Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Fine-Grained Cryptanalysis: Tight Conditional Bounds for Dense k-SUM and k-XOR

Itai Dinur, Nathan Keller, Ohad Klein

TL;DR

This work studies conditional hardness of dense average-case $k$-SUM and $k$-XOR under a standard conjecture, establishing near-optimality of known dense-regime algorithms for $k=3,4,5$ and partial results for larger $k$. The authors introduce a self-reduction that converts a sparse instance into many dense instances and an obfuscation mechanism that injects noise to decorrelate dense-instance solutions, enabling a reliable reduction back to the original problem. They develop Fourier-analytic techniques to bound correlations and prove that, with high probability, a dense-instance solution translates into a sparse-instance solution, yielding tight density-time tradeoffs. The results have cryptanalytic significance by linking dense-regime hardness to sparse-average-case assumptions, with implications for security proofs and potential extensions to broader parameter ranges.

Abstract

An average-case variant of the $k$-SUM conjecture asserts that finding $k$ numbers that sum to 0 in a list of $r$ random numbers, each of the order $r^k$, cannot be done in much less than $r^{\lceil k/2 \rceil}$ time. On the other hand, in the dense regime of parameters, where the list contains more numbers and many solutions exist, the complexity of finding one of them can be significantly improved by Wagner's $k$-tree algorithm. Such algorithms for $k$-SUM in the dense regime have many applications, notably in cryptanalysis. In this paper, assuming the average-case $k$-SUM conjecture, we prove that known algorithms are essentially optimal for $k= 3,4,5$. For $k>5$, we prove the optimality of the $k$-tree algorithm for a limited range of parameters. We also prove similar results for $k$-XOR, where the sum is replaced with exclusive or. Our results are obtained by a self-reduction that, given an instance of $k$-SUM which has a few solutions, produces from it many instances in the dense regime. We solve each of these instances using the dense $k$-SUM oracle, and hope that a solution to a dense instance also solves the original problem. We deal with potentially malicious oracles (that repeatedly output correlated useless solutions) by an obfuscation process that adds noise to the dense instances. Using discrete Fourier analysis, we show that the obfuscation eliminates correlations among the oracle's solutions, even though its inputs are highly correlated.

Fine-Grained Cryptanalysis: Tight Conditional Bounds for Dense k-SUM and k-XOR

TL;DR

This work studies conditional hardness of dense average-case -SUM and -XOR under a standard conjecture, establishing near-optimality of known dense-regime algorithms for and partial results for larger . The authors introduce a self-reduction that converts a sparse instance into many dense instances and an obfuscation mechanism that injects noise to decorrelate dense-instance solutions, enabling a reliable reduction back to the original problem. They develop Fourier-analytic techniques to bound correlations and prove that, with high probability, a dense-instance solution translates into a sparse-instance solution, yielding tight density-time tradeoffs. The results have cryptanalytic significance by linking dense-regime hardness to sparse-average-case assumptions, with implications for security proofs and potential extensions to broader parameter ranges.

Abstract

An average-case variant of the -SUM conjecture asserts that finding numbers that sum to 0 in a list of random numbers, each of the order , cannot be done in much less than time. On the other hand, in the dense regime of parameters, where the list contains more numbers and many solutions exist, the complexity of finding one of them can be significantly improved by Wagner's -tree algorithm. Such algorithms for -SUM in the dense regime have many applications, notably in cryptanalysis. In this paper, assuming the average-case -SUM conjecture, we prove that known algorithms are essentially optimal for . For , we prove the optimality of the -tree algorithm for a limited range of parameters. We also prove similar results for -XOR, where the sum is replaced with exclusive or. Our results are obtained by a self-reduction that, given an instance of -SUM which has a few solutions, produces from it many instances in the dense regime. We solve each of these instances using the dense -SUM oracle, and hope that a solution to a dense instance also solves the original problem. We deal with potentially malicious oracles (that repeatedly output correlated useless solutions) by an obfuscation process that adds noise to the dense instances. Using discrete Fourier analysis, we show that the obfuscation eliminates correlations among the oracle's solutions, even though its inputs are highly correlated.

Paper Structure

This paper contains 63 sections, 26 theorems, 144 equations, 1 figure.

Table of Contents

  1. Introduction
  2. Background
  3. The $k$-SUM problem.
  4. The $k$-XOR problem.
  5. Wagner's $k$-tree algorithm.
  6. Our results
  7. Informal statement of the main results.
  8. Discussion.
  9. Our methods
  10. The reduction for $k$-XOR.
  11. The reduction for $k$-SUM.
  12. Related work
  13. Algorithms for dense $k$-SUM and $k$-XOR.
  14. Fine-grained complexity.
  15. Asymptotic hardness for dense $k$-SUM.
  16. ...and 48 more sections

Key Result

Theorem 1.5

Assume that any algorithm that solves $(k,N,N^{1/k})$-SUM with probability $\Omega_k(1)/(\log N)^2$ has expected running time of at least $T = T(N,k)$. Then, there is $C=C(k)$ such that for any $0 \leq \epsilon \leq 1/2$, any algorithm that solves $(k,N',(N')^{(1 + \epsilon)/k})$-SUM with probabilit

Figures (1)

  • Figure 1: $k$-SUM and $k$-XOR density-complexity tradeoff lower and upper bounds for $k = 3,4,8$

Theorems & Definitions (66)

  • Definition 1.1: Average-case $k$-SUM problem
  • Conjecture 1.2: Sparse average-case $k$-SUM conjecture
  • Definition 1.3: Average-case $k$-XOR problem
  • Conjecture 1.4: Sparse average-case $k$-XOR conjecture
  • Theorem 1.5: Conditional dense $k$-SUM hardness, informal
  • Remark 1.6
  • Theorem 1.7: Conditional dense $k$-XOR hardness, informal
  • Theorem 1.8: Conditional dense $k$-XOR hardness, informal, reformulated
  • Remark 1.9
  • Theorem 3.1: Sparse to dense $k$-XOR reduction
  • ...and 56 more