# Cryptographic properties of field multiplication (Continued)

This question follows-up from this question/comment.

Suppose, you are given $$X \odot Y$$, where $$X~(\neq 0) \in \operatorname{GF}(2^{128})$$ is random, $$Y~(\neq 0) \in \operatorname{GF}(2^{128})$$ is random, and $$\odot$$ is a multiplication over $$\operatorname{GF}(2^{128}$$) with some modulus. As explained in this answer, the product $$X \odot Y$$ preserves privacy about its factors.

Therefore, assume you are given some extra information (see below). Will it be possible to recover (at least some non-trivial information) $$X$$, $$Y$$ under each of the scenarios:

1. $$X \oplus Y$$ is given. Since $$\oplus$$ can be stated as the addition operation over any $$\operatorname{GF}(\cdot)$$, we can also say the sum of $$X$$ and $$Y$$ over $$\operatorname{GF}(2^{128})$$ is given.
2. Arithmetic sum $$X + Y$$ is given.
3. Modular addition, $$X+Y \pmod{2^{128}}$$ is given. Or, may be with any other divider (except $$2$$ as this coincides with $$\oplus$$), say $$2^{8}$$ or $$2^{16}$$, instead of $$2^{128}$$.

I considered each of the above scenarios to be exclusive. Please feel free to combine the scenarios or propose a new scenario if that is useful.

• For 1: if $X$ or $Y$ is zero, $X\oplus Y$ recovers the other variable. Otherwise, substitute one equation into the other and solve a quadratic equation over the field (it's a bit different from the reals but there are methods, which I don't remember). Oct 7 '20 at 16:26
• For 2 or 3 I guess something can be done by introducing variable for the carries and solving quadratic equations over $GF(2)$, which is generally hard but here the system has very simple structure. Oct 7 '20 at 16:30
• I would also add that, mathematically speaking, this is not well-defined as there are no "good" maps between $GF(2^{128})$ and $\mathbb{Z}$ or $\mathbb{Z}_{2^{128}}$. (good meaning behaving well with respect to any usual operations, i.e. being homomorphisms). Oct 7 '20 at 16:31