Description
In this talk I will introduce a new kind of attack on cryptosystems which can be represented by an (unknown) low degree polynomial with tweakable public variables such as a plaintext or IV and fixed secret variables such as a key. Its complexity is exponential in the degree but only polynomial in the key size, and it was successfully applied to several concrete schemes. In particular, for Trivium with 672 initialization rounds, it reduces the complexity of the best known attack from a barely practical 2^{55} to a trivial 2^{19}, which can recover the full key in less than a second on a single PC.
Next sessions
-
Polytopes in the Fiat-Shamir with Aborts Paradigm
Speaker : Hugo Beguinet - ENS Paris / Thales
The Fiat-Shamir with Aborts paradigm (FSwA) uses rejection sampling to remove a secret’s dependency on a given source distribution. Recent results revealed that unlike the uniform distribution in the hypercube, both the continuous Gaussian and the uniform distribution within the hypersphere minimise the rejection rate and the size of the proof of knowledge. However, in practice both these[…]-
Cryptography
-
Asymmetric primitive
-
Mode and protocol
-
-
Post-quantum Group-based Cryptography
Speaker : Delaram Kahrobaei - The City University of New York