{"paper":{"title":"Cryptanalysis of the Legendre Pseudorandom Function over Extension Fields","license":"http://creativecommons.org/licenses/by/4.0/","headline":"The single-degree Legendre PRF over extension fields admits efficient key recovery through periodic fracture bucketing and geometric-sequence collisions.","cross_cats":["math.NT"],"primary_cat":"cs.CR","authors_text":"Daksh Pandey","submitted_at":"2026-04-06T16:35:32Z","abstract_excerpt":"The Legendre Pseudorandom Function (PRF) is a highly efficient cryptographic primitive built upon the Legendre symbol, valued for its low multiplicative complexity in Multi-Party Computation (MPC) and Zero-Knowledge Proof (ZKP) protocols. While its security over prime fields $\\mathbb{F}_p$ is well-documented, recent interest has shifted toward instantiations over extension fields $\\mathbb{F}_{p^r}$. This paper presents the first comprehensive cryptanalysis of the single-degree Legendre PRF operating over $\\mathbb{F}_{p^r}$.\n  First, we analyze polynomial input encoding under a standard passive"},"claims":{"count":4,"items":[{"kind":"strongest_claim","text":"We demonstrate that an adversary can systematically group fractured sequences by their structural shapes to bypass this defense, recovering the secret key in O(U · p^r/M) operations... an adversary can circumvent the additive fracture by evaluating the PRF along a geometric sequence generated by a primitive polynomial... extract the key in O(p^r/M) operations. Finally, we establish the cryptographic boundaries of these attacks, formally proving the necessity of higher-degree key variants (d ≥ 2) to achieve exponential security against structural reduction in extension fields.","source":"verdict.strongest_claim","status":"machine_extracted","claim_id":"C1","attestation":"unclaimed"},{"kind":"weakest_assumption","text":"The analysis relies on polynomial input encoding without carry-overs producing a deterministically periodic fracture, and on the existence of primitive polynomials enabling strict multiplicative homomorphism in the active model; if real implementations use different encodings or the fracture periodicity does not hold as claimed, the bucketing and collision attacks may fail.","source":"verdict.weakest_assumption","status":"machine_extracted","claim_id":"C2","attestation":"unclaimed"},{"kind":"one_line_summary","text":"The Legendre PRF over extension fields admits key recovery in O(p^r/M) operations via differential signature bucketing on fractured sequences or geometric sequence queries exploiting multiplicative homomorphism, proving higher-degree keys are required for exponential security.","source":"verdict.one_line_summary","status":"machine_extracted","claim_id":"C3","attestation":"unclaimed"},{"kind":"headline","text":"The single-degree Legendre PRF over extension fields admits efficient key recovery through periodic fracture bucketing and geometric-sequence collisions.","source":"verdict.pith_extraction.headline","status":"machine_extracted","claim_id":"C4","attestation":"unclaimed"}],"snapshot_sha256":"806a3309f25f614e5ed00b8b36701bb8fff60c2cbb151429a9ca1f94e1bcc4b7"},"source":{"id":"2604.04833","kind":"arxiv","version":3},"verdict":{"id":"9f2ee0d4-1f78-4bbb-bac8-fa2cde1409a2","model_set":{"reader":"grok-4.3"},"created_at":"2026-05-10T18:54:10.745331Z","strongest_claim":"We demonstrate that an adversary can systematically group fractured sequences by their structural shapes to bypass this defense, recovering the secret key in O(U · p^r/M) operations... an adversary can circumvent the additive fracture by evaluating the PRF along a geometric sequence generated by a primitive polynomial... extract the key in O(p^r/M) operations. Finally, we establish the cryptographic boundaries of these attacks, formally proving the necessity of higher-degree key variants (d ≥ 2) to achieve exponential security against structural reduction in extension fields.","one_line_summary":"The Legendre PRF over extension fields admits key recovery in O(p^r/M) operations via differential signature bucketing on fractured sequences or geometric sequence queries exploiting multiplicative homomorphism, proving higher-degree keys are required for exponential security.","pipeline_version":"pith-pipeline@v0.9.0","weakest_assumption":"The analysis relies on polynomial input encoding without carry-overs producing a deterministically periodic fracture, and on the existence of primitive polynomials enabling strict multiplicative homomorphism in the active model; if real implementations use different encodings or the fracture periodicity does not hold as claimed, the bucketing and collision attacks may fail.","pith_extraction_headline":"The single-degree Legendre PRF over extension fields admits efficient key recovery through periodic fracture bucketing and geometric-sequence collisions."},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2604.04833/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"}