\section{The Hierarchization Problem}
\label{sec:41problem}

Let $\sgset \subset \clint{0, 1}^d$ be a general (sparse) grid that
may be spatially adaptive, i.e.,
of the form $\sgset = \{\gp{\*l,\*i} \mid (\*l, \*i) \in \liset\}$,
where $\liset$ is a set of level-index pairs $(\*l, \*i)$ with $\*l \in \natz^d$
and $\*i \in \hiset{\*l}$ such that
$\ngp \ceq \setsize{\sgset} = \setsize{\liset} < \infty$
(see \cref{sec:233spatiallyAdaptiveSG}).
The \term{hierarchization problem} is finding
\term{hierarchical surpluses}
$(\surplus{\*l',\*i'})_{(\*l',\*i') \in \liset} \in \real^{\ngp}$ such that
\begin{equation}
  \label{eq:hierarchizationProblem}
  \largesum{(\*l', \*i') \in \liset} \surplus{\*l',\*i'}
  \basis{\*l',\*i'}(\gp{\*l,\*i}) = \fcnval{\*l,\*i}
  \quad\text{for all}\quad
  (\*l, \*i) \in \liset,
\end{equation}
where $\basis{\*l',\*i'}$ are arbitrary tensor product basis functions and
$(\fcnval{\*l,\*i})_{(\*l,\*i) \in \liset} \in \real^{\ngp}$ is a set of
function values $\objfun(\gp{\*l,\*i})$
at the grid points $\gp{\*l,\*i}$.
This then defines the interpolant $\sgintp$ as
\begin{equation}
  \label{eq:hierarchizationInterpolant}
  \sgintp\colon \clint{\*0, \*1} \to \real,\quad
  \sgintp \ceq
  \largesum{(\*l', \*i') \in \liset} \surplus{\*l',\*i'}
  \basis{\*l',\*i'},
\end{equation}
which interpolates $\objfun$ at the grid points $\gp{\*l,\*i}$ of $\sgset$.
\Cref{fig:hierarchization} shows the process of hierarchizing given
function values and evaluating the resulting interpolant.

\begin{figure}
  \subcaptionbox{%
    The objective function $\objfun$ is sampled at the grid points
    $\gp{l,i} \in \sgset$ to obtain function values $\fcnval{l,i}$,
    which form the input vector $\vlinin$ for the linear operator
    $\linop = \intpmatinv$.%
  }[46mm]{%
    \includegraphics{hierarchization_1}%
  }%
  \hfill%
  \subcaptionbox{%
    The linear operator $\linop$ is applied to $\vlinin$ to obtain
    the output vector $\vlinout$, which contains the hierarchical surpluses
    $\surplus{l,i}$ ($(l,i) \in \liset$).%
  }[46mm]{%
    \includegraphics{hierarchization_2}%
  }%
  \hfill%
  \subcaptionbox{%
    The interpolant $\sgintp$ \emph{(black dashed line)}
    is evaluated at $x \in \clint{0, 1}$
    by adding contributions \emph{(black dotted lines)}
    of weighted basis functions $\surplus{l,i} \basis{l,i}$
    \emph{(colored),} obtaining $\sgintp(x)$ \emph{(cross).}%
  }[46mm]{%
    \includegraphics{hierarchization_3}%
  }%
  \caption[%
    Hierarchization of function values and evaluation of interpolant%
  ]{%
    Hierarchization of function values $\fcnval{l,i}$ \emph{(left)}
    to obtain hierarchical surpluses $\surplus{l,i}$ \emph{(center)} and
    evaluation of the resulting interpolant $\sgintp$ \emph{(right),}
    using a univariate grid and the piecewise linear basis as an example.%
  }%
  \label{fig:hierarchization}%
\end{figure}

We explicitly allow $\basis{\*l',\*i'}$ to be nodal basis functions,
in which case $\*l'$ is constant and
$\sgset$ is a full grid.
Strictly speaking, the problem is then an \term{interpolation problem}
and the $\surplus{\*l',\*i'}$ are \term{interpolation coefficients.}
However, we still apply the terms
``hierarchization'' and ``hierarchical surpluses'' in this case
to keep the terminology consistent.

\paragraph{Hierarchization as a linear operator}

The example of hierarchization can be generalized
to arbitrary linear operators
\begin{equation}
  \linop\colon \real^{\ngp} \to \real^{\ngp},\quad
  \vlinin \mapsto \vlinout = \linop[\vlinin],
\end{equation}
where $\linop$ depends on the grid $\sgset$ at hand.
Input $\vlinin$ and output $\vlinout$ are scalar-valued data%
\begin{equation}
  \vlinin = (\linin{\*l,\*i})_{(\*l,\*i) \in \liset} \in \real^{\ngp},\quad
  \vlinout = (\linout{\*l,\*i})_{(\*l,\*i) \in \liset} \in \real^{\ngp},
\end{equation}
which give one scalar per grid point $\gp{\*l,\*i} \in \sgset$.
For the case of hierarchization,
$\linop$ is the inverse of the \term{interpolation matrix}
$\intpmat \in \real^{\ngp \times \ngp}$:
\begin{subequations}
  \label{eq:hierarchizationSLE}
  \begin{equation}
    \linop = \intpmatinv,\quad
    \intpmat = (\basis{\*l',\*i'}(\gp{\*l,\*i}))_%
    {(\*l,\*i),(\*l',\*i') \in \liset},\quad
    \vlinin = (\fcnval{\*l,\*i})_{(\*l,\*i) \in \liset},\quad
    \vlinout = (\surplus{\*l',\*i'})_{(\*l',\*i') \in \liset}.
    \hspace*{-1mm}
  \end{equation}
  This means that we can determine the $\surplus{\*l',\*i'}$ by solving
  the $\ngp \times \ngp$ system of linear equations
  \begin{equation}
    \vlinout = \linop[\vlinin]
    \quad\iff\quad
    \intpmat \cdot (\surplus{\*l',\*i'})_{(\*l',\*i') \in \liset}
    = (\fcnval{\*l,\*i})_{(\*l,\*i) \in \liset}.
  \end{equation}
\end{subequations}

\paragraph{Complexity of B-spline hierarchization}

As noted in \cite{Valentin18Fundamental},
hierarchization on sparse grids with hierarchical B-splines
$\bspl{\*l,\*i}{\*p}$ of degree $\*p$
as basis functions $\basis{\*l,\*i}$ is a tedious task.
The corresponding linear system \eqref{eq:hierarchizationSLE} is in general
non-symmetric
(i.e., $\bspl{\*l',\*i'}{\*p}(\gp{\*l,\*i}) \not=
\bspl{\*l,\*i}{\*p}(\gp{\*l',\*i'})$) and densely populated.
This is because the matrix entry in the $(\*l,\*i)$-th row and
$(\*l',\*i')$-th column vanishes if and only if
\begin{equation}
  \gp{\*l,\*i} \notin \interiorsupp \bspl{\*l',\*i'}{\*p}
  \iff
  \exlarge{t = 1, \dotsc, d}{
    \gp{l_t,i_t} \notin
    \opintscaled{
      \gp{l'_t,i'_t} - \tfrac{p_t+1}{2} \ms{l'_t},\,
      \gp{l'_t,i'_t} + \tfrac{p_t+1}{2} \ms{l'_t}
    }
  },
\end{equation}
where $\interiorsupp$ is the interior of the support
\cite{Valentin18Fundamental}.
For coarse levels $\*l'$, the mesh size $\ms{l'_t}$ is large in
every dimension $t$, which implies that $\interiorsupp \bspl{\*l',\*i'}{\*p}$
contains most of the grid points.
In contrast to the hat function case ($\*p = \*1$),
the value of $\surplus{\*l',\*i'}$ depends not only on
$\fcnval{\*l,\*i}$ and the data of the $3^d - 1$ neighboring grid points
on the boundary of $\supp \bspl{\*l',\*i'}{\*1}$,
but potentially on the data of the whole grid.
This is shown in \cref{fig:matrixDensityPattern}:
There are at most $3^d = 9$ non-zero entries in each row of $\intpmatinv$
for $\*p = \*1$ and $d = 2$.
As soon as the B-spline degree is increased,
both $\intpmat$ and $\intpmatinv$ become significantly denser.

\begin{SCfigure}
  \includegraphics{matrixDensityPattern_1}%
  \caption[%
    Density pattern of hierarchization matrices and of their inverses%
  ]{%
    Density pattern
    of the hierarchization matrix $\intpmat$
    \emph{(middle row, \textcolor{C0}{blue})} and
    of its inverse $\intpmatinv$
    \emph{(bottom row, \textcolor{C1}{red})}
    for the regular sparse grid $\coarseregsgset{n}{d}{1}$
    with $n = 4$ and $d = 2$ \emph{(top row)}
    and uniform hierarchical B-splines $\bspl{\*l,\*i}{\*p}$
    for degrees $\*p \in \{\*1, \*3, \*5\}$.
    The \textcolor{C0}{blue areas} in the top row
    show the extent of the support of one specific basis function
    $\bspl{\*l',\*i'}{\*p}$ with $\*l' = (2, 2)$ and $\*i' = (1, 1)$
    (\emph{cross:} corresponding grid point $\gp{\*l',\*i'}$).
    The \textcolor{C0}{blue points} are the grid points at which
    $\bspl{\*l',\*i'}{\*p}$ is non-zero.%
  }%
  \label{fig:matrixDensityPattern}%
\end{SCfigure}

This prohibits the use of the \up\punctfix{,}
which we will discuss in the next section,
on sparse grids with hierarchical B-splines.
Consequently, we have to solve the linear system
\eqref{eq:hierarchizationSLE}, which is significantly more time-consuming,
as it takes between $\landauOmega{\ngp^2 d}$ and $\landauO{\ngp^2 (N+d)}$ time
via Gaussian elimination.%
\footnote{%
  $\landauOmega{\ngp^2 d}$ for assembling $\intpmat$ and
  $\landauO{\ngp^3}$ for solving the system.
}
In addition, if we use an explicit solver for the linear system,
we additionally have to store an $\ngp \times \ngp$ matrix in memory.
However, a grid of size $\ngp = \num{116000}$ already exceeds the memory
of a \SI{128}{\gibi\byte} supercomputer node,
if we explicitly store the full matrix in double precision.
In comparison, for the hat function basis,
the \up only requires $\landauO{\ngp d}$ time and $\landauO{\ngp}$ memory.

\paragraph{Notation}

We do not need the hierarchical level-index information $(\*l, \*i)$ in
$\sgset$, $\liset$, $\vlinin$, and $\vlinout$
for most of the considerations in this chapter.
In these cases, we assume that in each dimension $t$, the level-index pairs
$(l_t, i_t)$ ($l_t \in \natz$, $i_t \in \hiset{l_t}$)
are continuously enumerated by a single index $k_t = k_t(l_t, i_t) \in \natz$.
We identify $(\*l, \*i)$ with a single index $\*k$,
whose $t$-th component is given by $k_t(l_t, i_t)$.
Hence,
we regard $\liset$ as a subset $\liset \ceq \{\*k \mid \*x_\*k \in \sgset\}$
of $\natz^d$.
We will switch between the notations whenever appropriate.
All statements that are formulated in the $\*k$ notation are
valid for both the nodal and the hierarchical basis.

\usenotation{kT00}
In the following, $k_t$ denotes the $t$-th component of a $d$-vector $\*k$
as usual.
\usenotation{kT10}
With $\*k_{-t}$, we denote the $(d-1)$-vector that is obtained from $\*k$
by omitting the $t$-th component,
i.e., $\*k_{-t} \ceq (k_1, \dotsc, k_{t-1}, k_{t+1}, \dotsc, k_d)$.
\usenotation{kT20}
For a $j$-tuple $T = (t_1, \dotsc, t_j) \in \{1, \dotsc, d\}^j$,
we define $\*k_T$ to be the $j$-vector $(k_{t_1}, \dotsc, k_{t_j})$
that only contains the entries of the dimensions listed in $T$.
\usenotation{kT30}
Accordingly, $\*k_{-T}$ is defined as the $(d-j)$-vector
that contains the entries of the remaining dimensions
(sorted by the dimension $t$).
We define $\*k_{\range{a}{b}} \ceq (k_a, k_{a+1}, \dotsc, k_b)$
as an indexing shortcut ($a \le b$).


% !TEX root = ../../../proposal.tex
\label{sec:adapted-bb}

\subsection{Success probability of fractions}
\label{sec:fraction-probability}

For a given fraction $u/t$, the success probability with a randomly chosen
\tlsconform ciphertext can be computed as follows.  Let $m_0$ be a random
\tlsconform message, $m_1 = m_0 \cdot u/t$, and let $\ell_k$ be the expected
length of the unpadded message.  For $s = u/t \bmod N$ where $u$ and $t$ are coprime, $m_1$ will be \sslconform if the following conditions all hold:

\begin{enumerate}
	\item $m_0$ is divisible by $t$. For a randomly generated $m_0$, this
	condition holds with probability $1/t$.

	\item $m_1[1] = 0$ and $m_1[2] = 2$, or the integer
	$m \cdot u/t \in [2B, 3B)$.
	For a randomly generated $m_0$ divisible by $t$, this condition holds
	with probability
\begin{equation*}
P =
\begin{cases}
3 - 2 \cdot t/u & \text{for }   2/3 < u/t < 1 \\
3 \cdot t/u - 2 & \text{for }   1 < u/t < 3/2 \\
0 & \text{otherwise}
\end{cases}
\label{eq:oracle}
\end{equation*}

	\item $\forall i \in [3, \ell_m-(\ell_k+1)], m_1[i] \neq 0$, or all bytes
	between the first two bytes and the $(k+1)$ least significant bytes are
	non-zero.  This condition holds with probability
	$(1 - 1/256)^{\ell_m-(\ell_k+3)}$.

	\item $m_1[\ell_m-\ell_k] = 0$: the $(\ell_k+1)$st least significant
	byte is 0. This condition holds with probability $1/256$.
\end{enumerate}

\ifext
As an example, let us assume a 2048-bit RSA ciphertext with $\ell_k = 5$, and consider the fraction $u = 7, t = 8$.  We have
\begin{align*}
P(t|m_0)= 1/t &= 1/8 \\
P( m_1[1,2] = 00||02 \, \big\vert \, t|m_0) &= 0.71\\
P(\forall i \in [3, \ell_m-6] \, m_1[i] \neq 0) = (1 - 1/256)^{248} &= 0.37\\
P(m_1[\ell_m-5] = 0) &= 1/256
\end{align*}
\fi

Using the above formulas for $u/t = 7/8$,
the overall probability of success is $P = 1/8 \cdot 0.71 \cdot 0.37 \cdot 1/256 = 1 / 7,774$; thus the attacker expects to find an \sslconform ciphertext after testing 7,774 randomly chosen \tlsconform ciphertexts.  The attacker can decrease the number of \tlsconform ciphertexts needed by multiplying each candidate ciphertext by several fractions.

Note that testing random $s$ values until $c_1 = c_0 \cdot s^e \bmod N$ is \sslconform yields a success probability of
$P_{rnd} \approx (1/256)^3 * (255/256)^{249} \approx 2^{-25}$.

\subsection{Optimizing the chosen set of fractions}
\label{sec:fraction-optimization}
%Section~\ref{sec:adapted-bb-compact} already introduced the optimization that allows us to narrow the key space for a single query by observing that, for example, using the fraction $u/t=8/7$ results in the new candidate message $m_1 = m_0 / t \cdot u$ is divisible by $u=8$, and the last three bits of $m_1$ (and thus \texttt{master\_key}) are zero.

In order to deduce the validity of a single ciphertext, the attacker would have to perform a non-trivial brute-force search over all 5 byte \texttt{master\_key} values. This translates into $2^{40}$ encryption operations.

The search space can be reduced by an additional optimization, relying on the fractional multipliers used in the first step.
If the attacker uses $u/t=8/7$ to compute a new \sslconform candidate, and $m_0$ is indeed divisible by $t=7$,
then the new candidate message $m_1 = m_0 / t \cdot u$ is divisible by $u=8$, and the last three bits of $m_1$ (and thus \texttt{$mk_{secret}$}) are zero.
This allows reducing the searched \texttt{master\_key} space by selecting specific fractions.

More generally, for an integer $u$, the largest power of 2 by which $u$ is
divisible is denoted by $v_2(u)$, and multiplying by a fraction $u/t$ reduces
the search space by a factor of $v_2(u)$.
With this observation, the trade-off between the 3 metrics: the required number of intercepted ciphertexts, the required number of queries, and the required number of encryption attempts, becomes non-trivial to analyze.

Therefore, we have resorted to using simulations when evaluating the performance metrics for sets of fractions.
The probability that multiplying a ciphertext by any fraction out of a given set of fractions results in an \sslconform message is difficult to compute, since the events are in fact inter-dependent: If $m \cdot 16/15$ is conforming, then $m$ is divisible by $5$, greatly increasing the probability that $m \cdot 4/5$ is also conforming.
However, it is easy to perform a Monte Carlo simulation, where we randomly generate ciphertexts, and measure the probability that any fraction out of a given set produces a conforming message.
The expected required number of intercepted ciphertexts is the inverse of that probability.

Formally, if we denote the set of fractions as $F$, and the event that a message $m$ is conforming as $C(m)$, we perform a Monte Carlo estimation of the probability
$ P_F = P(\exists f \in F: C(m \cdot f)) $, and the expected number of required intercepted ciphertexts equals $1/{P_F}$.
The required number of oracle queries is simply $ 1/P_F \cdot |F| $.
Accordingly, the required number of server connections is $ 2 \cdot 1/P_F \cdot |F| $, since each oracle query requires two server connections.
And as for the required number of encryption attempts, if we denote this number when querying with a given fraction $f = u/t$ as $E_f$, then
$E_f = E_{u/t} = 2^{40-v_2(u)}$.
We further define the required encryption attempts when testing a ciphertext
with a given set of fraction $F$ as
$E_F = \sum_{f \in F} E_f$.
Then the required number of encryption attempts in Phase 1 for a given set of fractions is $(1/{P_F}) \cdot E_F$.

We can now give precise figures for the expected number of required intercepted ciphertexts, connections to the targeted server, and encryption attempts.
The results presented in Table~\ref{tab:reasonable_parameters} were obtained using the above approach with one billion random ciphertexts per fraction set $F$.

\subsection{Rotation and multiplier speedups}
\label{sec:rotation-details}

For a randomly chosen $s$, the probability that the two most significant bytes are $\hexb{00}{02}$ is $2^{-16}$; for a 2028-bit modulus $N$ the probability that the next $\ell_m - \ell_k - 3$ bytes of $m_2$ are all nonzero is about 0.37 as in the previous section, and the probability that the $\ell_k+1$ least significant delimiter byte is $\hex{00}$ is 1/256.  Thus a randomly chosen $s$ will work with probability $2^{-25.4}$ and the attacker expects to try $2^{25.4}$ values for $s$ before succeeding.

However, since the attacker has already learned $\ell_k+3$ most significant bytes of $m_1 \cdot R^{-1} \bmod N$,
for $\ell_k \ge 4$ and $s < 2^{30}$ they do not need to query the oracle to learn if the two most significant bytes are \sslconform; they can compute this themselves from their knowledge of $\tilde{m_1} \cdot R^{-1}$.  They iterate through values of $s$, test that the top two bytes of $\tilde{m_1} \cdot R^{-1} \bmod N$ are \hexb{00}{02}, and only query the oracle for $s$ values that satisfy this test. Therefore, for a 2048-bit modulus they expect to test $2^{16}$ values offline per oracle query.  The probability that a query is conformant is then $P = (1/256) * (255/256)^{249} \approx 1/678$, so they expect to perform 678 oracle queries before finding a fully \sslconform ciphertext $c_2 = (s \cdot R^{-1})^e c_1 \bmod N$.

We can speed up the brute force testing of $2^{16}$ values of $s$ using algebraic lattices.  We are searching for values of $s$ satisfying $\tilde{m_1} R^{-1} s < 3 B \bmod N$, or given an offset $s_0$ we would like to find solutions $x$ and $z$ to the equation $\tilde{m_1} R^{-1} (s_0 + x) = 2 B + z \bmod N$ where $|x| < 2^{16}$ and $|z| < B$.  Let $X =  2^{15}$.  We can construct the lattice basis
\[
L =
\begin{bmatrix}
-B & X\tilde{m_1} R^{-1} & \tilde{m_1} R^{-1} s_0 + B \\
0 & XN & 0 \\
0 & 0 & N
\end{bmatrix}
\]
We then run the LLL algorithm~\cite{lll} on $L$ to obtain a reduced lattice basis $V$ containing vectors $v_1, v_2, v_3$.  We then construct the linear equations $f_1(x,z) = v_{1,1}/B \cdot z +v_{1,2}/X \cdot x + v_{1,3} = 0$ and $f_2(x,z) = v_{2,1}/B \cdot z +v_{2,2}/X \cdot x + v_{2,3} = 0$ and solve the system of equations to find a candidate integer solution $x = \tilde{s}$.  We then test $s = \tilde{s} + s_0$ as our candidate solution in this range.

$\det L = XZN^2$ and $\dim L = 3$, thus we expect the vectors $v_i$ in $V$ to have length approximately $|v_i| \approx (XZN^2)^{1/3}$.  We will succeed if $|v_i| < N$, or in other words $XZ < N$.  $N \approx 2^{8\ell_m}$, so we expect to find short enough vectors. This approach works well in practice and is significantly faster than iterating through $2^{16}$ possible values of $\tilde{s}$ for each query.

In summary, given an \sslconform ciphertext $c_1 = m_1^e \bmod N$, we can efficiently generate an \sslconform ciphertext $c_2 = m_2^e \bmod N$ where $m_2 = s \cdot m_1 \cdot R^{-1} \bmod N$ and we know several most significant bytes of $m_2$, using only a few hundred oracle queries in expectation.  We can iterate this process as many times as we like to continue generating \sslconform ciphertexts $c_i$ for which we know increasing numbers of most significant bytes, and which have a known multiplicative relationship to our original message $c_0$.

\subsection{Rotations in the general DROWN attack}
\label{sec:general-rotations}
After the first phase, we have learned an \sslconform ciphertext $c_1$, and we wish to shift known plaintext bytes from least to most significant bits.
Since we learn the least significant 6 bytes of plaintext of $m_1$ from a successful oracle $\OracleSSLexp$ query, we could use a shift of $2^{-48}$ to transfer 48 bits of known plaintext to the most significant bits of a new ciphertext.  However, we perform a slight optimization here, to reduce the number of encryption attempts.  We instead use a shift of $2^{-40}$, so that the least significant byte of $m_1 \cdot 2^{-40}$ and $\tilde{m_1} \cdot 2^{-40}$ will be known.  This means that we can compute the least significant byte of $m_1 \cdot 2^{-40} \cdot s \bmod N$, so oracle queries now only require $2^{32}$ encryption attempts each. This brings the total expected number of encryption attempts for each shift to $2^{32} * 678 \approx 2^{41}$.

We perform two such plaintext shifts in order to obtain an \sslconform message, $m_3$ that resides in a narrow interval of length at most $2^{8\ell-66}$. We can then obtain a multiplier $s_3$ such that $m_3 \cdot s_3$ is also \sslconform.
Since $m_3$ lies in an interval of length at most $2^{8\ell-66}$, with high probability for any $s_3 < 2^{30}$, $m_3 \cdot s_3$ lies in an interval of length  at most $2^{8\ell_m-36} < B$, so we know the two most significant bytes of $m_3 \cdot s_3$.
Furthermore, we know the value of the 6 least significant bytes after multiplication.
We therefore test possible values of $s_3$, and for values such that
$m_3 \cdot s_3 \in [2B, 3B)$, and $(m_3 \cdot s_3) [\ell_m - 5] = 0$,
we query the oracle with $c_3 \cdot s_3^e \bmod N$.
The only condition for PKCS conformance which we haven't verified before querying the oracle is the requirement of non-zero padding, which holds with probability 0.37.

In summary, after roughly $1 / 0.37 = 2.72$ queries we expect a positive response from the oracle.
Since we know the value of the 6 least significant bytes after multiplication,
this phase does not require performing an exhaustive search. If the message is \sslconform after multiplication, we know the symmetric key, and can test whether it correctly decrypts the \texttt{ServerVerify} message.

\subsection{Adapted Bleichenbacher iteration}
\label{sec:general-bleichenbacher}
After we have bootstrapped the attack using rotations, the original algorithm proposed by Bleichenbacher can be applied with minimal modifications.

The original step obtains a message that starts with the required \hexb{00}{02} bytes once in roughly every two queries on average, and requires the number of queries to be roughly $16 \ell_m$.
Since we know the value of the 6 least significant bytes after multiplying by any integer, we can only query the oracle for multipliers that result in a zero 6th least significant byte, and again an exhaustive search over keys is not required.
However, we cannot ensure that the padding is non-zero when querying, which again holds with probability 0.37.
Therefore, for a 2048-bit modulus, the overall expected number of queries for this phase is roughly $2048 * 2 / 0.37 = 11,070$.

\ifext
\subsection{General DROWN attack performance}
\label{sec:general-performance}

For a given set of fractions, $F$,
the required number of recorded client connections $A$ is a random variable distributed geometrically with a success probability $P = P_F$.
For typical fraction sets, $1/13,000 < P_F < 1/600$.
The required number of Bleichenbacher queries against the target server during the first step of the attack is a random variable, $B$, such that $B = |F| \cdot A$.
As each query consists of two separate connections to the target server, the required number of connections is always  twice the number of queries.
And last, the required keys to be tested overall is another random variable $C = k_F \cdot B; k_F \approx 2^{40}$.

Summing the figures from the different phases for a 2048-bit RSA modulus, the attack requires in expectation $13,838 + 1,393 + 1,393 + 6 + 22,140 = 38,770$ connections to the target server, when optimizing for the number of queries in phase 1.  Each oracle query requires two connections to the server.

Re-calculating the numbers for a 1024 bit modulus, the primary element that needs to change is $P_1 = P(\forall i \in [3, \ell_m-6]: m_i \neq 0) = (1 - 1/256)^{120} = 0.62$, which appears in phases 1, 2, 3 and 5. For phase 5, the number of queries is now in expectation $1024 * 2 / 0.62 = 3,303$. The total expected number of server connections is therefore $8,258 + 826 + 826 + 6 + 6,606 = 16,522$, again when optimizing for the number of queries in phase 1.

Similarly, re-calculating the numbers for a 4096 bit modulus, $P_1 = (1 - 1/256)^{504} = 0.14$, and the number of queries in phase 5 is now roughly $4096 * 2 / 0.14 = 58,514$. The algorithm for phase 5 can be further optimized if that is the case of interest; we omit these optimizations for space reasons. Again, summing up yields $36,571 + 3,657 + 3,657 + 29 + 117,028 = 160,942$ required connections to the server.
\fi

\balance

\subsection{Special DROWN MITM performance}
\label{sec:special-performance}

For the first step, the probability that the three padding bytes are correct remains unchanged. The probability that all the intermediate padding bytes are non-zero is now slightly higher, $P_1 = (1 - 1/256)^{229} = 0.41$, yielding an overall maximal success probability $P = 0.1 \cdot 0.41 \cdot \frac{1}{256} = 1/6,244$ per oracle query. Since the attacker now only needs to connect to the server once per oracle query, the expected number of connections in this step is the same, $6,243$. Phase~1 now yields a message with 3 known padding bytes and 24 known plaintext bytes.

For the remaining rotation steps, each rotation requires an expected 630 oracle queries.  The attacker could now complete the original Bleichenbacher attack by performing 11,000 sequential queries in the final phase.  However, with this more powerful oracle it is more efficient to apply a rotation 10 more times to recover the remaining plaintext bits. The number of queries required in this phase is now $10\cdot 256/0.41\approx 6,300$, and the queries for each of the 10 steps can be executed in parallel.

\paragraph{Using multiple queries per fraction.}
For the $\OracleSSLclear$ oracle, the attacker can increase their chances of
success by querying the server multiple times per
ciphertext and fraction, using different cipher suites with different key lengths. They can negotiate DES and hope
the 9th least significant byte is zero, then negotiate 128-bit RC4
and hope the 17th least significant byte is zero, then negotiate
3DES and hope the 25th least significant is zero. All three queries also require
the intermediate padding bytes to be non-zero. This technique
triples the success probability for a given pair of (ciphertext, fraction),
at a cost of triple the queries. Its primary benefit is that fractions with smaller
denominators (and thus higher probabilities of success) are now even more likely
to succeed.

For a random ciphertext, when choosing 70 fractions, the probability of the
first zero delimiter byte being in one of these three positions is 0.01.
% Nimrod: literally 0.01004702047755441
Hence, the attacker can use only 100 recorded ciphertexts, and expect to use
$100 * 70 * 3 = 21,000$ oracle queries. For the \tOracleSSLclear, each
query requires one SSLv2 connection to the server.
After obtaining the first positive response from the oracle, the attacker
proceeds to phase~2 using 3DES.

\subsection{Special DROWN with combined oracles}
\label{sec:special-both}

Using the Leaky Export oracle, the probability that a fraction $u/t$ will result
in a positive response is $P = P_0 * P_3$, where the formula for
computing $P_0 = P((m \cdot u/t)[1,2] = 00||02)$ is provided in \S\ref{sec:fraction-probability},
and $P_3$ is, for a 2048-bit modulus:
\begin{equation}
\begin{aligned}
P_3 = P(
\hex{00} \text{ } \not \in \text{ } \{m_3, \ldots,m_{10}\} \wedge \\
\hex{00} \text{ } \in \text{ } \{m_{11}, \ldots,m_{\ell}\}) \\
 = (1 - 1/256)^{8} * (1 - (1 - 1/256)^{246}) = 0.60
\end{aligned}
\end{equation}

%Since $P_0$ is also non-negligible for small fractions, the overall probability of
%obtaining a positive response is now also non-negligible.

\paragraph{Phase 1.}
Our goal for this phase is to obtain a divisor $t$ as large as possible,
such that $t|m$. We generate a list of
fractions, sorted in descending order of the probability of
resulting in a positive response from $\OracleSSLleaky$. For a given ciphertext $c$, we then query with
the 50 fractions in the list with the highest probability,
until we obtain a first positive response for a fraction $u_0/t_0$.
We can now deduce that $t_0|m$.
We then generate a list of fractions $u/t$ where $t$ is a multiple of $t_0$, sort them again
by success probability, and again query with the 50 most probable fractions, until a positive answer is obtained,
or the list is exhausted.
If a positive answer is obtained, we iteratively re-apply this process,
until the list is exhausted, resulting in a final fraction $u^*/t^*$.

\paragraph{Phase 2.}
We then query with all fractions
denominated by $t^*$, and hope the ciphertext decrypts to a plaintext of
one of seven possible lengths: $\{2, 3, 4, 5, 8, 16, 24\}$.
Assuming that this is the case, we learn at least three least significant bytes,
which allows us to use the shifting technique in order to continue the attack.
Detecting plaintext lengths 8, 16 and 24 can be accomplished using three Extra Clear oracle
queries, employing DES, 128-bit RC4 and 3DES, respectively, as the chosen cipher suite.
Detecting plaintext lengths 2, 3, 4 and 5 can be accomplishing by using a single
Leaky Export oracle query, which requires at most $2^{41}$ offline computation.
In fact, the optimization over the key search space described in
Section~\ref{sec:trimmers} is applicable here and can slightly reduce the required computation.
Therefore, by initiating four SSLv2 connections and performing at most $2^{41}$ offline
work, the attacker can test for ciphertexts which decrypt to one of these seven lengths.
%\looseness=-1

In practice, choosing 50 fractions per iteration as described above
results in a success probability of 0.066 for a single ciphertext.
Hence, the expected number of required ciphertexts is merely $1/0.066 = 15$.
The expected number of fractions per ciphertext for phase 1 is 60, as in most cases phase 1
consists of just a few successful iterations.
Since each fraction requires a single query to $\OracleSSLleaky$,
the overall number of queries for this stage is
$15 * 60 = 900$, and the required offline computation is at most
$900 * 2^{41} \approx 2^{51}$, which is similar to general DROWN\@.
For a 2048-bit RSA modulus, the expected number of queries for phase 2 is 16.
Each query consists of three queries to $\OracleSSLclear$ and one query
to $\OracleSSLleaky$, which requires at most $2^{41}$ computation.
Therefore in expectancy the attacker has to perform $2^{45}$ offline computation for phase 2.


\documentclass[../main.tex]{subfiles}
\begin{document}
\subsection{Graphs and their corresponding Matroid Theory}
In this section we introduce the graph theoretic definitions and results needed to understand the algorithms and subsequent optimisation in later sections. These definitions and results come mainly from Jungnickel's\cite{jungnickel} text. We will also see how these properties of graphs naturally align with the properties of matroids and in particular to bases of matroids which are the cornerstone of the results in the later sections.

\begin{defn}[Connected]
A graph is connected when there is a path between each pair of vertices.
\end{defn}

\begin{defn}[Acyclic]
An acyclic graph is a graph which contains no closed walks.
\end{defn}

\begin{defn}[Walk]
If there are vertices $v_{i-1}v_i$ for $i = 1, ..., n$ the sequence is called a walk. If $v_0 = v_n$ this sequence is called a closed walk.
\end{defn}

\begin{defn}[Tree]
A connected graph containing no circuits. In other words, acyclic graphs.\\
\noindent A forest is a disconnected graph containing no circuits\\
\end{defn}

\noindent We know from \textit{theorem 1.7}. If we let $E$ be the edge set of our graph $G.$ And we define $\mathcal{I}$ as the subsets of $E$ not containing all of the edges of any cycle in $G$ we have $M(G),$ the cycle matroid of G. We know that this is a matroid, and it is easy to see that in this case the elements of $\mathcal{I}$ correspond exactly to the trees of $G.$

\begin{defn}[Spanning Tree]
A spanning tree $T$ of an graph $G$ is a subgraph that is a \textit{tree} which includes all of the vertices of $G.$\\
\noindent A disconnected graph cannot contain a spanning tree as we cannot find a walk which brings us to all of the disconnected vertices.
\end{defn}

\begin{prop}
 A theorem of Cayley(1889) states that the number of distinct labelled trees which can be drawn using $n$ labelled points is $ n^{n-2}$.
 \end{prop}

\begin{cor}
The number of distinct labelled spanning trees which can be drawn using $n$ labelled points is $n^2.$
\end{cor}

\pagebreak
\begin{lem}\cite{jungnickel}
Any acyclic graph on $n$ vertices has at most $n-1$ edges.
\end{lem}
\noindent\Proof Let G be an acyclic graph with n vertices.\\
\noindent If n = 1 then we have no edges hence nothing to prove.\\
\noindent Assume $n>1,$ let $e$ be an edge in $G$ connecting two vertices $ab$ in the vertex set of $G.$\\
\noindent Let $H = G \setminus \{e\}, H$ has one more connected component than $G.$ $H$ has two maximal acyclic connected components, and thus can be decomposed into acyclic connected graphs $H_1, H_2, ..., H_k$ where $k \geq 2.$\\
\noindent By induction, we can assume each graph $H_i$ contains at most $n_i - 1$ edges where $n_i$ is the number of vertices of $H_i.$\\
\noindent Then $G$ has at most $n-1$ edges.\\
\noindent $(n_1 - 1) + ... + (n_k - 1) + 1 = (n_1 + ... + n_k) - (k - 1) \leq n - 1$ edges.
\\ \qed

\begin{defn}[Bridge]
A bridge(or cut edge) is an edge of a graph whose deletion increases the number of connected components. Equivalently, an edge is a bridge if and only if it is not contained in any cycle.
\end{defn}

\noindent The above definition is mainly useful for us in proving the next lemma, which comes from Jungnickel's text and will help us visualise the characteristics of a spanning tree of a graph. In particular condition $(1)$ and $(2)$, will allow us to see that the spanning trees of a graph directly correspond to the bases of a matroid.

 \begin{lem}\cite{jungnickel}
 Let $G$ be a graph. Then the following conditions are equivalent:\\
 1) $G$ is a tree.\\
 2) $G$ does not contain any cycles, but adding any further edge yields a cycle.\\
 3) Any two vertices of $G$ are connected by a unique path.\\
 4) $G$ is connected, and any edge of $G$ is a bridge.
 \end{lem}

 \noindent\Proof $(1) \Longrightarrow (2)$\\
 \noindent Suppose that $G$ is a tree,then $G$ is a connected graph with no circuits. Let $e$ be a new edge in G with $e = g_ig_k$ where $g_i,g_k$ are in the vertex set of $G.$ Then as $G \cup \{e\}$ must be connected, there exists a walk between any pair of vertices of $G$. So there is a walk $K$ from $g_j \rightarrow g_k$ and there is also a walk $L$ from $g_k \rightarrow g_j$ where $K$ does not traverse $e$ and $L$ does traverse $e$ and so we have a cycle.\\

\noindent\Proof $(2) \Longrightarrow (3)$\\
\noindent Let $u,v$ be vertices of $G.$ If there was no path joining $uv$ in $G$ then $e = uv$ does not create a cycle in $G.$ Thus $G$ must be connected.\\
\noindent Suppose $G$ contained two different paths $W_1, W_2$ from $u$ to $v.$\\
\noindent Then $ u \longrightarrow v \longrightarrow u$ would be a closed walk in $G. \\ \implies G$ contains a cycle. Which is a contradiction.\\

\noindent\Proof $(3) \Longrightarrow (4)$\\
\noindent $G$ is connected by hypothesis. Let $e = uv$ be an edge in $G.$\\
\noindent Suppose $e$ is not a bridge, then $G \setminus \{e\}$ is still connected. But then we have two distinct paths from $u$ to $v$ in $G.$\\

\noindent\Proof $(4) \Longrightarrow (1)$\\
\noindent G is connected by hypothesis.\\
\noindent Suppose $G$ contains a cycle $K.$ Then any edge of $K$ could be ommited from $G,$ and the resulting graph would still be connected. In other words, no edge of $K$ would be a bridge, a contradiction.\\
\qed

\noindent The vertices of a graph/network can be labelled and referred to as nodes. Information may then be recorded in them along with a cost, penalty or probability associated with each edge. For example, the problem of joining all nodes in a graph by the minimum length using our respective metric to a tree known as a \textit{minimum spanning tree}.

\noindent Weights can be assigned using a process as detailed below. We will later redefine this process in a more suitable way to take advantage of matroid properties in order to determine the minimum spanning trees in graphs.
\begin{defn}
Let $(G,\omega)$ be a network. For any subset $T$ of the edge set of $G, \omega$ is called the weight of $T.$\\
\begin{equation}
\omega (T) = \displaystyle\sum_{e \in T} \omega (T)
\end{equation}
\end{defn}

\begin{defn}[Minimal Spanning Tree]
A spanning tree is a \textit{minimal} spanning tree if its weight is minimal of all the weights of spanning trees.
\noindent A forest can be considered by finding a minimal spanning tree for each connected component of $G.$
\end{defn}

\begin{rem}
If the weight $\omega$ is constant, any spanning tree is minimal.\\
\noindent In this case, determining a minimal spanning tree could be done using a breadth-first search. Which is a similar procedure to the described depth-first section in \textit{appendix,algorithm 6}.
\end{rem}

 \end{document}


\section{It\^o's Formulas}

%\begin{frame}
%  \frametitle{Differentiation and Integration of Stochastic Processes}
%
%  \begin{itemize}
%   \item Brownian motion is a continuous time stochastic process that is nowhere differentiable.\\
%  \item  How do we make sense of $\frac{dB}{dt}$?\\
%\end{itemize}
%
%\end{frame}

\begin{frame}
  \frametitle{Riemann-Stieltjes Integration of Stochastic Processes}
  \begin{itemize}
  \item Riemann-Stieltjes Integral \\
    $$\int_{a}^{b} f(x) d\alpha(x)=\lim_{n\to\infty}\sum_{i=1}^{n} f(x_i) (\alpha(x_i)-\alpha(x_{i-1}))$$\\
  \item  Stochastic Integral \\
    $$\int_{a}^{b} f(t) dB=\lim_{n\to\infty}\sum_{i=1}^{n} f(t_{i-1}) (B(t_i)-B(t_{i-1}))$$\\
  %\item  Form the Taylor expansion on $f(B(b))-f(B(a))$\\
  \end{itemize}
\end{frame}

\begin{frame}
  \frametitle{Left and Right Stochastic Sums}
  \begin{itemize}
  \item Left Side Stochastic sum $$L=\lim_{n\to\infty}\sum_{i=1}^{n} f(t_{i-1}) (B(t_i)-B(t_{i-1}))$$\\
  \item Right Side Stochastic sum $$R=\lim_{n\to\infty}\sum_{i=1}^{n} f(t_i) (B(t_i)-B(t_{i-1}))$$\\

  \end{itemize}
\end{frame}

\begin{frame}
  \frametitle{Left and Right Riemann-Stieltjes Sums}
  \begin{itemize}
  \item Considering $$\int_{a}^{b}{B(t)d(B(t))}$$\\
  \item The left sided limit \\
    $$L=\frac{1}{2}B^2(t)-\frac{t}{2}$$\\
  \item The right sided limit \\
    $$R=\frac{1}{2}B^2(t)+\frac{t}{2}$$\\
  \end{itemize}
\end{frame}

\begin{frame}
  \frametitle{It\^{o}'s Formula (First Formulation)}
  \begin{itemize}
  \item $\Delta B^2 \to \Delta t$\\
  \item  The Taylor expansion is
  \begin{eqnarray*}
    f(B(t_i))-f(B(t_{i-1}))&=&f'(B(t_{i-1}))(B(t_i)-B(t_{i-1}))+\\
    & &\frac{1}{2}f''(B(t_{i-1}))(B(t_i)-B(t_{i-1}))^2+\\
    %& &\frac{1}{3}f'''(B(t_{i-1}))(B(t_i)-B(t_{i-1}))^3+\\
    & &\mathrm{Higher Order Terms}\\
  \end{eqnarray*}
  %f(B(b))-f(B(a))&=&\sum_{i=1}^{n}(f'(B(t_{i-1}))(B(t_i)-B(t_{i-1}))+\\
  %& &\frac{1}{2}f''(B(t_{i-1}))(B(t_i)-B(t_{i-1}))^2+\\
  %& &\frac{1}{3}f'''(B(t_{i-1}))(B(t_i)-B(t_{i-1}))^3+\\
  %& &\mathrm{Higher Order Terms})\\
  \item Taking the sum of the telescoping series $$f(B(b))-f(B(a))=\sum_{i=1}^{n}(f(B(t_i))-f(B(t_{i-1})))$$\\
  \item It\^o's Formula (first version) $$f(B(b))-f(B(a))=\int_{a}^{b}{\frac{\partial f}{\partial B} dB}+\int_{a}^{b}{\frac{1}{2} \frac{\partial^2 f}{\partial B^2} dt} $$\\
  \end{itemize}
\end{frame}

\begin{frame}
  \frametitle{It\^o's Formula (Second and Third Formulation)}
  \begin{itemize}

  \item  It\^o's Formula (second version) $$f(b,B(b))-f(a,B(a))=\int_{a}^{b}{\frac{\partial f}{\partial B} dB}+\int_{a}^{b}{(\frac{\partial f}{\partial s}+\frac{1}{2}\frac{\partial ^2 f}{\partial B^2}) ds}$$\\
  \item  It\^o's Formula (third version): The Stochastic Chain Rule $$d\theta=\frac{\partial\theta}{\partial t}dt+\frac{\partial\theta}{\partial x}f dB+\frac{\partial\theta}{\partial x}g dt+\frac{1}{2}\frac{\partial^2\theta}{\partial x^2}f^2dt$$\\
  where $\theta$ is a function of t and x\\
  and f and g are functions of t and B\\
  and x satisfies $dx=fdt+gdB$

  \end{itemize}

\end{frame}

%\begin{frame}
%  \frametitle{Integration by Parts}
%  \begin{itemize}
%  \item $$\int_{a}^{b}{f(t)dB}=f(t)B(t)|_{a}^{b}-\int_{a}^{b}{B(t)df}$$
%  \end{itemize}

%\end{frame}

%%% Local Variables:
%%% mode: latex
%%% TeX-master: "Presentation1"
%%% End:

%\