4

This is a theoretical question to solve an argument with a friend..

Is there a working cryptographic system that do square root operations during the encryption process?

"Working" means that it is really implemented, and not just an academic research.

Hint: I suspect that it is not possible as computer hardware has floating point limitations as it is based on binary, causing infinitely small numbers to truncate, hence doing sqrt during encryption loses information, and cannot be undone during the decryption.

Please help me win the bet :)

adambg
  • 141
  • 3
  • 9
    You can definitely use non-reversible functions to construct reversible ones, e.g. in a Feistel cipher. Also, if square roots in a finite field count, those can be reversible. (Also, the Rabin cryptosystem probably merits at least a passing mention, even though it only requires computing (modular) square roots for decryption, not for encryption.) – Ilmari Karonen Apr 08 '19 at 14:53
  • There's some relevant rounding stuff at Could there be a floating point CSPRNG? – Paul Uszak Apr 08 '19 at 15:05
  • 2
    The initialization vectors of the SHA-2 functions are the binary expansions of the fractional parts of the (real number) square roots of small prime numbers. The SHA-2 functions are often used with encryption, e.g. in a key derivation function for a public-key encryption scheme. Does that count? – Squeamish Ossifrage Apr 08 '19 at 15:39
  • 2
    Actually, if your CPU does IEEE math (universal nowadays), that places very strict requirements on the accuracy of the floating sqrt operation. Of course, you still have to account for the varying degrees of precision that various implementations provide, but it would be possible (however, I haven't heard of anyone actually doing it) – poncho Apr 08 '19 at 15:49
  • I think there's also some cipher that uses the middle square method for diffusion, but I forget if it was a block cipher or stream cipher or hash. Granted, squaring is not the same as taking a square root, but still. – forest Apr 09 '19 at 23:04
  • I think Rabbit is the cipher I was thinking of which uses some sort of middle square method. – forest Mar 14 '22 at 02:18

1 Answers1

5

I'm not aware of any cipher which uses square root as a primitive operation, and I suspect that none exist. Cipher designers tend to prefer a large number of simple operations to a lesser number of complex ones. The most complex operation used in practice is multiplication, and even that is not extremely common. The most complex mathematical operations I know of used in a cipher are exponentiation and logarithms. From a quote by James Massey on the use of complex functions:

I have many times used the discrete exponential or the discrete logarithm as nonlinear cryptographic functions and they have never let me down.

There is no reason why a square root operation would need to return a floating point value (for example, in 8-bit integer arithmetic, $\sqrt50=7$, though it's likely that taking the fractional part of the square root would be more beneficial for causing diffusion and promoting nonlinearity), so it is possible to use, technically. It's perfectly possible to return an integer and still achieve diffusion. I have a few guesses as to why no cipher uses square roots as a cryptographic mixing operation:

  • It's difficult to write a fast constant time implementation, which is necessary to avoid side-channels.

  • The nonlinear properties it provides are not well-researched compared to other operations.

  • It is a complex and slow function, and cryptographers often prefer many simple and fast functions.

  • Unless done in a finite field, it is impossible to reverse the operation (which is often useful).

If you loosen your requirements, then the Rabin cryptosystem may fit the bill. It's an asymmetric cipher and is very similar to RSA, but with the public exponent fixed to $2$. This means that decryption involves computing modular square roots. It's very possible that there is other asymmetric cryptography which makes use of square root operations, but I can't think of any off the top of my head.

If you can expand your requirements to any $n^\text{th}$-root operations, then the broken KN-Cipher from 1995 may be relevant. Its round function is based on the cube root operation in $\operatorname{GF}(2^{33})$. Computing cube roots is also a simpler and faster process than computing square roots.

forest
  • 15,253
  • 2
  • 48
  • 103
  • Nothing inherently wrong with floating-point sqrt as a reliably computed function from bit strings to bit strings! It's one of the mandatory correctly rounded IEEE 754 operations. (But its cryptographic value is limited.) – Squeamish Ossifrage Apr 08 '19 at 19:21
  • Yes of course and there is no "decryption" by square roots :-) – kodlu Apr 08 '19 at 20:31
  • 2
    @PaulUszak I'm not talking about IEEE floating point. And your statement is incorrect. $\forall x$ means for all $x$, but it's easy to create an $x$ whose square root is the same regardless of the bus width (e.g. $x=64$). – forest Apr 09 '19 at 00:19
  • Well spotted - lazy copy & paste. – Paul Uszak Apr 09 '19 at 00:27