A MORE SECURE MFE MULTIVARIATE PUBLIC KEY ENCRYPTION SCHEME *

Transcription

1 Internatonal Journal of Computer Scence and Applcatons Vol No pp - 00 Technomathematcs Research Foundaton A ORE SECURE FE ULTIVARIATE PUBLIC KE ENCRPTION SCHEE n Wang School of Telecommuncatons Engneerng dan Unersty 'an 00 Chna wangxn@malxdaneducn Feng Feng Department of Appled athematcs and Appled Physcs 'an Insttute of Posts and Telecommuncatons 'an 0 Chna fengf@xyoueducn nme Wang State Key Lab of Integrated Serce Networks State dan Unersty 'an 00 Chna xmwang@xdaneducn Q Wang College of Electrcal Engneerng Guangx Unersty Nannng 000 In 00 PKC conference Dng et al use the second order lnearzaton equaton attack method to break what be called FE multarate publc key encrypton scheme and also proposed a hgh order lnearzaton equaton attack on multarate publc key cryptosystems To resst hgh order lnearzaton equaton attack we present an enhanced FE encrypton scheme n ths artcle The mproed scheme has publc key polynomals of degree four and operates on smaller feld Then we ge some dscusson and securty analyss show that the new scheme s more securty Keywords: Publc Key Cryptography ultarate Cryptanalyss FE HOLE Introducton The problem of deelopng new publc key cryptosystem had occuped the cryptographc research felds for the last thrty decades Seeral recent publc key systems use multarate polynomal systems of equatons partcularly quadratc polynomals nstead of number-theoretc constructons The publc operaton n such a system s to ealuate the system output when gen an nput alue The prate operaton s to compute the pre- Ths paper s a resed and extended erson of the paper presented n ICCIT0 Noember - 00 at Busan South Korea Correspondence should be addressed to ths author

2 n Wang et al mage of a gen alue Ths research s based the obseraton that solng a system of modular multarate polynomal equatons oer any fnte feld s NP-complete [Garay and Johnson ()] And no quantum polynomal algorthm has been found to sole t In the deelopment of multarate publc key cryptosystems algebrac attack s an mportant area of research whch comes from the lnearzaton equaton attack by Patarn [Patarn ()] Ths attack method refers to any technque that ends wth a solng system A lnearzaton equaton s an equaton of such form: a u bu c d 0 where u are plantext arables and are cphertext arables Another generalzaton of lnearzaton equaton [Patarn et al (00)] has the followng form: ak u k bu cu d k k e f 0 As a further extenson Dng et al propose to call the equatons wth hgh order terms of the cphertext arables whle only lnear terms of plantext arables "hgh order lnearzaton equaton (HOLE)" [ Dng et al (00)] The total degree of the hghest order of the cphertext arables s called the order of the HOLE the equaton aboe s thus called a second order lnearzaton equaton (SOLE) And they use the SOLEs to break the FE multarate publc key cryptosystem proposed by Wang et al n the CTtrack of the 00 RSA conference [Wang et al (00)] In ths artcle we modfy the central map of the FE and present an mproed scheme Substtute for a system of quadratc polynomals whch operated n a bg extenson feld we mproe the degree properly oer a smaller extenson feld Securty analyss show the enhanced scheme s more secure and we also make comparson between the two schemes In addton snce the enhanced scheme has publc key polynomals of degree four whch wll lead larger sze of publc key then we present a slght and mmature dea to alleate ths problem FE Publc Key Cryptosystem Let K be a fnte feld and L be ts degree r extenson feld generally r or whch s so-called the "edum Feld" In FE we dentfy L wth K r by a K-lnear r somorphsm : L K Take a bass r of L oer K and defne a a a a for any a K Then t s natural to extend r r to two K-lnear somorphsm r a r r r : L K and : L K Take and on extenson feld L and arrange nto matrces: 0

3 Defne A ore Secure FE ultarate Publc Key Encrypton Scheme 0 T Then let 0 The expressons of are represented by 0 Q Q Q The : L L s called the central quadratc map and s fxed except for three components Q Q Q whch are randomly chosen quadratc polynomals The trple r ( Q Q Q ) form a trangular map from K to tself The prate key of FE s composed of two nertble affne transformatons : w x w c and : y z y c whch are randomly chosen nertble affne transformatons r r respectely defned on K and K plus parameters n Q needed for takng ts nerse The publc key s composed of the three maps as : n m K K The correspondng r publc key quadratc polynomals are expressed u u h u u u u Ths by h r r r n m x K ' x y ' : y K process can also be wrtten as Gen a plantext u ur the encrypton of FE s to ealuate the publc key polynomals The decrypton s to calculate n turn for a ald cphertext u ur Here the crtcal pont s nert whch can be soled by usng the trangular structure of The method of computng the s presented by Appendx B of [Wang et al (00)]

4 n Wang et al HOLE Attack Let we hae det that s When both and are replaced by followng form are gen by and and expanded four equatons of the l 0 whch hold for any correspondng par k k r u u and r Substtutng nto the aboe equaton then we can get r equatons of the form () u k a k k b c k d k k e f 0 the coeffcents a k b c d e f K These equatons are SOLEs k In cphertext-only attack we frstly ealuate suffcent many plan/cpher-texts to get a system of lnear equatons on the coeffcents a k f and fnd lnearly ndependent SOLEs lnear n u Then gen cpher components we can reduce the plantext arables u by Gauss Elmnaton method Substtute these lnear expressons nto the orgnal publc key polynomals When the number of the arables s small enough to solng the equatons by usng Gr o obner bass method we recoer the plantext fnally

5 A ore Secure FE ultarate Publc Key Encrypton Scheme Enhanced FE scheme Constructon of Central ap Smlarly K s the base feld (charf = ) L s the extenson feld and two K-lnear somorphsm are and The prate key of the new scheme stll are and parameters n Q Let 0 0 () T then the correspondng central map L L : s as follows: Q Q Q Encrypton and Decrypton Encrypton Encrypton s to compute the alue of publc key polynomals by substtutng the plantext components

6 n Wang et al Decrypton Step: From () we hae When are all nertble none of s zero and knowng we can get alues of and as follows The square root operaton s easy to handle oer a char = feld Step: Then substtute and nto we can fnd and n a trangular manner Q Q Q Step: From we can obtan then Step: Let A det then

7 0 A ore Secure FE ultarate Publc Key Encrypton Scheme A A A A A A A 0 A 0 Analyss and Comparson Securty Analyss HOLE Attack: We show how the new FE to resst the SOLE attack Such as () n FE the equaton has degree two n cpher components whle lnear n plan components Hence we consder the formula whch nclude product of some two elements among T and Wthout loss of generalty suppose the expresson on and Expandng we get Note left sde of equalty s the foot note goes all oer from to If the rght sde only has (or det and T ) we should at least plus and Ths wll lead to non-lnear n So no SOLEs can be found Rank Attacks: Rank attacks contan the Hgh Rank and Low Rank These attacks are manly aganst all TP and some other tame-lke systems [ang and Chen(00)] In these attacks the quadratc parts are assocated wth symmetrc matrces The attackers try to recoer the prate key by fndng lnear combnatons of matrces wth a gen specfc rank Howeer the central and publc polynomals n the enhanced FE hae degree four whch hae not effcent expressons of symmetrc matrces Therefore these attacks are not feasble for our scheme Patarn Relatons Attack for C :In orgnal FE the matrx products are arranged and T whch ams to aod Patarn Relatons There s also no Patarn Relaton n the enhanced system Gr o bner Bases: Gr o bner Bases s a well-known way of solng polynomals The classcal algorthm s Buchberger's algorthm for computng Gr o bner bases [Courtos et al (000)] The algorthm orders all the monomals and elmnates the top monomal by combnng two equatons wth approprate polynomal coeffcents and untl only one

8 n Wang et al arable remans then soles the unarate polynomal equaton Computng the Gr o bner bass of a system of m polynomals equatons of maxmal degree d n n on arables has tme complexty m d [Cangla et al ()] Gro o bner base technques do not usually beneft from the fact that the number of equatons exceeds the number of arables snce they proceed by sequentally elmnatng a sngle monomal from a partcular par of equatons So current Gr o bner-based methods cannot be used to cryptanalyze the enhanced FE effectely Patarn's IP Approach: Patarn et al proposed an attack method for fxed central map schemes n [Patarn ()] Snce there are arable parameters n the central equaton the IP attack s not applcable Sze of Key Let n r arables and m r equatons n system of publc key polynomals the prate key s the coeffcents n and Q for a total of n m elements of K The publc key comprse about mn! coeffcents of for the enhanced FE whle about mn for the orgnal FE Unfortunately the sze of publc key of the new scheme s larger than that of the orgnal FE Howeer besdes we take smaller alue of parameter r f we can also manage to make the publc key polynomals be sparse polynomals then the sze of publc key can be reduced greatly For example whether can we set some restrctons on affne transformaton parts? Dscusson The character of feld n FE scheme s usually and the extenson of feld s mplemented as "tower" degree-two extensons We hae a recurse defnton for hae I GF x x x GF Wth a proper choce of we GF The multplcaton and nerson are ax bcx d a bc d bdx ac bd ax b ax a bab b a where the addton s the btwse OR and the multplcaton of expressons of a b c d and are done n GF As the more the number of extensons the hgher the computaton GF multplcatons are three tmes faster than GF multplcatons twenty tmes faster than GF For the orgnal FE the suggested parameters are r or K GF or GF then correspondng L s at least GF The publc key polynomals of the enhanced FE are of degree four so

9 A ore Secure FE ultarate Publc Key Encrypton Scheme we can use een smaller base feld K and ts extenson feld L For nstance we can take GF GF r or and K or een By the way snce the enhanced FE has publc key polynomals of degree four ths wll obously ncrease the encrypton tme Howeer after we actually test we fnd t doesn t cost much more tme comparng wth the orgnal FE scheme wth the same parameters Concluson FE multarate encrypton scheme uses medum szed feld extensons whch makes t faster than preous schemes Howeer t suffers a maor securty weakness due to structure of tself In ths paper we present a more secure FE scheme to resst the HOLE attack The enhanced system has a set of polynomals of degree four hence a larger sze of publc key Whle we present some thoughts to alleate ths problem besdes take smaller alue of parameters Certanly researches for systems of hgher degree are stll far from enough There stll need amount of work deoted to ths area Acknowledgments The frst author wll wsh to thank Prof nme Wang for hs constant understandng and support Ths work was supported by the Natonal Natural Scence Foundaton of Chna (No0000) and the Educaton Department of Shaanx Pronce of Chna (No0JK) References Cangla L Gallgo A () Some New Effectty Bounds n Computatonal GeometryLecture Notes n Computer Scence : Courtos N Klmo A (000) Effcent algorthms for solng oerdefned systems of multarate polynomal equatons Lecture Notes n Computer Scence 0: 0 Dng J Hu L (00) Hgh order lnearzaton equaton (hole) attack on multarate publc key cryptosystems Lecture Notes n Computer Scence 0: Garay and Johnson D () Computers and ntractablty-a gude to the theory of NP- Completeness st edn WH Freeman and Company San Francsco Patarn J () Cryptanalyss of the atsumoto and Ima publc key scheme of Eurocrypt' Lecture Notes n Computer Scence : Patarn J () Hdden Felds Equatons (HFE) and Isomorphsms of Polynomals (IP): Two New Famles of Asymmetrc Algorthms Lecture Notes n Computer Scence 00: Patarn J Courtos N (00) Flash a fast multarate sgnature algorthm Lecture Notes n Computer Scence 00: 0 Wang L C ang B (00) A edum-feld ultarate Publc keyencrypton Scheme Lecture Notes n Computer Scence 0: ang B and Chen J (00) Rank Attacks and Defence n Tame-Lke ultarate PKC's Lecture Notes n Computer Scence :