1 of 80

CryptoBook

About this project

CryptoBook is a community project, developed by members of CryptoHack to create a resource for people to learn cryptography. The focus of this project is to create a friendly resource for the mathematical fundamentals of cryptography, along with corresponding SageMath implementation.

Think of this as an alternative SageMath documentation source, where the focus is its application in solving cryptographic problems.

If you're interested in contributing, come chat to us in our Discord Channel

Book Plan

A summary we plan to cover

Philosophy

The aim of CryptoBook is to have a consolidated space for all of the mathematics required to properly learn and enjoy cryptography. The focus of any topic should be to introduce a reader to a subject in a way that is fun, engaging and with an attempt to frame it as an applied resource.

The second focus should be to cleanly implement the various topics using SageMath, so that there is a clear resource for a new reader to gain insight on how SageMath might be used to create the objects needed.

Write about what you love and this book will be a success.

Descriptions of attacks against cryptosystems are strongly encouraged, however full SageMath implementations should not be included, as this has the potential for destroying CryptoHack challenges, or making all attacks known by so many people that CTFs become a total nightmare!!

Proposed topics

This list is not complete so please add to it as you see fit.

Mathematical Background

Fundamentals

Congruences
GCD, LCM
- Bézout's Theorem
- Gauss' Lemma and its ten thousand corollaries
Euclid's algorithm
Modular Arithmetic
Morphisms et al.
Frobenius endomorphism

Number Theory

Mainly thinking things like

Prime decomposition and distribution
Primality testing
Euler's theorem
Factoring
Legendre / Jacobi symbol

Abstract Algebra

Mainly thinking things like:

Groups, Rings, Fields, etc.
Abelian groups and their relationship to key-exchange
Lagrange's theorem and small subgroup attacks

Basilar Cryptanalysis forms

Introduction to Cryptanalysis
A linear Approach to Cryptanalysis
Matsui's Best biases algorithm
A Differential Approach to Cryptanalysis

Elliptic Curves

Weierstrass
Montgomery
Edwards
Counting points (Schoof's algorithm)
Complex multiplication
- Good reference, thanks Joachim

Generating Elliptic Curves

Generating Anomalous curves
Generating curves of prime order
Generating supersingular curves Wikipedia
Generating non-supersinular curves of low embedding degree
Generating curves of arbitary order (hard)
- Thesis on the topic
- Sage implementation ChiCube's script

Hyperelliptic curves

Generalization of elliptic curves
Recovering a group structure using the Jacobian
Example: genus one curves, jacobian is isomorphic to the set of points
Mumford representation of divisors
Computing the order of the Jacobian
- For characteristic 2^n: Example 56
- Hyper Metroid example

Security background

Basic Concepts
- Confidentiality, Integrity etc
- Encryption, Key generation
Attacker goals + Attack games
Defining Security - Perfect security, semantic security
Proofs of security + Security Reductions

Asymmetric Cryptography

RSA

Textbook protocol
Padding
- Bleichenbacher's Attack
- OAEP
Coppersmith
- Håstad's Attack
- Franklin-Reiter Attack
Wiener's Attack
RSA's Integer fattorization Attacks
- Fermat Factoring Attack
- Quadratic Sieve Attack
- Number Fielde Sieve Attack
RSA Digital Signature Scheme
Timing Attacks on RSA
RSA with Chinese Remainder Theorem (CRT)
- Fault Attack on RSA-CRT
- Bellcore Attack (Low Voltage Attack)

Paillier Cryptosystem

Textbook protocol

ElGamal Encryption System

Textbook protocol
ElGamal Digital Signature Scheme

Diffie-Hellman

Textbook protocol
Strong primes, and why

Elliptic Curve Cryptography

ECDSA
EdDSA

Symmetric Cryptography

One Time Pad

XOR and its properties
XOR as One Time Pad
Generalized One Time Pad

Block Ciphers

Stream Ciphers

Affine
RC4

Hashes

Introduction
Trapdoor Functions
MD family
SHA family
BLAKE Hash family
// TODO: Insert Attacks

Isogeny Based Cryptography

Isogenies
Isogeny graphs
Torsion poins
SIDH
SIKE
BIKE

Cryptographic Protocols

Zero-knowledge proofs

Schnorr proof of knowledge for dlog
Core definitions
Proof of equality of dlog
Proof of knowledge of a group homomorphism preimage

Formal Verification of Security Protocols

Definition of Formal Verification
Uses of Formal Verification
Handshake protocols, flawed protocols
The external threat: Man-In-The-Middle attacks
Attacking the (flawed) Needham-Shroeder public key exchange protocol

Usefull Resources ( Books, articles ..) // based on my material

Cryptanalytic Attacks on RSA (Yan, Springer, 2008)
Algorithmic Cryptanalysis (Antoine Joux, CRC Press, 2009)
Algebraic Cryptanalysis (Brad, Springer, 2009)
RC4 stream Cipher and its variants (H. Rosen, CRC Press, 2013)
Formal Models and Techniques for Analyzing Security Protocols (Cortier, IOS Press, 2011)
Algebraic Shift Register Sequences (Goresky && Klapper, Cambridge Press, 2012)
The Modelling and Analysis of Security Protocols (Schneider, Pearson, 2000)
Secure Transaction Protocol Analysis (Zhang && Chen, Springer, 2008)

Style Guide

Work in progress

Working together

If something doesn't make sense, make a comment using GitBook, or ask in the Discord.
If you are confident that something is wrong, just fix it. There's no need to ask.
If you think something doesn't have enough detail, expand on it, or leave a comment suggesting that.
If a page is getting too long, break it down into new pages. If you're unsure, then leave a comment or talk in the discord
If you want to write about something new and learn as you type, this is fine! But please leave a warning at the top that this is new to you and needs another pair of eyes.
If there's big subject you're working on, claim the page and save it, show us that that's what you're doing so we don't overlap too much

General Tips

Introduce new objects slowly, if many things need to be assumed, then try to plan for them to appear within the Book Plan somewhere.
It is better to cover less, and explain something well, than it is to quickly cover a lot. We're not racing
When explaining anything, imagine you are introducing it for a first time. Summaries exist elsewhere online, the goal of CryptoBook is education
Contribute as much or as little as you want, but try to only work on topics that
- You are interested in
- You have some experience of thinking about
External resources should be included at the end of the page. Ideally the book should be self-contained (within reason) but other resources are great as they offer other ways to learn

If anything on any page is unclear, then please leave a comment, or talk in the discord. We are all at different levels, and I want this to be useful for everyone. Let's work on this as a big team and create something beautiful.

Try and use the hints / tips blocks to break up dense text, for example:

To use $\LaTeX$ , you can wrap your text in $$maths here$$. If this is at the beginning of a paragraph, it makes it block, otherwise it is inline

Page Structure

A page should have a clear educational goal: this should be explained in the introduction. References to prerequisites should be kept within the book and if the book doesnt have this yet, it should be placed into Book Plan.
The topic should be presented initially with theory, showing the mathematics and structures we will need. A discussion should be pointed towards how this appears within Cryptography

Motivating a new reader is the biggest challenge of creating a resource. People will be coming here to understand cryptography and SageMath, so keep pointing back to the goal!

Within a discussion of a topic, a small snippet of code to give an example is encouraged
If you write code better than you write maths, then just include what you can and the page will form around that
An example page is given in Sample Page

Formatting

Mathematics notation

There's no "right or wrong" but it's good to be consistent, I think?

All maths must be presented using $\LaTeX$ using either both block and inline
We seem to be using mathbb for our fields / rings. So let's stick with that? Maybe someone has a good resource for notation we can work from?

Code Blocks

Make sure all code blocks have the right language selected for syntax highlighting
Preference is to SageMath, then to Python, then others.
Code should be cope-pastable. So if you include print statement, include the result of the output as a comment

# Example
a = 3
b = 6
print(a+b)
# 9

Algorithms

Algorithms should be presented as??

// todo

Sample Page

A rough guideline to a page

Introduction

Give a description of the topic, and what you hope the reader will get from this. For example, this page will cover addition of the natural numbers. Talk about how this relates to something in cryptography, either through a protocol, or an attack. This can be a single sentence, or verbose.

Laws of Addition

For all integers, the addition operation is

Associative: $a + (b + c) = (a + b) + c$
Commutative: $a + b = b + a$
Distributive: $a(b + c) = ab + ac$
Contains an identity element: $a + 0 = 0 + a = a$
Has an inverse for every element: $a + (-a) = (-a) + a = 0$
Closed: $\forall a, b \in \mathbb{Z}, a + b \in \mathbb{Z}$

Interesting Identity

(1 + 2 + 3 + \ldots + n)^2 = 1^3 + 2^3 + 3^3 + \ldots + n^3

Sage Example

sage: 1 + (2 + 3) == (1 + 2) + 3
True
sage: 1 + 2 == 2 + 1
True
sage: 5*(7 + 11) == 5*7 + 5*11
True
sage: sum(i for i in range(1000))^2 == sum(i^3 for i in range(1000))
True

Further Resources

Links to
Other interesting
Resources

Contributors

Optional space to say that you've worked on the book

Thank you!

🥳 CryptoBook is the result of the hard work of the CryptoHack community. Thanks to all of our writers, whether it's been line edits or whole section creation. This only exists because of the generosity and passion of a group of cryptographers.

Our Writers

...
You?

Join CryptoBook

If you would like to join the team, come over to our Discord Channel and talk with us about your ideas

Fundamentals

Mathematical Notation

Introduction

Throughout CryptoBook, discussions are made more concise by using various mathematical symbols. For some of you, all of these will feel familiar, while for others, it will feel new and confusing. This chapter is devoted to helping new readers gain insight into the notation used.

If you're reading a page and something is new to you, come here and add the symbol, someone else who understands it can explain its meaning

Mathematical Objects

Special Sets

: denotes the set of complex numbers
: denotes the set of real numbers
: denotes the set of integers
: denotes the set of rational numbers
: denotes the set of natural numbers (non-negative integers)
: denotes the set of integers mod

We refer to unit groups by or . Example:
We refer to finite fields with elements by
We refer to a general field by
We refer to the algebraic closure of this field by

Relation operators

means is an element of (belongs to)

Logical Notation

means for all
means there exists. means uniquely exists

Operators

means the probability of an event to happen. Sometimes denoted as or as

Division and Greatest common divisor

Author: Zademn

Introduction

Two of the skills a cryptographer must master are:

Knowing his way and being comfortable to work with numbers.
Understanding and manipulating abstract objects.

This chapter of fundamentals proposes to prepare you for understanding the basics of number theory and abstract algebra .We will start with the most basic concepts such as division and build up knowledge until you, future cryptographer, are able to follow and understand the proofs and intricacies of the cryptosystems that make our everyday life secure.

We will provide examples and snippets of code and be sure to play with them. If math is not your strongest suit, we highly suggest to pause and ponder for each concept and take it slow.

For the math-savy people we cover advanced topics in specific chapters on the subjects of number theory and group theory.

So what are we waiting for? Let's jump right in!

Division

Let $\mathbb{Z} = \{\dots , -1, 0, 1, 2, 3 \dots \}$ be the set denoting the integers.

Definition - Divisibility

For $a, b, \in \mathbb{Z}$ we say that $a$ divides $b$ if there is some $k \in \mathbb{Z}$ such that $a \cdot k = b$
Notation: $a | b$

Example

For $a = 2, b = 6$ we have $2 | 6$ because we can find $k = 3$ such that $6 = 2 \cdot 3$ .

Properties

$a | a, \ 1 | a \text{ and } a | 0$
$a | b$ and $a | c$ implies $a | (bu + cv) \ \forall u, v, \in \mathbb{Z}$
- Example: Let $b = 6, u = 5$ and $c = 9, v = 2$
- $3 | 6$ and $3 | 9 \Rightarrow 3 | (6 \cdot 5 + 9 \cdot 2) \iff 3 | 48$ . We can find $k = 16$ such that $48 = 3 \cdot 16$
$a | b$ and $b | c$ implies $a | c$
if $a|b$ and $b|a$ then $a = \pm b$

Definition - Division with remainder

Let $a, b \in \mathbb{Z}$ with $b≥1$ ,
There exists unique $q, r \in \mathbb{Z}$ such that $\boxed{a = bq + r}$ and $0 \leq r < b$
$q$ is called the quotient and $r$ the remainder

Examples:

To find $q, r$ python offers us the divmod() function that takes $a, b$ as arguments

q, r = divmod(6, 2)
print(q, r)
# 3 0 

q, r = divmod(13, 5)
print(q, r)
# 2 3 
# Note that 13 = 2 * 5 + 3

If we want to find only the quotient $q$ we can use the // operator
If we want to find the remainder $r$ we can use the modulo % operator

q = 13 // 5
print(q)
# 2

r = 13 % 5
print(r)
# 3

Exercises:

Now it's your turn! Play with the proprieties of the division in Python and see if they hold.

Greatest common divisor

Definition

Let $a, b \in \mathbb{Z}$ be 2 integers. The greatest common divisor is the largest integer $d \in \mathbb{Z}$ such that $d | a$ and $d | b$
Notation: $\gcd(a, b) = d$

Examples:

# In python we can import math to get the GCD algo
import math
print(math.gcd(18, 12)) # -> 6
# Sage has it already!
print(gcd(18, 12)) # -> 6

Remark:

for all other common divisors $c$ of $a, b$ we have $c | d$

Things to think about

What can we say about numbers $a, b$ with $\gcd(a, b) = 1$ ? How are their divisors?

Euclidean Algorithm

Introduction

Although we have functions that can compute our $\gcd$ easily it's important enough that we need to give and study an algorithm for it: the euclidean algorithm.

It's extended version will help us calculate modular inverses which we will define a bit later.

Euclidean Algorithm

Important Remark

If $a = b \cdot q + r$ and $d = \gcd(a, b)$ then $d | r$ . Therefore $\gcd(a, b) = \gcd(b, r)$

Algorithm

We write the following:

$a = q_0 \cdot b + r_0 \\ b = q_1 \cdot r_0 + r_1 \\ r_0 = q_2 \cdot r_1 + r_2 \\ \vdots \\ r_{n-2} = r_ {n-1} \cdot q_{n - 1} + r_n \\ r_n = 0$

Or iteratively $r_{k-2} = q_k \cdot r_{k-1} + r_k$ until we find a $0$ . Then we stop

Now here's the trick:

\gcd(a, b) = gcd(b, r_0) = gcd(r_0, r_1) = \dots = \gcd(r_{n-2}, r_{n-1}) = r_{n-1} = d

If $d = \gcd(a, b)$ then $d$ divides $r_0, r_1, ... r_{n-1}$

Pause and ponder. Make you you understand why that works.

Example:

Calculate $\gcd(24, 15)$

$24 = 1 \cdot 15 + 9 \\ 15 = 1 \cdot 9 + 6 \\ 9 = 1 \cdot 6 + 3 \\ 6 = 2 \cdot 3 + 0 \Rightarrow 3 = \gcd(24, 15)$

Code

def my_gcd(a, b):
    # If a < b swap them
    if a < b: 
        a, b = b, a
    # If we encounter 0 return a
    if b == 0: 
        return a
    else:
        r = a % b
        return my_gcd(b, r)

print(my_gcd(24, 15))
# 3

Exercises:

Pick 2 numbers and calculate their $\gcd$ by hand.
Implement the algorithm in Python / Sage and play with it. Do not copy paste the code

Extended Euclidean Algorithm

This section needs to be expanded a bit.

Bezout's identity

Let $d = \gcd(a, b)$ . Then there exists $u, v$ such that $au + bv = d$

The extended euclidean algorithm aims to find $d = \gcd(a, b), \text{ and }u, v$ given $a, b$

# In sage we have the `xgcd` function
a = 24
b = 15
g, u, v = xgcd(a, b)
print(g, u, v)
# 3 2 -3 

print(u * a + v * b)
# 3 -> because 24 * 2 - 15 * 3 = 48 - 45 = 3

Modular Arithmetic

Authors: A~Z, perhaps someone else but not yet (or they've decided to remain hidden like a ninja)

Introduction

Thinking not over the integers as a whole but modulo some integer $n$ instead can prove quite useful in a number of situation. This chapter attempts to introduce to you the basic concepts of working in such a context.

Congruences

For the following chapter, we will assume $n$ is a natural integer, and $a$ and $b$ are two integers. We say that $a$ and $b$ are congruent modulo $n$ when $n\mid (b-a)$ , or equivalently when there is an integer $k$ such that $a=b+kn$ . We denote this by $a\equiv b~ [n]$ or $a \equiv b\mod n$ . I will use the first notation throughout this chapter.

Remark: When $b\neq0$ , we have $a\equiv r~[b]$ , where $r$ is the remainder in the euclidean division of $a$ by

This relation has a number of useful properties:

$\forall c\in \mathbb Z, a\equiv b~[n] \implies ac \equiv bc ~ [n]$
$\forall c \in \mathbb Z, a\equiv b~[n] \implies a+c\equiv b+c ~[n]$
$\forall c \in \mathbb Z, a \equiv b ~[n] \text{ and } b\equiv c~[n]\implies a\equiv c ~[n]$
$\forall m \in \mathbb N, a\equiv b~[n] \implies a^m\equiv b^m ~[n]$
The proofs are left as an exercise to the reader :p (Hint: go back to the definition)

Seeing as addition and multiplication are well defined, the integers modulo $n$ form a ring, which we note $\mathbb Z/n\mathbb Z$ . In sage, you can construct such ring with either of the following

Zn = Zmod(5)
Zn = Integers(5)
Zn = IntegerModRing(5)
# Ring of integers modulo 5
Zn(7)
# 2
Zn(8) == Zn(13)
# True

Powering modulo $n$ is relatively fast, thanks to the double-and-square algorithm, so we needn't worry about it taking too much time when working with high powers

pow(2, 564654533, 7) # Output result as member of Z/7Z
# 4
power_mod(987654321, 987654321, 7) # Output result as simple integer
# 6
Zmod(7)(84564685)^(2^100) # ^ stands for powering in sage. To get XOR, use ^^.
# 5

As a side note, remember that if an equality holds over the integers, then it holds modulo any natural integer $n$ . This can be used to prove that a relation is never true by finding a suitable modulus, or to derive conditions on the potential solutions of the equation.

Example: by choosing an appropriate modulus, show that not even god is able to find integers $a$ and $b$ such that $a^2 = 2 + 4b$

Modular Inverse

Since we can multiply, a question arises: can we divide? The answer is yes, under certain conditions. Dividing by an integer $c$ is the same as multiplying by its inverse; that is we want to find another integer $d$ such that $cd\equiv 1~[n]$ . Since $cd\equiv 1~[n]\iff\exists k\in\mathbb Z, cd = 1 + kn$ , it is clear from Bézout's Identity that such an inverse exists if and only if $\gcd(c, n) = 1$ . Therefore, the units modulo $n$ are the integers coprime to $n$ , lying in a set we call the unit group modulo $n$ : $\left(\mathbb Z/n\mathbb Z\right)^\times$

Zn = Zmod(10)
Zn(7).is_unit()
# True
Zn(8).is_unit()
# False
3 == 1/Zn(7) == Zn(7)^(-1) == pow(7,-1,10) # member of Z/10Z
# True
inverse_mod(7, 10) # simple integer
# 3
Zn(3)/7
# 9
Zn(3)/8
# ZeroDivisionError: inverse of Mod(8, 10) does not exist
Zn.unit_group()
# Multiplicative Abelian group isomorphic to C4 (C4 being the cyclic group of order 4)

Finding the modular inverse of a number is an easy task, thanks to the extended euclidean algorithm (that outputs solutions in $d$ and $k$ to the equation $cd-kn=1$ from above).

xgcd(7, 10) # find (gcd(a, b), u, v) in au + bv = gcd(a, b)
# (1, 3, -2) <-- (gcd(7, 10), d, -k)

Theorems of Wilson, Euler, and Fermat

Wilson's Theorem

A positive integer is a prime if and only if:

Euler's Theorem

Let and s.t. , then:

Fermat's Little Theorem

Let be a prime and , then:

or equivalently:

Reference

Fermat's Little Theorem in Detail

Would you like to be an author?

Introduction

Since we can add, subtract, multiply, divide even... what would be missing? Powering! I'm not talking about some power fantasy here, but rather introduce some really really important theorems. Fermat little's theorem proves useful in a great deal of situation, and is along with Euler's theorem a piece of arithmetic you need to know. Arguably the most canonical example of using these is the RSA cryptosystem, whose decryption step is built around Euler's theorem.

Fermat's Little Theorem

Since we want to talk about powers, let's look at powers. And because I like 7, I made a table of all the powers of all the integers modulo 7.

On the last row, there is a clear pattern emerging, what's going on??? Hm, let's try again modulo 5 this time.

Huh, again?! Clearly, there is something going on... Sage confirms this!

Claim (Fermat's Little Theorem): Leta prime.

When, this is equivalent to what we observed:. There are several proofs of Fermat's Little Theorem, but perhaps the fastest is to see it as a consequence of the Euler's Theorem which generalizes it. Still, let's look a bit at some applications of this before moving on.

A first funny thing is the following:. When, this means we have found a non-trivial integer that when multiplied toyields 1. That is, we have found the inverse of, wow. Since the inverse is unique modulo, we can always invert non-zero integers by doing this. From a human point of view, this is really easier than using the extended euclidean algorithm.

Euler's Theorem in Detail

Todo

Quadratic Residues

Continued Fractions

Continued fractions are a way of representing a number as a sum of an integer and a fraction.

Mathematically, a continued fraction is a representation

a_{0} + \frac{b_{0}}{ a_{1} + \frac{b_{1}}{ a_{2} + \frac{b_{2}}{ \ddots }}}

$a_{i}, b_{i}$ are complex numbers. The continued fraction with $b_{i} = 1\ \forall i$ is called a simple continued fraction and continued fractions with finite number of $a_{i}$ are called finite continued fractions.

Consider example rational numbers,

\frac{17}{11} = 1 + \frac{6}{11} \\[10pt] \frac{11}{6} = 1 + \frac{5}{6} \\[10pt] \frac{6}{5} = 1 + \frac{1}{5} \\[10pt] \frac{5}{1} = 5 + 0

the continued fractions could be written as

\frac{5}{1} =5 \\[10pt] \frac{6}{5} = 1 + \frac{1}{5} \\[10pt] \frac{11}{6} = 1 + \frac{5}{6} = 1 + \frac{1}{\frac{6}{5}} = 1 + \frac{1}{1 + \frac{1}{5}} \\[10pt] \frac{17}{11} = 1 + \frac{6}{11} = 1 + \frac{1}{\frac{11}{6}} = 1 + \frac{1}{1 + \frac{1}{1 + \frac{1}{5}}}

Notation

a_{0} + \frac{1}{ a_{1} + \frac{1}{ a_{2} + \frac{1}{ \ddots }}}

A simple continued fraction is represented as a list of coefficients( $a_{i}$ ) i.e

x = [a_{0};\ a_{1},\ a_{2},\ a_{3},\ a_{4},\ a_{5},\ a_{6},\ \ldots]

for the above example

\frac{17}{11} = [1;\ 1,\ 1,\ 5]\ \ ,\frac{11}{6} = [1;\ 1,\ 5]\ \ ,\frac{6}{5} = [1; 5]\ \ ,\frac{5}{1} = [5;]

Computation of simple continued fractions

Given a number $x$ , the coefficients( $a_{i}$ ) in its continued fraction representation can be calculated recursively using

x_{0} = x \\[4pt] a_{i} = \lfloor x_{i} \rfloor \\[4pt] x_{i+1} = \frac{1}{x_{i} - a_{i}}

The above notation might not be obvious. Observing the structure of continued fraction with few coefficients will make them more evident:

x_{0} = a_{0} + \frac{1}{a_{1} + \frac{1}{a_{2}}},\ \ \ x_{1} = a_{1} + \frac{1}{a_{2}}, \ \ \ x_{2} = a_{2} \\[10pt] x_{i} = a_{i} + \frac{1}{x_{i+1}} \\[10pt] x_{i+1} = \frac{1}{x_{i} - a_{i}}

SageMath provides functions continued_fraction and continued_fraction_list to work with continued fractions. Below is presented a simple implementation of continued_fractions.

def continued_fraction_list(xi):
    ai = floor(xi)
    if xi == ai: # last coefficient
        return [ai]
    return [ai] + continued_fraction_list(1/(x - ai))

Convergents of continued fraction

The $k^{th}$ convergent of a continued fraction $x = [a_{0}; a_{1},\ a_{2},\ a_{3},\ a_{4},\ldots]$ is the numerical value or approximation calculated using the first $k - 1$ coefficients of the continued fraction. The first $k$ convergents are

\frac{a_{0}}{1},\ \ \ a_{0} + \frac{1}{a_{1}}, \ \ \ a_{0} + \frac{1}{a_{1} + \frac{1}{a_{2}}}, \ \ldots,\ a_{0} + \frac{1}{a_{1} + \frac{\ddots} {a_{k-2} + \frac{1}{a_{k-1}}}}

One of the immediate applications of the convergents is that they give rational approximations given the continued fraction of a number. This allows finding rational approximations to irrational numbers.

Convergents of continued fractions can be calculated in sage

sage: cf = continued_fraction(17/11)
sage: convergents = cf.convergents()
sage: cf
[1; 1, 1, 5]
sage: convergents
[1, 2, 3/2, 17/11]

Continued fractions have many other applications. One such applicable in cryptology is based on Legendre's theorem in diophantine approximations.

Theorem: if $\mid x - \frac{a}{b} \mid < \frac{1}{b^{2}}$ , then $\frac{a}{b}$ is a convergent of $x$ .

Wiener's attack on the RSA cryptosystem works by proving that under certain conditions, an equation of the form $\mid x - \frac{a}{b} \mid$ could be derived where $x$ is entirely made up of public information and $\frac{a}{b}$ is made up of private information. Under assumed conditions, the inequality $\mid x - \frac{a}{b} \mid < \frac{1}{b^{2}}$ is statisfied, and the value $\frac{a}{b}$ (private information) is calculated from convergents of $x$ (public information), consequently breaking the RSA cryptosystem.

Number Theory

Ideals

Example: Ideals of the integers

Definition - Ideal of

is an ideal we have

Example: - multiples of

Remarks:

we have
is an ideal

Example: Consider . This ideal contains

Greatest common divisor

Let be 2 integers. If

Polynomials With Shared Roots

Algorithmic Number Theory

Polynomial GCD
- Euclidean GCD
- Half-GCD for speed when e=0x10001
- demo application for that one RSA related message attack?
Resultant
- eliminate multivariate polynomials at the expense of increasing polynomial degree
- demo application for that one RSA Coppersmith short padding related message attack?
Groebner Basis
- what if you did GCD and Resultants at the same time, like whoa
- and what if it took forever to run!

Integer Factorization

Overview

Given a composite integer $n$ , can it be decomposed as a product of smaller integers (hopefully as a unique product of prime factors)?

As easy as it may sound, integer factorization in polynomial time on a classical computer stands one of the unsolved problems in computation for centuries!

Lets start dumb, all we need to do is check all the numbers $1 < p < n$ such that $p|n$ or programmatically n%p==0

def factors(n):
    divisors = []
    for p in range(1,n):
        if n%p==0:
            divisors.append(p)
    return divisors

Seems like its an $O(n)$ algorithm! whats all the deal about? By polynomial time, we mean polynomial time in $b$ when $n$ is a b-bit number, so what we looking at is actually a $O(2^b)$ which is actually exponential (which everyone hates)

Now taking a better look at it, one would realize that a factor of $n$ can't be bigger than $\sqrt{n}$ Other observation would be, if we already checked a number (say 2) to not be a divisor, we dont need to check any multiple of that number since it would not be a factor.

Pollard rho

Sieves

Abstract algebra

Groups

Authors: Ariana, Zademn Reviewed by:

Introduction

Modern cryptography is based on the assumption that some problems are hard (unfeasable to solve). Since the we do not have infinite computational power and storage we usually work with finite messages, keys and ciphertexts and we say they lay in some finite sets $\mathcal{M}, \mathcal{K}$ and $\mathcal{C}$ .

Furthermore, to get a ciphertext we usually perform some operations with the message and the key.

For example in AES128 $\mathcal{K} = \mathcal{M} = \mathcal{C} = \{0, 1\}^{128}$ since the input, output and key spaces are 128 bits. We also have the encryption and decryption operations: $Enc: \mathcal{K} \times \mathcal{M} \to \mathcal{C} \\ Dec: \mathcal{K} \times \mathcal{C} \to \mathcal{M}$

The study of sets, and different types of operations on them is the target of abstract algebra. In this chapter we will learn the underlying building blocks of cryptosystems and some of the hard problems that the cryptosystems are based on.

Definition

A set $G$ paired with a binary operation $\cdot:G\times G\to G$ is a group if the following requirements hold:

Closure: For all $a, b \in G: \$ $a\cdot b \in G$ - Applying the operation keeps the element in the set
Associativity: For all $a, b, c \in G:$ $(a \cdot b) \cdot c=a\cdot (b\cdot c)$
Identity: There exists an element $e\in G$ such that $a\cdot e=e\cdot a=a$ for all $a\in G$
Inverse: For all elements $a\in G$ , there exists some $b\in G$ such that $b\cdot a=a\cdot b=e$ . We usually denote $b$ as $a^{-1}$

For $n\in\mathbb Z$ , $a^n$ means $\underbrace{a\cdot a\dots{}\cdot a}_{n\text{ times}}$ when $n>0$ and $\left(a^{-n}\right)^{-1}$ when $n<0$ . For $n=0$ , $a^n=e$ .

If $ab=ba$ , then $\cdot$ is commutative and the group is called abelian. We often denote the group operation by $+$ instead of $\cdot$ and we typically use $na$ instead of $a^n$ .

Remark

The identity element of a group $G$ is also denoted with $1_G$ or just $1$ if only one groups is present

Examples of groups

Integers modulo $n$ (remainders) under modular addition $= (\mathbb{Z} / n \mathbb{Z}, +)$ . $\mathbb{Z} / n \mathbb{Z} = \{0, 1, ..., n -1\}$ Let's look if the group axioms are satisfied

$\checkmark$ $\forall a, b \in \mathbb{Z}/ n\mathbb{Z} \text{ let } c \equiv a + b \bmod n$ . Because of the modulo reduction $c < n \Rightarrow c \in \mathbb{Z}/ n\mathbb{Z}$
$\checkmark$ Modular addition is associative
$\checkmark$ $0 + a \equiv a + 0 \equiv a \bmod n \Rightarrow 0$ is the identity element
$\checkmark$ $\forall a \in \mathbb{Z}/ n\mathbb{Z}$ we take $n - a \bmod n$ to be the inverse of $a$ . We check that
$a + n - a \equiv n \equiv 0 \bmod n$
$n - a + a \equiv n \equiv 0 \bmod n$

Therefore we can conclude that the integers mod $n$ with the modular addition form a group.

Z5 = Zmod(5) # Technically it's a ring but we'll use the addition here
print(Z5.list())
# [0, 1, 2, 3, 4]

print(Z5.addition_table(names = 'elements'))
# +  0 1 2 3 4
#  +----------
# 0| 0 1 2 3 4
# 1| 1 2 3 4 0
# 2| 2 3 4 0 1
# 3| 3 4 0 1 2
# 4| 4 0 1 2 3

a, b = Z5(14), Z5(3)
print(a, b)
# 4 3
print(a + b)
# 2
print(a + 0)
# 4
print(a + (5 - a))
# 0

Example of non-groups

$(\mathbb{Q}, \cdot)$ is not a group because we can find the element $0$ that doesn't have an inverse for the identity $1$ . $(\mathbb{Z}, \cdot)$ is not a group because we can find elements that don't have an inverse for the identity $1$

Exercise

Is $(\mathbb{Z} / n \mathbb{Z} \smallsetminus \{0\}, \cdot)$ a group? If yes why? If not, are there values for $n$ that make it a group?

sɹosᴉʌᴉp uoɯɯoɔ puɐ sǝɯᴉɹd ʇnoqɐ ʞuᴉɥ┴ :ʇuᴉH

Proprieties

The identity of a group is unique
The inverse of every element is unique
$\forall$ $a \in G \ : \left(a^{-1} \right) ^{-1} = g$ . The inverse of the inverse of the element is the element itself
$\forall a, b \in G:$ $(ab)^{-1} = b^{-1}a^{-1}$
Proof: $(ab)(b^{−1}a^{−1}) =a(bb^{−1})a^{−1}=aa^{−1}= e.$

n = 11
Zn = Zmod(n)
a, b = Zn(5), Zn(7)
print(n - (a + b))
# 10
print((n - a) + (n - b))
# 10

Orders

In abstract algebra we have two notions of order: Group order and element order

Group order

The order of a group $G$ is the number of the elements in that group. Notation: $|G|$

Element order

The order of an element $a \in G$ is the smallest integer $n$ such that $a^n = 1_G$ . If such a number $n$ doesn't exist we say the element has order $\infty$ . Notation: $|a|$

Z12 = Zmod(12) # Residues modulo 12
print(Z12.order()) # The additive order 
# 12
a, b= Z12(6), Z12(3)
print(a.order(), b.order())
# 2 4
print(a.order() * a)
# 0

print(ZZ.order()) # The integers under addition is a group of infinite order
# +Infinity

We said our messages lay in some group $\mathcal{M}$ . The order of this group $|\mathcal{M}|$ is the number of possible messages that we can have. For $\mathcal{M} = \{0,1\}^{128}$ we have $|\mathcal{M}| = 2^{128}$ possible messages.

Let $m \in \mathcal{M}$ be some message. The order of $m$ means how many different messages we can generate by applying the group operation on $m$

Subgroups

Definition

Let $(G, \cdot)$ be a group. We say $H$ is a subgroup of $G$ if $H$ is a subset of $G$ and $(H, \cdot)$ forms a group. Notation: $H \leq G$

Proprieties

The identity of $G$ is also in $H:$ $1_H = 1_G$
The inverses of the elements in $H$ are found in $H$

How to check $H \leq G$ ? Let's look at a 2 step test

Closed under operation: $\forall a, b \in H \to ab \in H$
Closed under inverses: $\forall a \in H \to a^{-1} \in H$

Generators

Let $G$ be a group, $g \in G$ an element and $|g| = n$ . Consider the following set:

\{1, g, g^2, ..., g^{n-1}\} \overset{\text{denoted}}{=} \langle g\rangle.

This set paired the group operation form a subgroup of $G$ generated by an element $g$ .

Why do we care about subgroups? We praise the fact that some problems are hard because the numbers we use are huge and exhaustive space searches are too hard in practice.

Suppose we have a big secret values space $G$ and we use an element $g$ to generate them.

If an element $g \in G$ with a small order $n$ is used then it can generate only $n$ possible values and if $n$ is small enough an attacker can do a brute force attack.

Example

For now, trust us that if given a prime $p$ , a value $g \in \mathbb{Z} / p \mathbb{Z}$ and we compute $y = g^x \bmod p$ for a secret $x$ , finding $x$ is a hard problem. We will tell you why a bit later.

p = 101 # prime
Zp = Zmod(p) 
H_list = Zp.multiplicative_subgroups() # Sage can get the subgroup generators for us
print(H_list)
# ((2,), (4,), (16,), (32,), (14,), (95,), (10,), (100,), ())

g1 = H_list[3][0] # Weak generator
print(g1, g1.multiplicative_order())
# 32 20

g2 = Zp(3) # Strong generator
print(g2, g2.multiplicative_order())
# 3 100


## Consider the following functions
def brute_force(g, p, secret_value):
    """
    Brute forces a secret value, returns number of attempts
    """
    for i in range(p-1):
        t = pow(g, i, p)
        if t == secret_value:
            break
    return i
    
def mean_attempts(g, p, num_keys):
    """
    Tries `num_keys` times to brute force and 
    returns the mean of the number of attempts
    """
    total_attempts = 0
    for _ in range(num_keys):
        k = random.randint(1, p-1)
        sv = pow(g, k, p) # sv = secret value
        total_attempts += brute_force(g, p, sv)
    return 1. * total_attempts / num_keys
    
## Let's try with our generators
print(mean_attempts(g1, p, 100)) # Weak generator
# 9.850
print(mean_attempts(g2, p, 100)) # Strong generator
# 49.200

Examples

// subgroups, quotient groups

// cyclic groups

Another take on groups

// Visual

// Symmetries

// Permutations

Discrete Log Problem

Discrete log problem

Given any group $G$ and elements $a,b$ such that $a^n=b$ , the problem of solving for $n$ is known as the disctete log problem (DLP). In sage, this can be done for general groups by calling discrete_log

sage: G = DihedralGroup(99)
sage: g = G.random_element()
sage: discrete_log(g^9,g) # note that if the order of g is less than 9 we would get 9 mod g.order()
9

Discrete log over $\left(\mathbb Z/n\mathbb Z\right)^*$

Typically, one considers the discrete log problem in $\left(\mathbb Z/n\mathbb Z\right)^*$ , i.e. the multiplicative group of integers $\text{mod }n$ . Explicitly, the problem asks for $x$ given $a^x=b\pmod n$ . This can be done by calling b.log(a) in sage:

sage: R = Integers(99)
sage: a = R(4)
sage: b = a^9
sage: b.log(a)
9

This section is devoted to helping the reader understand which functions are called when for this specific instance of DLP.

When $n$ is composite and not a prime power, discrete_log() will be used, which uses generic algorithms to solve DLP (e.g. Pohlig-Hellman and baby-step giant-step).

When $n=p$ is a prime, Pari znlog will be used, which uses a linear sieve index calculus method, suitable for $p < 10^{50} \sim 2 ^{166}$ .

When $n = p^k$ , SageMath will fall back on the generic implementation discrete_log()which can be slow. However, Pari znlog can handle this as well, again using the linear sieve index calculus method. To call this within SageMath we can use either of the following (the first option being a tiny bit faster than the second)

x = int(pari(f"znlog({int(b)},Mod({int(a)},{int(n)}))"))
x = gp.znlog(b, gp.Mod(a, n))

Example

Given a small prime, we can compare the Pari method with the Sage defaults

p = getPrime(36)
n = p^2
K = Zmod(n)
a = K.multiplicative_generator()
b = a^123456789

time int(pari(f"znlog({int(b)},Mod({int(a)},{int(n)}))")) 
# CPU times: user 879 µs, sys: 22 µs, total: 901 µs
# Wall time: 904 µs
# 123456789

time b.log(a)
# CPU times: user 458 ms, sys: 17 ms, total: 475 ms
# Wall time: 478 ms
# 123456789

time discrete_log(b,a)
# CPU times: user 512 ms, sys: 24.5 ms, total: 537 ms
# Wall time: 541 ms
# 123456789

We can also solve this problem with even larger primes in a very short time

p = getPrime(100)
n = p^2
K = Zmod(n)
a = K.multiplicative_generator()
b = a^123456789

time int(pari(f"znlog({int(b)},Mod({int(a)},{int(n)}))")) 
# CPU times: user 8.08 s, sys: 82.2 ms, total: 8.16 s
# Wall time: 8.22 s
# 123456789

Discrete log over $E(k)$

// elliptic curve discrete log functions

Rings

A setwith two binary operations is a ring if the following holds:

is a commutative group with identity
is a monoid (group without the inverse axiom) with identity.
Distributivity:

// ideals, diff types of domains

Fields

A setwith two binary operations is a field if the following holds:

is a commutative group with identity
is a commutative group with identity.
Distributivity:

// field extensions, algebraic elements

Polynomials

// symmetric polynomials

// discriminants

// resultants

Elliptic Curves

Untitled

Lattices

Introduction

Lattices, also known as Minkowski's theory after Hermann Minkowski, or the geometry of numbers (deprecated!) allows the usage of geometrical tools (i.e. volumes) in number theory.

The intuitive notion of a lattice (perhaps surprisingly) matches its mathematical definition. For example, lattices are formed by

points on an infinite checkerboard;
centers of a hexagonal tessellation;
integers on the real number line.

The last example should hint at how we generalize this concept to arbitrary dimensions. In general, lattices consist of discrete points which appear at "regular intervals."

Definitions

A lattice $L$ is a subgroup of $\mathbb{R}^n$ generated by $b_i$ , i.e.

L=\sum_{i=1}^d\mathbb{Z} b_i = \left\{\left. \sum_{i=1}^d a_i b_i \right | a_i \in \mathbb{Z} \right\}

where $b_i$ are linearly independent vectors. Collectively, $\left\{b_i\right\}_{i=1}^d$ form a basis of $L$ .

We say a set of vectors $v_i$ are linearly independent if the only solution to the equation $\sum_{i} a_i b_i = 0$ is when all $a_i$ are zero.

Taking a step back, this definition should resemble that of a vector space, with one exception: scalars are integers! The discrete nature of lattices comes from this restriction.

Some more terminology from linear algebra will be useful. The dimension of a lattice, denoted $\dim L$ , is $d$ . A lattice is complete if $d=n$ . Note that we can always choose a subspace of $\mathbb R^n$ such that the lattice is complete, namely the subspace generated by $b_i$ .

The region

\Phi=\left\{\left.\sum_{i=1}^dx_ib_i\right|0\leq x_i<1\right\}

is known as the fundamental mesh.

In the image above, we see the points of a lattice in $\mathbb R^2$ . The red vectors are one set of basis vectors and the shaded region is the corresponding fundamental mesh. The green vectors also form another set of basis vectors with its corresponding fundamental mesh. We see here that the basis vectors and fundamental mesh is not unique to a lattice.

Although the fundamental mesh is not unique, it turns out that the ( $m$ dimensional) volume of the fundamental mesh is constant for any given lattice. Hence we can define the volume of a lattice as the volume of a fundamental mesh. However this definition can be hard to handle hence we provide an equivalent definition via determinants:

Let $\mathcal B$ be a $d\times n$ matrix whose rows are given by the basis vectors. Then the volume of a fundamental mesh is given by

\text{vol}(L)=\sqrt{\left|\det\left(\mathcal B\mathcal B^T\right)\right|}

A subset $X$ of $\mathbb R^n$ is known as centrally symmetric if $x\in X$ implies $-x\in X$ . It is convex if for any $x,y\in X$ , the line joining $x,y$ is contained in $X$ , i.e. $\left\{tx+(1-t)y|0\leq t\leq1\right\}\subset X$ . Finally we can introduce the most important theorem about lattices, the Minkowski's Lattice Point Theorem:

Let $L$ be a complete lattice of dimension $n$ and $X$ be a centrally symmetric convex set. Suppose

\text{vol}(X)>2^n\text{vol}(L)

Then $X$ contains at least one nonzero point of $L$ . This result is primarily used to prove the existence of lattice vectors.

Throughout this section, $\left\lVert v\right\rVert=\sqrt{\sum_iv_i^2}$ denotes the $\ell_2$ norm and $\langle a,b\rangle=\sum_ia_ib_i$ denotes the inner product.

Proof sketch of Minkowski's theorem

This proof is by some sort of a pigeonhole argument on volumes. Consider the set

\frac12X=\left\{\frac12x|x\in X\right\}

We have $\text{vol}\left(\frac12 X\right)>\text{vol}(L)$ , hence the inclusion $\frac12X\to\mathbb R^n/L$ cannot be injective, thus we can find some $x_1=x_2+\ell$ , $x_1,x_2\in\frac12 X,\ell\in L,x_1\neq x_2$ . Hence $x_1-x_2\in L$ is a nontrivial lattice point.

Exercises

1) Let $L$ be the lattice generated by $\mathcal B=\begin{pmatrix}-1&9&8\\1&-8&-7\end{pmatrix}$ (take the rows as basis vectors).

Compute the volume of this lattice
Show that $\mathcal B'=\begin{pmatrix}1&0&1\\0&1&1\end{pmatrix}$ generates the same lattice
Show that each row in $\mathcal C=\begin{pmatrix}1&0&1\\0&2&2\end{pmatrix}$ is in the lattice but $\mathcal C$ does not generate the lattice. This is one key difference from the case of linear algebra (over fields).

2) Let $\mathcal B,\mathcal B'$ be $d\times n$ matrices whose row vectors are basis for lattices $L,L'$ . Both lattices are the same iff there exists some $U\in\text{GL}_d(\mathbb Z)$ such that $\mathcal B'=U\mathcal B$ . Find $U$ for problem 1. Note that $\text{GL}_d(\mathbb Z)$ is the group of invertible matrices with integer coefficients, meaning $U$ and $U^{-1}$ have integer coefficients.

3) Show that the condition in Minkowski's lattice point theorem is strict, i.e. for any complete lattice $L$ of dimension $n$ , we can find some centrally symmetric convex set $X$ with $\text{vol}(X)=2^n\text{vol}(L)$ but the only lattice point in $X$ is the origin.

4*) Let $v$ be the shortest nonzero vector for some lattice $L$ with dimension $n$ . Show that

\left\lVert v\right\rVert\leq\frac2{\sqrt\pi}\Gamma\left(\frac n2+1\right)^{\frac1n}\text{vol}(L)^\frac1n

LLL reduction

Introduction

In this section, we hope to bring some intuitive understanding to the LLL algorithm and how it works. The LLL algorithm is a lattice reduction algorithm, meaning it takes in a basis for some lattice and hopefully returns another basis for the same lattice with shorter basis vectors. Before introducing LLL reduction, we'll introduce 2 key algorithms that LLL is built from, Gram-Schmidt orthogonalization and Gaussian Reduction. We give a brief overview on why these are used to build LLL.

As the volume of a lattice is fixed, and is given by the determinant of the basis vectors, whenever our basis vectors gets shorter, they must, in some intuitive sense, become more orthogonal to each other in order for the determinant to remain the same. Hence, Gram-Schmidt orthogonalization is used as an approximation to the shortest basis vector. However, the vectors that we get are in general not in the lattice, hence we only use this as a rough idea of what the shortest vectors would be like.

Lagrange's algorithm can be thought as the GCD algorithm for 2 numbers generalized to lattices. This iteratively reduces the length of each vector by subtracting some amount of one from another until we can't do it anymore. Such an algorithm actually gives the shortest possible vectors in 2 dimensions! Unfortunately, this algorithm may not terminate for higher dimensions, even in 3 dimensions. Hence, it needs to be modified a bit to allow the algorithm to halt.

Gram-Schmidt Orthogonalization

Overview

Gram-Schmidt orthogonalization is an algorithm that takes in a basis as an input and returns a basis where all vectors are orthogonal, i.e. at right angles. This new basis is defined as

where is the Gram-Schmidt coefficients.

One can immediately check that this new basis is orthogonal, meaning

Let be the matrix where the th row is given by andbe the matrix where the th row is given by , then the Gram-Schmidt orthogonalization gives us where and is the Gram-Schmidt coefficient. As an example, consider the basis of a subspace of :

Instead of doing the Gram-Schmidt orthogonalization by hand, we can get sage to do it for us:

This outputs two matrices, and :

One can quickly verify that and that the rows of are orthogonal to each other.

A useful result is that

Intuitively, this tells us that the more orthogonal a set of basis for a lattice is, the shorter it is as the volume must be constant.

Exercises

1) Show that the basis is orthogonal.

2) Verify that the output of sage is indeed correct.

3) Show that and is a diagonal matrix whose entries are . Conclude that .

4*) Given the Iwasawa decomposition where is a lower diagonal matrix with on its diagonal, is a diagonal matrix and an orthogonal matrix, meaning , show that and . Furthermore, prove that such a decomposition is unique.

LLL reduction

Overview

There are a few issues that one may encounter when attempting to generalize Lagrange's algorithm to higher dimensions. Most importantly, one needs to figure what is the proper way to swap the vectors around and when to terminate, ideally in in polynomial time. A rough sketch of how the algorithm should look like is

There are two things we need to figure out, in what order should we reduce the basis elements by and how should we know when to swap. Ideally, we also want the basis to be ordered in a way such that the smallest basis vectors comes first. Intuitively, it would also be better to reduce a vector by the larger vectors first before reducing by the smaller vectors, a very vague analogy to filling up a jar with big stones first before putting in the sand. This leads us to the following size reduction algorithm:

We can further improve this by optimizing the Gram Schmidt computation as this algorithm does not modify at all. Furthermorechanges in a very predictable fasion and when vectors are swapped, one can write explicit formulas for howchanges as well.

Next, we need to figure a swapping condition. Naively, we want

for all . However, such a condition does not guarantee termination in polynomial time. As short basis vectors should be almost orthogonal, we may also want to incorperate this notion. Concretely, we want to be somewhat small for all pairs of , i.e. we may want something like

However, since , this condition is easily satisfied for a sufficiently long , which is not what we want. The key idea is to merge these two in some way and was first noticed by Lovász - named the Lovász condition:

It turns out that using this condition, the algorithm above terminates in polynomial time! More specifically, it has a time complexity of where we havebasis vectors as a subset of and is a bound for the largest norm of . ensures that the lattice vectors are ordered roughly by size and ensures the algorithm terminates.

Polynomial time proof

This follows the proof provided by the authors of the LLL paper. We first prove that the algorithm terminates by showing it swaps the vectors finitely many times. Letbe the number of basis vectors as a subset of . Let be the volume of the lattice generated by at each step of the algorithm. We have . Now consider the quantity

This quantity only changes whenever some changes, i.e when swaps happen. Let's consider what happens when we swap and . Recall the Gram-Schmidt algorithm:

From this, see that when we swap and , is replaced by . Now using the Lovász condition, we see that we have, hence the value of must decrease by at least , i.e. the new is less than . All other must remain the same as the volume remains fixed when we swap basis vectors around. Hence at each swap, decreases by . This is why we need .Now we are left with showing is bounded from below then we are done.

Let be the length of the shortest (nonzero) vector in the lattice. We can treat as the volume of the lattice generated by. Let be the shortest vector in the lattice in . By using Minkowski's lattice point theorem, we have

(Note that the value of isn't particularly important, one can use a easier value like )

Hence we see that , and hence has a (loose) lower bound , meaning that there are at most swaps. Since at each iteration,either increases bywhen there is no swaps or decreases by at mostwhen there is swaps and ranges fromto, the number of time the loop runs must be at most , hence the algorithm terminates.

This proof also gives us a handle on the time complexity of the operation. Letis the length of the longest input basis vector. Since we have , and the algorithm loops times. The Gram-Schmidt orthogonalization is the most expensive part in the entire process, taking up arithmetic operations. By using classical algorithm for arithmetic operations, each takes time. From this, we deduce that the time complexity of the LLL algorithm is , a somewhat reasonable polynomial time algorithm.

Let be the output of the LLL algorithm, it turns out that we have the bound

which requires . Such bounds for the shortest vector will be elaborated in more detail in the section on reduced basis.

Exercises

1) Implement the LLL in sage and experimentally verify that does indeed decrease byeach time.

2) Show that the time complexity analysis is correct, and indeed each loop takes at most operations.

Asymmetric Cryptography

Symmetric Cryptography

Hashes

Isogeny Based Cryptography

Appendices

The Birthday paradox / attack

Authors: Zademn, ireland Reviewed by:

Prerequisites

Probability theory (for the main idea)
Hashes (an application)

Motivation

Breaking a hash function (insert story)

The birthday paradox

*insert story / introduction about why it's called a paradox + use*

Birthday version

Question 1

What is the probability that 1 person has the same birthday as you?

Solution

Let $A$ be the event that someone has the same birthday as you and $\bar{A}$ be the complementary event
- The events are mutually exclusive => $Pr(A) = 1 - Pr(\bar{A})$
Let $E_i$ be the events that person $i$ does not have your birthday

Then

$Pr(A) = 1 - Pr(\bar{A}) = 1 - \prod_{i=1}^n Pr(E_i) = 1 - \left( \dfrac {364} {365}\right)^n$

Reminder: $Pr(A, B) = Pr(A) \cdot Pr(B)$ if $A, B$ are independent events

Question 2

What is the probability that 2 out of $n$ people in a room share the same birthday?

Suppose the birthdays are distributed independently and uniformly

Solution

Let $A$ be the event that 2 people have the same birthday, let $\bar{A}$ be the complementary event (no 2 people have the same birthday)
Event 1 = Person 1 is born => $Pr(E_1) = \dfrac {365} {365}$
Event 2 = Person 2 is born on a different day than Person 1 => $Pr(E_2) = \dfrac {364} {365}$
$\vdots$
Event n = Person n is born on a different day than Person $1,...,n-1 \Rightarrow$ $\Rightarrow Pr(E_n) = \dfrac {365-(n-1)} {365}$

$Pr(\bar{A}) = Pr(E1) \cdot Pr(E_2) \cdot \dots \cdot Pr(E_n) = \dfrac {365} {365} \cdot \dfrac {364} {365} \cdot \dots \cdot \dfrac {365-(n-1)} {365} = \left( \dfrac {1} {365} \right) ^{n} \cdot \dfrac {365!} {(365-n)!} = \prod_{i=1}^{n-1} \left(1 - \dfrac i {365}\right)$

General case

Question 1

Instead of $365$ days we have $d \Rightarrow \boxed{1 - \left( \dfrac {d-1} {d}\right)^n}$

Question 2

Instead of $365$ days we have $d \Rightarrow \boxed{1 - \prod_{i=1}^{n-1} \left(1 - \dfrac i {d}\right)}$

Code examples

def my_birthday(n, d):
    return 1 - pow((d-1)/d , n)

def same_birthday(n, d):
    p = 1
    for i in range(1, n): #1 -> n-1
        p*=(1-i/d)
    return 1 - p

print(same_birthday(23, 365), same_birthday(32, 365), same_birthday(100, 365))
# (0.5072972343239854, 0.7533475278503207, 0.9999996927510721)

An useful approximation

From the Taylor approximation we know $e^x = 1 + x + \dfrac {x^2} {2!} + \dots => e_x\approx 1 + x$ for $x \ll 1$ Apply for each event: $\Rightarrow x = -\dfrac a d \Rightarrow e^{ -a /d} \approx 1- \dfrac a d \Rightarrow Pr(A) = 1 - \prod_{i=1}^{n-1}e^{-i/d} = 1-e^{-n(n-1) /{2d}} \approx 1-\boxed{e^{-{n^2} / {2d}}}$

If we want to solve for $n$ knowing $Pr(A)$ we take the $\ln$ => $\boxed{n \approx \sqrt{2d \ln \left(\dfrac 1 {1-Pr(A)}\right)}}$

def approx_same_birthday(n, d):
    return 1 - pow(e, -pow(n, 2) / (2*d)).n()
    
print(approx_same_birthday(23, 365)) 
print(approx_same_birthday(32, 365))
print(approx_same_birthday(100, 365))

# 0.515509538061517
# 0.754077719532824
# 0.999998876014983

Finding a collision

Let $H:\mathcal{M} \longrightarrow \mathcal{T}$ be a hash function with $|\mathcal{M}| >> |T|$
Let's denote $N = |\mathcal{T}|$

Algorithm

1. Choose $s \approx \sqrt{N}$ random distinct messages in $\mathcal{M}$

2. Compute $t_i = H(m_i)$ for $1\leq i \leq \sqrt{N}$

3. Look for $(t_i = t_j) \to$ If not found go to step 1

Example:

Consider the following hash function:

import hashlib
import random
from Crypto.Util.number import long_to_bytes, bytes_to_long

def small_hash(m, hash_bits):
    '''
    Arguments
        m: bytes -- input
        hash_bits: int -- number of bits of the hash
    Returns:
        {bytes} - hash of the message of dimension `hash_bits`
        '''
    assert hash_bits > 0, "no negative number of bits"
    
    mask = (1 << hash_bits) - 1 # Mask of bits
    t = hashlib.sha256(m).digest() # the hash in bytes
    t = bytes_to_long(t)
    t = t & mask # get the last 12 bits
    return long_to_bytes(t)

We make the following function to find the hashes:


def small_hash_colision(M_bits, T_bits):
    '''
    Arguments
        M_bits: int -- dimension of the message space
        T_bits: int -- dimension of the hash space
    Returns:
        {(bytes, bytes, bytes)} -- message1, message2, hash
        or
        {(b'', b'', b'')} -- if no collision found
    '''
    N = 1<<T_bits 
    print('Hash size: ', N)
    # This is `s`
    num_samples = 1 * isqrt(N)
    num_samples += num_samples//5 + 1 # num_samples = 1.2 * isqrt(N) + 1
    print(f'Making a list of {num_samples} hashes')
    print(f'Probability of finding a collision is {same_birthday(num_samples, N)}')
    
    m_list = []
    t_list = []
    
    # Make a list of hashes
    for i in range(num_samples):
        m = random.getrandbits(M_bits) # Get random message
        #m = random.randint(0, M_bits-1) 
        m = long_to_bytes(m)
        
        t = small_hash(m, T_bits) # Hash it
        if m not in m_list:
            m_list.append(m)
            t_list.append(t)
            
    # Check for collisionn
    for i in range(len(t_list)):
        for j in range(i+1, len(t_list)):
            if t_list[i] == t_list[j]:
                print('Collision found!')
                return m_list[i], m_list[j], t_list[i]
    else:
        print('Collision not found :(')
        return b"", b"", b""

We use it as follows:

M_bits = 30
T_bits = 20

m1, m2, t = small_hash_colision(M_bits, T_bits)
print(m1, m2, t)
print(small_hash(m1, T_bits) == small_hash(m2, T_bits))

# Hash size:  1048576
# Making a list of 1229 hashes
# Probability of finding a collision is 0.513213460854798
# Collision found!
# b'!\xafB\xc5' b'4F\xb6w' b'\x01y\xf7'
# True

Eliminating Storage Requirements with Pollard's Rho

While the above algorithm works to find a hash collision in time $O(\sqrt N )$ , it also requires storing $O(\sqrt N )$ hash values. As such, it represents a classic time-space tradeoff over the naive approach, which involves randomly selecting pairs of inputs until they hash to the same value. While the naive approach does not require any additional storage, it does have runtime $O(N )$ .

However, there is a better approach combining the best of both worlds: constant storage requirements and $O(\sqrt N)$ runtime. This approach is based on Pollard's Rho algorithm, which is better-known for its application to solving discrete logarithms. The core insight behind the algorithm is that by the Birthday Paradox, we expect to encounter a hash collision after trying $O(\sqrt N)$ random inputs. However, it is possible to detect whether a collision has occurred without needing to store all of the inputs and hashes if the inputs are chosen in a clever way.

This is done by choosing the next input based on the hash of the previous input, according to the following sequence:

x_0 = g(seed) \\ x_1 = g(H(x_0)) \\ x_2 = g(H(x_1)) \\ \dots \\ x_{n+1} = g(H(x_n)) \\

Where $H:\mathcal{M} \longrightarrow \mathcal{T}$ is our hash function and $g: \mathcal{T} \longrightarrow \mathcal{M}$ is a "sufficiently random" function which takes a hash value and produces a new. We define the composition of the functions to be $f = H \circ g : \mathcal{T} \longrightarrow \mathcal{T}$ .

# TODO:
# have the two hash functions used in this chapter be the same

from Crypto.Hash import SHA256
from Crypto.Util.number import bytes_to_long, long_to_bytes

from tqdm.autonotebook import tqdm

# bits in hash output
n = 30

# H
def my_hash(x):
    x = bytes(x, 'ascii')
    h = SHA256.new()
    h.update(x)
    y = h.digest()
    y = bytes_to_long(y)
    y = y % (1<<n)
    y = int(y)
    return y

# g
def get_message(r):
    x = "Crypto{" + str(r) + "}"
    return x

# f
def f(r):
    return my_hash(get_message(r))

By the Birthday Paradox, we expect that the sequence will have a collision (where $x_i = x_j$ for two distinct values $i,j$ ) after $O(\sqrt N)$ values. But once this occurs, then the sequence will begin to cycle, because $x_{i+1} = g(H(x_i)) = g(H(x_j)) = x_{j+1}$ .

Therefore, we can detect that a collision has occurred by using standard cycle-detection algorithms, such as Floyd's tortoise and hare!

And finally, we can locate the first place in the sequence where the collision occurred, which will let us determine what the colliding inputs to the hash function are. This is done by determining how many iterations apart the colliding inputs are, and then stepping together one iteration at a time until the collision occurs.

For Floyd's tortoise and hare, this is done by noting that when we found our collision after $n$ iterations, we were comparing $H(x_{n}) = H(x_{2 n})$ . And because the sequence is cyclic, if the first colliding input is $x_i$ , then it collides with $H(x_{i}) = H(x_{i+n})$ . So we define the new sequence $y_i = x_{n+i}$ , and step through the $x_i$ and $y_i$ sequences together until we find our collision!

This is implemented in the following code snippet.

"""
initialization

This routine will find a hash collision in sqrt time with constant space.
"""

seed = 0

x0 = get_message(seed)
x = x0
y = f(x)

"""
detect collision
using Floyd / tortoise and hare cycle finding algorithm

expected number of iterations is ~ sqrt(pi/2) * 2^(n/2),
we run for up to 4 * 2^(n/2) iterations
"""
for i in tqdm(range(4 << (n//2))):
        
    if f(x) == f(y):
        break
        
    x = f(x)
    
    y = f(y)
    y = f(y)
    

"""
locate collision
"""
x = x0
y = f(y)


for j in tqdm(range(i)):
    if f(x) == f(y):
        break
    
    x = f(x)
    
    y = f(y)
    

m1 = get_message(x)
m2 = get_message(y)

assert my_hash(m1) == f(x)
assert my_hash(m2) == f(y)

print("[+] seeds for messages: {}, {}".format(x, y))
print("[+] messages: {}, {}".format(m1, m2))
print("[+] collided hashes of messages: {}, {}".format(my_hash(m1), my_hash(m2)))


# 31%    40391/131072 [00:03<00:08, 10666.20it/s]
# 30%    12032/40391 [00:00<00:02, 13112.15it/s]
# 
# [+] seeds for messages: 404842900, 254017312
# [+] messages: Crypto{404842900}, Crypto{254017312}
# [+] collided hashes of messages: 1022927209, 1022927209

Finally, there is a third algorithm for finding hash collisions in $O(\sqrt N)$ time, namely the van Oorschot-Wiener algorithm based on Distinguished Points. While it does have additional storage requirements over Pollard's Rho, the main advantage of this algorithm is that it parallelizes extremely well, achieving $O(\frac{\sqrt N}{m})$ runtime when run on $m$ processors.

Resources

Round Transformations

This page gives a description of the four operations that compose a round of AES. Each has been designed to satisfy criterias, one of them is that all must be invertible.

Add Round Key

This is the only operation that involves a key. It is obvious that omitting it would mean no encryption.

Round keys are derived from the master key (see the Key Schedule section) and are all composed of 16 bytes. We simply xor byte by byte the state by the bytes of the round key in the according position.

Its inverse is itself: if we xor again, we get back the original value of the state.

Mix Columns

A major goal of MC is the diffusion property: each byte has an impact on the whole column, so a modification propagates to other positions.

This operation mixes each column of the state independently from each other: each byte of the column is replaced by a (slightly different) combination of the four bytes of the column.

Let $(a_0, a_1, a_2, a_3)$ the quadruplet of elements of a column, the operation MC is done by multiplying with a matrix $M$ .

The calculations are performed in the finite field. If you are not familiar enough with the notions, you can skip to the next part and retain that this operation is also invertible using another matrix.

This matrix is circulant: each row is the same as the one above but is shifted by one column. So we can construct it in one line of SageMath (recall that the bytes 02 and 03 correspond respectively to $x$ and $x+1$ in the field):

# we construct the matrix
# (we use the finite field F constructed in the previous page)
M = Matrix.circulant([x, x + 1, 1, 1])
M
# [    x x + 1     1     1]
# [    1     x x + 1     1]
# [    1     1     x x + 1]
# [x + 1     1     1     x]

# We multiply a column
col1 = vector([F.random_element() for i in range(4)])
col1
# (x^6 + x + 1, x^7 + x^4 + x^2, x^6 + x^4 + x^3 + x^2, x^7 + x^6 + x^4 + x^3 + x^2)
col2 = M*col1
col2
# (x^7 + x^5 + 1, x^6 + x^3, x^4, x^7 + x^5 + x^3 + x^2 + x)

Inverse of Mix Column

It is needed to reverse MC for the decryption process. Fortunately, there exists a matrix $N$ such that $M\times N = N \times M = \textrm{Id}$ , the identity matrix.

N = M^-1
N
# [x^3 + x^2 + x   x^3 + x + 1 x^3 + x^2 + 1       x^3 + 1]
# [      x^3 + 1 x^3 + x^2 + x   x^3 + x + 1 x^3 + x^2 + 1]
# [x^3 + x^2 + 1       x^3 + 1 x^3 + x^2 + x   x^3 + x + 1]
# [  x^3 + x + 1 x^3 + x^2 + 1       x^3 + 1 x^3 + x^2 + x]

# hexadecimal representation
for row in N:
    print([F_to_hex(a) for a in row])
# ['e', 'b', 'd', '9']
# ['9', 'e', 'b', 'd']
# ['d', '9', 'e', 'b']
# ['b', 'd', '9', 'e']

col3 = N*col2
col3 == col1
# True

We remark that the coefficient of the matrix are less friendly for the inverse operation as it involves polynomial of higher degree. This means that the decryption is a bit slower.

Shift Rows

The goal of shifting rows is reinforce the diffusion property: the bytes of a column are shifted so they are all positioned on different columns. Combined with MC, then a one byte modification will have an effect to the whole state after several rounds: this is the Avalanche effect.

This operation shifts the rows of the state in the following manner:

The rows are shifted from top to bottom respectively by an offset of 0, 1, 2 or 3 columns to the left. Bytes that overflow on the left are put back to the right of the row.

The inverse is almost the same: the rows are shifted to the right instead by the same offsets and exceeding bytes are put back to the left.

Small exercise: to what extent would be the impact on the security of AES if no shifting were present?

Substitution Box

Last, but not least, the SB design criterias is to bring the confusion property to make correlation between a plaintext and a ciphertext as small as possible.

The precedent operations shuffle the plaintext in such a way that any modification of a byte has an impact to the whole state after several rounds. Though, this is not enough as those operations are linear: it means that the ciphertext could be expressed as linear equations from the plaintext and the master key. From a known couple plaintext/ciphertext it would be easy to solve the system and find the key.

The substitution box is the operation that breaks the linearity: each byte of the state is replaced by another following the table below.

If 3b is the input, its output is on row 30 and column 0b and is the byte e2.

Let sbox the name of this table, then for any bytes b1 and b2, we have

\texttt{sbox}(\texttt{b1} \oplus \texttt{b2}) \neq \texttt{sbox}(\texttt{b1}) \oplus \texttt{sbox}(\texttt{b2})

which is the desired property.

Though, this is not enough and the design of the sbox is made to include a sufficient algebraic complexity. The construction of the sbox table is done in two steps:

An element $a$ is replaced by $b = a^{-1}$ ( $0$ has no inverse and is mapped to $0$ );
An affine transformation on the coefficients of $a$ :

\begin{bmatrix} 1 & 0 & 0 & 0 & 1 & 1 & 1 & 1 \\ 1 & 1 & 0 & 0 & 0 & 1 & 1 & 1 \\ 1 & 1 & 1 & 0 & 0 & 0 & 1 & 1 \\ 1 & 1 & 1 & 1 & 0 & 0 & 0 & 1 \\ 1 & 1 & 1 & 1 & 1 & 0 & 0 & 0 \\ 0 & 1 & 1 & 1 & 1 & 1 & 0 & 0 \\ 0 & 0 & 1 & 1 & 1 & 1 & 1 & 0 \\ 0 & 0 & 0 & 1 & 1 & 1 & 1 & 1 \end{bmatrix} \cdot \begin{bmatrix} b_0 \\ b_1 \\ b_2 \\ b_3 \\ b_4 \\ b_5 \\ b_6 \\ b_7 \end{bmatrix} + \begin{bmatrix} 1 \\ 1 \\ 0 \\ 0 \\ 0 \\ 1 \\ 1 \\ 0 \end{bmatrix}

The table we gave above has been construted with SageMath and applying the two steps:

def construct_sbox():
    mat = Matrix.circulant(vector(GF(2), [1,0,0,0,1,1,1,1]))
    sbox = []
    for a in range(256):
        # convert a byte value to field element
        b = sum(((a >> i) & 1)*x^i for i in range(8))
        # first step: map to inverse
        if b != 0:
        b = b^-1
        # second step:
        # affine transformation using a vector space over GF(2)
        b = mat*vector(b) + vector(GF(2), [1, 1, 0, 0, 0, 1, 1, 0])
        # convert the vector as an integer in [0, 255]
        sbox.append(sum(ZZ(b[i]) << i for i in range(8)))
    return sbox

sbox = construct_sbox()
for i in range(16):
    print([f'{a:02x}' for a in sbox[16*i : 16*(i + 1)]])
# ['63', '7c', '77', '7b', 'f2', '6b', '6f', 'c5', '30', '01', '67', '2b', 'fe', 'd7', 'ab', '76']
# ['ca', '82', 'c9', '7d', 'fa', '59', '47', 'f0', 'ad', 'd4', 'a2', 'af', '9c', 'a4', '72', 'c0']
# ['b7', 'fd', '93', '26', '36', '3f', 'f7', 'cc', '34', 'a5', 'e5', 'f1', '71', 'd8', '31', '15']
# ['04', 'c7', '23', 'c3', '18', '96', '05', '9a', '07', '12', '80', 'e2', 'eb', '27', 'b2', '75']
# ['09', '83', '2c', '1a', '1b', '6e', '5a', 'a0', '52', '3b', 'd6', 'b3', '29', 'e3', '2f', '84']
# ['53', 'd1', '00', 'ed', '20', 'fc', 'b1', '5b', '6a', 'cb', 'be', '39', '4a', '4c', '58', 'cf']
# ['d0', 'ef', 'aa', 'fb', '43', '4d', '33', '85', '45', 'f9', '02', '7f', '50', '3c', '9f', 'a8']
# ['51', 'a3', '40', '8f', '92', '9d', '38', 'f5', 'bc', 'b6', 'da', '21', '10', 'ff', 'f3', 'd2']
# ['cd', '0c', '13', 'ec', '5f', '97', '44', '17', 'c4', 'a7', '7e', '3d', '64', '5d', '19', '73']
# ['60', '81', '4f', 'dc', '22', '2a', '90', '88', '46', 'ee', 'b8', '14', 'de', '5e', '0b', 'db']
# ['e0', '32', '3a', '0a', '49', '06', '24', '5c', 'c2', 'd3', 'ac', '62', '91', '95', 'e4', '79']
# ['e7', 'c8', '37', '6d', '8d', 'd5', '4e', 'a9', '6c', '56', 'f4', 'ea', '65', '7a', 'ae', '08']
# ['ba', '78', '25', '2e', '1c', 'a6', 'b4', 'c6', 'e8', 'dd', '74', '1f', '4b', 'bd', '8b', '8a']
# ['70', '3e', 'b5', '66', '48', '03', 'f6', '0e', '61', '35', '57', 'b9', '86', 'c1', '1d', '9e']
# ['e1', 'f8', '98', '11', '69', 'd9', '8e', '94', '9b', '1e', '87', 'e9', 'ce', '55', '28', 'df']
# ['8c', 'a1', '89', '0d', 'bf', 'e6', '42', '68', '41', '99', '2d', '0f', 'b0', '54', 'bb', '16']

The inverse of the table is simple to produce: we only need to reverse the match between an input and its output.

Exercise: write the inverse of the substitution box in SageMath using the inverse of the affine transformation.