International Association for Cryptologic Research

International Association
for Cryptologic Research

CryptoDB

The Legendre Symbol and the Modulo-2 Operator in Symmetric Schemes over Fnp: Preimage Attack on Full Grendel

Authors:
Lorenzo Grassi , Digital Security Group, Radboud University, Nijmegen, The Netherlands
Dmitry Khovratovich , Dusk Network, Luxembourg City, Luxembourg; Ethereum Foundation, Luxembourg City, Luxembourg
Sondre Rønjom , University of Bergen, Bergen, Norway
Markus Schofnegger , Institute of Applied Information Processing and Communications, Graz University of Technology, Graz, Austria
Download:
DOI: 10.46586/tosc.v2022.i1.5-37
URL: https://tosc.iacr.org/index.php/ToSC/article/view/9525
Search ePrint
Search Google
Abstract: Motivated by modern cryptographic use cases such as multi-party computation (MPC), homomorphic encryption (HE), and zero-knowledge (ZK) protocols, several symmetric schemes that are efficient in these scenarios have recently been proposed in the literature. Some of these schemes are instantiated with low-degree nonlinear functions, for example low-degree power maps (e.g., MiMC, HadesMiMC, Poseidon) or the Toffoli gate (e.g., Ciminion). Others (e.g., Rescue, Vision, Grendel) are instead instantiated via high-degree functions which are easy to evaluate in the target application. A recent example for the latter case is the hash function Grendel, whose nonlinear layer is constructed using the Legendre symbol. In this paper, we analyze high-degree functions such as the Legendre symbol or the modulo-2 operation as building blocks for the nonlinear layer of a cryptographic scheme over Fnp.Our focus regards the security analysis rather than the efficiency in the mentioned use cases. For this purpose, we present several new invertible functions that make use of the Legendre symbol or of the modulo-2 operation.Even though these functions often provide strong statistical properties and ensure a high degree after a few rounds, the main problem regards their small number of possible outputs, that is, only three for the Legendre symbol and only two for the modulo-2 operation. By fixing them, it is possible to reduce the overall degree of the function significantly. We exploit this behavior by describing the first preimage attack on full Grendel, and we verify it in practice.
Video from TOSC 2022
BibTeX
@article{tosc-2022-31971,
  title={The Legendre Symbol and the Modulo-2 Operator in Symmetric Schemes over Fnp: Preimage Attack on Full Grendel},
  journal={IACR Transactions on Symmetric Cryptology},
  publisher={Ruhr-Universität Bochum},
  volume={2022, Issue 1},
  pages={5-37},
  url={https://tosc.iacr.org/index.php/ToSC/article/view/9525},
  doi={10.46586/tosc.v2022.i1.5-37},
  author={Lorenzo Grassi and Dmitry Khovratovich and Sondre Rønjom and Markus Schofnegger},
  year=2022
}