Abstract
At Eurocrypt’98, Boyko, Peinado and Venkatesan presented simple and very fast methods for generating randomly distributed pairs of the form (x; g x mod p) using precomputation. The security of these methods relied on the potential hardness of a new problem, the so-called hidden subset sum problem. Surprisingly, apart from exhaustive search, no algorithm to solve this problem was known. In this paper, we exhibit a security criterion for the hidden subset sum problem, and discuss its implications on the practicability of the precomputation schemes. Our results are twofold. On the one hand, we present an efficient lattice-based attack which is expected to succeed if and only if the parameters satisfy a particular condition that we make explicit. Experiments have validated the theoretical analysis, and show the limitations of the precomputation methods. For instance, any realistic smart-card implementation of Schnorr’s identification scheme using these precomputations methods is either vulnerable to the attack, or less efficient than with traditional precomputation methods. On the other hand, we show that, when another condition is satisfied, the pseudo-random generator based on the hidden subset sum problem is strong in some precise sense which includes attacks via lattice reduction. Namely, using the discrete Fourier transform, we prove that the distribution of the generator’s output is indistinguishable from the uniform distribution. The two conditions complement each other quite well, and therefore form a convincing picture of the security level.
Chapter PDF
References
M. Ajtai. Generating hard instances of lattice problems. In Proc. 28th ACM STOC, pages 99–108, 1996. Extended version at http://www.eccc.uni-trier.de/eccc/.
V. Boyko, M. Peinado, and R. Venkatesan. Speeding up discrete log and factoring based schemes via precomputations. In Proc. of Eurocrypt’ 98, volume 1403 of LNCS, pages 221–235. Springer-Verlag, 1998.
E. Brickell, D.M. Gordon, K.S. McCurley, and D. Wilson. Fast exponentiation with precomputation. In Proc. of Eurocrypt’92, volume 658 of Lecture Notes in Computer Science, pages 200–207. Springer-Verlag, 1993.
E. F. Brickell and K. S. McCurley. An interactive identification scheme based on discrete logarithms and factoring. Journal of Cryptology, 5(1):29–39, 1992.
M.J. Coster, A. Joux, B.A. LaMacchia, A.M. Odlyzko, C.-P. Schnorr, and J. Stern. Improved low-density subset sum algorithms. Computational Complexity, 2:111–128, 1992.
P. de Rooij. On the security of the Schnorr scheme using preprocessing. In Proc. of Eurocrypt’91, volume 547 of LNCS, pages 71–80. Springer-Verlag, 1991.
P. de Rooij. Efficient exponentiation using precomputation and vector addition chains. In Proc. of Eurocrypt’94, volume 950 of Lecture Notes in Computer Science, pages 389–399. Springer-Verlag, 1995.
P. de Rooij. On Schnorr’s preprocessing for digital signature schemes. Journal of Cryptology, 10(1):1–16, 1997.
T. El Gamal. A public key cryptosystem and a signature scheme based on discrete logarithms. IEEE Trans. Inform. Theory, 31:469–472, 1985.
R. Impagliazzo and M. Naor. Efficient cryptographic schemes provably as secure as subset sum. Journal of Cryptology, 9(4):199–216, 1996.
A. K. Lenstra, H. W. Lenstra, and L. Lovász. Factoring polynomials with rational coefficients. Math. Ann., 261:515–534, 1982.
C.H. Lim and P.J. Lee. More flexible exponentiation with precomputation. In Proc. of Crypto’94, volume 839 of Lecture Notes in Computer Science, pages 95–107. Springer-Verlag, 1994.
National Institute of Standards and Technology (NIST). FIPS Publication 186: Digital Signature Standard, May 1994.
P. Nguyen and J. Stern. Merkle-Hellman revisited: a cryptanalysis of the QuVanstone cryptosystem based on group factorizations. In Proc. of Crypto’97, volume 1294 of LNCS, pages 198–212. Springer-Verlag, 1997.
P. Nguyen and J. Stern. Cryptanalysis of a fast public key cryptosystem presented at SAC’ 97. In Proc. of SAC’ 98, LNCS. Springer-Verlag, 1998.
P. Nguyen and J. Stern. The Béguin-Quisquater server-aided RSA protocol from Crypto’ 95 is not secure. In Proc. of Asiacrypt’ 98, volume 1514 of LNCS, pages 372–379. Springer-Verlag, 1998.
C.-P. Schnorr. A hierarchy of polynomial lattice basis reduction algorithms. Theoretical Computer Science, 53:201–224, 1987.
C.P. Schnorr. Efficient identification and signatures for smart cards. In Proc. of Crypto’89, volume 435, pages 239–252. Springer-Verlag, 1990.
C.P. Schnorr. Efficient signature generation by smart cards. Journal of Cryptology, 4:161–174, 1991.
C.P. Schnorr and H.H. Horner. Attacking the Chor-Rivest cryptosystem by improved lattice reduction. In Proc. of Eurocrypt’95, volume 921 of LNCS, pages 1–12. Springer-Verlag, 1995.
V. Shoup. Number Theory C++ Library (NTL) version 3.6. Can be obtained at http://www.shoup.net/ntl/.
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 1999 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Nguyen, P., Stern, J. (1999). The Hardness of the Hidden Subset Sum Problem and Its Cryptographic Implications. In: Wiener, M. (eds) Advances in Cryptology — CRYPTO’ 99. CRYPTO 1999. Lecture Notes in Computer Science, vol 1666. Springer, Berlin, Heidelberg. https://doi.org/10.1007/3-540-48405-1_3
Download citation
DOI: https://doi.org/10.1007/3-540-48405-1_3
Published:
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-66347-8
Online ISBN: 978-3-540-48405-9
eBook Packages: Springer Book Archive