Rainbow Signature Research Articles

Look-up the Rainbow: Table-based Implementation of Rainbow Signature on 64-bit ARMv8 Processors

The Rainbow Signature Scheme is one of the finalists in the National Institute of Standards and Technology (NIST) Post-Quantum Cryptography (PQC) standardization competition, but failed to win because it has lack of stability in the parameter selection. It is the only signature candidate based on a multivariate quadratic equation. Rainbow signatures have smaller signature sizes compared with other post-quantum cryptography candidates. However, they require expensive tower-field based polynomial multiplications. In this article, we propose an efficient implementation of Rainbow signatures using a look-up table–based multiplication method. The polynomial multiplications in Rainbow signatures are performed on the 𝔽 16 field, which is divided into sub-fields 𝔽 4 and 𝔽 2 under the tower-field method. To accelerate the multiplication process on target processors, we propose a look-up table–based tower-field multiplication technique. In 𝔽 16 , all values are expressed in 4-bit data format and can be implemented using a 256-byte look-up table access. The implementation uses the TBL and TBX instructions of the 64-bit ARMv8 target processor. For Rainbow III and Rainbow V, they are computed on the 𝔽 256 field using an additional 16-byte table instead of creating a new look-up table. The proposed technique uses the vector registers of 64-bit ARMv8 processors and can calculate 16 result values with a single instruction. We also proposed implementations that are resistant to timing attacks. There are two types of implementations. The first one is the cache side-attack resistant implementation, which utilizes the 128-byte cache lines of the M1 processor. In this implementation, cache misses do not occur, and cache hits always occur. The second type is the constant-time implementation. This method takes a step-by-step approach to finding the required look-up table value and ensures that the same number of accesses is made regardless of which look-up table value is called. This implementation is designed to be constant-time, meaning it does not leak timing information. Our experiments on modern Apple M1 processors showed up to 428.73× and 114.16× better performance for finite field multiplications and Rainbow signatures schemes, respectively, compared with previous reference implementations. To the best of our knowledge, this proposed Rainbow implementation is the first optimized Rainbow implementation for 64-bit ARMv8 processors.

New Identified Strategies to Forge Multivariate Signature Schemes

A rogue certificate authority (RCA) is a dishonest entity that has the trust of web browsers and users to produce valid key pairs which are vulnerable. This work analyses two acknowledged post-quantum secure Multivariate Quadratic Problem (MQP) based signature schemes, namely the UOV and Rainbow signature schemes that obtain their key pair from a potential RCA methodology. We revisit two and provide a novel RCA methodology that would enable adversaries to forge UOV and Rainbow signatures. We also lay out two strategies to identify whether the public parameters are generated by the first two methodologies. To this end, strategies to identify the third strategy remain elusive. As such, the UOV and Rainbow schemes remain vulnerable to forgery if it was forged via the third methodology.

Recent progress in the security evaluation of multivariate public‐key cryptography

AbstractMultivariate public‐key cryptography (MPKC) is considered a leading candidate for post‐quantum cryptography (PQC). It is based on the hardness of the multivariate quadratic polynomial (MQ) problem, which is a problem of finding a solution to a system of quadratic equations over a finite field. In this paper, we survey some recent progress in the security analysis of MPKC. Among various existing multivariate schemes, the most important one is the Rainbow signature scheme proposed by Ding et al. in 2005, which was later selected as a finalist in the third round of the PQC standardization project by the National Institute of Standards and Technology. Under the circumstances, some recent research studies in MPKC have focussed on the security analysis of the Rainbow scheme. In this paper, the authors first explain efficient algorithms for solving the MQ problem and the research methodology for estimating their complexity in MPKC. Then, the authors survey some recent results related to the security analysis of the Rainbow scheme. In particular, the authors provide a detailed description of the complexity analysis for solving the bi‐graded polynomial systems studied independently by Nakamura et al. and Smith‐Tone et al., and then expound the rectangular MinRank attack against Rainbow proposed by Beullens.

Analysis of partial key recovery attack on multivariate cryptographic transformations using rank systems

The Rainbow signature scheme, proposed by Ding and Schmidt in 2005, is one of the oldest and most studied signature schemes in multidimensional cryptography. The Rainbow, based on the unbalanced Oil and Vinegar signature scheme, has the necessary cryptocurrency since 1999 with the right parameters. Interest in multivariate cryptography has increased in the last decade, as it is considered to be quantum-stable.
 Cryptanalysis of the Rainbow and its predecessors was actively developed in the early 2000s. Attacks from this era include the MinRank attack, the HighRank attack, the Bill-Gilbert attack, the UOV agreement attack, and the Rainbow bandwidth attack. After 2008, cryptanalysis seemed to have stopped, until the Rainbow's participation in the NIST PQC project, which motivated the continuation of cryptanalysis. During the second round of NIST, Bardett and others proposed a new algorithm for solving the MinRank problem. This dramatically increased the effectiveness of MinRank's attack, although not enough to threaten the parameters provided to NIST. A less memory-intensive version of this algorithm was suggested by Baena et al. Perlner and Smith-Tone analyzed the Rainbow bandwidth attack in depth, which showed that the attack was more effective than previously thought. This prompted the Rainbow team to increase slightly the parameters for the third round. During the third round, Bellens introduced a new attack that reduced the Rainbow's security by 220 times for SL 1. The Rainbow team claimed that despite the new attacks, the Rainbow's parameters still met NIST requirement.
 The purpose of this article is to present two new (partial) key recovery attacks on multivariate cryptographic transformations using rank systems.

New complexity estimation on the Rainbow-Band-Separation attack

Multivariate public key cryptography is a candidate for post-quantum cryptography, and it allows generating particularly short signatures and fast verification. The Rainbow signature scheme proposed by Ding and Schmidt is such a multivariate cryptosystem, and it is considered secure against all known attacks. The Rainbow-Band-Separation attack recovers a secret key of Rainbow by solving certain systems of quadratic equations, and its complexity is estimated by the well-known theoretical value called the degree of regularity. However, the degree of regularity is generally larger than the solving degree in experiments, and an accurate estimation cannot be obtained. In this article, we propose a new theoretical value for the complexity of the Rainbow-Band-Separation attack using a Gröbner basis algorithm, which provides a more precise estimation compared to that using the degree of regularity. This theoretical value is deduced by the two-variable power series∏i=1m(1−t1di1t2di2)(1−t1)n1(1−t2)n2. Since the two-variable power series coincides with the one-variable power series at t1=t2 deriving the degree of regularity, the theoretical value is less than or equal to the degree of regularity under a certain condition. Moreover, we show a relation between the Rainbow-Band-Separation attack using the hybrid approach and the HighRank attack. By considering this relation and our theoretical value, we obtain a new complexity estimation for the Rainbow-Band-Separation attack. Furthermore, applying our theoretical value to the complexity formula used in the NIST PQC 2nd round, we show that a slight modification of the proposed Rainbow parameter sets is required. Consequently, we provide a new theoretical value for generally estimating the solving degree of a bi-graded polynomial system, which can influence the parameter selection of Rainbow in the NIST PQC standardization project.

Generation of general system parameters for Rainbow signature scheme

The paper considers the description of electronic signature scheme Rainbow, which is based on multivariate transformations. It is a generalization of the UOV structure, which provides efficient parameterization due to the additional algebraic structure. The article provides an initial analysis of known attacks on the ES Rainbow scheme. Also, algorithms for generating general system parameters for 384 and 512 security bits were developed and the results are presented in this paper. The study found that the Rainbow signature generation process consists of simple operations of linear algebra, such as multiplying matrix vectors and solving linear systems over small finite fields. Another advantage of Rainbow is that this scheme offers very small signatures of only a few hundred bits. But the main disadvantage of Rainbow is the large size of public keys.

Rainbow Signature Scheme to Secure GOOSE Communications From Quantum Computer Attacks

The International Electrotechnical Commission (IEC) 62351-6 standard prescribes provisions to secure IEC 61850-8-1 generic object-oriented substation events (GOOSE) communications from cyber threats. The GOOSE authentication schemes recommended by IEC 62351-6 have shortcomings, such as long authentication-value computation times, large signature lengths, the usage of symmetric keys, and susceptibility to quantum computer attacks. To overcome these, this paper proposes the usage of the rainbow signature scheme (RSS), a quantum cryptographic method to secure GOOSE messages. The RSS offers fast signature generation and verification using asymmetric keys, making it very attractive to meet the time-latency and security requirements of the GOOSE protocol. The adaptation of the RSS cryptography method for its application to the GOOSE protocol is presented in this paper. The algorithms for key generation, signature computation and message verification are discussed in detail. A first-of-its-kind C library that incorporates security features within the GOOSE protocol in compliance with the IEC 62351-6-stipulated format, is developed. The superior features of the RSS in comparison with the other IEC 62351-6 security schemes are demonstrated.

Analysis of security of post-quantum algorithm of Rainbow electronic signature against potential attacks

Multidimensional public key cryptography is a candidate for post-quantum cryptography, and it makes it possible to generate particularly short signatures and quick verification. The Rainbow signature scheme proposed by J. Dean and D. Schmidt is such a multidimensional cryptosystem and it is considered to be protected against all known attacks. The need for research on Rainbow ES is justified by the fact that there is a need to develop and adopt a post-quantum national securities standard, and that in the process of the US NIST competition on the mathematical basis of cryptographic transformation method Rainbow, promising results. Therefore, it is considered important to take them into account and use them in Ukraine. The Rainbow signature scheme can be implemented simply and efficiently using linear algebra methods over a small finite field and, in particular, creates shorter signatures than those used in RSA and other post-quantum signatures [1]. In the 2nd round of NIST PQC, protected sets of Rainbow parameters are offered and several attacks on them are analyzed [1]. When comparing ES, preference is given to ES algorithms that have been selected according to unconditional criteria, as well as those that have better indicators for integral conditional criteria, because such a technique is more rational. In particular, the Rainbow-Band-Separation (RBS) attack [2] is the best known Rainbow attack with a certain set of parameters and is important. The Rainbow-Band-Separation attack restores the Rainbow secret key by solving certain systems of quadratic equations, and its complexity is measured by a well-known measure called the degree of regularity. However, as a rule, the degree of regularity is greater than the degree of solution in experiments, and it is impossible to obtain an accurate estimate. The paper proposes a new indicator of the complexity of the Rainbow-Band-Separation attack using F4 algorithm, which gives a more accurate estimate compared to the indicator that uses the degree of regularity.
 The aim of the work is a comparative analysis of ES based on MQ-transformations on the criterion of stability-complexity and an attempt to understand the security of Rainbow against RBS attack using F4.

A Rainbow-Based Authentical Scheme for Securing Smart Connected Health Systems.

Smart Connected Health Systems (SCHSs) belong to health systems that provide services of health care remotely. They provide the doctors with access to electronic medical records with the aid of medical sensors, smart wearable devices and smart medical instruments. Although SCHSs have many applications in the area of health care, securing massive amount of valuable and sensitive data of the patients and preserving the privacy are challenging. User authentication based on public key cryptographic techniques is playing a crucial role in SCHSs for protecting the privacy of patients. However, quantum computers will break such techniques. Rainbow signature is one of the candidates of the next generation of cryptographic algorithms which can resist attacks on quantum computers. However, it is vulnerable to Differential Power Analysis (DPA) attacks, which is based on information gained from the cryptographic implementations. We present techniques to exploit the countermeasures to protect Rainbow against DPA attacks. We propose a variant of Rainbow with resistance to DPA attacks. First, we take a random vector to randomize the power consumption of private keys during computing the first affine transformation; Second, random variables are adopted during computing central map transformation; Third, we take two random vectors during computing the second affine transformation to randomize the power consumption of private keys. We analyze the efficiency and implement the scheme on hardware. Compared with the related implementations, our scheme is efficient and suitable for signature generations on hardware. Besides, we propose a secure authentical scheme based on the implementation for protecting record of patients in SCHSs.

On the security of MQ cryptographic systems for constructing secure Internet of medical things

The Internet of Medical Things (IoMTs) are the group of medical devices connected to Internet, to perform the processes and services that support healthcare. The amount of data handled by medical devices grows exponentially, which means higher exposure of personal sensitive data. RSA, ECC and, other related public key cryptographic systems with countermeasures of power analysis and fault analysis, e.g., random masking, are often adapted by medical devices for guaranteing security and privacy. However, Shor algorithm has proven that they are not secure to quantum computer attacks. Fortunately, there exists a few quantum-resistant public key cryptographic schemes, e.g., Rainbow. To ensure end-to-end service delivery in the IoMTs under quantum attacks, there is a critical need for research into new designs and evaluation for the hardware security of new quantum-resistance cryptographic systems, e.g., rainbow, to make the medical devices more secure and reliable. Therefore, we present a physical analysis model of Rainbow by combining fault analysis and differential power analysis. The proposed model is implemented on cloud computing platform. Based on the experimental results, we successfully recover all the secret keys of Rainbow signature, which shows the importance of protecting multivariate signature with countermeasures on medical devices.

Under Quantum Computer Attack: Is Rainbow a Replacement of RSA and Elliptic Curves on Hardware?

Among cryptographic systems, multivariate signature is one of the most popular candidates since it has the potential to resist quantum computer attacks. Rainbow belongs to the multivariate signature, which can be viewed as a multilayer unbalanced Oil-Vinegar system. In this paper, we present techniques to exploit Rainbow signature on hardware meeting the requirements of efficient high-performance applications. We propose a general architecture for efficient hardware implementations of Rainbow and enhance our design in three directions. First, we present a fast inversion based on binary trees. Second, we present an efficient multiplication based on compact construction in composite fields. Third, we present a parallel solving system of linear equations based on Gauss-Jordan elimination. Via further other minor optimizations and by integrating the major improvement above, we implement our design in composite fields on standard cell CMOS Application Specific Integrated Circuits (ASICs). The experimental results show that our implementation takes 4.9 us and 242 clock cycles to generate a Rainbow signature with the frequency of 50 MHz. Comparison results show that our design is more efficient than the RSA and ECC implementations.

Building a new secure variant of Rainbow signature scheme

Rainbow is an effective multivariate digital signature scheme proposed by Ding and Schmidt. However, a lot of attacks against it have been proposed. To resist all these attacks, designer should be very careful with its choice of parameters. In this study, the authors will propose a new approach to build a secure variant of Rainbow. According to our security analysis, it could resist all the existing attacks against Rainbow and save some memory in the meantime.

An Authentication Scheme Based on the Light-Weight Rainbow Signature for Wireless Sensor Network

Based on the rainbow signature scheme and combining the minus perturbation method of the Shamir, a new light-weight rainbow signature scheme is proposed. This scheme only uses the addition and multiplication operation, so it can be performed easily. This scheme has high security and can resist the minimal rank, rank reduction attacks and oil-vinegar attacks, etc. Based new signature scheme, we also design authentication mechanism for the WSN. According to the characters of the cluster WSN, this authentication mechanism can choose proper authentication parameters to realize the authentication on the cluster WSN by the platform and the authentication between the sensor node and its neighbor nodes.

A Light-Weight Rainbow Signature Scheme for WSN

Since the wireless sensor network (WSN) is limited by power, computation capability and storage resources, it is difficult for the existed cryptographic schemes which are based on the traditional symmetric or public key cryptography to adapt to these restrictions. Till now, most studies are based on the Elliptic Digital Signature Algorithm (ECDSA), however, which have heavy energy consumption and cost much verification time, they are still not suitable for the WSN. Thus it is necessary to find a new cryptography to provide the security for the WSN. In this paper, firstly, we propose a light-weight rainbow signature (LWRS) scheme based on Shamir's minus method, and the performances of it has been evaluated with respect to the memory and computation time. Secondly, by choosing the proper number of variables, we use the scheme between the nodes or between the WSN and the business platform of the internet of things. Meanwhile, we set up the layer of the LWRS the same as that of the cluster WSN. That is, the ordinary node has the lowest energy and corresponds to the first layer of the LWRS scheme. Finally, we give the security analysis of the LWRS scheme. More specifically speaking, by choosing the appropriate number of oil-vinegar variables, our scheme can resist general attacks, rank reduction attacks and oil-vinegar attacks, etc.