In this paper we consider a two party key-exchange protocol
proposed by Grigoriev and Shpilrain
which uses tropical matrix algebra as a platform.
Our analysis shows that the scheme is not secure

Alexander Ushakov

Matvei Kotov

Abstract. In this paper we consider a two party key-exchange proto-col proposed in [4, Section 2] which uses tropical matrix algebra as a platform. Our analysis shows that the scheme is not secure

CiteSeerX

ANALYSIS OF A KEY EXCHANGE PROTOCOL BASED ON TROPICAL MATRIX ALGEBRA

Cryptology ePrint Archive

ANALYSIS OF A KEY EXCHANGE PROTOCOL BASEDON TROPICAL MATRIX ALGEBRAMATVEI KOTOV AND ALEXANDER USHAKOVAbstract. In this paper we consider a two party key-exchange proto-col proposed in [4, Section 2] which uses tropical matrix algebra as aplatform. Our analysis shows that the scheme is not secure.Keywords. Tropical algebra, cryptography, key-exchange, min-plussystems.2010 Mathematics Subject Classification. 94A60, 68W30.1. IntroductionIn this paper we analyze a key-exchange protocol based on tropical matrixalgebra proposed in [4, Section 2]. Ideas similar to [4] were used before inthe “classic” case, i.e., for algebras with familiar addition and multiplication.However in classic case these schemes were shown to be vulnerable to variouslinear algebra attacks. The idea to use an algebra with another addition andmultiplication came as an attempt to avoid those attacks, as there are noknown algorithms for solving systems of linear equations in tropical sense(it is an active field of research currently).1.1. Tropical algebra. Consider the extended set of real numbers R∪{∞}and binary operations ⊕,⊗ defined by:x⊕ y = min(x, y),x⊗ y = x + y.A set S ⊆ R ∪ {∞} closed under +, containing 0 and ∞ is called a tropicalsemi-ring. It is straightforward to check that (S,⊕,⊗) satisfies all axiomsof a commutative ring with unity 0 except for existence of additive inverses.In this paper S = Z ∪ {∞}.The set of all n×n matrices Mn(S) with entries from S can be equippedwith operations ⊕ and ⊗ as well, as defined below:(aij)⊕ (bij) = (aij ⊕ bij)(aij)⊗ (bij) = (ai1 ⊗ b1j ⊕ . . .⊕ ain ⊗ bnj).The obtained algebra R = (Mn(S),⊕,⊗) is called a tropical matrix algebra.Date: December 9, 2015.The first author has been partially supported by RFBR, project No. 14-01-00068.The second author has been partially supported by NSF grant DMS-1318716.12 M. KOTOV AND A. USHAKOVFor more information on tropical algebras see [1]. For more on non-commutative algebraic structures used in cryptography see [6].1.2. The protocol. Here we describe a two party key-exchange protocolproposed in [4, Section 2]. Let A,B ∈ R be matrices satisfying A ⊗ B 6=B ⊗A, called public base matrices.(1) Alice generates random polynomials p1(x), p2(x) ∈ Z[x] and sendsU = p1(A)⊗ p2(B) to Bob.(2) Bob generates random polynomials q1(x), q2(x) ∈ Z[x] and sendsV = q1(A)⊗ q2(B) to Alice.(3) Alice computes KA = p1(A)⊗ V ⊗ p2(B).(4) Bob computes KB = q1(A)⊗ U ⊗ q2(B).It is easy to check that Alice and Bob finally compute the same matrixK = KA = KB, called the shared key.The following key generation method is suggested in [4, Section 2.5].• The size of matrices n = 10.• The entries of matrices A and B are integers, selected randomly in[−1010, 1010].• The degrees of polynomials p1(x), p2(x), q1(x), q2(x) are selected uni-formly randomly in the range [1, 10].• The coefficients of p1(x), p2(x), q1(x), q2(x) are selected uniformlyrandomly in [−1000, 1000].1.3. Computational assumption. For a passive eavesdropper to breakthe protocol means to be able to compute the value of K based on thevalues of A,B,U, V . For that it clearly suffices to find a pair of matricesX,Y satisfying the following conditions:(1) X ⊗A = A⊗X,Y ⊗B = B ⊗ Y,X ⊗ Y = U,or to solve a similar system for Bob’s public key. Indeed, if X,Y satisfy theconditions above, then the product X ⊗ V ⊗ Y is equal to K. In the case ofmatrix algebra over (Z,+, ·) one would reduce the system above to a systemof linear equations (as in [8, 7]). The same approach does not seem to workwith tropical algebra as explained in [4].2. Simple heuristic for original key generation methodIn this section we argue that one can find a solution of the system (1) by avery simple heuristic when the public information is generated as proposedin [4].TROPICAL CRYPTOGRAPHY CRYPTANALYSIS 3Consider a particular 3 × 3 matrix A with entries chosen uniformly ran-domly in the range [−100, 100] and its tropical powers:A = −42 13 −96−28 16 65−85 31 −75 ,A⊗2 = −181 −65 −171−70 −15 −124−160 −72 −181 ,A⊗3 = −256 −168 −277−209 −93 −199−266 −150 −256 ,A⊗4 = −362 −246 −352−284 −196 −305−341 −253 −362 ,A⊗5 = −437 −349 −458−390 −274 −380−447 −331 −437 .As we can see the entries in A⊗i very soon become negative and decreaselinearly with i. In a linear combination of A⊗i’s with sufficiently smallcoefficients xi, say −10 ≤ xi ≤ 10, smaller monomials are irrelevant com-pared with the leading monomial, i.e., for any choice of the coefficients−10 ≤ xi ≤ 10 we have:(2)5⊕i=0xi ⊗A⊗i = x5 ⊗A⊗5.This is precisely the case for key generation proposed in [4]. Half of theentries in A and B have negative value. The entries in the tropical-powersA⊗i and B⊗i become all negative very fast (when i ≥ 2) and decreasefaster than the range for coefficients which makes lower monomials in thepolynomials p1, p2 irrelevant. Based on that observation one can expect thatthe system (1) has a solution of the form:X = c⊗A⊗i and Y = B⊗jfor some i, j ∈ [1, D] and c ∈ Z, where D is the upper bound for degrees ofpolynomials in the protocol.This gives us the following simple heuristic attack. For each i, j ∈ [1, D]we compute the matrix T ij = U − A⊗i ⊗ B⊗j . If T ij = (c)kl for someconstant c, then X = c ⊗ A⊗i, Y = B⊗j is a required solution to (1), andthe algorithm successfully stops. If there are not such i and j, then thealgorithm fails.Table 1 shows success rates of the described algorithm for different key-generation strategies. If the keys are generated as originally proposed, thenthe success rate is 97%. Success rate decreases to 71% if we allow a larger4 M. KOTOV AND A. USHAKOVrange for coefficients in polynomials p1, p2. It becomes negligible if we allowonly non-negative entries in A and B. Below we suggest an attack whichworks well in this case.Range for coeff. of polynomials [−103, 103] [−1010, 1010] [0, 1010]Range for entries of matrices [−1010, 1010] [−1010, 1010] [0, 1010]Avg. time 0.5 sec 0.6 sec 1.2 secSuccess rate 97% 71% 2%Table 1. Experimental results of the simple heuristical algorithm3. General attackIn this section we discuss a general attack on the protocol. The successrate of this attack does not depend on parameters of key generation andequals 100%. We find matrices X and Y of the form:X =D⊕i=0xi,⊗A⊗i, Y =D⊕j=0yj ⊗B⊗jwith unknown coefficients xi, yj ∈ Z. Clearly for such matrices the first andthe second equality in (1) are satisfied. Notice that:X ⊗ Y =D⊕i,j=0xi ⊗ yj ⊗A⊗i ⊗B⊗j .Therefore to break the protocol we need to find x0, . . . , xD, y0, . . . , yD ∈ Zsuch that:D⊕i,j=0xi ⊗ yj ⊗A⊗i ⊗B⊗j = U.Using the definition of ⊕ and ⊗, we get a system of equations(3) mini,j(xi + yj + Tijkl)= 0, for each k, l ∈ [1, n],where T ij = A⊗i ⊗B⊗j − U . Solving the system (3) is the main goal of thissection.Denote by mij the least entry in the matrix Tij and by Pij the set ofentries where the minimum is achieved:mij = mink,lT ijkl , Pij = {(k, l) | Tijkl = mij}.Notice that any solution xi, yj , 0 ≤ i, j ≤ D, of (3) satisfies the followingconditions:• xi + yj ≥ −mij ;• for every k, l there exist i, j such that (k, l) ∈ Pij and xi+yj = −mij .TROPICAL CRYPTOGRAPHY CRYPTANALYSIS 5Range for coef. of polynomials [−103, 103] [−1010, 1010] [0, 1010]Range for entries of matrices [−1010, 1010] [−1010, 1010] [0, 1010]Maximal number of covers 102 296 20736Avg. number of covers 4.2 16.52 705.5Median of number of covers 1 1 7.5Avg. number of tested covers 1 1.03 1.57Median of number of tested covers 1 1 1Avg. time 1.9 sec 2.0 sec 2.5 secSuccess rate 100% 100% 100%Table 2. Experimental results of the general attackTherefore, to solve (3) we need to find a cover C ⊆ {P00, P01, . . . , PDD} ofthe set [1, n]× [1, n] and values xi, yj , 0 ≤ i, j ≤ D, satisfying:(4){xi + yj = −mij if Pij ∈ C,xi + yi ≥ −mij otherwise.Hence, in order to solve (3) we need to enumerate all minimal covers for[1, n]× [1, n] and then find those that define consistent systems of equalitiesand inequalities (4).Recall that finding a minimal set cover problem is one of Karp’s 21 prob-lems shown to be NP-complete in 1972. Nevertheless, for all randomlygenerated instances of the protocol it was relatively easy to enumerate allpossible minimal covers.To enumerate the covers we use a simple recursive procedure and a coupleof heuristics. As one can see in Table 2, often the number of covers is small,and rarely it is greater than 10000. In every experiment we were able toenumerate all the minimal covers in a few seconds.Also, we noticed that often an appropriate cover (a cover defining a con-sistent system (4)) is smaller than most other covers produced by our algo-rithm. Furthermore, for covers of the same size an appropriate cover oftenhas smaller value of|{i | ∃j Pij ∈ C}| · |{j | ∃i Pij ∈ C}|than others. Therefore, to speed up computations we sort the covers usingthese criteria. This strategy works very well, as shown in Table 2, on averagewe have to test only one or two covers to find a solution.Finally, to determine if a system (4) is consistent for a particular cover Cwe use the simplex method, see [2].The described attacks were implemented in GAP [3]. The implementationcan be found in [5]. Our tests were run on Intel Core i3 1.50GHz computerwith 4GB of RAM, Ubuntu 14.04, GAP 4.7. We generated 100 randominstances for every set of parameters presented in the tables.6 M. KOTOV AND A. USHAKOV4. ConclusionThe protocol described in [4, Section 2] is not secure when used with theproposed parameter values. It is not clear how to modify key generation toprovide a sufficient level of security. We encourage an interested reader touse our code [5] and perform his/her computational experiments over thetropical algebra.References[1] P. Butkovič. Max-linear Systems: Theory and Algorithms. Springer Monographs inMathematics. Springer London, 2010.[2] T. Cormen, C. Leiserson, R. Rivest, and C. Stein. Introduction to Algorithms. TheMIT Press, 3 edition, 2009.[3] The GAP Group. GAP – Groups, Algorithms, and Programming, Version 4.7.7, 2015.[4] D. Grigoriev and V. Shpilrain. Tropical cryptography. Comm. Algebra, 43:2624–2632,2014.[5] M. Kotov and A. Ushakov. Implementation of attacks on a key excange protocol basedon tropical matrix algebra. Available at https://github.com/mkotov/tropical.[6] A. G. Miasnikov, V. Shpilrain, and A. Ushakov. Non-Commutative Cryptography andComplexity of Group-Theoretic Problems. Mathematical Surveys and Monographs.AMS, 2011.[7] C. Mullan. Cryptanalysing variants of Stickel’s key agreement scheme. preprint, 2010.[8] V. Shpilrain. Cryptanalysis of Stickel’s key exchange scheme. In Computer Science inRussia – CSR 2008, volume 5010 of Lecture Notes Comp. Sc., pages 283–288. Springer,2008.Department of Mathematics, Stevens Institute of Technology, Hoboken,NJ, USAE-mail address: mkotov,aushakov@stevens.edu

Analysis of a key exchange protocol based on tropical matrix algebra

Abstract

Similar works

Full text

Available Versions

CiteSeerX

Cryptology ePrint Archive