New Directions in Multivariate Public Key Cryptography
|
|
- Austin Atkinson
- 5 years ago
- Views:
Transcription
1 New Directions in Shuhong Gao Joint with Ray Heindl Clemson University The 4th International Workshop on Finite Fields and Applications Beijing University, May 28-30, 2010.
2 1 Public Key Cryptography in a nutshell Existing Systems 2 Example: MFE Cryptosystem Searching for polynomial identities 3 A new polynomial Identity Our system Analysis Open questions
3 Public Key Cryptography Public Key Cryptography in a nutshell Existing Systems Diffie and Hellman (1976) proposed the concept of public key cryptosystems with which users can communicate without sharing any prior secret key.
4 Public Key Cryptography Public Key Cryptography in a nutshell Existing Systems Diffie and Hellman (1976) proposed the concept of public key cryptosystems with which users can communicate without sharing any prior secret key. One-way function: easy to evaluate, but hard to invert (on average). Trapdoor one-way function: easy to evaluate, but hard to invert without knowledge of some trapdoor.
5 Public Key Cryptography Public Key Cryptography in a nutshell Existing Systems Diffie and Hellman (1976) proposed the concept of public key cryptosystems with which users can communicate without sharing any prior secret key. One-way function: easy to evaluate, but hard to invert (on average). Trapdoor one-way function: easy to evaluate, but hard to invert without knowledge of some trapdoor. A public key cryptosystem consists of a family of trapdoor one-way functions.
6 Examples Public Key Cryptography in a nutshell Existing Systems Candidate one-way function: Polynomials are easy to evaluate but NP-hard to invert, however, its average complexity is not known.
7 Examples Public Key Cryptography in a nutshell Existing Systems Candidate one-way function: Polynomials are easy to evaluate but NP-hard to invert, however, its average complexity is not known. Univariate: Given α F q, and a sparse polynomial f (x) = t f i x d i i=1 F q [x] where q is large (say q = ), d i s are as big as q, and t is small (say t = 500). Then it is easy to compute f (α), but it is NP-complete to decide, for a given β F q and a sparse f F q [x], whether there exists α F q such that f (α) = β.
8 Examples Public Key Cryptography in a nutshell Existing Systems Candidate trapdoor one-way functions: RSA cryptosystem encryption: f (x) = x e (modn) where n is a product two primes and gcd(e, φ(n)) = 1. Trapdoor : the factorization of n, or an integer d such that ed 1(modφ(n)).
9 Examples Public Key Cryptography in a nutshell Existing Systems Candidate trapdoor one-way functions: RSA cryptosystem encryption: f (x) = x e (modn) where n is a product two primes and gcd(e, φ(n)) = 1. Trapdoor : the factorization of n, or an integer d such that ed 1(modφ(n)). Discrete log based cryptosystems: G is a cyclic group generated by α of order n. Pick a random integer k {1, 2,..., n 1} as a trapdoor and let β = α k be public. The encryption function is then f (x) = (x β r, α r ) where r {1, 2,..., n 1}is random for each x.
10 Public key cryptosystems Public Key Cryptography in a nutshell Existing Systems Practical cryptosystems: RSA cryptosystem based on integer factorization and cryptosystems based on discrete log in finite fields and elliptic curves.
11 Public key cryptosystems Public Key Cryptography in a nutshell Existing Systems Practical cryptosystems: RSA cryptosystem based on integer factorization and cryptosystems based on discrete log in finite fields and elliptic curves. Main Problem: Quantum computers, if built, can factor integers and solve discrete logs in polynomial time (Shor 1997).
12 Public key cryptosystems Public Key Cryptography in a nutshell Existing Systems Practical cryptosystems: RSA cryptosystem based on integer factorization and cryptosystems based on discrete log in finite fields and elliptic curves. Main Problem: Quantum computers, if built, can factor integers and solve discrete logs in polynomial time (Shor 1997). Possible alternatives: Lattice-based cryptography Code-based cryptography Hash-based cryptography Multivariate cryptography
13 Public Key Cryptography in a nutshell Existing Systems NP-complete problem: Given a system of quadratic polynomials F = (f 1,..., f m ) F q [X 1,..., X n ] m and a point y = (y 1,..., y m ) F m q, decide whether there exists a point x = (x 1,..., x n ) F n q such that F (x) = y. To build a multivariate cryptosystem, we hope to disguise a nice polynomial system as an arbitrary quadratic polynomial system.
14 MPKC: Structure Public Key Cryptography in a nutshell Existing Systems Let k = F q be a finite field with q elements. Public Key: F : k n k m given by F (x 1,..., x n ) = where f i k[x 1,..., x n ] are quadratic. f 1 (x 1,..., x n ). f m (x 1,..., x n ) T
15 MPKC: Encryption/Decryption Public Key Cryptography in a nutshell Existing Systems Encryption: Decryption: (x 1,..., x n ) F (y 1,..., y m ) (y 1,..., y m ) F 1 (x 1,..., x n )
16 MPKC: Public Key Construction Public Key Cryptography in a nutshell Existing Systems We build the trapdoor one-way function F as F = L 1 F L 2, where F is a multivariate map that can be easily inverted, and L 1, L 2 are invertible affine transformations, which are secret. Evaluation: Inversion: (x 1,..., x n ) F (y 1,..., y m ) (y 1,..., y m ) L 1 1 F 1 L 1 2 (x 1,..., x n )
17 MPKC: Security Public Key Cryptography in a nutshell Existing Systems Public Private F = L 1 F L 2 Security is dependent on the known difficulty of Solving quadratic multivariate systems over finite fields. Factoring multivariate maps.
18 MPKC: Efficiency Public Key Cryptography in a nutshell Existing Systems Encryption: polynomial evaluation Decryption: depends on the system public Key: coefficients of quadratic systems
19 Goal: Construct secure MPKC Public Key Cryptography in a nutshell Existing Systems Difficult problem: Invertibility, security, and efficiency are interrelated, and a good system must satisfy all three requirements at the same time. Some past success, but mostly with signature schemes.
20 Existing Cryptosystems Public Key Cryptography in a nutshell Existing Systems Matsumoto-Imai (1988): generalizes of RSA using monomials Hidden Field Equations (Patarin 1996) Oil-Vinegar (Patarin 1997) Triangular (Fell and Diffie 1985, Shamir 1993, Moh 1999, Yang and Chen 2004) Other systems: Rainbow (Ding and Schmidt 2005), MFE (Wang et al. 2006), l-ic (Ding et al. 2007) Jintai Ding, Jason Gower, and Deiter Schmidt, Multivariate Public Key Cryptosystems, Springer (2006).
21 Triangular Systems Public Key Cryptography in a nutshell Existing Systems Central map: F (x 1,..., x n ) = x 1 x 2 + g 2 (x 1 ). x n 1 + g n 1 (x 1, x 2,..., x n 2 ) x n + g n (x 1, x 2,..., x n 2, x n 1 ) T
22 Triangular Systems Public Key Cryptography in a nutshell Existing Systems Central map: F (x 1,..., x n ) = x 1 x 2 + g 2 (x 1 ). x n 1 + g n 1 (x 1, x 2,..., x n 2 ) x n + g n (x 1, x 2,..., x n 2, x n 1 ) Inversion: iteratively solve for each component. T
23 Triangular Systems Public Key Cryptography in a nutshell Existing Systems Central map: F (x 1,..., x n ) = x 1 x 2 + g 2 (x 1 ). x n 1 + g n 1 (x 1, x 2,..., x n 2 ) x n + g n (x 1, x 2,..., x n 2, x n 1 ) Inversion: iteratively solve for each component. Weakness: triangular structure (first polynomial is linear, next few are too simple). T
24 Oil-Vinegar Systems (Patarin 1997) Public Key Cryptography in a nutshell Existing Systems Consider two sets of variables {ˇx 1,..., ˇx v } and {x 1,..., x o }. An oil-vinegar polynomial has the form aij ˇx i ˇx j + b ij ˇx i x j + c i ˇx i + d i x i + e.
25 Oil-Vinegar Systems (Patarin 1997) Public Key Cryptography in a nutshell Existing Systems Consider two sets of variables {ˇx 1,..., ˇx v } and {x 1,..., x o }. An oil-vinegar polynomial has the form aij ˇx i ˇx j + b ij ˇx i x j + c i ˇx i + d i x i + e. Given a system of o oil-vinegar polynomials, F = (f 1,..., f o ), if we substitute field values for ˇx 1,..., ˇx v, the result is an o o linear system, which is linear in the oil variables x 1,..., x o.
26 Oil-Vinegar Systems (Patarin 1997) Public Key Cryptography in a nutshell Existing Systems Consider two sets of variables {ˇx 1,..., ˇx v } and {x 1,..., x o }. An oil-vinegar polynomial has the form aij ˇx i ˇx j + b ij ˇx i x j + c i ˇx i + d i x i + e. Given a system of o oil-vinegar polynomials, F = (f 1,..., f o ), if we substitute field values for ˇx 1,..., ˇx v, the result is an o o linear system, which is linear in the oil variables x 1,..., x o. Signature generation: Given a document (y 1,..., y o ), choose (ˇx 1,..., ˇx v ) k v at random, and solve the resulting linear system for x 1,..., x o. The signature is then (ˇx 1,..., ˇx v, x 1,..., x o ).
27 Example: MFE Cryptosystem Searching for polynomial identities We propose a new framework for constructing central maps that combines ideas from Triangular and Oil-Vinegar Systems.
28 Example: MFE Cryptosystem Searching for polynomial identities We propose a new framework for constructing central maps that combines ideas from Triangular and Oil-Vinegar Systems. Benefits: Combine Triangular and Oil-Vinegar systems to build encryption schemes.
29 Example: MFE Cryptosystem Searching for polynomial identities We propose a new framework for constructing central maps that combines ideas from Triangular and Oil-Vinegar Systems. Benefits: Combine Triangular and Oil-Vinegar systems to build encryption schemes. Achieve invertibility more generally, then address the issues of security and efficiency.
30 Example: MFE Cryptosystem Searching for polynomial identities We propose a new framework for constructing central maps that combines ideas from Triangular and Oil-Vinegar Systems. Benefits: Combine Triangular and Oil-Vinegar systems to build encryption schemes. Achieve invertibility more generally, then address the issues of security and efficiency. Introduce flexibility in construction.
31 x 1,..., x n y 11,..., y 1n x 1 x 2 + g 2 (x 1 ). x n 1 + g n 1 (x 1, x 2,..., x n 2 ) x n + g n (x 1, x 2,..., x n 2, x n 1 ) first oil-vinegar system vinegar variables: x 1,..., x n oil variables: y 11,..., y 1n lock polynomials from oil-vinegar systems hide triangular structure. y l 1,1,..., y l 1,n l-th oil-vinegar system vinegar variables: x 1,..., x n,..., y l 1,1,..., y l 1,n oil variables: y l1,..., y ln
32 Example: MFE Cryptosystem Searching for polynomial identities Example: MFE Cryptosystem (Wang et al. 2006) It is based on the following identity. Let ( ) ( X1 X A(X ) = det 3 Y1 Y, A(Y ) = det 3 X 4 X 2 Y 4 Y 2 ), and ( X1 X 3 X 4 X 2 ) ( Y1 Y 3 Y 4 Y 2 ) ( f1 f = 3 f 4 f 2 Taking determinants on both sides gives the identity A(X )B(Y ) = f 1 f 2 f 3 f 4. ).
33 Example: MFE Cryptosystem (Wang et al. 2006) Input: (X 1, X 2, X 3, Y 1, Y 2, Y 3, Z 1, Z 2, Z 3 ) k 9 X 1 X 2 + φ(x 1 ) X 3 + φ(x 1, X 2 ) f 1 f 2 s.t. f 1 f 2 + f 3 f 4 = A(X )A(Y ) f 3 f 4 g 1 g 2 g 3 g 4 s.t. g 1 g 2 + g 3 g 4 = A(Y )A(Z) h 1 h 2 s.t. h 1 h 2 + h 3 h 4 = A(X )A(Z) h 3 h 4 Output: A vector in k 15
34 Example: MFE Cryptosystem (Wang et al. 2006) Input: (X 1, X 2, X 3, Y 1, Y 2, Y 3, Z 1, Z 2, Z 3 ) k 9 X 1, X 2, X 3 X 1 X 2 + φ(x 1 ) X 3 + φ(x 1, X 2 ) f 1 f 2 s.t. f 1 f 2 + f 3 f 4 = A(X )A(Y ) f 3 f 4 g 1 g 2 g 3 g 4 s.t. g 1 g 2 + g 3 g 4 = A(Y )A(Z) h 1 h 2 s.t. h 1 h 2 + h 3 h 4 = A(X )A(Z) h 3 h 4 Output: A vector in k 15
35 Example: MFE Cryptosystem (Wang et al. 2006) Input: (X 1, X 2, X 3, Y 1, Y 2, Y 3, Z 1, Z 2, Z 3 ) k 9 X 1, X 2, X 3 Y 1, Y 2, Y 3 X 1 X 2 + φ(x 1 ) X 3 + φ(x 1, X 2 ) f 1 f 2 s.t. f 1 f 2 + f 3 f 4 = A(X )A(Y ) f 3 f 4 g 1 g 2 g 3 g 4 s.t. g 1 g 2 + g 3 g 4 = A(Y )A(Z) h 1 h 2 s.t. h 1 h 2 + h 3 h 4 = A(X )A(Z) h 3 h 4 Output: A vector in k 15
36 Example: MFE Cryptosystem (Wang et al. 2006) X 1 + A(X ) X 2 + φ(x 1 ) X 3 + φ(x 1, X 2 ) A(X ) f 1 f 2 s.t. f 1 f 2 + f 3 f 4 = A(X )A(Y ) f 3 f 4 g 1 g 2 g 3 g 4 h 1 h 2 h 3 h 4 s.t. g 1 g 2 + g 3 g 4 = A(Y )A(Z) s.t. h 1 h 2 + h 3 h 4 = A(X )A(Z)
37 Example: MFE Cryptosystem (Wang et al. 2006) X 1 + A(X ) X 2 + φ(x 1 ) + A(Y ) X 3 + φ(x 1, X 2 ) f 1 f 2 s.t. f 1 f 2 + f 3 f 4 = A(X )A(Y ) f 3 f 4 g 1 g 2 g 3 g 4 h 1 h 2 h 3 h 4 s.t. g 1 g 2 + g 3 g 4 = A(Y )A(Z) s.t. h 1 h 2 + h 3 h 4 = A(X )A(Z) A(Y )
38 Example: MFE Cryptosystem (Wang et al. 2006) X 1 + A(X ) X 2 + φ(x 1 ) + A(Y ) X 3 + φ(x 1, X 2 ) + A(Z) f 1 f 2 s.t. f 1 f 2 + f 3 f 4 = A(X )A(Y ) f 3 f 4 g 1 g 2 g 3 g 4 h 1 h 2 h 3 h 4 s.t. g 1 g 2 + g 3 g 4 = A(Y )A(Z) s.t. h 1 h 2 + h 3 h 4 = A(X )A(Z) A(Z)
39 Example: MFE Cryptosystem (Wang et al. 2006) Input: (X 1, X 2, X 3, Y 1, Y 2, Y 3, Z 1, Z 2, Z 3 ) k 9 X 1 + A(X ) X 2 + φ(x 1 ) + A(Y ) X 3 + φ(x 1, X 2 ) + A(Z) f 1 f 2 s.t. f 1 f 2 + f 3 f 4 = A(X )A(Y ) f 3 f 4 g 1 g 2 g 3 g 4 s.t. g 1 g 2 + g 3 g 4 = A(Y )A(Z) h 1 h 2 s.t. h 1 h 2 + h 3 h 4 = A(X )A(Z) h 3 h 4 Output: A vector in k 15
40 Decryption Example: MFE Cryptosystem Searching for polynomial identities Decryption involves two steps: 1 Restoring the triangular structure and solving for the initial vinegar variables x 1,..., x n. 2 Iteratively solving the oil-vinegar systems for the remaining oil variables.
41 Decryption: Step 1 - Restore triangular structure X 1 + A(X ) X 2 + φ(x 1 ) + A(Y ) X 3 + φ(x 1, X 2 ) + A(Z) f 1 f 2 s.t. f 1 f 2 + f 3 f 4 = A(X )A(Y ) f 3 f 4 g 1 g 2 g 3 g 4 h 1 h 2 h 3 h 4 s.t. g 1 g 2 + g 3 g 4 = A(Y )A(Z) s.t. h 1 h 2 + h 3 h 4 = A(X )A(Z) ( ) 1/2 (f1 f 2 +f 3 f 4 )(h 1 h 2 +h 3 h 4 ) g 1 g 2 +g 3 g 4
42 Decryption: Step 1 - Restore triangular structure X 1 X 2 + φ(x 1 ) + A(Y ) X 3 + φ(x 1, X 2 ) + A(Z) f 1 f 2 s.t. f 1 f 2 + f 3 f 4 = A(X )A(Y ) f 3 f 4 g 1 g 2 g 3 g 4 h 1 h 2 h 3 h 4 s.t. g 1 g 2 + g 3 g 4 = A(Y )A(Z) s.t. h 1 h 2 + h 3 h 4 = A(X )A(Z) ( ) 1/2 (f1 f 2 +f 3 f 4 )(h 1 h 2 +h 3 h 4 ) g 1 g 2 +g 3 g 4
43 Decryption: Step 1 - Restore triangular structure X 1 X 2 + φ(x 1 ) X 3 + φ(x 1, X 2 ) + A(Z) f 1 f 2 s.t. f 1 f 2 + f 3 f 4 = A(X )A(Y ) f 3 f 4 g 1 g 2 g 3 g 4 h 1 h 2 h 3 h 4 s.t. g 1 g 2 + g 3 g 4 = A(Y )A(Z) s.t. h 1 h 2 + h 3 h 4 = A(X )A(Z) ( ) f 1 f (f1 2 +f f 23 +f f 4 1/2 3 f 4 )(h 1 h 2 +h 3 h 4 ) A(X ) g 1 g 2 +g 3 g 4
44 Decryption: Step 1 - Restore triangular structure X 1 X 2 + φ(x 1 ) X 3 + φ(x 1, X 2 ) f 1 f 2 s.t. f 1 f 2 + f 3 f 4 = A(X )A(Y ) f 3 f 4 g 1 g 2 g 3 g 4 h 1 h 2 h 3 h 4 s.t. g 1 g 2 + g 3 g 4 = A(Y )A(Z) s.t. h 1 h 2 + h 3 h 4 = A(X )A(Z) ( ) 1/2 (f1 f 2 +f 3 f 4 )(h 1 h 2 +h 3 h 4 ) g 1 g 2 +g 3 g 4 g 1 g 2 +g 3 g 4 A(Y )
45 Decryption: Step 2 - Solve oil-vinegar systems X 1, X 2, X 3 X 1 X 2 + φ(x 1 ) X 3 + φ(x 1, X 2 ) f 1 f 2 s.t. f 1 f 2 + f 3 f 4 = A(X )A(Y ) f 3 f 4 g 1 g 2 g 3 g 4 h 1 h 2 h 3 h 4 s.t. g 1 g 2 + g 3 g 4 = A(Y )A(Z) s.t. h 1 h 2 + h 3 h 4 = A(X )A(Z)
46 Decryption: Step 2 - Solve oil-vinegar systems X 1, X 2, X 3 Y 1, Y 2, Y 3 X 1 X 2 + φ(x 1 ) X 3 + φ(x 1, X 2 ) f 1 f 2 s.t. f 1 f 2 + f 3 f 4 = A(X )A(Y ) f 3 f 4 g 1 g 2 g 3 g 4 h 1 h 2 h 3 h 4 s.t. g 1 g 2 + g 3 g 4 = A(Y )A(Z) s.t. h 1 h 2 + h 3 h 4 = A(X )A(Z)
47 Constructing Polynomial Identities Example: MFE Cryptosystem Searching for polynomial identities Goal: construct identities of the form A(X )B(Y ) = f 1 f f m 1 f m over the polynomial ring k[x 1,..., X n, Y 1,..., Y n ]. Toolbox: 1 Parameterization 2 Gröbner Basis methods 3 Plücker coordinates 4 Matrix Determinants 5 Grassmann coordinates 6 Graph theory
48 A new polynomial Identity Our system Analysis Open questions Polynomial identity in k[x 1,..., X 8, Y 1,..., Y 8 ] A(X )B(Y ) = f 1 f 2 + f 3 f 4 + f 5 f 6 + f 7 f 8 + f 9 f 10, where A(X ) = X 1 X 2 + X 3 X 4 + X 5 X 6 + X 7 X 8 B(Y ) = Y 1 Y 2 + Y 3 Y 4 + Y 5 Y 6 + Y 7 Y 8 f 1 = X 4 Y 1 + X 8 Y 4 + (X 1 + X 4 )Y 5 + X 5 Y 8 f 2 = (X 2 + X 3 )Y 2 + X 7 Y 3 + X 2 Y 6 + X 6 Y 7 f 3 = X 8 Y 2 + X 4 Y 3 + X 5 Y 6 + (X 1 + X 4 )Y 7 f 4 = X 7 Y 1 + (X 2 + X 3 )Y 4 + X 6 Y 5 + X 2 Y 8 f 5 = X 2 Y 1 + X 6 Y 4 + (X 2 + X 3 )Y 5 + X 7 Y 8 f 6 = (X 1 + X 4 )Y 2 + X 5 Y 3 + X 4 Y 6 + X 8 Y 7 f 7 = X 6 Y 2 + X 2 Y 3 + X 7 Y 6 + (X 2 + X 3 )Y 7 f 8 = X 5 Y 1 + (X 1 + X 4 )Y 4 + X 8 Y 5 + X 4 Y 8 f 9 = Y 1 Y 7 + Y 2 Y 8 + Y 3 Y 5 + Y 4 Y 6 f 10 = X 1 X 7 + X 2 (X 5 + X 8 ) + X 3 X 5 + X 4 (X 6 + X 7 ).
49 Polynomial Identity A new polynomial Identity Our system Analysis Open questions We introduce the following notation: pxy ij = x i x j = x iy j x j y i, 1 i < j 4. y i y j Define Then xyzw = x 1 y 1 z 1 w 1 x 2 y 2 z 2 w 2 x 3 y 3 z 3 w 3 x 4 y 4 z 4 w 4. xyzw = p 12 xy p 34 zw p 13 xy p 24 zw + p 14 xy p 23 zw + p 23 xy p 14 zw p 24 xy p 13 zw + p 34 xy p 12 zw.
50 Polynomial Identity A new polynomial Identity Our system Analysis Open questions 0 = xyxw + xyxz + xyyw + xyyz + (1) zwxw + zwxz + zwyw + zwyz (2)
51 Polynomial Identity A new polynomial Identity Our system Analysis Open questions 0 = xyxw + xyxz + xyyw + xyyz + (1) zwxw + zwxz + zwyw + zwyz (2) Defining p ij = p ij xw + p ij xz + p ij yw + p ij yz, 1 i < j 4, (3) the four determinants of (1) can be regrouped as p 12 xy p 34 + p 13 xy p 24 + p 14 xy p 23 + p 23 xy p 14 + p 24 xy p 13 + p 34 xy p 12.
52 Polynomial Identity A new polynomial Identity Our system Analysis Open questions After performing a similar grouping for (2), we get the the identity 0 = (p 12 xy + p 12 zw )p 34 + (p 13 xy + p 13 zw )p 24 + (p 14 xy + p 14 zw )p 23 + (p 23 xy + p 23 zw )p 14 + (p 24 xy + p 24 zw )p 13 + (p 34 xy + p 34 zw )p 12. (4)
53 Polynomial Identity A new polynomial Identity Our system Analysis Open questions After performing a similar grouping for (2), we get the the identity 0 = (p 12 xy + p 12 zw )p 34 + (p 13 xy + p 13 zw )p 24 + (p 14 xy + p 14 zw )p 23 + (p 23 xy + p 23 zw )p 14 + (p 24 xy + p 24 zw )p 13 + (p 34 xy + p 34 zw )p 12. (4) After a slight modification and a change of variables, (4) becomes 0 = A(X )A(Y ) + f 1 f 2 + f 3 f 4 + f 5 f 6 + f 7 f 8 + f 9 f 10.
54 Our system A new polynomial Identity Our system Analysis Open questions A triangular system with 7 polynomials A chain of 7 oil-vinegar systems, each based on f 1, f 2, f 3, f 4, f 5, f 6, f 7, f 8 with f 9 and f 1 0 attached. Lock polynomials based on A(X ) and B(Y ).
55 Chain of Oil-Vinegar Systems A new polynomial Identity Our system Analysis Open questions The central map has input length 56: (X 1,..., X 24, Y 1,..., Y 32 ), and output length 74. Y 1,..., Y X 9,..., X 16 X 1,..., X 8 2 Y 9,..., Y 16 5 Y 17,..., Y 24 6 X 17,..., X 24 7 Y 25,..., Y 32
56 Security Analysis A new polynomial Identity Our system Analysis Open questions Gröbner basis attacks: F 4 (Faugére 1999), F 5 (Faugére 2002, Barget et al 2005), XL algorithm (Courtois et al 2000), G 2 V (Gao, Guan and Volny 2010).
57 Security Analysis A new polynomial Identity Our system Analysis Open questions Gröbner basis attacks: F 4 (Faugére 1999), F 5 (Faugére 2002, Barget et al 2005), XL algorithm (Courtois et al 2000), G 2 V (Gao, Guan and Volny 2010). The total number of operations in k is about (( ) n + ω ) dreg O, n where ω is the exponent in Gaussian reduction and d reg is the degree of regularity of the ideal formed by the polynomials in the system.
58 Security Analysis A new polynomial Identity Our system Analysis Open questions Attacks based on linear algebra: Minrank attack (Kipnis and Shamir 1999, Goubin and Courtois 2000). Each quadratic form is associated with a symmetric matrix and the rank of a matrix does not change under linear transforms. This attack explores the fact that some polynomials in the central map may have low rank. The complexity of this attack to our system is q d = q 16d.
59 Security Analysis A new polynomial Identity Our system Analysis Open questions Attacks based on linear algebra: Minrank attack (Kipnis and Shamir 1999, Goubin and Courtois 2000). Each quadratic form is associated with a symmetric matrix and the rank of a matrix does not change under linear transforms. This attack explores the fact that some polynomials in the central map may have low rank. The complexity of this attack to our system is q d = q 16d. Dual rank attack (Yang and Chen 2004). While minrank succeeds when an equation has too few variables, the dual rank attack is effective when a variable appears in too few equations. The complexity of the attack is (56d) 3 q 6d.
60 Security Analysis A new polynomial Identity Our system Analysis Open questions Attacks based on linear algebra: Separation of oil and vinegar variables attack (Kipnis and Shamir 1998, Kipnis, Patarin and Goubin 1999). The goal of this attack is to find the transformed oil space, so separate the oil and vinegar variables. The complexity is 20 4 q 15d.
61 Security Analysis A new polynomial Identity Our system Analysis Open questions Attacks based on linear algebra: Separation of oil and vinegar variables attack (Kipnis and Shamir 1998, Kipnis, Patarin and Goubin 1999). The goal of this attack is to find the transformed oil space, so separate the oil and vinegar variables. The complexity is 20 4 q 15d. Linearization equations attack. (Patarin 1996, Ding et al 2007). Computations using Magma verify that there are no first order linearization equations. Ding et al broke MFE using second order linearization equations which comes from the associativity of determinant. Our system avoids determinants, so their method does not apply. But there still might be some other second order linearization equations!
62 Security Analysis A new polynomial Identity Our system Analysis Open questions Claimed Input Output Complexity Key Size [kbytes] Security [bits] [bits] F 5 Rank/UOV Public Private
63 Efficiency A new polynomial Identity Our system Analysis Open questions System Input Output Decryption Encryption [bits] [bits] Central Map Total MFE ms 2ms 2.7ms Our System ms 1.4ms 2.3ms
64 Open Questions A new polynomial Identity Our system Analysis Open questions Find nontrivial solutions to the following equation: AB = CD + EF where A, B, C, D, E, F F 2 [x 1,..., x n, y 1,..., y n ] have degree two. MFE is based on solution with n = 4. Need solutions for 5 n 16.
65 Open Questions A new polynomial Identity Our system Analysis Open questions Find nontrivial solutions to the following equation: AB = CD + EF where A, B, C, D, E, F F 2 [x 1,..., x n, y 1,..., y n ] have degree two. MFE is based on solution with n = 4. Need solutions for 5 n 16. Can we characterize all quadratic solutions to the equations A(X )A(Y ) = CD + EF and A(X )A(Y ) = f 1 f 2 + f 3 f 4 + f 5 f 6 + f 7 f 8 + f 9 f 10?
66 Open Questions A new polynomial Identity Our system Analysis Open questions Using the tools from algebraic geometry and combinatorics, what other polynomial identities may be constructed to implement cryptosystems in the proposed framework?
67 Open Questions A new polynomial Identity Our system Analysis Open questions Using the tools from algebraic geometry and combinatorics, what other polynomial identities may be constructed to implement cryptosystems in the proposed framework? How to efficiently solve given systems of quadratic equations? G, Yinhua Guan, Frank Volny IV and Mingsheng Wang, A new algorithm for computing Grobner bases, which is both simpler and faster than F5.
68 Open Questions A new polynomial Identity Our system Analysis Open questions Using the tools from algebraic geometry and combinatorics, what other polynomial identities may be constructed to implement cryptosystems in the proposed framework? How to efficiently solve given systems of quadratic equations? G, Yinhua Guan, Frank Volny IV and Mingsheng Wang, A new algorithm for computing Grobner bases, which is both simpler and faster than F5. Thank you!
On the Complexity of the Hybrid Approach on HFEv-
On the Complexity of the Hybrid Approach on HFEv- Albrecht Petzoldt National Institute of Standards and Technology, Gaithersburg, Maryland, USA albrecht.petzoldt@gmail.com Abstract. The HFEv- signature
More informationSimple Matrix Scheme for Encryption (ABC)
Simple Matrix Scheme for Encryption (ABC) Adama Diene, Chengdong Tao, Jintai Ding April 26, 2013 dama Diene, Chengdong Tao, Jintai Ding ()Simple Matrix Scheme for Encryption (ABC) April 26, 2013 1 / 31
More informationMultivariate Public Key Cryptography
Winter School, PQC 2016, Fukuoka Multivariate Public Key Cryptography Jintai Ding University of Cincinnati Feb. 22 2016 Outline Outline What is a MPKC? Multivariate Public Key Cryptosystems - Cryptosystems,
More informationNew candidates for multivariate trapdoor functions
New candidates for multivariate trapdoor functions Jaiberth Porras 1, John B. Baena 1, Jintai Ding 2,B 1 Universidad Nacional de Colombia, Medellín, Colombia 2 University of Cincinnati, Cincinnati, OH,
More informationAnalysis of Hidden Field Equations Cryptosystem over Odd-Characteristic Fields
Nonlinear Phenomena in Complex Systems, vol. 17, no. 3 (2014), pp. 278-283 Analysis of Hidden Field Equations Cryptosystem over Odd-Characteristic Fields N. G. Kuzmina and E. B. Makhovenko Saint-Petersburg
More informationMultivariate Public Key Cryptography or Why is there a rainbow hidden behind fields full of oil and vinegar?
Multivariate Public Key Cryptography or Why is there a rainbow hidden behind fields full of oil and vinegar? Christian Eder, Jean-Charles Faugère and Ludovic Perret Seminar on Fundamental Algorithms, University
More informationThe Shortest Signatures Ever
The Shortest Signatures Ever Mohamed Saied Emam Mohamed 1, Albrecht Petzoldt 2 1 Technische Universität Darmstadt, Germany 2 Kyushu University, Fukuoka, Japan mohamed@cdc.informatik.tu-darmstadt.de, petzoldt@imi.kyushu-u.ac.jp
More informationTOT, a Fast Multivariate Public Key Cryptosystem with Basic Secure Trapdoor
TOT, a Fast Multivariate Public Key Cryptosystem with Basic Secure Trapdoor Wuqiang Shen and Shaohua Tang School of Computer Science & Engineering, South China University of Technology, Guangzhou 510006,
More informationMI-T-HFE, a New Multivariate Signature Scheme
MI-T-HFE, a New Multivariate Signature Scheme Wenbin Zhang and Chik How Tan Temasek Laboratories National University of Singapore tslzw@nus.edu.sg and tsltch@nus.edu.sg Abstract. In this paper, we propose
More informationHidden Field Equations
Security of Hidden Field Equations (HFE) 1 The security of Hidden Field Equations ( H F E ) Nicolas T. Courtois INRIA, Paris 6 and Toulon University courtois@minrank.org Permanent HFE web page : hfe.minrank.org
More informationEfficient variant of Rainbow using sparse secret keys
Takanori Yasuda 1, Tsuyoshi Takagi 2, and Kouichi Sakurai 1,3 1 Institute of Systems, Information Technologies and Nanotechnologies, Fukuoka, Japan 2 Institute of Mathematics for Industry, Kyushu University,
More informationAlgebraic Cryptanalysis of MQQ Public Key Cryptosystem by MutantXL
Algebraic Cryptanalysis of MQQ Public Key Cryptosystem by MutantXL Mohamed Saied Emam Mohamed 1, Jintai Ding 2, and Johannes Buchmann 1 1 TU Darmstadt, FB Informatik Hochschulstrasse 10, 64289 Darmstadt,
More informationInoculating Multivariate Schemes Against Differential Attacks
Inoculating Multivariate Schemes Against Differential Attacks Jintai Ding and Jason E. Gower Department of Mathematical Sciences University of Cincinnati Cincinnati, OH 45221-0025 USA Email: ding@math.uc.edu,
More informationImproved Cryptanalysis of HFEv- via Projection
Improved Cryptanalysis of HFEv- via Projection Jintai Ding 1, Ray Perlner 2, Albrecht Petzoldt 2, and Daniel Smith-Tone 2,3 1 Department of Mathematical Sciences, University of Cincinnati, Cincinnati,
More informationOil-Vinegar signature cryptosystems
Oil-Vinegar signature cryptosystems Jintai Ding University of Cincinnati Workshop on multivariate public key cryptosystems, 2006 Taiwan Information Security Center The National Taiwan University of Science
More informationMultivariate Quadratic Public-Key Cryptography Part 1: Basics
Multivariate Quadratic Public-Key Cryptography Part 1: Basics Bo-Yin Yang Academia Sinica PQCrypto Executive Summer School 2017 Eindhoven, the Netherlands Friday, 23.06.2017 B.-Y. Yang (Academia Sinica)
More informationLittle Dragon Two: An efficient Multivariate Public Key Cryptosystem
Little Dragon Two: An efficient Multivariate Public Key Cryptosystem Rajesh P Singh, A.Saikia, B.K.Sarma Department of Mathematics Indian Institute of Technology Guwahati Guwahati -781039, India October
More informationCryptanalysis of the TTM Cryptosystem
Cryptanalysis of the TTM Cryptosystem Louis Goubin and Nicolas T Courtois SchlumbergerSema - CP8 36-38 rue de la Princesse BP45 78430 Louveciennes Cedex France LouisGoubin@bullnet,courtois@minrankorg Abstract
More informationMutantXL: Solving Multivariate Polynomial Equations for Cryptanalysis
MutantXL: Solving Multivariate Polynomial Equations for Cryptanalysis Johannes Buchmann 1, Jintai Ding 2, Mohamed Saied Emam Mohamed 1, and Wael Said Abd Elmageed Mohamed 1 1 TU Darmstadt, FB Informatik
More informationCHAPMAN & HALL/CRC CRYPTOGRAPHY AND NETWORK SECURITY ALGORITHMIC CR YPTAN ALY51S. Ant nine J aux
CHAPMAN & HALL/CRC CRYPTOGRAPHY AND NETWORK SECURITY ALGORITHMIC CR YPTAN ALY51S Ant nine J aux (g) CRC Press Taylor 8* Francis Croup Boca Raton London New York CRC Press is an imprint of the Taylor &
More informationImproved Cryptanalysis of HFEv- via Projection
Improved Cryptanalysis of HFEv- via Projection Jintai Ding, Ray Perlner, Albrecht Petzoldt, Daniel Smith-Tone PQ Crypto 2018 Fort Lauderdale, Florida 04/10/2018 A. Petzoldt Cryptanalysis of HFEv- via Projection
More informationCryptanalysis of Simple Matrix Scheme for Encryption
Cryptanalysis of Simple Matrix Scheme for Encryption Chunsheng Gu School of Computer Engineering, Jiangsu University of Technology, Changzhou, 213001, China {chunsheng_gu}@163.com Abstract. Recently, Tao
More informationRGB, a Mixed Multivariate Signature Scheme
Advance Access publication on 7 August 2015 RGB, a Mixed Multivariate Signature Scheme Wuqiang Shen and Shaohua Tang c The British Computer Society 2015. All rights reserved. For Permissions, please email:
More informationHFERP - A New Multivariate Encryption Scheme
- A New Multivariate Encryption Scheme Yasuhiko Ikematsu (Kyushu University) Ray Perlner (NIST) Daniel Smith-Tone (NIST, University of Louisville) Tsuyoshi Takagi (Kyushi University) Jeremy Vates (University
More informationPoly Dragon: An efficient Multivariate Public Key Cryptosystem
Poly Dragon: An efficient Multivariate Public Key Cryptosystem Rajesh P Singh, A.Saikia, B.K.Sarma Department of Mathematics Indian Institute of Technology Guwahati Guwahati -781039, India May 19, 2010
More informationCryptanalysis of Patarin s 2-Round Public Key System with S Boxes (2R)
Cryptanalysis of Patarin s 2-Round Public Key System with S Boxes (2R) Eli Biham Computer Science Department Technion Israel Institute of Technology Haifa 32000, Israel biham@cs.technion.ac.il http://www.cs.technion.ac.il/~biham/
More informationMultivariate Public Key Cryptography
Multivariate Public Key Cryptography Jintai Ding 1 and Bo-Yin Yang 2 1 University of Cincinnati and Technische Universität Darmstadt. 2 Academia Sinica and Taiwan InfoSecurity Center, Taipei, Taiwan. Summary.
More informationQuantum-resistant cryptography
Quantum-resistant cryptography Background: In quantum computers, states are represented as vectors in a Hilbert space. Quantum gates act on the space and allow us to manipulate quantum states with combination
More informationPublic key cryptography using Permutation P-Polynomials over Finite Fields
Public key cryptography using Permutation P-Polynomials over Finite Fields Rajesh P Singh 1 B. K. Sarma 2 A. Saikia 3 Department of Mathematics Indian Institute of Technology Guwahati Guwahati 781039,
More informationAlgebraic Aspects of Symmetric-key Cryptography
Algebraic Aspects of Symmetric-key Cryptography Carlos Cid (carlos.cid@rhul.ac.uk) Information Security Group Royal Holloway, University of London 04.May.2007 ECRYPT Summer School 1 Algebraic Techniques
More informationChapter 8 Public-key Cryptography and Digital Signatures
Chapter 8 Public-key Cryptography and Digital Signatures v 1. Introduction to Public-key Cryptography 2. Example of Public-key Algorithm: Diffie- Hellman Key Exchange Scheme 3. RSA Encryption and Digital
More informationOn the Security and Key Generation of the ZHFE Encryption Scheme
On the Security and Key Generation of the ZHFE Encryption Scheme Wenbin Zhang and Chik How Tan Temasek Laboratories National University of Singapore tslzw@nus.edu.sg and tsltch@nus.edu.sg Abstract. At
More informationCryptanalysis of the Tractable Rational Map Cryptosystem
Cryptanalysis of the Tractable Rational Map Cryptosystem Antoine Joux 1, Sébastien Kunz-Jacques 2, Frédéric Muller 2, and Pierre-Michel Ricordel 2 1 SPOTI Antoine.Joux@m4x.org 2 DCSSI Crypto Lab 51, Boulevard
More informationHidden Pair of Bijection Signature Scheme
Hidden Pair of Bijection Signature Scheme Masahito Gotaishi and Shigeo Tsujii Research and Development Initiative, Chuo University, 1-13-27 Kasuga, Tokyo, Japan, 112-8551 gotaishi@tamaccchuo-uacjp http://wwwchuo-uacjp/chuo-u/rdi/index
More informationHybrid Approach : a Tool for Multivariate Cryptography
Hybrid Approach : a Tool for Multivariate Cryptography Luk Bettale, Jean-Charles Faugère and Ludovic Perret INRIA, Centre Paris-Rocquencourt, SALSA Project UPMC, Univ. Paris 06, LIP6 CNRS, UMR 7606, LIP6
More informationMathematics of Cryptography
UNIT - III Mathematics of Cryptography Part III: Primes and Related Congruence Equations 1 Objectives To introduce prime numbers and their applications in cryptography. To discuss some primality test algorithms
More informationCryptanalysis of the HFE Public Key Cryptosystem by Relinearization
Cryptanalysis of the HFE Public Key Cryptosystem by Relinearization Aviad Kipnis 1 and Adi Shamir 2 1 NDS Technologies, Israel 2 Computer Science Dept., The Weizmann Institute, Israel Abstract. The RSA
More informationA Polynomial-Time Key-Recovery Attack on MQQ Cryptosystems
A Polynomial-Time Key-Recovery Attack on MQQ Cryptosystems Jean-Charles Faugère, Danilo Gligoroski, Ludovic Perret, Simona Samardjiska, Enrico Thomae PKC 2015, March 30 - April 1, Maryland, USA 2 Summary
More informationA Classification of Differential Invariants for Multivariate Post-Quantum Cryptosystems
A Classification of Differential Invariants for Multivariate Post-Quantum Cryptosystems Ray Perlner 1 and Daniel Smith-Tone 1,2 1 National Institute of Standards and Technology, Gaithersburg, Maryland,
More informationKey Recovery on Hidden Monomial Multivariate Schemes
Key Recovery on Hidden Monomial Multivariate Schemes Pierre-Alain Fouque 1, Gilles Macario-Rat 2, and Jacques Stern 1 1 École normale supérieure, 45 rue d Ulm, 75005 Paris, France {Pierre-Alain.Fouque,
More informationRSA RSA public key cryptosystem
RSA 1 RSA As we have seen, the security of most cipher systems rests on the users keeping secret a special key, for anyone possessing the key can encrypt and/or decrypt the messages sent between them.
More informationPost-Quantum Cryptography
Post-Quantum Cryptography Sebastian Schmittner Institute for Theoretical Physics University of Cologne 2015-10-26 Talk @ U23 @ CCC Cologne This work is licensed under a Creative Commons Attribution-ShareAlike
More informationLecture 1: Introduction to Public key cryptography
Lecture 1: Introduction to Public key cryptography Thomas Johansson T. Johansson (Lund University) 1 / 44 Key distribution Symmetric key cryptography: Alice and Bob share a common secret key. Some means
More informationIntroduction to Modern Cryptography. Benny Chor
Introduction to Modern Cryptography Benny Chor RSA Public Key Encryption Factoring Algorithms Lecture 7 Tel-Aviv University Revised March 1st, 2008 Reminder: The Prime Number Theorem Let π(x) denote the
More informationMATH 158 FINAL EXAM 20 DECEMBER 2016
MATH 158 FINAL EXAM 20 DECEMBER 2016 Name : The exam is double-sided. Make sure to read both sides of each page. The time limit is three hours. No calculators are permitted. You are permitted one page
More informationA variant of the F4 algorithm
A variant of the F4 algorithm Vanessa VITSE - Antoine JOUX Université de Versailles Saint-Quentin, Laboratoire PRISM CT-RSA, February 18, 2011 Motivation Motivation An example of algebraic cryptanalysis
More informationCryptanalysis of the Oil & Vinegar Signature Scheme
Cryptanalysis of the Oil & Vinegar Signature Scheme Aviad Kipnis 1 and Adi Shamir 2 1 NDS Technologies, Israel 2 Dept. of Applied Math, Weizmann Institute, Israel Abstract. Several multivariate algebraic
More informationTaxonomy of Public Key Schemes based on the problem of Multivariate Quadratic equations
Taxonomy of Public Key Schemes based on the problem of Multivariate Quadratic equations Christopher Wolf, and Bart Preneel {Christopher.Wolf, Bart.Preneel}@esat.kuleuven.ac.be chris@christopher-wolf.de
More informationIntroduction to Quantum Safe Cryptography. ENISA September 2018
Introduction to Quantum Safe Cryptography ENISA September 2018 Introduction This talk will introduce the mathematical background of the most popular PQC primitives Code-based Lattice-based Multivariate
More informationAn Asymptotically Optimal Structural Attack on the ABC Multivariate Encryption Scheme
An Asymptotically Optimal Structural Attack on the ABC Multivariate Encryption Scheme Dustin Moody 1, Ray Perlner 1, and Daniel Smith-Tone 1,2 1 National Institute of Standards and Technology, Gaithersburg,
More informationComparison between XL and Gröbner Basis Algorithms
Comparison between XL and Gröbner Basis Algorithms Gwénolé Ars 1, Jean-Charles Faugère 2, Hideki Imai 3, Mitsuru Kawazoe 4, and Makoto Sugita 5 1 IRMAR, University of Rennes 1 Campus de Beaulieu 35042
More informationduring transmission safeguard information Cryptography: used to CRYPTOGRAPHY BACKGROUND OF THE MATHEMATICAL
THE MATHEMATICAL BACKGROUND OF CRYPTOGRAPHY Cryptography: used to safeguard information during transmission (e.g., credit card number for internet shopping) as opposed to Coding Theory: used to transmit
More informationComputers and Electrical Engineering
Computers and Electrical Engineering 36 (2010) 56 60 Contents lists available at ScienceDirect Computers and Electrical Engineering journal homepage: wwwelseviercom/locate/compeleceng Cryptanalysis of
More informationPublic Key Cryptography. All secret key algorithms & hash algorithms do the same thing but public key algorithms look very different from each other.
Public Key Cryptography All secret key algorithms & hash algorithms do the same thing but public key algorithms look very different from each other. The thing that is common among all of them is that each
More informationElliptic Curve Discrete Logarithm Problem
Elliptic Curve Discrete Logarithm Problem Vanessa VITSE Université de Versailles Saint-Quentin, Laboratoire PRISM October 19, 2009 Vanessa VITSE (UVSQ) Elliptic Curve Discrete Logarithm Problem October
More informationGröbner Bases in Public-Key Cryptography
Gröbner Bases in Public-Key Cryptography Ludovic Perret SPIRAL/SALSA LIP6, Université Paris 6 INRIA ludovic.perret@lip6.fr ECRYPT PhD SUMMER SCHOOL Emerging Topics in Cryptographic Design and Cryptanalysis
More informationSmall Public Keys and Fast Verification for Multivariate Quadratic Public Key Systems
Small Public Keys and Fast Verification for Multivariate Quadratic Public Key Systems Albrecht Petzoldt 1, Enrico Thomae, Stanislav Bulygin 3, and Christopher Wolf 4 1,3 Technische Universität Darmstadt
More informationOverview. Background / Context. CSC 580 Cryptography and Computer Security. March 21, 2017
CSC 580 Cryptography and Computer Security Math for Public Key Crypto, RSA, and Diffie-Hellman (Sections 2.4-2.6, 2.8, 9.2, 10.1-10.2) March 21, 2017 Overview Today: Math needed for basic public-key crypto
More informationInternational Electronic Journal of Pure and Applied Mathematics IEJPAM, Volume 9, No. 1 (2015)
International Electronic Journal of Pure and Applied Mathematics Volume 9 No. 1 2015, 37-43 ISSN: 1314-0744 url: http://www.e.ijpam.eu doi: http://dx.doi.org/10.12732/iejpam.v9i1.5 ON CONSTRUCTION OF CRYPTOGRAPHIC
More informationTi Secured communications
Ti5318800 Secured communications Pekka Jäppinen September 20, 2007 Pekka Jäppinen, Lappeenranta University of Technology: September 20, 2007 Relies on use of two keys: Public and private Sometimes called
More informationPublic-Key Identification Schemes based on Multivariate Quadratic Polynomials
Public-Key Identification Schemes based on Multivariate Quadratic Polynomials Koichi Sakumoto, Taizo Shirai, Harunaga Hiwatari from Tokyo, Japan Sony Corporation @CRYPTO2011 Motivation Finding a new alternative
More informationMath/Mthe 418/818. Review Questions
Math/Mthe 418/818 Review Questions 1. Show that the number N of bit operations required to compute the product mn of two integers m, n > 1 satisfies N = O(log(m) log(n)). 2. Can φ(n) be computed in polynomial
More informationLossy Trapdoor Functions and Their Applications
1 / 15 Lossy Trapdoor Functions and Their Applications Chris Peikert Brent Waters SRI International On Losing Information 2 / 15 On Losing Information 2 / 15 On Losing Information 2 / 15 On Losing Information
More informationA Classification of Differential Invariants for Multivariate Post-Quantum Cryptosystems
A Classification of Differential Invariants for Multivariate Post-Quantum Cryptosystems Ray Perlner 1 Daniel Smith-Tone 1,2 1 National Institute of Standards and Technology 2 University of Louisville 7th
More informationGröbner Bases Techniques in Post-Quantum Cryptography
Gröbner Bases Techniques in Post-Quantum Cryptography Ludovic Perret Sorbonne Universités, UPMC Univ Paris 06, INRIA Paris LIP6, PolSyS Project, Paris, France Post-Quantum Cryptography Winter School, Fukuoka,
More informationErrors, Eavesdroppers, and Enormous Matrices
Errors, Eavesdroppers, and Enormous Matrices Jessalyn Bolkema September 1, 2016 University of Nebraska - Lincoln Keep it secret, keep it safe Public Key Cryptography The idea: We want a one-way lock so,
More informationLinearity Measures for MQ Cryptography
Linearity Measures for MQ Cryptography Simona Samardjiska 1,2 and Danilo Gligoroski 1 Department of Telematics, NTNU, Trondheim, Norway, 1 FCSE, UKIM, Skopje, Macedonia. 2 simonas@item.ntno.no,simona.samardjiska@finki.ukim.mk,
More informationElliptic curves: Theory and Applications. Day 4: The discrete logarithm problem.
Elliptic curves: Theory and Applications. Day 4: The discrete logarithm problem. Elisa Lorenzo García Université de Rennes 1 14-09-2017 Elisa Lorenzo García (Rennes 1) Elliptic Curves 4 14-09-2017 1 /
More informationThe XL and XSL attacks on Baby Rijndael. Elizabeth Kleiman. A thesis submitted to the graduate faculty
The XL and XSL attacks on Baby Rijndael by Elizabeth Kleiman A thesis submitted to the graduate faculty in partial fulfillment of the requirements for the degree of MASTER OF SCIENCE Major: Mathematics
More informationOn the Goubin-Courtois Attack on TTM
On the Goubin-Courtois Attack on TTM T. Moh and Jiun-Ming Chen Abstract In the paper [1] published in Asiacrypt 2000, L. Goubin and N.T. Courtois propose an attack on the TTM cryptosystem. In paper [1],
More information1 What are Physical Attacks. 2 Physical Attacks on RSA. Today:
Today: Introduction to the class. Examples of concrete physical attacks on RSA A computational approach to cryptography Pseudorandomness 1 What are Physical Attacks Tampering/Leakage attacks Issue of how
More informationLecture Notes, Week 6
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467b: Cryptography and Computer Security Week 6 (rev. 3) Professor M. J. Fischer February 15 & 17, 2005 1 RSA Security Lecture Notes, Week 6 Several
More informationA brief survey of post-quantum cryptography. D. J. Bernstein University of Illinois at Chicago
A brief survey of post-quantum cryptography D. J. Bernstein University of Illinois at Chicago Once the enormous energy boost that quantum computers are expected to provide hits the street, most encryption
More informationIntroduction to Modern Cryptography. Lecture RSA Public Key CryptoSystem 2. One way Trapdoor Functions
Introduction to Modern Cryptography Lecture 7 1. RSA Public Key CryptoSystem 2. One way Trapdoor Functions Diffie and Hellman (76) New Directions in Cryptography Split the Bob s secret key K to two parts:
More informationPublic Key Algorithms
Public Key Algorithms Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-09/
More informationLecture V : Public Key Cryptography
Lecture V : Public Key Cryptography Internet Security: Principles & Practices John K. Zao, PhD (Harvard) SMIEEE Amir Rezapoor Computer Science Department, National Chiao Tung University 2 Outline Functional
More informationAn Algebraic Approach to NTRU (q = 2 n ) via Witt Vectors and Overdetermined Systems of Nonlinear Equations
An Algebraic Approach to NTRU (q = 2 n ) via Witt Vectors and Overdetermined Systems of Nonlinear Equations J.H. Silverman 1, N.P. Smart 2, and F. Vercauteren 2 1 Mathematics Department, Box 1917, Brown
More informationCryptanalysis of a Fast Public Key Cryptosystem Presented at SAC 97
Cryptanalysis of a Fast Public Key Cryptosystem Presented at SAC 97 Phong Nguyen and Jacques Stern École Normale Supérieure, Laboratoire d Informatique 45, rue d Ulm, F 75230 Paris Cedex 05 {Phong.Nguyen,Jacques.Stern}@ens.fr
More informationHOMOMORPHIC ENCRYPTION AND LATTICE BASED CRYPTOGRAPHY 1 / 51
HOMOMORPHIC ENCRYPTION AND LATTICE BASED CRYPTOGRAPHY Abderrahmane Nitaj Laboratoire de Mathe matiques Nicolas Oresme Universite de Caen Normandie, France Nouakchott, February 15-26, 2016 Abderrahmane
More informationPublic-key Cryptography and elliptic curves
Public-key Cryptography and elliptic curves Dan Nichols nichols@math.umass.edu University of Massachusetts Oct. 14, 2015 Cryptography basics Cryptography is the study of secure communications. Here are
More informationQuadratic Equations from APN Power Functions
IEICE TRANS. FUNDAMENTALS, VOL.E89 A, NO.1 JANUARY 2006 1 PAPER Special Section on Cryptography and Information Security Quadratic Equations from APN Power Functions Jung Hee CHEON, Member and Dong Hoon
More informationPublic-Key Encryption: ElGamal, RSA, Rabin
Public-Key Encryption: ElGamal, RSA, Rabin Introduction to Modern Cryptography Benny Applebaum Tel-Aviv University Fall Semester, 2011 12 Public-Key Encryption Syntax Encryption algorithm: E. Decryption
More informationA new attack on RSA with a composed decryption exponent
A new attack on RSA with a composed decryption exponent Abderrahmane Nitaj and Mohamed Ould Douh,2 Laboratoire de Mathématiques Nicolas Oresme Université de Caen, Basse Normandie, France abderrahmane.nitaj@unicaen.fr
More informationRank Analysis of Cubic Multivariate Cryptosystems
Rank Analysis of Cubic Multivariate Cryptosystems John Baena 1 Daniel Cabarcas 1 Daniel Escudero 2 Karan Khathuria 3 Javier Verbel 1 April 10, 2018 1 Universidad Nacional de Colombia, Colombia 2 Aarhus
More informationLecture 4 Chiu Yuen Koo Nikolai Yakovenko. 1 Summary. 2 Hybrid Encryption. CMSC 858K Advanced Topics in Cryptography February 5, 2004
CMSC 858K Advanced Topics in Cryptography February 5, 2004 Lecturer: Jonathan Katz Lecture 4 Scribe(s): Chiu Yuen Koo Nikolai Yakovenko Jeffrey Blank 1 Summary The focus of this lecture is efficient public-key
More informationRSA. Ramki Thurimella
RSA Ramki Thurimella Public-Key Cryptography Symmetric cryptography: same key is used for encryption and decryption. Asymmetric cryptography: different keys used for encryption and decryption. Public-Key
More informationHidden pairings and trapdoor DDH groups. Alexander W. Dent Joint work with Steven D. Galbraith
Hidden pairings and trapdoor DDH groups Alexander W. Dent Joint work with Steven D. Galbraith 2 Pairings in cryptography Elliptic curves have become an important tool in cryptography and pairings have
More informationOn the Security of HFE, HFEv- and Quartz
On the Security of HFE, HFEv- and Quartz Nicolas T. Courtois 1, Magnus Daum 2,andPatrickFelke 2 1 CP8 Crypto Lab, SchlumbergerSema 36-38 rue de la Princesse, BP 45, 78430Louveciennes Cedex, France courtois@minrank.org
More informationLemma 1.2. (1) If p is prime, then ϕ(p) = p 1. (2) If p q are two primes, then ϕ(pq) = (p 1)(q 1).
1 Background 1.1 The group of units MAT 3343, APPLIED ALGEBRA, FALL 2003 Handout 3: The RSA Cryptosystem Peter Selinger Let (R, +, ) be a ring. Then R forms an abelian group under addition. R does not
More informationCOMP4109 : Applied Cryptography
COMP409 : Applied Cryptography Fall 203 M. Jason Hinek Carleton University Applied Cryptography Day 3 public-key encryption schemes some attacks on RSA factoring small private exponent 2 RSA cryptosystem
More informationKey Recovery on Hidden Monomial Multivariate Schemes
Key Recovery on Hidden Monomial Multivariate Schemes Pierre-Alain Fouque 1, Gilles Macario-Rat 2, and Jacques Stern 1 1 École normale supérieure, 45 rue d Ulm, 75005 Paris, France {Pierre-Alain.Fouque,
More informationWinter 2011 Josh Benaloh Brian LaMacchia
Winter 2011 Josh Benaloh Brian LaMacchia Fun with Public-Key Tonight we ll Introduce some basic tools of public-key crypto Combine the tools to create more powerful tools Lay the ground work for substantial
More information1 Number Theory Basics
ECS 289M (Franklin), Winter 2010, Crypto Review 1 Number Theory Basics This section has some basic facts about number theory, mostly taken (or adapted) from Dan Boneh s number theory fact sheets for his
More informationDefinition: For a positive integer n, if 0<a<n and gcd(a,n)=1, a is relatively prime to n. Ahmet Burak Can Hacettepe University
Number Theory, Public Key Cryptography, RSA Ahmet Burak Can Hacettepe University abc@hacettepe.edu.tr The Euler Phi Function For a positive integer n, if 0
More informationOn error distributions in ring-based LWE
On error distributions in ring-based LWE Wouter Castryck 1,2, Ilia Iliashenko 1, Frederik Vercauteren 1,3 1 COSIC, KU Leuven 2 Ghent University 3 Open Security Research ANTS-XII, Kaiserslautern, August
More informationSecurity Issues in Cloud Computing Modern Cryptography II Asymmetric Cryptography
Security Issues in Cloud Computing Modern Cryptography II Asymmetric Cryptography Peter Schwabe October 21 and 28, 2011 So far we assumed that Alice and Bob both have some key, which nobody else has. How
More informationSuppose F is a field and a1,..., a6 F. Definition 1. An elliptic curve E over a field F is a curve given by an equation:
Elliptic Curve Cryptography Jim Royer CIS 428/628: Introduction to Cryptography November 6, 2018 Suppose F is a field and a 1,..., a 6 F. Definition 1. An elliptic curve E over a field F is a curve given
More informationSign of Permutation Induced by Nagata Automorphism over Finite Fields
Journal of Mathematics Research; Vol. 9, No. 5; October 217 ISSN 1916-9795 E-ISSN 1916-989 Published by Canadian Center of Science and Education Sign of Permutation Induced by Nagata Automorphism over
More informationElliptic Curve Cryptography
AIMS-VOLKSWAGEN STIFTUNG WORKSHOP ON INTRODUCTION TO COMPUTER ALGEBRA AND APPLICATIONS Douala, Cameroon, October 12, 2017 Elliptic Curve Cryptography presented by : BANSIMBA Gilda Rech BANSIMBA Gilda Rech
More informationHow to Use Short Basis : Trapdoors for Hard Lattices and new Cryptographic Constructions
Presentation Article presentation, for the ENS Lattice Based Crypto Workgroup http://www.di.ens.fr/~pnguyen/lbc.html, 30 September 2009 How to Use Short Basis : Trapdoors for http://www.cc.gatech.edu/~cpeikert/pubs/trap_lattice.pdf
More information