HNP-SUM: Hidden Number Problem With Small Unknown Multipliers in Python

Python and Sage Reproduction of HNP-SUM paper

Abstract for The Hidden Number Problem with Small Unknown Multipliers: Cryptanalyzing MEGA in Six Queries and Other Applications (Heninger & Ryan, 2023)

This is part of our series on Practical Hidden Number Problems for Programmers:

*These links are paywalled. (It’s how I’ll afford grad school lol)

Part 1: Quantum Computing and Intro to Hidden Number Problems

Part 2: Increasing Lattice Volume for Improved HNP Attacks

Part 3: Hidden Number Problems with Multiple Noise Holes

Part 4: Hidden Number Problems with Chosen Multipliers

Part 5: Hidden Number Problems with Chosen Errors

Part 6 : Solving Hidden Number Problems Without Lattices

Part 7 : Fourier Analysis Attacks on HNPs with Bleichenbacher’s algorithm.

Part 8 (we are here): Hidden Number Problems with Small Unknown Multipliers.

As usual, code is available on GitHub and Google Colab.

1.0 Introduction

HNP-SUM problem statement. Taken from Definition 1 (Heninger & Ryan, 2023)

The Hidden Number Problem with Small Unknown Multipliers: Cryptanalyzing MEGA in Six Queries and Other Applications (Heninger & Ryan, 2023)¹ introduces the HNP-SUM problem, the challenge of recovering unknown multipliers (not unknown keys) using a lattice approach.

The author’s approach can be summarized in three steps (Ryan, 2023)²:

1. Eliminate the private key x from the system of equations:

   

   Eliminate x. Taken from Slide 11 of (Ryan, 2023)

2. Reduce the lattice basis:

   

   Lattice basis. Taken from section 3.2 of (Heninger & Ryan, 2023)

3. Find the Hermite Normal Form of the reduced basis to obtain target multipliers.

We saw how to find the Hermite Normal Form earlier:

LLL Applied To Extended GCD, Hermite Normal Form

2.0 Coding HNP-SUM in Python

Code is available on GitHub and Google Colab.

We install fpylll and cysignals to proceed:

Installing libraries

2.1 Theorem 1: Testing for Solution Existence

Conditions for existence of a solution. Taken from Theorem 1 (Heninger & Ryan, 2023)

Where T and E are known size bounds for the multiplier and error term, N is our field characteristic, and n is the number of samples, the authors prove that HNP-SUM can be solved in polynomial time.

Python code resembles:

Coding Theorem 1 in Python

2.2 HNP-SUM Dataset Generator

HNP-SUM is unlike other HNPs because we only know the observation. We don’t know the multipliers, errors or secret key:

HNP-SUM problem statement. Taken from Definition 1 (Heninger & Ryan, 2023)

We proceed to generate a dataset for the HNP-SUM problem.

Dataset generation in Python

2.3 Lattice Construction

General basis construction. Taken from section 3.2 of (Heninger & Ryan, 2023)

We follow the basis construction above. For the curious, here’s an example with 3 samples to demonstrate how the basis works:

How basis works

In Python, we use fpylll to construct the lattice as:

Lattice construction using fpyll

2.4 Finding Solutions with Hermite Normal Form

Simple lattice reduction won’t reveal our desired basis vectors since t1 and t2 are not coprime:

Non-coprime nature of multipliers prevents lattice from revealing targets. Taken from section 3.1 of (Heninger & Ryan, 2023)

(Heninger & Ryan, 2023) overcome this ‘non-coprime’ challenge by finding the Hermite Normal Form of a sub-lattice of the reduced basis.

Lemma 2 proves that this sub-lattice is equivalent to taking out the final 2 rows of the reduced basis:

Choice of HNF matrix. Taken from Lemma 2 of (Heninger & Ryan, 2023)

Python code t0 extract this sub-lattice resembles:

Extract sub-lattice in Python

2.4.1 Testing Code

We test our code with the lattice from (Ryan, 2023):

HNP-SUM summary for three samples. Taken from Slide 11 of (Ryan, 2023)

In Python, we do this to obtain the sub-lattice:

Python obtain sub-lattice

Then we use Sage Math’s HNF as stated in (Heninger & Ryan, 2023):

Using Sage math to compute HNF. Taken from section 3.7 of (Heninger & Ryan, 2023)

The sage code resembles:

Sage code to work with HNF

As expected, it works!

Expected solutions. Taken from Slide 11 of (Ryan, 2023)

For the curious, this is how one interprets the reduced basis and the expected HNF result:

Reduced basis and HNF result interpretation

2.4.2 Cryptographic Example

We run our Python sub-lattice generator with a 237-bit prime:

Large prime example

Observe that our expected multipliers are:

Expected multipliers

We export our sub-lattice to Sage and find the HNF:

Export sub-lattice to Sage

Then we print our HNF results and observe that it works!

HNF result

Our results have 8 and 13 (the signs may be wrong but we still have them, lol). It works!

References

1. Heninger, N., Ryan, K. (2023). The Hidden Number Problem with Small Unknown Multipliers: Cryptanalyzing MEGA in Six Queries and Other Applications. In: Boldyreva, A., Kolesnikov, V. (eds) Public-Key Cryptography – PKC 2023. PKC 2023. Lecture Notes in Computer Science, vol 13940. Springer, Cham. DOI.

2. Ryan, K. (2023). Slide Presentation 136: The Hidden Number Problem with Small Unknown Multipliers: Cryptanalyzing MEGA in Six Queries and Other Applications. IACR. Link.