malb / algebraic_attacks (http://informatik.uni-bremen.de/~malb/blog.php)

This repository mainly holds code snippets for experimentation with algebraic attacks (and some general crypto code). The quality of this code is not 'release ready' at all. Although the code should work in general there is a lot of scratch, wrong and pathetic code in this repository. Also, some of this code dates back to my Diplomarbeit (master's thesis) and should be considered broken and outdated. By default all code listed here is released under the GPLv2+. Don't hesitate to ping me if you need something under some more permissive license like BSD-style.

Clone this repository (size: 122.6 KB): HTTPS / SSH
$ hg clone http://bitbucket.org/malb/algebraic_attacks/
commit 35: ce280e2b1a19
parent 34: 3dd50c6be752
branch: default
tags: tip
fixed a very stupid bug in PRESENT which made the polynomial system unecessarily hard
Martin Albrecht / malb
4 weeks ago
r35:ce280e2b1a19 592 loc 15.7 KB embed / history / annotate / raw /
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
# -*- Mode: Python -*-
# # vi:si:et:sw=4:sts=4:ts=4
#

"""
F4

AUTHOR: Martin Albrecht <malb@informatik.uni-bremen.de> 
"""

from sage.rings.all import *
from sage.misc.misc import exists
from sage.rings.ideal import is_Ideal
from sage.matrix.matrix_modn_sparse import Matrix_modn_sparse
from sage.matrix.matrix_space import MatrixSpace

def CoeffMatrix_modint(F):
    """
    See MQ.matrix()
    """

    if is_Ideal(F):
        F = F.gens()
    if isinstance(F,set):
        F = list(F)
        
    R = F[0].parent()
    k = R.base_ring()

    m = set([mon for f in F for mon in f.monomials()])
    m = tuple(sorted(m,reverse=True))

    #construct dictionary for fast lookups
    v = dict( map(lambda x,y:(x,y), m , range(0,len(m)) ) )

    MS = MatrixSpace(R.base_ring(), len(F), len(v), sparse=True)
    A  = CoeffMatrix_modint_impl(MS,{},False,False)
        
    for x in range( 0 , len(F) ):
        poly = F[x]
        for y in poly.monomials():
            A[ x , v[y] ] = poly.monomial_coefficient(y)
    print "% 4d x % 4d, % 4d, % 4d"%(A.nrows(), A.ncols(), A.rank(), A.nrows()-A.rank())
    return ( A , m )

class CoeffMatrix_modint_impl(Matrix_modn_sparse):
    """
    Sparse Matrix with some extra functions suitable
    for a coefficient matrix.
    """
    
    def rows_dict(self):
        """
        Returns a dictionary of whichs keys are row numbers and whichs
        values are ordered lists of column numbers. Those row/column
        number pairs represent non-zero entries.
        """
        try:
            return self.__md
        except AttributeError:
            d = self._dict()
            md = {}
            for point in d.iterkeys():
                if not md.has_key(point[0]):
                    md[point[0]] = [point[1]]
                else:
                    md[point[0]].append(point[1])
            for values in md.itervalues():
                values.sort()
            self.__md = md
            return md

    def polynomial(self,v,i):

        R = v[0].parent()
        poly_dict = dict()
        rd = self.rows_dict()
        f = R(0)
        try:
            for col in rd[self.nrows()-i-1]:
                f += self[self.nrows()-i-1, col] * v[col]
        except KeyError:
            pass

        return f

    def __mul__(self,right):
        """
        The product of a coefficent matrix with a monomial vector
        is a list of poylnomials.
        """
        if not isinstance(right, tuple):
            raise NotImplementedError

        R = right[0].parent()

        rd = self.rows_dict()
        rows = sorted(rd.iterkeys())
        nrows = self.nrows()
        return [self.polynomial(right,nrows-i-1) for i in rows]


class F4_orig:
    """
    Original F4 as described by Faugere
    """
    def __init__(self):
        pass

    def __call__(self, F, sel=None):
        if is_Ideal(F):
            F = F.gens()

        self.ring = F[0].parent()
        self.rr_bases = []
        G = list(F)
        F0p = F
        i = 0
        P = set([self.pair(f,g) for f in G for g in G if f<g ] )

        if sel==None:
            sel = self.normal_strategy

        while P != set():
            i += 1
            Pd, d = sel(P)
            print "% 2d"%(d,), 
            P = P.difference(Pd)
            Ld = set(self.left(Pd)).union(set(self.right(Pd)))
            Fdp = self.reduction(Ld,G)
            for h in Fdp:
                P = P.union(set([self.pair(h,g) for g in G ]))
                G.append(h)
            sys.stdout.flush()
        return G

    def reduction(self,L,G):
        F = self.symbolic_preprocessing(L,G)
        Ft = self.row_echelon(F)
        LMF = LM(F)
        Ftp = set([f for f in Ft if f.lm() not in LMF])
        return list(Ftp)

    def symbolic_preprocessing(self,L,G):
        """
        """ 
        G = G
        F = set([t*f for (t,f) in L ])
        Done = LM(F)
        M = set([m  for f in F for m in f.monomials()])
        R = self.ring
        while M != Done:
            m = M.difference(Done).pop()
            Done.add(m)
            t,g = self.ring.monomial_reduce(m,G)
            if t!=R(0): F.add(t*g)
            M = set([m  for f in F for m in f.monomials()])
        return F

    def pair(self,f,g):
        lcm = self.ring.monomial_lcm(f.lm(),g.lm())
        # it seems better speed-wise to calculate those on the fly
        #tf = LCMdLM(lcm,f.lm())
        #tg = LCMdLM(lcm,g.lm())
        return (lcm,f,g)
    
    def left(self,p):
        if isinstance(p,(list,set,tuple)):
            s = set()
            for f in p:
                s.add((self.ring.monomial_quotient(f[0],f[1].lm()),f[1]))
            return s
        else:
            return (self.ring.monomial_quotient(p[0],p[1].lm()),p[1])

    def right(self,p):
        if isinstance(p,(list,set,tuple)):
            s = set()
            for f in p:
                s.add((self.ring.monomial_quotient(f[0],f[2].lm()),f[2]))
            return s
        else:
            return (self.ring.monomial_quotient(p[0],p[2].lm()),p[2])

    def row_echelon(self, F):
        """
        """
        A,v=CoeffMatrix_modint(F)
        if self.protocol:
            A.visualize_structure(maxsize=None)

        A.echelonize()

        if self.protocol:
            A.visualize_structure(maxsize=None)

        F = A*v
        return F

    # Selection Strategies

    def normal_strategy(self,P):
        """

        The normal selection strategy

        INPUT:
            P -- a list of critical pairs

        OUTPUT:
            a sublist of P
        
        """ 
        d = min(set([ lcm.total_degree() for (lcm,fi,fj) in P ]))
        return set([ (lcm,fi,fj) for (lcm,fi,fj) in P if lcm.total_degree()==d]), d

    # Update Strategies

    def update_pairsGF2(self,G,B,h):
        """
        Following Becker, 'Groebner Bases', Springer 1993 as suggested
        by Faugere in his F4 paper. Also works in the quotient ring.

        INPUT:
            G -- an intermediate Groebner basis
            B -- a list of critical pairs
            h -- a polynomial

        OUTPUT:
            an intermediate Groebner basis, a list of critical pairs

        """

        R = self.ring

        hlm = h.lm()

        G_new = list()


        # if G is a set then C only contains unique elements
        C = list([self.pair(h,g) for g in G]) # 1.86
        D = list() # only adding elements of C, thus unique


        # Criterion F & M 
        while C!=list():
            (lcmhg1,h,g1) = C.pop()

            # will be removed in next loop
            if R.monomial_pairwise_prime(hlm,g1.lm()):
                D.append((lcmhg1,h,g1))
                continue

            found = 0
            for c in C:
                if R.monomial_divides( c[0], lcmhg1 ):
                    found=1; break
            if found: continue

            found = 0
            for d in D:
                if R.monomial_divides( d[0], lcmhg1 ):
                    found=1; break
            if found: continue

            D.append((lcmhg1,h,g1))


        E = list() #only adding elements of D, thus unique


        # Buchberger criterion 1
        for (lcmhg,h,g) in D:
            # if LM(h) and LM(g) are not disjoint
            if not R.monomial_pairwise_prime(hlm,g.lm()):
                E.append((lcmhg,h,g))


        B_new = set()

        # Criterion B_k
        for (lcmg1g2,g1,g2) in B:
            if not self.ring.monomial_divides( hlm, lcmg1g2 ) or \
                   self.ring.monomial_lcm(g1.lm(), hlm) == lcmg1g2 or \
                   self.ring.monomial_lcm( hlm,g2.lm()) == lcmg1g2 :
                B_new.add((lcmg1g2,g1,g2))

        B_new = B_new.union(E)

        r=[]
        for gen in hlm.variables():
            # consider F -- always true
            # consider M
            for f in G:
                if R.monomial_divides( hlm, f.lm() ):
                    r.append( (gen,f) )
                    break
        r.append((R(1),h))
        G_new = self.reduction(r,[],[],True)[0]

        
        for g in G: 
            if not R.monomial_divides(hlm, g.lm()):
                G_new.append(g)
        G_new.append(h)

        return G_new,B_new

    def update_pairs(self,G,B,h):
        """
        Following Becker, 'Groebner Bases', Springer 1993 as suggested
        by Faugere in his F4 paper.

        INPUT:
            G -- an intermediate Groebner basis
            B -- a list of critical pairs
            h -- a polynomial

        OUTPUT:
            an intermediate Groebner basis, a list of critical pairs

        """

        R = self.ring

        # if G is a set then C only contains unique elements
        C = [self.pair(h,g) for g in G]
        D = list() # only adding elements of C, thus unique

        # Criterion M
        
        while C!=list():
            (lcmhg1,h,g1) = C.pop()
            
            lcm_divides = lambda lcmhg2: R.monomial_divides(  lcmhg2[0], lcmhg1 )

            # if LM(h) and LM(g_1) are disjoint
            if R.monomial_pairwise_prime(h.lm(),g.lm()) or \
               (\
                   not exists(C, lcm_divides )[0] \
                   and \
                   not exists(D, lcm_divides )[0]\
                ):
                D.append((lcmhg1,h,g1))

        E = list() #only adding elements of D, thus unique

        # Criterion F
        
        while D != list():
            (lcmhg,h,g) = D.pop()
            # if LM(h) and LM(g) are not disjoint
            if not R.monomial_pairwise_prime(h.lm(),g.lm()):
                E.append((lcmhg,h,g))

        B_new = set()

        # Criterion B_k

        while B != set():
            lcmg1g2,g1,g2 = B.pop()
            if not self.ring.monomial_divides( h.lm(), lcmg1g2 ) or \
                   self.ring.monomial_lcm(g1.lm(), h.lm()) == lcmg1g2 or \
                   self.ring.monomial_lcm( h.lm(),g2.lm()) == lcmg1g2 :
                B_new.add((lcmg1g2,g1,g2))

        B_new = B_new.union(E)

        G_new = list()

        while G != list():
            g = G.pop()
            if not R.monomial_divides( h.lm(), g.lm() ):
                G_new.append(g)

        G_new.append(h)

        return G_new,B_new

    def update_simple(self,G, P, h):
        """
        Adding all critical pairs

        INPUT:
            G -- an intermediate Groebner basis
            B -- a list of critical pairs
            h -- a polynomial

        OUTPUT:
            an intermediate Groebner basis, a list of critical pairs
        
        """
        return G+[h],P.union([self.pair(g,h) for g in G])


class F4(F4_orig):
    """
    The improved F4 as described in Faugere's paper.
    """

    def __call__(self, F, Sel=None, Update=None, protocol=False):
        """
        INPUT:
            F      -- a finite subset of R[x]
            Sel    -- selection strategy
            Update -- update pairs to select critical pairs to compute

        OUTPUT:
            G -- a Groebner Basis for F
        """
        self.protocol = protocol
        
        if is_Ideal(F):
            F = F.gens()

        # pretty looking code
        Left = self.left
        Right = self.right
        Reduction = self.reduction
        first = self.first
        if Sel==None: Sel = self.normal_strategy
        if Update==None: Update = self.update_pairs
        
        self.ring = F[0].parent()
        self.ring._singular_().set_ring()
        self.term_order = self.ring.term_order()

        # We maintain a list of dictionaries which contain f.lm() => f
        # maps for the sets $F_j^~$ to allow O(1) lookups for this code:
        #"$F_j^~$ is the row echelon form of F_j w.r.t. < there exists a
        # (unique) $p \in F_j^~ such that LM(p) = LM(u*f)"
        self.Ftd = [[]]
        
        F = list(F) #
        Fd = dict()

        G = list()
        P = set()
        i = 0

        while F != list():
            f = first(F)
            F.remove(f)
            G,P = Update(G,P,f)
        sys.stdout.flush()

        while P != set(): 
            i += 1

            Pd, d = Sel(P)
            print "%2d"%(d),
            if self.protocol:
                print "P",sorted(P)
                print "P%d"%d,sorted(Pd)
                print "G",sorted(G)
            P = P.difference(Pd)
            Ld = Left(Pd).union( Right(Pd) )
            if self.protocol:
                print "L%d"%d,sorted(Ld)
            Fdp,Fd[i] = Reduction(Ld,G,Fd)
            for h in Fdp:
                G,P = Update(G,P,h)
        return G

    def reduction(self,L,G,Fset,no_update=False):
        """
        INPUT:
            L -- a finite subset of M x R[x]
            G -- a finite subset of R[x]
            F -- (F_k)k=1,\dots,(d-1), where F_k is finite subset of R[x]

        OUTPUT:
            F~+,F 
        """
        F = self.symbolic_preprocessing(L,G,Fset)
        #print max([len(f.dict()) for f in F])
        if self.protocol:
            print " F", sorted(F)

        Ft = self.row_echelon(F)
        if self.protocol:
            print " Ft", sorted(Ft)

        LMF = LM(F)
        Ftp = list(set([f for f in Ft if f.lm() not in LMF]))

        if self.protocol:
            print " Ftp", sorted(Ftp)
        if not no_update:
            # maintain the f.lm()=>f dictionary
            self.Ftd.append( dict([(f.lm(),f) for f in Ft]) )
        return Ftp,F

    def symbolic_preprocessing(self,L,G,Fset):
        """
        INPUT:
            L -- a finite subset of M x R[x]
            G -- a finite subset of R[x
            F -- (F_k)k=1,\dots,(d-1), where F_k is finite subset of R[x]

        OUTPUT:
            a finite subset of R[x]
        """
        Simplify = self.simplify
        R = self.ring
        Mul = lambda (m,f): m*f

        F = set([Mul(Simplify(m,f,Fset)) for (m,f) in L])
        if self.protocol:
            print "  F",sorted(F)

        Done = LM(F)

        if self.protocol:
            print "  Done",sorted(Done)
        
        M = set([m for f in F for m in f.monomials()])

        if self.protocol:
            print "  T(F)",sorted(M)

        MdivDone = M.difference(Done)
        zero = R(0)
        G = tuple(G)

        while MdivDone != set():#M != Done
            #m = M.difference(Done).pop()
            m = MdivDone.pop()
            Done.add(m)
            t,g = self.ring.monomial_reduce(m,G)
            if t!=zero:
                tg = Mul(Simplify(t,g,Fset))
                F.add(tg)
                # M = set([m for f in F for m in f.monomials()])
                for tgm in tg.monomials():
                    M.add(tgm)
                    if tgm not in Done:
                        MdivDone.add(tgm)
        return F

    def simplify(self,t,f,F):
        """
        INPUT:
            t -- \in M a monomial
            f -- \in R[x] a polynomial
            F -- (F_k)k=1,\dots,(d-1), where F_k is finite subset of R[x]

        OUTPUT:
            a non evaluated product, i.e. an element of M x R[x]
        """
        for u in sorted(self.ring.monomial_all_divisors(t),reverse=True):
            uf = u*f
            for j in F:
                if uf in F[j]:
                    # F~_j is the row echelon form of F_j w.r.t. <
                    # there exists a (unique) p \in F~_j such that LM(p) = LM(u*f)
                    p = self.Ftd[j][uf.lm()]
                    if u!=t:
                        return self.simplify(self.ring.monomial_quotient(t,u),p,F) #t/u
                    else:
                        return (self.ring(1),p)
        return (t,f)
    

    def first(self,G):
        """
        Returns the largest element of G.

        INPUT:
            G -- a finite subset of G

        OUTPUT:
            a polynomial \in G
        
        """
        mg = G[0]
        mm = mg.lm()
        for g in G:
            if g.lm() > mm:
                mm = g.lm()
                mg = g
        return mg

def LM(F):
    """
    """
    if isinstance(F,(list,set,tuple)):
        return set([f.lm() for f in F])
    else:
        return F.lm()