A Classification of Differential Invariants for Multivariate Post-Quantum Cryptosystems

Transcription

1 A Classification of Differential Invariants for Multivariate Post-Quantum Cryptosystems Ray Perlner 1 Daniel Smith-Tone 1,2 1 National Institute of Standards and Technology 2 University of Louisville 7th June, th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 1/23

2 Prototypical Multivariate Public Key Scheme Let f be an efficiently invertible (in some sense) system of n quadratic equations in m variables over some field F q. Let U and T be F q -linear maps of dimension m and n, respectively. Let P = T f U. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 2/23

3 Prototypical Multivariate Public Key Scheme Let f be an efficiently invertible (in some sense) system of n quadratic equations in m variables over some field F q. Let U and T be F q -linear maps of dimension m and n, respectively. Let P = T f U. Next... BELIEVE! 1 Inversion requires solving an instance of MQ or IP. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 2/23

4 Prototypical Multivariate Public Key Scheme Let f be an efficiently invertible (in some sense) system of n quadratic equations in m variables over some field F q. Let U and T be F q -linear maps of dimension m and n, respectively. Let P = T f U. Next... BELIEVE! 1 Inversion requires solving an instance of MQ or IP. 2 Solving such an instance of MQ is hard. 3 Solving such an instance of IP is hard. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 2/23

5 Discrete Differential Multivariate Systems Definition The Discrete Differential of a map f : k k is given by: Df(a,x) = f(a+x) f(x) f(a)+f(0). 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 3/23

6 Discrete Differential Multivariate Systems Definition The Discrete Differential of a map f : k k is given by: Df(a,x) = f(a+x) f(x) f(a)+f(0). Elementary Properties 1 Linear operator. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 3/23

7 Discrete Differential Multivariate Systems Definition The Discrete Differential of a map f : k k is given by: Df(a,x) = f(a+x) f(x) f(a)+f(0). Elementary Properties 1 Linear operator. 2 Reduces complexity of a function: If f is quadratic, Df is bilinear. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 3/23

8 Discrete Differential Multivariate Systems Definition The Discrete Differential of a map f : k k is given by: Df(a,x) = f(a+x) f(x) f(a)+f(0). Elementary Properties 1 Linear operator. 2 Reduces complexity of a function: If f is quadratic, Df is bilinear. 3 If f is quadratic, D(Tf(Ux +c)+d) = D(Tf(Ux)). 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 3/23

9 Differential of Multivariate Scheme DP Let P = T f U. DP(a,x) = TDf(La,Lx). 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 4/23

10 Differential of Multivariate Scheme DP Let P = T f U. DP(a,x) = TDf(La,Lx). Differential Coordinate Forms Since P has n coordinates, DP can be split into n bilinear differential coordinate forms, DP i = T i Df(La,Lx), where T i represents the action of T on the ith coordinate. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 4/23

11 Differential of Multivariate Scheme DP Let P = T f U. DP(a,x) = TDf(La,Lx). Differential Coordinate Forms Since P has n coordinates, DP can be split into n bilinear differential coordinate forms, DP i = T i Df(La,Lx), where T i represents the action of T on the ith coordinate. Span of Forms For all multivariate schemes, Span(DP i ) Span(D(f L) i ). 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 4/23

12 The C Scheme Multivariate Systems The C cryptosystem is the simplest example of a big field scheme. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 5/23

13 The C Scheme Multivariate Systems The C cryptosystem is the simplest example of a big field scheme. Construction ] k n F q 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 5/23

14 The C Scheme Multivariate Systems The C cryptosystem is the simplest example of a big field scheme. Construction ] k n We can identify x k with x F n q. F q 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 5/23

15 The C Scheme Multivariate Systems The C cryptosystem is the simplest example of a big field scheme. Construction ] k n We can identify x k with x F n q. F q Encryption Scheme y = P(x) = (T f U)x where f(x) = x qθ +1. (Df(a,x) = ax qθ +a qθ x.) 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 5/23

16 Differential Attack on C -Patarin s Relation Trivial Differential Relation We know that Df(v,v) = 0, since Df is antisymmetric. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 6/23

17 Differential Attack on C -Patarin s Relation Trivial Differential Relation We know that Df(v,v) = 0, since Df is antisymmetric. We Compute... 0 = Df(v,v) 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 6/23

18 Differential Attack on C -Patarin s Relation Trivial Differential Relation We know that Df(v,v) = 0, since Df is antisymmetric. We Compute... 0 = Df(v,v) = Df(v,u qθ +1 ) 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 6/23

19 Differential Attack on C -Patarin s Relation Trivial Differential Relation We know that Df(v,v) = 0, since Df is antisymmetric. We Compute... 0 = Df(v,v) = Df(v,u qθ +1 ) = vu q2θ +q θ +v qθ u qθ +1 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 6/23

20 Differential Attack on C -Patarin s Relation Trivial Differential Relation We know that Df(v,v) = 0, since Df is antisymmetric. We Compute... 0 = Df(v,v) = Df(v,u qθ +1 ) = vu q2θ +q θ +v qθ u qθ +1 ( ) = u qθ vu q2θ +v qθ u 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 6/23

21 Differential Attack on C -Patarin s Relation Trivial Differential Relation We know that Df(v,v) = 0, since Df is antisymmetric. We Compute... 0 = Df(v,v) = Df(v,u qθ +1 ) = vu q2θ +q θ +v qθ u qθ +1 ( ) = u qθ vu q2θ +v qθ u Therefore, vu q2θ = v qθ u. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 6/23

22 Differential Attack on C -Patarin s Relation Trivial Differential Relation We know that Df(v,v) = 0, since Df is antisymmetric. We Compute... 0 = Df(v,v) = Df(v,u qθ +1 ) = vu q2θ +q θ +v qθ u qθ +1 ( ) = u qθ vu q2θ +v qθ u Therefore, (T 1 y)(ux) q2θ = (T 1 y) qθ (Ux). 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 6/23

23 Multiplicative Attack on C and C Definition [based on Dubois et al. (2007)] A function f has the Multiplicative Symmetry if: Df(σa,x)+Df(a,σx) = p(σ)df(a,x) for all σ k. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 7/23

24 Multiplicative Attack on C and C Definition [based on Dubois et al. (2007)] A function f has the Multiplicative Symmetry if: Df(σa,x)+Df(a,σx) = p(σ)df(a,x) for all σ k. C monomial Df(σa,x)+Df(a,σx) = (σ qθ +σ)df(a,x), 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 7/23

25 Multiplicative Attack on C and C Definition [based on Dubois et al. (2007)] A function f has the Multiplicative Symmetry if: Df(σa,x)+Df(a,σx) = p(σ)df(a,x) for all σ k. C monomial Df(σa,x)+Df(a,σx) = (σ qθ +σ)df(a,x), DP(U 1 σua,x)+dp(a,u 1 σux) = L σ DP(a,x). 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 7/23

26 Multiplicative Attack on C and C Definition [based on Dubois et al. (2007)] A function f has the Multiplicative Symmetry if: Df(σa,x)+Df(a,σx) = p(σ)df(a,x) for all σ k. C monomial Df(σa,x)+Df(a,σx) = (σ qθ +σ)df(a,x), DP(U 1 σua,x)+dp(a,u 1 σux) = L σ DP(a,x). This relation provides a criterion for discovering the multiplicative structure of k which undermines C. Since this method doesn t require that T be invertible, this method works for C as well to generate enough relations to turn it into C. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 7/23

27 Balanced Oil-Vinegar Multivariate Systems The Core Map Let f : F 2o q F o q be a random quadratic map such that given random constants c 1,...,c o F q, f(x 1,...,x o,c 1,...,c o ) is affine in x 1,...,x o. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 8/23

28 Balanced Oil-Vinegar Multivariate Systems The Core Map Let f : F 2o q F o q be a random quadratic map such that given random constants c 1,...,c o F q, f(x 1,...,x o,c 1,...,c o ) is affine in x 1,...,x o. The Entire Map The public map, P, is defined by P = f L for some affine map, L. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 8/23

29 Balanced Oil-Vinegar Multivariate Systems The Core Map Let f : F 2o q F o q be a random quadratic map such that given random constants c 1,...,c o F q, f(x 1,...,x o,c 1,...,c o ) is affine in x 1,...,x o. The Entire Map The public map, P, is defined by P = f L for some affine map, L. Inversion Randomly choose c 1,...,c o, solve y = f(x 1,...,x o,c 1,...,c o ), compute L 1 (x 1,...,x o,c 1,...,c o ) T. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 8/23

30 Differential Version of Kipnis-Shamir Attack Trivial Differential Property of Core Map Let O represent the subspace generated by the first o coordinates. For all a,x O, Df(a,x) = 0. Therefore each differential coordinate form, Df i, has the form: [ 0 Dfi1 Df T i1 Df i2 ]. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 9/23

31 Differential Version of Kipnis-Shamir Attack Trivial Differential Property of Core Map Let O represent the subspace generated by the first o coordinates. For all a,x O, Df(a,x) = 0. Therefore each differential coordinate form, Df i, has the form: [ 0 Dfi1 Df T i1 Df i2 Differential Invariant Let M 1 and M 2 be two invertible matrices in the span of the Df i. Then M1 1 M 2 is an O-invariant transformation of the form: [ ] A B. 0 C ]. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 9/23

32 Broken Multivariate Systems Find the Invariant Subspace Since D(f L) i = L T Df i L, an attacker needs only find two invertible maps, M 1,M 2, in the span of DP i, and find the invariant subspace of M 1 1 M 2. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 10/23

33 Broken Multivariate Systems Find the Invariant Subspace Since D(f L) i = L T Df i L, an attacker needs only find two invertible maps, M 1,M 2, in the span of DP i, and find the invariant subspace of M 1 1 M 2. New Decryption Map Once recovered, the attacker produces a change of basis, M, sending the basis of O to the first o standard basis vectors. The attacker can then sign a document by the same method as the legitimate user. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 10/23

34 General Linear Symmetries Previous Work - Symmetries Present Work - Invariants Definition [based on Dubois et al. (2007)] We say that f satisfies a general linear symmetry if the following equation holds: Df(La,x)+Df(a,Lx) = Λ L Df(a,x). 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 11/23

35 General Linear Symmetries Previous Work - Symmetries Present Work - Invariants Definition [based on Dubois et al. (2007)] We say that f satisfies a general linear symmetry if the following equation holds: Df(La,x)+Df(a,Lx) = Λ L Df(a,x). Definition We denote the space of linear maps inducing the above symmetry, S G, and call this the space of symmetries. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 11/23

36 Previous Work - Symmetries Present Work - Invariants Classification of the Space of Symmetries for C Multiplicative Symmetry Since multiplication by σ, M σ S G, k < S G. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 12/23

37 Previous Work - Symmetries Present Work - Invariants Classification of the Space of Symmetries for C Multiplicative Symmetry Since multiplication by σ, M σ S G, k < S G. Theorem If f is a C monomial then S G equipped with standard multiplication is a k-algebra. Furthermore, if 3θ n then k = S G. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 12/23

38 Previous Work - Symmetries Present Work - Invariants Classification of the Space of Symmetries for C Multiplicative Symmetry Since multiplication by σ, M σ S G, k < S G. Theorem If f is a C monomial then S G equipped with standard multiplication is a k-algebra. Furthermore, if 3θ n then k = S G. In the case of the C scheme, the large size of this space allows a portion to survive when restrictions are made to the maps inducing symmetry while most arbitrary linear maps are eliminated. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 12/23

39 Previous Work - Symmetries Present Work - Invariants Classification of Maps Inducing Symmetry Theorem Let f(x) = x qθ +1, be a C monomial map. Let πx = d i=0 xqi and Mx = n 1 i=0 m ix qi be linear. Suppose Df(Ma,πx)+Df(πa,Mx) = Λ M Df(πa,πx). If θ +d < n 2, n 3θ > d, and 0 < d < θ 1, then M = M σ π for some σ k. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 13/23

40 Previous Work - Symmetries Present Work - Invariants Classification of Maps Inducing Symmetry Theorem Let f(x) = x qθ +1, be a C monomial map. Let πx = d i=0 xqi and Mx = n 1 i=0 m ix qi be linear. Suppose Df(Ma,πx)+Df(πa,Mx) = Λ M Df(πa,πx). If θ +d < n 2, n 3θ > d, and 0 < d < θ 1, then M = M σ π for some σ k. In the case of a codimension 1 projection, this result proves that the only linear symmetries of a pc scheme are the trivial scalar symmetries. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 13/23

41 Simultaneous Differential Invariants Previous Work - Symmetries Present Work - Invariants Definition Let f : k k. A simultaneous differential invariant of f is an F q -subspace V k such that AV V for all A Span(Df i ). 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 14/23

42 Simultaneous Differential Invariants Previous Work - Symmetries Present Work - Invariants Definition Let f : k k. A simultaneous differential invariant of f is an F q -subspace V k such that AV V for all A Span(Df i ). Example Let x V W where k = V W as an F q -vector space. Define f(x) = g(y)+h(z) where y V and z W. [ ] Dgi 0 Df i = ; 0 Dh i therefore, V and W are simultaneous differential invariants of f. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 14/23

43 First-order Differential Invariant Previous Work - Symmetries Present Work - Invariants Definition Let f : k k. A first-order differential invariant of f is an F q -subspace V k such that there exists a subspace W k of dimension at most dim(v) for which simultaneously AV W for all A Span(Df i ). 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 15/23

44 First-order Differential Invariant Previous Work - Symmetries Present Work - Invariants Definition Let f : k k. A first-order differential invariant of f is an F q -subspace V k such that there exists a subspace W k of dimension at most dim(v) for which simultaneously AV W for all A Span(Df i ). Clearly, every simultaneous differential invariant is first-order. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 15/23

45 Trivial Property I Multivariate Systems Previous Work - Symmetries Present Work - Invariants Proposition Let f : k k be quadratic and let L : k k be a nonsingular F q -linear map. If V is a first-order differential invariant of f L, then L 1 V is a first-order differential invariant of f. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 16/23

46 Trivial Property I Multivariate Systems Previous Work - Symmetries Present Work - Invariants Proposition Let f : k k be quadratic and let L : k k be a nonsingular F q -linear map. If V is a first-order differential invariant of f L, then L 1 V is a first-order differential invariant of f. Proof: A Span(Df i ) L T AL Span(D(f L) i ) L T ALV W for all L T AL Span(D(f L) i ) A(LV) (L T ) 1 W Since L is invertible, dim((l T ) 1 W) = dim(w) dim(v) = dim(lv). 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 16/23

47 Trivial Property II Multivariate Systems Previous Work - Symmetries Present Work - Invariants Proposition Let f : k k be quadratic and let L : k k be F q -linear. If V is a first-order differential invariant of f then the preimage of V under L is a first-order differential invariant of f L. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 17/23

48 Trivial Property II Multivariate Systems Previous Work - Symmetries Present Work - Invariants Proposition Let f : k k be quadratic and let L : k k be F q -linear. If V is a first-order differential invariant of f then the preimage of V under L is a first-order differential invariant of f L. Proof: A Span(Df i ) L T AL Span(D(f L) i ) Let ˆV be the preimage of V under L ALˆV W for all A Span(Df i ) L T ALˆV L T W for all L T AL Span(D(f L) i ) dim(l T W) dim(w) dim(v) dim(ˆv). 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 17/23

49 Previous Work - Symmetries Present Work - Invariants Induced Nonlinear Differential Symmetry To study the existence of a first-order differential invariant, we can analyze a particular nonlinear symmetry. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 18/23

50 Previous Work - Symmetries Present Work - Invariants Induced Nonlinear Differential Symmetry To study the existence of a first-order differential invariant, we can analyze a particular nonlinear symmetry. Orthogonal Subspaces Let V k be an F q -subspace of k. Define V = {x k x,v for all v V}. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 18/23

51 Previous Work - Symmetries Present Work - Invariants Induced Nonlinear Differential Symmetry To study the existence of a first-order differential invariant, we can analyze a particular nonlinear symmetry. Orthogonal Subspaces Let V k be an F q -subspace of k. Define V = {x k x,v for all v V}. Symmetric Relation Let V be a first-order differential invariant of f. Let M be a projection onto V and M be a projection onto (Span(Df i V)). Then Df(M a,mx) 0. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 18/23

52 C Invariants Multivariate Systems Previous Work - Symmetries Present Work - Invariants Theorem Let f be a C monomial. Then f has no nontrivial first-order differential invariant. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 19/23

53 C Invariants Multivariate Systems Previous Work - Symmetries Present Work - Invariants Theorem Let f be a C monomial. Then f has no nontrivial first-order differential invariant. Proof: Therefore, n 1 n 1 Df(M a,mx) = (m j (mj ) qθ +mi m qθ j )a qi x qj. for all 0 i,j n 1. i=0 j=0 m j (m j ) qθ +m i m qθ j = 0 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 19/23

54 C Invariants Proof Cont d Previous Work - Symmetries Present Work - Invariants Rank One over k [ m0 m 0 m 1 m n 1 m n 1 ] m qθ θ (m θ )qθ m qθ 1 θ m qθ n 1 θ (m n 1 θ )qθ 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 20/23

55 C Invariants Proof Cont d Previous Work - Symmetries Present Work - Invariants Rank One over k [ m0 m 0 m 1 m n 1 m n 1 ] m qθ θ (m θ )qθ m qθ 1 θ m qθ n 1 θ (m n 1 θ )qθ Relations on Coefficients Therefore there exists and s k such that m i = s qi m i. Thus, M x = M(sx). 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 20/23

56 C Invariants Proof Cont d Previous Work - Symmetries Present Work - Invariants Rank One over k [ m0 m 0 m 1 m n 1 m n 1 ] m qθ θ (m θ )qθ m qθ 1 θ m qθ n 1 θ (m n 1 θ )qθ Relations on Coefficients Therefore there exists and s k such that m i = s qi m i. Thus, M x = M(sx). Df(M(sa),Mx) 0 only possible if M is of rank one. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 20/23

57 pc Invariants Multivariate Systems Previous Work - Symmetries Present Work - Invariants Theorem Let f : k k be a C monomial and let π : k k be a projection. There exist no nontrivial first-order differential invariants of f π beyond ker(π). Proof Let V be a first-order differential invariant of f π. 0 D(f π)(m a,mx) = Df(πM a,πmx). From the previous proof, πm x = πm(sx). Also dim(πmk) 1, so dim(mk) dim(mk ker(π))+1, so there is no nontrivial first-order differential structure beyond ker(π). 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 21/23

58 Conclusions Multivariate Systems The existential criteria can provide a proof of security against any first-order differential adversary. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 22/23

59 Conclusions Multivariate Systems The existential criteria can provide a proof of security against any first-order differential adversary. The lack of a symmetric or invariant differential security argument does not necessarily mean that a scheme is vulerable to a differential adversary. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 22/23

60 Conclusions Multivariate Systems The existential criteria can provide a proof of security against any first-order differential adversary. The lack of a symmetric or invariant differential security argument does not necessarily mean that a scheme is vulerable to a differential adversary. Surprisingly, the pc model provably has no nontrivial first-order differential structure. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 22/23

61 Conclusions Multivariate Systems The existential criteria can provide a proof of security against any first-order differential adversary. The lack of a symmetric or invariant differential security argument does not necessarily mean that a scheme is vulerable to a differential adversary. Surprisingly, the pc model provably has no nontrivial first-order differential structure. It has been shown that the projection in pc can be removed, resulting in HFE ; the extra structure the particular resulting scheme retains may reveal a weakness. Any new attack on this system would be very interesting. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 22/23

62 Done Multivariate Systems Thanks! Please see the references in the paper. 7th June, 2013 Ray Perlner & Daniel Smith-Tone A Classification of Differential Invariants for MPQCs 23/23