 c -x1

1 x -x2 2 .
The security of this encryption scheme relies on the DLin assumption:

Definition 1.5 (Decisional linear assumption) Let G be a group of order q. Let g 1 , g 2 , g 3 be generators of G. A triple (c 1 , c 2 , c 3 ) is said linear with respect to (g 1 , g 2 , g 3 ) when there exists r, s ∈ Z q such that c 1 = g r 1 , c 2 = g s 2 , and c 3 = g r+s 3 . The decisional linear assumption (DLin) states that no efficient adversary can distinguish random linear triples w.r.t. a random basis, from random triples; i.e. given (g, g x , g y , g xr , g xs ) ∈ G 5 for random x, y, r, s, it is computationally hard to distinguish g r+s from a uniformly sampled random element of G.

Hard problems and parameters choices

The choice of parameters, such as the keys' lengths, is made so as to guarantee the hardness of the publickey cryptosystem's underlying hard-to-invert problem. This is measured by the number of elementary sequential operations that the adversary must carry in order to solve the hard problem, usually in the random access machine (RAM) model of computation. When selecting a security parameter κ, we tune the other parameters so that the adversary faces a challenge requiring of the order of 2 κ . A concrete value of 2 128 seems out of reach of current technology, for the years to come. Note that other computation models are possible, capturing new hardware capabilities (e.g. quantum algorithms, parallelism) and limitations (communication cost).

The parameters of cryptosystems must be chosen so that the best known algorithm takes time Ω(2 κ ) to solve the underlying hard problem.

Discrete logarithm algorithms 1.4.1.1 Baby-step giant-step

Shank's30 baby-step giant-step algorithm [START_REF] Shanks | Class number, a theory of factorization, and genera[END_REF] is a simple space-time tradeoff that can be used to compute the discrete logarithm in a generic group G. Let g be a generator of G, of order p, and y be the target, for which we must compute a discrete logarithm.

The key observation is that we can decompose g x as g x1+kx2 = g x1 (g k ) x2 . The algorithm consists in precomputing the g x1 part, which only needs to be done for x 1 between 0 and k -1. The remaining "online" work consists in varying x 2 from 0 to p/k . The tradeoff corresponds to k 2 = p; i.e. the algorithm's space and time complexity is O( √ p).

The reason for using prime-order groups, rather than groups of composite or smooth order n, is that more efficient algorithms exist for them (most notably the Pohlig-Hellman algorithm [START_REF] Pohlig | An improved algorithm for computing logarithms over GF (p) and its cryptographic significance[END_REF]), which reduce the difficulty to O( √ p), where p is the largest prime factor of n.

Other generic approaches

Shank's algorithm's complexity is essentially optimal. However various improvements are possible, either by reducing memory usage -using for instance a variant of Pollard's ρ algorithm [START_REF] Pollard | A Monte Carlo method for factorization[END_REF] -or by leveraging parallelism to compute efficiently several logarithms [START_REF] Pierre-Alain Fouque | Multi-user Collisions: Applications to Discrete Logarithm, Even-Mansour and PRINCE[END_REF], i.e. in O( √ Lp) instead of the naive O(L √ p)

where L is the number of logarithms to be computed in the same group.

In any case, no algorithm can break the O( √ p) barrier if they consider the group as a black-box, i.e.

without exploiting additional structure beyond the group's. Such algorithms are said to operate in the generic group model, a notion introduced along with a proof of the O( √ p) lower bound by Shoup [START_REF] Shoup | Lower Bounds for Discrete Logarithms and Related Problems[END_REF].

The generic group model is useful, in that it gives more theoretical power to prove statements, but it is unsatisfactory from a cryptographic standpoint, because no group is truly generic. Groups used in practice have additional structure, which leads to more efficient algorithms. A side effect is also that cryptosystems which are provably secure in the generic group model may be insecure when the generic group is replaced by any concrete group [START_REF] Dent | Adapting the Weaknesses of the Random Oracle Model to the Generic Group Model[END_REF][START_REF] Canetti | The Random Oracle Methodology, Revisited (Preliminary Version)[END_REF].

Index calculus

Index calculus is one of the approaches that improve over the generic group bound, by exploiting the multiplicative structure of finite fields. The algorithm works in three stages.

Initially, one chooses a smoothness basis B = {p 1 , . . . , p r }, usually consisting of the r first prime numbers. The first stage computes g k mod p for many values of k; for many of those, g k mod p is Bsmooth:

g k = p e1 1 • • • p er r .
The algorithm thus stores (e 1 , . . . , e r ), if this vector is linearly independent from all previously stored ones 31 , along with the corresponding k. This stage terminates when the matrix assembled from these vectors has rank r. Note that this stage can be trivially distributed amongst many independent computers, and can be performed offline provided that the group is known.

The second stage uses this full-rank matrix M to find log g p i as linear equations in the vectors of M. This can be performed offline but usually requires working on a single computer.

The third and final stage ("descent") first finds j such that g j y is B-smooth: y = p f1 1 • • • p fr r . At this point we can solve the linear system j + log g y = i f i log g p i . This stage is performed online, in the sense that the value y must be known to run it.

The index calculus method relies on efficient factorisation over B. It bears many similarities with the number field sieve (NFS, see Section 1.4.2.2) and in fact NFS-based index calculus is the most efficient general-purpose discrete logarithm algorithm over finite fields of prime order. Using an efficient DLP-NFS implementation, leveraging the fact that the group was known in advance, and exploiting a downgrade attack in TLS, Adrian et al. [ABD + 15] mounted real-time attacks against authenticated Diffie-Hellman key exchange, with individual discrete logarithms (512-bit) being computed in less than a minute.

Elliptic curves

Elliptic curves provide an interesting alternative to finite fields: their rational points have a group structure, but methods such as index calculus do not apply. 32 On well-chosen curves, no algorithm is known to outperform generic group algorithms. As a result, parameters for such curves can be chosen relatively small (e.g. 256 bits) without impairing security, with a noticeable speed-up in operation. The security of elliptic-curve cryptography is a complex and fascinating topic, and we refer to [START_REF] Galbraith | Recent progress on the elliptic curve discrete logarithm problem[END_REF] for an up-to-date survey.

Nevertheless let's recall a few useful facts about elliptic curves, crystallising the standard references [Sil09; Tat74; Sil13; BSS99] in a slightly more modern language. Elliptic curves have a wonderful and rich history, but we limit ourselves here to the strictly algebraic and number-theoretic aspects, which are the most relevant in cryptography. 33,34 Let k be a field. 35 An elliptic curve over k is a pair (E, O), where E is a smooth projective curve over k, geometrically irreducible36 , of genus g = 1, and O ∈ E(k) is a k-rational point of E called the "origin" or "point at infinity".

Divisors and the Riemann-Roch theorem. The formal sums

Div(E) := n x (x) s.t. n x ∈ Z, x ∈ |E|, and the sum is finite where |E| denotes the set of closed points of E, forms an Abelian group and is called the divisor group on E. When k is a perfect field, |E| corresponds to the k-rational points of E, and we define the degree of a divisor D ∈ Div(E) as the sum of its coefficients n P . We say that a divisor D is effective, and write D ≥ 0, if n P ≥ 0 for all P . We write Div 0 (E) = ker(deg) the subgroup of divisors of degree zero.

If f is a non-zero rational function on E: f ∈ R(E) × , then f has a divisor div(f ) ∈ Div 0 (E). Divisors of the form div(f ) are called principal divisors and form a subgroup P (E) ⊂ Div 0 (E).

The divisor class group of E is defined as the quotient Cl := Div(E)/P (E), and similarly for divisors of degree zero we define Cl 0 := Div 0 (E)/P (E).

The rational differentials on E form a vector space Ω R(E)/k over R(E), which is of dimension one. If ω ∈ Ω R(E)/k then div(ω) = K is independent of any choice: indeed, if ω, ω ∈ Ω R(E)/k -{0} then ω = gω for some g ∈ R(E). The Riemann-Roch theorem [START_REF] Roch | Über die Anzahl der willkürlichen Constanten in algebraischen Functionen[END_REF][START_REF] Berthelot | Théorie des intersections et théorème de Riemann-Roch[END_REF] states that

(D) -(K -D) = 1 -g + deg(D)
where we have written:

L(D) = {0} ∪ f ∈ R(E) × s.t. D + div(f ) ≥ 0 (D) = dim k L(D)
The group law. We are now equipped to explain what is often presented as a serendipitous fact, why elliptic curves can be equipped with a group law. The approach here is purely algebraic, to contrast with the typically more geometric intuition. Proof: Assume that P, Q ∈ E (k) and that (P ) -(O) = (Q) -(O) + div(f ) for some function f ∈ R(E) × . If P = Q then div(f ) = (P ) -(Q) = 0, so that f is a non-constant rational map f : E → P 1 k of degree 1. It follows that f is an isomorphism f : E ∼ -→ P 1 k , and in particular that g(E) = 0 which is a contradiction. Thus P = Q.

Let D ∈ Div 0 (E), the Riemann-Roch theorem implies that (D + (O)) = 1. Let f ∈ L(D + (O)) \ {0}. The divisor D = D + (O) + div(f ) ≥ 0 is an effective divisor of degree 1. Hence D = (P ) for a k-rational point P ∈ E (k). As D = (P ) -(0)div(f ), we have that D and (P ) -(O) belong to the same class.

As a consequence, the addition on Cl 0 (E) induces the structure of an abelian group (E(k), +) on E(k), with neutral element O. This addition law is characterised by

P + Q = R ⇔ ∃f ∈ R(E) × , (P ) + (Q) -(R) = (O) + div(f )
This in particular explains the usual addition formulas for E, where we write f the rational function obtained as a ratio of the line equation of (P Q) and ((P * Q)O), where P * Q is the intersection of the line (P Q) with the curve. This function has divisor Weierstrass equation. Let (E, O) be an elliptic curve over k. There exist rational functions x, y ∈ R(E) × such that the map α : E → P 2 k defined by: α : P → (x(P ) : y(P ) : 1) O → O = (0 : 1 : 0)

induces an isomorphism between (E, O) and the elliptic curve (C, O) C is the smooth cubic projective curve C : y 2 z + a 1 xyz + a 3 yz 2 = x 3 + a 2 x 2 z + a 4 xz 2 + a 6 z 3

In particular, if char(k) = 2, 3 then the affine curve C \ {O} can be written

y 2 = x 3 + a 4 x + a 6
which is known as the short Weierstrass form of C.

Proof: For each n ≥ 1, the Riemann-Roch theorem gives (n(O)) = n. In particular, there are rational functions

x ∈ L(2(O)) -L((O)) y ∈ L(3(O)) -L(2(O))
so that x, y, 1 forms a basis of L(3(O)). These three function also define a non-constant rational map (x : y : 1) : E → P 2 k which extends to a unique morphism α : E → P 2 k because E is a regular curve and P 2 k is projective. Furthermore,

x 2 ∈ L(4(O)) -L(3(O))
xy ∈ L(5(O)) -L(4(O))

x 3 , y 2 ∈ L(6(O)) -L(5(O))

It follows that the rational functions 1, x, y, x 2 , and xy form a basis of L(5(O)). Now, since we have dim(L(6(O))/L(5(O))) = 1, there exists a linear relation

x 3 -ay 2 ∈ L(5(O))
for some a ∈ k × . Replacing x ← ax, y ← a 2 y we can assume a = 1. Thus there exists a linear relation 0 = y 2 + a 1 xy + a 3 yx 3a 2 x 2a 4 xa 6 = f (x, y), a 1 , . . . , a 6 ∈ K × .

The morphism α factors as E β -→ C → P 2 k where C is the projectivisation of f above. Since f is irreducible in k[x, y], C is a reduced and geometrically irreducible curve.

The affine coordinates x, y ∈ R(C) define rational functions on C, hence rational maps x, y : C → P 1 k , and the composite rational maps x • β and y • β extend to morphisms E → P 1 k of degree 2 and 3 respectively. Thus deg(β) = 1, which means that β is birational and induces an isomorphism E ∼ -→ C ( C being the normalization -or canonical desingularisation -of C). In fact C = C because C is smooth: if not, then over a suitable finite extension L ⊃ k we have C(L) P 1 L which contradicts that C has genus 1. Finally, when char(k) = 2, 3 we simplify the expression f (x, y) = 0 by the substitutions y + a 1 x + a 3 2 → y

x + a 2 3 → x which yields the expected formula.

Remark. In fact an elliptic curve (E, O) is a commutative group scheme37 over k:

• There exists unique morphisms m : E × k E → E, and inv : E → E such that

P + Q = m(P, Q) -P = [-1]P = inv(P )
for all P, Q ∈ E(k) (and for all P, Q ∈ E(L) for all fields L ⊃ k).

• The following diagram is commutative

E × k E × k E id×m ---→ E × k E ↓ ↓ E × k E m -→ E • Let s : E × k E → E × k E be the morphism s(P, Q) = (Q, P ), then m • s = m. • The composite morphism E ∆ -→ E × k E id×inv ----→ E × k E m -→ E,
where ∆ is the diagonal map, is the constant map with value O.

Representation of elliptic curves. From here on we consider k = F p , with p an odd prime. There are several different ways to express elliptic curves over F p :

• Short Weierstrass form y 2 = x 3 + ax + b, where 4a 3 + 27b 2 is nonzero in F p . Every elliptic curve over F p can be converted to a short Weierstrass equation if p is larger than 3. As a result, this is the most widely-used format to describe a curve.

• Montgomery form By 2 = x 3 + Ax 2 + x, where B(A 2 -4) is nonzero in F p . 38,39 • Edwards form x 2 + y 2 = 1 + dx 2 y 2 , where d(1d) is nonzero in F p . 40 There is no point at infinity for this form.

The (short) Weierstrass form is the oldest; additional forms were introduced to improve the operation of single-scalar multiplication: computing the curve point nP given an integer n and a curve point P . This operation is at the heart of elliptic curve cryptography, much like modular exponentiation in finite fields, of which is it the analogue. Multiplication on Montgomery curves is very simple and efficient, using a construction dubbed the Montgomery ladder [START_REF] Peter | Speeding the Pollard and elliptic curve methods of factorization[END_REF], which only depends on the x-coordinate of a point. A similar ladder construction was later found for curves in short Weierstrass form [START_REF] Brier | Weierstraß Elliptic Curves and Side-Channel Attacks[END_REF]. The reader interested in the history, details, and uses of Montgomery curves in a cryptographic context is encouraged to read [START_REF] Costello | Montgomery curves and their arithmetic: The case of large characteristic fields[END_REF] and [START_REF] Daniel | Montgomery curves and the Montgomery ladder[END_REF].

Counting points. Elliptic curves over finite fields yield groups of finite order. A well-known estimation of that order was conjectured by Artin, proved by Hasse and extended by Weil: Theorem 1.2 (Artin-Hasse-Weil) If k = F q , where q = p k with p prime the the order of the group E(k) differs from 1 + q by at most 2 √ q.

Knowing precisely |E (k)| is important in cryptographic applications, since we will often work in a prime order subgroup, said prime must divide |E(k)|. There is no general formula for |E(k)|; however reasonably efficient procedures are known such as the Schoof-Elkies-Atkin algorithm [Sch95;[START_REF] Elkies | Elliptic and modular curves over finite fields and related computational issues[END_REF]. More precisely, this algorithm (and others similar to it) computes the trace of the Frobenius map φ : (x, y) → (x p , y p ), and uses the fact that over a prime field, |E(k)| = p -Tr(φ) + 1. This is achieved by working modulo a sequence of primes 1 , . . . , r and then invoking the Chinese remainder theorem (in Schoof's original algorithm) or an improvement thereof. We refer the interested reader to [LLV05; LM00] for additional details.

Embedding degree. There exist techniques that transfer the elliptic curve's group structure onto a more manageable group, such as the multiplicative group of a reasonably small finite field, where efficient discrete logarithm computations are possible. Denote the prime order of an elliptic curve group. For instance, if |(p -1), one can transfer the DLP onto F * p , where the DLP is solved in subexponential time by index calculus. If |(p 2 -1) the target group is F * p 2 , etc. The minimum possible multiplicativetransfer degree for a particular elliptic-curve group is called the embedding degree of that group. There are various opinions as to what is a reasonable embedding degree, and there is no single best answer, but generally speaking the higher the better and we may conservatively use an embedding degree ≥ /100. Small-subgroup attacks. Typical groups have order h , where is the prime order of the specified base point P , and h is an integer called the cofactor. The best strategy against the DLP nQ, is then to take a curve point Q of order h, so that the attack reveals n mod h. If n is a uniform random integer modulo h , then there are still equally likely possibilities for n. But if n is random modulo , then only just /h possibilities remain, allowing a √ h times speed-up over Pollard's ρ. Such small-subgroup attacks are easily thwarted, by rejecting any Q for which hQ = 0; or by using curves with h = 1.

38 Substituting x = Bu -A/3 and y = Bv produces the short Weierstrass equation v 2 = u 3 + au + b where a = (3 -A 2 )/(3B 2 ) and b = (2A 3 -9A)/(27B 3 ). 39 Curves of prime order or 2 × prime order can never be converted to Montgomery curves over Fp: Montgomery curves always have order divisible by 4. 40 Substituting x = u/v and y = (u -1)/(u + 1) produces the Montgomery equation Bv 2 = u 3 + Au 2 + u where A = 2(1 + d)/(1 -d) and B = 4/(1 -d).

Invalid-curve attacks

In an invalid-curve attack, the attacker sends a point Q that is not a point of the curve. For example, instead of sending point (x, y) on y 2 = x 3 + ax + b, the attacker sends a point on y 2 = x 3 + ax + c, where c = b. The standard formulas for scalar multiplication on short Weierstrass curves do not involve the constant coefficient b, so they automatically also work for this new point. The attacker can run the attack using a point Q 2 of order 2 on one curve, a point Q 3 of order 3 on another curve, a point Q 5 of order 5 on another curve, etc., revealing n mod 2, n mod 3, n mod 5, etc. then soon enough the Chinese remainder theorem recovers n [START_REF] Biehl | Differential Fault Attacks on Elliptic Curve Cryptosystems[END_REF]. No curve is immune to this attack, however it is simple to check whether Q belongs to the appropriate curve before computing, or to use point compression, i.e. using only one coordinate to represent points. As a corollary, invalid-curve attacks are limited in scope when ladders are used.

That being said, attackers may exploit twists of the curve41 to perform the equivalent of an invalid-curve attack despite the presence of ladders [FLR + 08]. Twist-secure curves provide guarantees that twists do not significantly lower the security level of the DLP -which does not in itself protect against invalid-curve attacks [START_REF] Lochter | Twist Insecurity[END_REF].

Complexity results and records

Two resources contribute to estimating reasonable parameters: complexity results on the one hand, which provide (asymptotic) reassurance that scaling parameters up increases hardness; and record-breaking computations, which make the power of current hardware and algorithms visible.

Table 1.1 summarizes the publicly-announced results regarding breaking the discrete logarithm problem in various fields. In particular, recent theoretical progress regarding the case of small characteristic fields has resulted in rapid development of special-purpose algorithms. Interest in small characteristic fields, and specifically binary extensions, stemmed from the relatively easy hardware implementation of cryptosystems using this field (see e.g. [START_REF] Joux | A New Index Calculus Algorithm with Complexity L(1/4 + o(1)) in Small Characteristic[END_REF]). Similarly, some extension fields have additional structure that can be exploited to achieve important speed-ups [BGK15; SS16; KB16].

Progress against prime fields, however, more closely matches asymptotic expectations; for this reason, we will almost exclusively use prime fields of large order (above 1024 bits) to implement cryptosystems relying on the hardness of the DLP. In that setting:

• The generic group algorithms operate in time O( √ p);

• The index calculus algorithm operates in time exp ( √ 2 + o(1)) log p log log p = L p 1 2 , √ 2 .

• The currently best algorithm [START_REF] Barbulescu | The multiple number field sieve for medium-and high-characteristic finite fields[END_REF] in finite fields is based on the number field sieve (see below in Section 1. [START_REF] Step | [END_REF]

 

From these estimates we can provide parameter sizes for groups of prime order where the DLP is hard. Table 1.2 summarises these estimations. For well-chosen elliptic curves, we will use the generic group parameters as reference.

Factorisation algorithms

Factoring an integer n allows one to directly break RSA-based cryptosystems. Thus the security of such systems can be evaluated by the efficiency of the best factoring algorithm. In this section we recall the principal approaches to factoring, which in turn determine our estimation of parameters sizes and properties to achieve a given security level.

Table 1.1: Record-breaking discrete logarithm computations in finite fields, as of late 2016. The star symbol indicates a (possibly twisted) Kummer extension. Adapted from [START_REF] Pierrot | Le problème du logarithme discret dans les corps finis[END_REF].

From here on let's assume that n is an odd, composite number. For simplicity assume that n is not the power of a prime. 42 If we have two distinct numbers x and y, such that x 2 ≡ y 2 mod n, then (xy)(x + y) divides n. Thus gcd(xy, n) is a factor of n.

All the methods mentioned below rely on this observation. They only differ in the way they find candidate x and y. In fact, they provide many couples (x, y) such that x 2 ≡ y 2 mod n -and hopefully x = ±y mod n.

Let's go into more details about how to find x and y. The intuition is that if x 2 = s 1 × • • • × s k , and y 2 = t 1 × • • • × t k , with s i ≡ t i mod n, then x 2 ≡ y 2 mod n. To make things simple, let's focus just on x: Given a list of numbers s i , can we choose a few of them and form a set I, such that i∈I s i is a square?

Let's start with the following notation: If s = 0 is an integer, then it can be written as a product of powers of prime numbers s = (-1) v-1(s) prime p p vp(s)

Let v(s) be the vector (v -1 (s), v 2 (s), v 3 (s), . . . ). Now s is a square if and only if each component of this vector is even. If we consider the product i∈I s i , the exponents add up, and the condition that this product is a square is exactly equivalent to the following:

i∈I v(s i ) ≡ 0 mod 2 (1.1)
In the above discussion, v(s) can become a vector with arbitrarily many entries. Let's restrict ourselves to numbers whose prime divisors are smaller than some constant k -they are known as k-smooth numbers. For such numbers s i , v(s i ) spans a finite-dimensional vector space. Thus if we consider many integers s i it will be highly likely that they are linearly dependent, i.e. that Equation (1.1) holds, i.e. that i∈I s i is a square. More precisely: If we have at least k values s i which are all k-smooth, then v(s i ) belongs to a (π(k) + 1)dimensional space, where π(k) denotes the number of primes up to k. But we have k such vectors, and k > π(k) + 1 for all k > 3. Thus the exponent vectors are linearly dependent, thus there exist I such that i∈I s i is a square.

To solve our problem, we need to find k-smooth numbers. What is an efficient smoothness test? One naive approach is trial division by all numbers up to k, but that is not very efficient.

Quadratic sieve

Consider the congruences t 2 ≡ t 2n mod n, where t runs over consecutive integers. Since one side of these congruences is already a square, the problem is reduced to finding a set T of values of t such that t∈T (t 2n) is a square. By the above discussion, the search for T is reduced to a search for values of t such that t 2n is smooth.

To find smooth numbers, the quadratic sieve makes use of the following observation. Let f (t) = t 2n, then

f (t + kp) = (t + kp) 2 -n = t 2 + 2tkp + (kp) 2 -n = f (t) + 2tkp + (kp) 2 ≡ f (t) (mod p)
Thus solving f (t) ≡ 0 mod p for t generates a whole sequence of values f (t), which are divisible by p. This method of sieving is much more efficient that trial division.

In practice, several polynomials can be used to find more candidates, but they should all be of the form (at + b) 2n. to find the values Y (0), Y (1), . . . , Y (99) which are divisible by p.

At the end of this procedure we have a collection of smooth numbers:

29 = 2 0 • 17 0 • 23 0 • 29 1 782 = 2 1 • 17 1 • 23 1 • 29 0 22678 = 2 1 • 17 1 • 23 1 • 29 1
given by X = 0, 3, and 71 respectively. From the exponents it is clear that

29 • 782 • 22678 = 22678 2
is a square, and (0 + 124) 2 (3 + 124) 2 (71 + 124

) 2 = 124 2 • 127 2 • 195 2 = 3070860 2
is also a square. Finally, by design, 22678 2 ≡ 3070860 2 (mod 15347). We thus get a factor gcd(3070860 -22678, 15347) = 103. The factorisation of N is therefore:

N = 15347 = 103 × 149.

Number field sieve

While the quadratic sieve is very efficient (in fact, it is the best method for numbers up to around 130 bits), it can be further improved. By using some clever ideas from number theory, we can construct the Number Field Sieve, which beats the quadratic sieve at factorising large numbers. Let f (t) be a monic polynomial, that is irreducible over Z. Let α be a (possibly complex) root of f . Now assume that m is an integer such that f (m) ≡ 0 mod n. There is a natural homomorphism φ that transports the ring Z[α] of algebraic integers to the ring Z/nZ, and such that φ(α) = m mod n. In other terms, if g(t) is any polynomial with integer coefficients, φ(g(α)) = g(m) mod n.

Here is how this construction helps us: suppose we could find a set S of polynomials g with integer coefficients, such that g∈S g(α) = β 2 is a square in Z[α], and such that g∈S g(m) = y 2 is a square in Z. Then we have found

x 2 ≡ φ(β) 2 ≡ φ(β 2 ) ≡ φ   g∈S g(α)   ≡ g∈S g(m) ≡ y 2 mod n.
(1.2)

From there it is easy to factor n as we did before. The devil lies in the details. Indeed, Z[α] is a complicated ring, in which we need a notion of smoothness and primes, etc.

Let's focus first on the right-hand side of Equation (1.2). How to find the g's that we need? Let d > 1 such that n > 2 d 2 , and let m = n 1/d . Now, writing n in base m we have

n = c d m d + c d-1 m d-1 + • • • + c 0
In fact it is easy to see that c d = 1, by the relative size of m and n. Now let

f (t) = t d + c d-1 t d-1 + • • • + c 0 .
Then f is a monic polynomial such that f (m) = n. If f is not irreducible, then we can factor f into irreducible components in time polynomial in log n. If the factorisation in non-trivial, then we directly get a factorisation of n itself by substituting m for t! So from now on assume that f is irreducible over Z.

Let g(t) = abt with a, b coprime and 0 < b, |a| ≤ B. The integers abm are small compared to n (because m ≈ n 1/d ). It is now easy to sieve to pick up pairs a, b such that abm is smooth: We fix b and sieve over a, then choose another b and sieve again, until we exhaust the choices of b. At the end of this procedure we have a square on the right-hand side of Equation (1.2).

Let's now turn our attention to the left-hand side of Equation (1.2). It would be easy if Z[α] were a unique factorisation domain, since in that case we have a notion of "prime" and we can adapt the construction we know for smoothness. But in general, this is not the case.

Instead, consider the norm map N : Q(α) → Q. If α = α 1 , α 2 . . . , α d are the conjugates in C of α and g ∈ Q[t] then

N (g(α)) = d i=1 g(α i ).
The norm map is multiplicative, and it sends algebraic integers to Z -in particular, N (Z[α]) ⊆ Z. From there, we have this simple result: If S is a set of coprime pairs (a, b) of integers, and (a,b)∈S (abα) is a square in Z[α], then (a,b)∈S N (abα) is a square in Z.

Note that we have, for rational numbers a and b = 0,

N (a -bα) = d i=1 (a -bα i ) = b d d i=1 a b -α i = b d f a b = a d + c d-1 a d-1 b + • • • + c 1 ab d-1 + c 0 b d
Thus the norm of abα is a polynomial in a, b with integer coefficients.

We shall say that abα is smooth if and only if N (abα) is smooth. By using a sieve as previously, it should be clear by now that we can find a set S of coprime integers (a, b) such that (a,b)∈S N (abα) is a square in Z. Namely, we use a sieve to detect pairs a, b where abα is k-smooth, create exponent vectors from the prime factorisations of the corresponding norms, use linear algebra modulo 2 to create a square.

The fact that the norm is a square doesn't in itself guarantee that the original number was a square in Z[α]. To give just an example, 2 ± i ∈ Z[i] both have norm 5, so their product has norm 5 2 . However, (2i)(2 + i) = 5 is not itself a square.

In general, a prime number p ∈ Z may factor into several prime ideals in Z[α], each having norm a power of p.

Elliptic curve method

Lenstra's elliptic curve factorisation algorithm (henceforth, ECM) [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF] is based on a modification of Pollard's (p -1) special-purpose factorisation method [START_REF] Pollard | Theorems on factorization and primality testing[END_REF], where the group of rational points on an elliptic curve are used instead of a multiplicative group. Unlike general-purpose algorithms, the ECM's complexity is determined by the size of the largest prime factor, not by the size of the number to be factorised.

As a result it is, at the time of writing, the best algorithm for divisors not greatly exceeding 80 bits. The method consists in the following steps:

1. On input a number n to be factorised, pick x 0 , y 0 , a $ ← -Z n , and compute b = y 2 0x 3 0ax 0 mod n. This amounts to choosing a random elliptic curve over Z n , of equation y 2 = x 3 + ax + b and picking a random point P = (x 0 , y 0 ) on that curve.

2. Using the curve's addition law, we compute kP . If kP and the neutral element become identical modulo some prime divisor p|n, then in projective coordinates the z-coordinate of kP is divisible by p; this gives a way to find non-trivial factors of n by computing gcd(n, z k ) where z k is the z-coordinate of kP .

The numbers k to try can be chosen in many ways, the simplest approach consisting in enumerating successive integers. Unlike Pollard's algorithm, if at some point the algorithm fails (i.e. kP = O or no factor was found) we can pick another random curve and start over. Using well-chosen curves (i.e. not completely random) and leveraging batching further improves this algorithm's performance, both in terms of running time and success probability [BBL + 13].

ECM will be most valuable to us when dealing with smooth numbers, i.e. numbers whose prime factors are small.

Complexity results and records

The asymptotic complexity of factorisation algorithms is often known only heuristically. Nevertheless these estimations are in good agreement with experimental results:

• The quadratic sieve operates in time

exp (1 + o(1)) log n log log n = L n 1 2 , 1
• The special number field sieve operates in time

exp 3 32 9 + o(1) (log n) 1 3 (log log n) 2 3 = L n 1 3 , 3 32 9
• The general field sieve operates in time

exp 3 64 9 + o(1) (log n) 1 3 (log log n) 2 3 = L n 1 3 , 3 64 9
• The elliptic curve method operates in time

exp √ 2 + o(1) log p log log p = L p 1 2 , √ 2
,
where p is the smallest factor of n.

There is no single best algorithm -for instance, the SNFS only applies to special-form integers, and the ECM works best on numbers with small factors. Against RSA moduli, which should avoid falling in either category, the quadratic sieve outperforms the GNFS for sizes up to around 400 bits; for larger moduli, as the ones used today, the GNFS is de facto the most appropriate. Table 1.3 summarises factorisation records for a few of the RSA challenge moduli. The effort is sometime measured in MIPS-years: 1 MIPS-year corresponds to the amount of computation performed in a whole year, using a computer that executes one million instructions per second. Table 1. [START_REF] Step | [END_REF] gives some additional results for numbers that are not RSA moduli, but whose factorisation wasn't known a priori, such as Cunningham numbers.

Based on the complexity of GNFS, we can estimate how large RSA moduli should be to reach a certain security level. The size of RSA moduli for various security levels are given in Table 1.5.

Table 1.4: Record-breaking factorisation results for integers. SNFS stands for the (special) number field sieve, the star symbol indicates only partial factorisation, and " Q " refers to a quantum algorithm computation.

Additional attacks on RSA

While factorisation is the most straightforward approach to attacking RSA, there are contexts in which more efficient attacks are possible.

For instance, if two moduli n and n share a common factor, then the Euclidean algorithm reveals gcd(n, n ) in O(log(n+n )) i.e. in time linear in the moduli size. Such a scenario is avoided by using enough randomness during key generation. In theory, by the prime number theorem, we would expect around 2 k / ln(2 k ) -2 k-1 / ln(2 k-1 ) prime numbers of size k, bringing the the collision probability to a negligible 2 -251 for 1024-bit moduli. Unfortunately, the reality of implementation makes this attack practical, with experiments [LHA + 12; BST + 16; BHL12] breaking a significant portion of public keys gathered from the Internet.

Choosing any prime factor too close to its expected size (e.g. 2 512 -2 256 < p < 2 512 + 2 256 for a 1024-bit RSA modulus), then p and q share about half of their leading bits, and one exposes oneself to the Coppersmith-Howgrave-Graham attack [START_REF] Coppersmith | Finding a Small Root of a Bivariate Integer Equation; Factoring with High Bits Known[END_REF][START_REF] Howgrave-Graham | Finding Small Roots of Univariate Modular Equations Revisited[END_REF][START_REF] Boneh | Factoring N = p r q for Large r[END_REF].

The choice of exponents also matters. For efficiency reasons, users may wish to use a small value of d (modular exponentiation takes time linear in the size of d); but if d is too small, namely d < n 1 4 /3, then one can recover the private key using continued fractions approximations of e/n, as observed by Wiener [START_REF] Michael | Cryptanalysis of Short RSA Secret Exponents (Abstract)[END_REF], in linear time. An improvement by Boneh and Durfee succeeds when d < n 0.292 [BDF98; BD99; HM10; KSI12; DN00; May10].

Similarly, one may wish to use a small value of e, such as the first Fermat primes 3, 17, 65537. In such a situation, attacks by Coppersmith et al. [Cop96b; CFP + 96; Cop97] allow to recover a message given only the two thirds of it, unless appropriate padding is used. Attacks against broadcast RSA and related messages, when linear padding is used, were also devised by Håstad [START_REF] Håstad | Solving Simultaneous Modular Equations of Low Degree[END_REF]. The padding schemes OAEP for instance, is provably secure in the random oracle model assuming the hardness of RSA itself [START_REF] Bellare | Optimal Asymmetric Encryption[END_REF][START_REF] Shoup | OAEP Reconsidered[END_REF]. However, more naive schemes such as linear padding with random numbers are not secure and practical attacks are known [START_REF] Coppersmith | Small Solutions to Polynomial Equations, and Low Exponent RSA Vulnerabilities[END_REF].

Even using appropriate padding and e = 65537, an attack by Heninger and Shacham recovers the private key given a 0.27 fraction of its bits at random [START_REF] Heninger | Reconstructing RSA Private Keys from Random Key Bits[END_REF], soon improved to 0.237 by Henecka et al. [START_REF] Wilko Henecka | Correcting Errors in RSA Private Keys[END_REF]. 43 While the latter is not a concern for typical uses of RSA, it becomes handy in cold-boot attack 43 Note that they call "private key" the information p, q, d and dp = d mod (p -1), dq = d mod (q -1), as specified by the scenarios, where we have access to a slightly corrupted key material.

Finally, there is a large corpus of side-channel and fault attacks against RSA, which work regardless of parameter choices.

Quantum algorithms

All the parameter estimations so far (and in the rest of this thesis) assume that practical computers, hence adversaries, are classical probabilistic Turing machines.

While the vast majority of computers fall in this category, there is a very active research effort focused on leveraging inherently quantum-mechanical effects to speed-up certain operations, yielding so-called quantum computers.

At the time of writing such computers have been built and demonstrated to work, but both engineering and theoretical limitations have so far restricted these devices to only a few qubits, much less than what is needed to even compete with the first classical computers.

The prospect of large-scale quantum computers is interesting, in that we know efficient quantum algorithms against some cryptographic problems, namely Shor's algorithm against the discrete logarithm problem and factorisation [Sho97a; LMP03] -run for the first time in 2001 [VSB + 01] -and the generic speed-up provided by Grover's algorithm [Gro96; BBB + 97] for black-box inversion. Should such computers become widely available, the security parameters would have to account for them, which for DLP-or RSA-based cryptosystems results in unrealistically large keys. Even post-quantum candidates generally require larger keys against quantum adversaries, to account for Grover's algorithm.

Other hard problems 1.4.5.1 Other number-theoretic assumptions

Goldwasser-Micali and quadratic residuosity. The Goldwasser-Micali cryptosystem [START_REF] Goldwasser | Probabilistic Encryption and How to Play Mental Poker Keeping Secret All Partial Information[END_REF] was historically the first probabilistic public-key encryption scheme to be proven secure in the standard model (see Section 1.5.2.1). It relies on the assumed hardness of the quadratic residuosity problem modulo an RSA modulus: Given n an RSA modulus, and a ∈ Z/nZ; determine whether there exists b ∈ Z/nZ such that a = b 2 mod n. While factoring n immediately gives an efficient way to solve this problem 44 , it is not currently known whether the converse holds. The cryptosystem works as follows:

• KeyGen(1 κ ) → (sk, pk). Generate an κ-bit security RSA modulus n = pq and find a quadratic non-residue x such that (x/p) = (x/q) = -1. Set sk = (p, q) and pk = (x, n).

• Encrypt(pk, m) → c. Write m as a sequence of bits m 1 , . . . , m k and pick random y 1 , . . . , y k coprime with n. Then set c = (c 1 , . . . , c k ) where c i = y 2 i x mi mod n.

• Decrypt(sk, c) → m. For each i, m i = 1 if c i is a quadratic residue modulo n; otherwise m i = 0.

Paillier and higher-degree residuosity. The Paillier cryptosystem [Pai99; DJ01] generalises Goldwasser-Micali's construction to higher-degree, namely it assumes the difficulty of determining whether a is a quadratic residue modulo n 2 . Historically it is the first cryptosystem to provide additive homomorphic properties.

• KeyGen(1 κ ) → (sk, pk). Generate a κ-bit security RSA modulus n = pq. Compute λ ← φ(n), µ ← λ -1 mod n, g ← n + 1. Then set sk = (λ, µ) and pk = (n, g).

• Encrypt(pk, m) → c. Given m ∈ Z/nZ, pick r $ ← -(Z/nZ) * and compute c ← g m r n mod n 2 .

• Decrypt(sk, c) → m. Compute s ← c λ mod n 2 , then t ← s/(n -1) in Z. Finally, m ← µt mod n.

Factoring n solves this problem as it did for the Goldwasser-Micali cryptosystem.

PKCS#1 standard, entry A.1.2. Using only p, q, d they need 42% of the information. Using only p and q they need 57%. 44 Using the multiplicative properties of the Jacobi symbol.

Phi-hiding assumption. The phi-hiding assumption is that it is hard to find small factors of φ(n) when the factorisation of n itself is unknown [START_REF] Cachin | Computationally Private Information Retrieval with Polylogarithmic Communication[END_REF][START_REF] Cachin | Efficient Private Bidding and Auctions with an Oblivious Third Party[END_REF]. This assumption has been used to design private information retrieval protocols.

Modular multiplicative knapsack.

The security of the Naccache-Stern knapsack cryptosystem [START_REF] Naccache | A New Public-Key Cryptosystem[END_REF] relies on the intractability of the following problem: Given p, v 0 , . . . , v n-1 ∈ Z/pZ, and

c = n-1 i=0 v mi i mod p,
find the bits m i . No efficient algorithm is known against this problem, although solving the discrete logarithm problem in Z/pZ de facto breaks the cryptosystem.

Approximate GCD. The approximate GCD problem was initially introduced as a gateway to factoring RSA moduli given partial information [START_REF] Howgrave-Graham | Approximate Integer Common Divisors[END_REF]; it consists in finding p, given several near multiples pq i + r i . However this assumption turned out to be instrumental in developing fully-homomorphic encryption schemes over the integers [DGH + 10; CMN + 11].

Lattice-based cryptography

Lattice-based cryptosystems rely on the hardness of solving certain problems appearing in discrete subgroups of Z n , typically of the form L = i c i b i where b i ∈ Z n are called the basis vectors. Typical hard problems are:

• SVP γ : Given a basis of L, find a non-zero vector v ∈ L of length v ≤ γλ 1 (L), where λ 1 (L) denotes the length of the shortest vector in L. Figure 1.8 illustrates the SVP problem on a simple case.

• GapSVP γ : Given a basis of L and d ∈ R, decide whether λ 1 (L) ≤ d or λ 1 (L) > γd. This problem reduces to SVP γ .

• SIVP γ : Given a basis of L, find linearly independent vectors v 1 , . . . , v n ∈ L such that v i ≤ γλ n (L), where λ n (L) denotes the length of the n-th smallest vector.

• BDD: Given a basis of L, t ∈ R n , and d < λ 1 (L)/2, find e ∈ t + L such that e ≤ d.

• SIS: Given an integer matrix A, and a vector u, find a short vector in the lattice L = {x ∈ Z m s.t. Ax = u mod q}.

Of particular interest is a class of problems used in many recent implementations, namely the learningwith-errors (LWE) paradigm, its ring-based variant Ring-LWE, and their "deterministic error" counterparts LWR and Ring-LWR.

• Search-LWE: Find the vector s over Z q , given b i = s, a i + e i mod q, where a i are random vectors, and the e i are sampled according to a Gaussian distribution of width αq > √ n.

• Decision-LWE: Distinguish (A, s A + e ), from uniform (A, b ), where A is a random matrix modulo q.

See Figure 1.9 for a schematic view of how these problems relate to one another.

Ring-LWE and their variants are appealing due to the presence of worst-case hardness theorems, also known as worst-case to average-case reductions. These theorems say that solving certain instantiations on random inputs is at least as hard as quantumly solving a corresponding approximate Shortest Vector Problem on any ideal lattice, i.e., a lattice corresponding to an ideal of the ring. Since these problems are believed to be hard even for quantum computers 45 , lattice-based cryptography is a serious post-quantum candidate.

Another interest in lattice-based constructions is the relative simplicity of both encryption and decryption algorithms, which makes it particularly well-suited to the design of fully-homomorphic encryption schemes [START_REF] Gentry | A fully homomorphic encryption scheme[END_REF][START_REF] Gentry | Fully homomorphic encryption using ideal lattices[END_REF] and multilinear maps [START_REF] Garg | Candidate Multilinear Maps from Ideal Lattices[END_REF]. Consider for instance the following LWE-based cryptosystem, due to Regev: Figure 1.8: Illustration of the shortest-vector problem in a two-dimensional lattice. In higher dimensions, the problem of finding the shortest vector of a lattice is believed to be hard, a fact that can be leveraged to construct public-key cryptographic schemes. • Setup(1 κ ) → pp. Choose n, q, m ≥ n log q46 , α appropriately and set pp = (n, m, α, q).

• KeyGen(pp) → (sk, pk). A $ ← -Z nm q , s $ ← -Z n q , pk = (A, b = s A + e ), sk = s; each component of the vector e is drawn according to a Gaussian.

• Encrypt(pp, pk, b ∈ {0, 1}) → c. Pick x $ ← -{0, 1} m , and set c = (Ax, b x + bq/2).

• Decrypt(pp, sk, c) → b. Let (u, u ) ← c, Compute us u ≈ bq/2, from which we recover the bit b.

One difficulty in lattice-based cryptography is the precise understanding of parameters. It was noticed early on (see e.g. [LMP + 08; Lyu09; LP11; BBL + 15]) that instantiations that are too small to be supported by known worst-case hardness theorems, or that are not covered by such theorems, are not significantly subject to known classes of attack.

In fact, most implementations use considerably smaller dimensions and errors than what is required to leverage worst-case hardness theorems -a dangerous game that resulted in several failures (see e.g. [START_REF] Arora | New Algorithms for Learning in Presence of Errors[END_REF][START_REF] Peikert | A Decade of Lattice Cryptography[END_REF]).

At the time of writing, there is a very active community of researchers exploring this avenue. We refer the interested reader to [START_REF] Peikert | A Decade of Lattice Cryptography[END_REF] for a more in-depth look at the history and developments of lattice-based cryptography.

Code-based cryptography

Code-based cryptography relies on the hardness of decoding some error-correcting codes. Definition 1.6 (Syndrome decoding problem) Given a matrix H and s = He , where e is a binary vector of Hamming weight w, find e.

The best known algorithms against this problem (so-called information-set decoding algorithms) are exponential, and Berlekamp et al. showed [START_REF] Berlekamp | On the inherent intractability of certain coding problems (Corresp.)[END_REF] that the decoding of general random linear codes is NP-hard.

Building on this observation, the first code-based cryptosystem was proposed by McEliece in 1978 [START_REF] Mceliece | A public-key cryptosystem based on algebraic coding theory[END_REF]. This cryptosystem, inspired by knapsacks, disguises an algebraic 47 Goppa code as a general linear code by using a random binary matrix. The rationale is that it would be difficult to distinguish between a random code and a shuffled Goppa code.

We recall here the McEliece cryptosystem in a slightly more general setting, using q-ary algebraic Goppa codes instead of the original binary codes.

• Setup(1 κ ) → pp. Choose a field size q, code length n, dimension k, and parameters m, t such that nmt ≤ 0. Messages belong to F k q , ciphertexts belong to F n q .

• KeyGen(pp) → (sk, pk). Pick y ∈ F n qm , g ∈ F q m [x] a polynomial of degree t, G a generator matrix of the Goppa code G(y, g). Pick S a random full-rank matrix of size (nk) × (nk); pick P a random permutation matrix of size n × n. Let T t be a t-decoder for G(y, g).

Set pk = {G pk = S • G • P, t} and sk = {T t , S, P} • Encrypt(pp, pk, m) → c. Pick a random e ∈ F n
q with Hamming weight t; compute c ← mG pk + e.

• Decrypt(pp, sk, c) → m. Compute m ← T t (cP -1 ); if decoding fails return ⊥. Otherwise output S -1 m.

Decoding algebraic Goppa codes can be done using Patterson's algorithm [START_REF] Nicholas | The algebraic decoding of Goppa codes[END_REF] (which is specific to binary Goppa codes), or the more general alternating code decoders [START_REF] Florence | The theory of error-correcting codes[END_REF]. Many schemes followed, providing additional primitives such as identification [START_REF] Stern | A New Identification Scheme Based on Syndrome Decoding[END_REF], pseudo-random number generators [START_REF] Fischer | An Efficient Pseudo-Random Generator Provably as Secure as Syndrome Decoding[END_REF], hash functions [START_REF] Daniel Augot | A Family of Fast Syndrome Based Cryptographic Hash Functions[END_REF], and digital signature [START_REF] Courtois | How to Achieve a McEliece-Based Digital Signature Scheme[END_REF].

At the time of writing, while the original McEliece cryptosystem has not been broken48 , many similar constructions have; furthermore, the parameter sizes required to make McEliece and similar schemes secure are still unreasonable when compared to other cryptosystems: as an example, taking a binary Goppa code yields a 194 kB public key for 128-bit security. 49That being said, code-based cryptosystems are relatively fast, the security reductions are tight [START_REF] Kobara | On the one-wayness against chosen-plaintext attacks of the Loidreau's modified McEliece PKC[END_REF], and even the best known quantum algorithms (e.g. [START_REF] Daniel | Post-Quantum Cryptography, Third International Workshop[END_REF]) do not significantly weaken their security.

Hash-based cryptography

Hash-based cryptography builds public-key cryptosystems from the use of hard-to-invert functions.

Lamport's one-time signature (OTS) scheme [START_REF] Lamport | Constructing Digital Signatures from a One-way Function[END_REF] is an early example of a hash-based signature scheme. The signing key consists of 2n elements sampled uniformly at random from {0, 1} n and denoted {x i,b }, ∀i ∈ {1, . . . , n}, b ∈ {0, 1}. Considering messages m of binary length n, the signature algorithm applies a one-way function on x i,mi and sets the public key as y i,b = f (x i,b ). Signing a message will reveal, simply, the n elements {x i,mi } used to generate the corresponding {y i,mi } from the public key. Unforgeability follows from the one-wayness of the function f . However, as one may easily notice, once part of the public key has been revealed, the scheme is no longer secure: with the help of a second message, the entire key can be revealed, which then results in a total break.

In an attempt to build signatures from hash functions only, refinements of Lamport's OTS were proposed. The original motivation was speed, but it was soon realised that hash-based constructions had other advantages, including speed weaker hypotheses, the possibility to resist quantum cryptanalysis. To go beyond one-or few-times signatures, an easy strategy is to include, in the signed message, a new public key to be used to sign the next message. This is quickly unwieldy; Merkle introduced hash-tree signatures [START_REF] Ralph | A Digital Signature Based on a Conventional Encryption Function[END_REF] as an improvement, which scale logarithmically with the number of messages signed.

Many new constructions proposed by Winternitz [Win83], Vaudenay [START_REF] Vaudenay | One-time identification with low memory[END_REF], Bos and Chaum [BC93], Even et al. [START_REF] Even | On-Line/Off-Line Digital Schemes[END_REF], Bleichenbacher and Maurer [BM94; BM96], and Perrig [START_REF] Perrig | The BiBa One-Time Signature and Broadcast Authentication Protocol[END_REF] produce efficient signatures from one-way functions with smaller parameters. Other recent improvements [HRB13; BDH11; BDK + 07; BGD + 06; DOT + 08] address the performance of key generation A fruitful line of research stemmed from Reyzin and Reyzin's HORS (Hash to Obtain Random Subset) [START_REF] Reyzin | Better than BiBa: Short One-Time Signatures with Fast Signing and Verifying[END_REF]. HORS relies on a one-way function f , and a hash function H which outputs a random subset of {1, 2, . . . , t} of size k with k < kt < t where t and k are a security parameters. The signing key is a random tuple (s 1 , . . . , s t ), the public key is (f (s 1 ), . . . , f (s t )). To sign a message m, let S = H(m) and output σ = s i : i ∈ S. To verify σ, apply f to each component of the signature, and check that the result matches with the public key. Each signature therefore reveals k elements of the secret key.

Combining HORS with hash trees, Bernstein et al. recently introduced SPHINCS [BHH + 15], the first stateless hash-based signature scheme.

Multivariate cryptography

In multivariate cryptography, public keys are a set of multivariate polynomials, i.e. pk = {p 1 (w 1 , . . . , w n ), . . . , p m (w 1 , . . . , w n )}.

Given a signature σ = (σ 1 , . . . , σ n ) for a message digest m = m 1 , . . . , m n , the verification consists in checking that pk(σ 1 , . . . , σ n ) = (m 1 , . . . , m n ). The signer knows a secret trapdoor that enables her to find σ 1 , . . . , σ n efficiently. One of the appeals of this approach is that signing (or encryption) are very efficient, consisting only of polynomial evaluations.

The rationale behind this family of constructions is that solving a set of m randomly chosen non-linear (i.e. at least quadratic) equations with n variables is NP-complete. 50 In practice, multivariate schemes do not use random equations, and the underlying structure may give an edge to the attacker.

The general strategy underlying many multivariate cryptography is to start from an easy-to-invert polynomial, which is transformed before being made public. The public result should be random-looking to the adversary, while the easy-to-invert structure is known by the signer. Concretely, this is done by choosing two linear affine transformations S and T , and an easy-to-invert polynomial in one variable Q over some finite field L: sk = (S, Q, T ) constitute the private key.

One typical example of a multivariate cryptographic construction is the HFE v-signature scheme 51 [Pat96]:

• The signer generates a secret key sk = (S, Q, T ), where -S is a 4b × 4b binary matrix; -T is a 2b × 3b binary matrix of rank 2b;

-Q ∈ L[x, v 1 , . . . , v b ]
is a multivariate polynomial, such that each term has ne of the following six forms:

x 2 i +2 j (with ∈ L, i < 2j , 2i + 2j ≤ 2b); x 2 i v j (with ∈ L, 2i ≤ 2b); v i v j , x 2 i , v j , or .
• The signer generates the corresponding public key as follows:

-Compute formally (x 0 , x 1 , . . . , x 3b-1 , v 1 , v 2 , . . . , v b ) ← S • (w 1 , . . . , w 4b ) . -Compute x = x i t i and y = Q(x, v 1 , v 2 , . . . , v b ) in the quotient ring L[w 1 , . . . , w 4b ]/(w 2 1 - w 1 , . . . , w 2 4b -w 4b ) -Write y as y 0 + y 1 t + • • • + y 3b-1 t 3b-1 , with each y i ∈ F 2 [w 1 , . . . , w 4b ] -Compute pk = (p 1 , p 2 , . . . , p 2b ) ← T • (y 0 , y 1 , . . . , y 3b-1 ) .
50 Indeed, every inversion problem can be rephrased as a problem of solving multivariate quadratic equations. 51 HFE stands for "hidden field equations", a cryptographic scheme proposed in 1996 by Patarin [START_REF] Patarin | Hidden Fields Equations (HFE) and Isomorphisms of Polynomials (IP): Two New Families of Asymmetric Algorithms[END_REF]. HFE has been quickly broken [KS99; Cou01a; Cou01b; FJ03], but attacks against the HFE v-variants are less immediately severe [START_REF] Courtois | On the Security of HFE, HFEv-and Quartz[END_REF]. The "v" stands for "vinegar" i.e. the additional variables v i , and the minus "-" alludes to a a variant where 2b equations are published out of 3b. HFE, HFE -, and HFE v-were proposed in the original paper [START_REF] Patarin | Hidden Fields Equations (HFE) and Isomorphisms of Polynomials (IP): Two New Families of Asymmetric Algorithms[END_REF], along with other variants.

Similarly to other public-key candidates, additional structure may lie hidden and be exploited by an adversary -for instance by computing efficiently Gröbner bases [START_REF] Faugère | Algebraic Cryptanalysis of Hidden Field Equation (HFE) Cryptosystems Using Gröbner Bases[END_REF]. At the time of writing, the security of multivariate cryptography is not yet fully understood, with recent attacks now targeting many HFE variants [START_REF] Courtois | On the Security of HFE, HFEv-and Quartz[END_REF].

Isogeny-based cryptography

Isogeny-based cryptography is yet another post-quantum candidate.

An isogeny is a non-constant morphism φ between elliptic curves [Sil09, Chapter 3], i.e. φ : E → E such that • φ(x, y) = (φ x (x, y), φ y (x, y));

• φ x and φ y are rational functions.

Isogeny between curves over a finite field is an equivalence relation [START_REF] Tate | Endomorphisms of abelian varieties over finite fields[END_REF][START_REF] Joseph | The arithmetic of elliptic curves[END_REF].

Isogeny-based cryptography (IBC) uses isogenies with large kernels to perform key-exchange, using supersingular curves E : y 2 = x 3 + x over F p with p = 2 a 3 b g, which have exactly p + 1 points and embedding degree 2.

Such curves are normally unsuitable for cryptography since discrete logarithms on them are easy. However, they make working with isogenies easier, and attacks against IBC on ordinary curves are known [START_REF] Childs | Constructing elliptic curve isogenies in quantum subexponential time[END_REF]. IBC security relies on non-standard assumptions that generalise CDH and DDH [FJP14; CLN16]: Definition 1.7 (Supersingular CDH assumption) Let φ A : E 0 → E A , and φ B : E 0 → E B be isogenies, with 52 :

ker φ A = A = m A P A + n A Q A ker φ B = B = m B P B + n B P B
where m X , n X are chosen at random from Z/ e X X and not both divisible by X where

X = A or X = B. Given E A , E B , φ A (P B ), φ A (Q B ), φ B (P A ), φ B (Q A ), find the j-invariant of the curve E 0 / A, B .
Intuitively, this measures the difficulty of finding a path connecting two given vertices in a graph of supersingular isogenies. Under such an assumption, one performs key exchange using the commutative diagram:

E 0 E/ A E/ B E/ A, B φ A φ A φ B φ B
As the history of isogeny-based cryptography is still rather young, with the earliest work being less than twenty years old [Gal99; CLG09; GHS02], it is difficult to assess the security of such constructions in the long term.

Adversaries and security notions

1.5.1 Security games

Efficient adversaries and negligible success

The question of security can be recast as a challenge, i.e. a game played between us and an adversary. Before defining precisely which games we consider and why, let's give a precise definition of the kind of adversary that we are entertaining.

We call an algorithm efficient when it can be carried out in probabilistic polynomial-time53 ; i.e., when there exists a polynomial p(•) such that for every input x, the computation of A(x) terminates within at most p( x ) steps where x denotes the length of x in bits. That is is "probabilistic" means that we allow the algorithm to use a source of randomness, which we can think of as a special "random tape". The class of efficient algorithms is closed under composition, i.e. efficient algorithms can use other efficient algorithms as subroutines.

This model attempts to capture the breadth of algorithms that can be run on modern hardware in a reasonable amount of time. As such, any attack on a cryptographic construction that has a realistic chance of running would be a probabilistic polynomial-time algorithm, i.e. an efficient adversary.

Polynomial-time adversaries may amplify any advantage up to a polynomial factor: if an adversary could succeed in breaking a scheme with probability 1/p(n) for some polynomial p, then the scheme would not be considered secure. Conversely, a probability much smaller could not be exploited efficiently by the adversary. A function f is said to be negligible if, for every polynomial p(•), there exists an N such that for all integers n > N we have f (n) < 1/p(n). The rationale is that events occurring with negligible probability are so unlikely, that they can be ignored for all practical purposes. We will use the notation negl to refer to an arbitrary negligible function.

A construction will thence be deemed secure (in a given security game), when all efficient adversaries have only a negligible probability of success, in the sense described above.

The format of a security game

A security game captures what it means for an adversary to successfully attack a system.

To illustrate this approach, let's consider an encryption scheme, and how to assess its security. Intuitively, an encryption scheme ought to guarantee the confidentiality of messages from an eavesdropper -as such, not even one bit of information should be learned from the ciphertext.

One game that captures this intuition is the following: the adversary chooses two messages m 0 , m 1 , and we encrypt only one of these. The adversary wins if they can find which one we encrypted. This game is called the indistinguishability under chosen-plaintext attack game, or IND-CPA, and captures the notion that not even one bit is learned by the adversary. Note that in this game, the adversary may win half of the time by sheer luck. A better measure of security is thus given by the measure of how consistently the adversary succeeds; we call advantage the gap between the adversary's success rate and chance.

An encryption scheme for which all efficient adversaries have a negligible advantage in the IND-CPA game is said IND-CPA-secure. 54,55 It is essential to note at this point that there is no single notion of security that encompasses everything; one cannot claim that a construction is secure without specifying secure "in which game", i.e., "against what".

Security notions for encryption. In the particular case of encryption, IND-CPA-security is not in itself a guarantee against stronger adversaries. For instance, in some situations an adversary may have access to a certain amount of plaintext-ciphertext pairs. This scenario is captured by the IND-CCA game, but not by the IND-CPA game; hence a scheme can be IND-CPA-secure but IND-CCA-insecure.

Similarly, IND-CPA-security is not in itself a guarantee against other games. For instance, the adversary may not wish to decrypt the contents of a message, but simply to alter them. When messages have a known format, which is often the case for control messages, this may be as efficient as decryption, if not more. This scenario is captured by the NM-CPA game but not by the IND-CPA game; hence a scheme can be IND-CPA-secure but NM-CPA-insecure. Definition 1.8 (Indistinguishability security) Let E = (KeyGen, Encrypt, Decrypt) be a public-key encryption scheme, and A = (A 1 , A 2 ) be an adversary. For X ∈ {CPA, CCA1, CCA2} and κ ∈ N, define the adversarial advantage of A in the IND-X game as

Adv IND-X E,A (κ) = Pr Exp IND-X-1 E,A (κ) = 1 -Pr Exp IND-X-0 E,A (κ) = 1
where we have defined the experiment

Exp IND-X-b E,A (κ)
:

1. (pk, sk) ← E.KeyGen(κ) 2. (x0, x1, s) ← A O 1 (•) 1 (pk) 3. y ← E.Encrypt pk (x b ) 4. d ← A O 2 (•) 2
(x0, x1, s, y)

return d

and

O 1 (•) = ∅ if X = CPA E.Decrypt sk (•) otherwise O 2 (•) = E.Decrypt sk (•) if X = CCA2 ∅ otherwise
with the constraint that x 0 and x 1 have identical length, and that y is not decrypted by O 2 .

Definition 1.9 (Non-malleability security) Let E = (KeyGen, Encrypt, Decrypt) be a public-key encryption scheme, and A = (A 1 , A 2 ) be an adversary. For X ∈ {CPA, CCA1, CCA2} and κ ∈ N, define the adversarial advantage of A in the NM-X game as

Adv NM-X E,A (κ) = Pr Exp NM-X-1 E,A (κ) = 1 -Pr Exp NM-X-0 E,A (κ) = 1
where we have defined the experiment

Exp NM-X-b E,A (κ)
:

1. (pk, sk) ← E.KeyGen(κ) 2. (x0, x1, s) ← A O 1 (•) 1 (pk) 3. y ← E.Encrypt pk (x1) 4. (R, y ) ← A O 2 (•) 2
(x0, x1, s, y)

5.

x ← E.Decrypt sk (y )

6. if y = y and x = ⊥ and R(x b , x) then return 1 else return 0 with the same oracles and constraints as in Definition 1.8.

These different notions can be related, see Figure 1.10. 56The IND-CCA2 security game places much power into the adversary's hands, giving her access to an encryption and decryption oracle, which she may access as she plays the game -hence the full name for this game: indistinguishability under adaptive chosen-ciphertext attacks. This was long thought to be an artificial situation, with no real-world equivalent -until Bleichenbacher showed a concrete attack against SSLv3 [START_REF] Bleichenbacher | Chosen Ciphertext Attacks Against Protocols Based on the RSA Encryption Standard PKCS #1[END_REF].

Security notions for signatures. Signatures draw a somewhat simpler landscape, with the most interesting security game being EF-CMA [START_REF] Shafi Goldwasser | A Digital Signature Scheme Secure Against Adaptive Chosen-message Attacks[END_REF]: Many textbook signature schemes are not EF-CMA-secure; such is the case for instance of RSA signatures when no padding (or inappropriate padding) is used.

IND-CCA2 NM-CCA2 IND-CCA1 NM-CCA1 IND-CPA NM-CPA

Security models

Ideal models

In the context of provable security, it is often useful to replace concrete primitives (such as SHA-3 or AES) by idealised versions thereof. On the one hand this often makes proofs simpler, by focusing on high-level, simple properties of these constructions. On the other hand, the resulting proofs are more general, because what is said does not depend on the concrete choice of e.g. cipher or hash function. However, there might be situations where concrete primitives behave differently from their ideal counterparts, at which point a security proof in the ideal model becomes meaningless, or even deceitful.

Random oracle model.

The random oracle model (ROM, [BR93a; CGH98; FS87]) models the operation of hash functions as queries to a special entity called the random oracle. This oracle, upon receiving a new query, replies with a true random number in some sampling space; upon receiving again that query, the oracle replies with the same number. Hence a random oracle captures the intuition of an ideal hash function.

The ROM is a very powerful setting, especially for the security proofs of signature schemes. For instance, the security of OAEP, RSA-FDH, PSS, and of Schnorr signatures were first established in that model. In fact, the security of FDH cannot be proven generically without it [START_REF] Dodis | On the Generic Insecurity of the Full Domain Hash[END_REF].

However, no concrete algorithm can implement a true random oracle; this leads to interesting situations where a cryptosystem is provably secure in the ROM, but provably insecure when any concrete hash function is used instead [START_REF] Canetti | The Random Oracle Methodology, Revisited (Preliminary Version)[END_REF]. Such constructions are very unnatural from a cryptographic point of view [START_REF] Koblitz | The random oracle model: a twenty-year retrospective[END_REF] but illustrate that there exists a gap between the ideal model and real-world implementations.

Ideal cipher model. The ideal cipher model (ICM) pertains to symmetric encryption; in this model the concrete encryption and decryption primitives are replaced by an oracle that takes a key and input, and replies with an output that is truly random when encrypting a new plaintext or decrypting a neverencrypted-before ciphertext. As for the ROM, many schemes have been proven secure in the ICM [BRS02; Des00; EM93; KR01]. As for the ROM, there are (artificial) schemes that are provably secure in the ICM, but provably insecure for any concrete block cipher [START_REF] Black | The Ideal-Cipher Model, Revisited: An Uninstantiable Blockcipher-Based Hash Function[END_REF]. In fact the ROM and ICM are equivalent [START_REF] Jean-Sébastien Coron | The Random Oracle Model and the Ideal Cipher Model Are Equivalent[END_REF].57 Generic group model. The generic group model (GGM, [START_REF] Shoup | Lower Bounds for Discrete Logarithms and Related Problems[END_REF]) captures the notion of an abstract group on which no further structure can be exploited, unlike e.g. finite fields. In that model, one is given access to a randomly chosen encoding of a group, and use an oracle to perform the group operation. As in the ROM, one can construct schemes that are provably secure in the GGM but provably insecure when any concrete group is used to implement them [START_REF] Dent | Adapting the Weaknesses of the Random Oracle Model to the Generic Group Model[END_REF]. Nevertheless, it is not known at the time of writing whether the GGM and ROM are equivalent. The security of DSA and Schnorr signatures can be proven in the GGM [START_REF] Daniel | Generic Groups, Collision Resistance, and ECDSA[END_REF] under relatively weak concrete assumptions for the hash function.

Common reference string models. The common reference string58 (CRS, [Dam00; FF11; CF01]) models assume that all the participants have access to a common string, that is drawn from some specified distribution. This reference string is chosen ahead of time and is made available before any interaction starts. This setting is useful in proving the security of zero-knowledge protocols [START_REF] Damgård | Efficient Concurrent Zero-Knowledge in the Auxiliary String Model[END_REF] and commitment schemes, as it gives a simulator additional power (namely, the ability to choose the reference string and plant trapdoors in it [START_REF] Fischlin | Efficient Non-Malleable Commitment Schemes[END_REF]).

Schemes proven secure in the CRS model are secure given that the setup was performed correctly.

The CRS model allows the construction of primitives that are impossible without it, such as bit commitment protocols that are universally composable [START_REF] Fischlin | Efficient Non-Malleable Commitment Schemes[END_REF].

Special setups and trusted parties. We may assume that some participants in a protocol are never under the control of an adversary, and that there exists a secure communication channel between them and other participants. There exist protocols for which such trusted third parties (TTP) are necessary, such as early fair contract signing protocols [START_REF] Ben-Or | Completeness Theorems for Non-Cryptographic Fault-Tolerant Distributed Computation (Extended Abstract)[END_REF]. TTPs for setup operations, which are sometimes called authorities in that context, may be considered -typical public-key infrastructures, for instance, rely on certification authorities to assess the validity and legitimacy of public keys.

Schemes that assume a trusted third party for setup or other operations may be completely compromised when an adversay takes even partial control of that entity (see, e.g., [START_REF] Young | The Dark Side of "Black-Box" Cryptography, or: Should We Trust Capstone?[END_REF]).

Standard model

All the constructions that do not ground their security in ideal models are said to be in the standard model. 59In light of the separation results given above, proofs in the standard model achieve the highest level of confidence; however they are notoriously difficult to find, and they are often looser than their ideal model counterparts.

Chapter 2

Results and contributions Contents

Organisation of this thesis.

In Chapter 3, we extend the notion of zero-knowledge protocols in three directions: Space, time and energy. Concretely, Section 3.1 constructs a distributed zero-knowledge protocol that can authenticate a group of devices together; Section 3.2 shows how to use shorter commitments than previously thought possible, at the cost of timing constraints; and Section 3.3 describes a general securitycomputation effort tradeoff, that applies to a large class of zero-knowledge protocols, and results in more lightweight constructions.

Chapter 4 discusses digital signature schemes. We extend them functionally in Section 4.1, solving an open problem posed by Naccache [START_REF] Naccache | Is theoretical cryptography any good in practice?[END_REF]. Section 4.3 improves on Schnorr signatures: we show how to securely reuse the nonce, which furthermore enables us to compute signatures in less operations. In Section 4.2 we consider the scenario of contract signing, that provides a form of fairness without resorting to trusted third parties. Finally, we define and solve the certification authority dilemma: they are expected to stand surety for their clients' keys, but these keys may not be properly generated. Certifying insecure keys is not only bad for end-users, but it also impacts negatively the certification authority. Naturally, asking for the private keys to ensure proper generation is not a better option. This difficult dilemma is dealt with in Section 4.4, where we describe a general-purpose mechanism to prove that a given procedure was used to generate RSA public keys.

In Chapter 5 we focus on encryption. After extending and improving upon the Naccache-Stern knapsack cryptosystem in Sections 5.1 and 5.2, we describe in Section 5.3 a general transformation to turn digital signatures into public-key cryptosystems -since signatures can usually rely on many different assumptions, this may extend the toolset of available primitives. As a surprising result this constructions gives "split" cryptosystems, where the public key is not a function of the private key. In Section 5.4 we perform a practical cryptanalysis of a beautiful and recent PKC proposed by Aggarwal et al. In last resort, we explore in Section 5.5 the possibility of using human intellect as a hard problem, drawing consequence from the (falsifiable) assumption that humans can solve efficiently problems that machines cannot. Finally Section 5.6 considers the possibility of an unbounded adversary, powerful enough to try all possible decryption keys, and discusses how to design beyond-brute-force secure cryptosystems.

Chapter 6 addresses side channels. We first describe in Section 6.1 how we used side-channel analysis to unravel the workings of a sophisticated payment card fraud; and countermeasures against similar attacks in the future. Section 6.2 introduces a microprocessor architecture along with a special compiler, that we designed to protect against power attacks. Section 6.3 highlights a new cross-OS covert channel.

Chapter 7 is concerned with computer exploitation. In Section 7.4 we formulate the optimal botnet problem, i.e. the notion of a strategy that guarantees the fastest conquest of a network by an adversary. We show in Section 7.1 how to bypass certain protections to run arbitrary, polymorphic code on a variety of devices, including an unmodified iPhone 61 and a DragonBoard 410c. In Section 7.2 how to generically transform the control flow of a program without altering its functionality, resulting in programs that successfully evade all current antivirus detectors. Section 7.3 introduces a new, stealthy hardware trojan, which enable us to recover secret cryptographic keys.

Chapter 8 introduces new building blocks; the notion and a construction of community-serving proofs of works is described in Section 8.1, building from a hard graph problem. Section 8.2 introduces the question of optimal batch signature verification, for which we provide an analysis, algorithms, and heuristics. Finally, Section 8.3 summarises an attempt at constructing very efficient cryptographic multilinear maps -while we should insist that our construction is now broken, because of recent progress in the cryptanalysis of the similar [START_REF] Jean-Sébastien Coron | New Multilinear Maps Over the Integers[END_REF], we think that some contributions and techniques introduced in this work are useful; in particular, the perspective of designing efficient multi-user key agreement protocols, be it using multilinear maps or not, seems an interesting research avenue.

Chapter 9 describes several improvements to well-known algorithms and problems. Section 9.1 introduces an efficient multiplication algorithm, which outperform known techniques in the scenario that one multiplicand is known in advance. In Section 9.3 we show how to choose specific -yet securemoduli resulting in a twofold performance improvement when using Barrett reduction. Independently, extending Barrett reduction to polynomials, Section 9.4 improves the performance of BCH errorcorrecting codes. Higher-level primitives can also be improved; we complete in Section 9.2 the picture of a Micali and Shamir protocol. Finally, we introduce in Section 9.5 a queue-theoretic construction that regulates its output, with applications in random number generation, making it easier to design hardware blocks, resulting in conceptually and physically smaller, and more energy-efficient designs.

Chapter 10 gathers some mathematical constructions which are not strictly speaking cryptographic but nevertheless may have interesting cryptographic applications, or at least some thematic connection to cryptography. In Section 10.1 we introduce a number-theoretic error-correcting code. Section 10.2 explores the possibility of constructing some families of elliptic curves on which a variant of the knapsack cryptosystem could be designed. Section 10.3 extends a theorem of Laguerre on the location of polynomial roots. The notion of identity stems from the intuition that individuals can be singled out, and that the same could be said of machines. However, machines being the result of industrial production, we may expect them to be identical, and therefore to lack any intrisic notion of identity. The cryptographic answer to this dilemma is to endow otherwise identical devices with a unique secret -this secret uniquely identifies each of them.

Personal bibliography

Conference articles

We call identification the process by which a device establishes its knowledge of the secret; we call authentication the process by which a device identifies itself, or guarantees it is the author of its actions or messages.

Suddenly, we face an interesting challenge: How does one check identity? The straightforward strategy is to give the verfier a copy of the secret; he would then ask the prover its secret, and compare to a reference. This approach is wormed with flaws, but helps in pointing out some important facts about identification protocols. A first issue is the possibility of an eavesdropper, i.e. an adversary that listens to the exchanges between prover and verifier, and thereby learns the prover's secret. A second issue is the dishonest verifier situation, whereby the verifier steals the prover's secret, e.g. to impersonate the prover to a third party. A third issue is that of an adversary that contacts the verifier and tries many "secrets", in hope that one happens to be correct.

Defending against such scenarios calls for two key features of identification protocols. The first is an asymmetry between prover and verifier, such that one can prove their identity (i.e. their knowledge of the secret) without giving it away. The second is that an eavesdropper does not learn anything from tapping into communications (neither success, failure, nor any part of the secret): In particular, an eavesdropper cannot "replay" a previous conversation successfully.

Such desirable properties are realised by so-called zero-knowledge protocols. It may be surprising that such protocols exist at all: They literally allow one to prove knowledge of some fact (e.g. that they have a proof of the Riemann hypothesis) without giving out any other information at all. In particular, in the context of identification, one can prove knowledge of a secret, without revealing this secret. What is maybe even more surprising is the result that a vast class of statements can be proved in this fashion, namely all those of NP.

One typical recipe for constructing zero-knowledge identification consists in designing a three-round protocol. The last two rounds are respectively a question to the prover, and its response. The essential addition is the first round, in which the prover commits to some (usually random) value. This commitment will determine the verfier's question, but will also enable the prover to hide (or "blind") her secret from the response.

In this chapter, we extend this notion in three directions: Space, time and energy. Concretely, Section 3.1 constructs a distributed zero-knowledge protocol that can authenticate a group of devices together; Section 3.2 show how to use shorter commitments (thereby breaking a theoretical barrier due to Girault and Stern), by leveraging timing constraints; and Section 3.3 describes a general security-computation effort tradeoff, that applies to a large class of zero-knowledge protocols, and results in more lightweight constructions.

Introduction

A growing market focuses on lightweight devices, whose low cost and easy production allow for creative and pervasive uses. The Internet of Things (IoT) consists in spatially distributed nodes that form a network, able to control or monitor physical or environmental conditions (such as temperature, pressure, image and sound), perform computations or store data. IoT nodes are typically low-cost devices with limited computational resources and limited battery. They transmit the data they acquire through the network to a gateway, also called the transceiver, which collects information and sends it to a processing unit. Nodes are usually deployed in hostile environments, and are therefore susceptible to physical attacks, harsh weather conditions and communication interferences.

Due to the open and distributed nature of the IoT, security is key to the entire network's proper operation [VPH + 11]. However, the lightweight nature of sensor nodes heavily restricts the type of cryptographic operations that they can perform, and the constrained power resources make any communication costly.

This paper describes an authentication protocol that establishes network integrity, and leverages the distributed nature of computing nodes to alleviate individual computational effort. This enables the base station to identify which nodes need replacement or attention. This is most useful in the context of wireless sensor networks and the IoT, but applies equally well to mesh network authentication and similar situations.

Related work:

Zero Knowledge (ZK) protocols have been considered for authentication of wireless sensor networks. For instance, Anshul and Roy [START_REF] Anshul | A ZKP-based Identification Scheme for Base Nodes in Wireless Sensor Networks[END_REF] describe a modified version of the Guillou-Quisquater identification scheme [START_REF] Guillou | A Practical Zero-Knowledge Protocol Fitted to Security Microprocessor Minimizing Both Trasmission and Memory[END_REF], combined with the µTesla protocol [PST + 02] for authentication broadcast in constrained environments. We stress that the purpose of the scheme of [START_REF] Anshul | A ZKP-based Identification Scheme for Base Nodes in Wireless Sensor Networks[END_REF], and similar ones, is to authenticate the base station.

Aggregate signature schemes such as [BGL + 03; ZQW + 10] may be used to achieve the goal pursued here -however they are intrinsically non-interactive, and the most efficient aggregate constructions use elliptic curve pairings, which require powerful devices.

Closer to our concerns, [UMS11] describes a ZK network authentication protocol, but it only authenticates two nodes at a time, and the base station acts like a trusted third party. As such it takes a very large number of interactions to authenticate the network as a whole.

What we propose instead is a collective perspective on authentication and not an isolated one.

Preliminaries

Fiat-Shamir authentication

The Fiat-Shamir authentication protocol [START_REF] Fiat | How to Prove Yourself: Practical Solutions to Identification and Signature Problems[END_REF] enables a prover P to convince a verifier V that P possesses a secret key without ever revealing the secret key [START_REF] Shafi Goldwasser | The Knowledge Complexity of Interactive Proof-Systems (Extended Abstract)[END_REF][START_REF] Feige | Zero-Knowledge Proofs of Identity[END_REF]. The algorithm first runs a one-time setup, whereby a trusted authority publishes an RSA modulus n = pq but keeps the factors p and q private. The prover P selects a secret s < n such that gcd(n, s) = 1, computes v = s 2 mod n and publishes v as its public key.

When a verifier V wishes to identify P, he uses the protocol of Protocol 1. V may run this protocol several times until V is convinced that P indeed knows the square root s of v modulo n.

Protocol 1: Fiat-Shamir Authentication

Prover

Verifier

r $ ← -[1, n -1] x ← r 2 mod n x -----→ {e1, . . . , e k } $ ← -{0, 1} k e 1 ,...,e k ←----- y ← r k i=1 s e i i mod n y -----→ Check y 2 = x k i=1 v e i i mod n
Protocol 1 describes the original Fiat-Shamir authentication protocol [START_REF] Fiat | How to Prove Yourself: Practical Solutions to Identification and Signature Problems[END_REF], which is honest verifier zero-knowledge1 , and whose security is proven assuming the hardness of computing arbitrary square roots modulo a composite n, which is equivalent to factoring n.

As pointed out by [START_REF] Fiat | How to Prove Yourself: Practical Solutions to Identification and Signature Problems[END_REF], instead of sending x, P can hash it and send the first bits of H(x) to V, for instance the first 128 bits. With that variant, the last step of the protocol is replaced by the computation of H(y 2 k i=1 v ai i mod n), truncated to the first 128 bits, and compared to the value sent by P. Using this "short commitment" version reduces somewhat the number of communicated bits. However, it comes at the expense of a reduced security level. A refined analysis of this technique in given in [START_REF] Girault | On the Length of Cryptographic Hash-Values Used in Identification Schemes[END_REF].

Topology-aware distributed spanning trees

Due to the unreliable nature of sensors, their small size and wireless communication system, the overall network topology is subject to change. Since sensors send data through the network, a sudden disruption of the usual route may result in the whole network shutting down.

Topology-aware networks A topology-aware network detects changes in the connectivity of neighbours, so that each node has an accurate description of its position within the network. This information is used to determine a good route for sending sensor data to the base station. This could be implemented in many ways, for instance by sending discovery messages (to detect additions) and detecting unacknowledged packets (for deletions). Note that the precise implementation strategy does not impact the algorithm.

Given any graph G = (V, E) with a distinguished vertex B (the base station), the optimal route for any vertex v is the shortest path from v to B on the minimum degree spanning tree S = (V, E ) of G. Unfortunately, the problem of finding such a spanning tree is NP-hard [START_REF] Singh | Approximating minimum bounded degree spanning trees to within one of optimal[END_REF], even though there exist optimal approximation algorithms [SL07; LV08]. Any spanning tree would work for the proposed algorithm, however the performance of the algorithm gets better as the spanning tree degree gets smaller.

Mooij-Goga-Wesselink's algorithm

The network's topology is described by a spanning tree W constructed in a distributed fashion by the Mooij-Goga-Wesselink algorithm [START_REF] Arjan | A distributed spanning tree algorithm for topology-aware networks[END_REF]. We assume that nodes can locally detect whether a neighbour has appeared or disappeared, i.e. graph edge deletion and additions.

W is constructed by aggregating smaller subtrees together. Each node in W is attributed a "parent" node, which already belongs to a subtree. The complete tree structure of W is characterized by the parenthood relationship, which the Mooij-Goga-Wesselink algorithm computes. Finally, by topological reordering, the base station T can be put as the root of W .

Each node in W has three local variables {parent, root, dist} that are initially set to a null value ⊥. Nodes construct distributively a spanning tree by exchanging "M -messages" containing a root information, distance information and a type. The algorithm has two parts:

• Basic: maintains a spanning tree as long as no edge is removed (it is a variant of the union-find algorithm [CSR + 01]). When a new neighbour w is detected, a discovery M -message (root, dist) is sent to it. If no topology change is detected for w, and an M -message is received from it, it is processed by Algorithm 1. Note that a node only becomes active upon an event such as the arriving of an M -message or a topology change.

• Removal: intervenes after the edge deletion so that the basic algorithm can be run again and give correct results.

Algorithm 1: Mooij-Goga-Wesselink Algorithm (Basic part)

Receive: An M -message (r, d) coming from a neighbour w.

1. (parent, root, dist) ← (⊥, ⊥, ⊥) 2. if (r, d + 1) < (root, dist) 3. parent ← w 4. root ← r 5. dist ← d + 1 6.
send the M -message (root, dist) to all neighbours except w Algorithm 1 has converged once all topology change events have been processed. At that point we have a spanning tree [START_REF] Arjan | A distributed spanning tree algorithm for topology-aware networks[END_REF].

For our purposes, we may assume that the network was setup and that Algorithm 1 is running on it, so that at all times the nodes of the network have access to their parent node. Note that this incurs very little overhead as long as topology changes are rare.

Distributed Fiat-Shamir authentication

The approach

Given a k-node network N 1 , ..., N k , we may consider the nodes N i as users and the base station as a trusted center T . In this context, each node will be given only an2 s i . To achieve collective authentication, we propose the following Fiat-Shamir based algorithm:

• Step 0: Wait until the network topology has converged and a spanning tree W is constructed with Algorithm 1 presented in Section 3.1.2.2. When that happens, T sends an authentication request message (AR-message) to all the N i directly connected to it. The AR-message may contain a commitment to e (cf. Step 2) to guarantee the protocol's zero-knowledge property even against dishonest verifiers.

•

Step 1: Upon receiving an AR-message, each N i generates a private r i and computes x i ← r 2 i mod n. N i then sends an A-message to all its children, if any. When they respond, N i multiplies all the x j sent by its children together, and with its own x i , and sends the result up to its own parent. This recursive construction enables the network to compute the product of all the x i s and send the result x c to the top of the tree in d steps (where d = deg W ). This is illustrated for a simple network including 4 nodes and a base station in Figure 3.1.

•

Step 2: T sends a random e as an authentication challenge (AC-message) to the N i directly connected to it.

• Step 3: Upon receiving an AC-message e, each N i computes y i ← r i s ei i . N i then sends the ACmessage to all its children, if any. When they respond, N i multiplies the y j values received from all its children together, and with its own y i , and sends the result to its own parent. The network therefore computes collectively the product of all the y i 's and transmits the result y c to T . This is illustrated in Figure 3.2.

• Step 4: Upon receiving y c , T checks that y 2 c = x c v ei i , where v 1 , . . . , v k are the public keys corresponding to s 1 , . . . , s k respectively.

T x c = x 4 mod n N 4 x 4 = r 2 4 x 1 x 2 x 3 N 2 x 2 = r 2 2 N 3 x 3 = r 2 3 N 1 x 1 = r 2 1 Figure 3.1: The construction of x c . T y c = y 4 mod n N 4 y 4 = r 4 s e4 4 y 1 y 2 y 3 N 2 y 2 = r 2 s e2 2 N 3 y 3 = r 3 s e3 3 N 1 y 1 = r 1 s e1 1 Figure 3.2:
The construction of y c .

Figure 3.3: The proposed algorithm running on a network. Each parent node aggregates the values computed by its children and adds its own information before transmitting the result upwards to the base station.

Note that the protocol may be interrupted at any step. In the version of the algorithm that we have just described, this results in a failed authentication.

Back-up authentication

Network authentication may fail for many reasons described and analysed in detail in Section 3.1.4.3. As a consequence of the algorithm's distributed nature that we have just described, a single defective node suffices for authentication to fail. This is the intended behaviour; however there are contexts in which such a brutal answer is not enough, and more information is needed. For instance, one could wish to know which node is responsible for the authentication failure.

A simple back-up strategy consists in performing usual Fiat-Shamir authentication with all the nodes that still respond, to try and identify where the problem lies. Note that, as long as the network is healthy, using our distributed algorithm instead is more efficient and consumes less bandwidth and less energy.

Since all nodes already embark the hardware and software required for Fiat-Shamir computations, and can use the same keys, there is no real additional burden in implementing this solution.

Security Proofs

In this section we wish to discuss the security properties relevant to our construction. The first and foremost fact is that algorithm given in Figure 3.2 is correct: a legitimate network will always succeed in proving its authenticity, provided that packets are correctly transmitted to the base station T (possibly hopping from node to node) and that nodes perform correct computations.

The interesting part, therefore, is to understand what happens when such hypotheses do not hold.

Soundness

Lemma 3.1 (Soundness) If the authentication protocol succeeds then with overwhelming probability the network nodes are genuine.

Proof: Assume that an adversary A simulates the whole network, but does not know the s i , and cannot compute in polynomial time the square roots of the public keys v i . Then, as for the original Fiat-Shamir protocol [START_REF] Fiat | How to Prove Yourself: Practical Solutions to Identification and Signature Problems[END_REF], the base station will accept A's identification with probability bounded by 2 k where k is the number of nodes.

Zero-knowledge Lemma 3.2 (Zero-knowledge)

The distributed authentication protocol of Section 3.1.3.1 achieves statistical zero-knowledge.

Proof: Let P be a prover and A be a (possibly cheating) verifier, who can use any adaptive strategy and bias the choice of the challenges to try and obtain information about the secret keys. Consider the following simulator S :

Step 1. Choose e $ ← -{0, 1} k and y $ ← -[0, n -1] using any random tape ω

Step 2. Compute x ← y 2 v ei i and output (x, e, y).

The simulator S runs in polynomial time and outputs triples that are indistinguishable from the output of a prover that knows the corresponding private key.

If we assume the protocol is run N times, and that A has learnt information which we denote η, then A chooses adaptively a challenge using all information available to it e(x, η, ω) (where ω is a random tape). The proof still holds if we modify S in the following way:

Step 1. Choose e Note that the protocol is also "locally" ZK, in the sense that an adversary simulating out of k nodes of the network still has to face the original Fiat-Shamir protocol.

Security analysis

Choice of parameters Let λ be a security parameter. To ensure this security level the following constraints should be enforced on parameters:

• The identification protocol should be run t ≥ λ/k times (according to Lemma 3.1), which is reasonably close to one as soon as the network is large enough;

• The modulus n should take more than 2 λt operations to factor;

• Private and public keys are of size comparable to n.

Complexity

The number of operations required to authenticate the network depends on the exact topology at hand, but can safely be bounded above:

• Number of modular squarings: 2kt

• Number of modular multiplications ≤ 3kt

In average, each N i performs only a constant (a small) number of operations. Finally, only O(d) messages are sent, where d is the degree of the minimum spanning tree of the network. Pathological cases aside, d = O(log k), so that only a logarithmic number of messages are sent during authentication. All in all, for λ = 256, k = 1024 nodes and t = 1, we have n ≥ 2 1024 , and up to 5 modular operations per node.

Root causes of authentication failure

Authentication may fail for several reasons. This may be caused by network disruption, so that no response is received from the network -at which point not much can be done.

However, more interestingly, T may have received an invalid value of y c . The possible causes are easy to spot: 1. A topology change occurred during the protocol:

• If all the nodes are still active and responding, the topology will eventually converge and the algorithm will get back to Step 0.

• If however, the topology change is due to nodes being added or removed, the network's integrity has been altered.

2. A message was not transmitted: this is equivalent to a change in topology.

3.

A node sent a wrong result. This may stem from low battery failure or when errors appear within the algorithm the node has to perform (fault injection, malfunctioning, etc). In that case authentication is expected to fail.

Effect of network noise

Individual nodes may occasionally receive incorrect (ill-formed, or well-formed but containing wrong information) messages, be it during topology reconstruction (M -messages) or distributed authentication (A-messages). Upon receiving incorrect A or M messages, nodes may dismiss them or try and acknowledge them, which may result in a temporary failure to authenticate. An important parameter which has to be taken into account in such an authentication context is the number of children of a node. When a node with many children starts failing, all its children are disconnected from the network and cannot be contacted or authenticated anymore. While a dysfunction at the leaf level might be benign, the failure of a fertile node is catastrophic.

Man-in-the-Middle An adversary could install itself between nodes, or between nodes and the base station, and try to intercept or modify communications. Lemma 3.2 proves that a passive adversary cannot learn anything valuable, and Lemma 3.1 shows that an active adversary cannot fool authentication.

It is still possible that the adversary relays information, but any attempt to intercept or send messages over the network would be detected.

Variants and implementation trade-offs

The protocol may be adapted to better fit operational constraints: in the context of IoT for instance communication is a very costly operations. We describe variants that aim at reducing the amount of information sent by individual nodes, while maintaining security.

Shorter challenges variant

In the protocol, the long (say, 128-bit) challenge e is sent throughout the network to all individual nodes. One way to reduce the length of e without compromising security is the following:

• A short (say, 80-bit) value e is sent to the nodes;

• Each node i computes e i ← H(e i), and uses e i as a challenge;

• The base station also computes e i the same way, and uses this challenge to check authentication. This variant does not impact security, assuming an ideal hash function H, and it can be used in conjunction with the other improvements described below.

Multiple-secret variant

Instead of keeping one secret value s i , each node could have multiple secret values s i,1 , . . . , s i, . Note that these additional secrets need not be stored: they can be derived from a secret seed.

The multiple secret variant is described here for a single node, for the sake of clarity. Upon receiving a challenge e i (assuming for instance that e i was generated by the above procedure), each node computes a response

y i ← r i s ei,1 i,1 s ei,2 i,2 • • • s e i, i, mod n.
This can be checked by the verifier by checking whether

y 2 i ? = x i v ei,1 i,1 v ei,2 i,2 • • • v e i, i,
mod n.

To do swarm authentication, it suffices to perform aggregation as described in the protocol of Section 3.1.3 at intermediate nodes.

Using this approach, one can adjust the memory-communication trade-off, as the security level is λ = t (single-node compromission). Therefore, if = 80 for instance, it suffices to authenticate once to get the same security as t = 80 authentications with = 1 (which is the protocol of Section 3.1.3). This drastically cuts bandwidth usage, a scarce resource for IoT devices.

Furthermore, computational effort can be reduced by using batch exponentiation techniques to compute y i .

Precomputed alphabet variant

A way to further reduce computational cost is the following: each node chooses an alphabet of m words w 0 , . . . , w m-1 (a word is a 32-bit value), and computes once and for all the table of all pairwise products p i,j = m i m j . Note that each p i,j entry is 64 bit long.

The values s i are generated by randomly sampling from this alphabet. Put differently, s i is built by concatenating u words (bit patterns) taken from the alphabet only.

We thus see that the s i , which are mu-bit integers, can take m u possible values. For instance if m = u = 32 then s i is a 1024-bit number chosen amongst 32 32 = 2 160 possible values. Thanks to the lookup table, most multiplications need not be performed, which provides a substantial speed-up over the naive approach.

The size of the lookup table is moderate, for the example given, all we need to store is 32×31/2+32 = 528 values. This can be further reduced by noting that the first lines in the table can be removed: 32 values are zeros, 31 values are the results of multiplications by 1, 30 values are left shifts by 1 of the previous line, 29 values are the sum of the previous 2 and 28 values are left shifts by 2. Hence all in all the table can be compressed into 528 -32 -31 -29 -28 = 408 entries. Because each entry is a word, this boils down to 1632 bytes only.

Precomputed combination variant

The idea is that computational cost can be cut down if we precompute and store some products, only to assemble them online during Fiat-Shamir authentication: the values of

s i,1,2 ← s i,1 s i,2 , s i,2,3 ← s i,2 s i,3 , ... are stored in a lookup table.
The use of combined values s i,a,b in the evaluation of y results in three possible scenarios for each:

1. s a s b appears in y -the probability of this occurring is 1/4 -in which case one additional multiplication must be performed;

2. s a s b does not appear in y -the probability of this occurring is 1/4 -in which case no action is performed;

3. s a or s b appears, but not both -this happens with probability 1/2 -in which case one single multiplication is required.

As a result the expected number of multiplications is reduced by 25%, to wit 3 4 × 2 m-1 , where m is the size of e.

The method can be extended to work in a window of size κ ≥ 2, for instance with κ = 3 we would precompute:

s i,3n,3n+1 ← s i,3n s i,3n+1 s i,3n+1,3n+2 ← s i,3n+1 s i,3n+2 s i,3n,3n+2 ← s i,3n s i,3n+2 s i,3n,3n+1,3n+2 ← s i,3n s i,3n+1 s i,3n+2
Following the same analysis as above, the expected number of multiplications during the challenge-response phase is 7 8 × 2 m 3 . The price to pay is that larger values of κ claim more precomputing and memory. More precisely, we have the following trade-offs, writing µ = 2 m mod κ:

Multiplications (expected) = 2 m 2 κ -1 2 κ 2 m κ -1 - 2 µ -1 2 µ Pre-multiplications = -1 + (2 κ -κ -1) 2 m κ + (2 µ -µ -1) Stored Values = (2 κ -1) 2 m κ + (2 µ -1)
where is the number of components of s i .

Conclusion

In this work we describe a distributed Fiat-Shamir authentication protocol that enables network authentication using very few communication rounds, thereby alleviating the burden of resource-limited devices such as wireless sensors and other IoT nodes. Instead of performing one-on-one authentication to check the network's integrity, our protocol gives a proof of integrity for the whole network at once.

Zero knowledge with colliding commitments: Slow-motion zero-knowledge

Introduction

Authentication is a cornerstone of information security, and much effort has been put in trying to design efficient authentication primitives. However, even the most succinct authentication protocols require collision-resistant commitments. As proved by Girault and Stern [START_REF] Girault | On the Length of Cryptographic Hash-Values Used in Identification Schemes[END_REF], breaking beyond the collisionresistance size barrier is impossible. This paper shows that if we add the assumption that the verifier can measure the prover's response time, then commitment collision-resistance becomes unnecessary. We call this new construction slow-motion zero knowledge (SM-ZK). As we will show, the parameter determining commitment size in SM-ZK protocols is the attacker's online computational power rather than the attacker's overall computational power. As a result, SM-ZK allows a significant reduction (typically by a factor of 4 to 6) of the prover's commitment size.

The prover's on-line computational effort remains unchanged (enabling instant replies in schemes such as GPS [START_REF] Girault | On the Fly Authentication and Signature Schemes Based on Groups of Unknown Order[END_REF]). The prover's offline work is only slightly increased. The main price is paid by the verifier who has to solve a time-puzzle per session. The time taken to solve this time-puzzle determines the commitment's shortness.

The major contribution of this work is thus a technique forcing a cheating prover to either attack the underlying zero-knowledge protocol or exhaust the space of possible replies in the presence of a time-lock function that slows down his operations. When this time-lock function is properly tuned, a simple time-out on the verifier's side rules out cheating provers. It is interesting to contrast this approach to the notion of knowledge tightness introduced by Goldreich, Micali and Widgerson [START_REF] Goldreich | Proofs that Yield Nothing But Their Validity for All Languages in NP Have Zero-Knowledge Proof Systems[END_REF], and generalizations such as precise/local ZK introduced by Micali and Pass [START_REF] Micali | Local zero knowledge[END_REF], which uses similar time-constraint arguments but to prove reduced knowledge leakage bounds.

Building blocks

SM-ZK combines two existing building blocks that we now recall: three-pass zero-knowledge protocols and time-lock functions.

Three-pass zero-knowledge protocols

A Σ-protocol [HL10; Dam10; GMR85] is a generic 3-step interactive protocol, whereby a prover P communicates with a verifier V. The goal of this interaction is for P to convince V that P knows some value -without revealing anything beyond this assertion. The absence of information leakage is formalized by the existence of a simulator S, whose output is indistinguishable from the recording (trace) of the interaction between P and V.

The three phases of a Σ protocol can be summarized by the following exchanges:

x -----→ P c ← ----- V y -----→
Namely,

• The prover sends a commitment x to the verifier;

• The verifier replies with a challenge c;

• The prover gives a response y.

Upon completion, V may accept or reject P, depending on whether P's answer is satisfactory. Such a description encompasses well-known identification protocols such as Feige-Fiat-Shamir [START_REF] Feige | Zero-Knowledge Proofs of Identity[END_REF] and Girault-Poupard-Stern [START_REF] Girault | An Identity-based Identification Scheme Based on Discrete Logarithms Modulo a Composite Number[END_REF].

Formally, let R be some (polynomial-time) recognizable relation, then the set L = {v s.t. ∃w, (v, w) ∈ R} defines a language. Proving that v ∈ L therefore amounts to proving knowledge of a witness w such that (v, w) ∈ R. A Σ-protocol satisfies the following three properties:

• Completeness: given an input v and a witness w such that (v, w) ∈ R, P is always able to convince V.

• Special honest-verifier zero-knowledge3 : there exists a probabilistic polynomial-time simulator S which, given v and a c, outputs triples (x, c, y) that have the same distribution as in a valid conversation between P and V.

• Special soundness: given two accepting conversations for the same input v, with different challenges but an identical commitment x, there exists a probabilistic polynomial-time extractor procedure E that computes a witness w such that (v, w) ∈ R.

Many generalizations of zero-knowledge protocols have been discussed in the literature. One critical question for instance is to compose such protocols in parallel [GMW91a; MP06], or to use weaker indistiguishability notions (e.g., computational indistinguishability).

Commitment pre-processing

Because the commitment x does not depend on the challenge c, authors quickly noted that x can be prepared in advance. This is of little use in protocols where the creation of x is easy (e.g., Fiat-Shamir [START_REF] Feige | Zero-Knowledge Proofs of Identity[END_REF]). Discrete-logarithm commitment pre-processing is a well-known optimization technique (e.g., [de 97; MN94]) that exploits two properties of DLP:

1. In DLP-based protocols, a commitment is generated by computing the exponentiation x = g r in a well-chosen group. This operation claims most of the prover's efforts.

2. The commitment x being unrelated to the challenge c, can hence be computed in advance. A "pre-computed commitment" is hence defined as {r, x} computed in advance by P4 . Because several pre-computed commitments usually need to be saved by P for later use, it is possible to derive all the r i components by hashing a common seed.

Such pre-processing is interesting as it enables very fast interaction between prover and verifier. While the technique described in this work does not require the use of pre-processing, it is entirely compatible with such optimizations.

Time-lock puzzles

Time-lock puzzles [RSW96; MMV11] are problems designed to guarantee that they will take (approximately) τ units of time to solve. Like proof-of-work protocols [START_REF] Dwork | Pricing via Processing or Combatting Junk Mail[END_REF], time-locks have found applications in settings where delaying requests is desirable, such as fighting spam or denial-of-service attacks, as well as in electronic cash [ABM + 05; DGN03; DNW05]. Time-lock puzzles may be based on computationally demanding problems, but not all such problems make good time-locks. For instance, inverting a weak one-way function would in general not provide a good time-lock candidate [START_REF] Rivest | Time-lock puzzles and timed-release crypto[END_REF]. The intuition is that the time it takes to solve a time-lock should not be significantly reduced by using more computers (i.e., parallel brute-force) or more expensive machines.

A time-lock puzzle is informally described as a problem such that there is a super-polynomial gap between the work required to generate the puzzle, and the parallel time required to solve it (for a polynomial number of parallel processors). The following definition formalizes this idea [START_REF] Ciobotaru | On the (non-) equivalence of UC security notions[END_REF].

Definition 3.1 (Time-lock puzzle)

A time-lock puzzle is the data two PPT algorithms T G (1 k , t) (problem generator) and T V (1 k , a, v) (solution verifier) satisfying the following properties:

• For every PPT algorithm B(1 k , q, h), for all e ∈ N, there exists m ∈ N such that (k). Intuitively, T G generates puzzles of hardness t, and B cannot efficently solve any puzzle of hardness t ≥ k m for some constant m depending on B.

sup t≥k m ,|h|≤k e Pr (q, a) ← T G (1 k , t) s.t. T V (1 k , a, B(1 k , q, h)) = 1 is negl
• There is some m ∈ N such that, for every d ∈ N , there is a PPT algorithm C(1 k , t) such that min

t≤k d Pr (q, a) ← T G (1 k , t), v ← C(1 k , q) s.t. T V (1 k , a, v) = 1 and |v| ≤ k m
is overwhelming in k. Intuitively, this second requirement ensures that for any polynomial hardness value, there exists an algorithm that can solve any puzzle of that hardness.

Rivest, Shamir and Wagner [START_REF] Rivest | Time-lock puzzles and timed-release crypto[END_REF], and independly Boneh and Naor [START_REF] Boneh | Timed Commitments[END_REF] proposed a time-lock puzzle construction relying on the assumption that factorization is hard. This is the construction we retain for this work, and to the best of our knowledge the only known one to achieve interesting security levels. 5The original Rivest-Shamir-Wagner (RSW) time-lock [START_REF] Rivest | Time-lock puzzles and timed-release crypto[END_REF] is based on the "intrinsically sequential" problem of computing:

2 2 τ mod n
for specified values of τ and an RSA modulus n. The parameter τ controls the puzzle's difficulty. The puzzle can be solved by performing τ successive squares modulo n. Using the formalism above, the RSW puzzle can be described as follows:

T G (1 k , t) = (p 1 p 2 , min(t, 2 k )), (p 1 , p 2 , min(t, 2 k )) T V (1 k , (p 1 , p 2 , t ), v) = 1 if (v = v 1 , v 2 ) and v 1 = 2 2 t mod n and v 2 = n 0 otherwise
where p 1 and p 2 are (k/2)-bit prime numbers. Both solving the puzzle and verifying the solution can be efficiently done if p 1 and p 2 are known. Good time-lock problems seem to be hard to find, and in particular there exist impossibility results against unbounded adversaries [START_REF] Mahmoody | Time-Lock Puzzles in the Random Oracle Model[END_REF]. Nevertheless, the RSW construction holds under a computational assumption, namely that factorisation of RSA moduli is hard

Slow motion zero-knowledge protocols

Definition

We can now introduce the following notion: Definition 3.2 (SM-ZK) A Slow Motion Zero-Knowledge (SM-ZK) protocol (σ, T , τ, ∆ max ), where σ defines a Σ protocol, T is a time-lock puzzle, τ ∈ N, and ∆ max ∈ R, is defined by the three following steps of σ:

1. Commitment: P sends a commitment x to V 2. Timed challenge: V sends a challenge c to P, and starts a timer.

3.

Response: P provides a response y to V, which stops the timer.

V accepts iif

• y is accepted as a satisfactory response by σ; and • x is a solution to the time-lock puzzle T with input (y, c) and hardness τ ; and

• time elapsed between challenge and response, as measured by the timer, is smaller than ∆ max .

Commitment shortening

Commitments in a Σ-protocol are under the control of P, which may be malicious. If commitments are not collision-resistant, the protocol's security is weakened. Hence commitments need to be long, and in classical Σ protocols breaking below the collision-resistance size barrier is impossible as proved by [START_REF] Girault | On the Length of Cryptographic Hash-Values Used in Identification Schemes[END_REF].

However, as we now show, commitment collision-resistance becomes unnecessary in the case of SM-ZK protocols.

An example slow-motion zero-knowledge protocol

While SM-ZK can be instantiated with any three-pass ZK protocol, we will illustrate the construction using the Girault-Poupard-Stern (GPS) protocol [PS98; GPS06; Gir90], and a modification of the time-lock construction due to Rivest, Shamir and Wagner [START_REF] Rivest | Time-lock puzzles and timed-release crypto[END_REF].

Protocol 2: Girault-Poupard-Stern Identification Protocol P V r $ ← -[0, A -1] x ← g r mod n x -----→ c $ ← -[0, B -1] c ←----- if c / ∈ [0, B -1] then abort else y ← r + c × s y -----→ if y ∈ [0, A + (B -1)(S -1) -1]
and g y v c = x mod n then valid else invalid

Girault-Poupard-Stern protocol

GPS key generation consists in generating a composite modulus n, choosing a public generator g ∈ [0, n -1] and integers A, B, S such that A BS. Choice of parameters depends on the application and is discussed in [START_REF] Girault | On the Fly Authentication and Signature Schemes Based on Groups of Unknown Order[END_REF]. Implicitly, parameters A, B, S are functions of the security parameter k.

The secret key is an integer s ∈ [0, S -1], and the corresponding public key is v = g -s mod n. Authentication is performed as in Protocol 2.

P can also precompute as many values x i ← g ri as suitable for the application, storing a copy of r i for later usage. The detailed procedure by which this is done is recalled in Section 3.2.8.

Girault-Poupard-Stern Rivest-Shamir-Wagner slow-motion zero-knowledge identification

We can now combine the previous building-blocks to construct a pre-processing scheme that requires little commitment storage.

The starting point is a slightly modified version of the RSW time-lock function τ → 2 2 τ . Let µ be some deterministic function (to be defined later) and n an RSA modulus different from the n used for the GPS, we define for integers τ, :

f τ, (x) = µ(x) 2 τ mod n mod 2 .
Here, τ controls the puzzle hardness and is a parameter controlling output size. The function f τ, only differs from the RSW time-lock in two respects: We use µ(x) instead of 2; and the result is reduced modulo 2 .

The motivation behind using a function µ stems from the following observation: An adversary knowing x 2 τ 1 and x 2 τ 2 could multiply them to get (x 1 x 2 ) 2 τ . To thwart such attacks (and similar attacks based on the malleability of RSA) we suggest to use for µ a deterministic RSA signature padding function (e.g., the Full Domain Hash [START_REF] Bellare | Random Oracles are Practical: A Paradigm for Designing Efficient Protocols[END_REF]).

The reduction modulo 2 is of practical interest, it is meant to keep the size of answers manageable. Of course, an adversary could brute-force all values between 0 and 2 -1 instead of trying to solve the time-lock. To avoid this situation, and τ should be chosen so that solving the time-lock is the most viable option of the two.

Under the same assumptions as RSW (hardness of factorization), and if and τ are properly tuned, f τ, generates a time-lock problem.

Then, we adapt a construction of M'Raïhi and Naccache [START_REF] David | Couponing Scheme Reduces Computational Power Requirements for DSS Signatures[END_REF] to GPS [START_REF] Girault | An Identity-based Identification Scheme Based on Discrete Logarithms Modulo a Composite Number[END_REF]. This is done by defining a secret J, a public hash function H, and computing the quantities:

x i = g H(J,i,s) mod n
This computation can be delegated to a trusted authority. This is interesting in our case because the authority can compress these x i by computing x i = f τ, (x i ). Note that because the authority knows the factors of n, computing the x i is fast. P is loaded with k pre-computed commitments x 1 , . . . , x k as shown in Protocol 3. The quantity k of pre-computed commitments depends on the precise application.

Protocol 3: Slow motion commitment pre-processing for GPS

Authority P J $ ← -[1, 2 512 ] J ←----- for i = 1 to k do ri ← H(J, i, s) x i ← g r i mod n xi ← f τ, (x i ) end for x 1 ,...,x k -----→ Store J, x1, . . . , x k
When V wishes to authenticate P the parties execute the protocol shown in Protocol 4. With a proper choice of τ, we can have a reasonable verification time (assuming that V is more powerful than P), extremely short commitments (e.g., 40-bit ones) and very little on-line computations required from P. y

Protocol 4: Slow Motion GPS

P V i ← i + 1 r ← H(J, i -1, s) x i-1 -----→ c $ ← -[0, B -1] δ ← Time c ←----- y ← r + c × s
-----→ ∆ ← Time -δ z ← f τ, (g y v c ) if ∆ ≤ ∆max and z = xi-1 then valid else invalid
Note: Range tests on c and y were omitted for the sake of clarity.

Choice of parameters

What drives the choice of parameters is the ratio between:

• The time t it takes to a legitimate prover to compute y and transmits it. In GPS this is simply one multiplication of operands of sizes log 2 B and log 2 S (additions neglected), this takes time λ log(B) log(S) for some constant λ (not assuming optimizations such as [START_REF] Robert | Multiplication by integer constants[END_REF] based on the fact that operand s is constant).

• The time T it takes for the fastest adversary to evaluate once the time-lock function f τ, . T does not really depend on , and is linear in τ . We hence let T = ντ . Note that there is no need to take into account the size of n, all we require from n is to be hard to factor. That way, the slowing effect will solely depend on τ .

In a brute-force attack, there are 2 possibilities to exhaust. The most powerful adversary may run κ ≤ 2 parallel evaluations of the time-lock function, and succeed to solve the puzzle in t time units with probability

= κt 2 T = κ log(B) log(S)λ ν2 τ A typical instance resulting in 40-bit commitments is {κ = 2 24 , T = 1, t = 2 -4 , = 2 -20 } ⇒ = 40.
Here we assume that the attacker has 16.7 million (2 24 ) computers capable of solving one time-lock challenge per second (T = 1) posing as a prover responding in one sixteenth of a second (t = 2 -4 ). Assuming the least secure DSA parameters (160-bit q) this divides commitment size by 4. For 256-bit DSA the gain ratio becomes 6.4. The time-out constant ∆ max in Protocol 4 is tuned to be as small as possible, but not so short that it prevents legitimate provers from authenticating. Therefore the only constraint is that ∆ max is greater or equal to the time t it takes to the slowest legitimate prover to respond. Henceforth we assume ∆ max = t.

Security Proof

The security of this protocol is related to that of the standard GPS protocol analysed in [START_REF] Poupard | Security Analysis of a Practical "on the fly" Authentication and Signature Generation[END_REF][START_REF] Girault | On the Fly Authentication and Signature Schemes Based on Groups of Unknown Order[END_REF]. We recall here the main results and hypotheses.

Preliminaries

The following scenario is considered. A randomized polynomial-time algorithm Setup generates the public parameters (G, g, S) on input the security parameter k. Then a second probabilistic algorithm GenKey generates pairs of public and private keys, sends the secret key to P while the related public key is made available to anybody, including of course P and V. Finally, the identification procedure is a protocol between P and V, at the end of which V accepts or not.

An adversary who doesn't corrupt public parameters and key generation has only two ways to obtain information: either passively, by eavesdropping on a regular communication, or actively, by impersonating (in a possibly non protocol-compliant way) P and V.

The standard GPS protocol is proven complete, sound and zero-knowledge by reduction to the discrete logarithm with short exponent problem [START_REF] Girault | On the Fly Authentication and Signature Schemes Based on Groups of Unknown Order[END_REF]: Definition 3.3 (Discrete logarithm with short exponent problem) Given a group G, g ∈ G, and integer S and a group element g x such that x ∈ [0, S -1], find x.

Compressed commitments for time-locked Girault-Poupard-Stern identification

We now consider the impact of shortening the commitments to bits on security, while taking into account the time constraint under which P operates. The shortening of commitments will indeed weaken the protocol [START_REF] Girault | On the Length of Cryptographic Hash-Values Used in Identification Schemes[END_REF] but this is compensated by the time constraint, as explained below.

Lemma 3.3 (Completeness)

Execution of the protocol of Protocol 4 between a prover P who knows the secret key corresponding to his public key, and replies in bounded time ∆ max , and a verifier V is always successful.

Proof: This is a direct consequence of the completeness of the standard GPS protocol [GPS06, Theorem 1]. By assumption, P computes y and sends it within the time allotted for the operation. This computation is easy knowing the secret s and we have

g y v c = g ri+cs v c = x i g cs v c = x i v c-c = x i Consequently, f τ, (g y v c ) = f τ, (x i ) = x i . Finally, y = r + cs ≤ (A -1) + (B -1)(S -1) < y max .
Therefore all conditions are met and the identification succeeds.

Lemma 3.4 (Zero-Knowledge)

The protocol of Protocol 4 is statistically zero-knowledge if it is run a polynomial number of times N , B is polynomial, and N SB/A is negligible.

Proof:

The proof follows [START_REF] Girault | On the Fly Authentication and Signature Schemes Based on Groups of Unknown Order[END_REF] and can be found in Section 3.2.7.

The last important property to prove is that if V accepts, then with overwhelming probability P must know the discrete logarithm of v in base g.

Lemma 3.5 (Time-constrained soundness) Under the assumption that the discrete logarithm with short exponent problem is hard, and the time-lock hardness assumption, this protocol achieves time-constrained soundness.

Proof: After a commitment x has been sent, if A can correctly answer with probability > 1/B then he must be able to answer to two different challenges, c and c , with y and y such that they are both accepted, i.e., f τ, (g y v c ) = x = f τ, (g y v c ). When that happens, we have

µ (g y v c ) 2 τ = µ g y v c 2 τ mod n mod 2
Here is the algorithm that extracts these values from the adversary A. We write Success(ω, c 1 , . . . , c n ) the result of the identification of A using the challenges c 1 , . . . , c n , for some random tape ω.

Step 1. Pick a random tape ω and a tuple c of N integers c 1 , . . . , c N in [0, B -1]. If Success(ω, c) = false, then abort.

Step 2. Probe random N -tuples c that are different from each other and from c, until Success(ω, c ) = true.

If after B N -1 probes a successful c has not been found, abort.

Step 3. Let j be the first index such that c j = c j , write y j and y j the corresponding answers of A. Output c j , c j , y j , y j .

This algorithm succeeds with probability ≥ -1/B N = , and takes at most 4∆ max units of time [START_REF] Girault | On the Fly Authentication and Signature Schemes Based on Groups of Unknown Order[END_REF]. This means that there is an algorithm finding collisions in f τ, with probability ≥ and time ≤ 4∆ max .

Assuming the hardness of the discrete logarithm with short exponents problem, the adversary responds in time by solving a hard problem, where as pointed out earlier the probability of success is given by

ζ = κ log(B) log(S)λ ν2 τ
where κ is the number of concurrent evaluations of f τ, performed by A. There is a value of τ such that ζ . For this choice of τ , A is able to compute f τ, much faster than brute-force, which contradicts the time-lock hardness assumption.

Conclusion and further research

This paper introduced a new class of protocols, called Slow Motion Zero Knowledge (SM-ZK) showing that if we pay the conceptual price of allowing time measurements during a three-pass ZK protocol then commitments do not need to be collision-resistant.

Because of its interactive nature, SM-ZK does not yield signatures but seems to open new research directions. For instance, SM-ZK permits the following interesting construction, that we call a fading signature: Alice wishes to send a signed message m to Bob without allowing Bob to keep a long-term her involvement. By deriving c ← H(x, m, ρ) where ρ is a random challenge chosen by Bob, Bob can can convince himself6 that m comes from Alice. This conviction is however not transferable if Alice prudently uses a short commitment as described in this paper.

Proof of Lemma 3.4

Proof: The zero-knowledge property of the standard GPS protocol is proven by constructing a polynomialtime simulation of the communication between a prover and a verifier [GPS06, Theorem 2]. We adapt this proof to the context of the proposed protocol. The function δ is defined by δ(true) = 1 and δ(false) = 0, and ∧ denotes the logical operator "and". For clarity, the function f τ, is henceforth written f . The scenario is that of a prover P and a dishonest verifier A who can use an adaptive strategy to bias the choice of the challenges to try to obtain information about s. In this case the challenges are no longer chosen at random, and this must be taken into account in the security proof. Assume the protocol is run N times and focus on the i-th round.

A has already obtained a certain amount of information η from past interactions with P. P sends a pre-computed commitment x i . Then A chooses a commitment using all information available to her, and a random tape ω: c i (x i , η, ω).

The following is an algorithm (using its own random tape ω M ) that simulates this round:

Step

1. Choose c i $ ← -[0, B -1] and y i $ ← -[(B -1)(S -1), A -1] using ω M . Step 2. Compute x i = f τ, g yi v ci .
Step 3. If c i (x i , η, ω) = c i then return to step 1 and try again with another pair (c i , y i ), else return

(x i , c i , y i ). 7
The rest of the proof shows that, provided Φ = (B -1)(S -1) is much smaller than A, this simulation algorithm outputs triples that are indistinguishable from real ones, for any fixed random tape ω. Formally, we want to prove that

Σ 1 = α,β,γ Pr ω P [(x, c, y) = (α, β, γ)] -Pr ω M [(x, c, y) = (α, β, γ)]
is negligible, i.e., that the two distributions cannot be distinguished by accessing a polynomial number of triples (even using an infinite computational power). Let (α, β, γ) be a fixed triple, and assuming a honest prover, we have the following probability:

p = Pr ω P [(x, c, y) = (α, β, γ)] = Pr 0≤r<A [α = f (g r ) ∧ β = c(α, η, ω) ∧ γ = r + βs] = A-1 r=0 1 A δ α = f (g γ v β ) ∧ β = c(α, η, ω) ∧ r = γ -βs = 1 A δ α = f (g γ v β ) ∧ β = c(α, η, ω) ∧ γ -βs ∈ [0, A -1] = 1 A δ α = f (g γ v β ) δ (β = c(α, η, ω)) δ (γ -βs ∈ [0, A -1]) .
where f = f τ, .

We now consider the probability p = Pr ω M [(x, c, y) = (α, β, γ)] to obtain the triple (α, β, γ) during the simulation described above. This is a conditional probability given by

p = Pr y∈[Φ,A-1] c∈[0,B-1] α = f g y v c ∧ β = c ∧ γ = y c = c f g y v c , η, ω
Using the definition of conditional probabilities, this equals

p = Pr y∈[Φ,A-1] c∈[0,B-1] α = f g y v c ∧ β = c ∧ γ = y Pr y∈[Φ,A-1] c∈[0,B-1] [c = c (f (g y v c ) , η, ω)] Let us introduce Q = y∈[Φ,A-1] c∈[0,B-1] δ c = c f g y v c , η, ω
then the denominator in p is simply Q/B(A -Φ). Therefore:

p = c∈[0,B-1] 1 B Pr y∈[Φ,A-1] α = f g y v c ∧ γ = y ∧ β = c = c(α, η, ω) B(A -Φ) Q = Pr y∈[Φ,A-1] α = f g γ v β ∧ γ = y ∧ β = c(α, η, ω) A -Φ Q = y∈[Φ,A-1] 1 A -Φ δ α = f g γ v β ∧ γ = y ∧ β = c(α, η, ω) A -Φ Q = 1 Q δ α = f g γ v β δ (β = c(α, η, ω)) δ (γ ∈ [Φ, A -1])
We will now use the following combinatorial lemma:

Lemma 3.6 If h : G → [0, B -1] and v ∈ {g -s , s ∈ [0, S -1]} then the total number M of solutions (c, y) ∈ [0, B -1] × [Φ, A -1] to the equation c = h(g y v c ) satisfies A -2Φ ≤ M ≤ A.
Proof: The proof of Lemma 3.6 is adapted from [GPS06, Appendix A]. Specialising Lemma 3.6 to the function that computes c(f (g y v c ), η, ω) from (c, y) gives A-2Φ ≤ Q ≤ A. This enables us to bound Σ 1 :

Σ 1 = α,β,γ Pr ω P [(x, c, y) = (α, β, γ)] -Pr ω M [(x, c, y) = (α, β, γ)] = α,β,γ∈[Φ,A-1] Pr ω P [(x, c, y) = (α, β, γ)] -Pr ω M [(x, c, y) = (α, β, γ)] + α,β,γ / ∈[Φ,A-1] Pr ω P [(x, c, y) = (α, β, γ)] = γ∈[Φ,A-1] β∈[0,B-1] α=f (g γ v β ) 1 A δ (β = c(α, η, ω)) - 1 Q δ(β = c(α, η, ω)) +   1 - α,β,γ∈[Φ,A-1] Pr ω P [(x, c, y) = (α, β, γ)]   = 1 A - 1 Q Q + 1 - γ∈[Φ,A-1] β∈[0,B-1] α=f (g γ v β ) 1 A δ (β = c(α, η, ω)) = |Q -A| A + 1 - Q A Therefore Σ 1 ≤ 2|Q -A|/A ≤ 4Φ/A < 4SB/A,

Girault-Poupard-Stern commitment pre-computation

Protocol 5 describes one possible way in which pre-computed commitments are generated and used for GPS. In this figure, we delegate the computation to a trusted authority. That role can be played by P alone, but we leverage the authority to alleviate P's computational burden.

To efficiently generate a sequence of commitments, the authority uses a shared secret seed J and a cryptographic hash function H. Here J is chosen by P but it could be chosen by the authority instead.

Protocol 5: Commitment pre-processing as applied to GPS

Authority P J $ ← -N J ←----- for i = 1 to k do ri ← H(J, i, s) xi ← g r i mod n end for x 1 ,...,x k -----→ Store J, x1, . . . , x k P V i ← i + 1 x i-1 -----→ r ← H(J, i -1, s) c $ ← -[0, B -1] c ←----- y ← r + s × c y -----→ Verify(xi-1, y, c) Note:
The first stage describes the preliminary interaction with a trusted authority, where pre-computed commitments are generated and stored. The second stage describes the interaction with a verifier. For the sake of clarity the range-tests on c and y were omitted. The trusted authority can be easily replaced by P himself.

Introduction

Since their discovery, zero-knowledge proofs (ZKPs) [GMR89b; BCC88] have found many applications and have become of central interest in cryptology. ZKPs enable a prover P to convince a verifier V that some mathematical statement is valid, in such a way that no knowledge but the statement's validity is communicated to V. The absence of information leakage is formalized by the existence of a simulator S, whose output is indistinguishable from the recording (trace) of the interaction between P and V. Thanks to this indistinguishability, an eavesdropper A cannot tell whether she taps a real conversation or the monologue of S. P and V, however, interact with each other and thus know that the conversation is real.

It may however happen, by sheer luck, that A succeeds in responding correctly to a challenge without knowing P's secret. ZKPs are designed so that such a situation is expected to happen only with negligible probability: Repeating the protocol renders the cheating probability exponentially small if the challenge at each protocol round is random. Otherwise, A may repeat her successful commitments while hoping to be served with the same challenges.

Classically, the protocol is regarded as ideal when the challenge distribution is uniform over a large set (for efficiency reasons, the cardinality of this set rarely exceeds 2 128 ). Uniformity, however, has its drawbacks: all challenges are not computationally equal, and some challenges may prove harder than others to respond to.

This paper explores the effect of biasing the challenge distribution. Warping this distribution unavoidably sacrifices security, but it appears that the resulting efficiency gains balance this loss in a number of ZKPs. Finding the optimal distribution brings out interesting optimization problems which happen to be solvable exactly for a variety of protocols and variants. We apply this idea to improve on four classical ZK identification protocols that rely on very different assumptions: RSA-based Fiat-Shamir [START_REF] Fiat | How to Prove Yourself: Practical Solutions to Identification and Signature Problems[END_REF], SD-based identification [START_REF] Stern | A New Identification Scheme Based on Syndrome Decoding[END_REF], PKP-based identification [START_REF] Shamir | An Efficient Identification Scheme Based on Permuted Kernels (Extended Abstract) (Rump Session)[END_REF], and PPP-based indentification [START_REF] Pointcheval | A New Identification Scheme Based on the Perceptrons Problem[END_REF].

Preliminaries

Three-round zero-knowledge protocols

A Σ-protocol [HL10; Dam10; GMW91a] is a generic 3-step interactive protocol, whereby a prover P tries to convince a verifier V that P knows a proof that some statement is true -without revealing anything to V beyond this assertion. The three phases of a Σ-protocol are illustrated by Figure 3

.4. x -----→ P c ← ----- V y -----→ Figure 3.4: Generic Σ-protocol.
Namely,

• P sends a commitment x to V

• V replies with a challenge c;

• P provides a response y.

Upon completion, V may accept or reject P, depending on whether P's response is satisfactory. In practice, the protocol will be repeated several times until V is satisfied. An eavesdropper A should not be able to learn anything from the conversation between P and V. This security notion is formalized by the existence of a simulator S, whose output is indistinguishable from the interaction (or "trace") T between P and V. Different types of zero-knowledge protocols exist, that correspond to different indistinguishability notions.

In computational zero-knowledge, S's output distribution is computationally indistinguishable from T , whereas in statistical zero-knowledge, S's output distribution must be statistically close to the distribution governing T : Thus even a computationally unbounded verifier learns nothing from T . The strongest notion of unconditional zero-knowledge requires that A cannot distinguish S's output from T , even if A is given access to both unbounded computational resources and P's private keys. The Fiat-Shamir protocol [START_REF] Fiat | How to Prove Yourself: Practical Solutions to Identification and Signature Problems[END_REF] is an example of unconditional ZKP.

Definition 3.4 (Statistical Indistinguishability)

The statistical difference between random variables X and Y taking values in Z is defined as:

∆(X, Y ) := max Z⊂Z |Pr(X ∈ Z) -Pr(Y ∈ Z)| = 1 - z∈Z min {Pr(X = z), Pr(Y = z)}
We say that X and Y are statistically indistinguishable if ∆(X, Y ) is negligible.

Finally, we expect P to eventually convince V, and that V should only be convinced by such a P (with overwhelming probability). All in all, we have the following definition: Definition 3.5 (Σ-protocol) A Σ-protocol is a three-round protocol that furthermore satisfies three properties:

• Completeness: given an input v and a witness w such that vRw, P is always able to convince V.

• Zero-Knowledge: there exists a probabilistic polynomial-time simulator S which, given (v, c), outputs triples (x, c, y) that follow a distribution indistinguishable from a valid conversation between P and V.

• Special Soundness: given two accepting conversations for the same input v, and the same commitment x, but with different challenges c 1 = c 2 , there exists a probabilistic polynomial-time algorithm E called extractor that computes a witness w = E(c 1 , c 2 , v, x) such that vRw.

Security efficiency

During a Σ-protocol, P processes c to return the response y(x, c). The amount of computation W (x, c) required for doing so depends on x, c, and on the challenge size, denoted k. Longer challenges -hence higher security levels -would usually claim more computations.

Definition 3.6 (Security Level) Let P ↔ V be a Σ-protocol, the security level S(P ↔ V): is defined as the challenge min-entropy

S(P ↔ V) := -min c log Pr(c)
This security definition assumes that A's most rational attack strategy is to focus her efforts on the most probable challenge (in situations where there are better strategies (see Section 4.2) a different measure of security must be used). From a defender's perspective, verifiers achieve the highest possible security level by sampling challenges from a uniform distribution.

Definition 3.7 (Work Factor) Let P ↔ V be a Σ-protocol, the average work factor W (P ↔ V) is defined as the expected value of W (x, c):

W (P ↔ V) := E x,c [W (x, c)]
Definition 3.8 (Security Efficiency) Let P ↔ V be a Σ-protocol, the security efficiency of P ↔ V, denoted E(P ↔ V), is defined as the ratio between S(P ↔ V) and W (P ↔ V):

E(P ↔ V) := S(P ↔ V) W (P ↔ V)
Informally, E(P ↔ V) represents 8 the average number of security bits per mathematical operation.

Linear programming

Linear programming (LP) [Dan51; DT06a; DT06b; BV04] problems appear when a linear objective function must be optimized under linear equality and inequality constraints. These constraints define a convex polytope. General linear programming problems can be expressed in canonical form as: maximize c x subject to Ax ≤ b and x ≥ 0 where x represents the vector of variables (to be determined), c and b are vectors of (known) coefficients and A is a (known) matrix of coefficients. Linear programming is common in optimization problems and ubiquitous in logistics, operational research, and economics. Interestingly, linear programming has almost never surfaced in cryptography, save a few occasional appearances in error correcting codes [START_REF] Bierbrauer | Bounds for Resilient Functions and Orthogonal Arrays[END_REF], or under the avatar of its NP-hard variant, integer programming [START_REF] Lenstra | Integer programming and cryptography[END_REF].

Every linear problem can be written in so-called "standard form" where the constraints are all inequalities and all variables are non-negative, by introducing additional variables ("slack variables") if needed. Not all linear programming problems can be solved: The problem might be unbounded (there is no maximum) or infeasible (no solution satisfies the constraints, i.e. the polytope is empty).

Many algorithms are known to solve LP instances, on the forefront Dantzig's Simplex algorithm [START_REF] Dantzig | Maximization of a Linear Function of Variables Subject to Linear Inequalities[END_REF]. The Simplex algorithm solves an LP problem by first finding a solution compatible with the constraints at some polytope vertex, and then walking along a path on the polytope's edges to vertices with non-decreasing values of the objective function. When an optimum is found the algorithm terminates -in practice this algorithm has usually good performance but has poor worst-case behavior: There are LP problems for which the Simplex method takes a number of steps exponential in the problem size to terminate [START_REF] Dantzig | Linear programming 1: Introduction[END_REF][START_REF] Katta | Linear programming[END_REF].

Since the 1950's, more efficient algorithms have been proposed called "interior point" methods (as opposed to the Simplex which evolves along the polytope's vertices). In particular, these algorithms demonstrated the polynomial-time solvability of linear programs [START_REF] Karmarkar | A new polynomial-time algorithm for linear programming[END_REF]. Following this line of research, approximate solutions to LP problems can be found using very efficient (near linear-time) algorithms [START_REF] Koufogiannakis | Beating Simplex for Fractional Packing and Covering Linear Programs[END_REF][START_REF] Allen | Using Optimization to Break the Epsilon Barrier: A Faster and Simpler Width-Independent Algorithm for Solving Positive Linear Programs in Parallel[END_REF].

In this work we assume that some (approximate) LP solver is available. Efficiency is not an issue, since this solver is only used once, when the ZKP is designed

Optimizing E(P ↔ V)

The new idea consists in assigning different probabilities to different c values, depending on how much it costs to generate their corresponding y values, while achieving a given security level. The intuition is that by choosing a certain distribution of challenges, we may hope to reduce P's total amount of effort, but this also reduces security. As we show, finding the best trade-off is equivalent to solving an LP problem.

Consider a set Γ of symbols, and a cost function η : Γ → N. Denote by p j := Pr (i | i ∈ Γ j ) the probability that a symbol i is emitted, given that i has cost j. We wish to find this probability distribution.

Let Γ j denote all symbols having cost j, i.e. such that η(i) = j. Let γ j be the cardinality of Γ j . The expected cost for a given choice of emission probabilities {p j } is

W = E [η] = i∈Γ η(i) Pr(i) = j j × γ j × p j 8 i.e. is proportional to
W is easy to evaluate provided we can estimate the amount of work associated with each challenge isocost class Γ j . The condition that probabilities sum to one is expressed as:

1 = i∈Γ Pr(i) = j γ j p j
Finally, security is determined by the min-entropy9 S =log 2 max i Pr(i) =log 2 max j p j Let = 2 -S , so that p j ≤ for all j. The resulting security efficiency is E = S/W = (-log 2 ) /W .

We wish to maximize E, which leads to the following constrained optimization problem:

Given {γ j } and ,

     minimize W = j jp j γ j subject to 0 ≤ p j ≤ j γ j p j = 1 (3.1)
This is a linear programming problem [Dan51; DT06a; DT06b], that can be put in canonical form by introducing slack variables q j =p j and turning the inequality constraints into equalities p j + q j = .

The solution, if it exists, therefore lies on the boundary of the polytope defined by these constraints. Note that a necessary condition for an optimal solution to exist is that ≥ 1/ j γ j , which corresponds to the choice of the uniform distribution.

Exact solutions to Equation (3.1) can be found using the techniques mentioned in Section 3.3.2.3. We call such optimized ZKP versions "thrifty ZKPs". Note that the zero-knowledge property is not impacted, as it is trivial to construct a biaised simulator.

Thrifty zero-knowledge protocols

The methodology described in Section 3.3.3 can be applied to any ZK protocol, provided that we can evaluate the work factor associated with each challenge class. As an illustration we analyse thrifty variants of classical ZKPs: Fiat-Shamir (FS, [START_REF] Fiat | How to Prove Yourself: Practical Solutions to Identification and Signature Problems[END_REF]), Syndrome Decoding (SD, [START_REF] Stern | A New Identification Scheme Based on Syndrome Decoding[END_REF]), Permuted Kernels Problem (PKP, [START_REF] Shamir | An Efficient Identification Scheme Based on Permuted Kernels (Extended Abstract) (Rump Session)[END_REF]), and Permuted Perceptrons Problem (PPP, [START_REF] Pointcheval | A New Identification Scheme Based on the Perceptrons Problem[END_REF]).

Thrifty Fiat-Shamir

In the case of Fiat-Shamir [START_REF] Fiat | How to Prove Yourself: Practical Solutions to Identification and Signature Problems[END_REF], response to a challenge c claims a number of multiplications proportional to c's Hamming weight. We have k = n-bit long challenges. Here γ j is the number of n-bit challenges having Hamming weight j, namely

γ j = n j
Note that the lowest value of for which a solution to Equation (3.1) exists is 2 -n , in which case p j = is the uniform distribution, and W = n/2. Hence the original Fiat-Shamir always has E = 2.

Example 3.1 Let n = 3. In that case Equation (3.1) becomes the following problem:

Given ,      minimize W = 3p 1 + 6p 2 + 3p 3 subject to 0 ≤ p 0 , p 1 , p 2 , p 3 ≤ p 0 + 3p 1 + 3p 2 + p 3 = 1
Security efficiency is (-log 2 )/W . Note that the original Fiat-Shamir protocol has W = 3/2 and security S = 3 bits, hence a security efficiency of E = 2, as pointed out previously.

Let for instance = 1/7, for which the solution can be expressed simply as p 0 = p 1 = p 2 = , and p 3 = 1 -7 , yielding an effort

W = 9 + 3(1 -7 ) = 3(1 -4 )
Therefore the corresponding security efficiency is -log 2 3(1-4 ) , which at = 1/7 equals 7 log 2 7/9 2.18. This is a 10% improvement over a standard Fiat-Shamir. Remark. We can compute the optimal distribution for any value of ≥ 1/8, i.e. choose the p i s that yields the maximum security efficiency Ê( ). The result of this computation is given in Figure 3.5. Corresponding optimal probabilities pi are given in Figure 3.6.

Remark. Figure 3.5 shows that Ê is not a continuously differentiable function of . The two singular points correspond to = 1/7 and = 1/4. These singular points correspond to optimal strategy changes: when gets large enough, it becomes interesting to reduce the probability of increasingly many symbols. This is readily observed on Figure 3.6 which displays the optimal probability distribution of each symbol group as a function of .

Example 3.2 Solving Equation (3.1) for Fiat-Shamir with n = 16 gives Figure 3.7 which exhibits the same features as Figure 3.5, with more singular points positioned at = 2 -4 , 2 -7 , 2 -9 , etc. W. The methodology of Section 3.3.3 is then used to compute the optimal probability distributions and construct the thrifty variant of these protocols. However, there is a peculiarity in these protocols: An adversary can correctly answer (k -1) out of k possible challenges, requiring a legitimate prover to achieves more than 2/3, 1/2 and 3/4 success rates respecitvely for SD, PKP and PPP. In this case, the attacker's optimal strategy is to bet on the most probable combination of (k -1) challenges. Hence security is no longer measured by the min-entropy, but instead bylog 2 min(p i ). In that case it is easily seen that the security efficiency cannot be improved, and linear optimisation confirms that the optimal parameters are that of uniform distributions.

Thrifty SD, PKP and PPP

The result of measurements 11 and optimisations is summarized in Tables 3.1 to 3.3. For details about the protocols we refer the reader to the original descriptions.

Source code

Python source code for the zero-knowledge protocol simulation, as well as the optimisation algorithm (using the CVXOPT library 12 ) to solve Equation ( A digital signature is a piece of information that attests to the authorship of a given message. Unlike authentication (discussed in the previous chapter), signatures are non-interactive, which means that one should be able to check them in absence of the author. A typical use of signatures is to ensure the integrity of a message, i.e. that the message has not undergone modification since its author signed it.

Signatures are essential to information security as a whole, as they provide guarantees that some data (or, more generally, some system) did not change. As such it plays a role in many protocols, such as key exchange algorithms, delegation mechanisms, etc. The nature of a signature is also that it is non-repudiable, meaning that it binds the signer to the message being signed -so that digital signatures really are the cryptographic equivalent of "manual" signatures, bearing legal status in many jurisdictions. Unlike traditional signatures however, the digital versions are much more versatile. We demonstrate this fact in Section 4.1, solving an open problem posed by Naccache [START_REF] Naccache | Is theoretical cryptography any good in practice?[END_REF] on "lambda signatures".

The main security concern regarding signatures is the possibility of forgery, against which we can provide cryptographic protections. Unfortunately, one of the most widely-used signature algorithm, known as ECDSA, is very brittle and unforgiving; in particular, it relies critically on the choice of a random number, the nonce. Should even one bit of the nonce be known or guessable to the attacker, practical attacks exist that completely break such signatures. This frailty is not unique to ECDSA, and nonce-reuse is a realistic problem in concrete situations and also affects its predecessor, Schnorr signatures. By minimally modifying Schnorr signatures, we show in Section 4.3 how to securely reuse the nonce, which furthermore enables us to compute signatures in less operations.

New usages lead to new attacks that do not need forgeries to be effective; such is the case for instance of contract signing, whereby two parties exchange their respective signature on a contract. In such a scenario, there is always a possibility for the latest player to abort, meaning that they get a complete and valid signature from the other party, while said other party gets nothing in return. From contract signing protocols we therefore demand fairness, i.e. the guarantee that if one party receives a valid result, then so do all. We explore this particular problem in Section 4.2.

Another use of digital signatures is that of certification, whereby a trusted authority lends credibility to some information, typically a public key. This system is, as of today, crucial to commerce over the Internet. However, certification authorities face a difficult fact: The keys to be certified were generated by their client, and may not be properly generated. Certifying insecure keys is not only bad for end-users, but it also impacts negatively the certification authority. Naturally, asking for the private keys to ensure proper generation is not a better option. This difficult dilemma is dealt with in Section 4.4, where we describe a general-purpose mechanism to prove that a given procedure was used to generate RSA public keys.

Universal witness signatures

Abstract

A lot of research has been devoted to the problem of defining and constructing signature schemes with various delegation properties. They mostly fit into two families. On the one hand, there are signature schemes that allow the delegation of signing rights, such as (hierarchical) identity-based signatures, attribute-based signatures, functional signatures, etc. On the other hand, there are malleable signature schemes, which make it possible to derive, from a signature on some message, new signatures on related messages without owning the secret key. This includes redactable signatures, set-homomorphic signatures, signatures on formulas of propositional logic, etc.

In this paper, we set out to unify those various delegatable signatures in a new primitive called universal witness signatures (UWS), which subsumes previous schemes into a simple and easy to use definition, and captures in some sense the most general notion of (unary) delegation. We also give several constructions based on a range of cryptographic assumptions (from one-way functions alone to SNARKs and obfuscation) and achieving various levels of security, privacy and succinctness. This is joint work with Mehdi Tibouchi at NTT Corporation, and Chen Qian at École normale supérieure de Rennes.

Introduction

Many signature schemes in the literature have delegatability properties either for keys or for messages. The first family includes notions like (hierarchical) identity-based [Sha84; GS02; CHY + 04; KN08] and attribute-based [LAS + 10; MPR11; OT14] signatures, in which a master key authority grants signing rights to users, who may in turn be able to delegate those rights to lower-level signers. It also includes a slightly different class of schemes where the owner of the master secret key can sign all messages in the message space, and can delegate signing rights on restricted families of messages (again, possibly with recursive delegation): functional signatures [BGI14; BMS13] and policy-based signatures [START_REF] Bellare | Policy-Based Signatures[END_REF] are examples of such schemes.

The second family of schemes is that of malleable signature schemes, as defined e. + 14]: in those schemes, it is possible, given a signature on some message, to publicly derive signatures on certainly related messages. Specific examples include content extraction signatures [START_REF] Steinfeld | Content Extraction Signatures[END_REF], redactable and sanitizable signatures [JMS + 02; ACM + 05], some variants of set-homomorphic and network coding signatures [JMS + 02; BFK + 09] (where users sign sets, resp. vector spaces, and those signatures can be delegated to subsets or subspaces) and more. A different example and one of the original motivations of this work is Naccache's notion of signatures on formulas of propositional logic [START_REF] Naccache | Is theoretical cryptography any good in practice?[END_REF], which makes it possible to derive a signature on a propositional formula Q from a signature on P whenever P ⇒ Q.

Main idea of this work

The goal of this paper is to unify all of the schemes above into a single very general and versatile primitive, which we call universal witness signatures (UWS), and to propose concrete instantiations of that primitive achieving good security and privacy properties.

Our first observation is that delegation of keys and delegation of messages are really two sides of the same coin, which can be unified by regarding a signature on a message m by an identity A as really the same object as a key associated with the sub-identity (A, m) of A. The operation of signing messages simply becomes a special case of key delegation.

Then, we can obtain in some sense the most general notion of signature scheme with (unary) delegation by saying that the set of identities is endowed with an essentially arbitrary pre-order relation ≤, and that given a key SK A on an identity A, we are able to derive another key SK B on any identity B such that B ≤ A. Unforgeability is then defined in the obvious way: roughly speaking, after obtaining keys SK Ai on various identities A i (possibly derived from higher-level identities), an adversary is unable to construct a valid key SK B for an identity B that doesn't satisfy B ≤ A i for any i.

The type of delegation functionality achieved by such a scheme is simply determined by the pre-order relation ≤. For example, regular (non-delegatable) signatures are obtained by choosing a set of identities equal to the message space together with a special identity * , such that m ≤ * for any message m, and no other relationship exists. Then, SK * is the secret key in the traditional sense, and it can be used to derive keys SK m playing the role of signatures.

If non-trivial relationships exist between the messages m themselves, we get a malleable signature scheme instead. For instance, we get redactable signatures if messages are ordered in such a way that m ≤ m if and only if m is obtained from m by replacing some of the text in m by blanks.

And we obtain identity-based signatures with a larger set of identities, still containing a special identity * associated with the master key authority, but also identities id i associated with the various users of the system, and identities (id i , m) for each pair of a user and a message. The order relation is then given by id i ≤ * for all i, and (id i , m) ≤ id i for all i and all messages. If additional nontrivial relationships exist between the id i 's, we essentially get hierarchical identity-based signatures.

We would like to support a really general class of pre-order relations ≤, to support for example the signatures on propositional formulas mentioned earlier, which are malleable signatures on messages (formulas) ordered by logical implication. However, the delegation algorithm that lets us publicly derive SK B from SK A when B ≤ A should certainly be able to efficiently test whether the relation B ≤ A actually holds. This is not possible directly for a relation like logical implication. For general NP relations, however, it does become possible if the delegation algorithm also receives as input a witness w of B ≤ A (for logical implication, for example, it would be a proof that A ⇒ B).

Our contributions

Along the lines sketched above, our first contribution is to define the notion of universal witness signature (UWS) scheme with respect to an arbitrary NP pre-order relation ≤ with a greatest element * . Such a scheme consists of only two algorithms:

• Setup(1 λ ): returns a key SK * on the special identity * , as well as some public parameters PP;

• Delegate(PP, SK A , A, B, w): checks that SK A is a valid key for the identity A and that w is a valid witness of B ≤ A. If so, returns a fresh key SK B for the identity B. Otherwise, returns ⊥.

We do not actually need a separate algorithm for signature verification: to check whether SK A is a valid key on A, we can simply try to delegate A to itself (since ≤ is a pre-order, there is a trivial witness w A≤A for A ≤ A), and test whether the Delegate algorithm returns something or just ⊥. Security for a UWS scheme is defined as the unforgeability notion described in the previous paragraph. As usual, we distinguish between selective security (in which the adversary has to choose in advance the identity on which it will try to forge) and adaptive security.

We also identify two other desirable properties of a UWS scheme: the privacy notion of context-hiding UWS, which says that the delegation path used to obtain a given key is computationally hidden, and the notion of succinctness, which says that the size of a key SK A is bounded only in terms of the size of A and the security parameter, independently of the delegation path.

We show that universal witness signatures are sufficient to obtain many earlier schemes appearing the literature, including HIBS, redactable signatures, functional signatures and Naccache's propositional signatures (for which our concrete constructions provide the first complete instantiations, to the best of our knowledge).

And finally, we give several constructions of UWS based on a range of assumptions, and achieving various subsets of our desirable properties.

First, we show that one-way functions alone are enough to obtain adaptively secure UWS for arbitrary NP pre-order relations. The approach is similar to the one-way function-based construction of functional signatures [START_REF] Boyle | Functional Signatures and Pseudorandom Functions[END_REF]. As in the work of Boyle et al., however, the resulting scheme, is neither context-hiding nor succinct.

Then, we prove that virtual black-box obfuscation [BGI + 12] (for a well-defined program depending on the pre-order relation under consideration) provides a very simple construction of secure, succinct, context-hiding UWS. This construction ticks all of our boxes, but it is of course based on a very strong assumption: in fact, Barak et al. showed that VBB is unachievable for general circuits. There could exist a virtual black-box obfuscator for our specific program of interest (and in fact, candidate constructions of indistinguishability obfuscation conjecturally satisfy that property), but this is rather speculative.

We therefore try to achieve similarly strong properties based on somewhat more reasonable assumptions. We give two such constructions: one based on SNARKs [Kil92; BCI + 13; GGP + 13] (actually, proof-carrying data [CT10a; BCC + 13; BCT + 14]), which is secure and succinct but achieves a somewhat weaker form of privacy than the context-hiding property; and another based on (superpolynomially secure) indistinguishability obfuscation [BGI + 12; GGH + 13; SW14; GMS16], which is succinct and context-hiding but which we only prove selectively secure. Both of those constructions suffer from a limitation on delegation depth: it can be an arbitrary polynomial in the security parameter but fixed at Setup time. Moreover, our iO-based construction only applies to order relations rather than general pre-orders.

Preliminaries

In this section, we recall the formal definitions of SNARKs, proof-carrying data, and notions related to obfuscation. All these notions are used in this paper to construct our Universal Witness Signature scheme.

SNARK proof systems

Succinct non-interactive arguments of knowledge, or SNARKs for short, are powerful proof systems that we use in particular to instanciate proof-carrying data constructions. To achieve this we define the SNARK proof system for the universal language on Random-Access Machines.

Definition 4.1 (Universal relation and language)

The universal relation is the set R U of instance-witness pairs (y, w) = ((M, x, t), w), where |y|, |w| ≤ t and M is a random-access machine, such that M accepts (x, w) after at most t steps.

We call L U the universal language corresponding to the universal relation R U .

Definition 4.2 (SNARK proof system) A SNARK proof system for the relation R U is a triple of algorithm (G, P, V), where G is probabilistic, P, V are deterministic, which verifies the following properties:

• Completeness: For all (y, w) = ((M, x, t), w) ∈ R U , and for all strings crs ← G(1 λ )

Pr [V (crs, x, P (y, w, crs)) → 1] = 1

• Adaptive Soundness: There exists a negligible function ε(•), for all PPT adversaries A Pr y ∈ L ∧ V(crs, y, π) → 1 crs ← G(1 λ ), π ← P(crs, y) ≤ ε(λ)

• Succinctness: There exists a universal polynomial p such that, for every large enough security parameter k ∈ N and every instance y = (M, x, t) with t ≤ B. The length of a proof generated by an honest prover is bounded by p(k + log(B)).

Proof-carrying data

Proof carrying data (PCD), introduced by Chiesa and Tromer [START_REF] Chiesa | Proof-Carrying Data and Hearsay Arguments from Signature Cards[END_REF], is a cryptographic mechanism for ensuring that a given property is maintained at every step of a computation, typically in a distributed setting. The property of interest is specified as a compliance predicate, and every modification of the data comes accompanied with a proof that the data, and any operation leading to its current contents, satisfies the compliance predicate.

In this section we give a formal definition of PCD adapted from Bitansky et al. [BCC + 13].

Definition 4.3 (Distributed computation transcript)

A distributed computation transcript is a tuple T = (G, linp, data) with G = (V, E) a directed acyclic graph, linp : V → {0, 1} * a label function for vertices and data : E → {0, 1} * a label function for edges. We require that linp(v) = ⊥ for all v which are sources or sinks. The output of T , denoted out(T ), is equal to (ũ, ṽ) which is the lexicographical first edge such that ṽ is a sink.

Definition 4.4 (Proof-carrying transcript)

A proof-carrying transcript is a pair (T, π) with T a distributed computation transcript and π : E → {0, 1} * an edge label function.

Definition 4.5 (Compliance predicate)

A compliance predicate C is a polynomial-time computable predicate for nodes of the distributed computation transcript. We denote it C(z out ; linp, z in ), where z in is some input, z out is the (alledged) output, and the node's label is linp. Given a distributed computation transcript DCT, we say that node n in DCT, with inputs z in and local input linp, is C-compliant if C(z out , linp, z in ) holds for every output z out of n. We say that DCT is C-compliant if every node in the graph is C-compliant. We say that a string z is C-compliant if there exists a C-compliant distributed computation transcript containing an edge labeled z. Definition 4.6 (Distributed-computation generator) A distributed-computation generator is an algorithm S(C, σ, P CT ) which takes a C-compliance, a reference string σ and a computation transcript. Then at every time step, it chooses to do one of the following actions • Add a new unlabeled vertex to the computation transcript. Then the algorithm outputs a tuple ("add unlabeled vertex", x, ⊥), with x the new vertex.

• Label an unlabeled vertex. Then it outputs ("label vertex", x, y) with x ∈ V neither a source nor a sink and linp(x) = ⊥, and y is the new label of the vertex.

• Add a new labeled edge. Then it outputs ("add labeled edge", x, y) with x ∈ E and y the label of the edge.

We introduce in Algorithm 2 the ProofGen(C, σ, S, P) procedure, which describes an interactive protocol with C a compliance predicate, σ a reference string, S a distributed-computation generator (not necessarily efficient) and P C a PCD prover w.r.t. C, the PCD prover P C interacts with the distributed-computation generator S such that when S chooses to add a labeled edge P C produces a proof for the C-compliance of the new message and add this new proof as the proof label of the edge. Using the above ProofGen algorithm, we can give the formal definition of the Proof-Carrying Data scheme. Definition 4.7 (Proof-carrying data scheme) A proof-carrying data (PCD) scheme is a triple of algorithms (G, P, V) with G is probabilistic and P and V are deterministic.

A proof-carrying data system for a class of compliance predicates C is a triple of algorithm (G, P, V) that works as follows:

• G(1 λ ) → crs, on input the security parameter λ, outputs a common reference string crs.

Pr   T is B-bounded C(T ) = 1 V(σ, z o , π o ) = False σ ← G(1 λ , B) (z o , π o , T ) ← ProofGen(C, σ, S, P)   ≤ ε(λ)
• Proof of Knowledge: For every polynomial-size prover P * there exists a polynomial-size extractor E P * such that for every compliance C ∈ C, every large enough security parameter k ∈ N, every auxiliary input z ∈ {0, 1} poly (k) , and every time bound B ∈ N.

Pr   V(σ, z out , π) = True ⇒ (out(T ) = z out ∧ C(T ) = 1) σ ← G(1 λ , B) (z out , π) ← P * (σ, z in ) T ← E P * (σ, z in )   ≥ 1 -ε(λ)

Punctured pseudo-random function and obfuscations

Punctured pseudo-random functions (punctured PRFs), first introduced by Boyle et al. [START_REF] Boyle | Functional Signatures and Pseudorandom Functions[END_REF], has been largely used [START_REF] Sahai | How to use indistinguishability obfuscation: deniable encryption, and more[END_REF] with the obfuscators to construct provably secure cryptographic schemes. In our case, we combine punctured PRFs with an indistinguishable obfuscator to get the UWS scheme.

Definition 4.8 (Punctured pseudo-random function)

A puncturable family of PRFs is a triple of algorithm (G, P, F) corresponding to generation of initial parameters, getting punctured keys and applying the PRF. These three algorithms have to verify that there exists a pair of computable functions n(•) and m(•), satisfying the following conditions.

• Functionality preserved under puncturing. For every PPT adversary A such that A(1 λ ) outputs a set S ⊆ {0, 1} n(λ) , then for all x ∈ {0, 1} n(λ) where x ∈ S, we have that:

Pr F(K, x) = F(K S , x) : K ← G(1 λ ), K S = P(K, S) = 1
• Pseudo-random at punctured points. For every PPT adversary A such that A(1 λ ) outputs a set S ⊆ {0, 1} n(λ) and a state σ, then for all x ∈ {0, 1} n(λ) where x ∈ S, and for all PPT algorithm D, let K ← G(1 λ ) and K S ← P(K, S) there exists a negligible function ε(•) such that:

Pr [D (σ, K S , S, F(K, S)) = 1] -Pr D σ, K S , S, U m(λ)•|S| = 1 = ε(λ)
(x) -M 1 (x)|(M 0 , M 1 , τ ) ← Samp(1 λ ) ≥ 1 -ε(λ) then Pr D(σ, iO(τ, M 0 )) = 1 | (M 0 , M 1 , τ ) ← Samp(1 λ ) -Pr D(σ, iO(τ, M 1 )) = 1 | (M 0 , M 1 , τ ) ← Samp(1 λ ) ≤ ε(λ)
Then we give the formal definition of Weak Differing-Inputs Obfuscation which will be used in the construction of our scheme. The security of such obfuscators is measured by the following: For every non-uniform PPT adversary A and polynomial p(•). there exists a non-uniform PPT extractor E and polynomials q(•), t(•) such that the following holds. For every k ∈ N, every pair of Turing machines M 0 , M 1 ∈ M and every auxiliary input z,

Pr A(1 k , M , M 0 , M 1 , z) = b | b ← {0, 1}, M ← diO(1 λ , M b ) ≥ 1 2 + 1 p(λ) ⇒ Pr M 0 (w) = M 1 (w) | w ← E(1 λ , M 0 , M 1 , z) ≥ 1 q(λ)
The run-time of the extractor E is t(λ, d(λ)).

Applications: From UWS to other primitives

Our universal witness signature scheme can be considered as a generalization of many existing malleable signature schemes. To showcase this, we use our UWS scheme to instanciate several well-known signature schemes, and some more original ones, namely: Functional signatures, propositional signatures, hierarchical identity-based signatures, and redactable signatures. To the best of our knowledge, this is the first time that a construction for propositional signatures appears in the literature.

Functional signatures

Functional signatures, introduced by Boyle et al. [START_REF] Boyle | Functional Signatures and Pseudorandom Functions[END_REF], are a particularly wide-ranging generalization of identity-based signatures in which the key authority can generate signing keys sk f associated to functions f , such that the owner of sk f can sign exactly those messages that are in the image of f . Moreover, to sign m in the image of f , the owner of sk f needs a witness to this fact, namely a preimage of m under f . In this section, we show how we can easily obtain functional signatures based on universal witness signatures.

Definition 4.11 (Functional signature)

The functional signature for a message space M and a function family F = {f : D f → M} is a tuple of algorithms (Setup, KeyGen, Sign, Verify) which is specified as follows:

• Setup(1 λ ) → (msk, mvk): the setup algorithm takes a security parameter λ and it returns a master signing key msk and a master verification key mvk. Then it keeps the master signing key secret msk and publishes the master verification key mvk.

• KeyGen(msk, f ) → sk f : the key generation algorithm takes a master signing key msk and a function f to specify which one will be allowed to sign the messages, then it outputs a corresponding signing key.

• Sign(f, sk f , m) → (f (m), σ f (m) ): the signing algorithm takes a function f and the corresponding signing key sk f as input and produces f (m) and the signature σ f (m) of f (m)

• Verify(mvk, σ m , m) → {True, False}: the verification algorithm takes a signature-message pair (m, σ m ) and the master verification key mvk. The algorithm outputs True if σ m is a valid signature of m, otherwise outputs False.

Functional signatures from UWS. Consider the order O F corresponding to the function family F:

• Let M be the message space. The order O F is an order on the set { * } ∪ F ∪ M

• * is the greatest identity, bigger than all other messages.

• m ≤ f when ∃m ∈ M ∧ m = f (m )
• There does not exist any other non-trivial order

We note ≤ be the previously defined order. Then consider the UWS scheme corresponding to this order. The construction of the functional signature is described in figure

Sign(f, sk f , m): σ f (m) = UWS.Delegate(PP, sk f , f, f (m), m, "f (m) ≤ f ") return f (m), σ f (m)
Verify(mvk, σm, m):

return UWS.Verify(PP, SK f (m) , f (m)) Security of the functional signature scheme. A functional signature scheme is typically expected to verify the following properties:

• Correctness: This property expresses the fact that a properly generated signature is verified to be correct. Formally:

∀f ∈ F, ∀m ∈ D f , (msk, mvk) ← Setup(1 λ ), sk f ← KeyGen(msk, f ), (f (m), σ f (m) ) ← Sign(f, sk f , m), Verify(mvk, σ f (m) , f (m)) = True.
• Unforgeability: The unforgeability of the functional signature scheme is defined by the the following security game between an adversary A and a challenger C:

-C generates a pair of keys (msk, mvk) ← Setup(1 λ ), then publishes the master verification key mvk byt keeps the master signing key msk secret.

-C constructs an initially empty hash map H indexed by f ∈ F, a key generation oracle O KeyGen and a signing oracle O Sign as follows:

1. Verify(mvk, m, σ) = True 2. There does not exist m and f such that m = f (m ) and f was sent as a query to the key generation oracle O KeyGen .

3. The message m was not sent as a query to the signing oracle O Sign .

Condition 1 implies that Verify(PP, σ, m) = True. Condition 2 implies that for all (f, m ) which verifies that f (m ) = m, sk f has never been revealed. Then the third condition implies that σ m has not been revealed. As in the specific order corresponding to the functional signature, the only elements bigger than m are m itself, * , and {f | ∃m ∈ M.f (m ) = m}. With the conditions 2 and 3, the signatures of these identities have never been revealed, but A can produce a valid signature for m which break the existential unforgeability of the underlying UWS scheme.

Propositional signatures

In an invited talk at CRYPTO and CHES 2010, Naccache [START_REF] Naccache | Is theoretical cryptography any good in practice?[END_REF] introduced the new notion of propositional signatures, for which he suggested a number of real-world applications such as contract-signing. Propositional signatures are signatures on formulas of propositional calculus, which are homomorphic with respect to logical implication. In other words, given a signature on a propositional formula P , one should be able to publicly derive a signature on any Q such that P ⇒ Q. Since the satisfiablity of propositional formulas cannot be decided efficiently without auxiliary information, the derivation algorithm should also take as input a witness of P ⇒ Q, i.e. a proof of Q assuming P .

To the best of our knowledge, no construction of propositional signatures has been proposed so far. However, it is easy to see that they are, again, easily obtained from UWS.

Security of propositional signatures. Formally, a propositional signature scheme is a triple (G, D, V) of efficient algorithms for key generation: G(1 λ ) → (mvk, σ False ), signature derivation: D(mvk, σ P , P, Q, π) → σ Q , and verification: V(mvk, σ P , P ) → True/False. The signature σ False on the false proposition plays the role of master secret key, due to ex falso quodlibet. Correctness states that if σ P is a valid signature on proposition P (in the sense that V(mvk, σ P , P ) evaluates to True) and π is a valid proof of P ⇒ Q, then D(mvk, σ P , P, Q, π) a valid signature σ Q on Q. Unforgeability says that after obtaining signatures on propositions P i of his choice, an efficient adversary cannot produce a valid signature on a prosition Q such that none of the P i 's implies Q.

Propositional signatures from UWS. Clearly, the UWS scheme associated with the corresponding set of propositional formulas endowed with the NP preorder relation given by logical implication (where witnesses are proofs) exactly gives a propositional signature scheme.

In fact, our definition of security captures for UWS captures a slightly stronger security model, where unforgeability still holds when the adversary can make unrestricted delegation queries on messages he cannot see, so as to control delegation paths.

Hierarchical identity-based signatures

Hierarchical identity-based signatures (HIBS) were first introduced by Chow et al. [CHY + 04]. In that hierarchical version of identity-based signatures, the Private Key Generators are organized as a tree structure. An identity of depth , is represented by an -tuple id = (id 0 , id 1 , . . . id -1 ), and given the signing key SK id associated with id, it is possible to extract signing keys SK id on all identities id of the form id = (id 0 , . . . , id -1 , id , . . . ) (i.e. such that id is a prefix of id ). Definition 4.12 (HIBS) A hierarchical identity-based signature is a tuple of four PPT algorithms (Setup, Extract, Sign, Verify) which verifies the following specifications:

• Setup(1 λ ) → (PP, msk): Setup algorithm takes the security parameter λ as input and it outputs public parameters PP, and the master signing key msk, which is a signing key on the depth zero identity () (which is a prefix of all identities).

• Extract(PP, SK id , id, id ) → SK id : Given the secret key SK id on identity id, and an identity id such that id is a prefix of id , output a signing key SK id on id .

• Sign(PP, SK id , id, m) → σ m : Takes a signing key corresponding to the identity id and a message m. Outputs a signature σ m of the message m.

• Verify(PP, σ m , m, id) → {True, False}: Takes the master verification key, a message m, and its signature σ m as input. It outputs True or False.

These algorithms need to verify also the following standard correctness property: if SK is a signing key for identity id and σ ← Sign(SK, id, m), then we have Verify(PP, σ, m, id) = True.

HIBS from UWS. Consider an HIBS scheme with identity space I and message space M. We can define an order relation ≤ on the disjoint union I I × M as follows: id ≤ id if and only if id is a prefix of id ; (id , m) ≤ ID if and only if id is a prefix of id ; and (id , m ) ≤ (id, m) if and only if m = m and id is a prefix of id . Then the HIBS scheme can easily be constructed from any universal witness signature scheme for the order relation ≤ (note also that since ≤ is efficiently computable, witnesses can be omitted). The construction is as described in Figure 4 • A outputs an identity id * which will be used to challenge the security of the HIBS scheme.

• C takes a security parameter λ and computes the public parameters PP and the master signing key msk, sending the public parameters PP to A and keeping the master signing key msk secret.

• A can submit two types of queries:

Extract: in which A receives the signing key SK id on any identity id of his choosing Sign: in which A chooses a message m and an identity id, and receives a valid signature σ on message m under identity id

• Finally, A outputs a message m * and a signature σ * , and he wins if and only if V(PP, σ * , m * , id * ) = True.

That security notion is clearly satisfied by our UWS-based construction of HIBS, provided that the UWS scheme is adaptively secure (we in fact achieve the stronger notion of unforgeability under fully adaptive attacks). However, starting from a selectively secure UWS scheme, we may not be able to satisfy the property above, since the UWS definition of selective security would require the adversary to announce both the target identity and the target message of her forgery from the start (since we are effectively forging on (id * , m * )).

Redactable signatures

Redactable signatures are a type of homomorphic signature scheme originally defined by Johnson, Molnar, Song and Wagner [JMS + 02], that allows to redact part of a signed message while preserving signature validity. They were proposed as a way of guaranteeing the authenticity of documents published as part of public disclosure initiatives while taking security and privacy concerns into account. They have also found uses in medical and legal settings.

Let us consider the alphabet Σ = {0, 1, #}. We define a partial order on Σ with # ≤ Σ 0 and # ≤ Σ 1, no other non-trivial order in the alphabet. Then this order can induce a partial order in the set Σ * by point-wise comparison. Which means x 0 , x 1 , . . . , x n ≤ y 0 , y 1 , . . . , y n if ∀i ∈ {0, . . . , n}.x i ≤ Σ y i . Definition 4.13 (Redactable signature scheme) A redactable signature scheme is a tuple of algorithms (G, S, V, D) with (PP, sk) ← G(1 λ ) which verifies the following properties:

• S(PP, sk, m) outputs a signature σ m on m ∈ Σ * .

• D(PP, σ m , m, m ) takes as input the public parameters, a signature σ m on a message m, and another message m ∈ Σ * , and returns a signature σ m on m provided that σ m is valid and m ≤ m.

• The verification algorithm V is subject to the obvious correctness constraints (it accepts validly generated and derived signatures).

Redactable signatures from UWS. We will use our UWS scheme to construct the redactable signature scheme. Let us consider a UWS scheme (Setup, Delegate) with respect to the order ≤ on the set { * } ∪ Σ * , where Σ * is ordered as in the redactable signature scheme, and * is appended as the greatest element. Note that the order ≤ is efficiently computable, so that we do not actually need witnesses. We can construct a redactable signature scheme as descibed in Figure 4.3. Security of redactable signatures. A redactable signature is said to be secure (i.e. unforgeable) if an efficient adversary allowed to make signature queries on arbitrary messages m 1 , . . . , m q ∈ Σ * is not able to produce a valid signature on a new mesage m * that does not satisfy m * ≤ m i for any i.

Our construction clearly satisfies that property, provided that the underlying UWS scheme is adaptively secure.

Construction of UWS

We now explain how to realise UWS. The first construction requires only the existence of one-way function, but is neither context-hiding nor succinct. These properties can be obtained at the cost of introducing new assumptions such as the existence of proof-carrying data (for succinctness) or obfuscators (for contexthiding).

Construction from one-way functions

Firstly, we propose a construction of the UWS scheme based only on the existence of one-way functions. Since the existence of one-way function is a very weak and basic assumption of cryptography. But this very basic construction does not verify many other properties than adaptive security like succinctness or context-hiding.

In this construction, we use a "certificate of computation" approach: Every signature is provided with a certificate of the delegation path. And an identity A can provide a certificate of the identity B if and only if B ≤ A. For example if for the generation of the signature of the identity A, we have passed the identities * , id 1 , id 2 , . . . , id n , A. Each identity produced a signing-verification key pair (sk idi , vk idi ) using the key generation of a signature scheme, and σ vki is a signature of (id i , w idi≤idi-1 , vk i )1 produced using the signing key sk i-1 The signature of the identity A is represented by

SK A = sk A , (vk A , A, w A≤n , σ vk A ) , vk idn , id n , w idn≤idn-1 , σ vk idn , . . . , (vk * , * , w * ≤ * , σ vk * )
For simplicity we will note "w is a valid witness of x ≤ y" by "x ≤ w y" in the following sections of this paper and we propose the following construction of our UWS scheme using a classical existential unforgeable signature scheme Sig = (Setup, Sign, Verify).

• Setup(1 λ ):

-The setup algorithm first takes two pairs of keys (msk, mvk), (vk * , sk * ) from the signature's parameters generation algorithm.

-Then it generates a signature σ vk * of ( * , w * ≤ * , vk * ) using the signing key msk, this can be considered as a certificate of the verification key vk * delivered by the master authority.

-The certificate c * of the identity * is [(vk * , * , w * ≤ * , σ vk * )]. The signing key (signature) SK * of the identity * in our UWS scheme is (sk * , c * ) and the public parameter PP will be mvk.

• Delegate(mvk, SK A , A, B, w):

-The signing key SK A has the form (sk A , c A ), where the certificate c A is a list

[(vk A , A, w A , σ A ), . . . , (vk * , * , w * ≤ * , σ vk * )].
-The delegation algorithm first verifies that the certificate c A is valid, by checking that each σ j is a valid signature on (id j , w j , vk j ) with respect to the verification key vk j-1 . It also checks that the witnesses are valid: B ≤ w A ≤ w A id n . . . and that vk A is a correct public key for sk A by signing a random message and verifying it.

-If all these verification steps succeed, a fresh key pair (sk and by construction, we have that (vk B , sk B ) is a valid signature key pair, and σ B is a valid signature of (B, w B≤A , vk B ). By the verification above and hypothesis of SK A is valid, c B is also a valid certificat and Verify(mvk, SK B , B) outputs True.

The proof that this construction is adaptively secure is given in Section 4.1.5.

Succinct construction from proof-carrying data

Notice that in the previous construction only based on a one-way function, the scheme is clearly neither context-hiding nor succinct. Thus in this section we will give a construction based on SNARKs, which is adaptively secure and succinct, and for which we provide arguments hinting that it is context-hiding. As a downside, we are limited to a polynomial number of elements: the maximum delegation level must be decided at setup time, as it is polynomial in the security parameter.

Our construction use the following theorems proposed by Bitansky et al. [BCC + 13].

Theorem 4.2 (SNARK recursive composition theorem)

There exists an efficient transformation RecComp algorithm such that, for every publicly-verifiable SNARK (G SNARK , P SNARK , V SNARK ), the 3-tuple algorithms (G, P, V) = RecComp(G, P, V) is a publicly-verifiable P CD system for every constant-depth compliance predicate.

Theorem 4.3 (PCD depth-reduction theorem) Let H = {H K } k∈N be a collision-resistant hash-function family. There exists an efficient transformation DepthRed H with the following properties:

• Correctness: If (G, P, V) is a P CD system for constant-depth compliance predicates, then (G , P , V ) = DepthRed H (G, P, V) is a path P CD for polynomial-depth compliance predicates.

• Verifiability Properties: If (G, P, V) is publicly verifiable then so is (G , P , V )

• Efficiency: There exists a polynomial p such that the (time and space) efficiency of (G , P , V ) is the same as that of (G, P, V) up to the multiplicative factor p(k)

For the construction, we follow the same line of thinking as in Section 4.1.4.1. We consider an existential unforgeable signature scheme Sig = (Gen, Sign, Verify), with master signing key msk and master verification key mvk. Let us first define the distributed computation transcript T = (G, linp, data) and the corresponding C-compliance C(z out , linp, z in ) as follows:

• G = (V, E): The graph of the distributed computation transcript, with V labeled by the identity and (A, B) ∈ E labeled by the tuple (VK B , SK B , w B≤A , σ VK B ).

• linp: The local input of the vertices will be the identity corresponding to this vertex.

• z out : The data of the edges are the labels of the edges, specifically z out = (VK B , SK B , w B≤A , σ VK B ).

• Let us consider the PCD scheme (G, P, V) corresponding to the distributed computation transcript described as above. Then we have all the building blocks for our universal witness signature. Proof: If SK B is produced by the Delegate algorithm on SK A , and SK A is a valid signature of A, by the correctness of the PCD scheme, we have π B is a valid proof of the fact that z B is consistent with the C-compliance transcript. This assures that the new signature SK B will pass the verification algorithm which means Verify(PP, SK B , B) will outputs True.

We give also proof of the selective security and succinctness of this construction in Section 4.1.6.

Construction from virtual black-box obfuscation

Obfuscations of programs is a very powerful cryptographic primitive, from which many attractive protocols can be constructed [START_REF] Sahai | How to use indistinguishability obfuscation: deniable encryption, and more[END_REF].

For our construction, we remind that in previous sections we have constructed two different UWS. But these constructions have not been proven completely context-hiding. In this section, we will use the Virtual Black-Box (VBB) obfuscator to construct the first context-hiding UWS scheme.

Notice that the constructions of the black-Box obfuscator for general circuits has been proven by Barak et. al. [BGI + 12] impossible, however the construction using black-Box obfuscation usually can give us some good ideas for the construction using some more realistic primitives like indistinguishable obfuscation etc.

Definition 4.14 (Virtual black-box obfuscator) A virtual black-box obfuscator O is a probabilistic algorithm verifying the following three properties:

• Functionality: For every circuit C, the string O(C) describes a circuit that given any inputs outputs the same result as C.

• Polynomial Slowdown: There exists a polynomial p such that |O(C)| ≤ p(|C|).

• Virtual Black-Box: For any PPT adversary A, there exists a PPT algorithm S and a negligible function ε such that for all circuits C:

Pr [A(O(C)) = 1] = Pr S C (1 |C| ) = 1 ≤ (|C|)
We give our construction as follows. Let O be a VBB obfuscator and Sig = (Setup, Sign, Verify) a deterministic existential unforgeable signature scheme. And we suppose that all identities and witnesses have at most polynomial size with respect to the security parameter. Let us consider the following signature scheme:

• Setup(1 λ ):

-We generate a pair of signautre keys (msk, mvk) ← Sig.Setup(1 λ ). • Succinctness, context-hiding. As mentioned before, a valid signature SK A equals to Sig.Sign(msk, A), then the signature is completely independent from the delegation path, thus the UWS scheme is succinct and context-hiding.

The intuition of the security proof of this construction is directly based on the virtual-black box property of VBB obfuscation. We give the detailed proof of security in Section 4.1.7.

Construction from indistinguishable obfuscation

In the previous section, we constructed a provable context-hiding UWS scheme using the virtual black-box obfuscation, as presented by Barak et Our construction of UWS from punctured PRFs and iO achieves correctness, context-hiding, and succinctness. However, besides the reliance on such an evasive primitive as iO, our construction is limited to certain pre-orders, and the maximum delegation level must be chosen at setup time. More precisely, we give a construction for the pre-orders ≤ which verify the specific properties:

• ≤ is anti-symmetric;

• Each element e has only polynomial-many elements bigger than e -we denote this bound by B. This enables us to leverage weak differing-inputs obfuscators (wdiO), introduced by Boyle, Chung, and Passin [START_REF] Boyle | On Extractability Obfuscation[END_REF], and which can be constructed only based on indistinguishable obfuscators.

We will use the following three primitives in our construction:

1. Let C = wdiO(C) be the weak differing-inputs obfuscation of the circuit C;

2. Let (G, F) be a punctured PRF scheme in which G generates the system parameters and F is the keyed PRF;

3. Let f be a one-way function.

Here is our construction:

• Setup(1 λ ):

-We generate the PRF key K from G(1 λ ) and compute the weak differing-inputs obfuscation CheckSign of the algorithm CheckSign.

-The master signing key (signature of * ) SK * is the PRF value F(K, * ) of * and the public parameter PP is the obfuscated circuit CheckSign .

• Delegate(PP, SK A , A, B, w B≤A ):

-CheckSign (SK A , A, B, w B≤A ) which is a weak differing-inputs obfuscation of the program CheckSign described Algorithm 4.

Algorithm 4: CheckSign[K]

Input: SKA, A, B, w. Output: SKB or ⊥. Proof: Same as the proof of correctness, succinctness and context-hiding of the VBB-based construction, These three properties of this construction relies on the functionality property of the underlying weak differing-inputs obfuscation wdiO. By the construction we can see that a valid signature SK A of identity A is equivalent to the fact that SK A = F(K, A).

1. if f (F(K, A)) == f (SKA) ∧ A >w B 2. return SKB = F(K, B) 3. else iff (F(K, A)) == f (SKA) ∧ A =w B
• Correctness If SK B is produced by the algorithm Delegate, then SK B = F(K, B). We have Verify(PP, SK B , B) = True.

• Succinctness and Context-hiding The signature SK A = F(K, A) is independent from the delegation path and as it's output of a pseudo-random function, the UWS scheme is succinct and context-hiding.

We also give a security proof and a more detailed proof of succinctness and context-hiding of the construction of UWS scheme based on the iO in the Section 4.1.8.

Adaptive security of the OWF-based construction

Theorem 4.7 If the signature scheme Sig used in Section 4.1.4.1 is adaptively and existentially unforgeable then the OWF-based UWS scheme based is also adaptively secure with our definition.

Proof: We will construct an attacker against the adaptively existential unforgeability of the underlying signature scheme A Sig by using an attacker against the existential unforgeability the UWS scheme A UWS . Suppose that we have an adversary A UWS which wins the existential unforgeable security game against the UWS scheme with an advantage ε. By definition, it can produce SK A which is a valid signature of A. Thus SK A verifies the following properties: Suppose that the number of requests of delegation is bounded by a fixed number q and the adversary A can produce SK m = (sk m , c m ) corresponding to m. We define 2 types of forgeries:

1. SK A = (sk A , [(vk A , A,
• Type 0 forgery: c m is a prefix of c m which is a certificate of m revealed by the requests of the adversary A.

• Type 1 forgery: c m is not a prefix of any c m which is a certificate of m revealed by the request of the adversary A. c x is a prefix of c y . We note maxPref(c x ) the longest prefix of c x which is a valid certificate for a certain identity.

To construct an adversary A Sig , we need simulate the delegation oracle O Delegate and the reveal oracle O Reveal by the functions in the underlying signature scheme.

Let us consider the hash map H initially empty. We will proof that the attacker A UWS with nonnegligeable advantage ε against its own security game can win the security game of the underlying signature scheme with advantage ε 2q+1 which is not negligible. We suppose that A UWS outputs SK m = (sk m , c m ) as challenge text against the UWS scheme. We choose an integer i in {0, . . . , 2q} and then proceed as in the case i described below:

• Case 0: In this case, we guess that A UWS is a type 1 forgery and maxPref(c m ) is the empty prefix ε.

Firstly we construct a simulator which simulates O Delegate and O Reveal .

-O Delegate : We construct the delegation function just as it has been defined.

-O Reveal : Outputs the value corresponding in the hash table.

During the procedure Setup, the simulator follows the same procedure except that for signing m * = * ||w * ≤ * ||vk * we replace the signing algorithm Sig.Sign by the signing oracle O msk using the master signing key msk.

Suppose that there exists an adversary A which produces an attack text SK of type 0 forgeryagainst the UWS OW F scheme. Let (m * = ( * ||w * ≤ * ||vk * ), σ vk * ) be the first element of the certificate of SK . We submit the message-signature pair (m * , σ vk * ) as a challenge text for underlying signature scheme using the master signing key msk. As (m * , σ vk * ) is not a prefix of any c x revealed by the Adversary(by the assumption of this case), so with the negligible probability O sign has evaluated on m * . Thus if our guess is correct, we can win the security game against the underlying signature scheme with a non-negligible probability.

• Case i (for i ∈ {1, . . . , q}): In these cases, we guess that A UWS is a type 1 forgery, and it outputs (SK A , A) with SK A = (sk A , c A ). In the case i we suppose that in the i-th query's result SK x we have c x = maxPref(c A ).

Then we construct an adversary A Sig for the underlying signature scheme.

-O Delegate : We follow the construction of the delegation function in the UWS scheme for the first i queries. Then when we use the function Delegate(P P, SK x , x, y, w), we replace the signing procedure using sk x by the signing oracle O skx until another different sk x corresponding to x have been generated. -O Reveal : Outputs the corresponding value in the hash table.

Let (m, σ m ) be the element in c A just after maxPref(c A ). The existence of (m, σ m ) is assured by the fact that maxPref(c A ) = c A otherwise it is a type 0 forgery. Then we submit it as challenge text for the underlying signature scheme with signing key sk x . With a negligible probability O skx has signed the message m (even A UWS have required to delegate from x to m, any valid signing key corresponding to the identities smaller than m can never be revealed, otherwise it contradict with the assumption "c x = maxPref(c A )", so we can simply ignore these requests), but as SK A is a valid signature of A. σ m is a valid signature of m w.r.t the signing key sk x which means if our guess is correct then we have constructed an adversary A Sig who can win the security game against the underlying signature scheme.

• Case i (for i ∈ {q + 1, . . . , 2q}): In these cases, we guess that A UWS is a type 0 forgery and it outputs (SK A , A) with SK A = (sk A , c A , c sk A ). In the case i, we suppose that in the (iq)-th query's result SK x we have c x = c A . Then we construct an adversary A Sig for the underlying signature scheme.

-O Delegate : We follow the construction of the delegation function in the UWS scheme for the first iq -1 queries. Then when we use the function Delegate(PP, SK x , x, y, w), we replace the signing procedure using sk x by the signing oracle O skx . -O Reveal : Outputs the corresponding value in the hash table .   Let m be a message randomly generated. We obtain the signature σ m corresponding to the message m using sk x obtained in the SK A . As m is generated randomly, so the signing oracle O skx only has a negligible probability to have signed the message m. So with a non-negligible probability (m, σ m ) is a valid challenge text for the security game against the underlying signature scheme. Thus if our guess of this case is correct then we can construct an adversary against the underlying signature scheme.

Finally as the 2q + 1 types of forgeries recover all the possibilities, our adversary constructed A Sig can win at least one of them with advantage ε, and the adversary choose randomly between the 2q + 1 cases, then the advantage of A Sig against the underlying signature scheme is at least ε 2q+1 , which is still non-negligible if ε is non-negligible.

Security proof of the PCD-based construction

Suppose that there exists an adversary A PCD with non-negligible advantage against the PCD-based UWS scheme described in Section 4.1.4.2. In the selective security game, the adversary first announces the identity id * that will be targeted. Since as a hypothesis, there are only polynomially many identities, the set I = {id | id .id < id ∧ id * < id } also has polynomial size. We ask the Delegate OWF oracle to sign all identities in the set I, then we construct a simulator for the UWS PCD oracles.

We construct the following simulator S:

• Delegate PCD (PP, SK A , A, B, w B≤A ): S verifies that SK A is a valid signature. Then use the signatures of the identities in I to generate a valid signature for the identity B. Then stock it in a hash table.

• Reveal PCD (A): This algorithm follows the honest procedure of access to the hash table.

Together with the attacker A PCD , the simulator S can be considered as a prover which provides a valid PCD proof (z id * , π id * ). Then by the proof of knowledge property there exist a extractor E algorithm which can produce a valid distributed computation transcript T ← E(PP) verifing that out(T ) = z id * and C(T ) = True. From this transcript we can construct a valid signature (SK id * , c id * ) for id * in UWS OWF . This will be a valid attack for the underlying one-way function based UWS scheme.

Remind that actually our construction is also selective with the a pre-order without anti-symmetric property, because in our construction, when we delegate to an identity whether there already exists a vertex with the same label, we will always create a new vertex. Thus the distributed computation script corresponding to the pre-order is always acyclic.

Security proof of the VBB-based construction

We simulate the two oracles O Delegate and O Reveal , which will be used by the adversary later on:

• O Delegate (PP, A, B, w B≤A ): If A = * or the value corresponding to the identity A in the hash map is , then it add (B, ) to the hash map.

• O Reveal (B): If the value corresponding to the identity B int the hash map is , then it outputs Sig.Sign(msk, B).

We will present the security proof using hybrids:

• Hybrid 0: This hybrid is the real-world adaptive security game for the adversary A. Denote the advantage of A by Adv 0

• Hybrid 1: In this hybrid, we replace PP = (mvk, P ) by PP = mvk. and consider the adversary S P (•) , which is an adversary with the oracle access to the algorithm P . Denote the advantage of S P by Adv 1 .

Lemma 4.8 There exists a negligible function ε such that with the security parameter λ:

Adv 0 ≤ Adv 1 + ε(λ).
Proof: By the virtual black-box property which is:

∀A.∃S. Pr [A(O(Delegate)) = 1] -Pr S Delegate(•) 1 |Delegate| = 1 ≤ ε(|Delegate|)
We know that, Adv 0 ≤ Adv 1 + ε(λ).

Lemma 4.9 There exists a negligible function ε such that with the security parameter λ:

Adv 1 ≤ ε(λ).
Proof: By the adaptive security of the signature scheme, there exists a negligible function ε(•) such that all adversaries A have at most ελ advantage against the signature scheme.

And from the security game in the hybrid 1, we can see that we can simulate the oracle access to the delegation algorithm by the access of the signing oracle. From a forgery (m, SK m ) of the UWS scheme, we submit it as a forgery of the underlying signature scheme. In the security game, by the definition S P has never required to get a message-signature pair (m , SK m ) such that m ≤ m . Thus (m, SK m ) is a valid forgery for the underlying signature scheme. By the adaptive security of the signature scheme and the fact that S P is a valid adversary, we have Adv 1 ≤ ε(λ).

Succinctness. The succinctness of the UWS scheme is clear from the construction. A valid signature of the message m in the UWS scheme by the construction in equal to Sig.Sign(msk, m). Thus if the underlying signature scheme is succinct. Then the UWS scheme constructed is succinct.

Proof of security, context-hiding and succinctness of the weak iO based construction

Security proof

We begin the proof by the citation of a theorem proposed by Boyle et al. [START_REF] Boyle | On Extractability Obfuscation[END_REF]. Informally, with the assumption of existence of indistinguishable obfuscator we can construct weak differencing-input obfuscators as defined in the preliminary.

Remind that we need a super polynomial inditinguishable obfusction for this construction.

Theorem 4.10 Let O be an indistinguishable obfuscator for P/poly. Then O is also a weak differing-inputs obfuscator for P/poly.

Then we prove the selective security of the constructed signature scheme using the following hybrid games played between the adversary A and a challenger C. • Hybrid 0: In this hybrid, we proceed exactly as in the initial selective security game of the UWS scheme:

1. A chooses a message m.

2. C uses the PRF's generation algorithm G to get the key K for the PRF.

C uses the obfuscator wdiO to get a weak differing-inputs obfuscation of the function CheckSign[K]

and sets it as a public parameter and keep the PRF's key K secret.

4.

A can require C to apply polynomial times the function CheckSign [K](SK A , A, B, w) and can only require C to reveal a secret key SK A of A if A ≤ m.

5.

A returns a secret key corresponding to the message m.

Let H X be a hash map which associates x ∈ X to the value f (F(K, x)). We also define an initially empty set L. Suppose that there are 2 n identities and 2 |W | possible witnesses, we will represent them by e 1 , . . . , e 2 n and w 1 , . . . , w 2 |W | .

• Hybrid .e 0 : e 0 represents the first possible identity.

1. A chooses a message m.

2. C uses the PRF's generation algorithm G to generate the key K for the PRF.

1. if A ∈ L l ∧ B ≤w A ∧ B = A ∧ f (SKA) == HL (A) 2. return SKB = F(KL , B) 3. else if A ∈ L ∧ B == A ∧ f (SKA) == HL (A) 4. return SKB = SKA 5. else if A ∈ L ∧ B ≤w A ∧ B = A ∧ f (SKA) == f (F(KL , A)) 6. return SKB = F(KL , B) 7. else if A ∈ L ∧ B == A ∧ f (SKA) == f (F(KL , A)) 8. return SKB = SKA 9. return ⊥
• Hybrid .e i .(e j , w k ): e j and w k represent respectively j-th identity and k-th possible witness. These hybrids do exactly the same thing as the hybrid .e 0 except that in the step 3 we add "C tests whether e i ≤ w k e j ∧ e i = e j ∧ e j ∈ L. If it is the case, then set the F lag only<L to False. Also if m ≤ w e i then set F lag ≥m to True."

And after the hybrid .e i .(e 2 n -1 , w 2 |w| -1 ) we continue with the hybrid .e i .final.

Remind that the idea behind these hybrid is that the variable F lag only<L is Trueiff all bigger identities than e i are in the set L . Thus to set the expected value to this variable, we need to test all the possible witness and identites.

• Hybrid .e i .final: In this hybrid, we test firstly whether F lag only<L = True and F lag ≥m = False. If one of these tests fail, then this hybrid do exactly the same thing as the hybrid .e i and continue with Hybrid .e i+1 .(e 0 , w 0 ) Otherwise, we continue with the hybrid .e i .random with L +1 = L ∪ {e i }, also replace K L +1 = P(K L , e i ) and add the key-value pair (e i , f (F(K L , e i ))) into the hash map

H L to construct H L +1 . Then we replaceCheckSign k [K L , H L ](SK A , A, B, w) by CheckSign +1 [K L +1 , H L +1 ](SK A , A, B, w).
• Hybrid .e i .random: This hybrid does the same thing except that we replace the value in the hash table H corresponding to e i by a random value. Then we continue with the hybrid + 1.e 0 .

Proof: [of Theorem 4.10] We begin the proof by remind that Hybrid 0 and Hybrid 0.e 0 are exactly the same procedure. And the hybrid .e i and .e i .(e j , w k ) do also the same thing. The only difference is that C does some tests which are totally independent with the output. Thus the A can not distinguish these hybrids with non-negligible probability. Denote this probability by ε 0 . We now prove some useful subresults. Proof: [of Lemma 4.11] The only difference between the hybrid .e i .(e j , w k ) and the hybrid .e i .final is when F lag only<L = T rue and F lag ≥m = False we have added e i in to the set L +1 .

The boolean value F lag only<L indicates whether e i is only smaller than elements in L, and F lag ≥m indicates whether e i is lager than m.

Assume A can find an input (SK A , A, B, w) which can differentiate these two hybrids, i.e.

-B = e i -B ≤ w A ∧ B = A ∧ f (SK A ) = H L (A)
But we remind that in the hash table H L . All values are replaced by random values. So if A can produce a tuple (SK A , A, B, w) that verifies the previous properties, then for any random values σ, A can find with non-negligible probability x such that f (x) = σ. Then A is also a valid adversary for the security of one-way function.

On the other side, if A can not find the input (SK A , A, B, w) which can differentiate these two hybrids, then by the weak differing-inputs property for wdiO, A can not differentiate these two hybrids.

Lemma 4.12 If A can distinguish the hybrid .e i .final and the hybrid .e i .random. Then A can break the pseudo-randomness of the punctured PRF. Denote the probability of distinguishing these two hybrids by ε PRF .

Proof: [of Lemma 4.12] Informally the punctured PRF guarantees that for a set S and for any elements s ∈ S, there does not exist a PPT adversary B given K s , x, σ can differentiate F(K, S) from the a value chosen randomly from the uniform distribution U m(λ),S . In the hybrid .e i .final we only know the constant K L +1 and H L +1 . We don't know the value of K L +1 , thus by the security property of the punctured pseudo-random function no adversary can distinguish F(K L l , x) for x ∈ L +1 -L l from a random value with non-negligible probability. Any adversary which can distinguish .e i .random from .e i .final can exactly distinguish F(K L l , x) from a random value. As the number of elements bigger than m is bounded by B. Then the probability of distinguish these the last hybrid from the Hybrid 0 is

Lemma 4.13 If

2 n • 2 |w| • ε 0 + 2 n • (ε OWF + ε diO + ε PRF ) ≤ c2 -λ
with c a constant independent from the security parameter λ. This concludes the proof of Theorem 4.10.

Context-hiding and succinctness

Apart from the very basic notion of unforgeability, there are many other properties which are interesting such as context-hiding and succinctness. We will show that our construction verifies such properties Remind that the value of the signing key SK A for the identity A is equal to F(K, A).

• Context-hiding. As defined in the preliminary, no adversary can distinguish between

SK 1 B ← Delegate(PP, SK A1 , A 1 , B, w 1 ) SK 2 B ← Delegate(PP, SK A2 , A 2 , B, w 2 )
Indeed they have exactly the same value.

• Succinctness. As we mentioned before, a valid signature SK A for an identity A is equal to F(K, A). So the length of the signature is bounded by the length of messages in the PRF's range.

Conclusion

We have introduced in this paper, the new definition if the generalization of the delegatable signature schemes called Universal Witness Signature. We formally define the security properties, context-hiding property and succinctness for our UWS scheme. And we give four different constructions with respect to different properties required using one-way function, proof-carrying data scheme, virtual-black box obfuscation and indistinguishable obfuscation. However, each of these constructions has some limitations. Constructing secure, succinct and contexthiding UWS with unbouded delegation depth based on relatively weak assumptions is left as a challenging open problem. In addition, our work did not tackle the problem of anonymity for UWS-like schemes, and we only considered unary delegation. Those problems are also worth investigating in future work.

Legally fair contract signing without keystones Abstract

In two-party computation, achieving both fairness and guaranteed output delivery is well known to be impossible. Despite this limitation, many approaches provide solutions of practical interest by weakening somewhat the fairness requirement. Such approaches fall roughly in three categories: "gradual release" schemes assume that the aggrieved party can eventually reconstruct the missing information; "optimistic schemes" assume a trusted third party arbitrator that can restore fairness in case of litigation; and "concurrent" or "legally fair" schemes in which a breach of fairness is compensated by the aggrieved party having a digitally signed cheque from the other party (called the keystone).

In this paper we describe and analyse a new contract signing paradigm that doesn't require keystones to achieve legal fairness, and give a concrete construction based on Schnorr signatures which is compatible with standard Schnorr signatures and provably secure. This is joint work with Houda Ferradi, Diana Maimuţ, David Naccache, and David Pointcheval. This work was presented at ACNS 2016 in Guildford (United Kingdom), and the paper was published in [FGM + 16a].

Introduction

When mutually distrustful parties wish to compute some joint function of their private inputs, they require a certain number of security properties to hold for that computation:

• Privacy: Nothing is learned from the protocol besides the output;

• Correctness: The output is distributed according to the prescribed functionality;

• Independence: One party cannot make their inputs depend on the other parties' inputs;

• Delivery: An adversary cannot prevent the honest parties from successfully computing the functionality;

• Fairness: If one party receives output then so do all.

Any multi-party computation can be securely computed [Yao86; GMW87a; Gol04a; BGW88; CCD88] as long as there is a honest majority [START_REF] Andrew | Legally-Enforceable Fairness in Secure Two-Party Computation[END_REF]. In the case where there is no such majority, and in particular in the two-party case, it is (in general2 ) impossible to achieve both fairness and guaranteed output delivery [Lin08; Cle86].

Weakening fairness.

To circumvent this limitation, several authors have put forth alternatives to fairness that try and capture the practical context (e.g. contract-signing, bank transactions, etc.). Three main directions have been explored:

1. Gradual release models: The output is not revealed all at once, but rather released gradually (e.g. bit per bit) so that, if an abort occurs, then the adversary has not learnt much more about the output than the honest party. This solution is unsatisfactory because it is expensive and may not work if the adversary is more computationally powerful [GHK + 08; GL91; Pin03; GMP + 06].

Optimistic models:

A trusted server is setup but will not be contacted unless fairness is breached. The server is able to restore fairness afterwards, and this approach can be efficient, but the infrastructure requirements and the condition that the server be trusted limit the applicability of this solution [Mic03; ASW97; CC00]. In particular, the dispute-resolving third party must be endowed with functions beyond those usually required of a normal certification authority.

Legally fair, or concurrent model:

The first party to receive output obtains an information dubbed the "keystone". The keystone by itself gives nothing and so if the first party aborts after receiving it, no damage has been done -if the second party aborts after receiving the result (say, a signature) then the first party is left with a useless keystone. But, as observed in [START_REF] Chen | Concurrent Signatures[END_REF] for the signature to be enforced, it needs to be presented to a court of law, and legally fair signing protocols are designed so that this signature and the keystone give enough information to reconstruct the missing data. Therefore, if the cheating party wishes to enforce its signed contract in a court of law, it by doing so reveal the signature that the first party should receive, thereby restoring fairness [START_REF] Chen | Concurrent Signatures[END_REF]. Legal fairness requires neither a trusted arbitrator nor a high degree of interaction between parties.

Lindell [START_REF] Andrew | Legally-Enforceable Fairness in Secure Two-Party Computation[END_REF] also introduces a notion of "legally enforceable fairness" that sits between legal fairness and optimistic models: a trusted authority may force a cheating party to act in some fashion, should their cheating be attested. In this case the keystone consists in a digitally signed cheque for an frighteningly high amount of money that the cheating party would have to pay if the protocol were to be aborted prematurely and the signature abused.

Concurrent signatures. Chen et al. [START_REF] Chen | Concurrent Signatures[END_REF] proposed a legally fair signature scheme based on ring signatures [RST01; AOS02] and designated verifier signatures [START_REF] Jakobsson | Designated Verifier Proofs and Their Applications[END_REF], that is proven secure in the Random Oracle Model assuming the hardness of computing discrete logarithms.

Concurrent signatures rely on a property shared by ring and designated verifier signatures called "ambiguity". In the case of two-party ring signatures, one cannot say which of the two parties produced the signature -since either of two parties could have produced such an ambiguous signature, both parties can deny having produced it. However, within the ring, if A receives a signature then she knows that it is B who sent it. The idea is to put the ambiguity-lifting information in a "keystone". When that keystone is made public, both signatures become simultaneously binding.

Concurrent signatures schemes can achieve legal fairness depending on the context. However their construction is not abuse-free [BW00; GJM99]: the party A holding the keystone can always determine whether to complete or abort the exchange of signatures, and can demonstrate this by showing an outside party the signature from B with the keystone, before revealing the keystone to B.

Our Results. In this work we describe a new contract signing protocol that achieves legal fairness and abuse-freeness. This protocol is based on the well-known Schnorr signature protocol, and produces signatures compatible with standard Schnorr signatures. For this reason, and as we demonstrate, the new contract signing protocol is provably secure in the random oracle model under the hardness assumption of solving the discrete logarithm problem. Our construction can be adapted to other DLP schemes, such as most 3 of those enumerated in [START_REF] Horster | Meta-El-Gamal Signature Schemes[END_REF], including Girault-Poupard-Stern [START_REF] Girault | On the Fly Authentication and Signature Schemes Based on Groups of Unknown Order[END_REF] and ElGamal [START_REF] Elgamal | A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms[END_REF].

Preliminaries

Schnorr signatures

Schnorr digital signatures [START_REF] Schnorr | Efficient Identification and Signatures for Smart Cards[END_REF] are an offspring of ElGamal [START_REF] Elgamal | A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms[END_REF] signatures. This family of signatures is obtained by converting interactive identification protocols (zero-knowledge proofs) into transferable proofs of interaction (signatures). This conversion process, implicitly used by ElGamal, was discovered by Feige, Fiat and Shamir [START_REF] Feige | Zero-Knowledge Proofs of Identity[END_REF] and formalized by Abdalla, Bellare and Namprempre [AAB + 02].

Throughout this section, we will refer to the original Schnorr signature protocol as "classical" Schnorr. This protocol consists in four algorithms:

• Setup( ): On input a security parameter , this algorithm selects large primes p, q such that q ≥ 2 and p -1 mod q = 0, as well as an element g ∈ G of order q in some multiplicative group G of order p, and a hash function H : {0, 1} * → {0, 1} . The output is a set of public parameters pp = (p, q, g, G, H).

• KeyGen(pp): On input the public parameters, this algorithm chooses uniformly at random x $ ← -Z × q and computes y ← g x . The output is the couple (sk, pk) where sk = x is kept private, and pk = y is made public.

• Sign(pp, sk, m): On input public parameters, a secret key, and a message m this algorithm selects a

random k $ ← -Z × q , computes r ← g k e ← H(m r) s ← k -ex mod q
and outputs r, s as the signature of m.

• Verify(pp, pk, m, σ): On input the public parameters, a public key, a message and a signature σ = r, s , this algorithm computes e ← H(m, r) and returns True if and only if g s y e = r; otherwise it returns False.

The security of classical Schnorr signatures was analyzed by Pointcheval and Stern [PS96; PS00] using the Forking Lemma. Pointcheval and Stern's main idea is as follows: in the Random Oracle Model, the opponent can obtain from the forger two valid forgeries { , s, e} and { , s , e } for the same oracle query {m, r} but with different message digests e = e . Consequently, r = g s y -e = g s y -e and from that it becomes straightforward to compute the discrete logarithm of y = g x . Indeed, the previous equation can be rewritten as y e-e = g s -s , and therefore:

y = g s -s e-e ⇒ Dlog g (y) = s -s e -e
The Forking Lemma for Schnorr signatures is originally stated as follows:

Theorem 4.14 (Forking Lemma, [PS00]) Let A be an attacker which performs within a time bound t F an existential forgery under an adaptively chosen-message attack against the Schnorr signature, with probability F . Assume that A makes q h hashing queries to a random oracle and q s queries to a signing oracle. Then there exists an adversary solving the discrete logarithm problem in subgroups of prime order in polynomial expected time.

Assume that F ≥ 10(q s + 1)(q s + q h )/q, then the discrete logarithm problem in subgroups of prime order can be solved within expected time less that 120686 q h t F / F . This security reduction loses a factor O(q h ) in the time-to-success ratio. Note that recent work by Seurin [START_REF] Seurin | On the Exact Security of Schnorr-Type Signatures in the Random Oracle Model[END_REF] shows that this is essentially the best possible reduction to the discrete logarithm problem.

Concurrent Signatures

Let us give a more formal account of legal fairness as described in [START_REF] Chen | Concurrent Signatures[END_REF][START_REF] Andrew | Legally-Enforceable Fairness in Secure Two-Party Computation[END_REF] in terms of concurrent signatures. Unlike classical contract-signing protocol, whereby contractors would exchange full-fledged signatures (e.g. [START_REF] Goldreich | A Simple Protocol for Signing Contracts[END_REF]), in a concurrent signature protocol there are "ambiguous" signatures that do not, as such, bind their author. This ambiguity can later be lifted by revealing some additional information: the "keystone". When the keystone is made public, both signatures become simultaneously binding.

Let M be a message space. Let K be the keystone space and F be the keystone fix space.

Definition 4.16 (Concurrent signature)

A concurrent signature is composed of the following algorithms:

• Setup(k): Takes a security parameter k as input and outputs the public keys (y A , y B ) of all participants, a function KeyGen : K → F, and public parameters pp describing the choices of M, K, F and KeyGen.

• aSign(y i , y j , x i , h 2 , M ): Takes as input the public keys y 1 and y 2 , the private key x i corresponding to y i , an element h 2 ∈ F and some message M ∈ M; and outputs an "ambiguous signature"

σ = s, h 1 , h 2
where s ∈ S, h 1 , h 2 ∈ F.

• aVerify(σ, y i , y j , M ): Takes as input an ambiguous signature σ = s, h 1 , h 2 , public keys y i and y j , a message M ; and outputs a Boolean value, with the constraint that aVerify (σ , y j , y i , M ) = aVerify (σ, y i , y j , M ) where σ = s, h 2 , h 1 .

• Verify(k, σ, y i , y j , M ): Takes as input k ∈ K and σ, y i , y j , M as above; and checks whether KeyGen(k) = h 2 : If not it terminates with output False, otherwise it outputs the result of aVerify(σ, y i , y j , M ).

A valid concurrent signature is a tuple k, σ, y i , y j , M that is accepted by the Verify algorithm. Concurrent signatures are used by two parties A and B in the following way:

1. A and B run Setup to determine the public parameters of the scheme. We assume that A's public and private keys are y A and x A , and B's public and private keys are y B and x B .

2. Without loss of generality, we assume that A initiates the conversation. A picks a random keystone k ∈ K, and computes f = KeyGen (k). A takes her own public key y A and B's public key y B and picks a message M A ∈ M to sign. A then computes her ambiguous signature to be

σ A = s A , h A , f = aSign(y A , y B , x A , f, M A ).
3. Upon receiving A's ambiguous signature σ A , B verifies the signature by checking that

aVerify(s A , h A , f, y A , y B , M A ) = True
If this equality does not hold, then B aborts. Otherwise B picks a message M B ∈ M to sign and computes his ambiguous signature

σ B = s B , h B , f = aSign(y B , y A , x B , f, M B )
then sends this back to A. Note that B uses the same value f in his signature as A did to produce σ A .

4. Upon receiving B's signature σ B , A verifies that

aVerify(s B , h B , f, y B , y A , M B ) = True
where f is the same keystone fix as A used in the previous steps. If the equality does not hold, then A aborts. Otherwise A sends keystone k to B.

At the end of this protocol, both k, σ A and k, σ B are binding, and accepted by the Verify algorithm.

Remark.

Note that A has an the upper hand in this protocol: Only when A releases the keystone do both signatures become simultaneously binding, and there is no guarantee that A will ever do so. Actually, since A controls the timing of the keystone release (if it is released at all), A may only reveal k to a third party C but withhold it from B, and gain some advantage by doing so. In other terms, concurrent signatures can be abused by A [BW00; GJM99]. Chen et al. [START_REF] Chen | Concurrent Signatures[END_REF] argue that there are situations where it is not in A's interest to try and cheat B, in which abuse-freeness is not necessary. One interesting scenario is credit card payment in the "four corner" model. Assume that B's signature is a payment to A. To obtain payment, A must channel via her acquiring bank C, which would communicate with B's issuing bank D. D would ensure that B receives both the signature and the keystone -as soon as this happens A is bound to her signature. Since in this scenario there is no possibility for A to keep B's signature private, fairness is eventually restored.

Example 4.1 A concurrent signature scheme based on the ring signature algorithm of Abe et al. [AOS02] was proposed by Chen et al. [CKP04]:

• Setup: On input a security parameter , two large primes p and q are selected such that q|p -1. An element g ∈ Z × p of order q is selected. The spaces S = F = Z q and M = K = {0, 1} * are chosen. Two cryptographic hash functions H 1 , H 2 : {0, 1} * → Z q are selected and we set KeyGen = H 1 . Private keys x A , x B are selected uniformly at random from Z q and the corresponding public keys are computed as g xi mod p.

• aSign: The algorithms takes as input y i , y j , x i , h 2 , M , verifies that y i = y j (otherwise aborts), picks a random value t ∈ Z q and computes

h = H 2 g t y h2 j mod p M h 1 = h -h 2 mod q s = t -h 1 x i mod q
where denotes concatenation. The algorithm outputs s, h 1 , h 2 .

• aVerify: This algorithm takes as input s, h 1 , h 2 , y i , y j , M and checks whether the following equation holds:

h 1 + h 2 = H 2 g s y h1 i y h2 j mod p M mod q
The security of this scheme can be proven in the Random Oracle model assuming the hardness of computing discrete logarithms in Z × p .

Legal fairness for concurrent signatures

A concurrent signature scheme is secure when it achieves existential unforgeability, ambiguity and fairness against an active adversary that has access to a signature oracle. We define these notions in terms of games played between the adversary A and a challenger C. In all security games, A can perform any number of the following queries:

• KeyGen queries: A can receive a keystone fix f = KeyGen (k) where k is chosen by the challenger 4 .

• KeyReveal queries: A can request that C reveals which k was chosen to produce a keystone fix f in a previous KeyGen query. If f was not a previous KeyGen query output then C returns ⊥.

• aSign queries: A can request an ambiguous signature for any message of his choosing and any pair of users5 .

• SKExtract queries: A can request the private key corresponding to a public key.

Definition 4.17 (Unforgeability)

The notion of existential unforgeability for concurrent signatures is defined in terms of the following security game:

1. The Setup algorithm is run and all public parameters are given to A.

2.

A can perform any number of queries to C, as described above.

3. Finally, A outputs a tuple σ = s, h 1 , f where s ∈ S, h 1 , f ∈ F, along with public keys y C , y D and a message M ∈ M.

A wins the game if aVerify accepts σ and either of the following holds:

• A did not query SKExtract on y C nor on y D , and did not query aSign on (y C , y D , f, M ) nor on (y D , y C , h 1 , M ).

• A did not query aSign on (y C , y i , f, M ) for any y i = y C , and did not query SKExtract on y C , and f is the output of KeyGen: either an answer to a KeyGen query, or A can produce a k such that k = KeyGen(k).

The last constraint in the unforgeability security game corresponds to the situation where A knows one of the private keys (as is the case if A = A or B).

Definition 4.18 (Ambiguity)

The notion of ambiguity for concurrent signatures is defined in terms of the following security game:

1. The Setup algorithm is run and all public parameters are given to A.

Phase 1:

A can perform any number of queries to C, as described above.

Challenge:

A selects a challenge tuple (y i , y j , M ) where y i , y j are public keys and M ∈ M. In response,

C selects a random k ∈ K, a random b ∈ {0, 1} and computes f = KeyGen(k). If b = 0, then C outputs σ 1 = s 1 , h 1 , f = aSign(y i , y j , x i , f, M ) Otherwise, if b = 1 then C computes σ 2 = s 2 , h 2 , f = aSign(y j , y i , x i , f, M ) but outputs σ 2 = s 2 , f, h 2 instead.

Phase 2:

A can perform any number of queries to C, as described above.

Finally, A outputs a guess bit b ∈ {0, 1}.

A wins the game if b = b and if A made no KeyReveal query on f , h 1 or h 2 .

Definition 4.19 (Fairness)

The notion of fairness for concurrent signatures is defined in terms of the following security game:

1. The Setup algorithm is run and all public parameters are given to A.

2.

A can perform any number of queries to C, as described above.

3. Finally, A chooses two public keys y C , y D and outputs k ∈ K and S = (s,

h 1 , f, y C , y D , M ) where s ∈ S, h 1 , f ∈ F, M ∈ M.
A wins the game if aVerify(S) accepts and either of the following holds:

• f was output from a KeyGen query, no KeyReveal query was made on f , and Verify accepts k, S .

• A can output S = (s , h 1 , f, y D , y C , M ) where aVerify(S ) accepts and Verify(k, S) accepts, but Verify(k, S ) rejects.

This definition of fairness formalizes the idea that B cannot be left in a position where a keystone binds his signature to him while A's initial signature is not also bound to A. It does not, however, guarantee that B will ever receive the necessary keystone.

Legally fair co-signatures 4.2.3.1 Legal fairness without keystones

The main idea builds on the following observation: Every signature exchange protocol is plagued by the possibility that the last step of the protocol is not performed. Indeed, it is in the interest of a malicious party to get the other party's signature without revealing its own. As a result, the best one can hope for is that a trusted third party can eventually restore fairness.

To avoid this destiny, the proposed paradigm does not proceed by sending A's signature to B and vice versa. Instead, we construct a joint signature, or co-signature, of both A and B. By design, there are no signatures to steal -and stopping the protocol early does not give the stopper a decisive advantage. More precisely, the contract they have agreed upon is the best thing an attacker can gather, and if she ever wishes to enforce this contract by presenting it to a court of law, she would confirm her own commitment to it as well as the other party's. Therefore, if one can construct co-signatures without intermediary individual signatures being sent, legal fairness can be achieved without keystones.

Since keystones can be used by the party having them to abuse the other [START_REF] Chen | Concurrent Signatures[END_REF], the co-signature paradigm provides an interesting alternative to concurrent signatures.

Schnorr Co-signatures. To illustrate the new paradigm, we now discuss a legally fair contract-signing protocol built from the well-known Schnorr signature protocol, that produces signatures compatible with standard Schnorr signatures. This contract signing protocol is provably secure in the random oracle model under the hardness assumption of solving the discrete logarithm problem.

The construction can be adapted to other DLP schemes, such as most6 of those enumerated in [START_REF] Horster | Meta-El-Gamal Signature Schemes[END_REF], including Girault-Poupard-Stern [START_REF] Girault | On the Fly Authentication and Signature Schemes Based on Groups of Unknown Order[END_REF] and ElGamal [START_REF] Elgamal | A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms[END_REF].

• Setup: An independent (not necessarily trusted) authority generates a classical Schnorr parameter-set p, q, g which is given to A and B. Each user U generates a usual Schnorr public key y U = g x U and publishes y U on a public directory D (see -During the second phase of the protocol, B sends s

B ← k B -e × x B mod q to A. A replies with s A ← k A -e × x A mod q. Both users compute s ← s A + s B mod q.
• Verify: As in the classical Schnorr signature, the co-signature {r, s} is checked for a message m by computing e ← H(m r), and checking whether g s y e = r (

yA,B ← yA × yB yA,B ← yA × yB kA $ ← -Z * q kB $ ← -Z * q rA ← g k A rB ← g k B ρ ← H(0 rB) ρ ← ----------- r A -----------→ r B ← ----------- if H(0 rB) = ρ abort r ← rA × rB r ← rA × rB e ← H(1 m r) e ← H(1 m r) sA ← kA -exA mod q sB ← kB -exB mod q s B ← ----------- s A -----------→ s ← sA + sB mod q s ← sA + sB mod q
Remark. Note that during the co-signature protocol, A might decide not to respond to B: In that case, A would be the only one to have the complete co-signature. This is a breach of fairness insofar as A can benefit from the co-signature and not B, but the protocol is abuse-free: A cannot use the co-signature as a proof that B, and B alone, committed to m. Furthermore, it is not a breach of legal fairness: If A presents the co-signature in a court of law, she ipso facto reveals her commitment as well.

Remark. In a general fair-contract signing protocol, A and B can sign different messages m A and m B .

Using the co-signature construction requires that A and B agree first on the content of a single message m.

Security analysis

The security of the co-signature scheme essentially builds on the unforgeability of classical Schnorr signatures. Since there is only one co-signature output, the notion of ambiguity does not apply per se -albeit we will come back to that point later on. The notion of fairness is structural in the fact that a co-signature, as soon as it is binding, is binding for both parties.

As for concurrent signatures, an adversary A has access to an unlimited amount of conversations and valid co-signatures, i.e. A can perform the following queries:

• Hash queries: A can request the value of H(x) for a x of its choosing.

• CoSign queries: A can request a valid co-signature r, s for a message m and a public key y C,D of its choosing.

• Transcript queries: A can request a valid transcript (ρ, r C , r D , s C , s D ) of the co-signing protocol for a message m of its choosing, between users C and D of its choosing.

• SKExtract queries: A can request the private key corresponding to a public key.

• Directory queries: A can request the public key of any user U .

The following definition captures the notion of unforgeability in the co-signing context:

Definition 4.20 (Unforgeability) The notion of unforgeability for co-signatures is defined in terms of the following security game between the adversary A and a challenger C:

1. The Setup algorithm is run and all public parameters are provided to A.

2.

A can perform any number of queries to C, as described above. We shall say that a co-signature scheme is unforgeable when the success probability of A in this game is negligible.

Finally,

To prove that the Schnorr-based scheme described above is secure we use the following strategy: Assuming an efficient forger A for the co-signature scheme, we turn it into an efficient forger B for Schnorr signatures, then invoke the Forking Lemma to prove the existence of an efficient solver C for the discrete logarithm problem. All proofs hold in the Random Oracle model. Since the co-signing protocol gives the upper hand to the last-but-one speaker there is an asymmetry: Alice has more information than Bob. Therefore we address two scenarios: When the attacker plays Alice's role, and when the attacker plays Bob's. Proof: The proof consists in constructing a simulator S Bob that interacts with the adversary and forces it to actually produce a classical Schnorr forgery. Here is how this simulator behaves at each step of the protocol.

Key Establishment Phase:

S Bob is given a target DLP instance {y, g, p, q}. As a simulator, S Bob emulates not only Bob, but also all oracles and the directory D (see Figure 4.9). S Bob injects the target y into the game, namely by posting in the directory the "public-key" y B ← y × y -1 A .

A Alice S Bob g, p, q, y g, p, q activate 1 y B = y/y A 2 s s S Alice A Bob g, p, q g, p, q, y activate 1 y A = y/y B 2 s s
To inject a target DLP instance y ← g x into A, the simulator S Bob reads y A from the public directory and poses as an entity whose public-key is y S ← y × y -1 A . It follows that y A,S , the common public-key of A and S will be precisely y A,S ← y S × y A which, by construction, is exactly y.

Then S Bob activates A Alice , who queries the directory and gets y B . At this point in time, A Alice is tricked into believing that she has successfully established a common co-signature public-key set {g, p, q, y} with the "co-signer" S Bob .

Query Phase:

A Alice will now start to present queries to S Bob . In a "normal" attack, A Alice and Bob would communicate with a random oracle O representing the hash function H. However, here, the simulator S Bob will play O's role and answer A Alice 's hashing queries.

S Bob must respond to three types of queries: hashing queries, co-signature queries and transcript queries. S Bob will maintain an oracle table T containing all the hashing queries performed throughout the attack. At start T ← ∅. When A Alice submits a hashing query q i to S Bob , S Bob answers as shown in Algorithm 6.

Algorithm 6: Hashing Oracle Simulation

Input: A hashing query qi from A. Output: An oracle response ρ.

1. if ∃ei, {qi, ei} ∈ T 2. ρ ← ei 3. else 4. ρ $ ← -Z * q 5.
append {qi, ρ} to T

return ρ

When A Alice submits a co-signature query to S Bob , S Bob proceeds as explained in Algorithm 7.

Algorithm 7: Co-signing Oracle Simulation

Input: A co-signature query m from A Alice . Output: sB. a) sB, e $ ← -Z * q b) rB ← g s B y e c) send H(0 rB) to A Alice d) receive rA from A Alice e) r ← rA × rB f) u ← 1 m r g) if ∃e = e, {u, e } ∈ T h) abort i) else j) append {u, e} to T k) return sB
Finally, when A Alice requests a conversation transcript, S Bob replies by sending the tuple {m, ρ, r A , r B , s B , s A } from a previously successful interaction.

Output Phase:

After performing queries, A Alice eventually outputs a co-signature m, r, s valid for y A,S where r = r A r B and s = s A + s B . By design, these parameters are those of a classical Schnorr signature and therefore A Alice has produced a classical Schnorr forgery.

To understand S Bob 's co-signature reply (Algorithm 7), assume that A Alice is an honest Alice who plays by the protocol's rules. For such an Alice, {s, r} is a valid signature with respect to the common co-signature public-key set {g, p, q, y}. There is a case in which S Bob aborts the protocol before completion: this happens when it turns out that r A × r B has been previously queried by A Alice . In that case, it is no longer possible for S Bob to reprogram the oracle, which is why S Bob must abort. Since A Alice does not know the random value of r B , such a bad event would only occur with a negligible probability exactly equal to q h /q (where q h is the number of queries to the hashing oracle). Therefore, A Alice is turned into a forger for the target Schnorr instance with probability 1q h /q. Since A Alice succeeds with probability F , A Alice 's existence implies the existence of a Schnorr signature forger of probability S = (1q h /q) F , which by the Forking Lemma shows that there exists a polynomial adversary breaking the chosen DLP instance with high probability.

Being an attacker, at some point A Alice will output a forgery {m , r , s }. From here on we use the Forking Lemma and transform A Alice into a DLP solver as described by Pointcheval and Stern in [PS00, Theorem 14].

Adversary attacks Alice.

The case where A targets A is similar but somewhat simpler, and the proof follows the same strategy. Theorem 4.17 Let {y, g, p, q} be a DLP instance. If A Bob plays the role of Bob and is able to forge a cosignature with probability F , then in the Random Oracle model A Bob can break that DLP instance with high probability in polynomial time.

Proof: [Theorem 4.17] Here also the proof consists in constructing a simulator, S Alice , that interacts with the adversary and forces it to actually produce a classical Schnorr forgery. The simulator's behavior at different stages of the security game is as follows:

1. The Key Establishment Phase: S Alice is given a target DLP instance {y, g, p, q}. Again, S Alice impersonates not only Alice, but also O and D. S Alice injects the target y into the game as described in Section 4.2.3.1. Now S Alice activates A Bob , who queries D (actually controlled by S Alice ) to get y B . A Bob is thus tricked into believing that it has successfully established a common co-signature public-key set {g, p, q, y} with the "co-signer" S Alice .

The Query Phase:

A Bob will now start to present queries to S Alice . Here as well, S Alice will play O's role and will answer A Bob 's hashing queries.

Again, S Alice must respond to hashing queries and co-signature queries. Hashing queries are answered as shown in Algorithm 6. When A Bob submits a co-signature query to S Alice , S Alice proceeds as explained in Algorithm 8.

S Alice controls the oracle O, and as such knows what is the value of r B that A Bob is committed to. The simulator is designed to trick A Bob into believing that this is a real interaction with Alice, but Alice's private key is not used.

Output:

Eventually, A Bob produces a forgery that is a classical Schnorr forgery {m, r, s}.

Algorithm 8 may fail with probability 1/q. Using the Forking Lemma again, we transform A Bob into an efficient solver of the chosen DLP instance.

Concurrent co-signatures

Proofs of involvement. We now address a subtle weakness in the protocol described in the previous section, which is not captured by the fairness property per se and that we refer to as the existence of "proofs of involvement". Such proofs are not valid co-signatures, and would not normally be accepted by verifiers, but they nevertheless are valid evidence establishing that one party committed to a message. In a legally fair context, it may happen that such evidence is enough for one party to win a trial against the otherwho lacks both the co-signature, and a proof of involvement.

Example 4.2

In the co-signature protocol of Protocol 6, s B is not a valid Schnorr signature for Bob. Indeed, we have g s B y e B = r B = r. However, Alice can construct s = s Bk A , so that m, r, s forms a valid classical signature of Bob alone on m.

Example 4.2 illustrates the possibility that an adversary, while unable to forge a co-signature, may instead use the information to build a valid (mono-) signature. Note that Alice may opt for a weaker proof of involvement, for instance by demonstrating her possession of a valid signature using any zero-knowledge protocol.

A straightforward patch is to refrain from using the public keys y A , y B for both signature and cosignature -so that attempts at constructing proofs of involvement become vain. For instance, every user could have a key y

(1) U used for classical signature and for certifying a key y

U used for co-signature 7 . If an adversary generates a classical signature from a co-signature transcript as in Example 4.2, she actually reveals her harmful intentions.

However, while this exposes the forgery -so that honest verifiers would reject such a signature -the perpetrator remains anonymous. There are scenarios in which this is not desirable, e.g. because it still proves that B agreed (with some unknown and dishonest partner) on m.

Note that the existence of proof of involvement is not necessary and depends on the precise choice of underlying signature scheme.

Security model

It is important to make extremely clear the security model that we are targeting. In this situation an adversary A (possibly Alice or Bob) tries to forged signatures from partial and/or complete traces of co-signature interactions, which can be of two kinds :

1. Co-signatures between two parties, at least one of which did not take part in the co-signature protocol; 7 The key y

U may be derived from y

(1) U in some way, so that the storage needs of D are the same as for classical Schnorr.

(Traditional) signatures of either party.

A succeeds if and only if one of these forgeries is accepted, which can be captured as the probability of acceptance of A's outputs, and the victim (purported mono-signatory, or co-signatory) doesn't have a co-signature with A8 .

Observe that due to the unforgeability of Schnorr signatures, the attacker must necessarily impersonate one of the co-signatories to achieve either of the two forgeries mentioned above (in fact, the strongest position is that of Alice, who has an edge over Bob in the protocol). This is the reason why the victim may have a co-signature of A, so that this security model captures fairness.

In short, we propose to address such attacks in the following way:

1. By using a different key for co-signature and mono-signature;

2. By having Bob store specific co-signature-related information in non-volatile memory.

The reason for (1) is that it distinguishes between mono-signatures, and mono-signatures generated from partial co-signature traces. Thanks to this, it is easy for the verifier to detect a forgery, and perform additional steps.

The reason for ( 2) is twofold: On the one hand, it enables the verifier to obtain from Bob definitive proof that there was forgery; on the other hand, once the forgery has been identified, it makes it possible for the verifier to re-establish fairness binding the two real co-signatories together. Note that Bob is in charge of keeping this information secure, i.e. available and correct.

Concurrent co-signatures

In the interest of fairness, the best we can ask is that if A tries to incriminate B on a message they both agreed upon, she cannot do so anonymously.

To enforce fairness on the co-signature protocol, we ask that the equivalent of a keystone is transmitted first; so that in case of dispute, the aggrieved party has a legal recourse. First we define the notion of an authorized signatory credential:

Γ Alice,Bob = {Alice, Bob, k A , σ(g k A Alice Bob)}
is called an authorized signatory credential given by Alice to Bob, where σ is some publicly known auxiliary signature algorithm using Alice's private key x A as a signing key.

Any party who gets Γ Alice,Bob can check its validity, and releasing Γ Alice,Bob is by convention functionally equivalent to Alice giving her private key x A to Bob. A valid signature by Bob on a message m exhibited with a valid Γ Alice,Bob is legally defined as encompassing the meaning ( ) of Alice's signature on m:

{Γ Alice,
yA,B ← yA × yB yA,B ← yA × yB kA $ ← -Z * q kB $ ← -Z * q rA ← g k A rB ← g k B ρ ← H(0 rB) ρ ← ----------- t ← σ(rA Alice Bob) r A ,t -----------→ if t is incorrect then abort store t in L r B ← ----------- if H(0 rB) = ρ then abort r ← rA × rB r ← rA × rB e ← H(1 m r) e ← H(1 m r) sA ← kA -exA mod q sB ← kB -exB mod q store sB in L breakpoint x s B ← ----------- if sB is incorrect then abort breakpoint y s A -----------→ if sA is incorrect then abort breakpoint z s ← sA + sB mod q s ← sA + sB mod q if {m, r, s} is valid then erase t, sB from L
The modified signature protocol is described in Protocol 7. Alice has only one window of opportunity to try and construct a fraudulent signature of Bob: by stopping the protocol at breakpoint y and using the information s B9 . Indeed, if the protocol is interrupted before breakpoint x, then no information involving m was released by any of the parties: The protocol's trace can be simulated without Bob's help as follows

s B , r $ ← -Z q e ← H(1 m r Alice Bob) r B ← g s B y e B r A ← r × r -1 B t ← σ(r A Alice Bob) ρ ← H(0 r B )
and Bob has only received from Alice the signature of a random integer.

If Alice and Bob successfully passed the normal completion breakpoint z, both parties have the cosignature, and are provably committed to m.

"Willingness-to-sign" attacks

David Pointcheval10 pointed out a subtle attack that exceeds our model. In the scenario considered by Pointcheval Bob is willing to sign m. An attacker wanting to check this fact eavesdrops a legitimate co-signature session with Alice and replays r A , t. Bob will proceed and pass breakpoint x thereby revealing to the attacker his intent to co-sign m with Alice. A possible way to avoid this attack consists in having Bob send an auxiliary random challenge z along with ρ. The definition of t will then be modified to include z (i.e. t = σ(r A |z|Alice|Bob)). This will prevent the recycling (replay) of past protocol sessions. We conjecture that this countermeasure suffices to thwart these willingness to sign attacks although we did not prove that.

Conclusion and further work

In this section we described an alternative construction paradigm for legally fair contract signing that doesn't require keystones, but can be combined with them to provide additional power. The new paradigm produces co-signatures that bind a pair of users, and can be adapted to a number of DLP signature protocols. In the co-signature version of Schnorr's protocol, the resulting co-signatures have the same format as classical (single-user) signature. This paradigm guarantees fairness and abuse-freeness, and can be equipped with keystones to add functionalities such as whistle-blower traceability.

Reusing nonces in Schnorr signatures

Abstract

The provably secure Schnorr signature scheme is popular and efficient. However, each signature requires a fresh modular exponentiation, which is typically a costly operation. As the increased uptake in connected devices revives the interest in resource-constrained signature algorithms, we introduce a variant of Schnorr signatures that mutualises exponentiation efforts.

Combined with precomputation techniques (which would not yield as interesting results for the original Schnorr algorithm), we can amortise the cost of exponentiation over several signatures: these signatures share the same nonce. Sharing a nonce is a deadly blow to Schnorr signatures, but is not a security concern for our variant, dubbed ReSchnorr.

ReSchnorr is provably secure, asymptotically-faster than Schnorr when combined to efficient precomputation techniques, and experimentally 2 to 6 times faster than Schnorr for the same number of signatures when using 1 MB of static storage.

Introduction

The increased popularity of lightweight implementations invigorates the interest in resource-preserving protocols. Interestingly, this line of research was popular in the late 1980's, when smart-cards started performing public-key cryptographic operations (e.g. [START_REF] Fiat | How to Prove Yourself: Practical Solutions to Identification and Signature Problems[END_REF]). Back then, cryptoprocessors were expensive and cumbersome, and the research community started looking for astute ways to identify and sign with scarce resources.

In this work we revisit a popular signature algorithm published by Schnorr in 1989 [START_REF] Schnorr | Efficient Identification and Signatures for Smart Cards[END_REF] and seek to lower its computational requirements assuming that the signer is permitted to maintain some read-only memory. This storage allows for time-memory trade-offs, which are usually not very profitable for typical Schnorr parameters.

We introduce a new signature scheme, ReSchnorr, which is provably secure in the random oracle model (ROM) under the assumption that the partial discrete logarithm problem (see below) is intractable. This scheme can benefit much more from precomputation techniques, which results in faster signatures.

Implementation results confirm the benefits of this approach when combining efficient precomputation techniques, when enough static memory is available (of the order of 250 couples of the form (x, g x )). We provide comparisons with Schnorr for several parameters and pre-computation schemes.

Intuition and general outline of the idea

Schnorr's signature algorithm uses a large prime modulus p and a smaller prime modulus q dividing p -1. The security of the signature scheme relies on the discrete logarithm problem in a subgroup of order q of the multiplicative group of the finite field Z p (with q | p -1). Usually the prime p is chosen to be large enough to resist index-calculus methods for solving the discrete-log problem (e.g. 3072 bits for a 128-bit security level), while q is large enough to resist the square-root algorithms [START_REF] Shanks | Class number, a theory of factorization, and genera[END_REF] (e.g. 256 bits for 128-bit security level).

The intuition behind our construction is to consider a prime p such that p -1 has several different factors q i large enough to resist these birthday attacks, i.e. p = 1 + 2 i=1 q i then several "orthogonal" Schnorr signatures can share the same commitment component r = g k mod p. This is not the case with standard Schnorr signatures where, if a k is reused then the secret signing key is revealed.

It remains to find how r can be computed quickly. In the original Schnorr protocol k is picked uniformly at random in Z q . However, to be secure, our construction requires that k is picked in the larger set Z p-1 . which means that a much higher effort is required to compute r. Here we cut corners by generating an r with pre-computation techniques which allow an exponentiation to be sub-linear. The trick is that once the exponentiation is sub-linear, we are more effective in our setting than in the original Schnorr setting.

We start by reminding how the original Schnorr signature scheme works and explain how we extend it assuming that k is randomly drawn from Z p-1 . We then present applications of our construction, by comparing several pre-processing schemes.

Preliminaries

We denote the security parameter by κ ∈ N which is given to all algorithms in the unary form 1 κ . Algorithms are randomized unless otherwise stated, and PPT stands for "probabilistic polynomial-time," in the security parameter. We denote random sampling from a finite set X according to the uniform distribution with x $ ← -X. We also use the symbol $ ←for assignments from randomized algorithms, while we denote assignment from deterministic algorithms and calculations with the symbol ←. If n is an integer, we write Z n for the ring Z/nZ. We let Z * n the invertible elements of Z n . As is usual, f ∈ negl(κ) denotes a function that decreases faster than the inverse of any polynomial in κ; such functions are called negligible. The set of numbers 1, 2, . . . , k is denoted [k]. Most of our security definitions and proofs use code-based games. A game G consists of an initializing procedure Init, one or more procedures to respond to oracle queries, and a finalizing procedure Fin.

Schnorr's signature scheme

Schnorr signatures [START_REF] Schnorr | Efficient Identification and Signatures for Smart Cards[END_REF] are an offspring ElGamal signatures [START_REF] Elgamal | On Computing Logarithms Over Finite Fields[END_REF] which are provably secure in the Random Oracle Model under the assumed hardness of solving generic instances of the Discrete Logarithm Problem (DLP) [START_REF] Pointcheval | Security Proofs for Signature Schemes[END_REF]. The Schnorr signature scheme is a tuple of algorithms defined as follows:

• Setup(1 κ ): Large primes p, q are chosen, such that q ≥ 2 κ and p -1 = 0 mod q. A cyclic group G ⊂ Z p of prime order q is chosen, in which it is assumed that the DLP is hard, along with a generator

g ∈ G. A hash function H : {0, 1} * → G is chosen. Public parameters are pp = (p, q, g, G, H).
• KeyGen(pp): Pick an integer x uniformly at random from [2, q -1] as the signing key sk, and publish y ← g x as the public key pk.

• Sign(pp, sk, m): Pick k uniformly at random in Z * q , compute r ← g k mod q, e ← H(m, r), and s ← kex mod q. Output σ ← {r, s} as a signature.

• Verify(pp, pk, m, σ): Let (r, s) ← σ, compute e ← H(m, r) and return True if g s y e = r, and False otherwise.

Security model

We recall the strong 11 EF-CMA security notion: Definition 4.22 (Strong EF-CMA Security) A signature scheme Σ is secure against existential forgeries in a chosen-message attack (strongly EF-CMA-secure) if the advantage of any PPT adversary A against the EF-CMA game defined in Figure 4.11 is negligible:

Adv EF A,Σ (κ) = Pr EF A Σ (κ) = 1 ∈ negl(κ).

ReSchnorr signatures: using multiple q's

Our construction relies on using a prime p of the form mentioned in the introduction. This is not a trivial change, and requires care as we discuss below. Technically, our construction is a stateful signature scheme (see e.g. [KL07, Chapter 12]), in which we simultaneously sign only one message and keep a state corresponding to the values k, g k and the index i for the current prime number. However, it is more compact and convenient to describe it as a signature for simultaneous messages.

EF A Σ (κ): L ← ∅ (sk, pk) $ ← -Σ.KeyGen(1 κ ) (m * , σ * ) ← A Sign(•),Verify(•,•),H(•) (1 κ ) if (m * , σ * ) ∈ L return Σ.Verify(pk, m * ) return 0 Sign(m): σ $ ← -Σ.Sign(sk, m) L ← L ∪ {m, σ} return σ Verify(m, σ): return Σ.Verify(pk, m, σ)

ReSchnorr signature scheme

Similar to the Schnorr signature scheme, Reschnorr is a tuple of algorithms (Setup, KeyGen, Sign, and Verify), which we define as follows:

• Setup(1 κ ): Generate primes q 1 , . . . , q of size ≥ 2 κ and groups G 1 , . . . , G respectively of order q 1 , . . . q such that the DLP is hard in the respective G i , and such that p = 1 + 2 q i is prime. This is easily achieved by selecting ( -1) primes q i and varying the last one until p is prime. 12 Choose a cryptographic hash function H : {0, 1} * → {0, 1} q1 . The hash function will be used to produce elements of Z qi . For this we will denote by H i the composition of H and a conversion function from {0, 1} q1 to Z qi 13 Finally, choose g a generator of the group Z * p of order p -1. The public parameters are therefore pp = p, {q i } i=1 , H, g, {G i } i=1 .

• KeyGen(pp): The signer chooses x $ ← -Z * p-1 and computes y ← g x mod p. The key sk = x is kept private to the signer, while the verification key pk = y is made public.

• Sign(pp, sk, m 1 , . . . , m ): The signer chooses k $ ← -Z p , such that k = 0 mod q i for all i, and computes r ← g k mod p. The signer can now sign the messages m i as:

ρ i $ ← -{0, 1} κ , e i ← H i (m i ,
r, ρ i ), and s i ← ke i x mod q i outputting the signatures σ i = {r, s i , ρ i }-or, in a more compact form, σ = {r, s 1 , . . . , s , ρ 1 , . . . , ρ }.

• Verify(pp, pk, m i , (r, s i , ρ i ), i) : Verifying a signature is achieved by slightly modifying the original Schnorr scheme: First check that s i ∈ {0, . . . q i -1} and compute e i ← H i (m i , r, ρ i ), then observe that for a correct signature 14 :

(g si y ei ) p-1 q i = r p-1 q i mod p.
The signature is valid if and only if this equality holds, otherwise the signature is invalid (see Lemma 4.18).

Remark. Note that unlike Schnorr, in the Sign algorithm we add a random ρ i for a signature to make the argument of the hash function unpredictable. This will be useful for the proof of Theorem 4.19 in the ROM.

12 See Section 4.3.8 for a discussion on some particularly interesting moduli. 13 This conversion function can read the string as a binary number and reduce it modq i for example. 14 One can note, p-1

q i = 2q 1 • • • q i-1 q i+1 • • • q .
Remark. Note also that one almost recovers the original Schnorr construction for = 1-the only differences being in the verification formula, where both sides are squared in our version, and the addition of a fresh random to hash.

Lemma 4.18 (Correctness)

The ReSchnorr signature scheme is correct.

Proof: Let g, y, r, s i , and ρ i be as generated by the KeyGen and Sign algorithms for a given message m i .

We check that,

(g si y ei ) si r p-1 q i = 1 mod p.
By the definition of s i , there exists λ ∈ Z such that g si = g k-eix+λqi , hence

g si y ei g -k = g λqi mod p.
Raising this to the power of p-1 qi we get g λ(p-1) = 1 since the order the multiplicative group Z * p is p -1.

Security

To aid in the proof of security, we introduce the following problem which we call the partial discrete logarithm problem (PDLP). Intuitively it corresponds to solving a discrete logarithm problem in the subgroup of our choice.

Definition 4.23 (PDLP)

Let ≥ 2 be an integer, q 1 , . . . , q distinct prime numbers and q = q 1 . . . q . Let G be a group of order q and g a generator of G. Given g, q, q 1 , . . . , q l , and y = g x , the partial discrete logarithm problem (PDLP) consists in finding i ∈ [ ] and

x i ∈ Z qi such that x i = x mod q i .
In our context, we are chiefly interested in a subgroup of order q of a multiplicative group of a finite field Z * p , where q divides p -1-ideally, q = (p -1)/2. The best known algorithms to solve the PDLP are index-calculus based methods in Z * p and square-root algorithms in subgroups of prime order q i for some i ∈ [ ]. With p of bit-size 3072, q = (p -1)/2, = 12 and q 1 , . . . , q of bit-size 256, we conjecture that solving the PDLP requires about 2 128 elementary operations. In Section 4.3.4, we provide security argument in the generic group model on the intractability of the PDLP for large enough prime numbers q 1 , . . . , q . Theorem 4.19 (Existential unforgeability) ReSchnorr is provably EF-CMA-secure assuming the hardness of solving the PDLP, in the ROM.

To prove this result, we will exhibit a reduction from an efficient EF-CMA forger to an efficient PDLP solver.

To that end we first show a sequence of indistinguishability results between the output distributions of • Our signature algorithm Sign = Sign 0 on user inputs.

• A modified algorithm Sign 1 (see Figure 4.12), where the hash of user inputs is replaced by a random value. This situation is computationally indistinguishable from the previous one in the ROM.

• A modified algorithm Sign 2 (see Figure 4.12), that has no access to the signing key x. The output distribution of this algorithm is identical to the output of Sign 1 (Theorem 4.20).

Then we use the forking lemma [PS00; BN06] to show that an efficient EF-CMA-adversary against Sign 2 can be used to construct an efficient PDLP solver. Finally we leverage the above series of indistinguishably results to use an adversary against Sign 0 . Let CRT (for Chinese Remainder Theorem) be the isomorphism that maps

Z q1 × • • • × Z q × Z 2 to Z p-1 .

Theorem 4.20

The output distributions of Sign 1 and Sign 2 are identical.

Sign 1 : ρ $ ← -{0, 1} κ k $ ← -Zp \ i=1 {qi, 2qi, . . . , p -1} r ← g k mod p for i = 1 to ei $ ← -Zq i si ← k -eix mod qi ρi $ ← -{0, 1} κ
end for return (r, e1, . . . , e , s1, . . . , s , ρ1 . . . , ρ ) Sign 2 :

for i = 1 to ei $ ← -Zq i si $ ← -Zq i ρi $ ← -{0, 1} κ end for a $ ← -{0, 1} b $ ← -{0, 1} S ← CRT(s1, . . . , s , a) E ← CRT(e1, . . . , e , b) r ← g S y E for i = 1 to check that r = 1 mod qi,
otherwise abort end for return (r, e1, . . . , e , s1, . . . , s , ρ1 . . . , ρ ) Proof: This theorem builds on several intermediate results described in Lemmata 4.21 to 4.25. We denote δ the output distribution of Sign 1 and δ the output distribution of Sign 2 . The structure of the proof is the following :

• In Lemma 4.21 we show that the output of Sign 2 is a subset of the output of Sign 1 .

• Lemma 4.22 shows that in Sign 1 there is a unique random tape per output.

• Lemma 4.23 shows that in Sign 2 there are exactly two random tapes per output.

• Lemma 4.25 shows that there are twice as many random tapes possible for Sign 2 than for Sign 1 This demonstrates that by uniformly choosing the random tape, the resulting distributions for Sign 1 and Sign 2 are identical, which is the uniform distribution on the set of valid signatures.

S = s i mod q i and E = e i mod q i .
So there exists λ, µ ∈ Z such that S = s i + λq i and E = e i + µq i .

Hence:

r p-1 q i = g S y E p-1 q i = g si+λqi y ei+µqi p-1 q i = (g si y ei ) p-1 q i g λ(p-1) y µ(p-1) = (g si y ei ) p-1 q i
The last equality holds since the order of the multiplicative group Z * p is p -1, and this concludes the proof with the fact that r = 1 mod q i . Lemma 4.22 There is exactly one random tape upon which Sign 1 can run to yield each particular tuple of δ.

Proof: [of Lemma 4.22] Let k, e 1 , . . . , e , ρ 1 , . . . , ρ and k , e 1 , . . . , e , ρ 1 , . . . , ρ be random choices of δ that both yield (r, e 1 , . . . , e , s 1 , . . . , s , ρ 1 , . . . , ρ ). It is immediate that e i = e i and ρ i = ρ i for all i ∈ [ ]. Also since g k = g k , g is of order p -1 and since k and k are in [p] then k = k . Lemma 4.23 There are exactly two random tapes over k, ρ 1 , . . . , ρ , e 1 , . . . , e that output each tuple of δ .

Proof: [of Lemma 4.23] Let e 1 , . . . , e , s 1 , . . . , s , a, b, ρ 1 , . . . , ρ and e 1 , . . . , e , s 1 , . . . , s , a , b , ρ 1 , . . . , ρ be random choices that both give (r, e 1 , . . . , e , s 1 , . . . , s , ρ 1 , . . . , ρ ). It is immediate that e i = e i , s i = s i , and ρ i = ρ i for all i ∈ [ ]. Let S, S , E, and E be the corresponding CRT images. We have g S y E = g S y E , which is g S+xE = g S +xE , and S + xE = S + xE mod (p -1). Since x is odd (it is invertible mod p -1), it follows that S + E and S + E have the same parity. Therefore a + b = a + b mod 2 and we have two choices: a = b, or a = 1b, both of which are correct.

Lemma 4.24 # Z p \ i=1 {q i , 2q i , . . . , p -1} = 2 i=1 (q i -1).
Proof: [of Lemma 4.24] The number of invertible elements mod p is i=1 (q i -1) × (2 -1) so the number of invertible mod q i for all i (and not necessarily for 2) is 2 i=1 (q i -1). This is exactly the cardinality of the set

Z p \ i=1 {q i , 2q i , . . . , p -1} , Lemma 4
.25 There are twice as many possible random choices in δ than in δ.

Proof: [of Lemma 4.25] For the number of random choices in δ we use Lemma 4.24 to count the number of k and then count the number of e i and get 2 i=1 (q i -1) × i=1 q i . For δ , having r = 1 mod q i is equivalent to having s i = -e i x. Therefore it has the same number of random choices as a distribution picking the

s i from Z qi \ {e i x} which is i=1 q i × i=1 (q i -1) × 2 × 2.
It follows from the above results that the two distributions are the same, i.e. the uniform distribution over the set of valid signatures. This concludes the proof of Theorem 4.20.

Theorem 4.26 (Security under Chosen Message Attack) An efficient attacker against Sign 2 can be turned into an efficient PDLP solver in the ROM.

Proof: Let A be an attacker that wins the EF-CMA game for ReSchnorr, illustrated in Figure 4.13. We construct in Figures 4.14 • ( ) This occurs with negligible probability since the ρ is a fresh random which is unpredictable by the adversary.

R A R.Hi R.Sign A R.H i R.Sign R.Init R.Fin g x , g, p, q1, . . . , q xi, i
• ( †) This occurs with non overwhelming probability since the adversary is efficient.

• ( ‡) The element is in the list with non negligible probability because if the adversary forges on an unqueried hash in the ROM, it has a negligible chance to succeed.

• ( §) This happens with non overwhelming probability due to the forking lemma [START_REF] Pointcheval | Security Arguments for Digital Signatures and Blind Signatures[END_REF].

If R does not abort, then g s * y e * p-1 q i * = (r * )

p-1 q i * = g s * y ẽ * p-1 q i * mod p. Then s * + e * x = s * + ẽ * mod q i * . It follows that the value returned by R is equal to x mod q i * . R succeeds with non negligible probability, as explained earlier. The probability of forking is polynomial in the number of queries to the random oracle, the number of queries to the signature oracle, and . Note that the reduction is times looser than [START_REF] Pointcheval | Security Arguments for Digital Signatures and Blind Signatures[END_REF]. This concludes the proof of Theorem 4.26.

Proof: [of Theorem 4.19] Using Theorem 4.20, we can use Sign 0 instead of Sign 2 as a target for the attacker in Theorem 4.26.

Generic security of the partial discrete logarithm problem

In this section, we prove that the partial discrete logarithm problem introduced in Section 4.3.3.2 is intractable in the generic group model. This model was introduced by Shoup [START_REF] Shoup | Lower Bounds for Discrete Logarithms and Related Problems[END_REF] for measuring the exact difficulty of solving classical discrete logarithm problems. Algorithms in generic groups do not exploit any properties of the encodings of group elements. They can access group elements only via a random encoding algorithm that encodes group elements as random bit-strings.

Proofs in the generic group model provide heuristic evidence of some problem hardness when an attacker does not take advantage of group elements' encoding. However, they do not necessarily say anything about the difficulty of specific problems in a concrete group. R.Init(y = g x , g, p, q1, . . . , q ) : Let be some non-negative integers, let q 1 , . . . , q be some distinct prime numbers and let q = q 1 • • • q . We consider a cyclic group G of (composite) order q generated by g. We assume without loss of generality that q 1 = max(q 1 , . . . , q ). A classical method [START_REF] Pohlig | An improved algorithm for computing logarithms over GF (p) and its cryptographic significance[END_REF] to solve the partial discrete logarithm problem in G given h = g x ∈ G is to compute h q2•••q , an element of order diving q 1 (that belongs to the subgroup generated by g q2•••q ) and to compute its discrete logarithm x 1 in base g q2•••q using a square root method such as Shanks "baby-step giant-step" algorithm [START_REF] Shanks | Class number, a theory of factorization, and genera[END_REF]. It is easy to see that x 1 is equal to x mod q 1 and is obtained within time complexity O( √ q 1 + log(q 2 • • • q )) group operations.

set L ← ∅ Σ ← ∅ j ← 1 k ← 0 l ← 0 pk ← y pp ← {p, {qi} i=1 , g} return (pk, pp) R.Fin(pk, pp) : (m * , r * , s * , ρ * , i * ) $ ← -A(pp, pk) e * ← R.Hi * (m * , r * mod qi * , ρ * ) a ← L -1 [((m * , r * mod qi * , ρ * ), e * )] ‡ if not Verify pp,pk (m * , r * , s * , i * ) abort † (m * , r * , s * , ρ * , i * ) $ ← -A (pp, pk) if i * = i * then abort § if r * = r * then abort § e * ← R.Hi * (m * , r * mod qi * , ρ * ) if e * = e * then abort § if not Verify pp,pk (m * , r * , s * , i * ) abort † ∆s ← s * -s * ∆e ← e * -e * return (i * , ∆s/∆e) R.Sign (m) : l ← 0 return Σ.[i] l ← l + 1 R.H(x) : if ∃(x , h ) ∈ L s.t. x = x return h else h $ ← -Zp L ← L ∪ {(x, h)} return h R.H (x) : k ← 0 L ← ∅ if ∃(x , h ) ∈ L s.t. x = x return h else if i ≤ a (x , h ) ← L.[i] return h k ← k + 1 L ← L ∪ {(x, h)} else h $ ← -Zp L ← L ∪ {(x, h)} return h R.Sign(m) : if j = 1 (r, e1, . . . , e , s1, . . . , s , ρ1, . . . , ρ ) $ ← -δ if ∃h s.t. ((m, r mod q1, ρ1), h) ∈ L abort L ← L ∪ {((m, r mod q1, ρ1), e1)} j ← j + 1 mod return (s1, r, ρ1, 1) Σ ← Σ ∪ {(s1, r, ρ1, 1)} else if ∃h s.t. ((m, r mod qj, ρj), h) ∈ L abort L ← L ∪ {(m, r mod qj, ρj), ej} j ← j + 1 mod return (sj, r, ρj, j) Σ ← Σ ∪ {(sj, r, ρj, j)}
Our goal is to prove that this time complexity is essentially optimal in the generic group model. Let A be a generic group adversary that solves the partial discrete logarithm problem in G. As usual, the generic group model is implemented by choosing a random encoding σ : G -→ {0, 1} m . Instead of working directly with group elements, A takes as input their image under σ. This way, all A can test is string equality. A is also given access to an oracle computing group multiplication and division: taking σ(g 1 ) and σ(g 2 ) and returning σ(g 1 • g 2 ) and σ(g 1 /g 2 ) respectively. Finally, we can assume that A submits to the oracle only encodings of elements it had previously received. This is because we can choose m large enough so that the probability of choosing a string that is also in the image of σ is negligible.

Theorem 4.27

Let A be a generic algorithm that takes as input two encodings σ(g) and σ(h) (where g is a generator of G and h = g x ∈ G) and makes at most τ group oracle queries, then A's advantage in outputting a partial discrete logarithm (i, x i ) with i ∈ {1, . . . , } and x i = x mod q i is upper-bounded by O(τ 2 /q 1 ).

Proof:

We consider an algorithm B playing the following game with A. Algorithm B picks two bit strings σ 1 , σ 2 uniformly at random in {0, 1} m . Internally, B keeps track of the encoded elements using elements in the ring

Z q1 [X 1 ] × • • • × Z q [X ].
To maintain consistency with the bit strings given to A, B creates a lists L of pairs (F, σ) where F is a polynomial vector in the ring

Z q1 [X 1 ] × • • • × Z q [X
] and σ ∈ {0, 1} m is the encoding of a group element. The polynomial vector F represents the exponent of the encoded element in the group

Z q1 × • • • × Z q . Initially, L is set to {((1, 1, . . . , 1), σ 1 ) , ((X 1 , . . . , X n ), σ 2 )}
Algorithm B starts the game providing A with σ 1 and σ 2 . The simulation of the group operations oracle goes as follows:

Group operation: Given two encodings σ i and σ j in L, B recovers the corresponding vectors F i and F j and computes F i + F j for multiplication (or

F i -F j for division) termwise. If F i + F j (or F i -F j ) is already in L, B returns to A the corresponding bit string; otherwise it returns a uniform element σ R ← -{0, 1} m and stores (F i + F j , σ) (or (F i -F j , σ)) in L.
After A queried the oracles, it outputs a pair (i * , x * i ) ∈ {1 . . . , }×Z q i * as a candidate for the partial discrete logarithm of h in base g. At this point, B chooses uniform random values x 1 , . . . ,

x n ∈ Z q1 × • • • × Z q . The algorithm B sets X i = x i for i ∈ {1, . . . , n}.
If the simulation provided by B is consistent, it reveals nothing about (x 1 , . . . , x ). This means that the probability of A guessing the correct value for (i * , x * i ) ∈ {1, . . . , } × Z q i * is 1/q i * . The only way in which the simulation could be inconsistent is if, after we choose value for x 1 , . . . , x n , two different polynomial vectors in L happen to produce the same value.

It remains to compute the probability of a collision happening due to a unlucky choice of values. In other words, we have to bound the probability that two distinct vectors F i , F j in L evaluate to the same value after the substitution, namely F i (x 1 , . . . , x n ) -F j (x 1 , . . . , x n ) = 0. This reduces to bound the probability of hitting a zero of F i -F j . By the simulation, this happens only if F i -F j is a vector of polynomials where at least one coordinate -say the k-th -is a non-constant polynomial (and thus of degree one) denoted (F i -F j ) (k) .

Recall that the Schwartz-Zippel lemma says that, if F is a degree

d polynomial in Z q k [X k ] and S ⊆ Z q k then Pr[F (x k ) = 0 mod q k ] ≤ d |S|
where x k is chosen uniformly from S. Going back to our case, we obtain by applying the Schwartz-Zippel lemma :

Pr[(F i -F j ) (k) (x k ) = 0 ∈ Z q k ] ≤ 1/q k ≤ 1/q 1 .
Therefore, the probability that the simulation provided by B is inconsistent is upper-bounded by τ (τ -1)/q 1 (by the union bound) and the result follows.

Provably secure pre-computations

Often the bottleneck in implementations centers around modular exponentiation. In this section we briefly outline several proposed pre-computation techniques, as well as presenting in more detail two pre-computation schemes which were used in our implementation to compare timings between classical Schnorr and ReSchnorr.

Brief overview

The problem of computing modular exponentiations is well-known to implementers of both DLP-based and RSA-based cryptosystems. In the specific case that we want to compute g x mod p, the following strategies have been proposed but their security is often heuristic:

• Use signed expansions (only applicable to groups where inversion is efficient);

• Use Frobenius expansions or the GLV/GLS method (only applicable to certain elliptic curves);

• Batch exponentiations together, as suggested by M'Raïhi and Naccache [START_REF] David | Batch Exponentiation: A Fast DLP-Based Signature Generation Strategy[END_REF].

The above approaches work for arbitrary values of x. Alternatively, one may choose a particular value of x with certain properties which make computation faster; however there is a possibility that doing so weakens the DLP:

The E-BPV pre-computation scheme

E-BPV 15 relies on pre-computing and storing a set of pairs (k i , g ki mod p); then a "random" pair (r, g r mod p) is generated by choosing a subset of the k i , setting r to be their sum, and computing the corresponding exponential by multiplying the g ki mod p.

To guarantee an acceptable level of security, and resist lattice reduction attacks, the number n of precomputed pairs must be sufficiently large; and enough pairs must be used to generate a new couple.

(E-)BPV.Preprocessing:

k 1 , . . . , k n $ ← -Z * p L ← ∅ for j ∈ [n] L ← L ∪ {(k j , K j = g kj mod p)} return L E-BPV.GetRandomPair: pick S ⊆ [n] s.t. |S| = k (d i , D i ) $ ← -D r ← 0 R ← 1 for j ∈ S x j $ ← -[h -1] r ← r + k j x j mod φ(p) R ← R • K xj j mod p return(r, R)
Figure 4.16: The E-BPV algorithm for generating random pairs (x, g x mod p). The BPV algorithm is a special case of E-BPV for h = 2.

Nguyen et al. [START_REF] Phong | Distribution of modular sums and the security of the server aided exponentiation[END_REF] showed that using E-BPV instead of standard exponentiation gives an adversary an advantage bounded by

m K n k (h -1) k
with m the number of signature queries by the adversary, (k, n, h) E-BPV parameters, and K the exponent's size. 16We fix conservatively m = 2 128 . For ReSchnorr, at 128-bit security, we have K = P = 3072. As suggested in [START_REF] Phong | Distribution of modular sums and the security of the server aided exponentiation[END_REF] we set n = k, and constrain our memory:

h k ≥ 2 3400
Optimizing 2k + h under this constraint, we find (h, k) = (176, 455). This corresponds to 1087 modular multiplications, i.e., an amortized cost of 90 multiplications per signature, for about 170 kB of storage.

Alternatively, we can satisfy the security constraints by setting n = 2048, h = 100, k = 320, which corresponds to about 770 kB of storage, giving an amortized cost of 62 modular multiplications per signature.

In the implementation (Section 4.3.6), we solve the constrained optimisation problem to find the best coefficients (i.e., the least number of multiplications) for a given memory capacity.

Remark.

To achieve the claimed bounds on modular multiplications, one should not compute R ← K xj j mod p directly; rather, an efficient speedup due to Brickell et al. [BGM + 93] (BGMW) may be used. To illustrate the importance of this remark, we also give timings for a "naive" implementation in Table 4.3.

Halving storage cost

The following idea can halve the amount of storage required for the couples (x, g x ): instead of drawing the values x at random, we draw a master secret s once, and compute x i+1 ← g xi ⊕ s (or, more generally/securely, a PRF with low complexity x i+1 = PRF s (g xi )). Only s, x 0 , and the values g xi need to be stored; instead of all the couples (x i , g xi ). This remark applies to both BPV and E-BPV.

Lim and Lee precomputation scheme

We also consider a variation on Lim and Lee's fast exponentiation algorithm [START_REF] Hoon | More Flexible Exponentiation with Precomputation[END_REF]. Their scheme originally computes g r for r known in advance, but it is easily adapted to the setting where r is constructed on the fly. The speed-up is only linear, however, which ultimately means we cannot expect a sizable advantage over Schnorr. Nevertheless, Lim and Lee's algorithm is less resource-intensive and can be used in situations where no secure E-BPV parameters can be found (e.g., in ultra-low memory settings).

The Lim-Lee scheme (LL) has two parameters, h and v. In the original LL algorithm, the exponent is known in advance, but it is easily modified to generate an exponent on the fly. Intuitively, it consists in splitting the exponent in a "blocks" of size h, and dividing further each block in b sub-blocks of size v. The number of modular multiplications (in the worst case) is a + b -2, and we have to store (2 h -1)v pairs. The algorithms are given in Figure 4.17.

For a given amount of memory M , it is easy to solve the constrained optimization problem, and we find

h opt = 1 ln(2) 1 + W 1 + M e
where W is the Lambert function. For a memory M of 750 kB, this gives h ≈ 8.6. The optimal parameters for integers are h = 9 and v = 4.17

Remark. For LL, Section 4.3.5.2 on halving storage requirements does not apply, as x need not be stored.

A summary of the properties for the pre-computations techniques E-PBV and LL can be found in Table 4.1.

LimLee.Preprocessing(h, v):

g0 ← g L = ∅ for i = 0 to h -1 gi ← g 2 a i-1 for i = 0 to 2 h -1 let i = e h-1 . . . e1 in binary g0,i = g e h-1 h-1 . . . g e 1 1 for i = 0 to 2 h -1 for j = 0 to v -1 gj,i ← g 2 b j-1,i L ← L ∪ {gj,i} return L LimLee.GetRandomPair: R ← 1 r ← 0 for i = b -1 to 0 R ← R 2 r ← r + r for j = v -1 to 0 ri,j $ ← -{0, . . . , 2 h -1} R ← R × gj,r i,j r ← r + ri,j return (r, R)
Figure 4.17: The LL algorithm for generating random pairs (x, g x mod p).

Implementation results

Reschnorr, using the algorithms described in Sections 4.3.3 and 4.3.5, has been implemented in C using the GMP library. In the interest of timing comparison we have also implemented the classical Schnorr scheme. The results for several scenarios are outlined in Table 4.2 (at 128-bit security) and Table 4.3 (at 192-bit security). Complete source code and timing framework are available upon request from the authors.

These experiments show that ReSchnorr is faster than Schnorr when at least 250 pairs (i.e., 750 kB at 128-bit security) have been precomputed. This effect is even more markedly visible at higher security levels: ReSchnorr benefits more, and more effectively, from the E-BPV+BGMW optimisation as compared to Schnorr. The importance of combining E-BPV and BGMW is also visible: E-BPV using naive exponentiation does not provide any speed-up.

Schnorr and ReSchnorr achieve identical performance when using Lim and Lee's optimisation, confirming the theoretical analysis. When less than 1 MB of memory is alloted, this is the better choice.

Heuristic security

Several papers describe server-aided precomputation techniques (e.g., [START_REF] Sabir | Efficient and verifiable algorithms for secure outsourcing of cryptographic computations[END_REF]), which perform exponentiations with the help of a (possibly untrusted) server, i.e., such techniques allow to outsource the computation of g x mod n, with public g and n, without revealing x to the server.

Interestingly, the most efficient algorithms in that scenario (which of course we could leverage) use parameters provided by Hohenberger and Lysyanskaya [START_REF] Hohenberger | How to Securely Outsource Cryptographic Computations[END_REF] for E-BPV. A series of papers took these parameters for granted (including [START_REF] Sabir | Efficient and verifiable algorithms for secure outsourcing of cryptographic computations[END_REF]), but we should point out that these are not covered by the security proof found in [START_REF] Phong | Distribution of modular sums and the security of the server aided exponentiation[END_REF].

Despite this remark, it seems that no practical attack is known either; therefore if we are willing to relax our security expectations somewhat it is possible to compute the modular exponentiation faster. Namely, a Q-bit exponent can be computed in O(log Q 2 ) modular multiplications.

Algorithm Storage Multiplications Security

Square-and-multiply 0

1.5 log P Always BPV [BPV98] nP k -1 m P ( n k ) < 2 -κ E-BPV [NSS01] nP 2k + h -3 m P ( n k )(h-1) k < 2 -κ Lim and Lee [LL94] 2 h × v × P log P h (1 + 1 v ) -3 Always Table 4
.1: Precomputation/online computation trade-offs. ReSchnorr uses an exponent that is times bigger than Schnorr, which is amortized over signatures. Comparing ReSchnorr to Schnorr, the ratio is log(Q) 2 (log Q) 2 . With Q = 256 we get a ratio of approximately 5.7. Note that as Q increases, so does , and therefore so does the advantage of ReSchnorr over Schnorr in that regime.

Reduction-friendly moduli

As part of computing g k mod p, a very costly operation is the reduction mod p. An interesting question is whether some particular moduli p can be found, for which reduction is particularly easy.

An example of such moduli are those that start with a 1 followed by many 0.

Example 4.3 For P = 3072 and Q = 256, using (in hexadecimal notation)

∆ i = {12d,

Conclusion

We have introduced a new digital signature scheme variant of Schnorr signatures, that reuses the nonce component for several signatures. Doing so does not jeopardise the scheme's security; attempting to do the same with classical Schnorr signatures would immediately reveal the signing key. However the main appeal of our approach is that precomputation techniques, whose benefits can only be seen for large enough problems, become applicable and interesting. As a result, without loss of security, it becomes possible to sign messages using fewer modular multiplications. Our technique is general and can be applied to several signature schemes using several speed-up techniques.

Attestations for RSA prime generation algorithms

Abstract

RSA public keys are central to many cryptographic applications; hence their validity is of primary concern to the scrupulous cryptographer. The most relevant properties of an RSA public key (n, e) depend on the factors of n: are they properly generated primes? are they large enough? is e co-prime with φ(n)? etc. And of course, it is out of question to reveal n's factors.

Generic non-interactive zero-knowledge (NIZK) proofs can be used to prove such properties. However, NIZK proofs are not practical at all. For some very specific properties, specialized proofs exist but such ad hoc proofs are naturally hard to generalize.

This paper proposes a new type of general-purpose compact non-interactive proofs, called attestations, allowing the key generator to convince any third party that n was properly generated. The proposed construction applies to any prime generation algorithm, and is provably secure in the Random Oracle Model.

As a typical implementation instance, for a 138-bit security, verifying or generating an attestation requires k = 1024 prime generations. For this instance, each processed message will later need to be signed or encrypted 14

Introduction

When provided with an RSA public key n, establishing that n is hard to factor might seem challenging: indeed, most of n's interesting properties depend on its secret factors, and even given good arithmetic properties (large prime factors, etc.) a subtle backdoor may still be hidden in n or e [And93; YY96; YY97; YY06; YY05].

Several approaches, mentioned below, focused on proving as many interesting properties as possible without compromising n. However, such proofs are limited in two ways: first, they might not always be applicable -for instance [KKM12; BY96; BY93] cannot prove that (n, e) define a permutation when e is too small. In addition, these ad hoc proofs are extremely specialized. If one wishes to prove some new property of n's factors, that would require modelling this new property and looking for a proper form of proof.

This paper proposes a new kind of general-purpose compact non-interactive proof ω n , called attestation. An attestation allows the key generator to convince any third party that n was properly generated. The corresponding construction, called an attestation scheme, applies to any prime generation algorithm G(1 P , r) where r denotes G's random tape, and P the size of the generated primes. The method can, for instance, attest that n is composed of primes as eccentric as those for which 9393 sin 4 (p 3 ) = 3939.

More importantly, our attestation scheme provides the first efficient way to prove that (n, e) defines a permutation for a small e, by making G only output primes p such that e is coprime with p -1.

Our construction is provably secure in the Random Oracle Model. We present two variants: In the first, a valid attestation ω n ensures that n contains at least two P -bit prime factors generated by G (if n is honestly generated, n must contain prime factors, for some integer ≥ 2 depending on the security parameter). In the second variant, a valid attestation ω n covers a set of moduli n = (n 1 , . . . , n u ) and ensures that at least one of these n i is a product of two P -bit prime factors generated by G.

Both variants are unified into a general attestation scheme18 to encompass the entire gamut of tradeoffs offered by the concept.

Prior work. A long thread of papers deals with proving number-theoretic properties of composite moduli. The most general (yet least efficient) of these use non-interactive zero-knowledge (NIZK) proof techniques [CD98; GMW87b; BCC88]. Recent work by Groth et al. [START_REF] Groth | Perfect Non-interactive Zero Knowledge for NP[END_REF] establishes that there is a perfect NIZK argument for n being a properly generated RSA modulus. We distinguish between these generic proofs that can, in essence, prove anything provable [BGG + 90] and ad hoc methods allowing to prove proper modulus generation in faster ways albeit for very specific Gs.

The first ad hoc modulus attestation scheme was introduced by Van de Graff and Peralta [vP88] and consists in proving that n is a Blum integer without revealing its factors. Boyar, Friedl and Lund [START_REF] Boyar | Practical Zero-Knowledge Proofs: Giving Hints and Using Deficiencies[END_REF] present a proof that n is square-free. Leveraging [vP88; BFL90], Gennaro, Micciancio and Rabin [START_REF] Gennaro | An Efficient Non-Interactive Statistical Zero-Knowledge Proof System for Quasi-Safe Prime Products[END_REF] present a protocol proving that n is the product of two "quasi-safe" primes19 . Camenisch and Michels [START_REF] Camenisch | Separability and Efficiency for Generic Group Signature Schemes[END_REF] give an NIZK proof that n is a product of two safe primes. Juels and Guajardo [START_REF] Juels | RSA Key Generation with Verifiable Randomness[END_REF] introduce a proof for RSA key generation with verifiable randomness. Besides its complexity, [START_REF] Juels | RSA Key Generation with Verifiable Randomness[END_REF]'s main drawback is that public parameters must be published by a trustworthy authority (TTP). Several authors [Mic93; BF97; CFT98; Mao99] describe protocols proving that n is the product of two primes p and q, without proving anything on p, q but their primality. Proving that n = pq is insufficient to ascertain security (for instance, p may be too short). Hence, several authors (e.g., [LS98; Bou00; FO97; FO98; Mao99; CFT98]) introduced methods allowing to prove that p and q are roughly of identical sizes.

This works takes an entirely different direction: Given any generation procedure G, we prove that G has been followed correctly during the generation of n. The new approach requires no TTPs, does not rely on n having any specific properties and attests that the correct prime generation algorithm has been usedwith no restriction whatsoever on how this algorithm works.

As such, the concern of generating proper moduli (e.g. such that (N, e) define a permutation, but what constitutes a "proper" modulus may depend on the application) is entirely captured by the concern of choosing G appropriately. Our work merely attests that G was indeed used.

Cryptographic applications of attested RSA moduli abound. We refer the reader to [START_REF] Gennaro | An Efficient Non-Interactive Statistical Zero-Knowledge Proof System for Quasi-Safe Prime Products[END_REF] or [START_REF] Mao | Verifiable Partial Sharing of Integer Fractions[END_REF] for an overview of typical applications of attested moduli. In particular, such concerns are salient in schemes where an authority is in charge of generating n (e.g. Fiat-Shamir or Guillou-Quisquater) and distributing private keys to users, or in the design of factoring-based verifiable secret-sharing schemes.

Outline of the approach

The proposed attestation method is based on the following idea: fix k ≥ 2, generate k random numbers r 1 , . . . , r k and define h i = H(i, r i ) where H denotes a hash function. Let p i = G(h i ) and:

N = k i=1 p i Define (X 1 , X 2 ) = H 2 (N )
, where H 2 is a hash function which outputs two indices 1 ≤ X 1 < X 2 ≤ k. We later show how to construct such an H 2 . This defines n = p X1 × p X2 and ω n = {r 1 , r 2 , . . . , r X1-1 , , r X1+1 , . . . , r X2-1 , , r X2+1 , . . . , r k } Here, a star symbol ( ) denotes a placeholder used to skip one index. The data ω n is called the attestation of n. The algorithm A used to obtain ω n is called an attestator.

The attestation process is illustrated in Figure 4.18: the choice of the r i determines N , which is split into two parts: n and N/n. Splitting is determined by d, which is the digest of N , and is hence unpredictable for the opponent.

Verifying the validity of such an attestation ω n is performed as follows: all (non-star) values r i in ω n are fed to G to generate primes, that are multiplied together and by n. This gives back N . If by hashing N and reading, as earlier, the digest of N (denoted d) as two values X 1 and X 2 , we get the two exact starred positions X 1 and X 2 in ω n , then ω n is valid; else ω n is invalid. The algorithm V we just described is called a validator. It is very similar to the attestator A mentioned above.

For a subtle reason, the r i 's are pre-processed into a set of values h i before being fed into G. The values h i are generated by hashing the input r i s with their positions i. This serves two purposes: first, the hash welds together r i and its position i in the list, which prevents the opponent from shuffling the p i s to his advantage; second, hashing prevents the opponent from manipulating the r i 's to influence G's output.

Evidently, as presented here, the method requires a very large k to achieve a high enough security level. The attacker, who chooses X 1 , X 2 , is expected to perform k(k -1)/2 operations to succeed. We circumvent this limitation using two techniques:

• The first technique uses indices X 1 , . . . , X and not only = 2. In RSA, security depends on the fact that n contains at least two properly formed prime factors. Hence we can afford to shorten k by

r 1 h 1 p 1 . . . . . . . . . r X1 h X1 p X1 . . . . . . . . . N d = {X 1 , X 2 } r X2 h X2 p X2 . . . . . . . . . r k h k p k H(1, r 1 ) G(h 1 ) H(X 1 , r X1 ) G(h X1 ) H(X 2 , r X2 ) G(h X2 ) H(k, r k ) G(h k ) H 2 (N ) × Figure 4
.18: The approach used to generate and validate an attestation. allowing more factors in n. The drawback of using -factor moduli is an significant user slow-down as most factoring-based cryptosystems run in O(log 3 n). Also, by doing so, we prove that n contains a properly formed modulus rather than that n is a properly formed modulus.

• A second strategy consists in using 2u indices to form u moduli n 1 , . . . , n u . Here, each user will be given u moduli and will process20 each message u times. Thereby, total signature size and slow-down are only linear in . Encryption is more tricky: while for properly signing a message it suffices that at least one n i is secure, when encrypting a message all n i must be secure. Hence, to encrypt, the sender will pick u session keys κ i , encrypt each κ i using n i , and form the global session-key κ = κ 1 ⊕ . . . ⊕ κ u .

The target message will then be encrypted (using a block-cipher) using κ. In other words, it suffices to have at least one factoring-resistant n i to achieve message confidentiality. Interestingly, to be secure a signature conceptually behaves as a logical "or", while encryption behaves as a logical "and".

The size of ω n is also a concern in this simple outline. Indeed, as presented here ω n is O(kR) bits large, where R represents the bitsize of the r i21 . Given the previous remark on k being rather large, this would result in very large attestations. Luckily, it turns out that attestation size can be reduced to O(R log k) using hash trees, as we explain in Section 4.4.5.

Note.

Multiplication in N is one implementation option. All we need is a completely multiplicative operation. For instance, as we have:

a N = a p 1 a p 2 • • • a p k ,
the hash of the product of the Jacobi symbols of the p i with respect to the first primes a j = 2, 3, 5, . . .22 can equally serve as an index generator. Before we proceed note that when generating a complete RSA key pair (n, e), it is important to ascertain that gcd(e, φ(n)) = 1. This constraint is easy to integrate into G23 . All in all, what we prove is that with high probability, the key was generated by the desired algorithm G, whichever this G happens to be.

Model and analysis

Preliminaries and notations

We now formally introduce the tools using which the method sketched in Section 4.4.2 is rigorously described and analysed.

Throughout this paper, λ will denote a security parameter. The expression polynomial time will always refer to λ. The construction uses two cryptographic hash functions: a classical hash function H : {0, 1} * → {0, 1} R and a second hash function H d : {0, 1} * → S d where S d is the set of subsets of {1, . . . , k} of size d (for some positive integer d and k). H can be constructed from a classical hash function using an unranking function [START_REF] Stanton | Constructive combinatorics[END_REF] (see Section 4.4.8). Both hash functions will be modelled as random oracles in the security analysis.

Let k ≥ 2. Moreover our attestation and validation algorithms always implicitly take λ as input. We denote by |a| the bitsize of a.

Let G(1 P , r) be a polynomial-time algorithm which, on input of a unary size P and of a random seed r ∈ {0, 1} R produces a prime or a probably prime p of size P . The argument 1 P is often omitted, for the sake of simplicity. The size P of the primes is supposed to be a function of λ. We write r 1 $ ← -{0, 1} R to indicate that the seed r 1 is chosen uniformly at random from {0, 1} R .

An attestation scheme for G is a pair of two algorithms (A, V), where

• A is an attestation algorithm which takes as input k random entries (r 1 , . . . , r k ∈ {0, 1} R , in the sequel) and which outputs a tuple of moduli n = (n 1 , . . . , n u ) along with a bitstring ω n , called an attestation; u and k are integer parameters depending on λ; when u = 1, n 1 is denoted n;

• V is a validation algorithm which takes as input a tuple of moduli n = (n 1 , . . . , n u ) together with an attestation ω n . V checks ω n , and outputs True or False.

An attestation scheme must comply with the following properties:

• Randomness. If r 1 , . . . , r k are independent uniform random values, A(1 λ , r 1 , . . . , r k ) should output a tuple of moduli n = (n 1 , . . . , n u ) where each n i is the product of random primes generated by G. The positive integer ≥ 2 is a parameter depending on λ. More formally the two following distributions should be statistically indistinguishable:

n = (n 1 , . . . , n u ) (r 1 , . . . , r k ) $ ← -{0, 1} R (n 1 , . . . , n u , ω n ) ← A(r 1 , . . . , r k ) n = (n 1 , . . . , n u ) (r 1 , . . . , r u ) $ ← -{0, 1} R n 1 ← G(r 1 ) • • • G(r ), . . . , n u ← G(r (u-1) +1 ) • • • G(r u )
• Correctness. The validator V always accepts an attestation honestly generated by the attestator A.

More precisely, for all r 1 , . . . , r k :

V A(1 λ , r 1 , . . . , r k ) = True.

• Soundness. No polynomial-time adversary F can output (with non-negligible probability) a tuple n = (n 1 , . . . , n u ) and a valid attestation ω n such that no n i contains at least two prime factors generated by G with two distinct random seeds. More formally, for any polynomial-time adversary F, the soundness advantage Adv snd (F) defined as

Pr   (n = (n 1 , . . . , n u ), ω n ) $ ← -F(1 λ ) V(n 1 , . . . , n u , ω n ) = True and ∀i = 1, . . . , u, s 1 , s 2 ∈ {0, 1} R , s 1 = s 2 and G(s 1 ) • G(s 2 ) divides n i   is negligible in λ.
We remark that when it is hard to find two seeds s 1 and s 2 such that G(s 1 ) = G(s 2 ), then soundness basically means that one of the n i 's contains a product of two distinct primes generated by G. In addition, when = 2, if V rejects moduli of size different from 2P (the size of a honestly generated modulus), one of the n i 's is necessarily exactly the product of two prime factors generated by G. Table 4.4 summarizes the various parameters used in our construction (all are assumed to be function of λ). We now describe the following two variants:

• The multi-prime variant, where A only outputs one modulus (i.e. u = 1);

• The multi-modulus variant, where A outputs u ≥ 2 two-factor moduli (i.e. = 2).

Multi-prime attestation scheme (u = 1)

We now describe the algorithms A and V that generate and verify, respectively, an attestation along with an RSA public key, when u = 1 (only one modulus is generated). Algorithms in this Section are given for = 2 (corresponding to the common case where n = pq) for the sake of clarity and as a warm-up. Algorithms for arbitrary are particular cases of the general algorithms described in Section 4.4.3.4. In Algorithms 9 and 10, a star symbol ( ) denotes a placeholder used to skip one index.

Generating an attestation. The attestator A is described in Algorithm 9. A calls H and G.

1. N ← 1 2. for all i ← 1 to k 3.
hi ← H(i, ri)

4. pi ← G (hi) 5. N ← N × pi 6. X1, X2 ← H 2 (N ) 7. ωn ← {r1, . . . , rX 1 -1, , rX 1 +1, . . . , rX 2 -1, , rX 2 +1, . . . , r k } 8. n ← pX 1 × pX 2

return n, ωn

In this setting, the attestation has size k. This size is reduced to log k using hash trees as described in Section 4.4.5.

Verifying an attestation. The validator V is described in Algorithm 10. Correctness: The h i s are generated deterministically, therefore so are the p i s, and their product times n yields the correct value of N .

1. N ← n 2. for all ri = ∈ ωi 3. hi ← H(i, ri) 4. pi ← G (hi) 5. N ← N × pi 6. X1, X2 ← H 2 (N )

Randomness:

In the Random Oracle Model (for H), the scheme's randomness is proven later in Section 4.4.4.1, as a particular case of the general scheme's24 soundness.

Multi-Modulus Attestation Scheme (u ≥ 2, = 2)

The second variant consists in generating in a batch u = /2 bi-factor moduli. The corresponding attestator and validator are given in Algorithms 11 and 12.

Algorithm 11: Attestator A for the Multi-Modulus Attestation Scheme (u ≥ 2, = 2)

Input: r1, . . . , r k .

Output: n = (n1, . . . , nu), ωn.

1. N ← 1 2. for i ← 1 to k 3. hi ← H(i, ri) 4. pi ← G (hi) 5. N ← N × pi 6. X1, . . . ,

General attestation scheme

Algorithms 13 and 14 describe our general attestation scheme, for any u ≥ 1 and ≥ 2. The previous multi-prime and multi-modulus schemes are illustrative particular cases of this scheme.

The correctness and randomness arguments are similar to those of Section 4.4.3.2. In addition, the attestation has size k. This size is brought down to u log k using hash-trees as described in Section 4.4.5.

Algorithm 13:

Attestator A for the General Attestation Scheme (u ≥ 1, ≥ 2) Input: r1, . . . , r k . Output: n = (n1, . . . , nu), ωn.

1. N ← 1 2. for i ← 1 to k 3.
hi ← H(i, ri)

4. pi ← G (hi) 5. N ← N × pi 6. X1, . . . , X u ← H u (N ) 7. ωn ← {r1, . . . , rX 1 -1, , rX 1 +1, . . . , rX u -1, , rX u +1, . . . , r k } 8. for j ← 1 to u 9. nj ← pX ( -1)j+1 × • • • × pX j 10
. return n = (n1, . . . , nu), ωn Algorithm 14: Validator V for the General Attestation Scheme (u ≥ 1, ≥ 2) In this section, we prove that for correctly chosen parameters u, , k, the general attestation scheme defined in Section 4.4.3.4 (Algorithms 13 and 14) is sound. We recall that the two other properties required by an attestation scheme (namely correctness and randomness) were proven in previous sections.

Input: n, ωn. Output: True or False 1. N ← n1 × • • • × nu 2. for ri = in ωn 3. hi ← H(i, ri) 4. pi ← G (hi) 5. N ← N × pi 6. X1, . . . , X 2u ← H u (N )
More formally, we have the following theorem:

Theorem 4.28 In the Random Oracle Model, the soundness advantage of an adversary making q H queries to H and q H queries to H is at most:

(q H + 1) • u k -( -1)u + 1 ( -1)u + q H • (q H -1) 2 • p G-col ,
where p G-col is the probability that two G(r) = G(s), when r, s

$ ← -{0, 1} R .
We point out that p G-col must be small, otherwise the generated primes are unsafe in any case.

Proof: First, we denote by S i the set of all prime numbers ρ = G(H(i, r)), for which (i, r) has been queried to H (for i = 1, . . . , k). We remark that the probability that two such primes ρ are equal is at most

q H •(q H -1) 2
• p G-col . This is the second term in the security bound.

In the sequel, we suppose that there are no collisions between the primes. Thus the sets S i are pairwise disjoint. Now assume that the adversary F has been able to forge a valid attestation ω n for n = (n 1 , . . . , n u ) and let N = β u i=1 n i , where β stands for the product of all the primes generated from the elements of ω n . As the attestation is valid,

|n 1 | = • • • = |n u | = P . Let N = L i=1 ρ i be the prime decomposition of N .
Up to reordering the sets S i , there exists an integer t such that:

• none of S 1 , . . . , S t contains a factor ρ i ;

• each of S t+1 , . . . , S k contains a factor ρ i . We arbitrarily choose a prime p i ∈ S i for i = t + 1, . . . , k.

We distinguish two cases:

• if t < ( -1) • u, then this means that N is divisible by m = p t+1 × • • • × p k . But we also know that N is divisible by n 1 × • • • × n u . As |n 1 × • • • × n u | = uP , |m| = (k -t)P > kP -( -1)uP + P , and |N | = kP , we have |gcd(n 1 • • • n u , m)| ≥ |n 1 • • • n u | + |m| -|N | ≥ (u + 1)P.
This implies that n 1 × • • • × n u is divisible by at least u + 1 distinct primes among p t+1 , . . . , p k . By the pigeon-hole principle, at least one of the n i 's is divisible by two distinct primes generated as G(r i ) for two distinct seeds r i (seeds have to be distinct, otherwise the two primes would be equal).

• if t ≥ ( -1) • u, the adversary will only be able to generate a valid attestation if none of the indices X 1 , . . . , X u (obtained by H u (N )) falls in {1, . . . , t}. As {1, . . . , k} \ {X 1 , . . . , X u } is a random subset of {1, . . . , k} with ku elements, the previous bad event (F is able to generate a valid attestation) corresponds to this set being a subset of {t + 1, . . . , k} and happens with probability:

k-t k-u k k-u = (k -t) • (k -t -1) • • • (k -u + 1) k • (k -1) • • • (k -u + 1) • ( u)! ( u -t)! ≤ 1 (k -t + 1) t • ( u) t ≤ u k -( -1)u + 1 ( -1)•u .
Since F makes q H queries to H , we get the theorem's bound (where the +1 corresponds to the query necessary to verify F's attestation if he did not do it himself).

Typical parameters and complexity analysis

Algorithms 13 and 14 have the following properties:

• Attestation size |ω n | = 2u R log k, using the hash-tree compression technique in Section 4.4.5

• λ-bit security approximatively when:

u k -( -1)u + 1 ( -1)u ≤ 2 -λ
(according to the soundness bound given by Theorem 4.28, omitting the second part, which is negligible in practice);

• Attestation and validation times mostly consist in generating (or re-generating) the k primes. Validation time is very slightly faster than attestation time.

Compressing the attestation

As mentioned above, providing an attestation ω n "as is" might be cumbersome, as it grows linearly with k. However, it is possible to drastically reduce ω n 's size using the following technique. The tree of Figure 4.19 is constructed as follows: Let h be some public hash function. Each non-leaf node C of the tree has two children, whose value is computed by r x0 ← h(r x , 0) and r x1 ← h(r x , 1) for the left child and the right child respectively, where r x is the value of C. Given a root seed r, one can therefore reconstruct the whole tree. The leaf values can now be used as r i 's for the attestation procedure.

To compress ω n we proceed as follows:

• Get the indices X 1 and X 2 from the attestation procedure;

• Identify the paths from X 1 up to the root, and mark them;

• Identify the paths from X 2 up to the root, and mark them;

• Send the following information:

ω n = {for all leaves L, highest-ranking unmarked parent of L}
This requires revealing at most 2 log 2 k intermediate higher-rank hashes25 instead of the k -2 values required to encode ω n when naively sending the seeds directly. Generalization to u ≥ 2 is straightforward. r r 0 = h(r, 0)

r 00 = h(r 0 , 0) r 000 = h(r 00 , 0)
r 001 = h(r 00 , 1)

r 01 = h(r 0 , 1) r 010 = h(r 01 , 0)
r 011 = h(r 01 , 1)

r 1 = h(r, 1)
r 10 = h(r 1 , 0) r 100 = h(r 10 , 0) r 101 = h(r 10 , 1)
r 11 = h(r 1 , 1) r 110 = h(r 11 , 0) r 111 = h(r 11 , 1)
Figure 4.19: Compressing ω n using a hash tree.

Parameter settings

Table 4.5 shows typical parameter values illustrating different tradeoffs between security (λ), attestation size (2u R log k), modulus size ( ), the number of required moduli (u), and the work factors of A and V (kt G where t G is G's average running time). Table 4.6 provides the same information for the multi-modulus variant. We (arbitrarily) consider that reasonable attestations and validations should occur in less than ten minutes using standard HSM such as the IBM 4764 PCI-X Cryptographic Coprocessor [IBM] or Oracle's Sun Crypto Accelerator SCA 6000 [Ora]. When run with 7 threads in the host application, the 4764 generates on average 2.23 key-pairs per second (1,024 bits). The SCA 6000 (for which average key generation figures are not available) is about 11 times faster than the 4764 when processing RSA 1,024-bit keys. Hence we can assume that the SCA 6000 would generate about 24 key-pairs per second. We thus consider that average-cost current-date HSMs generate 10 key-pairs per second, i.e. 20 primes per second.

Spending ten minutes to generate or validate an attestation might not be an issue given that attestation typically occurs only once during n's lifetime. This means that a "reasonable" attestation implementation would use k = 10 × 60 × 20 = 12,000. This gives = 10 and = 6 for the multi-prime and multi-modulus A (respectively) for λ = 128.

Note that in practical field deployments an attestation would be verified once by a trusted Attestation Authority and replaced by a signature on n (or n).

According to the bounds of Theorem 4.28, we have

λ ≥ -( -1)u log 2 u k -( -1)u + 1
Table 4.5 is read as follows: we can see that taking for instance = 10 and log 2 k = 13 with the multifactor version gives 156-bit security. In Table 4.6, taking = 10 and log 2 k = 13 with the multi-modulus version gives 285-bit security.

Conclusion and further research

The construction described in this paper attests in a non-interactive way that n was properly generated using an arbitrary (publicly known) prime generator G. The attestation is compact and publicly verifiable. As a result, any entity can convince herself of the modulus' validity before using it. Even though computation times may seem unattractive, we stress that attestation generation and verification only need to be performed once.

This work raises a number of interesting questions. Commiting to the primes p i 's might also be achieved using more involved tools such as pairings. For instance, given the commitments g p1 and g p2 , it is easy to check that e(g p1 , g p2 ) = e(g, g) n .

An interesting research direction consists in hashing N mod v (instead of N ) for some public v, to speed-up calculations. However, the condition v > n must be enforced by design to prevent an opponent from using ω n as the "attestation" of n + tv for some t ∈ N. Note that we did not adapt our security proof to this (overly?) simplified variant.

In general, any strategy allowing to reduce k without impacting λ would yield more efficient attestators. Also, generalizing and applying this approach to the parameter generation of other cryptographic problems, such as the discrete logarithm, may prove useful.

Finally, to date, no attestation method proves (without resorting to TTPs) that the random tape used for forming the primes was properly drawn. Like all other prior work articles cited in Section 4.4.1, we do not address this issue and assume that the random number that feeds G was not biased by the attacker.

Implementing the second hash function H

To implement the second hash function H d from a classical hash function, we can apply an unranking hash function [START_REF] Stanton | Constructive combinatorics[END_REF], which maps an integer (in some interval) to a subset {X 1 , . . . , X u } ⊂ {0, . . . , k -1}.

As an example, we describe here a simple (natural) unranking function. Let H be a classical hash function with range {0, . . . , M }, where

M = k(k -1) • • • (k -u + 1) -1.
To hash a value N , we first compute r ← H (N ). Then we compute the integers r 1 , . . . , r d as in Algorithm 15.

for all

i = 1 to u 2. ri ← r mod (k -i + 1) 3. r ← r div (k -i + 1) 4. return r1, . . . , ru
Algorithm 15 generates a mixed radix representation of r, hence any r ∈ [0, M ] can be represented this way. We now generate the unranking X 1 , . . . , X d iteratively as follows:

• X 1 ← r 1 • X i+1 ← r i+1 + #{X j s.t. X j ≤ r i+1 for j ≤ i}
In other terms, we have a pool of M values, and for each i, one of these values is drawn and assigned to X i . Hence it is easy to check that this provides a list of pairwise distinct integers.

This algorithm is simple and illustrates how unranking may be implemented. Alternative unranking methods can be found in [START_REF] Stanton | Constructive combinatorics[END_REF]. Table 4.6: Some typical parameters for multi-modulus attestation (u = /2). Each cell contains λ for the corresponding choice of k and . Some choices of parameters are incompatible and are hence indicated by a dash. is historically very ancient, and is still used today when speed is essential; the latter can be dated to the works of Merkle and of Rivest-Shamir-Adleman in 1978. One of the key assets of public-key cryptography is the prospect of proving security, which is typically achieved by showing that the problem the attacker faces is at least as hard as a mathematically hard problem. Hopefully the latter has a long history of puzzling mathematicians and computer scientists, giving assurance that any progress against it would be both improbable or slow, and very interesting in its own right. The first mathematical notion of security for encryption, semantic security, was introduced by Shannon in the 1950's. With the exception of the one-time pad, all previously known ciphers fail to achieve this security property. The reader interested in older designs can have a look at our study of a post-Kerckhoffs, pre-Shannon code in Appendix A.1. An immediate consequence of semantic security is that any deterministic encryption scheme fails to satisfy it. The reuse of messages or keys for such systems can have (and historically has had) dramatic consequences.

The hard problems from which to build secure public-key cryptosystems are not many. Only a few are known, and fewer even have passed the test of time. And yet even fewer might remain in use, should practical quantum computation become reality. We therefore turned our attention to old and new hard problems, that may provide interesting alternatives. The Naccache-Stern cryptosystem is one such construction, but its original description lacked semantic security; we remedy this (and extend it in other ways) in Sections 5.1 and 5.2. Then in Section 5.3 we describe a general transformation to turn digital signatures into public-key cryptosystems -since signatures can be usually constructed from many different assumptions, this may extend the toolset of available primitives. As a surprising result this constructions gives "split" cryptosystems, where the public key is not a function of the private key. In Section 5.4 we perform a practical cryptanalysis of a beautiful and recent PKC proposed by Aggarwal et al. In last resort, we explore in Section 5.5 the possibility of using human intellect as a hard problem, drawing consequence from the (falsifiable) assumption that humans can solve efficiently problems that machines cannot.

Finally Section 5.6 considers the possibility of an unbounded adversary, powerful enough to try all possible decryption keys, and discusses how to design beyond-brute-force secure cryptosystems.

Introduction

In 1997, Naccache and Stern (NS, [START_REF] Naccache | A New Public-Key Cryptosystem[END_REF]) presented a public-key cryptosystem based on the conjectured hardness of the modular multiplicative knapsack problem. This problem is defined as follows:

Let p be a modulus 1 and let v 0 , . . . , v n-1 ∈ Z p .

Given p, v 0 , . . . , v n-1 , and

n-1 i=0 v mi i mod p, find the {m i }.
Given this scheme's algebraic structure it is interesting to determine if variants and generalizations can add to NS features such as semantic security, re-randomizability or extend it to operate on higher-residues. This paper addresses these questions and explores several such variants.

The Original Naccache-Stern Cryptosystem

The NS cryptosystem uses the following sub-algorithms:

• Setup: Pick a large prime p and a positive integer n.

Let P = {p 0 = 2, . . . , p n-1 } be the set of the n first primes, so that n-1 i=0 p i < p (We leave aside a one-bit leakage dealt with in [NS97] -this technique applies mutatis mutandis to the algorithm presented in this paper).

• KeyGen: Pick a secret integer s < p -1, such that gcd(p -1, s) = 1. Set

v i = s √ p i mod p.
The public key is (p, n, v 0 , . . . , v n-1 ). The private key is s.

• Encrypt: To encrypt an n-bit message m, compute the ciphertext c:

c = n-1 i=0 v mi i mod p
where m i is the i-th bit of m.

1 p is usually prime but nothing prevents extending the problem to composite RSA moduli.

• Decrypt: To decrypt c, compute

m = n-1 i=0 2 i µ i (c, s, p)
where µ i (c, s, p) ∈ {0, 1} is the function defined by:

µ i (c, s, p) = gcd(p i , c s mod p) -1 p i -1 .
To this day, NS has neither been proven secure in the usual models, nor has it been attacked. Rather, its security relies on the conjectured hardness of a multiplicative variant of the knapsack problem2 :

Definition 5.1 (Multiplicative Knapsack Problem) Given p, c, and a set {v i }, find a binary vector x such that

c = n-1 i=0 v xi i mod p.
Just as in additive knapsacks, this problem is NP-hard in general but can be solved efficiently in some situations; the secret key enabling precisely to transform the ciphertext into an easily-solvable instance. Unlike additive knapsacks, this multiplicative knapsack doesn't lend itself to lattice reduction attacks, which completely break many additive knapsack-based cryptosystems [Adl82; Bri84; JS93; CJS92; Len91; HM12b].

Over the past years, several NS variants were published, these notably seek to either increase efficiency [START_REF] Chevallier-Mames | Linear Bandwidth Naccache-Stern Encryption[END_REF] or extend NS to polynomial rings [START_REF] Herold | New Attacks for Knapsack Based Cryptosystems[END_REF]; to the best of our knowledge, no efficient attacks against the original NS are known.

Security Notions

A cryptosystem is semantically secure, or equivalently IND-CPA-secure [START_REF] Goldwasser | Probabilistic Encryption and How to Play Mental Poker Keeping Secret All Partial Information[END_REF], if there is no adversary A capable of distinguishing between two ciphertexts of plaintexts of his choosing.

To capture this notion, A starts by creating two messages m 0 and m 1 and sends them to a challenger C. C randomly selects one of the m i (hereafter m b ) and encrypts it into a ciphertext c. A is then challenged with c and has to guess b with probability significantly higher than 1/2.

Given a public-key cryptosystem PKC = {Setup, KeyGen, Encrypt, Decrypt}, this security notion can be formally defined by the following game: A wins the game if b = b. The advantage of A in this game is defined as:

Adv IND-CPA PKC,A := Pr [b = b ] - 1 2 A public-key cryptosystem PKC is IND-CPA-secure if Adv IND-CPA PKC,A is negligible for all PPT adversaries A.
IND-CPA-security is a very basic requirement, and in some scenarios it is desirable to have stronger security notions, capturing stronger adversaries. The strongest security notion for a public-key cryptosystem is indistinguishability under adaptive chosen ciphertext attacks, or IND-CCA2-security. IND-CCA2 is also defined in terms of a game, where A is furthermore given access to an encryption oracle and a decryption oracle: A wins the game if b = b and if no query to the oracles concerned m 0 nor m 1 . The advantage of A in this game is defined as

Adv IND-CCA2 PKC,A := Pr [b = b ] - 1 2 A public-key cryptosystem PKC is IND-CCA2-secure if Adv IND-CCA2 PKC,A
is negligible for all PPT adversaries A.

We further remind the syntax of a perfectly re-randomizable encryption scheme [CKN03; Gro04; PR07]. A perfectly re-randomizable encryption scheme consists in four polynomial-time algorithms (polynomial in the implicit security parameter k):

1. KeyGen: a randomized algorithm which outputs a public key pk and a corresponding private key sk.

2. Encrypt: a randomized encryption algorithm which takes a plaintext m (from a plaintext space) and a public key pk, and outputs a ciphertext c. Note that ReRand takes only a ciphertext and a public key as input, and in particular, does not require sk.

Higher-Residues Naccache-Stern

The deterministic nature of NS prevents it from achieving IND-CPA-security: Indeed, a given message m 0 will always produce the same ciphertext c 0 , so A will always win the game of Definition 5.2.

We now describe an NS variant that is randomized. We then show how this modification guarantees semantic security, and even CCA2 security in the random oracle model, assuming the hardness of solving the multiplicative knapsack described earlier. In doing so, we must be very careful not to introduce additional structure that an adversary could leverage. To make this very visible, we decomposed the construction into three steps, each step pointing out the flaws avoided in the final construction.

Construction Step x

Because the modified cryptosystem uses special prime moduli, algorithms Setup and KeyGen are merged into one single Setup + KeyGen algorithm3 .

• Setup + KeyGen: Pick a large prime p such that (p -1)/2 = as is a factoring-resistant RSA modulus. Pick a positive integer n. Let P = {p 0 = 2, . . . , p n-1 } be the set of the n first primes, so that

n-1 i=0 p i < p Set v i = s √ p i mod p
Let g be a generator of F p , and = g 2a mod p.

The public key is (p, n, , v 0 , . . . , v n-1 ). The private key is s.

• Encrypt: To encrypt m, pick a random integer k ∈ [1, p -2] and compute:

c = k n-1 i=0 v mi i mod p
where m i is the i-th bit of the message m.

• Decrypt:

To decrypt c compute m = n-1 i=0 2 i µ i (c, s, p).
To understand why decryption works we first observe that

( k ) s = ((g 2a ) k ) s = g k(p-1) = 1 mod p.
Hence:

c s = k n-1 i=0 v mi i s = ¨( k ) s n-1 i=0 p mi i mod p.
And we are brought back to the original NS decryption process.

The problem: The (attentive) reader could have noted at this step that because s is large and because the p i are very few, the odds that a p i is an s-th residue modulo p are negligible. Hence, unless p is constructed in a very particular way, key pairs simply... cannot be constructed. 4A solution consisting in using a specific p and is detailed in Section 5.1.4. The alternative consists in proceeding with y hereafter.

Construction Step y

The workaround will be the following: Assume that we pick a v i at random, raise it to the power s and get some integer π: π = v s i mod p Refresh v i until π = 0 mod p i where π is considered as an element of Z. (In the worst case this takes p i trials.) Letting y i = π/p i , we have:

p i × y i = v s i mod p ⇒ p i = y -1 i × v s i = u i × v s i mod p
We will now add the u i as auxiliary public keys.

• Setup + KeyGen: Pick a large prime p such that (p -1)/2 = as is a factoring-resistant RSA modulus.

Pick a positive integer n. Let P = {p 0 = 2, . . . , p n-1 } be the set of the n first primes, so that

n-1 i=0 p i < p
Generate the u i , v i pairs as previously described so that:

p i = u i × v s i mod p
Let g be a generator of F p , and = g 2a mod p.

The public key is (p, n, , u 0 , . . . , u n-1 , v 0 , . . . , v n-1 ). The private key is s.

• Encrypt: To encrypt m, pick a random integer k ∈ [1, p -2] and compute:

c 0 = k n-1 i=0 v mi i mod p and c 1 = n-1 i=0 u mi i
where m i is the i-th bit of the message m.

• Decrypt:

To decrypt c 0 , c 1 compute m = n-1 i=0 2 i η i (c 0 , c 1 , s, p) Where η i (c 0 , c 1 , s, p) = gcd(p i , c 1 × c s 0 mod p) -1 p i -1 .
To understand why decryption works remind that ( k ) s = 1 mod p and hence

c 1 × c s 0 = n-1 i=0 u mi i k n-1 i=0 v mi i s = ¨( k ) s n-1 i=0 (u i v s i ) mi = n-1 i=0 p mi i mod p.
And we are brought back to the original NS decryption process.

The problem: The (very attentive) reader could have noted that the resulting cryptosystem does not achieve semantic security because the construction process of c 1 is deterministic.

Construction Step z

The workaround is the following: we provide the sender with two extra elements of Z p that will allow him to blind c 0 , c 1 .

To that end, pick a random α ∈ Z p , let βα s = 1 mod p and add α, β to the public key. The algorithms Setup + KeyGen and Decrypt remain otherwise unchanged but Encrypt now becomes:

• Encrypt: To encrypt m, pick a random integer k ∈ [1, p -2] and compute:

c 0 = α k n-1 i=0 v mi i mod p and c 1 = β k n-1 i=0 u mi i .
To understand why decryption works we note that (modulo p):

c 1 × c s 0 = β k n-1 i=0 u mi i α k n-1 i=0 v mi i s = $ $ $ $ (βα s ) k n-1 i=0 (u i v s i ) mi = n-1 i=0 p mi i .
And we are brought back to the original NS decryption process.

Security

Semantic Security

The modified scheme's security essentially relies on blinding an NS ciphertext using a multiplicative factor k = g 2ka mod p, which belongs to the subgroup of Z p of order b.

Lemma 5.1 Under the subgroup hiding assumption in Z p , the scheme described in Section 5.1.2.1 is IND-CPAsecure.

Recall that the subgroup-hiding assumption [START_REF] Boneh | Evaluating 2-DNF Formulas on Ciphertexts[END_REF] states that the uniform distribution over Z p is indistinguishable from the uniform distribution over one of its subgroups.

Proof: Assume that A(pk) wins the IND-CPA game with non-negligible advantage. Then in particular A(pk) has non-negligible advantage in the "real-or-random" game

Adv R/R A := Pr[A E pk (pk) = 1] -Pr[A O (pk) = 1]
where E pk is an encryption oracle and O is a random oracle. We define B(pk, γ) as follows:

• Let E B (m) = γ n-1 i=0 v mi i mod p;
• B(pk, γ) returns the same result as

A E B (pk)
The scenario B(pk, γ = g 2au ) yields E B = E pk . The scenario B(pk, γ = g u ) for random u gives a ciphertext that is a uniform value, and therefore behaves as a perfect simulator of a random oracle, i.e. E B = O. Hence if A is an efficient adversary against our scheme, then B is an efficient solver for the subgroup-hiding problem.

Note that this part of the argument does not fundamentally rely on the original NS being secureindeed, we may consider an encryption scheme that produces ciphertexts of the form c = x k m. Decryption for such a cryptosystem would be tricky, as c b = m b and there are b possible roots. That is why using NS is useful, as we do not have decryption ambiguity issues.

As we pointed out, the construction of Section 5.1.2.2 is not semantically secure: indeed, c 1 is generated deterministically from m. This is addressed in Section 5.1.2.3 by introducing two numbers α and β. Using a similar argument as in Lemma 5.1, we have Lemma 5.2 Under the DDH assumption in Z p , and assuming that factoring (p -1)/2 is infeasible, the scheme described in Section 5.1.2.3 is IND-CPA-secure.

Note that these hypotheses can be simultaneously satisfied.

CCA2 Security

Even more interesting is the case for security against adaptive chosen-ciphertext attacks (IND-CCA2)

[CS98; FOP + 04].
The original NS is naturally not IND-CCA2; nor is in fact the "Step x" variant discussed above: indeed it is possible to re-randomise a ciphertext, which immediately gives a way to win the IND-CCA2 game.

To remedy this, we leverage the fact that upon successful decryption, we can recover the randomness k . The idea is to choose k in some way that depends on m i . If k is a deterministic function of m i only however, randomisation is lost. Therefore we suggest the following variant, at the cost of some bandwidth:

• Instead of m, we encrypt a message m r where r is a random string.

• Let k ← H(m r) where H is a cryptographic hash function, and use this value of k instead of choosing it randomly in Encrypt.

• Modify Decrypt to recover k (or α k and β k ). Upon successfully recovering (m r), extract r, and check that k (resp. α k and β k ) correspond to the correct value of k -otherwise it ouputs ⊥.

This approach guarantees IND-CCA2 in the random oracle model; this can be captured as a series of games:

• Game 0: This is the IND-CCA2 game against our scheme (x or z), instantiated with some hash function H.

• Game 1: This game differs from Game 0 in replacing H by a random oracle O. In the random oracle model, this game is computationally indistinguishable from Game 0.

• Game 2: This game differs from Game 1 by the fact that the ciphertext is replaced by an uniformlysampled random element of the ciphertext space. The results on IND-CPA security tell us that this game is computationally indistinguishable from Game 1 (under their respective hypotheses).

Generating Strong Pseudo-Primes in Several Bases

We now backtrack and turn our attention to generating specific moduli allowing to implement securely the "x" scheme of Section 5.1.2.1. This boils down to describing how to efficiently generate strong pseudo-prime numbers. In this section, we denote N the sought-after modulus.

Using quadratic reciprocity, we first introduce an algorithm generating numbers passing Fermat's test. Then we leverage quartic reciprocity to generate numbers passing Miller-Rabin's test. The pseudoprimes we need must be strong over several bases, and complexity is polynomial in the size of the product of these bases.

Primality Tests

A base-A Fermat primality test consists in checking that A B ≡ A mod B. Every prime passes this test for all bases A. There are however composite numbers, known as Carmichael numbers, that also pass this test in all bases. For instance, 1729 = 7 • 13 • 19 is such a number. There are an infinity of Carmichael numbers.

The Miller-Rabin primality test also relies on Fermat's little theorem. Let B -1 = 2 e m with m odd. An integer B passes the Miller-Rabin test if A m ≡ 1 mod B or if there exists an i ≤ e -1 such that A 2 i m ≡ -1 mod B.

Definition 5.4 (Strong pseudo-prime) A number that passes the Miller-Rabin test is said strongly pseudoprime in base A.

An interesting theorem [Mon80, Proposition 2][Rab80] states that a composite number can only be strongly pseudo-prime for a quarter of the possible bases.

Constructing Pseudo-Primes

When p and 2p -1 are prime, Fermat's test amounts to the computing of a Jacobi symbol. Indeed, Theorem 5.3 Let p be a prime such that q = 2p -1 is also prime. Let A ∈ QRq. Then B = pq passes Fermat's test in base A.

Proof:

A B ≡ (A p ) q ≡ A q ≡ A 2(p-1)+1 ≡ A mod p A B ≡ (A q ) p ≡ A p ≡ A (q-1)/2+1 ≡ A A q ≡ A mod q
By the Chinese remainder theorem, we find that A B ≡ A mod B.

From Gauss' quadratic reciprocity theorem, if q ≡ 1 mod 4 we can take q ≡ 1 mod A which guarantees that A ∈ QRq. To make 2 a quadratic residue modulo q we must have q ≡ ±1 mod 8. It is therefore easy to construct numbers that pass Fermat's test in a prescribed list of bases.

Constructing Strong Pseudo-primes

In this section we seek to generate numbers that are strongly pseudo-prime in base η, where η is prime. Let p denote a prime number such that q = 2p -1 is also prime, and N = pq. We have the following equations:

N -1 ≡ 0 mod p -1 N -1 ≡ q -1 2 mod q -1 n -1 2 ≡ p -1 2 mod p -1 n -1 2 ≡ 3 q -1 4 mod q -1
From there on, we will use the notation • • 4 to denote the quartic residue symbol. Theorem 5. [START_REF] Step | [END_REF] Let p be a prime such that q = 2p -1 ≡ 1 mod 8 is also prime. Let A be an integer such that

A p = -1, A q = +1, and A q 4 = -1.
Then N = pq passes the Miller-Rabin test in base A.

Proof: Note that if A (N -1)/2 ≡ -1 mod N , then n passes the Miller-Rabin test in base a. It then suffices to compute this quantity modulo p and q respectively:

A (N -1)/2 ≡ A (p-1)/2 ≡ A p ≡ -1 mod p A (N -1)/2 ≡ A 3(q-1)/4 ≡ A p 3 4
≡ -1 mod q.

Bases η > 5. Let η ≥ 7 be a prime number. We consider here the case p ≡ 5 mod 8, i.e. q ≡ 9 mod 16.

We will leverage the following classical result: Theorem 5.5 Let q be a prime number, q = A 2 + B 2 ≡ 1 mod 8 with B even. Let η be a prime number such that (p/η) = 1, then

η q 4 = 1 ⇔        η | B , or η | A and 2 η = 1 , or A ≡ µB where µ 2 + 1 ≡ λ 2 mod η and λ(λ+1) η = 1
We will also need the following easy lemmata:

Lemma 5.6 Let η ≥ 7 be a prime number, there is at least an integer Λ such that

Λ η = 2 -Λ η = -1. Proof: Let s 1 = # i ∈ F η , i η = +1, 2 -i η = +1, s 2 = # i ∈ F η , i η = +1, 2 -i η = -1, s 3 = # i ∈ F η , i η = -1, 2 -i η = +1, s 4 = # i ∈ F η , i η = -1, 2 -i η = -1, .
Then it is clear that s 1 + s 2 + s 3 + s 4 = η -2. The quantity s 1 + s 2 corresponds to the number of quadratic residues modulo η, except maybe 2. Therefore,

s 1 + s 2 = η -2 η 2 -1.
By symmetry between i and 2i, we have s 2 = s 3 . We also have

s 2 + s 3 = # i ∈ F η , i(2 -i) η = -1 = # i ∈ F * η , 2/i -1 η = -1 = # u ∈ F η , u = -1, u η = -1 = η + -1 η 2 -1.
From that we get the value of s 4 :

s 4 = η + 2 2 η --1 η -2 4 .
Therefore, for every η ≥ 7, s 4 > 0.

Choosing such an i, we denote λ the integer such that i = 1 + 1/λ mod η. Then,

1 + 1/λ η = 1 -1/λ η = -1 (λ + 1)λ η = (λ -1)λ η = -1 λ 2 -1 η = (λ + 1)λ η (λ -1)λ η = 1.
Let µ be such that µ 2 + 1 = λ 2 . We can thus construct λ and µ so that the third possibility of Theorem 5.5 is never satisfied.

Lemma 5.7 Let η ≥ 7 be a prime number, there is at least an integer x such that (x/η) = -1 and (2x-1/η) = +1.

Proof: As for the previous lemma, we show that there are

1 4 η + 2 2 η --1 η -2 such values of x,
which strictly positive for η ≥ 7.

For such an x, we write y = 2x -1 = z 2 mod η, A η = z/λ mod η, and B η = A η µ. We then have

A 2 η + B 2 η = (1 + µ 2 )A 2 η = λ 2 A 2 η = z 2 = y mod η If q = A 2 + B 2
≡ 1 mod 8 is prime, with B even, A ≡ A η mod η, and B ≡ B η mod η, then we see that the conditions of Theorem 5.5 are not satisfied, hence (η/q) 4 = -1. Furthermore, q ≡ y mod η so that (η/q) = +1. If we assume that p = (q + 1)/2 is prime, and that p ≡ 5 mod 8, then the conditions of Theorem 5.4 are satisfied. Indeed, p ≡ x mod η so that (η/p) = (x/η) = -1. Thus we generated a pseudo-prime in base η.

All in all, the results from this section are captured by the following theorem.

Theorem 5.8 Let η ≥ 7 be a prime number. There are integers A η , A η such that N = pq is strongly pseudo-prime in base η, provided that

                             q = A 2 + B 2 B is even A ≡ A η mod η B ≡ B η mod η q ≡ 9 mod 16 p = (q -1)/2 q is prime p is prime Base η = 2.
In that case the following theorem applies.

Theorem 5. 9 The integer N = pq is strongly pseudo-prime in base 2 provided that

                   q = A 2 + B 2 A ≡ 3 mod 8 B ≡ 4 mod 8 p = (q -1)/2 q is prime p is prime
Proof: From the conditions of Theorem 5.9, q ≡ 9 mod 16 and q ≡ 5 mod 8, which proves that 2 is a square modulo q and not modulo p, as it is not of the form α 2 + 64β 2 .

Bases η = 3 and η = 5. In both cases, we cannot find p and q such that the base is a square modulo q and not modulo p. As we will see in the next section this is not too much of a problem in practice. We can in any case ensure that the base is a quartic residue modulo q, using for instance the following choices:

A 3 = 1, B 3 = 0, A 5 = 1, B 5 = 0.

Combining Bases

Consider a set P of prime numbers, which will be used as bases. For each η ∈ P, we construct a η , b η as described in the previous section, using either the general construction (for η ≥ 7) or the specific constructions (for η = 2, 3, 5). Then we invoke the Chinese remainder theorem, to get three integers a P , b P , and m P such that N = pq is strongly pseudo-prime in all bases of P (except maybe 3 and 5),

provided that                              q = A 2 + B 2 B is even A ≡ A P mod m P B ≡ B P mod m P q ≡ 9 mod 16 p = (q -1)/2 q is prime p is prime
In fact, running the algorithm several times eventually yields an integer N that is also strongly pseudo-prime in bases 3 and 5.

Numerical Example

Consider P = {p 1 = 2, . . . , p 46 } the set of all primes smaller than 200. We get: This N can hence be used as the missing modulus needed to instantiate a "Step x" NS variant.

A P =

Extensions

Using Composite Moduli

In the y/z variants of our scheme, one might be tempted to replace p itself by an RSA modulus n, where φ(n) = 2ab. Indeed, the original NS construction allows for such a choice. Doing so, however, would immediately leak information about the factorisation of n:

Indeed, gcd(g a - 1, n) = p.
There is a workaround: First we choose p and q so that (p -1)/2 and (q -1)/2 are RSA moduli, i.e. p -1 = 2s 1 s 2 and q -1 = 2r 1 r 2 , with large s 1 , s 2 , r 1 , r 2 . Then we set n = pq, a = s 1 r 1 , and b = 2s 2 r 2 . Therefore φ(n) = 2ab as before, but the GCD attack mentioned above does not apply, and the modified y/z Naccache-Stern cryptosystem works.

Bandwidth Improvements

The idea described in this paper is fully compatible with the modifications introduced in [CNS08] to improve encryption bandwidth.

But there is even more: An interesting observation is that, upon decryption, it is possible to recover both the message m and the whitening x k . This is unlike most randomized encryption schemes, where the random nonce is lost. Thus we may contemplate storing some information in k, thereby augmenting somewhat the total information contained in a ciphertext. Alternatively, x k may also be used as key material if NS is used (in a hybrid mode) as a key transfer mechanism.

For instance, given a message m = m 1 m 2 , we may encrypt m 1 k using the blinding m k 2 with odd k. Upon decryption, one recovers k, and computes the k-th root of the blinding factor m k 2 -such a root is unique with overwhelming probability -thereby reconstructing the whole message.

One nontrivial research direction is to provide, in the message m, hints that make solving the discrete log modulo p easier and thereby embed directly information in k.

Mixed-radix Naccache-Stern encryption

Abstract

In this work we explore a combinatorial optimisation problem stemming from the Naccache-Stern cryptosystem. This work is published as [GN17a].

The Naccache-Stern (NS) modular knapsack cryptosystem encodes messages m = {m i } ∈ {0, 1} n as p m1 1 • • • p mn n mod p. For decryption to be possible, one must choose a large enough modulus p, namely

p > p 1 • • • p n .
In this work we consider the possibility to encode m as a mixed-radix representation -which is just another way to dispatch m's bits. This gives encodings of the form p µ1 1 • • • p µ , where for all i, 0 ≤ µ i ≤ w i are integers. The original NS corresponds to w i = 1.

One interest of such a representation is that some more weight could be put on the smallest primes p i , which are much smaller than the largest primes. As a result, more bits are available for encoding, using the same p i (and p) as the original NS. Note that decoding is not much harder than in the original NS case, as it suffices to iterate over the smoothness base at most max i w i times.

Mathematically, we consider the following problem:

Maximise i=1 log 2 (1 + w i ) Subject to w i ∈ N, i=1 w i log 2 (p i ) < log 2 (p)
w = {7, 4, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0}
we can encode 17-bit messages. Notice that the last two primes p 14 , p 15 are not used. This is a 13% increase in bandwidth, but it is arguably a small gain.

We now face several interesting questions: Does an optimal w always exist? How to find it? Is the gain marginal, or does it provide an (asymptotic or practical) advantage?

A daunting optimisation problem

Equation (5.1) can be reformulated, and simplified somewhat. First we may rewrite the objective as a polynomial in w i ; then we may further impose w i+1 ≤ w i for all 1 ≤ i ≤ . The resulting problem is not strictly equivalent as Equation (5.1), but a solution for this modified problem is also an optimal solution for the original problem.

         Maximise f (w) = i=1 (1 + w i ) Subject to w i ∈ N, w i+1 ≤ w i , i=1 w i log 2 (p i ) < log 2 (p).
(5.

2)

The linear constraints delimit a simplex, however the objective function is not itself linear, which prevents us from directly leveraging efficient linear programming techniques. Equation (5.2) belongs to a class of polynomial programming problems. Unfortunately,

Theorem 5.10 ([GJ79; DHK + 06])

The problem of minimizing a degree-4 polynomial over the lattice points of a convex polygon is NP-hard.

Brute-force exploration

Despite the problem's complexity, we may hope to exhaust all solutions for small enough instances. This can be achieved by backtracking, where we explore the combinatorial graph "from the end", i.e. with values of w as roots, w -1 as subroots, etc. One advantage of this approach is its simplicity; however it quickly runs out of steam as larger instances are considered. The solution of Example 5.1 was first computed this way.

It is interesting to compute the number of configurations that can be explored, i.e. the number of points in P ∩ Z n , where P is the polytope defined by the constraints of Equation (5.2). In dimension 2 one can use Pick's theorem, however there are no simple generalisations to higher dimensions of such a result. Rather, we may estimate the number of integer points as the volume of P :

N = |P ∩ Z n | ≈ vol(P ) = 1 n! n i=1 log pi p.
Assuming that all the p i are of similar size, this is approximately (log pn p) n /n!; by the prime number theorem we have log pn p = ln p/ ln(p n ) ≈ ln p/ ln(n ln n), so that

N ≈ (ln p) n n!(n ln n) n
Using p ≥ #75 ≈ 2 512 , we find N ≈ 2 82 , which is nearly beyond reach -and in any case impractical.

Fully polynomial-time approximation scheme

In the face of Theorem 5.10, and of the comments above, we will alter the problem: First we replace the logarithms by their rational approximation, the precision of which will be discussed later; Second we look for an approximation to the optimum, rather than the optimum itself.

Approximation problem. Having an approximate value for the maximum value f * = f ( w) taken by f on the optimal solution w provides us with a strategy: Lemma 5.11 Let P be an n-dimensional rational polytope. Assume that there exists a polynomial-time algorithm that computes f * over P ∩ Z n . Then there is a polynomial-time algorithm that finds a feasible solution w such that f *f (w) ≤ O( ).

Proof: We proceed by iterative bisection of P .

Remark. The expression "polynomial-time" refers here to an algorithm whose complexity is bounded above by a polynomial function of the encoding of f and P .

Therefore we first focus on finding efficiently an approximation for f * , from which an immediate algorithm follows (by Lemma 5.11), that provides an approximation to w.

Recall the classical fact that, for {x 1 , . . . , x n } a collection of non-negative real numbers,

max i x i = x ∞ = lim k→∞ x k where • k is the k -norm, from which we get n -1 k x k ≤ x ∞ ≤ x k .
Now, denote x i = f (w) for all w in the rational polytope P , and x = (x 1 , . . . , x N ), where

N = |P ∩ Z n |.
Then for all k > 0,

N -1 k x k ≤ x ∞ ≤ x k .
Phrased equivalently, the optimal solution, w = x ∞ , can be approximated by summing a polynomial in the points of P ∩ Z n . Namely: Lemma 5.12 Let > 0, then for k = (1 + 1/ ) log ,

x k 1 --1 k ≤ f ( w)
Remark. It is important to note at this point that we can expand the polynomial function f k as a list of monomials in polynomial time.

The only remaining question is whether we can compute x k in polynomial time.

Polynomial-time computation over P ∩ Z n . One difficulty is that P contains a priori an exponential number of integer points. Here is how to circumvent this apparent problem: Consider the generating formal (Laurent) series:

g(P ; z) = w∈P ∩Z n z w . (5.3)
Since P is bounded, the sum is in fact finite, and g(P ; z) is a formal (Laurent) polynomial for which we may expect a short rational representation.

Example 5.2 Consider P the interval [0, k], so that P ∩ Z = {0, . . . , k}. We have

g(P ; z) = w∈P ∩Z z w = k j=0 z j = z 0 + z 1 + • • • + z k = 1 -z k+1 1 -z .
The second line of the above equation gives a compact representation of g(P ; z), which is linear in n. In particular, one may count the points in P -i.e. compute the 1 -norm over the integer points of P -by carefully evaluating g(P ; z) at z = 1. Carefully refers to the 1z denominator, which requires us to use either residue methods, the Bernoulli-l'Hôpital rule, or a numerical approximation of the limit w 1 = lim z→1 g(P ; z).

Theorem 5.13 ([Bar94; BP99]

) There exists a polynomial-time algorithm for computing the rational generating function of a polyhedron P ⊆ R n given by rational inequalities.

Theorem 5.13 is constructive and provides an explicit algorithm, that we reproduce below. But first, observe that the knowledge of g(P ; z) is enough to compute the function Then

g(P, h; z) =
Dg(P ; z) = D 1 -z k+1 1 -z = z d dz z d dz 1 -z k+1 1 -z = z d dz z(1 -(1 + k)z k + kz 1+k ) (1 -z) 2 = z((k(z -1)(k(z -1) -2) + z + 1)z k -z -1) (z -1) 3 = z 1 + 4z 2 + 9z 3 + • • • + k 2 z k = g(P, h; z)
where h(z) = z 2 .

Lemma 5.14 Let h ∈ Z[w 1 , . . . , w n ] be a polynomial, then there is a differential operator D h such that D h g(P ; z) = g(P, h; z).

Proof: This is a straightforward extension of Example 5.3:

D h = h w 1 ∂ ∂w1 , . . . , w n ∂ ∂wn .
Combining this with Lemma 5.12, we see that the knowledge of g(P, f k ; z) gives the the desired approximate solution. Hence everything hinges on Theorem 5.13 being polynomial-time.

Definition 5.5 An algorithm

A is an -approximation algorithm for a constrained optimisation problem with optimal cost f * if, for each instance of the problem of encoding length N , A runs in poly(n) and returns a feasible solution with cost f A , such that f A ≥ (1 -)f * . Definition 5.6 A family {A } of -approximation algorithms is a fully polynomial-time approximation scheme (FPTAS) if the running time of A is poly(n, 1/ ).

Theorem 5. 15 Let f be a polynomial function over the integer points of a rational polytope P , and a rational number > 0, where f is given as a list of monomials with rational coefficients and integer exponents, then there exists a FPTAS for the maximisation problem for all polynomial functions f that are non-negative on the feasible region, i.e. an polynomial-time algorithm that computes a feasible solution x such that

|f (x ) -f * | ≤ f * Proof:
The algorithm is as follows: On input P , f , > 0,

1. Compute k = (1 + 1/ ) log(|P ∩ Z n |) (
LB k = g(P, f k ; 1) g(P ; 1) 1 k U B k = g P, f k ; 1 1 k These bounds satisfy U B k -LB k ≤ f * (|P ∩ Z n |) 1 k -1
7. Iteratively bisecting P (as in Lemma 5.11) we get a feasible solution that is (1 -)-optimal.

Every step is easily checked to run in polynomial time.

Algorithm 16: Barvinok's Algorithm [START_REF] Barvinok | A polynomial time algorithm for counting integral points in polyhedra when the dimension is fixed[END_REF] Input: Polyhedron P . Output: Short generating function g(P ; z).

1. Compute all vertices vi, and corresponding supporting cones Ci, of P 2. Triangulate Ci into simplicial cones Ci,j, keeping track of all the intersecting proper faces 3. Apply signed decomposition to the cones vi + Ci,j, to obtain unimodular cones vi + C i,j,l (again keeping track of all the intersecting proper faces)

4. Compute the unique integer point ai in the fundamental parallelepiped of every resulting cone vi + C i,j,l .

5. For each unimodular cone, the generating function is z a / n j=1 (1 -z b j ), where a is the integer point and bj are the cone's spanning vectors.

6. Compute the signed summation of all the cones, resulting in g(P ; z).

Mixed-radix linear-bandwidth Naccache-Stern encryption

Using [START_REF] Chevallier-Mames | Linear Bandwidth Naccache-Stern Encryption[END_REF], messages can be encoded by "packing" primes together. The resulting construction results in asymptotically linear bandwidth encryption.

• Setup(1 κ ) → pp. Let ≥ 1 and γ be two integers. We construct n "packs" containing γ small primes each, and pick a prime p such that • KeyGen(pp) → (sk, pk). Choose a random integer s | (p -1), and let

v i ← p 1/s i mod p for i = 1 to γn. Set sk ← q, pk ← {v i }. • Encrypt(pp, pk, m) → c. Write m in base b as m 0 , . . . , m n-1 , then {d i,j } ← unrank(m i ). Finally, c ← n-1 i=0 γ j=1 v di,j iγ+j mod p.
• Decrypt(pp, sk, c) → m. Compute c s mod p in N, factor over the smoothness base {p i } and recover each m i as m i ← rank({d i,j }).

The main appeal of this approach is that p can be made much smaller compared to the original cryptosystem. We can use the techniques described above to optimise each "pack". Let's illustrate this on an example.

Example 5. [START_REF] Step | [END_REF] Let n = 3, γ = 4, = 1, hence we will use the primes p 1 to p 12 , for which an admissible value of p is 4931. 5 Let s = 3079. The public key consists in the {v i }:

pack 1          v 1 = s √ 2 mod p = 1370 v 2 = s √ 3 mod p = 1204 v 3 = s √ 5 mod p = 1455 v 4 = s √ 7 mod p = 3234 pack 2          v 5 = s √ 11 mod p = 2544 v 6 = s √ 13 mod p = 3366 v 7 = s √ 17 mod p = 1994 v 8 = s √ 19 mod p = 3327 pack 3          v 9 = s √ 23 mod p = 4376 v 10 = s √ 29 mod p = 1921 v 11 = s √ 31 mod p = 3537 v 12 = s √ 37 mod p = 3747
To encrypt a message, it is written in base γ = 4 and the appropriate v i 's are multiplied; thus if m = 35 = 203 4 ,

c = v 4 • v 5 • v 11 mod p = 4484.
This cryptosystems allows the encoding of 6-bit messages.

There are two ways to introduce the mixed-radix approach: by choosing different pack sizes, for instance making the first pack larger, or by using varying powers of primes. The two approaches are related, as it might be more efficient to use e.g. a higher power of a small prime, rather than introducing a new large prime.

To illustrate the effect of pack-adjusting, assume that the packs have dimension γ 1 , γ 2 , γ 3 ; this allows the encoding of messages of log 2 γ 1 γ 2 γ 3 bits, under the condition that p γ1 p γ2+γ1 p γ1+γ2+γ3 < p. The choice γ 1 = 2, γ 2 = 4, γ 3 = 24 satisfies the constraints and allows for encoding 192 different messages, i.e. a little more than 7-bit messages. Alternatively, using γ 1 = γ 2 = 2, γ 3 = 16, we still encode 6-bit messages, but we can safely bring p down to 1493.

The optimisation problem corresponding to pack-adjusting can readily be addressed using the same tools as in Section 5.2.1, and we give the results for small values of n in Table 5.1. As is visible already in this table, the gain of pack-adjusting increases, achieving a 50% bandwidth improvement for larger values of n. However not all these candidates survived the test of time: Merkle and Hellman's knapsack-based cryptosystem [START_REF] Merkle | Hiding information and signatures in trapdoor knapsacks[END_REF], for instance, was broken by Shamir [START_REF] Shamir | A Polynomial Time Algorithm for Breaking the Basic Merkle-Hellman Cryptosystem[END_REF] using a now-classical lattice reduction algorithm [START_REF] Klaas Lenstra | Factoring polynomials with rational coefficients[END_REF].

Looking back on the history of public-key cryptography [START_REF] Koblitz | A Survey of Public-Key Cryptosystems[END_REF] it seems that almost every new cryptosystem comes with its cortege of new assumptions. As observed by Naor [START_REF] Naor | On Cryptographic Assumptions and Challenges (Invited Talk)[END_REF], Goldwasser and Kalai [START_REF] Goldwasser | Cryptographic Assumptions: A Position Paper[END_REF], we face an increase in the number of new assumptions, which are often complex to define, difficult to interpret, and at times hard to untangle from the constructions which utilize them [BBC + 13]. While being instrumental to progress and a better understanding of the field, new assumptions often shed doubt on the real security of the schemes building on them.

Encryption from signature. The origin of this paper draws from the following intuition: It should be possible to construct public-key cryptosystems from signatures, provided the signatures satisfy some generic properties. We describe below a generic framework to build cryptosystems from randomizable signatures, which concretizes this intuition. But then, looking at the internals of the signature schemes (especially [Wat05; PS15c]), we were surprised to find that it was in fact possible to decouple the public and private key.

More precisely, the public key material belongs to some group G 1 while the private key belongs to an unrelated group G 2 (which is not even necessarily public).

This feature enables us to substantially weaken the assumptions under which our construction is secure.,

Preliminaries

Public-key cryptosystems

Consider a plaintext space M = {0, 1} m , a key space K = {0, 1} k and a ciphertext space C = {0, 1} c . Recall that a public-key cryptosystem is usually defined as follows:

Definition 5.7 (Public-Key Cryptosystem) A public-key cryptosystem is a set of four algorithms:

• Setup(k) takes as input a security parameter k and outputs public parameters pp;

• KeyGen(pp) ∈ K 2 takes as input pp, and outputs a pair (sk, pk) of secret and public keys -we make the assumption that sk contains pk;

• Encrypt(pp, pk, m) ∈ C takes as input pk and a message m, and outputs a ciphertext c;

• Decrypt(pp, sk, c) ∈ {M, ⊥} takes as input sk and c, and outputs m or ⊥.

Setup, KeyGen and Encrypt may be randomized algorithms, but Decrypt is usually deterministic.

The strongest notion of security for a public-key cryptosystem is indistinguishability under adaptive chosen ciphertext attacks, defined in terms of the following game: A wins the game if b = b. The advantage of A in this game is defined as ) is negligible for all PPT adversaries A.

Adv IND-CCA2 K,A (k)
:= Pr [b = b ] - 1 2 A public-key cryptosystem K is IND-CCA2-secure if Adv IND-CCA2 K,A (k

Randomizable signature schemes

Digital signatures are fundamental cryptographic primitives. This paper focuses on signatures that have the additional property of being randomizable. A signature is randomizable if it is possible to turn any valid signature into an equally valid signature for the same message, using public key material and public parameters only. Randomizable signatures are interesting objects in their own right, as they enable the design of higher-level constructs such as anonymous credentials, direct anonymous attestations or group signatures.

Definition 5.9 (Signature Scheme) A signature scheme is a collection of four algorithms:

• Setup(k) takes as input a security parameter k and outputs a description pp of public parameters;

• KeyGen(pp) takes as input pp, and outputs a pair (sk, pk) of signing and verification keys -we make the assumption that sk contains pk;

• Sign(sk, m) takes as input sk and a message m, and outputs a signature σ;

• Verify(m, σ, pk) outputs 1 if σ is a valid signature for m under pk, and outputs 0 otherwise.

Setup, KeyGen and Sign may be probabilistic, while Verify is usually deterministic.

It is generally expected that Verify(m, σ, pk) = 1 if and only if σ = Sign(sk, m).

Definition 5.10 (Randomizable Signature Schemes) A randomizable signature scheme is a signature scheme endowed with an additional randomized algorithm ReRand(σ, pp) which takes as input a signature σ and a set of public parameters pp, and outputs a new signature σ = σ, such that σ is accepted by Verify if and only if σ is accepted by Verify.

The security of digital signature schemes is defined with respect to an adversarial goal and an attack model. We will consider the notion of computational indistinguishability from random noise, when the message is not known (IND$-KOA).

|Pr [t ← X n , D(t) = 1] -Pr [t ← Y n , D(t) = 1]| < (n)
In other words, two families of probability distributions are computationally indistinguishable if no efficient distinguisher can tell them apart better than with a negligible advantage. We write

{X n } c ≈ {Y n }.
Definition 5.12 (IND$-KOA-Security) A digital signature scheme Σ is IND$-KOA-secure if the distribution of signatures for an unknown message is computationally indistinguishable from the uniform distribution.

In the case of randomizable signatures, re-randomisation should produce a signature that is still indistinguishable from random noise given only public information. The following results shows that this holds in general:

Lemma 5.16 (Closure) Let {X n } and {Y n } be two families of probability distributions, and M be a PPT machine. Then

{X n } c ≈ {Y n } ⇒ {M (X n )} c ≈ {M (Y n )}.
Lemma 5.17 (Transitivity) Let m = poly(n) and X 1 , . . . , X m be a sequence of probability distributions. Assume there exists a distinguisher D telling X 1 and X m apart with probability . Then ∃i ∈ {1, . . . , m -1} such that D distinguishes X i from X i+1 with probability /m.

A direct corollary of Lemma 5.17 is that

X c ≈ Y and Y c ≈ Z ⇒ X c ≈ Z.
Proof: By assumption,

Pr t ← X 1 , D(t) = 1 -Pr [t ← X m , D(t) = 1] > .
Let g i ← Pr t ← X 1 , D(t) = 1 , so that the above equation is written |g 1g m | > . Using the triangle inequality,

|g 1 -g 2 | + • • • + |g m-1 -g m | ≥ |g 1 -g 2 + g 2 -g 3 + • • • + g m-1 -g m | = |g 1 -g m | > .
Therefore, there must exist an i such that |g ig i+1 | > /m. • Type 1, when G 1 = G 2 ;

Type 3 bilinear pairings

• Type 2, when G 1 = G 2 but there exists an efficiently computable homomorphism φ : G 2 → G 1 , while there does not exist efficient such maps exists in the reverse direction;

• Type 3, when G 1 = G 2 and no efficiently computable homomorphism between G 1 and G 2 exists, in either direction.

Example 5.5 Type 3 pairings can be constructed, for instance, on Barreto-Naehrig curves where G 1 is the group of F q -rational points (of order p) and G 2 is the subgroup of trace zero points in E(F q 12 )[p].

Example 5.6 Pointcheval and Sanders [START_REF] Pointcheval | Short Randomizable Signatures[END_REF] proposed the following randomizable digital signature scheme based on type 3 pairings:

• Setup(k) selects a type 3 pairing e : G 1 × G 2 → G T and a generator g of G 2 .

• KeyGen(pp) generates x, y ∈ Z, and computes X ← gx and Y ← gy . The signing key is sk ← (x, y), and the verification key is pk ← (X, Y ).

• Sign(sk, m) selects a random h $ ← -G 1 \ {1 G1 } and outputs σ ← (h, h x+my ).

• Verify(m, σ, pk) unpacks (σ 1 , σ 2 ) ← σ and outputs 1 if e(σ 1 , XY m ) = e(σ 2 , g), and 0 otherwise.

• ReRand(σ, pp) selects a random r $ ← -Z, where (σ 1 , σ 2 ) ← σ and outputs σ ← (σ r 1 , σ r 2 ). This signature is IND$-KOA-secure under the DDH assumption in G 1 .

From randomized signatures to public-key eencryption

Everything is now ready to give a description of our scheme-conversion paradigm. It builds on an existing randomizable signature, such as that of Example 5.6 (although, as we will see below, this particular example is not very exciting). We first describe the encryption and decryption of a single bit.

One-bit encryption

Let Σ = (Setup Σ , KeyGen Σ , Sign Σ , Verify Σ , ReRand Σ ) be a randomizable signature scheme, with a security parameter k. We construct the public-key cryptosystem K as follows:

• Setup K (k) := Setup Σ (k).
• KeyGen K (pp) is given in Algorithm 17.

Encrypt K (pp, pk K , b) ← random c if b = 0 ReRand Σ (pk K , pp) if b = 1 • Decrypt K (pp, sk K , c
) decrypts a ciphertext c as follows:

Decrypt K (pp, sk K , c) ← 1 if Verify Σ (κ, c, pk Σ ) = True 0 otherwise
Remark. It may be that distinguishing a Σ-signature from random is not a hard problem. To address this problem we can generate two messages κ 0 and κ 1 , and include their signature in the public key. In that case, to encrypt b, the sender randomises the signature of κ b .

Remark. Observe that in Algorithm 17 the signing key sk Σ is only used to compute the public key pk K , and is discarded afterwards. The security of this construction depends on the cryptographic properties of the underlying randomizable signature scheme Σ. The attack scenario is unusual, since the signed message κ, as well as the verifying key pk Σ , are unknown to the adversary. Precisely, we require Σ to satisfy the following property:

Definition 5.15 (Unlinkability) Given a signature σ, a number σ , and public information {pp, pk K }, there is no efficient way to tell whether σ is a randomization of σ.

Remark. Note that unlinkability implies that Σ is a blind signature: signing does not reveal the message m being signed. Thus, unlinkability ensures that m and sk K remain private.

Remark. If furthermore Σ is IND$-KOA-secure, then two signatures randomizations remain indistinguishable from one another, and from random (through Lemma 5.17), for the adversary.

Example 5.7 The signatures of Example 5.6 are unlinkable under the DDH assumption in G 1 .

Multi-bit constructions

The one-bit construction is simple but very limited, akin in that respect to a construction by Goldwasser and Micali [START_REF] Goldwasser | Probabilistic Encryption and How to Play Mental Poker Keeping Secret All Partial Information[END_REF]. We describe here some generic multi-bit constructions that work for any randomizable signature scheme.

• Multi-encryption: A naive generalisation consists in using n times the scheme, to encrypt n bits individually. This strategy is efficient, but obviously produces very large ciphertexts.

• Permutations : message m encodes a permutation on elements6 . We assume a public-key pk K generated in the following way:

-Choose bitstrings κ i $ ← -{0, 1} k -Publish pk K ← {Sign Σ (sk Σ , κ 1 ), . . . , Sign Σ (sk Σ , κ )}
To encode m, we can randomize all pk K,i and shuffle pk K according to the permutation encoded by m. Using this encoding the cryptosystem achieves a bandwidth of log 2 ( !) bits.

• Improved permutations : This can be further improved by allowing both randomizations of pk K,i and random numbers. Using this encoding, we reach a bandwidth of

W = log 2 α=1 α! 2 -α bits.
An exact formula for this sum can be derived (in terms of the exponential integral) but it suffices to say that W > 128 for > 34.

Remark. More efficient encodings are possible when the underlying signature Σ has additional, homomorphiclike properties.

New public-key cryptosystems

As an instance of the generic construction described in Section 5.3.3, we leverage bilinear pairings to assemble new public-key cryptosystems.

Split ElGamal

The first example, and the simplest, is to apply our construction to the signature of Example 5.6. The resulting cryptosystem is akin to ElGamal [START_REF] Elgamal | On Computing Logarithms Over Finite Fields[END_REF], with two independent keys, which we therefore dub split ElGamal.

In that setting, we have M = {0, 1},

K 1 = C = G 2 1 , K 2 = G 2 × Z p .
The scheme is defined by the following algorithms:

• Setup K (k) selects a type 3 pairing e, G 1 , G 2 , G T , with groups of prime order p ≈ 2 k . Only G 1 needs to be known publicly, the other groupes and e are kept private.

• KeyGen K (pp) selects uniformly at random h

$ ← -G 1 , g $ ← -G 2 , s $ ← -Z p , and outputs sk ← (g, s) ∈ G 2 × Z p and pk ← (h, h s ) ∈ G 2 1 . • Encrypt K (pp, pk K , b) returns c $ ← -G 2 1 if b = 0; otherwise it selects a random r $ ← -Z p and returns c ← (h r , h rs ).
• Decrypt K (pp, sk K , c) reads a, b ← c and outputs 1 if e(a, g s ) = e(b, g); otherwise it outputs 0.

The multi-bit extension described in Section 5.3.3.2 applies to this construction.

Note that the pairing is absolutely not necessary here: We could work in G 1 only and replace the decryption procedure by a simple equality check in G 1 -this is, quite anticlimactically, vanilla ElGamal.

Encryption from SPS

Structure-preserving signatures (SPS) [AFG + 10] are pairing-based signatures where everything -messages, signatures and public keys -are group elements. Verification of such signatures is performed by testing equality of products of pairings between group elements. SPS can yield efficient protocols, that are provably secure under standard cryptographic assumptions, without the use of random oracles.

But above all, many of these schemes are rerandomisable [AGH + 11; ACD + 12; Gha16; AGO + 14; LPY15; FHS15; Gha13; CM15; BFF + 15; Gro15] and can be proven secure, either in the generic group model (GGM, [START_REF] Shoup | Lower Bounds for Discrete Logarithms and Related Problems[END_REF]), or based on well-established, constant-size number theoretic assumptions such as the k-Lin or the Symmetric eXternal Diffie-Hellman (SXDH) assumptions [START_REF] Boneh | Short Group Signatures[END_REF].

To illustrate the construction, let's recall Ghadafi's SPS [START_REF] Ghadafi | Short Structure-Preserving Signatures[END_REF], secure against existential forgery in the generic group model:

• Setup Σ (k) selects a type 3 pairing e, G 1 , G 2 , G T , with groups of prime order p ≈ 2 k . The public parameters include a generator h of G 1 and a generator g of G 2 .

• KeyGen Σ (pp) picks x, y $ ← -Z p , and set sk = (x, y), pk = (X = g x , Y = g y ) ∈ G 2 .

• Sign Σ (pk, m) considers a message m = (m 1 , m 2 ) from the "Diffie-Hellman pairs" G:

G = {(a, b) | (a, b) ∈ G 1 × G 2 ,

On the hardness of the Mersenne low Hamming ratio assumption Abstract

In a recent paper [AJP + 17], Aggarwal, Joux, Prakash, and Santha (AJPS) describe an ingenious public-key cryptosystem mimicking NTRU over the integers. This algorithm relies on the properties of Mersenne primes instead of polynomial rings. The security of the AJPS cryptosystem relies on the conjectured hardness of the Mersenne Low Hamming Ratio Assumption, defined in [AJP + 17].

This work shows that AJPS' security estimates are too optimistic and describes an algorithm allowing to recover the secret key from the public key much faster than foreseen in [AJP + 17].

In particular, our algorithm is experimentally practical (within the reach of the computational capabilities of a large organization), at least for the parameter choice {n = 1279, h = 17} conjectured in [AJP + 17] as corresponding to a 2 120 security level. The algorithm is fully parallelizable. This is joint work with Marc Beunardeau, Aisling Connolly, and David Naccache. The corresponding paper was presented at the 5 th International Conference on Cryptology and Information Security in Latin America, Latincrypt 2017, in La Habana, Cuba; and has been published as [BCG + 17b].

Introduction

A Mersenne prime is a prime of the form 2 n -1, where n > 1 is itself prime.

In a recent paper [AJP + 17], Aggarwal, Joux, Prakash, and Santha (AJPS) describe an ingenious publickey cryptosystem mimicking NTRU over the integers. This algorithm relies on the properties of Mersenne numbers instead of polynomial rings. This scheme is defined by the following algorithms:

• Setup(1 λ ) → pp, which chooses the public parameters pp = (n, h) so that p = 2 n -1 is prime and so as to achieve a λ-bit security level. In [AJP + 17] the following lower bound is derived

n -1 h -1 > 2 λ
which for instance is satisfied by λ = 120, pp = (n = 1279, h = 17).

• KeyGen(pp) → (sk, pk), which picks F, G two n-bit strings chosen independently and uniformly at random from all n-bit strings of Hamming weight h, and returns sk ← G and pk ← H = F/G mod (2 n -1).

• Encrypt(pp, pk, b ∈ {0, 1}) → c, which picks A, B two n-bit strings chosen independently and uniformly at random from all n-bit strings of Hamming weight h, then computes c ← (-1) b (AH + B) mod (2 n -1).

• Decrypt(pp, sk, c) → {⊥, 0, 1}, which computes D = Gc mod (2 n -1) and returns

     0 if D ≤ 2h 2 , 1 if D ≥ n -2h 2 , ⊥ otherwise
We refer the reader to [AJP + 17] for more details on this cryptosystem which does not require further overview because we directly attack the public key to infer the secret key.

In particular, security rests upon the conjectured intractability of the following problem:

Definition 5. 16 The Mersenne Low Hamming Ratio Assumption states that given an n-bit Mersenne prime p = 2 n -1 and an integer h, the advantage of any probabilistic polynomial time adversary attempting to distinguish between F/G mod p and R is at most

poly(n) 2 λ
, where R is a uniformly random n-bit strings, and (F, G) are independently chosen n-bit strings each having Hamming weight h.

As we will see, we argue that (F, G) can be experimentally computed from H, at least for the parameter choice {n = 1279, h = 17} conjectured in [AJP + 17] as corresponding to a 2 120 security level.

The full code (Python for partition sampling and Mathematica for lattice reduction) is available from the authors upon request.

Outline of the Analysis

The analysis uses the Lenstra-Lenstra-Lovász lattice basis reduction algorithm (LLL, [START_REF] Klaas Lenstra | Factoring polynomials with rational coefficients[END_REF]). We do not recall here any internal details of LLL but just the way in which it can be used to solve a linear equation with k unknowns when the total size of the unknowns is properly bounded.

Using LLL to Spread Information

Let x 1 , . . . , x k ∈ N * be k unknowns. Let p ∈ N be a modulus and a 0 , . . . , a k ∈ N. Consider the equation:

a 0 = k i=1 a i x i mod p.
All the reader needs to know is that the LLL algorithm will find x 1 , . . . ,

x k if k i=1 x i < p.
In particular, LLL can be adapted to provide any uneven split of sizes between the x i as long as the sum of those sizes does not exceed the size of p. More details on the theoretical analysis of LLL in that setting and variants are given in [NS01, Sec. 3.2] and [Jou09, Chap. 13], in the context of generalised knapsack problems.

Partition and Try

The first observation that attracted our attention is that the size7 of F (and G) has an unusually small expectation σ(n, h):

σ(n, h) = n 1 + (1 -h n ) n+1 -1 h n (n + 1)
The difference in size between n = 1279 and σ(1279, 17) is not huge 8 and cannot be immediately exploited. However, the same phenomenon also occurs at the least significant bits and further shortens the expected nonzero parts of F and G by 70 bits.

Similarly, assume that in the key generation procedure, both F and G happen to have bits set to 1 only in their lower halves. When this (rare event) happens, we can directly apply LLL to H to recover F and G. We call this event T .

Is that event rare? Since F and G are chosen at random, T happens with probability at least 2 -2h . While T 's probability is not cryptographically negligible, this pre-attack only allows to target one key out of 2 2h . For the first suggested parameter set (λ = 120), one public key out of 67 million can be attacked in this fashion and its F and G recovered, i.e., a total break. The question is hence, can this phenomenon be extended to any key? and if so, at what cost? In particular, can we sacrifice work to increase the size of the vulnerable key space? The answers to these questions turn out to be positive, as we will explain hereafter.

Random partitions. Instead of a fixed partition of {0, . . . , n -1}, we can sample random partitions, for instance by sampling (without replacement) m positions, which are interpreted as boundaries between regions of zeros and regions that possibly contain a 1. The total number of regions, m + 1, determines the dimension of the lattice being reduced.

For the sake of simplicity we consider balanced partitions: Definition 5.17 A partition of {0, . . . , n -1} into m/2 type 1 blocks and m/2 + 1 type 2 blocks is balanced if the total size of the type 1 blocks and the total size of the type 2 blocks differ by at most one. 9A randomly sampled partition is not necessarily a balanced partition: we use rejection sampling to ensure the balancing property. 10 The sought-after property of these partitions is the following: Definition 5.18 Let X be a binary string of length n. A partition of X into m/2 type 1 blocks and m/2 + 1 type 2 blocks is correct for X if the type 2 blocks are completely made of zeros.

Figure 5.1 illustrates the partitions that we are interested in on a simple example. Also note that the definition above does not put any constraint on type 1 blocks, which may contain zeros or not; since they are not guaranteed to be zero we refer to them as "non-zero" blocks. Accordingly, blocks of type 2 in a correct partition is referred to as "zero" blocks. 1: An illustration of the partitions that we are interested in: in these diagrams, a black square in F or G represents a 1, while white squares represent 0s. The partitions f and g are balanced and correct for F and G respectively, with "zero" blocks coloured white, and "non-zero" blocks coloured black. The vertical dashed lines show how F and G align with their respective partitions.

The observation at the beginning of this section is that using a balanced partition that is correct for F and another one that is correct for G, we can recover F and G from H.

Since F and G are unknown, we cannot construct a correct partition from them directly; but the probability that a random balanced partition is correct for F (resp. G) is lower bounded11 by 2 -h . Assuming that F and G are independent, which they should be according to the key generation procedure, we found a correct partition for both F and G with a probability of 2 -2h .

Remark. We may also consider imbalanced partitions which allow an extra speed-up for a subtle reason: Given that the unknowns found by LLL have a low Hamming density, the odds that these numbers naturally begin by a sequence of zeros (and are hence shorter than expected) is high. The interesting point is that the total length of such natural gains sums up and allows to unbalance the partition in favor of type 1 blocks. Consider the analogy of a fishing boat that can carry up to 1000 kilograms of fish. The fishermen fishes with 3 nets having maximal capacities of 200, 300 and 500 kilograms each. Because waters are sparse in fish, the nets are expected to catch only 70% of their maximal capacity. Hence, we see that larger nets (285, 428, 714) can be used to optimize the boat's fishing capacity. However, unlike the boat, with LLL fish cannot be thrown back to the water and... excess weight sinks the boat (the attack fails). Hence if this speed-up strategy is used, we need to catch more than normal but not be too greedy. Note as well that if all variables end by at least trailing (LSB) zeros then these m zeros add-up to the gain as well (because there is no constant term in the equation a division of all variables by 2 has no effect on the solution's correctness). We did not exploit nor analyze these tricks in detail.

Trying partitions. The attack then consists in sampling a balanced partition, running LLL, and checking whether the values of F and G obtained from the reduction have the correct Hamming weight and yield H by division. Concretely, the matrix to be reduced is obtained as follows from the partitions f of F and g of G:

1. Compute the size of the each non-zero blocks in f and g, we call these sizes u = {u i } and v = {v i } respectively, with i = 0, . . . , m/2 -1. Let w = max i {u i , v i }.

2. Construct the vector s = s i as follows:

s i = 2 w-vi if i < m/2 2 w-ui if m/2 ≤ i < m 3.
Construct the vector a = {a j } as follows: let f i (resp. g i ) denote the starting position of the non-zero blocks in F (rep. G), and set

a j = H × 2 gi mod p if j < m/2 p -2 fi if m/2 ≤ j < m 4.
Choose an integer K, and assemble the matrix M as follows:

M = diag(s) Ka 0 Kp
where diag(x) is the diagonal matrix whose diagonal entries are given by x. The coefficient K is a tuning parameter, which we set to 2 1200 .

5. Finally, we use LLL on M (using the Mathematica command LatticeReduce) and recover the reduced matrix's row that complies with the Hamming density of F and G. This row is expected to give the values of the non-zero blocks of F and G, and we can check its correctness by computing its Hamming weight, and checking that the ratio of the candidate values modulo p give H.

By the above analysis, a given partition is correct with probability 2 -2h , which for λ = 120 is only 2 -34 ; if we can run LLL reasonably fast, which is the case for m = 16, an efficient attack happens to be within the reach of a well-equipped organization. Experimental evidence indeed suggests the feasibility of the attack, see Section 5.4.3.

Remark.

For larger security parameters λ, the ratio h/n deduced from the analysis in [AJP + 17] asymptotically vanishes. It should be checked if this influences imbalanced partition finding to the attacker's relative advantage for larger values of λ. We did not explore this avenue left to the reader as a potential research question.

Putting it Together

To illustrate the attack's feasibility, we fix a random tape in a deterministically verifiable way and implement our algorithm (see Figure 5. We generated a nothing-up-our-sleeves key with the procedure of Figure 5.3. The sample(S, h) procedure selects h indices without replacement in the range S. It is implemented12 by returning the h first entries of a deterministic Fisher-Yates shuffle of S. The randomness in sample(S, h) is simulated by iterating the SHA256 function, starting with the seed given by the ASCII representation of the 100 first decimals of π: In a real attack we would simply use a fast non-cryptographic random number generator, but the above choice serves the purpose of reproducibility.

31415926535897932384626433832795028841971693993751 05820974944592307816406286208998628034825342117068 1. n, h ← pp 2. I1 = {i1, . . . , i h } ← sample({0, . . . , n -1}, h) 3. I2 = {i1, . . . , i h } ← sample({0, . . . , n -1}, h) 4. F ← h i∈I 1 2 i 5. G ← h i∈I 2 2 i 6. return (sk = G, pk = F • G -1 mod p)
This gives the following (in hexadecimal notation, the zero MSBs have not been written): respectively for F and G, which upon lattice reduction yield candidates of the correct Hamming weight.

I 1 = {33,
Their ratio indeed gives H; however one may debate our claim that this partition was found at random and argue that we constructed it from our prior knowledge of F and G.

To counter this argument and insist that finding partitions is reasonably easy, we derived them deterministically from the same seed as the key. To achieve this, we proceed as follows: we draw two independent sets of m/2 -1 indices in the range [0, n/2], which gives the sizes of the zero blocks and the non-zero blocks. This guarantees that the partitions are balanced. The randomness used for this sampling is obtained by iterating SHA256 as for key generation.

As in the example above, we constructs partitions for m = 16 -this choice is not dictated by probability (as the likelihood to find a correct partition is in theory independent of m), but rather by a trade-off between the cost of LLL and the number of partitions explored. It is possible for instance to start with m = 2 partitions, then m = 3, and so forth, but we settled for a random search which is easier to implement.

We found the following partition for F at run #1,152,006 (in 116 s):

f = {27, b2, 10e, 13c, 198, 1cf, 24b, 27b, 2ac, 30f, 3e1, 456, 45a, 4ba, 4d6, 4fd}

Recovering F alone took about two minutes. 13 Given that we have a totally deterministic random tape, we regard our experiment as legitimately reflecting reality. Because F and G are independent, this brings the total effort to about the square of this number, i.e. about 2 34 attempts to get both partitions with certainty.

Each of these attempts must also involve one LLL, which is the main cost factor. Using the same sequence, #64,249 gave a partition for G too (in 7.6 s): Finally, note that the task is fully parallelizable and would benefit from running on several independent computers, a remark that we will later use in our final workfactor estimates.

g = {7b, 11c,
Computing the Secret Key Running our program as explained in Section 5.4.2, we recover F , G, and confirm that H = F/G mod p.

Predicting the Total Execution Time

Putting all the above figures together and assuming no further algorithmic improvements, the total expected effort is:

(LLL_Time + 2 × Partition_Time) × Average_Partition_Tries 2

Number_of_Processors

Where, in our basic scenario Average_Partition_Tries = 2 h . We performed LLL on Mathematica using the LatticeReduce function, which took less than a second in the worst case on a simple laptop. We safely assume that this figure can be divided by 10 using a dedicated and optimized code. We also assume that a credible attacker can, for example, very easily afford buying or renting 150 TILE-Gx72 multicore processors. Hence, according to the evidence exhibited in this paper, breaking a 1279 bit key takes a week using 150 currently available multicore processors (e.g. TILE-Gx72).

Conclusion

While we did not formally evaluate efficiency nor asymptotic complexities, our quick and dirty experiments clearly suffice to show that key recovery is fast and within reach. An obvious countermeasure consists in increasing parameter sizes. Hence a precise re-evaluation of parameter sizes and safety margins of the Mersenne Low Hamming Ratio Assumption seems in order. More systemic protections may consist in modifying the definition of H (and possibly the underlying cryptosystem) which is clearly a very interesting open problem.

Nonetheless the beautiful idea of Aggarwal, Joux, Prakash, and Santha exploiting the fact that arithmetics modulo Mersenne numbers is (somewhat) Hamming-weight preserving, is very elegant and seems very rich in possibilities and potential cryptographic applications.

Introduction

CAPTCHAs 14 [ABH + 03] are problems that are hard to solve by computers, while being at the reach of most untrained humans. There might be many reasons why, at a particular time, a given type of CAPTCHA is considered hard for computers. The automated solving of CAPTCHAs may either require more computational power than is available, or algorithms have yet to be invented. It might well be that computers are inherently less efficient, or even incapable, at some tasks than human beings. Whichever the cause, several candidate CAPTCHAs are widely used throughout the Internet to keep robots at bay, or at least slow them down (e.g. [EDH + 07; CGJ + 08; AMM + 07; CB03; NAS + 14; SHL + 10]).

Most CAPTCHAs are used as human-interaction proofs [START_REF]Human Interactive Proofs, Second International Workshop, HIP 2005[END_REF] but their full potential as cryptographic primitives has not been leveraged so far despite a few exploratory papers. Early attempts [Dzi10; CHS06; ABH + 03; CHS05] faced the inherent difficulty of malleability: given a CAPTCHA Q, an adversary could generate Q , whose solution gives a solution to Q. Thus the security of such constructions could only be evaluated against unrealistic "conservative adversaries" [KOP + 13]. All in all, we propose to fill the gap by providing a finer taxonomy of CAPTCHAs as well as cryptosystems based on them, which can reach real-life security standards.

The organisation of this paper is as follows: Section 5.5.1 defines the classes of problems we are interested in, and estimates how many of those problems can be solved per time unit. We then refine the classical CAPTCHA concept into Decisional and Existential CAPTCHAs. Section 5.5.2 describes how to implement public-key encryption using Decisional CAPTCHAs; Section 5.5.3 describes a short passwordbased encryption mode that uses Existential CAPTCHAs to wrap high-entropy keys. Section 5.5.4 presents Decisional and Existential CAPTCHA candidates.

Preliminaries and definitions

CAPTCHA problems

Let Q be a class of problem instances, A a class of answers, and S a relation such that S(Q, A) expresses the fact that "A ∈ A is a solution of Q ∈ Q". Solving an instance Q of problem Q means exhibiting an A ∈ A such that S(Q, A). We assume that for each problem there is one and only one solution, i.e. that S is bijective. This formal setting (similar to [KOP + 13; CHS06]) allows us to provide more precise definitions.

Because CAPTCHAs involve humans and considerations about the state of technology, we do not pretend to provide formal mathematical definitions but rather clarifying definitional statements.

Definition 5.19 (Informal)

A given problem Q ∈ CP (CAPTCHA Problem) if no known algorithm can solve a generic instance Q ∈ Q with non-negligible advantage over 1/|A|, which is the probability to answer Q correctly at random; yet most humans can provide the solution A to a random Q ∈ R Q with very high probability in reasonable time.

In Definition 5.19, it is worth pointing out that future algorithms might turn out to solve efficiently some problems that evade today's computers' reach. As such, CP is not so much a complexity class as it is a statement about technology at any given point in time.

There exist today several approaches to building CAPTCHAs, based for instance on deformed word recognition, verbal tests, logic tests or image-based tasks. We are chiefly interested in those tests that can be automatically generated.

We extend CP in two ways: Remark. Definition 5.21 depends on the set Q. We silently assume that, for a given problem Q, an appropriate Q is chosen. This choice makes no difference.

Definition 5.20 (Informal) A given problem Q ∈ DCP (Decisional CP) if Q ∈ CP
When Q is not exhaustively searchable, Definition 5.21 means that a computer cannot decide whether a given Q is a CAPTCHA or not, let alone solve

Q if Q is indeed a CAPTCHA.
Remark. Definition 5.21 can be reformulated similarly to the IND-CPA [START_REF] Naor | Public-key Cryptosystems Provably Secure against Chosen Ciphertext Attacks[END_REF] security game: we pick a random bit b and provide the adversary with Q b , where Q 0 ∈ Q and Q 1 ∈ Q. The adversary is expected to guess b no better than at random unless it resorts to human aid.

Remark. ECP, DCP ⊆ CP, but there is no inclusion of ECP in DCP or vice versa. Informally, CP is about finding an answer, DCP is about checking an answer, and ECP is about recognizing a question.

Remark. Solving a problem Q ∈ CP is either done using computers which by definition provide unreliable answers at best; or by asking a human to solve Q -effectively an oracle. However, there is a limit on the number of solutions humans can provide and on the rate at which humans can solve CAPTCHAs.

Consider a given Q ∈ CP whose generic instances can be solved by a human in reasonable time. Let us estimate an upper bound b on the number of instances of Q that a human may solve during a lifetime. Assuming a solving rate of 10 instances per minute, and working age of 15-75 years, spent exclusively solving such problems, we get b ∼ 10 8 . Taking into account sleep and minimal life support activities, b can be brought down to ∼ 10 7 .

There should be no measurable difference between solving a problem in CP or in DCP, however it might be slightly simpler (and therefore quicker) for humans to identify whether a problem is a CAPTCHA without actually solving it. For simplicity we can assume that CAPTCHA recognition is ten times faster than CAPTCHA resolution.

There are various estimations on the cost of having humans solve CAPTCHAs. Some websites offer to solve 1000 CAPTCHAs for a dollar 15 . Of course, the oracle may employ more than one human, and be proportionally faster, but also proportionally more expensive.

Human public-key encryption

We now describe a public-key cryptosystem using problems in DCP. Let Q ∈ DCP. We denote by H(m) a cryptographic hash function (e.g. SHA-3) and by E k (m) a block cipher (e.g. AES-128). Here, m is the plaintext sent by Bob to Alice.

• Key-pair generation: The public key pk is a list of b instances of

Q pk = {Q 1 , . . . , Q b }
The private key is the set of solutions (in the CP sense) to the Q i :

sk = {A 1 , . . . , A b } i.e. for 1 ≤ i ≤ b, S(Q i , A i ) holds true.
• Encryption: Bob wants to send m to Alice. Bob picks k random problems {Q i1 , . . . , Q i k } from Alice's pk, and solves them 16 . Let σ ← {A i1 , . . . , A i k } and α ← {i 1 , . . . , i k }. Bob computes κ ← H(α) and c ← E κ (m), and sends (σ, c) to Alice.

• Decryption: Given σ, Alice identifies the set of indices α and computes κ ← H(α). Alice then uses κ to decrypt c and retrieve m. Decryption does not require any human help.

The general idea of this cryptosystem is somewhat similar to Merkle's puzzles [START_REF] Ralph | Secure Communications Over Insecure Channels[END_REF], however unlike Merkle's puzzle here security is not quadratic, thanks to problems in CP not being automatically solvable. We may assume that the A i s are pairwise different to simplify analysis.

Remark. Indeed if Q ∈ CP it might be the case that a machine could decide if given A, Q the relation S(A, Q) holds without solving Q. Hence Q must belong to DCP. Remark. The main drawback of the proposed protocol is the size of pk. Assuming that each Q i can be stored in 20 bytes, a pk corresponding to b ∼ 10 8 would require 2 GB. However, given that CAPTCHAs are usually visual problems, it is reasonable to assume that pk might turn out to be compressible.

Remark

Remark. Instead of sending back the solutions σ in clear, Bob could hash them individually. Hashing would only make sense as long as solutions have enough entropy to resist exhaustive search.

Remark. It is possible to leverage the DCP nature of the Q i s in the following way: instead of sending a random permutation of solutions, Bob could interleave into the permutation d random values (decoy answers). Alice would spot the positions of these decoy answers and both Alice and Bob would generate α = {i 1 , . . . , i k , j 1 , . . . , j d } where j d are the positions of decoys. Subsequently, security will grow to b k+d /d!. This is particularly interesting since for b = 10 7 , k = 1 and d = 6 we exceed 128-bit security. In other words, all the sender has to do is to solve one CAPTCHA.

Entropy can be further increased by allowing d to vary between two small bounds. In that case the precise (per session) value of d is unknown to the attacker.

Short password-based encryption

In the following scenario Alice and Bob share a short password w. We will show how a message m can be securely sent from Alice to Bob using only w. This is particularly suited to mobile devices in which storing keys is risky.

Let Q ∈ ECP ∩ DCP.

• Alice generates a full size 17 key R and uses it to encrypt m, yielding c 0 ← E 0|R (m). She generates an instance Q ∈ Q, such that S(P, R). Alice computes c 1 ← E 1|w (P ) and sends (c 0 , c 1 ) to Bob.

• Bob uses w to decrypt c 1 , and solves P . He thus gets the key R that decrypts c 0 . 16 Here Bob must resort to human aid to solve {Q i 1 , . . . , Q i k }. 17 e.g. 128-bit.

An adversary therefore faces the choice of either "attacking Shannon" or "attacking Turing", i.e. either automatically exhaust R, or humanly exhaust w. Each candidate w yields a corresponding P that cannot be computationally identified as a CAPTCHA. The adversary must hence resort to humans to deal with every possible candidate password.

Assuming that CAPTCHA identification by humans is ten times faster than CAPTCHA resolution, it appears that w can be a 5-character alphanumeric code 18 .

Remark. R must have enough entropy bits to provide an acceptable security level. R can be generated automatically on the user's behalf. As we write these lines we do now know if there exists Q ∈ ECP ∩ DCP admitting 128-bits answers. If such Qs do not exist, R could be assembled from several problem instances.

Remark. In the above we assume that R is generated first, and then embedded into the solution of a problem instance P . All we require from R is to provide sufficient entropy for secure block cipher encryption. Hence, it might be easier to generate P first, and collect R afterwards.

Remark. The main burden resting on Bob's shoulders might not be the solving on P but the keying of the answer R. 128 bits are encoded as 22 alphanumeric characters. Inputting R is hence approximately equivalent to the typing effort required to input a credit card information into e-commerce website interfaces 19 . Alternatively, Bob may as well read the solution R to a speech-to-text interface that would convert R into digital form.

Remark. Q ∈ ECP ∩ DCP is necessary because the adversary may partially solve Q and continue using exhaustive search. Under such circumstances, c 0 serves as a clue helping the attacker to solve Q. If Q ∈ ECP ∩ DCP, such a scenario is avoided.

DCP and ECP candidate instances

The above constructions assume that ECP and DCP instances exist and are easy to generate. Because ECP and DCP depend both on humans and on the status of technology, it is difficult to "prove" the feasibility of the proposed protocols.

We hence propose a DCP candidate an ECP candidates and submit them to public scrutiny. As a simple way to generate DCPs, we propose to start from a standard CP (e.g. a number recognition problem) and ask a further question about the answer. The further question should be such that its answer may correspond to numerous potential contents. For instance, the further question could be whether two sequences of digits recognised in an image Q sum up to A = 91173 or not (see Figure 5.4).

ECP candidates

This section proposes a few candidate Q that we conjecture to belong to ECP.

The first step is to design a task that we think is challenging for computers. Despite recent progress (see e.g. [GBI + 13]), computer vision is still expensive and limited. Most computer vision algorithms have to be trained specifically to recognise objects or features of a given kind (dog breeds, handwritten characters, etc.), and fail whenever the task at hand requires more than mere object identification. Even in that case, ? Even if image contents can be detected, we can still pose a hard challenge. Indeed, while computers excel at solving logical reasoning questions when those questions are encoded manually as logical formulae, state of the art algorithms fail at even the most basic questions when challenges are presented in visual form. Therefore, solving for instance a visual-logical task is a problem that is at least in DCP (see Figure 5.5).

Good ECP candidates for cryptographic purposes should be easy to generate, they should have enough possible solutions to thwart exhaustive search attempts, and it should be hard to tell automatically whether there is a solution at all. Temporal sequence ECP. The intuition for this candidate is that although computer vision algorithms may reach human accuracy (and even beat it), humans can make use of external knowledge, which provides additional understanding of what is under scrutiny. Here the external knowledge is that real-life events abide by causality.

We provide k images (e.g. k = 5), each of which is a snapshot of some situation: buying goods, driving a car, dressing up, etc. The order of images is scrambled (some random images may be inserted as decoys) and the problem is to put images back in the correct order. This task, which we call temporal sequence, requires the contextual knowledge that some events can only happen after (or before) others. This is illustrated in Figure 5.6.

We conjecture that the temporal sequence task is both in DCP and in ECP.

One drawback of this approach is that to reach an 80-bit security level we need k = 40 images20 which can be unwieldy. This may be solved by using collections of κ images, and tune , κ so that (κ!) > 2 80 .

Temporal sequences may be automatically generated from videos, although it is not obvious how to ensure that sequences generated like this are always meaningful to humans. Figure 5.7: Visual Letter Recognition ECP: letters are concealed using an existing CP, and one digit is inserted into each sequence of letters. The ECP problem is to reorder the CAPTCHAs in increasing digit order, discarding all non-digit symbols. Here the solution consists in selecting the 4th, 5th, 2nd, 3rd, and 1st images, in that order.

Visual letter recognition ECP. Assume we have a CP problem Q, whose instances can successfully conceal letters (a "one-letter" CAPTCHA). We provide k instances of Q 1 , . . . , Q k corresponding to answer letters A 1 , . . . , A k , and ask for the alphabetically sorted list of these A i .

As an example, we would generate instances of Q for the letters {A, M, T, O, B, R}, and ask for the solution ABMORT. Under the assumption that Q ∈ CP, determining whether a solution exists requires human aid. Therefore we conjecture that this problem belongs to ECP.

A further variant of this idea is illustrated in Figure 5.7. Note that the visual letter recognition problem is DCP if an only if Q ∈ DCP. The main difficulty is that the notion of indistinguishability is tricky to define for images, and even harder to enforce: humans and computers alike use very specific visual cues to try and perform object Figure 5.9: All values of other than OK produce decoys whose statistical properties are conjectured to be indistinguishable from the correct image, with salient features but no real meaning. recognition, which are hard to capture statistically. Following [YKJ + 15], we may try and learn from a dataset how to properly encode images, but this is cumbersome in our context, especially when dealing with a large number of instances.

Our candidate is a simpler embodiment based on the following intuition: using biased noise (i.e. noise that is not random), we can elicit pareidolia in computer vision programs. Each candidate value of would then correspond to some object being recognised -but only one of those is really relevant. We conjecture that only humans are able to pick this relevant object apart.

The authors implemented this idea. We start from a black and white picture of a clearly identifiable object (Figure 5.8 left, here A = "rabbit"), turn it into a collection of black dots22 (1). The picture is then cut into blocks which are shuffled and rotated (2). Finally, noise is added, under the form of black dots whose size is distributed as the size of black dots in the original picture (3). The image is then rotated back in place (Figure 5.8 right) to provide the challenge Q OK . The motivation for this approach is as follows: (1) guarantees that individual pixels contain no information on luminance, and geometric features (lines, gradients and corners) -each dot being circular destroys information about orientation; the shuffling and rotation of blocks in ( 2) is encoded as an integer ; and (3) inserts decoy features, so that any shuffling/rotation would make geometric features appear (to lure a computer vision algorithm into detecting something). Now, many decoys Q ∈ Q, = OK can be generated easily from this image by shuffling and rotating blocks (Figure 5.9). Each decoy shares the same statistical properties as the correct (unshuffled) image, but has no recognizable content.

Our conjecture is that the human brain can perceive structures very efficiently and assign meaning to them. Many such structures are irrelevant and inserted so as to fool computer vision algorithms, but the familiar ones are immediately and intuitively grasped by humans. Consequently, although the original picture is severely deteriorated, we conjecture that it should still be possible for humans to tell noise and signal apart and identify correctly the contents of this image. Beyond their cryptographic interest, DCP and ECP tasks may have interesting applications in their own right.

Further applications

One such application is the following: users may wish to store sensitive data as a DCP instance, for instance credit card information, instead of plaintext. Indeed, attackers often browse their victims' computers looking for credit card information, which is easy to recognize automatically. By storing credentials in an ECP the attacker's task can be made harder.

Introduction

Cryptography assumes that keys and passwords can be kept private. Should such secrets be revealed, any guarantee of confidentiality or authenticity would be lost. To that end, the set of possible secretsthe keyspace K -is designed to be very large, so that an adversary cannot possibly exhaust it during the system's lifetime.

In some applications however, the keyspace is purposely limited -for instance, passwords. In addition to the limited keyspace size, secret selection has a fundamental limitation: keys should be chosen uniformly at random -yet users routinely pick (the same) poor passwords. Consequently, key guessing is a guided process in which the adversary does not need to exhaust all possibilities. The deadly combination of lowentropy key generation and small keyspace make password-based encryption (PBE) particularly vulnerable [LHA + 14].

The best security measure of a PBE is the min-entropy of the key distribution over K:

µ = -log 2 max k∈K p k (k).
where p k is the probability distribution of keys. The min-entropy captures how probable is the most probable guess. Conventional PBE schemes such as [START_REF] Kaliski | PKCS #5: Password-Based Cryptography Specification Version 2[END_REF] can be broken with constant effort with probability O(2 -µ ), but µ is in practice very small: [START_REF] Bonneau | The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords[END_REF] reports µ < 7 for passwords observed in a population of about 69 million users. If a message m were to be protected by such passwords, an adversary could easily recover m by trying the most probable passwords 23 . But how would the adversary know that the key she is trying is the correct one? A message has often some structure -documents, images, audio files for instance -and an attempt at decrypting with an incorrect key would produce something that, with high probability, does not feature or comply with this structure. The adversary can therefore tell apart a correct key from the incorrect ones, judging by how appropriate the decryption's output is. Mathematically, the adversary uses her ability to distinguish between the distribution of outputs for her candidate key k and the distribution p m of inputs she is expecting to recover.

Using such a distinguisher enables the attacker to try many keys, then select only the best key candidates. If there are not many possible candidates, the adversary can recover the plaintext (and possibly the key as well). In the typical case of password vaults, when one 'master password' is used to encrypt a list of passwords, such an attack leads to a complete security collapse. Then the adversary can distinguish between two candidate keys 5171 and 1431:

m 5171 = 486f6e65790000000000000000000000 m 1431 = bd941105a2e5a7c84857872a8852bc7e
Indeed, m 5171 spells out 'Honey' in ASCII while m 1431 has many characters that do not correspond to any letters. Exhausting all 4 digit keys yields only one message completely made of letters, hence k = 5171 and the adversary succeeded in recovering the plaintext m 5171 .

To thwart such attacks, Juels and Ristenpart introduced Honey Encryption (HE) [START_REF] Juels | Honey Encryption: Security Beyond the Brute-Force Bound[END_REF]. HE is an encryption paradigm designed to produce ciphertexts which, upon decryption with wrong keys, yields plausible-looking plaintexts. Thus brute-force attackers need to use additional information to decide whether they indeed found the correct key.

Mathematically, the decoding procedure in HE outputs candidate plaintexts distributed according to a distribution p d close to the distribution p m of real messages. This renders distinguishing attacks inoperant. The advantages of HE are discussed at length in [START_REF] Juels | Honey Encryption: Security Beyond the Brute-Force Bound[END_REF] where the concept is applied to password-based encryption of RSA secret keys, credit card PINs and CVVs. In particular, HE does not reduce the security level of the underlying encryption scheme, but may act as an additional protection layer.

However, the applications of HE highlighted in [START_REF] Juels | Honey Encryption: Security Beyond the Brute-Force Bound[END_REF] are very specific: Passwords protecting passwords (or passwords protecting keys). More precisely, low min-entropy keys protecting high min-entropy keys. The authors are wary not to extend HE to other settings and note that designing HE '...for human-generated messages (password vaults, e-mail, etc.) (...) is interesting as a natural language processing problem.' [START_REF] Juels | Honey Encryption: Security Beyond the Brute-Force Bound[END_REF] To give a taste of the challenge, realizing HE as Juels and Ristenpart defined it is equivalent to modelling the probability distribution of human language itself. A more modest goal is to restrict to subsets of human activity where choices are more limited, such as passwords -this is indeed the target of a recent paper by Chatterjee, Bonneau, Juels and Ristenpart [CBJ + 15], which introduces encoders for human-generated passwords they call 'natural language encoders' (NLE). Chatterjee et al.'s approach to language is to model the distribution of messages using either a 4-gram generative Markov model or a custom-trained probabilistic grammar model. This works reasonably well for passwords.

A natural question is therefore: Could the same techniques be extended or generalized to humangenerated documents in general? Chatterjee et al. hint at it several times, but never actually take a leap: The core reason is that these approaches do not scale well and fail to model even simple sentences -let alone entire documents.

In this paper we give arguments why the approach of Chatterjee et al. does not extends, and give an alternative approach based on a corpus quotation distribution transforming encoding.

Preliminaries

Notations. We write x D ← -X to denote the sampling of x from X according to a distribution D, and x $ ← -X when D is the uniform distribution.

Message recovery attacks.

Let M be a message space and let K be a key space. We denote by p m the message distribution over M, and by p k the key distribution over K. Let Enc be any encryption scheme. The message-recovery advantage of an adversary A against Enc is defined as

Adv MR Enc,pm,p k (A) = Pr MR A Enc,pm,p k = True
where the MR security game is described in Game 1. A may run for an unbounded amout of time, and make an unbounded number of queries to a random oracle. This advantage captures the ability of an adversary knowing the distributions p m , p k to recover a message encrypted with Enc.

When key and message entropy are low, this advantage might not be negligible. However, using Honey Encryption, Juels and Ristempart show that A's advantage is bounded by 2 -µ , where µ = log max k∈K p k (k) is the min-entropy of the key distribution.

Game 1 Message recovery (MR) security game MR A

Enc,pm,p k . As such, DTEs cannot be arbitrary: They need to mimic the behaviour of the cumulative distribution function and its inverse. More precisely, the closeness of p d and p m is determined by the advantage of an adversary A in distinguishing the games of Figures 5.11 and 5.12:

K p k ←-K M pm ← --M C $ ← -Enc(K , M ) M ← A(C ) return M == M Figure 5.11: SAMP0 B DTE x $ ← -[0, 1] M ← DTDecode(x ) b $ ← -B(M , x ) return b
Adv A DTE,pm = Pr SAMP1 A DTE,pm = 1 -Pr SAMP0 A DTE = 0
A is provided with either a real message and its encoding, or a fake encoding and its decoding. A outputs 1 or 0 depending on whether it bets on the former or the latter. A perfectly secure DTE is a scheme for which the indistinguishability advantage is zero even for unbounded adversaries (this is equivalent to

p d = p m ).
Having good DTEs is the central aspect of building a Honey Encryption scheme as well as the main technical challenge. Given a good DTE, the honey encryption and decryption of messages is provided by a variation of the "DTE-then-encrypt" construction described in Figures 5.13 and 5.14 where some symmetric encryption scheme (ESEncode, ESDecode) is used. In the "DTE-then-encrypt" paradigm, a message is first transformed by the DTE into an integer x in some range, and x (or rather, some binary representation of x) is then encrypted with the key. Decryption proceeds by decrypting with the key, then reversing the DTE. + 15] developed an approach to generating DTEs based on two natural language models: an n-gram Markov model, and a custom probabilistic grammar tree.

Natural language encoding

Chaterjee et al. [CBJ

Markov model.

The n-gram model is a local description of letters whereby the probability of the next letter is determined by the n -1 last letters:

Pr[w 1 • • • w k ] = k i=1 Pr w i | w i-(n-1) • • • w i-1
It is assumed that these probabilities have been learnt from a large, consistent corpus.

Such models are language-independent, yet produce strings that mimic the local correlations of a training corpus -but, as Chomsky pointed out [Cho02; Cho56; Cho59], the output of such models lacks the long-range correlations typical of natural language. The latter is not an issue though, as Chatterjee et al. train this model on passwords.

The model can be understood as a directed graph where vertices are labelled with n-grams, and edges are labelled with the cumulative probability from some distinguished root node. To encode a string it suffices to encode the corresponding path through this graph from the root -and decoding uses the input as random choices in the walk. Encoding and decoding can be achieved in time linear in message size.

Grammar model. Probabilistic context-free grammars (PCFG) are language-dependent models that learn from a tagged corpus a set of grammatical rules, and then use these rules to generate syntactically possible sentences. PCFGs are a compact way of representing a distribution of strings in a language.

Although it is known that context-free grammars do not capture the whole breadth of natural language, PCFGs are a good starting point, for such grammars are easy to understand, and from a given probabilistic context-free grammar, one can construct compact and efficient parsers [START_REF] Klein | Accurate unlexicalized parsing[END_REF]. The Stanford Statistical Parser, for instance, has been used by the authors to generate parse trees in this paper.

Mathematically, a probabilistic context-free grammar G is a tuple of the form (N, T, R, P, R ) where N are non-terminal symbols, T are terminal symbols (disjoint from N ), R are production rules, P is the set of probabilities on production rules and R is the start symbol. Every production rule is of the form A → b, where A ∈ N and b ∈ (T ∪ N ) * .

Figure 5.15 shows a parse tree aligned with a sentence. Some grammatical rules can be read at every branching: The DTE encoding of a string is the sequence of probabilities defining a parse tree that is uniformly selected from all parse trees generating the same string (see e.g. Figure 5.16, which provides an example of two parse trees for a same sentence, amongst more than 10 other possibilities). Decoding just emits the string indicated by the encoded parse tree. In the probabilistic context, the probability of each parse tree can be estimated. A standard algorithm for doing so is due to Cocke, Younger, and Kasami (CYK) [START_REF] Cocke | Programming languages and their compilers: Preliminary notes[END_REF][START_REF] Daniel | Recognition and Parsing of Context-Free Languages in Time n 3[END_REF][START_REF] Kasami | An efficient recognition and syntax analysis algorithm for context-free languages[END_REF].

→ , → , → , etc.

Generalized grammar model.

The generalized idea relies on the assumption that if part of the syntactic tree of a message is revealed, little can be inferred about the message. To understand the intuition, consider the syntactic tree of the previous sentence (clause) shown in Figure 5.17 As we can see, words are tagged using the clause level, phrase level and word level labels listed in Section 5.6.6.

The idea underlying syntactic honey encryption consists in revealing a rewritten syntactic tree's word layer while encrypting words 24 . The process starts by a syntactic analysis of the message allowing to extract the plaintext's syntactic tree. This is followed by a projection at the word level. When applied to the previous example, we get the projection denoted by S (hereafter called skeleton):

S =
Given a clause, we can automatically associate each word s i to a label L i25 . For instance, if the third word of the clause is "relies", then L 3 ← . We denote by R i the rank of the skeleton's i-th word in the dictionary of the category L i . Finally we denote by |X| the cardinality of the set X.

To map our ordered wordlist into a single integer, we note that because in the above example there are 5 s, 3 s, 6 s, 2 s, 6 s, and 1 , , and 1 , our specific clause is one amongst exactly B syntactically correct messages where:

B = | | 5 | | 3 | | 6 | | 2 | | 6 | || || || |
We can thus map a clause skeleton into N by writing:

e ← k-1 i=0 R i i-1 j=0 |L j |
where, by typographic convention, L -1 = 1. To get back the original clause, given e and the skeleton, we use algorithm of Algorithm 18.

Algorithm 18: Syntactic Decoding Algorithm

Input: An integer e, 0 ≤ e < B representing a sentence, and a skeleton S = {Li}. Output: A collection {wordi} of words.

1. ← |L0| 2. k ← |S| 3. for i ← 0 to k -1 4.
Ri ← e mod

5.

e ← (e -Ri)/

← × |Li+1|

7. wordi ← Dictionary L i (Ri)

return {wordi}

The skeleton is transferred in clear:

s =
Note that there is no need to tune precisely the plaintext size of the underlying block cipher because the decoding process for e stops automatically when i reaches k -1. In other words, we can randomize encryption at little cost by replacing e by e + µB for some random integer µ.

The number e is then honey encrypted, thus attempting to protect the actual content of the plaintext sentence.

Limitations of honey encryption

As observed by [START_REF] Juels | Honey Encryption: Security Beyond the Brute-Force Bound[END_REF], HE security is threatened when A has some side information about the target message. This puts strong constraints on HE's applicability to situations such as protecting RSA or HTTPS private keys. A second limitation is that the HE construction assumes that the key and message distributions are independent. When these distributions are correlated, A can identify a correct message by comparing that message with the decryption key that produced it. Similarly, encrypting two correlated messages under the same key enables A to identify correct messages.

Finally, constructing a DTE requires knowing the distribution p m of messages in M. As we will argue, this turns out to be extremely difficult to evaluate when M becomes a large enough space, such as humangenerated messages (emails, etc.). In those cases, it might even turn out that adversaries know p m better than users.

The methods described in Section 5.6.2.1 apply reasonably well to short passwords, but as we will now argue they cannot scale to deal with natural language as used in real-world scenarios such as: e-mails and written documents. The reason is threefold: First the methods require a huge amount of context-relevant information; Second, even when this information is available, the methods of [CBJ + 15] fail to produce convincing honey messages, i.e. messages that fool automated tools in telling them apart from real messages with high probability; Third, natural language HE may actually leak information about the underlying message.

Scaling NLE. The models developed for passwords in [CBJ + 15] can be extended: Markov models for instance can be configured to generate arbitrary-length messages. Instead of letters, such models can be trained to produce words, in accordance with some known distribution of n-grams. But while there are only a few English letters, a recent study of the English language [MSA + 11] counts more than a million individual words in usage.

As a result assuming we use one hundredth of the English language, the memory required to store an n-gram database is of the order of 10 4n ≈ 2 13n . That becomes a problem not only in terms of storage, but also when access latency is taken into account. Applying directly the method of [CBJ + 15] to words (using n = 5) would require knowing, storing, and sharing 2 65 bytes of data26 . The real issue however is that measuring accurately 5-grams usage is extremely difficult in practice, so that most of this impossibly large database is essentially unknown 27 .

Using grammars is one way to avoid this combinatorial explosion by keeping a simple and compact model of language. To that end, a sentence is parsed to reveal its grammatical structure as in Figures 5.15 and 5.16. Each word is labelled with an indication of its grammatical role (see Section 5.6.6).

A sentence is therefore uniquely represented by a list of grammatical tags, and a list of integers denoting which word is used. The idea behind syntactic honey encryption consists in revealing the tags but honey encrypting the words. By construction, generated honey messages have the same syntax as the original message, which makes decryption with a wrong key yield an often plausible plaintext. For instance, a sentence such as s 1 = 'Secure honey encryption is hard' could be honey decrypted as Chomsky's famous sentence s 2 ='Colorless green ideas sleep furiously' [START_REF] Chomsky | Three models for the description of language[END_REF], illustrating a sentence that is grammatically correct while being semantically void. Here s 1 and s 2 share the same syntax. To use this algorithm the communicating parties must agree on a dictionary that includes a set of labels and a parsing algorithm.

There are however two structural limitations to this grammatical approach. First, revealing the syntactic structure of a message leaks information. This is a very big deviation from classical cryptography, since it has always been taken for granted -for obvious reasons-that a ciphertext should not leak anything but the length of the underlying plaintext. On a more practical note unless the message is long enough, there might be only very few possible sentences with that given syntax. Second, a grammar is language-dependentand furthermore, to some extent, there is variability within a given language28 . The consequence of an inaccurate or incorrect tagging is that upon honey decoding, the sentence might be noticeably incorrect from the suitable linguistic standpoint.

This opens yet another research avenue. Automatically translate the sentence into an artificially created language where syntactic honey encryption would be very efficient. For instance translate French to Hindi, then perform honey encryption on the Hindi sentence.

Quality of NLE.

The question of whether a honey message is "correct" in a given linguistic context can be rephrased: Is it possible, to an adversary having access to a large corpus (written in the same language), to distinguish honey messages from the legitimate plaintext? It turns out that the two approaches to modelling natural language provide two ways to construct a distinguisher: We can compare a candidate to a reference, either statistically or syntactically. But we can actually do both simultaneously: We can use Web search engines to assess how often a given sentence or word is used29 . This empirical measure of probability is interesting in two respects: First, an adversary may query many candidates and prune those that score badly; Second, the sender cannot learn enough about the distribution of all messages using that "oracle" to perform honey encryption.

The situation is that there is a measurable distance between the model (used by the sender) of language, and language itself (as can be measured by e.g. a search engine). Mathematically, the sender assumes an approximate distribution p m on messages which is different from the real-world distribution p m . Because of that, a good DTE in the sense of Figures 5.11 and 5.12 would, in essence, yield honey messages that follow p m and not p m . An adversary capable of distinguishing between these distributions can effectively tell honey messages apart.

What is the discrepancy between p m and p m ? Since p m measures real-world usage, we can make the hypothesis that such messages correspond to human concerns, i.e. that they carry some meaning -in one word, what distinguishes p m from p m is semantics.

Leaking information. Another inherent limitation of HE is precisely that decryption of uniformly random ciphertexts produces in general the most probable messages. There are many situations in which linguistic constraints force a certain structure on messages, e.g. the position of a verb in a German sentence. Consequently, there might be enough landmarks for a meaningful reconstruction (see also [RWJ + 06]).

To thwart such reconstruction attacks, it is possible to consider phrase-level defences. Such defences imply modifying the syntactic tree in a way which is both reversible and indistinguishable from other sentences of the language. Phrase-level defences heavily depend on the language used. For instance the grammar of Latin, like that of other ancient Indo-European languages, is highly inflected; consequently, it allows for a large degree of flexibility in choosing word order. For example, femina togam texuit, is strictly equivalent to texuit togam femina or togam texuit femina. In each word the desinence (also called ending or suffix): -a, -am and -uit, and not the position in the sentence, marks the word's grammatical function. This specific example shows that even if the target language allows flexibility in word order, this flexibility does not necessarily imply additional security. Semitic languages, such as Arabic or Hebrew, would on the contrary offer very interesting phrase-level defences. In semitic languages, words are usually formed by associating three, four or five-consonant verbs to structures. In Hebrew for example the structure mi a a corresponds to the place where action takes place. Because the verb drš means to teach (or preach), and because the verb zrk means to throw (or project), the words midraša30 and mizraka respectively mean "school" and "water fountain" (the place that projects (water)). This structure which allows, in theory, to build O(ab) terms using O(a) verbs and O(b) and thus turns out to be HE-friendly.

Corpus quotation DTE

We now describe an alternative approach which is interesting in its own right. Instead of targeting the whole breadth of human language, we restrict users to only quote from a known public document 31 .

The underlying intuition is that, since models fail to capture with enough detail the empirical properties of language, we should think the other way around and start from an empirical source directly. As such, the corpus quotation DTE addresses the three main limitations of HE highlighted in Section 5.6.3: It scales, it produces realistic sentences (because they are actual sentences), and it does not leak structural information.

Consider a known public string M (the "corpus"). We assume that M consists in contiguous sequence of words sampled from M, i.e. from the set of substrings of M. To build a DTE we consider the problem of mapping a substring m ∈ M to [0, 1].

Interval encoding of substrings. Let M be the size of M, there are |M| = M (M -1)/2 substrings denoted m i,j , where i is the starting position and j is the ending position, with i ≤ j. Substrings of the form m i,i are 1-letter long.

The DTE encoding of m ∈ M is a point in a sub-interval of [0, 1], whose length is proportional to the probability p m (m) of choosing m. If p m is uniform over M, then all intervals have the same length and are of the form

I k = 2k M (M -1) , 2(k + 1) M (M -1) .
where k is the index of m ∈ M for some ordering on M. Decoding determines which I k contains the input and returns k, from which the original substring can be retrieved. For more general distributions p m , each substring m i,j is mapped to an interval whose size depends on p m (m).

Length-dependent distributions. Let's consider the special case where p m (m) depends only on the length of m. We will therfore consider the function p : [1, M ] -→ [0, 1] giving the probability of a substring of a given length. This captures some properties of natural languages such as Zipf's law [START_REF] Manning | Foundations of statistical natural language processing[END_REF]: Short expressions and words are used much more often than longer ones. Note that part of this is captured by the fact that there are fewer long substrings than short ones. Thus the encoding of a message m i,j is a random point in an interval of size (ji) proportional to p m (m i,j ) = p(ji):

m 0,0 m 0,M-1 m M-1,M-1
(k) = p(k) L , L = M k=1 (M -k)p(k).
This ensures that

M k=1 (M -k) (k) = 1.
The intervals associated to each substring are defined as follows. First, substrings m i,j are mapped via the map τ : m i,j → (i, j) to a triangle (see Figure 5.18):

T = {(i, j) | j ≥ i ∈ [0, M -1]} ⊂ N 2 .
Then points in T are mapped to [0, 1] using the function:

Φ : (i, j) → (i -1) (diag(i, j)) + diag(i,j)-1 k=1 k (k)
where diag(i, j) = M -1 -(ji) indicates on which upright diagonal (i, j) is. All in all, a substring m i,j is encoded using the following algorithm:

DTEncode : m i,j → (Φ + • diag) (τ (m i,j ))
where is sampled uniformly at random from [0, 1].

Encoding can be understood as follows: Substrings of equal length k are mapped by τ to points along a diagonal of constant k = ji. The first diagonal is the whole corpus M and the only substring of length

M . The (M -1 -k)-th diagonal is the set of substrings {m i,i+k | i ∈ [0, M -1 -k]} of length k.
Decoding is achieved by Algorithm 19, which takes a number x ∈ [0, 1] and returns the position (i, j) = Φ -1 (x) of the corresponding substring by determining the position in T . The idea is to count the segment length before x. At each iteration we update the segment length and the current position in the diagonal.

Algorithm 19: Corpus Quotation Decoding

Input: x ∈ [0, 1]. Output: (a, b) ∈ {0, . . . , M } 2 such that Φ(a, b) = x. 1. i, j ← 0 2. k ← M 3. while i < x 4. i ← i + (k) 5. j ← j + 1 6. if j ≥ M -k + 1 7. j ← 0 8. k ← k -1 9. return (j -1, M + j -k -1)
This decoding algorithm is linear in the number of substrings, i.e. it runs in time O(M 2 ). We can speed things up using pre-computations, Algorithms 20 and 21 run in O(M ) time and memory.

Algorithm 20: Precomputation Step

Input: , M .

Output: V . 1. V [0] ← 0 2. for i ← 1 to M 3. V [i] ← V [i -1] + (i)(M -i + 1)

return V

Algorithm 21: Fast Corpus Quotation Decoding using precomputation

Input: x ∈ [0, 1], V . Output: (a, b) ∈ {0, . . . , M } 2 such that Φ(a, b) = x. 1. i ← 1 2. while V [i] < x increment i 3. j ← (x -V [i])/ (i) 4. return (j -1, M -i -1)

Further research

This work opens a number of interesting research directions:

Machine to human HE: Search engines, and more generally computational knowledge engines and answer engines such as Wolfram Alpha32 provide users with structured answers that mimic human language. These algorithms generate messages using well-defined algorithmic process having a precise probability distribution which DTEs can be better modelled. Such sentences are hence likely to be safer to honey encrypt.

Automated plaintext pre-processing:

A more advanced, yet not that unrealistic option consists in having a machine understand a natural language sentence m and re-encode m as a humanly understandable yet grammatically and syntactically simplified sentence m having the same meaning for a human. Such an ontology-preserving simplification process will not modify the message's meaning while allowing the construction better DTEs.

Adding syntactic defenses: This work was mostly concerned by protecting messages at the word level.

It is however possible to imagine the adding of defenses at the clause and at the phrase levels. Two simple clause-level protections consist in adding decoy clauses to the message, and shuffling the order of clauses in the message. Both transforms can be easily encoded in the ciphertext by adding an integer field interpreted as the rank of a permutation and a binary strong whose bits indicate which clauses should be discarded. Decryption with a wrong key will yield a wrong permutation and will remove useful skeletons from the message. It should be noted that whilst the permutation has very little cost, the addition of decoy skeletons impacts message length. It is important to use decoy skeletons that are indistinguishable from plausible skeletons. To that end the program can either pick skeletons in a huge database (e.g. the web) or generate them artificially.

Adding phrase-level defenses: Adding phrase-level defenses is also a very interesting research direction.

A simple way to implement phrase-level defenses consists in adding outgrowths to the clause. An outgrowth is a collection of fake elements added using a specific rewriting rule. Note that information cannot be removed from the sentence. Here is an example of scrambling using outgrowths: the original clause m 0 is the sentence "During his youth Alex was tutored by a skilled architect until the age of 16". The syntactic tree of m 0 is: The skeleton of m 0 is . Now consider the following rewriting rules:

→ → →
We can apply these rules to m 0 to obtain:

m 0 m 1 ← r 1 (m 0 ) m 2 ← r 2 (m 1 ) m 3 ← r 3 (m 2 )
m 3 is a plausible skeleton that could have corresponded to the clause: "During his early youth Alex was tutored by a linguist and by a skilled architect until the approximate age of 16": It remains to show how to reverse the process to recover the original skeleton m 0 . To that end, we include in the ciphertext a binary string indicating which outgrowths should be removed. Removal consists in scanning m 0 and identifying what could have been the result of rewriting. Scanning reveals one potential application of rule 1 (namely "his early youth"), two potential applications of rule 2 ("a skilled architect" and "the approximate age") and one potential application of rule 2 ("by a linguist and by a skilled architect"). Hence 4 bits suffice to identify and remove the outgrowths. Algorithms describe a sequence of operations, that are mathematical in nature, but meant to be executed by some system. Such a system is bound by the laws of Physics; it is first and foremost a device that uses and dissipates energy -in the form of electric power, noise, heat, photons, etc. -and performs its operations in a finite amount of time. By measuring such quantities, an adversary may learn usable information against a system, often in addition to the system's intended output. Attacks that leverage such measurements are called side-channel attacks.

Grammatical tags for English

Since side-channel attacks target an implementation, they routinely break cryptosystems for which mathematical attacks are not applicable -reading off the secret key e.g. from timing measurements [START_REF] Paul | Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems[END_REF], the power consumption variations [KJJ99; BCO04], or from the noise made by coil whine [GPP + 16a]. Even when they do not target cryptosystems directly, side-channel analyses reveal information1 , including about the inner workings of a system -in Section 6.1 we used such an approach to unravel the workings of a sophisticated payment card fraud; and to protect against similar attacks in the future.

Protecting against side-channel attacks requires appropriate physical countermeasures and special implementations. As a result, most consumer products are unprotected. In an attempt to explore to which extent the hardware layer can provide resistance, even when the software running on it is vulnerable, we designed a microprocessor architecture along with a special compiler, aimed at protecting against power attacks. This work is described in Section 6.2.

Usually side channels are unintentional, but it may happen that a program or device makes deliberate use of them, to exfiltrate information out of an otherwise controlled system. In that case we refer to such a communication medium as a covert channel. Covert channel are especially difficult to track downindeed, the adversary may use software or hardware components that are not supposed to process sensitive material, which are therefore unprotected against side-channel analysis, as a means to communicate with a receiving station or a measuring apparatus. A typical example is the abuse of a computer's GPU [GKK + 14] or USB ports [START_REF] Guri | USBee: Air-Gap Covert-Channel via Electromagnetic Emission from USB[END_REF] to emit radio signals, bypassing airgap protections. The same approaches can be used by sending high-frequency signals to other components of a system. In Section 6.3 we describe another kind of covert channel, which relies on information shared by the OS.

When organized crime applies academic results

Introduction

EMV [EMV; EMV08a; EMV08b; EMV08c] (Europay, MasterCard, Visa) is a global standard, currently managed by the public corporation EMVCo, specifying interactions between integrated circuit cards and PoS terminals. The standard also defines exchanges between cards and automatic teller machines (ATMs). Over the recent years, additional payment operators (such as JCB, AmericanExpress, China UnionPay and Discover) endorsed EMV. EMV cards rely on pre-existing physical, link, network, and transport layer protocols such as ISO/IEC 7816 and ISO/IEC 14443.

According to EMVCo's website, by Q4 2014 a third of card present transactions worldwide followed the EMV protocol, and 3.423 billion EMV cards were in circulation.

Brief overview of an EMV transaction

A typical EMV transaction breaks down into three phases: (1) card authentication, (2) cardholder verification and (3) transaction authorization.

During card authentication, the PoS explores the applications supported by the card (e.g. credit, debit, loyalty, ATM, etc.).

During cardholder verification, the PoS queries the PIN from the user and transmits it to the card. The card compares the PIN and responds by "yes" (SW code2 0x9000) or "no" (0x63CX3 ).

Transaction authorization starts by feeding the card with the transaction details T (e.g. amount, currency, date, terminal ID, fresh randomness, etc.). The card replies with an authorization request cryptogram (ARQC) based on T . {ARQC, T } is sent to the issuer 4 , who replies with an authorization request code (ARC) instructing the PoS how the transaction should proceed. The issuer also sends to the PoS an authorization response cryptogram (ARPC) which is a MAC of {ARQC, ARC}. ARPC is transmitted to the card that responds with a transaction certificate (TC) sent to the issuer to finalize the transaction.

We refer the reader to [MDA + 10] for a comprehensive diagram illustrating these three phases.

Murdoch et al.'s attack

The protocol vulnerability described in [MDA + 10] is based on the fact that the card does not condition transaction authorization on successful cardholder verification. Hence the attack consists in having the genuine card execute the first and last protocol phases, while leaving the cardholder verification to a man-in-the-middle device.

To demonstrate this scenario's feasibility, Murdoch et al. produced an FPGA-based proof-of-concept, noting that miniaturisation remains a mechanical challenge.

Fraud in the field

In May 2011, the French's bankers Economic Interest Group (GIE Cartes Bancaires) noted that a dozen EMV cards, stolen in France a few months before, were being used in Belgium. A police investigation was thus triggered.

Because transactions take place at well-defined geographic locations and at well-defined moments in time, intersecting the IMSIs5 of SIM cards present near the crime scenes immediately revealed the perpetrators' SIM card details. A 25 years old woman was subsequently identified and arrested, while carrying a large number of cigarette packs and scratch games. Such larceny was the fraudsters' main target, as they resold these goods on the black market.

Investigators quickly put a name on most of the gang members. Four were arrested, including the engineer who created the fake cards. Arrests occurred in the French cities of Ezanville, Auchy-les-Mines and Rouvroy. About 25 stolen cards were seized, as well as specialized software and e5000 in cash.

The net loss caused by this fraud is estimated to stand below e600,000, stolen over 7,000 transactions using 40 modified cards.

A forensic investigation was hence ordered by Justice [START_REF] Judiciary | French prosecution case[END_REF].

Physical analysis

Optical inspection

The The backside is deformed around the chip area (Figure 6.2). Such a deformation is typically caused by heating. Heating (around 80 • C) allows melting the potting glue to detach the card module.

The module looks unusual in two ways: (1) it is engraved with the inscription "FUN"; and (2) glue traces clearly show that a foreign module was implanted to replace the **89 card's original chip (Figure 6.3).

The module is slightly thicker than normal, with the chip bulging somewhat through the card, making insertion into a PoS somewhat uneasy but perfectly feasible (Figure 6.4).

The "FUN" engraving indicates that the module belongs to a FUN card. FUN cards are open cards, widely used for hobbying and prototyping purposes.

The FUN module contains an Atmel AVR AT90S8515 microcontroller and an EEPROM memory AT24Cxx. The AVR has 8 kB of Flash memory and 512 bytes of internal EEPROM, 512 bytes of internal RAM and a few other resources (timer, etc.). The AT24Cxx has varying capacity depending on the exact FUN card model. For a FUNcard5, this capacity is 512 kB (Figure 6.5).

Magnetic stripe analysis

The magnetic stripe was read and decoded. The ISO1 and ISO2 tracks perfectly agrees with the embossed information. ISO3 is empty, as is usual for European cards.

X-ray analysis

X-ray analysis was performed using a Y.Cougar Microfocus Xylon imager. Figure 6.6 shows an unmodified FUN card, while Figure 6.7 is an X-ray image of the forgery.

X-ray analysis reveals, using false colours, the different materials composing the forged module (Figure 6.9). Legitimate connection wires are made of gold, but connections between the FUN card and the stolen chip underneath are made of another metal (copper, as will later appear after opening the forged card). Soldering was made using a classical mixture of silver and tin.

Probing non-ISO Contacts

FUN cards are programmed using specialised hardware. Programming is done via the two unstandardized pins MOSI and SCK.

We tried to use programming hardware to read back the card's contents and reverse-engineer its software. All reading attempts failed. FUN cards can be protected against reading at flashing time. Clearly, the fraudster enabled this protection.

It is possible to identify the chip using the programming hardware, but this uses writing commands that are invasive and possibly destructive. Therefore such an identification was not attempted.

ISO/IEC 7816 compliance

We assumed that the forged card's software was rudimentary and did not fully comply with ISO/IEC 7816. The assumption was that the fraudsters contented themselves with a minimal implementation that works reasonably well under usual conditions. We hence analyzed the forgery's behavior at external clock frequencies close to the most extreme value (5 MHz) allowed by ISO/IEC 7816.

The forgery behaved normally up to 4.90 MHz. At 4.91 MHz, the forgery stopped responding to commands and only returned an ATR (Answer To Reset).

Protocol analysis

The electronic exchanges between the forgery and the PoS were monitored using the Cardpeek 9 tool. Cardpeek allows monitoring the APDU commands sent to the forgery. This is a read-only operation that does not alter the analyzed card. When queried, the forgery responded with the following information: PAN = 4561**********79; expiry date in 2011; and the cardholder name henceforth refered to as H.D. All this information is in blatant contradiction with data embossed on the card (mentioned in Section 6.1.2.1).

Application selection

Application selection is performed by browsing the PSE 10 , as described in [START_REF] Emvco | EMV Specification (Book 1) -version 4[END_REF].

Select 1PAY.SYS.DDF01. Selecting the DDF 11 named 1PAY.SYS.DDF01 succeeded 12 . Browsing the payment system directory Records in the Payment System Directory were browsed in-order and revealed the presence of CB 13 and VISA applications.

ReadRecord SFI 14 1 record #1 15 : this SFI contains:

• Application AID A0 00 00 00 42 10 10

• Label: CB • Priority: 1 ReadRecord SFI 1 record #2: this SFI contains:

• Application AID: A0 00 00 00 03 10 10

• Label: Visa DEBIT • Priority: 2 Attempting ReadRecord SFI 1 record #3 returns a status word equal to 0x6A83, i.e. "record not found". All applications have thus been found.

Select "VISA Debit" Cardpeek used the previously discovered AID to select the VISA Debit application 16 .

Transaction initialization

GetProcessingOptions (GPO) Next, we retrieved the card's processing options 17 . This data contains the AIP (Application Interchange Profile) and the AFL (Application File Locator) as defined in [EMV08c, Chapter 10.2]. The card claims that it supports:

• static authentication (SDA);

• dynamic authentication (DDA);

• cardholder verification;

• and external authentication. 9 See http://code.google.com/p/cardpeek/downloads/list. 10 Payment System Environment. 11 Directory Definition File. 12 Command: 00 A4 04 00 14. 13 Carte Bancaire. 14 Short File Identifier. 15 Command: 00 B2 xx 0C Le, where xx is incremented as records are being read. 16 Command: 00 A4 04 00 07. 17 Command: 80 A8 00 00 02 followed by a GetResponse command: 00 C0 00 00 20.

The card furthermore requests risk management by the PoS.

AFL consists in a list of 4-byte blocks describing which records should be read. In our case, the following blocks were received:

• SFI #1, of record 01 to 01. No record of this SFI is used for "disconnected" mode data authentication.

• SFI #2, of record 01 to 02. Record #1 of this SFI is used for "disconnected" mode data authentication.

• SFI #3, of record 01 to 04. Record #1 of this SFI is used for "disconnected" mode data authentication.

SFI records

Having read the GPO data, the reader can access the SFI records.

ReadRecord SFI 2 record #1 (used for "disconnected" mode data authentication) contained the following VISA application information:

• Application creation and expiry date: between a date in 2009 and a date in 2011 (omitted here for privacy reasons).

• The card's PAN: 4561**********79.

The Bank Identification Number of this PAN corresponds to a HSBC VISA card (4561), which is inconsistent with the information embossed on the card. ReadRecord SFI 2 record #2 of the VISA application provided the following information:

• The list of objects to be included upon the first GenerateAC (CDOL1) (tags list + lengths)

• The list of objects to be included upon the second GenerateAC (CDOL2).

• The list of objects to be included upon internal authentication (DDOL):

• Tag 0x9F37 -"Unpredictable Number" (length: 4 octets)

• Cardholder's name: abridged here as H.D. for privacy reasons.

The chip belongs to Mr. H.D., which is also inconsistent with the information embossed on the card. ReadRecord SFI 3 record #1, 2, 3, 4 (used for "disconnected" mode data authentication) contained actions codes, requested by the card to authorize a transaction, as well as a list of supported authentication methods, their public keys and certificates.

ReadRecord SFI 1 record #1 should have revealed the exact same information encoded in the ISO2 track. Instead, it contained, again, the following information:

• Account number: 4561**********79

• Expiration date (YYMM): a date in 2011 (anonymised for privacy reasons) ReadRecord SFI 4 record #1 indicated an empty record.

Authentications

InternalAuthenticate In smart card terms, an InternalAuthenticate18 is an authentication of the card by the reader (cf. [EMV08b, Chapter 6.5]). The reader requests that the card signs a random 4-byte number, as asked by the DDOL. The reader accepted this authentication.

VerifyPIN (cardholder verification)

The reader checks that the card isn't blocked by reading the number of remaining PIN presentation tries 19 . There are 3 remaining tries before the card is blocked.

PIN codes are verified using the command VerifyPIN20 . A correct PIN results in a 0x9000 status word.

Our experiments reveal that the PIN is always considered correct, regardless of P1 and P2, even for inconsistent values. The card accepts any PIN unconditionally.

Transaction

The reader gathers risk management data before starting a transaction.

GetData (ATC)

The ATC (Application Transaction Counter) was requested 21 .

The ATC sent by the card does not change, regardless of the number of transactions performed. This ATC is different from the one returned by the first GenerateAC (which is incremented at each transaction), and is therefore clearly false.

The ATC is forged to manipulate the PoS risk management routine, which would otherwise request to go on-line.

The above also applied to the reading of the last online ATC 22 .

Risk management Based on available data, the reader performs risk management as described in [EMV08c, Chapter 10.6.3]:

"If the required data objects are available, the terminal shall compare the difference between the ATC and the Last Online ATC Register with the Lower Consecutive Offline Limit to see if the limit has been exceeded."

Here, ATC (0x04) -LOATC (0x02) > LCOL (0x01).

As the transaction log extracted from the card indicated, the fraudsters performed many small amount purchases to avoid on-line connection requests.

Side-channel power analysis

Measuring variations in the device's power consumption enables detecting patterns that correspond to repeated operations. This is a common way to try and determine secret keys used in cryptographic operations. Although very rarely, side-channel analysis is also used by forensic experts (e.g. [START_REF] Souvignet | Differential power analysis as a digital forensic tool[END_REF]).

Here, side-channel analysis will expose the fact that the forgery contains an underlying (legitimate) card, by analysing in detail the forgery's power trace when it is operated.

We shall constrast the "VerifyPIN" command, which does not propagate to the stolen card, with the "Select" command, which must be relayed to the stolen card.

EMV "Select" command

The VISA application is selected based on its AID.

The sequence diagram of Figure 6.10 shows what should happen if the forgery indeed behaved as a "chip-in-the-middle" proxy.

Power consumption is measured and synchronized with the I/O between the card and the reader. However, internal communication between the FUN card and the stolen chip is witnessed on the power trace.

Figure 6.11 shows power consumption over time when the Select command is sent to the forgery. Patterns clearly appear during I/O activity. Some patterns can also be noticed between I/O operations, while there is no communication with the reader. A finer analysis shows that these patterns are made of sub-patterns, whose number is equal to the number of bytes exhanged. This confirms that communication is intercepted and retransmitted by the FUN card, as illustrated in Figure 6.12.

EMV "VerifyPIN" command

We now turn our attention to the "VerifyPIN" command which, in the case of a proxy chip, would never be sent to the stolen chip.

As expected, this command is executed directly, as shown on the power trace of Figure 6.13. No operations between I/Os are witnessed here.

GetData commands

When sent a GetData command, the card seems to modify some values used for risk management purposes, so as to manipulate the PoS. The level of resolution offered by power trace analysis (Figure 6.14) is insufficient for seeing when this happens.

Destructive analysis

We finally de-capsulated the forged module to analyze its internal structure. Results are shown in Figures 6.15 to 6.17. The Vcc, RST, CLK, GND contacts of the FUN card are connected to the corresponding pins of the stolen card (Vcc to Vcc, RST to RST etc.). However the stolen card's IO pin is connected to the SCK pin of the FUN card (Figure 6.18).

Anti-forensic countermeasures

Figure 6.19 shows that the perpetrators scratched the printed circuit copper track of SCK to conceal the traffic transiting via SCK. Recall that SCK is the most informative signal in the device because SCK is used by the FUN card to communicate with the stolen card. During questioning by law enforcement, two reasons were advanced by the perpetrator for doing so. The first was, indeed, the intention to make forensic analysis harder. The second is way more subtle: using a software update, PoSs could be modified to spy the traffic on SCK. This would have allowed deploying a software countermeasure that would have easily detected forged cards.

Aftermath & lessons learned

The forensic report produced by the authors of this paper was sufficient for the court to condemn the perpetrators. During our testimony we underlined to the court that this case shows that organised crime is following very attentively advances in information security. We also noted that producing the forgery required patience, skill and craftsmanship. It is important to underline that, as we write these lines, the attack described in this paper is not applicable anymore, thanks to the activation of a new authentication mode (CDA, Combined Data Authentication) and network level protections acting as a second line of defense. Until the deployment of CDA, this fraud was stopped using network-level counter-measures and PoS software updates. While we cannot detail the network-level countermeasures for confidentiality reasons 23 , the following two fixes allowed to immediately stop the fraud: Parity faults We assumed that the fraudster only implemented the just-enough functionalities allowing to perform the fraud. This was indeed the case: when injecting byte-level parity errors into bytes transmitted from the PoS to the FUN card, the FUN card did not request byte retransmission as mandated by the ISO/IEC 7816 standard. Coding, testing and deploying this countermeasure took less than a week.

Abnormal applicative behavior

The forged card replies with a status word equal to 0x9000 to VerifyPIN commands sent outside of a transaction context (e.g. just after a reset). This is incompliant with EMV specifications (where a PIN is necessarily attached to a previously selected application) and proves that the FUN card is not context-aware. Coding, testing and deploying this countermeasure was done overnight.

In addition, four other software-updatable countermeasures were developed and tested, but never deployed. These were left for future fraud control, if necessary.

Nonetheless, this case illustrates that, as a rule of thumb, an unmalleable cryptographic secure channel must always exist between cards and readers. Other (more expensive) solutions allowing to avoid man-inthe-middle devices consist in relying on physical attestation techniques such as [START_REF] Mayes | Smart Card Platform Fingerprinting[END_REF].

Other applications of miniature spy chips

The technique explained in this paper can be generalized to attack non-payment devices.

Eavesdropping mobile communications

By extracting a chip from a FUN card and implanting it under the SIM connector of a smartphone, mobile communications can be monitored and decrypted. The demonstrator, on which we currently work, functions as follows: GSM and 3G communication confidentiality is based on session keys (denoted Kc, CK and IK) transmitted by the SIM to the phone. These session keys are derived from a random challenge (RAND) sent from the Authentication server (AuC) to the SIM (see Figure 6.20). A FUN card implanted under the reader can easily monitor these exchanges and record Kc, CK and IK in EEPROM.

While this happens, the opponent intercepts and records encrypted voice communications without decrypting them. It remains to extract the captured key material and transmit it to the attacker. This is far from being a trivial task given that, unlike the EMV fraud case that we have just analyzed, a FUN card implanted under a card reader does not actively control the SIM. As strange as this may sound, as a matter of fact it does, assuming that the FUN card can read bits quicker than the phone (which is the case in practice). The ISO/IEC 7816 protocol relies on the fact that the IO signal connecting the card to the reader is pulled-up. This means that a party wishing to communicate pulls-down the IO and hence signals a zero to the other party. When the communicator's port is switched to high impedance, the line automatically goes up again. Hence, if we connect the FUN card's IO to the SIM connector's IO, both the FUN card and the legitimate SIM can signal zeros to the phone. In other words, the phone will see the information b f ∧ b s where b f and b s (respectively) denote the bits sent by the FUN card and by the SIM.

To prove its identity to the network, the SIM returns to the AuC a response called SRES (or RES). Hence, the FUN card can intervene in the transmission of RES and force some of RES's bits to zero. Because RES is false the authentication will fail but information (in which the FUN card can embed Kc, CK or IK) will be broadcast to the attacker over the air. This precise information encoding problem was already considered by Rivest and Shamir in [START_REF] Ronald | How to reuse a "write-once" memory[END_REF].

The implementation of this strategy is technical. It requires more than just turning bits to zero, because every byte sent from the SIM to the phone has a parity bit. Switching a single bit to zero means that the parity bit must also be flipped, which can only be done when the parity is one. Hence, the FUN card needs to compute the parity p of bits [0:6]. If p = 0 or bit 7 is zero, the FUN card remains quiet. Else, the FUN card pulls down the IO during bit 7 and during the parity. Another option consists in pulling down two data bits during transmission and leaving the parity unchanged.

Characterising unknown readers

Consider the case of a border control device, produced and sold in small quantities, to carefully chosen clients. Users are given identification cards that interact with the device, but the description of the ISO commands exchanged between the card and the device is kept confidential. Exhausting all possible commands is impossible because critical-infrastructure cards usually embed a ratification counter that limits the number of unknown commands to 10 before definitively blocking the card.

An intelligence agency wishing to characterise the readers and understand how they work may construct a "chip-in-the-middle" command recorder based on a FUN card and a genuine identification card. The ISO command set could then be retrieved for later analysis.

Low-cost hardware security modules

In a number of industrial settings, keys, signatures or ciphertexts must be generated at a fast pace. A smart-card has relatively strong tamper resistance defences but modest computational capabilities. Hardware Security Modules (HSMs) are expensive devices featuring both tamper-resistance and important computational capabilities.

A number of manufacturers propose multi-smart-card readers (Figure 6.21). In such readers, a central processor establishes distinct one-to-one connections with each smart-card. An alternative HSM concept, illustrated in Figure 6.22, would consist in simply wiring card modules to each other. Power and clock supply would be common to all card modules. All card modules will be reset at once (given that IO is pulled up, the simultaneous emission of answers to reset will not cause signal conflicts). Communicating with individual modules will only require the (software) coding of a non-ISO protocol, where modules monitor IO and emit information to the reader while avoiding collisions.

The conjoined microprocessor Abstract

Over the last twenty years, the research community has devised sophisticated methods for retrieving secret information from side-channel emanations, and for resisting such attacks. This paper introduces a new CPU architecture called the Conjoined Microprocessor (CμP). The CμP can randomly interleave the execution of two programs at very low extra hardware cost. We developed for the CμP a compiler that turns a target algorithm into two separate queues Q0 and Q1 that can run in alternation. Q0 and Q1 fulfill the same operation as the original target algorithm. Power-analysis resistance is achieved by randomly alternating the execution of Q0 and Q1, with different runs resulting in different interleavings. Experiments reveal that this architecture is indeed effective against CPA. This is joint work with Ehsan Aerabi, A. Elhadi Amirouche, Houda Ferradi, David Naccache, and Jean Vuillemin. This work was presented at HOST 2016, MacLean (VA, USA) and published in [AAF + 16].

Introduction

Over the last twenty years, the research community has devised sophisticated methods for retrieving secret information from side-channel emanations and for resisting such attacks. We assume that the reader is familiar with side-channel attacks such as SPA, DPA [START_REF] Paul | Differential Power Analysis[END_REF] and CPA [BCO04] that we do not re-describe here.

This paper introduces a new CPU architecture called the Conjoined Microprocessor (CμP). The CμP can be seen as the electronic equivalent of conjoined twins. In biology the term conjoined twins designates identical twins joined in utero. Conjoined twins usually share a few vital organs such as the heart or the liver. The CμP has one ALU (Arithmetic and Logical Unit) and one RAM space but two independent register banks and two independent stacks. This enables the CμP to take two queues of codes that modify the same RAM space and alternate randomly their execution. CμP hardware relies on a compiler that transforms the target algorithm into two separate code queues Q 0 and Q 1 run in alternation. Q 0 and Q 1 fulfill the same operation as the original target algorithm. Thus, Q 0 and Q 1 co-operate to alternatively modify the same RAM space and perform a specific computational task.

Attacks such as CPA or DPA exploit a device's power consumption at a specific clock cycle t 0 . The statistical exploitation of data-related power variations usually requires a large number of re-runs. CPA and DPA are based on the observation that during t 0 , secret data being processed and power consumption are correlated. Algorithms are often designed to run in constant time to thwart timing attacks [START_REF] Paul | Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems[END_REF], but constant-time implementations enable attackers to align the power traces of consecutive runs, focus on t 0 , and perform statistical analysis. The opponent can then guess the secret data (usually a byte of it) and check whether this guess is correct. A correct guess will produce a power trace that resembles the real consumption at t 0 .

The rationale of the CμP idea is to prevent such attacks by randomly alternating between Q 0 and Q 1 , i.e. shuffling instructions on the fly, and thus change the clock cycles at which sensitive data is being processed between executions. Even if an attacker succeeds in targeting a given clock cycle t, power consumption at t also depends on the instructions executed before t. Thereby the CμP hinders the attacker's efforts at the expense of a small overhead on the device.

The advantages of the CμP architecture are the following:

• An opponent trying to exploit side-channel leakage is faced with the problem of correctly partitioning operations in time. In addition, the power consumption at time t does not only depend on opcode t but also on opcode t-1 . If these opcodes belong to two different Q i s, the power traces of the two processes will influence and blur each other.

• The insertion of random wait-states is a popular countermeasure (e.g. [CCD00; CK09; CK10]) but wait-states impact system performance by slowing down computations (i.e. when the system marks a halt to mislead the opponent, time is inevitably lost). Alternating between two fully useful processes does not cause any time loss and preserves global system determinism. Previous works using shuffling methods focus on specific algorithms (e.g. [KY09; MSH09; THM07]) or demand large runtime resources such as area and power [START_REF] May | Non-deterministic Processors[END_REF].

• Because conjoining does not duplicate the ALU and the RAM (which are the most expensive chip parts in terms of surface) but only a few registers, conjoining is relatively cheap.

• Finally, by turning off one of the two processes, CμP runs code with total backward compatibility. Conversely, by just skipping the conjoining opcodes, CμP code is automatically serialized on-the-fly for a non-conjoined µP.

As we will subsequently see, the main challenge in designing the CμP is not that much the CμP's hardware design but the compilation of code for the CμP. We adapted compilation tools [KAS + 10] to generate code that can be run safely in alternation, and combined these tools with optimization strategies [START_REF] Allen | Optimizing Compilers for Modern Architectures: A Dependencebased Approach[END_REF] to overcome the lack of symbolic information, missing function indices and implicit induction variables. We also propose a method to interleave straightline codes in Section 6.2.3. Section 6.2.2 provides technical background. Section 6.2.3 overviews the methods for alternating code used in the compilation process for the CμP. Section 6.2.4 provides implementation details. Section 6.2.5 illustrates the additional resistance to CPA and DPA brought by the CμP. We did not subject the CμP to higher-order or non-linear power analyses24 . We also expect the CμP to increase resistance against other side-channels such as EM radiation or heat dissipation, although we did not perform such experiments as yet.

Technical background

Reordering constraints for dependent instructions

The CμP is designed for the interleaved non-deterministic execution of two (or more) instruction streams 25 . This requires all possible code interleaving configurations to be equivalent. To guarantee the equivalence of two instances of an algorithm, we use the following result [AK01, Theorem 1]: Theorem 6.1 Any reordering transformation φ that preserves every dependence in a program preserves the meaning of that program.

In this theorem the word dependence refers to Write-after-Write (WaW), Write-after-Read (WaR) or Readafter-Write (RaW) relationships between instructions. Recall that WaW, WaR and RaW are data hazards that occur when instructions exhibiting data dependence modify data concurrently. We illustrate these hazards with simple examples in Table 6.1 assuming that, to perform correctly a given computational task, opcode 1 must precede opcode 2 . The problematic variable in the following three examples is x. x := a a := x x := a opcode 2 b := x x := b x := b There are three situations in which a data hazard can occur:

• RaW (true dependence): opcode 2 tries to read a variable before opcode 1 could write it. i.e. opcode 2 refers to a result that has not been calculated yet.

In Table 6.1. opcode 1 saves a value in x and opcode 2 is expected to move this value into b. Hence, opcode 1 and opcode 2 do not commute. This is a data dependence because opcode 2 depends on the successful completion of opcode 1 .

• WaR (anti-dependence): opcode 2 tries to write a variable (x) before opcode 1 could read it. A brief look at the WaR column of Table 6.1 shows that opcode 1 and opcode 2 do not commute.

• WaW (output dependence): In this configuration opcode 2 tries to write a variable (x) before opcode 1 writes it. Here as well, opcodes do not commute26 .

Conversely, a transformation φ does not yield an equivalent program (φ is an invalid transformation) if φ changes the order of two opcode i s referring to a same memory location when at least one of these opcode i s is a write. Otherwise φ is defined as valid. Kennedy et al. [START_REF] Allen | Optimizing Compilers for Modern Architectures: A Dependencebased Approach[END_REF] introduced a set of methods for loop dependence testing and parallelization which are complete and adequate for our purpose. Kotha et al. [KAS + 10] applied a subset of these methods to parallelize binary codes. Both approaches are integrated in the CμP compilation toolkit.

Parallelization and alternation

To recompile a program P into the two alternatable queues of codes Q 0 or Q 1 , we distinguish program parts that belong to loops from straight-line program parts (that do not belong to loops), and treat them differently.

Loop and straight-line code sections

To split a program P into Q 0 and Q 1 , we start by dividing P into loop and straight-line sections: A loop is a set of instructions that successively reiterates until a certain condition is met. Whatever falls outside loop boundaries is considered as straight-line code.

Each instruction of a straight-line section is assigned to Q 0 or Q 1 based on its dependences with the instructions previously assigned to that Q i . Assigning is done by Algorithm 22.

Loop and nested loop code sections are parallelized using [AK01; KAS + 10].

Synchronizing instruction queues

It is someties necessary to pause the execution of one Q i , to make sure that executing instructions in two queues never violates dependence. This requires adding new synchronization opcodes to the CμP's instruction-set. Instruction queues are synchronized using the (new) barrier (brr) and carrier (crr) instructions. In the following, brr and crr instructions will be referred to by the generic notation xrr.

• brr is used to enforce the correct order of execution of two instructions belonging to different Q i s. Each brr is followed by a memory address (brr M). The queue issuing a brr instruction will be stalled until the other queue executes the instruction at address M. Table 6.2 gives a 68 05 example for brr. Assume the lda mem1 in Q 0 must be processed before the sta mem1 in Q 1 . brr stalls Q 1 until Q 0 reaches LABEL1.

• crr is used to transfer a register value from one queue to another. Each crr is followed by a memory address M and a register name Y (crr M,Y). The queue Q i issuing the crr instruction will be stalled until Q 1-i executes the instruction at address M, and then the contents of register Y are carried (copied) from Q 1-i to the Q i . Table 6.3 illustrates the use of crr. Suppose that the add in Q 1 requires the value loaded into register A from mem1 in Q 0 . crr waits until lda finished, then it transfers the contents of Q 0 's A into Q 1 's A. Then the add instruction is processed.

Algorithm for straight-line code

The k-th instruction of a program is denoted by opcode [k]. We denote by D [k] and S [k] the sets of all destination instructions (an instruction that must be executed after opcode [k]) and source instructions (an instruction that must be executed before opcode [k]), respectively; Q i [k] is the queue that opcode [k] belongs to ; n [k] is the number of instructions that must be executed before instruction opcode [k] can be assigned 27 . Finally, we introduce R[k] ∈ {0, 1}, the recommended queue index, which is determined from the instructions in S [k].

Figure 6.23 illustrates this process for a short program: seven instructions affect registers A (accumulator) and X (index). Their dependence graph is illustrated in Figure 6.24a. Each node is an instruction and each directed edge is a dependence between two instructions. The incx at line 4 has the attribute D[4] = {(X, 6), (X, 7)} because its writing of register X must be executed before line 6 and 7 and the lda at line 1 has the attribute D[1] = {(mem1, 6), (A, 3)}. Now each instruction must be assigned to a queue for the program to be effectively executed. The assigning process is described in Algorithm 22. Each iteration begins by selecting a node having no input edge, or having all its adjacent source nodes assigned. We refer to this node as the current node. The algorithm then assigns the current node to a queue and ends when all nodes are assigned. Choosing the appropriate queue is based on two conditions:

1 lda mem1 ; A ← mem1 2 ldx mem2 ; X ← mem2 3 inca ; A ← A+1 4 incx ; X ← X+1 5 sta mem2 ; mem2 ← A 6 stx mem1 ; mem1 ← X 7 mul ; X:A = 256*X+A ← A*X
1. Already assigned instructions can assign a queue to their destinations. This is called recommendation.

2.

If the node has no recommendation, it is assigned to the shorter queue.

After determining the appropriate queue, and assigning the current node to the queue, Algorithm 22 updates the nodes that depend on the current node.

To find out if a synchronizing instruction xrr is required, the algorithm checks whether a source instruction of the current node has been assigned to the other queue or not; if so, it inserts an appropriate brr or crr.

A toy example

To show how Algorithm 22 works, we apply it to the code of Figure 6.23. In Figure 6.24, bold rectangles show the instruction processed by Algorithm 22 at each step. Plain arrows represent the analyzed code's dependences. Bold arrows denote recommendation paths and gray nodes represent assigned opcodes that will not be processed again. 3.

S[k] ← sources of opcode[k] 4. n[k] ← #S[k] 5. Qi[k] ← -1 6. R[k] ← -1 Node assignation 7. while ∃k s.t. Qi[k] = -1 and n[k] = 0 8. if R[k] = -1 9. Qi[k] ← R[k]
10. else 11.

assign opcode [k] to the shortest queue

12. if ∃(R, J) ∈ S[k] s.t. Qi[J] = R[k]
13. insert required xrr instructions before opcode [k] in R [k] 14.

recommend Qi [k] to appropriate nodes in D [k] 15.

for (r, )

∈ D[k] 16. n[ ] ← n[ ] -1 17. return Q0, Q1
The procedure starts by considering the instruction at line 1, which is assigned to Q 0 , while queue Q 0 is recommended to the 3 rd instruction (Figure 6.24b). The algorithm then proceeds to the next sourceless node, which is the 2 nd instruction (Figure 6.24c). Now the 3 rd and 4 th instructions have a recommended queue equal to 0 and 1 respectively, so the algorithm will assign the 3 rd instruction to Q 0 and the 4 th to Q 1 . Note that the 3 rd instruction and its source (1 st inst.) have been assigned to the same queue, so that no xrr is required (Figure 6.24d); the same remark applies to the 4 th instruction (Figure 6.24e).

However, instruction 5 has been sent to Q 0 , but has a source (2 nd inst.) that is assigned Q 1 . A brr is therefore inserted to ensure instruction 2 has been processed on Q 1 (Figure 6.24f). The same reasoning applies to instruction 6 (Figure 6.24g).

The algorithm proceeds to the 7 th and last instruction, which is assigned to Q 0 . This instruction requires the content of registers A and X. Since X is affected by Q 1 , a crr is necessary to synchronize its value (Figure 6.24h).

Table 6.4 illustrates the queues once this procedure has completed. The instruction brr LABEL_1_1 on Q 0 ensures that this queue will be stalled until ldx is processed by Q 1 . The brr LABEL_0_1 instruction on Q 1 has a comparable effect on Q 1 . The crr LABEL_0_2,A instruction will transfer the contents of register A from Q 0 after inca has finished.

2: X ← mem1 3: R=0 4: X ← X+1 5: mem1 ← A 6: mem2 ← X 7: X:A ← A × X (b) Iteration 2 A X mem2 mem1 A X X A 1: Q=0 2: Q=1 3: Q=0 4: R=1 5: R=0 6: R=1 7: R=0 (d) Iteration 4 A X mem2 mem1 A X X A 1: A ← mem2 2: X ← mem1 3: A ← A+1 4: X ← X+1 5: mem1 ← A 6: mem2 ← X 7: X:A ← A × X (a) Iteration 1 A X mem2 mem1 A X X A 1: Q=0 2: Q=1 3: R=0 4: R=1 5: mem1 ← A 6: mem2 ← X 7: X:A ← A × X (c) Iteration 3 A X mem1 mem2 A X X A

Implementation

The CμP architecture

The CμP (Figure 6.25) has two separated register banks, an Alternator and a common core including an ALU and control logic. Each register bank duplicates registers A, X, the Flags, Stack Pointer and Program Counter. The Multiplexer can change the data path between the two banks based on the queue being run. The Alternator is also composed of a Shuffler Switch that randomly shuffles two instruction streams and a Thread Synchronizer that checks if the fetched instruction is an xrr. The Alternator controls that Q 0 and Q 1 are run in correct order using xrrs.

Algorithm 22 decides to assign instructions with no dependences to the shorter queue to strive to keep queues equal in size. But dependences may affect the symmetry in queue sizes. So the shuffler must be capable of shuffling in proportion of queue sizes. Proportional shuffling results in two queues with fair execution time shares based on their sizes so as to minimize the idle time of short queues. To that end a random number generator outputs a queue index i ∈ {0, 1} with probabilities L 0 /(L 0 + L 1 ) and L 1 /(L 0 + L 1 ) respectively, where L i is the size of Q i . To construct this dynamically biased generator we used the hardware permutation technique of [START_REF] Brier | Fast Primitives for Internal Data Scrambling in Tamper Resistant Hardware[END_REF] and [START_REF] Bagini | Communication Networks Keyed permutations for fast data scrambling[END_REF]. These keyed hardware permutation generators are fast enough to produce an element i ∈ {0, 1} at each clock cycle. Using a permutation function Π(k, L) where k is the key and L = L 0 +L 1 is the length of permutation, it is possible to generate a random permutation Π of (1, 2, . . . , L 0 + L 1 ) and then construct a switch S(i, Π) that returns 0 if i appears in Π at a position i such that 1 ≤ i ≤ L i , and returns 1 if L 0 + 1 ≤ i ≤ L 0 + L 1 . In other words S(i, Π) acts as an oracle informing the CμP which queue must be unleashed to run instruction i.

Choosing a CPU core

The CμP was implemented in VHDL. The design includes a 68 05 core28 , the Alternator, ROM, two clone register banks and a 32-bit LFSR (as a simple Shuffler). Since we have simulated the CμP on ModelSim 6.3, no I/O ports were required. All input and output vectors are stored in files by the VHDL simulator. The implementation was used to generate the simulated power traces necessary for side-channel evaluation. We used the Hamming distance variation of all registers to model dynamic power consumption [START_REF] Tiri | Simulation models for side-channel information leaks[END_REF].

We also developed a code splitting tool in C++. The tool accepts a program in 68 05 assembly, extracts all dependences into several graphs, applies the alternation algorithms to these graphs and outputs two binary code streams. The binary code is then imported into ROM. Our method requires the CμP to implement the two new xrr opcodes. Luckily the 68 05 instructions table has several unused opcodes (e.g. 0x90, 0x91 and 0x92). We hence assigned 0x90, 0x91, 0x92 and 0x93 to brr, crr A, crr X and crr flags instructions respectively. If Q 0 contains an instruction such as brr 0x1234 then Q 0 should be stalled until PC 2 reaches 0x1234. Likewise, if Q 0 contains an instruction such as crr A,0x1234 then Q 0 should be stalled until PC 2 reaches 0x1234 and then the contents of register A of Q 1 would be transferred to the register A of Q 0 .

Area and speed penalty

Table 6.5 compares the simulation results of a standard 68 05 with those of its corresponding CμP on Xilinx Spartan-6 FPGA. Adding an extra register bank and the code alternation circuits increased area by about 20% in terms of registers and 7% in LUTs and decreased speed by about 4%.

Correlation power attack experiments

To benchmark our CμP design, we implemented a naive 128-bit AES in 68 05 assembly.

We then mounted a simple Correlation Power Attack (CPA) [START_REF] Brier | Correlation Power Analysis with a Leakage Model[END_REF] that targets the AddRoundKey subroutine during the final AES encryption round. In AddRoundKey, the secret key is exclusive-ored (eor instruction) with data. Knowing implementation details, spotting this eor is easy. Since the 68 05 is an eight-bit microprocessor, the 128-bit final round key is processed by a 16-round loop, each iteration of which performs an 8-bit eor. We attack the first 8 bits of the key in the first iteration.

The target clock cycle t 0 , in which the first 8-bit eor takes place, was determined experimentally to be the 15232 nd . t 0 is followed by fifteen remaining eors which occur every 245 cycles. We examine all 256 possible byte values at t 0 . To give a brief description of the attack, assume that D and C are data bytes values before and after the final AES round, and K represents the eight bits of the final round sub-key. Then C = ShiftRows(SubBytes(D)) ⊕ K (6.1)

To ensure that the 68 05 AES implementation is vulnerable to CPA, we performed the attack with the CμP working as a single queue CPU. We ran 200 encryptions using random inputs with a fixed key and gathered all simulated power traces. The leakage model used in CPA [BCO04; MOP07] is based on Hamming distance, and provides a linear estimation of power consumption. The model consists in measuring the number of bit flips (transitions from 0 to 1 or vice versa at the transistor level) from an original (unknown) rest state R. Therefore for each trace i, the power consumption P i during t 0 where the D i (the final round input) is converted to C i (the final round output) is related to:

HammingDist(C i , D i ) (6.2)
and for each 256 possible 8-bit key hypothesis K j j ∈ {0, ..., 255} there are 256 possible D ij s (see Equation (6.1)). The idea is to compute the Hamming distance between C i and D ij for execution i, with a key hypothesis j. This Hamming distance, denoted h ij , is compared to the power effectively used by the device during t 0 , denoted P i . A correct guess j would result in a high correlation between the model h ij and P i , as measured by Pearson's correlation formula:

ρ j = 1 (n -1)σ h σ p n i=0 h i -h P i -P (6.3)
where n is the number of power traces, P is the mean value of power traces at t 0 and σ p is the standard deviation of all the P i s. h is the mean value of the Hamming distance of all traces with standard deviation of σ h . The correct key causes a significant spike in ρ as is shown in Figure 6.26 where first four subkeys are shown in different colors. Each spike represents the most correlated key value for one of the four (8-bit) subkeys.

Next, we have run the same attack on the CμP. Figure 6.27 shows the result of CPA targeting four bytes of the final sub-keys. Figure 6.28 illustrates how three eors in the final round of AES (1 st , 2 nd , and 3 rd ) were scattered over the CPU cycles for 200 execution instances. In this experiment, CPA fails to identify the correct key. In general, if the correlation coefficient is divided by T , then in average T 2 times more traces are required to achieve the same accuracy level [START_REF] Mangard | Power analysis attacks -revealing the secrets of smart cards[END_REF]. In Figures 6.26 and 6.27, the correlation coefficient at t 0 for 4 key bytes has decreased from 1 to 0.06. The CμP's resistance against CPA can be tested experimentally by using more execution traces. Table 6.6 shows the number of successfully discovered sub-keys, along with number of evaluated traces. Full disclosure of the AES key requires at least 90000 traces. Table 6.6: Evaluating CμP resistance against CPA.

Traces

Correct sub-keys 50000 0 60000 2 70000 5 80000 14 90000 16

Conclusion

This paper introduced the use of randomized instruction interleaving as a side-channel countermeasure.

The new CPU architecture interleaves randomly the execution of two instruction queues. These queues are generated from a single target algorithm, whose functionality is preserved. Since the instructions' execution order varies between runs, fixed patterns in power consumption vanish, and the device resists side-channel attacks such as SPA and CPA.

Introduction

A process table is a data structure in RAM holding information about the processes currently handled by an operating system. This information is generally considered harmless and visible to all processes and to all users, with only minor exceptions, on a vanilla system30 . However, as pointed out by Qian et al. [START_REF] Qian | Collaborative TCP sequence number inference attack: how to crack sequence number under a second[END_REF]: "Even though OS statistics are aggregated and seemingly harmless, they can leak critical internal network/system state through unexpected interactions from the on-device malware and the offpath attacker" Indeed, several papers [JS12; ZW09; QMX12] used data from the procfs on Linux systems to compromise network or software security. Namely, [START_REF] Zhang | Peeping Tom in the Neighborhood: Keystroke Eavesdropping on Multi-user Systems[END_REF] could recover user's keystrokes based on registry information, and [QMX12; QM12; JS12] accessed other programs' memory to mount a network attack. In all such cases, attacks relied on additional information about the target process (such as instruction pointers or register values) which were publicly available. Following these attacks the procfs default access right policy was changed in recent Linux versions.

This paper describes and analyzes a new covert channel exploiting the process table that can be used reliably and stealthily to bypass process isolation mechanisms, thereby allowing inter-process communication on all major operating systems. Malicious programs exploiting this strategy do not need any specific permissions from the underlying operating system. Contrary to earlier attacks, we do not assume any additional information (registry values etc.) to be available.

Prior work. Whilst, to the best of the authors' knowledge, the problem of covert channel communication through process IDs (PIDs) was not formally addressed so far, the intuition that such channels exist must have been floating around, since most modern OSes currently randomize their process IDs. Interestingly, as we will later show, randomization makes our attacks easier.

Most known attacks on the process table exploited public information such as registry values [JS12; ZW09; QMX12]. Such information can be used directly or indirectly to recover sensitive data such as keys or keystrokes.

A long-standing bug of the BSD procfs became widely known in 1997 and relied on the possibility to write in the procfs, due to incorrect access right management. In that scenario, an unprivileged process A forks off a process B. Now A opens /proc/pid-of-B/mem, and B executes a setuid binary. Though B now has a different euid than A, A is still able to control B's memory via /proc/pid-of-B/mem descriptor. Therefore A can change B's flow of execution in an arbitrary way.

Besides these design flaws, many implementation mistakes led to a wealth of practical and powerful exploits against BSD's procfs in the early 2000's [NN97; Ete00; FU04; THJ + 00].

There is also trace of an old Denial-of-Service remote attack dubbed the "process table attack" [Ken99; DAR00]. According to [START_REF] Marchette | Computer intrusion detection and network monitoring: a statistical viewpoint[END_REF]p. 93] this attack was developed by the MIT Lincoln Labs for DARPA to be used as part of intrusion detection systems. Their approach relies on the hypothesis that the only limit to how many TCP connections are handled is the number of processes that the server can fork. This is by no means still the case on modern systems, rendering this attack completely inoperant. Note that instead of causing a DoS, the same approach could be used as a covert channel [Gli94, p. 109].

Preliminaries

Covert channels

Covert channels were introduced in [Lam73], and subsequently analyzed in [Lip75; SGL + 77; Hus78]. They are communication channels that enable communication between processes, which are not supposed to interact as per the computer's access control policy. We stress that the notion of covert channels is distinct from that of (legitimate) communication channels that are subjected to access controls. Covert channels are also distinct from side channels, which enable an attacker to gather information about an entity without this entity's collaboration.

Detecting covert channels is unfortunately generally hard, although general methodologies for doing so exist (e.g. [START_REF] Kemmerer | Shared resource matrix methodology: An approach to identifying storage and timing channels[END_REF]). Indeed, such channels may have devastating effects. Modern platforms implement a variety of security features meant to isolate processes and thus prevent programs from communicating, unless authorized by the security policy.

When modern counter-measures are not available, e.g. on mobile platforms, protecting against covert channels is very challenging. To further complicate things, many stake-holders take part in the development of mobile software and hardware (e.g. OEM handset manufacturers, telecommunication providers or carriers, application developers, and the device owner). For lack of better solutions, trusted execution environments (TEE) such as TrustZone emerged. These TEEs rely on hardware security resources present in the mobile platform which are not necessarily accessible to application developers and end-users.

Process IDs, process table, and forking

Processes running on top of an OS are given a unique identifier called process ID, or PID. The PID enables the OS to monitor which programs are running, manage their permissions, perform maintenance tasks, and control inter-process communication.

Historically, PIDs were allocated in sequence: Starting at 0 and incrementing until a system-specific maximum value, skipping over PIDs that belong to running programs. On some systems such as MPE/iX the lowest available PID is used, in an effort to minimize the number of process information kernel pages in memory. Every process knows its own PID 31 .

Complex applications also leverage process IDs. One typical example is forking: A process creates a copy of itself, which now runs alongside its parent. The PID of a parent process is known to the child process32 , while the child's PID -different from that of the parent -is returned to the parent. The parent may, for example, wait for the child to terminate33 , or terminate the child process. Between the moment a child process dies, and its parent reaps its return value, the child process is in a special zombie state 34 .

Fork is the primary method of process creation on Unix-like operating systems, and is available since the very first version of Unix [START_REF] Thompson | SYS FORK (II)[END_REF]. For DOS/Windows systems lacking fork support, the almost equivalent spawn functionality was supplied as a replacement for the fork-exec combination.

On Unix-like systems, information about all currently running processes (including memory layout, current execution point, open file descriptors) is stored in a structure called the process table. Whenever a process forks to create a child, the entire process table entry is duplicated, which includes the open file entries and the their file pointers -this is in particular how two processes, the parent and the child, can share an open file.

By default on Unix-like systems, the complete process table is public and accessible as a file through the procfs. Alternatively, non-root users can execute the ps -efl command to access the detailed table. On Microsoft Windows platforms (XP and above) the list is accessible through the EnumProcesses API35 .

For the sake of simplicity we used Python 3.4 with the psutil library to abstract these implementation details away. We thus have a wrapper function ps that works on all major platforms and provides us with process information.

Overview of the attack

Assumptions

We consider two programs A and B, and for the sake of clarity consider that A wants to send information to B. We assume that the operating system can freely implement any process isolation technique of its choosing, while allowing the following minimalistic assumptions:

1. A can fork36 ; 2. B can see A and its forks in the process table.

Even though there are restrictions on the number of forks that a process can launch, this limit is usually larger than one. In this work we only require the ability to launch one fork at a time. Forking at least once is nearly always possible. The second assumption is not unreasonable, as most systems expose all processes, including those launched by other (potentially priviledged) users and the kernel. Furthermore, tools such as unhide37 try to detect hidden processes by comparing the outputs of different programs and looking for inconsistencies. Similar techniques could be implemented by B even if the OS tries to restrict process visibility.

The idea here is to exploit the fact that PIDs are public and immediately visible to construct a covert channel.

Naive approach

First, assume that no processes other than A and B are being run. When A forks, the number of visible PIDs increases. When that forked process dies, the PIDs' population decreases. B queries the process table repeatedly and monitors the differences between successive counts -which are interpreted as 0s or 1s. Now what happens to this approach when we remove the assumption that no other processes are running? New processes are launched by the OS and by users. Old processes die. This may cause process table modifications at any time.

Depending on the situation, it may happen that such perturbations are rare, and do not impact communication between the malicious programs. If this is the case, then the covert channel reaches its maximal capacity, determined by the time t = max(t f , t k ) that it takes to fork or kill a program. In that scenario, A and B may use differential Manchester encoding (alknown known as F2F encoding): one of the two bits, i.e., "0" or "1", is represented by no transition at the beginning of a pulse period and a transition in either direction at the midpoint of a pulse period; the other is represented by a transition at the beginning of a pulse period and a transition at the midpoint of the pulse period. The covert channel capacity is therefore 1/2τ bits/s, where τ ≥ t is a timestep on which both parties agreed beforehand.

If however, the number and frequency of parasitic processes being created or killed is not negligible, this approach quickly fails, and requires a stronger handling of noise. Such a situation occurs on busy servers and workstations being actively used.

Handling noise

It might happen that when new processes are created, their PIDs are predictable -oftentimes the smallest available one. To some extent, this information could be used to deal with noise. However, such an approach would fail if processes are removed from the process table (and new ones start reusing the freed spots), and therefore wouldn't be reliable over time. We assume instead that the PIDs are attributed at random.

Let p be a prime number. If x and y are distributed uniformly modulo p, then x + y is also distributed uniformly modulo p. We make use of this fact in the following way: when a process is created or deleted, the sum of the PIDs modulo p changes to a value S which is, approximately, chosen uniformly at random modulo p.

Let T be a target value, consider the following algorithm.

1. Let f ← 0.

2. If S = T go to 1.

3. If S = T and f = 0, the main process A creates a fork38 A .

4. If S = T and f = 1, the process A kills itself.

Note that, assuming that there is no noise, this succeeds in setting S = T in expected p iterations. In other terms, if there is no external process creation or deletion during p iterations, S is set to the target value T . The strategy consists in running this algorithm continuously. Whenever there is a change in the process table, forks are created or deleted until the desired target sum is reached.

Note that, in the absence of noise, and if the OS attributes PIDs deterministically, then this algorithm may fail, as it could be stuck oscillating between two incorrect S values.

Channel capacity. Assume that external process creation or deletion happens on average every ∆ time units (one could consider a Poisson distribution for instance). If it takes a time t S for A to query S and t f to fork (or kill a fork), then it takes an expected time p(t S + t f ) to reach the target value. Therefore this algorithm sends ∆/p(t S + t f ) /∆ elements of Z p per elementary time unit. Hence, channel capacity is:

C(p) = ∆/p(t S + t f ) log 2 p ∆ bit/s
Note that ∆ should be large enough, namely ∆ > p(t S + t f ), for the channel to allow sending data at all. C(p) is maximal for p = 2, which incidentally makes implementation easier.

If one wishes to send data faster, error-correcting codes (such as LPDC) may be used to thwart the effect of noise and make communication reliable at higher rates.

Countermeasures

A number of solutions can be implemented at various levels to counter the attacks described in this paper. A prerequisite is the precise definition of the attack model. If we assume that the receiver and the sender use a known transmission process whose parameters are potentially known (for instance a key k shared between the sender and the receiver) then we can imagine ad hoc countermeasures targeting the specific transmission process and/or k. If, on the other hand the communication process is unknown then a number of generic countermeasures can be devised to try and prevent unauthorized transmission in general.

Because an important number of information leakage methods can be imagined and designed, this section will only deal with generic countermeasures. Note that we do not claim that any of the generic methods below will have a guaranteed effect on all PID-based covert channels.

Restricting process visibility

A most natural approach is simply to make PID information invisible to processes. At first glance, restricting (even partially) process visibility solves the issue, as two mutually invisible processes cannot communicate as described in this paper. To some extent, this is the kind of strategy employed by security patches such as grsec for Linux.

However, such a policy has limits. Indeed, there are processes that need to communicate and IPC was precisely designed to enable that. The goal is not to prevent any process from communicating with any other process, but to allow so if and only if such communication is permitted by the OS's security policy. It is sensible to try and hide kernel-related and other sensitive processes from untrusted programs, however it is not a good idea to isolate all processes from one another.

This policy restriction has the disadvantage of grandly reducing system functionally. Furthermore this counter-measure is vulnerable to transitive attacks, whereby a process acts as a relay between two mutually invisible programs. In some instances, processes may bypass the process table altogether, for instance by attempting to directly contact random PIDs. Depending on the answer, it is possible to guess that a process is running with that PID, even though it cannot be seen in the process table. Alternatively, it is possible to run legitimate commands (e.g. lsof) which have a different view of the process table. By using such commands, processes can gather information otherwise denied to them.

Zombies, timing and decoys

The most evident idea is similar to the adding of random delays in timing attacks or to the adding of random power consumption to prevent power attacks. Here the operating system can randomly launch and stop processes to prevent B from properly decoding the information coming from A. Note that the OS does not need to launch real processes, only zombies i.e. PIDs present in the table that do not correspond to actual processes. Alternatively, the OS may simply add random PIDs (decoys) when replying to a query about the process table.

To be efficient, this countermeasure needs to generate a sequence of process starts and interrupts in a way that effectively prevents information decoding by B. To illustrate our purpose, assume that B's processes are very rarely killed, and that the OS launches and kills PIDs at a very high pace. After a sufficiently long observation time, B may infer the processes belonging to A. As this is done A may start communicating information to B by progressively killing the processes it controls. This illustrates the need to have the OS generate and kill PIDs in a way indistinguishable from A. Because we do not know a priori the communication conventions used for this covert channel, this countermeasure can only rely on empirical estimates of normal program behaviour.

If the time between launched processes is used to send information, the OS can randomly delay the removal of PIDs from the list to prevent communication based on PID presence time.

A number of generic approaches, inspired by fraud detection, can also be imagined. The idea here consists in limiting system performance to reduce the attacker's degree of freedom. For instance, limiting the number of offspring processes launchable per unit of time by a process is also likely to have an effect on the attack as it would naturally reduce information rate. Note that this restriction should only apply to processes whose launcher requires a PID to appear publicly. Fraud-detection countermeasures consist in monitoring the frequency at which the PID-list is read by each process and detect processes whose behaviour may betray the reading of a covert channel.

Virtual PIDs

By modifying the way in which the OS manages PIDs, other countermeasures can be imagined. A possible way to implement such a protection consists in having a private PID list per process. Here, process U sees the PID of process V as f (s, U, V ) where s is an OS secret known to processes U and V . This allows U to solicit V without sharing PID information visible by both U and V . This may reduce the available information transmission channels to global information such as the PID-list's cardinality (number of processes), the time separating the appearing of new PIDs in the list etc.

A variant works as follows:

• Each time a process U queries the process table, U is given a random list of PIDs.

• When U requests an IPC with some process V , then upon the OS's IPC approval, the PIDs of V and U as seen by each other do not change anymore.

This still provides IPC functionality while preventing process table abuse.

Formal proofs

To tackle the problem in general, a formal model should be defined, so that one can attempt to come up with proofs of isolation. For instance, a process may be modelled as the data of a process birth time, a process death time and a value assigned by the OS. The birth and death times are controlled by the sender and the analyst's goal is to determine the channel capacity in the presence of generic countermeasures.

To the best of our knowledge, such models have not been developed so far.

Experimental setup

A proof-of-concept was implementated in Python 3.4, using the psutil library. Code was tested on a Linux server (Debian Jessie) and Microsoft Windows 7 and 8, for both 32-bit and 64-bit architectures, with similar results. All test machines were active web servers running Apache or Microsoft IIS in their latest versions as we are writing these lines.

The proof-of-concept consists in two programs, a sender and a receiver, that may be granted different permissions and be launched by different users. The implementation follows straightforwardly Section 6.3.3. The test consisted in sending a given sequence of bits from the sender to the receiver. The observed sequence on a busy server is illustrated on Figure 6.29, where the target sequence was "010101...". Exploitation aims at reliably taking control of, or extracting valuable information from a system (usually, a remote system). Against a computer, it may allow for a deeper installation of long-term observation or exfiltration capabilities.

That this is possible at all results from a long accumulation of engineering choices, at a time when the security implications were not salient, and less of a priority than the need for infrastructure and diffusion -the sunken cost now effectively preventing most attempts at rebuilding and rethinking these choicesor simply incorrect assumptions.

The Internet falls into the first category. When the Internet was designed, it came with no builtin confidentiality or integrity mechanism. As a consequence, messages sent over the Internet are not guaranteed to come from whence they claim; there is no guarantee that they weren't read along the way, or modified, unless we make good use of cryptographic techniques (authenticated key exchange, etc.). While the situation is improving on the user side of things, with most major browser now taking care of implementing up to half of the necessary security setup1 , the lowest layers of the Internet do not, and for technical reasons may never provide this kind of guarantees. This makes sending messages from fake senders a trivial exercise, a benign one if it weren't for the possible abuse of targeting a single receiver with many coordinated messages from (apparently) different sources.

Attacks of this kind often result in a saturation of the receiver's network and are known as (distributed) denial of service attacks (DDoS). Only in recent years have the bandwidth of such attacks become a concern, the most striking example at the time of writing is the 2016 attack against Dyn, a DNS provider for more than 60 major websites. 2 What made the attack difficult to thwart was a combination of the sheer stream (estimated at more than 1.5 Tbps) and the great diversity of devices which took part in the attack, making it very difficult to identify and block specific addresses. While its size and media appearance made this particular attack visible, it is in a sense representative of the kind of operations made possible by botnets -large networks of compromised devices, under the control of an operator that can launch coordinated and very targeted strikes.

Such strikes may have other effects than disabling their target. 3 Indeed, a botnet needs to grow to sustain its activity -nodes get blocked or deactivated, control of some device is lost, etc. -so part of a botnet's activity is focused around attacking targets so as to integrate them. This is how the Mirai botnet, responsible for the aforementioned 2016 Dyn attack, assembled its workforce. How are the candidates chosen? The botnet's operators combine vulnerability scans, Internet searchs, and information shared or bought on the black market. This is a very manual process, which may fail and expose the operator. In Section 7.4 we ask the question of the optimal strategy, i.e. that which guarantees the fastest conquest of a network by a botnet.

Exploitable vulnerabilities from the second category -incorrect assumptions -are ubiquitous in security systems. For instance, it happens to be the case that many intrusion detection systems, threat and computer virus detectors do not consider text as potential executable code; an English sentence would pass unfiltered because, it is incorrectly assumed, that may not be a threat. As we show in Section 7.1 this allows us to run arbitrary, polymorphic code on a a varierty of devices, including an unmodified iPhone 64 and a DragonBoard 410c. Another assumption made by some antivirus software is that malware exhibits recognisable "signatures", i.e. either pieces of code or structures in that code that do not change, despite evasion techniques such as polymorphism. We show in Section 7.2 how to generically transform the control flow of a program without altering its functionality, evading all current antivirus detectors.

To stronger attackers, deeper infiltration is possible. We show in Section 7.3 how to minimally alter a nanometric portion of a CPU at manufacture time to later recover secret cryptographic keys.

Introduction

Much effort has been undertaken in recent years to secure smartphones and tablets. For such devices, software security is a challenge: on the one hand, most software applications are now developed by third-parties; on the other hand, defenders are restrained as to which watchdogs to install, and how efficient they can be, given these devices' restricted computational capabilities and limited battery life.

In particular, it is important to understand how countermeasures fare against one of the most common security concerns: memory safety issues. Using traditional buffer overflow exploitation techniques, an attacker may exploit a vulnerability to successfully execute arbitrary code, and take control of the device [START_REF] One | Smashing The Stack For Fun And Profit[END_REF]. The relatively weak physical defenses of mobile devices tend to make memory attacks a rather reliable operation [DDS + 11].

In particular, an attack program may be self-contained in the form of a shellcode -a short string sent to the device, where a vulnerability is used to write a malicious program into memory and run it. This would enable an opponent to gain control of the device by opening a shell, or alter memory regardless of the security policy. In shellcode form, an attack is easy to distribute and weaponize, and many ready-made shellcodes are available with frameworks such as Metasploit [Pro].

To launch the attack, the opponent sends the shellcode to a vulnerable application, either by direct input, or via a remote client. However, before doing so the attacker might have to overcome a number of difficulties: if the device has a limited keyboard for instance, some characters might be hard or impossible to type; or filters may restrict the available character set of remote requests for instance. A well-known situation where this happens is input forms on web pages, where input validation and escaping is performed by the server.

This paper describes an approach allowing to compile arbitrary shellcodes into executable code formed from a very limited subset of the ASCII characters. We focus on alphanumeric shellcodes, and target the ARM-v8A architecture, to illustrate our technique. More specifically, we will work with the AArch64 instruction set, which powers the Exynos 7420 (Samsung Galaxy S6), Project Denver (Nexus 9), ARM Cortex A53 (Raspberry Pi 3), A57 (Snapdragon 810), A72, Qualcomm Kryo (Snapdragon 818, 820 and 823), as well as the Apple A7 and A8 ARMv8-compatible cores (Apple iPhone 5S/6/7).

Prior and related work

The idea to write alphanumeric executable code first stemmed as a response to anti-virus or hardening technologies that were based on the misconception that executable code is not ASCII-printable. Eller [START_REF] Eller | Bypassing MSB data filters for buffer overflow exploits on Intel platforms[END_REF] described the first ASCII-printable shellcodes for Intel platforms to bypass primitive buffer-overflow protection techniques. [START_REF] Eller | Bypassing MSB data filters for buffer overflow exploits on Intel platforms[END_REF] was shortly followed by RIX [START_REF] Rix | Writing IA32 alphanumeric shellcodes[END_REF] on the IA32 architecture. Mason et al. [MSM + 09] designed shellcodes using only English words to bypass IDS filters. Obscou [START_REF] Obscou | Building IA32 Unicode-Proof Shellcodes[END_REF] managed to obtain Unicode-proof shellcodes that work despite the limitation that no zero-character can appear in the middle of a standard C string. All the above constructions built on existing shellcode writing approaches and required manual fine-tuning.

Basu et al. [START_REF] Basu | Automatic Generation of Compact Alphanumeric Shellcodes for x86[END_REF] developed an algorithm for automated shellcode generation targeting the x86 architecture. The Metasploit project provides the msfvenom utility, which can turn arbitrary x86 programs into alphanumeric x86 code. Both UPX5 and msfvenom can generate self-decrypting ARM executables, yet neither provide alphanumeric encodings for this platform.

More recently, Younan et al. generated alphanumeric shellcodes for the ARMv5 architecture [YP09; YPP + 11]. They provide a proof that the subset of alphanumeric commands is Turing-complete, by translating all BF [Rai; Faa; Cri] commands into alphanumeric ARM code snippets.

Our contribution

This paper describes, to the best of the authors' knowledge, the first program turning arbitrary ARMv8 code into alphanumeric executable code. The technique is generic and may well apply to other architectures. Besides solving a technical challenge, our tools produce valid shellcodes that can be used to try and take control of a device.

Our global approach is the following: we first identify a subset Σ of minimal Turing-complete alphanumeric instructions, and use Σ to write an in-memory decoder. The payload is encoded offline (with an algorithm that only outputs alphanumeric characters), and is integrated into the decoder. The whole package is therefore an alphanumeric program, and allows for arbitrary code execution. All source files are provided in the appendices.

Preliminaries

Notations and definitions

Throughout this paper, a string will be defined as alphanumeric if it only contains upper-case or lower-case letters of the English alphabet, and numbers from 0 to 9 included. When writing alphanumeric code, spaces and return characters are added for reading convenience but are not part of the actual code. Words are 32-bit long. We call polymorphic, a code that can be mutated using a polymorphic engine into another one with the same semantics.

When dealing with numbers we use the following convention: plain numbers are in base 10, numbers prefixed by 0x are in hexadecimal format, and numbers prefixed by 0b are in binary format. The littleendian convention is used throughout this paper for alphanumeric code, to remain consistent with ARMv8 internals. However, registers will be considered as double-words or words; each 32-bit register W = W high W low is split into a most significant 16 bits half-word W high and a least significant 16 bits W low . S[i] denotes i-th byte6 of a string S.

Vulnerable applications and platforms

To attempt a buffer overflow attack, we assume that there exists a vulnerable application on the target device. Smartphone applications are good candidates because (1) they can easily be written in languages that do not check array bounds; and (2) they can be spread to many users via application marketplaces. Note that on Android platforms, applications are often written in Java which implements implicit bound checking. At first glance it may seem that this protects Java applications from buffer overflow attacks. However, it is possible to access C/C++ code libraries via the Java Native Interface (JNI), for performance reasons. Such vulnerabilities were exposed in the JDK [START_REF] Tan | An Empirical Security Study of the Native Code in the JDK[END_REF].

ARMv8 AArch64

AArch64 is a new ARM-v8A instruction set. AArch64 features 32 general purpose 64-bit registers Xi (0 ≤ i < 32) and 32 registers for floating-point numbers. All instructions are 32-bit long. The 32 LSBs of each Xi is a word denoted by Wi. These words are used directly in many instructions. Younan et al.

[YPP + 11] use the fact that, in AArch32 (32-bits ARM architecture), almost all instructions can be executed conditionally via a condition code checked against the CPSR register. In AArch64, this is not the case anymore. Only specific instructions, such as branches, can be made conditional: this renders Younan et al.'s approach inoperant.

Each instruction is made of an opcode and zero or more operands, where opcode gives the instruction to perform and operands may consist in addresses, register numbers, or constants. As an example, the instruction:

ldr x16 , PC +0 x60604
is assembled as 0x583030307 and decoded as follows [START_REF] Limited | ARM Architecture Reference Manual. ARMv8, for ARMv8-A architecture profile[END_REF]:

0 1 0 1 1 0 0 0 imm19 Xt
Bits 0 to 4 encode the reference number of a 64-bit register Xt. Bits 5 to 23 encode the immediate value imm19, which is a relative offset counted in words (a single word is 32-bit long).

An interesting feature is that immediate values and registers often follow each other in instructions, as is the case here for imm19 and Xt. This is a real advantage for creating alphanumeric shellcodes, as it indicates that instructions who share a prefix are probably related. For instance 000X and 100X turn out to decode respectively into Thus it is relatively easy to modify the operands of an existing instruction.

Shellcodes

A shellcode is a set of machine code instructions injected into a running program. To that end, an attacker would for instance exploit a buffer overflow vulnerability. The attacker could insert executable code into the stack, and control the current stack frame's return address. As a result, when the victim program's current function returns, the attacker's code is executed. Other strategies might be employed to achieve that goal, but the stack frame hack is well known and we will use for simplicity.

It is common practice to flood the buffer with a nopsled, i.e. a sequence of useless operations, which has the added benefit of allowing some imprecision in the return address.

Shellcodes may execute directly, or employ some form of evasion strategy such as filter evasion, encryption or polymorphism. The latter allows having a large number of different shellcodes that have the same effect, which decreases their traceability. In these cases the payload must be encoded in a specific way, and decode itself at runtime.

In this work, we encode the payload in a filter-friendly way and equip it with a decoder (or vector). The vector itself must be filter-friendly, and is usually handwritten.

Hence designing a shellcode is a tricky art.

Building the instruction set

Some ARM instructions are alphanumeric. To find these, we generated all 14,776,336 alphanumeric 32-bit words using the custom-made program provided in Section 7.1.8. This gave 4-byte values that were then tentatively disassembled using objdump8 for the AArch64 architecture, in the hope that these chunks correspond to valid and interesting instructions. For instance, the word 000X corresponds to an ldr instruction:

58303030 ldr x16 , PC +0 x60604
Alphanumeric words that do not correspond to any valid instruction ("undefined") were removed from our set. For instance, the word 000S is not a valid instruction:

.inst 0 x; undefined

Valid instructions were finally classified as pertaining to data processing, branch, load/store, etc. At this step we established a first list A 0 of all valid alphanumeric AArch64 instructions.

From A 0 , we constructed a set A 1 of opcodes for which there exists at least one operand instance making it alphanumeric. A 1 is given in Section 7.1.9.

Finally, we extracted from A 1 only those instructions which we could use to prototype higher-level constructs. This final list is called A max .

Data processing

The following instructions belong to A max : The constraint that the sf bit must be set to 0 restricts us to using only the 32-bit variant of most instructions. This makes modifying the upper 32 bits of a register harder.

Branches

Only conditional jumps are available:

cbz 32 -bit cbnz 32 -bit b . cond tbz tbnz
It is quite easy to turn a conditional jump into a non-conditional jump. However, only tbz and its opposite tbnz have a realistic use for loops. The three other instructions require an offset too large to be useful.

Exceptions and system

Neither exceptions nor system instructions are available. This means that we cannot use syscalls, nor clear the instruction or data cache. This makes writing higher-level code challenging and implementationdependent.

Load and stores

Many load and stores instructions can be alphanumeric. This requires fine tuning to achieve the desired result, as limitations on the various load and store instructions are not consistent across registers.

SIMD, floating point and crypto

No floating point or cryptographic instruction is alphanumeric. Some SIMD are available, but the instructions moving data between SIMD and general purposes registers are not alphanumeric. This limits the use of such instructions to very specific cases.

Therefore, we did not include any of these instructions in A max .

Higher-level constructs

A real-world program may need information about the state of registers and memory, including the program counter and processor flags. This information is not immediately obtainable using A max . We overcome this difficulty by providing higher-level constructs, which can then be combined to form more complex programs. Indeed it turns out that A max is Turing-complete. Those higher-level constructs also make easier to build polymorphic programs, given that several low-level implementations are available for each construct.

Registers operations

Zeroing a register There are multiple ways of setting an AArch64 register to zero. One of them which is alphanumeric and works well on many registers consists in using two and instructions with shifted registers. However, we only manage to reset the register's 32 LSBs. This becomes an issue when dealing with addresses for instance.

As an example, to reset w17 low , execute:

ands w17 , w17 , w17 , lsr #16 ands w17 , w17 , w17 , lsr #16

This corresponds to the code 1BQj1BQj. Loading arbitrary values into a register Loading a value into a register is the cornerstone of any program. Unfortunately there is no direct way to perform a load directly using only alphanumeric instructions. We hence used an indirect strategy. Using adds and subs with the available immediate constants, we can increment and decrement registers. One of the constraints is that this immediate constant must be quite large. Thus, we selected two consecutive constants, using an adds/subs pair. By repeating this operation we can set registers to arbitrary values. For instance, to add 1 to the register w11 we can use: which is encoded by ki0qke01.

The following table summarizes the available increment and decrement operations: We manually selected registers and constants to achieve the desired value. However, it would be much more efficient to solve a knapsack problem, if one were to do this at a larger scale. As we will see later on, the values above are sufficient for our needs. which is encoded by qA010B0q. We will later use this approach to design a logical and operation.

a a ← a + 1 a ← a -1 w2

Moving a register

Bitwise operations

Exclusive OR The xor operation B ← A⊕B can be performed as follows: We split the two input registers into their higher and lower half-words, and use a temporary register C.

C ← 0 C high ← C high ⊕ ¬A low C low ← C low ⊕ ¬A high B high ← B high ⊕ ¬C low = B high ⊕ A high B low ← B low ⊕ ¬C high = B low ⊕ A low
This gives the following code: For c = w17, the following instructions can be used: Logical NOT We use the fact that ¬b = b ⊕ (-1) which relies on negative number being represented in the usual two's complement format. Thus we can use the operations described previously:

a b b ← a ⊕ b
C ← 0 C ← C -1 B ← C ⊕ B
Logical AND The and operation is more intricate and requires three temporary registers C, E, and F . We manage to do it by anding the lower and the upper parts of the two operands into a third register as follows:

D ← 0 C ← 0 E ← 0 F ← 0 C high ← C high ⊕ ¬B low E high ← E high ⊕ ¬A low F low ← F low ⊕ ¬E high = A low D low ← F low ∧ ¬C high = A low ∧ B low C ← 0 E ← 0 F ← 0 C low ← C low ⊕ ¬B high E low ← E low ⊕ ¬A high F high ← F high ⊕ ¬E high = A high D high ← F high ∧ ¬C low = A high ∧ B high
Which corresponds to the assembly code: As an illustration of this technique, let

A ← w18, B ← w25, C ← w17, D ← w11, E ← w19, F ← w26
which corresponds to computing w11 ← w18 ∧ w25. This gives the following assembly code: This is an alphanumeric program which we can write more compactly as:

kAKjkAKj1BQj1BQjsBSjsBSjZCZjZCZj1B9JsB2J ZCsJKCqj1BQj1BQjsBSjsBSjZCZjZCZj1ByJsBrJ ZC3JKC1j
We provide in Section 7.1.10 a program generating more instructions of this type.

Load and store operations

There are several load and stores instructions available in A max . We will only focus or ldrb (which loads a byte into a register) and strb (which stores the low byte of a register into memory). ldrb is available with the basic addressing mode: ldrb wA, [xP, #n] which loads the byte at address xP+n into wA. To use this instruction we must use a value of n that makes the whole alphanumeric, but this is not a truly limiting constraint. Moreover, we can chain different values of n to load consecutive bytes from memory without modifying xP.

Another addressing mode which can be used is ldrb wA, [xP, wQ, uxtx]. This will extend the 32-bits register wQ into a 64 bit one, padding the high bits with zeros, which removes the need for an offset.

As an illustration, we load a byte from the address pointed by x10 and store it to the address pointed by x11. First, we initialize a temporary register to zero and remove the ldrb offset from x10 using the previous constructs. These two instructions correspond to the alphanumeric executable code Y5A9yI38.

Pointer arithmetic

32-bit address case.

As we mentioned previously we only control the lower 32 bits of XP with data processing instructions. Thus, if addresses are in the 4 GB range, we can use the data-instructions seen previously to add 1, load the next byte, and loop on it.

64-bit address case.

If the address does not fit into 32 bits, any use of data instructions will clear the 32 upper bits. Thus, we need a different approach.

We use another addressing mode which reads a byte from the source register, and adds a constant to it. This addition is performed over 64-bits. As an example, we read a byte from x10+1 and increment x10: The same limitations apply to strb.

Branch operations

A max contains several branch instructions, however there are severe restrictions on the minimum offset we can use, since this offset must be alphanumeric. For this reason we will only use the tbz and tbnz instructions.

The tbz (test and branch if zero) is given three operands: a bit b, a register Rt and a 14-bit immediate value imm14. If the b th bit of register Rt is equal to zero, then tbz jumps to an offset imm14.

There is a tradeoff here since we cannot easily control individual bits. We chose the smallest offset value, at the expense of restricting our choice for Rt and b. tbnz works symmetrically and jumps if the tested bit equals 1.

We can turn tbz into an unconditional jump by using a register that has been set to zero. Conditional jumps require that we control a specific register bit, which is trickier.

The smallest forward jump offset we can encode is by 1540 bytes, and the smallest backward jump offset is 4276 bytes.

The maximal offset reachable with any of these instructions is less than 1 MB.

Fully alphanumeric AArch64

The building blocks we described so far could be used to assemble complex programs from the bottom up. However, even though many building blocks could be designed in theory, in practice we get quickly limited by branching, system instructions and function calls: Turing-completeness is not enough.

We circumvent this limitation by first encoding the payload P as an alphanumeric string. Decoding is performed in-memory by a vector program written only with instructions drawn from A max , leveraging the higher-level constructs of the previous section. Finally, the decoded payload is executed.

The encoder E was implemented in PHP, with the corresponding decoder D implemented as part of the vector with instructions from A max only. Finally, we implemented a linker L D that embeds the encoded payload in D. This operation results in an alphanumeric program A ← L D (E(P )).

The encoder

Since we have 62 alphanumeric characters, it is theoretically possible to encode almost 6 bits per alphanumeric byte. However, to keep D short, we only encode 4 bits per alphanumeric byte. This spreads each binary byte of the payload P over 2 alphanumeric consecutive characters.

E splits the upper and lower part of the input byte P [i] and adds 0x40 to each nibble:

a[2i] ← (b[i] & 0xF) + 0x40 a[2i + 1] ← (b[i] 4) + 0x40
Zero is encoded in a special way: the above encoding would give 0x40 i.e. the character '@', which does not belong to our alphanumeric character set. We add 0x10 to the previously computed a [k] to transform it into a 0x50 which corresponds to 'P'. The encoder's source code is provided in Section 7.1.11.

The decoder

Decoding is straightforward, but because D must itself be an alphanumeric program some tricks must be used. Our solution is to use the following snippet: The first eon shifts wA 20 bits to the left and negates it, since wZ is zero:

wA 2 ← wZ ⊕ ¬(wA 1 20) = ¬(wA 1 20)
The ands is used to keep only the 4 lowest bits of wB. The reason why the pattern 0xFFFF000F is used (rather than the straightforward 0xF) is that the instruction ands wB, wB, 0xFFFF000F is alphanumeric, whereas ands wB, wB, 0xF is not. The last eon performs the following operation: wB is xored with the negation of wA shifted 16 bits right, thus recovering the 4 upper bits.

wB ← wB ⊕ ¬(wA 2 16)

= wB ⊕ ¬(¬(wA 1 20) 16)

= wB ⊕ (wA 1 4)

It is natural to wish D to be as small as possible. However, given that the smallest backward jump requires an offset of 4276 bytes, D cannot possibly be smaller than 4276 bytes.

Payload delivery

The encoded payload is embedded directly in D's main loop. D will decode the encoded payload until completion (cf. Figure 7.1), and will then jumps into the decoded payload (cf. Figure 7.2).

To implement the main loop we need two jump offsets: one forward offset large enough to jump over the encoded payload, and one even larger backward offset to return to the decoding loop. The smallest available backward offset satisfying these constraints is selected, alongside with the largest forward offset smaller than the chosen backward offset. Extra space is padded with nop-like instructions.

The decoder's source code is provided in Section 7.1.12.

Assembly and machine code

Note that there is no bijection between machine code and assembly. As an example, 0x72304F39 (9O0r) is disassembled as

ands W25 , W25 , #0 xFFFF000F
but this very instruction, when assembled back, gives 9O.r (0x72104F39), which is not alphanumeric. Structurally, 9O0r and 9O.r are equivalent. However, only the latter is chosen by the assembler. Thus, to ensure that our generated code is indeed alphanumeric we had to put directly this instruction's word representation in the assembly code. Using the fact that registers fields are contiguous, simple arithmetic allowed us to compute the right word directly from the register number. 2) is twice the size of (3).

Polymorphic shellcode

It is possible to add partial polymorphism to both the vector and the payload using our approach. This allows the shellcode evading basic pattern matching detection methods [START_REF] Bontchev | Future Trends in Virus Writing[END_REF] but more specific techniques can be applied here in order to fool more recent IDS [DUM + 03].

The payload can be mutated using the fact that only the last 4 bits of each byte contains information about the payload, allowing us to modify the first 4 bytes arbitrarily, as long as the instructions still remain alphanumeric. This gives a total polymorphism of the payload as shown by the polymorphic engine provided in Section 7.1.14, which mutates each byte into between two and five possibilities. Moreover, the padding following the payload is also mutated with the same code. The NOP sled can also be made totally polymorphic. Indeed, a trivial search reveals more than 80 000 instructions that could be used as NOP instructions in our shellcode.

The vector is made partially polymorphic by creating different versions of each high level construct. The two easiest ones being the ones defined in Sections 7.1.4.1 and 7.1.4.1, which have both been implemented. Indeed, in order to zero a register, it is possible replace the shift value by anything in the set {16..30} \ {23} . The same idea can be applied to increasing or decreasing a register, in which the immediate value can be replaced by any other constant keeping the instruction alphanumeric (the values are in the range 0xc0c -0xe5c, with some gaps in between). We show as an example a polymorphic engine that mutates the zeroing a register construct in Section 7.1.14. Those two techniques are enough to mutate 9 over 25 instructions of the decoder, and by counting the NOPs and the payload, we have that 4256 over 4320 bytes of the shellcode are polymorphic.

Experimental results

On ARM, when memory is overwritten, the I-cache is not invalidated. This hampers the execution of self-rewriting code, and has to be circumvented: we need to flush the I-cache for our shellcode to work. Unfortunately the dedicated instruction to do that is not alphanumeric 9 .

More precisely, there are only two situations where this is an issue:

• Execution of the decoder;

• Jump to the decoded payload.

Our concern mostly lies with the second point. Fortunately, it is sufficient that the first instructions be not in the cache (i.e. that cache be flushed with the first instructions). This enables us to make this shellcode work on a given ARM core. However, cache management is implementation-dependent when it comes to details, making our code less portable.

QEMU

As a proof-of-concept, we tested the code with QEMU [START_REF] Bellard | QEMU, a Fast and Portable Dynamic Translator[END_REF], disregarding the above discussion on cache issues. Moreover, as addresses are below the 4 GB barrier, we can easily perform pointer arithmetic. We provide in Section 7.1.13 the output of our tool, where the input is a simple program printing "Hello World!". The result can be easily tested using the parameters given in Section 7.1.13.

DragonBoard 410c

We then moved to real hardware. The DragonBoard 410c [Qua] is an AArch64-based board with a Snapdragon 410 SoC. This SoC contains ARM Cortex A53 64-bit processor. This processor is widely used (in the Raspberry Pi 3 among many others) and is thus representative of the AArch64 world. We installed Debian 8.0 (Jessie) and were successfully able to run a version of our shellcode. We had no issue with the I-cache: As we do not execute code on the same page we write, the cache handler does not predict we are going to branch there.

Apple iPhone

In this work we focused on the Apple iPhone 6 running iOS 8. Most iOS 8 applications are developed in the memory-unsafe Objective-C language, and recent research seems to indicate the pervasiveness of vulnerabilities [XBL + 15] , all the more so since a unicode exploit on CoreText10 working on early iOS 8 has been released, which consists in a corruption of a pointer being then dereferenced.

We build an iPhone application to test our approach. For the sake of credibility, we shaped our scenario on existing applications that are currently available on the Apple Store. Thus, although we made the application vulnerable on purpose, we stress that such a vulnerability could realistically be found in the wild.

Namely, the scenario is as follows:

• The application loads some statically compiled scripts, which are based on players parameters

• It also interprets the downloaded scripts (they cannot be compiled per Apple guidelines)

• Downloaded scripts (for example scripts made by users) are sanity-checked (must be printable characters: blanks + 0x20-0x7E range)

• Thus, there is an array of tuples {typeOfScript, p} where typeOfScript indicates interpreted script or JIT compiled executable code, and p is a pointer to the aforementioned script or code.

• A subtle bug enables an attacker to assign the wrong type of script in certain cases

• Thus we can force our evil user-script to be considered as executable code instead of interpretable script.

• Therefore our shellcode gets called as a function directly.

From then on, the decoder retrieves the payload and uses a gadget to change the page permissions from "write" to "read|exec" 11 , and executes it. We never encountered cache coherency issues.

In this proof-of-concept, our shellcode only changes the return value of a function, displaying an incorrect string on the screen.

Conclusion

We described a methodology as well as a generic framework to turn arbitrary code into an (equivalent) executable alphanumeric program for ARMv8 platforms. To the best of our knowledge, no such tools are available for this platform, and up to this point most constructions were only theoretical.

Our final construction relies on a fine-grained understanding of ARMv8 specifics, yet the overall strategy is not restricted to that processor, and may certainly be transposed to address other architectures and constraints.

Source code of Program 1

The following Haskell program generates all the possible combinations of 4 alphanumeric characters, and saves the result in a file.

Alphanumeric instructions

This section describes A 1 , the set of all AArch64 opcodes that can give alphanumeric instructions for some operands.

• Data processing instructions:

adds , sub , subs , adr , bics , ands , orr , eor , eon , ccmp • Other (SIMD, floating point, crypto...)

cmhi , shl , cmgt , umin , smin , smax , umax , usubw2 , ushl , srshl , sqshl , urshl , uqshl , sshl , ssubw2 , rsubhn2 , sqdmlal2 , subhn2 , umlsl2 , smlsl2 , uabdl2 , sabdl2 , sqdmlsl2 , fcvtxn2 , fcvtn2 , raddhn2 , addhn2 , fcvtl2 , uqxtn2 , sqxtn2 , uabal2 , sabal2 , sri , sli , uabd , sabd , ursra , srsra , uaddlv , saddlv , sqshlu , shll2 , zip2 , zip1 , uzp2 , mls , trn2

Alphanumeric AND

The and operation described in Section 7.1.4.2 can be automatically generated using the following code.

To abstract register numbers and generate repetitive lines, the source code provided is pre-processed by m4 [START_REF] Kernighan | The M4 macro processor[END_REF]. This allowed us to easily change a register number without changing every occurrence if we found that a specific register could not be used.

divert ( -1) changequote ({ ,}) define ({ LQ } ,{ changequote ( , ){ dnl } changequote ({ ,})}) define ({ RQ } ,{ changequote ( , ) dnl { } changequote ({ ,})}) changecom ({ ; }) define ({ concat } ,{ $1$2 }) dnl define ({ A } ,

Encoder's Source Code

We give here the encoder's full source code. This program is written in PHP.

function mkchr ( $c ) { return ( chr (0 x40 + $c )); } $s = file_get_contents ( shellcode . tmp ); $p = file_get_contents ( payload . bin ); $b = 0 x60 ; /* Synchronize with pool */ for ( $i =0; $i < strlen ( $p ); $i ++)

{ $q = ord ( $p [ $i ]); $s [ $b +2* $i ] = mkchr (( $q >> 4) & 0 xF ); $s [ $b +2* $i +1] = mkchr ( $q & 0
xF ); } $s = str_replace ( @ , P , $s ); file_put_contents ( shellcode . bin , $s );

Decoder's source code

We give here the decoder's full source code. This code is pre-processed by m4 [KR77] which performs macro expansion. The payload program to decode has to be be placed at the pool offset.

divert ( -1) changequote ({ ,}) define ({ LQ } ,{ changequote ( , ){ dnl } changequote ({ ,})}) define ({ RQ } ,{ changequote ( , ) dnl { } changequote ({ ,})}) changecom ({ ; }) define ({ concat } ,{ $1$2 }) dnl define ({ repeat } , { ifelse ( $1 , 0 , {} , $1 , 1 , { $2 } , { $2 repeat ( eval ( $1 -1) , { $2 })})}) define ({ P } , 10) define ({ Q } ,

Polymorphic engine

The following shows two modifications that make the code partly polymorphic. The first one is a modification of the encoder, that will randomize both the payload and the remaining blank space.

function mkchr ( $c ) { $a = []; if ( $c >0 x0 ){ $a [] = 0 x40 ; $a [] = 0 x60 ;} if ( $c <0 xA ){ $a [] = 0 x30 ;} if ( $c <0 xB ){ $a [] = 0

Introduction

In the white-box security model, adversaries have access to a program's internals -assembly code, memory, etc. This model captures real-world attacks against low-end devices, as well as disassembly and dynamic analysis against software. Such attacks may allow the adversary to extract secrets from the implementation, either in the form of tokens (passwords, etc.), intellectual property (algorithms, etc.), or may help uncover design flaws that may later be exploited. Reverse-engineering may also help the adversary recognize some trait that the program shares with other programs, e.g. in the case of malware analysis or intellectual property infringement. The aim of obfuscation in general is to prevent reverse-engineering, by defeating automated methods and stave off human efforts to make sense of the code. Applications of RE-evasion techniques are many, and constitute for instance an essential building block of digital rights management (DRM) systems.

Historically, program identification focused on finding known code chunks called signatures in the binary. While this technique is still widely in use amongst intrusion and virus detection systems, such an approach requires both extensive, and up-to-date, databases (to account for the ever-growing population of threats) and a very efficient binary comparison method. At the same time, widely used packagers with self-modifying code capacity, now standard amongst virus designers, made the traditional signature-based approach less and less effective.

Indeed, an increasing number of malicious programs re-write their executable code so as not to feature any recognizable code of significant length. In practice, it is not even necessary to resort to very complex re-writing mechanisms: the malicious code can simply add (or remove) useless instructions or instruction sequences (such as nop, and reversible register operations, e.g. inc/dec) to disrupt a trivial comparison. While such variation can be accounted for, it requires significantly more effort from the analyst, especially when scanning a large number of files.

An alternative, and certainly complementary approach to malware detection and analysis consists in running the program of interest within a controlled environment, or sandbox, in which every operation can be monitored and does not impact the "real" underlying system. Sandboxes typically implement a form of virtualized environment, and monitor access to resources, secrets, and peripherals to detect abnormal behavior. Naturally, the term 'abnormal' is application-dependent, hence this approach assumes that characteristic behavioral features are known and are sufficiently distinguishable from those of uninfected software. Furthermore, running such a controlled environment is resource-and time-demanding. This limits the interest of sandboxing as a program identification tool.

Between these two approaches, recent research focused on methods for comparing programs using control-flow graph isomorphism [DR05; Fla04; KKM + 05; Sab04]. The rationale is that the program's flow graph (CFG) wouldn't be altered significantly by the adjunction or removal of useless "decoy" operations, the kind of which thwarts direct comparison. CFG comparison techniques are also unaffected by straightline code obfuscation techniques, e.g. when each function's code is completely rewritten. CFGs can be extracted statically to a large extent, and therefore constitute an attractive and resource-frugal alternative to full-blown virtualisation.

Defeating CFG analysis. In the malware-writing community, a typical anti-reverse engineering technique is the trampoline: instead of using typical control flow instructions such as jmp or call, the program makes heavy use of exception handling, that preempts the instruction pointer and runs the exception handler, which re-dispatches control flow to another part of the program (see e.g. [START_REF] Vincenzo | Code-Reuse Attacks and Defenses[END_REF]). After execution, each program part raises an exception, and falls back to an exception handler (hence the name, trampoline). There can be several trampolines, which may be created and moved at runtime, and code boundaries need not be rigid. This prevents disassemblers from reliably cross-referencing information, and makes it difficult to perform dynamic analysis as well, because it is typically impossible to run such code within a debugger.

However, because there is no classical call hierarchy, trampolines have to emulate the stack, and an analyst that recognizes the mechanism can easily reconstruct the control flow graph by following this pseudo-stack. Therefore, while the use of trampolines slows down analysis, it is by no means an efficient method anymore against trained reverse engineers, and the additional effort put into designing such code is not worth the marginal gain.

Recent work tried to automate the process, which strives to achieve a "flat" control flow graph, i.e. a graph with either a single central trampoline that dispatches execution, or a program that is fully unrolled and appears as a long straight-line code segment without internal structure [WHK + 00; CGJ + 01; LD03; PDA07; LK09; CP10; SK11]. However not only are such techniques not always applicable, but more importantly they tend to produce code that, while "flat", has salient signatures.

Our contribution. This paper addresses the question of rewriting a program in a way that hides its original control flow graph from static analysis (and, to a certain extent, from dynamic analysis as well), while preserving functionality. Straight-line code (SLC) obfuscation techniques can be used on top of our construction to destroy remaining signatures. Indeed SLC obfuscators have already been described in the literature and shown to effectively defeat classic code analysis techniques [SKK + 16]. The rewriting is randomized, and produces different outputs every time. Unlike the trampoline construction, whose heavy use of exception handling is easily recognizable, and from there, traceable, our construction only uses common instructions and rely on a specific routing mechanism along execution -which is much harder to detect.

More formally, given a program P , we show how to obtain a functionally equivalent program P , such that the CFG of P is essentially a random graph. This transformation is automatic, and we show how to implement a CFG-transcompiler for the x86-64 architecture, which is widely used and furthermore makes our implementation easier.

Control flow graph transcompilation

Prerequisites

The control flow graph of a program is a graphical representation, based on nodes and edges, of the paths that might be traversed by the program during its execution.

Definition 7.1 (Control flow graph)

The (full) control flow graph of a program P is the graph whose nodes are the program's instructions and the edges are control flow transitions. The restricted control flow graph of P has for nodes straight-line blocks, i.e. a maximal sequence of code without departure or arrival of static jumps, and there is an edge from node x to node y (and we write x → y) if either of the following conditions hold:

• The code of node y is located immediately after the node x, and both are separated by a conditional jump.

• The last instruction of the node x is either a conditional or a static jump, which is a call to the physical address of the beginning of the node y.

In the following, unless specified otherwise, we always refer to the restricted control flow graph. This construction does not include information about dynamic jumps: In practice it is challenging to statically and reliably resolve dynamic jumps. The ret instruction, which we cannot ignore since it is often used to implement function calls, will be dealt with in a special way. However, other dynamic and indirect control flow modifications (e.g. by direct alteration of the instruction pointer, or non-standard exception handling) are not considered in this work. One the one hand this is a limitation, that may prevent some programs from undergoing the transformation that we propose. On the other hand, this may constitute an interesting countermeasure against code-reuse and hijack attacks that leverage such possibilities.

Let P be the program to be obfuscated. We denote by G = (V, E) the CFG of P , where V and E correspond respectively to the nodes and edges of G. Let G = (V , E ) be a given 'final' target CFG.

Overview of our approach

Our goal is to rewrite P into a program P that achieves the same functionality as P , but whose CFG is G G = (V, E) = CFG(()P ). This is achieved in successive steps, illustrated in Figures 7.5 to 7.8.

Step 1: Relabeling. We start from a morphism π between the two graphs, i.e. a function that is injective on nodes and preserves edges. If we fail to find enough nodes or edges to perform this operation, which happens with very low probability when the target graph is large enough, we simply start over with a new random graph G . The process is illustrated in Figure 7.5.

Step 2: Breaking edges. Then, additional nodes will be added by transforming the graph. The idea is to replace simple edges by paths in G = (V , E ), i. • ∀i ∈ {1, . . . , n -1}, (s i , s i+1 ) ∈ E

We keep track of which edges were originally present and which edges were added at this step. The process is illustrated in Figure 7.6.

a b

Step 1

---→ π(a) π(b)
Step 2 Step 3: Identifying active and passive nodes. The previous step introduced 'extra' operations between a and b. Since we wish to preserve the original program's functionality, we should make sure that only the original endpoints, a and b, are executed, while all the intermediary nodes are without effect when executed. We call a and b the active nodes, and the intermediary nodes (i.e. edges that do not exist in the original CFG) are called passive.

---→ π(a) π(b) • • • s 1 s 2 s n

Remark.

A node that is neither active nor passive in the control flow graph G can be considered either active or passive in G .

Depending on the execution path taken, some nodes may be active or passive (e.g. Figure 7.7). To decide whether a given node is active or passive, the program (more precisely, the node itself) checks at runtime the value of a routing variable (see below). Step 4: Routing. Finally, we transform each node so that execution of passive nodes is without side effects (a process we call passivation), except continuing through the sequence of nodes until an active node is attained. To that end we introduce an additional 'routing' variable that will be updated as the program is executed.

Nodes consult the routing variable to know whether they are active or not; if not, they simply hand over execution to the next node in sequence (possibly after executing dummy instructions). The path is taken according the routing variable m. If the node is passive (m = 0), the path to be taken will be the subsequent node. In the case of a active node (m = 1), the next node will be defined by the current node

m = 0 s 1 π(a) m = 1 s 2 m = 0 s 3 m = 0 π(b) m = 1 π(c) m = 1 s 4 m = 0

Contexts

During program execution, every node in the transformed program undergoes the following procedure:

1. Determine whether it is active or passive.

2. If active, restore the registers. Otherwise passivate itself.

Run the code 4. Call the next node in the sequence

To allow this series of operations, we introduce the concept of contexts.

A context is a set of variables that save the node state, in a way that can later be restored. Each traversed node is associated to a context, which is available just during the time that the node is being traversed.

Since passive nodes are without side effects, they cannot in particular find the next node to be called; hence the next node is part of the context. If the node is active, it may ignore this part of the context and branch to another destination.

Node passivation

Node passivation requires that we cancel the instruction(s) being executed, or compensate its effects in some way. We do this by using both the registers and the stack (it is not possible to rewrite registers that are in active mode), leveraging the specificities of the x86-64 architecture.

Register operations. Any register operation can be dealt with using contexts, with the exception of the stack registers.

Stack operations.

Stack operations are harder to compensate: the following instructions have an effect on the stack PUSH, POP, PUSHA, POPA, PUSHAD, POPAD, PUSHF, POPF, PUSHFD, POPFD

We control writing and reading in the stack by using a pointer to a 'trash' address, stored as a fixed value. If a passive node attempts to write something in the stack, we redirect the address to the trash, nullifying the instruction's effects. The reading process is handled in the same way. If the node is active, the real address is used.

The context m is used in the following way: after a PUSH, we perform the following operation to the pointer to the top of the stack p:

p ← p + (8 & m)
where

• m = 1 • • • 1 2 if
the node is passive. In this case the operation will be compensated and will not have any effect due to the top of the stack having not changed.

• m = 0 if the node is active. In this case the addition is useless and the PUSH works as intended.

MOV instruction. mov instructions from one register to another are already without effect, since register values are restored at the begging of each active node, and are stored in the environment. However, mov instructions that involve a memory address require additional care, and we use the same technique as for the stack: the address is rewritten to the 'trash' when the node is passive. This is followed by the transformation:

address = (address & (¬m))|(trash_address & m)
This technique also hides the addresses that are really used during the program execution.

Function calls. We will distinguish library function calls and calls to internal functions, that are defined in the code.

Library calls. In the case of library function calls, each one is treated separately by using a specific context per function, considering that it is not possible to handle all the functions at the same time. We propose to call the functions but using parameters that make such calls ineffective.

Jumps and internal calls

Internal calls. Recall that we distinguish between a call to an address in a PUSH from a static jump. This makes the above transformation effective to handle these instructions. However, the RET instruction corresponds to a dynamic jump and is subtler to handle.

Let n be a node with a RET instruction in G, and assume that in G the corresponding node π(n) has two neighbors, f 1 and f 2 . Their addresses are fixed, so that one can place, on the top of the stack, the address of the node that follows π(n) (either f 1 or f 2 ).

Example 7.3 Consider the following example, where we print in the screen the result returned by func1. In this case, we jump from func1 to func2 adding the desired address on the top of the stack by using a push operation. As result, the program jumps to func2 instead of jumping back to the address after the call.

Routing

Once we passed through a passive node, without changing the environment, we must be capable to take the next desired branch. As each node is outdegree at most two, all that we need is that a boolean variable in the environment that indicates to which child we must to go.

In practice, it is enough to maintain a global routing variable r. This gives the sequence of branches to follow (left or right) between to consecutive nodes. Hence, we modify r for each active node found and its i-th bit gives the direction of the i-th branch of the current path. We will call denote by r i the i-th bit of r.

Remark. Routing variables have a limited size if we use native types, but it is straightforward to extend them, at the price of some added arithmetic.

JUMP instruction. First of all, we need to transform a conditional jmp from P into a jmp that goes to the let next node as determined by r i . For simplicity, we assume that all conditional jumps test a 'zero flag', which is set by a comparison just before the jump. For example, we have the node A (with children B and C) and the following program: This program then jumps according to the first value of the routing variable.

Note that, for passive nodes, routing variables are set to the (masked) trash address.

RET instruction. In the case that a node is passive, we want to have two possible branches as in the case of the jump instruction. To achieve this we also store the constants A_to_B and A_to_C; and we will use the mask m as the context. We will go to node B if r i = 1 and to node C if r i = 0. We want to put at the top of the stack the address where we want to go. Hence, we just add the following line before the ret:

p ← (p & m)|((r & A_to_B)|(¬r & A_to_C)) & ¬m
The transformation presented above allow us to modify the control flow graph of the program. With this we are capable to transform an arch into a path, ensuring that the execution of the path is the same as running the arch in the original graph.

Control flow graph obfuscation

While the construction presented effectively transforms the program's CFG, the resulting construction has a strong signature, and it is easy to reverse the process to obtain the initial graph. Indeed, it is enough to run the program and identify nodes that change the routing variable. These nodes are the active ones, and it is possible to reconstruct the original control flow graph.

We propose in this section several ways to obfuscate the transformed program and make this reconstruction harder. First, we will 'force' the execution of the program in order to recover successfully the initial control flow graph. Then we hide the nodes' activity, including operations on the routing variable, which is a signature of an active node.

Forcing execution

For now, knowing the routing variable is enough to determine the next active node. We will modify its definition and use it to hide the control flow from static analysis. The routing variables is now maintained as a sequence of bits (r 1 , . . . , r n ).

Upon transitioning to node i, we apply to the routing bit r i a random permutation f i of {0, 1}.

Example 7. [START_REF] Step | [END_REF] For example, if one seeks to obtain at the end of the function a bit equal to 1, the following operations can be used:

r ← 0 Null routing variable a ← rand() Introduce randomness t ← 5a t ← t + r × a r ← t/a mod 2
At the end of the code execution we obtain r = 1. If we declare r = 1 instead, we get r = 0.

We can generate the random flips f i easily, using arithmetic operation and their inverses. Since, in general, statically determining the value of a variable is undecidable, running the program is the most natural way to get information about the execution paths taken.

Node hiding

The same way that routing bits are masked, we can hide the value of the bit that tells whether a node is active or passive. However doing so within node i only hides the status of node i + 1. We can also change the value of the mask by choosing at random between m and ¬m, and updating the formulae accordingly.

Route hiding

Updates to the routing variable are crucial, as they immediately reveal active nodes. In order to hide the information about the routing changes, we will extend each path beyond the active node, and introduce a weak form of 'onion' routing, where the next node is determined at runtime. The rationale is that determining whether a node is active or not will require recovering the full route that lead to this particular node.

We introduce two additional variables per node, called path and next path. The next path variable is masked (XORed) with a value that depends on the node. Upon execution of an active node, the values of these two new variables are further modified.

If the next node is C, the route from B to C is stored in next path, and masked by being XORed with the constants of every intermediary node between A and B.

The number of hops is counted. Upon arriving at the final hop B of the path from A to B, we swap next path and path.

The route hiding process is illustrated in Figure 7.9.

Init A B D C a ← rand() t ← 5a t ← t + r × a r ← t/a mod 2 ( r , m ) A ( r , m )B ( r , m ) C next path next path
Figure 7.9: Diagram of hiding process for nodes and routes

Security

Intuitively, the security of our construction is determined by the hardness of identifying active nodes. This can be formalized as an adversarial game, whereby a more precise notion of security can be given:

CFG-FullRecovery Game:

1. The challenger provides a program CFG G = (V, E)

The adversary chooses a set N ⊆ V

The adversary wins the game if the nodes in N are the active ones.

To get a grasp on how hard this game is, assume that the we choose N at random in V , where there are exactly |N | active nodes:

Pr [N is exactly the active nodes | N ⊆ R V ] = 1 |V | |N | = |N |!(|V | -|N |)! |V |! .
If one node out of two is active, and there are more than 42 × 2 nodes in V , this probability is negligible. Thus we may hope, for realistically large programs, to resist adversaries for which there is no better way to choose N than selecting a random subset of V . However, in practice, adversaries may succeed in recovering smaller portions of the CFG. This corresponds to the following game:

CFG-OneRecovery Game:

1. The challenger provides a program CFG G = (V, E)

The adversary chooses a node n ∈ V

The adversary wins the game if n is active and n is not the first node of G (which is always active).

The probability of success if n is chosen at random is

Pr [n is active | n ∈ R N ] = |N | |V |
where again N is the set of (actually) active nodes. In the balanced case, where 2|N | = |V | this probability is exactly one half. When that is the case, and V is large enough, security in this second game implies security in the first game.

As discussed above, static analysis cannot in general determine the variables' value in a given node (by Rice's theorem). Given that the difference between active and passive nodes is only semantic, for a general program determining whether a given node is active is undecidable.

Hence, our obfuscation scheme is secure against static analysis, for large enough values of N and few enough active nodes.

Security against dynamic analysis

Dynamic analysis is performed by running and monitoring the program. As mentioned previously, the first node is always active. The second node can be determined as follows: Execution continues until the next path variable is updated. At that point, we know that therer is an active node between the current node B and the first node A.

The analyst then does the following operation: For each node n between A and B in the CFG, replace n by another operation, and run the program up to B. There are at most |V | nodes to test. A node is active if, when modified, the program's state at B has changed.

As each test require to continue running the program until B, which can take up to |V | steps, we can determine the next active node in O(|V | 2 ). Running this procedure iteratively for all nodes, we reconstruct the list of active nodes, hence the original CFG, in O(|V | 3 ) operations.

Implementation

Our construction is illustrated here. Given as input a program CFG, we construct a 'target' CFG to which the original program is mapped.

1. Graph generation. We generate an random graph with n edge and maximum outdregee two, using a variant of the Tarjan-Eswaran algorithm [ET76; Rag05].

2.

Linearisation. This graph is linearised, so that it corresponds to a control flow graph.For this purposes we use the scheme presented by Leroy for the CompCert compiler [START_REF] Leroy | The CompCert C verified compiler: Documentation and user's manual[END_REF]. We then select a random morphism π between the initial graph and the new graph we are creating.

3.

Transformation. We begins the transformation identifying the actives and passive nodes. Then we change the edges for paths by nullifying (passivation) the instructions using: registers and stacks operation, transforming the jumps and internal call, and defining the route to follow according to the routing variable. Finally, we remove the signature of the new graph hiding the routing variable and the status of the node (active or passive) by randomizing their values and adding the variables path and next path. In order to mask the variable next path we will XOR it with values of the node.

Conclusion

In this paper we presented an algorithm that transforms a program into a functionally equivalent program, but such that the resulting control flow graph is entirely different from the original one. This transformation hides the program's original control flow graph from static analysis and some level of dynamic analysis, but does not alter its functionality. The rewriting process is randomized, so that every time one runs the transformation, one gets a new program. While there is an overhead to our construction, it is minimal and less characteristic when compared to, e.g., the trampoline construction, whose heavy use of exception handling is easily identifiable, and from there, traceable. The use of common instructions, and specific routing mechanism make our modifications harder to detect. This transformation is entirely automatic, and we implemented a CFG-transcompiler for the x86-64 architecture.

Introduction

The design and the detection of hardware trojans is an active research field. In most real-life cases trojan insertion occured during offshored chip design or manufacturing. In the silicon industry, offshoring is frequent as a means to meet ever tighter budgets.

There are several manners that Hardware Trojans (HT) can be inserted into an IC [KRR + 10]. Offshoring gives an adversary the opportunity to tamper hardware during the design, fabrication, packaging, testing, or integration phases. In general one or several untrusted semiconductor foundry employees would be bribed, coerced or convinced to cooperate with a government agency to purposely modify the IC by implementing backdoors or by weakening its design.

In general, HT attacks are defined as the tampering of ICs for the purpose of producing an adversarial behaviour allowing to compromise secrets processed or contained in the IC.

The majority of HTs for which prevention and detection mechanisms exist, are either based on combinational logic or sequential logic. Combinational HTs wake up when a particular condition occurs at certain internal circuit nodes. Sequential HTs are activated when a specific sequence of rare logic values occurs at internal nodes.

Because hardware is the lowermost system basis, if hardware is tampered, no upper-layer security or policies may be enforced.

A typical HT modus operandi consists in two steps:

• The HT reads the target circuit's state by a trigger contained in the HT.

• Then the HT influences or modifies the target circuit's state (to run a malicious function or leak information); This is caused by an HT component called the payload.

Detecting hardware trojans. HT detection is an extremely challenging problem given the variety of HT types and their increased sophistication. As we write these lines, traditional test suites seem insufficient for detecting HTs, especially when attackers are literate in anti-trojan countermeasures and specifically design their way around them. Malicious circuit parts can be detected invasively, whereby the defender alters or even destroys the device; or non-invasively, revealing the attacker's alterations without affecting or even without interacting with the device [XW17; NGD17].

Invasive analysis is usually done by injecting faults, modifying the IC, or any combination of these. Chakraborty et al. have proposed a design that aims to expose the presence of a HT in a multi-module design [START_REF] Subhra Chakraborty | On-demand Transparency for Improving Hardware Trojan Detectability[END_REF]. Salmani et al. pointed out that some logic additions within the IC may simplify HT detection, such as adding dummy flip-flops to increase a suspected HT activity, which in turn facilitates detection using side-channel techniques [START_REF] Salmani | New Design Strategy for Improving Hardware Trojan Detection and Reducing Trojan Activation Time[END_REF].

Non-invasive analyses generally compare some aspect of the component to a reference chip, which could be done either at design time, runtime (i.e., combined with the countermeasures), or during testing. They may also and simultaneously leverage side-channel analyses to try and monitor the IC's activity. Runtime analyses may require the use of additional logic, as explained in [START_REF] Abramovici | Integrated circuit security: new threats and solutions[END_REF]. Testing-time analyses can leverage side-channel analysis [BDG + 13], and some form of functional tests, e.g., [START_REF] Jha | Randomization Based Probabilistic Approach to Detect Trojan Circuits[END_REF]. In the HT detection context, there are mainly two types of side-channel signal analyses: power and timing.

Power-based analysis allows more visibility of the internal IC structure and activities, which allows detecting an HT without activating it. Agrawal et al. [ABK + 07] present the first side-channel based HT detection mechanism. This process detects the HTs of the circuit contributions to overall power consumption of the circuit.

Timed-based analysis is usually done by using clock sweeping techniques, whereby signals patterns are repeatedly injected into a path, at different frequencies. As these signals traverse the IC they get modified in a very specific way. An HT, even if inactive, distorts the expected outcoming signal and is hence detected. In other words, HTs can be detected by observing the frequencies at which a group of paths cannot propagate its signal i.e. the delays are extended beyond the threshold determined by the process variations level with some degree of precision [START_REF] Tehranipoor | A Survey of Hardware Trojan Taxonomy and Detection[END_REF]. Li and Lach introduced a delay-based physical unclonable function (PUF) for HT detection [START_REF] Li | At-Speed Delay Characterization for IC Authentication and Trojan Horse Detection[END_REF].

Contribution. This paper introduces a novel HT type showing how analog trojans can be implemented. An analog trojan is a circuit modification made at the design flow's lowest level i.e. without using the combinational nor sequential mechanisms. Subsequently, analog trojans are expected to evade current trojan identification techniques.

In particular, our trojan differs from the recently introduced "stealthy" trojans described in [BRP + 13; BRP + 14; GBH + 16], which disguise transistors into inactive elements. As shown in [SSF + 14; SSF + 15], all transistors can be checked to determine if they are functional or fake, revealing modifications such as those of [BRP + 13; BRP + 14; GBH + 16]. Usually, transistor count is less than one billion, therefore such a check is practical-albeit it comes at some price. Our trojans, however, are not hidden amongst transistors, and they do not impact the functionality of the circuits they are installed in.

We describe how to concretely implement and install such a trojan, and read the information that it exfiltrates. We show how this information can be used to break cryptosystems, in particular public-key primitives based on the intractability of computing discrete logarithms.

Resistive hardware trojan

Principle of operation

The HTs described in this paper work as follows: Let A, B be two conductive points in a target circuit and assume that an attacker can connect A and B through a resistor. When A and B are at the same potential -which we write A = B -the target's power consumption will be essentially that of a trojan-less circuit; but when A = B consumption will increase and hence leak A ⊕ B, which suffices to break several cryptosystems.

In our scenario, the attacker manages to insert during manufacturing a simple resistor between A and B. As opposed to transistors, resistors are not logic devices and are hence undetectable by traditional imagingbased netlist re-building techniques [START_REF] Torrance | The State-of-the-Art in IC Reverse Engineering (Invited Talk)[END_REF], or other methods such as observation of supernumerary transistors [CLF + 15]. The addition of a resistor can be achieved by doping variations or by optically invisible chemical substrate modifications.

In CMOS logic, digital cells are inverting by default. Indeed, PMOS transistors are active when the transistor's input (gate port) is "0", and therefore connects the transistor's output (drain port) to the VDD net. Hence an input of 0 maps to an output of 1. An NMOS transistor achieves the complementary function, mapping an input of 1 to an output of 0. As digital cells in CMOS logic consist in one "PMOS network" which drives the output exclusively with the "NMOS network" they are, by design, inverting. Obtaining non-inverting cells is customarily achieved by aligning two inverting cells; e.g., a logical AND function is the result of a NAND cell followed by an inverter. Hence, to illustrate our attack, we focus on the simplest possible cell, namely the inverter.

In the scenario that we consider, the trojan will be installed on behalf of the attacker inside a device meant to be operated by the defender. Our goal, as attackers, is to extract secrets from the defender. The defender's goal is to prevent such exfiltration attempts, and possibly detect the presence of our HT.

Y 1 A 1 Y 2 A 2 (a) Without Trojan Y 1 A 1 Y 2 A 2 (b) With Trojan R Figure 7
.10: Proof-of-concept setup for the resistive trojan.

Side-channel observation

To demonstrate the attack's feasibility, we study the setup given in Figure 7.10. The trojan-less circuit is made up of two independent inverters. The trojan's side-channel observability can be enhanced by connecting with a passive element (e.g., one resistor) two high drive cells. In that respect, embedded memory12 read amplifiers are attractive targets because:

• they have a strong drive-this is by design, for the memory read to be reliable;

• they are easily spotted in a design (by an attacker) by searching for them on the boundary of memory blocks;

• they are placed in the layout side by side, which corresponds to our proof-of-concept example; and, most importantly,

• they carry information which is easily related to high-level variables and is hence cryptanalytically exploitable.

With the trojan inserted (resistor added between the output of the two inverters, see part (b) of Figure 7.10), a coupling is created between the inverters. Such a trojan may have two effects:

1. it may introduce a malfunction in the circuit, thereby creating logical faults (the payload); or, 2. it may not alter the circuit's functionality, but create an externally observable current overshoot when the inverters' outputs differ.

The second scenario provides and attacker with an indirect way to compare the two inverters' states. Such a trojan is mostly useful for eavesdropping. We refer the reader to the framework described in [RGJ + 10] for classifying the behavior and the structure of these two resistive trojans. In any case, 1. If the trojan uses a small resistance R, then it can be made smaller. However, if the netlist's reverseengineering is not done by imaging but by connectivity extraction, the trojan may be uncovered by the defender.

2. If the trojan uses a large resistance R, it is more challenging to keep its dimensions small.

Probing model. Note that the effect of our trojan is to reveal the XOR of two bits which are chosen by the attacker. As such, it is more powerful than single-bit probing, but not as powerful as two-bit probing attacks. As we show in the next section, it is possible to install several trojans. Probing attacks [START_REF] Ishai | Private Circuits: Securing Hardware against Probing Attacks[END_REF] model complex and challenging higher-order side-channel attacks, which typically require many traces and high-precision equipment to be successful. Our trojan enables us to achieve essentially identical results by much simpler and more reliable means.

Implementation

Active area implementation

The resistance can be easily realized as an active area. We consider that the two gates to connect are located on the same placement row, and face each other (i.e., the second instance is horizontally flipped). Therefore, the two nodes to connect are in line of sight from one another, and the extra active area does not need to cross wells. Besides, the only transformation done to the lithographic masks is the addition of one rectangle. See Figure 7.11 for the original layout, and Figure 7.12 for the same layout with the trojan. The difference is minimal and only requires very local modifications-namely the extra active area, visible as a horizontal green band in the false colour Figure 7.12. Doping levels are not visible, and are hard to determine, so that in fact the change illustrated here would not appear to the defender.

Note that it is also possible to create resistors by varying doping and thickness.

Simulation results

We simulated the trojan's design, using STMicroelectronics' HCMOS9 technology, with low leakage (LL) 130 nm transistors. We used the standard IVLL inverter, which happens to have a very little drive, with a nominal voltage VDD of 1.2 V.

Standard behavior.

As a control, we first implemented the inverters without modifications. The resulting behavior is illustrated in Figure 7.13, and we have verified that the circuit works as expected:

Y 1 = ¬A 1 , and Y 2 = ¬A 2 .
Peak power dissipation (see last line of Figure 7.13, which is the plot of W = I(t) × VDD, where t is the time represented in X-axis), which occurs on signal toggles, is approximately ±200 µW.

Small-resistance trojan. We now consider the situation where the trojan is in place, and has a small resistance, i.e. R ∈ {1, 2, 3, . . . , 10} kΩ.

Simulations show the behavior depicted in Figure 7.14: as the voltage of Y 1 and Y 2 deviates too much from 0 or 1.2 V, the circuit does not follow the intended function. Such a misbehavior is likely to cause "digital" faults in the subsequent logic. Peak power dissipation now occurs both:

1. on signals toggle, and 2. steadily, when the signals are fixed: this is a short circuit (also called hotspot).

The latter form of dissipation is the main contribution.

Large-resistance trojan. Finally, we increase the trojan's resistance using R = 10, 20, ..., 100 kΩ. Increasing resistance restores the inverters' correct functionality.

The signals, simulated in Figure 7.15, show small deviations from the unmodified setting (Figure 7.13), but the gates following the inverters can handle them, and fluctuations are quickly corrected; Indeed, fluctuations of a few millivolts occur often in circuits due to "IR drop", and CMOS logic is designed to be resilient to such small voltage drops. As a result, the circuit user will not notice any behavioral alterations.

However, the attacker can monitor the dissipated power, which leaks the value Y 1 ⊕ Y 2 .

Multiple Trojans

In theory, nothing precludes the installation of several trojans in a system. Naturally, doing so increases the chances of revealing (by side-channel analysis) that an attacker tampered with the system. However, we note that being aware of the presence of a trojan does not in itself inform us as to where it is installed. There are essentially two possible scenarios: the trojans may belong to the same subsystem (e.g. the portion of a circuit that performs cryptographic operations); or they may be installed into several disjoint subsystems (e.g. portions of the circuit corresponding to different cryptographic operations). In the latter case, we may assume that the subsystems are not used simultaneously, and there is no interaction between trojans. 13The most interesting case is to install several trojans that may be activated simultaneously. If no precaution is taken, the signals from all our trojans add up. Denoting (x i , y i ) the bitlines which the i-th trojan connects, the measurement is i x i ⊕ y i , where • denotes the Hamming weight. While this may be sufficient in some settings, we may wish to distinguish between the different signals.

One approach is to give sufficiently different values to the trojans' resistances. As a result, we measure instead T i=1 ρ i z i where T is the number of trojans, z i = x i ⊕ y i , and ρ i is determined by the resistance R i and is known. Finding the collection (z i ) T i=1 ∈ {0, 1} T is then simply solving a (0, 1)-subset-sum problem. While this problem is known to be NP-complete in general, in practice T is very small-furthermore we are at liberty to choose ρ i , so we may select a superincreasing sequence, for which the subset-sum problem is easy [START_REF] Merkle | Hiding information and signatures in trapdoor knapsacks[END_REF].

Definition 7.2 A superincreasing sequence is one in which the next term of the sequence is greater than the sum of all preceding terms.

In practice, we may have to deal with noise resulting both from measurement and from the fact that we only know the resistance approximately in the first place. We also have to account for the limited range of resistances available to implement the trojan. This reduces the practical number of trojans that can be accurately used simultaneously.

For instance, if we can only realise resistances in the range 10, . . . , 100 kΩ, and noise levels impose a minimum separation of ±5 kΩ, then we may use simultaneously 4 trojans, with resistances R 1 = 10, R 2 = 20, R 3 = 40, R 4 = 80 kΩ.

Attacking cryptosystems

We will now describe the way in which the information sent out by the trojan is decoded and exploited. In the following, we assume that the trojan is installed between two neighboring bit lines, e.g., in registers or in circuit logic.

At this point, one may be tempted to leverage usual side-channel attacks. The interesting aspect is that the leaked bits are not related to the secret in a straightforward way (e.g. in the discrete log case below, there is a discrete log relationship between one and the other, roughly speaking), so standard statistical techniques like DPA do not apply. This is particularly relevant for SCA protected implementations: for example, our attack works in exactly the same way on an implementation that uses exponential blinding for discrete log/RSA.

Discrete logarithm-based cryptosystems

One of the nice features of our construction is that it leaks enough information to allow the attacker to break discrete logarithms using a polynomial-time algorithm.

Definition 7.3 (Discrete logarithm problem)

Given a generator g of a cyclic group G, and y ∈ G, find x such that g x = y. DLP-based cryptosystems are ubiquitous, ranging from key exchange protocols (Diffie-Hellman [START_REF] Diffie | New Directions in Cryptography[END_REF]) to signatures (DSA [START_REF] Arjen | Generating Standard DSA Signatures Without Long Inversion[END_REF]). In particular, they are at the core of the TLS protocol that secures Internet connections.

For the sake of simplicity, we may consider that the computation of k → u k mod p, for some fixed and known u, is performed on the target using a square-and-multiply algorithm. The trojan is installed between two bits of the temporary variable u t = u mod p, i.e. we have access to y t = u t [i] ⊕ u t [j], for fixed positions i and j. Trojan-aided discrete logarithm reconstruction. The basic recovery algorithm consists in extending a Galton-Watson tree 14 [WG75; DL02], and pruning it at each generation t based on the information y t provided by the trojan. At each iteration, we double the set of candidate prefixes of the secret exponent by extending each them either by 0 or 1, and then remove all the candidates that are incompatible with the new bit of information given by the trojan. The probability that a candidate is compatible with that bit is expected to be 1/2, independently for all candidates. In particular, a vertex in the tree of possible candidates should have 0, 1 or 2 children according as whether none, either, or both of its extensions by 0 and 1 is compatible; this should thus happen with probability 1/4, 1/2 and 1/4 respectively for all vertices, independently. Thus, our recovery algorithm is a search in a Galton-Watson tree with p 1 = 1/2, p 0 = p 2 = 1/4 and p k = 0 for all k > 2 in the sense of the following definition.

Definition 7.4 (Galton-Watson process)

A Galton-Watson process {Z n } n≥0 with offspring distribution F = {p k } k≥0 is a discrete-time Markov chain taking values in the set Z + of nonnegative integers, and whose transition probabilities are as follows:

Pr [Z n+1 = k | Z n = m] = p * m
k , where {p * m k } denotes the m-th convolution power of the distribution {p k }, i.e. the conditional distribution of Z n+1 given that Z n = m is the distribution of the sum of m i.i.d. random variables each with distribution {p k }. 14 This family of processes was initially introduced in 1875 by Galton and Watson [START_REF] William | On the probability of the extinction of families[END_REF] to study the propagation of patronyms. Their approach used generating functions to compute the population over time; however their conclusion was wrong: they found that all their processes eventually died out, i.e., the extinction probability was incorrectly claimed to be 1. This was pointed out and fixed by Steffensen [START_REF] Frederik | Om Sandsynligheden for at Afkommet uddør[END_REF], 55 years later. It was later realised (by Heyde and Seneta [START_REF] Heyde | Studies in the History of Probability and Statistics. XXXI. The simple branching process, a turning point test and a fundamental inequality: A historical note on IJ Bienaymé[END_REF]) that a correct statement about the extinction probability was given, without proof, in a 1845 note by Bienaymé [START_REF] Bienaymé | De la loi de multiplication et de la durée des familles[END_REF]; see, e.g., [START_REF] Kendall | The genealogy of genealogy branching processes before (and after) 1873[END_REF] and [START_REF] Bacaër | A short history of mathematical population dynamics[END_REF]Chapter 7]. For this reason some authors prefer to refer to Bienaymé-Galton-Watson processes. The study of Galton-Watson processes, and in particular its conditionned variants (see, e.g., [Kes86; GK99; Le 10; Riz15; BM14; Add12]) showed many connections with other areas of mathematics, as a good model for scaling limits: in random processes of course [START_REF] Athreya | Branching processes[END_REF], but also in group theory [START_REF] Steven | Rayleigh processes, real trees, and root growth with re-grafting[END_REF] and geometry [HM12a; PS15a; GJW17; AM08; CHK15; Bet15; Car16; PSW + 16].

The probabilities p k denote the probability that a node has k offsprings.

In our case, each vertex in the tree has on average µ = ∞ k=0 kp k = 1 child: in other words, we have a critical Galton-Watson process, so that E[Z n ] = µ n E[Z 0 ] = 1. In particular, the size of the full search space, which is given by Z

1 + • • • + Z n ,

does not undergo a combinatorial explosion.

There are several ways to implement the Galton-Watson simulation; one possibility is to keep a pool of candidates (roots) from which new candidates (leaves) are generated and pruned. This gives the algorithm of Algorithm 23. This algorithm has been implemented, and results for various parameters are given in Table 7.1. We can see on the table that the size of the search space increases quadratically rather than linearly with the bit length n of the exponent (despite the fact that

E[Z 1 + • • • + Z n ] = n)
. This is because we are looking at a Galton-Watson tree conditioned on having at least one vertex at depth n, and we can show that E[Z 1 + • • • + Z n |Z n = 0] = Ω(n 2 ): see the discussion in Section 7.3.6. Nevertheless, our attack is polynomial and very practical for cryptographic group sizes.

Our algorithm terminates after a polynomial number of steps when µ 0 ≤ 1, i.e. if and only if p ≥ p crit where p crit = 2 k-1 /(2 k -1). For k = 4 trojans, this requires a success probability of 8/15 ≈ 54%. Simulation results for this scenario are given in Table 7.2.

A finer analysis considers individual bits instead, assuming that iteration 1 leaks j 1 bits, iteration 2 leaks j 2 bits, etc. The average number of offsprings in that case is 2 1-j1 • • • 2 1-jn ; now if we learn a bit with probability p, and summing over all possibilities, we have

µ = j1 • • • jn k j 1 p j1 (1 -p) j1 • • • k j n p jn (1 -p) jn 2 1-j1 • • • 2 1-jn = 2 n k j1=0 k j 1 (p/2) j1 (1 -p) j1 • • • k jn=0 k j n (p/2) j1 (1 -p) jn = 2 n 1 - p 2 kn = µ n 0 this time with µ 0 = 2(1 -p/2) k .
The smallest value of p for which our attack runs in polynomial time is

p crit = 2(1 -2 -1/k
). E.g. for k = 4, the condition is p 32%. Simulation results for this attack are given in Table 7.3.

Algorithm 24 gives the DL-recovery algorithm for k trojans, using as input a sequence (y t ) N t=1 = ((y 1 t , . . . , y k t )) N t=1 . The couples of bits being XORed is given by a list L = ((i 1 , j 1 ), . . . , (i k , j k )).

Algorithm 24: Multi-trojan-aided discrete logarithm reconstruction.

Input: {(i1, j1), . . . , (i k , j k )}, {y0, . . . , yN }, g, p, y. Output: x s.t. y = g x mod p; or ⊥. Our new type of side-channel provides such a counterpart! Moreover, like in the extensions of the original attack of Heninger and Shacham, one can consider variants of our attack model in which we recover the trojan information with possible bit flips, or analog noise, rather than erasures. The generalization of our techniques to those models is left as a possible open problem.

1. X ← ∅ 2. for (i , j ) ∈ L 3. if g[i ] ⊕ g[j ] = y 0 goto step 5 4. X ← X ∪ {(1, g)} 5. for (i , j ) ∈ L 6. if y 0 = 0 goto step 8 7. X ← X ∪ {(0, 1)} 8. for t = 1, . . . , N 9. X ← X 10. for (x, gx) ∈ X 11. c0 ← 2x 12. g0 ← g 2 x mod p 13. g1 ← g0 • g mod p 14. for (i , j ) ∈ L 15. if g0[i ] ⊕ g0[j ] = y t goto step 17 16. X ← X ∪ {(c0, g0)} 17. for (i , j ) ∈ L 18. if g1[i ] ⊕ g1[j ] == y t goto step 20 19. X ← X ∪ {(c0 + 1, g1)}
Remark. Another remark is that, while we have described our attack in the context of finite field discrete logarithms, it of course applies in exactly the same way to discrete logarithms in arbitrary groups, including elliptic curves. For an elliptic curve, say, the trojan would be placed between two bits of the bit representation of the variable point of the double-and-add scalar multiplication, and the exact same approach recovers the secret scalar. This applies even when a point has many possible equivalent bit representations (e.g. projective coordinates) as long as the computation is deterministic. However, randomized projective coordinates are a possible countermeasure in the elliptic curve setting.

Attacking (EC)DSA. What we have described so far is a generic attack against discrete logarithm-based cryptographic schemes. Particular schemes among them, however, can be vulnerable to stronger attacks. For example, it is possible to efficiently break (EC)DSA (or more generally Schnorr-like signatures) with a single trojan even if the presence of noise causes the corresponding leakage bit to be recoverable with probability p < 1 (this is in contrast with the generic attack above, in which a less than perfect recovery makes the search space with only one trojan exponentially large).

A first possible approach is to place the trojan between two bits of the (EC)DSA nonce (or one bit of the nonce and a known bit such as GND), thus leaking one bit of information about the nonce. That bit of information can then used to recover the secret signing key given sufficiently many signatures, using the statistical attack of Bleichenbacher [Ble00; MHM + 14]. The attack with a single bit of information requires many signatures, but Aranha et al. [AFG + 14] have shown it to be practical at least against 160-bit groups. And if the leakage is recoverable only with probability p, the same attack can be mounted by simply increasing the number of signatures by a factor of 1/p and throwing away those for which the bit is unrecoverable.

A more efficient approach is to combine the generic trojan attack from the previous paragraph with nonce-based lattice attacks on (EC)DSA [HS01; NS03]. When we have a single trojan from which we recover the leakage bit with probability p < 1, the idea is that we will not be able to recover the entire nonce, but we may be able to learn a prefix of it (i.e. the MSBs of the nonce, for a left-to-right square-and-multiply) with good probability. And if we have sufficiently many signatures for which we know the MSBs of the nonce, standard lattice techniques will recover the signing key.

More precisely, consider the first bit of the nonce (the MSB), which may be 0 or 1. With probability p, we learn the leakage from the trojan, which may itself be compatible (with equal probability) with that bit being 0, 1, or both (but not neither of them, because our search tree is conditioned on knowing that a solution actually exists). If it is both, we learn nothing, but otherwise we learn that MSB: this happens with probability 2p/3. And in that case, we can make the same argument for the second bit, and then the third, and so on. With probability at least (2p/3) k , we will learn the k most significant bits of the nonce. (This is actually a lower bound, since the search tree can in principle grow and then collapse back to a single vertex at depth k, but that lower bound is sufficient for our purposes). Now how many MSBs do we need to mount the lattice attack? This depends on the bit size n of the group, and the maximum lattice dimension d max in which we can reliably find the shortest vector of a random lattice (nowadays, d max = 100 is a reasonable rule-of-thumb using reduction algorithms like BKZ 2.0 [START_REF] Chen | BKZ 2.0: Better Lattice Security Estimates[END_REF]; academic records on the SVP Hall of Fame go all the way to dimension 150 as of this writing). Indeed, it is standard that we can recover the signing key by computing the SVP in a lattice of dimension d = n/(kc), where c = log 2 πe/2, so the lowest usable k is given by k = c + n/d max . And we then need d signatures with k known nonce MSBs to carry out the attack. This can be obtained by collecting m = 3 2p k • d signatures with the trojan leakage above, and keeping those for which the leakage is enough to learn the k most significant bits.

In a 256-bit group and with d max = 100, we have k = 4 and d ≈ 87. If the probability of learning a bit of the trojan leakage is p = 1/2, we thus get m ≈ 7000: collecting 7000 signatures should yield enough signatures with 4 known MSBs to mount the attack and recover the signing key. This is much better than the Bleichenbacher approach, which would require billions of signatures at this group size, and a fortiori better than trying to apply the generic trojan attack, since the expected size of the search space in that case is at least µ = (p + 2 -2p) n = (3/2) 256 ≈ 2 150 by (7.1). [START_REF] Bauer | Practical Key Recovery for Discrete-Logarithm Based Authentication Schemes from Random Nonce Bits[END_REF] have recently analyzed (EC)DSA-type schemes in the presence of leakage on randomly-located bits of the nonces. Although seemingly relevant, this attack does not apply to our setting, because the trojan leakage will not reveal many randomly located bits of the nonce: to learn a bit with certainty, it should be the only bit compatible when extending all previous candidate prefixes, and this is exponentially unlikely to happen when the set of candidate prefixes is already large.

Remark. Bauer and Vergnaud

Attacking RSA and RSA-based cryptosystems

The algorithms of Algorithm 23 and Algorithm 24 and their analysis also apply directly to RSA [START_REF] Rivest | A Method for Obtaining Digital Signature and Public-Key Cryptosystems[END_REF] and RSA-type cryptosystems where the message being signed (or the ciphertext being decrypted) is known to the attacker. Indeed, in that setting, the algorithm will recover the secret RSA exponent, which breaks the corresponding schemes.

Symmetric cryptography

Symmetric cryptosystems, such as block ciphers, may also be vulnerable to our trojan, by adapting techniques from differential cryptanalysis [START_REF] Biham | Differential Cryptanalysis of DES-like Cryptosystems[END_REF].

Indeed, one may see attacking the block cipher using trojan information as a reduced-round attack where the opponent has access to differences in the state at any round. In such a setting existing methods recover e.g. AES keys [DFJ13; BDF11; FKL + 01].

Unlike these approaches, using a single trojan we only have access to a single bit of information per round, i.e. up to 10 bits per encryption or decryption.

Countermeasures

In essence, the addition of generic power attack countermeasures 15 to a circuit should hide or reduce leakage and hence slow down or thwart the trojan. The deployment of such countermeasures will thus decrease the signal to noise ratio, allowing the attacker to read the information leaked by the trojan.

Algorithmic protections against the attack require a careful definition of the trojan insertion capabilities and of the insertion scenario. We illustrate one such solution in a cryptographic device (e.g. smartcards) composed of a weak processor P and a powerful yet trojanized exponentiation cryptoprocessor a b mod n = C(a, b, n). In essence, the idea is the following: because the Galton-Watson algorithm requires the knowledge of a, we will compute a b without exposing a directly.

Remark. Since a trojan leaks one bit of information, a first thought might be to double the security parameters; however this is rather blunt and unsatisfactory for several reasons. An obvious argument against this approach is certainly the performance, and construction cost: increasing parameters may require the complete redesign of certain portions of a circuit, and certainly results in slower and more energy-demanding circuits. But most importantly, there might be more than one trojan, as pointed out in Section 7.3.3.3. Therefore a reasonable protection against our attacks must defeat all trojans simultaneously.

Remark. In theory, side-channel countermeasures that are secure in the 2k-probing model also provide security against k trojans.

Protecting RSA

Let e × d = 1 mod φ(n) and assume that the device computes s = m d mod n for known n, m, s, e values. Note that even if randomized message padding is used (be it for signature or encryption), an exponentiation will always leak-out d. Even if m is unknown (to the attacker) when exponentiation starts, m will be eventually recovered after the signature verification process.

• If e is small: P may pick a random r, mask t = m × r e and perform the computation-intensive exponentiation s = t d using the leaky C. P can then recover s = s /r. Because t is unknown to the attacker, the Galton-Watson algorithm does not apply.

• If e is large: P may pick a random r and compute u = r e using the leaky C. Then P obtains t = um and continues as in the small e case. This doubles processing time but thwarts the trojan.

Protecting discrete logarithm algorithms

We now assume that the device computes r = g x mod p for known r, g, p. Pick u at random and compute v = g/u. Use C twice to compute r v = v x and r u = u x and reconstruct r = r u × r v . Again, the fact that the bases u, v are unknown thwarts the Galton-Watson search.

Galton-Watson conditioning and search space growth

In this section, we explain why the search space for the critical Galton-Watson search described in Section 7.3.4.1 is found to increase quadratically (see Table 7.1). This is due to the fact that we have a Galton-Watson tree which is guaranteed to have a vertex at depth n. In other words, the average search space size that we want to estimate is

E[Z 1 + • • • + Z n |Z n = 0]
, where Z i is the number of vertices at depth i. Our analysis relies on the following result.

Proposition 7.1 Consider a Galton-Watson process {Z n } n≥0 with Z 0 = 1, with offspring distribution {p k } k≥0 , which is critical, i.e. µ = k≥0 kp k = 1, and non trivial, in the sense that p 1 = 1. Denote by f the generating function of the offspring distribution:

f (x) = +∞ k=0 p k x k .
and assume that f (1) < +∞. Then the following asymptotic estimate holds:

Pr[Z n = 0] ∼ n→+∞ 2 f (1) • 1 n .
Proof: Note first that under the assumptions of the theorem, we have f (1) = 1 (because {p k } is a probability distribution) and f (1) = 1 (because of criticality). As a result, we claim that f (x) > 0 for x > 0. Indeed, f (x) = k≥2 k(k -1)p k x k-2 is certainly nonnegative, and can only vanish if p k = 0 for all k ≥ 2. But if that were the case, we would get p 1 = f (1) = 1, contradicting non triviality.

As a consequence, we must have f (x) > x for all x ∈ [0, 1). Indeed, the function g(x) = f (x)x satisfies g = f , and is thus strictly convex over [0, 1]. Hence g = f -1 is monotonically increasing, and it vanishes as 1, hence g > 0 over [0, 1). This implies f (x) > x for all x ∈ [0, 1) as required. Now, let

u n = Pr[Z n = 0] and v n = 1 -u n = Pr[Z n = 0]
. By definition of the Galton-Watson process, the sequence (u n ) satisfies the recurrence relation u 0 = 1 and u n+1 = f (u n ). By the argument above, the sequence (u n ) is strictly increasing, and since it is bounded by 1, it must converge to the only fixed point of f is [0, 1], which is 1. In particular, v n tends to 0, and using the Taylor expansion of f at 1, we get:

v n+1 = 1 -u n+1 = 1 -f (1 -v n ) = 1 -f (1) -f (1)v n + f (1) 2 v 2 n + o(v 2 n ) = v n • 1 - f (1) 2 v n + o(v n ) .
Raising this relation to the power -1 yields:

v -1 n+1 = v -1 n • 1 - f (1) 2 v n + o(v n ) -1 = v -1 n • 1 + f (1) 2 v n + o(v n ) = v -1 n + f (1) 2 + o(1)
.

This shows that v -1 n+1 -v -1 n converges to f (1) 2
as n → +∞, and hence, by Cesàro's lemma:

lim n→+∞ v -1 n n = f (1) 2
which is exactly what we needed to prove.

From Proposition 7.1, we can easily obtain the asymptotic behavior of the conditional expectation E[Z n |Z n = 0]. Indeed, we have:

1 = E[Z n ] = E[Z n |Z n = 0] • Pr[Z n = 0] + E[Z n |Z n = 0] • Pr[Z n = 0] = 0 + E[Z n |Z n = 0] • Pr[Z n = 0].
As a result:

E[Z n |Z n = 0] = 1 Pr[Z n = 0] ∼ n→+∞ f (1) 2 • n.
In our case of interest,

p 0 = p 2 = 1/4, p 1 = 1/2 and p k = 0 for k ≥ 2, so that f (1) = 1/2. Thus E[Z n |Z n = 0] ∼ n/4. What we want to estimate is E[Z 1 + • • • + Z n |Z n = 0] = n j=1 E[Z j |Z n = 0]. To do so, we can observe that E[Z j |Z j = 0] ≤ E[Z j |Z n = 0] ≤ E[Z n |Z n = 0].
Hence the series

n j=1 E[Z j |Z n = 0] is
E[Z 1 + • • • + Z n |Z n = 0] = Ω(n 2 )
as required, with the implied constant between 1/8 and 1/4. This reflects the results of Table 7.1.

Conclusion

In this paper we have described a hardware modification, which plays the role of a trojan horse and enables attackers to mount discreet side-channel attacks. This modification is installed at foundry during chip manufacturing, and relies on variations in the doping levels of silicon, which is very challenging to measure and hence to detect the trojan. Furthermore, our trojan does not alter the targeted circuit's logical functionality, unlike most (if not all) other trojan horses.

Using our trojan, we showed how an attacker may break many real-world cryptosystems to recover cryptographic secret.

Pointing out the relative simplicity of using our trojan, it behooves us to explain how to resist it. We discussed software countermeasures, that may be used to limit or nullify this trojan's efficiency, without impacting the underlying operation too much.

Since the approach described here is both rather simple, and easy to exploit, we would be surprised that it hasn't already been used in the field; although to the best of our knowledge no publication mentioned it.

Further work. This work also opens many interesting research avenues:

1. When the gates are not minimally-sized, the minimal resistance of a hardware trojan is different and possibly higher.

2. A way to realise larger resistances could be to embed a P + active layer in the N-well;

3. It could also be possible to realise a special-purpose N-well resistor-this requires the collusive modification of:

• A filler cell, hacked to cut the N-well on a cell row;

• An antenna effect protection cell, hacked to contact a net (such as the victim inverter's output) to the floating N-well (which will become the resistor);

• An N-well-tap cell, hacked not to polarize the N-well to the positive voltage (VDD).

A proof-of-concept is shown in Figures 7. 16 to 7.18 below. The resistance of a typical N-well sheet is around 2 kΩ/square, ±400 Ω. Using a 10 × 100 sheet, we achieve a resistance between 16 and 24 kΩ.

A 1 Y 1 A 2 Y 2 Y 1 A 1 Y 2 A 2 TAP WELL INV 1 FILLER ANT INV 2 FILLER ANT No trojan Caption: poly = contact M1 P+ N- P-Substrate N-well Y 1 A 1 Y 2 A 2 ANT INV 1 BREAK" TAP INV 2 "WELL WELL A 1 Y 1 A 2 Y 2 TAP WELL "WELL BREAK" V DD V DD V DD V DD to NMOS network to NMOS network

R With resistive trojan

Introduction

Recent coordinated attacks over the Internet have relied on a large network of compromised devices. These devices were known for their lack of strong security protections, which allowed the attackers to slowly accumulate valid credentials by brute-forcing most commonly-used passwords.

In this work we consider the possibility that compromised nodes themselves may be directed by the attacker to participate in the brute-forcing of additional, yet-uncompromised nodes. In other terms, every node in the network lends its resources (computational power, bandwidth, etc.) to the attacker. These resources are allocated to trying to capture new devices. Our goal is to describe the optimal strategy for selecting which nodes to attack. This scenario is in fact quite common, and the collection of compromised devices is known as a botnet [PGL11; RZM + 06].

We should note here that the botnet's objective in this work could be stated as the eventual maximisation of its available resources. In practice, this only accounts for a part of the botnet's existence: Once enough resources are available, the botnet's operator may decide to start using these resource to attack (without trying to capture) a target.

Overview

Consider a graph G, representing interconnected devices 17 . A proportion of these devices has been initially compromised by an attacker, and this subset H 0 of G can be controlled to target and compromise new nodes. If this attack succeeds, the "victim" falls under adversarial control and joins the ranks of H 0 , to form H 1 , the botnet at time t = 1.

We consider a very simple scenario, where the attacker only targets one device at a a time. The attack may succeed or not, according to some node-dependent probability. Once hijacked, the device lends its resources (computing power, network bandwidth, etc.) to the botnet. The botnet's goal is to take control of the whole network as fast as possible, or equivalently to control as many resources as possible.

Every attack plan P has an expected completion time ∆(P ). P can be deterministic or adaptive. In a deterministic attack plan, the botnet must define in advance the instant at which each node in G will be attacked. Attacks will be automatically launched as planned regardless successes or failures. An adaptive attacker has more freedom and progressively adapts her actions to observed successes or failures.

In a deterministic sequential plan, P is a permutation of the nodes of G (identified with {1, . . . , n}). In more general settings, plans may involve concurrency (i.e. distribute the available computational power between several simultaneous attacks) and pauses (i.e. halt an attack at a certain point in time and resume it later). This work does not deal with concurrency and pauses.

More precisely, the botnet's task is, at each time step t, to choose a sequence of nodes in G \ H t , using the following information:

• Hijack probability for target node g is given by A(g, r(H t )), where H t is the botnet at time t and r(H t ) is the amount of resources available to the botnet at that time;

• Successfully hijacking a node g yields the rewards B(g) and adds the node to H t+1 ;

• Attempting a hijack requires an incompressible investment C(g), regardless of success.

We assume a centralised "command & control" operation center that has full visibility on G and H t , and decides which node to attack next.

Example 7.5 As a motivational example, we may consider a 2-node scenario, with the properties given in Table 7. [START_REF] Step | [END_REF]. The initial node is assumed to start with a ressource count of 1. There are only two strategies:

1. First focus on Saul. This has a fixed cost of 1, and an initial success probability of 0.2, hence on average one would have to repeat 5 times, spending 2 resource units each time. Upon capturing Saul, 10 resource units become available, that can be spent on capturing Simon, which succeed after an average of 1.25 attempts, and costs on average 1.25 units. All in all, one has spent a time 6.25 and the resource balance is 1 -10 + 10 -1.25 + 3 = 2.75.

First focus on

Simon. On average one spends 1.25 units of time and resources to capture Simon; then attacking Saul has a success probability of 0.8, i.e. succeed on average after 1.25 attempts. All in all, the attack lasted 2.5 units of time, and the resource balance is 1 -1.25 + 3 -2.5 + 10 = 10.25.

As is clear, in this example, the second strategy is the best.

In a first time, we will explore a generalisation of the above example, in which the attack plan is deterministic and can be formalised as the choice of a certain permutation (i.e., which nodes are attacked in which order). This provides us with combinatorial insight about the problem, and highlights some of its interesting and surprising features. However, trying to find the optimal strategy in this way eventually hits a computational barrier. As we then discuss, it is possible to devise an optimal strategy when A, B, C are known. We achieve this by recasting the botnet optimisation problem as a Markov decision process, for which we can find the optimal solution through the associated Bellman equations. When A is not known, a fallback strategy is to learn it on the fly, using a variant of the Q-learning algorithm. Intuitively, this amounts to "training" the botnet to recognise good targets.

Notations

Unless stated otherwise we use boldface to denote vectors, and indices for coordinates, e.g. u = (u 0 , . . . ). The notation X ∼ D means that X is a random variable sampled according to the distribution D. The notation x $ ← -X means that x is sampled uniformly from the finite set X. Γ n will denote the symmetric group, i.e., the group of permutations of {1, . . . , n}; we will denote permutations σ ∈ Γ n by their effect, i.e. {σ(1), . . . , σ(n)}. When useful, we use V i /t i to mean "the botnet attacks V i and this attack requires t i time units".

Deterministic attack plans

It is interesting, in a first time and to highlight the intricacies of our problem, to consider a slightly simplified version. In a deterministic sequential plan, P ∈ Γ n , and the operation takes an expected time ∆ det (P ). The botnet's objective is to find the P op that minimizes ∆ det (P ).

In this section, we model the network in a very simple way: each node of G (labeled V i ) is assimilated to a black-box having only three attributes ( i , w i , π): The botnet's initial computational power is A.18 Example 7.6 A glance at the small example ∆ det ({1, 2, 3, 4}) is given in Figure 7.19, and reveals the structure of ∆ det (P ):

A((V i , r) = i r/w i , B(V i ) = π i , and C(V i ) = 0. V 1 / w1 A V 2 / w2 A V 3 / w3 A V 4 / w4 A f a i l u r e 1 - 3 V 4 / w4 A+π3 s u c c e s s 3 f a i l u r e 1 - 2 V 3 / w3 A+π2 V 4 / w4 A+π2 f a i l u r e 1 - 3 V 4 / w4 A+π2+π3 s u c c e s s 3 s u c c e s s 2 failu re 1 -1 V 2 / w2 A+π1 V 3 / w3 A+π1 V 4 / w4 A+π1 f a i l u r e 1 - 3 V 4 / w4 A+π1+π3 s u c c e s s 3 f a i l u r e 1 - 2 V 3 / w3 A+π1+π2 V 4 / w4 A+π1+π2 f a i l u r e 1 - 3 V 4 / w4
∆ det ({1, 2, 3, 4}) = 1 2 3 w 1 A + w 2 A + π 1 + w 3 A + π 1 + π 2 + w 4 A + π 1 + π 2 + π 3 + 1 2 (1 -3 ) w 1 A + w 2 A + π 1 + w 3 A + π 1 + π 2 + w 4 A + π 1 + π 2 + 1 (1 -2 ) 3 w 1 A + w 2 A + π 1 + w 3 A + π 1 + w 4 A + π 1 + π 3 + 1 (1 -2 )(1 -3 ) w 1 A + w 2 A + π 1 + w 3 A + π 1 + w 4 A + π 1 + (1 -1 ) 2 3 w 1 A + w 2 A + w 3 A + π 2 + w 4 A + π 2 + π 3 + (1 -1 ) 2 (1 -3 ) w 1 A + w 2 A + w 3 A + π 2 + w 4 A + π 2 + (1 -1 )(1 -2 ) 3 w 1 A + w 2 A + w 3 A + w 4 A + π 3 + (1 -1 )(1 -2 )(1 -3 ) w 1 A + w 2 A + w 3 A + w 4 A
For instance, the term:

1 (1 -2 ) 3 w 1 A + w 2 A + π 1 + w 3 A + π 1 + w 4 A + π 1 + π 3
expresses the following fact: initially, the botnet must attack V 1 using her own computer (during w1 A time units). As V 1 falls into the botnet's "hands" ( 1 ), the attack on V 2 uses both A and V 1 's captured power π 1 . Hence, w2

A+π1 time units are required to attack V 2 but this attack fails (1 -2 ). Hence V 3 is attacked using A + π 1 only during w3 A+π1 time. V 3 falls ( 3 ) and the botnet's power grows further to A + π 1 + π 3 which allows her to complete the (last) attack on V 4 in w4 A+π1+π3 time units. In other words, the formula enumerates all success/failure scenarios and sums their respective time expectations.

Theorem 7.2 For arbitrary n, ∆ det is given by the following formula where k[j] denotes the j-th bit of k:

∆ det (P ) = 2 n-1 -1 k=0 n-2 j=0 k[j] P (j+1) 1 -P (j+1) 1-k[j] n i=1 w P (i) A + i-2 =0 k[ ]π P ( +1)
Remark. The evolution of ∆ det is irregular because ∆ det (P ) does not depend on π P (n) and P (n) . Thus, swapping V P (n) with some another V i =P (n) replaces two formula parameters by new ones. This may cause radical variations in ∆.19

Computational strategies

The problem of minimising ∆ det is a form of combinatorial optimisation; most such problems cannot be efficiently solved, and unsurprisingly we do not have a polynomial-time algorithm to compute the optimal deterministic strategy. However, it is noteworthy that the problem's complexity is (at most) exponential and not factorial as one would expect.

We first note that the computation of P op can be accelerated (by a constant factor) using early aborts20 and by smartly recycling for P i+1 computations performed for computing P i .

Also, if P = {P (1), . . . , P (n -1), P (n)} and P = {P (1), . . . , P (n -2), P (n), P (n -1)} we observe that the common prefix {P (1), . . . , P (n -2)} can serve for the computation of both ∆ det (P ) and ∆ det (P ). Pushing this observation further, we get a divide and conquer algorithm. Let n = 2k and let P 2k op be the optimal plan for attacking V 1 , . . . , V 2k . Given the (unordered) list V P 2k op (1) , . . . , V P 2k op (k) we can compute the (ordered) prefix {P 2k op (1), . . . , P 2k op (k)} of P 2k op without examining V P 2k op (k+1) , . . . , V P 2k op (2k) , i.e. ∆ det (P 2k op ) can be computed by generating and solving all 2k k sub-problem pairs of size k. In other words, if the cost of finding

P 2k op is f (n) then, denoting n = 2 a : f (n) = n n/2 × 2f n 2 = 2 a n!f (1) a-1 i=1 (2 i )! ∼ c 1 2 2 a+1 +c2a-a 2 4 = O 2 2n+c2 log 2 n-log 2 2 n 4 = O 2 2n
where:

c 1 = f (1)π 2 e 2 and c 2 = 5 -2 log 2 π 4
Remark. Can a P n+1 op be constructed by inserting V n+1 into P n op ? It appears that such is frequently the case. We can provide experimental statistics about the ratio of configurations for which the insertion of V 5 and V 6 into a 4-target solution is possible.

We ran the following experiment, for values of A between 0 and 400:

Experiment(Bπ, Bw)(A):

1. rA ← 0 2. for t = 1 to 800 For large A, the success ratio r A tends to one. We do not have an explanation of this observation; see Figure 7.20. However, if true, this could yield a polynomial-time algorithm that outputs P op with high probability for large A values. .20: Experiment(100, 100) (in red) and Experiment(50, 200) (in blue). r A is the ratio of 6-target optimal plans obtainable by inserting 5 and 6 into their corresponding 4-target optimal plan. As A grows, it seems that one can find an optimal solution with high probability, simply by inserting the additional nodes in a smaller optimal solution.

3. for i = 1 to 6 4. i $ ← -[0.01, 1] 5. πi $ ← -[1, Bπ] 6. wi $ ← -[1,

Analysing adaptive attacks

In an adaptive attack, Alice adapts future moves to successes and failures. To understand what an optimal adaptive attack is, assume that we already know (thanks to some oracle) that the best adaptive attack must start by attacking V 1 . Before attacking V 1 we face the two possible futures illustrated in Figures 7.21 and 7.22: After attacking V 1 the "dust settles", and Alice's information increases. Hence:

∆ ad ({1, •, •}) = w 1 A + 1 min w 2 A + π 1 + 2 w 3 A + π 1 + π 2 + (1 -2 )w 3 A + π 1 , w 3 A + π 1 + 3 w 2 A + π 1 + π 3 + (1 -3 )w 2 A + π 1 + (1 -1 ) min w 2 A + 2 w 3 A + π 2 + (1 -2 )w 3 A , w 3 A + 3 w 2 A + π 3 + (1 -3 )w 2 A
It appears that To find the best adaptive attack, Alice defines:

w 2 A + π 1 + 2 w 3 A + π 1 + π 2 + (1 -2 )w 3 A + π 1 < w 3 A + π 1 + 3 w 2 A + π 1 + π 3 + (1 -3 )w 2 A + π 1 and w 2 A + 2 w 3 A + π 2 + (1 -2 )w 3 A < w 3 A + 3 w 2 A + π 3 + (1 -3 )w 2 A ,
∆ ad ({x, •, •}) = w x A + (1 -x ) min w z A + z w y A + π z + (1 -z )w y A , w y A + y w z A + π y + (1 -y )w z A + x min w z A + π x + z w y A + π x + π z + (1 -z )w y A + π x , w y A + π x + y w z A + π x + π y + (1 -y )w z A + π x
and computes: ∆ ad (P opt ) = min {x,y,z}∈Γn

(∆ ad (x, •, •)) .
Intuition suggests that an adaptive plan (allowing Alice more freedom of action) would yield better results than a deterministic one. Such is indeed the case, as shown in the following example 21 where A = 7, n = 3 and V 1 = {2, 1, 0.3}, V 2 = {10, 5, 0.2}, V 3 = {1, 2, 0.4} (see Figure 7.24). We have:

σ {1, 2, 3} {1, 3, 2} {2, 1, 3} {2, 3, 1} {3, 1, 2} {3, 2, 1} ∆ det 1.04564 1.04452 1.07646 1.08646 1.05643 1.08436
For n = 3, adaptive attacks are not characterized by a permutation but by the V i attacked first. It appears that:

∆ det (2, 1, 3) =∆ ad (2, •, •) = 1.07646 ∆ det (3, 1, 2) =∆ ad (3, •, •) = 1.05643 but: ∆ ad (1, •, •) = 1.04417 < min {x,y,z}∈Γ3 (∆ det (x, y, z)) = ∆ det (1, 3, 2) = 1.04452
Here,

∆ ad (1, •, •) = w 1 A + (1 -1 ) (1 -3 )w 2 A + 3 w 2 A + π 3 + w 3 A + 1 w 2 A + π 1 + (1 -2 )w 3 A + π 1 + 2 w 3 A + π 1 + π 2 = 1.04417
The general algorithm is illustrated in Figures 7.25 and 7.26. Assume again that we know (thanks to some oracle) that an adaptive attack for n = 4 should start by V 1 . Figure 7.25 shows the 4 possible attack plans starting by an attack on V 1 .

To compute a time expectation of a branch, consider the chain of red and blue cells leading to the black leaf. The chain defines the computation power available for attacking the black leaf and hence the time taken to do so. Work the way up until a ? is met. Then prune all branches except the one whose time is minimal and proceed further up. This will yield a decision tree representing the optimal adaptive moves. Now, because we are not given an oracle (i.e., the optimal attack may begin by some V i = V 1 ) the process must be repeated for all possible first targets as shown in Figure 7.26.

The algorithm examines 2 n n! attack chains and prunes them to get the 2 n "recipe" describing how to best proceed adaptively.

The frequencies of different timings are given in Table 7.5. We could heuristically identify some of these entries as:

{2i!, 1}, {2, i!φ(i)}, {2(i -1)!, i}, {2(i -2)!, 3i(i -1)}.
A noteworthy feature of the problem we are approaching is the following:

21 V i = {π i , w i , i }. V1/ w 1 A V2/ w 2 A V3/ w 3 A f a i l u r e 1 - 2 V3/ w 3 A+π 2 s u c c e s s 2 f a i l u r e 1 - 1 V2/ w 2 A+π 1 V3/ w 3 A+π 1 f a i l u r e 1 - 2 V3/ w 3
V 1 : attack V 2 first, V 3 next. V1/ w 1 A V3/ w 3 A V2/ w 2 A f a i l u r e 1 - 3 V2/ w 2 A+π 3 s u c c e s s 3 f a i l u r e 1 - 1 V3/ w 3 A+π 1 V2/ w 2 A+π 1 f a i l u r e 1 - 3 V2/ w 2
V 1 : attack V 3 first, V 2 next. V1/ w 1 A 2w3π2(A + π3) > 3w2π3(A + π2) V3/ w 3 A V2/ w 2 A f a i l u r e 1 -3 V2/ w 2 A+π 3 s u c c e s s 3 f a l s e V2/ w 2 A V3/ w 3 A f a i l u r e 1 -2 V3/ w 3 A+π 2 s u c c e s s 2 t r u e fai lur e 1 -1 2w3π2(A + π1 + π3) > 3w2π3(A + π1 + π2) V3/ w 3 A+π 1 V2/ w 2 A+π 1 f a i l u r e 1 -3 V2/ w 2 A+π 1 +π 3 s u c c e s s 3 f a l s e V2/ w 2 A+π 1 V3/ w 3 A+π 1 f a i l u r e 1 -2 V3/ w 3

Last node standing

The power of the last captured node does not contribute to the botnet's total power, as by definition this ends the game. Consequently, the optimal strategy is independent of the last node's power.

The catch is, of course, that modifying a given node's characteristics may change the optimal order. This is why a deterministic attack plan is notoriously difficult to design. However, the above remark is downplayed if we regard the capture game only as the first phase of a two-phase game: capture then attack. In the capture phase, the botnet attempted to capture a whole subnetwork. In the attack phase, the botnet will use the capture power to disrupt another target subnetwork. In this two-phase scenario, the total power when the capture phase ends is the objective to be maximised. • S is a set (the set of "states")

• S is a probability distribution over S (distribution of the initial state)

• A is a set (the set of "actions")

• π is the state transition distribution, i.e. for each s ∈ S, a ∈ A, π s,a is the distribution over to which state we will randomly transition if we take action a in state s.

• γ ∈ [0, 1] is a constant real number • R : S × A → R

is a bounded function of the current state and action (the "reward")

MDPs capture formally the problem of planning and acting in the face of uncertainty. We start from an initial state s 0 $ ← -S. At each time step t, we have to pick an action a t , which causes the state to evolve to s t+1 $ ←π st,at . At time T , we have gone through a sequence of states s 0 , s 1 , . . . , s T , and a sequence of actions a 0 , . . . , a T , which has resulted in some payoff

R(s, a) = ∞ t=0 γ t R(s t , a t ) = T t=0 γ t R(s t , a t ) + γ T +1 1 -γ R f inal
where γ plays the role of a discount factor, which has a natural interpretation: immediate rewards are valued more than prospective ones. As a result we encourage the solution to be fast rather than slow. The action a t can be chosen based on all previous actions and states, but since the future actions are conditionally independent from the past ones given the current state, it suffices to choose actions only as a function of the current state s t .

This observation is at the basis of the "policy-based" approach: The problem becomes that of finding a function D : S → A that decides the next action, and is such that the reward R(s, a) is maximal when the policy is followed.

Bellman equations. For every policy D, we define the value function of this policy by:

V D (s i ) = E at∼D [R(s, a) | s 0 = s i ]
which gives the expected returns for taking actions according to D and starting from a state s i . The Q-function for D is defined by:

Q D (s i , a i ) = E [R(s, a) | s 0 = s i , a 0 = a i , a t = D(s t ), ∀t > 0]
which gives the expected returns for starting at a state s i , taking action a i , and then following D to decide the upcoming actions.

The optimal V -and Q-functions are defined to be the functions corresponding to the best policy:

V * (s i ) = max D V D (s i ) Q * (s i , a i ) = max D Q D (s i , a i )
Optimising over D is not trivial, but it is a famous result that an optimal policy D * exists and satisfies

D * (s i ) = argmax a∈A Q * (s i , a) (7.2)
The knowledge of Q * is therefore enough to find the optimal policy. The Bellman equations give a recursive definition for Q * (and also for Q D , V D , and V * ):

Q * (s i , a i ) = R(s i , a i ) + γ s∈S π si,a (s) max a∈A Q * (s, a) (7.3)
and Q * is the unique (bounded) solution to this equation. When π is known, Equation (7.3) can be solved for Q * as a fixpoint by iteratively updating Q(s i , a i ) until convergence. However, this is not a very efficient strategy and requires the precise knowledge of π.

Q-learning. As observed above, the knowledge of Q is sufficient to decide an optimal policy. This gives rise to an algorithm that learns Q and uses it to take subsequent decisions, updating its policy without knowing π. Concretely, starting with a random (or zero) matrix Q and introducing a learning rate α, we use the iteration:

Q(s i , a i ) ← (1 -α)Q(s i , a i ) + α R(s i , a i ) + γ max a∈A Q(s f , a) (7.4)
on transitions s i a -→ s f . The next transition is decided according to the best policy given by this Q-function (Equation (7.2)), or chosen at random, or chosen using Thompson sampling.

Thompson sampling works by modelling how precise is the information we have on nodes. It favours exploration conservatively, when there is still uncertainty about potential payoffs. We can illustrate Thompson sampling on a toy example as follows. Consider that there are n actions, and that action k produces a reward of 1 with probability θ k . Usually one would compute the sample mean θ k from several experiments, and possibly select the most profitable action a ← argmax k θ k -this would correspond to the 'greedy' approach, but naturally our initial knowledge of θ k is very inaccurate. The rationale is therefore to reason from som generic prior belief on θ k , e.g., a Beta distribution parametrised by two quantities α k and β k :

p(θ k ) = Beta(α k , β k ) = Γ(α k + β k ) Γ(α k )Γ(β k ) θ α k -1 k (1 -θ k ) β k -1 .
At time t, after choosing an action i, and reaping a reward r ∈ {0, 1}, we update our distribution to account for the new information:

(α i , β i ) ← (α i , β i ) + (r, 1 -r)
this has the effect of reducing the variance and shifting the mean, reflecting the fact that this action improved our knowledge of the payoff. Accordingly, we must account for the fact that our knowledge is imprecise, and rather than use the sample mean to select the next action, we sample θ k from the knowledge distribution:

θ k ∼ Beta(α k , β k ) for each k.
The action is chosen after this sampling so as to maximise expected payoff: a ← argmax k θ k .

In our case, the action is chosen as argmax k Q(s, k), and we keep track of the state s, and the prior distribution is a product of beta functions.

Optimal botnet as an MDP

The botnet problem can now be phrased directly in the language of MDPs:

• Denoting by F the set of G's nodes an action is a node g ∈ F . Hence A = F .

• A state is a sequence of actions (and, equivalently, a subset of G). We will also keep track of the result (success or failure) of previous actions. Hence a state we can be represent as a list of elements from F × {0, 1}. Hence S = Lists(F × {0, 1}).22

• The reward for reaching state s t and then taking action a t is

R(s t , a t ) = -C(a t )
if (a t , 1) ∈ s t -C(a t ) + (g,1)∈st B(g) otherwise i.e. all attempts cost some amount C of effort, but only successfully completed attacks (f = 1) contribute to the positive reward. Furthermore, attempts to "re-attack" already hijacked nodes does not yield additional profits.

Note that instead of counting only the last added node as immediate reward, we use the total amount of resources available after the attack, i.e.

r(s t ) = (g,1)∈st B(g)
• Attacking a t from state s t can lead to one of two successor states: -Success: s t+1 ← s t .append((a t , 1)) -Failure: s t+1 ← s t .append((a t , 0)) Thus, taking action a t from state s t will randomly transition to one of these new states. If (a t , 1) ∈ s t then we always transition to a failure state. and the transition probability is given by A(a t , r(s t )), i.e.

π st,at = s t .append((a t , 1)) with probability A(a t , r(s t )) s t .append((a t , 0)) with probability 1 -A(a t , r(s t ))

• For the probability of successfully hijacking the state a with resistance r when having a total power p in state s, the currently implemented formula is

π s,a = min 1, p r
However, this model has the disadvantage of not being inversible in P/R, which is problematic in model-based learning. Thus, another possible model is the following:

π s,a = 1 -e -p r

Implementation

Exact solution. Using Equation (7.3), we can compute Q * as a fixpoint by iteratively updating Q(s i , a i ) until convergence (as said in Section 7.4.6.1). Nevertheless, the graph of the states is very specific here, which allows us to compute the optimal policy with only one step for each state. Indeed, computing the value Q * (s i , a i ) usually requires the value of s∈S π si,a (s) max a∈A Q * (s, a), which we don't know, because it may contain other unknown values of Q * . But in the case of the botnet, the possible results from taking action a i in state s i are either the state s i if it fails, or the state s i+1 otherwise, where s i+1 is the state s i plus the computer a i . It follows:

Q * (s i , a i ) = R(s i , a i ) + γπ si,ai (s i ) max a∈A Q * (s i , a) + γπ si,ai (s i+1 ) max a∈A Q * (s i+1 , a))
Let's now assume that a i is the optimal action to take in state s i , i.e max a∈A Q * (s i , a) = Q * (s i , a i ). The above equation then boils down to:

Q * (s i , a i ) = R(s i , a i ) + γπ si,ai (s i+1 ) max a∈A Q * (s i+1 , a) 1 -γπ si,ai (s i )
If a i isn't the optimal action, then this equation becomes a lower bound on Q * (s i , a i ). The point is that considering this bound as the exact value doesn't affect the other values. This way, we can recursively compute the value of Q * (s i+1 , a) (or we could start from the end), and doing this way, the size of the state will increase at each step, until reaching the final state, for which we know the value (as given by the definition of R). This is correct because when we reuse some already computed value of Q * , it goes through some max over every possible action, and therefore only the value of the optimal action matters, which is indeed exact, as seen above. The other lower bounds don't interfere with this maximum, unless it is the optimal action. This way, we can compute the exact value of Q * on all the optimal actions for each state, with which we can easily compute the optimal policy. This is nice, but requires to go through every state once, which finally costs O(2 n ) computations, if n is the size of the network.

Q-learning. To avoid this exponential complexity, we do not need to visit every state. Therefore, we compute an approximation of Q * by exploring some states and using Q-learning to update the estimate. The botnet is trained by leading successive attacks on the networks, allowing to do such updates with regards to the rewards obtained.

In a first approach, we only use Equation (7.4) to update the estimate, at each step of exploration. This approach is the model-free approach, which means we don't make any assumption on the transition probabilities (we don't even know that they depend only on resistance and computation power). The easiest way to explore is to always choose some random action to perform. This assures that first levels (first attacks within an invasion) of the state graph will be deeply explored, but after a few steps, with a great probability, the path explored will be unknown. At the end of the training, this means that after taking a few optimal steps according to the obtained policy, the botnet will probably reach some unknown state, and then act randomly.

As an improvement, we can use the computed values during training, to focus mainly on the interesting states. The completely greedy training policy would be to take, at each step, the optimal action according to the previous computed policy, and choose at random if the state is unknown. This would lead to suboptimal solutions, because the botnet won't explore new states, even if they are the optimal ones. Therefore, we set a trade-off between these two policies, using a random-action rate decreasing with times and trials (i.e. fully random at beginning, and fully greedy at the end of the training).

Another policy is based on Thompson sampling [START_REF] William | On the likelihood that one unknown probability exceeds another in view of the evidence of two samples[END_REF]: in addition to the estimate of Q * , we compute an approximation of the transition probabilities in each state. Then, at each step, the botnet samples transition for each possible action, according to its internal estimates of theses probabilities. It then only considers successful actions, and takes the one which has the best value. Some kind of optimistic (and riskier) variant is to considers these actions as (really) already successful, and then consider the value of the state after such a success, and take the best one. We can also do some combination of both values.

A very different approach is to learn not only the Q * function, but also the different parameters like the transition probabilities, and the rewards. This is called model-based learning. At each step, the botnet updates these parameters, and uses them to update the estimate of Q * , basically iterating Equation (7.3).

To improve the propagation of information, we can use the trick we saw above to exactly update the value (according to the estimates), but we can also wait for the end of the invasion, and then update from the end to the beginning the value of all the states and actions we went through in this invasion. This allows us to propagate modifications much quicker (we need one update instead of n successive ones). To drive the exploration-exploitation trade-off, we can use Thompson sampling again.

Suboptimal, greedy algorithms. In order to compare the performance of our learning botnets, often on networks of a size too big to compute the optimal policy, we designed simple, greedy algorithms (which "cheats" with the knowledge of the network) to compare it to.

The first one consists of iteratively computing a policy for the nodes a 1 to a i . Let us remember that in our model, a policy consists of an ordering of the nodes, which is the order of the attacks (because a failed hijack doesn't change the state, and therefore the policy). To expand our policy to include the node a i+1 , we simply consider all the possible insertions in our current policy, and selects the one that maximizes the reward (or minimizing the time to capture the whole subnetwork, depending on what we want to compare). We assumes the relative position of the previously placed nodes won't change. This algorithm can be further improved by performing a sort on the nodes beforehand. Considering the nodes by increasing resistance, for instance, has yielded quite good results. The resulting complexity is O(n 3 ).

Of course, as is, this algorithm doesn't compute the optimal policy. We indeed have found counterexamples with only three or four nodes for the following orderings on the nodes: increasing power, increasing resistance, decreasing power, decreasing resistance. However, there exists an order which yields the optimal policy: we just have to sort the nodes as in the optimal policy, and the algorithm above will be optimal (because if there is an order of the first i nodes that is better than in the optimal policy, we could design a policy better than the optimal one).

We designed a second algorithm, based on the following remark: the optimal policy is computed for each state (i.e. each subset of the whole network), but in our model, the transition probabilities only depend on the total power of the hijacked nodes, rather than on which specific nodes are hijacked (except for the case where the Botnet tries to attack a captured node). Therefore, we compute for each power p (smaller than the total power of the network) and action a a value V (p, a) according to the following rule:

V (p, a) = (1 -π p,a )V (p, a) + π p,a I(p, a) + max a V (p + p a , a ) V (p, a) = I(p, a) + max a V (p + p a , a )
Here, I(p, a) is a sort of immediate reward after hijacking a when having a power p, π p,a is the probability of success, and p a is the proselytism of the node a. The policy is then retrieved by, when in state s (and therefore disposing of a power p(s)), taking the action a correponding to an enemy node which maximizes V (p(s), a). I(s, a) can be chosen as 1 πp,a , which is the average time of capture (and taking a minimum rather than a maximum), which would correspond to minimizing the average time of capture of the whole network. Another possibility is I(s, a) = R(s, a).

This algorithm isn't optimal either, because it forgets which nodes he can't capture again, and therefore is lured by unreal states where an appealing node has endlessy been captured. However, a good I function (which remains to be found) can lead to good results. This algorithm has a complexity of O(P max n 2 ), where P max is the maximum proselytism of the nodes in the network (assuming the I function can be computed in O(1)).

Percolation-first strategy

So far we have modelled the network after a complete graph, capturing the fact that the botnet can contact any node directly. While this is a reasonable model for the Internet, there are specific scenarios, such as enterprise networks, in which access is less straightforward.

These networks often offer only a limited direct connection to the "outside world", from which our attack is launched. Therefore the botnet much work its way through some "obligatory" nodes, before it can spread, even if attacking these nodes is suboptimal from a whole-graph perspective. 23We use percolation centrality [START_REF] Mahendra Piraveenan | Percolation centrality: Quantifying graph-theoretic impact of nodes during percolation in networks[END_REF] as a measure of a node's infection potential: high percolation means that they give access to many new nodes. Let G = (V, E) be the target network, denote by d(a, b) the graph distance on G between from a to b, σ(a, b) the number of shortest paths in G from a to b, and τ (a, b, c) the number of shortest paths in G from a to c passing through b, both measured with d. The classical topological betweenness centrality [Fre77; Fre78; Bra01; New05] is defined for each node g ∈ G by:

B(g) = 1 (|G| -1)(|G| -2) s =g =t τ (s, g, t)
σ(s, t)

i.e. it counts the proportion of shortest paths that go through g. 24 The classical betweenness centrality measure assumes that information flow is through the shortest paths in a network. This is not a realistic assumption [START_REF] Stephenson | Rethinking centrality: Methods and examples[END_REF], and in particular does not apply to heavily centralised modern networks. Analyses of cascading failures in power grids [LPC09; GKK01; CLM04; KCA + 05; CLP13] highlighted the importance of load balancing, itself a consequence of whether the nodes operate correctly or not, and at which capacity.

Percolation centrality is therefore a time-dependent measure, that depends on how much of the network is already under our control. Unlike betweenness, which is purely topological, percolation evolves as we capture the network. It is defined as:

P (g, t) = 1 |G| -2 s =g =r τ (s, g, r) σ(s, r) w t (s, g)
where w t is defined in term of the infection variables: I t (g) = 0 if g is not infected at time t; otherwise I t (g) = 1. 25 We have:

w t (s, g) = I t (s)
g ∈G\{g} I t (g ) An interpretation of percolation centrality is that it counts how many percolation paths go through a node g; a percolated path is a shortest path between a pair of nodes, where the source node is percolated, i.e., infected. If all nodes are percolated to the same extent at some time t 0 , then P (g, t 0 ) = B(g).

Computing B(g) and P (g, t) can be done using Brande's algorithm [START_REF] Brandes | A faster algorithm for betweenness centrality[END_REF], which runs in worst case O(|V | • |E|) time for B and O(|V | 3 ) for P .

To include percolation as one of the botnet's objectives, we can simply add λP (g) to the rewards of capturing node g. This works as a topological heuristic: by capturing g, one can hope to get access to many more nodes when P (g) is high. The weighting constant λ > 0 determines how important this objective is, relative to accumulating immediate power, and therefore articulates between a conquest-oriented strategy and a domestic control strategy.

Limitations and improvements

Complexity

The fully informed algorithm solves a combinatorial problem through the Bellman equations, which is inherently exponential (although in practice orders of magnitude much faster than combinatorial enumeration); it also stores the Q matrix, which is of size O(|V | 2 ). The learning variant furthermore has the limitations of Q-learning itself.

Improvements on convergence speed and memory footprint can be achieved by using interpolation instead of storing Q (e.g. neural networks), and reward shaping techniques may be used to guide the learning process. In practice the attacker would restrict its attention to a subnetwork of reasonable size (i.e. not millions of devices), so we may conjecture that one does not run into difficulties using the algorithm on today's networks.

Multiple targets

Extending the problem to deal with simultaneous targets is possible. What determines whether this brings any advantage over serial attacks is twofold: Whether serial attacks are more visible to the defender and impact further intrusion; and whether attacking n targets costs more (or less) than n successive attacks. Both these aspects are beyond the model considered here.

An educated guess is that simultaneously attacking multiple targets could benefit the botnet; but also that the resulting optimisation problem is much trickier to solve.

Moving targets

A natural extension is to consider "moving targets", i.e. nodes whose property evolve other times, including maybe nodes that were in the botnet but escape it at some point (malfunction, repair, etc.). Minor modifications of our algorithms can deal with such situations.

Continuous model

The model doesn't require a lot of changes to be adapted to a continuous time t ∈ R.

• The reward function now is

R(s, a) = ∞ 0 γ t R s(t), a(t) dt = - 1 ln(γ) N -1 i=0 γ ti -γ ti+1 R s(t i ), a(t i ) + γ t N R f inal
• The probability of success π s,a is replaced by the time of capture T s,a , which is sampled according to an exponential distribution of same expected value than the geometrical distribution of the discrete model: T s,a ∼ E resistance(s) power(a)

This model may allow our algorithms to learn faster, because of the following remark: the value of a real random variable gives more information than a discrete one. The computation/proof is yet to be done. Cryptologic techniques apply to a broader range of problems than those traditionally associated with it. This in turn allows to turn some notions on their heads, turning "flaws" or "hardness" into usable and useful features.

For instance, the cryptographer's expertise in hard problems can be leveraged to slow down adversaries at a marginal cost -such a barrier is called a proof of work, since the only way to find a valid solution is to address the hard problem, often by exhausting all possibilities. Hence an entity with a correct solution had no choice but to invest energy, time, and effort -"work". This notion was first introduced in 1993 to fight automated unsollicited electronic mail, by preventing abusers from overflooding the network. It has now made its way in the public sphere, being at the heart of such popular cryptocurrencies as Bitcoin.

That being said, the "work" in a proof of work is wasted, in the sense that there is usually no gain in performing this computation; in fact one uses electricity, time, and effort -cryptocurrency appropriately counteract this loss by rewarding the first correct proof of work. Alternatives are possible1 but their relevance in most use cases is dubious. In Section 8.1 we introduce the notion of "community-serving" proofs of work, and give a concrete example in the quest for nilcatenations. Solving this problem identifies redundant information in the underlying database, and makes these findings public, hence benefitting the whole community. Another well-known example of "flaw"-turned-useful is encryption homomorphism, which allows an adversary to combine two ciphertexts into a third one, or to perform some operation in the underlying plaintext, without decoding. Surely such a possibility is not desirable in many contexts, and a great many efforts have been undertaken to design cryptosystems that do not have homomorphic properties; or to correct those who have. However, there are situations when homomorphisms are desirable; an example is that of secure computation outsourcing, whereby a user wishes to leverage a third party's computational power, but does not trust this third party. Concretely, the user demands that the third party computes on data, but does not wish to provide this data, only an encrypted version of it, which the third party should not be able to decrypt. This is where homomorphic encryption plays a role, enabling computation "with a blindfold" 2 .

Homomorphic encryption schemes are in turn useful cryptographic primitives, from which we can construct further primitives, such as cryptographic multilinear maps. Such constructions generalise (elliptic curve) pairings, originally introduced to attack the DLP [START_REF] Menezes | Reducing Elliptic Curve Logarithms to Logarithms in a Finite Field[END_REF] but quickly appeared essential in the construction of efficient multi-party key exchange [START_REF] Joux | A One Round Protocol for Tripartite Diffie-Hellman[END_REF] and signature (e.g., [START_REF] Boneh | Short Signatures from the Weil Pairing[END_REF]) mechanisms. In addition, multilinear maps promise to realise indistinguishability obfuscation, a very powerful tool that connects many parts of cryptography together 3 . For these miracles to happen and take hold in the industry, efficient and secure constructions must be found. At the time of writing neither efficiency nor security are certain for such building blocks. In Section 8.3 we describe a very efficient multilinear map construction, inspired by a 2015 candidate by Coron-Lepoint-Tibouchi. Unfortunately their scheme was broken that same year, and the subtle attack also applied with some modifications to our construction. Nevertheless, the techniques we used are of interest and may enable the design of efficient multi-party key exchange protocols.

Finally we discuss in Section 8.2 an optimisation problem stemming from the efficient verification of several signatures having a homormophic property. This problem reveals a beautifully intricate combinatorial structure, which we explored using a combination of algebra, algorithms, and geometry. This result in an optimal batch signature verification algorithm, that identifies which signatures are correct and which are not in a minimal number of tests.

Community-serving proofs of work Abstract

Banks, blockchains, and other book-keeping mechanisms need to keep track of an ever-increasing list of operations between the accounts owned by their users. However, as time goes by, many of these transactions can be safely 'forgotten', in the sense that purging a set of transactions that compensate each other does not impact the network's semantic meaning i.e. the vector b of amounts representing the balances of users at a given point in time t.

We call nilcatenation a collection of past transaction vectors having no effect on b. Removing these transactions yields a smaller, but equivalent set of transactions.

Motivated by the computational and analytic benefits obtained from more compact representations of numerical data, we formalize the problem of finding nilcatenations, and propose detection algorithms. Among the suggested applications are decoupling of centralized and distributed databases, improvements on internal representations for graph-based databases, and strategies for alleviating the burden of large nodes in financial transaction blockchains.

Our nilcatenation detection algorithm even constitutes a proof of useful work, as the periodic removal of nilcatenations keeps the ledger size as small as possible.

This is joint work with Simon Cogliani, Răzvan Roşie, and David Naccache. This work was presented at the 13 th EAI International Conference on Security and Privacy in Communication Networks (SECURE-COMM 2017) in Niagara Falls (Canada) and published as [CGN + 17].

Introduction

In many database applications, chiefly those that keep track of data or value being moved around, a list of transactions is stored. As a first example, consider a centralized DBMS, where a high number of concurrent transactions can affect the performance of the system. As a second example consider a table storing the financial transactions occurring between a set of users -access problems occur when the list is growing too much and multiple users are auditing the data; this causes pressure on the various locking strategies in order to prevent anomalies such as dirty reads/writes, phantom reads etc. One interesting solution consists in decoupling such database in separate and functionally independent parts, by preserving the balance of the users and storing possibly old, outdated transactions separately and always able for being interrogated.

That scenario occurs is in distributed ledger protocols, such as the increasingly popular Bitcoin blockchain [START_REF] Nakamoto | Bitcoin: A peer-to-peer electronic cash system[END_REF] protocol, where currency is exchanged between accounts and the (complete) history of such exchanges constitutes the blockchain itself. As time passes, the number of transactions grows, and so do the storage requirements: in the begging of 2017 the Bitcoin blockchain claimed in excess of 100 GB [Blo16]. While not excessive in storage terms by today's standards, the Bitcoin blockchain still exerts considerable stress on the network, in particular when users need to access this history, even if only to search some information in it. Popular crypto-currencies, such as Ethereum and Bitcoin, already support ad hoc compression mechanisms, so that users are not required to store the entire blockchain.

In any case, storage requirements will only grow, and it makes sense to think about how information can be efficiently stored or cleansed, i.e., represented. Such a representation should be semantically preserving, at least to the extent that the effect of no transaction is lost in the process 4 . In many cases, some details might become irrelevant (e.g., the precise number of successive transactions between two parties) and it might be possible then to clump some events together into a more compact form. Such a semantical preserving property may found another use. To extend the motivational landscape, money laundering activities may be spotted easier if such semantically preserving subgraphs are detected.

Our discussion would also apply to institutions such as banks, however as stated in [KPC + 14; GI13], due to the nature of financial secrets, only scarce information is publicly known about the transaction graphs. Purging past transactions while preserving the network's semantics also has potential privacy implications. By eliminating some transactions, we do not lie about the past (i.e., create virtual transactions that do not exist) while still forgetting transactions that do not need to be remembered.

The problem of transaction ledger will thus be a motivating example throughout this paper. We therefore consider a set of users (each one owning one account for simplicity), and transactions between these users, which can be represented as labeled edges between nodes. Thus the transaction ledger consists in a multigraph (as edges can be repeated). Our goal is to identify redundant information, in the form of a subgraph that can be removed without affecting any user's balance (the network's semantics). We call such a subgraph a nilcatenation. The notion of nilcatenation is generic, in that is applies to any labeled graph, and therefore bears applications in many situations. This paper is concerned with defining and efficiently finding nilcatenations.

The nilcatenation problem. We consider a transaction graph, loosely defined as a public ledger holding a history of all transactions between users. These transactions accumulate over time and constitute a large database which needs to be duplicated (to keep the ledger public) and checked (to ensure transaction validity). This causes an ever-increasing burden on all operations. The 'nilcatenation problem' (NCP) consists in constructing a (provably equivalent) ledger that is shorter than the existing one. That the new and old information coincide should be easy to check, and the shorter ('purged') graph makes duplication and checking easier.

In the context of blockchains, identifying blockchain nilcatenations is a service to the community, that can be rewarded by. . . coins, just as any other proof of work. In that respect the perspective of a cryptocurrency allowing users to mine by nilcatenation is not totally unrealistic, and we discuss it below.

Alternatives. The problem of bookkeeping is not new, but it only becomes truly problematic in a distributed context. In the traditional setting, complete archiving is the de facto solution.

In a distributed context, using for instance blockchains, there has been some effort in trying to avoid the perpetual duplication of history, starting with Bitcoin's Merkle-based fast transaction checking [START_REF] Nakamoto | Bitcoin: A peer-to-peer electronic cash system[END_REF]. With this scheme, it is possible to verify that a transaction has been accepted by the network by downloading just the corresponding block headers and the Merkle tree. Nodes that do not maintain a full blockchain, called simplified payment verification (SPV) nodes, use Merkle paths to verify transactions without downloading full blocks.

However since SPV nodes do not have the full blockchain there must still be some other nodes that do the archiving. An idea that is often described [START_REF] Bruce | Purely P2P Crypto-Currency With Finite Mini-Blockchain[END_REF][START_REF] Bruce | The Mini-Blockchain Scheme[END_REF] consists in excluding the old transactions: Discarding transactions that happened prior to a pre-established time limit, while keeping only the most recent ones. The problem with this approach is that it prevents auditability, insofar as the origin of some transactions may be lost. It is also incompatible with existing protocols (such as Bitcoin), and results in an alternative ledger or cryptocurrency.

Contributions

The contributions that we give in ths work can be summarized as follows:

• we begin by formalising the nilcatenation problem and place it in the context of financial transactions, representable through weighted multigraphs. To the best of our knowledge, this is the first time when this problem is formalised. We show -via a reduction to the (multi-dimensional) subset-sum problem -that NCP is NP-complete.

• our main contribution is a procedure for finding the optimal 5 nilcatenations when the underlying subset-sum problem has a low density. 6 Our approach is based on a combination of graph-theoretical and lattice reduction techniques.

• since checking the validity of a solution to the NCP is easy, as a separate contribution, we suggest using NCP solutions as proofs of work, suitable to blockchain-oriented application. Reward models are presented and the practical precautions needed to correctly fine-tune the resulting incentive are also discussed. We analyse cheating strategies and provide countermeasures. The first countermeasure that is proposed suits the blockchains models considering transactions fees. A second solution is offered (together with a proof in the Random Oracle Model) for blockchain models without transaction fees. Along the way, we point out several interesting questions raised by the analysis of this problem.

Preliminaries

Notations. We will make use of the following standard notations: [n] denotes the set {1, . . . , n}. For a set S, we denote by s ← $ S the action of sampling s uniformly at random. We denote by |S| the cardinality of a set. Bold letters (e.g. v, A) are used to represent vectors and matrices.

Graphs and multigraphs

We will make use of the following standard definitions: A graph G = (V, E) is the data of a finite set V and E ⊆ V × V , called respectively the vertices and edges of G. A sequence of edges (s 1 , t 1 ), . . . , (s n , t n ) such that t i = s i+1 for all 1 ≤ i < n is called a directed path from s 1 to t n . The degree of a vertex v ∈ V is the number of edges connected to v. The in-degree (resp. out-degree) of v is the number of edges ending at (resp. starting at) v. E) is a graph, then a strongly connected component (or SCC) of G is a maximal subgraph of G such that for each two distinct nodes x and y, there exists a directed path from x to y, and a directed path from y to x.

Definition 8.1 If G = (V,
In particular, any strongly connected component is connected, but the converse does not hold.

In this work we consider an extension of graphs where edges can be repeated and are labeled: A labeled multigraph is denoted by G = (V, E, φ) where now E is a multiset of couples from V × V (not just a set), and φ : E → Z gives the label associated to each edge7 . We will use the following notation: If e = (a, b) ∈ E, and r = φ(e), we represent the edge e by writing a r -→ b.

The definitions of connected and strongly connected components, and the definition of degree, naturally extend to multigraphs.

The subset-sum problem

We recall the well-known subset-sum problem (SSP, [START_REF] Karp | Computational Complexity of Combinatorial and Graph-Theoretic Problems[END_REF]): Definition 8.2 (Subset-Sum Problem) Given a finite set A ⊂ Z, and a target value t ∈ Z, find a subset S ⊆ A such that s∈S s = t.

The SSP is known to be NP-complete [START_REF] Karp | Reducibility among combinatorial problems[END_REF]. An equivalent definition of the problem is given by the following: Definition 8.3 (Subset-sum problem, alternative definition) Given a vector A ∈ Z n , and a target value t ∈ Z, find a vector ∈ {0, 1} n such that A, = t, where •, • denotes the inner product.

The density of a particular SSP instance is defined [START_REF] Lagarias | Solving low-density subset sum problems[END_REF] as:

d = n max a∈A log a
While generic SSP instances are hard to solve, low-density instances can be solved efficiently using approximation techniques or lattice reduction.

Formalising the NCP

A first definition

We are now equipped to formalise the nilcatenation problem. In all that follows, the history of transactions is assumed to form a multigraph G = (V, E, φ), where the vertices V correspond to accounts, and a labeled edge a In other terms, finding a nilcatenation consists in finding edges that can be removed without impacting anyone's balance -i.e. that preserve the graph's semantics. Note that merging transactions together is not allowed.

NCP and SSP

A key insight in solving this problem is to realise that a similar way of stating that the edges in E do not contribute to the balance of any v, is that they contribute a quantity of zero. In other terms, at each vertex v the balance in G is b(v) = 0. This gives the following description: In fact, more is true: NCP can be seen as a multi-dimensional variant of the subset-sum problem, where the entries belong to Z |V | instead of Z. Note however that NCP is a remarkably sparse special case of that multi-dimensional SSP. Proposition 8.1 NCP is equivalent to SSP, and hence NP-complete.

Proof: By the above discussion, a multi-dimensional SSP oracle provides a solution to any NCP instance. Vectors of Z |V | can be described as integers using base |V | encoding. Hence SSP and multi-dimensional SSP are equivalent. Therefore we have a reduction from SSP to NCP.

Conversely, assume an NCP oracle, and in particular an n = 2 oracle, then by the remark made above it is exactly an SSP oracle.

We may define accordingly 'zeroth-order' obstructions, where the minimum of the in-and out-degree of v is zero (but such vertices do not exist in a strongly connected component), and higher-order obstructions, where the in-or out-degree of v is larger than 1, and there is no solution to the local conservation SSP: This problem is exactly the SSP on the set E I E O , and target value 0, hence the name.

Strongly connected components.

It is easy to see that a partition of G into k strongly connected components corresponds to a partition of E into (k + 1) multisets: Each strongly connected component with its edges, and a remainder of edges that do not belong to SCCs. As explained above this remainder does not belong to E.

The partition of a graph into strongly connected components can be determined exactly in linear time using for instance Tarjan's algorithm [START_REF] Tarjan | Depth-first search and linear graph algorithms[END_REF]. To each component, we can associate a descriptor (for instance a binary vector defining a subset of E), and either process them in parallel or sequentially, independently.

This corresponds to reordering V so that E is a block diagonal matrix, and working on each block independently.

Higher-Order Obstructions While first-order obstruction are easy to characterise and can be spotted in linear time, the case for higher-order obstructions is more challenging. Detecting higher-order obstructions requires that we solve several (small) SSP instances, which comes at an extra cost. As a reward, more edges can be removed (see Figure 8.1). There are no first-order obstructions is these graphs, which are strongly connected and whose edges are all labelled identically. Such 'hubs' can be detected by detecting higher-order obstructions, at the cost of solving (n + 1) times an n-element SSP instance, where n = 5 (left) or 6 (right).

Repeatedly solving the SSP is probably not optimal, as there is a lot of redundant work. Whichever method we retain, it is interesting to know whether the reward of detecting higher-order obstructions is worth the effort. We postpone this question to the next subsection. In the meantime observe that detecting a degree n obstruction is equivalent to solving a multi-dimensional SSP instance with at most 2n elements.

The pruning algorithm

We can now describe the pruning algorithm (Algorithm 25), that leverages the observations of this section.

Algorithm 26: Fast NCP solver

Input: Multigraph G = (V, E, φ). Output: Nilcatenations { Gi}. 1. {G1, . . . , G } ← RecursivePruning(G) 2. for each G k = (V k , E k , φ k ) 3. E k ← LLL(I|E k ) 4. G k ← (V k , E k , φ k )
5. return { G1, . . . , G }

The advantage over directly using lattice reduction on the large instance, besides the obvious fact that smaller instances are dealt with faster, is that the computational burden can now be distributed, as every small instance can be treated independently.

If we are only interested in the largest connected nilcatenation, as will be the case in the following section, then our algorithm performs even better: Indeed only the largest subgraph needs to be dealt with, and we can discard the other.

NCP-solving as a proof of work

Many blockchain constructions rely on a proof of work, i.e. a computationally hard problem that serves to demonstrate (under some reasonable hypotheses) that one has spent a long time computing. Computing a proof of work requires operations that, as such, are useless. This waste of energy is unnecessary, and we suggest an interesting extension that is compatible with existing blockchains.

The idea is to recognise as a valid proof of work the result of ledger nilcatenations. Intuitively, a larger nilcatenations would be rewarded more, as they require more work. As a result, users could keep their local copy of the blockchain smaller -indeed checking that a given nilcatenation is valid is an easy task. This is a community-serving proof of work.

Concretely, a nilcatenation block is similar to 'standard' blocks, but checked in a different way. Instead of containing transactions, nilcatenation blocks contain a description of the nilcatenation. Users responsible for publishing nilcatenation blocks get rewarded as a function of the size of their nilcatenations. Users receiving nilcatenation blocks would check them and accept them only if they are valid.

Before nilcatenation blocks can be used as proof of work, however, we must consider cheating strategies and fine-tune the incentives, so that honest computation is the rational choice for miners. We identify two cheating strategies, dubbed ghost cycles and welding, for which we suggest countermeasures. We then discuss the question of how to reward nilcatenations.

As a summary, to use NCP as a proof of work, one should:

• Require that nilcatenations obey the ghostbusting rules of Section 8.1.5.1, i.e. belong to a randomlysampled subgraph of a snapshot of the transaction multigraph;

• Only accept connected nilcatenations as explained in Section 8.1.5.2;

• Be rewarded linearly in the size of the nilcatenation, as described in Section 8.1.5.3.

Ghost cycles

Ghost cycle creation.

A first remark is that some users may create many (useless) transactions with the intent to make nilcatenation easier. For the easiness of exposition, we only consider cycles, but point out that adversaries may create cliques as well. Such an 'attack' is not very practical, since users may only create transactions from the accounts they control. But since the number of accounts that a person may create is a priori unbounded, we cannot dismiss the possibility that a cheater acts as follows:

1. Find the longest path of identical transactions that point to the controlled node: write them v i r -→ v i+1 , with i = 0, . . . , n and v n+1 being the nodes under adversarial control. Note that r is fixed. Searching for such a cycle can be done by starting from v n+1 , and performing a depth-first search on the transaction graph.

2. Compute the expected gain of a nilcatenation-based proof of work that removes (n + 1) transactions: call it G n+1 . Such a quantity would be publicly known, and we may assume for simplicity that G n > G m whenever n > m.

3. If G n+1 > r, make a new transaction v n+1 r -→ v 0 ; then send the nilcatenable cycle {v 0 , . . . , v n+1 } as a 'proof of work'. By using several accounts, artificially-long chains can be created by a user, only to be immediately "found" and removed. We dub these 'ghost cycles', and this form of cheating is of course highly undesirable.

Ghostbusting. There are two (complementary) ways to combat ghosts. An economical approach, discussed in Section 8.1.5.3, consists in making ghosts unprofitable. A technical countermeasure, called ghostbusting and described here, ensures that ghosts cannot be leveraged, except perhaps with negligible probability.

A natural idea to fight ghost cycles could be to restrict which part of the transaction graph can be nilcatenated. It could be restricted in "time", or in 'space', but straightforward approaches are not satisfactory:

• For instance, if B t denotes the blockchain at a given time t, we may only consider a threshold time T , and only accept nilcatenations for B s , where ts > T . However this does not prevent an adversary from creating ghost cycles over a longer period of time.

• Alternatively, observe that since the transaction that 'closes the cycle' originates from the cheater, we may require that the nilcatenation doesn't contain this node. This countermeasure is easily bypassed by creating a new account whose sole purpose is to claim the rewards from the associated proof of work.

What the above remarks highlight is the need that nilcatenation be computed on a graph that is not under the adversary's control.

Using the procedure described in Algorithm 27, we can sample a subgraph SG uniformly in the transaction graph. This procedure relies on the idea that a block on the chain contains enough entropy, because it carries digests from all the preceding blocks (as per the blockchain mechanism). The principle of ghostbusting is that only nilcatenations among the nodes of SG should be accepted.

Note that the sampling procedure must be deterministic, so that verifiers can ensure that the nilcatenation indeed belongs to the authorised subgraph, and so that miners all address the same task.

return SG

Here we use a pseudorandom function H for which computing preimages is difficult, i.e. given y it should be hard to find x such that H(x) = y. Most standard cryptographic hash functions are believed to satisfy this property -however we should refrain from specifically using SHA-256 itself, because Bitcoin's proof of work results in blocks whose SHA-256 hash has a large known prefix.

A simple workaround is to use for H a function different from standard SHA-256, e.g. H(x) = SHA-256(0 x).

The subgraph SG is obtained via SubGraphGen by selecting nodes (i.e. accounts, which may be under adversarial control), and all edges between these nodes. To be accepted, a nilcatenation should only contain nodes from this subgraph. Proposition 8.2 Assuming that the adversary has control over k out of n nodes, and that the sampled subgraph contains nodes, with k < n/2, the probability that at least m ≤ of these nodes are under adversarial control is

1 2k -n • k m n k +1-m -(n -k) +1-m .
In the limit that k n, this probability is approximately (k/n) m , which does not depend on the choice of .

Proof:

We assume that H is a random oracle [START_REF] Bellare | Random Oracles are Practical: A Paradigm for Designing Efficient Protocols[END_REF]. Thus SG is sampled perfectly uniformly in G. Thus, a given node will have probability k/n to be controlled by an adversary. There are nodes in SG, hence the probability of choosing at least m adversarial nodes is 0 if m > and:

Pr[C ≥m ] = Pr[C m ] + Pr[C m+1 ] + • • • + Pr[C ]
otherwise, where C p is the event where exactly p chosen nodes are under adversarial control. Since the nodes are picked uniformly at random,

Pr[C p ] = k n p 1 - k n -p
Therefore,

Pr[C ≥m ] = Pr[C m ] + • • • + Pr[C ] = p=m k n p 1 - k n -p = 1 2k -n k k m n m 1 - k n -m + k n - k m n m-1 1 - k n -m = 1 2k -n • k m n k +1-m -(n -k) +1-m
Assuming k n, we can use a series expansion in k/n of the above to get:

Pr[C ≥m ] = k n m 1 + k n (m -+ 1) + O((k/n) 2 ) ,
and in particular the result follows.

Hence, the probability that an adversary succeeds in creating a large ghost cycle when the ghostbusting procedure is used gets exponentially small. As regards how the "defining block" b t should be chosen, we only require that all miners and verifiers agree on a deterministic procedure to decide whether b t is acceptable. We suggest the following: Let T -1 be the time stamp of the last nilcatenation block in the blockchain, and T -2 be the time stamp of the nilcatenation block before it. Then b t can be any block added to the blockchain between T -2 and T -1 .

Welding nilcatenations

Another interesting question, motivated by the increased number of cryptocurrency miners who parallelize their work, is to measure how much parallel computation helps in solving the NCP. As described previously (see Section 8.1.4), the pruning algorithm generates many small graphs that can be dealt with independently.

In our scenario, after gathering enough nilcatenations published by peers, a user could assemble them into a single, larger instance and claim the rewards for it. From a theoretical standpoint, a large, disjoint nilcatenation satisfies Definition 8.5.

However the incentive there would be to produce quickly many small nilcatenations. Since checking for disjointedness is easy, we suggest that users reject disconnected nilcatenations, i.e. only accept connected ones. This encourages miners to look for larger nilcatenations, and also limits the efficiency of miner pools.

Such an approach does not prevent, in theory, users from joining together partial nilcatenations into a larger one. Consider for instance the graph of Figure 8.2, where user 1 finds a nilcatenation 10-10, user 2 finds 20-20, and user 3 finds 30-30. Then they may collude to generate a larger, connected nilcatenation.

However we conjecture that is a hard problem in general to assemble nilcatenations that are not disjoint into a larger one; or at the very least, that this is as expensive as computing them from scratch. Furthermore, the ghostbusting constraints reduce the possibilities of collusion by preventing adversarially-controlled nodes from participating in the nilcatenation graph.

Determining the reward

Using the NCP as a proof of work, we reward users that computed a valid nilcatenation. The exact reward should be finely tuned to provide the correct incentives. Note that this depends on whether or not the cryptocurrency applies transaction fees.

Transaction fees. If such fees apply, then creating a ghost is a costly operation from an adversarial point of view. The system should set the reward for a nilcatenation with m edges, denoted reward(m), to be lower than or equal to the cost of creating a ghost of size m, which we may assume is m • c where c is the transaction fee. We may settle for reward(m) = m • c. Similar techniques may apply where a larger spectrum of transaction fees are available.

Note that using a sub-linear reward function is counter-productive, as it encourages producing many small nilcatenations, rather than a large unique one.

Conversely, using a super-linear reward function, while encouraging larger nilcatenations, also makes ghosts profitable above a certain size.

No transaction fees. If there are no transaction fees, then the aforementioned method does not apply (since c = 0). For cryptocurrencies that do not use transaction fees, ghostbusting (Section 8.1.5.1) limits the creation of ghost cycles. In such cases, the reward function may be an arbitrary affine function in the size of the nilcatenation.

Additional attacks

We have identified two potential cheating strategies in the previous sections. It is possible that additional attacks exist, although we could not find them, and encourage the community to try and find profitable cheating strategies that work in spite of our countermeasures.

Conclusion and open questions

We initiate the problem of blockchain nilcatenation, a soon-to-be pressing question for distributed ledgers of appreciable size, given the increasing length of blockchains in viable applications such as Bitcoin. This problem, dubbed NCP, is formalised and shown to be NP-complete. We introduce an algorithm, based on a combination of graph algorithms and lattice reduction, that finds optimal nilcatenations on a given transaction graph in most practical settings (and approximations thereof in other cases). Since nilcatenations are hard to find, easy to check, and useful, we suggest using them as community-serving proofs of work. We discuss the precautions and incentives of doing so, and conclude that nilcatenation blocks may be implemented over existing cryptocurrencies.

To the best of our knowledge this is the first community-serving proof of work to be described and analysed in the literature.

Future research directions

As regards future research directions, this work opens many interesting questions in both the theoretical and practical fields:

• What are the graph-theoretic properties of transaction ledgers? Only very few studies address this question [START_REF] Ron | Quantitative Analysis of the Full Bitcoin Transaction Graph[END_REF]. In particular, what would be a realistic "random labeled multigraph" model? Can anything be said about its strongly connected components?

• What is the typical size of an SCC after having run the pruning algorithm?

• How frequent are higher-order obstructions, and what is the most efficient way to detect them?

• Given measurable properties of a transaction ledger (density, degree distribution, etc.), what is the probability that our algorithm returns the optimal result? In other terms, how can the results of Section 8.1.7 be extended to more general settings?

• Are there profitable cheating strategies that work in spite of our countermeasures ?

Solving NCP using a single SVP oracle query

The algorithm proposed in Section 8.1.4 relies on LLL as an SVP-oracle, to find a short vector and solve the given NCP instance. In other terms, we claim that specific NCP instances can be solved, with overwhelming probability, using a single query to an SVP-oracle. This appendix makes this claim precise, by extending the work of [CJL + 92; LO85; PZ16] where similar proofs are laid out for SSP and multi-dimensional SSP (henceforth MDSSP) instances with uniformly sampled entries. As a starting point, we recall the following result: Theorem 8.3 (Pan and Zhang [START_REF] Pan | Solving low-density multiple subset sum problems with SVP oracle[END_REF]) Given a positive integer A, let a ji where 1 ≤ j ≤ n, 1 ≤ i ≤ m be independently uniformly sampled random integers between 1 and A, e = (e 1 , e 2 , . . . , e m ) be an arbitrary non-zero vector in {0, 1} m and s j = m i=1 a ji e i , where j = 1, . . . , n. If the density d < 0.9408 . . . then with overwhelming probability the multi-dimensional subset sum problem (MDSSP) defined by a ji and s 1 , s 2 , . . . , s n can be solved in polynomial time with a single call to an SVP oracle.

One can attempt to reduce the NCP instance to an MDSSP one; however, the impeding issue is the distribution of a ji , which is not uniform in general, so the above result does not apply directly. However, we may hope to get a useful result, based on the crux point that we are working with sparse subsets of a ji (as defined by the edge multiset E of our multigraph). Here, by a sparse subset, we mean one where at least half of the elements are 0.

We use the following notion: Call a 'hub multigraph', one that contains a vertex directly connected to all the other nodes (we call this vertex a 'hub vertex'). For such graphs, we can prove the following: Theorem 8.4 (MDSSP for Hub Graphs) Given a A ∈ N, let a ji where 1 ≤ j ≤ n, 1 ≤ i ≤ m be a sparse set of independently sampled (not necessary uniform) integers between 0 and A, e = (e 1 , e 2 , . . . , e m ) be an arbitrary non-zero vector in {-1, 0, 1} m and s j = m i=1 a ji e i = 0, where 1 ≤ j ≤ n. If the density d < 0.488 . . . and if there exists i such that ∀j ∈ {1, . . . , n}, a ji = 0, then the MDSSP defined by a ji and s 1 , s 2 , . . . , s n can be solved in polynomial time with a single call to an SVP oracle.

Proof: We follow closely the proof of [START_REF] Pan | Solving low-density multiple subset sum problems with SVP oracle[END_REF], and diverge in the last part of their demonstration, i.e the one responsible for obtaining the probability of an SVP-oracle to return an accurate answer, given a uniform, low density instance of the MDSSP.

The multigraph is finite, therefore at a given point in time, the maximum number of arcs connecting one vertex with another is bounded by M , thus ∀i : deg

+ (v i ) ≤ M ∧ deg -(v i ) ≤ M . Let m = M • n • (n -1)/2
and let e be the solution to the SSP problem.

We begin by defining an appropriate basis for a lattice, based on the way we have defined the matrix representation of the multiset E. The idea is to write the basis as

B = I m |N • E t b m+1
where I m stands for the identity matrix, E stands for the matrix representing the edges, as described in Definition 8.5 and N > (m + 1)/4. The last component of the basis, namely b m+1 , will be a special vector of the form: b m+1 = ( 1 2 , 1 2 , . . . , 1 2 , 1 2 , 0, 0, 0, . . . , 0, 0)

Let L be the lattice generated by b 1 , b 2 , . . . , b m+1 . We can observe that e = (e 1 -1 2 , e 2 -1 2 , . . . , e m -1 2 , 0, 0, . . . , 0) ∈ L. We define X as the set of vectors different by ±e (with a smaller norm) that belong to L: X = {v ∈ L : v ≤ e and v ∈ {±e, 0}}

Roughly, we want to prove that with overwhelming probability, the problem has a unique solution, which is given by ±e. We make two remarks and prove the second one:

1. If X = ∅, then ±e are the only short non-zero vectors in L.

2. X = ∅ with probability exponentially close to 1.

The crux part in the proof is bounding the value of Pr

[X = ∅]. Let v ∈ X such that v = m+1 i=1 (z i • b i ), having z i ∈ {-1, 0, 1}.
Since N > (m + 1)/4, the last n elements in v must be 0. Hence, we set up v as follows:

v i = z i + 1 2 z m+1 , for i ∈ [m] v m+1 = 1 2 z m+1 , v m+1+j = N • m i=1 z i • a ji = 0 for j ∈ [n]
By using the previous notations, we now rewrite the condition as:

m i=1 a ji (v i -v m+1 ) = m i=1 a ji z i = 0, ∀j ∈ [n].
Then, following the same technique as in [START_REF] Pan | Solving low-density multiple subset sum problems with SVP oracle[END_REF], we let

D = {v ∈ Z n+1 | ∃(z 1 , . . . , z m+1 ) ∈ Z n+1 s.t. v i = z i + 1 2 z m+1 ∧ v m+1 = 1 2 z m+1 }
and bound the required probability:

Pr[X = ∅] ≤ Pr m i=1 a ji (v i -v m+1 ) = 0 : j ∈ [n] ∧ v ∈ {0, ±e} × |{v ∈ D | v ≤ e }| (8.1)
There are now two possible situations:

• If z m+1 is even, then v = m+1 4 , implying |{v ∈ D | v ≤ e }| = 2 m .
• If z m+1 is odd, the cardinality of the second expression in Equation (8.1) corresponds to the number of points with integer coordinates in the m + 1 dimensional ball centered at the origin and having radius m+1 4 , which is bounded by 2 1+(m+1)c , where c is a constant described in [START_REF] Lagarias | Solving low-density subset sum problems[END_REF] (c = 2.047 . . . ).

Thus we get that |{v ∈ D | v ≤ e }| ≤ 2 c . All that remains is to approximate the first term in Equation (8.1).

We now diverge from the original proof and investigate what happens if the a ji are not sampled uniformly at random, but rather form a sparse set, following some unknown distribution. This observation is related to the way in which a ji are induced by the multigraph in the blockchain we described. Thus:

Pr m i=1 a ji (v i -v m+1 ) = 0 : j ∈ [n] ∧ v ∈ {0, ±e} ≤ Pr m i=1 a ji z i = 0 : j ∈ [n] = n j=1 Pr m i=1 a ji z i = 0 (8.2)
We stress that the form of z i obtained in [START_REF] Pan | Solving low-density multiple subset sum problems with SVP oracle[END_REF] differ from the form of z i we use, due to the fact that in our version of the problem, the target sum in the MDSSP is 0. As an observation, the previous probability bound we obtain in Equation (8.2) can be equivalently stated:

Pr[ m i=1 z i • a ji = 0] ⇐⇒ Pr[z t • a j = 0],
where a j = (a j1 , . . . , a jm ).

Let E t be the matrix defined by a ji (example given in Figure 8.3). The condition Pr[z t • a j = 0] states that z is in the left nullspace of the matrix E t (which is sparse, given that the a ji form a sparse set). Because e is already in the left null-space (e t • E t = 0 t ), the problem to solve becomes now to find the probability that z exists and that it is shorter than e.

If the matrix E t has rank n -1 then the dimension of the left nullspace is 1 (following from the Rank-Nullity theorem); hence z is an integer multiple of e, thus failing to have a shorter norm than ±e. Finally, we estimate the probability of rank(E t ) < n -1. Observe the form of E t , as the matrix associated to a random "hub" multigraph (∃i such that ∀j, a ji = 0). If there exists a row j for which a ji = 0, then we can apply elementary matrix operations, such that E t will have a sub-matrix of size n -1 which is diagonal.

Hence, we used the hypothesis to prove that Pr[z T • a j = 0] = 0, which is equivalent to the claim that there is no shorter vector than ±e in L, when L = (I m |E t ), with E being the matrix of a "hub" graph. As shown above, for such graphs, Pr[X = ∅] = 1, which completes the proof.

E t =                

Optimal batch signatures Abstract

Batch cryptography started with the observation that RSA's homomorphic properties allow checking many signatures at once. Therefore several verification algorithms were designed to check simultaneously a batch of RSA or DSA signatures. If all the signatures are correct, batch verification succeeds after a few operations. However, if a single signature is incorrect, failure does not indicate which signatures are wrong.

This paper describes how to optimally detect incorrect signatures in batches, i.e. in a minimum expected number of tests, given a list indicating the a priori probabilities with which each of the signature in the batch is correct. The resulting algorithms are non-intuitive and quite surprising. This is joint work with Marc Beunardeau, Éric Brier, Noémie Cartier, Simon Cogliani, Aisling Connolly, Nathanaël Courant, and David Naccache.

Introduction and motivation

Batch cryptography, introduced by Fiat in [Fia90; Fia97], leverages RSA's homomorphic properties [START_REF] Rivest | A Method for Obtaining Digital Signature and Public-Key Cryptosystems[END_REF] to speed-up signature schemes. On the verification side, the product of individual RSA signatures can be checked in a single operation as explained in [START_REF] Bellare | Fast Batch Verification for Modular Exponentiation and Digital Signatures[END_REF]. This idea can be applied to many other schemes enjoying homomorphic properties.

In [NMV + 95], Naccache et al. described the first batch verifier for DSA signatures. Laih and Yen [START_REF] Yen | Improved Digital Signature Suitable for Batch Verification[END_REF] proposed a batch verification method of DSA and RSA signatures, later broken by [START_REF] Boyd | Attacking and Repairing Batch Verification Schemes[END_REF]. Similarly another construction of Harn for RSA and DSA was soon proven insecure and retracted [START_REF] Hwang | Cryptanalysis of the Batch Verifying Multiple RSA Digital Signatures[END_REF][START_REF] Hwang | Two Simple Batch Verifying Multiple Digital Signatures[END_REF]. This called for a more systematic approach, where security of batch verification could be modeled and proved.

This was answered when Bellare, Garay and Rabin [START_REF] Bellare | Fast Batch Verification for Modular Exponentiation and Digital Signatures[END_REF] presented three generic methods for batching modular exponentiations: the random subset test, the small exponents test, and the bucket test. [START_REF] Bellare | Fast Batch Verification for Modular Exponentiation and Digital Signatures[END_REF] showed how to apply these methods to batch verification of DSA signatures.

The problem of bad signature identification arises when at least one signature in the batch is incorrect, in which case the batch test fails 9 . The naive approach is then to test individually each signature, which can be costly.

For this reason several solutions were proposed to quickly sieve out bad signatures: At Eurocrypt 1998, Bellare et al. introduced RSA screening [BGR98], soon broken and fixed by Coron and Naccache [START_REF] Coron | On the Security of RSA Screening[END_REF]; at PKC 2000 Pastuszak et al. described a simple "divide-and-conquer" algorithm to identify one incorrect signature in a batch [PMP + 00]. Another approach by Law and Matt [LM07], using identity-based signature schemes, also allows identifying invalid signatures in a batch.

Our contribution: This paper departs from the above approaches by assuming the availability of extra information: the a priori probability that each given signature is correct. In practice, we may either assume that such probabilities are given, estimated from signer trust metrics, or are learned from past verifications. We assume in this work that these probabilities are known.

In this paper, we show that it is possible to find incorrect signatures in an optimal way -i.e. by performing on average the minimum number of tests -by exploring the combinatorial and algebraic properties of verification algorithms. This turns out to be faster than RSA screening or divide-and-conquer verifiers in the vast majority of settings.

On top of cryptographic applications, we note that optimal batch testing can improve the time, cost and reliability of other tests, such as medical screening, traitor-tracing or fraud control in large networks.

Intuition

Before introducing models and general formulae, let us provide the intuition behind our algorithms.

Let us begin by considering the very small case of two signatures. These can be verified individually or together, in a batch. Individual verification claims a minimum two units of work-check one signature, then check the other. Batch-checking them requires a minimum of one verification. If it is highly probable that both signatures are correct, then batch verification is interesting: If both signatures are indeed correct, we can make a conclusion after one test and halve the verification cost. However, if that fails, we are nearly back to square one: One of these signatures (at least) is incorrect, and we don't know which one.

In this paper, we identify when to check signatures individually, and when to batch-check them insteadincluding all possible generalizations when there are more than 2 signatures. We assume that the probability of a signature being incorrect is known to us in advance. The result is a testing 'metaprocedure' that offers the best alternative to sequential and individual testing.

To demonstrate: the testing procedure that always works is to verify every signature individually, one after the other: This gives the 'naive procedure', which always performs 2 verifications, as illustrated in Figure 8.4. In this representation, the numbers in parentheses indicate which signatures are being tested at any given point. The leaves indicate which signatures are correct (denoted 1) or incorrect (denoted 0), for instance the leaf 01 indicates that only the second signature is valid. Note that the order in which each element is tested does not matter: There are thus 2 equivalent naive procedures, namely the one represented in Figure 8.4, and the procedure obtained by switching the testing order of (1) and (2).

(1)

(2) 00 01

(2) 10 11 Alternatively, we can leverage the possibility to test both signatures together as the set {1, 2}. In this case, batching the pair {1, 2} must be the first step: Indeed, testing {1, 2} after any other test would be redundant, and the definition of testing procedures prevents this from happening. If the test on {1, 2} is correct, both signatures are correct and the procedure immediately yields the outcome 11. Otherwise, we must identify which of the signatures 1 or 2 (or both) is responsible for the test's incorrectness. There are thus two possible procedures, illustrated in Figure 8. Intuitively, the possibility that this procedure terminates early indicates that, in some situations at least, only one test is performed, and is thus less costly than the naive procedure. However, in some situations up to three tests can be performed, in which case it is more costly than the naive procedure.

Concretely, we can compute how many verifications are performed on average by each approach, depending on the probability x 1 that the first signature is incorrect, and x 2 that the second is incorrect. To each procedure, naive, batch-left, batch-right, we associate the following polynomials representing the expected stopping time:

• L naive = 2 • L batch-left = (1 -x 1 )(1 -x 2 ) + 2(1 -x 1 )x 2 + 3x 1 (1 -x 2 ) + 3x 1 x 2 • L batch-right = (1 -x 1 )(1 -x 2 ) + 3(1 -x 1 )x 2 + 2x 1 (1 -x 2 ) + 3x 1 x 2
It is possible to see analytically which of these polynomials evaluates to the smallest value as a function of (x 1 , x 2 ). Looking at Figure 8.6, we use these expectations to define zones in [0, 1] 2 where each algorithm is optimal (i.e. the fastest on average). More precisely, the frontier between zones C and B has equation x 1 = x 2 , the frontier between A and B has equation x 2 = (x 1 -1)/(x 1 -2), the frontier between A and C has equation x 2 = (2x 1 -1)/(x 1 -1), and the three zones meet at Having identified the zones, we can write an algorithm which, given x 1 and x 2 , identifies in which zone of Figure 8.6 (x 1 , x 2 ) lies, and then apply the corresponding optimal verification sequence. In the specific case illustrated above, three algorithms out of three were needed to define the zones; however, for any larger scenario, we will see that only a very small portion of the potential algorithms will be considered.

x 1 = x 2 = (3 - √ 5
Our objective is to determine the zones, and the corresponding verification algorithms, for arbitrary n, so as to identify which signatures in a set are correct and which are not, while minimizing the expected number of verification operations.

Preliminaries

This section will formalize the notion of a testing procedure, and the cost thereof, so that the problem at hand can be mathematically described. We aim at the greatest generality, which leads us to introduce 'and-tests', a special case of which are signatures that can be batch verified.

Testing procedures

We consider a collection of n signatures. Let [n] denote {1, . . . , n}, and Ω = P([n])\{∅}, where P is the power set (ie. P(X) is the set of subsets of X).

Definition 8.8 (Test)

A test is a function φ : Ω → {0, 1}, that associates a bit to each subset of Ω.

We are mainly interested in tests satisfying homomorphic properties. We focus in this work on the following: Definition 8.9 (And-Tests) An and-test φ : Ω → {0, 1} is a test satisfying the following property:

∀T ∈ Ω, φ(T ) = t∈T φ({t}).
In other terms, the result of an and-test on a set is exactly the logical and of the test results on individual members of that set. Hence the test φ(T ) = WasSigned(T ) is an and-test, that returns False if at least one signature was not generated by the legitimate owner, and True otherwise.

Remark. We have to introduce the WasSigned primitive, because if one signature is multiplied by any α and another divided by the same α, then both are incorrect and Verify applied on the product will return True. However an attacker without forgery capabilities cannot generate signatures for which WasSigned returns True and are not computed from signatures generated by the legitimate signer with more than negligible proabability.

Remark. Note that 'or-tests', where ∧ is replaced by ∨ in the definition, are exactly dual to our setting. 'xor-tests' can be defined as well but are not investigated here. Although theoretically interesting by their own right, we do not address the situation where both and-tests and or-tests are available, since we know of no concrete application where this is the case.

Elements of Ω can be interpreted as n-bit strings, with the natural interpretation where the i-th bit indicates whether i belongs to the subset. We call selection an element of Ω.

F φ (T ) = {φ(x), x ∈ T } ∈ {0, 1} n . When T = [n], F φ will concisely denote F φ ([n]).
Our purpose is to determine the outcome of a given test φ, by minimizing in the expected number of queries to φ. Note that this minimal expectation is trivially upper bounded by n. where the operation ∧ is performed element-wise. This splits S into two. Similarly the complement S ⊥ T = S -S T is called the negative part of S with respect to T .

We are interested in algorithms that find F φ . More precisely, we focus our attention on the following: Definition 8.12 (Testing procedure) A testing procedure is a binary tree T with labeled nodes and leaves, such that:

1. The leaves of T are in one-to-one correspondence with Ω in string representation; Remark. It follows from the Definition 8.12 that a testing procedure is always a finite binary tree, and that no useless calls to φ are performed. Indeed, doing so would result in an empty S for one of the children nodes. Furthermore, the root node has S = Ω.

is the outcome of φ. The expected length of a testing procedure T is defined naturally as:

L T = E [ T ] = ω∈Ω T (ω) Pr(ω)
It remains to specify the probabilities Pr(ω), i.e. for any given binary string ω, the probability that ω is the outcome.

If the different tests are independent, we can answer this question directly with the following result: Lemma 8.5 Assume that the events 'φ({i}) = 1' and 'φ({j}) = 1' are independent for i = j. Then, ∀ω ∈ Ω, Pr(ω) can be written as a product of monomials of degree 1 in x 1 , . . . , x n , where

x i = Pr(φ({i}) = 1) = Pr(i-th bit of ω = 1).

Thus L T is a multivariate polynomial of degree n with integer coefficients.

In fact, or-tests provide inherently independent tests. Therefore we will safely assume that the independence assumption holds. Remark. L T is uniquely determined as a polynomial by the integer vector of length 2 n defined by all its lengths: (T ) = ( T (0...0), . . . , T (1...1)).

Optimal batch verification

We have now introduced everything necessary to state our goal mathematically. Our objective is to identify the best performing testing procedure T (i.e. having the smallest L T ) in a given situation, i.e. knowing Pr(ω) for all ω ∈ Ω.

Generating all procedures

We can now explain how to generate all the testing procedures for a given n ≥ 2.

One straightforward method is to implement a generation algorithm based on the definition of a testing procedure. Algorithm 28 does so recursively by using a coroutine. The complete list of testing procedures is recovered by calling FindProcedure(Ω, Ω \ {∅}). We implemented this algorithm in Python. The result of testing procedure generations for small values of n is summarized in Table 8.1. The number of possible testing procedures grows very quickly with n.

An informal description of Algorithm 28 is the following. Assuming that you have an unfinished procedure (i.e. nodes at the end of branches are not all leaves). For those nodes S, compute for each T the sets S T and S ⊥ T . If either is empty, abort. Otherwise, create a new (unfinished) procedure, and launch recursively on nodes (not on leaves, which are such that S has size 1).

Algorithm 28 terminates because it only calls itself with strictly smaller arguments. We will discuss this algorithm further after describing some properties of the problem at hand.

Metaprocedures

Once the optimality zones, and the corresponding testing procedures, have been identified, it is easy to write an algorithm which calls the best testing procedure in every scenario. At first sight, it may seem that nothing is gained from doing so -but as it turns out that only a handful of procedures need to be implemented.

This construction is captured by the following definition: Definition 8.13 (Metaprocedure) A metaprocedure M is a collection of pairs (Z i , T i ) such that:

1. Z i ⊆ [0, 1] n , Z i ∩ Z j = ∅ whenever i = j and i Z i = [0, 1] n .
2. T i is a testing procedure and for any testing procedure T ,

∀x ∈ Z i , L Ti (x) ≤ L T (x).
A metaprocedure is interpreted as follows: Given x ∈ [0, 1] n find the unique Z i that contains x and run the corresponding testing procedure T i . We extend the notion of expected length accordingly:

L M = min i L Ti ≤ n
One way to find the metaprocedure for n, is to enumerate all the testing procedures using Algorithm 28, compute all expected lengths L T from the tree structure, and solve polynomial inequalities.

Surprisingly, a vast majority of the procedures generated are nowhere optimal: This is illustrated in Table 8.2. Furthermore, amongst the remaining procedures, there is a high level of symmetry. For instance, in the case n = 3, 8 procedures appear 6 times, 1 a procedure appears 3 times, and 1 procedure appears once. The only difference between the occurrences of these procedures -which explains why we count them several times -is the action of the symmetric group S 6 on the cube (see Section 8.2.7 for a complete description).

The metaprocedure for n = 3 cuts the unit cube into 52 zones, which correspond to a highly symmetric and intricate partition, as illustrated in Figures 8.8 to 8.10. An STL model was constructed and is available upon request.

The large number of suboptimal procedures shows that the generate-then-eliminate approach quickly runs out of steam: Generating all procedures for n = 6 seems out of reach with Algorithm 28. The number of zones, which corresponds to the number of procedures that are optimal in some situation, is on the contrary very reasonable. This function approximates the smallest integer n such that there exists n calls to φ with arguments T 1 , . . . , T n , and β 1 , . . . , β n in {⊥, } with S β1,...,βn T1•••Tn = {S}. This function is used to define a 'gain' function evaluating how much information is gathered when performing a test knowing the set of outcomes:

gain(T, S) = S∈S T 1 - cost(S, S T ) cost(S, S) Pr(S) + S∈S ⊥ T 1 - cost(S, S ⊥ T ) cost(S, S)
Pr(S)

Intuitively, we give higher gains to subsets T on which testing gives more information. Note that, if a call to φ doesn't give any information (i.e. S T or S ⊥ T is empty), then gain(T, S) = 0. This heuristic provides us with a greedy algorithm that is straightforward to implement. For given values x 1 , . . . , x n we thus obtain a testing procedure T H .

Testing the heuristic. We compared numerically T H to the metaprocedure found by exhaustion in the case n = 3. The comparison consists in sampling points at random, and computing the sample mean of each algorithm's length on this input. The heuristic procedure gives a mean of 2.666, which underperform the optimal procedure (2.661) by only 1%.

Counter-example to optimality. In some cases, the heuristic procedure behaves very differently from the metaprocedure. For instance, for n = 3, x 1 = 0.01, x 2 = 0.17, x 3 = 0.51, the metaprocedure yields a tree which has an expected length of 1.889. The heuristic however produces a tree which has expected length 1.96. Both trees are represented in Figure 8.12.

Beyond their different lengths, the main difference between the two procedures of Figure 8.12 begin at the third node. At that node the set S is the same, namely {010, 011, 100, 101, 110, 111}, but the two procedures settle for a different T : The metaprocedure splits S, with T = {1, 3}, into S ⊥ T = {010} and S T = {011, 100, 101, 110, 111}; while the heuristic chooses T = {1} instead, and gets S ⊥ T = {010, 011} and S T = {100, 101, 110, 111}.

To understand this difference, first notice that besides 010 and 011, all leaves are associated to a very low probability. The heuristic fails to capture that by choosing T = {1, 3} early, it could later rule out the leaf 010 in one step and 011 in two. There does not seem to be a simple greedy way to detect this early on.

Pairing heuristic

Another approach is to use small metaprocedures on subsets of the complete problem. Concretely, given n objects to test, place them at random into k-tuples (from some small value k, e.g. 5). Then apply the k-metaprocedure on these tuples. While sub-optimal, this approach does not yield worst results than the naive procedure.

In cases where it makes sense to assume that all the x i are equal, then we may even recursively use the metaprocedures, i.e. the metaprocedures to be run are themselves places into k-tuples, etc. Using lazy evaluation, only the necessary tests are performed.

Equivalences and symmetries for n = 3

A procedure can undergo a transformation that leaves its expected length unchanged. Such transformations are called equivalences. On the other hand, Lemma 8.13 shows that some transformations operate a permutation σ on the variables x i -such transformations are called symmetries.

Equivalences and symmetries are responsible for a large part of the combinatorial explosion observed when generating all procedures. By focusing on procedures up to symmetry, we can thus describe the complete set in a more compact way and attempt a first classification.

In the following representations (Figures 8.13 (1) (1,2,

(1)

(2,3) (2)
(3) .12: The optimal metaprocedure tree (left), and heuristic metaprocedure (right) for the same point x = (0.01, 0.17, 0.51). The optimal procedure has expected length 1.889, as compared to 1.96 for the heuristic procedure.

Best testing procedure at a point

We examine the following problem: Find the testing procedure T for a given k ≤ n, (p i1 , . . . , p i k ) ∈ [0, 1] n , and a selection P ⊆ 2 [k] that satisfies:

• S T = P ,

• T is optimal at point (p i1 , . . . , p i k )

This can be computed using a dynamic programming technique, by examining the outcome of each possible test that is the root node of the testing procedure T . This approach gives Algorithm 29.

The same dynamic programming algorithm can also be used to compute the number of testing procedures (including those leading to duplicate polynomials) that exist in a given dimension. It is actually even easier (meaning that we can apply the algorithm to an even higher dimension than our solution to the given point problem), since there is a huge number of symmetries that can be exploited to count.

We will introduce the following definition, in use in our algorithm: Definition 8.14 (Decided point) We say that x is a decided point for S a set of selections if either of the following is true:

• x ∈ S for all S ∈ S • x ∈ S for all S ∈ S
In the first case, we will say that x is a positive decided point, and a negative decided point in the second case. We denote by D + S the set of positive decided points of S, D - S its set of negative decided points, and D S = D + S ∪ D - S its set of decided points.

Algorithm 29: FindOptimal Input: k ≥ 0, (p1, . . . , p k ) ∈ [0, 1] k , S ⊂ 2 [k] . Output: The optimal testing procedure T at point (p1, . . . , p k ) which satisfies ST = S. Counting the number of algorithms in a given dimension works the same way; the only difference is that there is no need to look at the probabilities, and thus, the resulting Algorithm 30 does fewer recursive calls and is faster. We are not aware of a closed-form formula providing the same values as this algorithm.

Algorithm 30: CountAlgorithms

Input: k ≥ 0, S ⊂ 2 [k] . Output: The number of testing procedures which satisfy ST = S. All the procedures for n = 3 that are optimal at some point, up to symmetries, are represented in Figure 8.16.

1. if k == 0 then return 1 2. if |DS | > 0 3. U ← {u1, . . . , u } = [k] \ DS

Conclusion and open questions

We have introduced the question of optimal batch verification with a priori probabilities, where one is given a set of signatures and must determine in the least average number of operations which signatures are correct, and which are not. We formalized this problem and pointed out several interesting combinatorial and algebraic properties that speed up the computation of an optimal sequence of operations -which we call a metaprocedure. We determined the exact solution for up to 4 objects. For larger values, our approach requires too many computation to be tractable, and thus an exact solution is out of reach; however we gave several heuristic algorithms that scale well. We showed that these heuristics are sub-optimal in all cases, but they always do better than standard screening. The existence of a polynomial-time algorithm that finds optimal metaprocedures for large value of n is an open question -although there is probably more hope in finding better heuristics. An alternative would be to modify our generation algorithm to kill branches when the resulting expected lengths are all worse than some already-known procedure.

Once the metaprocedure for a given n is known, which only needs to be computed once, implementation is straightforward and only invokes a handful of (automatically generated) cases. Besides the performance gain resulting from implementing metaprocedures for signature verification, the very general framework allows for applications in medical and engineering tests.

Encoding size. The GGH and CLT graded encoding schemes have encoding size poly(κ) for multilinearity parameter κ, resulting in large space requirements; this renders some applications impossible to instantiate, or useless. For example, the Papamanthou et al. [START_REF] Papamanthou | Optimal Authenticated Data Structures with Multilinear Forms[END_REF] optimal authenticated data structures primitive needs "compact" maps (i.e. of bit-size independent of κ), and Rothblum's counterexample to the KDMsecurity of bit encryption conjecture [START_REF] Rothblum | On the Circular Security of Bit-Encryption[END_REF] requires a κ that is just out of reach in current constructions. Another example is Boneh, Waters and Zhandry's construction of low-overhead broadcast encryption from existing graded encoding schemes which leads to worse systems (even asymptotically) than the trivial broadcast system because of the size of the encodings [START_REF] Boneh | Low Overhead Broadcast Encryption from Multilinear Maps[END_REF].

Obviously the same issue arises in the context of fully homomorphic encryption schemes. Namely for a somewhat homomorphic encryption scheme, the ciphertext noise grows linearly with the degree of the polynomial being evaluated; consequently only low-degree polynomials can be evaluated. To obtain a fully homomorphic encryption scheme, Gentry's key idea, called bootstrapping, consists in homomorphically evaluating the decryption polynomial to obtain a refreshed ciphertext [START_REF] Gentry | Fully homomorphic encryption using ideal lattices[END_REF]. Alternatively, Brakerski, Gentry and Vaikuntanathan introduced in 2011 a remarkable new FHE framework, in which the bitsize of parameters increases only linearly with the multiplicative level instead of exponentially [START_REF] Brakerski | Efficient Fully Homomorphic Encryption from (Standard) LWE[END_REF][START_REF] Brakerski | Fully Homomorphic Encryption from Ring-LWE and Security for Key Dependent Messages[END_REF][START_REF] Brakerski | Leveled) fully homomorphic encryption without bootstrapping[END_REF]. The main ingredient of this framework was a modulus switching technique, that allowed to (efficiently) transform a ciphertext encrypted under a modulus p into a ciphertext under a different modulus p but with reduced noise. The modulus switching technique was initially described in the context of LWE-based schemes, and was later adapted in [START_REF] Jean-Sébastien Coron | Public Key Compression and Modulus Switching for Fully Homomorphic Encryption over the Integers[END_REF] to the DGHV fully homomorphic encryption over the integers [DGH + 10].

Due to the similarities between multilinear map schemes and homomorphic encryption, a natural question is:

Can we adapt the modulus switching technique to existing multilinear map schemes ?

Namely as in the BGV framework for leveled fully homormophic encryption, the encoding noise for graded encoding schemes would then grow only linearly with the depth of the circuit being evaluated (instead of exponentially). This implies that for Diffie-Hellman key exchange the parameter size would grow only logarithmically with the number of users, instead of polynomially.

Our contribution. In this paper we describe a candidate construction that answers the above question, i.e. we describe a new construction of multilinear maps in which the encoding noise grows only linearly with the depth of the circuit being evaluated. Our construction is a variant of the last CLT graded encoding scheme over the integers [START_REF] Jean-Sébastien Coron | New Multilinear Maps Over the Integers[END_REF], to which we apply a modulus switching technique.

Strictly speaking, our construction is no longer a graded encoding scheme according to the definition in [START_REF] Garg | Candidate Multilinear Maps from Ideal Lattices[END_REF], but it is still an approximation of multilinear maps. Therefore we must first define a new generic notion of multilinear maps, called logarithmic multilinear maps. In our setting, encodings also have a notion of level, but the multiplication of two level-i encoding yields a level-(i + 1) encoding, instead of 2i. This implies that with κ levels one can evaluate a polynomial of degree 2 κ in the exponents, instead of κ only. We then define the similar notion of logarithmic encoding schemes, as an approximation of logarithmic multilinear maps. The main difference is that encodings are randomized, which means that as in [GGH13; CLT15], the same exponent (i.e. a ring element) can be encoded in many different ways. Then, for level-(κ + 1) encodings and those only, a procedure will allow to check if an encoding is an encoding of 0, and to deterministically extract a string that only depends on the encoded value, as in [GGH13; CLT15].

Our candidate construction is a variant of the CLT scheme over the integers, to which we apply a modulus switching technique. More precisely, the modulus switching is performed after each multiplication of CLT encodings. Moreover we keep the same zero-testing procedure as in the last CLT scheme [START_REF] Jean-Sébastien Coron | New Multilinear Maps Over the Integers[END_REF]; our technique is actually independent from the modication of CLT to resist the Cheon et al. attack. We obtain a candidate logarithmic encoding scheme that can handle arithmetic circuits of multiplicative depth κ; therefore it can evaluate the product of 2 κ encodings, instead of κ for existing constructions, with parameter and encoding size polynomial in κ. This implies that we can perform Diffie-Hellman key exchange with 2 κ + 1 users, instead of only κ + 1 with existing schemes.

Our construction. Our construction works as follows. As in the CLT scheme, an encoding of a vector

m = (m i ) ∈ R = Z g1 × • • • × Z gn is an integer c such that for all 1 ≤ i ≤ n: c ≡ r i • g i + m i z (mod p i ) ,
where the p i 's are secret primes, z is a secret mask and the r i 's are small random integers. It is clear that such encodings can be added, and the multiplication of two such encodings gives an integer ĉ such that

ĉ ≡ ri • g i + mi z 2 (mod p i ) ,
where the new noise ri is larger than the initial noise, namely

|r i | ≈ |g i | • |r i | 2 .
Now instead of multiplying encodings up to degree κ as in the CLT scheme, we perform a modulus switching on ĉ, i.e. we publicly transform ĉ into a new encoding c of the same ring element m ∈ R, but under a different set of primes p i , and masked by a different z :

c ≡ ri • g i + mi z (mod p i ) ,
The crucial property is that the new noise ri is now scaled down by a factor p i /p i , that is ri ≈ ri • p i /p i . Therefore if the secret primes are chosen so that p i /p i ≈ 1/(g i • r i ), we will have |r i | ≈ |r i | and the noise does not increase after a multiplication. This implies that as in the BGV framework [START_REF] Brakerski | Leveled) fully homomorphic encryption without bootstrapping[END_REF], we can control the growth of the noise by performing a modulus switching after every multiplication, using a ladder of secret primes p i 's. More precisely, given K = 2 κ encodings at level 1, we can multiply them pairwise and apply our modulus switching technique to obtain K/2 encodings at level 2 with roughly the same noise, and so on until we get a final level-(κ + 1) encoding of the product of the ring elements. Eventually, the zero-testing element p zt is applied with the last set of primes p i 's, which enables to extract a function of the m i 's only. Since the largest secret primes in the ladder are of size O(κ), the encodings and public parameters in our scheme are also of size polynomial in κ. This enables to evaluate the product of K = 2 κ encodings, which is an exponential improvement compared to existing graded encoding scheme that can evaluate the product of κ encodings only.

Notations

Let x be a real number and n be an integer. We denote respectively by x , x and x the rounding of x up, down, and to the nearest integer, and by |x| the absolute value of x. We denote the reduction of x modulo n by [x] n or (x mod n) with -n/2 < [x] n ≤ n/2. We let Z n = {[i] n : i ∈ Z} denote the ring of integers modulo n and let [n] denote the set {1, . . . , n}.

Vectors are denoted in bold, addition and multiplication of vectors are done componentwise, and we extend the previous notation to vectors componentwise. Finally, for x, y ∈ R k , we denote x ∞ = max i∈ [k] |x i | the infinite norm of x and x, y the scalar product of x and y. We denote e 1 , . . . , e n ∈ Z n the vectors such that (e i ) j = 1 when i = j and 0 otherwise. We say that x ∈ Z is n-rough when it does not contain prime factors smaller than n.

We denote by λ the security parameter. A function f (λ) is said negligible (and we denote f = negl(λ)) if it is λ -ω(1) ; a probability p(λ) is said overwhelming if it is 1λ -ω(1) . We denote by a ← S the action of picking a independently and uniformly at random from some set S, and by a ← R( •) the action of running algorithm R on some inputs and naming a the value returned by R.

Logarithmic encoding scheme

In [START_REF] Boneh | Applications of Multilinear Forms to Cryptography[END_REF], Boneh and Silverberg proposed a generalization of pairings called cryptographic multilinear maps. A (symmetric) κ-multilinear map is a non-degenerate map e : G κ → G T (where G and G T are groups of prime order p, denoted additively, and g is a generator of G) such that, for all a 1 , . . . , a κ ∈ Z p , e(a 1 • g, . . . , a κ

• g) = (a 1 • • • a κ ) • e(g, . . . , g)
In this section, we introduce the notion of κ-logarithmic multilinear maps (and of logarithmic encoding schemes, an approximation thereof), a generalization of multilinear maps. Our new notion differs from the notion of leveled multilinear maps, introduced in [START_REF] Garg | Candidate Multilinear Maps from Ideal Lattices[END_REF]. For those familiar with the GGH syntax, the main difference is that a multiplication of two level-i encodings yields a level-(i + 1) encoding of the product of the encoded values (except for i = 0, where the product remains at level 0), instead of a level-2i encoding.

Leveled multilinear maps and graded encoding schemes

We first recall the original notion of leveled multilinear maps introduced in [GGH13] by Garg, Gentry and Halevi Definition 8.15 (Leveled Multilinear Map) A κ-leveled multilinear map is a set of bilinear maps {e i,j :

G i × G j → G i+j | i, j ∈ [κ], i+j ≤ κ}
where each G i is a group of prime order p, denoted additively and generated by g i for all i ∈ [κ], and such that each map e i,j satisfies e i,j (a

• g i , b • g j ) = (a • b) • g i+j for a, b ∈ Z p and i, j ∈ [κ] and i + j ≤ κ.
The integer κ is called the multilinearity level. The graded encoding schemes candidates are only approximate leveled multilinear maps [GGH13; CLT13; CLT15]. The main difference is that encodings are randomized (with some noise) instead of deterministic and one can only test whether an encoding in G κ encodes 0 or not. We recall the definition of graded encoding system from [START_REF] Garg | Candidate Multilinear Maps from Ideal Lattices[END_REF] in Section 8.3.7.

Logarithmic encoding schemes

We propose a different notion of multilinear maps that we called logarithmic multilinear maps. A κlogarithmic multilinear map will allow to compute polynomials up to degree 2 κ in the exponents, but not more.

Definition 8.16 (Logarithmic Multilinear Map) A κ-logarithmic multilinear map is a set of bilinear maps {e

i : G i × G i → G i+1 | i ∈ [κ]}
where each G i is a group of prime order p, denoted additively and generated by g i for all i ∈ [κ + 1], and such that each map e i satisfies e i (a

• g i , b • g i ) = (a • b) • g i+1 for a, b ∈ Z p for all i ∈ [κ].
The integer κ is called the logarithmic multilinearity level. Note that a κ-logarithmic multilinear map can evaluate a polynomial of degree up to 2 κ in the exponent, whereas a κ-leveled multilinear map is limited to degree κ. Namely consider any 2 κ exponents a 1 , . . . , a 2 κ ∈ Z p . Using a tree structure we can first compute the 2 κ-1 values:

e 1 (a 1 • g 1 , a 2 • g 1 ) = a 1 a 2 • g 2 , . . . , e 1 (a 2 κ -1 • g 1 , a 2 κ • g 1 ) = a 2 κ -1 a 2 κ • g 2 ∈ G 2
By repeating this pairwise mapping with each map e j , for j = 2 to j = κ, we finally obtain:

a 1 a 2 • • • a 2 κ • g κ+1 ∈ G κ+1 .
which is of degree 2 κ in the exponents.

Similarly to graded encoding schemes for leveled multilinear maps, we introduce the notions of logarithmic encoding schemes as approximate logarithmic multilinear maps. For completeness we provide the full definition in Section 8.3.8.

The Coron-Lepoint-Tibouchi graded encoding scheme

In this section, we recall the multilinear maps scheme over the integers from [START_REF] Jean-Sébastien Coron | New Multilinear Maps Over the Integers[END_REF]. One generates n secret primes p i and computes x 0 = i p i , which is also kept secret; one also generates n small secret primes g i and a random secret integer z modulo x 0 . The message space is R

= Z g1 × • • • × Z gn . A level-k encoding of a vector m = (m i ) ∈ R is then an integer c such that for all 1 ≤ i ≤ n: c ≡ r i • g i + m i z k (mod p i ) (8.3)
for some small random integers r i ; the integer c is therefore defined modulo x 0 by CRT. Encodings can then be added and multiplied over Z, as long as the noise r i is such that r i • g i + m i < p i for each i. The multiplication of a level-i encoding by a level-j encoding gives an encoding at level i + j.

The zero-testing procedure works as follows. From Equation (8.3) a level-κ encoding c can be written as follows, using the Chinese Remainder Theorem:

c = n i=1 r i + m i • (g -1 i mod p i ) • u i -a • x 0 (8.4)
over Z for some a ∈ Z, where the u i 's are the CRT coefficients corresponding to the primes p i 's, and scaled by g i • z -κ for each i:

u i := g i • z -κ • x 0 p i -1 mod p i • x 0 p i (8.5)
We let N be some sufficently large integer. The zero-testing element p zt is an integer defined modulo N , such that for all 1 ≤ i ≤ n, the integers v i := p zt • u i mod N are much smaller than N , and v 0 := p zt • x 0 mod N is also much smaller than N . As shown in [START_REF] Jean-Sébastien Coron | New Multilinear Maps Over the Integers[END_REF], such p zt is easy to construct owing to the particular structure of the CRT coefficients u i . The zero-testing procedure then consists in computing ω = p zt •c mod N . Namely we have from Equation (8.4):

ω ≡ n i=1 r i + m i • (g -1 i mod p i ) • v i -a • v 0 (mod N ) (8.6)
If m i = 0 for all i, since the r i 's are small, the integer a in Equation (8.4) is also small, which implies that ω in Equation (8.6) will also be small compared to N . This enables to test whether c is an encoding of 0 or not. Moreover for general encodings the high-order bits of ω only depend on the m i 's and not on the noise r i ; this enables to extract a function of the m i 's only, which gives a degree-κ multilinear map.

In the new CLT scheme the integer x 0 is kept private; therefore the addition and multiplication of encodings are done over Z instead of modulo x 0 in the original CLT scheme. To reduce the size of an intermediate encoding c back to the size of x 0 , one can publish a ladder of encodings of 0 and progressively reduce c modulo those encodings, as in the DGHV scheme. Finally since the primes p i must be kept secret, new encodings can be publicly generated by computing a random subset-sum of public encodings. We refer to Section 8.3.9 for a full description of the repaired CLT scheme.

Modulus switching

Our construction of a logarithmic encoding scheme is a variant of the CLT scheme [START_REF] Jean-Sébastien Coron | New Multilinear Maps Over the Integers[END_REF] on which we apply a modulus switching technique. Therefore we first recall the modulus switching technique from [START_REF] Jean-Sébastien Coron | Public Key Compression and Modulus Switching for Fully Homomorphic Encryption over the Integers[END_REF], and we explain how it can be adapted to the CLT scheme.

Modulus switching: an overview

Since the CLT scheme is based on the DGHV homomorphic encryption scheme over the integers, we start with a simple variant of the DGHV scheme in which the message m is such 0 ≤ m < g for some integer g, instead of binary. A ciphertext c has the form:

c = q • p + g • r + m (8.7)
where p is the secret key, for some large random q and small random r. Therefore we have:

c ≡ g • r + m (mod p) (8.8)
Modulus switching is a tool that enables to publicly transform a ciphertext defined modulo p into a ciphertext modulo p , without knowing the secrets p and p . More precisely, given a ciphertext c, we can obtain a ciphertext c such that:

c ≡ p • c mod p p + δ (mod p ) (8.9)
for some small additional noise δ ∈ Z, namely |δ| ≤ 2 ρ+1 • Θ • k, for some parameters ρ, Θ and k determined later. However, we cannot apply this technique directly to a ciphertext c satisfying Equation (8.8). Namely in that case we would obtain:

c ≡ p • g • r + m p + δ (mod p )
and the message m would be drowned in the additional noise δ. Namely Equation (8.9) shows that the modulus switching technique only preserves the high-order bits of c mod p (up to the scaling factor p /p), while the low-order bits of c mod p can get arbitrarily modified by the additional noise δ.

The solution used in [START_REF] Jean-Sébastien Coron | Public Key Compression and Modulus Switching for Fully Homomorphic Encryption over the Integers[END_REF] for g = 2 consists in modifying the modulus switching so that c mod p is replaced by c mod 2p in Equation (8.9), which enables to recover [q] 2 in Equation (8.7) and eventually

[m] 2 = [c] 2 ⊕ [m] 2 .
Such technique can be easily extended to any g; however this would require a public g, whereas in CLT the integers g i remain secret. Moreover in the batch variant with multiple p i 's the same g must be used, whereas in CLT we can have different g i 's modulo each p i .

Our modulus switching variant.

Since the solution from [START_REF] Jean-Sébastien Coron | Public Key Compression and Modulus Switching for Fully Homomorphic Encryption over the Integers[END_REF] does not apply directly in the CLT scheme, we use a different technique: we first encode the message m in the high-order bits modulo p, so that it gets preserved by the modulus switching. For this it suffices to multiply the ciphertext by g -1 mod p, which gives from Equation (8.8):

c ≡ g -1 • c ≡ m • g -1 + r (mod p)
and the message m is now encoded in the high-order bits of c mod p, while the noise r only affects the low-order bits. Such multiplication by g -1 mod p can actually be performed within the modulus switching, so that g does not need to be public. Namely it is easy to modify the modulus switching procedure so that Equation (8.9) is replaced by:

c ≡ p • α • c mod p p + δ (mod p ) (8.10)
for any fixed α ∈ Z p . Then it suffices to take α := g -1 mod p and we obtain:

c ≡ p • m • (g -1 mod p) + r p + δ (mod p )
which gives:

c ≡ m • p • g -1 mod p p + r (mod p )
for some small r ∈ Z. This can be written:

c ≡ m • f /g + r (mod p )
for some small f ∈ Z. Namely assuming p < p we have:

g • p • g -1 mod p p ≡ g • p • g -1 mod p p + f ≡ p • 1 p + f ≡ f (mod p )
for some f ∈ Z with |f | < g. Therefore we obtain:

g • c ≡ g • r + m • f (mod p )
This shows that the ciphertext g • c is an encryption modulo p of the message m • f mod g. Finally, to remove the previous f factor, it suffices to multiply the ciphertext by the message f -1 mod g. We obtain:

c ≡ (f -1 mod g) • g • c ≡ g • r + m (mod p ) with |r | ≤ g • |r |.
As previously, such multiplication by (f -1 mod g) • g can be performed within the modulus switching procedure. Namely it is easy to modify the modulus switching procedure so that Equation (8.10) is replaced by:

c ≡ β • p • α • c mod p p + δ (mod p ) (8.11)
for any fixed α ∈ Z p and β ∈ Z p . Then it suffices to take β := (f -1 mod g) • g and as required we obtain directly:

c ≡ g • r + m (mod p )
which shows that c is DGHV ciphertext modulo the new modulus p . The advantage of the above technique is that it easily extends to the batch setting with distinct secret g i 's modulo primes p i 's. Therefore, it is directly applicable to the CLT multilinear map scheme.

The modulus switching procedure

In this section we explain how we obtain Equation (8.11) given as input a ciphertext c. Our technique is a simple variant of the technique described in Let k be an integer. Given α ∈ Z p , we generate at key-generation phase a subset-sum sharing of 2 k • α/p:

2 k • α p = Θ i=1 s i • y i + ε (mod 2 k )
where the public real numbers y i 's have κ bits of precision after the binary point, with |ε| ≤ 2 -κ , and the secret s i 's are bits. The technique consists in first expanding the initial ciphertext c using the y i 's into a ciphertext vector c, as in the original DGHV "squashed decryption" procedure, and then computing a scalar product between c and the secret-key s = (s i ) to get the new ciphertext c modulo p . As in the DGHV bootstrapping procedure, to keep the privacy of s, only a DGHV encryption of the s i 's under p is used. One can then show that the new noise in the ciphertext c is reduced by a factor p /p.

Given a ciphertext c such that |c| < 2 κ , we let:

c = ( c • y i mod 2 k ) 1≤i≤Θ
and we let c = BitDecomp(c, k) be the expanded ciphertext, where BitDecomp is defined as follows [START_REF] Brakerski | Leveled) fully homomorphic encryption without bootstrapping[END_REF]. Given a vector x ∈ [0, 2 k+1 [ Θ we write x = k i=0 2 j • u j where all the elements in vectors u j are bits, and we define BitDecomp(x, k) := (u 0 , . . . , u k ). Similarly given a vector z ∈ R Θ we define Powersof2(z, k) := (z, 2 • z, . . . , 2 k • z). It is easy to see that for any vectors x and z:

BitDecomp(x, k), Powersof2(z, k) = x, z
Let p be an integer such that p < 2 k . The secret-key bits s i 's are encrypted under the modulus p as follows. We let s = Powersof2(s, k) and we compute the vector of ciphertexts:

σ = p • q + β • r + p 2 k • s where q ← (Z ∩ [0, 2 γ /p )) (k+1)•Θ and r ← (Z ∩ (-2 ρ , 2 ρ )) (k+1)•Θ . The new ciphertext is then computed as: c = σ, c
In the following, we show that c is a new DGHV ciphertext with noise reduced by a factor p /p. Namely we obtain:

c ≡ β • r, c + p 2 k • s , c (mod p )
Since the components of c are bits, we have:

p 2 k • s , c = p 2 k • s , c + δ 1 = p 2 k • s , c + δ 1 = p 2 k • s, c + δ 1 where |δ 1 | ≤ Θ • k. We have: s, c ≡ Θ i=1 s i c • y i ≡ Θ i=1 s i • c • y i + δ 2 ≡ c • s, y + δ 2 (mod 2 k ) Let c ∈ Z x0 be a level-k CLT encoding m ∈ R under pp such that, for all i ∈ [n], [c] pi = r i • g i + m i z k mod p i . If r ∞ • g ∞ • 2 η -η + V < 2 η -2 / g ∞ , then c = SwitchKey w (τ, c) verifies for all i ∈ [n], [c ] p i = g i • r i + m i z mod p i with r ∞ ≤ 2 η -η • g ∞ • r ∞ + V , where V = w • Θ • (1 + • (2 ρ+1 + 1))/4 + g ∞ /4 + g 2 ∞ /8 + 1.
Similarly to Lemma 8.22, the latter Lemma states that a CLT level-k encoding of m ∈ R (under modulus x 0 = p i and multiplicatively masked by z k ) can be expanded, and then collapsed to an encoding under modulus x 0 = p i and multiplicatively masked by z , for the same underlying exponent m. Moreover, for all i ∈ [n], the noise modulo p i of the initial encoding is roughly reduced by a factor

p i /p i • g i , i.e. r ∞ ≈ r ∞ • (2 η -η • g ∞ ).

Candidate logarithmic encoding scheme: CLT with polylog complexity

We can now describe our candidate κ-logarithmic encoding scheme CLT' whose encodings and public parameters sizes depend polynomially on the logarithmic multilinearity level κ. Let η 0 = η 0 (κ) be a parameter to be determined later for correctness, and define for all j ∈ [κ + 1], η j = (κj + 3) • η 0 . Let w ≥ 2 be a word.

Remark. The differences between CLT .InstGen and CLT.InstGen are as follows:

• Step 2 of CLT is repeated κ + 1 times for CLT' with bit-size the η j 's, j ∈ [κ + 1];

• Step 4 of CLT is repeated κ + 1 times for CLT' to produce κ + 1 multiplicative masks;

• Steps 5-8 of CLT' correspond to Steps 5-8 of CLT for the parameters corresponding to j = 1;

• Step 9 of CLT' corresponds to Step 9 of CLT for the parameters corresponding to j = κ + 1;

• Step 12 of CLT' generates the switching keys.

Instance generation.

CLT .InstGen(1 λ , 1 κ ) : On input the security parameter λ and the logarithmic multilinearity level κ:

1. Fix the parameters {n, ν, ρ, , µ, τ, β, α, Θ} and η 0 to ensure correctness and security according to the constraints of Section 8.3.6.3;

2. For all j ∈ [κ + 1], generate the private modulus x

(j) 0 = i∈[n] p ji , where p ji is a η j -bit prime for η j = (κ -j + 2) • η 0 ; 3. Generate the exponent ring R = Z g1 × • • • × Z gn ,
where g i is a α-bit prime integer; 4. For all j ∈ [κ + 1], generate the secret multiplicative mask z j as a random invertible integer modulo x (j) 0 ;

5. Generate random level-0 encodings x 1 , . .

. , x ∈ Z such that ∀j ∈ [ ], ∀i ∈ [n], [x j ] p1i = g i • r ij + a ij ,
where r ij ← (-2 ρ , 2 ρ ) and a ij ← Z gi ;

• w = O(2 λ ) for efficiency and security (cf. Section 8.3.6.4);

• ν = η κ+1β -(η 0 -1)λ -3 to apply Lemma 8.18;

• N of size n • η 0 + 2η 0 + 1 bits for the proof of Lemma 8.18 (cf. [START_REF] Jean-Sébastien Coron | New Multilinear Maps Over the Integers[END_REF]).

In particular, when one has to multiply level-1 encodings and evaluate a circuit of multiplicative depth κ to produce the final level-κ encoding, the bit-size η 1 of the p 1i 's is η 1 = Õ(κ 2 ) (for a fixed security level). Therefore, the size of the encodings is ≈ n • η = Õ(κ 4 ) and the public parameters pp have bit-size Õ(κ 7 ), that is polynomial in the multiplicative depth of the circuit.

Remark. The optimizations proposed in [START_REF] Jean-Sébastien Coron | New Multilinear Maps Over the Integers[END_REF] to reduce the size of the public parameters are all directly applicable to our scheme: non-uniform sampling, quadratic sampling, quadratic rerandomization and a single zero-testing integer p zt instead of a zero-testing. 14 However they do not impact the asymptotic public parameters bit-size, i.e. Õ(κ 7 ) for a fixed security parameter, because of the bit-size of the switching keys.

Security

Due to the similarities between the CLT' logarithmic encoding scheme of Section 8.3.6 and the CLT graded encoding scheme, the attacks of [START_REF] Jean-Sébastien Coron | New Multilinear Maps Over the Integers[END_REF] apply to the same extent (which justifies the parameters constrains of above).

Cheon et al. attack.

The original CLT scheme [START_REF] Jean-Sébastien Coron | Practical Multilinear Maps over the Integers[END_REF] was completely broken by an attack from Cheon et al. [CHL + 15], which recovers all secret parameters in polynomial time by targeting the zerotesting procedure. Here we based our new scheme on the new CLT scheme described by Coron et al. in [START_REF] Jean-Sébastien Coron | New Multilinear Maps Over the Integers[END_REF] (CRYPTO 2015) which thwarts the attacks by two means:

• Changing the zero-testing procedure, so that the CRT component mod p i of a level-κ encoding are mapped to some value mod N (instead of mod x 0 ), where N is an independent integer;

• Keeping x 0 private, which in turn requires a modification of the re-randomization procedure.

Since the same countermeasures are present in CLT', our logarithmic encoding scheme does not appear to be subject to Cheon et al. attack [CHL + 15] and generalizations thereof [CGH + 15] either. Therefore the κ-LDDH, subgroup membership and decision linear assumptions currently hold in our scheme.

Exploiting the switching keys? Finally, one could try to exploit the additional information that is provided in our scheme and not in the CLT scheme: the switching keys. For the CCK fully homomorphic encryption scheme, the switching keys are proved not to leak secret information under the subset-sum assumption and the circular security of the scheme. In CLT', these switching keys can be used together with the zero-testing vector. However, the zero-testing procedure of the new CLT scheme has been made highly non linear to thwart Cheon et al. attack, and similarly the same countermeasures scramble any information one would get from using switching keys similarly as what is described in [CLT15, Sec. 3.2].

However, one could try to exploit the additional information that is provided in our scheme and not in the CLT scheme, that is the switching key. In the CCK fully homomorphic encryption scheme, switching keys are assumed not to leak secret information under the subset-sum assumption when assuming the bit circularity of the scheme. Unfortunately in our logarithmic encoding scheme CLT', these switching keys can be used together with the zero-testing vector and may leak some function of secret values.

That being said, it seems difficult to exploit this leakage in any useful way, especially to break hardness assumptions related to our scheme. In any case, this leakage can be contained by rerandomizing some more the switching key, e.g. by setting: , it holds that

[σ] p (κ+1)i = z -1 κ+1 • g i • b i • r i + p (κ+1)i w • P ( ) w (s i ) mod p (κ+1)i , where b i ← (-2 B , 2
u 1 + u 2 ∈ S (α1+α2) v and u 1 -u 2 ∈ S (α1-α2) v
where α 1 + α 2 and α 1α 2 are addition and subtraction in R.

There is an associative binary operation

× (on {0, 1} * ) such that for every α 1 , α 2 ∈ R, every v 1 , v 2 with 0 ≤ v 1 + v 2 ≤ κ, and every u 1 ∈ S (α1) v1 and u 2 ∈ S (α2) v2 , it holds that u 1 × u 2 ∈ S (α1•α2) v1+v2 where α 1 • α 2 is multiplication in R.

Definition 8.18 (Graded Encoding Schemes)

A symmetric κ-graded encoding scheme G with rerandomization and public sampling consists of the following (polynomial time) procedures G = {InstGen, Samp, Enc, ReRand, Neg, Add, Mult, IsZero, Ext}:

InstGen(1 λ , 1 κ ) : The randomized instance generation procedures takes as input the security parameter λ, the multilinearity level κ, and outputs the public parameters (pp, p zt ) where pp is a description of a κ-graded encoding system as above, and p zt is a zero-test parameter;

Samp(pp) : The randomized sampling procedure takes as input the public parameters pp and outputs a "level-0" encoding u ∈ S (α) 0

for a nearly uniform α ∈ R;

Enc(pp, i, u) : The (possibly randomized) encoding procedure takes as inputs the parameters pp, an index i ∈ [κ] and a "level-0" encoding u ∈ S (α) 0

for some α ∈ R and outputs a "level-i" encoding u ∈ S

i ;

ReRand(pp, i, u) : The randomized rerandomization procedures takes as inputs the parameters pp, an index i ∈ [κ] and a "level-i" encoding u ∈ S (α) i

for some α ∈ R, and outputs another u ∈ S i (α) such that, for any u 1 , u 2 ∈ S (α) i , the output distributions of ReRand(pp, i, u 1 ) and ReRand(pp, i, u 2 ) are nearly the same; Neg(pp, u) The arithmetic negation is deterministic, takes as input the public parameters pp and a "level-i" encoding u ∈ S (α) i for some α in R and outputs a "level-i" encoding u ∈ S

n < ρ f ≤ η -2β -2α -λ -8 and let ν = η -ρ f -β -λ -3 ≥ 2α + β + 5. Let c be such that [c] pi ≡ (r i • g i + m i )/z κ for all i ∈ [n], where m i ∈ Z gi for all i. Let r = (r i ) i∈[n] and assume that r ∞ < 2 ρ f . If m = 0 then [c • p zt ] N ∞ < 2 -ν-λ • N . Conversely, if m = 0, then [c • p zt ] N ∞ > 2 -ν+2 • N .
Finally, the parameters must satisfy the following constraints to realize a one-round (κ + 1)-way Diffie-Hellman key exchange protocol:

• ρ = Ω(λ) to avoid brute force attacks on the noise [CN12; CNT12; LS14] -in practice we can take ρ = λ;

• α = λ for the GDDH assumption to be hard;

• n = ω(η • log λ) to thwart lattice-based attacks on the encodings; • ν = ηβρ fλ -3 to apply Lemma 8.21;

• N of size n • η + 2η + 1 bits for the proof of Lemma 8.21 (cf. [START_REF] Jean-Sébastien Coron | New Multilinear Maps Over the Integers[END_REF]).

In particular, when one has to multiply O(κ) level-1 encodings to produce the final level-κ encoding, the bit-size η of the p i 's is η = O(κ) (for a fixed security level). Therefore, the size of the encodings is

≈ n • η = O(κ 2
) and the public parameters pp have bit-size O(κ 3 ).

Application to the CCK somewhat homomorphic encryption scheme

In Section 8.

The somewhat homomorphic CCK scheme

In this section, we recall the somewhat homomorphic encryption scheme over the integers (CCK) of Cheon et al. [CCK + 13], a batch generalization of the DGHV scheme [DGH + 10] (that corresponds to the case n = 1). We denote R = Z g1 × • • • × Z gn the plaintext space, where the g i 's are positive integers. Let λ be the security level and d the multiplicative depth of the circuits to evaluate. The parameters pp = {n, g, ν, η, ρ, γ, τ, β} are chosen to ensure correctness and security (cf. [CCK + 13]).

CCK.KeyGen(pp) : Generate n 2 ν -rough η-bit integers p 1 , . . . , p n and a 2 ν -rough integer q ∈ [0, 2 γ / i∈[n] p i ), and define sk = {p, q}. Denote

x 0 = q • i∈[n] p i . Generate x 0 ∈ Z τ x0 such that for all j ∈ [τ ], [(x 0 ) j ] q ← (-q/2, q/2] and for all i ∈ [n], [(x 0 ) j ] pi = g i •r ij for a randomly generated r ij in (-2 ρ , 2 ρ ).
Generate x e ∈ Z n x0 such that for all j ∈ [n], [(x e ) j ] q ← (-q/2, q/2] and for all i ∈ [n], [(x e ) j ] pi = g i • r ij + (e j ) i for a randomly generated r ij in (-2 ρ , 2 ρ ).

Define pk = {x 0 , x 0 , x e } and output K = {sk, pk}.

To encrypt m, we compute the scalar product of m with encryptions of the canonical basis e of the Z-module R, and we add a subset-sum of encryptions of 0 for security. Modulus switching. To make up for this exponential growth of the noise in the number of multiplications, a modulus switching technique (coming from lattice-based fully homomorphic encryption schemes [START_REF] Brakerski | Efficient Fully Homomorphic Encryption from (Standard) LWE[END_REF]) was adapted for the DGHV fully homomorphic encryption scheme -that is the CCK scheme for n = 1 and R = Z 2 -by Coron, Naccache and Tibouchi [START_REF] Jean-Sébastien Coron | Public Key Compression and Modulus Switching for Fully Homomorphic Encryption over the Integers[END_REF]. Assume that c encrypts a bit m. Their main idea to switch from a modulus N = p • q to a modulus N = p • q with p ≤ w is to publish a tuple ). Therefore by applying the modulus switching technique after every multiplication, using a ladder of gradually decreasing moduli p's, the bit-size of the larger p can be lowered to Õ(d) to handle circuits of multiplicative depth d.

(v, σ) ∈ R Θ × Z n•Θ N such that c = 2 c, σ + [c] 2 mod N (8.12) verifies c mod p = r • g + m , where c ∈ {-1, 0, 1} Θ•η is defined such that that c • v k mod 2 η = j∈[η ] c (k-1)•η +j 2 j-1 .
Remark. Note that the previous technique can easily be adapted to the CCK scheme when R = Z n g by replacing the 2's in Equation (8.12) by g. Also, if we assume that q = 1, the technique can be adapted for any g i 's; we defer to Section 8.3.13 the adaptations to these two cases. 15 However, q 1 was a necessary condition to prove the semantic security of the scheme assuming the hardness of the Approximate-GCD problem in [CCK + 13]. The difficulty to generalize Coron et al. technique to the general case comes from the fact that one has to correct the additive mask [c] q modulo all the g i 's at once in order to ensure that the new ciphertext still encrypts the same plaintext.

A new modulus-switching technique for CCK

Consider two set of CCK parameters pp = {n, g, ν, η, ρ, γ, τ, β} and pp = {n, g, ν, η , ρ, γ, τ, β} with η < η -1. Let K = {sk, pk} ← CCK.KeyGen(pp) and K = {sk , pk } ← CCK.KeyGen(pp ), where sk = {p , q }, pk = {N , x 0 , x e } and sk = {p , q }, pk = {N , x 0 , x e } .

Our goal is to transform a ciphertext c under K, in which ∀i ∈

[n], [c] pi = g i • r i + m i , to a ciphertext c under K , in which ∀i ∈ [n], [c ] p i = g i • r i + m i with r ∞ ≤ 2 η -η • g ∞ • r ∞ + V ,
where V ∈ N is a constant that does not depend of c. Our key idea consists in a temporary switch from a ciphertext c such that ∀i ∈

[n], [c] pi = g i • r i + m i to an integer c * ∈ Z N such that ∀i ∈ [n], [c * ] pi = [g -1 i ] pi • m i + r i pi (
that is move m i to the "most significant bits" of c * mod p i ), and to apply a modulus switching technique inspired of [START_REF] Jean-Sébastien Coron | Scale-Invariant Fully Homomorphic Encryption over the Integers[END_REF] on such a "ciphertext".

Let w be a word (typically w = 2 or w = 2 64 ) and ∈ Z be an integer. Let us define the functions word decomp and powers of words. The function word decomp D ( ) w decomposes (componentwise) a vector v ∈ Z n in words: 16 The function powers of words P ( ) w multiplies a vector v ∈ Z n by powers w i of the word w for i ∈ {0, . . . , -1}:

D ( ) w : v ∈ Z n → (v 1 , . . . , v ) ∈ ([-w/2, w/2] n ) such that [v] w = i∈[ ] v i • w i-1 .
P ( ) w : v ∈ Z n → (v, w • v, . . . , w -1 • v) ∈ (Z n ) . Finally, recall that for v, v ∈ Z n , [ v, v ] w = [ D ( ) w (v), P ( ) w (v ) ] w .
In the following, define = η / log 2 w (so that p i < w for all i ∈ [n]). Let us define the SwitchKeyGen and SwitchKey algorithms for parameters Θ, w (Θ is a parameter to be chosen later for security):

SwitchKeyGen Θ,w (n, g, {sk, N }, {sk , N , }) : On input two CCK secret keys, let µ = log 2 N , and:

1. Generate a vector v ∈ R Θ of real numbers in [0, w ) with µ bits of precision after the binary point, and let s i ∈ Z Θ w be vectors such that, for all i ∈

[n], v, s i w = w • [g -1 i • f i ] pi p i + ε i mod w , (8.13)
where

|ε i | < 2 -µ and f i = [f -1 i ] gi for f i = p i pi • [g -1 i ] pi • g i p i .
2. Given the vectors s i 's for i ∈ [n], define a vector σ ∈ Z •Θ N such that [σ] q ← (-q /2, q /2] •Θ , and such that for all i ∈

[n], [σ] p i = g i • r i + p i w • P ( ) w (s i ) mod p i , (8.14)
where The following lemma shows that the expanded ciphertext can be collapsed into a new ciphertext c for key K instead of K, for the same underlying plaintext; moreover for all i ∈ [n], the noise modulo p i is reduced roughly by a factor

r i ← (-2 ρ , 2 ρ ) •Θ ; 3. Output τ K→K = {v, σ, N, N , }.
p i /p i • g i , i.e. r ∞ ≈ r ∞ • (2 η -η • g ∞ ).
Lemma 8.22 Let pp, pp , K, K , w, Θ and = η / log 2 w be defined as above. Let 16 To uniquely define D ( ) w , we request that, for all i ∈ [ ], (∃j

τ K→K ← SwitchKeyGen Θ,w (n, g, {sk, N }, {sk , N , }) . Let c ∈ Z N be a ciphertext of m ∈ R under K such that, for all i ∈ [n], [c] pi = g i • r i + m i . If r ∞ • g ∞ • 2 η -η + V < 2 η -2 / g ∞ , then c = SwitchKey w (τ K→K , c) is a ciphertext of m under K , i.e. such that for all i ∈ [n], [c ] p i = g i • r i + m i with r ∞ ≤ 2 η -η • g ∞ • r ∞ + V , where V = w • Θ • (1 + • (2 ρ+1 + 1))/4 + g ∞ /4 + g 2 ∞ /8 + 1.
∈ [n] : (v i ) j = -w/2 ⇒ v j < 0). Proof: Denote c = D ( ) w c • v mod w ∈ [-w/2, w/2] Θ• . Assume that, for all i ∈ [n], c = q i • p i + g i • r i + m i and σ = q i • p i + g i • r i + g i • p i w • P ( ) w (s i ) , where g i • r i + m i = [c] pi and m i ∈ Z gi . Let i ∈ [n]. We have that c, σ = p i • c, q i + g i • c, r i + g i • c, p i w • P ( ) w (s i ) .
Since the components of c are words, we have c,

p i w • P ( ) w (s i ) = p i w • D ( ) w [ c • v ] w , P ( ) w (s i ) +R 0 (|R 0 | ≤ 1 2 • w 2 • Θ • ) = p i w • c • v , s i w + p i w • (a 0 • w ) +R 0 = p i w • c • v, s i w +p i • a 1 +R 1 (|R 1 | ≤ |R 0 | + 1 2 • w 2 • Θ) = p i w • c • w • [g -1 • f i ] pi p i + ε i +p i • a 2 +R 1 = p i p i • [c • g -1 ] pi • f i +p i • a 3 +R 2 (|R 2 | ≤ |R 1 | + 1) = p i p i • (m i • [g -1 i ] pi + r i ) • f i +p i • a 4 +R 2 = m i • f i • p i p i • [g -1 i ] pi +p i • a 5 +R 3 , where |R 3 | ≤ |R 2 | + |g i | 2 /8 + |g i |/2 • 2 η -(η-1) • r ∞ and a 0 , a 1 , a 2 , a 3 , a 4 , a 5 ∈ Z. Thus g i • c, p i w • P ( ) w (s i ) = m i • f i • f i + R 3 • g i + a 6 • p i
for a 6 ∈ Z. Now, we have that

f i = p i p i • [g -1 i ] pi • g i p i = p i p i • [g -1 i ] pi • g i + δ p i = δ, with |δ| ≤ |g i |/2 ,
and therefore

f i • f i = 1 + R 4 • g i with |R 4 | ≤ |g i |/4. Finally, [ c, σ ] p i = g i • r i + m i with |r i | ≤ |R 4 | + |R 3 | + (w/2) • Θ • • 2 ρ .

The leveled homomorphic CCK scheme

We can now describe our leveled homomorphic encryption scheme CCK' whose parameters depend polynomially on the depth of the circuits that the scheme can evaluate. Let λ denote the security level and d denote the multiplicative depth of the circuits to evaluate. Determine the parameters ν, ρ, η 0 , γ, τ, β and Θ to ensure correctness and security (cf. below), and for all j ∈ [d], define pp j = {n, g, ν, (dj + 2) • η 0 , ρ, γ, τ, β}. Define pp = {pp 1 , . . . , pp d , Θ, w}.

CCK .KeyGen(pp) : For all j ∈ [d], run K j = {sk j , pk j = {N j , x CCK .Decrypt(pp, sk, c) : Suppose that the ciphertext c is under key K j . Run CCK.Decrypt(pp j , sk j , c).

CCK .Add(pp, pk, c 1 , c 2 ) : Suppose that the ciphertexts c 1 , c 2 are under key K j ; if they are not use CCK .Refresh to make it so. Output [c 1 + c 2 ] Nj .

CCK .Mult(pp, pk, c 1 , c 2 ) : Suppose that the ciphertexts c 1 , c 2 are under key K j for j ∈ [d]; if they are not use CCK .Refresh to make it so. Compute

c 3 = [c 1 • c 2 ] Nj , if j = d output c 3 , otherwise output CCK .Refresh(pp, j, c 3 ).
CCK .Refresh(pp, j, c) : Output SwitchKey w (τ j→j+1 , c).

Correctness, parameter constraints and security

Correctness. The proof of correctness of the scheme is similar to [START_REF] Jean-Sébastien Coron | Public Key Compression and Modulus Switching for Fully Homomorphic Encryption over the Integers[END_REF]Th. 3]. Let us show how to fix the parameter η 0 so that the ciphertext noise for every modulus in the ladder remains roughly the same. We say that a CCK ciphertext c has noise r ∞ when c = q i • p i + r i where r

i = [c] pi for all i ∈ [n].
Let us pick an universal bound B on the noise, that is a ciphertext under K j must have noise at most B for all j ∈ [d]. Then it suffices to take 2 ηj > 4B 2 for all j ∈ [d] to ensure the correctness of the scheme.

A fresh ciphertext has noise bounded by B 0 = g ∞ • (n(2 ρ + 1) + τ • 2 β+ρ ); therefore we need to ensure that B ≥ B 0 . By induction now, assume that the bound is verified for ciphertexts c 1 and c 2 under K j , and define c = CCK .Mult(pp, pk, c 1 , c 2 ). 17 The first operation in CCK .Mult is a modular multiplication, which gives a ciphertext noise at most B 2 . Then from Lemma 8.22, c has noise at most

B = B 2 • 2 ηj+1-ηj + w • Θ • (1 + η j+1 / log 2 w • (2 ρ+1 + 1))/4 + g ∞ /4 + g 2 ∞ /8 + 1 .
If we choose B and η 0 such that the following properties hold:

1. B ≥ 2 • (w • Θ • (1 + η j / log 2 w • (2 ρ+1 + 1))/4 + g ∞ /4 + g 2 ∞ /8 + 1) for all j ∈ [d], j ≥ 2, 2. 2 η0 ≥ B • 2, then B ≤ B. It then suffices to select η 0 such that 2 η0 ≥ 2 ρ+β • max(w • Θ • η 0 • d, g ∞ • (n + τ ), g 2 ∞ ) .
For log 2 w = Õ(poly(λ)), we get that η

0 = Õ(log(τ • n • g ∞ • λ • Θ) + ρ + β + log d) and η 1 = Õ(d • η 0 ).
Parameter constraints. The scheme must meet the following constraints, similar to those of [CCK + 13; CNT12]:

• ρ = Ω(λ) to avoid brute force attacks on the noise [CN12; CNT12; LS14];

• η 0 = Õ(log d + ρ + β + log(τ • n • g ∞ • λ • Θ))
where d is the multiplicative depth of the circuits to be evaluated;

• γ = ω(η 2 1 • log λ) = ω(d 2 • η 2 0 • log λ)
in order to thwart lattice-based attacks [CH12; CCK + 13];

• Θ 2 = γ • ω(log λ) to avoid lattice attacks on the subset-sum [CMN + 11];

• β • τ ≥ γ + 2λ in order to apply the leftover hash lemma during encryption [CCK + 13].

To satisfy the above constraints, one can take ρ

= Õ(λ), β = Õ(λ 2 ), τ = Õ(d 2 λ 3 ), Θ = Õ(dλ 3 ), g ∞ = Õ(poly(λ)), η 0 = Õ(log 2 d + λ 2 ), γ = Õ(d 2 λ 5 ).
Semantic security. The proof of the semantic security of the scheme under standard assumptions (namely the Approximate-GCD assumption and the subset-sum assumption) is a straightforward adaptation of [CNT12; CLT14]; we defer to these articles.

Generalization to multiplicative masks

We use the notation of Section 8.3.10.2. We say that a CCK ciphertext c under K is multiplicatively masked by

z ∈ Z N if ∀i ∈ [n], [c] pi = g i • r i + m i z mod p i .
The generalization of the modulus switching technique to multiplicative masks is straightforward.

Let z be an invertible integer modulo N . If we have as input a ciphertext c under K masked by z then it suffices to replace Equation (8.13)

in SwitchKeyGen Θ,w by v, s i w = w • [g -1 i • f i • z] pi p i + ε i mod w .
In order to have an output ciphertext under K multiplicatively masked by z , an invertible integer modulo N , it suffices to replace Equation (8.14) in SwitchKeyGen Θ,w by

[σ] p i = (z ) -1 • g i • r i + p i w • P ( ) w (s i ) mod p i .
We call this new procedure SwitchKeyGen z→z Θ,w .

Optimization of SwitchKey

Our new modulus switching technique is compatible with the optimization described in [CNT12, Sec. 8.1]. 18We use the notation of Section 8.3.10.2.

This optimization consists in generating the vector v in SwitchKeyGen Θ,w with a special structure instead of pseudo-random. Let δ a parameter to be specified later. One generates a v ∈ R such that v ≤ w and v has µ + δ • Θ • • log 2 w bits of precision after the binary point. For all n < k ≤ Θ, set

v k = v • w k•δ• w ,
keeping only µ bits of precision after the binary point, and set v 1 , . . . , v n such that Equation (8.13) holds for all j ∈ [n]. Therefore for k > n,

(c expand ) k = c • v k mod w = c • v • w k•δ• mod w .
Therefore computing the coefficients of c expand for k > n is essentially a single multiplication c•v. The authors of [START_REF] Jean-Sébastien Coron | Public Key Compression and Modulus Switching for Fully Homomorphic Encryption over the Integers[END_REF] describe a lattice attack against that optimization that is thwarted when δ

• • log 2 w • Θ ≥ 3 • µ.

Key exchange from logarithmic encoding schemes

Similarly to [START_REF] Garg | Candidate Multilinear Maps from Ideal Lattices[END_REF], we get a one-round (2 κ + 1)-way Diffie-Hellman key exchange protocol in the common reference string model using logarithmic encoding schemes.

Consider a setting with N parties who wish to set up a shared secret key using a one-round protocol. Each party only broadcasts one value to all other parties, and all the broadcasts occur simultaneously. Once the values have been broadcasted, each party should be able to locally compute a shared secret key s. Such a key exchange scheme consists of the following three randomized polynomial time algorithms:

Setup(1 λ , 1 N ). From a security parameter λ and the number of participants N , this algorithm runs in polynomial time in λ, N and outputs public parameters pp.

• for all i ∈

[n], if s i = (s ki ) k∈[Θ] , [σ] p i = r i + p i w • P ( ) w (s i ) mod p i , where r i ∈ Z •Θ is uniformly random in (-2 ρ , 2 ρ ) •Θ , • [σ] q is uniformly random in (-q/2, q/2] . Assume that c = q i • p i + g • r i + m i for all i ∈ [n], set c = D ( ) w c • v mod w and define c = g • c, σ + [c] g . so that [c ] g = [c] g . Then for all i ∈ [n], c = g • p i • c, [(σ -[σ] p i )/p i ] N /p i + g • c, r i + g • c, p i w • P ( ) w (s i ) + [c] g . Now, g • c, p i w • P ( ) w (s i ) = g • p i w • c, P ( ) w (s i ) + R = c • p i p i + g • t • p i + R = (g • r i + m i ) • p i p i + (q i + g • t) • p i + R with t ∈ Z, |R| ≤ 1/2 • Θ • • (w/2) • g and |R | ≤ |R| + 1 + (w/2) • Θ/2 • g. Therefore c = p i • (g • q i + q i ) + r i , with q i ∈ Z and |r i | ≤ |R | + 2 -ξ • g • ( r ∞ + 1) + g • Θ • • (w/2) • 2 ρ + g. Finally, [r i ] g = [c -p i • q i ] g = [[c] g -[q i ] g ] g = [c -p i • q i ] g = m i ,
which proves that c encrypts m under the key {sk , pk }.

With q = 1

For this adaptation, we need to assume that CCK.KeyGen produces p i 's such that

[p i ] gi = 1 for all i ∈ [n]. Let sk = {p, 1}, pk = {N, x 0 , x e } ← CCK.KeyGen(1 λ ) and let µ = log 2 N . Assume that c ∈ Z N encrypts the vector m ∈ R = Z g1 × • • • × Z gn and denote G = i∈[n] g i . To switch from the key sk, pk to a key sk = {p , 1}, pk = {N , x 0 , x e } with p i ≤ w , [p i ] gi = 1 and 1 ≤ 2 ξ ≤ p i /p i , we can publish a tuple (v, σ = G • σ ) ∈ R Θ × Z n•Θ , with Θ = Θ(λ) a fixed parameter, such that: • for all i ∈ [n], w /(p i • g i ) w = k∈[Θ] s ki • v k + ε i mod w ,
where the v k 's have µ bits of precision after the binary point, with |ε i | < 2 -µ , and s ki ∈ [-w/2, w/2],

• for all

i ∈ [n], if s i = (s ki ) k∈[Θ] , [σ ] p i = g i /G • r i + p i w • P ( ) w (s i ) mod p i , where r i ∈ Z •Θ is uniformly random in (-2 ρ , 2 ρ ) •Θ .
intensive use of multiplication. That we can still improve on such a well-known operation as multiplication might sound surprising, but it is the case as we show in Section 9.1. The other staple operation in cryptographic implementations is modular reduction. Very efficient techniques are known to perform modular reduction; in Section 9.3 we show how to choose specificyet secure -moduli resulting in a twofold performance improvement. Barrett reduction, in turn, can be extended to polynomials, and we show in Section 9.4 how this improves the performance of BCH error-correcting codes.

Higher-level primitives can also be improved. Micali and Shamir showed that relaxing parameter generation in the Fiat-Shamir identification scheme, which we have much discussed in this thesis, could improve performance -however they left unspecified how to solve the additional problems arising in that new setting. We complete the picture in Section 9.2.

Finally, we introduce in Section 9.5 a queue-theoretic construction that regulates its output, with applications in random number generation. This makes it easier to design hardware blocks, which do not require the usual additional circuitry necessary to deal with irregular inputs, resulting in conceptually and physically smaller, and more energy-efficient designs.

Throughout the paper we will assume unsigned integers, and denote by w the word size (typically, w = 8), a i , b i and r i the binary digits of a, b and r respectively:

a = n-1 i=0 2 wi a i , b = n-1 i=0 2 wi b i , and r = a × b = 2n-1 i=0 2 wi r i .

Textbook multiplication

A direct way to implement long multiplication consists in extending textbook multiplication to several words. This is often done by using a1 routine. A routine takes as input four n-bit words {x, y, c, ρ}, and returns the two n-bit words c , ρ such that 2 n c + ρ = x × y + c + ρ. We write {c , ρ } ← (x, y, c, ρ).

If such a routine is available then multiplication can be performed in n 2 calls using Algorithm 31. The MIRACL big number library [Cer] provides such a functionality.

for

i ← 0 to 2n -1 2. ri ← 0 3. for i ← 0 to n -1 4. c ← 0 5. for j ← 0 to n -1 6. {c, ri+j} ← M (ai, bj, c, ri+j) 7. ri+n ← c 8. return r
This approach is unsatisfactory: it performs more computation than often needed. Assuming a constanttime instruction, Algorithm 31 runs in time O(n 2 ).

Karatsuba's algorithm

Karatsuba [START_REF] Karatsuba | Multiplication of Many-Digital Numbers by Automatic Computers[END_REF] proposed an ingenious divide-and-conquer multiplication algorithm, where the operands a and b are split as follows:

r = a × b = (2 L a + a) × (2 L b + b),
where typically L = nw/2. Instead of computing a multiplication between long integers, Karatsuba performs multiplications between shorter integers, and (virtually costless) multiplication by powers of 2. Karatsuba's algorithm is described in Algorithm 32.

Algorithm 32: Karatsuba Multiplication Algorithm

Input: a, b ∈ Z. Output: r ∈ Z such that r = a × b. 1. u ← a × b 2. v ← a × b 3. w ← (a + a)(b + b) -u -v 4. r ← 2 2L × u + 2 L × w + v 5. return r
This approach is much faster than naive multiplication -on which it still relies for multiplication between short integers -and runs 2 in Θ(n log 2 3 ).

Bernstein's multiplication algorithm

When one of the operands is constant, different ways to optimize multiplication exist. Bernstein [START_REF] Robert | Multiplication by integer constants[END_REF] provides a branch-and-bound algorithm based on a cost function.

The minimal cost, and an associated sequence, are found by exploring a tree, possibly using memoization to avoid redundant searches. More elaborate pruning heuristics exist to further speedup searching. The minimal cost path produces a list of operations which provide the result of multiplication.

Because of its exponential complexity, Bernstein's algorithm is quickly overwhelmed when dealing with large integers. It is however often implemented by compilers for short (32 to 64-bit) constants.

The proposed algorithm

Intuitive idea

The proposed algorithm works with an alternative representation of the constant operand a. Namely, we wish to express some a i as a linear combination of other a j s with small coefficients. It is then easy to reconstruct the whole multiplication b × a from the values of the b × a j only.

The more linear combinations we can find, the less multiplications we need to perform. Our algorithm therefore tries to find the longest sequence of linear relationships between the digits of a. We call this sequence's length the coverage of a.

Yet another performance parameter is the number of registers used by the multiplier. Ideally at any point in time two registers holding intermediate values should be used. This is not always possible and depends on the digits of a.

As an example, consider the set of relations of Table 9.1. All words are expressed ultimately in terms of the values of a 3 and a 7 . In Table 9.1, we express a as a subset of words A ∈ {a 0 , . . . , a n-1 } and build a sparse table U where U i,j ∈ {-1, 0, 1, 2, =}, which encodes linear relationships between individual words. During multiplication, U describes how the different a i can be derived from each other.

2 = -1 1 a 0 ← a 7 -a 4 a 0 a 4 a 7 3 2 = a 9 ← a 4 + a 4 a 0 a 4 a 9 4 1 = -1 a 1 ← a 0 -a 9 a 0 a 1 a 9 5 1 = 1 a 8 ← a 1 + a 9 a 8 a 1 a 9 6 1 = 1 a 2 ← a 1 + a 8 a 8 a 1 a 2 7 2 = a 6 ← a 2 + a 2 a 8 a 6 a 2
Hence it suffices to compute b × a 3 and b × a 7 to infer all other b × a i by long integer additions. Note that the algorithm only needs to allocate three (n + 1)-word registers reg1, reg2 and reg3 to store intermediate results.

The values allowed in U can easily be extended to include more complex relationships (larger coefficients, more variables, etc.) but this immediately impacts the algorithm's performance. Indeed, the corresponding search graph has correspondingly many more branches at each node.

Operations can be performed without overflowing (i.e. so that results fit in a word), or modulo the word size. In the latter case, it is necessary to subtract b w from the result, where w is the word size, to obtain the correct result. This incurs some additional cost.

Backtracking algorithm

2 When repeated recursively.

as the current operation. With suitable listing, Algorithm 36 outputs a set of values being related, along with the corresponding relation. The dependencies that we take into account in our C code (given in Appendix B.2) don't go beyond depth 2. Thus, the corresponding operations are C = {+, -, ×2}. We also add these operations performed modulo 256, to obtain more solutions. The alternative to this approach is to consider a bigger depth, which naturally leads to more possibilities.

Our program takes as an input an integer p that represents the percentage of a being covered (i.e. the coverage is p/100 times the length of the a). In a typical lightweight scenario, a 128-byte number is involved in the multiplication process. Our software attempts to backtrack over a coverage-related number of values out of 256. It follows immediately that at most a 50% coverage would be required for performing such a multiplication (as byte collisions are likely to happen).

The program takes as parameter the list of bytes of a. If some bytes appear multiple times, it is not necessary to re-generate each of them individually: generation is performed once, and the value is cloned and dispatched where needed.

Note that if precomputation takes too long, the list of a i can be partitioned into several sub-lists on which backtrackings are run independently. This would entail as many initial multiplications by the online multiplier but still yield appreciable speed-ups.

Multiplication algorithm Algorithm 37: Multiplication Virtual Machine

Input: b, instr = (opcode, i, j, t, p) k , R. Output: r.

1. r ← 0 2. for each (i, v) ∈ R 3. reg[i] ← v × b 4. PlaceAt(v, reg[i])
5. for each (opcode, i, j, t, p) ∈ instr 6. reg[t] ← opcode(reg[i], reg[j])

7.

PlaceAt(p, t)

return r

With the encoding of a generated by Algorithm 36, it is now possible to implement multiplication efficiently.

To that end we make use of a specific-purpose multiplication virtual machine (VM) described in Algorithm 37. The VM is provided with instructions of the form opcode t, i, j, p that are extracted offline from U . Here, opcode is the operation to perform, i and j are the indices of the operands, t is the index of the result, and p ← w × t is the position in r where to place the result, w being the word size. The value of p is pre-computed offline to allow for a more efficient implementation.

We store the result in a 2n-byte register initialized with zero. We also make use of a long addition procedure PlaceAt(p, i) which "places" the contents of the (n + 1)-byte register reg[i] at position p in r. PlaceAt performs the addition of register reg[i] starting from an offset p in r, propagating the carry as needed.

Finally, we assume that the list R = (i, v) k of root nodes (position and value) of U is provided. After executing all the operations described in U , Algorithm 37 has computed r ← a × b.

Karatsuba multiplication

Using the notations of Algorithm 32 one can see that in settings where a is a constant, the numbers u, v, w all result from the multiplication of b, b and b + b (which are variable) by a, a and a + a (which are constant). Hence our approach can independently be combined with Karatsuba's algorithm to yield further improvements.

A Micali-Shamir implementation note Abstract

In the Micali-Shamir paper [START_REF] Micali | An Improvement of the Fiat-Shamir Identification and Signature Scheme[END_REF] improving the efficiency of the original Fiat-Shamir protocol [FS87; FFS88; SF88], the authors state that '(. . . ) not all of the vi's will be quadratic residues mod n. We overcome this technical difficulty with an appropriate perturbation technique (. . . )' This perturbation technique is made more explicit in the associated patent application [START_REF] Shamir | Variants of the Fiat-Shamir identification and signature scheme[END_REF]:

'Each entity is allowed to modify the standard vj which are QNRs. A particularly simple way to achieve this is to pick a modulus n = pq where p = 3 mod 8 and q = 7 mod 8, since then exactly one of vj, -vj, 2vj, -2vj is a QR mod n for any vj. The appropriate variant of each vj can be (. . . ) deduced by the verifier himself during the verification of given signatures.'

In this short note we clarify the way in which the verifier can infer by himself the appropriate variant of each vj during verification. This is joint work with Simon Cogliani and David Naccache, and was published as [CGN16].

Introduction

The increased popularity of lightweight implementations invigorates the interest in the resource-preserving protocols of the late 1980s initially designed for smart-cards. By then, cryptoprocessors were expensive and cumbersome, hence the research community started looking for astute ways to identity and sign with scarce resources.

One such particularly elegant procedure is the the Fiat-Shamir protocol [START_REF] Feige | Zero-Knowledge Proofs of Identity[END_REF] (that we do not fully restate here). In the original procedure, the public-keys are derived as follows [FS87; SF88]: (. . . ) the center (. . . ) chooses and makes public (. . . ) a PRF f which maps arbitrary strings to the range [0, n). (. . . ) The center then performs the following steps:

1. Compute the values v j = f (I, j) for small values of j.

2. Pick distinct k values of j for which v j is a QR mod n and compute the smallest square root s j of v -1 j . 3. Issue a smart card which contains I, the k s j values, and their indices.

In a follow-up paper by Micali and Shamir [START_REF] Micali | An Improvement of the Fiat-Shamir Identification and Signature Scheme[END_REF], the authors propose a way to reduce the verifier's work factor by selecting small public-keys. In this version, the v j 's are the first small primes. 4 However, as noted in [START_REF] Micali | An Improvement of the Fiat-Shamir Identification and Signature Scheme[END_REF], doing so does not yield only QRs: '(. . . ) not all of the v i 's will be quadratic residues mod n. We overcome this technical difficulty with an appropriate perturbation technique (. . . )'

The associated patent [START_REF] Shamir | Variants of the Fiat-Shamir identification and signature scheme[END_REF] describes further the idea:

'Each entity is allowed to modify the standard v j which are QNRs. A particularly simple way to achieve this is to pick a modulus n = pq where p = 3 mod 8 and q = 7 mod 8, since then exactly one of v j , -v j , 2v j , -2v j is a QR mod n for any v j . The appropriate variant of each v j can be (. . . ) deduced by the verifier himself during the verification of given signatures.' Indeed, we have the following well-known result: Lemma 9.1 For n = pq where p = 3 mod 8 and q = 7 mod 8 (such moduli are sometimes known as Williams numbers), -1 and 2 are both quadratic non-residues modulo n.

Proof: For -1 to be a quadratic residue mod n, it has to be a quadratic residue modulo every prime that divides n, i.e. it has to be a QR modulo p and q. One easily checks that -1 p = (-1) (p-1)/2 = -1 and -1 q = (-1) (q-1)/2 = -1 because both p and q are equal to -1 modulo 4. Similarly, 2 n = (-1) (n 2 -1)/8 = -1

because n = pq = -3 mod 8. Thus both -1 and 2 are QNR mod n.

However there is no indication, in the paper nor in the associated patent, as to how exactly the verifier can deduce which or the four possibilities should be considered.

Existing approaches

Besides leaving the verifier to determine which v j are QR, [START_REF] Shamir | Variants of the Fiat-Shamir identification and signature scheme[END_REF] mentions providing this information explicitly to the verifier, either alongside the public key material, or during the protocol. It also points out that using d = 3 and n such that φ(n) 3 so that every v j has a cubic root mod n. However the choice of such a d exposes the participants to Wiener's attack [BM04; BD99; Cop97; Wie90], and in any case requires an additional modular multiplication during the generation and the verification of signatures. When the Micali-Shamir scheme is considered, the question of the QNR is usually evacuated by making sure that only v j that are QR are part of the public key (see e.g. [START_REF] Bellare | Hash Functions from Sigma Protocols and Improvements to VSH[END_REF]). The downside of such an approach is that many values of v j cannot be chosen, and since the v j are prime this causes an increase in the public key size, and an overall loss of efficiency.

Compensating coefficients

The way in which the verifier can deduce which v j (where ∈ {-2, -1, 1, 2}) to use is left unexplicited in [START_REF] Shamir | Variants of the Fiat-Shamir identification and signature scheme[END_REF], but explicited in [START_REF] Simmons | Zero-knowledge proofs of identity and veracity of transaction receipts[END_REF]. But it can be done as follows. We use the equivalent values v j , -v j , v j /2, -v j /2 for the sake of faster calculations.

Denote by i ∈ {-1/2, -1, 1, 1/2} the value such that i v i is a QR mod n. The prover keeps two binary strings α, β defined as follows:

α i = 0 if | i | = 1 1 if | i | = 1/2 β i = 0 if the sign of i is + 1 if the sign of i is -
For a given challenge e we define:

u = k-1 i=0 α i e i and w = k-1 i=0 β i e i mod 2
and u = u div 2 and u = u mod 2 (so that in particular u = 2u + u).

We now describe three approaches that allow the verifier to perform its task.

Version 1: The prover sends u and w

Because not all the v j are QR, when computing directly with v j the verification algorithm must check that:

y 2 k-1 i=0 v ej j = (-1) w 2 u x mod n.
This is easy to verify, provided that the prover has sent u and w alongside their response. This requires the transmission of a few bits (u and w can typically be encoded using a single byte). Note that u and w are computed from the (public) values of the v j and of e, so that there is no information leaked in sharing these numbers.

Version 2: No correction

In fact, it is not necessary to transmit u or w. Indeed, from

y 2 k-1 i=0 v ej j = (-1) w 2 u x mod n.
The verifier can compute:

∆ = x -1 y 2 k-1 i=0 v ej j mod n because 2 u < 2 k < n.
The verifier therefore only needs to check that either ∆ or n -∆ is of the form 2 u in Z, for some u. This of course can be checked very efficiently. While minimizing the prover's effort, note that this variant requires from the verifier an extra modular inversion. Note also that the tolerance concerning extra -1 and 2 in the verification formula cannot be confused with the use of v j equal to these values as both -1 and 2 are QNRs. Therefore we do not impact the protocol's soundness.

Version 3: The prover compensates u

In this approach, we alter the definition of y, which is now:

y = 2 u r k-1 i=0 s ej j .
We call this operation 'compensating u'. The computation of y is performed by the prover. Then the verifier can check that:

Γ = 2y 2 k-1 i=0 v ej j = 2 2 u r k-1 i=0 s ej j 2 × k-1 i=0 v ej j = (-1) w 2 ¬u x mod n.
In other words, all the verifier has to do is check if

Γ ∈ {x, n -x, 2x mod n, -2x mod n}.
This verification is quick and easy: Start by comparing to x or nx. One of the values x, nx is a number by one bit shorter than n. A simple shift to the right of therefore allows to continue comparing (subtract n again if needed).

Alternatively, the two bits ¬u, w can be sent to the verifier to further speed-up verification. Note here again that these quantities do not leak any secret information.

Security analysis

In the constructions of Sections 9.2.2.1 and 9.2.2.2 only the verifier's algorithm is modified, and it is straightforward to see that the verifier will not accept with our modifications a response that they would not have accepted using the original Fiat-Shamir verification algorithm.

However the variant of Section 9.2.2.3 proposes a different definition of y, and we must show that this does not impact the scheme's security. Note that soundness is guaranteed from the observation that -1 and 2 are QNR mod n, so that no new valid response is introduced by altering the verification procedure in the way we did. There remains to show that the honest-verifier zero-knowledge property still holds, by expliciting a simulator. This is straightforward when u is public (just multiply by 2 u the output y of a Fiat-Shamir simulator). When u is not public, the simulator can do the same after drawing a value u at random. Nevertheless, these arguments only show that our modifications do not impact the security of the Micali-Shamir variant of the Fiat-Shamir protocol, not that it is secure in the first place. The discussion in [START_REF] Micali | An Improvement of the Fiat-Shamir Identification and Signature Scheme[END_REF] gives a heuristic argument, and refers to a full version of the paper that, to the best of our knowledge, never appeared. Bellare and Ristov [START_REF] Bellare | Hash Functions from Sigma Protocols and Improvements to VSH[END_REF] call this claim the 'square roots of prime products' assumption.

Double-speed Barrett moduli

Abstract

Modular multiplication and modular reduction are the atomic constituents of most public-key cryptosystems. Amongst the numerous algorithms for performing these operations, a particularly elegant method was proposed by Barrett. This method builds the operation a mod b from bit shifts, multiplications and additions in Z. This allows to build modular reduction at very marginal code or silicon costs by leveraging existing hardware or software multipliers. This paper presents a method allowing to double the speed of Barrett's algorithm by using specific composite moduli. This is particularly useful for lightweight devices where such an optimization can make a difference in terms of power consumption, cost and processing time. The generation of composite moduli with a predetermined portion is a well-known technique and the use of such moduli is considered, in statu scientiae, as safe as using randomly generated composite moduli. This is joint work with Diana Maimuţ and David Naccache, and was published in [GMN16].

Introduction

Modular multiplication and modular reduction are the atomic constituents of most public-key cryptosystems. Amongst the numerous algorithms for performing these operations (e.g. [BGV94; Bri82; Knu68; Mon85]), a particularly elegant method was proposed by Barrett in [Bar87]. This method assembles the operation a mod b from bit shifts, multiplications and additions in Z. This allows to build modular reduction at very marginal code or silicon costs by leveraging existing hardware or software multipliers. For a very detailed comparison of the principal modular reduction strategies, we refer the reader to [START_REF] Bosselaers | Comparison of Three Modular Reduction Functions[END_REF].

This paper presents a method allowing to double the speed of Barrett's algorithm by using specific composite moduli. This is particularly useful for lightweight devices where such an optimization can make a difference in terms of power consumption, cost and processing time. The generation of composite moduli with a predetermined portion is a well-known technique [Joy08; Len98; VZ95] and the use of such moduli is considered, in statu scientiae, as safe as using randomly generated composite moduli. [START_REF] Douguet | Modular reduction using a special form of the modulus[END_REF] describe a modified Barrett modular reduction algorithm whose purpose is the acceleration of this type of operation in certain (elliptic curve) groups of known moduli. Thus, the approach they consider implies moduli with a given form, e.g. the recommended ones from [START_REF] Kerry | Federal information processing standards publication digital signature standard (DSS)[END_REF]. Estimations of the speed-ups are not provided, but the resistance of various architectures to different physical attacks is discussed. A general form of the Barrett constant and of the quotients (when certain moduli are used) are described. As an example of the proposed techniques, the Elliptic Curve Digital Signature Algorithm (ECDSA) [START_REF] Kerry | Federal information processing standards publication digital signature standard (DSS)[END_REF] is taken into account.

Related work: Douguet and Dupaquis

We stress that no specific modulus generation algorithm is presented in [START_REF] Douguet | Modular reduction using a special form of the modulus[END_REF]. The approach of [START_REF] Douguet | Modular reduction using a special form of the modulus[END_REF] is rather a practical one, whereas our goal is to provide formal mathematical models for moduli with a predetermined portion generation.

Knežević, Batina and Verbauwhede [START_REF] Knezevic | Modular Reduction without Precomputational Phase[END_REF] propose two sets of moduli for which Barrett's modular reduction algorithm can be implemented by avoiding the precomputation of the Barrett constant. The types of moduli considered throughout this paper do not fall into those sets.

Structure of the paper: Section 9.3.2 describes Barrett's and Montgomery's algorithm for modular reduction. Section 9.3.3 recalls background concerning composite moduli a predetermined portion. Section 9.3.4 introduces our core idea, that leverages Section 9.3.3 to generate Barrett-friendly RSA moduli. In Section 9.3.5, we apply this idea to other cryptographic primitives, such as DSA [START_REF] Kerry | Federal information processing standards publication digital signature standard (DSS)[END_REF].

Preliminaries

Notations

For a given a, let |a| = 1 + log 2 a = log 2 (a + 1) . That is, |a| will denote the bit-length of a throughout this paper. a|b will represent the concatenation of the bit-strings a and b. x y will denote binary shift-to-the-right of x by y places i.e.:

x y = x 2 y

= κ U = 2 L-U n . Proof: ∃ α < 2 U and β < n (integers) verifying: κ = κ 2 U - α 2 U and κ = 2 L n - β n . Therefore, min α β 2 L-U n - β + αn 2 U n ≤ κ = 2 L-U n - β + αn 2 U n ≤ max α,β 2 L-U n - β + αn 2 U n and finally, 2 L-U n -1 < 2 L-U n -1 + 1 2 U n ≤ κ ≤ 2 L-U n .

Moduli with a predetermined portion

RSA [START_REF] Rivest | A Method for Obtaining Digital Signature and Public-Key Cryptosystems[END_REF] moduli with a predetermined portion are used to reduce storage requirements or computations. As mentioned before, such moduli are presently not known to be cryptographically weaker than randomly chosen ones. The first techniques for generating composite moduli were proposed by Vanstone and Zuccherato [START_REF] Vanstone | Short RSA Keys and Their Generation[END_REF] who presented various ways of specifying N/4 ≤ ≤ N/2 bits of n. Lenstra [START_REF] Arjen | Generating RSA Moduli with a Predetermined Portion[END_REF] proposed more advanced techniques for specifying up to N/2 bits. Based on Lenstra's algorithms, Joye proposed new techniques in [START_REF] Marc | RSA Moduli with a Predetermined Portion: Techniques and Applications[END_REF]. Further works in the area include, for instance, [Kno88; Mei91; Shp06]. We will hereafter recall the folklore method described by Joye (Algorithm 40), that perfectly fits our purpose.5 Note: The algorithm's theoretical analysis could be simplified and the failure rate improved if step (4) of Algorithm 40 is replaced by: "If ω is composite then goto 1; else q ← ω". The quality of the generated primes will also become theoretically uniform because NextPrime favors primes p i whose distance from the previous prime p i-1 is large. This modification will, however, come at the cost of more computation time. The same note is applicable to Algorithm 41 as well.

Algorithm 40: "Folklore" Modulus Generation Algorithm

Input: N, H ≤ N/2, n h < 2 H . Output: n = n h 2 N -H + n , such that 0 < n < 2 N -H . 1. Generate a random prime p, such that 2 N -H-1 < p < 2 N -H -1 2. η ← n h 2 N -H 3. ω ← η p 4. q ← NextPrime(ω) 5
. n ← pq 6. return n

Barrett-friendly moduli

We note that both multiplications in Algorithm 38 are multiplications by constants. Namely by n and κ. It is known (e.g. Section 9.1 or [START_REF] Robert | Multiplication by integer constants[END_REF]) that multiplications by constants can be performed faster than multiplications by arbitrary integers. Our goal is to generate a composite n, whose leading bits do not need to be multiplied, and whose associated κ also features a most significant part that does not need to be multiplied. As for the least significant parts of n and κ, these are constants and can hence independently benefit of speedup techniques such as the ones of Section 9.1 or of [START_REF] Robert | Multiplication by integer constants[END_REF]. The algorithm is given for the very common setting L = D = 2N . For convenience we introduce a bitlength unit U such that L = 2N = 4U .

Algorithm 41: Barret-Friendly Modulus Generation Algorithm

Input: L = 2N = 4U . Output: n, an RSA modulus such that 2 N -1 < n < 2 N -1 + (0.7U + 2)(2 U -1) whose associated κ is such that 2 N +1 -2 U +1 (1 + 0.7U ) < κ < 2 N +1 . 1. Generate a random integer r such that 2 U -1 < r < 2 U -1 2. η ← 2 N -1 + r 3. Generate a random prime p such that 2 U -1 < p < 2 U -1 4. ω ← η p 5. q ← NextPrime(ω) 6
= 1ace38e78e29f η = 8000000000001ace38e78e29f p = 322a28626f0a7 ω = 28d356763fe4a q = 51a6acec7fcd5 n = 80000000000a8c93071ac14d9 κ = 1ffffffffffd5cdb3e394fe440
Now observe that r + mp < 2 N -1 , therefore we can write

2 L 2 N -1 + r + mp = 2 2N 2 N -1 + r + mp = 2 N +1 1 1 + 2 1-N (r + mp) = 2 N +1 ∞ =0 (-2) (1-N ) (r + mp)
This series is convergent, alternating, and the term is strictly decreasing, therefore its sum is bounded below (resp. above) by the partial sum of odd (resp. even) degree S . As a consequence,

κ > S 1 -1 = 2 N +1 1 -2 1-N (r + pm) -1 = 2 N +1 -4(r + pm) -1 > 2 N +1 -2 U +1 (1 + m). The fact that r + α + mp > 0 implies 1 2 N -1 + r + α + mp < 1 2 N -1 . Thus: κ ≤ 2 L n = 2 L 2 N -1 + r + α + mp < 2 L 2 N -1 < 2 N +1 .
Upper bounding ω we get:

ω < η p + 1 = 2 N -1 + r p + 1 < 2 N -1 + 2 U -1 2 U -1 + 1 = 2 N -1-U +1 + 1 + 1 < 2 U + 2.
Note that the most significant bit of p must be set to 1, i.e. 2 U -1 < p < 2 U -1.

It follows directly from Lemma 9.5 that:

q = NextPrime[ω] ≤ NextPrime[2 U + 2] = NextPrime[2 U + 1].
Let n h denote the predetermined portion of n, i.e. n h = 2 U -1 . Applying the Prime Number Theorem, we obtain m ln (2 U + 1) 0.7U . Put differently, the log 2 (m + 2) log 2 (0.7U + 2) < log 2 U least significant bits of n h are likely to get polluted. We hence rectify the size of n h to Uτlog 2 U where τ ∈ N is a parameter allowing to reduce the failure probability of Algorithm 41 at the cost of further shortening n h . For the sake of clarity, we do not integrate these fine-tunings in the description of Algorithm 41 but consider that n h is composed of a "real" prescribed pattern n h of size Uτlog 2 U bits right-padded with τ + log 2 U zero bits. Various success rates for N = 1024, U = 512 are given in Table 9.5. Based on those we recommend to set τ = 0 or τ = 1 and re-launch the generation process if the algorithm fails.

It is easy to see that multiplication by both n and κ is not costly at all. To be more specific, n and κ satisfy the inequalities:

2 N -1 < n < 2 N -1 + (0.7U + 2)(2 U -1) and 2 N +1 -2 U +1 (1 + 0.7U ) < κ < 2 N +1 .
As a result, our approach requires only half of the computations. This in effect can double the speed of Barrett reduction.6

Extensions

The method we described can be extended to provide speedups in a variety of settings. As an illustration we apply our approach to accelerate digital signatures computed by DSA.

Barrett-friendly DSA parameters generation

DSA's parameter generation is presented in Algorithm 42. For the complete description of the DSA, we refer the reader to [START_REF] Kerry | Federal information processing standards publication digital signature standard (DSS)[END_REF]. 1. choose a Q-bit prime q 2. choose a P -bit prime p, such that p -1 = 0 mod q 3. return p, q

We suggest a modified DSA prime generation process leveraging the idea of Section 9.3.4. The goal is to generate primes p and q that are multiplication-friendly and such that reduction mod p or mod q is efficient. The procedure is described in Algorithm 43.

1. q ← NextPrime(2 Q-1 ) 2. p ← 4 3. i ← 1 4. F ← 2 P -Q-1 5. while p is composite 6. p ← 2q(F + i) + 1 7. i ← i + 1 8. return p, q
Lemma 9.6 (Structure of κ q ) Let κ q be the κ associated to q. With the notations of Algorithm 43, we have

κ q = 2 Q+1 -4ω, assuming that ω < 2 Q 2 -1 .
Proof: Let z = p-1 q and ω = q -2 Q-1 . We observe that |z| = P -Q and q = 2 Q-1 |ω. By definition, κ q = 2 Lq q , where L q = 2Q. As we assumed ω < 2 Q 2 -1 , using Lemma 9.4 we have:

κ q = 2 L Q q = 2 2Q 2 Q-1 + ω = 2 Q+1 -4ω.
The key consequence of Lemma 9.6 is that κ q consists of a long pattern concatenated to a short different sequence, with a predetermined portion that is the complement of q h = 2 Q-Ω . The computation of κ q is easy.

Lemma 9.7 Let m(n) = 1 8 n + √ n 2 + 2 P +3 n . Let x be a positive integer such that 0 < x < 2 P -1 and m(n) ≤ x < m(n + 1). Then, 2 2P 2 P -1 + x = 2 P +1 -4x + n and 0 ≤ n < 2 P .

Proof:

The proof consists of writing the fraction as a geometric series:

κ = 2 2P 2 P -1 + x = 2 P +1 ∞ n=0 (-x) n 2 n(1-P ) = 2 P +1 1 -2 1-P x + 2 2-2P x 2 -2 3-3P x 3 + . . . = 2 P +1 -4x + 2 3-P x 2 -2 4-2P x 3 + . . .
Now, 2 P +1 -4x is always a positive integer, it can therefore be safely taken out of the floor function. None of the remaining terms of the sum is an integer. We have:

κ = 2 P +1 -4x + ∞ n=2 (-x) n 2 n(1-P ) .
The rightmost term is essentially a sum of shifted versions of powers of x. If x is small, then this contribution quickly vanishes. We have:

κ = 2 P +1 -4x + 2 2-P x 2 2 P -1 2 P -1 + x = 2 P +1 -4x + 4x 2 2 P -1 + x .
For any positive integer n, we have:

4x 2 2 P -1 + x = n ⇔ x = 1 8 n + n 2 + 2 P +3 n .
We assumed x > 0, thus we only need to consider the positive root. The leftmost fraction is a strictly increasing function of x as its derivative is > 0. Therefore, the rightmost formula strictly increases with n.

Let m(n) = 1 8 n + √ n 2 + 2 P +3 n and assume that m(n) ≤ x < m(n + 1). Then, we have:

n ≤ 4x 2 2 P -1 + x < n + 1 Therefore: 4x 2 2 P -1 + x = n.
Finally, x < 2 P -1 implies an upper bound on the value of n, which must therefore be smaller than 2 P .

Example 9.2 An illustrative example for P = 1024 and Q = 160 follows:

ω = 299 i p = 1 L q = 2 • 160 q = 2 159 + 299 κ q = 2 163 -4 • 299 L p = 2 • 1024 = 2 11 p = (2 864 + 2)q + 1 = (2 864 + 2)(2 159 + 299) + 1 x = 2 60 + 299 • 2 864 + 2 • 299 + 1 κ p = 2 71 5 k=0 2 159k (-299) 6-k -2 162 + 2387
Thus, multiplication by p, q, κ p and κ q is easy, and reduction modulo p or q using Barrett's algorithm benefits from the corresponding speedup.

Applying cryptographic techniques to error correction Abstract

Modular reduction is the basic building block of many public-key cryptosystems. BCH codes require repeated polynomial reductions modulo the same constant polynomial. This is conceptually very similar to the implementation of public-key cryptography where repeated modular reductions in Zn or Zp are required for some fixed n or p. It is hence natural to try and transfer the modular reduction expertise developed by cryptographers during the past decades to obtain new BCH speed-up strategies. Error correction codes (ECCs) are deployed in digital communication systems to enforce transmission accuracy. BCH codes are a particularly popular ECC family. This paper generalizes Barrett's modular reduction to polynomials to speed-up BCH ECCs. A BCH(15,7,2) encoder was implemented in Verilog and synthesized. Results show substantial improvements when compared to traditional polynomial reduction implementations. We present two BCH code implementations (regular and pipelined) using Barrett polynomial reduction. These implementations, are respectively 4.3 and 6.7 faster than an improved BCH LFSR design. The regular Barrett design consumes around 53% less power than the BCH LFSR design, while the faster pipelined version consumes 2.3 times more power than the BCH LFSR design. This is joint work with Diana Maimuţ, David Naccache, Rodrigo Portella do Canto, and Emil Simion. This work was presented at SECITC 2015 in Bucharest (Romania) and was published in [GMN + 15], with small modification from the published version.

From modular reduction to polynomial reduction

Modular reduction (e.g. [BGV94; Bri82; Knu69; Mon85]) is the basic building block of many public-key cryptosystems. We refer the reader to [START_REF] Bosselaers | Comparison of Three Modular Reduction Functions[END_REF] for a detailed comparison of various modular reduction strategies.

BCH codes are widely used for error correction in digital systems, memory devices and computer networks. For example, the shortened BCH(48,36,5) was accepted by the U.S. Telecommunications Industry Association as a standard for the cellular Time Division Multiple Access protocol (TDMA) [START_REF] Shparlinski | On RSA Moduli with Prescribed Bit Patterns[END_REF]. Another example is BCH(511, 493) which was adopted by International Telecommunication Union as a standard for video conferencing and video phone codecs (Rec. H.26) [START_REF] Arjen | Generating RSA Moduli with a Predetermined Portion[END_REF]. BCH codes require repeated polynomial reductions modulo the same constant polynomial. This is conceptually very similar to the implementation of public-key cryptography where repeated modular reduction in Z n or Z p are required for some fixed n or p [START_REF] Barrett | Implementing the Rivest Shamir and Adleman Public Key Encryption Algorithm on a Standard Digital Signal Processor[END_REF].

It is hence natural to try and transfer the modular reduction expertise developed by cryptographers during the past decades to obtain new BCH speed-up strategies. This work focuses on the "polynomialization" of Barrett's modular reduction algorithm [START_REF] Barrett | Implementing the Rivest Shamir and Adleman Public Key Encryption Algorithm on a Standard Digital Signal Processor[END_REF]. Barrett's method creates the operation a mod b from bit shifts, multiplications and additions in Z. This allows to build modular reduction at very marginal code or silicon costs by leveraging existing hardware or software multipliers.

Reduction modulo fixed multivariate polynomials is also very useful in other fields such as robotics and computer algebra (e.g. for computing Gröbner bases).

Orders

Definition 9.1 (Monomial Order) Let P, Q and R be three monomials in ν variables. We say that is a monomial order if the following conditions are fulfilled:

• P 1

• P Q ⇒ ∀R, P R QR Example 9.
3 It is straightforward that the lexicographic order on exponent vectors and defined by ν i=1

x ai ν i=1

x bi ⇔ ∃ i, a j = b j for i < j and a i > b i is a monomial order. We denote it by .

Polynomial Barrett complexity

We decompose the algorithm's analysis into steps and determine at each step the cost and the size of the result. Size is measured in the number of terms. In all the following we assume that polynomial multiplication is performed using traditional cross product. Faster (e.g. ν-dimensional FFT [BC99]) polynomial multiplication strategies may grandly improve the following complexities for asymptotically increasing L and ν.

Given our focus on on-line operations we do not count the effort required to compute K (that we assume given). We also do not account for the partial multiplication trick for the sake of clarity and conciseness.

Let 2. K(Q y 0 ).

Because K is the result of the division of h(L) = ν j=1 x L j by P , the leading term of K has an exponent vector equal to Ly 0 . This means that K's second biggest term can be x L-y1,0 1 ν j=2 x L j . Hence, the size of K is size K = O((Ly 1,0 )L ν-1 ). 3. B = (K(Q y 0 )) (Ly 0 ) Definition 9.7 (Dual Code) Given a linear code C ⊂ F n q of length n, the dual code of C (denoted by C ⊥ ) is defined to be the set of those vectors in F n q which are orthogonal7 to every codeword of C, i.e.:

C ⊥ = {v ∈ F n q |v • c = 0, ∀c ∈ C}.

As α i is a root of c(x) for 1 ≤ i ≤ 2t, then c(α i ) = c i α ij . This equality can be written as a matrix product and results in the next property:

Remark. If c = (c 0 , c 1 , . . . , c n-1 ) is a codeword, then the parity-check matrix H of this code satisfies c • H T = 0, where:

H =        1 α α 2
. . . α n-1 1 α 2 (α 2 ) 2 . . . (α 2 ) n-1 1 α 3 (α 3 ) 2 . . . (α 3 ) n-1 . . . . . . . . . . . .

1 α 2t (α 2t ) 2 . . . (α 2t ) n-1       
.

If c • H T = 0, then c(α i ) = 0.

Remark. A parity check matrix of a linear block code is a generator matrix of the dual code. Therefore, c must be a codeword of the t-error correcting BCH code. If each entry of H is replaced by its corresponding m-tuple over F 2 arranged in column form, we obtain a binary parity-check matrix for the code.

Definition 9.8 (Systematic Encoding)

In systematic encoding, information and check bits are concatenated to form the message transmitted over the noisy channel.

The speed-up we described applies to systematic BCH coding only. Consider an (n, k) BCH code. Let m(x) be the information polynomial to be coded and m x n-k = m(x), we can write m (x) as m(x)g(x) + b(x).

The message m(x) is coded as c(x) = m (x)b(x).8 BCH Decoding. Syndrome decoding is a decoding process for linear codes using the parity-check matrix.

Definition 9.9 (Syndrome) Let c be the emitted word and r the received one. We call the quantity S(r) = r • H T the syndrome of r .

If r • H T = 0 then no errors occurred, with overwhelming probability. If r • H T = 0, at least one error occurred and r = c+e, where e is an error vector. Note that S(r) = S(e). The syndrome circuit consists of 2t components in F 2 m . To correct t errors, the syndrome has to be a 2t-tuple of the form S = (S 1 , S 2 , . . . , S 2t ).

Syndrome. In the polynomial setting, S i is obtained by evaluating r at the roots of g(x). Indeed, letting r(x) = c(x) + e(x), we have Error Location. Let X = α j . Then, for binary BCH codes, we have S i = ν j=1 X i . The X 's are called error locators and the error locator polynomial is defined as:

Λ(x) = ν =1 (1 -X ) = 1 + Λ 1 x + • • • + Λ ν x ν .
Note that the roots of Λ(x) point out errors' places and the number of errors ν is unknown.

There are several ways to compute Λ(x), e.g. the Peterson-Gorenstein-Zierler algorithm [START_REF] Daniel Gorenstein | Two-Error Correcting Bose-Chaudhuri Codes are Quasi-Perfect[END_REF], a modification of the Extended Euclidean algorithm [SKH + 75], or the Berlekamp-Massey algorithm [START_REF] Berlekamp | Nonbinary BCH decoding (Abstr.)[END_REF][START_REF] Berlekamp | Algebraic coding theory[END_REF][START_REF] James | Shift-register synthesis and BCH decoding[END_REF]. Chien search [START_REF] Robert | Cyclic decoding procedures for Bose-Chaudhuri-Hocquenghem codes[END_REF] is applied to determine the roots of Λ(x).

The essential observation of the PGZ algorithm (Algorithm 45) is that we have

     S 1 S 2 • • • S ν S 2 S 3 • • • S ν+1 . . . . . . . . . . . . S ν S ν+1 • • • S 2ν-1           Λ ν Λ ν-1 . . . Λ 1      =      -S ν+1 -S ν+2 . . . -S 2ν     
so that we can determine Λ k by inverting the left-hand side Toeplitz matrix. The only difficulty is that ν is a priori unknown, but this is not a deep issue as it can be determined automatically.

Algorithm 45: Peterson-Gorenstein-Zierler Algorithm Input: v(x) the received polynomial. Output: ν, Λ.

1. for j = 1, . . . , 2t, set Sj ← v(α j+j 0 -1 ).

2. set ν ← t.

3. set M ← Mν , the ν × ν matrix consisting of the top-left corner of S 4. if det(M ) = 0, set ν ← ν -1 and go to previous step. Otherwise, proceed to next step.

5. set (Λν , Λν-1, . . . , Λ1) T ← M -1 (-Sν+1, -Sν+2, . . . , -S2ν ) T .

return ν, Λ

Chien's error search. Chien search finds the roots of Λ(x) by brute force [START_REF] Brickell | A Fast Modular Multiplication Algorithm With Application To Two Key Cryptography[END_REF][START_REF] Robert | Cyclic decoding procedures for Bose-Chaudhuri-Hocquenghem codes[END_REF]. The algorithm evaluates Λ(α i ) for i = 1, 2, . . . , 2 m -1. Whenever the result is zero, the algorithm assumes that an error occurred, thus the position of that error is located. A way to reduce the complexity of Chien search circuits stems from Equation (9.3) for Λ(α i+1 ).

Λ(α

i ) = 1 + σ 1 α i + σ 2 (α i ) 2 + • • • + σ t (α i ) t = 1 + σ 1 α i + σ 2 α 2i + • • • + σ t α it (9.3) Λ(α i+1 ) = 1 + σ 1 α i+1 + σ 2 (α i+1 ) 2 + • • • + σ t (α i+1 ) t = 1 + α (σ 1 α i ) + α 2 (σ 2 α 2i ) + • • • + α t (σ t α it )
Implementation and results. To evaluate the efficiency of Barrett's modular division in hardware, the BCH(15, 7, 2) was chosen as a case study code. Four BCH encoder versions were designed and synthesized. Results are presented in detail in the coming sections.

Standard architecture. The BCH-Standard architecture consists of applying the modular division using shifts and XORs. Initially, to determine the degree of the input polynomials, each bit9 of the dividend and of the divisor are checked until the first bit one is found. Then, the two polynomials are left-aligned (i.e., the two most significant ones are aligned) and XORed. The resulting polynomial is right shifted and again left-aligned with the dividend and XORed. This process is repeated until the dividend and the resulting polynomial are right-aligned. The final resulting polynomial represents the remainder of the division. Algorithm 46 provides the pseudocode for the standard architecture. ) and the input data. The feedback connections are defined by the generator polynomial g(x). In the case of BCH(15, 7, 2), g(x) = x 8 + x 7 + x 6 + x 4 + 1, therefore the input of registers d 0 , d 4 , d 6 and d 7 are XORed with the feedback value. As shown in Figure 9.1, the multiplexer that selects the bits to compose the final codeword is controlled by the counter. The LFSR is shifted k times with the feedback connections enabled. After that, the LFSR state contains the result of the modular division, therefore the bits can be serially shifted out from the LFSR register.

To calculate the correct codeword, the LFSR must shift the input data during k clock cycles. After that, the output is serially composed by nk extra shifts. This means that the LFSR implementation's total latency is n clock cycles. Nevertheless, it is possible to save nk -1 clock cycles by outputting the LFSR in parallel from the sub-module to the control unit after k iterations, while during the k first cycles the input data is shifted to the output register, as we perform systematic BCH encoding. This decreases the total latency to k + 1 clock cycles. This method was applied to the BCH-LFSR-improved design depicted in Figure 9.2.

Barrett architecture. The LFSR submodule can be replaced by the Barrett submodule to evaluate its performance. The idea is that Barrett operations can be broken down into up to k + 1 pipeline stages, to match the LFSR's latency. The fact that Barrett operations can be easily pipelined drastically increases the final throughput, while both LFSR implementations do not allow for pipelining. In the Barrett submodule, the constants y 0 , L, and K are pre-computed and are defined as parameters of the block. Since the Barrett parameter P is defined as the generator polynomial, P does not need to be defined as an input, which saves registers. As previously stated, Barrett operations were cut down to k iterations (in our example, k = 7). The first register in the pipeline stores the result of Q y 0 . The multiplication by K is the most costly operation, taking 5 clock cycles to complete. Each cycle operates on 3 bits, shifting and XORing at each one bit of K, according to the rules of multiplication. The last operation simply computes the intermediate result from the multiplication left-shifted by Ly 0 .

Performance. As mentioned previously in this thesis, the gate equivalent (GE) metric was calculated by dividing the total cell area of each design by the size of the smallest NAND-2 of the digital library. This metric allows comparing area figures without the impact of the technology node size. BCH-Barrett presented comparable area with the smallest design, the BCH-LFSR. Although the BCH-Barrett does not reach the maximum clock frequency, it can be seen from Table 9.6 that it actually reaches the best throughput, around 2.3 Gbps. This is mainly achieved by Barrett parallelizable operations, allowing the design to be easily pipelined. Moreover, Barrett consumes the less power among the four designs.

Regulating the pace of von Neumann correctors Abstract

In a famous paper published in 1951 [START_REF] John Von Neumann | Various techniques used in connection with random digits[END_REF], von Neumann presented a simple procedure allowing to correct the bias of random sources. This procedure introduces latencies between the random outputs. On the other hand, algorithms such as stream ciphers, block ciphers or even modular multipliers usually run in a number of clock cycles which is independent of the operands' values: Feeding such hardware blocks with the inherently irregular output of such de-biased sources frequently proves tricky, and is challenging to model at the HDL level.

We propose an algorithm to compensate these irregularities, by storing or releasing numbers at given intervals of time. This algorithm is modelled as a special queue that achieves zero blocking probability and a near-deterministic service distribution (i.e. of minimal variance).

While particularly suited to cryptographic applications, for which it was designed, this algorithm also applies to a variety of contexts and constitutes an example of queue for which the buffer allocation problem can be solved. This is joint work with Houda Ferradi, Diana Maimuţ, David Naccache, and Amaury de Wargny. It has been published in the Journal of Cryptographic Engineering [FGM + 17].

Introduction

A queue with random arrival times, yet fixed output rate is known in queuing theory as a G/D/1 queue10 [Ken53; GOW04]. The number of packets in the system at any given time t is some integer X t ∈ N; New packets arrive at times T a that follow some distribution A, and stay in the system until processed; A packet is processed at some deterministic rate µ. It is well known that if the queue has some maximal capacity K -in Kendall's notation [START_REF] Kendall | Stochastic processes occurring in the theory of queues and their analysis by the method of the imbedded Markov chain[END_REF] it is a G/D/1/K queue -then if at some point the queue gets full, any further incoming packets must be dropped.

Such events happen with probability p K , called the queue's blocking probability [START_REF] Kleinrock | Queuing systems[END_REF][START_REF] Balsamo | Analysis of queueing networks with blocking[END_REF]. A famous open problem in queuing theory is to solve the buffer allocation problem (BAP, see [START_REF] Demir | The State of the Art on Buffer Allocation Problem: A Comprehensive Survey[END_REF]):

[BAP] : "Given > 0, find optimal values for K such that p K < " The BAP is usually described as an integer programming problem involving non-linear functions of stochastic variables [START_REF] Macgregor | The buffer allocation problem for general finite buffer queueing networks[END_REF]. Very few exact solutions are known, and approximate solutions (e.g. [SP00; SCH00; SCH95; NAN06]) are not always sufficient for practical purposes.

In this paper we propose a radical change in perspective: Instead of assuming a G/D/1/K queue, and solving for K, we will fix K in advance, and construct a distribution S K which is "as close as possible" to deterministic, i.e. such that Var(S K ) is minimal, while minimizing the blocking probability. For such a "G/S K /1/K" queue, which we call a regulator, the BAP is solvable and we can achieve zero blocking probabilities for typical families of arrival distributions, and any queue capacity K > 0.

As a side-effect however, we do not keep the time spent by a packet inside the system to a minimum, i.e. the price to pay for this lower variance is a somewhat longer average service time E[S K ].

We will mostly be interested in situations where the arrival time T a is distributed according either to a Poisson distribution of rate λ, a geometric distribution of parameter p, or a general positive distribution A with compact support. One key application of our construction is the steady generation of random numbers from a biased physical source.

Motivation: Median regulator for Poisson inputs

To motivate our discussion we first analyze in some detail M/G/1 queues: In this setting, the arrival distribution is Markovian, i.e. follows some Poisson distribution with rate λ. The M/G/1 queue was completely solved by Pollaczek in 1930 [Pol30a;Pol30b] and provides explicit formulas for most interesting parameters. According to the Pollaczek-Khinchine formula [Khi32] and Little's theorem [START_REF] John | A proof for the queuing formula: L = λW[END_REF], the mean queue length is given by This description doesn't account however for the variance of X around this expected value. The reason for X to wander around X is that sometimes packets arrive "early", i.e. they cannot be processed right away and have to be stored in the queue; and sometimes they arrive "late", i.e. some old packets were processed before the new packet arrived. Let ν denote the median of T a , so that by definition P r[T a > ν] = Pr[T a < ν] = 1/2. This leads us to choose S such that µ = ν: On average, every incoming packet corresponds to an outgoing packet. This results in the M/D/1/K queue with the longest average time-to-overflow (or underflow) provided the queue is initialized with X = K/2 packets at the start. We call this construction the median regulator with Poisson inputs.

X = λE[S] + λ 2 E[S 2 ] 2(1 -λE[S]) (9.
To see that this holds note that the probability that X is larger than some value x can again be expressed from the Pollaczek-Khinchin generating function [START_REF] Khinchine | Mathematical theory of a stationary queue[END_REF]:

π(z) = (1 -z)(1 -ρ)g(λ(1 -z)) g(λ(1 -z)) -z (9.7)
where g is the Laplace transform of T a 's distribution function. The probabilities π n = Pr[X = n] in the steady-state regime are given by the Taylor expansion of π(z) and we get:

Pr[X > x] = 1 -(1 -ρ) x n=0
ρ n (nx) n n! e -ρ(n-x) (9.8) which solely depends on the load parameter ρ = λ/µ. When x is large, this distribution is almost exponential.

Of course, once this queue overflows (or underflows) it takes a long time to recover. The larger K, the longer it will take before a problem occurs -yet we know that problems will occur, eventually. The buffer allocation problem consists in adjusting K so that the overflow probability falls below some prescribed threshold .

With the median regulator, the queue length undergoes a random walk. Therefore, on average, this regulator reaches an error state after receiving O( √ m) packets, and it takes as long to go back to its initial state. This is essentially the best one could hope for, if the service distribution is indeed kept deterministic and constant. But as we now discuss it is possible to do much better by relaxing these assumptions.

Adaptive regulators

The key idea of our construction is that the service time can usually be artificially slowed down on purpose, so as to guarantee a steadier outflow.

In all generality we write S t the service distribution at time t and assume the inter-arrival time distribution A is known and stationary. A regulator is a G/G/1 queue where service time distribution S t is governed by some function R, such that S t = R(X t , K, A). The median regulator corresponds to the choice: R(x, y, A) = Median(A). (9.9)

We already observed that if the queue is half-full this is the best choice. Two other limiting scenarios can be considered: If the queue is full, then the service should be as fast as possible to try and make room for new packets to arrive; If the queue is empty, then incoming packets should be stored instead and service time is purposely slowed down as much as possible. In other terms: R(0, K, A) = t max , (9.10) R(K/2, K, A) = t 1/2 , (9.11) R(K, K, A) = t min , (9.12)

Lagrange regulators

In light of Section 9.5.3, we might also simplify the design of a regulator to keep the "learning" phase to a minimum. The simplest way to achieve this is to take the constraints of Equations (9.10) to (9.12) as control points and choose as function R the lowest-degree polynomial that satisfies these equalities: It is a Lagrange polynomial whose coefficients depend entirely on an estimation of t min , t 1/2 , and t max . Let The learning phase with that scenario consists in estimating t min , t 1/2 , and t max . If we know that the input distribution belongs to some parametrised family, we may simply estimate the parameters from data using e.g. expectation-maximisation. Otherwise, we may use direct estimates, such as the sample minimum, maximum and median. Such estimates are not perfect -it is well known for instance that there does not exist any unbiased estimator of the median for general distributions. However in practice this is often an acceptable compromise. However, if the von Neumann generator receives biased input bits at a regular interval, the unbiasing causes delays and as a result the output distribution is not regular anymore. In fact in that case the output follows a Poisson distribution. A regulator R, adapted to this distribution, can be installed between the corrector C and the randomness consumer to absorb this variability (see Figure 9.3), so that the randomness consumer receives a steadier input. The reason why we need a regulator is that cryptographic hardware is usually synchronous. Algorithms such as stream ciphers, block ciphers or even modular multipliers usually run in a number of clock cycles which is independent of the operands' values. Designing hardware to accept such inherently irregular inputs from C frequently proves tricky 11 .

Application: Regulated von Neumann generators

Note that in practice true random number generators implement large buffers, which are aimed to be full most of the time, so as to provide large arrays of random bits at once. These buffers are compatible with our design (provided they are placed after the regulator), and benefit from the easier implementation. Therefore, it is possible to address both the steady-flow generation of random numbers, and the problem of burst accesses.

The latter point highlights that FIFO-like solutions are complementary, but not equivalent, to regulators. Trying for instance to replace the regulator by a FIFO queue, one would need to adjust the queue size to both the randomness generator and consumer, and blocking probabilities could only be adjusted provided that both generation and consumption behaviours are known.

Description as an event-driven automaton

The regulators we describe in this paper can be expressed in the language of event-driven automata. Such a device has access to the following primitives:

• Push(a) pushes a on the stack M.

• Pop() pops an object a from the stack and emits it to F.

• Stack() returns the number of objects currently stored in M.

• Signal(t) registers an event listener EventSig (see below) to be called after time t has elapsed.

The events are:

• EventSig is called when time t has elapsed since the call of Signal(t).

• ObjIn(a) is called when an object is received from G.

• Setup is called once at initialization.

• Error is called upon errors.

R is inactive between events: it is entirely characterized by describing what it does when events occur.

The regulator's functionality is achieved by using the event handlers described in Algorithms 47 to 49. For the sake of simplicity, we allow R to use a single global variable s for its operation which we do not count as part of M in the following discussion. We purposely leave the error handler unspecified.

At setup time, the variable s is set to some prescribed value t max meant to be the maximum acceptable waiting time before a packet is received. This value thus depends on the input distribution, but in practice can always be set to a large enough value. The choice of µ in Algorithm 49 corresponds to the different regulator constructions we described. For instance, the median regulator is given by the choice of a constant function µ(x) = Median(A).

Numerical simulation

The event-driven description lends itself nicely to numerical simulation: Only reception and emission events are considered, which allows for an exact solution (in particular, there is no timer involved). Arrival times are simulated by inverse sampling of a given distribution. The source code is provided in Appendix B.3 for a Lagrange regulator with uniform input.

Uniform input distribution

Numerical simulations can be performed in a first time on a uniform input distribution, which lends itself to easier interpretation and constitutes a first ground on which to compare implementation and theory. The results of using a regulator are illustrated in Figure 9.4.

We choose a certain amount of memory K and run the simulation for n K packets. The output distribution is then measured. After some warming-up time (which is of the order of K/2), the output distribution reaches a steady state distribution peaked around a central value µ with a much smaller variance than the inter-arrival time distribution. A larger memory K results in a narrower distribution: Figure 9.5 shows the evolution of variance and interquartile range (IQR) as a function of K.

Statistical dispersion around µ decreases quickly as K increases: log log IQR decreases almost linearly with K. Both standard deviation and IQR reach a minimum value. IQR decreases faster than standard deviation, which yields a distribution with higher kurtosis as K increases. These observations are consistent across various parameter choices.

Geometric input distribution

The output times of the von Neumann corrector follow a geometric distribution. Since this distribution is not compactly supported, we define a cut-off value t max .

We use the random.geometric function from numpy to automatically generate sequence of appropriately distributed arrival times (t i ), with a cut-off at 2 80 for the distributional regulator. The cut-off incurs a non-zero (albeit negligible) failure probability, that must be dealt with: When an exceptionally large delay occurs, the degraded operation simply consists in outputting the late object as soon as it arrives. This did not occur during the simulation, however.

Results of a simulation with a geometric input distribution of parameter p are similar to the uniform case, with a compact-supported output distribution concentrated around a value µ slightly larger than µ = 1/p. Using a too small cut-off value causes the regulator to underflow, and in extreme cases we get a situation identical to a regulator-less setting. For p = 1/2, memory usage stabilised around K/4, confirming the theoretical result of Equation (9.17).

Conclusions and further investigations

In this paper we described a new algorithm allowing to regulate the throughput of G/D/1 queues, with applications to the efficient implementation of von Neumann correctors. The method requires little memory -in fact, how much memory is available to regulation is a parameter -and does not entail any complex calculations during regulation. The very simple nature of our regulator allows for efficient implementations, so that we achieve execution times much shorter than the time interval between successive samples.

Beyond the security applications of the new regulation method the analysis done in this paper is interesting by its own right as it constitutes an instance of the buffer allocation problem for which finding solutions is easy. We can also imagine several industrial settings, where the ability to guarantee a steadyflow input of objects could streamline manufacturing processes: As an example, cryptographic signature generation may take a variable amount of time, thereby preventing further manufacturing steps to happen, with delays all across the assembly line. We can hope that using our approach to regulation could prove effective in such situations. This work also opens many questions that call for further investigation. The effect of regulators with longer decision delays could be much harder to model, but should probably be taken into account when dealing with industrial applications. The dynamics of composition, where several regulators are assembled in a daisy-chain fashion, should also be addressed mathematically, although experimental evidence suggests this only cause additional, mild delays. As observed in the above section, the results depend somewhat on the input distribution A. While the cases of practical interest are covered here, and numerical simulation seems to argue in favour of robustness, it could be interesting to further study regulators' performance from a theoretical point of view: In particular, it seems that for large enough values of K the steady output distribution in the long-term is independent of the input distribution, provided that the latter is compactly supported and has some given mean. Whether this is indeed the case of simply an artifact of our experiments calls for further investigation.

• An algorithm µ, taking as input some message m ∈ M, as well as some public parameters params ∈ P, and outputting c ∈ C.

• An algorithm µ -1 , taking as input c ∈ C as well as parameters params ∈ P, and outputting m ∈ M ∪ {⊥}.

The ⊥ symbol indicates that decoding failed. Definition 10.2 (Correction Capacity) Let (µ, µ -1 , M, C, P) be an error-correcting code. There exists an integer t ≥ 0 and some parameters params ∈ P such that, for all e ∈ {0, 1} n such that h(e) ≤ t, µ -1 (µ (m, params) ⊕ e, params) = m, ∀m ∈ M and for all e such that h(e) > t, µ -1 (µ (m, params) ⊕ e, params) = m, ∀m ∈ M.

t is called the correction capacity of (µ, µ -1 , M, C, P).

Definition 10.3 A code of message length k, of codeword length n and with a correction capacity t is called an (n, k, t)-code. The ratio ρ = n k is called the code's expansion rate.

A new error-correcting code

Consider in this section an existing (n, k, t)-code C = (µ, µ -1 , M, C, P). For instance C can be a Reed-Muller code. We describe how the new (n , k, t)-code C = (ν, ν -1 , M, C , P ) is constructed.

Parameter generation: To correct t errors in a k-bit message, we generate a prime p such that:

2 • p 2t k < p < 4 • p 2t k (10.1)
As we will later see, the size of p is obtained by bounding the worst case in which all errors affect the end of the message. p is a part of P .

Encoding: Assume we wish to transmit a k-bit message m over a noisy channel. Let γ = 2 so that m i denote the i-th bit of m, and define: Note that since h(m ⊕ m) ≤ t, we have that a and b are strictly smaller than (p k ) t . Theorem 10.1 from [START_REF] Pierre-Alain Fouque | CryptoComputing with Rationals[END_REF] shows that given t the receiver can recover a and b efficiently using a variant of Gauss' algorithm [START_REF] Vallée | Gauss' Algorithm Revisited[END_REF]. As 0 ≤ a ≤ A and 0 < b ≤ B where A = B = (p k ) t -1 and 2AB < p from Equation (10.1), we can recover a and b from t in polynomial time. Then, by testing the divisibility of a and b with respect to the small primes p i , the receiver can recover m ⊕ m and eventually m.

A numerical example is given in Section 10.1.6.

Bootstrapping: Note that instead of using an existing code as a sub-contractor for protecting c(m), the sender may also recursively apply the new scheme described above. To do so consider c(m) as a message, and protect c = c(c(• • • c(c(m))), which is a rather small value, against accidental alteration by replicating it 2t + 1 times. The receiver will use a majority vote to detect the errors in c. The total output length of the new error-correcting code is therefore log 2 p, plus the length k of the message m. C outperforms the initial error correcting code C if, for equal error capacity t and message length k, it outputs a shorter encoding, which happens if n < n, keeping in mind that both n and n depend on k. But n(k ) ≥ δk , hence

(δ -1)k ≥ δk ⇒ k ≥ k δ (δ -1)
.

Comparison with the binary case is complicated by the fact that here t refers to the number of any errors regardless their semiologic meaning. In other words, an error transforming a 0 into a 2 counts exactly as an error transforming 0 into a 1.

Example 10.1 As a typical example, for t = 7, κ = 10 6 and γ = 3, p κ = 15485863 and p is a 690-bit number.

For the sake of comparison, t = 7, k = 1584963 (corresponding to κ = 10 6 ) and γ = 2, yield p k = 25325609 and a 346-bit p.

Improvement using smaller primes

The construction described in the previous section can be improved by choosing a smaller prime p, but comes at a price; namely decoding becomes only heuristic.

• Parameter generation: The idea consists in generating a prime p smaller than before. Namely, we generate a p satisfying :

2 u • p t k < p < 2 u+1 • p t k (10.9)
for some small integer u ≥ 1.

• Encoding and Decoding: Encoding remains as previously. The redundancy c(m) being approximately half as small as the previous section's one, we have :

s = a b mod p,      a = (m i =1)∧(mi=0) p i b = (m i =0)∧(mi=1)
p i (10.10)

and since there are at most t errors, we must have :

a • b ≤ (p k ) t (10.11)
We define a finite sequence {A i , B i } of integers such that A i = 2 u•i and B i = 2p/A i . From Equations (10.9) and (10.11) there must be at least one index i such that 0 ≤ a ≤ A i and 0 < b ≤ B i . Then using Theorem 10.1, given A i , B i , p and s, the receiver can recover a and b, and eventually m.

The problem with this approach is that we lost the guarantee that {a, b} is unique. Namely we may find another {a , b } satisfying Equation (10.10) for some other index i . We expect this to happen with negligible probability for large enough u, but this makes the modified code heuristic (while perfectly implementable for all practical purposes). Proof: Using Equation (10.9) and the prime number theorem.

Thus, the smaller prime variant has a shorter c(m).

As u is a small integer (e.g. u = 50), it follows immediately from Equation (10.1) that, for large n and t, the size of the new prime p will be approximately half the size of the prime p generated in the preceding section.

This brings down the minimum message size k above which our construction provides an improvement over the bare underlying correcting code.

Note:

In the case of Reed-Muller codes, this variant provides no improvement over the technique described in Section 10.1.3 for the following reasons: (1) by design, Reed-Muller codewords are powers of 2; and (2) Equation (10.12) cannot yield a twofold reduction in p. Therefore we cannot hope to reduce p enough to get a smaller codeword.

That doesn't preclude other codes to show benefits, but the authors did not look for such codes.

Prime packing encoding

It is interesting to see whether the optimization technique of [START_REF] Chevallier-Mames | Linear Bandwidth Naccache-Stern Encryption[END_REF] yields more efficient ECCs. Recall that in [START_REF] Chevallier-Mames | Linear Bandwidth Naccache-Stern Encryption[END_REF], the p i s are distributed amongst κ packs. Information is encoded by picking one p i per pack. This has an immediate impact on decoding: when an error occurs and a symbol σ is replaced by a symbol σ , both the numerator and the denominator of s are affected by additional prime factors. Let C = (µ, µ -1 , M, C, P) be a t-error capacity code, such that it is possible to efficiently recover c from µ(c) ⊕ e for any c and any e, where h(e) ≤ t. Let γ ≥ 2 be a positive integer.

Before we proceed, we define κ := k/ log 2 γ and f := f (γ, κ, t) = k i=k-t p γi .

• Parameter generation:

Let p be a prime number such that:

2 • f 2 < p < 4 • f 2 (10.13)
Let Ĉ = M × Z p and P = (P ∪ P) × N. We now construct a variant of the ECC presented in Section 10.1.3 from C and denote it Ĉ = ν, ν -1 , M, Ĉ, P .

• Encoding:

We define the "redundancy" of a k-bit message m ∈ M (represented as κ digits in base γ) by: ĉ(m) := • Decoding:

The received information α differs from ν(m) by a certain number of bits. Again, we assume that the number of these differing bits is at most t. As h(e) = h(e m ) + h(e ĉ) ≤ t, we have that a and b are strictly smaller than f (γ, κ) 2t . As A = B = f (γ, κ) 2t -1, we observe from Equation (10.13) that 2AB < p. We are now able to recover a, b, gcd(a, b) = 1 such that s = a/b mod p using lattice reduction [START_REF] Vallée | Gauss' Algorithm Revisited[END_REF].

Testing the divisibility of a and b by p 1 , . . . , p κγ the receiver can recover e m = m ⊕ m, and from that get m = m ⊕ e m . Note that by construction only one prime amongst γ is used per "pack": the receiver can therefore skip on average γ/2 primes in the divisibility testing phase. Again, the total output length of the new error-correcting code is n = k + |p|.

Plugging γ = 3, κ = 10 6 and t = 7 into Equation (10.13) we get a 410-bit p. This improves over Example 10.1 where p was 690 bits long.

Toy example

Let m be the 10-bit message 1100100111. For t = 2, we let p be the smallest prime number greater than 2 • 29 4 , i.e. p = 707293. We generate the redundancy:

c(m) = 2 1 • 3 1 • 5 0 • 7 0 • 11 1 • 13 0 • 17 0 • 19 1 • 23 1 •

High-rank elliptic curves and applications to cryptography Abstract

Elliptic curves over finite fields are now a staple of cryptology, both in designing cryptosystems and digital signatures, and in cryptanalysis where ECM provides a very useful factorisation algorithm. Less interest was drawn, however, to the uses one could make of elliptic curves over fields of characteristic zero. One reason is certainly the lack of applications for such objects, and the difficulty of representing arbitrary-precision numbers on hardware.

An admittedly far-fetched but nevertheless open question is whether the Naccache-Stern knapsack cryptosystem (see e.g. Section 5.1) can be adapted to work on elliptic curves, where knapsack-resolution techniques are fewer than in finite fields.

We suggest that a possible approach to this is to encode information in the curve over the rationals. Doing so requires constructing high-rank curves, a difficult problem. It turns out that we can consider hyperelliptic curves in that context, for which the construction of high-rank groups is somewhat easier.

While the following discussion does not fully answer our underlying cryptographic motivation, it may serve as a basis for further investigation.

Introduction

Mordel [START_REF] Joel | On the rational solutions of the indeterminate equations of the third and fourth degrees[END_REF] proved that the set E(Q) of rational points of an elliptic curve has the structure of an abelian group, and that this group is finitely generated. In other terms, E(Q) T × Z r where T is a finite abelian group (the 'torsion group' of E), and the non-negative integer r is called the rank of E. Mazur [Maz77; MG78] showed4 that there are only fifteen possible groups T , which are the groups for which there is a rational modular curve parametrising elliptic curves E with an embedding T into E(Q). It is conjectured, but not proven, that the ranks r of elliptic curves over Q are unbounded.

The status and distribution of r, however, is much less clear. Recent5 efforts have brought elliptic curves of rank at least 28, using a detour through K3 surfaces and a combination of ingenious tricks. The general strategy is to start from a parametrised family of curves (or equivalently from a well-chosen elliptic surface), for instance curves over Q(t), and find candidates by specialisation, i.e. choosing specific values of t 0 (this is referred to, below, as 'Mestre's method'), as well as generically independent points P 1 , . . . , P r . Algebraic tricks can be used to gain one, sometimes two additional degrees (see [START_REF] Elkies | Three lectures on elliptic surfaces and curves of high rank[END_REF] for details).

What makes things technically challenging is that there is no known systematic way to establish the exact rank of a given curve. Rather, in some specific cases, lower and upper bounds can be computed and guide a sieving procedure. This is used in combination with a Birch-Swinnerton-Dyer [SB65] heuristic, which claims equality between the analytic and algebraic rank, i.e., between the curve's L-function behaviour near 0 and the rank ('Mestre's heuristic').

It is noteworthy that in the record-holding curves, the torsion group is trivial. Table 10.4 records the highest-rank elliptic curves explicitly published in the literature (Néron, for instance, proved the existence of rank 10 curves but did not provide any example, so he does not appear in that list).

Note that Table 10.4 gives in many cases lower bounds, as the rank is not known exactly in many cases; however it is very improbable that the rank is higher.

Mestre's method.

The main strategy is to design the sought-after curve over an extension of the target field, namely Q(t)or in the case of hyperelliptic curves, Q(t 0 , . . . , t N ) -so that the curve has high rank over that extension, and then invoke a specialisation theorem of Néron-Silverman-Tate to get an infinite family of high-rank curves over Q. The main concern is only to be careful and choose values t i that are distinct, and do not cause the curve to become singular.

The true challenge, after these preliminary steps, is to prove a lower bound on the rank, and this is best achieved by exhibiting a set of independent points.

Explicit construction of high-rank curves

In this following section we give explicit coordinates for these points, and prove their independence by invoking their Néron-Tate height, a topic we shall discuss in more detail later.

However this approach has its drawbacks: In order to provably achieve large ranks we need to increase the curve's genus. As a result we get hyperelliptic curves, rather than elliptic curves. This is problematic in a cryptographic setting if one wishes to design DLP-based schemees on such curves, as efficient index calculus methods are known on curves of genus g ≥ 3 [GTT + 07; EGT11]. Since our focus is on the infinite subgroups, we may not have to worry about this, as other cryptosystems may be designed in these subgroups that are immune to such work.

Let k be a field of characteristic = 2. Consider e(x) a monic polynomial of degree n, f (x) a polynomial of degree at most n -1, both having coefficients in k, and write

Φ(x) = N i=1 (x -u i ) = e(x) 2 -f (x)
where N = 2n. Now let us define three curves:

Γ 1 : y 2 = f (x), Γ 2 : y 2 = xf (x), Γ 3 : Y 2 = f (X 2 ).
Letting t 1 , . . . , t N be algebraically independent elements over k, we take u i = t 2 i , and define the following extensions: K = k(t 1 , . . . , t N ), K 1 = k(u 1 , . . . , u N ) ⊂ K K 0 = k(c 1 , . . . , c N ) ⊂ K 1 F = k(a 0 , . . . , a n-1 ) ⊂ K 0

Here, c i is the coefficient of x N -i in Φ, and a i is the coefficient of x n-i-1 in f . Also note that

dim k K = dim k K 1 = dim k K 0 = 2 dim k F = 2n.
The curves Γ 1 , Γ 2 , Γ 3 are defined over F , and have genus g 1 , g 2 , and g 3 respectively. There are two cases, depending on the parity of n: n = 2g 1 + 2, g 1 = g 2 , g 3 = 2g 1 if n is even n = 2g 1 + 3, g 2 = g 1 + 1, g 3 = 2g 1 + 1 if n is odd in both cases, g 1 + g 2 = g 3 and n = g 3 + 2.

The curve Γ 1 has, by design, N obvious rational points P i over K 1 :

P i = (u i , e(u i )), 1 ≤ i ≤ N.
Similarly, Γ 3 has 2N obvious rational points P ± i over K, with coordinates:

P ± i = (±t i , e(t 2 i )), 1 ≤ i ≤ N
Let φ : (x, y) → (X 2 , Y ) defined over F (it is a morphism), then φ( P ± i ) = P i . This shows that Γ 3 is a double cover of Γ 1 ; but Γ 3 is also a double cover of Γ 2 via ψ : (x, y) → (X 2 , XY ). As a result, we get N rational points on Γ 2 over K:

Q i = ψ( P ± i ) = (t 2 i , t i e(t 2 i )), 1 ≤ i ≤ N.
Independence of the points. We now make use of the following result of Shioda-Mori [Shi98; Mor76]: Theorem 10.5 Let J i be the Jacobian variety associated to Γ i over F . Then for any finitely generated extension F of F , J(F ) is finitely generated.

As a corollary, rank J 3 (K) = rank J 1 (K) + rank J 2 (K)

≥ rank P i + rank Q i
The next step is to measure how independent the P i (resp the Q i ) are. We assume from now on that n is even. In that situation Γ 1 has a unique point O at x = ∞, which is a F -rational point; we therefore embed Γ 1 into J 1 so that O is mapped to the origin of the group law on J 1 . Considering the function α = ye(x) on Γ 1 , which only has poles at O, we have y = e(x) for any P = (x, y) in (α) 0 = P 1 + • • • + P N , and x = u i for some i (hence P = P i ); thus the associated divisor of zero is indeed (α) 0 . This also shows that each P i occurs with muliplicity 1, and we have

P 1 + • • • + P N = O in J 1 (10.15)
Now, the theory of Néron-Tate (or 'canonical') height [START_REF] Néron | Quasi-fonctions et hauteurs sur les variétés abéliennes[END_REF] [Lan13, Chapter 11] associates each point P with a 'height' h(P ). Furthermore, h(P ) is a positive semi-definite quadratic function up to some bounded function, i.e., h(P ) = P, P + O(1) where •, • is a symmetric bilinear pairing called the height pairing. A key property of this pairing (see, e.g., [Sil07, Theorem 3.6]) is that if a curve A is defined on K, and if we consider K a finite Galois extension of K on which A is defined, then P σ , Q σ = P, Q , P, Q ∈ A(K ), σ ∈ Gal(K /K)

In our case, Gal(K 1 /K 0 ) is the symmetric group S N . Hence, from the property above we get P i , P i = a, and P i , P j = b (i = j)

Now P 1 , i P i = a + (N -1)b = 0 by Equation (10.15). Hence b = -a/(N -1). The corresponding height matrix is therefore the circulant

H = a N -1      N -1 -1 • • • -1 -1 N -1 • • • -1 . . . . . . . . . . . . -1 -1 • • • N -1     
One easily check that det H = 0, and that its principal minor of size N -1 is positive definite. If we can prove that a > 0 then this shows that the N points P i generate a subgroup of rank N -1.

To do this, assume for the sake of argument that a = 0, so that every P i is a torsion point, i.e., there exists an m > 0 such that mP i = 0. Let F be the extension of F obtained by adjoining all m-torsion points of J 1 to F . F is a finite algebraic extension of F , hence has same dimension as F over k, i.e. dim k F = dim k F = n. But by definition P i = (u i , e(u i )) and therefore F ⊃ F (P 1 , . . . , P N ) ⊃ k(u 1 , . . . , u N ) which would imply that F has dimension at least N = 2n: this is a contradiction. Hence a > 0.

Let's now turn our attention to Γ 2 , which always has an F -rational point (0, 0) that we can take as the origin for J 2 . Since G = Gal(K/K 0 ) acts transitively on ±Q i , we have as before that Q i , Q i = a, and Q i , Q j = b for all i = j. However, if we take σ ∈ G such that σ(t 1 ) = -t 1 and σ(t i ) = t i for all i > 1, then

Q σ i = -Q 1 , Q σ i = Q i (i > 1)
which immediately shows b = -b, hence b = 0. By the same argument as before, we also have a > 0. Therefore the N points Q i are mutually independent and generate a subgroup of rank N .

Using the remark at the beggining of this subsection, this shows that

rank J 3 ≥ N + N -1 = 2N -1 = 4n -1 = 4g 3 + 7.
For instance, a rank 127 curve can be obtained from this construction, and it has genus 30.

Néron-Tate height on hyperelliptic curves

We now turn our attention to the computation of the Néron-Tate height of points on the Jacobian of a curve. For curves of genus 1, a classical approch makes use of explicit equations for projective embeddings of Jacobians. This has been extended by Cassels-Flynn-Smart-Stoll [CF96; FS97] to genus 2. However possible [START_REF] Stoll | Explicit Kummer Varieties for Hyperelliptic Curves of Genus 3. Théorie des nombres et applications[END_REF], this method is unwieldy for genus 3 [Stu00; Mül14]. Computing height explicitly is possible, although we do not have closed formulas available; indeed the classical definition is given by a limiting process. Recent work by Holmes [START_REF] Holmes | Computing Néron-Tate heights of points on hyperelliptic Jacobians[END_REF] and Müller [START_REF] Müller | Computing canonical heights using arithmetic intersection theory[END_REF] provide algorithms to achieve this, which rely respectively on Arakelov geometry and the machinery of Gröbner bases. Both approaches stem from an observation of Faltings and Hriljac [START_REF] Faltings | Calculus on arithmetic surfaces[END_REF][START_REF] Hriljac | Heights and Arakelov's intersection theory[END_REF] but differ in how they perform the computations.

For the purpose of illustration, let HE 1 : y 2 = x 2g+1 + 2x 2 -10x + 11

HE 2 : y 2 = x 2g+1 + 6x 2 -4x + 1
Let D 1 be the point on HE 1 corresponding to the divisor (1, 2) -∞, and D 2 be the point on HE 2 corresponding to (1, 2) + (0, 1) -2 • ∞. Computation times using Holmes' algorithm are given in Table 10.5.

For these reasons we may give up the computation of exact heights, and may be content with an approximation of it, such as the one introduced in [Hol12, Chapter 6]. In fact, an order of magnitude might suffice; instead of the canonical height, we may use the arithmetic height: if P ∈ P N (Q) = [x 0 : • • • : x N ], with gcd(x 0 , . . . , x N ) = 1, define h Q = log max{|x 0 |, . . . , |x N |} and let φ : P N (Q) → P N (Q) be a rational map of degree d, then (see, e.g., [Sil07, Theorem 3.11]) we have h Q (φ(P )) = dh Q (P ) + O(1). Arithmetic height is a good approximation of canonical height to within a constant factor [Sil07, Theorem 3.20], which is sufficient for estimation purposes. One difficulty is that explicit addition formulae for high genera curves are unwieldy in projective coordinates; a very crude approximation is that d ≈ g. This creates an interesting situation if one wishes to encode information in the curve's infinite subgroups: encoding several bits in a given group requires large numbers (because the height increases); using more subgroups to encode more bits requires an increase in genus (with our construction), and thereby an increase in the cost of per-group encoding. Depending on the situation, the most advantageous approach might be the former or the latter. More advanced techniques, such as the ones we developed for the Naccache-Stern cryptosystem in Section 5.2, may also apply in that setting.

Laguerre's theorem uses this hypothesis of having all real roots to improve on the well-known general Gauss bound that all the roots of P lie in the disk of radius

ρ = 1 + max 1≤k≤n+1 |a k |
and in particular, Laguerre's result only relies on a 1 and a 2 , and not on all the other coefficients.

Improving Laguerre's theorem

Samuelson's interpretation of Laguerre's theorem relies on the observation that a 1 and a 2 are the sum of, respectively, the r i and the r 2 i , by Vieta's formulae. Our initial insight is that we can get a more precise information by also using a 3 . Indeed, when Laguerre's inequality is saturated, all the polynomial's roots are fixed, hence all coefficients a i for i > 2 are fixed. But if a 3 is in fact below this maximal value, as should happen most of the time, then we obtain a smaller interval than the one Laguerre's theorem predicts.

More formally, we can say that for every polynomial P (x), there is an affine transformation P (x) → P (x) such that P (x) has the form P (x) = x n -1 2

x n-2 -α 3

x n-3 + • • • (10.17)

In other terms, the sum of its roots is 0; the sum of the roots' squares is 1; and the sum of the roots' cubes is α.

The value α cannot be infinitely large under these constraints, and this is the key observation from which we improve Lagrange's result. The maximal value that α can take is determined as a solution to an optimisation problem, with three constraints. Finding the maximal value of α is the trick that will help us better locate the roots.

All the functions being differentiable and working on a compact space, we can leverage Lagrange's theorem: The vector (1, 0, . . . , 0) is a linear combination of the vectors (1, 1, . . . , 1) (r 1 , r 2 , . . . , r n+1 ) (r 2 1 , r 2 2 , . . . , r 2 n+1 )

Hence each r i is a root of a polynomial whose degree is at most two. For i > 1 all these polynomials are the same, hence r i can only take either of two values. All in all there are therefore only three values for the roots (one for r 1 , and two for r i when i > 1). Let r be the largest root, and u, v be the two other, which appear a times and b times respectively. Thus Before tackling the generic case, we must observe that that a = 0 (or, equivalently, a = n) is not a solution. In all other cases, however, we should expect an improvement over Laguerre's result. Let's henceforth assume that a = 0, n. Theorem 10.7 The maximum value of α is attained when a = 1 or a = n -1.

Proof: Fixing the largest root r, we compute the Gröbner basis of Equation (10.18) with respect to the variables {u, v, α}. Solving for α gives two possibilities. We consider the bigger one, and differentiate it with respect to a, which yields

Introduction

The history of cryptography is short and recent, yet clouded by some fears that cryptographic techniques should be kept secret themselves, a belief widely dismissed in the community, but still held by a few laymen -often if not always unaware of the consequences. Since Kerckhoffs' works, it has become almost common sense to design, evaluate and implement cryptography in a transparent way, not merely for scientific but for very pragmatic reasons.

Even though contemporary cryptographers heeded this warning, their employers often did not. As a result, early relics of cryptographic work are hard to unearth: They often lay in the shadows of military archive bunkers, despite the fact that most of the techniques described there were never implemented, let alone used in the field, and are in any case obsolete by today's standards.

It is thus very lucky, in a sense, that Major Josse's system attracted enough attention for the Germans to take notice of it, and bring descriptions to Berlin for cryptanalysis. In hindsight this is in itself a mystery: at the time the Germans seized the document, it was more than 30 years old; and while this is no guarantee of certainty, we have no evidence that this particular code was used at all. It is unclear then what exactly was their motivation; it may have been part of a systematic effort to search for and analyse every technique they could lay their hands on. Whether they picked this code in particular, or it was part of a bundle, we do not know.

When East Germany fell to the Soviet army, the document was sent to Moscow, probably to undergo analysis as well. It has resided there until recently, when the document was brought back to France.

A.1.2 The corpus

Because of its tortured history, being moved from one archiving place to the other across countries, it comes at some surprise that all documents in the bundle we recovered are in an excellent state, showing no more that stains due to aging paper and some degradation related to manipulation. This may indicate that these documents were not handled very much -or possibly that they were handled with extreme care.

As we discuss below, the bundle itself consists in several pages, the origin of which we investigate.

A.1.2.1 Description of the corpus

The corpus consists in 17 unnumbered manuscript pages, including title pages and appendices. They were handwritten in French. The corpus, reproduced in appendix, is composed of several documents:

1. A main document, entitled 'Projet de Cryptographie Militaire n°3' (Military Cryptography Project Nr.

3). This document describes a cryptosystem's design goals, encryption and decryption procedures, and makes additional remarks on how to teach it. We will henceforth refer to this cryptosystem as Josse's system. This document appears twice (1a and 1b).

2. A second document, probably meant to follow the first one, entitled 'Système cryptographique n°3' (Cryptographic system Nr. 3). This document contains the result of training exercices with several officers on Josse's code, where accuracy and speed were recorded.

3. A newspaper article draft, which praises a 'New cryptographic system' (without explicitly mentioning Josse's system).

4. An appendix to the main document (two copies, corresponding to the two versions), containing subtraction tables (4a and 4b). 6. A leaflet, entitled 'Méthode stéganographique Josse' (Josse steganographic method) followed by a poem.

We will refer to these documents by the numbers 1a, 1b, 2, 3, 4a, 4b, 5, and 6 in the following discussion. Note that all pages except the poem are of standard format (A3 double pages, or A4 single pages). The poem paper is lighter and of lesser quality, possibly removed from a notebook.

A.1.2.2 Handwriting analysis

It is possible to use forensic handwriting analysis techniques on the documents to gather information about their authorship. In this context, there is no suspicion of simulation and we may assume that differences in writing correspond to different authors. This analysis relies on identifying characteristic features of handwriting, such as letter shapes, word spacing, presence and nature of ligatures, connecting strokes, and line form (which indicates pressure). We are helped in this endeavour by the documents length, and the relatively regular handwriting under scrutiny.

Analysis, summarized in Table A.1, reveals that eigth authors contributed to the corpus. In particular, the absence of stroke-through text and mistakes in Document 1b seems to indicate that it was copied after 1a (and similarly, 4b was probably copied from 4a). We mention in this table the key features that enable to distinguish one author from all the others. Some documents (1b, 2, and 4b) are written carefully in a prescribed calligraphic style. This alone does not guarantee that they were written by different persons. However we take the conservative approach to give these authors different names. Document 6 is written in a style reminiscent of 1a, but exhibits key differences and is probably the work of an unrelated author. more or less in its entirety in several books published before Josse's death. We found an early mention in ' Amusements philologiques ou variétés en tous genres' by Gabriel Peignot (1808), although there might be even earlier sources. According to Peignot, 'These letters first present a meaning, when read as usual; but if we read the first line, the third, the fifth, etc. that is, every other line, we shall find a meaning opposite to the one a first reading suggested. 1 ' In other terms, while the entire poem makes sense as it is, reading the even-numbered lines only (and skipping over the odd-numbered lines) reveals a message that completely contradicts it.

Peignot mentions several other examples of vers brisés (broken verses) in French literature, including the poem's continuation.

As such, the text itself seems to be an exercise in literary entertainment rather than a military steganographic method, and there is no mention of it in any of the other documents. The leaflet is not signed nor dated, and the different paper grade and format seem to indicate that it was not part of the original bundle.

Since the document is handwritten, the possibility remains that there is hidden information in the way words are written, in the placement of words on the paper, or non-word symbols (e.g. dots), or invisible ink.

Comparison to Peignot's version rules out steganography based on altering words. It is unlikely that inter-word spacing was engineered, and a quick statistical hypothesis test on a digital copy is consistent with a Gaussian distribution. The placement of dots and punctuation sign is rather free, and there are enough such marks (around 75) to encode a short message if using for instance a grid. Inspection of the document under visible and near-UV light did not seem to indicate the use of special ink.

A.1.3.3 The newspaper article (document 3)

The newspaper draft, written on Revue de Cavalerie Militaire letterhead and unsigned, praises the benefits of a 'new cryptographic system' not otherwise made precise. The precise date of writing or possible publication is not written. We couldn't find a mention of a published version of this article in the École Militaire's Milindex document archive, which seems to start around 1892. Since the Revue was created in 1885 and the letterhead indicates 188... we can suspect that the draft was writen during this period: 1885-1889 or 1892. Since the draft refers to a previous issue 2 we may assume that the author already wrote for the Revue before, in March of the same year.

A thorough read raises doubts on the idea that the cryptographic system mentioned in this draft is really Josse's. Indeed, it insists on the usage of two cryptographic keys (Josse's system, as we will see, only has one), and on the immunity of ciphertexts to alterations 3 that seem to break ciphertexts generated by Josse's method. The encryption procedure seems different from Josse's 4 , but is not described in enough details to be decisive.

Finally, the author admits (without knowing) that the system's security relies not on the key, or the encryption grid, but on the cryptosystem's principle 5 -a blatant violation of Kerchoffs' design recommendations. As we shall see, Josse's system does not assume security by obscurity. In fact, as noted by Kahn [Kah67]:

' Josse quoted Kerckhoffs so often that he felt it necessary to insert an apologetic 'M. Kerckhoffs, whose name recurs so often in cryptography' after an especially heavy flurry of references.' Altogether this seems to rule this specific document out, as a contemporary account not otherwise related to Josse's system.

A.1.3.4 Core documents

The remainder of the documents forms a densely connected and consistent set. Document 1a describes a cryptographic scheme, and is supplemented by Document 4a. Document 5 mentions that a copy was performed, which seems to refer to documents 1b and 4b. Finally, Document 2 relates field experiments (timing measurements) based on the cryptosystem.

If we are to believe Document 5, the cryptosystem under consideration was engineered by Josse, and Documents 1a and 4a would bear his very own writing. Fighting in the 1870 war against Prussia, Josse was made Major and later knighted within the Ordre de la Légion d'Honneur (Matricule 61,140) on August 14, 1900.

Originally an artillery officer, Josse is the author of a single book, dedicated to military cryptography and published in 1885 [START_REF] Désiré | La Cryptographie et ses applications à l'art militaire[END_REF] (from which Kahn's citation is excerpted [Jos85a, p. 695]). The book actually gathers articles published that same year by Josse himself, essentially in the Revue Maritime et Coloniale [START_REF] Désiré | La cryptographie et ses applications à l'art militaire[END_REF][START_REF] Désiré | La cryptographie et ses applications à l'art militaire[END_REF].

He seems to have taken a prime role in the early organisation of French military cryptography6 along with fellow army officers Philippe, Munier, Delanne, Berthaut, Brun, Picquart, Legrand, and Straforello, issuing in particular field manuals related to telegraphic communications. One of these documents, known as the 'Dictionnaire 1890', described a dual system relying on one cipher in wartime and another when in peace. It was amongst the codes that Bazeries broke while still an amateur.

This would be contemporary to the system described here, which seems to have been designed around 1889.

In 1900 Josse (at that time a colonel) participated in the French Ministry of War official commission on cryptography, along with Jean-Jules Brun, Henry-Marie-Auguste Berthaut, and François Cartier.

According to the records, Josse died on February 10, 1929, at the age of 76.

A.1.4.2 Description of the cryptosystem

Josse's system works on a restricted subset of the Latin alphabet, without punctuation, numbers or spaces, and does not distinguish between upper and lower case. Interestingly, the letter W is also removed from this alphabet. As was very common at the time, letters are put in correspondence with their index in the alphabet: Both the plaintext, password, and ciphertext are written using this alphabet, and understood as a sequence of numbers in Z 25 , where 0 = 25.

• Setup: Both the sender and the recipient agree beforehand on a "seed" P , which will be used to generate the substitution table used to both encode and decode messages. P is a short password, written in the alphabet discussed above.

• Key generation: To generate the key, duplicate letters are removed from P , which gives P of length N . P is spelled and put in the first row of a table with N columns. The rest of the letters follow, in alphabetical order. There are thus 25/N rows in the table. The table is then read column-wise to yield a shuffled alphabet, which is the secret key. We write S(a) to denote the position of the letter a in that new alphabet.

• Encryption: Let m = m 1 • • • m M be a message. If necessary, the message is padded with random letters7 so that M is a multiple of 5. First compute r i = S(m i ) + r i-1 mod 25

with the exception of the first, r 1 = 25 -S(m 1 ) mod 25. The ciphertext is given by c i = S -1 (r i ).

• The message is finally recovered as m i = S -1 (d i ).

Amongst other seemingly arbitrary tweaks, the different treatment regarding c 1 is justified by a desire that 'the first letter of the ciphertext be different from the first letter of the message'.

A.1.5 Implementation remarks

Josse makes several remarks about the use of his cipher in the field, with details about how to avoid making mistakes.

A.1.6 Cryptanalysis

Josse's system can essentially be seen as several protection layers added on top of a simple substitution cipher. The protections are threefold8 :

• The first letter is encoded in a different way;

• Some form of "error propagation" mechanism is used, possibly to thwart frequency analyses and make partial recovery harder;

• The alphabet is scrambled in a key-dependent way.

By design the key size is limited to 25 (after removing duplicate letters), which offers a choice of 25! ≈ 2 83 keys. That being said there are at least two flaws in that design. The key derivation mechanism for instance, works by transposing an alphabet formed by appending unused letters to the password. We may expect the password to be short, so that in fact most letters are in place. Let's assume for simplicity an empty password -i.e. the key is obtained by transposing the plain alphabet using a grid of unknown size N , 1 ≤ N ≤ 25. Each possibility gives a scrambled alphabet. The closest candidate alphabet is only wrong by an offset between actual key letters, which enables recovery of the password length and (by subtracting the offsets) the password itself. This works well if the password is relatively short.

The other flaw is that this encryption is completely deterministic. Thus this cryptosystem lends itself to several attacks; for instance, using several ciphertexts, we can look at the first letter c 1 = S -1 (25 -S(m 1 )) and use for instance a frequency analysis to recover not only m 1 but also S(m 1 ). Given enough messages this allows a complete recovery of the substitution alphabet, hence the key. Another possibility is a replay attack, whereby the attacker repeats a valid ciphertext that was intercepted previously.

A.1.7 Conclusion

This paper provides a concrete glimpse into the French military cryptographic universe during the late 1880s and in the early 1890s. As we could see, the proposed methods were relatively simple, as there design was mostly based on empirical protections and basic text transforms.

A.1.8 The poem (document 6) in extenso

We reproduce here the poem, with even lines coloured red, and odd lines coloured blue. The poem can be read in two ways: Either 'normally', reading every line; or skipping the odd (red) lines. The two readings yield opposite meanings.

Mademoiselle, Je m'empresse de vous écrire pour vous déclarer que vous vous trompez beaucoup si vous croyez que vous êtes celle pour qui je soupire Il est bien vrai que pour vous éprouver je vous ai fait mille aveux. Après quoi vous êtes devenue l'objet de ma raillerie. Ainsi ne doutez plus de ce qui vous dit ici celui qui n'a eu que de l'aversion pour vous et qui aimerait mieux mourir que de se voir obligé de vous épouser, et de changer le dessein qu'il a formé de vous haïr toute sa vie, bien loin de vous aimer, comme il vous l'a déclaré. Soyez donc désabusée, croyez-moi, et si vous êtes encore constante et persuadée que vous êtes aimée vous serez encore plus exposée à la rizée de tout le monde et particulièrement de celui qui n'a jamais été et ne sera jamais

3 s 2 Figure 1 . 2 :

 3212 Figure 1.2: AES consists in 10 to 14 repetitions of the round function illustrated above. The 128-bit state is represented as a 4 × 4 matrix of bytes. The last round does not use the MixColumn operation. Note that every operation is reversible.

Figure 1 . 3 :

 13 Figure 1.3: ECB mode of operation for encryption (left) and decryption (right) of a message.

Lemma 1. 1

 1 Let (E, O) be an elliptic curve over a field k, then the map:E(k) → Cl 0 (E) = Div 0 (E)/P (E) P → The class of (P ) -(O)is bijective.

  div(f ) = (P ) + (Q) + (P * Q) -(P * Q) -(O) -((P * Q) * O) = (P ) + (Q) -(O) -((P * Q) * O)Hence, (P * Q) * O = P + Q.

Example 1. 1 (

 1 Quadratic sieve: Worked example) Assume N = 15347, we use the sieving polynomial (t + √ N ) 2 -N = (t 2 + 124) -15347. The first 4 primes p for which 15347 has a square root modulo p are 2, 17, 23, and 29. The next step is to perform the sieve: For each p in our factor base {2, 17, 23, 29} solve the equation Y (X) ≡ (X + √ N ) 2 -N ≡ 0 (mod p)

2 Figure 1 . 9 :

 219 Figure 1.9: Relationships between lattice hard problems; an arrow A α -→ B indicates that A can be reduced to B in polynomial time, losing a factor α. Adapted from [LPW12].

Figure 1 . 10 :

 110 Figure 1.10: Relationships between security notions for encryption; the arrows indicate implication [BDP + 98].

$Step 3 .

 3 ← -{0, 1} k and y $ ← -[0, n -1] using any random tape ω Step 2. Compute x ← y 2 v ei i If e(x, η, ω) = e then go to Step 1 ; else output (x, e, y).

Figure 3 . 5 :

 35 Figure 3.5: Security efficiency for biased Fiat-Shamir with n = 3, as a function of . Standard Fiat-Shamir security efficiency corresponds to the dashed line.

Figure 3 .

 3 Figure 3.6: Fiat-Shamir (n = 3) optimal probability distribution for challenges in group j = 0, . . . , 3, as a function of . Branching happens at = 1/7 and = 1/4. Dashed line corresponds to the standard Fiat-Shamir distribution.

Figure 3 . 7 :

 37 Figure 3.7: Maximal security efficiency Ê for biased Fiat-Shamir with n = 16, as a function of security log . Standard Fiat-Shamir security efficiency corresponds to the dashed line.

Algorithm 2 :

 2 ProofGenInput: C, σ, S, P Output: zo, πo, T 1. set T and P CT to be "empty transcript" (with T = (G, linp, data) and P CT = (T, proof ) with G = (V, E) = (∅, ∅))

Definition 4 . 10 (

 410 Weak differing-inputs obfuscation) Let M = {M λ } be a class of Turing machines which verifies that for every polynomial d(•) and sufficiently large security parameter λ, every pair of Turing machines (M 0 , M 1 ) ∈ M λ differing on at most d(k) inputs. An uniform PPT machine diO is a weak differing-inputs obfuscator (wdiO) for the Turing machine class M, if it verifies the following property:

Figure 4 . 1 .

 41 Setup(1 λ ): (PP, SK * ) ← UWS.Setup(1 λ ) return (SK * , PP) KeyGen(msk, f ): return UWS.Delegate(PP = msk, SK * , * , f, "f ≤ * ")

Figure 4 . 1 :

 41 Figure 4.1: Functional signatures from UWS.

Figure 4 . 2 :

 42 Figure 4.2: HIBS from UWS.

Figure 4 . 3 :

 43 Figure 4.3: Redactable signatures from UWS.

Figure 4 . 4 :

 44 Figure 4.4: Construction of UWS from one way functions.

Figure 4 . 5 :Theorem 4 . 4

 4544 Figure 4.5: Construction of UWS from proof-carrying data.

Theorem 4 . 6

 46 The construction of the UWS signature based on iO is correct succinct and context-hiding.

Definition 4 . 15 (

 415 Valid certificate) c x is a valid certificate of x if and only if the adversary has required a signature of y and

Figure 4 .

 4 6 illustrates the relationships between hybrids.

3 .

 3 C computes the punctured PRF key K L = P(K, L ) and H L k then uses the iO to get an wdiO of the function CheckSign [K L , H L ] described in Algorithm 5 and sets it as a public parameter with initially L 0 = {⊥}, and keeps the PRF's key K secret. C sets the F lag ≥m = False and F lag only<L = True. 4. A can require C to apply the function CheckSign k [K L , H L ](SK A , A, B, w) a polynomial number of times, and can only require C to reveal a secret key SK A of A when A ≤ m.5.A returns a secret key corresponding to the message m.

Algorithm 5 :

 5 CheckSign [KL , HL ] Input: SKA, A, B, w. Output: SKB or ⊥.

Lemma 4 .

 4 11 If A can distinguish the hybrid .e i .(e 2 n -1 , w 2 |W | -1 ) and the hybrid .e i .final. Then A can also break the indistinguishable property of the Weak Differing-Inputs Obfuscator or the security of the one-way function. Denote the probability of distinguishing these two hybrids by ε diO + ε OWF .

Hybrid 0 FalseFigure 4 . 6 :

 046 Figure 4.6: Relationships between hybrids in the proof of Section 4.1.8.1.

Figure 4 .Figure 4 . 7 :-

 447 Figure 4.7: Public directory D distributing the public keys.

Figure 4 . 8 )Figure 4 . 8 :

 4848 Figure 4.8: Verification of a Schnorr co-signature m, r, s.

  A outputs a tuple (m, r, s, y C,D ). A wins the game if Verify(m, r, s) = True and there exist public keys y C , y D ∈ D such that y C,D = y C y D and either of the following holds: • A did not query SKExtract on y C nor on y D , and did not query CoSign on m, y C,D , and did not query Transcript on m, y C , y D nor m, y D , y C . • A did not query Transcript on m, y C , y i for any y i = y C and did not query SKExtract on y C , and did not query CoSign on m, y C , y i for any y i = y C .

Theorem 4 . 15

 415 Let {y, g, p, q} be a DLP instance. If A plays the role of Bob (resp. Alice) and is able to forge in polynomial time a co-signature with probability F , then in the Random Oracle model A can break the DLP instance with high probability in polynomial time. The proof of Theorem 4.15, proceeds by splitting Theorem 4.15 in twain depending on whether A impersonates Bob or Alice: Adversary attacks Bob Theorem 4.16 Let {y, g, p, q} be a DLP instance. If A Alice plays the role of Alice and is able to forge in polynomial time a co-signature with probability F , then in the Random Oracle model A Alice can break that DLP instance with high probability in polynomial time.

Figure 4 . 9 :

 49 Figure 4.9: The simulator S Bob (left) or S Alice (right) answers the attacker's queries to the public directory D.

Algorithm 8 :B 9 .

 89 Co-signing Oracle Simulation for S Alice Input: A co-signature query m from A Bob . Output: sA 1. receive ρ from A Bob 2. query T to retrieve rB such that H(0 rB) = ρ 3. e, sA $ ← -Zq 4. r ← rBg s A y e 5. u ← 1 m r 6. if ∃e = e, {u, e } ∈ T then abort 7. append {u, e} to T 8. rA ← r × r -1 send rA to A Bob 10. receive rB from A Bob (this rB is not used by S Alice ) 11. receive sB from A Bob 12. return sA

Definition 4 .

 4 21 (Authorized signatory credential) The data field

Figure 4 . 10 :

 410 Figure 4.10: The verification procedure: proof of involvement.

Figure 4 . 11 :

 411 Figure 4.11: The strong EF-CMA experiment for digital signature schemes.

Figure 4 .

 4 Figure 4.12: The algorithms used in Theorem 4.20, as part of the proof of Theorem 4.19.

Lemma 4 .

 4 21 Every tuple of δ is a valid signature tuple. Therefore δ ⊆ δ. Proof: [of Lemma 4.21] Let (r, e 1 , . . . , e , s 1 , . . . , s , ρ 1 , . . . , ρ ) ∈ δ . Let i ∈ [ ]. By the Chinese Remainder Theorem we have:

and 4 .

 4 15 an algorithm R that uses A to solve the PDLP. A is equivalent to A (with the same random tape which we omit in the notation), the difference being that it interacts with different oracles. Abusing notation we denote by R.H i the composition of the hash function and the conversion function. If L is a list of pairs, we denote by L -1 [e] the index of the element e in the list, and by L[i] the i-th element of the list. If they cannot (i.e. if e is not in the list, or the list does not have an i-th element) they abort.The algorithm R aborts in four possible ways during the simulation (denoted ( ), ( †), ( ‡) and ( §)) inFigures 4.14

Figure 4 . 13 :

 413 Figure 4.13: An efficient EF-CMA adversary A against ReSchnorr, with random oracle H and a signing oracle O.

Figure 4 . 14 :

 414 Figure 4.14: An efficient solver R for the PDLP, using a polynomial number of queries to A. R implements the random oracle as R.H and the signing oracle as R.Sign. The rewinded adversary and oracles are indicated with a prime symbol.

Figure 4 . 15 :

 415 Figure 4.15: An efficient solver for the PDLP, constructed from an efficient EF-CMA adversary against ReSchnorr.

Algorithm 9 :

 9 Attestator A for the Multi-Prime Attestation Scheme (u = 1) with = 2 Input: r1, . . . , r k . Output: n, ωn.

Algorithm 10 :

 10 Validator V for the Multi-Prime Attestation Scheme (u = 1) with = 2 Input: n, ωn. Output: True or False.

  7. if rX 1 = and rX 2 = and #{ri ∈ ωn s.t. ri = } = 2 and |n| = P 8. return True 9. return False

  7. if rX j = for j = 1 to and #{ri s.t. ri = } = u and |n1| = • • • = |nu| = P

Algorithm 15 :

 15 Unranking AlgorithmInput: r, k, u. Output: r1, . . . , ru.

log 2 k

 k Time = 6 = 8 = 10 = 12 = 14 = 16 = 18 = 20 = 30 = 40 = 50 = 60 = 70 = 80 7 12

Definition 5 . 2 (

 52 IND-CPA-Security) The following game is played: • C selects a secret random bit b; • A outputs two messages m 0 and m 1 ; • C sends to A the ciphertext c ← Encrypt(m b ); • A outputs a guess b .

Definition 5 . 3 (

 53 IND-CCA2-Security) An adversary A is given access to an encryption oracle O E and a decryption oracle O D . The following game is played: • C selects a secret random bit b; • A queries O E and O D and outputs two messages m 0 and m 1 ; • C sends to A the ciphertext c ← Encrypt(m b ); • A queries O E and O D and outputs a guess b .

3 .

 3 ReRand: a randomized algorithm which takes a ciphertext c and outputs another ciphertext c ; c decrypts to the same message m as the original ciphertext c. 4. Decrypt: a deterministic decryption algorithm which takes a private key sk and a ciphertext c, and outputs either a plaintext m or an error indicator ⊥. In other words: {sk, pk} ← KeyGen(1 k ) Decrypt(ReRand(Encrypt(m, pk), pk), sk) = Decrypt(Encrypt(m, pk), sk) = m

87159614203780372129899474046144658803240

  From these we get the following number N , which is strongly pseudo-prime over all the bases in P:

  (5.1) Example 5.1 NS with = 15 and 64-bit modulus p can encode 15-bit messages. Using

Example 5 . 3

 53 Consider the same setting as in Example 5.2, and let D be the differential operator D = z d dz 2 .

p

  γi < p, where p i is the i-th prime number (p 1 = 2). Denoting b = γ + , we introduce an invertible function unrank that maps an integer 0 ≤ m < b to a γ-tuple (d 1 , . . . , d γ ) such that 0 ≤ d k and d 1 + • • • + d k ≤ . Set pp ← (p, n, γ, ).

Definition 5 . 8 (

 58 IND-CCA2-Security) An adversary A is given access to an encryption oracle O E and a decryption oracle O D . The following game is played: • We choose a secret random bit b; • A queries the oracles and outputs two messages m 0 and m 1 ; • We provide the ciphertext c ← Encrypt(m b ) to A; • A queries O E and O D and outputs a guess b .

Definition 5 . 13 (Definition 5 . 14 (

 513514 Bilinear Pairing) A Bilinear Pairing is a set of three cyclic groups G 1 , G 2 and G T of prime order p, along with an efficiently computable map e : G 1 × G 2 → G T which is:1. A bilinear map, i.e. for all g ∈ G 1 , h ∈ G 2 and a, b ∈ Z p , e(g a , h b ) = e(g, h) ab 2. Non-degenerate, i.e. for g = 1 G1 and h = 1 G2 , e(g, h) = 1 G T ;The following typology is useful[START_REF] Galbraith | Pairings for cryptographers[END_REF]: Type 1, 2, 3 Pairings) We further categorize e as:

Algorithm 17 :

 17 KeyGen K (pp) Input: Public parameters pp. Output: Public key pk, secret key sk. 1. κ $ ← -{0, 1} k 2. (skΣ, pk Σ ) ← KeyGen Σ (pp) 3. pk K ← Sign Σ (skΣ, κ) 4. skK ← (κ, pk Σ ) 5. return pk K , skK • Encrypt K (pp, pk K , b) encrypts a bit b as follows:

Lemma 5 .

 5 18 (Correctness)The public-key cryptosystem K defined in Section 5.3.3.1 is correct, i.e. for b ∈ {0, 1}, Decrypt K (pp, sk K , Encrypt K (pp, pk K , b)) = b,with high probability, for any set of parameters pp generated by Setup and corresponding keys generated by KeyGen.Proof: If b = 1 then the encryption of b is a valid signature of κ, therefore the decoding algorithm outputs 1. If b = 0 then the encryption of b is a random number, which is an invalid signature of κ with high probability, which results in the output of 0.

  e(a, g) = e(h, b)} , picks a $ ← -Z × p , and outputs the signature σ = (h a , m a 1 , h ax m ay 1 ) ∈ G 3 1 . • Verify Σ (m, σ, pk) checks that m = (m 1 , m 2 ) ∈ G, and that σ = (a, b, c) satisfies e(a, m 2 ) = e(b, g) and e(c, g) = e(a, X)e(b, Y ).

  Figure 5.1: An illustration of the partitions that we are interested in: in these diagrams, a black square in F or G represents a 1, while white squares represent 0s. The partitions f and g are balanced and correct for F and G respectively, with "zero" blocks coloured white, and "non-zero" blocks coloured black. The vertical dashed lines show how F and G align with their respective partitions.

Figure 5 . 2 :

 52 Figure 5.2: The feasibility demonstration consists in deriving the attack's random tape from a verifiable source in a deterministic way, as well as the keys.

Figure 5 . 3 :

 53 Figure 5.3: The KeyGen(pp) procedure.

1 10 ×

 10 1,152,006 × 64,249 150 × 72 × 1 60 × 60 × 24 ≈ 7 days 22 hours

  . A brute-force attacker will exhaust all b k possible values of α. Hence b k should be large enough. Given that b ∼ 10 7 or b ∼ 10 8 , it appears that k = 6 provides at least 128-bit security.

5. 5 . 4 . 1

 541 Figure 5.4: A DCP candidate constructed from an existing CP.

Figure 5 . 5 :

 55 Figure 5.5: An instance of a visual-logical task ECP problem.Recognizing objects in this image is insufficient to tell whether there is a solution, nor to compute the solution should there be one.

Figure 5 .

 5 Figure 5.6: Three instances of the temporal sequence ECP problem. The problem consists in temporally arranging the pictures.

Figure 5 . 8 :

 58 Figure 5.8: A honey image ECP. Left: original image; right: Q OK , the transformed image for OK .

Figure 5 . 10 :

 510 Figure 5.10: Credit card PAN and expiry date, stored as a DCP instance.

Example 5 . 8

 58 Assume that we wish to AES-decrypt what we know is an English word protected with a small 4 digits key: c ← Enc k (m). An efficient distinguisher is whether m k ← Dec k (c)is made of letters belonging to the English alphabet. For instance, if c = 0f897d668b4c27d750fa990c5ad611eb 23 Such passwords may be learnt from password leaks [VCT14; WAd + 09; JD12].

Figure 5 Figure 5 . 13 :Figure 5 . 14 :

 5513514 Figure 5.12: SAMP1 B DTE,pm

Figure 5 . 15 :

 515 scheme

Figure 5 . 16 :

 516 Figure 5.16: Two possible derivations of the same sentence. Note that these derivations correspond to two possible meanings which are not identical.

  .

Figure 5 . 17 :

 517 Figure 5.17: Syntactic tree of an example sentence.

Figure 5 .

 5 Figure 5.18: Triangle representation T of the substrings M ⊆ M. Substrings along right diagonals have equal length. The top-left point represents the entire corpus M.

Figure 6 . 1 :

 61 Figure 6.1: The judicial seizure. Personal information such as cardholder name are censored for privacy reasons.

Figure 6 . 2 :

 62 Figure 6.2: Deformation due to heating of the forgery's backside.

Figure 6 . 3 :

 63 Figure 6.3: Forgery's ISO module. Red arrows show glue traces.

Figure 6 . 4 :

 64 Figure 6.4: Side-views of the forgery, showing that it is somewhat thicker than a standard card (0.83 mm). The extra thickness varies from 0.4 mm to 0.7 mm suggesting the existence of several components under the card module, besides the FUN card.

Figure 6 . 5 :

 65 Figure 6.5: The FUN card's inner schematics.

Figure 6

 6 Figure 6.6: FUN card X-ray analysis. (1) External memory (AT24C64); (2) Microcontroller (AT90S8515A); (3) Connection wires; (4) Connection grid.

Figure 6 . 7 :Figure 6 . 8 :

 6768 Figure 6.7: Forgery X-ray analysis. (5) Stolen card's module; (6) Connection wires added by the fraudster; (7) Weldings by the fraudster (only three are pointed out here).

Figure 6 . 9 :

 69 Figure 6.9: False colours X-ray image of the forgery. Different colours correspond to different materials. The stolen chip is clearly visible in green.

Figure 6 . 10 :

 610 Figure 6.10: The FUN card intercepts the Select command and replays it to the stolen card. Then the FUN card sends back the response to the PoS.

Figure 6 . 11 :

 611 Figure 6.11: The power trace analysis of the forgery during the Select command reveals a pattern that is repeated, despite the absence of I/O operations. It is readily observed that the pattern corresponds to the replay of data sent earlier by the PoS.

Figure 6 .

 6 Figure 6.12: (1) PoS sends the ISO command 00 A4 04 00 07; (2) The command is echoed to the stolen card by the FUN card; (3) The stolen card sends the procedure byte A4 to the FUN card; (4) The FUN card retransmits the procedure byte (A4) to the PoS; (5) The PoS sends the data A0 00 00 00 03 10 10 to the FUN card; (6) The FUN card echoes A0 00 00 00 03 10 10 to the stolen card; (7) The stolen card sends the status word (SW1=61, SW2=30) to the FUN card; (8) and the FUN card transmits SW1 SW2 to the PoS. Communication: PoS → FUN card is shown in blue; FUN card → stolen card in red; Stolen card → FUN card in green and FUN card → PoS in black.

Figure 6 . 13 :

 613 Figure 6.13: Power trace of the forgery during the VerifyPIN command. Notice the absence of a retransmission on the power trace before the returning of SW1 SW2.

Figure 6 . 14 :

 614 Figure 6.14: Power consumption during a GetData command.

Figure 6 . 15 :

 615 Figure 6.15: (1) Connection grid; (2) Stolen card's module (outlined in blue); (3) Stolen card's chip; (4) FUN card module; (5) Weldings of connection wires.

Figure 6 . 16 :Figure 6 . 17 :Figure 6

 6166176 Figure 6.16: (1) FUN card module; (2) genuine stolen card; (3) welded wire.

Figure 6 .Figure 6

 66 Figure 6.19: Anti-forensics precautions taken by the perpetrator. Zoom on parts of Figure 6.18 (fraudulent card), Figure 6.6 (X-ray of the fraudulent card), and Figure 6.7 (unmodified FUN card). The abrasion and cut wire are clearly visible.

Figure 6 .Figure 6

 66 Figure 6.21: An industrial multi-SIM reader.

Figure 6 .

 6 Figure 6.23: Sample program and opcode attributes.

Algorithm 22 :

 22 Queue Generating Algorithm Input: Program P. Output: Queues Q0 and Q1. Initialisation 1. for k ← 1 to |P| 2.D[k] ← destinations of opcode[k]

Figure 6 .Figure 6

 66 Figure 6.24: Iterations of Algorithm 22 on Figure 6.23.

FigureFigure 6

 6 Figure 6.25: CμP architecture.

Figure 6

 6 Figure 6.28: Temporal distribution of three eors in final AES round. 200 Executions.

Figure 6 .

 6 Figure 6.29: Use of the PID covert channel on Windows 7 demonstrating how the message 010101... can be sent.

  which is encoded by ki01ke0q. And similarly to subtract 1: subs w11 , w11 , #0 xc1a adds w11 , w11 , #0 xc19

  eor ( xor ) b := a eor b , c = w17 a = w16 -25 b = w18 -25 c :=0 eon c c a lsl 16 eon c c a lsr 16 eon b b c lsl 16 eon b b c lsr 16

w19 ← 0

 0 w25 ← w25 -77 Then, we can actually load and store the byte.

Figure 7 . 1 :

 71 Figure 7.1: Memory layout of the shellcode during execution. First step: The encoded payload is decoded and placed further down on the stack. Note that (2) is twice the size of (3).

Figure 7 . 2 :

 72 Figure 7.2: Memory layout of the shellcode during execution. Second step: Once the payload is decoded, the decoder calls it.

  n = [[ a ,b ,c , d ]| a < -i ,b < -i ,c < -i ,d < -i ] where i = [ 0 .. 9 ]++ [ a .. z ]++ [ A .. Z ] m = concat n main = writeFile " allalphanum " m

  x50 ; $a [] = 0 x70 ;} return ( chr ( $a [ array_rand ( $a )]+ $c )); } function randalnum () { $n = rand (0 , 26+26+10 -1); if ( $n <26) { return chr (0 x41 + $n ); } $n -= 26; if ( $n <26) { return chr (0 x61 + $n ); } return chr (0 x30 + $n -26); } /* Replace $s = str_replace ( @ , P , $s ); with : */ $j = $b + 2* $i ; while ( $s [ $j ] === B ) { $s [ $j ++] = randalnum (); }

Figure 7 . 4 :

 74 Figure 7.4: Restricted CFG of the program of Example 7.1.

CFGFigure 7 . 5 :

 75 Figure 7.5: Illustration of Step 1: Relabeling. The original nodes and edges from CFG(P ) are in black, other nodes are in gray.

Figure 7 . 6 :

 76 Figure 7.6: Illustration of Step 2: Breaking edges. The original path π(a) → π(b) is extended by a path f ((a, b)) = (s 1 , . . . , s n ) of G .

Figure 7 . 7 :

 77 Figure 7.7: Illustration of Step 3: Identifying active and passive nodes. Here two original sequences π(a) → π(b) and π(c) → π(d) cause some nodes to be passive (empty circle), active (filled black circle), or active depending on the execution path taken (grey circle).

Figure 7 . 8 :

 78 Figure 7.8: Illustration of Step 4:The path is taken according the routing variable m. If the node is passive (m = 0), the path to be taken will be the subsequent node. In the case of a active node (m = 1), the next node will be defined by the current node

Figure 7 . 11 :

 711 Figure 7.11: Layout of two (unmodified) inverters, captured under GNU/Electric.

Figure 7 .

 7 Figure7.12: Layout of two inverters, modified to include the trojan; it is visible as an additional horizontal active area represented in light green, which connects the two inverters.

Figure 7 . 13 :

 713 Figure 7.13: Simulation without trojan (or R = +∞).

Figure 7 . 14 :

 714 Figure 7.14: Simulation with trojan of small resistance, R ∈ {1, 2, 3, . . . , 10} kΩ.

Figure 7 . 15 :

 715 Figure 7.15: Simulation with trojan of large resistance, R ∈ {10, 20, 30, . . . , 100} kΩ.

  (x * , y * ) ∈ |X | 22. if y * == y then return x * 23. return ⊥ Remark. Our attacks are reminiscent of the cold boot attack of Heninger and Shacham against factorization [HS09] and its numerous follow-ups, such as [HMM10; PPS12; KSI13; KH14]. This is quite interesting, as these cold boot attacks do not really have a natural polynomial-time counterpart in the discrete logarithm setting (even the attack of Poettering and Sibborn [PS15b] is basically exponential).

Figure 7 . 16 :Figure 7 . 17 :

 716717 Figure 7.16: The N-well can be used as a resistor. The parasitic diode effect is illustrated.

Figure 7 .

 7 Figure 7.18: Trojan using an N-well as resistor. N-well has the largest resistance per square.

A+π1+π2+π3 s u c c e s s 3 s u c c e s s 2 succ ess 1 Figure 7

 3217 Figure7.19: A toy example to illustrate deterministic sequential attacks. Here the attack plan P = {1, 2, 3, 4} is followed.

  Figure7.20: Experiment(100, 100) (in red) and Experiment(50, 200) (in blue). r A is the ratio of 6-target optimal plans obtainable by inserting 5 and 6 into their corresponding 4-target optimal plan. As A grows, it seems that one can find an optimal solution with high probability, simply by inserting the additional nodes in a smaller optimal solution.

Figures 7 .

 7 Figures 7.21 and 7.22 can thus be merged into the unique plan shown in Figure 7.23.To find the best adaptive attack, Alice defines:

A+π 1 +π 2 s u c c e s s 2 s u c c e s s 1 Figure 7

 2217 Figure 7.21: First possible future after attacking V 1 : attack V 2 first, V 3 next.

A+π 1 +π 3 s u c c e s s 3 s u c c e s s 1 Figure 7

 3317 Figure 7.22: Second possible future after attacking V 1 : attack V 3 first, V 2 next.

A+π 1 +π 2 Figure 7

 27 Figure 7.23: Combined attack plan starting with V 1 .

5 (

 5 Markov decision process)A Markov decision process (MDP) is a tuple (S, S, A, π, γ, R), where:

u-Definition 8 . 4 (

 84 → b corresponds to a transaction from a to b of amount u. The balance b(v) of an individual account v is given by the difference between incoming transactions and outgoing transactions, i.e. b(v) = e:•→v φ(e)f :v→• φ(f ), where (• → v) denotes all incoming edges, i.e. all the elements in E of the form (w, v) for some w ∈ V ; similarly (v → •) denotes all outgoing edges. Let b(G) denote the vector {b(v), v ∈ V }, which we refer to as the graph's semantics. Nilcatenation Problem) Given a multigraph G = (V, E, φ), find the maximal E ⊆ E such that b(G) = b(G -G), where G = (V, E, φ). We call ( G, G -G) the nilcatenation of G.

Definition 8 . 5 (

 85 NCP, alternative definition) Let G = (V, E, φ) be a multigraph. Write V = {v 1 , . . . , v n }, and represent an edge e : v i r -→ v j as the vector r • e ij ∈ Z n where e ij is the vector of Z n with 1 in position j, -1 in position i and 0 in the remaining components. Now E is understood as a list of m such vectors E = (e 1 , . . . , e m ). The nilcatenation problem consists in finding the ∈ {0, 1} m of maximal Hamming weight such that m i=1 i e i = E, = 0, where we have extended the notation •, • in the obvious way. The nilcatenation of G is then defined as (G -G, G), where G = (V, E, φ) and E = {e i ∈ E, i = 1}. This definition makes clear the parallel between the nilcatenation problem and the multi-dimensional version of the subset-sum problem, as described in Definition 8.3: For n = 2, NCP and SSP are almost the same problem.

Definition 8 . 7 (

 87 Local conservation SSP) Let v ∈ V , let E I the multiset of incoming edges, and E O the multiset of outgoing edges. The local conservation SSP is the problem of finding S I ⊆ E I , S O ⊆ E O such that e∈S I φ(e) = f ∈S O φ(f )

  Figure 8.1: There are no first-order obstructions is these graphs, which are strongly connected and whose edges are all labelled identically. Such 'hubs' can be detected by detecting higher-order obstructions, at the cost of solving (n + 1) times an n-element SSP instance, where n = 5 (left) or 6 (right).

Algorithm 27 :

 27 Gostbusting Procedure Input: The transaction graph Bt. Output: The subgraph SG in which miners are required to find a nilcatenation. 1. Consider bt the defining block at time t 2. seed ← H(bt) 3. SG ← SubGraphGen(seed)

Figure 8 . 2 :

 82 Figure 8.2: Concatenation of three independent nilcatenations.

Figure 8 . 3 :

 83 Figure 8.3: A simple support example, depicting a multigraph with a nilcatenable subgraph.

Figure 8 . 4 :

 84 Figure 8.4: The "naive procedure" for n = 2 consists in testing each entity separately and sequentially.

Figure 8 . 5 :

 85 Figure 8.5: Two batching testing procedures having (1, 2) as root.

Figure 8 . 6 :

 86 Figure 8.6: Optimality zones for n = 2. A : naive procedure; B : batching procedure (right); C : batching procedure (left).

Example 8 . 1

 81 Let WasSigned be a function that returns True if and only if all messages were signed at some point by the legitimate signer. Consider a set of RSA signatures T = {σ 1 , . . . , σ n } on a (respective) set of messages M = {m 1 , . . . , m n }, then we have WasSigned(M ) = Verify m∈M

Definition 8 . 10 (

 810 Outcome) The outcome F φ (T ) of a test φ on T ∈ Ω is the string of individual test results:

Definition 8 . 11 (

 811 Splitting) Let T ∈ Ω be a selection and φ be a test. Let S be a subset of Ω. The positive part of S with respect to T , denoted S T , is defined as the set S T = {S|S ∈ S, S ∧ T = T } .

2 .

 2 Each node of T which is not a leaf has exactly two children, (S ⊥ , S ), and is labeled (S, T ) whereS ⊆ Ω and T ∈ Ω, such that a) S ⊥ ∩ S = ∅ b) S ⊥ S = S c) S ⊥ = S ⊥T and S = S T .

Example 8 . 2

 82 Let n = 5 and ω = 11101, then Pr(ω) = x 1 x 2 x 3 (1x 4 )x 5 .

Algorithm 28 : 10 .

 2810 FindProcedureInput: S ∈ Ω, C ∈ Ω. Output: A binary tree.1. if |S| == 1 then return S 2. S ⊥ = S = C = ∅ 3. for each T ∈ C for i ∈ {1, . . . , |C |} 11. C = C -C [i] 12. for each T ⊥ ∈ FindProcedure(S ⊥ [i], C) 13.for each T ∈ FindProcedure(S [i], C)14. yield (C [i],T ⊥ , T )

Figure 8 . 8 :

 88 Figure 8.8: Slices of the cube decomposition for the n = 3 metaprocedure. The slices are taken orthogonally to the cube's main diagonal, with the origin at the center of each picture. Each color corresponds to a procedure. The symmetries are particularly visible.

Figure 8 . 9 :

 89 Figure 8.9: Slices through the cube at the z = 0.17 (left) and the z = 0.33 (right) planes, showing the metaprocedure's rich structure. The origin is at the top left.

  to 8.15), blue indicates a fixed part, and red indicate a part undergoing some permutation. Double-headed arrows indicate that swapping nodes is possible. The number of symmetries obtained by such an operation is indicated under the curly brace below.

Figure 8 .

 8 Figure 8.10: A 3D visualisation of the cube. Left: exterior, where it is visible that each face has the same decomposition as the 2D problem; Middle: with the naive algorithm region slightly removed, showing that it accounts for slightly less than half of the total volume; Right: exploded view of the 52 substructures (looking from (-1, -1, -1)).

Figure 8 . 11 :

 811 Figure 8.11: Naive algorithm, where the order of tests are unimportant in the left and right branches.

Figure 8

 8 Figure 8.12: The optimal metaprocedure tree (left), and heuristic metaprocedure (right) for the same point x = (0.01, 0.17, 0.51). The optimal procedure has expected length 1.889, as compared to 1.96 for the heuristic procedure.

4 . 8 . 2 . 9

 4829 R = {{r1, . . . , rp} | {ur 1 , . . . , ur p } ∪ D + S } 5. return CountAlgorithms( , R) 6. c ← 0 7. for each T ⊆ [k] S ⊥ = ∅ or S = ∅ then continue 11. c ⊥ ← CountAlgorithms(k, (p1, . . . , p k ), S ⊥ ) 12. c ← CountAlgorithms(k, (p1, . . . , p k ), S ) 13. c ← c + c c ⊥ 14. return c Enumerating procedures for n = 3

  CCK.Encrypt(pp, pk, m ∈ R) : Generate a vector b ← (-2 β , 2 β ) τ . Output m, x e + b, x 0 x0 . CCK.Decrypt(pp, sk, c) : Output m such that for all i ∈ [n], m i = [c] pi mod g i . This scheme is somewhat homomorphic: addition (resp. multiplication) of ciphertexts in Z x0 implicitly adds (resp. multiplies) componentwise the underlying plaintexts in R. If c is a fresh ciphertext, assume that |[c] pi | ≤ B for all i ∈ [n]. Then if c has been obtained by multiplying 2 d fresh ciphertexts, we have |[c] pi | ≤ B 2 d for all i ∈ [n]; therefore to ensure correctness, one needs to set η = O(log 2 (B 2 d )), that is η = O(2 d ).

  SwitchKey w (τ K→K , c) : On input a switching key τ K→K = {v, σ, N, N , }: 1. Compute the expanded ciphertext c expand = [c] N • v mod w and let c = D ( ) w (c expand ); 2. Output c = c, σ mod N .

e

  }} ← CCK.KeyGen(pp j ). For all j ∈ [d -1], run τ j→j+1 ← SwitchKeyGen Θ,w (n, g, {sk j , N j }, {sk j+1 , N j+1 , j }) ,for j = η j+1 / log 2 w .Output sk = {sk 1 , . . . , sk d } and pk = {pk 1 , . . . , pk d , τ 1→2 , . . . , τ d-1→d }.CCK .Encrypt(pp, pk, m ∈ R) : Run CCK.Encrypt(pp 1 , pk 1 , m).

Algorithm 31 :

 31 M -based Multiplication Algorithm Input: a, b ∈ N. Output: r ∈ N such that r = a × b.

Work factor:

  We know now that κ = κ L -D. Let c 5 = D -N + 1. Replacing step 4 of Algorithm 38 with c 6 ← dn(κc 1 c 5 ), the multiplication of c 1 by κ (κ adjusted to D -N bits, shifting by L -D bits to the right), will be done in O((D -N ) 2 ). Hence, the new work factor decreases to (D -N ) 2 + N (D -N ) = (D -N )D.

. n ← pq 7. return n Example 9 . 1

 91 Let N = 100 and L = 200: r

Algorithm 42 :

 42 DSA Parameter Generation AlgorithmInput: Key lengths P and Q ≤ P . Output: Parameters (p, q).

Algorithm 43 :

 43 Barrett-Friendly DSA Parameter Generation Algorithm Input: Key lengths P and Q ≤ P . Output: Parameters (p, q).

  ω ∈ Z ν , in this section we denote by ||ω|| the quantity ||ω|| = Cost: lm(Q) is at most L, . . . , L hence Q has at most L ν monomials. Shifting discards all monomials having exponent vectors ω for which ∃ j such that ω j < y j,0 . The number of such discarded monomials is O(||y 0 ||), hence the overall complexity of this step is:cost 1 = O ((L ν -||y 0 ||)ν)The number of monomials remaining after the shift is size 1 = O (L ν -||y 0 ||)

  a) Cost: The cost of computing K(Q y 0 ) is cost 2 = O(ν × size 1 × size K ). b) Size: The size of K(Q y 0 ) is determined by lm(K(Q y 0 )) = lm(K)×lm(Q y 0) which has the exponent vector u = (Ly 0 ) + Ly 1,0 , L, . . . , L .

size 2 =

 2 O(||u||)

S

  i = r(α j ) = c(α j ) + e(α j ) ik for i ≤ 1 ≤ 2t.Suppose that r has ν errors denoted e ji . ThenS i = ν j=1 e ji (α i ) j = ν j=1e ji (α j ) i .

Figure 9 .

 9 Figure 9.1: Standard LFSR architecture block diagram. (Design BCH-LFSR)

15 Figure 9 . 2 :

 1592 Figure 9.2: Improved LFSR architecture block diagram. In denotes the module's serial input. (Design BCH-LFSR-improved)

4 )

 4 where S is the service distribution. In particular, for a deterministic service time,E[S] = 1/µ and E[S 2 ] = 1/µ 2 give X = ρ(ρ -2) 2(ρ -1)(9.5)where ρ = λ/µ. We can rewrite Equation9.4 as a function of moments, i.e. X = λf (E[S], E[S 2 ]) with f (x, y) = x + yλ 2 -2xλ (9.6)

a = 2 K 2 t

 22 max + t min -2t 1/2 , (9.18) b = 1 K t max + 3t min -4t 1/2 , (9.19) c = t max . (9.20)Then we define the Lagrange regulator of A to be:R L (X, K, A) = aX 2 + bX + c. (9.21)Note that Equation (9.21) coincides with the distributional regulator of Equation (9.13) when A is the uniform distribution.

  In a famous paper published in 1951[START_REF] John Von Neumann | Various techniques used in connection with random digits[END_REF], von Neumann presented a simple procedure allowing to correct the bias of random sources. Consider a biased binary source S emitting 1s with probability p and 0s with probability 1p. A von Neumann corrector C queries S twice to obtain two bits a, b until a = b. When a = b the corrector outputs a. Because S is biased, Pr[ab = 11] = p 2 and Pr[ab = 00] = (1p) 2 , but Pr[ab = 01] = Pr[ab = 10] = p(1p). Hence C emits 0s and 1s with equal probability.

Figure 9 . 3 :

 93 Figure 9.3: Source correction and regulation.

Figure 9 . 4 :

 94 Figure 9.4: Steady-state output distribution of a Lagrange regulator, with input distribution T = Uniform(200, 600) and memory K = 10, 100, 200, 400, 1000, and 2000. Observe how the variance shrinks as larger values of K are used, with the last distribution being supported on [397, 403]. Compare to the input distribution (µ = 400, σ = 115.4).

Figure 9 . 5 :

 95 Figure9.5: The output distribution's variance diminishes as K increases. This is log log Var(S K ) as a function ok K in the steady-state regime for the same parameter set as Figure9.4. For large values of K this approaches a linear function, meaning that the variance decreases doubly exponentially.

2 )

 2 The integer generated by Equation (10.2) is encoded using C to yield µ(c(m)). Finally, the encoded message ν(m) transmitted over the noisy channel is defined as:µ(m) := m µ(c(m)) (10.3)Note that, if we were to use C directly, we would have encoded m (and not c). The value c is, in most practical situations, much shorter than m. As is explained in Section 10.1.3.1, c is smaller than m (except the cases in which m is very small and which are not interesting in practice) and thereby requires fewer extra bits for correction. For appropriate parameter choices, this provides a more efficient encoding, as compared to C.Decoding: Let α be the received 2 message. Assume that at most t errors occurred during transmission:α = ν(m) ⊕ e = m (µ(c(m)) ⊕ e )where the error vector e is such that h(e) = h(m ⊕ m) + h(e ) ≤ t.Since c(m) is encoded with a t-error-capacity code, we can recover the correct value of c(m) from µ(c(m)) ⊕ e and compute the quantity:

Theorem 10 . 1

 101 Let a, b ∈ Z such that -A ≤ a ≤ A and 0 < b ≤ B. Let p be some prime integer such that 2AB < p. Let s = a • b -1 mod p. Then given A, B, s and p, a and b can be recovered in polynomial time.

10.1. 3 . 1 2 Lemma 10 . 2

 312102 Performance of the new error-correcting code for γ = The bit-size of c(m) is: log 2 p 2 • t log 2 (k ln k). (10.6) Proof: From Equation (10.1) and the prime number theorem 3 .

Corollary 10 . 3

 103 Assume that there exists a constant δ > 1 such that, for k large enough, n(k) ≥ δk. Then for k large enough, n (k) ≤ n(k).Proof: Let k be the size of m and k be the size of c(m). We have n(k) = k + n(k ), therefore n(k)n (k) = n(k) -(k + n(k )) ≥ (δ -1)kn(k ). Now, (δ -1)kn(k ) ≥ 0 ⇔ (δ -1)k ≥ n(k ).

4

 4 The bit-size of c(m) is:log 2 p u + t log 2 (k ln k).(10.12)

p

  iγ+mi+1 mod p A message m is encoded as follows: ν(m) := m µ (ĉ (m))

  Therefore α = ν(m) ⊕ e, where h(e) ≤ t. Write e = e m e ĉ such that α = ν(m) ⊕ e = m ⊕ e m µ(ĉ(m)) ⊕ e ĉ = m µ(ĉ(m)) ⊕ e ĉ.Since h(e) = h(e m ) + h(e ĉ) ≤ t, the receiver can recover efficiently ĉ(m) from α. It is then possible to compute

  As we focus on the new error-correcting code we simply omit the Reed-Muller component. The encoded message is ν(m) = 1100100111 2 129125 10 .Let the received encoded message be α = 1100101011 2 129125 10 . Thus,c(m ) = 2 1 • 3 1 • 5 0 • 7 0 • 11 1 • 13 0 • 17 1 • 19 0 • 23 1 • 29 1 mod p = 748374mod 707293 = 41081 mod 707293. Dividing by c(m) we get Applying the rationalize and factor technique we obtain s = 17 19 mod 707293. It follows that m ⊕ m = 0000001100. Flipping the bits retrieved by this calculation, we recover m.

r

  + au + bv = 0 r 2 + au 2 + bv 2 = 1 r 3 + au 3 + bv 3 = α (10.18)Note that, by design, b = na.

  a)(n -(n + 1)r 2 ) 3 2a 2 (na) 2 Sign(2an).The value at a = n/2 is a minimum. Hence the maximum value of α is attained when either a = 1 or a = n -1 (which is equivalent, up to swapping u and v). Thus the maximal value of α isα = (n -2) n 2 √ n -1 n -(n + 1)r2 3/2 + (n + 1)(n + 2)

5 .

 5 A letter, signed by 'S. Mounier' and dated June 29, 1889, addressed to Major Josse, mentioning the successfully copied version of the original draft. Indeed the first and second documents each appear in two versions: a draft version, with visible crossing-outs and additions; and a clean version. In all probability the clean version is the one mentioned by Mounier.

  Hippolyte Désiré Josse, was born on July 14, 1852 in Montmartre (Seine) near Paris. His parents Jean Louis Désiré Josse (born 1820) and Cécile Amélie Denisia Dufeu (born 1832) had another child, Marie Emilie Eugénie (born 1860). Hippolyte Josse married Alix Amélie Hyvernat (born 1855) in 1881 in Paris.

A

  B C D E F G H I J K L M N O P Q R S T U V X Y Z 1 2 3 45 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

  Decryption: Given a ciphertext c = c 1 • • • c M we first construct d i = S(c i ) -S(c i-1 ) mod 25with the exception of the first, d 1 = 25 -S(c 1 ) mod 25.

16 #

 16 Votre serviteur coeffsp = map ( float , get_coeffsp ( n )) coeffsw = map ( float , get_coeffsw ( n )) # Put the problem in canonical form , i . e . # construct matrix A and vectors b , c # such that the problem is in the form Ax + b <= c A = [] for i in range ( n ): A += [[0.]* i + [1.] + [0.]*( n -i -1)] A += [ map ( lambda y : -y , coeffsp )] for i in range ( n ): A += [[0.]* i + [ -1.] + [0.]*( n -i -1)] A += [ coeffsp ] A = matrix ( A ). trans () b = matrix ([ epsilon ] * n + [ epsilon -1.] + [0.] * n + [1.]) c = matrix ( coeffsw ) # Solve the linear programming problem sol = solvers . lp (c , A , b ) # Extract solution and append p0 p0 = 1 -sum ( i * w for i , w in zip ( sol [ x ] , coeffsp )) pi = [ p0 ] + [ i for i in sol [ x ]] # Compute total work ( for Fiat -Shamir ) w = sum ( i * w for i , w in zip ( sol [ x ] , coeffsw )) # Compute total security sec = -math . log ( epsilon , 2) # Return security , work , efficiency , and optimal probabilities return ( sec , w , sec /w , xi ) # Challenge bits n = Number of sampling points N = 500 # Smallest possible value of epsilon mineps = 2**( -n ) # Save data to a file by uniformly sampling values of epsilon f = open ( output % s . txt %n , w ) plabel = \ t . join ([ p % s %( i ) for i in range ( n +1)]) f . write ( i \ teps \ ts \ tw \ tse \ t % s \ n % plabel ) for i in range ( N ): s = float ( i )/ N * n e = 2**( -s ) s , w , se , xi = solve_lp (e , n ) xi = \ t . join ( map ( str , xi )) f . write ( % s \ t % s \ t % s \ t % s \ t % s \ t % s \ n %( i ,e ,s ,w , se , xi )) f . close () print y ^2* prod ( v [ i ]^e [ i ] for i in range ( k )) == x *( -1)^( w )*(2)^( u ) randint (0 ,1) for i in range ( k )] # Response y = r * prod (( s [ j ])^e [ j ] for j in range ( k )) u = sum ( alpha [ i ]* e [ i ] for i in range ( k )) w = mod ( sum ( beta [ i ]* e [ i ] for i in range ( k )) , 2) # Verifier Checking delta = mod ( inverse_mod (x , n )* y ^2* prod ( v [ i ]^e [ i ] for i in range ( k )) , n ) try : print log ( delta , 2) in ZZ except ValueError : print log (n -delta , 2) in ZZ # The prover compensates $ \ overline { u } $ def version3 randint (0 ,1) for i in range ( k )] # Response u = sum ( alpha [ i ]* e [ i ] for i in range ( k )) w = mod ( sum ( beta [ i ]* e [ i ] for i in range ( k )) , 2) u_overline = u >> 1 u_underline = u % 2 y = 2^( u_overline )* r * prod (( s [ j ])^e [ j ] for j in range ( k )) Gamma = mod ( -1^w * 2^( u_underline . __xor__ (1)) * x , n ) print Gamma == x or Gamma == n -x or Gamma == mod (2* x , n ) or Gamma == mod ( -2* x , n )

Table 1 .

 1 3: Record-breaking factorisation results against moduli from the RSA challenge, as of early 2017. GNFS stands for the general number field sieve, while MPQS stands for the multipolynomial quadratic sieve.

	Year	Number	Size (bits)	Time	Method	Authors
	1991	RSA-100	330	7 MIPS-years	MPQS	Lenstra and Manasse
	1992	RSA-110	364	1 month	MPQS	Lenstra
	1993	RSA-120	397	825 MIPS-years	MPQS	Denny et al.
	1994	RSA-129	426	5000 MIPS-years	MPQS	Atkins et al.
	1996	RSA-130	430	500 MIPS-years	GNFS	Dodson et al.
	1999	RSA-155	512	8000 MIPS-years	GNFS	Aardal et al.
	2003	RSA-576	576	-	GNFS	Franke and Kleinjung
	2005	RSA-200	663	2 years	GNFS	Bahr et al.
	2009	RSA-768	768	2 years	GNFS	Aoki et al.

  2.1 Organisation of this thesis. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 2.2 Personal bibliography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

2.2.1 Conference articles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 2.2.2 Journal articles and book chapters . . . . . . . . . . . . . . . . . . . . . . . . . 40 2.2.3 Under review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 2.2.4 Patents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 2.2.5 Additional publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

  Distributed zero-knowledge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

	Chapter 3
	Identification and authentication
	Contents
	3.1
		Part II
	Cryptographic Primitives and Protocols
		Ed. by William H. Robinson, Swarup Bhunia and Ryan Kastner. IEEE Computer Society,
		2016, pp. 67-70 (cit. on p. 213).
	[BCG + 15]	Éric Brier, Jean-Sébastien Coron, Rémi Géraud, Diana Maimuţ and David Naccache. 'A
		Number-Theoretic Error-Correcting Code'. In: Innovative Security Solutions for Information
		Technology and Communications -8 th International Conference, SECITC 2015, Bucharest,
		Romania, June 11-12, 2015. Revised Selected Papers. Ed. by Ion Bica, David Naccache and
		Emil Simion. Vol. 9522. Lecture Notes in Computer Science. Springer, 2015, pp. 25-35
		(cit. on p. 398).

[AAF

+ 16]

Ehsan Aerabi, A. Elhadi Amirouche, Houda Ferradi, Rémi Géraud,

David

Naccache and Jean Vuillemin. 'The Conjoined Microprocessor'. In: 2016 IEEE International Symposium on Hardware Oriented Security and Trust, HOST 2016, McLean, VA, USA, May 3-5, 2016. 3.1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.2 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.3 Distributed Fiat-Shamir authentication . . . . . . . . . . . . . . . . . . . . . . . 3.1.4 Security Proofs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.5 Variants and implementation trade-offs . . . . . . . . . . . . . . . . . . . . . . 3.1.6 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 Zero knowledge with colliding commitments: Slow-motion zero-knowledge . . . . . . . 3.2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.2 Building blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.3 Slow motion zero-knowledge protocols . . . . . . . . . . . . . . . . . . . . . . 3.2.4 An example slow-motion zero-knowledge protocol . . . . . . . . . . . . . . . . 3.2.5 Security Proof . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.6 Conclusion and further research . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.7 Proof of Lemma 3.4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.8 Girault-Poupard-Stern commitment pre-computation . . . . . . . . . . . . . . . 3.3 Non-uniform zero-knowledge: Thrifty zero-knowledge . . . . . . . . . . . . . . . . . . 3.3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.2 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.3 Optimizing E(P ↔ V) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.4 Thrifty zero-knowledge protocols . . . . . . . . . . . . . . . . . . . . . . . . .

  which proves that the real and simulated distributions are statistically indistinguishable if SB/A is negligible.

Table 3 .

 3 1: Challenge effort distribution for SD[START_REF] Stern | A New Identification Scheme Based on Syndrome Decoding[END_REF], with a 16 × 16 parity matrix H, over 10 4 runs.

	Challenge	Operations by prover	Time	Optimal p i
	0 1 2	Return y and σ Compute y ⊕ s Compute y • σ and s • σ	0 s ±0.01 747.7 s ±2 181.22 s ±2	0.333 0.333 0.333
	The authors implemented 10 the SD, PKP and PPP protocols, and timed their operation as a function of
	the challenge class. Only the relative time taken by each class is relevant, and can be used as a measure of

Table 3 .

 3

	2: Challenge effort distribution for PKP [Sha90a], over 10 7 runs.
	Challenge	Operations by prover	Time	Optimal p i
	0 1		Compute W Compute W and π(σ)	390 s ±2 403 s ±2	0.5 0.5
	Table 3.3: Challenge effort distribution for PPP [Poi95], over 10 6 runs.
	Challenge	Operations by prover	Time	Optimal p i
	0 1 2 3	Return P, Q, W Compute W + Q -1 V Compute Q(P (A)) and Q -1 V Compute Q -1 V	0.206 s ±0.05 6.06 s ±0.05 21.13 s ±0.5 4.36 s ±0.05	0.25 0.25 0.25 0.25

Chapter 4 Digital signatures and integrity Contents 4

  .1 Universal witness signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 4.1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 4.1.2 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 4.1.3 Applications: From UWS to other primitives . . . . . . . . . . . . . . . . . . . . 80 4.1.4 Construction of UWS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 4.1.5 Adaptive security of the OWF-based construction . . . . . . . . . . . . . . . . . 90 4.1.6 Security proof of the PCD-based construction . . . . . . . . . . . . . . . . . . . 92 4.1.7 Security proof of the VBB-based construction . . . . . . . . . . . . . . . . . . . 92 4.1.8 Proof of security, context-hiding and succinctness of the weak iO based construction 93 4.1.9 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 4.2 Legally fair contract signing without keystones . . . . . . . . . . . . . . . . . . . . . . . 98 4.2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

	. 98
	4.2.2 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
	4.2.3 Legally fair co-signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	4.3 Reusing nonces in Schnorr signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	4.3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	4.3.2 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1) in the Fiat-Shamir case are given in Appendix B.1. 4.3.3 ReSchnorr signatures: using multiple q's . . . . . . . . . . . . . . . . . . . . . .
	4.3.4 Generic security of the partial discrete logarithm problem . . . . . . . . . . . .
	4.3.5 Provably secure pre-computations . . . . . . . . . . . . . . . . . . . . . . . . .
	4.3.6 Implementation results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	4.3.7 Heuristic security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	4.3.8 Reduction-friendly moduli . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	4.3.9 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	4.4 Attestations for RSA prime generation algorithms . . . . . . . . . . . . . . . . . . . . .
	4.4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	4.4.2 Outline of the approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	4.4.3 Model and analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	4.4.4 Security and parameter choice . . . . . . . . . . . . . . . . . . . . . . . . . . .
	4.4.5 Compressing the attestation . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	4.4.6 Parameter settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	4.4.7 Conclusion and further research . . . . . . . . . . . . . . . . . . . . . . . . . .
	4.4.8 Implementing the second hash function H . . . . . . . . . . . . . . . . . . . .
	and sympy 0.7.6.1.
	12 http://cvxopt.org/

  • P C (crs, π i , z i .z o , linp) → π o for a compliance predicate C ∈ C which takes as input a common reference string crs, inputs z i with corresponding proofs π i , a local input linp, and an output z o . The algorithm produces a proof π o for the fact that z o is consistent with some C-compliance transcript such that C ∈ C. • V C (crs, z o , π o ) → {True, False} for a compliance predicate C ∈ C takes as input a common reference string crs, an output z o with corresponding proof π o , the algorithm returns True if π o is a valid proof of the fact that z o is consistent with some C-compliance transcript, otherwise it returns False.

	And there exists a negligible function ε(•) such that (G, P, V) satisfies:
	• Completeness: For every compliance predicate C ∈ C and (possibly unbounded) distributed computation generator S,

  Obfuscation of programs is a powerful notion in cryptography, as it enables many attractive protocols[START_REF] Sahai | How to use indistinguishability obfuscation: deniable encryption, and more[END_REF].As proved byBarak et al. [BGI + 12], the ideal Virtual Black-Box can not be achieved for all functions. They proposed two weaker versions of obfuscators: indistinguishable obfuscator (iO) and differing-input obfuscator(diO). Previous research on obfuscations shows that a weak version of diO (different only on polynomial many inputs) can be constructed using iO proposed by Boyle et al.[START_REF] Boyle | On Extractability Obfuscation[END_REF], and as shown by Garg et al. [GGH+ 13] we can construct indistinguishable obfuscator for polynomial size circuits.

	Definition 4.9 (Indistinguishability obfuscation) A uniform PPT machine iO is called an indistinguish-
	able obfuscator (iO) for a Turing Machine class {M λ }, if it verifies the two following properties:
	1. Functionality preserving. For all security parameters λ ∈ N, for all M ∈ M λ , for all inputs x, we have that
		Pr [M (x) = M (x)|M ← iO(λ, M )] = 1
	2. Indistinguishability obfuscation. For any (not necessarily uniform) PPT distinguisher (Samp, D),
	there exists a negligible function ε(•) such that the following conditions holds: if for all security parameters
	λ ∈ N.	Pr ∀x.M 0

  .2.

	Setup(1 λ ):	Sign(SK id , id, m):
	return UWS.Setup(1 λ )	return UWS.Delegate PP, SK id , id, (id, m)
	Extract(PP, SK id , id, id ):	Verify(PP, σm, m, id):
	return UWS.Delegate(PP, SK id , id, id )	return UWS.Verify PP, σm, (id, m)

  B , vk B ) for Sig is generated, together with a signature σ B on (B, w B≤A , vk B ) using the siging key sk A The algorithm then computes an extended certificate c B by prepending (vk B , B, w B , σ B ) to c A , and returns the signature SK B as (sk B , c B ). The construction of UWS based on the one-way function is correct.

	This construction is summarized in Figure 4.4. (msk, mvk) ← Sig.Setup(1 λ ) (sk * , vk * ) ← Sig.Setup(1 λ ) σ vk * ← Sig.Sign(msk, ( * , w * ≤ * , vk * )) c * ← [(vk * , * , w * ≤ * , σ vk * )] return (mvk, (sk * , c * ) Theorem 4.1 Setup(1 λ ):	Delegate(mvk, SKA, A, B, w): skA, cA ← SKA {(vki, i, wi, σ vk i )} ← cA Check certificate and witnesses: Assert Sig.Verify(vkj-1, (idj, wj, vkj), σj) for all j Assert B ≤w A ≤w A≤idn idn, . . . , * ≤w * ≤ * * Check public key: m $ ← -random(1 λ ) σm ← Sig.Sign(skA, m) Assert Sig.Verify(vkA, m, σm) Generate new key pair and certificate: (skB, vkB) ← Sig.Setup(1 λ ) σ vk B ← Sig.Sign(skA, (B, w B≤A , vkB)) cB ← (vkB, B, w B≤A , σ vk B ) :: cA return SKB = (skB, cB))

  C(z out , linp, z in ): parse z out as (VK B , SK B , w B≤A , σ VK B ), and suppose z in = (VK A , SK A , w A≤C , σ VK A ) with C the predecessor of A. The algorithm C(z out , linp, z in ) outputs True if -Sig.Verify(VK A , (linp(B), w B≤A , VK B ), σ VK A ) == True

	-B ≤ w B≤A A
	-For a random message m, we have Sig.Verify(VK B , m, Sig.Sign(SK B , m)) == True.

•

  Setup(1 λ ) → (PP, SK * ): Let (mvk, msk) ← Sig.Gen(1 λ ), then use the generation algorithm of the proof-carrying data to get PP = crs ← G(1 λ ). Let z * = (VK * , SK * , " * ≤ * ", σ VK * ), then SK * = (z * , π * ) with σ VK * = Sig.Sign(msk, ( * , " * ≤ * ", VK * )) and π * ← P(crs, ⊥, ⊥, z * , * ) • Delegate(PP, SK A , A, B, w B≤A ) → SK B : -Parse SK A as (z A , π A ) with z A = (VK A , SK A , w A≤C , σ VK A ). We first check whether π A is valid proof of the fact that z A is consistent with the C-compliance transcript. If it fail this test then the algorithm ouputs ⊥ -If the check suceeds, use the underlying signature scheme's generation algorithm to get (SK B , VK B ) ← Sig.Gen(1 λ ), and use the sign algorithm to get σ VK B = Sig.Sign(SK A , (B, w A≤B , VK B )). Let z B = (VK B , SK B , w B≤A , σ VK B ). Finally use the proof algorithm P to generate a proof of z B : π B ← V(crs, z A , π A , z B , B) which is a proof of the fact that z B is consistent with the C-compliance transcript. The algorithm outputs SK B = (z B , π B ).

	--This construction is summarized in Figure 4.5.
	Setup(1 λ ):	Delegate(mvk, SKA, A, B, w):
	(msk, mvk) ← Sig.Setup(1 λ )	(zA, πA) ← SKA
	crs ← G(1 λ )	(VKA, SKA, w A≤C , σ VK A ) ← zA
	σ VK * ← Sig.Sign(msk, ( * , " * ≤ * ", VK * ))	Assert that πA is valid proof of zA / C-compliance
	π * ← P(crs, ⊥, ⊥, z * , * )	(SKB, VKB) ← Sig.Gen(1 λ )
	z * = (VK * , SK * , " * ≤ * ", σ VK * )	σ VK B ← Sig.Sign(SKA, (B, w A≤B , VKB))
	return ((z * , π * ), crs)	zB ← (VKB, SKB, w B≤A , σ VK B )
		πB ← V(crs, zA, πA, zB, B)
		return (zB, πB)

  B≤A ): return P (mvk, SK A , A, B, w B≤A ), where P is described in Algorithm 3, in which msk is a constant. This algorithm is doing directly what we want to do, it checks if SK A is a valid signature of the identity A. Using the functionality of VBB obfuscation, we can see that the valid signature SK A is equal to Sig.Sign(msk, A). Thus if B ≤ w A and SK B = Delegate(PP, SK A , A, B, w) then wee have Sig.Verify(mvk, B, SK B ) outputs True, which means Verify(mvk, SK B , B) does not output ⊥.

	Proof:
	• Correctness.
		Then compute the VBB
		obfuscation P = O(P [msk]) of the algorithm P [msk]
		-The master signing key (signature of * ) SK * is Sig.Sign(msk, * ) and the public parameter is PP = (P , mvk).
	• Delegate(PP, SK A , A, B, w Algorithm 3: P [msk]
	Input: mvk, SKA, A, B, w.
	Output: SKB or ⊥.
	1. if Sig.Verify(mvk, A, SKA) ∧ A ≥w B
	2.	return SKB = Sig.Sign(msk, B)
	3. else
	4.	return ⊥
	Theorem 4.5 The construction based on VBB obfuscation is correct, succinct and context-hiding.

  al.[BGI + 12]. The virtual black-box obfuscator for all circuits does not exist. Thus we try to construct our UWS scheme in a somewhat more reasonable setting. To construct a UWS scheme achieving context-hiding property, we use in this section two main tools: Punctured PRFs (Definition 4.8) and indistinguishable obfuscators (Definition 4.10).

w

  A≤n , σ vk A ), (vk n , n, w n≤n-1 , σ vkn ), . . . , (vk 1 , 1, w 1≤ * , σ vk1 ), (vk * , * , w * ≤m , σ vk * )]) 2. For m ← random(1 λ ) and σ m ← Sig.Sign(m, sk A ), we have Sig.Verify(vk A , m, σ m ) outputs True

	3. Sig.Sign(sk A , m) == σ m
	4. The identities verifies that A ≤ w A≤n n ∧ • • • ∧ * ≤ w * ≤ * * .
	5. Each signature in the certificate verifies the following conditions:
	• Sig.Verify(mvk, * ||w * ≤ * ||vk * , σ vk * ) → True
	•	. . .

• Sig.Verify(vk n-1 , n||w n≤n-1 ||vk n , σ vkn ) → True • Sig.Verify(vk n , A||w A≤n ||vk A , σ vk A ) → True • Sig.Verify(vk n , sk A , σ sk A ) → True

  As for the identity m, it has only at most B elements bigger than m including itself, and by the construction, in the B.e i .random all these values are in the set L B . Thus if there exists A which can break the hybrid B.e i .random. Then by definition A can produce a signing key SK A corresponding to the identity A which is lager than B and verifying that Delegate(PP, SK A , A, A, "∀x.x ≤ x") = ⊥. To pass this test, as A ∈ L B , SK A must verify that f (SK A ) = H L B (A), but remind that as A ∈ L B , H L B is a randomly chosen value. Such an A thus breaks the security of the one-way function.

A can break the security of the hybrid B.e i .random. Then A can also break the security of the one-way function. Denote the probability of distinguishing these two hybrids by ε OWF .

Proof: [of

Lemma 4.13]

  Therefore, should Alice try to exhibit as in Example 4.2 a signature of Bob alone on a message they both agreed upon (which is known as a fraud), the court would be able to identify Alice as the fraudster. , kA(or ZKA(kA)), sB ∃sB, t ∈ L s.t. ν(t, g s B -s B )

	proof of involvement			proof of involvement
	m, r, sB m, r? = True ν(t, g k A ) ∃t ∈ L s.t.
	n o	Alice is not involved with m. Bob gets deniability.	n o
		No party involved with m.
		Alice is Bob's
	yes	authorized signatory. Now check Bob's role.	yes, sB ← sB + kA
	n o	r	? = g s B y e B	y e s
	Alice is Bob's authorized signatory, but Bob did not sign. No party involved with m.		Alice cheated. Both parties are involved with m.

Bob , signature by Bob on m} signature by Alice on m Second, the co-signature protocol of Protocol 6 is modified by requesting that Alice provide t to Bob. Bob stores this in a local memory L along with s B . Together, t and s B act as a keystone enabling Bob (or a verifier, e.g. a court of law) to reconstruct Γ Alice,Bob if Alice exhibits a (fraudulent) signature binding Bob alone with his co-signing public key. ? = True

  This is joint work with Marc Beunardeau, Aisling Connolly, David Naccache, and Damien Vergnaud. This work was accepted at the 22 nd European Symposium on Research in Computer Security, ESORICS 2017, Oslo (Norway) and published as [BCG + 17e].

  • Choose x with low Hamming weight as proposed by Agnew et al. [AMO + 91]; • Choose x to be a random Frobenius expansion of low Hamming weight, as discussed by Galbraith [Gal12, Sec. 11.3];

• Choose x to be given by a random addition chain, as proposed by

Schroeppel et

al. [SOO + 95]; • Choose x to be a product of low Hamming weight integers as suggested by Hoffstein and Silverman [HS03]-broken by Cheon and Kim [CK08]; • Choose x to be a small random element in GLV representation-broken by Aranha et al. [AFG + 14]; Finally, a third branch of research uses large amounts of pre-computation to generate random pairs (x, g x mod p). The first effort in this direction was Schnorr's [Sch90], quickly broken by de Rooij [de 97]. Other constructions are due to Brickell et al. [BGM + 93], Lim and Lee [LL94], and de Rooij [de 95]. The first provably secure solution is due to Boyko et al. [BPV98], henceforth BPV, which was extended and made more precise by [NSS01; CMT01; NS99]. This refined algorithm is called E-BPV (extended BPV).

Table 4 .

 4 2: Timing results for Schnorr and ReSchnorr, at 128-bit security (P = 3072, Q = 256). Computation was performed on an ArchLinux single-core 32-bit virtual machine with 128 MB RAM. Averaged over 256 runs.

	Scheme	Storage	Precomp.	Time (per sig.)
	Schnorr	-	-	6.14 ms
	Schnorr + [NSS01]	170 kB	33 s	105 ms
	Schnorr + [NSS01] + [BGM + 93]	170 kB	33 s	2.80 ms
	Schnorr + [NSS01] + [BGM + 93]	750 kB	33 s	2.03 ms
	Schnorr + [NSS01] + [BGM + 93]	1 MB	34 s	2.00 ms
	Schnorr + [NSS01] + [BGM + 93]	2 MB	37 s	2.85 ms
	Schnorr + [LL94]	165 kB	3 s	949 ns
	Schnorr + [LL94]	750 kB	3 s	644 ns
	Schnorr + [LL94]	958 kB	3 s	630 ns
	Schnorr + [LL94]	1.91 MB	3 s	472 ns
	ReSchnorr	-	-	5.94 ms
	ReSchnorr + [NSS01]	170 kB	33 s	9.2 ms
	ReSchnorr + [NSS01] + [BGM + 93]	170 kB	33 s	1.23 ms
	ReSchnorr + [NSS01] + [BGM + 93]	750 kB	33 s	426 ns
	ReSchnorr + [NSS01] + [BGM + 93]	1 MB	34 s	371 ns
	ReSchnorr + [NSS01] + [BGM + 93]	2 MB	37 s	327 ns
	ReSchnorr + [LL94]	165 kB	3 s	918 ns
	ReSchnorr + [LL94]	750 kB	3 s	709 ns
	ReSchnorr + [LL94]	958 kB	3 s	650 ns
	ReSchnorr + [LL94]	1.91 MB	3 s	757 ns

Table 4 .

 4

	Scheme	Storage	Time (/sig.)
	Schnorr	-	35.2 ms
	Schnorr + [LL94]	715 kB	508 ns
	Schnorr + [NSS01] + [BGM + 93]	750 kB	2.08 ms
	Schnorr + [NSS01] + [BGM + 93]	1.87 MB	1.62 ms
	Schnorr + [LL94]	1.87 MB	476 ns
	ReSchnorr	-	33.0 ms
	ReSchnorr + [LL94]	715 kB	486 ns
	ReSchnorr + [LL94]	1.87 MB	467 ns
	ReSchnorr + [NSS01] + [BGM + 93]	1.87 MB	263 ns

3: Timing results for Schnorr and ReSchnorr, at 192-bit security (P = 7680, Q = 384). Computation was performed on an ArchLinux single-core 32-bit virtual machine with 128 MB RAM. Averaged over 256 runs.

  times by the final users of the attested moduli. This is joint work with Fabrice Benhamouda, Houda Ferradi, and David Naccache. This work has been accepted at the 22 nd European Symposium on Research in Computer Security, ESORICS 2017, Oslo (Norway). and the corresponding paper is published as [BFG + 17a].

Table 4 . 4 :

 44 Summary of the various parameters λ security parameter (all the other parameters are function of λ) P size of prime numbers p i generated by G R size of the seed used by G to generate a prime number k number of primes generated by the attestator A, which is the dominating cost of A u number of moduli output by A (u = 1 in the multi-prime variant, and u ≥ 2 in the multi-modulus variant) number of factors of each modulus n i : |n i | = P

Table 4 .

 4

	log 2 k	Time	= 6	= 8	= 10	= 12	= 14	= 16	= 18	= 20
	8	25 s	43	54	64	72	79	84	89	93
	9	51 s	53	69	83	95	107	117	126	135
	10	1.7 m	64	83	101	118	134	148	162	175
	11	3.4 m	74	97	119	140	160	179	197	214
	12	6.8 m	84	111	138	162	186	209	231	253
	13	13.7 m	94	125	156	185	212	239	266	291
	14	27.3 m	104	139	174	207	238	269	300	329
	15	54.6 m	114	153	192	229	264	299	334	367
	16	1.8 hrs	124	167	210	251	290	329	368	405
	17	3.6 hrs	134	181	228	273	317	359	402	443
	18	7.3 hrs	144	195	246	295	343	389	436	481
	19	14.6 hrs	154	209	264	317	369	419	470	519
	20	1.2 d	164	223	282	339	395	449	504	557
	21	2.4 d	174	237	300	361	421	479	538	595

5: Some typical parameters for multi-factor attestation (u = 2). Each table entry contains λ for the corresponding choice of k and .

  as in Lemma 5.12) 2. Compute f k as a list of monomials 3. Use Lemma 5.14 to compute D f

k 4. Use Barvinok's algorithm (Algorithm 16) to get the function g(P ; z) 5. Apply D f k to g(P ; z) to get g(P, f k ; z) 6. Using residue techniques, compute

Table 5 .

 5 1: Comparison of the original and pack-adjusting mixed-radix linear-bandwidth Chevallier-Mames-Naccache-Stern encryption, for γ = 4, = 1. Since the introduction of public-key cryptography in the late 1970's [DH76; Mer78; Pur74; RSA78; KM04; MH78], many candidate constructions were proposed based on the assumption that some mathematical problem is hard to solve.Prime example of hard problems considered in the literature include: Factorizing a large number[START_REF] Michael O Rabin | Digitalized signatures and public-key functions as intractable as factorization[END_REF]; Finding the e-th root modulo a composite n of arbitrary numbers, when n is the product of two large primes[START_REF] Rivest | A Method for Obtaining Digital Signature and Public-Key Cryptosystems[END_REF]; Solving a large enough instance of the knapsack problem [MH78; NS97]; Finding the discrete logarithm in a group of large prime order [DH76; Kob87; Mil86; SS98].

	n	Minimal p	CMNS	MR-CMNS	Radix
		11	2 bits	2 bits	4
		137	4 bits	4 bits	3, 6
		4931	6 bits	7 bits	2, 7, 11
		260849	8 bits	10 bits	2, 4, 9, 17
		18517753	10 bits	13 bits	2, 2, 8, 15, 23
		1648077367	12 bits	16 bits	2, 2, 4, 12, 19, 30
		176344276177	14 bits	19 bits	2, 2, 3, 7, 14, 23, 37
		23101100172959	16 bits	23 bits	2, 2, 2, 5, 10, 19, 28, 44
		3488266126107761	18 bits	26 bits	2, 2, 2, 3, 9, 12, 22, 32, 51

Definition 5.11 (Computational Indinguishability)

  Let {X n } and {Y n } be families of probability distributions where X n , Y n are probability distributions over {0, 1} (n) for some polynomial (•). We say that {X n } and {Y n } are computationally indistinguishable if, for all non-uniform PPT D, there exists a negligible function (n) such that for all n,

  and, given a random instance Q ∈ R Q and a purported solution A to Q, no known algorithm can decide whether A is a solution to Q, i.e. evaluate S(Q, A), with non-negligible advantage over 1/|A|; while humans can determine with high probability S(Q, A) in reasonable time. Let Q / ∈ CP be a set of "decoy data" which are not CAPTCHAs. A given problem Q ∈ ECP (Existential CP) if Q ∈ CP and, given a generic instance Q ∈ Q or a decoy Q ∈ Q, no known algorithm can decide whether Q ∈ Q with non-negligible advantage over |Q|/|Q ∪ Q|; while humans can decide correctly if Q ∈ Q or Q ∈ Q in reasonable time with high probability.

	Finally, we introduce a further class of problems:
	Definition 5.21 (Informal)

Table 5 .

 5 When organized crime applies academic results . . . . . . . . . . . . . . . . . . . . . . 195

	Clause Level
	Simple declarative clause
	Clause introduced by a (possibly empty) subordinating conjunction.
	Phrase Level
	Adverb phrase
	Noun phrase
	Prepositional phrase
	Verb phrase
	Word Level
	Conjunction, coordinating
	Determiner
	Preposition or subordinating conjunction
	Adjective
	Modal
	Noun, singular or mass
	Pronoun, personal
	Pronoun, possessive
	Adverb
	Verb, base form
	Verb, past participle
	Verb, third person singular present

2: Partial list of grammatical roles. 6.1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195 6.1.2 Physical analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 6.1.3 Protocol analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202 6.1.4 Side-channel power analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204 6.1.5 Destructive analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206 6.1.6 Aftermath & lessons learned . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207 6.1.7 Other applications of miniature spy chips . . . . . . . . . . . . . . . . . . . . . 209 6.2 The conjoined microprocessor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213 6.2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213 6.2.2 Technical background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214 6.2.3 Parallelization and alternation . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 6.2.4 Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219 6.2.5 Correlation power attack experiments . . . . . . . . . . . . . . . . . . . . . . . 221 6.2.6 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 6.3 Process table covert channels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 6.3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 6.3.2 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224 6.3.3 Overview of the attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225 6.3.4 Countermeasures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226 6.3.5 Experimental setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228

Table 6 .

 6 1: Different types of dependence.

	RaW	WaR	WaW
	opcode 1

Table 6 .

 6 2: Barrier synchronization instruction brr.

	Q0	Q1
	. . .	. . .
	lda mem1	brr LABEL1
	LABEL1:	sta mem1
	. . .	. . .

Table 6 .

 6 3: Carrier synchronization instruction crr.

	Q0	Q1
	. . .	. . .
	lda mem1	crr LABEL2,A
	LABEL2:	add 0x20
	. . .	. . .

Table 6 .

 6 4: Queues after applying Algorithm 22.

	Instruction	Q0	Q1
	1	lda mem1	ldx mem2
	2	LABEL_0_1:	LABEL_1_1:
	3	inca	incx
	4	LABEL_0_2:	brr LABEL_0_1
	5	brr LABEL_1_1	stx mem1
	6	sta mem2	crr LABEL_0_2,A
	7	-	mul

Table 6 .

 6

	5: Performance and Area on a Xilinx xc6slx4-3tqg144 FPGA
	Design	Regs	LUTs	Freq.
	Standard 68 05	137	1288	120 MHz
	CμP 68 05	165	1375	115 MHz
	Ratio between designs	1.02	1.07	0.96

  ARMv8 shellcodes from ' A' to 'Z' . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Control-flow obfuscation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Where there is Power there is Resistance . . . . . . . . . . . . . . . . . . . . . . . . . . 7.3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.3.2 Resistive hardware trojan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.3.3 Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.3.4 Attacking cryptosystems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.3.5 Countermeasures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.3.6 Galton-Watson conditioning and search space growth . . . . . . . . . . . . . . . 7.3.7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.4 Optimal botnet attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.4.2 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.4.3 Notations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.7 Percolation-first strategy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287 7.4.8 Limitations and improvements . . . . . . . . . . . . . . . . . . . . . . . . . . . 288

	Chapter 7
	Exploitation
	Contents
	7.1

7.1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.1.2 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.1.3 Building the instruction set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.1.4 Higher-level constructs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.1.5 Fully alphanumeric AArch64 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.1.6 Experimental results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.1.7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.1.8 Source code of Program 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.1.9 Alphanumeric instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.1.10 Alphanumeric AND . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.1.11 Encoder's Source Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.1.12 Decoder's source code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.1.13 Hello World shellcode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.1.14 Polymorphic engine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2 7.2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.2 Control flow graph transcompilation . . . . . . . . . . . . . . . . . . . . . . . . 7.2.3 Control flow graph obfuscation . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.4 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.5 Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.6 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.3 7.4.4 Deterministic attack plans . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.4.5 Analysing adaptive attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.4.6 The ÜberBot: Fully adaptive attacks . . . . . . . . . . . . . . . . . . . . . . . . 7

  Moving a register A into B can be performed in two steps: first we set the destination register to zero, and then we xor it with the source register. The xor operation is described in Section 7.1.4.2.Another method for moving w11 into w16 is the following:

	adds w17 , w11 , #0 xc10
	subs w16 , w17 , #0 xc10

  The following program prints "Hello world" when executed. It can be tested with QEMU the options qemu-system-aarch64 -machine virt -cpu cortex-a57 -nographic -kernel shellcode.bin -m 2048 --append "console=ttyAMA0". It was generated by the program described in Section 7.1.5. The notation (X)ˆ{Y} means that X is repeated Y times.

	/* S ++ */
		ADDS	WS , WS , #0 xC1A
		SUBS	WS , WS , #0 xC19
		TBZ	WZ , #0 b01001 , next
	pool :	11) repeat (978 , { .word 0 x42424242 })
	define ({ S } , 2)
	define ({ A } , 18) /* NOPs */
	define ({ B } , 25) next : repeat ( 77 ,
	define ({ U } , 26)	{ ANDS WU , WU , WU , lsr #12})
	define ({ Z } , 19)
		TBZ	WZ , #0 b01001 , loop
	define ({ WA } , concat (W , A ))
	define ({ WB } , concat (W , B ))
	define ({ WP } , concat (W , P )) define ({ XP } , concat (X , P )) 7.1.13 Hello World shellcode
	define ({ WQ } , concat (W , Q ))
	define ({ XQ } , concat (X , Q ))
	define ({ WS } , concat (W , S ))
	define ({ WU } , concat (W , U ))
	define ({ WZ } , concat (W , Z ))
	divert (0) dnl
	jiL0JaBqJe4qKbL0kaBqkM91k121sBSjsBSjb2Sj /* Set P */ l1 : ADR b8Y7R1A9Y5A9Jm01Je0qrR2J9O0r9CrJyI38ki01 XP , ke0qBh01Bd0qszH6PPBPJHMBAOPPPPIAAKPPPPID l1 +0 b010011000110100101101 PPPPPPADPPALPPECPBBPJAMBPAPCHPMBPABPJAOB /* Sync with pool */ SUBS BAPPDPOIJAOOBOCGPAALPPECAOBHPPGADAPPPPOI WP , WP , #0 x98 , lsl #12 SUBS FAPPPPEDJPPAHPEBOGOOOOAGLPPCEOMFOMGKKNJI WP , WP , #0 xD19 OMPCPPIAOCPKPPOIOCPCPPJJFPPBDPCIHPPPPPCD
	GCPFPPIANLOOOOIGOLOOOOAGOCPKDPOIOMGKLBJH /* Set Q */ l2 : ADR LPPCEOMFOMGKKOJIPPPMHPEBOMPCPPIANDOOOOIG XQ , JPPLHPEBNBOOOOIGHPPMHPEBNPOOOOIGHPPMHPEB l2 +0 b010011000110001001001 MNOOOOIGNPPMHPEBMLOOOOIGHPPEHPEBMJOOOOIG /* Sync with TBNZ */ SUBS PPPDHPEBMHOOOOIGNPPNHPEBMFOOOOIGNPPMHPEB WQ , WQ , #0 x98 , lsl #12 ADDS MDOOOOIGDPPNHPEBMBOOOOIGHPPMHPEBMPOOOOIG WQ , WQ , #0 xE53 ADDS HPPLHPEBLNOOOOIGBPPDHPEBLLOOOOIGDPPAHPEB WQ , WQ , #0 xC8C LJOOOOIGPPPPHPEBOMGKLAJHLPPCEOMF
	( BBBB )^{854} /* Z :=0 */ ANDS ( Z3Zj )^{77} ANDS szO6	WZ , WZ , WZ , lsr #16 WZ , WZ , WZ , lsr #16
	/* S :=0 */
		ANDS	WS , WZ , WZ , lsr #12
	/* Branch to code */
	loop :	TBNZ	WS , #0 b01011 ,
			0 b0010011100001100
	/* Load first byte in A */
		LDRB	WA , [ XP , #76]
	/* Load second byte in B */
		LDRB	WB , [ XP , #77]
	/* P +=2 */
		ADDS	WP , WP , #0 xC1B
		SUBS	WP , WP , #0 xC19
	/* Mix A and B */
		EON	WA , WZ , WA , lsl #20
		/* ANDS WB , WB , #0 xFFFF000F */
		.word	0 x72304C00 +33* B
		EON	WB , WB , WA , lsr #16
	/* STRB B , [ Q ] */
		STRB	WB , [ XQ , WZ , uxtw ]
	/* Q ++ */
		ADDS	WQ , WQ , #0 xC1A
		SUBS	WQ , WQ , #0 xC19

  Example 7.1 Consider the following program, implementing a simple double-and-add algorithm:

	dbl_add ( int , int ):			; Compute ab from integer arguments a and b
	test	esi , esi
	mov	eax , 0			; tmp = 0
	jle	.end			; if b == 0 , return tmp
	.loop :
	lea	edx , [ rax + rax ]	; tmp2 = 2 tmp
	add	eax , edi		; tmp = tmp + a
	test	sil , 1
	cmovne eax , edx		; if b even set tmp = tmp2
	sar	esi			; shift b to the right
	jne	.loop			; loop if b > 0
	rep ret
	.end :
	rep ret
	The CFG associated to this program is represented in Figure 7.3, where the instructions' arguments have been
	removed for clarity. The associated restricted CFG is represented in Figure 7.4.
		test	mov	jle	lea	add	test	cmovne	sar	jne	rep ret
			Figure 7.3: Full CFG of the program of Example 7.1.
			test + mov	jle	lea	add • • • sar	jne	rep ret

  As we know in advance how to move from node A to node B or C, we can save the routes in some constants A_to_B and A_to_C. Hence, we use the following code:

	cmp ( ... )	; comparison
	je B	; conditional jump to B
	C	; next node
	mov routing_variable , A_to_C	; set routing variable
	cmp ( ... )		; comparison
	cmove routing_variable , A_to_B ; set routing variable iif comparison succeeds

  asymptotically bounded below by n j=1 j/4 ∼ n 2 /8 and above by n • n/4 ∼ n 2 /4. As a result, we obtain

Table 7 .

 7 1: Simulation of the attack with a single trojan, in the discrete log groups specified in RFC 5114. The leakage bit is recovered with probability p. Simulation in Sage run on a single core of Xeon E5-2697v3 workstation. Average over 100 trials for each parameter set. • 10 4 113 ms 4.8 • 10 4 430 ms 5.2 • 10 5 5.8 s 224-bit group 1.3 • 10 4 140 ms 2.6 • 10 4 300 ms 2.9 • 10 5

	p = 100%	p = 99%	p = 97%	p = 95%
	Space CPU time Space CPU time Space CPU time Space CPU time
	160-bit group 6.6 • 10 3	50 ms	1.4 4.3 s	4.3 • 10 6	73 s
	256-bit group 1.8 • 10 4 220 ms 4.7 • 10 4 600 ms 1.4 • 10 6	25 s	-	-

Table 7 .

 7 2: Simulation of the attack with k trojans, in the 256-bit discrete log group of RFC 5114, in the all-or-nothing model (at each iteration, all k bits are recovered with probability p, and nothing is recovered otherwise). The probability p crit = 2 k-1 /(2 k -1) is the theoretical bound for a polynomial-size search tree. Average over 100 trials for each parameter set.

		p = 80%	p = 70%	p = 60%	p = 50%
		p crit Space CPU time Space CPU time Space CPU time Space CPU time
	k = 2	66% 990	14 ms	1500	16 ms	2.3 • 10 4 250 ms	-	-
	k = 3	57% 280	5 ms	400	7 ms	1120	13 ms	1.1 • 10 4 120 ms
	k = 4	53% 240	5 ms	330	6 ms	630	9 ms	2010	25 ms

Table 7 .

 7 3: Simulation of the attack with k trojans, in the 256-bit discrete log group of RFC 5114, in the bitwise model (at each iteration, each of the k bits is recovered with probability p). The probabilityp crit = 2 • (1 -2 -1/k) is the theoretical bound for a polynomial-size search tree. Average over 100 trials for each parameter set.

		p = 60%	p = 50%	p = 40%		p = 30%
		p crit Space CPU time Space CPU time Space CPU time Space CPU time
	k = 2	59% 3500	50 ms	-	-	-	-	-	-
	k = 3	41% 550	10 ms	890	15 ms	5.1 • 10 4 870 ms	-	-
	k = 4	32% 370	9 ms	480	11 ms	930	18 ms	1.2 • 10 4 190 ms

Table 7 .

 7 4: Network parameters for the scenario of Example 7.5.

	Node	A(r)	B	C
	Saul	0.2r	10	2
	Simon	0.8	3	1

Table 7 .

 7 5: The frequencies of different timings. Finding an adaptive P opt for n = 4 (start of process). Community-serving proofs of work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1.2 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1.3 Formalising the NCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1.4 Faster NCP solving . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1.5 NCP-solving as a proof of work . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1.6 Conclusion and open questions . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1.7 Solving NCP using a single SVP oracle query . . . . . . . . . . . . . . . . . . . 8.2 Optimal batch signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.1 Introduction and motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.2 Intuition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.3 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.4 Optimal batch verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.5 Pruning the generation tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.6 Approximation heuristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.7 Equivalences and symmetries for n = 3 . . . . . . . . . . . . . . . . . . . . . . 8.2.8 Best testing procedure at a point . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.9 Enumerating procedures for n = 3 . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.10 Conclusion and open questions . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3 Multilinear maps with polylog complexity . . . . . . . . . . . . . . . . . . . . . . . . . 8.3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3.2 Notations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3.3 Logarithmic encoding scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3.4 The Coron-Lepoint-Tibouchi graded encoding scheme . . . . . . . . . . . . . . 8.3.5 Modulus switching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3.6 The new logarithmic encoding scheme . . . . . . . . . . . . . . . . . . . . . . . 8.3.7 Graded encoding schemes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3.8 Logarithmic encoding schemes . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3.9 The "repaired" Coron-Lepoint-Tibouchi scheme . . . . . . . . . . . . . . . . . . 8.3.10 Application to the CCK somewhat homomorphic encryption scheme . . . . . . . 8.3.11 Optimization of SwitchKey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3.12 Key exchange from logarithmic encoding schemes . . . . . . . . . . . . . . . . 8.3.13 Adapting the Coron-Naccache-Tibouchi modulus switching technique to CCK . .

	|G|	{timing, frequency}
	2	{4,1}, {2,2}
	3	{12,1}, {2,12}, {4,3}
	4	{48,1}, {4,36}, {2,72}, {12,4}
	5	{240,1}, {12,60}, {8,30}, {4,300}, {2,600}, {48,5}
	6	{1440,1}, {48,90}, {24,120}, {12,600}, {4,3600}, {8,360},
		{2,5760}, {240,6}
	7	{10080,1}, {240,126}, {96,210}, {48,1050}, {72,140},
		{12,8400}, {24,1680}, {8,7560}, {4,45360}, {2,65520},
		{1440,7}

Table 8

 8

		.1: Generation results for some small n
	n	Number of procedures	Time
	1	1	0
	2 3 4	4 312 36585024	∼ 0 ∼ 0 ∼ 30 mn

  B ) is small (note that to ensure correctness, we have to replace β in Lemma 8.18 by β + B). The b i 's add a random Then if B = diag(b), we recover δ = H T • B • S instead of H T • S. It could be harder to exploit this leakage δ because of the additional rerandomization. Finally, we strongly recommend to use large words, e.g. w ≥ 2 λ , to widen the range of the coefficients of S. There are binary operations + and -(on {0, 1} * ) such that for every α 1 , α 2 ∈ R, every v ∈ N, and every u 1 ∈ S

	8.3.7 Graded encoding schemes
	Definition 8.17 (Graded Encoding System [GGH13]) A κ-graded encoding system for a ring R is a sys-
	tem of sets S = {S v (α)	∈ {0, 1} (α) v	: α ∈ R} are disjoint.
	2. (a1) v	and u 2 ∈ S	(a2) v

* : v ∈ N, α ∈ R}, with the following properties:

1. For every v ∈ N, the sets {S

;

  Mult(pp, u 1 , u 2 ) The arithmetic multiplication is deterministic, takes as input the public parameters pp, a "level-i" encoding u 1 ∈ S Let , η, α, β as in our parameter setting. Let ρ f be such that α + log 2

	S	(α1+α2) i	(α1) i	and u 2 ∈ S i (α2)	for some α 1 , α 2 in R and outputs a "level-i" encoding u ∈
	(α1) i and outputs a "level-(i + j)" encoding u ∈ S and a level-j encoding u 2 ∈ S j (α2) (α1•α2) i+j ;	for some α 1 , α 2 in R such that i + j ≤ κ
	IsZero(pp, p zt , u) The zero-testing procedure is deterministic, takes as input the public parameters pp and a
	"level-κ" encoding u ∈ S κ (α)	and outputs 1 if α = 0 and 0 otherwise;

(-α

) i ; Add(pp, u 1 , u 2 ) The arithmetic addition is deterministic, takes as input the public parameters pp and "level-

i" encodings u 1 ∈ S Ext(pp, p zt , u)

The extraction procedure is deterministic, takes as input the public parameters pp, the zero-test parameter p zt and a "level-κ" encoding u ∈ S (α) κ and outputs a λ-bit string s such that: 1. For any α ∈ R and u 1 , u 2 ∈ S (α) κ , Ext(pp, p zt , u 1 ) = Ext(pp, p zt , u 2 ); Lemma 8.21 (Lemma 3 of [CLT15])

  3.10.1, we recall the CCK somewhat homomorphic encryption scheme. Then we present our new modulus switching technique in Section 8.3.10.2, and use thereof in Section 8.3.10.3 to present a CCK leveled homomorphic encryption scheme. Finally, we generalize the modulus switching technique to multiplicative masks in Section 8.3.10.5, and propose an optimization thereof in Section 8.3.11.

  Thus c encrypts m under the new secret key {p , q }. Now, this technique gives that |r | ≤ r • p /p + C for C = O(2 ρ ). Thus, if |r| = O(2 2ρ ) and p/p ≈ 2 ρ , the ciphertext c will have noise |r | = O(2 ρ

Table 9 .

 9 1: An example showing how linear relationships between individual words are encoded and interpreted.step a 0 a 1 a 2 a 3 a 4 a 5 a 6 a 7 a 8 a 9

	meaning	reg1	reg2	reg3

Table 9 .

 9 3: Comparison between modular reduction algorithms for computing x mod n when x = 2 n = k (from[START_REF] Bosselaers | Comparison of Three Modular Reduction Functions[END_REF]). drawback of Montgomery reduction for low-end devices is that it requires numbers to be converted into and out of "Montgomery form", which is an expensive operations requiring a real modulo in each direction -Barrett reduction operates on regular numbers directly.

	Algorithm	Classical	Barrett	Montgomery
	Multiplications	k(k + 2.5)	k(k + 4)	k(k + 1)
	Divisions	k	0	0
	Precomputation	Normalization	2 2k /n	-m -1 mod 2 N
	Arg. transformation	-	-	n-residue
	Postcomputation	Unnormalization	-	Reduction
	Restrictions	-	x < 2 2k	x < 2 k n
	9.3.2.

4 Dynamic constant scaling Lemma

9.2 If U ≤ L, then κ

Table 9 .

 9 4: Success rates of Algorithm 40 for N = 1024, H = 512 and 10 4 experiments.

	τ	0	1	2	3	4
	|n h |	503	502	501	500	499
	success rate	85.66%	97.96%	99.96%	100%	100%

Table 9 .

 9 5: Success rates of Algorithm 41 for N = 1024, U = 512 and 10 4 experiments.

	τ	0	1	2	3	4
	|n h |	503	502	501	500	499
	success rate	85.16%	97.51%	99.91%	100%	100%

Table 9 .

 9 6: Synthesis results of the four BCH encoder designs.

	Design	Gate instances GE Max freq. (MHz) Throughput (Mbps) Power (nW)
	BCH-Standard	310	447	741	690	978
	BCH-LFSR	155	223	1043	972	920
	BCH-LFSR-improved	160	236	1043	2080	952
	BCH-Barrett	194	260	655	9150	512
	BCH-Barrett-pipelined	426	591	995	13900	2208

10.1.5.1 Performance Rosser

  's theorem[START_REF] Dusart | The k-th prime is greater than k(ln k + ln ln k -1) for k ≥ 2[END_REF][START_REF] Rosser | The n-th Prime is Greater than n ln n[END_REF] states that for n ≥ 6, ln n + ln ln n -1 < p n n < ln n + ln ln n i.e. p n < n(ln n + ln ln n). Hence a crude upper bound of p is p < 4f (κ, γ, t) 2

		κ		2
	= 4			p γi
		i=κ-t
		κ
	≤ 4	i=κ-t	(iγ(ln iγ + ln ln(iγ))) 2
	≤ 4γ 2t	κ! (κ -t -1)!	2	(ln κγ + ln ln κγ) 2t

Table 10 .

 10 Table 10.3 gives a few examples. 3: A few elliptic curves and their group of rational points.

	E : y 2 =	E(Q)	r	basis
	x 3 -x	Z/2Z × Z/2Z	0	-
	x 3 -25x	Z(×Z/2Z) 2	1	(-4, 6)
	x 3 -(2 • 7 • 11) 2 x	Z 2 × (Z/2Z) 2	2	(-98, 1176), (350, 5880)
	x 3 -(2 • 3 • 11 • 19) 2 x	Z 3 × (Z/2Z) 2	3	(-98, 12376), (1650, 43560), (109554, 36258840)

Table 10 .

 10 5: Computation time for Holmes' algorithm on two test hyperelliptic curve for varying genus[START_REF] Holmes | Computing Néron-Tate heights of points on hyperelliptic Jacobians[END_REF].

	g	h(D 1 )	Time (HE 1 )	h(D 2 )	Time (HE 2 )
	1	1.11...	1.94 s	1.41...	2.06 s
	2	1.35...	6.44 s	1.37...	6.73 s
	3	1.50...	15.10 s	1.50...	15.62 s
	4	1.61...	32.71 s	1.40...	32.60 s
	5	63.42...	72.23 s	1.70...	76.48 s
	6	1.77...	212.37 s	1.81...	291.17 s
	7	51.01...	20 m	1.71...	27 m
	8	1.89...	3 hrs	-	-
	10	78.85...	16 hrs	-	-

The attentive reader will find traces of at least 8 languages in this thesis, plus at least 9 programming languages, and mentions of even more.

See https://technet.microsoft.com/en-us/security/cc308575.aspx.v

The interested reader is strongly encouraged to consult David Kahn's monograph[START_REF] Kahn | The Codebreakers: The story of secret writing[END_REF], which covers a colossal portion of the topic up to the late 1960's, with the notable exception of Enigma. A recent reedition of this book also discusses the context of some later discoveries, such as RSA.

The term comes in English from French, and decomposes as crypto-, from the Ancient Greek adjective κρυπτός < PIE *kreh 2 u-"concealed"; and the suffix -logia < Ancient Greek λογία, abstract modifier of λέγω "I say, I collect" < PIE *leǵ-"I gather". Cryptology is thus the study of (discourse on) concealment.

 3 Shannon also introduced the term "bit", to denote a unit of information, in that same article[START_REF] Shannon | A Mathematical Theory of Communication[END_REF].

This encounter is reported by Hodges [Hod12, pp. 243-252], Turing's biographer.

Solving at the same time an open problem about program termination [Tur37; Tur38].

This feat, as part of the then-classified "Ultra" programme, was not disclosed until the 1970's, long after Turing's death.

According toPolyaenus [Pol60, Book VIII.23.6] the dispatch only contained the words "Καῖσαρ Κικέρονι θαρρεῖν. προσδέχου βοήθειαν": "Caesar to Cicero, courage. Expect aid."

The Zodiac Killer was a serial killer who operated in northern California in the late 1960's and early 1970s. He sent several cryptic messages to the police. On August 8, 1969, Donald and Bettye Harden, two high-school teachers, cracked the first 408-symbol cryptogram, which was a simple substitution cipher.

Originally, σκυτάλη refers to a baton used in relay races, or to the handle of a whip. There is no archaeological evidence, nor any contemporary account that it was used as a cryptographic device; see e.g.[START_REF] Kelly | The myth of the skytale[END_REF]. The σκυτάλη was clearly associated with (Spartan) military messages, often designating the message itself, but it may be nothing more than a rolled up parchment inside the rod, passed from general to general in the manner of a baton. The idea of a strip rolled around the rod, as a cryptographic technique, may be a later invention. In any case it had become a well-known trope by the 2 nd century CE, being mentioned by Athenaeus of Naucratis [Nau27, pp. X, 451d], and later by Plutarch [Plu16, Lys. XIX, 8-12] and Aulus Gellius [Gel27, Book XVII, IX, 7-15].

On this topic, see in particular [Kah67, p. 535-539].

By exploiting key-reuse mistakes in Soviet OTP-encrypted communications, the British and United States secret services were able to expose the now-famous Cambridge Five espionage ring in the UK, as part of the Venona project, declassified in 1995.

An idea originally due to Shannon[START_REF] Shannon | Communication theory of secrecy systems[END_REF].

This is the ideal cipher model, see below in Section 1.5.2.1.

ECB stands for "Electronic Code Book", as it mimics the operation of traditional codebooks.

CBC stands for "Chained Block Cipher".

For collision resistance, a classical probability result called the birthday theorem shows that on average √ 2 n tests are required, instead of 2 n , where n is the output size of h in bits.

It is now known that Ellis envisioned the possibility of public-key cryptography by 1970, and that Cocks devised a cryptosystem that is essentially identical to RSA around 1973. As members of the GCHQ, their work was classified, and the documents attesting to this early discovery [Ell70b; Ell70a; Coc73] were only declassified in 1997.

This construction, however, cannot provide more than a quadratic computational advantage over the adversary.

Maybe the only practical way, see[START_REF] Daniel | Breaking RSA May Be As Difficult As Factoring[END_REF], which addresses amongst others some initial doubts raised by[START_REF] Boneh | Breaking RSA May Not Be Equivalent to Factoring[END_REF]. Assuming access to special oracles, efficient attacks are known, see e.g. [JLN + 09].

The size of these numbers is determined in Section 1.4.2.4

Note that λ(n) = lcm(p -1, q -1) can be used instead of φ(n) = (p -1)(q -1).

Namely, the fact that m d × m d mod n = (mm ) d mod n.

There is a similar class of protocols guaranteeing witness-indistinguishability instead, i.e., an adversary could not tell which witness was used by the prover[START_REF] Feige | Witness Indistinguishable and Witness Hiding Protocols[END_REF].

We should note that SPHFs were not initially introduced as a way to construct ZKPs; this interpretation came to light later, e.g., in[START_REF] Gennaro | A Framework for Password-Based Authenticated Key Exchange[END_REF].

And possibly depending on x itself, although this case was not modeled in[START_REF] Cramer | Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure Public-Key Encryption[END_REF]; see e.g.[START_REF] Gennaro | A Framework for Password-Based Authenticated Key Exchange[END_REF].

Note that λ(n) can be used instead of φ(n).

In the first page of a 1994 article[START_REF] Vassiliy | Complexity of a determinate algorithm for the discrete logarithm[END_REF], Nechaev claims that this algorithm was already known to his collaborator A. O. Gel'fond in 1962, a claim reproduced by Galbraith in his book[START_REF] Steven | Mathematics of Public Key Cryptography[END_REF]. For lack of evidence, besides Nechaev's personal recollections, we will continue calling this algorithm Shank's.

Instead of checking for independence each time, elimination can be performed afterwards.

Or, when it does, it is inferior to brute-force attacks[START_REF] Silverman | Elliptic Curve Discrete Logarithms and the Index Calculus[END_REF]. It is known, however, that index calculus works efficiently on curves of higher genus starting at g ≥ 3 [GTT + 07; EGT11].

The use of elliptic curves in cryptology can be traced to Lenstra's factorisation algorithm[START_REF] Lenstra | Factoring integers with elliptic curves[END_REF] and below; Miller[START_REF] Victor | Use of Elliptic Curves in Cryptography[END_REF] pointed out their cryptographic interest.

We will introduce additional notions and generalisations when needed, such as pairings, rank, etc.

In some situations, we will consider elliptic curves defined over a ring, such as Z/nZ, as in the elliptic curve factorisation algorithm below. The theoretical framework is however much simpler for fields.

That is to say, irreducible over k.

We use the word "scheme" here -and only here -as in modern algebraic geometry. For more background on schemes, the reader may consult[Har77], and on group schemes specifically, [EH01, Chapter IV].

A twist X of X is a curve that is k-equivalent but not k-equivalent to X (i.e., geometrically the same, but arithmetically different). For our concerns here, a twisted curve is obtained from a reference curve by multiplying the left-hand side of the curve's equation (only the x 2 factor in the case of Edwards curves) by a quadratic non-residue ε ∈ Fp. For a general introduction to twists, see e.g.[START_REF] Joseph | The arithmetic of dynamical systems[END_REF] Chapter 4.8].

If n = p k it is easy to find the factorisation of n by computing the k-th root over the real numbers, for different candidate integers k up to log p n.

At least in some scenarios, see [CGS14; CDP+ 16]

This enables us to leverage the leftover hash lemma [HIL + 99; IZ89], so that the ciphertext is uniformly random.

We refer to these code, which generalise the BCH family, as algebraic, to distinguish them from the more recent and unrelated geometric Goppa codes.

Kobara and Imai even described an efficient improvement to achieve IND-CCA2-security, which is provably as secure as the original scheme, and has almost the same bandwidth[START_REF] Kobara | Semantically Secure McEliece Public-Key Cryptosystems-Conversions for McEliece PKC[END_REF].

Taking a Goppa code over F 31 requires a 87 kB public key for the same security level; but using non-binary codes one can only correct up to t/2 errors.

That these kernels have this form comes from the structure of the curve over the extension F p 2 , because the embedding degree is 2.

We consider, here and throughout this work, only uniform adversaries. One may widen the class of adversaries to include non-uniform algorithms, i.e. algorithms that are also given as input an "advice string", and thereby are more powerful. For more details on these aspects, see [KM12; BL13; DGK17].

The historical notion of semantic security is equivalent to IND-CPA-security [Gol04b, Chapter 5.2].

Note that IND-CPA-security implies that the scheme is randomised; otherwise an adversary would play again and consistently win.

There are additional security notions, such as the intermediary "validating-checking attack" where the adversary accesses an oracle that tells whether a ciphertext is valid.

Note that the reduction given in[START_REF] Jean-Sébastien Coron | The Random Oracle Model and the Ideal Cipher Model Are Equivalent[END_REF] is not tight; thus the ROM and the ICM are qualitatively equivalent, but the ICM is quantitatively a stronger assumption.

This is sometimes known under different names, with occasional variations, such as "auxiliary string", "common random string", etc.

Sometimes called "plain model" or "vanilla model".

And iPhone 7, which was not yet available at the time of publication, but uses the same microarchitecture.

This can be fixed by requiring V to commit on the a i before P has sent anything, but this modification will not be necessary for our purpose.

This is for clarity. It is straightforward to give each node several private keys, and adapt the algorithm accordingly.

Note that special honest-verifier zero-knowledge implies honest-verifier zero-knowledge.

Or for P by a trusted authority.

See [GMP+ 11] for an overview. To be fair, Bitansky et al. [BGJ+ 16] provide a different construction, but it fundamentally relies on indistinguishability obfuscation and therefore is not (yet) practical.

If y was received before ∆max.

The probability of success at step 3 is essentially 1/B, and the expected number of executions of the loop is B, so that the simulation of N rounds runs in O(N B): the machine runs in expected polynomial time.

This if true if the adversary cannot 'bet' on several challenges at once. Such a situation is analysed in Section 4.2, and calls for a modified definition of security.

Python source code is available upon request.

Experiments were performed on a Intel Core i7-4712HQ CPU at 2.30 GHz, running Linux 3.13.0, Python 2.7.6, numpy 1.9.3,

This is represented as a message id i ||w id i ≤id i-1 ||vk i .

See [GHK + 08] for a very specific case where completely fair two-party computation can be achieved.

In a number of cases, e.g. DSA, the formulae of s do not lend themselves to security proofs.

The algorithm KeyGen being public, A can compute KeyGen(k) for any k of her choosing.

Note that with this information and using KeyGen queries, A can obtain concurrent signatures for any message and any user pair.

In a number of cases, e.g. DSA, the formulae of s do not lend themselves to security proofs.

In particular, the question of whether Bob "intended" to sign is outside the scope of this security model.

If Bob transmits a wrong or incorrect s B , this will be immediately detected by Alice as r B = g s B y e B . Naturally, in such a case, Bob never sent any information binding him to the contract anyway.

de auditu.

In contrast to the weak version, the adversary is allowed to forge for a message that they have queried before, provided that their forgery is not an oracle response.

BPV is a special case of E-BPV where h = 2. As such they share the same precomputing step.

For Schnorr, the exponent's size is Q; for ReSchnorr, it is P .

In practice, it turns out that h = v = 8 performs slightly better, due to various implementation speed-ups possible in this situation

I.e., use several multi-factor moduli.

A prime p is "quasi-safe" if p = 2u a + 1 for a prime u and some integer a.

Sign, verify, encrypt, or decrypt.

Because G may destroy entropy, R must be large enough to make the function G(H(i, r)) is collision resistant.

This product is actually an a j -wise exclusive-or.

A simple way to do so consists in re-running G with r i j (instead of r i ) for j = 1, 2, . . . until gcd(p i -1, e) = 1.

Cf. Section 4.4.3.4.

I.e., we essentially only publish co-paths.

This can also be described as a modular variant of the 'subset product' problem.

Alternatively, we can regard Setup as a pro forma empty algorithm.

Note that this is obviously not be an issue with the original NS scheme.

In the original NS setting, p would be at least 7420738134871.

Remark. Note that sk K and pk K belong to a priori different mathematical structures. Hence in all rigour there are two separate keyspaces: K 1 and K 2 .

If m is too short, padding may be used.

That is, the length of a number, once its leading zeros are discarded.

1279 -σ(1279, 17) ≈ 75 bits.

Since n is odd, we must accept a ± 1 excess.

There is room for improvement here as well, since rejection sampling is a very inefficient approach. Nevertheless it will be sufficient for our discussion, and any approach to generating such partitions would work without impacting the analysis.

We ignore the fact that we sample without replacement here, as h n. Under this conservative approximation, all the bits are sampled uniformly and independently, and may fall with probably 1/2 either in a type 1 or a type 2 block.

Other implementations are of course possible and do not affect the analysis. For other classical sampling without replacement algorithms, the reader may consult[START_REF] Stanton | Constructive combinatorics[END_REF].

Experiments with random partitions show that this number is quite variable and follows a Poisson distribution, with a correct partition being typically found earlier, with an average of 2 17 tries.

"Completely Automated Public Turing test to Tell Computers and Humans Apart".

At a first glance, the previous figures imply that breaking a public-key (as defined in the next section) would only cost $10 4 . We make the economic nonlinearity conjecture there are no $10 4 service suppliers allowing the scaling-up of this attack. In other words, if the solving demand d increases so will the price. We have no data allowing to quantify price(d).

There are 64 alphanumeric characters, and 64 5 > 10 × b.

PAN (16 characters), expiry date (4 characters) and a CVV (4 characters).

There are k! combinations, and 40! > 2 80 .

In the specific case of Figure5.8, translation, rotation, mirroring as well as border cropping may also generate the meaningful image corresponding to OK , but the overall proportion of such images remains negligible.

For instance using an iteratively reweighted Voronoi diagram.

We stress that unlike e.g. Kamouflage [BBB + 10] which deals with passwords, syntactic honey encyrption applies to natural language.

Note that such a skeleton might be ambiguous in certain constructions, for instance in sentences such as "Time flies like an arrow; fruit flies like a banana".

This is conceptually similar to Borges' famous library[START_REF] Borges | El Jardín de senderos que se bifurcan[END_REF][START_REF] Borges | Ficcione. Spanish[END_REF].

See for instance http://www.ngrams.info/.

An extreme example is William Shakespeare's use of inversion as a poetic device: "If't be so, For Banquo's issue have I fil'd my mind,/ For them the gracious Duncan have I murther'd,/Put rancors in the vessel of my peace" (MacBeth, III.1.8).

We may assume that communication with such services is secure, i.e. confidential and non-malleable, for the sake of argument.

The Arabic equivalent is madrasa.

The way some characters do in Umberto Eco's novel, Il pendolo di Foucault[START_REF] Eco | Il pendolo di Foucault[END_REF].

www.wolframalpha.com.

An early example is the NSA TEMPEST programme, remotely reconstructing computer screens and keystrokes from electromagnetic emanations, recently improved upon by e.g. [GPT14; GPP + 15; GPP + 16b].

Whenever a command is executed by a card, the card returns two status bytes called SW1 and SW2. These bytes encode a success or a failure cause.

X denotes the number of further PIN verifications remaining before lock-up.

For our purposes, the issuer can be thought of as the bank.

International Mobile Subscriber Identity.

Permanent Account Number (partially anonymized here).

Precise date removed for privacy reasons.

Card Verification Value.

Command: 00 88 00 00 04.

Command: 80 CA 9F 17 04.

Command: 00 20 00 80 08.

Command: 80 CA 9F 36 05.

Command: 80 CA 9F 13 05.

These can potentially be efficient against yet unknown future forms of fraud.

That being said, such advanced methods are usually more sensitive to noise than CPA or DPA, and require more traces [BGP+ 11].

In the following sections, instruction streams will also be referred to as "queues", "programs" or "codes" and will be denoted by Q 0 and Q 1 .

The reader may question the usefulness of overwriting x. Such a situation may occur if x is an I/O port for instance.

n[k] is initialized by #S[k] and decremented whenever one of the sources of opcode[k] is assigned to a queue. When n[k] reaches zero, opcode[k] can be safely assigned.

Recall that the Motorola 68 05 core has an 8-bit accumulator A, an 8-bit index register X, a 16-bit Program Counter PC and a few basic flags

. The CPU can address ≤ 2 16 = 64k one-byte memory locations denoted M [0], ..., M [ -1].

Somes patches, such as grsecurity for Linux, may restrict the visibility of the process table. However, grsec's default configuration doesn't affect our discussion.

For instance using the getpid() system call on Unix-like OSes, or the GetCurrentProcessId() API on Windows platforms.

For instance using a getppid() system call on Unixes.

For instance using the waitpid() function on Unixes.

See the Unix System V Manual entry: http://www-cdf.fnal.gov/offline/UNIX_Concepts/concepts.zombies.txt.

See https://msdn.microsoft.com/en-us/library/windows/desktop/ms682623(v=vs.85).aspx.

Or, equivalently, A can launch at least a process and later kill it.

See http://www.unhide-forensics.info/.

It is assumed that the forked process knows that f = 0. This value could be sent as command line argument for instance.

As of today, key exchange is only authenticated unilaterally: servers may have a (certified) public key, but most users don't use any.

For an overview of the events, see e.g. https://en.wikipedia.org/wiki/2016_Dyn_cyberattack.

In some cases, disabling a target is a part of a more elaborate attack. During Christmas 1994, Kevin Mitnick famously used a SYN-flood denial of service attack to access Tsutomu Shimomura's X-Terminal computer, at the time that the latter was assisting the FBI in tacking down Mitnick. The DoS temporarily deactivated a trusted workstation, which was impersonated by the intruder.

And iPhone 7, which was not yet available at the time of publication, but uses the same microarchitecture.

See http://upx.sf.net.

Each byte is 8 bits long.

Which is 01011000001100000011000000110000 in binary. Incidentally, this instruction is alphanumeric and corresponds to the ASCII string 000X. Note the little endianness of the string.

We used the options -D --architecture aarch64 --target binary.

Alternatively, we could assume we were working on a Linux OS and perform the appropriate syscall, but again this instruction is not alphanumeric.

Also know as the 'effective power' SMS exploit

Apple iOS enforces write xor exec.

Such as RAM, EEPROM, FLASH, etc.

It is also possible that trojans belonging to a single subsystem are never activated simultaneously, in which case they can be treated independently as well.

e.g. adding noise, wait-states, switching capacitors, etc.

This is, of course, a pun on a famous similar concept[START_REF] Nietzsche | Also sprach Zarathustra: Ein Buch für Alle und Keinen[END_REF].

Some devices are not directly connected, due to NAT, firewalls, etc. Hence G is not necessary a complete graph.

A = 1 if the unit in which the π i are expressed is not instructions per second but "bot-equivalents".

A (somewhat artificial) remedy would be to rectify the model and assume that after the last attack Alice needs to amortize the captured computational power to perform some constant computational task w . We do not use this alternative definition here.

For instance, start by recording ∆ det (P 0 ) as a best score and begin computing ∆ det (P 1 ). As soon as the summation of terms in ∆ det (P 1 ) exceeds ∆ det (P 0 ) stop and try P 2 , etc.

In practice, it may not be necessary to hold an ordered list; however we need to know which node was the last attempted target.

Alternatively, one may see such scenarios as a computer network equivalent of the fog of war [Von32, Book I, Chapter 3].

It is also possible to associate weights to each nodes, see[START_REF] Wang | Betweenness centrality in a weighted network[END_REF].

Any intermediary value is also allowed, although we may not need it in our model.

We considered for instance the possibility of a proof of work based on helping in factoring an RSA public key -with each participant contributing to that key eventually being broken.

For an elementary introduction to homomorphic encryption, we refer the reader to our article [BCG + 16b], not reproduced here.

The reader interested in an explanation of the relationship between multilinear maps and obfuscation in layman's terms is invited to read our article [BCG + 16a], not reproduced here.

Which is very different from 'that no transaction is lost in the process'.

Ensured through the optimality of the solutions found via LLL.

Assuming maximal transaction in the order of billions of economical units.

We may equivalently replace Z by Q; Since we know that, in practice, transactions have a finite precision, we may always think of them as integers.

Actually testing two incorrect signatures might answers true due to cancellation : if σ 1 and σ 2 are correct signatures for m 1 and m 2 , for any α testing σ 1 α × ασ 2 for m 1 × m 2 will yield true. We will ingore this issue since it can only happens either with negligible probabilities or from manipulation from legitimate signatures.

The construction of "graph-induced" multilinear maps of Gentry, Gorbunov and Halevi[START_REF] Gentry | Graph-Induced Multilinear Maps from Lattices[END_REF], another approximation of multilinear maps, is also built from the realm of homomorphic encryption[START_REF] Gentry | Homomorphic Encryption from Learning with Errors: Conceptually-Simpler, Asymptotically-Faster, Attribute-Based[END_REF].

Note that in that case the scheme is no longer computationally zero-test secure, i.e. an adversary can recover a level-(κ + 1) encoding u of a non-zero exponent such that IsZero(pp, pzt, u) = 1, thanks to LLL.

Additionally, note that these adaptations also require that for all i ∈ [n], p i is congruent to 1 modulo g i .

The bound will also be verified for CCK .Add since ciphertext addition increases the noise much more slowly than multiplication.

Note however that our technique does not seem compatible with the optimization of [CLT14, Sec. 5.1] in which σ has a particular structure. Indeed, this latter optimization affects the low order bits of c, σ , and therefore affects the message m with our technique, whereas in[START_REF] Jean-Sébastien Coron | Scale-Invariant Fully Homomorphic Encryption over the Integers[END_REF] the m i 's were moved to the most significant bits.

An acronym standing for "Multiply Add Divide"

These linear relations are unknown to the attacker.

The choice of the v j as the first k primes is motivated by the fact that large values make the scheme less efficient, and the observation that multiplicatively related values can make the scheme less secure. More generally, the v j can be relatively prime small integers with small Hamming weight.

For the sake of clarity we remove all tests meant to enforce the condition gcd(e, φ(n)) = 1.

A few more complexity bits can be grabbed if the variant described in the note at the end of Section 9.3.3 is used.

The scalar product of the two vectors is equal to 0.

where b(x) is the remainder of the division of c(x) by g(x)

Considered in big endian order.

Kendall's notation is the standard system used to describe and classify queueing nodes: An a/b/c queue receives inputs from a distribution a, has output distribution b, and uses c servers. As is standard, G denotes a general distribution, and D a degenerate distribution.

A similar problem is met when RSA primes must be injected into mobile devices on an assembly line. Because the time taken to generate a prime is variable, optimizing a key injection chain is not straightforward.

Shannon's theorem states that the best achievable expansion rate is 1 -H

(p b ), where H 2 is binary entropy and p b is the acceptable error rate.

Hence, α is encoded and potentially corrupted.

In the form p k k ln k.

A generalisation of this result, showing that the torsion of elliptic curves over arbitrary number fields is bounded, was proven by Merel in 1996[START_REF] Merel | Bornes pour la torsion des courbes elliptiques sur les corps de nombres[END_REF]. Both results would be special cases of a far-reaching conjecture by Morton and Silverman[START_REF] Morton | Rational periodic points of rational functions[END_REF].

The curve in question was posted by Elkies in 2006; see https://listserv.nodak.edu/cgi-bin/wa.exe?A2=ind0605&L= nmbrthry&T=0&F=&S=&P=50. As far as we are aware there was no formal publication of this result. The previous record was held byMartin and McMillen, from the NSA, who also posted on this Internet listserver without formal publication.

In Laguerre's original theorem and proof, he did not assume a monic polynomial, and uses a i /a 0 everywhere instead of a i . We also use n + 1 instead of n. This is of course without consequence in the discussion.

SHD-AG, 1 K 842, p. 5.

The document is not explicit as to how these letters should be chosen.

The padding does not really add any security, it is used to fit in a standard format.

Acknowledgements / Remerciements

where σ = (a, b, c).

We can apply our construction to turn this signature scheme into an encryption scheme (with the minor modification that, in Algorithm 17, κ is drawn from G). Encrypting one bit takes three group elements (from G 1 ), and using the multi-bit construction we can encode 128-bit messages by using = 34 individual pk K,i . This brings the total public key size, which is also the message size, to about 13 kB.

Part III

Hardware and software security

The second one is an example of adding polymorphism for zeroing a register using a Haskell engine.

Control-flow obfuscation

Abstract

One of the big challenges in program obfuscation consists in modifying not only the program's straight-line code (SLC) but also the program's control flow graph (CFG). Indeed, if only SLC is modified, the program's CFG can be extracted and analyzed. Usually, the CFG leaks a considerable amount of information on the program's structure.

In this work we propose a method allowing to re-write a code P into a functionally equivalent code P such that the CFG of P is extremely different from that of P . This is joint work with Mirko Koscina, Paul Lenczner, David Naccache, and David Saulpic. The corresponding paper was presented at the 22 nd Nordic Conference on Secure IT Systems (NordSec 2017) in Tartu, Estonia, and published as [GKL + 17].

Where there is Power there is Resistance Abstract

The increased improvements in hardware trojan detection techniques stimulate the search for smaller and stealthier trojans. This article describes a minimalistic hardware trojan consisting of... a single resistor. Let A, B be two conductive points in a target circuit and assume that an attacker can connect A and B through a resistor. All else being equal, when A = B the target's power consumption will increase and hence leak A ⊕ B. Depending on the exact role of A and B, it turns out that A ⊕ B frequently suffices to break several popular cryptosystems.

We describe the trojans' electronic structure, provide hardware simulation results, present attacks on several cryptosystems and discuss possible countermeasures. This is joint work with Houda Ferradi and Mehdi Tibouchi at NTT Secure Platform Laboratories (Japan), Sylvain Guilley at Institut Mines-Telecom (France), and David Naccache. Currently under review.

The title of this section alludes to Foucault's work, La volonté de savoir [START_REF] Foucault | Histoire de la sexualité (Tome 1) -La volonté de savoir[END_REF].

Algorithm 23: Trojan-aided discrete logarithm reconstruction Input: i, j, {y0, . . . , yN }, g, p, y. Output: x s.t. y = g x mod p; or ⊥.

if g[i]

⊕ g[j] == y0 then X ← X ∪ {(1, g)}; otherwise X ← X ∪ {(0, 1)} 2. for t = 1, . . . , N

3.

X ← X

4.

for (x, gx) ∈ X

c0 ← 2x

6. g0 ← g 2 x mod p 7.

g1 ← g0 • g mod p Dealing with noisy measurements. Which bits (i and j) we use does not matter, however what does matter is that we know y t exactly. Indeed, if we have less than one bit of information at each generation, the population grows exponentially (i.e. µ > 1), as we can see in Table 7.1 when the probability of recovering each bit of leakage is slightly less that 100%. If uncertainty on the measurements from the trojan is unavoidable, we may need to install a second trojan, or more, as described in Section 7.3.3.3-at which point we can allow for some noise in the measurements.

A first, crude model of this situation is that at each iteration of the square-and-multiply algorithm, we learn all k bits from k trojans, with some probability p. With probability 1p we do not learn anything. This gives a generation-dependent Galton-Watson process: with probability p there will be an average of 2 1-k offsprings, and with probability 1p there will be an average of 2 offsprings. It turns out that the expected number of vertices at depth n is then exactly the product of the expected numbers of offsprings at each generation [Fea72, Proposition 4]. As a result, after n iterations, of which were successful extractions (we learned all k bits) and nfailed (we learned nothing), the average number of offsprings is µ = (2 -k+1 ) • 2 n-. Naturally, we do not know , so that we have to compute the weighted sum over all possible values:

(7.1)

Optimal botnet attacks Abstract

A botnet is a collection of Internet-connected devices, that are under the control of a single entity. They are often used to launch coordinated attacks over the Internet.

We are interested here in the situation where these attacks compromise their target, which then becomes itself a member of the botnet. As such, every attack is an investment, with a potential reward (additional computing power, bandwidth, new IP addresses, etc.).

Formulating this problem as an optimisation task, we construct an optimal attacker or ÜberBot 16 , which captures the whole network in the least amount of time, when the network's parameters are known. When the parameters are unknown, we leverage machine learning techniques to adapt the strategy and improve the attack scenario over time.

This is joint work with Éric Brier (Ingenico), Éric Freyssinet (LIP 6, UPMC, CNRS), Florentin Guth, David Naccache, Tomas Rigaux, Martin Ruffel, and Lionel Zoubritzky.

Solving a generic NCP instance

Following the previous observation, one may be tempted to leverage known SSP solving techniques to tackle the NCP. However, the reduction from NCP to SSP is not very interesting from a computational standpoint: Coefficients become very large, of the order of Bb n , where B is the upper bound of the representation of E, and b is the chosen basis. This encoding can be somewhat improved if we know the bounds B ± i for each column, because we can use better representations. However, in practice it becomes quickly prohibitive; even brute-forcing the original NCP is less computationally demanding -the subset-sum problem can be solved exactly (classically) in worst-case time O(2 m ) by brute-forcing all combinations [BJL + 13], and even state-of-the-art algorithms only have marginally better complexity, namely O(2 m•0.291... ) [START_REF] Howgrave | New Generic Algorithms for Hard Knapsacks[END_REF][START_REF] Becker | Improved Generic Algorithms for Hard Knapsacks[END_REF].

If we wish to tackle the NCP directly, for n > 2, the meet-in-the-middle based approaches do not apply, as in that case there is no total order on Z n . Instead we will leverage the famous LLL lattice reduction algorithm [START_REF] Klaas Lenstra | Factoring polynomials with rational coefficients[END_REF]. Given as input an integer d-dimensional lattice basis whose vectors have norm less than B, LLL outputs a reduced basis in time O(d 2 n(d + log B) log Bf ) [START_REF] Phong | An LLL Algorithm with Quadratic Complexity[END_REF], where f stands for the cost of d-bit multiplication.

To see why lattice reduction would solve the problem, first note that E can be represented as an n × m matrix with rational (or integer) coefficients. It is a sparse matrix, having (at most) two non-zero entries per column, i.e. (at most) 2m non-zero entries out of nm. Let I n be the n × n identity matrix and let E = (I n |E) be the result of concatenating the two blocks: E is an n × (n + m) matrix, having at most n + 2m non-zero elements out of n(n + m).

Now if there is a solution to the NCP, then (0, . . . , 0) belongs to the lattice generated by E. In particular this is a short vector: If this is the shortest vector then LLL 8 will find it with overwhelming probability. The question of solving the NCP from a solution to the shortest-vector problem (SVP) depends on the density, topology and weights' probabilistic distribution of the multigraph. A proof of optimality for some graph families is worked out in Section 8.1.7, and in the cases that optimality is not guaranteed, the result is still often close to optimal.

In practice, however, using this technique directly is impractical. The main reason is that LLL's complexity on a large graph is dominated by m 3 , and real-world ledgers handle many transactions, with m being of the order of 10 8 per day.

Faster NCP solving

While the lattice reduction approach discussed above cannot be efficiently applied directly on a large multigraph to find a solution to the NCP, it can work on small multigraphs. We describe in this section a pruning algorithm that reduces the problem size dramatically. This algorithm breaks down the NCP instance into many smaller NCP sub-instances, which can be tackled by LLL. Furthermore, each instance can be dealt with independently, which makes our heuristic parallelizable.

In other terms, while we could turn an NCP instance into an SSP instance and try to tackle the SSP instance with existing techniques, we first leverage the particular form of such problems -namely the graph-related properties -to reduce problem size. Reducing the problem size is possible thanks to the following two observations:

1. We only need to consider strongly connected components. Indeed, if v, w ∈ V belong to two different strongly connected components of G, then by definition there is no path going from v to w and back. Therefore any amount taken from v cannot be returned, so that the balance of v cannot be conserved. Thus, all the edges of E are contained in a strongly connected component of G.

2. Let H be a nilcatenation of G. Then H must satisfy a 'local flow conservation' property: the flow (Definition 8.7) through any cut of H is zero; equivalently, the input of each vertex equates the output. Subgraphs failing to satisfy this property are dubbed obstructions and can be safely removed.

Definition 8.6 (First-Order Obstruction)

A vertex v ∈ V is a first-order obstruction if the following holds:

• The in-degree and out-degree of v are both equal to 1.

• The labels of the incoming and the outgoing edge are unequal. 8 Or BKZ [START_REF] Peter | Block Korkin-Zolotarev bases and successive minima[END_REF], or one of their variants.

Algorithm 25: Pruning Algorithm

Input: Multigraph G = (V, E, φ). Output: Multigraphs {Gi = (Vi, Ei, φi)}, having no simple obstruction.

1. {G1, . . . , G } ← Tarjan(G)

remove all edges connected to v in Ei

denote e in the incoming edg This algorithm: (1) decomposes the graph into its SCCs; then (2) removes (first-order) obstructions in each component. Removing obstructions may split a strongly connected component in twain (we can keep track of this using a partition refinement data structure), so we may repeat steps (1) and ( 2) until convergence, i.e. until no obstruction is found or no new SCC is identified. This gives the obvious recursive algorithm RecursivePruning.

Complexity analysis.

The complexity of this algorithm depends a priori on the graph being considered, and in particular on how many SCCs we may expect, how probable it is that an obstruction creates new SCCs, how frequent obstructions are, etc. If we turn our attention to the worst-case behaviour, we can in fact consider the multigraph for which this algorithm would take the most time to run.

Tarjan's algorithm has time complexity O(n + m), and first-order obstruction removal has time complexity O(n). Thus the complete pruning's complexity is determined by the number of iterations until convergence. The worst graph would thus have one obstruction, which upon removal splits its SCC in two; each sub-SCC would have one obstruction, which upon removal splits the sub-SCC in two, etc. Assuming that this behaviour is maintained all the way down, until only isolated nodes remain, we see that there cannot be more than log 2 n iterations.

Each iteraction creates two NCP instances, each having n/2 vertices and around m/2 edges. Thus the complete pruning algorithm has complexity O((m + n) log n). Note that in fact, each subproblem can be worked on independently.

If we now extend the pruning algorithm to also detect higher-order obstructions, say up to a fixed order d, then the obstruction removal step costs O(2 d n) = O(n) since 2 d is a constant. Thus the asymptotic worst-case complexity is not impacted. However the constant term might in practice be a limiting factor, especially since higher-order obstruction may be rare. Making this a precise statement requires a model of random multigraphs. To compensate for the extra cost of detecting them, order-d obstructions should be frequent enough: We conjecture that this is not the case, and that there is no gain in going beyond the first order.

Fast NCP solving

We can now describe in full the fast NCP solving algorithm. It consists in first using the pruning algorithm of Section 8.1.4.2, which outputs many small NCP instances, and then solving each instance using the lattice reduction algorithm of Section 8.1.3.3. This is described in Algorithm 26.

Interpreting and representing testing procedures

Consider a testing procedure T , defined as above. T describes the following algorithm. At each node (S, T ), perform the test φ on the selection T of signatures. If φ(T ) = 0, go to the left child; otherwise go to the right child. Note that at each node of a testing procedure, only one invocation of φ is performed.

The tree is finite and thus this algorithm reaches a leaf S final in a finite number of steps. By design, S final = F φ .

Remark. From now on, we will fix φ and assume it implicitly.

Remark. We represent a testing procedure graphically as follows: Nodes (in black) are labeled with T , whereas leaves (in blue) are labeled with S written as a binary string. This is illustrated in Figure 8.7 for n = 3.

This representation makes it easy to understand how the algorithm unfolds and what are the outcomes: Starting from the root, each node tells us which entity is tested. If the test is positive, the right branch is taken, otherwise the left branch is taken. Leaves indicate which signatures tested positive and which signatures tested negative from now on.

Remark. The successive steps of a testing procedure can be seen as imposing new logical constraints. These constraints ought to be satisfiable (otherwise one set S is empty in the tree, which cannot happen). The formula at a leaf is maximal in the sense that any additional constraint would make the formula unsatisfiable. This alternative description in terms of satisfiability of Boolean clauses is in fact strictly equivalent to the one that we gave.

In that case, T is understood as a conjunction T [i]=1 t i , S is a proposition formed by a combination of terms t i , connectors ∨ and ∧, and possibly ¬. The root has S = . The left child of a node labeled (T, S) is labeled S ⊥ T = S ∧ (¬T ); while the right child is labeled S T = S ∧ T . At each node and leaf, S must be satisfiable.

Probabilities on trees

To determine how efficient any given testing procedure is, we need to introduce a probability measure, and a metric that counts how many calls to φ are performed.

We consider the discrete probability space (Ω, Pr). The expected value of a random variable X is classically defined as:

Let T a testing procedure, and let S ∈ Ω be one of its leaves. The length T (S) of T over S is the distance on the tree from the root of T to the leaf S. This corresponds to the number of tests required to find S if S Lemma 8.6 (Number of naive procedures) Let n ≥ 1, then there are

equivalent naive procedures.

Proof: By induction on n: There are (n + 1) choices of a root node, P (n) choices for the left child, and P (n) choices for the right child. This gives the recurrence P (n + 1) = (n + 1)P (n) 2 , hence the result.

This number grows rapidly and constitutes a lower bound for the total number of procedures (e.g. for n = 8 we have P (n) > 2 184 ). On the other hand, the naive procedure is the one with maximal multiplicity, which yields a crude upper bound αP (n) on the number of procedures, where α is the 2 The zones can be determined by sampling precisely enough the probability space. Simple arguments about the regularity of polynomials guarantee that this procedure succeeds, when working with infinite numerical precision. In practice, although working with infinite precision is feasible (using rationals), we opted for floating-point numbers, which are faster. The consequence is that sometimes this lack of precision results in incorrect results on the zone borders -however this is easily improved by increasing the precision or checking manually that there is no subzone near the borders.

Pruning the generation tree

We now focus on some of the properties exhibited by testing procedures, which allows a better understanding of the problem and interesting optimizations. This in effect can be used to prune early the generation of procedures, and write them in a more compact way by leveraging symmetries. We consider in this section a testing procedure T . Lemma 8.7 Let B 0 and B 1 be two binary strings of size n, that only differ by one bit (i.e. B 0 [i] = 0 and B 1 [i] = 1 for some i). Then T (B 0 ) ≤ T (B 1 ).

Proof: First notice that for all T , T , and b, b ∈ { , ⊥} we have (S b T ) b T = (S b T ) b T . We will denote both by S bb T T .

We have the following : If there exists k, T 1 , . . . , T k , and β 1 , . . . , β k such that

Remark. Lemma 8.7 indicates that testing procedures are, in general, unbalanced binary trees: The only balanced procedure being the naive one. Lemma 8.8 If N is the naive procedure, then for any testing procedure T and for all x 1 , . . . , x n such that

In other terms {∀i ∈ [n], 1 2 ≤ x i ≤ 1} is contained in the naive procedure's optimality zone.

Proof: An immediate corollary of Lemma 8.7 is that for all i ∈ [n], we have ∂ xi L T (x 1 , . . . , x n ) ≥ 0, where ∂ xi indicates the derivative with respect to the variable x i . Since the native procedure has a constant length, it suffices to show that it is optimal at the point { 1 2 , . . . , 1 2 }. Evaluating the length polynomials at this point gives

Now remember that the naive procedure gives the only perfect tree. It suffices to show that unbalancing this tree in any way results in a longer sum in the equation above. Indeed, to unbalance the tree one needs to:

• Remove two bottom-level leaves, turning their root node into a leaf

• Turn one bottom-level leaf into a node

• Attach two nodes to this newly-created leaf

The total impact on the sum of lengths is +1. Hence the naive algorithm is minimal at { 1 2 , . . . , 1 2 }, and therefore, in the region {∀i ∈

Remark. This also show that if we assume that the probabilities are supposed uniform (ie. we assume no a priori knowledge) the optimal procedure is the naive one. Therefore we can see that the gain for n = 3 is aprroximately 0, 34 since the optimal procedure in average gives 2, 66. In percentage the gain is 15%. If the probabilites are very low we have a gain of almost 2 which is 3 times faster. As expected it is much more interesting if we think that the signatures have a good chance to be correct, which is the case in most real life scenarii.

Lemma 8.9 If the root has a test of cardinality one, then the same algorithms starting at both sons have same expected stopping time. This applies if the next test is also of cardinal one.

Proof: Without loss of generality we can assume that the test is {1}. We have {0,

A test T that doesn't test 1 applied on those sets will give the same split for both, and the probability that the test answers yes or no is the same. This is also true for the sets and the tests T such that i is not in T for i in {1, . . . , k}.

A test T such that there exists i in T {1, . . . , k} brings no information for the set of possibilities This result helps in identifying redundant descriptions of testing procedures, and can be used to narrow down the generation, by skipping over obvious symmetries of the naive procedure (see Figure 8.11).

To further accelerate generation we can only keep one representative of each algorithms that have the same expected length for all x i . Lemma 8.11 If a node labeled T 1 has two children that are both labeled T 2 , then we can interchange T 1 and T 2 without changing the testing procedure's expected length.

Yet another simple observation allows to reduce the set of subsets T at each step: Lemma 8.12 Consider a node labeled (T, S). Assume that there is i ∈ [n] such that, for all S in S, i / ∈ S. Then we can replace T by T ∪ {i}.

Proof: We can easily see that S T = S T ∪{i} and S ⊥ T = S ⊥ T ∪{i} .

Finally we can leverage the fact that the solutions exhibit symmetries, which provides both a compact encoding of testing procedures, and an appreciable reduction in problem size.

Lemma 8. 13 Let σ ∈ S n be a permutation on n elements. If we apply σ to each node and leaf of T , which we can write σ(T ), then

Proof: Note that for any S ∈ Ω and T ∈ Ω \ {∅} we have σ S T = S σ(T ) and σ S ⊥ T = S ⊥ σ(T ) , where σ operates on each binary string. It follows that for any leaf S, T (S) becomes T (σ(S)) under the action of σ, hence the result. Lemma 8.14 Let S be a simplex of the hypercube, T a procedure, E = {σ(T )|σ ∈ S n }, then there exists T 0 in E, such that for all x in S, T 1 in E we have

Moreover we have for all

Remark. The last two propositions allow us to solve the problem on a simplex of the hypercube (of volume 1/n!) such as {p 1 , . . . ,

Approximation heuristics

The approach consisting in generating many candidates, only to select a few, is wasteful. In fact, for large values of n (even from 10), generating all the candidates is beyond reach, despite the optimizations we described.

Instead, one would like to obtain the optimal testing procedure directly. It is a somewhat simpler problem, and we can find the solution by improving on our generation-then-selection algorithm (see Section 8.2.8). However if we wish to address larger values of n, we must relax the constraints and use the heuristic algorithms described below, which achieve near-optimal results. This would be usefull in real life scenarii for signatures verifications since we would like to verify hundreds or more signatures to have real gain.

Information-Based Heuristic

We first associate a 'cost' to each outcome S, and set of outcomes S: cost(S, S) = f (S, S) + g(S, S)

(3)

(3) (1,2)

(1) (3)

(1,2)

(3) (3) 46 45 46 45 48 47 (3) (1,2,3)

(1,2,3) All permutations with g=2 (3) Figure 8.15: Trees representation with a grouping by three elements on the root. For a fixed element at the upper left corner side, we have 2 2 possible permutations. For the upper right corner side, we get 2 2 . We replace the subroot of the fixed trees and get (2 2 + 2 2 ) × 3. We also have the 40 × 3 trees from the grouping of two. Hence, we have 40

(3) 000 001

(3) 000 001

Multilinear maps with polylog complexity Abstract

The concept of graded encoding schemes was introduced by Garg, Gentry and Halevi at Eurocrypt 2013, as an approximation of cryptographic multilinear maps, with astounding applications in cryptography; in particular the first construction of an obfuscated circuit. In this paper we describe a new construction of multilinear maps whose public parameter size and encoding size are polynomial in the depth of the evaluated circuit; this is an exponential improvement compared to existing schemes. In particular for Diffie-Hellman key exchange with κ + 1 users the encoding and parameter size become poly(log κ) instead of poly(κ). Our construction is a variant of the CLT multilinear map scheme over the integers, based on a modulus switching technique. This is joint work with Jean-Sébastien Coron and Tancrède Lepoint. This paper was originally submitted to AsiaCrypt 2015 but retracted when we learnt (during CRYPTO 2015) of the Cheon et al. attack [START_REF] Hee Cheon | Cryptanalysis of the New CLT Multilinear Maps[END_REF] against [START_REF] Jean-Sébastien Coron | New Multilinear Maps Over the Integers[END_REF], which can be adapted to our construction and therefore makes it insecure. Nevertheless, the modulus switching technique is interesting in itself, and the general construction may be transposed to other integer-based homomorphic encryption schemes.

Introduction

Graded encoding schemes. Since the breakthrough work of Garg, Gentry and Halevi in [START_REF] Garg | Candidate Multilinear Maps from Ideal Lattices[END_REF], there has been an increasing interest in cryptographic multilinear maps. The new notion of graded encoding schemes introduced in [GGH13] can be viewed as "approximate" leveled multilinear maps. Namely these maps have a richer structure than the generalization of pairings proposed by Boneh and Silverberg [START_REF] Boneh | Applications of Multilinear Forms to Cryptography[END_REF]. In particular, they introduce the notion of encoding level: exponents are level-0 encodings, it is possible to add two encodings at the same level, and the multiplication of a level-i encoding by a level-j encoding yields a level-(i + j) encoding, up to level κ, where κ is called the multilinearity parameter. Graded encoding schemes realize an approximate version of such leveled multilinear maps with randomized encodings. At level κ, it is possible to test whether an encoding is an encoding of 0, and one can deterministically extract a string from level-κ encodings that only depends on the encoded value. A straightforward application is non-interactive Diffie-Hellman key exchange with κ + 1 users, instead of only 3 users with bilinear pairings.

Two constructions of graded encoding schemes are known: the initial construction of Garg, Gentry and Halevi [START_REF] Garg | Candidate Multilinear Maps from Ideal Lattices[END_REF] from ideal lattices (GGH), later improved by Langlois, Stehlé and Steinfeld [START_REF] Langlois | GGHLite: More Efficient Multilinear Maps from Ideal Lattices[END_REF], and the construction of Coron, Lepoint and Tibouchi [CLT13; CLT15] over the integers (CLT), based on the DGHV scheme [DGH + 10]. Both constructions start from some homomorphic encryption scheme (respectively [Gen09b; LTV12] and [CCK + 13]), and go further by allowing to recover some information using a zero-testing parameter at a certain level, without needing any secret key. 10 Security of graded encoding schemes. The security of the initial GGH and CLT schemes was only heuristic and surveys of cryptanalytic techniques were provided in [START_REF] Garg | Candidate Multilinear Maps from Ideal Lattices[END_REF] and [START_REF] Jean-Sébastien Coron | Practical Multilinear Maps over the Integers[END_REF]. However, recent attacks exploiting the zero-testing parameter completely reshaped the state-of-the-art on graded encoding schemes security.

For GGH, a "zeroizing" attack was known from the beginning to make analogues of the decision linear and subgroup membership problems easy [START_REF] Garg | Candidate Multilinear Maps from Ideal Lattices[END_REF]. Recently, it has been used to break in polynomial time the underlying hardness assumption of GGH (an analogue of the Diffie-Hellman assumption) by Hu and Jia [START_REF] Hu | Cryptanalysis of GGH Map[END_REF], and Cheon and Lee [START_REF] Hee | Approximate Algorithms on Lattices with Small Determinant[END_REF].

For CLT, the latter zeroizing attack is not directly applicable, but an adaptation thereof was proposed by Cheon, Han, Lee, Ryu and Stehlé [CHL + 15] and completely breaks the original CLT scheme [START_REF] Jean-Sébastien Coron | Practical Multilinear Maps over the Integers[END_REF] in polynomial time. Tentative approaches modifying the form of the encodings to thwart this attack were proposed [BWZ14b; GGH + 16], but were subsequently defeated in polynomial time by extensions of the Cheon et al. attack [CGH + 15].

A recent modification of CLT [START_REF] Jean-Sébastien Coron | New Multilinear Maps Over the Integers[END_REF] (CRYPTO 2015) modifies in depth the zero-testing procedure itself to avoid the latter attacks, and is as of today the only graded encoding scheme for which analogues of this paper we only consider the latter modification of CLT; our technique is actually orthogonal to this modification of CLT.

for some

for some δ 3 with |δ 3 | ≤ Θ/2 + 1. This gives:

and therefore as required we recover Equation (8.11):

Application to the CCK somewhat homormophic encryption scheme

In the previous section we have described our modulus switching variant for a single prime p. As in [START_REF] Jean-Sébastien Coron | Public Key Compression and Modulus Switching for Fully Homomorphic Encryption over the Integers[END_REF] the extension to the batch setting, i.e. with multiple p i 's is straightforward. Therefore, our modulus switching variant is directly applicable to the CCK fully homomorphic encryption scheme [CCK + 13], for any message space R = Z g1 × • • • × Z gn . We obtain a semantically secure leveled homomorphic encryption scheme whose parameters depend polynomially on the depth of the circuits that the scheme can evaluate. We describe the new scheme in Section 8.3.10.

The new logarithmic encoding scheme

In this section, we propose a candidate logarithmic encoding scheme, obtained as a variant of the recent graded encoding scheme CLT [START_REF] Jean-Sébastien Coron | New Multilinear Maps Over the Integers[END_REF] (cf. Section 8.3.4). Our main main idea is, given a set of K = 2 κ encodings u i masked by z 1 modulo a set of integers p 1i 's, to multiply them pairwise and then to apply the modulus switching technique of Section 8.3.5 to work modulo p 2i and switch from mask z 2 1 to z 2 (cf. Section 8.3.10.5), and so on. The number of levels required to compute the product of the K = 2 κ encodings is κ + 1. Eventually the vector p zt is with respect to the last set of primes p (κ+1)i . The encoding size and public-key are therefore polynomial in the logarithmic multilinearity level κ, that is poly-logarithmic in the number of multiplications K. As "obvious" application of our candidate, we describe a multipartite Diffie-Hellman key exchange in Section 8.3.12.

Modulus switching technique for CLT

Consider the κ-GES CLT of Section 8.3.4, and denote (pp, p zt ) ← CLT.InstGen(1 λ , 1 κ ) where

where the (possibly secret) exponent ring is R = Z g1 × • • • × Z gn for α-bit primes g i 's, and the secret mask is z.

Let η ∈ N with η < η -1, assume that p ∈ N n is a vector of η -bit primes, set x 0 = i∈[n] p i , and let z be a random integer modulo x 0 (as in CLT.InstGen). From Lemma 8.22 and section 8.3.10.5, we have the following Lemma: Lemma 8.15 Let pp, p, η , p , x 0 , z, z be defined as above. Let = η / log 2 w . Let w ≥ 2 be a word and Θ, k be integers. Let

where r i ← (-2 ρ , 2 ρ );

where ij ← (-2 ρ , 2 ρ ) for i = j and ii ← (n2 ρ , n2 ρ + 2 ρ );

where r ij is randomly generated in the half-open parallelepiped spanned by the columns of

). Generate a random prime integer N of size nη κ+1 + 2η κ+1 + 1 bits and get by LLL pairs of non-zero integers (α i , β i ) such that

where

From that we obtain a zero-testing vector

10. Generate a ladder of level-1 encodings of zero, {X

j } of increasing size. Specifically, for j ∈ [n • η 1 + log 2 ], we set:

11. Generate a seed s for a strong randomness generator Extract;

, 1}, and generate

, η j+1 / log 2 w }) .

Publish the parameters (pp, p zt ) where

We say that u is a level-k encoding of the exponent

, where z 0 = 1. We say that r = (

is the noise vector of u.

Sampling, encoding and rerandomization. The sampling, encoding and re-randomization procedures of CLT' are the same as for CLT.

CLT .Samp(pp) : Generate a random vector b ∈ {0, 1} and output b, x ∈ Z.

CLT.Enc(pp, u) : Output CLT.ReRand(pp, u • y).

CLT.ReRand(pp, u) : Generate vectors b ← {0, 1} τ and b ← [0, 2 µ ) n and output u + b, x + b , Π .

Encodings are reduced down to the size of x

(1) 0 using the ladder {X

(1) j }.

Addition and multiplication.

Similarly to the CCK encryption scheme, we can add and multiply encodings at the same level. More precisely, we have the following procedures:

Refresh(pp, j, u) : Output SwitchKey w (τ j→j+1 , u).

CLT .Mult(pp, u 1 , u 2 ) : If u 1 and u 2 are encodings at level i, j for i + j ≤ 1, output u 1 • u 2 . Now assume that u 1 and u 2 are level-j encodings for 1 ≤ j ≤ κ; if not, use Refresh and y to make it so. 11 Compute u 3 = u 1 • u 2 and output Refresh(pp, j, u 3 ).

CLT .Add(pp, u 1 , u 2 ) : Suppose u 1 and u 2 are level-j encodings for j ∈ [κ + 1]; if not use Refresh and y to make it so. Output u 1 + u 2 .

Zero-testing and extraction. The zero-testing and extraction procedures of CLT' are the same as for CLT.

CLT .IsZero(pp, p zt , c) :

, where msbs ν extracts the ν most significant bits of the result.

Correctness and parameters constraints

Let us prove that CLT' is a correct logarithmic encoding scheme. First, the sampling procedure CLT .Samp outputs an encoding of a nearly uniform exponent; this is a direct adaptation of Lemma 8.19:

The distribution of (pp, m) is statistically close to the distribution of (pp, m ) where m ← R.

The rerandomization procedure CLT .ReRand is identical to that of CLT.ReRand, and thereby Lemma 8.17 holds. The procedure CLT .IsZero is identical to that from CLT.IsZero, so that Lemma 8.18 holds.

Lemma 8.17 Let the encodings

(1) 0 , and define r = (r 1 , . . . , r n+1 ) T . If 2(ρ + α + λ) ≤ η and τ ≥ (n + 2) • ρ + 2λ, then the distribution of (pp, r) is statistically close to that of (pp, r ) where r ∈ Z n+1 is randomly generated in the half-open parallelepiped spanned by the column vectors of 2 µ Π. Moreover we have

Lemma 8.18 Let n, η j , α, β as in our parameter setting. Let ρ f be such that α

11 Assume that u 1 is a level-i encoding and u 2 is a level-j encoding with 1 ≤ i < j ≤ κ + 1 (if i = 0, replace u 1 by u 1 • y). Then we can define y 1 = y and y k = CLT .Mult(y k-1 , y k-1 ) for all k < j, and define u

for all k ∈ {i + 1, . . . , j}. Finally, u

1 is a level-j encoding that encodes the same exponent as u 1 .

Finally, let us do the same correctness analysis as in Section 8.3.10.4 to fix the parameter η 0 so that the encoding noise at every level remains roughly the same. We say that a level-k encoding u has noise r ∞ when u = q i • p ki + r i where r i = [u] p ki for all i ∈ [n]. Let us pick an universal bound B on the noise, that is a level-k encoding must have noise at most B for all k ∈ [κ + 1]. Then it suffices to take 2 η k > 4B 2 for all k ∈ [κ] and 2 ηκ+1 > 4B to ensure the correctness of the scheme.

Let us denote by K 0 the number of multiplications between two level-0 encodings, and K 01 the number of multiplications between a level-0 encoding and a level-1 encoding.

A fresh level-0 encoding has noise bounded by B 0 = 2 • 2 2ρ+2α ; a freshly rerandomized level-1 encoding has noise bounded by B 1 = 5n 2 2 2ρ+2α+λ (cf. [START_REF] Jean-Sébastien Coron | New Multilinear Maps Over the Integers[END_REF]).

Therefore all level-1 encodings have noise bounded by

. By induction now, assume that the bound is verified for level-j encodings u 1 and u 2 for j ∈ [κ], and define u = CLT .Mult(pp, u 1 , u 2 ). 12 The first operation in CLT .Mult is a modular multiplication, which gives an encoding (masked by z 2 j ) of noise at most B 2 . Then from lemma 8.15, u has noise at most

If we choose B and η 0 such that the following properties hold:

As in [START_REF] Jean-Sébastien Coron | New Multilinear Maps Over the Integers[END_REF], the security of our logarithmic encoding scheme cannot be reduced to standard assumptions; we thus make the assumption that the κ-LDDH problem is hard for our CLT' scheme. Also, the CLT' scheme is built as a variant of the CLT scheme: all the parameters will therefore be chosen so as to thwart the attacks of [START_REF] Jean-Sébastien Coron | New Multilinear Maps Over the Integers[END_REF]. The parameter constraints are therefore as follows:

• ρ = Ω(λ) to avoid brute force attacks on the noise [CN12; CNT12; LS14];

• α = O(κ) for the κ-LDDH assumption to be hard; 13 • η 0 = Õ(log(Θ • • n) + λ + 2α + 2ρ + log κ) for correctness;

• n = ω(κ • η 0 • log λ) to thwart lattice-based attacks on the encodings [CLT13, Sec. 5.1];

• ≥ n • α + 2λ to apply Lemma 8.16;

• τ ≥ (n + 2) • ρ + 2λ and η ≥ 2(α + ρ + λ) to apply Lemma 8.17;

to avoid lattice attacks on the subset-sum [CMN + 11];

• β = Ω(λ) in order to avoid an attack on the zero-testing vector [START_REF] Hyung | Security Analysis of Multilinear Maps over the Integers[END_REF]; 12 The bound will also be verified for CLT .Add since encoding addition increases the noise much more slowly than multiplication. 13 Note that in [CLT13; CLT15], the g i 's are selected as α-bit (prime) integers for α = λ so that a product of random exponents is not 0 with overwhelming probability (with the same argument as below, they could have taken α ≈ log 2 κ). For our logarithmic encoding scheme, we can take α = log 2 (2 κ + 1) + 1 (that is

Now the constraints on the parameters of the CLT' scheme ensure that n ≥ λ/0.4; therefore the product of 2 κ + 1 random exponents is 0 with negligible probability.

The distribution {Ext(pp, p

The graded encoding schemes proposed in [GGH13; CLT13] consider slightly relaxed definitions of IsZero and Ext, where IsZero can output 1 for some non-zero encoding with negligible probability and Ext can extract to different outputs for encodings of the same ring element with negligible probability.

Hardness assumption. In [START_REF] Garg | Candidate Multilinear Maps from Ideal Lattices[END_REF] is introduced an analogue of the multilinear decisional Diffie-Hellman assumption (see [START_REF] Boneh | Applications of Multilinear Forms to Cryptography[END_REF]) for graded encoding schemes: the Graded Decisional Diffie-Hellman assumption (GDDH).

Logarithmic encoding schemes

First, let us define an logarithmic encoding system: Definition 8.20 (Logarithmic Encoding System) A κ-logarithmic encoding system for a ring R is a system of sets S = {S , it holds that

where α 1 + α 2 and α 1α 2 are addition and subtraction in R.

3.

There is an associative binary operation × (on {0, 1} * ) such that for every

Definition 8.21 (Logarithmic Encoding Schemes)

A symmetric κ-logarithmic encoding scheme L with rerandomization and public sampling consists of the following (polynomial time) procedures L = {InstGen, Samp, Enc, ReRand, Neg, Add, Mult, IsZero, Ext} :

The randomized instance generation procedures takes as input the security parameter λ, the logarithmic multilinearity level κ, and outputs the public parameters (pp, p zt ) where pp is a description of a κ-logarithmic encoding system as above, and p zt is a zero-test parameter;

Samp(pp) : The randomized sampling procedure takes as input the public parameters pp and outputs a "level-0" encoding u ∈ S (α) 0

for a nearly uniform α ∈ R;

Enc(pp, i, u) : The (possibly randomized) encoding procedure takes as inputs the parameters pp, an index i ∈ [κ + 1] and a "level-0" encoding u ∈ S (α) 0

for some α ∈ R and outputs the "level-i" encoding u ∈ S (α) i ;

ReRand(pp, i, u) : The randomized rerandomization procedures takes as inputs the parameters pp, an index i ∈ [κ + 1] and a "level-i" encoding u ∈ S (α) i

for some α ∈ R, and outputs another u ∈ S i (α) such that, for any u 1 , u 2 ∈ S (α) i , the output distributions of ReRand(pp, i, u 1 ) and ReRand(pp, i, u 2 ) are nearly the same; Neg(pp, u) The arithmetic negation is deterministic, takes as input the public parameters pp and a "level-i" encoding u ∈ S (α) i

for some α in R and i ∈ {0, . . . , κ + 1} and outputs a "level-i" encoding u ∈ S (-α) i

;

The arithmetic addition is deterministic, takes as input the public parameters pp and "level-i" encodings u 1 ∈ S (α1) i and u 2 ∈ S (α2) i

for some α 1 , α 2 in R and i ∈ {0, . . . , κ+1} and outputs a "level-i" encoding u ∈ S for some α 1 , α 2 in R and i, j ∈ {0, . . . , κ} and outputs a "level-k" encoding

where k = max(i, j) if i + j ≤ 1, and k = max(i, j) + 1 otherwise;

IsZero(pp, p zt , u) The zero-testing procedure is deterministic, takes as input the public parameters pp and a "level-(κ + 1)" encoding u ∈ S (α)

κ+1 and outputs 1 if α = 0 and 0 otherwise;

The extraction procedure is deterministic, takes as input the public parameters pp and a "level-

κ+1 and outputs a λ-bit string s such that:

Similarly to what is done for graded encoding schemes, we consider slightly relaxed definitions of IsZero and Ext, where IsZero can output 1 for some non-zero encoding with negligible probability and Ext can extract to different outputs for encodings of the same ring element with negligible probability.

Hardness assumption. Let us introduce an analogue of the multilinear decisional Diffie-Hellman assumption (see [START_REF] Boneh | Applications of Multilinear Forms to Cryptography[END_REF]) for logarithmic encoding schemes: the Logarithmic Decisional Diffie-Hellman assumption (LDDH).

where the multiplication is performed using a binary tree, and

The "repaired" Coron-Lepoint-Tibouchi scheme

In this section, we recall the recent graded encoding scheme over the integers (CLT) of Coron, Lepoint and Tibouchi [START_REF] Jean-Sébastien Coron | New Multilinear Maps Over the Integers[END_REF]. Note that a CLT level-k encoding u of an exponent m ∈ R can be viewed as a CCK ciphertext of the plaintext m ∈ R multiplicatively masked by z k when q = 1 in the CCK scheme. The vector p zt can then be viewed as a partial secret key, and can be used to test if u encodes 0 ∈ R when k = κ.

Instance generation.

CLT.InstGen(1 λ , 1 κ ) : On input the security parameter λ and the multilinearity level κ:

1. Fix the parameters {n, ν, ρ, , µ, η, τ, β} to ensure correctness and security, as analyzed in [CLT15, Sec. 2.2] and [LS14];

2. Generate n secret random η-bit primes p i and compute x 0 = i∈[n] p i .

3. Generate the exponent ring R = Z g1 × • • • × Z gn , where g i is a α-bit prime integer;

4. Generate the secret multiplicative mask z as a random invertible integer modulo x 0 ;

5. Generate random level-0 encodings

where r ij ← (-2 ρ , 2 ρ ) and a ij ← Z gi ;

6. Generate a level-1 encoding

where r i ← (-2 ρ , 2 ρ );

where ij ← (-2 ρ , 2 ρ ) for i = j and ii ← (n2 ρ , n2 ρ + 2 ρ );

where r ij is randomly generated in the half-open parallelepiped spanned by the columns of

9. Generate an integer matrix H = (h ij ) ∈ Z n×n such that H is invertible in Z and both H T ∞ and (H -1 ) T ∞ are upper bounded by 2 β (cf. [START_REF] Hyung | Security Analysis of Multilinear Maps over the Integers[END_REF]). Generate a random prime integer N of size nη + 2η + 1 bits and get by LLL pairs of non-zero integers (α i , β i ) such that

where

From that we obtain a zero-testing vector

10. Generate a ladder of level-1 encodings of zero, {X

j } of increasing size. Specifically, for j ∈ [nη + log 2 ], we set:

11. Generate a seed s for a strong randomness generator Extract.

Publish the parameters (pp, p zt ) where pp = {n, η, α, ρ, β, τ, , µ, y, x, x , {X We say that u is a level-k encoding of the exponent

is the noise vector of u.

Sampling, encoding and rerandomization.

To sample a level-0 encoding, we compute a subset-sum of the x j 's (the statistical uniformity of the encoded value follows by application of the leftover hash lemma over R, cf. [CLT13, Lem. 1]). To obtain a level-1 encoding from a level-0 encoding, we multiply it by y (which encodes the exponent 1 at level 1), and then we rerandomize it to avoid a trivial division attack. This rerandomization adds subset-sums of level-1 encodings of 0. (Note that the Π j 's and x j 's are specially designed to prove that the output of ReRand is nearly independent of the input as long as it encodes the same exponent -cf. The encodings are computed in Z and then brought down to the size of x 0 using the ladder {X

(1) j }.

Negation, addition and multiplication. The addition modulo x 0 of two level-k encodings with small enough noise vectors yields a level-k encoding of the componentwise addition of the exponents in R. The multiplication modulo x 0 of a level-i encoding with a level-j encoding, with small enough noise vectors, yields a level-(i + j) encoding of the componentwise multiplication of the exponents in R. However, since x 0 is not public, these operations are performed in Z instead, and brought down to the size of x 0 by using the ladder {X

(1) j } as above.

CLT.Neg(pp, u) : Output -u.

CLT.Add(pp, u 1 , u 2 ) : On input two encodings u 1 , u 2 at level i ∈ {0, . . . , κ}, output u 1 + u 2 .

CLT.Mult(pp, u 1 , u 2 ) : On input two encodings u 1 , u 2 at level i, j such that i + j ≤ κ, output u 1 • u 2 .

Zero-testing and extraction. Finally, we have that a level-κ encoding u encodes 0 ∈ R when the most significant bits of [u • p zt ] N are zeroes. In other words, the most significant bits of the latter value for any level-κ encoding only depends on the exponent it encodes. Finally, if these most significant bits have sufficient min-entropy, we can extract from them a random λ-bit string using a strong randomness extractor.

CLT.IsZero(pp, p zt , u) :

, where msbs ν extracts the ν most significant bits of the result.

Correctness, security and parameters constraints

In [START_REF] Jean-Sébastien Coron | New Multilinear Maps Over the Integers[END_REF], the authors prove that the previous scheme is a correct graded encoding scheme. In particular:

• Lemma 8.19 proves that CLT.Samp outputs a level-0 encoding of a nearly uniform m ∈ R;

• Lemma 8.20 proves that the output of CLT.ReRand is nearly independent from the input;

• Lemma 8.21 proves that, with overwhelming probability, CLT.IsZero outputs 1 if and only if the encoded exponent is 0 ∈ R.

Lemma 8.19 (Lemma 1 of [CLT13]

) Let u ← CLT.Samp(pp) and write

The distribution of (pp, m) is statistically close to the distribution of (pp, m ) where m ← R.

Lemma 8.20 (Lemma 2 of [CLT15])

Let the encodings c ← Samp(pp), ĉ1 ← Enc(pp, 1, c) and c 1 such that

x 0 , and define r = (r 1 , . . . , r n+1 ) T . If 2(ρ + α + λ) ≤ η and τ ≥ (n + 2) • ρ + 2λ, then the distribution of (pp, r) is statistically close to that of (pp, r ) where r ∈ Z n+1 is randomly generated in the half-open parallelepiped spanned by the column vectors of 2 µ Π. Moreover we have

Publish(pp, i). Given a value i ∈ {1, . . . , N }, this algorithm outputs a key pair (pub i , priv i ). Party i broadcasts pub i to all other parties and keep priv i secret.

KeyGen(pp, i, priv i , {pub j } j =i ). Party i computes KeyGen on all the collected public (broadcast) values {pub j } j =i and its secret value priv i . This algorithm outputs a key s i .

The protocol is said to be correct if the N parties generate the same shared key s with high probability, i.e. s = s 1 = • • • = s N . A correct protocol is said to be secure if, given all N public values pub i , no polynomial time algorithm can distinguish the true shared secret s from a random string.

As in [GGH13; CLT13] for graded encoding schemes, a logarithmic encoding scheme L can be used to instantiate a one-round N -way Diffie-Hellman key exchange protocol in the common reference string model, under the κ-LDDH assumption for N = 2 κ + 1 users.

Setup(1 λ , 1 N = 1 2 κ +1 ). Output pp ← L.InstGen(1 λ , 1 κ ) as the public parameter.

Publish(pp, i). Each party i samples a random c i ← L.Samp(pp) as a secret value, and publishes as the public value the corresponding level-1 encoding

KeyGen(pp, i, c i , {c j } j =i ). Each party i computes ci = c i • j =i c j using a binary tree and the procedure L.Mult, and uses the extraction routine to locally compute the key s ← L.ext(pp, ci ).

The correctness of the protocols follows from the fact that all parties get valid encodings of the same ring element, and the extraction property implies that they should extract the same key with overwhelming probability.

The security of the protocol follows from the randomness property of the extraction property of the extraction procedure and the LDDH hardness assumption. The proof is a straightforward adaptation of [CLT13, Appendix D].

Theorem 8.23 The protocol described above is a secure one-round N -way Diffie-Hellman key exchange protocol if N = 2 κ + 1 and if the κ-LDDH assumption holds for the underlying encoding scheme.

Adapting the Coron-Naccache-Tibouchi modulus switching technique to CCK

In this section, we give two adaptations of the modulus switching technique proposed by Coron, Naccache and Tibouchi [START_REF] Jean-Sébastien Coron | Public Key Compression and Modulus Switching for Fully Homomorphic Encryption over the Integers[END_REF] to the CCK scheme. These adaptations assume either the plaintext space is R = Z n g with g ≥ 2, or that the additive mask that allowed to prove the semantic security of the scheme is zero (i.e. we assume that q = 1).

We use the notation of Section 8.3.10.2.

With plaintext space Z n g

For this adaptation, we need to assume that CCK.KeyGen produces p i 's such that

Let sk = {p, q}, pk = {N, x 0 , x e } ← CCK.KeyGen(1 λ ) and let µ = log 2 N . Assume that c ∈ Z N encrypts the vector m ∈ Z n g . To switch from the key sk, pk to a key sk = {p , q }, pk = {N , x 0 , x e } with p i ≤ w , [p i ] g = 1 and 1 ≤ 2 ξ ≤ p i /p i , we can publish a tuple (v, σ) ∈ R Θ × Z •Θ N , with Θ = Θ(λ) a fixed parameter, such that:

where the v k 's have µ bits of precision after the binary point, with |ε i | < 2 -µ , and

Also, define χ ∈ Z n N G such that, for all j ∈ [n], [χ j ] N = (x e ) j and [χ j ] gi = (e j ) i for all i ∈

and in particular [c ] gi = [c] gi . Now,

which proves that c encrypts m under the key {sk , pk }.

Chapter 9

Improving building blocks Contents

Backtracking-assisted multiplication Abstract

This paper describes a new multiplication algorithm, particularly suited to lightweight microprocessors when one of the operands is known in advance. The method uses backtracking to find a multiplicationfriendly encoding of the operand known in advance.

A 68 05 microprocessor implementation shows that the new algorithm indeed yields a twofold speed improvement over classical multiplication for 128-byte numbers. This is joint work with Houda Ferradi, Diana Maimuţ, David Naccache, and Hang Zhou. This work was presented at ArcticCrypt 2016, Longyearbyen (Svalbard) and published in [FGM + 16b].

Introduction

A number of applications require performing long multiplications in performance-restricted environments. Indeed, low-end devices such as the 68 05 or the 80 51 microprocessors have a very limited instructionset, very limited memory, and operations such as multiplication are rather slow: a mul instruction typically claims 10 to 20 cycles.

General multiplication has been studied extensively, and there exist algorithms with very good asymptotic complexity such as the Schönhage-Strassen algorithm [START_REF] Schönhage | Schnelle Multiplikation grosser Zahlen[END_REF] which runs in time O(n log n log log n) or the more recent Fürer algorithm [START_REF] Fürer | Faster integer multiplication[END_REF], some variants of which achieve the slightly better O(2 3 log * n n log n) complexity [START_REF] Harvey | Even faster integer multiplication[END_REF]. Such algorithms are interesting when dealing with extremely large integers, where these asymptotics prove faster than more naive approaches.

In many cryptographic contexts however, multiplication is performed between a variable and a predetermined constant:

• During Diffie-Hellman key exchange [START_REF] Diffie | New Directions in Cryptography[END_REF] or ElGamal [START_REF] Elgamal | On Computing Logarithms Over Finite Fields[END_REF] a constant g must be repeatedly multiplied by itself to compute g x mod p.

• The essential computational effort of a Fiat-Shamir prover [FFS88; FFS87] is the multiplication of a subset of fixed keys (denoted s i in [START_REF] Feige | Zero Knowledge Proofs of Identity[END_REF]).

• A number of modular reduction algorithms use as a building-block multiplications (in N) by a constant depending on the modulus. This is for instance the case of Barrett's algorithm [START_REF] Barrett | Implementing the Rivest Shamir and Adleman Public Key Encryption Algorithm on a Standard Digital Signal Processor[END_REF] or Montgomery's algorithm [START_REF] Peter | Modular multiplication without trial division[END_REF].

The main strategy to exploit the fact that one operand is constant consists in finding a decomposition of the multiplication into simpler operations (additions, subtractions, bitshifts) that are hardware-friendly [START_REF] Robert | Multiplication by integer constants[END_REF]. The problem of finding the decomposition with the least number of operations is known as "single constant multiplication" (SCM) problem. SCM ∈ NP-complete as shown in [START_REF] Cappello | Some complexity issues in digital signal processing[END_REF], even if fairly good approaches exist [WH99; Avi61; DM94a; DM94b] for small numbers. For larger numbers, performance is unsatisfactory unless the constant operand has a predetermined format allowing for ad hoc simplifications.

In this paper, we propose a completely different approach: the constant operand is encoded in a computation-friendly way, which makes multiplication faster. This encoding is based on linear relationships detected amongst the constant's digits (or, more generally, subwords), and can be performed offline in a reasonable time for 1024-bit numbers and 8-bit microprocessors. We use a graph-based backtracking algorithm [START_REF] Knuth | The Art of Computer Programming[END_REF] to discover these linear relationships, using recursion to keep the encoder as short and simple as possible.

Multiplication algorithms

We now provide a short overview of popular multiplication methods. This summary will serve as a baseline to evaluate the new algorithm's performance.

Multiplication algorithms usually fall in two broad categories: general divide-and-conquer algorithms such as [START_REF] Cook | On the minimum computation time of functions[END_REF] and Karatsuba [START_REF] Karatsuba | Multiplication of Many-Digital Numbers by Automatic Computers[END_REF]; and the generation of integer multiplications by compilers, where one of the arguments is statically known. We are interested in the case where small-scale optimizations such as Bernstein's [START_REF] Robert | Multiplication by integer constants[END_REF] are impractical, but general purpose multiplication algorithms à la Toom-Cook are not yet interesting.

Performance

The algorithm has an offline step (backtracking) and an online step (multiplication), which are implemented on different devices.

The offline step is naturally the longest; its performance is heavily dependent on the digit combination operations allowed and on how many numbers are being dealt with. More precisely, results are near-instant when dealing with 64 individual bytes and operations {+, -, ×2}. It takes much longer if operations modulo 256 are considered as well, but this gives a better coverage of a, hence better online results. That being said, modulo 256 operations are slightly less efficient than operations over the integers ( 1.5 more costly), since they require a subtraction of b afterwards. Table 9.2 provides comparative performance data for a multiplication by the processed constant π2 1024 . Backtracking this constant took 85 days on an Altix UV1000 cluster. As a final remark, note that one can also reverse the idea and generate a key by which multiplication is easy. This can be done by progressively picking VM operations until an operand (key) with sufficient entropy is obtained. While this is not equivalent to randomly selecting keys, the authors conjecture that, in practice, the existence of linear relations 3 between key bytes should not significantly weaken public-key implementations.

Barrett's algorithm

Barrett's algorithm (Algorithm 38) approximates the result c = d mod n by a quasi-reduced number c + n where 0 ≤ ≤ 2. We denote N = |n| , D = |d| and set a maximal bit-length reduction capacity L such that N ≤ D ≤ L. The algorithm will function as long as D ≤ L. In most implementations D = L = 2N . The algorithm uses the pre-computed constant κ = 2 L /n that depends only on n and L. The reader is referred to [START_REF] Barrett | Implementing the Rivest Shamir and Adleman Public Key Encryption Algorithm on a Standard Digital Signal Processor[END_REF] for a proof and a thorough analysis of this algorithm.

Algorithm 38: Barrett Multiplication Algorithm

Montgomery's algorithm

Montgomery's algorithm [START_REF] Peter | Modular multiplication without trial division[END_REF] is another approach to compute modulo n without dividing by n. It is based on modular congruences and exact division, whereas Barrett is based on approximating the real reciprocal with bounded precision.

Let R and T integers such that R > n, gcd(n, R) = 1, and 0 ≤ T < nR. Montgomery's algorithm computes T R -1 mod n. Nombers of the form xR mod n are called n-residues. Multiplication of two nresidues followed by Montgomery reduction is therefore equivalent to the ordinary modular multiplication. With a suitable choice of R, often 2 N , a Montgomery reduction can be efficiently computed.

In Algorithm 39 we write x i to denote the i-th least significant bit of x. The algorithm can be written in an arbitrary base b, but we only consider b = 2 here. The value n ← -n -1 mod 2 N is precomputed.

Algorithm 39: Montgomery Multiplication Algorithm

ui ← ain mod 2

4.

A ← A + (uin i)

3 compares Montgomery's and Barret's algorithm to classical reduction. Despite Montgomery's algorithm being asymptotically more efficient than Barrett's, its performance for numbers under 1024 digits is poorer. Furthermore, implementing Montgomery's algorithm is more complex than Barrett's. Another Folklore method. The purpose of the folklore technique recalled by Joye is to obtain an RSA modulus n with a predetermined leading part n h . Letting |n h | = H, we have:

The algorithm uses the function NextPrime(x) that returns the prime following x (if x is prime then x = NextPrime(x)). Note that because the gap between x and NextPrime(x) is unpredictable, the algorithm may fail to return an n of the form n = n h 2 N -H + n and will have to be re-launched. We refer the reader to [START_REF] Arjen | Generating RSA Moduli with a Predetermined Portion[END_REF] for a more formal analysis of this process. Proof: By definition, ω = η/p means that there exists α < p such that

Substituting the value of η, we get:

Thus:

Upper bounding ω we get:

Note that the most significant bit of p must be set to 1, i.e. 2 N -H-1 < p < 2 N -H -1.

It follows directly from Lemma 9.3 that:

Applying the Prime Number Theorem, we find that m ln (2 H+1 + 1) 0.7(H + 1). In other words, the log 2 (m + 1) log 2 (0.7H + 1.7) < log 2 H least significant bits of n h are likely to get polluted. We hence rectify the size of n h to Hτlog 2 H where τ ∈ N is a parameter allowing to reduce the failure probability of Algorithm 40 at the cost of further shortening n h . For the sake of clarity, we do not integrate these fine-tunings in the description of Algorithm 40 but consider that n h is composed of a "real" prescribed pattern n h of size Hτlog 2 H bits right-padded with τ + log 2 H zero bits. Various success rates for N = 1024, H = 512 are given in Table 9.4. Based on those we recommend to set τ = 0 or τ = 1 and re-launch the generation process if the algorithm fails.

This is a polynomial of degree 2, that has one positive and one negative root. We assumed x > 0, therefore we only need to consider the positive root x max :

Therefore, if x < 2 P/2-1 , then the fraction in Equation (9.2) is smaller than one. As a consequence, we have

i.e., as 2 P +1 -4x is an integer,

Proof: By definition, ω = η/p implies that there exists α < p such that

Substituting the value of η, we get:

Therefore we have the bound:

Bounding κ we obtain:

Terminology

1. The leading term of P according to , will be denoted by lt(P ) = p 0 ν j=1 x yj,0 j .

2. The leading coefficient of P according to will be denoted by lc(P ) = p 0 ∈ Q.

3. The quotient lm(P ) = lt(P ) lc(P ) = ν j=1 x yj,0 j is the leading monomial of P according to .

The above notations allow to generalize the notion of degree to exponent vectors: deg(P ) = deg(lm(P )) = y 0 = y 0,0 , . . . , y ν,0 .

Example 9.4 For and P (x, y) = 2x 2 1 x 2 2 + 11x 1 + 15, we have that:

, and lc(P ) = 2.

. We denote by Q -→ P Q 1 the reduction step with respect to P and according to :

There is only one polynomial Q i with this property.

We denote

and call Q i the residue of Q w.r.t (P, ).

Example 9.6

The usual Euclidean division for polynomials is a reduction in the sense defined here, in which i = 1.

Barrett's algorithm for multivariate polynomials

We will now adapt Barrett's algorithm to Q

Barrett's algorithm and Lemma 9.2 can be generalised to Q[x], by shifting polynomials instead of shifting integers.

Definition 9.3 (Polynomial right shift)

and a = a 1 , a 2 , . . . , a ν ∈ N ν . We denote:

where ϕ(a) = {i, ∀j, y i,j ≥ a i }.

Example 9.7 Let P (x) = 17x 7 + 26x 6 + 37x 4 + 48x 3 + 11. Then

Theorem 9.9 (Barrett's Algorithm for Polynomials) Let P, Q ∈ Q[x], such that lm(Q) lm(P ). Write

x wj,i j

Let L ≥ max (w i,j ) ∈ N, and define

With the above notations, (K(Q

where we naturally extended the notation A/B to polynomials.

Applying the definition of " ", we obtain

where 0 = 0 ν . Thus,

x wj,i-L = Q ϕ(y0) P .

We know that P G and L ≥ max(w i,j ), therefore

x wj,i-L = 0.

Let Q be the irreducible polynomial with respect to P , obtained by removing from Q the terms that exceed lm(P ).

Hence,

Algorithm 44: Polynomial Barrett Algorithm

Let us have a closer look at the expression B = (K(Q y)) z. Given the final shifting by z, the multiplication of K by Q y can be optimised by being only partially accomplished. Indeed, during multiplication, we only have to form monomials whose exponent vectors b = w

This remark is leveraged in the following example.

Example 9.8 Let

x 2 2 + 3. Let L = 6 and we observe that ν = 2. We can pre-compute K:

At this point, we shift Q by y 0 = 2, 2 , which is the vector of exponents for lm(P ).

This result, shifted by L νy 0 = 6, 6 -2, 2 = 4, 4 to the right gives:

It is easy to verify that:

b) Size: The leading monomial of B has the exponent vector u -Ly 0 which is equal to Ly 1,0 , L, . . . , L . We thus have size B = size K .

4. BP . The cost of this step is cost

5. Final subtraction Q -BP . The cost of polynomial subtraction is negligible with respect to cost 4 .

The algorithm's overall complexity is hence

Dynamic constant scaling in

Proof: First note that K = h(L)/P implies that K = (h(L)h(L) mod P )/P . Let G = h(L) mod P , then

Since u ν ∈ N ν , we have

We know that P G, thus P G ϕ( u ν ) , so that deg ≥0

Example 9.9 Let

We let u = 4 and we observe that ν = 2. We pre-compute K:

We first shift Q by y 0 = 2, 2 , which is the vector of exponents for lm(P ).

Then, we compute

This result shifted by u νy 0 = 4, 4 -2, 2 = 2, 2 to the right gives:

It is easy to verify that:

Application to BCH codes

General remarks. BCH codes are cyclic codes that form a large class of multiple random error-correcting codes. Originally discovered independently by Hocquenghem [START_REF] Hocquenghem | Codes correcteurs d'erreurs[END_REF] and Bose and Ray-Chaudhuri [START_REF] Pieprzyk | On a class of error correcting binary group codes[END_REF], as binary codes of length 2 m -1, that generalise Hamming codes, BCH codes were subsequently extended to non-binary settings by Gorenstein et al. [START_REF] Daniel Gorenstein | Two-Error Correcting Bose-Chaudhuri Codes are Quasi-Perfect[END_REF]. They also noticed that BCH codes and Reed-Solomon codes have a common generalization, and that the decoding algorithm extends to more general situation.

Terminology. We further refer to the vectors of an error correction code as codewords. The codewords' size is called the length of the code. The distance between two codewords is the number of coordinates at which they differ. The minimum distance of a code is the minimum distance between two codewords.

Recall that a primitive element of a finite field is a generator of the multiplicative group of the field.

BCH preliminaries

Definition 9.4 Let m ≥ 3. For a length n = 2 m -1, a distance d and a primitive element α ∈ F * 2 m , we define the binary BCH code:

Let m ≥ 3 and 0 < t < 2 m-1 be two integers. There exists a binary BCH code (called a t-error correcting BCH code) with parameters n = 2 m -1 (the block length), nk ≤ mt (the number of parity-check digits) and d ≥ 2t + 1 (the minimum distance).

Definition 9.5 (Generator polynomial) Let α be a primitive element in

The degree of g(x), which is the number of parity-check digits nk, is at most mt. Let i ∈ N and denote i = 2 r j for odd j and r ≥ 1. Then α i = (α j ) 2 r is a conjugate of α j which implies that α i and α j have the same minimal polynomial, and therefore φ i (x) = φ j (x). Consequently, the generator polynomial g(x) of the t-error correcting BCH code can be written as follow:

. . , α 2t as its roots.

where t min = min(A), t 1/2 = Median(A), and t max = max(A). This observation leads to the definition of a distribution adaptive regulator R A as follows:

where F is the cumulative distribution function of A. In particular, this definition agrees with the constraints of Equations (9.10) to (9.12).

Remark. The requirement we make that A be stationary allows the regulator to depend only implicitly on t. If we allow a time-dependent distribution A t then the regulator may depend on the history of A -and possibly of X t -which makes the description more complicated.

Remark.

The assumption that we know A is not very restrictive: It is possible to learn A on-the-fly as packets arrive. Thus after some temporary regime of observation, we may assume that the relevant parameters of A are known.

In such a scenario, there would be some impact on the initial performance of the service.

Adaptive regulators never overflow or underflow, unless they are limited in some way (e.g. they cannot serve packets as fast as R A would command).

Steady-state average occupation

In the steady-state regime, let X = E[X t ] (which exists because 0 ≤ X t ≤ K), and assuming that no overflow occurs, as many packets enter the queue as they leave. In average, it takes E[A] units of time for a packet to arrive, and the regulator lets a packet leave every R A (X, K, A). Equating the two yields the steady-state average occupation:

where Γ(s, x) is the upper incomplete Gamma function, defined by:

The special case λ = 10 gives X ≈ 0.41 K. Note that because of Equation (9.6), there is a variance-queue length trade-off.

Example 9.12 (Geometric distribution) The geometric distribution is a good approximation to a von Neumann corrector's output, and constitutes yet another interesting example. For a geometric distribution with parameter p, we have F (k) = 1 -(1p) k and E[A] = 1/p, hence solving Equation (9.14) yields:

In particular, if p = 1/2 then X = K/4.

Chapter 10

Mathematical results This chapter gathers some mathematical constructions which are not strictly speaking cryptographic but nevertheless have interesting cryptographic applications.

Contents

They stem from interesting observations from number theory, such as the number-theoretic errorcorrecting code that we describe in Section 10.1; algebraic geometry, Section 10.2 explores the possibility of constructing some families of elliptic curves on which a variant of the knapsack cryptosystem could be designed; and calculus, with Section 10.3 extending a theorem of Laguerre on the location of polynomial roots.

A number-theoretic error-correcting code Abstract

In this paper we describe a new error-correcting code (ECC) inspired by the Naccache-Stern cryptosystem. While by far less efficient than Turbo codes, the proposed ECC happens to be more efficient than some established ECCs for certain sets of parameters.

The new ECC adds an appendix to the message. The appendix is the modular product of small primes representing the message bits. The receiver recomputes the product and detects transmission errors using modular division and lattice reduction. This is joint work with Éric Brier, Jean-Sébastien Coron, Diana Maimuţ, and David Naccache. It was presented at SECITC 2015 in Bucharest (Romania), and published in [BCG + 15].

Introduction

Error-correcting codes (ECCs) are essential to ensure reliable communication. ECCs work by adding redundancy which enables detecting and correcting mistakes in received data. This extra information is, of course, costly and it is important to keep it to a minimum: there is a trade-off between how much data is added for error correction purposes (bandwidth), and the number of errors that can be corrected (correction capacity).

Shannon showed [START_REF] Shannon | A Mathematical Theory of Communication[END_REF] in 1948 that it is in theory possible to encode messages with a minimal number of extra bits 1 . Two years later, Hamming [START_REF] Hamming | Error Detecting and Error Correcting Codes[END_REF] proposed a construction inspired by parity codes, which provided both error detection and error correction. Subsequent research saw the emergence of more efficient codes, such as Reed-Muller [Mul54; Ree54] and Reed-Solomon [START_REF] Reed | Polynomial Codes Over Certain Finite Fields[END_REF]. The latest were generalized by Goppa [START_REF] Valerii | Codes on Algebraic Curves[END_REF]. These codes are known as algebraic-geometric codes.

Convolutional codes were first presented in 1955 [START_REF] Elias | Coding for Noisy Channels[END_REF], while recursive systematic convolutional codes [START_REF] Berrou | Near Shannon Limit Error-Correcting Coding and Decoding: Turbo-Codes[END_REF] were introduced in 1991. Turbo codes [START_REF] Berrou | Near Shannon Limit Error-Correcting Coding and Decoding: Turbo-Codes[END_REF] were indeed revolutionary, given their closeness to the channel capacity ("near Shannon limit").

Results: This paper presents a new error-correcting code, as well as as a form of message size improvement based on the hybrid use of two ECCs one of which is inspired by the Naccache-Stern (NS) cryptosystem [START_REF] Naccache | A New Public-Key Cryptosystem[END_REF][START_REF] Chevallier-Mames | Linear Bandwidth Naccache-Stern Encryption[END_REF]. For some codes and parameter choices, the resulting hybrid codes outperform the two underlying ECCs.

The proposed ECC is unusual because it is based on number theory rather than on binary operations.

Preliminaries

Notations

Let P = {p 1 = 2, . . . } be the ordered set of prime numbers. Let γ ≥ 2 be an encoding base. For any m ∈ N (the "message"), let {m i } be the digits of m in base γ i.e.:

We denote by h(x) the Hamming weight of x, i.e. the sum of x's digits in base 2, and, by |y| the bit-length of y.

Error-correcting codes

Let M = {0, 1} k be the set of messages, C = {0, 1} n the set of encoded messages. Let P be a parameter set.

Definition 10.1 (Error-Correcting Code) An error-correcting code is a couple of algorithms: In other terms, any correcting code whose encoded message size is growing linearly with message size can benefit from the described construction.

Expansion rate: Let k be the length of m and consider the bit-size of the corresponding codeword as in Equation (10.6). The expansion rate ρ is: 10.1. For instance, a message of size 163 bits can be encoded as a 256-bit string, among which up to 7 errors can be corrected.

To illustrate the benefit of our approach, consider a 5812-bit message, which we wish to protect against up to 31 errors.

A direct use of Reed-Muller would require n(5812) = 8192 bits as seen in Table 10.1. Contrast this with our code, which only has to protect c(m), that is 931 bits as shown by Equation (10.6), yielding a total size of 5812 + n(931) = 5812 + 2048 = 7860 bits.

Other parameters for the Reed-Muller primitive are illustrated in Table 10.2, which shows that for large message sizes and a small number of errors, our error-correcting code slightly outperforms Reed-Muller code

The case γ > 2

The difficulty in the case γ > 2 stems from the fact that a binary error in a γ-base message will in essence scramble all digits preceding the error. As an example, 1220021012202012010011120202 3 + 2 30 = 1220021022112000112220110110 3 Hence, unless γ = 2 Γ for some Γ, a generalization makes sense only for channels over which transmission uses γ symbols. In such cases, we have the following: a k-bit message m is pre-encoded as a γ-base κ-symbol message m . Here κ = k/ log 2 γ . Equation (10.1) becomes:

Improving Laguerre's theorem on locating a polynomial's roots

Abstract A famous theorem due to Edmond Laguerre (and sometimes incorrectly credited to Samuelson) gives a range that contains all the roots of a given polynomial, when all roots are real.

We refine this result by observing that it is possible to leverage the third coefficient's information through the resolution of an optimisation problem. This is joint work with Éric Brier.

Laguerre's theorem

In 1880, Laguerre published a statement and proof of the following theorem bounding the roots of a given polynomial 6 [Lag80]:

Theorem 10.6 (Laguerre) Let P (x) = x n+1 + a 1 x n + • • • + a n x + a n+1 be a monic polynomial of degree n + 1, whose roots (r 1 , . . . , r n+1 ) are all real. Then for

where u and v are the roots of

Explicitly, this gives the following result, known in the Statistics litterature as Samuelson's inequality [START_REF] Paul A Samuelson | How deviant can you be?[END_REF] and sometimes incorrectly credited to Samuelson himself:

Samuelson's main contribution was to realise that -a 1 /(n+1) is in fact r, the mean of all roots; and that b is the standard deviation of the r i , thereby giving a statistical interpretation to this result. Further refinements of this approach were formulated by many authors in the 1950s to 1970s, often with a substantial overlap [START_REF] Tyler | The Laguerre-Samuelson inequality with extensions and applications in statistics and matrix theory[END_REF].

We reproduce here, in a somewhat more compact and modern language, the proof that Laguerre provided for his theorem.

Now this quantity is always greater than or equal to (ur j ) 2 = u 2 -2r j u + r 2 j for any j, because the sum only consists of non-negative integers. In other terms,

This is a strictly positive quadratic function of u, therefore it has no real roots, therefore its discriminant must be non-positive, which is written

Hence, r j must lie between the roots of this polynomial, which are

and it is easy to check that u and v are reals.

Note that the quantity n -(n + 1)r 2 , is positive: This it exactly the contents of Laguerre's original theorem.

Universal form

We can provide a 'universal' result that does not depend explicitly on n, by taking the limit n → ∞ in Equation (10.19). We get a maximal value α = (1r 2 ) 3/2 + r 3 .

Appendix A

Historical cryptography

A.1 A French code from the late 19 th century

Abstract

The Franco-Prussian war (1870-1871) was the first major European conflict during which extensive telegraph use enabled fast communication across large distances. Field officers would therefore have to learn how to use secret codes. But training officers also raises the probability that defectors would reveal these codes to the enemy. Practically all known secret codes at the time could be broken if the enemy knew how they worked.

Under Kerckhoffs' impulsion, the French military thus developed new codes, meant to resist even if the adversary knows the encoding and decoding algorithms, but simple enough to be explained and taught to military personnel.

Many of these codes were lost to history. One of the designs however, due to Major H. D. Josse, has been recovered and this article describes the features, history, and role of this particular construction. Josse's code was considered for field deployment and underwent some experimental tests in the late 1800s, the result of which were condensed in a short handwritten report. During World War II, German forces got hold of documents describing Josse's work, and brought them to Berlin to be analysed. A few years later these documents moved to Russia, where they have resided since. This is joint work with David Naccache. A8 wrote on the back only. A7 bears some similarity to A2.

A.1.3 Content analysis

A.1.3.1 Overview of inter-document relationships

Handwriting analysis (Appendix A.1.2.2) already gives some information about how the different documents are related. We completed this analysis by an in-depth examination of the corpus content and consistency. An overview of the relationships between documents is illustrated in Figure A.1 and detailed hereafter.

In particular, documents 3 and 6 do not seem to be related to the cryptographic system described in documents 1, 2, 4, 5. Document 6 bears a mention of Josse, and is thus not completely unrelated. However document 3 does not, and seems to be completely independent.

A.1.3.2 The poem (document 6)

Let's start with a description and analysis of the ancillary documents, because their relationship to the cryptographic system is unclear and they can be treated independently. While the leaflet bears the inscription 'Méthode stéganographique Josse', the poem written on this page and reproduced in Appendix A.1.8 was widely known at the time. Indeed, the poem was quoted This appendix collects some of the implementations that we realised during this thesis. The reasons for including these is not merely anecdotal; it serves two purpose. The first, and most obvious argument in favour of including source code is that cryptology is perhaps more than any other field a dialog with implementers -as such, it is not only good practice but an essential part of cryptographic design to offer reference and benchmark implementations, that are clear and provide a reproducible basis for further improvements. The second argument, which explains why only a small fraction of our implementation work appears here, and why we use so many diverse languages, is that these implementations are not trivial. Either we use specific tricks (e.g. C and m4 macro expansion), or we use these programs as proof that a certain technique or algorithm provides the expected results; in any case, we think that these programs exemplify the connection between mathematics and computer science.

B.1 Implementation of the Thrifty Fiat-Shamir identification protocol

The following Python code solves the linear problem investigated in Section 3.3 for the Fiat-Shamir protocol. The other protocols (PKP, PPP, SD) were also implemented in Python but are not reproduced here since they follow immediately from the problem description.

B.2 Implementation of the backtracking-assisted multiplication algorithm

This section gives a C implementation of the encoding algorithm introduced in Section 9.1, showcasing the advantages of using macro expansion to achieve a compact encoder. The corresponding decoder, implemented in 65HC08 assembly, is not reproduced here. def generate_events (N , icdf ): """ Generates N events distributed according to the provided inverse cumulative distribution function """ return [ generator ( icdf ) for i in range ( N )] events = generate_events (1000000 , unif_icdf ) ret = simulate ( events , lambda x : mu_D ( unif_icdf , x ))

B.4 Implementation of the polynomial Barrett reduction algorithm

In this section we provide a Lisp implementation of the polynomial Barrett algorithm we introduced in Section 9.4, and illustrate the algorithm on an example. We choose the following polynomials:

The following program describes our algorithm and applies it to p 1 and p 2 . ; Shifting a polynomial to the right ( define shift ( lambda ( l q ) ( if ( or ( null ? l ) ( < ( caar l ) q )) () ( cons ( cons (-( caar l ) q ) ( cdar l )) ( shift ( cdr l ) q )) ) ) )

; Adding polynomials ( define add ( lambda ( p q ) ( degre ( if ( >= ( caar p ) ( caar q )) ( cons p ( list q )) ( add q p ) ) ) ) )

; Multiplying a term by a polynomial , without monomials preceding x ^lim ( ; Euclidean division .

( define divide ( lambda ( q p r ) ( if ( and p ( <= ( caar p ) ( caar q ))) ( let (( tampon ( cons (-( caar q )( caar p )) ( list (/ ( cadar q ) ( cadar p )) ) )) ) ( divide ( add ( map ( lambda ( x ) ( cons ( car x ) ( list (-cadr x ))))) ( txp tampon p -1) ) q ) p ( cons tampon r ) ) ) ( reverse r ) ) )

( define division ( lambda ( q p ) ( divide q p ()) ) )

; Barrett (k , L , last_P , Y ) , representing K , L , P and y ( define k ) ( define y ) ( define L 8) ( define last_P ) ( define barrett ( lambda ( q p ) ( if ( eq ? last_P p ) ( letrec (( g ( caar q )) ( h (-(+ g 1) y ))) ( shift ( degre ( mul ( shift k (-L g 1)) ( shift q y ) h )) h ) ) ( begin ( set ! k ( division ( list ( cons L (1) )) p )) ( set ! y ( caar ( set ! last_P p ))) ( barrett q p ) ) ) ) )

B.5 Implementation of the Micali-Shamir protocol

The following notebook (written in Sage version 7.2) demonstrates the three techniques introduced in Section 9.2 on a toy example.

Résumé

La sécurité de l'information repose sur la bonne interaction entre différents niveaux d'abstraction : les composants matériels, systèmes d'exploitation, algorithmes, et réseaux de communication. Cependant, protéger ces éléments a un coût ; ainsi de nombreux appareils sont laissés sans bonne couverture.

Cette thèse s'intéresse à ces différents aspects, du point de vue de la sécurité et de la cryptographie. Nous décrivons ainsi de nouveaux algorithmes cryptographiques (tels que des raffinements du chiffrement de Naccache-Stern), de nouveaux protocoles (dont un algorithme d'identification distribuée à divulgation nulle de connaissance), des algorithmes améliorés (dont un nouveau code correcteur et un algorithme efficace de multiplication d'entiers), ainsi que plusieurs contributions à visée systémique relevant de la sécurité de l'information et à l'intrusion.

En outre, plusieurs de ces contributions s'attachent à l'amélioration des performances des constructions existantes ou introduites dans cette thèse.

Abstract

Information security relies on the correct interaction of several abstraction layers: hardware, operating systems, algorithms, and networks. However, protecting each component of the technological stack has a cost; for this reason, many devices are left unprotected or under-protected.

This thesis addresses several of these aspects, from a security and cryptography viewpoint. To that effect we introduce new cryptographic algorithms (such as extensions of the Naccache-Stern encryption scheme), new protocols (including a distributed zero-knowledge identification protocol), improved algorithms (including a new error-correcting code, and an efficient integer multiplication algorithm), as well as several contributions relevant to information security and network intrusion.

Furthermore, several of these contributions address the performance of existing and newly-introduced constructions.

Mots-clés

Cryptographie à clé publique, preuves à divulgation nulle de connaissance, signatures numériques, codes correcteurs d'erreurs, algorithmes, sécurité de l'information, espions matériels