再论Goldreich伪随机生成器的具体安全性
Revisiting the Concrete Security of Goldreich's Pseudorandom Generator
摘要：
局部伪随机数发生器是密码学中的一类基本的密码原语，在理论密码学中有着非常广泛的应用。根据Couteau et al.的工作，本文进一步研究了一类重要的局部伪随机生成器的具体安全性，即，Goldreich伪随机发生器我们的第一次攻击是猜测和确定类型。我们的结果显着改进了Couteau等人提出的最先进的算法，在渐近和具体的复杂性方面，并打破了他们提出的所有挑战参数。例如，对于建议的128位安全性的参数集，我们可以通过大约$2^{61}$的因子更快地求解实例，从而完全破坏所声称的安全性。我们的第二次攻击进一步利用了谓词$P_5$的极其稀疏的结构，并结合了迭代解码的思想。这种新的攻击，命名为猜测和解码，大大改善了猜测和确定的方法，密码相关的参数。Couteau等人提出的所有挑战参数集。ASIACRYPT 2018中的工作，以80位（128位）安全级别为目标，可以在大约$2^{58}$（$2^{78}$）的操作中解决。我们提出了新的参数，以实现80位（128位）的安全性相对于我们的攻击。我们还将攻击扩展到其他有前途的谓词，并调查他们的阻力。
英文摘要：
Local pseudorandom generators are a class of fundamental cryptographic primitives having very broad applications in theoretical cryptography. Following Couteau et al.'s work in ASIACRYPT 2018, this paper further studies the concrete security of one important class of local pseudorandom generators, i.e., Goldreich's pseudorandom generators. Our first attack is of the guess-and-determine type. Our result significantly improves the state-of-the-art algorithm proposed by Couteau et al., in terms of both asymptotic and concrete complexity, and breaks all the challenge parameters they proposed. For instance, for a parameter set suggested for 128 bits of security, we could solve the instance faster by a factor of about $2^{61}$, thereby destroying the claimed security completely. Our second attack further exploits the extremely sparse structure of the predicate $P_5$ and combines ideas from iterative decoding. This novel attack, named guess-and-decode, substantially improves the guess-and-determine approaches for cryptographic-relevant parameters. All the challenge parameter sets proposed in Couteau et al.'s work in ASIACRYPT 2018 aiming for 80-bit (128-bit) security levels can be solved in about $2^{58}$ ($2^{78}$) operations. We suggest new parameters for achieving 80-bit (128-bit) security with respect to our attacks. We also extend the attack to other promising predicates and investigate their resistance.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
