Global Journal of Pure and Applied Mathematics. ISS 0973-1768 Volume 13, umber 5 (2017), pp. 1447 1464 Research India Publications http://www.ripublication.com/gjpam.htm STRU: A on Alternative and Multidimensional Public Key Cryptosystem Khushboo Thakur Department of Mathematics, Govt..P.G. College of Science, Raipur (C.G.), India. B.P. Tripathi Department of Mathematics, Govt..P.G. College of Science, Raipur (C.G.), India. Abstract In this paper, we propose STRU by using sedenion algebra which is a non alternative and multi-dimensional public key cryptosystem based on the TRU. Our scheme STRU encrypts sixteen data vectors in each encryption procedure. The underlying algebraic structure of STRU is a non associative and non alternative but power-associative 16 dimensional algebra with a quadratic form and whose element are constructed from real number R by iterations of the Cayley Dickson Process. Moreover, it is neither a composition algebra nor a division algebra because it has zero divisors. Further, we provide the details of the key generation, encryption and decryption algorithms and discuss the object about key security, message security, and probability of successful decryption. AMS subject classification: 94A60, 2005, 17A45. Keywords: TRU, STRU, sedenion algebra, zero divisors, Cayley-Dickson Process, Encryption, Decryption.
1448 Khushboo Thakur and B.P. Tripathi 1. Introduction TRU is a probabilistic public key cryptosystem that was first proposed by Jeffrey Hoffstein, Jill Pipher and Joseph H. Silverman in the rump session of Crypto 96 and the first official paper was published in 1998 [15]. Compared to more well-known systems such as RSA or ECC, the greatest advantage of TRU is that it is based on a class of basic arithmetic operations whose inherent complexity is rather low, amounting to O( 2 ) in worst-case. Computational efficiency along with low cost of implementation have turned TRU into a very suitable choice for a large number of applications such as embedded systems, mobile phones, portable devices and resource constrained devices [1]. As a rough comparison, TRU is hundreds of times faster than RSA and has a much faster key generation algorithm. However, there is an obvious drawback in using TRU in that sometimes the decryption process fails to give the plaintext back with a very small probability (e.g., smaller than 2 80 ) [3]. TRU is classified as a lattice-based cryptosystem since its security is based on difficulty of hard-problems in certain types of lattices, contrary to RSA and ECC. On the other hand, TRU is also classified as a probabilistic cryptosystem as each encryption involves a random vector (ephemeral key) and, hence, messages do not have unique encryptions. During the past ten years, TRU has been strictly analyzed by researchers and its main core is still assumed to be safe. Most sophisticated attacks against TRU are based on lattice reduction techniques. Two famous lattice problems, Shortest Vector Problem (SVP) and Closest Vector Problem (CVP), have shown to be among P-hard problems [12, 5, 7, 4]. However, the lattice problem arising in TRU is classified as a Convolution Modular Lattice (CML) and it is not determined, yet, whether or not the cyclic structure of CML is going to help reducing the complexity of CVP or SVP. This issue has been considered in new versions of TRU [8, 9]. In this paper by introducing a non-alternative and multidimensional public key cryptosystem. We will prove that a lattice based public key cryptosystem based on nonalternative algebra is not sufficient but also possibly more secure then tru, because its lattice does not completely fit within Circular and Convolutional Modular Lattice. In completely even circumstances, i.e., choosing the same parameters for both TRU and STRU, STRU works sixteen times slower than TRU and the data are encrypted simultaneously as sixteen vectors. Other than changing the underlying algebra, no other change has been made. In particular, STRU keeps the probabilistic properties of TRU. Hence the main advantages of the proposed cryptosystem would be higher security and the increase of parallelism levels. Since sixteen vectors of data are encrypted simultaneously in each system call, STRU can be considered as a multidimensional cryptosystem. As a result of high complexity of the STRU lattice, the dimension can be reduced. Hence, the imposed speed reduction caused by sedenionic processing, can be compensated. This paper is organized as follows: Section 2 summarizes the TRU cryptosystem. Then, Section 3 includes a brief introduction to sedenion algebras. We dedicate Section 4 to introducing the algebraic structure of STRU. Then, Sections 5 and 6 are devoted to the description of STRU and general analysis of the scheme.
STRU: A on Alternative and Multidimensional Public Key Cryptosystem 1449 2. The TRU Cryptosystem The basic operations in TRU take place in the ring Z[x]/(x 1), which is known as the ring of convolution polynomial of rank, where is a prime [16]. Let define the following three rings: R = Z[x]/(x 1), R p = (Z/pZ)[x]/(x 1), and R q = (Z/qZ)[x]/(x 1). An element f of the rings R, R p, R q can be written as a polynomial or a vector of coefficients: f = i=0 1 f i.x i [f 0,f 1,...,f 1 ]. In the convolution rings, addition corresponds to the ordinary polynomials addition, i.e., element-wise vector addition. But multiplication, is denoted by is explicitly defined as follows, f(x):= g(x) := h(x) := h k := 1 i=0 1 i=0 1 i=0 f i.x i =[f 0,f 1,...,f 1 ] 1,f i Z. g i.x i =[g 0,g 1,...,g 1 ] 1,g i Z. h i.x i =[h 0,h 1,...,h 1 ] 1,h i Z. k f i.g k i + i=0 1 i=k+1 f i.g +k i = i+j=k f i.g j. Clearly, addition and multiplication in R p or R q are equivalent to performing the same operations in R and ultimately reducing the resulting coefficients mod p or mod q. Let d f, d g, d φ, and d m be constant integers less than. These are the public parameters of the cryptosystem and determine the distribution of the coefficients of the polynomials. Based on these constants, we shall define the subsets L f,l m,l Á,L g Raccording to the criteria presented in Table 1. With this notations and definitions, the tru public key cryptosystem can now be described as follows. Public Parameters: The public parameters (,p,q,d) in TRU are assumed to be fixed and must be agreed upon by both the sender and the receiver. and p are prime numbers such that gcd(p, q) = gcd(, q) = 1 and q >> p. Usual value include = 167 for moderate security, = 251 for high security, and = 503 for very high security along with p=3 and d 3. Key Generation: To create an TRU key, first two small polynomials g L g and f L f are randomly generated. The polynomial f must be invertible in R p and R q. When f is randomly selected from the subset L f, the probability for this polynomial to be invertible in R p and R q is very high. However, in rare event that f is not invertible, a new polynomial f can be easily generated. The inverse of f over R p and R q are computed using the extended Euclidian algorithm. We call those two inverses fp 1 and fq 1, respectively. Hence, we have f fp 1
1450 Khushboo Thakur and B.P. Tripathi Table 1: Definition of public parameters of TRU otation Definition Typical Value for =167, p=3, q=128 L f {f R f has d f coefficients equal d f = 61 to +1, (d f 1) equal to 1, the rest 0} L g {g R g has d f coefficients equal to d g = 61 +1, (d g 1) equal to 1, the rest 0} L φ {φ R φhas d f coefficients equal to d φ = 61 +1, (d φ 1) equal to 1, the rest 0} L m {m R coefficients of m are chosen modulo p, between p/2 and p/2} 1(modp) and f fq 1 1(modq). While f, g, fp 1 1 and fq are kept private, the public key h is computed in the following manner h = f 1 q g(modq). Encryption: The system initially selects a random polynomial φ L φ, called the ephemeral key, and cipher the input message to a polynomial m L m. The ciphertext is computed as follows: e = p.h φ + m(modq). ote that p is a constant parameter and we can pre-compute the polynomial p.h. Hence, disregarding the time required for generating the ephemeral key and transforming the incoming message into the polynomial m, the encryption process demands 2 multiplication and addition mod q. Decryption: The first step of the decryption process starts by multiplying (convolving) the received polynomial e by the private key f a = f e(modq). a = f (p.h φ + m)(modq) a = p.f h φ + f m(modq) a = p.f fq 1 g φ + f m(modq) a = p.g φ + f m(modq) In the second step, the coefficients of a R q are identified with the equivalent representatives in the interval [ q/2, +q/2]. Assuming that the public parameters have been chosen properly, the resulting polynomial is exactly equal to p.g φ + f m(modq) in R. With this assumption, when we reduce the coefficients of a mod p, the term p.g φ vanishes and f m(modp) remains. In order to extract the message m, it is enough to
STRU: A on Alternative and Multidimensional Public Key Cryptosystem 1451 multiply f m(modp) by f 1 p. Decryption Failure: If the public parameters (,p,q,d) are chosen to satisfy q> (6d +1)p then decryption process will never fail. However, to have a better performance and also to reduce the size of the public key, smaller value of q may be chosen for q such that the probability of decryption failure be very small of order 2 80 [3]. Successful decryption depends on whether or not p.g φ + f m < q. Through a few simple probabilistic calculations [17], the approximate bound for successful decryption probability can be calculated as follows P r(successf uldecryption) = ( 2φ ( ) q 1 2σ ) 1 where φ denotes the distribution of the standard normal variable and 36df.d g σ + 8d f 6. 3. A Brief Introduction to Sedenion Algebra The algebras C (complex numbers), H (quaternions), and O (octonions) are real division algebras obtained from the real numbers R by a doubling procedure called the Cayley-Dickson Process. By doubling R (dim 1), we obtain C (dim 2), then C produces H (dim 4), and H yields O (dim 8), The next doubling process applied to O then yields an algebra S (dim 16) called the sedenions. The world sedenion is derived from sexdecim, meaning sixteen.the real sedenion or hexadecanions is denoted by S. The sedenion is a non-commutative, non-associative, non-alternative, but power-associative 16 dimensional algebra with a quadratic form and whose elements are constructed from real numbers R by iterations of the Cayley-Dickson Process [10, 11]. Moreover, it is neither a composition algebra nor a division algebra because it has zero divisors. This means that there exist sedenions a,b = 0 such that ab = 0. The sedenions have multiplicative identity element and multiplicative inverse. otation: Let 2 4 = 16 basis elements of the sedenion algebra S be represented by the set S E ={e 0,e 1,e 2,...,e 15 }, where e 0 is the identity element and e 1,...,e 15 are called imaginaries. Then every sedenion is a linear combination of the unit sedenions e 0,e 1,e 2,...,e 15, which form a basis of the vector space of sedenions. Every sedenion can be represented in the form, S = x 0 e 0 + x 1 e 1 + x 2 e 2 + x 3 e 3 + +x 14 e 14 + x 15 e 15 S ={x 0 + x i e i x 0,...,x 15 R}
1452 Khushboo Thakur and B.P. Tripathi where x i R. Here x 0 is called the real part of S while x i e i is called its imaginary part. The addition of two sedenion is performed by adding corresponding coefficients (i.e., element-wise) but multiplication is defined by bilinearity and the multiplication rule of the base elements. Thus, if x,y S, wehave: xy = ( i=0 )( ) x i e i y j e i = i=0 i,j=0 x i y j (e i e j ) i,j,k=1 f ij γ k ij e k where e i,e j,e k E 16, f ij = x i y j R, and the quantities γ k ij Rare called structure constants. The multiplication rule of the sedenion base elements is given by and is summarized in Table 2 [13] e i e j = k=0 γ k ij e k Table 2: The multiplication Table Of The Sedenion element e 0 e 1 e 2 e 3 e 4 e 5 e 6 e 7 e 8 e 9 e 10 e 11 e 12 e 13 e 14 e 15 e 0 e 0 e 1 e 2 e 3 e 4 e 5 e 6 e 7 e 8 e 9 e 10 e 11 e 12 e 13 e 14 e 15 e 1 e 1 e 0 e 3 e 2 e 5 e 4 e 7 e 6 e 9 e 8 e 11 e 10 e 13 e 12 e 15 e 14 e 2 e 2 e 3 e 0 e 1 e 6 e 7 e 4 e 5 e 10 e 11 e 8 e 9 e 14 e 15 e 12 e 13 e 3 e 3 e 2 e 1 e 0 e 7 e 6 e 5 e 4 e 11 e 10 e 9 e 8 e 15 e 14 e 13 e 12 e 4 e 4 e 5 e 6 e 7 e 0 e 1 e 2 e 3 e 12 e 13 e 14 e 15 e 8 e 9 e 10 e 11 e 5 e 5 e 4 e 7 e 6 e 1 e 0 e 3 e 2 e 13 e 12 e 15 e 14 e 9 e 8 e 11 e 10 e 6 e 6 e 7 e 4 e 5 e 2 e 3 e 0 e 1 e 14 e 15 e 12 e 13 e 10 e 11 e 8 e 9 e 7 e 7 e 6 e 5 e 4 e 3 e 2 e 1 e 0 e 15 e 14 e 13 e 12 e 11 e 10 e 9 e 8 e 8 e 8 e 9 e 10 e 11 e 12 e 13 e 14 e 15 e 0 e 1 e 2 e 3 e 4 e 5 e 6 e 7 e 9 e 9 e 8 e 11 e 10 e 13 e 12 e 15 e 14 e 1 e 0 e 3 e 2 e 5 e 4 e 7 e 6 e 10 e 10 e 11 e 8 e 9 e 14 e 15 e 12 e 13 e 2 e 3 e 0 e 1 e 6 e 7 e 4 e 5 e 11 e 11 e 10 e 9 e 8 e 15 e 14 e 13 e 12 e 3 e 2 e 1 e 0 e 7 e 6 e 5 e 4 e 12 e 12 e 13 e 14 e 15 e 8 e 9 e 10 e 11 e 4 e 5 e 6 e 7 e 0 e 1 e 2 e 3 e 13 e 13 e 12 e 15 e 14 e 9 e 8 e 11 e 10 e 5 e 4 e 7 e 6 e 1 e 0 e 3 e 2 e 14 e 14 e 15 e 12 e 13 e 10 e 11 e 8 e 9 e 6 e 7 e 4 e 5 e 2 e 3 e 0 e 1 e 15 e 15 e 14 e 13 e 12 e 11 e 10 e 9 e 8 e 7 e 6 e 5 e 4 e 3 e 2 e 1 e 0 Multiplication is neither commutative nor associative but is power-associative and have zero divisors. The conjugate and square norm of an sedenion x = x 0 + are given by [18] x = x 0 x i e i and (x)= x.x = x.x = i=0 x i e i x 2 i respectively. Every non-zero element in S has a unique multiplicative inverse which is given by x 1 =(x) 1.x. ow, suppose that R is an arbitrary finite ring of odd characteristic. We can define the sedenion algebra A over R as follows 15 A ={x 0 + x i e i x 0,...,x 15 R} (3.1)
STRU: A on Alternative and Multidimensional Public Key Cryptosystem 1453 with the same multiplication defined for the real sedenion. The algebra A is a nonassociative algebra with a norm and multiplicative inverse that has much the same properties as the real sedenion algebra S. ote that the sedenion algebra is non-associative and consequently does not have any matrix representation because ordinary matrix multiplication is always associative. 4. Algebraic Structure of STRU Consider the convolution polynomial rings R:=Z[x]/(x 1), R p := Z p [x]/(x 1), and R q := Z q [x]/(x 1) that are used in tru. 'We define three sedenion algebrasa, A p and A q as follows A := {a 0 (x) + A p := {a 0 (x) + A q := {a 0 (x) + a i (x).e i a 0 (x),...,a 15 (x) R} (4.1) a i (x).e i a 0 (x),...,a 15 (x) R p } (4.2) a i (x).e i a 0 (x),...,a 15 (x) R q } (4.3) For simplicity, p, q and are assumed to be prime numbers and q >> p. Since Z p [x]/(x 1) and Z q [x]/(x 1) are finite rings with characteristics p and q, respectively, one can easily conclude that A p and A q are sedenionic nonassociative split algebras similar to S. Let us detailed more on algebras A p and A q. A p :={a 0 (x) + a i (x).e i a 0 (x),...,a 15 (x) R p } ={f 0 + f 1.e 1 + +f 15.e 15 f 0...f 15 A p } A q :={a 0 (x) + a i (x).e i a 0 (x),...,a 15 (x) R q } ={g 0 + g 1.e 1 + +g 15.e 15 g 0...g 15 A q } ow assume that s 1, s 2 A p (or A q ) where, s 1 = f 0 (x) + f 1 (x).e 1 + +f 15 (x).e 15, s 2 = g 0 (x) + g 1 (x).e 1 + +g 15 (x).e 15. Then, the Addition, Multiplication, orm, Trace and Multiplicative Inverse are defined in the below:
1454 Khushboo Thakur and B.P. Tripathi Addition: The addition of two sedenions corresponds to the usual addition of sixteen polynomials including 16 modular addition mod p (mod q), i.e., s 1 + s 2 = (f 0 (x) + g 0 (x)) + (f 1 (x) + g 1 (x)).e 1 + (f 2 (x) + g 2 (x)).e 2 + (f 3 (x) + g 3 (x)).e 3 + (f 4 (x) + g 4 (x)).e 4 + (f 5 (x) + g 5 (x)).e 5 + (f 6 (x) + g 6 (x)).e 6 + (f 7 (x) + g 7 (x)).e 7 + (f 8 (x) + g 8 (x)).e 8 + (f 9 (x) + g 9 (x)).e 9 + (f 10 (x) + g 10 (x)).e 10 + (f 11 (x) + g 11 (x)).e 11 + (f 12 (x) + g 12 (x)).e 12 + (f 13 (x) + g 13 (x)).e 13 + (f 14 (x) + g 14 (x)).e 14 + (f 15 (x) + g 15 (x)).e 15. Multiplication: The multiplication of two sedenions is defined by s 1 s 2 =(f 0 g 0 f 1 g 1 f 2 g 2 f 3 g 3 f 4 g 4 f 5 g 5 f 6 g 6 f 7 g 7 f 8 g 8 f 9 g 9 f 10 g 10 f 11 g 11 f 12 g 12 f 13 g 13 f 14 g 14 f 15 g 15 ) +(f 0 g 1 + f 1 g 0 + f 2 g 3 f 3 g 2 + f 4 g 5 f 5 g 4 f 6 g 7 + f 7 g 6 + f 8 g 9 f 9 g 8 f 10 g 11 + f 11 g 10 f 12 g 13 + f 13 g 12 + f 14 g 15 f 15 g 14 ).e 1 +(f 0 g 2 f 1 g 3 + f 2 g 0 + f 3 g 1 + f 4 g 6 + f 5 g 7 f 6 g 4 f 7 g 5 + f 8 g 10 + f 9 g 11 f 10 g 8 f 11 g 9 f 12 g 14 f 13 g 15 + f 14 g 12 + f 15 g 13 ).e 2 +(f 0 g 3 + f 1 g 2 f 2 g 1 + f 3 g 0 + f 4 g 7 f 5 g 6 + f 6 g 5 f 7 g 4 + f 8 g 11 f 9 g 10 + f 10 g 9 f 11 g 8 f 12 g 15 + f 13 g 14 f 14 g 13 + f 15 g 12 ).e 3 +(f 0 g 4 f 1 g 5 f 2 g 6 f 3 g 7 + f 4 g 0 + f 5 g 1 + f 6 g 2 + f 7 g 3 + f 8 g 12 + f 9 g 13 + f 10 g 14 + f 11 g 15 f 12 g 8 f 13 g 9 f 14 g 10 f 15 g 11 ).e 4 +(f 0 g 5 + f 1 g 4 f 2 g 7 + f 3 g 6 f 4 g 1 + f 5 g 0 f 6 g 3 + f 7 g 2 + f 8 g 13 f 9 g 12 + f 10 g 15 f 11 g 14 + f 12 g 9 f 13 g 8 + f 14 g 11 f 15 g 10 ).e 5 +(f 0 g 6 + f 1 g 7 + f 2 g 4 f 3 g 5 f 4 g 2 + f 5 g 3 + f 6 g 0 f 7 g 1 + f 8 g 14 f 9 g 15 f 10 g 12 + f 11 g 13 + f 12 g 10 f 13 g 11 f 14 g 8 + f 15 g 9 ).e 6 +(f 0 g 7 f 1 g 6 + f 2 g 5 + f 3 g 4 f 4 g 3 f 5 g 2 + f 6 g 1 + f 7 g 0 + f 8 g 15 + f 9 g 14 f 10 g 13 f 11 g 12 + f 12 g 11 + f 13 g 10 f 14 g 9 f 15 g 8 ).e 7 +(f 0 g 8 f 1 g 9 f 2 g 10 f 3 g 11 f 4 g 12 f 5 g 13 f 6 g 14 f 7 g 15 + f 8 g 0 + f 9 g 1 + f 10 g 2 + f 11 g 3 + f 12 g 4 + f 13 g 5 + f 14 g 6 + f 15 g 7 ).e 8 +(f 0 g 9 + f 1 g 8 f 2 g 11 + f 3 g 10 f 4 g 13 + f 5 g 12 + f 6 g 15 f 7 g 14 f 8 g 1 + f 9 g 0 f 10 g 3 + f 11 g 2 f 12 g 5 + f 13 g 4 + f 14 g 7 f 15 g 6 ).e 9 +(f 0 g 10 + f 1 g 11 + f 2 g 8 f 3 g 9 f 4 g 14 f 5 g 15 + f 6 g 12 + f 7 g 13 f 8 g 2 + f 9 g 3 + f 10 g 0 f 11 g 1 f 12 g 6 f 13 g 7 + f 14 g 4 + f 15 g 5 ).e 10 +(f 0 g 11 f 1 g 10 + f 2 g 9 + f 3 g 8 f 4 g 15 + f 5 g 14 f 6 g 13 + f 7 g 12 f 8 g 3 f 9 g 2 + f 10 g 1 + f 11 g 0 f 12 g 7 + f 13 g 6 f 14 g 5 + f 15 g 4 ).e 11 +(f 0 g 12 + f 1 g 13 + f 2 g 14 + f 3 g 15 + f 4 g 8 f 5 g 9 f 6 g 10 f 7 g 11 f 8 g 4 + f 9 g 5 + f 10 g 6 + f 11 g 7 + f 12 g 0 f 13 g 1 f 14 g 2 f 15 g 3 ).e 12 +(f 0 g 13 f 1 g 12 + f 2 g 15 f 3 g 14 + f 4 g 9 + f 5 g 8 + f 6 g 11 f 7 g 10 f 8 g 5 f 9 g 4 + f 10 g 7 f 11 g 6 + f 12 g 1 + f 13 g 0 + f 14 g 3 f 15 g 2 ).e 13 +(f 0 g 14 f 1 g 15 f 2 g 12 + f 3 g 13 + f 4 g 10 f 5 g 11 + f 6 g 8 + f 7 g 9 f 8 g 6 f 9 g 7 f 10 g 4 + f 11 g 5 + f 12 g 2 f 13 g 3 + f 14 g 0 + f 15 g 1 ).e 14 +(f 0 g 15 + f 1 g 14 f 2 g 13 f 3 g 12 + f 4 g 11 + f 5 g 10 f 6 g 9 + f 7 g 8 f 8 g 7 + f 9 g 6
STRU: A on Alternative and Multidimensional Public Key Cryptosystem 1455 f 10 g 5 f 11 g 4 f 12 g 3 + f 13 g 2 f 14 g 1 + f 15 g 0 ).e 15, Here denotes the convolution product. sedenion multiplication in A p (or A q ) needs 256 polynomial convolutions and 240 polynomial addition modulo p(q), which together account for 256. 2 modular multiplications and (256(-1)+240) modular additions. Conjugate: The conjugate of sedenions which is defined as below needs 15 negations mod p or q. s =+f 0 (x) f 1 (x)e 1 f 2 (x)e 2 f 3 (x)e 3 f 15 (x)e 15 orm: we define the norm of a sedenion S, defined as follows (s 1 ) = s 1 s 1 = s 1 s 1 = (f 0 (x)) 2 + (f 1 (x)) 2 + (f 2 (x)) 2 + (f 0 (x)) 2 + +(f 15 (x)) 2 Totally, 16 2 multiplications and (16(-1)+15) additions are required for calculating the squared norm of an sedenions. Multiplicative inverse: (s 1 ) = 0 s 1 = s 1 (s 1 ) = ((f 0(x)) 2 + (f 1 (x)) 2 + (f 2 (x)) 2 + (f 0 (x)) 2 + + (f 15 (x)) 2 ) 1.(f 0 (x) f 1 (x).e 1 f 2 (x).e 2 f 3 (x).e 3 f 15 (x).e 15 ) Thus, the following operations will be needed for calculating the multiplicative inverse of an element in A p or A q 1. Calculation of g(x) (s)over the ground ring (Z/pZ)[x]/(x 1) and (Z/qZ)[x]/(x 1) at the total cost of 16 2 multiplications and (16(- 1)+15) additions. 2. Finding the inverse of g(x) over the ground ring using the extended Euclid algorithm with a running time of O( 2 ) [14]. 3. Conjugation of s including 15 negations. 4. Calculation of g 1 (x).s including 16 2 multiplication and 16( 1) addition modulo p or q. After setting up the required notation and algebras A, A p and A q, we describe STRU.
1456 Khushboo Thakur and B.P. Tripathi 5. Proposed Scheme: STRU In the STRU cryptosystem, encryption and decryption are taken place in a multi-dimensional vector space and similar to tru, the security of the cryptosystem depends on three parameters (,p,q)and four subsets L f, L m, L ƒ, L g A as defined in Table I., p and q, d f, d g, d ƒ are constant parameters which play a similar role as in tru except that for simplicity these constants are supposed to be all prime numbers. ow proposed scheme is divided into three parts: Key Generation, Encryption and Decryption as follows, a) Key Generation: In order to generate a pair of public and private keys, initially, two small sedenion F and G are randomly generated. F := f 0 + f 1.e 1 + f 2.e 2 + +f 15.e 15 A f 0...f 15 L f A G := g 0 + g 1.e 1 + g 2.e 2 + +g 15.e 15 A g 0...g 15 L g A The sedenion F must be invertible over A p and A q. If such an inverse does not exist i.e., when i=0 f 2 i (x) is not invertible in Z p[x]/(x 1), and Z q [x]/(x 1), a new sedenion F will be generated. The inverses of F over the algebras A p and A q are denoted by F p 1 and F q 1 The public key, which is an sedenion, is computed as follows H = F q G (5.1) The sedenions F, F p and F q are kept secret in order to be used in the decryption phase. One can estimate that the key generation of STRU is 256 times slower than that of tru, when the same parameters (,p,q)are used in both cryptosystems. However, in STRU, we can definitely work with a lower dimension, without reducing the system security. b) Encryption: In the encryption process, the cryptosystem initially generates a random sedenion, called the blinding sedenion. Incoming data must be converted into a sedenion including sixteen polynomial in L φ based on a simple conversion. The ciphertext E is then calculated as follows E = p.h φ + M A q (5.2) c) Decryption: The received encryption E is first multiplied by the private key F F E= (F (p.h φ + M))modq = (F p.h φ + F M)modq = (p.f F q G φ+ F M)modq = (p.g φ + F M). The coefficients of the sixteen polynomials in the resulting sedenion must be reduced mod q into the interval ( q/2, +q/2]. Upon suitable selection of the cryptosystem
STRU: A on Alternative and Multidimensional Public Key Cryptosystem 1457 constant parameters, the coefficients of the sixteen polynomial in (p.g φ + F M) will most probably be within ( q/2, +q/2] and the last reduction mod q will not be required. With such an assumption, when the result of (p.g φ + F M)is reduced mod p, the term p.g φvanishes and the F M(modp) remains. In order to extract the original message M it will be sufficient to multiply F Mmod p by F p and adjust the resulting coefficients within the interval [ p/2, +p/2]. One can estimate that the encryption and decryption algorithms in STRU with the same dimension are about 16 and 32 times slower than that of tru, however, in STRU we can work with a lower dimension, without reducing the cryptosystem security. Also, similar to tru, STRU can be optimized for efficiency based on the various optimization methods proposed in [6]. In addition, there are multiple parallelism levels in the proposed scheme that can be exploited to improve encryption and decryption speed. 6. Analyzing of STRU cryptosystem In this section, we analyze STRU and discuss the probability of successful decryption, key security, message security, and the message expansion rate. Successful Decryption: Probability of successful decryption in STRU is calculated in the same way as TRU and under the same assumptions considered in [16] and [17]. Moreover, for successful decryption in STRU, all sedenion coefficients of F E= (p.g φ + F M) must lie in the interval [ q + 1/2, +q 1/2]. Hence, we obtain A :=F E=(p.G φ + F M) = a 0 + a 1.e 1 + a 2.e 2 + a 3.e 3 + a 4.e 4 + a 5.e 5 + a 6.e 6 + a 7.e 7 + a 8.e 8 + a 9.e 9 + a 10.e 10 + a 11.e 11 + a 12.e 12 + a 13.e 13 + a 14.e 14 + a 15.e 15 where a 0 = p(g 0 φ 0 g 1 φ 1 g 2 φ 2 g 3 φ 3 g 4 φ 4 g 5 φ 5 g 6 φ 6 g 7 φ 7 g 8 φ 8 g 9 φ 9 g 10 φ 10 g 11 φ 11 g 12 φ 12 g 13 φ 13 g 14 φ 14 g 15 φ 15 + f 0 m 0 f 1 m 1 f 2 m 2 f 3 m 3 f 4 m 4 f 5 m 5 f 6 m 6 f 7 m 7 f 8 m 8 f 9 m 9 f 10 m 10 f 11 m 11 f 12 m 12 f 13 m 13 f 14 m 14 f 15 m 15 )
1458 Khushboo Thakur and B.P. Tripathi a 1 = p(g 0 φ 1 + g 1 φ 0 + g 2 φ 3 g 3 φ 2 + g 4 φ 5 g 5 φ 4 g 6 φ 7 + g 7 φ 6 + g 8 φ 9 g 9 φ 8 g 10 φ 11 + g 11 φ 10 g 12 φ 13 + g 13 φ 12 + g 14 φ 15 g 15 φ 14 + f 0 m 1 + f 1 m 0 + f 2 m 3 f 3 m 2 + f 4 m 5 f 5 m 4 f 6 m 7 + f 7 m 6 + f 8 m 9 f 9 m 8 f 10 m 11 + f 11 m 10 f 12 m 13 + f 13 m 12 + f 14 m 15 f 15 m 14 ) a 2 = p(g 0 φ 2 g 1 φ 3 + g 2 φ 0 + g 3 φ 1 + g 4 φ 6 + g 5 φ 7 g 6 φ 4 g 7 φ 5 + g 8 φ 10 + g 9 φ 11 g 10 φ 8 g 11 φ 9 g 12 φ 14 g 13 φ 15 + g 14 φ 12 + g 15 φ 13 + f 0 g m f 1 m 3 + f 2 m 0 + f 3 m 1 + f 4 m 6 + f 5 m 7 f 6 m 4 f 7 m 5 + f 8 m 10 + f 9 m 11 f 10 m 8 f 11 m 9 f 12 m 14 f 13 m 15 + f 14 m 12 + f 15 m 13 ) a 3 = p(g 0 φ 3 + g 1 φ 2 g 2 φ 1 + g 3 φ 0 + g 4 φ 7 g 5 φ 6 + g 6 φ 5 g 7 φ 4 + g 8 φ 11 g 9 φ 10 + g 10 φ 9 g 11 φ 8 g 12 φ 15 + g 13 φ 14 g 14 φ 13 + g 15 φ 12 + f 0 m 3 + f 1 m 2 f 2 m 1 + f 3 m 0 + f 4 m 7 f 5 m 6 + f 6 m 5 f 7 m 4 + f 8 m 11 f 9 m 10 + f 10 m 9 f 11 m 8 f 12 m 15 + f 13 m 14 f 14 m 13 + f 15 m 12 ) a 4 = p(g 0 φ 4 g 1 φ 5 g 2 φ 6 g 3 φ 7 + g 4 φ 0 + g 5 φ 1 + g 6 φ 2 + g 7 φ 3 + g 8 φ 12 + g 9 φ 13 + g 10 φ 14 + g 11 φ 15 g 12 φ 8 g 13 φ 9 g 14 φ 10 g 15 φ 11 + f 0 m 4 f 1 m 5 f 2 m 6 f 3 m 7 + f 4 m 0 + f 5 m 1 + f 6 m 2 + f 7 m 3 + f 8 m 12 + f 9 m 13 + f 10 m 14 + f 11 m 15 f 12 m 8 f 13 m 9 f 14 m 10 f 15 m 11 ) a 5 = p(g 0 φ 5 + g 1 φ 4 g 2 φ 7 + g 3 φ 6 g 4 φ 1 + g 5 φ 0 g 6 φ 3 + g 7 φ 2 + g 8 φ 13 g 9 φ 12 + g 10 φ 15 g 11 φ 14 + g 12 φ 9 g 13 φ 8 + g 14 φ 11 g 15 φ 10 + f 0 m 5 + f 1 m 4 f 2 m 7 + f 3 m 6 f 4 m 1 + f 5 m 0 f 6 m 3 + f 7 m 2 + f 8 m 13 f 9 m 12 + f 10 m 15 f 11 m 14 + f 12 m 9 f 13 m 8 + f 14 m 11 f 15 m 10 ) a 6 = p(g 0 φ 6 + g 1 φ 7 + g 2 φ 4 g 3 φ 5 g 4 φ 2 + g 5 φ 3 + g 6 φ 0 g 7 φ 1 + g 8 φ 14 g 9 φ 15 g 10 φ 12 + g 11 φ 13 + g 12 φ 10 g 13 φ 11 g 14 φ 8 + g 15 φ 9 + f 0 m 6 + f 1 m 7 + f 2 m 4 f 3 m 5 f 4 m 2 + f 5 m 3 + f 6 m 0 f 7 m 1 + f 8 m 14 f 9 m 15 f 10 m 12 + f 11 m 13 + f 12 m 10 f 13 m 11 f 14 m 8 + f 15 m 9 ) a 7 = p(g 0 φ 7 g 1 φ 6 + g 2 φ 5 + g 3 φ 4 g 4 φ 3 g 5 φ 2 + g 6 φ 1 + g 7 φ 0 + g 8 φ 15 + g 9 φ 14 g 10 φ 13 g 11 φ 12 + g 12 φ 11 + g 13 φ 10 g 14 φ 9 g 15 φ 8 + f 0 m 7 f 1 m 6 + f 2 m 5 + f 3 m 4 f 4 m 3 f 5 m 2 + f 6 m 1 + f 7 m 0 + f 8 m 15 + f 9 m 14 f 10 m 13 f 11 m 12 + f 12 m 11 + f 13 m 10 f 14 m 9 f 15 m 8 ) a 8 = p(g 0 φ 8 g 1 φ 9 g 2 φ 10 g 3 φ 11 g 4 φ 12 g 5 φ 13 g 6 φ 14 g 7 φ 15 + g 8 φ 0 + g 9 φ 1 + g 10 φ 2 + g 11 φ 3 + g 12 φ 4 + g 13 φ 5 + g 14 φ 6 + g 15 φ 7 + f 0 m 8 f 1 m 9 f 2 m 10 f 3 m 11 f 4 m 12 f 5 m 13 f 6 m 14 f 7 m 15 + f 8 m 0 + f 9 m 1 + f 10 m 2 + f 11 m 3 + f 12 m 4 + f 13 m 5 + f 14 m 6 + f 15 m 7 )
STRU: A on Alternative and Multidimensional Public Key Cryptosystem 1459 a 9 = p(g 0 φ 10 + g 1 φ 11 + g 2 φ 8 g 3 φ 9 g 4 φ 14 g 5 φ 15 + g 6 φ 12 + g 7 φ 13 g 8 φ 2 + g 9 φ 3 + g 10 φ 0 g 11 φ 1 g 12 φ 6 g 13 φ 7 + g 14 φ 4 + g 15 φ 5 + f 0 m 10 + f 1 m 11 + f 2 m 8 f 3 m 9 f 4 m 14 f 5 m 15 + f 6 m 12 + f 7 m 13 f 8 m 2 + f 9 m 3 + f 10 m 0 f 11 m 1 f 12 m 6 f 13 m 7 + f 14 m 4 + f 15 m 5 ) a 10 = p(g 0 φ 10 + g 1 φ 11 + g 2 φ 8 g 3 φ 9 g 4 φ 14 g 5 φ 15 + g 6 φ 12 + g 7 φ 13 g 8 φ 2 + g 9 φ 3 + g 10 φ 0 g 11 φ 1 g 12 φ 6 g 13 φ 7 + g 14 φ 4 + g 15 φ 5 + f 0 φ 10 + f 1 φ 11 + f 2 m 8 f 3 m 9 f 4 m 14 f 5 m 15 + f 6 m 12 + f 7 m 13 f 8 m 2 + f 9 m 3 + f 10 m 0 f 11 m 1 f 12 m 6 f 13 m 7 + f 14 m 4 + f 15 m 5 ) a 11 = p(f 0 φ 11 f 1 φ 10 + f 2 φ 9 + f 3 φ 8 f 4 φ 15 + f 5 φ 14 f 6 φ 13 + f 7 φ 12 f 8 φ 3 f 9 φ 2 + f 10 φ 1 + f 11 φ 0 f 12 φ 7 + f 13 φ 6 f 14 φ 5 + f 15 φ 4 + (f 0 m 11 f 1 m 10 + f 2 m 9 + f 3 m 8 f 4 m 15 + f 5 m 14 f 6 m 13 + f 7 m 12 f 8 m 3 f 9 m 2 + f 10 m 1 + f 11 m 0 f 12 m 7 + f 13 m 6 f 14 m 5 + f 15 m 4 ) a 12 = p(g 0 φ 12 + g 1 φ 13 + g 2 φ 14 + g 3 φ 15 + g 4 φ 8 g 5 φ 9 g 6 φ 10 g 7 φ 11 g 8 φ 4 + g 9 φ 5 + g 10 φ 6 + g 11 φ 7 + g 12 φ 0 g 13 φ 1 g 14 φ 2 g 15 φ 3 + f 0 m 12 + f 1 m 13 + f 2 m 14 + f 3 m 15 f 4 m 8 f 5 m 9 f 6 m 10 f 7 m 11 f 8 m 4 + f 9 m 5 + f 10 m 6 + f 11 m 7 + f 12 m 0 f 13 m 1 f 14 m 2 f 15 m 3 ) a 13 = p(g 0 φ 13 g 1 φ 12 + g 2 φ 15 g 3 φ 14 + g 4 φ 9 + g 5 φ 8 + g 6 φ 11 g 7 φ 10 g 8 φ 5 g 9 φ 4 + g 10 φ 7 g 11 φ 6 + g 12 φ 1 + g 13 φ 0 + g 14 φ 3 g 15 φ 2 + f 0 m 13 f 1 m 12 + f 2 m 15 f 3 m 14 + f 4 m 9 + f 5 m 8 + f 6 m 11 f 7 m 10 f 8 m 5 f 9 m 4 + f 10 m 7 f 11 m 6 + f 12 m 1 + f 13 m 0 + f 14 m 3 f 15 m 2 ) a 14 = p(g 0 φ 14 g 1 φ 15 g 2 φ 12 + g 3 φ 13 + g 4 φ 10 g 5 φ 11 + g 6 φ 8 + g 7 φ 9 g 8 φ 6 g 9 φ 7 g 10 φ 4 + g 11 φ 5 + g 12 φ 2 g 13 φ 3 + g 14 φ 0 + g 15 φ 1 + f 0 m 14 f 1 m 15 f 2 m 12 + f 3 m 13 + f 4 m 10 f 5 m 11 + f 6 m 8 + f 7 m 9 f 8 m 6 f 9 m 7 f 10 m 4 + f 11 m 5 + f 12 m 2 f 13 m 3 + f 14 m 0 + f 15 m 1 ) a 15 = (g 0 φ 15 + g 1 φ 14 g 2 φ 13 g 3 φ 12 + g 4 φ 11 + g 5 φ 10 g 6 φ 9 + g 7 φ 8 g 8 φ 7 + g 9 φ 6 g 10 φ 5 g 11 φ 4 g 12 φ 3 + g 13 φ 2 g 14 φ 1 + g 15 φ 0 + f 0 m 15 + f 1 m 14 f 2 m 13 f 3 m 12 + f 4 m 11 + f 5 m 10 f 6 m 9 + f 7 m 8 f 8 m 7 + f 9 m 6 f 10 m 5 f 11 m 4 f 12 m 3 + f 13 m 2 f 14 m 1 + f 15 m 0 )
1460 Khushboo Thakur and B.P. Tripathi ow, according to the definition of the subsets L f, L g, L φ and L m from Table 1, we obtain P r (f i,j = 1) = d f, P r(f i,j = 1) = d f 1 P r (g i,j = 1) = P r (g i,j = 1) = d g, where P r (φ i,j = 1) = P r (φ i,j = 1) = d φ, P r (m i,j = j) = 1 p d f,, i = 0...15 j = p + 1 2 P r(f i,j = 0) = 2d f P r(g i,j = 0) = 2d g, P r(φ i,j = 0) = 2d φ,... +p 1. 2, f i =[f i,0,f i,1,...,f i, 1 ] i = 0,...15 g i =[g i,0,g i,1,...,g i, 1 ] i = 0,...15 φ i =[φ i,0,φ i,1,...,φ i, 1 ] i = 0,...15 (6.1) Under the above assumptions, we get E[f i,j ] 0, E[g i,j ] = 0, E[r ij ] = 0, and E[m i,j ]=0. Therefore, we have E[a ij ]=0 i = 0...15 j = 0... 1. In order to calculate Var[a i,j ], analogous to TRU, it is sufficient to write Var[φ i,k.g j,l ]= 4d φ.d g 2 i, j = 0, 1,..., 15 k, l = 0,..., 1, Var[f i,k.m j,l ]= d f (p 1).(p + 1) 6. i, j = 0, 1,..., 15 k, l = 0,..., 1. As a result, [ Var[a 0,k ]=Var (p(g 0 φ 0 g 1 φ 1 g 2 φ 2 g 3 φ 3 g 4 φ 4 g 5 φ 5 g 6 φ 6 i+j=k g 7 φ 7 g 8 φ 8 g 9 φ 9 g 10 φ 10 g 11 φ 11 g 12 φ 12 g 13 φ 13 g 14 φ 14 g 15 φ 15 + f 0 m 0 f 1 m 1 f 2 m 2 f 3 m 3 f 4 m 4 f 5 m 5 f 6 m 6 f 7 m 7 f 8 m 8 ] f 9 m 9 f 10 m 10 f 11 m 11 f 12 m 12 f 13 m 13 f 14 m 14 f 15 m 15 )).
STRU: A on Alternative and Multidimensional Public Key Cryptosystem 1461 Upon insertion of Var[φ i,k.g j,l ] and Var[f i,k.m j,l ] values, we obtain ( ) ( ) Var[a 0,k ]=256p 2 4df d g df (p 1)(p + 1) 2 + 256 6 ( 256 4p 2 ) d f d g = + 128d f (p 1)(p + 1) 3 Similarly, we have = 1024p2 d f d g Var[a 1,k ]=Var[a 2,k ]... + 128d f (p 1)(p + 1). 3 = Var[a 15,k ] 1024p2 d f d g + 128d f (p 1)(p + 1). 3 [ q + 1 It is desirable to calculate the probability that a i,k lies within... +q 1 ], 2 2 which implies successful decryption. With the assumption that a i,k have normal distribution with zero mean and the variance calculated as above, we have ( P r = a i,k q 1 ) 2 ( = P r = q 1 a i,k q 1 ) 2 2 ( ) q 1 = 2φ 1, i = 0,..., 15, k = 0... 1 2σ where φ denotes the distribution of the standard normal variable and 1024p 2 d f d g σ = + 128d f (p 1)(p + 1). 3 Assuming that a i,k s are independent random variables, the probability for successful decryption in STRU can be calculated through the following two observations: The probability for each of the messages m 0, m 1, m 2,...,m 16 to be correctly decrypted is ( ( ) q 1 2φ 1), (6.2) 2σ The probability for all the messages m 0, m 1, m 2,...,m 16 to be correctly decrypted is ( ( ) q 1 16 2φ 1), (6.3) 2σ
1462 Khushboo Thakur and B.P. Tripathi Brute Force Attack: In STRU, an attacker knows the constant and public parameters,namely dφ, d g, d f, q, p and, as well as, the public key H = F q G=h 0 + h 1 + +h 15. If the attacker finds one of the sedenions G L g or F L f, the private key can be easily computed. In order to find G or F using a brute force attack, the attacker can try all possible values and check to see if F H (G H 1 ) turns into a sedenion with small coefficients or not. The total state space for the two subsets L f and L g is calculated as follows L f = ( d f + 1 ) 16 ( df 1 d f ( ) 16 L g = ( df + 1 d f d g ) 16 = ( ) 16 =! (d f + 1)!d f!( 2d f 1)! 16 (d g )! 32 ( 2d g )! 16 Since d g is generally considered to be smaller than d f, L g is smaller than L f and by trying all possible values of G L g in G H 1, the attacker can find the private key through searching a space of order L g. Using a Meet-In-The-Middle attack approach, the order of the search space can be reduced through searching a space of order! 4 L g = (d g )! 16 [2].Similarly, in order to find the original 4 ( 2d g )! message from the corresponding ciphertext, the attacker must search in L φ. On average, the search must be done in a space of order! 4 L φ = (d φ )! 16 ( 2d φ )! 4. However, with the typical values for d φ, d g and, finding the private key or plaintext using brute force attack is computationally infeasible. ) 16 Message Expansion: Analogous to tru, the length of the encrypted message in STRU is more than the original message and that is part of the price one has to pay for gaining more encryption speed in both cryptosystems. The expansion ratio can be easily calculated as log C =logq16 =logq, where C and P are ciphertext space and plaintext log P 16 logp logp space, respectively. For both tru and STRU, it seems that this ratio depends merely on p and q, however, we have to choose q in such a way that the probability of decryption failure be very small (e.g., smaller than 2 80 ). Thus, the maximum expansion ratio in STRU is at most about 17. Advantages of STRU: The advantages of using the non-associative algebra in the proposed public key cryptosystem can be summarized as follows: The encryption process in STRU compared with tru (with an equal dimension) is almost sixteen times slower than tru and its decryption process runs almost 32 times slower. On the other hand, considering that the complexity of the convolution multiplication is O( 2 ), the reduction of with the power of two affects the speed
STRU: A on Alternative and Multidimensional Public Key Cryptosystem 1463 of the calculations. Therefore, the tru cryptosystem with a dimension of 16. is almost 256 times slower than tru with a dimension of and is also naturally much slower than the STRU. Hence, we claim that with the reduction of within a reasonable range, one can compensate for the decrease of the speed of STRU in such a way that a higher security is achieved. One can also compensate for the fact that the length of the parameter q in the STRU is larger and also that it is not prime, with an insignificant cost. The STRU lattice is not completely convolutional and the open problems and doubts which exist with respect to the cyclic structure of the tru lattice are not there in the case. The open problem is whether the cyclic structure of the convolutional lattices can possibly contribute to the improvement of lattice reduction algorithms and finding the shortest vector in polynomial time. The STRU is an operational instance of a public key cryptosystem with a nonassociative algebra which relies for its security on the intractability of finding shortest vector problem in a lattice. On the other hand, its core (or in other words, basic operations in the underlying algebraic structure) is fast, efficient and cost effective, just like the tru public key cryptosystem. 7. Conclusion In this paper, we have introduced sedenion algebra, analogue of TRU, which is called STRU. It is non-associative, non-alternative, non division algebra and non-composition algebra. The sedenion algebra do not have any matrix isomorphic representation because it is a non-associative and this feature causes for its cryptanalysis with the help of the system of linear equations, also if the sedenion algebra is represented in the form of lattice then the dimension of the lattice increases to 32. To achieve such a level of security in the tru,the parameter shall be considered sixteen times larger, something that will cause the decrease of the speed of the cryptosystem at a rate of about 256. Therefore, even though STRU, with a dimension () equal to tru, is slower than tru, this decrease of speed can be compensated by the reduction of Instead. The increase of parameter q in STRU will lead to the increase of the message expansion ratio and the reduction of the speed of the modular operations. The complexity of encryption and decryption is the same in both the cryptosystem (STRU, TRU) for the same parameter. References [1] D. V. Bailey, D. Coffin, A. Elbirt, J. H. Silverman, and A. D. Woodbury, TRU in constrained devices. In CHES 01: Proceedings of the Third International Workshop on Cryptographic Hardware and Embedded Systems. London, UK: Springer- Verlag, 2001, pp. 262 272.
1464 Khushboo Thakur and B.P. Tripathi [2]. H. Graham, J. H. Silverman, and W. Whyte. A meet-in-the-middle attack on an TRU private key. 2002. [3] J. Hffstein, J. Pipher, and J. H. Silverman, TRU: A ring-based public key cryptosystem. In Lecture otes in Computer Science Springer-Verlag, 1998, pp. 267 288. [4] D. Micciancio and S. Goldwasser, Complexity of Lattice Problems. A cryptographic perspective, volume 671 of The Kluwer International Series in Engineering and Computer Science. Kluwer Academic Publishers, Boston, Massachusetts, 2002. [5] D. Micciancio. The hardness of the closest vector problem with preprocessing. IEEE Transactions on Information Theory, 2001, pp. 1212 1215. [6] J. Hoffstein and J. Silverman, Optimizations for ntru. In In Public Key Cryptography and Computational umber Theory, 2000, pp. 11 15. [7] D. Micciancio. The shortest vector problem is P-hard to approximate to within some constant. SIAM Journal on Computing, 2001, pp. 2008 2035. [8] A. May and J. H. Silverman. Dimension reduction methods for convolution modular lattices. In CaLC 01: Revised Papers from the Internationa Conference on Cryptography and Lattices, London, UK: Springer-Verlag, 2001, pp. 110 125. [9] H.Graham, J. Hoffstein, J. Pipher, W. Whyte, and tru Cryptosystems, On estimating the lattice security of TRU, 2005. [10] R.D. Schafer, An Introduction to onassociative Algebras, Academic Press, ew York, 1966. [11] L.E. Dickson, J. de Math. Pures et Appliq. 2 (1923) 281. [12] M. Ajtai. The shortest vector problem in l2 is np-hard for randomized reductions. In STOC 98: Proceedings of the thirtieth annual ACM symposium on Theory of computing, ew York, Y: USA, 1998, pp. 10 19. [13] R.E. Cawagas, On the structure and zero divisors of the cayley-dickson sedenion algebra. Discussiones Mathematicae General Algebra and Applications, 2004, pp. 251 265. [14] A. J. Menezes, P. C. van Oorschot, and S. A. Vanstone, Handbook of applied cryptography. Boca Raton, Florida: CRC Press, 1996. [15] Hoffstein J., Pipher J. and Silverman J.H., TRU : A Ring Based Public Key Cryptosystem, Lecture notes in Computer Science, Springer-Verlag, Berlin 1433, pp. 267 288, 1998. [16] J. Pipher and tru Cryptosystems. Lectures on the TRU encryption algorithm and digital signature scheme, 2005. [17] R. Kouzmenko. Generalizations of the TRU cryptosystem. Master s thesis, Polytechnique, Montreal, Canada, 2006. [18] K. Imaeda and M. Imaeda, Sedenions: algebra and analysis.appl. Math. Comput. 115 (2000), pp. 77 88.