We revisit the polynomial attack to the \(\textsf{ROS}\) problem modulo p from [6]. Our new algorithm achieves a polynomial time solution in dimension \(\ell \gtrsim 0.726 \cdot \log _2 p\) , extending the range of dimensions for which a polynomial attack is known beyond the previous bound of \(\ell > \log _2p\) . We also combine our new algorithm with Wagner’s attack to improve the general \(\textsf{ROS}\) attack complexity for a range of dimensions where a polynomial solution is still not known. We implement our polynomial attack and break the one-more unforgeability of blind Schnorr signatures over 256-bit elliptic curves in a few seconds with 192 concurrent sessions.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Dimensional e \(\textsf{ROS}\) ion: Improving the  \(\textsf{ROS}\) Attack with Decomposition in Higher Bases

  • Antoine Joux,
  • Julian Loss,
  • Giacomo Santato

摘要

We revisit the polynomial attack to the \(\textsf{ROS}\) problem modulo p from [6]. Our new algorithm achieves a polynomial time solution in dimension \(\ell \gtrsim 0.726 \cdot \log _2 p\) , extending the range of dimensions for which a polynomial attack is known beyond the previous bound of \(\ell > \log _2p\) . We also combine our new algorithm with Wagner’s attack to improve the general \(\textsf{ROS}\) attack complexity for a range of dimensions where a polynomial solution is still not known. We implement our polynomial attack and break the one-more unforgeability of blind Schnorr signatures over 256-bit elliptic curves in a few seconds with 192 concurrent sessions.