International Association for Cryptologic Research

International Association
for Cryptologic Research


Cryptanalysis of Symmetric Primitives over Rings and a Key Recovery Attack on Rubato

Lorenzo Grassi , Ruhr University Bochum
Martha Norberg Hovd , Simula UiB
Irati Manterola Ayala , Simula UiB
Håvard Raddum , Simula UiB
Qingju Wang , Telecom Paris, Institut Polytechnique de Paris
Morten Øygarden , Simula UiB
DOI: 10.1007/978-3-031-38548-3_11 (login may be required)
Search ePrint
Search Google
Presentation: Slides
Conference: CRYPTO 2023
Abstract: Symmetric primitives are a cornerstone of cryptography, and have traditionally been defined over fields, where cryptanalysis is now well understood. However, a few symmetric primitives defined over rings Z _q for a composite number q have recently been proposed, a setting where security is much less studied. In this paper we focus on studying established algebraic attacks typically defined over fields and the extent of their applicability to symmetric primitives defined over the ring of integers modulo a composite q. Based on our analysis, we present an attack on full Rubato, a family of symmetric ciphers proposed by Ha et al. at Eurocrypt 2022 designed to be used in a transciphering framework for approximate fully homomorphic encryption. We show that at least 25% of the possible choices for q satisfy certain conditions that lead to a successful key recovery attack with complexity significantly lower than the claimed security level for five of the six ciphers in the Rubato family.
  title={Cryptanalysis of Symmetric Primitives over Rings and a Key Recovery Attack on Rubato},
  author={Lorenzo Grassi and Martha Norberg Hovd and Irati Manterola Ayala and Håvard Raddum and Qingju Wang and Morten Øygarden},