A Complete algorithm for local inversion of maps: Application to Cryptanalysis

The problem of inversion of permutation polynomials in finite fields has a vast literature. References [14, 13, 12] are good representatives. However inversion of permutation polynomials does not result in a method for local inversion. Recently in [7] a linear representation of functions in finite fields is proposed and it is shown that when $F$ (is a permutation function) with the global inverse $G$ then the inverse $G$ as well as its linear representation also follows from that of $F$. The linear representations of inverses are inverses of linear representations. However linear representation of $F$ does not solve the problem of local inversion when $F$ is not globally invertible (since $G$ does not exist). Hence local inversion problem needs to be solved afresh.

As discussed above, the Time Memory Tradeoff (TMTO) attack on OWFs is a well known algorithm for solving the local inversion of a map $F:X\mapsto X$ in $X=\{0,1\}^{n}$ given $y=F(x)$ in $X$. TMTO algorithm was proposed by Hellman in [2] and has been well researched over last several years as shown in [3, 4, 5]. TMTO algorithm is however probabilistic and does not utilize structure of the set $X$ as a vector space over a finite field and its success probability is based on the Birthday attack which has complexity of order $O(2^{n/2})$. In practice TMTO attack requires gathering of multiple large sized tables offline not just one to overcome merging of chains, false positive solutions and even failure to capture a solution. However the online search can be carried out in parallel which is advantageous.

An algorithm for representing all solutions (satisfying assignments) of a Boolean systems of equations is proposed in [9]. This algorithm is completely thread parallel hence the time performance improves with increase in memory space. The problem of representing all solutions of Boolean equations is however of $\sharp$-P class whose special case, that of deciding solvability of $3$-CNF system is an NP complete problem. If the Boolean equations are represented in the form $y=F(x)$ for a known $y$ in $\mathbb{F}_{2}^{n}$ with $n$-unknowns taking values in $\mathbb{F}_{2}$, this method can be used for local inversion. Hence al solutions of inverses can be solved using the algorithm proposed in [9] better than brute force search. However if the offline computation on $F$ of the method proposed in this paper is feasible, the local inversion does not require solution of non-linear Boolean equations but only depends on forward computations of the function. Hence the algorithm proposed in this paper is a definite way to solve these hard problems even without solving the system of Boolean equations and only resorting to forward computation of the map $F$ if the offline computation is feasible.

Problem of solving rational roots of polynomial of systems of equations over finite fields is one of the well known hard problems of computation. This problem has been addressed in past by algebraic geometric and probabilistic algorithmic methods [10, 11]. The case of deciding the solvability of a multivariate quadratic system is an NP complete problem. Hence in general the local inversion problem is computationally hard. More specifically the problem of inversion of permutation polynomials requires symbolic arithmetic and results in an inverse function [12]. The problem of local inversion of a function $F(x)$ at a point $y=F(x)$ is thus a special counterpart of both of these problems. Any algorithm for finding roots of polynomial systems can solve all rational roots in $\mathbb{F}_{q}$ of the equation $y=F(x)$ given $y$. Similarly if $F$ is a permutation of $\mathbb{F}_{q}$ and $G$ is the global inverse permutation then $x=G(y)$ is the unique inverse image of $y$. However when $F$ is not a permutation these methods cannot solve the local inversion problem. For $\mathbb{F}_{2^{n}}$ existence and computation of all rational roots of $y=F(x)$ can be accomplished by the Boolean system solver [9]. However no such algorithm is known for fields in other characteristics.

Consider the sequence $S(F,y)$. It is a-priori not possible to know whether the sequence is periodic from a short length samples $F^{(k)}(y)$ (for small $k$) since the period can be exponentially large. The issue here is that while the sequence $S(F,y)$ is not fully available for computation, to compute a linear recurrence relation (3) of shortest degree. In fact this is what is the well known computation of linear complexity of a sequence by the Berlekamp-Massey algorithm. Important point is that such a computation requires the a-priori knowledge of the period of the sequence $S(F,y)$ to stop the search for the degree of the minimal polynomial. We introduce the Hankel matrix

Following proposition is well known on computation of minimal polynomial of sequences in finite fields. In the present context the sequence is the vector sequence $S(F,y)$ in $\mathbb{F}_{2}^{n}$. Hence the Hankel matrix (7) is no more square as in the case of sequences over finite fields but is a block Hankel matrix.

One solution of $F(x)=y$ when sequence $S(F,y)$ is periodic, is obtained as described in the theorem below.

We note following important points about the solution (10).

1. 1.

   The unique solution (10) in the periodic orbit $S(F,y)$ is expressed in terms of the linear combinations of the sequence $S(F,y)$ which consists of only forward operations of the map $F$ (which is assumed to be feasible in practical time).

2. 2.

   The number of terms in (10) are $m$ the degree of the minimal polynomial. Hence the solution $x$ is computed in polynomial order of computations in $O(m^{k})$ given $y$.

3. 3.

   Since $S(F,y)$ is periodic of period $N$ if it has a minimal polynomial, $x=F^{(N-1)}(y)$ is also the same solution as computed in (10). However $N$ may be exponentially large hence this formula for computation of $x$ is not feasible without knowing the period $N$.

4. 4.

   If a solution $x$ is obtained by a possible minimal polynomial as in (10) then knowing the possible period $N$ it can be easily verified whether $x$ lies in the periodic orbit $S(F,y)$ by $F(x)=y$ instead of verifying by the equation $F^{(N-1)}(y)=x$.

5. 5.

   If the degree $m$ itself is of polynomial order in $n$ (number of variables) then the online computation of the solution $x$ in $S(F,y)$ is computable in polynomial time. (The situation is comparable to primitive polynomials of degree $n$ whose order is $N=2^{n}-1$. Hence $m$ is expected to be of the order $\log N$ in same proportions (density) as primitive polynomials of degree $n$ among all polynomials).

Based on this theorem the online algorithm to compute one solution $x$ when $y$ is in a periodic orbit $S(F,Y)$ is Algorithm 1.

It is interesting to observe how an online incomplete online algorithm can be constructed which may possibly find a solution given $y$ but without any offline computation. Such an algorithm may be practically useful within certain bounds on the degree of the minimal polynomial. Let a bound $M$ on the degree of the minimal polynomial $m(X)$ is specified and the step of computation of $m(X)$ is stopped when degree $m$ of a possible minimal polynomial exceeds $M$. The bound $M$ should be theoretically at most equal to any of the possible periods of closed orbits $N$ of $F$. However $M$ is chosen from a point of view of feasibility of the computation of the minimal polynomial using the rank criterion of the the section 2.1.1. Hence $M$ may be chosen of polynomial order $O(n^{k})$ in the number of variables for suitable $k$. Algorithm 2 shows this computation.

Algorithm 2 is practically feasible and results in one correct solution when the linear complexity of $S(F,y)$ is less than $M$. The algorithm eliminates false positive solutions by checking the equation $F(x)=y$ in step $11$.

Theorem 1 leaves open the question whether there are other solutions outside the periodic orbit $S(F,y)$ or when such solutions exist when $S(F,y)$ is not periodic. This problem is considered next.

If $z(k)=F^{(k)}(z)$ is a sequence of points on a chain, the chain terminates when $z(k)$ meets a periodic orbit. If all possible periods of periodic orbits of $F$ are known a-priori then for each $N$ of these periods, the relation $F^{N}(z(k))=z(k)$ seems to be the only way to check whether $z(k)$ is on a periodic orbit of period $N$. Hence it is necessary to show that even when $N$ is exponential order in $n$, evaluation $F^{N}(z)$ can be carried out efficiently in polynomial time in $\log N$ on any point $z$ in $\mathbb{F}_{2}^{n}$. This is shown in Appendix. Algorithm 3 to compute solutions of $F(x)=y$ outside periodic orbits $S(F,y)$ can be as follows.

Algorithm 3 is repeated in parallel for all points $z$ in GOE. Both the online algorithms Algorithm 1 for computing an inverse in a periodic orbit containing $y$ and Algorithm 3 to compute all other solutions, require an a-priori (offline) computation on $F$ which is independent of $y$. This computation creates a data, the set $\hat{\Pi}$ of all possible periods of periodic orbits of $F$ and the set GOE. This offline computation is discussed in the next section.

Consider the linear dynamic systems, called hereafter as Koopman system corresponding to $F$, defined by iterations by the linear map

For a trajectory

of iterations of the map $F$ in $\mathbb{F}_{2}^{n}$ define an embedding in the trajectories of Koopman system in $\mathbb{F}_{2}^{N}$ corresponding to the basis ${\cal B}$ by

where

Then a trajectory of the map $F$ in $\mathbb{F}_{2}^{n}$ is embedded as a trajectory of the linear map (14) in $\mathbb{F}_{2}^{N}$ by

From this lemma we get a set of all numbers which contains all periods of closed orbits of $F$ as follows.

For the sake of clarity of the computation of $\hat{\Pi}$, the set of periods of all closed orbits of iterations of $K^{T}$, we present the well known result from [1] here without proof.

(Here $\mbox{Order}\;p(X)$ of a polynomial satisfying $p(0)\neq 0$ is the smallest number $T$ such that $p(X)$ divides $X^{T}-1$). For a proof of this well known theorem reader may see section 12.10 in [1]. The theorem above shows that the computation of the set $\Pi(A)$ of periods of the map $A$ is accomplished by computing the rational canonical form of $A$ to compute all elementary divisors of $A$.