Beyond Explicit Generators: Distribution-Free Linear-Decomposition Attacks on Public-Key Encryption

2026-08-21

AI Summary

研究通过仅使用公开的采样与评估接口，无需恢复秘密代数动作，利用线性分解攻击破解公钥加密方案，证明了在特定条件下此类攻击的有效性和安全性界限。

Abstract

Linear-decomposition attacks can break public-key schemes without recovering the secret algebraic action: when a target public state lies in a known linear span, its decomposition coefficients transfer through the unknown action to reveal the shared value. We study a setting in which the adversary uses only the public sampling-and-evaluation oracle available to honest participants, the induced distribution is arbitrary, and the goal is to attack future ciphertexts rather than recover the full algebraic span. We model public paired samples under a fixed secret linear transport and define the sampled-orbit dimension as the effective dimension of the encryption distribution. We prove distribution-free one-shot recovery, a high-probability certificate for the future-ciphertext coverage of a sampled span, and the optimal sampled-span complexity $m^\star_{\mathrm{span}}(r,\varepsilon,δ) =Θ((r+\log(1/δ))/\varepsilon)$. These results yield a generic impossibility theorem: publicly samplable linear key transport with polynomial sampled-orbit dimension is incompatible with IND--CPA security when the transported value determines the decryption payload. We apply the framework to the 2024 probabilistic PKE from twisted--skew group rings. Its underlying Computational Twisted--Skew Problem admits a sampler-only linear attack using independently generated public protocol samples, yielding plaintext recovery and constant IND--CPA advantage. Experiments verify the linear transport and end-to-end recovery, and show that high future-ciphertext coverage may precede recovery of the full algebraic span.

Problem

• public-key encryption
• linear-decomposition attacks
• distribution-free
• future ciphertexts
• IND-CPA security

Innovation

• Linear-decomposition attacks
• Distribution-free
• Sampled-orbit dimension
• Public-key encryption
• IND-CPA security