Multivariate Public Key Cryptosystems Research Articles

A security analysis of uniformly-layered rainbow defined over non-commutative rings

Abstract Hashimoto and Sakurai proposed a signature scheme (HS scheme), whose security is based on the difficulty of integer factorization. In this paper, we redefine HS scheme as a signature scheme in Multivariate Public Key Cryptosystems (MPKC). MPKC are public key cryptosystems whose security is based on the difficulty of solving multivariate quadratic equations, and candidates for post-quantum cryptography. In this paper, we analyze the security of the extended HS scheme using technique of security analysis for MPKC. Furthermore, based on the security analysis of the extended HS scheme, we estimate secure parameters of the extended HS scheme.

Cryptanalysis of Extended Multivariate Public Key Cryptosystem

Extended Multivariate Public Key Cryptosystems(EMC for short) is a new security enhancement method of Multivariate Public Key Cryptosystems(MPKC for short) proposed by Wang et al.in 2011.The core technique of EMC is doing a Hash-based tame(HT) transformation on plaintext before it being encrypted by the original MPKC.Combined with plus method,they proposed HTTP(Hash-based tame and plus) for encryption.They claimed the schemes can resist all of the existing attacks to MPKC.Through our analysis,we found that the EMC method cannot enhance the security of the original MPKC.If there is a method that can recover the corresponding plaintext of valid ciphertext encrypted by original MPKC,also could this method work on the enhanced scheme.We verify our results by computer experiments.

Analysis of a Multivariate Public Key Cryptosystem and Its Application in Software Copy Protection

We analysed and solved possible singularity for an improved MFE multivariate public key (Medium Field Multivariate Public Key Encryption) and studied the use of it in software copy protection. We used our new MFE multivariate public key cryptosystem to design an algorithm of software registration, in which a given plaintext can result in multi-cipher-text.. The breaking is hard because the ciphertext is variable. The ability to withstand algebraic attacks is enhanced. The dependence of registration string on the fingerprints of machine prevents any registration string from being shared by multiple machines.

Security of Multivariate Signature Scheme Using Non-commutative Rings

Multivariate Public Key Cryptosystems (MPKC) are candidates for post-quantum cryptography. Rainbow is a digital signature scheme in MPKC, whose signature generation and verification are relatively efficient. However, the security of MPKC depends on the difficulty in solving a system of multivariate polynomials, and the key length of MPKC becomes substantially large compared with that of RSA cryptosystems for the same level of security. The size of the secret and public keys in MPKC has been reduced in previous research. The NC-Rainbow is a signature scheme in MPKC, which was proposed in order to reduce the size of secret key of Rainbow. So far, several attacks against NC-Rainbow have been proposed. In this paper, we summarize attacks against NC-Rainbow, containing attacks against the original Rainbow, and analyze the total security of NC-Rainbow. Based on the cryptanalysis, we estimate the security parameter of NC-Rainbow at the several security level.

Extended Algorithm for Solving Underdefined Multivariate Quadratic Equations

It is well known that solving randomly chosen Multivariate Quadratic equations over a finite field (MQ-Problem) is NP-hard, and the security of Multivariate Public Key Cryptosystems (MPKCs) is based on the MQ-Problem. However, this problem can be solved efficiently when the number of unknowns n is sufficiently greater than that of equations m (This is called “Underdefined”). Indeed, the algorithm by Kipnis et al. (Eurocrypt’99) can solve the MQ-Problem over a finite field of even characteristic in a polynomial-time of n when n ≥ m(m + 1). Therefore, it is important to estimate the hardness of the MQ-Problem to evaluate the security of Multivariate Public Key Cryptosystems. We propose an algorithm in this paper that can solve the MQ-Problem in a polynomial-time of n when n ≥ m(m + 3)/2, which has a wider applicable range than that by Kipnis et al. We will also compare our proposed algorithm with other known algorithms. Moreover, we implemented this algorithm with Magma and solved the MQ-Problem of m = 28 and n = 504, and it takes 78.7 seconds on a common PC.

New multivariate hash function quadratic polynomials multiplying linear polynomials

In this study the authors propose a new multivariate hash function with HAsh Iterative FrAmework framework which we call the hash function quadratic polynomials multiplying linear polynomials (QML). The new hash function is made of cubic polynomials which are the products of quadratic polynomials and linear polynomials. The authors design the quadratic-polynomial part of the compression function based on the centre map of the multivariate public key cryptosystem Matsumoto-Imai cryptosystem (MI). The hash function QML can keep the three cryptography properties and be immune to the pre-image attack, second pre-image attack, collision attack, differential attack and algebraic attack. The required memory storage is about 50% of the one which is built of the cubic polynomials and their coefficients are random. On the avalanche effect, by experiments the authors get the result that about one half of the output bits are different when one input bit is changed randomly. The one-round diffusion of the hash function QML is twice of that of Blake. Also the authors simplify the matrixes of the new hash function, analyse the rationality and show the comparable data. Finally, the authors give the advice to the parameters of the new hash function and summarise the paper.

A Verifiable Ring Signature Scheme Based on Multivariate Public-Key Cryptosystem

Most existing verifiable ring signature schemes are based on traditional PKCs, which cannot resist future attacks of quantum computers. Fortunately, the MQ-problem based Multivariate Public-Key Cryptosystem (MPKC) is an important alternative to traditional PKCs for its potential to resist future attacks of quantum computers. In this paper, we proposed a construction of verifiable ring signature based on MPKC, which has the properties of consistent, unforgery, signer-anonymity and verifiability.

Security Analysis of Square Minus Scheme

The multivariate public key cryptosystem is a new and fast public key cryptosystem. This paper investigates the security of Square minus scheme, and presents a method to attack the scheme. The attack utilizes the affine parts of the private keys and the weakness caused by the structures of the private keys to find a large number of linear equations. The attack can recover the private keys efficiently when the parameters are small enough.

A New Public Key Cryptographic Scheme

The multivariate public key cryptosystem is a new and fast public key cryptosystem. This paper presents a multivariate public key cryptographic scheme over a finite field with odd prime characteristic. The idea of embedding and layering is manifested in its construction. The security of the scheme is analyzed in detail. The result indicates that the proposed scheme can resist all known attacks effectively.

General Fault Attacks on Multivariate Public Key Cryptosystems

The multivariate public key cryptosystem (MPKC), which is based on the problem of solving a set of multivariate systems of quadratic equations over a finite field, is expected to be secure against quantum attacks. Although there are several existing schemes in MPKC that survived known attacks and are much faster than RSA and ECC, there have been few discussions on security against physical attacks, aside from the work of Okeya et al. (2005) on side-channel attacks against Sflash. In this study, we describe general fault attacks on MPKCs including Big Field type (e.g. Matsumoto-Imai, HFE and Sflash) and Stepwise Triangular System (STS) type (e.g. UOV, Rainbow and TTM/TTS). For both types, recovering (parts of) the secret keys S,T with our fault attacks becomes more efficient than doing without them. Especially, on the Big Field type, only single fault is sufficient to recover the secret keys.

On enumeration of polynomial equivalence classes

The isomorphism of polynomials (IP), one of the hard problems in multivariate public key cryptography induces an equivalence relation on a set of systems of polynomials. Then the enumeration problem of IP consists of counting the numbers of different classes and counting the cardinality of each class that is highly related to the scale of key space for a multivariate public key cryptosystem. In this paper we show the enumeration of the equivalence classes containing \(\sum\nolimits_{i = 0}^{n - 1} {a_i X^{2q^i } } \) when char\((\mathbb{F}_q )\) = 2, which implies that these polynomials are all weak IP instances. Moreover, we study the cardinality of an equivalence class containing the binomial \(aX^{2q^i } + bX^{2q^j } (i \ne j)\) over \(\mathbb{F}_{q^n } \) without the restriction that char(\((\mathbb{F}_q )\)) = 2, which gives us a deeper understanding of finite geometry as a tool to investigate the enumeration problem of IP.

Multivariate public key cryptosystems from diophantine equations

Wang et al. introduced in (A medium-field multivariate public-key encryption scheme. Topics in Cryptology--CTRSA 2006: The Cryptographers' Track at the RSA Conference, 2006) a multivariate public key cryptosystem, called MFE cryptosystem, and it is appealing as it is based on a simple polynomial identity. Their system, however, was subsequently broken by Ding et al. in (High order linearization equation (hole) attack on multivariate public key cryptosystems. Public key cryptography--PKC 2007: 10th international conference on practice and theory in public-key cryptography, 2007a, ?-Invertible cycles for multivariate quadratic public key cryptography. Public key cryptography--PKC 2007: 10th international conference on practice and theory in public-key cryptography, 2007b). Inspired by their work, we present a more general framework for multivariate public key cryptosystems, which combines ideas from both triangular and oil-vinegar schemes. Within this framework, we propose a new public key cryptosystem based on a solution of a Diophantine equation over polynomial rings.

Ring signature scheme based on multivariate public key cryptosystems

The ring signature scheme is an important cryptographic primitive that enables a user to sign a message on behalf of a group in authentic and anonymous way, i.e. the recipient of the message is convinced that the message is valid and it comes from one of the group members, but does not know who the actual signer is. Currently, all the existing ring signatures are based on traditional cryptosystems. However, the rapid advances in the field of quantum computing indicate a growing threat to traditional cryptosystems. Multivariate public key cryptosystems (MPKCs) is one of the promising alternatives which may resist future quantum computing attacks. In this work, we propose a novel ring signature scheme based on multivariate polynomials with the security model for the first time. Our ring signature scheme has a great advantage in efficiency compared to many existing ring signature schemes, and currently it seems to be immune to quantum computing attacks.

On enumeration of polynomial equivalence classes and their application to MPKC

The Isomorphism of Polynomials (IP) is one of the most fundamental problems in multivariate public key cryptography (MPKC). In this paper, we introduce a new framework to study the counting problem associated to IP. Namely, we present tools of finite geometry allowing to investigate the counting problem associated to IP. Precisely, we focus on enumerating or estimating the number of isomorphism equivalence classes of homogeneous quadratic polynomial systems. These problems are equivalent to finding the scale of the key space of a multivariate cryptosystem and the total number of different multivariate cryptographic schemes respectively, which might impact the security and the potential capability of MPKC. We also consider their applications in the analysis of a specific multivariate public key cryptosystem. Our results not only answer how many cryptographic schemes can be derived from monomials and how big the key space is for a fixed scheme, but also show that quite many HFE cryptosystems are equivalent to a Matsumoto–Imai scheme.

A Hybrid Multivariate Signature Scheme Based on HFEv and IPHFE

Based on the cryptanalysis of multivariate public key cryptosystems the hidden fields equations(HFE) system with some external variables(HFEv) and internal perturbation of HFE(IPHFE),a hybrid multivariate signature scheme is proposed.In this scheme,both methods of the external perturbation in HFEv and the internal perturbation in IPHFE are used,with which the existing attacks against HFEv and IPHFE become invalid.Thus the security of the proposed scheme have been enhanced,while the total amount of computation does not increase too much.Furthermore,the security of the proposed signature scheme can be improved by the method of minus,or by multiplying two perturbations to produce mutual effect.

Extended multivariate public key cryptosystems with secure encryption function

Advances in quantum computers pose great threats on the currently used public key cryptographic algorithms such as RSA and ECC. As a promising candidate secure against attackers equipped with quantum computational power, multivariate public key cryptosystems (MPKCs) have attracted increasing attention in recently years. Unfortunately, the existing MPKCs can only be used as a multivariate signature scheme, and it remains unknown how to construct an efficient MPKC enabling secure encryption. Furthermore, some multivariate signature schemes have been shown insecure in recent years, and it is also not trivial to build MPKC which can serve as a secure signature scheme. By employing the basic MQ-trapdoors, this paper proposes a novel MPKC and shows how it can be used as a multivariate signature scheme and a multivariate encryption scheme, respectively. The goal is achieved by incorporating our new hash authentication techniques and some modification methods such as the Shamir’s minus method. Thorough analysis shows that our schemes are secure and efficient. Our MPKC gives a positive response to the challenges in multivariate public key cryptography.

Poly-Dragon: an efficient multivariate public key cryptosystem

In this paper we propose an efficient multivariate public key cryptosystem. Public key of our cryptosystem contains polynomials of total degree three in plaintext and ciphertext variables, two in plaintext variables and one in ciphertext variables. However, it is possible to reduce the public key size by writing it as two sets of quadratic multivariate polynomials. The complexity of encryption in our public key cryptosystem is O(n), where n is bit size, which is equivalent to other multivariate public key cryptosystems. For decryption we need only four exponentiations in the binary field. Our Public key algorithm is bijective and can be used for encryption as well as for signatures.

A new perturbation algorithm and enhancing security of SFLASH signature scheme

This paper introduces the concept of noise factor and noise operation, and constructs a noise group. We present a new perturbation algorithm for enhancing security of multivariate public key cryptosystems (MPKCs). European Consortium SFLASH which derives from Matsumoto-Imai scheme is a fast signature scheme intended for low cost smart cards. It was broken with the differential cryptanalysis by Dubois et al. in 2007. Taking Matsumoto-Imai system as an example, security analysis shows that the new algorithm can powerfully demolish its potential mathematical properties of the public key, and effectively avoid differential cryptanalysis without lowering the efficiency of the original algorithm.

Bypassing the decomposition attacks on two-round multivariate schemes by a practical cubic round

It was reported that a multivariate public key cryptosystem (MPKC) could be strengthened if its public key is generated by composition of two original public keys. In fact, two existing keys are used to constitute two quadratic rounds of the new key. But such a two-round scheme, called 2R, was claimed to have been decomposed, and even a further improved 2R, named 2R−, was shown to be similarly vulnerable. The result casts doubts on the principle of using a two-round structure to improve the security. However, this study clearly states that the decomposition attacks depend on the prerequisite that either of the rounds is quadratic. It shows that these attacks, even the conceivable extended ones, do not work in theory or in practice if the first round is of higher degree, although the threat still remains when only the degree of the second round is changed. Therefore adopting a cubic first round becomes a rule in the design of the 2-round schemes. The analysis and experiments in this study also demonstrate that the new schemes with such an indecomposable two-round public key can provide the desired security against many other known and potential attacks on MPKCs and that the key size can be practically controlled.

On Patarin's Attack against the <i>l</i>IC Scheme

In 2007, Ding et al. proposed an attractive scheme, which is called the l-Invertible Cycles (lIC) scheme. lIC is one of the most efficient multivariate public-key cryptosystems (MPKC); these schemes would be suitable for using under limited computational resources. In 2008, an efficient attack against lIC using Grobner basis algorithms was proposed by Fouque et al. However, they only estimated the complexity of their attack based on their experimental results. On the other hand, Patarin had proposed an efficient attack against some multivariate public-key cryptosystems. We call this attack Patarin's attack. The complexity of Patarin's attack can be estimated by finding relations corresponding to each scheme. In this paper, we propose an another practical attack against the lIC encryption/signature scheme. We estimate the complexity of our attack (not experimentally) by adapting Patarin's attack. The attack can be also applied to the lIC- scheme. Moreover, we show some experimental results of a practical attack against the lIC/lIC- schemes. This is the first implementation of both our proposed attack and an attack based on Grobner basis algorithm for the even case, that is, a parameter l is even.