Mathematical Problems in Multivariate Public Key Cryptography - PowerPoint PPT Presentation

Mathematical Problems in Multivariate Public Key Cryptography Timothy Hodges University of Cincinnati January 15, 2015 Timothy Hodges (University of Cincinnati) Mathematical Problems in MPKC January 15, 2015 1 / 28

Overview Multivariate Public Key Cryptosystems 1 Solving Systems of Polynomial Equations 2 First Fall Degree and HFE-systems 3 Semi-regular systems 4 Timothy Hodges (University of Cincinnati) Mathematical Problems in MPKC January 15, 2015 2 / 28

Outline Multivariate Public Key Cryptosystems 1 Solving Systems of Polynomial Equations 2 First Fall Degree and HFE-systems 3 Semi-regular systems 4 Timothy Hodges (University of Cincinnati) Mathematical Problems in MPKC January 15, 2015 3 / 28

Multivariate Public Key Cryptosystems F a finite field with | F | = q { p 1 ,..., p n } F n → F m − − − − − − p i ( x 1 , . . . , x n ) ∈ F [ x 1 , . . . , x n ] / � x q 1 − x 1 , . . . , x q n − x n � = Fun( F n , F ) Solving p 1 ( x 1 , . . . , x n ) = y 1 . . . . . . p m ( x 1 , . . . , x n ) = y m is a hard problem. Problem Design a trapdoor that retains this level of security. Timothy Hodges (University of Cincinnati) Mathematical Problems in MPKC January 15, 2015 4 / 28

Multivariate Public Key Cryptosystems F a finite field with | F | = q { p 1 ,..., p n } F n → F m − − − − − − p i ( x 1 , . . . , x n ) ∈ F [ x 1 , . . . , x n ] / � x q 1 − x 1 , . . . , x q n − x n � = Fun( F n , F ) Solving p 1 ( x 1 , . . . , x n ) = y 1 . . . . . . p m ( x 1 , . . . , x n ) = y m is a hard problem. Problem Design a trapdoor that retains this level of security. Timothy Hodges (University of Cincinnati) Mathematical Problems in MPKC January 15, 2015 4 / 28

Multivariate Public Key Cryptosystems F a finite field with | F | = q { p 1 ,..., p n } F n → F m − − − − − − p i ( x 1 , . . . , x n ) ∈ F [ x 1 , . . . , x n ] / � x q 1 − x 1 , . . . , x q n − x n � = Fun( F n , F ) Solving p 1 ( x 1 , . . . , x n ) = y 1 . . . . . . p m ( x 1 , . . . , x n ) = y m is a hard problem. Problem Design a trapdoor that retains this level of security. Timothy Hodges (University of Cincinnati) Mathematical Problems in MPKC January 15, 2015 4 / 28

Multivariate Public Key Cryptosystems F a finite field with | F | = q { p 1 ,..., p n } F n → F m − − − − − − p i ( x 1 , . . . , x n ) ∈ F [ x 1 , . . . , x n ] / � x q 1 − x 1 , . . . , x q n − x n � = Fun( F n , F ) Solving p 1 ( x 1 , . . . , x n ) = y 1 . . . . . . p m ( x 1 , . . . , x n ) = y m is a hard problem. Problem Design a trapdoor that retains this level of security. Timothy Hodges (University of Cincinnati) Mathematical Problems in MPKC January 15, 2015 4 / 28

Multivariate Public Key Cryptosystems F a finite field with | F | = q { p 1 ,..., p n } F n → F m − − − − − − p i ( x 1 , . . . , x n ) ∈ F [ x 1 , . . . , x n ] / � x q 1 − x 1 , . . . , x q n − x n � = Fun( F n , F ) Solving p 1 ( x 1 , . . . , x n ) = y 1 . . . . . . p m ( x 1 , . . . , x n ) = y m is a hard problem. Problem Design a trapdoor that retains this level of security. Timothy Hodges (University of Cincinnati) Mathematical Problems in MPKC January 15, 2015 4 / 28

Hidden Field Systems: Matsumoto-Imai Identify (secretly) F n with an extension field K , where dim F K = n . So | K | = q n The map P : K → K , P ( X ) = X θ is invertible with inverse P − 1 ( X ) = X s if gcd( θ, q n − 1) = 1, For all 0 � = α ∈ K , α q n − 1 = 1 by Lagrange’s Theorem. Since gcd( θ, q n − 1) = 1, then there exist s , t ∈ Z such that θ s + ( q n − 1) t = 1 so ( α θ ) s = α − ( q n − 1) t +1 = α − ( q n − 1) t α = α Take q = 2 t and θ = 1 + q s , P ( X ) = X . X q s is quadratic P − − − − − → K K Private Key x ? σ ? τ ? ? y { p 1 ,..., p n } F n → F n − − − − − − Public Key σ, τ invertible affine linear maps Timothy Hodges (University of Cincinnati) Mathematical Problems in MPKC January 15, 2015 5 / 28

Hidden Field Systems: Matsumoto-Imai Identify (secretly) F n with an extension field K , where dim F K = n . So | K | = q n The map P : K → K , P ( X ) = X θ is invertible with inverse P − 1 ( X ) = X s if gcd( θ, q n − 1) = 1, For all 0 � = α ∈ K , α q n − 1 = 1 by Lagrange’s Theorem. Since gcd( θ, q n − 1) = 1, then there exist s , t ∈ Z such that θ s + ( q n − 1) t = 1 so ( α θ ) s = α − ( q n − 1) t +1 = α − ( q n − 1) t α = α Take q = 2 t and θ = 1 + q s , P ( X ) = X . X q s is quadratic P − − − − − → K K Private Key x ? σ ? τ ? ? y { p 1 ,..., p n } F n → F n − − − − − − Public Key σ, τ invertible affine linear maps Timothy Hodges (University of Cincinnati) Mathematical Problems in MPKC January 15, 2015 5 / 28

Hidden Field Systems: Matsumoto-Imai Identify (secretly) F n with an extension field K , where dim F K = n . So | K | = q n The map P : K → K , P ( X ) = X θ is invertible with inverse P − 1 ( X ) = X s if gcd( θ, q n − 1) = 1, For all 0 � = α ∈ K , α q n − 1 = 1 by Lagrange’s Theorem. Since gcd( θ, q n − 1) = 1, then there exist s , t ∈ Z such that θ s + ( q n − 1) t = 1 so ( α θ ) s = α − ( q n − 1) t +1 = α − ( q n − 1) t α = α Take q = 2 t and θ = 1 + q s , P ( X ) = X . X q s is quadratic P − − − − − → K K Private Key x ? σ ? τ ? ? y { p 1 ,..., p n } F n → F n − − − − − − Public Key σ, τ invertible affine linear maps Timothy Hodges (University of Cincinnati) Mathematical Problems in MPKC January 15, 2015 5 / 28

Hidden Field Systems: Matsumoto-Imai Identify (secretly) F n with an extension field K , where dim F K = n . So | K | = q n The map P : K → K , P ( X ) = X θ is invertible with inverse P − 1 ( X ) = X s if gcd( θ, q n − 1) = 1, For all 0 � = α ∈ K , α q n − 1 = 1 by Lagrange’s Theorem. Since gcd( θ, q n − 1) = 1, then there exist s , t ∈ Z such that θ s + ( q n − 1) t = 1 so ( α θ ) s = α − ( q n − 1) t +1 = α − ( q n − 1) t α = α Take q = 2 t and θ = 1 + q s , P ( X ) = X . X q s is quadratic P − − − − − → K K Private Key x ? σ ? τ ? ? y { p 1 ,..., p n } F n → F n − − − − − − Public Key σ, τ invertible affine linear maps Timothy Hodges (University of Cincinnati) Mathematical Problems in MPKC January 15, 2015 5 / 28

Hidden Field Systems: Matsumoto-Imai Identify (secretly) F n with an extension field K , where dim F K = n . So | K | = q n The map P : K → K , P ( X ) = X θ is invertible with inverse P − 1 ( X ) = X s if gcd( θ, q n − 1) = 1, For all 0 � = α ∈ K , α q n − 1 = 1 by Lagrange’s Theorem. Since gcd( θ, q n − 1) = 1, then there exist s , t ∈ Z such that θ s + ( q n − 1) t = 1 so ( α θ ) s = α − ( q n − 1) t +1 = α − ( q n − 1) t α = α Take q = 2 t and θ = 1 + q s , P ( X ) = X . X q s is quadratic P − − − − − → K K Private Key x ? σ ? τ ? ? y { p 1 ,..., p n } F n → F n − − − − − − Public Key σ, τ invertible affine linear maps Timothy Hodges (University of Cincinnati) Mathematical Problems in MPKC January 15, 2015 5 / 28

Hidden Field Systems: Matsumoto-Imai Identify (secretly) F n with an extension field K , where dim F K = n . So | K | = q n The map P : K → K , P ( X ) = X θ is invertible with inverse P − 1 ( X ) = X s if gcd( θ, q n − 1) = 1, For all 0 � = α ∈ K , α q n − 1 = 1 by Lagrange’s Theorem. Since gcd( θ, q n − 1) = 1, then there exist s , t ∈ Z such that θ s + ( q n − 1) t = 1 so ( α θ ) s = α − ( q n − 1) t +1 = α − ( q n − 1) t α = α Take q = 2 t and θ = 1 + q s , P ( X ) = X . X q s is quadratic P − − − − − → K K Private Key x ? σ ? τ ? ? y { p 1 ,..., p n } F n → F n − − − − − − Public Key σ, τ invertible affine linear maps Timothy Hodges (University of Cincinnati) Mathematical Problems in MPKC January 15, 2015 5 / 28

Patarin’s HFE System P ( X ) is P ( X ) K − − − − − → K x ? of low total degree, D (efficient σ ? τ ? ? y decryption). { p 1 ,..., p n } F n → F n − − − − − − quadratic over F so that p i ( x 1 , . . . , x n ) are quadratic (efficient encryption) a ij X q i + q j + b i X q i + c X X P ( X ) = q i + q j ≤ D q i ≤ D where a ij , b i , c ∈ K . Timothy Hodges (University of Cincinnati) Mathematical Problems in MPKC January 15, 2015 6 / 28

Patarin’s HFE System P ( X ) is P ( X ) K − − − − − → K x ? of low total degree, D (efficient σ ? τ ? ? y decryption). { p 1 ,..., p n } F n → F n − − − − − − quadratic over F so that p i ( x 1 , . . . , x n ) are quadratic (efficient encryption) a ij X q i + q j + b i X q i + c X X P ( X ) = q i + q j ≤ D q i ≤ D where a ij , b i , c ∈ K . Timothy Hodges (University of Cincinnati) Mathematical Problems in MPKC January 15, 2015 6 / 28