I. INTRODUCTION. against the existing

Transcription

1 Paamete secuty caactezato of kapsack publc-key cypto ude quatum computg Xagqu Fu,, Wasu Bao,,*, Jaog S,, Fada L,, Yucao Zag, ( Zegzou Ifomato Scece ad Tecology Isttute, Zegzou, Ca 454 Syegetc Iovato Cete of Quatum Ifomato ad Quatum Pyscs, Uvesty of Scece ad Tecology of Ca, Hefe, Ca 36) Abstact: I ode to eseac te secuty of te kapsack poblem ude quatum algotm attack, we study te quatum algotm fo kapsack poblem ove Z based o te elato betwee te dmeso of te kapsack vecto ad Fst, te oacle fucto s desged based o te kapsack vecto B b, b,, b ad S, ad te quatum algotm fo te kapsack poblem ove Z s peseted Te obsevato pobablty of taget state s ot mpoved by desgg utay tasfom, but oacle fucto Its complexty s polyomal Ad ts success pobablty depeds o te elato betwee ad Fom te above dscusso, we gve te essetal codto fo te kapsack poblem ove Z agast te exstg quatum algotm attacks, e O( ) Te we aalyze te secuty of te Co-Rvest publc-key cypto PACS umbes: 367Lx, 367Ac, 365Sq I INTRODUCTION Kapsack publc-key ecypto scemes [] ae based o te kapsack poblem, wc s NP-complete Mekle-Hellma kapsack ecypto sceme was te fst cocete ealzato of a publc-key ecypto sceme As ts secue bass s supeceasg kapsack poblem, t as bee demostated to be secue May vaatos ave subsequetly bee poposed, wose kapsack vecto desty ae less ta L 3 -lattce bass educto algotm [] s a polyomal-tme algotm fo fdg a educed bass we gve a bass fo a lattce I 99, Sco ad Euce peseted ad mpoved algotm [3] I 99, Coste et al gave a algotm fo low desty kapsack poblem based o lattce bass educto algotm [4] If te desty of te kapsack s less ta 948, te kapsack poblem ca be solved wt g pobablty Tus most vaatos of te Mekle-Hellma sceme ae secue Howeve, tee s ot a effcet algotm fo solvg kapsack poblem, ad te complexty of te O [5], wee s te dmeso of te kapsack vecto best algotm s So peseted a quatum algotm fo ode-fdg [6], based o wc factog ad dscete logatm ove fte feld ca be solved polyomal tme Te publc-key cypto, suc as RSA ad ECC, s ude teat Gove peseted a quatum seac algotm acevg quadatc speedup fo te ustuctued seac poblem [7], wc ca be used fo seacg cyptogapc key Fom te o, lots of acevemets ave bee made o te quatum compute ad quatum algotm [8~] Te success pobablty of te quatum algotm s depcted by te measuemet pobablty of te taget state(mpts) I te exstg quatum algotm, te MPTS s mpoved by desgg utay tasfom Fo example, ug quatum Foue tasfom oce ca obta g MPTS So s algotm; ug Gove teato O( N ) tmes ca obta g MPTS Gove s algotm, wee N s te sze of te seac space Teefoe te success pobablty ad complexty of te quatum algotm deped o te MPTS Most of te polyomal quatum algotms ca be educed to Abela dde subgoup poblem, but kapsack poblem caot Tus, oe to desg te quatum algotm fo kapsack poblem based o ew metod of mpovg MPTS eques fute study Te best quatum algotm fo geeal kapsack poblem was peseted by VAvd ad RScule [], wc s based o te - Itege Lea Pogams ad Gove s algotm Its complexty ad success pobablty ae espectve O(c /3 ) ad Tee s o effcet quatum algotm fo kapsack poblem Tus we coectue tat kapsack poblem ca esst te quatum computg attack Sce te kapsack publc-key cypto s based o te kapsack poblem wt specal popety, suc as supeceasg ad low desty, t ca be boke polyomal Fo te classcal algotm fo kapsack poblem ove Z, ts complexty s coelated wt (te dmeso of te kapsack vectob = ( b, b,, b ) ), ot wt Howeve, te elatosp betwee ad te quatum algotm fo * tzz@sacom - -

2 kapsack poblem ove Z s stll ukow Tus, based o te elato betwee ad, t s wot gvg te essetal codto fo te kapsack poblem ove Z agast te exstg quatum algotm attacks Futemoe, t ca povde te teoetcal bass fo te secuty of te publc-key cypto, wc s based o te NPC poblem I ts pape, we peset a quatum algotm fo kapsack poblem ove Z, based o wc te essetal codto fo te kapsack poblem ove Z agast ts algotm s gve Te we aalyze te secuty of Co-Rvest publc-key cypto II BACKGROUND Te secuty of te kapsack publc-key cypto depeds o kapsack poblem, wc s NPC poblem Defto Te kapsack poblem [5] s te followg: gve a vecto B b, b,, b ad S, deteme wete o ot tee exst, x,, suc tat Kapsack publc-key cypto s geeally based o kapsack poblem ove Defto Te kapsack poblem ove S, wee b bx S Z Z s te followg: gve a vecto B b, b,, b Î Z, deteme wete o ot tee exst x,, bx mod S B s called te kapsack vecto, wose dmeso s ad, suc tat I quatum algotm, quatum Foue tasfom s a vey mpotat utay tasfom, wc ca be used fo pepag supeposto state ad mpovg te MPTS Defto 3 (Quatum Foue tasfom) [3] Te quatum Foue tasfom QFT o a otoomal bass,,, N s defed to be a lea opeato U F wt a acto o te bass states descbed by N k UF : N N k k Teefoe, te acto o a abtay state may be wtte as N NN k UF : x xn N k k, N wee te symbol stads fo a vetble tasfom ad N e If N, t s called te -dmesoal QFT III QUANTUM ALGORITHM FOR KNAPSACK PROBLEM OVER Z Fo te classcal algotm fo kapsack poblem ove Z, ts complexty s coelated wt (te dmeso of te kapsack vectob = ( b, b,, b ) ), ot wt Accodg to Defto ad Defto, te bgge s, e te less te umbe of solutos fo kapsack poblem ove Z s, te ge safety of te kapsack publc-key cypto s Tus, we peset a quatum algotm fo kapsack poblem ove Z, wc ca be used fo depctg te secuty of kapsack poblem ove Z based o te elato betwee ad Fo abtay x ad y, z x y meas z ( x y)mod, wee ( x, x,, x ), ( y, y,, y ), ( z, z,, z ) ae espectvely te bay epesetato of x, y ad z, e x x, y y ad z z Fo te sake of agumet, k s deoted as te umbe of te solutos fo kapsack poblem, e tee ae - -

3 k tmesm, m,, m Z s te bay epesetato of Teoem Suppose xyz,, {,,, }, z x y f ad oly f Poof: If f ( xy, ) gz ( ), e m, suc tat mb S, wee,,, k f ( xy, ) ( x y) bs xb x x, x ad y ad z y m y z m, ( x y ) b S xb zb S (z x ( x y )) b Sce z x y, z x ( x y) s ete o Futemoe, ca be foud, suc tat z x ( x y) m Case We z, x ( x y) m Case (a) If m, { x, y }, e x m ad y z m Case (b) If m, { x, y }, e x m ad y z m Case We z, x ( x y) m Case (a) If m, { x, y }, e x m ad y z m Case (b) If m, { x, y }, e x m ad y z m If tee s, suc tat x m ad y z m t s obvous tat f ( xy, ) gz ( ) Tus we obta Teoem Accodg to Teoem, we ca obta Coollay Coollay Suppose f ( xy, ) ( x y) bs xb y y, u ad,,, m m m Z gz ( ) zb, wee z, te f ( xy, ) gz ( ) wt ad uv (, ) ( uv) b, wee,,, {,,, xyuv }, x x, u ad v v, te f ( xy, ) uv (, ) wt u v x y f ad oly f x m, y u v m f ad s called te adot fucto Accodg to Coollay, f x, yuv,, satsfy u v x y ad f ( xy, ) uv (, ), ( x, x,, x ) s a soluto of kapsack poblem ove Z Defto 4 Te exteded kapsack poblem ove Z s te followg: gve a vecto B b, b,, b ad S, wee b Î Z, deteme wete o ot tee exst x,,,, - 3 -

4 , suc tat bx mod S Let k be te umbe of solutos of te exteded kapsack poblem ove Z, e te umbe of m m m,,,,,, s k, suc tat If mb Sfo,,, k B { m, m,, m,,,,,, k} ad B {,,, }, t s obvous tat B 4 ad B Tus, fo abtay S B, te aveage umbe of solutos of te exteded kapsack poblem ove Z s 4 Futemoe, f O(4 ), e 4 O(), we ca obta tat k O() Now, we gve te quatum algotm fo te kapsack poblem ove Z, wee ad satsfy O(4 ) Ts algotm ca be sowed as follows Quatum algotm fo te kapsack poblem ove Z Step Gve 5 quatum egstes, wose dmeso ae espectvely,,, ad log 3 Te tal state ae all Apply te quatum Foue tasfom to te fome fou egstes, te obta te supeposto state Step Pefom te oacle fucto a x y z 3 a x y z f( x, y), a Gaxyz (,,, ), xz (, ), a 3 3 a x y z a x y z wee te defto of f ad ae te same as Defto, Step3 Measue te last egste ad get A We ca obta ( x y z A (+ t t) z x, y wee x (, z) A, f ( x, y ) A (( x z ) x ( x y )) b S a x y z a x y z G( a, x, y, z) y y ad y x, z x y z A ) z z, t ( x, z) ( x, z) A, t ( x, y) f( x, y) A Step4 Measue te fst egste ad get t Obta otewse output falue Step5 Measue te secod ad td egste We ca obta ad x y z A f z x, y t x ad y Set m x t, - 4 -

5 Step6 ( m, m,, m ) s oe soluto of te kapsack poblem ove Z f output falue Coectess, success pobablty ad complexty ae vey mpotat a quatum algotm Coectess ad success pobablty mb S, otewse Te success pobablty s uelated to Step ad Step Oly we t Step4 wll te algotm go o pefomg Step5 It s obvous tat Step ad Step ae bot coect Tus te algotm s coectess ad success pobablty ae oly elated to Step3, Step4, Step5 ad Step6 () I Step3, we ca obta te measuemet esult A Case If tee ae x ad z, suc tat A G(, x, y, z), x y z A s fmly cluded te supeposto state ad x (, z) A Accodg to Coollay, x y z A s also cluded te supeposto state ad (( x z ) x ( x y )) b S Case If tee ae x ad y, suc tat A G(, x, y, z), x y z A s fmly cluded te supeposto state ad f ( x, y) A Accodg to Coollay, x y z A s also cluded te supeposto state ad (( x z ) x ( x y )) b S Tus, accodg to Case ad Case, we ca obta ( x y z A (+ t t) z x, y y x, z x y z A ) Step3 () Sce (( x z ) x ( x y )) b S, fo abtay m, AS= ( xz) b S (( xz) m ) b (( x y) x) b It s obvous tat ( x y) x{,,,} ad ( x z) m {,,, } If te umbe of D d, d,, d s t, wee bd mod A S ad d {,,,}, we wll get t t ad t t Sce x ad y ae depedet of oe aote, ( x y ) x,( x y ) x,,( x y ) x ca go toug D, D,, Dt Futemoe, Step4, te pobablty of t s t P t t (3) I Step4, eac quatum state x y z A of te supeposto state satsfes Fo abtay m, tee s y, suc tat AS= (( x y) x) b - 5 -

6 e ( m y ) m ( xz) m (( m y ) m ) b A- S Tus, te supeposto state must clude quatum state m y z A Afte measug Step5, te pobablty of gettg m s k P t Accodg to (), () ad (3), te success pobablty of ts algotm s P P P k t t We O(4 ), te aveage value of t s O (), e te pobablty of ts algotm s at least O () Complexty I Step, te algotm eed take tme oe-dmesoal quatum Foue tasfom ad 3 tmes -dmesoal quatum Foue tasfom Ad -dmesoal quatum Foue tasfom eques O ( ) elemetay quatum gates [3] Tus, t eques O ( ) elemetay quatum gates fo Step I Step, te algotm eques addto opeatos, wee te added s legt s log Ad te addto opeatos eques O(( log ) ) elemetay quatum gates [4] Tus, t eques O(( log ) ) elemetay quatum gates fo Step I Step3 ad Step4, te algotm oly eed take measug opeato Tus, t eques O () elemetay quatum gates fo Step3 ad Step4 I Step5, te algotm eed take tmes measug opeato ad tme classcal computg Tus, t eques O () elemetay quatum gates fo Step5 Te classcal computg ca be doe polyomal tme I Step6, te algotm eed take tme classcal computg, wc ca be doe polyomal tme Tus, t eques O(( log ) ) fo ts algotm, wose complexty s polyomal If adot fucto f ( xy, ) ad uv (, ) ae equal, te elato betwee m, x ad y ca be got Based o te elato, we ca costuct a system of lea equatos vaables m, m,, m, wose ak s Fute, we ca obta m Safe paamete of kapsack poblem ude quatum computg Te success pobablty of te quatum algotm fo kapsack poblem ove Z depeds o te umbe of solutos of te exteded kapsack poblem ove Z If t O( ), e te success pobablty of te algotm s O ( ), te algotm eed mplemetg O ( ) tmes to obta oe soluto of te kapsack poblem ove Z wt O () pobablty Tus, to guaatee te secuty of te kapsack publc-key cypto, ad must satsfy O( ), e 4 O( ) Futemoe, te bgge s, te ge te success pobablty of te algotm, e te ease te kapsack poblem ove Z ca be solved NPC poblem s te secue bass of te post-quatum publc-key cypto Sce all NPC poblems ae educed eac ote, pope paametes ae cose fo te post-quatum publc-key cypto to esst te quatum algotm fo kapsack poblem ove Z, wc based o te NPC poblem - 6 -

7 toa IV THE SECURITY OF CHOR-RIVEST KNAPSACK PUBLIC-KEY CRYPTO Mekle-Hellma kapsack ecypto sceme s secue, most of wose vaatos ae also secue Sce 3 kapsack vecto desty of tese vaatos ae less ta, tey caot esst te L algotm Co-Rvest kapsack publc-key cypto s te oly kow publc-key cypto sceme tat does ot use some fom of modula multplcato [5] 3 Ad t ca esst te L algotm, sce ts kapsack vecto desty s moe ta It s sow as follows Co-Rvest kapsack publc-key cypto [5] Key geeato Step Coose fte feld F q of caactestc p, wee q p ad p, ad fo wc te dscete logatm poblem s feasble Step Coose a adom moc educble polyomal q f x of degee ove Z p Te elemets of F wll be epeseted as polyomals Z [ x ] of degee less ta, wt multplcato pefomed modulo f x Step3 Select a adom pmtve elemet Step4 Compute a log x p g x of F q, fo eac Z g x p Step5 Coose a adom pemutato o,,, p Step6 Coose d, d p Step7 Compute mod b a d p, p Step8 Publc key s p b, b,, b, p, Ecypto B sould do te followg ; pvate key s f x, g x,, d Step Tasfom te message m to a bay vecto M M, M,, M p exactly s as follows: Let l Fo fom to p do te followg: p If m l te set M, M p Step Compute c M mod b p Step3 Sed te cpetext c Decypto A sould do te followg cd mod p Step Compute Step Compute ux gx mod f x Step3 Compute sxux f x Step4 Facto sx to sx xt, wee t Zp Step5 Compute a bay vecto M M, M,, M p ave dces t Te emag compoets ae Step6 Te message m s ecoveed fom M as follows: Let m, l Fo fom to p do te follows: of legt p avg p mm l, l l Otewse, set as follows Te compoets of M tat ae - 7 -

8 p If M te set mm l ad l l Te coectess of Co-Rvest sceme s sow Refeece [5] If we obta M fom cb,, b,, bp, t s easy to obta m Te secuty of Co-Rvest sceme s based o te kapsack poblem ove Z p To date, ude classcal computg, safe paametes p ad fo te Co-Rvest sceme wee peseted Refeece [6], wc sould satsfy fve codtos, e () p s a pme, () s a pme, (3) p, (4) 3, 44 6 (5) p I ts pape, tese codtos ae called Fve Codtos (FC) fo sot Futemoe, te geatest pme facto 3 of p s equal to o less ta fo computatoal feasblty If p 9 ad 9, wc ae te poposed paametes Refeece [6] satsfy te FC Te Co-Rvest sceme fo tese paametes s secue ude classcal computg Sce 4 (9 ) O( ), te Co-Rvest sceme fo tese paametes ca be boke wt at least 6956 pobablty by te quatum algotm fo kapsack ove Z, e t ca be boke wt goable pobablty polyomal tme Tus, ude quatum computg, FC ad 4 p ( p ) O( p ) ca be used fo depctg te secuty of Co-Rvest sceme V CONCLUSION Te quatum algotm fo kapsack poblem ove Z s peseted, wose success pobablty eles o te umbe of solutos of te exteded kapsack poblem ove Z Te metod of paamete selecto s gve fo te kapsack poblem ove Z agast te exstg quatum computg Howeve, te quatum algotm oly solves te kapsack poblem ove Z wt specal paamete How to desg a quatum algotm fo geeal kapsack poblem ove Z eques fute study Ts wok was suppoted by te Natoal Basc Reseac Pogam of Ca (Gat No 3CB338) REFERENCES [] Mekle R C, Hellma M E Hdg fomato ad sgatues tapdoo kapsacks IEEE Tasactos o Ifomato Teoy, 978, 4:4-6 [] Lesta A K, Lesta H W, Lovasz L Factog polyomals wt atoal coeffcets Matematsce Aale, 98, 6: [3] Sco C P, Euce M Lattce bass educto: mpoved pactcal algotms ad solvg subset sum poblems Fudametals of Computato teoy(lncs 59):68-85 [4] Coste J M, Joux A,LaMacca B A, et al Impoved low-desty subset sum algotms Computatoal Complexty, 99, : -8 [5] Meezes A J, Ooscot P C V, Vastoe S A Hadbook of Appled Cyptogapy Cada: CRC Pess LLC, 997 [6] So P W Polyomal-tme algotms fo pme factozato ad dscete logatms o a quatum compute SIAM J Comput, 997, 6: [7] Gove L K A fast quatum mecacs algotm fo database seac I: Poceedg of te 8t ACM Symposum o Teoy of Computato New Yok: ACM Pess, [8] Log G L Gove algotm wt zeo teoetcal falue ate Pys Rev A,, 64: 37 [9] Zalka C Gove s Quatum Seacg Algotm s Optmal Pys Rev A, 999, 6(4): [] FU Xag-Qu, BAO Wa-Su, ZHOU Cu Speedg up mplemetato fo So s factozato quatum algotm Cese Sc Bull,, 55(3): [] Gove L K Fxed-pot quatum seac Pys Rev Lett, 5, 95(5): 55 [] Avd V, Scule R Te quatum quey complexty of - kapsack ad assocated claw poblems Lectue Notes Compute Scece, 3, 96:

9 [3] Nelse M A, Cuag I L Quatum computato ad quatum fomato Cambdge: Cambdge Uvesty, [4] Vedal V, Baeco A, Eket A Quatum etwoks fo elemetay atemetc opeatos Pys Rev A, 996, 54: [5] Co B, Rvest R L A kapsack type publc key cyptosystem based o atmetc fte felds I: Blakley G R, Caum D, eds Advaces Cyptology: Poceedgs of CRYPTO 84, 984 Aug 9-, Sata Babaa Bel: Spge, 984, [6] Ecas L H, Masque J M, Dos A Q Safe paametes fo te Co-Rvest Computes & Matematcs wt Applcatos, 8, 56 ():