Zeroizing without low-level zeroes: New MMAP attacks and their limitations

Abstract

We extend the recent zeroizing attacks of Cheon, Han, Lee, Ryu and Stehl´e (Eurocrypt’15) on multilinear maps to settings where no encodings of zero below the maximal level are available. Some of the new attacks apply to the CLT13 scheme (resulting in a total break) while others apply to (a variant of) the GGH13 scheme (resulting in a weak-DL attack). We also note the limits of these zeroizing attacks.