ALGORITHMS FOR SOLVING LINEAR AND POLYNOMIAL ...

2.3 The Formulation of Keeloq2.3.1 What is Algebraic Cryptanalysis?Given a particular cipher, algebraic cryptanalysis consists of two steps. First,one must convert the cipher and possibly some supplemental information (e.g. fileformats) into a system of polynomial equations, usually over GF(2), but sometimesover other rings. Second, one must solve the system of equations and obtain fromthe solution the secret key of the cipher.This chapter deals with the first steponly. The systems of equations were solved with Singular [sin], Magma [mag], andwith the techniques of Chapter 3, as well as ElimLin, software by Nicolas Courtoisdescribed in [CB06].2.3.2 The CSP ModelIn any constraint satisfaction problem, there are several constraints in severalvariables, including the key. A solution must satisfy all constraints, so there arepossibly zero, one, or more than one solution.The constraints are models of acipher’s operation, representing known facts as equations.Most commonly, thisincludes µ plaintext-ciphertext pairs, P 1 , . . . , P µ and C 1 , . . . , C µ , and the µ facts:E(P i ) = C i for all i ∈ {1, . . . , µ}. Almost always there are additional constraintsand variables besides these.If no false assumptions are made, because these messages were indeed sent,we know there must be a key that was used, and so at least one key satisfies allthe constraints. And so it is either the case that there are one, or more than one8