଱ྔࢠ‫߸҉ػࢉܭ‬ͷ‫ڀݚ‬ಈ޲ௐࠪใࠂॻ

CRYPTREC ҉߸ٕज़ௐࠪ WG (҉߸ղੳධՁ)2019 ೥ 3 ݄

໨࣍
ୈ1ষ

͸͡Ίʹ

1

1.1

଱ྔࢠ‫( ߸҉ػࢉܭ‬PQC) ͷඞཁੑʹ͍ͭͯ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2

1.2

PQC ͷ‫ͼٴڀݚ‬ඪ४Խ౳ʹؔ͢Δಈ޲ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3

1.3

ຊใࠂॻͰѻ͏࢛ͭͷ PQC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

4

1.4

2017 ʙ 2018 ೥౓ ҉߸ٕज़ௐࠪ WG (҉߸ղੳධՁ) ͷҕһߏ੒ . . . . . . . . . . . . . . . . . . . .

5

1.5

֤ষͷࣥචऀͱ಺༰ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5

ୈ 1 ষͷࢀߟจ‫ݙ‬6

ୈ2ষ֨ࢠʹ‫ٕ߸҉ͮ͘ج‬ज़8֨ࢠʹ‫ٕ߸҉ͮ͘ج‬ज़ͷ҆શੑͷࠜ‫ͳͱڌ‬Δ໰୊ . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

8

LWE ໰୊ͱ୅දతͳ‫ٻ‬ղ๏ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

8

2.1.1.1

LWE ໰୊ͷ঺հ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

8

2.1.1.2֨ࢠͷ‫ج‬ຊࣄ߲ͱ q-ary ֨ࢠͷ঺հ

2.1.1.3

LWE ໰୊ͷ୅දతͳ‫ٻ‬ղ๏ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

2.1

2.1.1

2.2

2.3

2.4

. . . . . . . . . . . . . . . . . . . . . . . . . . 10

2.1.2

NTRU ໰୊ͱ୅දతͳ‫ٻ‬ղ๏ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2.1.3

֨ࢠ໰୊Λղ͘ΞϧΰϦζϜͱͦͷ‫͍ͯͭʹྔࢉܭ‬. . . . . . . . . . . . . . . . . . . . . . . 12

2.1.3.1

୅දతͳ֨ࢠ‫ج‬ఈ؆໿ΞϧΰϦζϜͷ঺հ . . . . . . . . . . . . . . . . . . . . . . . 12

2.1.3.2

BKZ ‫ج‬ఈ؆໿ΞϧΰϦζϜͷग़ྗ‫ج‬ఈͱ‫ ྔࢉܭ‬. . . . . . . . . . . . . . . . . . . . 12

୅දతͳ֨ࢠʹ‫ࣜํ߸҉ͮ͘ج‬ͷઆ໌ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2.2.1

LWE ʹ‫߸҉ͮ͘ج‬Խ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2.2.2

Ring-LWE ʹ‫߸҉ͮ͘ج‬Խ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

2.2.3

NTRU ໰୊ʹ‫߸҉ͮ͘ج‬Խ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

۩ମతͳ҉߸ํࣜ

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

2.3.1

LOTUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

2.3.2

NewHope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

2.3.3

Lizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

2.3.4

CRYSTALS-Dilithium . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

2.3.5

pqNTRUSign . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21·ͱΊ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

ୈ 2 ষͷࢀߟจ‫ݙ‬

25

i

ୈ3ষ

3.1

3.2

3.3

ූ߸ʹ‫ٕ߸҉ͮ͘ج‬ज़ූ߸ʹ‫ٕ߸҉ͮ͘ج‬ज़ͷ҆શੑͷࠜ‫ͳͱڌ‬Δ໰୊ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

3.1.1

LPN ໰୊ͱ͸ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

3.1.2

LPN ໰୊ͷ֦ு . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
3.1.2.1

෮߸໰୊ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

3.1.2.2

γϯυϩʔϜ෮߸໰୊ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

3.1.2.3

Exact-LPN ໰୊ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

3.1.2.4

Sparse-LPN ໰୊ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

3.1.2.5

Toeplitz-LPN ໰୊ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

3.1.2.6

Ring-LPN ໰୊ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

3.1.3

LPN ໰୊ʹର͢ΔධՁ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

3.1.4

BKW ΞϧΰϦζϜ͓Αͼͦͷվྑ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

3.1.5

Arora-Ge ΞϧΰϦζϜ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

3.1.6

SD ໰୊Λ‫ܦ‬༝͢ΔΞϧΰϦζϜ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

3.1.7

ྔࢠΞϧΰϦζϜ΁ͷ଱ੑ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

୅දతͳූ߸ʹ‫ࣜํ߸҉ͮ͘ج‬ͷઆ໌ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

3.2.1

҉߸ํࣜ 1: McEliece ҉߸ͱͦͷมछ

3.2.2

҉߸ํࣜ 2: Niederreiter ҉߸ͱͦͷมछ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

3.2.3

҉߸ํࣜ 3: Alekhnovich ҉߸ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

3.2.4

҉߸ํࣜ 3: Lyubashevsky-Peikert-Regev ෩҉߸ . . . . . . . . . . . . . . . . . . . . . . . . 38

3.2.5

ॺ໊ํࣜ 1: CFS ॺ໊ͱͦͷมछ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

۩ମతͳ҉߸ํࣜ

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

3.3.1

҉߸ํࣜ 1: Classic McEliece . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

3.3.2

҉߸ํࣜ 2: DAGS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

3.3.2.1߈ܸʹ͍ͭͯ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

3.3.3

҉߸ํࣜ 3: RQC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

3.3.4

ॺ໊ํࣜ 1: RankSign . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

3.3.4.1
3.4

29

߈ܸʹ͍ͭͯ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44·ͱΊ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

ୈ 3 ষͷࢀߟจ‫ݙ‬

46

ୈ4ষ

51

4.1

4.2

ଟม਺ଟ߲ࣜʹ‫ٕ߸҉ͮ͘ج‬ज़ଟม਺ଟ߲ࣜʹ‫ٕ߸҉ͮ͘ج‬ज़ͷ҆શੑͷࠜ‫ͳͱڌ‬Δ໰୊ . . . . . . . . . . . . . . . . . . . . . . . . 51

4.1.1

ଟม਺ެ։‫ ͍ͯͭʹ߸҉ݤ‬. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

4.1.2

ଟม਺ެ։‫߸҉ݤ‬ͷ҆શੑͷࠜ‫ͳͱڌ‬Δ໰୊ͱͦͷղಡ‫ྔࢉܭ‬. . . . . . . . . . . . . . . . . 52

୅දతͳଟม਺ଟ߲ࣜʹ‫ࣜํ߸҉ͮ͘ج‬ͷઆ໌ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

4.2.1

૒‫ܕۃ‬γεςϜ

4.2.2

Simple field ๏ͱ big field ๏ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
4.2.2.1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

ॺ໊ํࣜ UOV . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

iiॺ໊ํࣜ HFE−v . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

4.2.2.2
4.3

۩ମతͳ҉߸ํࣜ

4.3.1

4.3.2

4.3.3

4.4

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Rainbow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
4.3.1.1

Rainbow ͷ֓ཁ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

4.3.1.2

Rainbow ͷύϥϝʔλબ୒ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

Gui . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
4.3.2.1

Gui ͷ֓ཁ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

4.3.2.2

Gui ͷύϥϝʔλબ୒ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

MQDSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
4.3.3.1

MQDSS ͷ֓ཁ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

4.3.3.2

MQDSS ͷύϥϝʔλબ୒ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63·ͱΊ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

ୈ 4 ষͷࢀߟจ‫ݙ‬

65

ୈ5ষ

68

5.1

5.2

5.3

5.4

ಉछࣸ૾ʹ‫ٕ߸҉ͮ͘ج‬ज़ಉछࣸ૾ʹ‫ٕ߸҉ͮ͘ج‬ज़ͷ҆શੑͷࠜ‫ͳͱڌ‬Δ໰୊

. . . . . . . . . . . . . . . . . . . . . . . . . . 68

5.1.1

ಉछࣸ૾໰୊ͷҰൠ‫ ܗ‬. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

5.1.2

SIDH ‫ڞݤ‬༗ͷ҆શੑͷࠜ‫ͳͱڌ‬Δ໰୊

5.1.3

CSIDH ‫ڞݤ‬༗ͷ҆શੑͷࠜ‫ͳͱڌ‬Δ໰୊ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

5.1.4

3 ͭͷ‫ج‬ຊಉछࣸ૾໰୊ͷ઴ۙతղಡ࣌ؒൺֱ . . . . . . . . . . . . . . . . . . . . . . . . . . 73

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

୅දతͳಉछࣸ૾ʹ‫ࣜํ߸҉ͮ͘ج‬ͷઆ໌ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

5.2.1

SIDH ‫ڞݤ‬༗ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

5.2.2

CSIDH ‫ڞݤ‬༗ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

۩ମతͳ҉߸ํࣜ

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

5.3.1

SIKEɿSIDH ϕʔεެ։‫ݤͱ߸҉ݤ‬ΧϓηϧԽํࣜ . . . . . . . . . . . . . . . . . . . . . . . 76

5.3.2

ಉछࣸ૾ʹ‫ͮ͘ج‬ೝূ෇͖‫ڞݤ‬༗ɾάϧʔϓ‫ڞݤ‬༗

5.3.3

ಉछࣸ૾ʹ‫ ࣜํ໊ॺͮ͘ج‬. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

. . . . . . . . . . . . . . . . . . . . . . . 78·ͱΊ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

ୈ 5 ষͷࢀߟจ‫ݙ‬

81

iii

ୈ1ষ

͸͡Ίʹ
҉߸ٕज़͸ΠϯλʔωοτΛ͸͡Ί, ‫ݱ‬୅ͷ৘ใ௨৴γεςϜͷηΩϡϦςΟΛࢧ͑Δ‫ج‬൫ٕज़Ͱ͋Γ, ωοτγϣο
ϐϯά΍ΠϯλʔωοτόϯΩϯά, ަ௨‫ ܥ‬IC Χʔυ, ແઢ LAN ͳͲͰ೔ৗతʹར༻͞Ε͍ͯΔ. ‫͞༻࢖͘޿ࡏݱ‬Ε
͍ͯΔެ։‫ ͯ͠ͱࣜํ߸҉ݤ‬RSA ҉߸ͱପԁ‫ۂ‬ઢ҉߸͕‫͛ڍ‬ΒΕΔ. RSA ҉߸ͷ҆શੑ͸੔਺ΛૉҼ਺෼ղ͢Δ‫ܭ‬ࢉͷࠔ೉ੑΛࠜ‫͓ͯ͠ͱڌ‬Γ, ପԁ‫ۂ‬ઢ҉߸ʹ͍ͭͯ͸཭ࢄର਺໰୊Λղ͘‫ࢉܭ‬ͷࠔ೉ੑ͕ར༻͞Ε͍ͯΔ. ྔࢠ‫ࢉܭ‬‫ػ‬ͷ։ൃ͕े෼ʹਐΉͱ Shor ͷΞϧΰϦζϜ [14, 15] ʹΑΓ੔਺ͷૉҼ਺෼ղ΍཭ࢄର਺Λߴ଎ʹ‫͖Ͱࢉܭ‬ΔͨΊ,ͦΕΒͷ҉߸ํࣜͷ҆શੑ͕େ͖͘௿Լ͢Δ. ͦͷͨΊ, ྔࢠ‫ʹػࢉܭ‬ରͯ͠΋, ·ͨ‫͞༻࢖ࡏݱ‬Ε͍ͯΔ‫ʹػࢉܭ‬ରͯ͠΋, ҆શੑΛ֬อͰ͖Δ҉߸ํ͕ࣜඞཁͱ͞Ε͓ͯΓ, ͦͷΑ͏ͳ҉߸ํࣜ͸଱ྔࢠ‫( ߸҉ػࢉܭ‬Post-Quantum

Cryptography: PQC) ͱΑ͹Ε͍ͯΔ.
ۙ೥, ྔࢠ‫ػࢉܭ‬ͷ։ൃ͕ੈքతʹਐΊΒΕ͍ͯΔ. ͦΕʹͱ΋ͳͬͯ, PQC ʹؔ͢Δ‫ͦͼٴڀݚ‬ͷඪ४Խʹ޲͚ͨ‫׆‬ಈ΋ੈք֤ࠃͷ૊৫Ͱ࣮ࢪ͞Ε͓ͯΓ, ࠃ಺Ͱ΋ PQC ͷ‫ڀݚ‬ಈ޲Λ೺Ѳ͢Δඞཁੑ͕ߴ·͍ͬͯΔ. 2017 ೥౓ͷ҉߸ٕज़‫ݕ‬౼ձʹ͓͍ͯ, ҉߸ٕज़ධՁҕһձͷ‫׆‬ಈ‫ܭ‬ըͱͯ͠ 2 ೥Λ͔͚ͯ PQC ͷ‫ڀݚ‬ಈ޲Λௐࠪ͢Δ͜ͱ͕ܾఆ͞
Εͨ. ҉߸ٕज़ධՁҕһձ͸҉߸ٕज़ௐࠪϫʔΩϯάάϧʔϓ (҉߸ղੳධՁ) Λઃஔ͠, 2017 ೥౓‫ ͼٴ‬2018 ೥౓ʹ͓͍ͯຊௐࠪΛ࣮ࢪͨ͠ (ਤ 1.1).

ਤ 1.1

CRYPTREC ͷମ੍ਤ (https://www.cryptrec.go.jp/system.html)

1ຊௐࠪͰ͸ PQC ͷ୅දతͳީิͰ͋Δ࢛ͭͷ෼ྨ (֨ࢠʹ‫ٕ߸҉ͮ͘ج‬ज़, ූ߸ʹ‫ٕ߸҉ͮ͘ج‬ज़, ଟม਺ଟ߲ࣜʹ‫ٕ߸҉ͮ͘ج‬ज़, ಉछࣸ૾ʹ‫ٕ߸҉ͮ͘ج‬ज़) ʹ͍ͭͯௐࠪ͠, ओʹ 2018 ೥ 10 ݄ 12 ೔·Ͱͷௐࠪ݁ՌΛຊใࠂॻʹ·ͱΊͨ. ·ͨ, ຊใࠂॻͷ 1 ষ͸ҰൠతͳಡऀʹΉ͚ͨ಺༰ͱͯ͠·ͱΊ, ͦΕҎ֎ͷষʹ͍ͭͯ͸҉߸ٕज़ʹ‫ܞ‬ΘΔ‫ٕͼٴऀڀݚ‬ज़ऀΛಡऀͱͯ͠૝ఆͨ͠಺༰ͱͨ͠. ϋογϡؔ਺ʹ‫໊ٕॺͮ͘ج‬ज़΋ PQC ͷओཁͳީิͷҰͭͰ͋Γ, ͦΕʹ͍ͭͯ͸ [1, 9] Λࢀর͞Ε͍ͨ.

1.1 ଱ྔࢠ‫( ߸҉ػࢉܭ‬PQC) ͷඞཁੑʹ͍ͭͯྔࢠ‫ʹػࢉܭ‬͸, ྔࢠήʔτ‫ܕ‬ͷྔࢠ‫ࢠྔͱػࢉܭ‬ΞχʔϦϯά‫ࢉܭ‬ઐ༻ͷ΋ͷ౳͕͋Γ, Shor ͷΞϧΰϦζϜ͕௚઀ద༻Ͱ͖Δͷ͸ྔࢠήʔτ‫ܕ‬ͷྔࢠ‫͋Ͱػࢉܭ‬Δ. ྔࢠήʔτ‫ܕ‬ͷ৔߹ͷϓϩηοαʹؔ͢Δۙ೥ͷ։ൃʹ͍ͭͯ͸,2017 ೥ 11 ݄ʹ IBM ͕ 50 ྔࢠϏοτͷϓϩηοαΛ [17], 2018 ೥ 5 ݄ʹ Google ͕ 72 ྔࢠϏοτͷϓϩηοα
Λ։ൃͨ͠ͱൃද͓ͯ͠Γ [11], ྔࢠήʔτ‫ܕ‬ͷྔࢠ‫ػࢉܭ‬ͷ։ൃ͕ਐΜͰ͍Δ͜ͱΛࣔ͢ใࠂ͕͍͔ͭ͋͘Δ. ·ͨ,

NIST ͷ Interim Report 8105 ʹ͓͍ͯ, 2000 bit ͷ߹੒਺Λར༻͢Δ RSA ҉߸ΛղಡՄೳͳྔࢠ‫ ͕ػࢉܭ‬2030 ೥·Ͱʹ࣮‫͞ݱ‬ΕΔՄೳੑ͕͋Δͱ, ྔࢠ‫ػࢉܭ‬ͷ‫ऀڀݚ‬Β͕‫ੵݟ‬΋͍ͬͯΔͱͷ‫ه‬ड़͕͋Δ [3].
͔͠͠, จ‫[ ݙ‬10, 12, 16] Ͱड़΂ΒΕ͍ͯΔΑ͏ʹ, ྔࢠ‫ ͱػࢉܭ‬Shor ͷΞϧΰϦζϜΛར༻ͨ͠਺஋࣮‫͍͓ʹݧ‬ͯ, େ͖ͳ੔਺ͷૉҼ਺෼ղ͸·ͩ੒ޭ͍ͯ͠ͳ͍ (ද 1.1). ྫ͑͹, ྔࢠ‫ ͱػࢉܭ‬Shor ͷΞϧΰϦζϜΛ࢖༻ͯ͠ૉҼ਺෼ղͰ͖ͨ‫Ͱ఺࣌ݱ‬ͷ࠷େͷ߹੒਺͸ 21 ͱ͞Ε͓ͯΓ, 2012 ೥ͷ Martı́n-López ΒʹΑΔ੒Ռ͕‫͛ڍ‬ΒΕΔ[13]. ͞Βʹ, Լ‫ه‬ͷཧ༝ʹΑΓ, ͜ͷ਺஋࣮‫͚͓ʹݧ‬Δ࣮૷͸ Shor ͷΞϧΰϦζϜͷ࣮૷ͱͯ͠ෆద౰Ͱ͋Δ. ShorͷΞϧΰϦζϜͷಛ௃͸৒༨ྨ‫؀‬ͷ‫ݩ‬ͷ৐๏Ґ਺Λޮ཰Α͘‫͖Ͱࢉܭ‬Δ͜ͱͰ͋Γ, ͜ͷੑ࣭͕੔਺ͷૉҼ਺෼ղ΍཭ࢄର਺໰୊Λղ͘‫ʹࢉܭ‬ར༻͞ΕΔ. ͔͠͠, ͜ͷ਺஋࣮‫Ͱݧ‬͸͜ͷҐ਺ͷ‫ࢉܭ‬ΛߦΘͣ, ճ࿏ઃ‫ܭ‬ͷஈ֊Ͱ 21 Λ๏ͱͨ͠ͱ͖ͷ 4 ͷ৐๏Ґ਺͕ 3 Ͱ͋Δ͜ͱ͕ར༻͞Ε͍ͯΔ. Ґ਺͕ະ஌ͷ৔߹ͷ੒Ռͱͯ͠, 2001 ೥ʹ Vandersypen
ΒʹΑΔ 15 ͷૉҼ਺෼ղͷ੒Ռ [18] ͕‫͛ڍ‬ΒΕΔ͕, ͜ͷ࣮‫Ͱݧ‬΋, λʔήοτͱͳΔ߹੒਺ͷಛ௃Λճ࿏ઃ‫ܭ‬ͷஈ֊Ͱա৒ʹ૊Έࠐ·Ε͓ͯΓ, ൚༻తͳճ࿏ߏ੒ͱͳ͍ͬͯͳ͍. ैͬͯ, ‫Ͱ఺࣌ݱ‬͸ Shor ͷΞϧΰϦζϜΛ൚༻తͳճ࿏ߏ੒ʹΑΓྔࢠ‫ͯ͠૷࣮Ͱ্ػࢉܭ‬, ૉҼ਺෼ղʹ੒ޭͨ͠੒Ռ͸஌ΒΕ͍ͯͳ͍.

෼ղ๏

Shor

‫ࢉܭ‬खஈ

߹੒਺

Ϗοτ௕

ൃද೥

δϟʔφϧ໊

උߟ

NMR

15

4

2001 ೥Nature# QB=7ޫࢠ

21

52012 ೥Nature Photonics# QB=1+log 3

ޫूੵճ࿏

15

4

2009 ೥

Science# QB=5δϣηϑιϯૉࢠ15

42012 ೥Nature Physics# QB=3ΠΦϯτϥοϓ

15

42016 ೥

Science# QB=5ɾຊ෼ղ๏͸෼ղର৅ͷૉҼ਺෼ղͷ݁ՌΛ༻͍ɼShor ͷΞϧΰϦζϜͷԋࢉͷҰ෦Λলུ͍ͯ͠Δɽ
ɾ# QB ͸࢖༻ͨ͠ྔࢠϏοτ਺.
ɾ2 ߦ໨ͷ # QB ͷ஋͸ 2 ਐ਺ද‫ ͱݱ‬3 ਐ਺ද‫͔ݱ‬Βࢉग़͞Ε͍ͯΔɽ

ද 1.1ྔࢠήʔτ‫ʹػࢉܭܕ‬ΑΔૉҼ਺෼ղͷ‫ه‬࿥ ([10] ͷද 1 ΛҰ෦վม )ҰํͰ, ྔࢠΞχʔϦϯά‫ࢉܭ‬ઐ༻ͷྔࢠ‫͍ͯͭʹػࢉܭ‬͸, 2017 ೥ 1 ݄ʹΧφμͷ D-Wave ͔ࣾΒ 2048 ྔࢠϏοτͷϓϩηοαΛ։ൃͨ͠ͱͷൃද͕͋Γ, ൃച͞Εͨ [5, 6]. ྔࢠΞχʔϦϯά‫ࢉܭ‬ઐ༻ͷྔࢠ‫ ͍͓ͯʹػࢉܭ‬ShorΞϧΰϦζϜΛޮ཰Α͘ద༻͢Δํ๏͸ൃ‫͞ݟ‬Ε͓ͯΒͣ, ೋ࣍ଟม਺ଟ߲ࣜΛར༻ͨ͠ΞϧΰϦζϜ͕࢖༻͞Ε͍ͯ

2

Δ. ‫Ͱ఺࣌ݱ‬, ͜ͷ‫ࢉܭ‬ख๏ʹΑͬͯૉҼ਺෼ղ͞Εͨ࠷େͷ߹੒਺͸ 200099 Ͱ͋Γ, 2016 ೥ͷ Dridi ͱ Alghassiͷ਺஋࣮‫ʹݧ‬ΑΔ΋ͷͰ͋Δ [7] (ද 1.2).

෼ղ๏‫ࢉܭ‬खஈ

߹੒਺

Ϗοτ௕

ൃද೥

δϟʔφϧ໊

උߟ

ૉ๿๏

NMR

21

5

2008 ೥

Psysical Review Letters# QB=3

NMR

143

8

2012 ೥

Psysical Review Letters# QB=4D-Wave20009918

2016 ೥

Scientific Reports# QB=897

චࢉ๏

ɾ# QB ͸࢖༻ͨ͠ྔࢠϏοτ਺.

ද 1.2ྔࢠΞχʔϦϯά‫ࢉܭ‬ઐ༻ͷྔࢠ‫ʹػࢉܭ‬ΑΔૉҼ਺෼ղͷ‫ه‬࿥ ([10] ͷද 1 ΛҰ෦վม )Ҏ্ͷ͜ͱ͔Β, RSA ҉߸ʹର͢Δྔࢠ‫ػࢉܭ‬Λ࢖༻ͨ͠৔߹ͷ࣮ࡍతͳ‫ڴ‬Җ͕ࠩ͠ഭ͍ͬͯΔͱ͸‫Ͱ఺࣌ݱ‬͸அ‫͍ͳ͖Ͱݴ‬. ͔͠͠, ‫͞༻࢖͘޿ࡏݱ‬Ε͍ͯΔެ։‫߸҉ݤ‬ͷ҆શੑ͸, ੔਺ͷૉҼ਺෼ղ΍཭ࢄର਺ͷ‫ࠔࢉܭ‬೉ੑʹ‫ͮج‬
͍͍ͯΔͨΊ, े෼ͳੑೳΛ࣋ͭྔࢠ‫ػࢉܭ‬ͷ։ൃ͕ਐΜͩ৔߹ͷϦεΫ͸‫ۃ‬Ίͯେ͖͍. ·ͨ, ࢖ΘΕ͍ͯΔ҉߸γεςϜΛߋ৽͢ΔͨΊʹ͸, ͦͷ४උͱͯ͠௕͍೥݄͕ඞཁͰ͋Δ. ैͬͯ, RSA ҉߸΍ପԁ‫ۂ‬ઢ҉߸͔Β PQC ΁ͷҠߦ͕ඞཁͱͳͬͨ৔߹ʹ, ͙͢ʹ PQC Λ࢖༻Ͱ͖ΔΑ͏ʹे෼ͳ࣌ؒΛ͔͚ͯલ΋ͬͯ४උΛ͓ͯ͘͜͠ͱ͕๬·͍͠. Ҏ্ͷཧ༝͔Β, ‫ࡏݱ‬, ੈք֤ࠃʹ͓͍ͯ PQC ʹؔ͢Δ‫ڀݚ‬։ൃ΍ඪ४Խ͕ਐΊΒΕ͍ͯΔ.

1.2 PQC ͷ‫ͼٴڀݚ‬ඪ४Խ౳ʹؔ͢Δಈ޲
PQC ʹؔ͢Δ‫ڀݚ‬੒Ռ͸ Crypto, Eurocrypt, Asiacrypt ౳, ҉߸෼໺ͷࠃࡍձٞͰ௕೥ٞ࿦͞Ε͍ͯΔ. ͞Βʹ
PQC Λઐ໳ʹѻ͏ࠃࡍձٞͱͯ͠ PQCrypto ͕‫͛ڍ‬ΒΕ, ͦͷୈ 1 ճձٞ͸ 2006 ೥ʹ։࠵͞Ε, 2018 ೥·Ͱʹ‫ ܭ‬9ճ։࠵͞Ε͍ͯΔ.

PQC ͷඪ४Խʹؔ͢Δۙ೥ͷಈ޲ʹ͍ͭͯ͸, ·ͣ 2015 ೥ 8 ݄, ΞϝϦΧࠃՈ҆શอো‫( ہ‬NSA) ͕ PQC ΁ͷকདྷతͳҠߦ‫ܭ‬ըΛൃද͍ͯ͠Δ. ·ͨ, ΞϝϦΧࠃཱඪ४ٕज़‫( ॴڀݚ‬NIST) ͸ 2016 ೥͔Β PQC ͷެืΛ։࢝͠, ͦͷక੾Ͱ͋Δ 2017 ೥ 11 ݄ 30 ೔·Ͱʹ 82 ݅ͷ҉߸ํ͕ࣜఏҊ͞Ε, ఏग़ॻྨ͕‫׬‬උͰ͋Δ͜ͱ͕֬ೝ͞Εͨ 69 ͕݅ Round 1 ͷධՁର৅ͱͳͬͨ. ·ͨ, 2019 ೥ 1 ݄ 30 ೔ʹ͸, NIST ͔Β Round 2 ΁ਐΉํࣜͱͯ͠ 26 ͕݅ൃද͞Εͨ. ‫ࡏݱ‬͸, ఏҊ͞ΕͨͦΕΒͷ҉߸ํࣜͷ҆શੑΛධՁ͢Δஈ֊ʹ͋Γ, 2023 ೥લ‫ʹͰ·ޙ‬ඪ४ԽΛਐΊΔ‫ܭ‬ըΛཱ͍ͯͯΔ [4] (ਤ 1.2). ԤभͰ͸ EU H2020 ʹ͓͍ͯ SAFECrypto *1 ΍ PQCRYPTO *2 ͳͲͷ‫ڀݚ‬ϓϩδΣΫτ͕࣮ࢪ͞Εͨ΄͔, ETSI ͔Β Quantum-safe Cryptography ʹؔ͢ΔΨΠυϥΠϯ͕ग़൛͞Ε͍ͯΔ [8]. ·ͨ,

ISO/IEC JTC 1/SC 27 WG2 ʹ͓͍ͯ΋ PQC ʹؔ͢Δ Standing Document ͷ࡞੒͕࢝·ΔͳͲ, ඪ४Խʹ޲͚ͨٞ࿦͕࢝·͍ͬͯΔ.
҉߸ٕज़ௐࠪϫʔΩϯάάϧʔϓʹ͓͍ͯ΋ 2014 ೥౓ʹ PQC ͷ୅දతͳީิͰ͋Δ֨ࢠʹ‫ٕ߸҉ͮ͘ج‬ज़ʹ͍ͭͯௐࠪΛߦ͍, ใࠂॻʮ֨ࢠ໰୊౳ͷࠔ೉ੑʹؔ͢ΔௐࠪʯΛެ։͍ͯ͠Δ [2]. ͞Βʹ 2017 ೥౓͔Β 2018 ೥౓ʹ͔͚ͯ, PQC ͷ୅දతͳީิͰ͋Δલड़ͷ࢛ͭͷ෼ྨʹ͍ͭͯௐࠪ͠, ຊใࠂॻʹ·ͱΊͨ.

*1 https://www.safecrypto.eu/*2 https://pqcrypto.eu.org/

3ਤ 1.2NIST PQC ඪ४Խεέδϡʔϧ (https://csrc.nist.gov/projects/post-quantum-cryptography/
workshops-and-timeline)

1.3 ຊใࠂॻͰѻ͏࢛ͭͷ PQC
ຊઅͰ͸ຊௐࠪͷର৅ͱͯ֨͠ࢠʹ‫ٕ߸҉ͮ͘ج‬ज़, ූ߸ʹ‫ٕ߸҉ͮ͘ج‬ज़, ଟม਺ଟ߲ࣜʹ‫߸҉ͮ͘ج‬, ಉछࣸ૾ʹ‫ٕ߸҉ͮ͘ج‬ज़Λબ୒ͨ͠ཧ༝‫ͦͼٴ‬ͷઆ໌ʹඞཁͳࣄ߲ʹ͍ͭͯड़΂Δ.
୅දతͳެ։‫߸҉ݤ‬͸, ਺ֶతͳ‫ࢉܭ‬໰୊ͷࠔ೉ੑΛͦͷ҆શੑͷࠜ‫ͯ͠ͱڌ‬ར༻͍ͯ͠Δ. ྫ͑͹ RSA ҉߸Ͱ͸,ೋͭͷಉఔ౓ͷେ͖͞Ͱ͔ͭ૬ҟͳΔૉ਺ p, q ͕ൿີ‫ݤ‬, ͦΕΒͷੵ N = pq ͕ެ։‫͞༻࢖ͯ͠ͱݤ‬Ε, N ͕ૉҼ਺෼ղ͞ΕΔͱൿີ‫ ݤ‬p, q ͕‫͞ࢉܭ‬Εͯ͠·͍, RSA ҉߸͸ղಡ͞Εͯ͠·͏. ପԁ‫ۂ‬ઢ҉߸ͷ৔߹΋ପԁ‫ۂ‬ઢ҉߸ͷެ։‫͔ݤ‬Βପԁ‫ۂ‬ઢ্ͷ཭ࢄର਺໰୊͕ఆٛ͞Ε, ͦΕΛղ͘͜ͱͰͦͷൿີ‫͏·͖ͯ͠Ͱࢉܭ͕ݤ‬. ຊใࠂॻͰѻ͏୅දతͳ࢛ͭͷ PQC (֨ࢠʹ‫ٕ߸҉ͮ͘ج‬ज़, ූ߸ʹ‫ٕ߸҉ͮ͘ج‬ज़, ଟม਺ଟ߲ࣜʹ‫߸҉ͮ͘ج‬, ಉछࣸ૾ʹ‫҉ͮ͘ج‬߸ٕज़) ΋ RSA ҉߸ͱಉ༷ʹ, ͦΕΒͷ҆શੑ͸ͦΕͧΕͰར༻͞ΕΔ਺ֶతͳ‫ࢉܭ‬໰୊ͷࠔ೉ੑΛࠜ‫͍ͯ͠ͱڌ‬Δ.
ͦͯ͠, ͜ΕΒͷ໰୊Λྔࢠ‫ػࢉܭ‬Λར༻ͯ͠ޮ཰Α͘ղ͘ΞϧΰϦζϜ͸·ͩൃ‫͞ݟ‬Ε͍ͯͳ͍͜ͱ͕, ͦΕΒ࢛ͭͷ҉߸ํ͕ࣜ PQC ͱ͞Ε͍ͯΔཧ༝Ͱ͋Δ. ຊௐࠪͷର৅Ͱ͋Δ҉߸ํࣜͱ਺ֶతͳ‫ࢉܭ‬໰୊ͷؔ܎͸֤ষͷ 1 અͰઆ໌͢Δ.
ຊใࠂॻͷௐࠪର৅Ͱ͋Δ࢛ͭͷ҉߸ٕज़ͷ‫ڀݚ‬ͷྺ࢙͸௕͘, ֨ࢠʹ‫ٕ߸҉ͮ͘ج‬ज़‫ͼٴ‬ಉछࣸ૾ʹ‫ٕ߸҉ͮ͘ج‬ज़ 20 ೥Ҏ্, ଟม਺ଟ߲ࣜʹ‫ٕ߸҉ͮ͘ج‬ज़͸ 30 ೥Ҏ্, ූ߸ʹ‫ٕ߸҉ͮ͘ج‬ज़͸ 40 ೥Ҏ্‫ߦ͕ڀݚ‬ΘΕ͍ͯΔ.
ैͬͯ, ຊௐࠪͰ͸͜ΕΒͷ҉߸ٕज़Λ༗ྗͳ PQC ͱͯ͠ௐࠪͨ͠. ্ड़ͷ֤҉߸ํࣜͷྺ࢙తͳࣄ࣮ʹ͍ͭͯ͸֤ষͷ 4 અʹ‫ͨ͠ࡌه‬.

4

1.4 2017 ʙ 2018 ೥౓ ҉߸ٕज़ௐࠪ WG (҉߸ղੳධՁ) ͷҕһߏ੒
ओࠪ

ߴ໦ ߶

౦‫ژ‬େֶେֶӃ ৘ใཧ޻ֶ‫ڀݚܥ‬Պ ‫ڭ‬तҕһ੨໦ ࿨ຑ࿊

೔ຊి৴ి࿩‫ࣜג‬ձࣾ NTT ηΩϡΞϓϥοτϑΥʔϜ‫ ॴڀݚ‬άϧʔϓϦʔμҕһ૲઒ ‫ܙ‬ଠ೔ຊి৴ి࿩‫ࣜג‬ձࣾ NTT ηΩϡΞϓϥοτϑΥʔϜ‫ڀݚ ॴڀݚ‬ओ೚

ҕһ

ᅳኍ ঢ

౦‫ژ‬େֶେֶӃ ৽ྖҬ૑੒Պֶ‫ڀݚ‬Պ ।‫ڭ‬त

ҕһ

Լࢁ ෢࢘

ҕһ

ߴౡ ࠀ޾

ࡾඛి‫ࣜגػ‬ձࣾ ৘ใٕज़૯߹‫ ॴڀݚ‬ओ؅ٕࢣ௕ҕһ҆ా ‫و‬ಙԬࢁཧՊେֶ ޻ֶ෦ ।‫ڭ‬त

ҕһ

҆ా խ࠸

‫۝‬भେֶɹϚεɾϑΥΞɾΠϯμετϦ‫ ॴڀݚ‬।‫ڭ‬त‫ࣜג‬ձࣾ෋࢜௨‫ ॴڀݚ‬ηΩϡϦςΟ‫ ॴڀݚ‬σʔλˍ IoT ηΩϡϦςΟϓϩδΣΫτ
ओ؅‫ڀݚ‬һ

1.5 ֤ষͷࣥචऀͱ಺༰
֤ষͷࣥච୲౰ऀ‫ͼٴ‬ௐࠪ಺༰͸Լදͷ௨ΓͰ͋Δ.
ষ
ୈ1ষ

ࣥචऀ໊

಺༰

ߴ໦ ߶ ओࠪ, ࠇ઒ ‫ࣄ( ࢘و‬຿‫)ہ‬,ࣰ‫ ݪ‬௚ߦ (ࣄ຿‫)ہ‬, ੝߹ ࢤൕ (ࣄ຿‫)ہ‬ௐࠪͷ໨త, ֓ཁͳͲୈ2ষ

Լࢁ ෢࢘ ҕһ, ҆ా խ࠸ ҕһ, ੨໺ ྑൣ (ࣄ຿‫)ہ‬֨ࢠʹ‫ٕ߸҉ͮ͘ج‬ज़ୈ3ষ

૲઒ ‫ܙ‬ଠ ҕһූ߸ʹ‫ٕ߸҉ͮ͘ج‬ज़ୈ4ষ҆ా ‫و‬ಙ ҕһଟม਺ଟ߲ࣜʹ‫ٕ߸҉ͮ͘ج‬ज़

ୈ5ষ

ߴౡ ࠀ޾ ҕһಉछࣸ૾ʹ‫ٕ߸҉ͮ͘ج‬ज़

5

ୈ 1 ষͷࢀߟจ‫ݙ‬[1] J. Buchmann, E. Dahmen, M. Szydlo, Hash-based Digital Signature Schemes, Post-Quantum Cryptography,
pp. 35-93. Springer, Heidelberg, 2009.
[2] CRYPTREC, ֨ࢠ໰୊౳ͷࠔ೉ੑʹؔ͢Δௐࠪ, CRYPTREC report 2014, https://www.cryptrec.go.jp/ex
report/cryptrec-ex-2404-2014.pdf, 2015.
[3] L. Chen, S. Jordan, Y.-K. Liu, D. Moody, R. Peralta, R. Perlner, D. Smith-Tone, Report on Post-Quantum
Cryptography, NISTIR 8105, https://nvlpubs.nist.gov/nistpubs/ir/2016/NIST.IR.8105.pdf, 2016.
[4] L. Chen, D. Moody, Y.-K. Liu, Post-Quantum Cryptography, https://csrc.nist.gov/projects/post-q
uantum-cryptography/workshops-and-timeline, 2018.
[5] D-Wave Systems Inc.,

D-Wave Announces D-Wave 2000Q Quantum Computer and First System

Order, https://www.dwavesys.com/press-releases/d-wave%C2%A0announces%C2%A0d-wave-2000q-qua
ntum-computer-and-first-system-order, 2017.
[6] D-Wave Systems Inc., The D-Wave 2000QTM Quantum Computer Technology Overview, https://www.dwavesys.com/sites/default/files/D-Wave%202000Q%20Tech%20Collateral 0117F.pdf, 2017.
[7] R. Dridi, H. Alghassi, Prime Factorization Using Quantum Annealing and Computational Algebraic Geometry, https://arxiv.org/abs/1604.057962v2, 2016.
[8] ETSI, Quantum-Safe Cryptography, https://www.etsi.org/technologies-clusters/technologies/quantum-safe-cryptography.
[9] A. Huelsing, D. Butin, S. Gazdag, J. Rijneveld, A. Mohaisen, XMSS: eXtended Merkle Signature Scheme,
RFC8391, https://tools.ietf.org/html/rfc8391, 2018.
[10] ҏ౾ ఩໵, ᅳኍ ঢ, ૉҼ਺෼ղͷ‫ݱ‬ঢ়, Proceedings of the 2018 Symposium on Cryptography and Information
Security, SCIS 2018, 2B2-3, 2018.
[11] J. Kelly, A Preview of Bristlecone, Googleʟs New Quantum Processor, https://ai.googleblog.com/2018/03/a-preview-of-bristlecone-googles-new.html, 2018.
[12] ᅳኍ ঢ, Shor ͷΞϧΰϦζϜʹ‫ͮ͘ج‬ૉҼ਺෼ղ࣮‫ݧ‬ͷௐࠪ, ిࢠ৘ใ௨৴ֶձٕज़‫ڀݚ‬ใࠂ, volume 76, pp.
58-62, IEICE, 2018.
[13] E. Martı́n-López, A. Laing, T. Lawson, R. Alvarez, X.-Q. Zhou, J.L. O’Brien, Experimental Realization of
Shor’s Quantum Factoring Algorithm Using Qubit Recycling, Nature Photonics, volume 6, number 11, pp.
773-776, 2012.
[14] P. W. Shor, Polynominal time algorithms for discrete logarithms and factoring on a quantum computer,
Proceedings of Algorithmic Number Theory, First International Symposium , pp. 289-289, 1994.
[15] P. W. Shor, Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum

6Computer, SIAM J. Comput., volume 26, number 5, pp. 1484-1509, 1997.
[16] ਗ਼ਫ ढ़໵, ҏ౾ ఩໵, ࣰ‫ ݪ‬௚ߦ, ੝߹ ࢤൕ, ᅳኍ ঢ, ΞχʔϦϯά‫ʹࢉܭ‬ΑΔૉҼ਺෼ղʹ͍ͭͯ, Proceedingsof the 2019 Symposium on Cryptography and Information Security, SCIS 2019, 2B4-3, 2019.
[17] C. Vu, Client systems with 20 qubits ready for use; next-generation IBM Q system in development with
first working 50 qubit processor. - -IBM expands its open-source quantum software package QISKit; oﬀers
the world’s most advanced ecosystem for quantum computing, https://www-03.ibm.com/press/us/en/pressrelease/53374.wss, 2017.
[18] L. M. K. Vandersypen, M. Steﬀen, G. Breyta, C. S. Yannoni, M. H. Sherwood, I. L. Chuang, Experimental
Realization of Shor’s Quantum Factoring Algorithm Using Nucler Magnetic Resonance, Nature, volume 414,
pp. 883-887, 2001.

7

ୈ2ষ

֨ࢠʹ‫ٕ߸҉ͮ͘ج‬ज़ຊষͰ͸֨ࢠʹ‫ٕ߸҉ͮ͘ج‬ज़ʹ͍ͭͯ·ͱΊΔ. ֨ࢠʹ‫ٕ߸҉ͮ͘ج‬ज़ͷ҆શੑ͸, LWE (Learning With Errors)
໰୊, NTRU ໰୊, ͓ΑͼͦΕΒͷมछ౳Λ‫ؚ‬Ή, ֨ࢠཧ࿦ʹؔ܎͢Δ໰୊Λղ͘‫ࢉܭ‬ͷࠔ೉ੑʹґଘ͍ͯ͠Δ.

2.1 ֨ࢠʹ‫ٕ߸҉ͮ͘ج‬ज़ͷ҆શੑͷࠜ‫ͳͱڌ‬Δ໰୊
2.1.1 LWE ໰୊ͱ୅දతͳ‫ٻ‬ղ๏ຊઅͰ͸, 2005 ೥ Regev ͕ఏҊͨ͠ LWE ໰୊ [40] Λ঺հ͢Δͱ‫ʹڞ‬, ֨ࢠΛར༻ͨ͠ LWE ໰୊ʹର͢Δ‫ٻ‬ղ๏Λ঺հ͢Δ. ·ͨ, LWE ໰୊ͷ͍͔ͭ͘ͷมछʹ͍ͭͯ΋‫͢ٴݴ‬Δ.

2.1.1.1

LWE ໰୊ͷ঺հ

LWE ໰୊͸‫ػ‬ցֶशཧ࿦͔Β೿ੜͨ͠‫ٻ‬ղࠔ೉ͳ໰୊Ͱ, ੔਺৒༨ྨ‫ ؀‬Zq ্ͷൿີϕΫτϧ s ∈ Znq ʹؔ͢ΔϥϯμϜͳ࿈ཱઢ‫ܗ‬ʮۙࣅʯํఔ͕ࣜ༩͑ΒΕͨͱ͖, ͦͷൿີϕΫτϧΛ෮‫͢ݩ‬Δ໰୊Ͱ͋Δ. ਺஋ྫͱͯ͠

n = 4, q = 17 ͱ͠, ൿີϕΫτϧ s = (s1 , s2 , s3 , s4 ) ∈ Z417 ʹؔ͢Δ࿈ཱઢ‫ํࣅۙܗ‬ఔࣜ⎧
14s1 + 15s2 + 5s3 + 2s4 ≈ 8
⎪
⎪
⎪
⎪
⎪
13s1 + 14s2 + 14s3 + 6s4 ≈ 16⎪⎪⎨
6s1 + 10s2 + 13s3 + s4 ≈ 12
⎪
⎪
..
⎪
⎪
⎪
.
⎪
⎪
⎩
6s1 + 7s2 + 16s3 + 2s4 ≈ 3(mod 17)(mod 17)(mod 17)(mod 17)͕༩͑ΒΕͨͱ͢Δ. (͜ͷ਺஋ྫ͸ [43] ͔ΒҾ༻ͨ͠.) ͨͩ͠, ֤ઢ‫ํܗ‬ఔࣜͷ஋͸ۙࣅ஋Ͱ͋Γ, ͦͷ‫ࠩޡ‬͸͜ͷྫͰ͸ ±1 Ҏ಺ͱԾఆ͢Δ. ͜ͷͱ͖, ͜ͷ࿈ཱઢ‫ํࣅۙܗ‬ఔࣜͷղ s Λ‫ٻ‬ΊΔͷ͕ LWE ໰୊Ͱ͋Δ. (͜ͷ਺஋ྫͰ͸s = (0, 13, 9, 11) ∈ Z417 ͕ղͱͳΔ.) LWE ໰୊Ͱ஫ҙ͢΂͖͜ͱ͸, ࿈ཱઢ‫ํࣅۙܗ‬ఔࣜʹ‫͍ͳ͕ࠩޡ‬৔߹͸, Gaussͷফ‫ڈ‬๏ʹΑΓޮ཰తʹղΛ‫ٻ‬ΊΔ͜ͱ͕Ͱ͖Δ఺Ͱ͋Δ. ‫ͱ͏ݴʹٯ‬, ࿈ཱઢ‫ํࣅۙܗ‬ఔࣜͰ༩͑ΒΕΔ‫ࠩޡ‬ͷେ͖͕͞ LWE ໰୊ͷ‫ٻ‬ղΛࠔ೉ʹ͢Δ. (࣮ࡍ, ‫͕ࠩޡ‬େ͖͘ͳΔ΄Ͳ LWE ໰୊ͷ‫ٻ‬ղ͸ΑΓࠔ೉ʹͳΔ.)
˙཭ࢄ Gauss ෼෍Ұൠʹ, LWE ໰୊ʹ͓͚Δ࿈ཱઢ‫ํࣅۙܗ‬ఔࣜͷ‫ࠩޡ‬͸, ฏ‫ ۉ‬0, ύϥϝʔλ σ > 0 ͷ Z ্ͷ཭%2ࢄ Gauss ෼෍ χ = DZ,σ ͔Βੜ੒͞ΕΔ*1 . ΑΓਖ਼֬ʹ͸, χ ͸֤੔਺ x ͕αϯϓϧ͞ΕΔ֬཰͕ exp − πxσ2*1ຊষͰ͸‫ ߸ه‬σ ΛΨ΢ε෼෍ͷύϥϝʔλ (ඪ४ภࠩͱ͸ҟͳΔ) ͷҙຯͰ࢖͍, ॺ໊Λද͢ͱ͖ʹ͸ sig Λ༻͍Δ.

8

&

ʹൺྫ

͢Δ Z ্ͷ཭ࢄ֬཰෼෍Ͱ͋Δ. ͜ͷ෼෍͸, ਺ֶతͳਖ਼‫ن‬෼෍*2 ͱ͸ҟͳΔ͕, ઈର஋ͷେ͖ͳ஋͕ੜ੒͞ΕΔ֬཰
͕ඇৗʹখ͍͞ͱ͍͏ੑ࣭͸‫ڞ‬௨͍ͯ͠Δ. ྫ͑͹, ઈର஋͕ 3σ ΑΓେ͖ͳ੔਺͕αϯϓϧ͞ΕΔ֬཰͸ඇৗʹখ͞
͍. ཭ࢄ Gauss ෼෍ͷৄࡉʹ͍ͭͯ͸ [33] ͳͲΛࢀর.
཭ࢄ Gauss ෼෍Λਖ਼֬ʹੜ੒͢ΔΞϧΰϦζϜ͸࣮૷͕༰қͰ͸ͳ͘, timing attack ͳͲͷ੬ऑੑ [11] ͕ੜ·Εͯ
͠·͏ͨΊ, ‫࣮ݱ‬ͷํࣜ (2.3 અࢀর) ʹ͓͍ͯ͸, ‫( ࠩޡ‬ϊΠζ) ͱͯ͠཭ࢄ Gauss ෼෍ͱͷ౷‫͕཭ڑܭ‬খ͍͞෼෍Λ
Scheme༻͍͍ͯΔ. ͦΕΒΛ۠ผ͢ΔͨΊ, ํࣜ Scheme ಺Ͱ༻͍ΒΕΔϊΠζͷ෼෍Λ DZ,sͱද‫͢ݱ‬Δ. ͜͜Ͱ, s ͸ύ
SchemeϥϝʔλͰ͋Δ, ·ͨ, ‫ ߸ه‬DZScheme, DZScheme͔Βಠཱʹੜ੒ͨ͠ n ࣍‫ݩ‬ϕΫτn ,sn×m ,s ʹΑͬͯͦΕͧΕ, ੒෼Λ DZ,sϧ, n × m ߦྻͱ͢Δ.
˙LWE ໰୊ͷఆࣜԽ
ఆٛ 2.1 (LWE ໰୊ [40]) n Λਖ਼ͷ੔਺ͱ͠, q Λ‫ح‬ૉ਺ͱ͢Δ. ฏ‫ ۉ‬0, ඪ४ภࠩ σ ͷ Z ্ͷ཭ࢄ Gauss ෼෍Λχ = DZ,σ ͱ͢Δ. ൿີϕΫτϧ s ∈ Znq Λ‫ݻ‬ఆ͢Δ. Ұ༷ϥϯμϜʹબ͹Εͨ a ∈ Znq ͱ཭ࢄ Gauss ෼෍ χ ͔Βαϯϓϧ͞Εͨ e ∈ Z ʹରͯ͠, (a, b) ∈ Zn
q × Zq ͷ૊Λग़ྗ͢Δ֬཰෼෍Λ Ls,χ ͱ͢Δ. ͨͩ͠, b ≡ ⟨a, s⟩ + e (mod q)
ͱ͢Δ. (2 ͭͷϕΫτϧ v ͱ w ͷ಺ੵΛ ⟨v, w⟩ Ͱද͢.) ͜ͷͱ͖, ࣍ͷ 2 ͭͷ໰୊Λߟ͑Δɿ

1. ൑ఆ LWE (Decision-LWE)n༩͑ΒΕͨ૊ (a, b) ∈ Zn
q × Zq ͕, ֬཰෼෍ Ls,χ ͔Βαϯϓϧ͞Εͨ‫͔ݩ‬, Zq × Zq

্Ұ༷ϥϯμϜʹੜ੒͞Εͨ‫͔ݩ‬Λܾఆ͢Δ໰୊.

2. ୳ࡧ LWE (Search-LWE)

֬཰෼෍ Ls,χ ͔Βαϯϓϧ͞Εͨ૊ (a, b) ͔ΒൿີϕΫτϧ s Λ෮‫͢ݩ‬Δ໰୊.

Ұൠʹ, ্‫ه‬ͷ LWE ໰୊ʹ͓͍ͯ֬཰෼෍ Ls,χ ͸೚ҙ‫ݸ‬ͷ૊ (a, b) Λαϯϓϧ͢ΔΦϥΫϧͱͯ͠Έͳ͢. ۩ମతʹ͸, ͋Δ‫ݻ‬ఆͨ͠αϯϓϧ਺ m > 0 ʹରͯ͠, ֬཰෼෍ Ls,χ ͔Βαϯϓϧ͞ΕͨҟͳΔ m ‫ݸ‬ͷ૊⎧(a1 , b1 ),
⎪
⎪
⎪
⎪
⎪
⎨ (a2 , b2 ),
⎪
⎪
⎪
⎪
⎪
⎩

..
.

(am , bm ),b1 ≡ ⟨a1 , s⟩ + e1
b2 ≡ ⟨a2 , s⟩ + e2
bm ≡ ⟨am , s⟩ + em

(mod q)(mod q)(mod q)͔Β LWE ໰୊Λղ͘͜ͱΛߟ͑Δ. (ղಡʹཁ͢Δ‫࠷͕ؒ࣌ࢉܭ‬΋୹͘ͳΔΑ͏ͳ m Λ߈ܸऀ͕બ΂Δ͜ͱΛ૝ఆ͢Δ.) ୈ i ߦϕΫτϧΛ ai ͱ͢Δ m × n ߦྻΛ A ͱ͠, b = (b1 , b2 , . . . , bm ) ͱ͓͘. ͜ͷͱ͖, ্‫ه‬ͷ m ‫ݸ‬ͷ LWE αϯϓϧͷ૊͸ (A, b) ∈ Zm×n
× Znq ͱ؆ܿʹදͤͯ, ؔ܎ࣜ b ≡ sA⊤ + e (mod q) Λຬͨ͢. ͨͩ͠,qe = (e1 , e2 , . . . , em ) ∈ Zm ΛϊΠζϕΫτϧͱ͢Δ. (֤ ei ͸ χ ͔Βαϯϓϧ͞Εͨ‫͋Ͱݩ‬Δ͜ͱʹ஫ҙ͢Δ.)
˙LWE ໰୊ͷมछ

LWE ໰୊ͷมछͱͯ͠ଟ߲ࣜ‫ ؀‬Rq = Zq [x]/(φ) ্ͷ LWE Ͱ͋Δ Ring-LWE [48, 34] *3

΍ Module-LWE [36] ͕͋Δ. Ring-LWE Ͱ͸, 3 ͭͷଟ߲ࣜ s, ai , ei ∈ Rq ʹର͢Δ Ring-LWE αϯϓϧͱͯ͠{(ai , ai · s + ei )}m
i=1 Λߟ͑Δ. (ಛʹ, ௨ৗͷ LWE ໰୊ͱಉ͡Α͏ʹ, ϥϯμϜͳ s ͱ, ܎਺͕খ͍͞ଟ߲ࣜͷू߹͔ΒαϯϓϦϯά͞Εͨ ei ͕༻͍ΒΕΔ.) Ring-LWE ͷ‫ ؀ૅج‬Rq ΛఆΊΔଟ߲ࣜͱͯ͠ φ = xn + 1 ͕Α͘༻͍ΒΕΔ. ·ͨ, Module-LWE Ͱ͸, ଟ߲ࣜϕΫτϧ s, ai ∈ Rqk ͱଟ߲ࣜ ei ∈ Rq ʹର͢Δ Module-LWE αϯϓϧͱͯ͠n/k{(ai , ⟨ai , s⟩ + ei )}m+ 1 ͕Α͘༻͍ΒΕi=1 Λߟ͑Δ. Module-LWE ͷ‫ ؀ૅج‬Rq ΛఆΊΔଟ߲ࣜͱͯ͠͸ φ = x√22e−z /(2t ) ʹΑΓఆٛ͞ΕΔͨΊ, 2π ഒͷͣΕ͕͋Δ. ֨ࢠ҉߸ͷ҆શੑΛٞ࿦͢Δࡍʹ֨ࢠ্ͷ Fourier ม‫͍༻͕׵‬ΒΕΔ͜ͱ͕ଟ͘ [40], ຊจதͷఆٛΛ༻͍Δ͜ͱͰ, ਺ࣜͷද‫͕ݱ‬؆ܿͱͳΔ.
*3 จ‫[ ݙ‬34] Ͱ͸ΑΓҰൠతʹ੔਺‫ͱ؀‬ΠσΞϧΛ༻͍ͯఆٛ͞Ε͍ͯΔ͕, ‫ޙ‬ͷจ‫[ ݙ‬15] Ͱ͸ͦΕͷ؆ུԽͱͯ͠, ଟ߲ࣜ‫ ؀‬Rq Λ༻͍ͨද‫ݱ‬
Ͱ͋Δ “polynomial-LWE assumption” ͕ఏҊ͞Εͨ. 2019 ೥‫Ͱࡏݱ‬͸‫ऀޙ‬ͷද‫ݱ‬ͷํ͕ Ring-LWE ͱ‫ݺ‬͹Ε͍ͯΔ.
*2

෼ࢄ t2 ʹରͯ͠਺ֶతͳਖ਼‫ن‬෼෍ N (0, t2 ) ͸, ֬཰ີ౓ؔ਺͕ √ 1

2πt

9

Δ. ͞Βʹ, ‫্؀‬ͷ LWE Ҏ֎ͷ LWE ໰୊ͷมछͱͯ͠, ‫ؙ‬ΊࠐΈࣸ૾ͰϊΠζϕΫτϧΛੜ੒͢Δ LWR (Learningwith Rounding) [14] ΍ middle-product ͱ‫ݺ‬͹ΕΔଟ߲ࣜԋࢉΛ༻͍Δ Middle-product LWE [44] ͳͲ਺ଟ͘ఏҊ͞Ε͍ͯΔ.

2.1.1.2 ֨ࢠͷ‫ج‬ຊࣄ߲ͱ q-ary ֨ࢠͷ঺հm ࣍‫࣮ݩ‬ϕΫτϧۭؒ Rm ͷҰ࣍ಠཱͳ m ‫ݸ‬ͷϕΫτϧ b1 , b2 , . . . , bm ͷ੔਺܎਺ͷઢ‫߹݁ܗ‬'m
શମ L = { i=1 xi bi : xi ∈ Z, 1 ≤ i ≤ m} Λ (‫׬‬શ֊਺ͷ) m ࣍‫Ϳݺͱࢠ֨ݩ‬. ಛʹ, ֨ࢠ L ͸ϕΫτϧۭؒ Rm
˙֨ࢠͷ‫ج‬ຊࣄ߲ͷ (཭ࢄ) Ճ๏෦෼‫͋Ͱ܈‬Δ. ·ͨ, ֨ࢠ L Λੜ੒͢ΔҰ࣍ಠཱͳ m ‫ݸ‬ͷϕΫτϧͷ૊ {b1 , b2 , . . . , bm } Λ‫ج‬ఈͱ‫ݺ‬ͼ, ֤ bi Λ‫ج‬ఈϕΫτϧͱ‫Ϳݺ‬. ͞Βʹ, ߦϕΫτϧͰදͨ͠‫ج‬ఈϕΫτϧ bi ∈ Rm Λߦͱͯ࣋ͭ͠ m × m ߦྻ

B = (bi )mi=1 Λ֨ࢠ L ͷ‫ج‬ఈߦྻͱ‫Ϳݺ‬. 2 ࣍‫ݩ‬Ҏ্ͷ֨ࢠΛੜ੒͢ΔҟͳΔ‫ج‬ఈ͸ແ‫ʹݶ‬ଘࡏ͠, ಉ֨͡ࢠΛੜ੒͢

Δ 2 ͭͷ‫ج‬ఈߦྻ B1 ͱ B2 ʹର͠ B2 = VB1 Λຬͨ͢ m × m ͷϢχϞδϡϥߦྻ V ͕ଘࡏ͢Δ. ·ͨ, ‫ج‬ఈߦྻ B Λ༻͍ͯ, ֨ࢠ L ͷମੵΛ vol(L) = | det(B)| ͱఆΊΔ. (ମੵ͸‫ج‬ఈͷऔΓํʹґଘ͠ͳ͍.) ֨ࢠ L ͷୈ 1 ஞ࣍࠷খ͸ L ্ͷ࠷୹ͳඇྵϕΫτϧͷ Euclid ϊϧϜΛࢦ͠, λ1 (L) ͱද͢. ϕΫτϧۭؒ Rm ͷ‫׬‬શ֊਺ͷ֨ࢠ L ʹ( = {x ∈ Rm : ⟨x, y⟩ ∈ Z
ର͠, ू߹ L*−1 ⊤(∀y ∈ L)} Λ֨ࢠ L ͷ૒ର֨ࢠͱ‫Ϳݺ‬. ·ͨ, ֨ࢠ L ͷ‫ج‬ఈߦྻ B ʹରͯ͠,( Λ૒ର‫ج‬ఈߦྻͱ‫Ϳݺ‬. ୯Ґߦྻ Im ʹର͠ BB( ⊤ = Im Λຬͨ( ͷ‫ج‬ఈߦྻͱͳΓ, ͜ͷ B͸૒ର֨ࢠ L˙q-ary ֨ࢠ

LWE ໰୊ͷ‫ٻ‬ղͰར༻͢Δಛघͳ֨ࢠΛ঺հ͢Δ. ਖ਼ͷ੔਺ q ʹରͯ͠, qZm ⊆ L ⊆ Zm Λຬͨ͢‫׬‬

)

( = B
B

( = 1 ͕੒Γཱͭ.
͢ͷͰ, vol(L) × vol(L)શ֊਺ͷ m ࣍‫ ࢠ֨ݩ‬L Λ q-ary ֨ࢠͱ‫Ϳݺ‬. 2 ͭͷࣗવ਺ m > n ʹର͠, ೚ҙͷਖ਼ͷ੔਺ q ͱ n × m ੔਺ߦྻ X ʹ
ର͢Δ 2 ͭͷ m ࣍‫ ݩ‬q-ary ֨ࢠΛΛq (X) = {y ∈ Zm : ∃s ∈ Zn s.t. y ≡ sX(mod q)} ,

+
,
m
⊤
Λ⊥
q (X) = y ∈ Z : yX ≡ 0 (mod q)

ͱఆٛ͢Δ. (͜ΕΒ 2 ͭͷू߹͸ Rm ͷ཭ࢄՃ๏෦෼‫ͳ܈‬ͷͰ֨ࢠͰ͋Δ.) ਖ਼‫ن‬ԽͷࠩΛআ͖, ͜ΕΒ 2 ͭͷ!
⊥!
q-ary ֨ࢠ͸‫ʹ͍ޓ‬૒ରͷؔ܎ʹ͋Δ. ਖ਼֬ʹ͸ Λ⊥
q (X) = q Λq (X) ͱ Λq (X) = q Λq (X) ͕੒Γཱͭ. ·ͨ, ‫܈‬४ಉ‫ ૾ࣸܕ‬f : Zm −→ (Z/qZ)n ,y -−→ yX⊤ (mod q) ͷ֩͸ q-ary ֨ࢠ Λ⊥
q (X) ͳͷͰ, ‫܈‬ͷ४ಉ‫ܕ‬ఆཧ͔Βvol(Λ⊥ (X))

q
m
⊥
m
⊥
vol(Λ⊥
q (X)) = [Z : Λq (X)] = #Im(f ) ͕੒Γཱͭ. (‫܈‬ͷࢦ਺ [Z : Λq (X)] ͸֨ࢠͷମੵͷൺ vol(Zm ) ʹҰக͢) ⊥*Δ͜ͱʹ஫ҙ͢Δ.) ͜ΕΑΓ, ମੵ vol Λq (X) ͸ q n ΛׂΔ. ͞Βʹ, ‫ݩ‬ͷ֨ࢠͱ૒ର֨ࢠͷମੵͷؔ܎͔Β, q m−n ͸)*nମੵ vol (Λq (X)) ΛׂΔ͜ͱ͕෼͔Δ. (ͨͩ͠, ΄ͱΜͲͷߦྻ X ʹରͯࣸ͠૾ f ͸શࣹͰ, ͦͷ࣌ vol Λ⊥q (X) = q

ͱ vol (Λq (X)) = q m−n ͕੒Γཱͭ.) q-ary ֨ࢠ Λq (X) ্ͷϕΫτϧ͸ y = sX + qz (s ∈ Zn , z ∈ Zm ) ͱ͔͚ΔͷͰ, ͦͷ֨ࢠ͸ (n + m) × m ੔਺ߦྻ

-

X

.

ͷҰ࣍ैଐͳ (n + m) ‫ݸ‬ͷߦϕΫτϧͰੜ੒͞ΕΔ. ͜ͷੜ੒ߦྻͷ
qIm
Hermite Normal Form Λ‫͢ࢉܭ‬Δ͜ͱͰ, m ࣍‫ ݩ‬q-ary ֨ࢠ Λq (X) ͷ‫ج‬ఈߦྻ B ∈ Zm×m ͕ಘΒΕΔ. ·ͨ, ૒ର−1 ⊤‫ج‬ఈͷੑ࣭͔Β, ΋͏ยํͷ q-ary ֨ࢠ Λ⊥) ∈ Zm×m ͰಘΒΕΔ.
q (X) ͷ‫ج‬ఈߦྻ͸ (qB

2.1.1.3

LWE ໰୊ͷ୅දతͳ‫ٻ‬ղ๏˙൑ఆ LWE ໰୊ʹର͢Δ‫ٻ‬ղ൑ఆ LWE ໰୊Λ SIS (Short Integer Solution) ໰୊ʹ‫ؼ‬ணͯ͠ղ͘ํ๏Λ঺հ͢Δɿਖ਼ͷ੔਺ q ͱ, 0 < β < q Λຬ࣮ͨ͢਺ β Λ‫ݻ‬ఆ͢Δ. ֤੒෼͕৒༨‫ ؀‬Z/qZ ্Ұ༷ϥϯμϜʹબ͹Εͨ n × m ੔਺ߦྻ X ʹରͯ͠, ∥v∥ ≤ β ͔ͭ vX⊤ ≡ 0 (mod q) Λຬͨ͢ඇྵϕΫτϧ v ∈ Zm Λ‫͚ͭݟ‬Δ໰୊Λ SIS ໰୊ͱ‫ݺ‬
Ϳ. ͭ·Γ, ͜Ε͸ q-ary ֨ࢠ Λ⊥
q (X) ্ͷ୹͍ඇྵϕΫτϧΛ‫͚ͭݟ‬Δ໰୊Ͱ͋Δ. ৒༨ύϥϝʔλ q ʹ͓͚Δ LWE໰୊ͷαϯϓϧ਺Λ m ͱ͠, m ‫ݸ‬ͷ LWE αϯϓϧͷ૊Λ (A, b) ∈ Zm×n× Zmqq ͱ͢Δ. ͜͜Ͱ, n × m ͷసஔߦྻ⊤A⊤ ʹର͢Δ SIS ໰୊ͷ୹͍ղϕΫτϧ v ∈ Λ⊥
q (A ) ͕ಘΒΕͨͱ͢Δ (0 < ∥v∥ ≤ β ͱԾఆ). ͜ͷͱ͖, LWE α

10ϯϓϧͷ૊ (A, b) ͸ؔ܎ࣜ b ≡ sA⊤ + e (mod q) Λຬͨ͢ͷͰ, ⟨v, b⟩ ≡ ⟨v, sA⊤ + e⟩ ≡ ⟨vA, s⟩ + ⟨v, e⟩ ≡ ⟨v, e⟩(mod q) ͕੒Γཱͭ. (vA ≡ 0 (mod q) ʹ஫ҙ͢Δ.) ͞Βʹ, ϊΠζϕΫτϧ e ͷ͢΂ͯͷ੒෼ ei ͸཭ࢄ Gauss ෼෍ χ ͔Βαϯϓϧ͞Εͨ‫ͳݩ‬ͷͰ, |⟨v, e⟩| ≈ σ∥v∥ ≤ σβ ͕‫ظ‬଴Ͱ͖Δ. (཭ࢄ Gauss ෼෍ χ = DZ,σ ͷαϯϓϧ‫ ݩ‬eiͷઈର஋͸͓͓Αͦ σ ະຬͰ, ଟΊʹ‫ੵݟ‬΋ͬͯ ∥e∥ = σ ͱͨ͠.) Ώ͑ʹ, σβ ≪ q ͳΒ͹, |⟨v, b⟩| (mod q) ͷ஋ͷେ͖͔͞Β LWE αϯϓϧͷ૊ (A, b) ͸֬཰෼෍ Ls,χ ͔Βαϯϓϧ͞Εͨ΋ͷ͔൑ఆͰ͖Δ.
˙୳ࡧ LWE ໰୊ʹର͢Δ‫ٻ‬ղ๏୳ࡧ LWE ໰୊Λ BDD (Bounded Distance Decoding) ໰୊ʹ‫ؼ‬ணͯ͠ղ͘ํ๏Λ঺հ͢Δɿ֨ࢠ L ͱ໨ඪϕΫτϧ w ͱͷ‫ͯؔ͠ʹ཭ڑ‬, ͋Δ 0 < µ ≤ 12 ͕ଘࡏ͠ dist(w, L) = minv∈L ∥w − v∥ <µλ1 (L) Λຬͨ͢ͱԾఆ͢Δ. ֨ࢠ L ͷ‫ج‬ఈ͕༩͑ΒΕͨͱ͖, ໨ඪϕΫτϧ w ʹ࠷΋͍ۙ֨ࢠϕΫτϧ v ∈ L Λ‫ͭݟ‬⊤
͚Δ໰୊Λ BDD ໰୊ͱ‫Ϳݺ‬. m ‫ݸ‬ͷ LWE αϯϓϧͷ૊ (A, b) ∈ Zm×n× Zmqq ͸ؔ܎ࣜ b ≡ sA + e (mod q) Λຬͨ͢ͷͰ, ୳ࡧ LWE ໰୊͸ b Λ໨ඪϕΫτϧͱ͢Δ q-ary ֨ࢠ Λq (A⊤ ) ্ͷ BDD ໰୊ͱΈͳͤΔ. ࣮ࡍ, ໨ඪϕΫτϧ b = sA⊤ + e + qz (∃z ∈ Zm ) ʹରͯ͠, ֨ࢠϕΫτϧΛ v = sA⊤ + qz ∈ Λq (A⊤ ) ͱ͓͘ͱ, b − v = e ͕੒Γཱͭ. ϊΠζϕΫτϧ e ͷ͢΂ͯͷ੒෼ ei ͸཭ࢄ Gauss ෼෍ χ ͔Βαϯϓϧ͞Εͨ‫͋Ͱݩ‬ΔͨΊ, ෼ࢄͱ࣍‫͕ݩ‬େ͖͍৔߹ʹ͸͓͓ΑͦεέʔϦϯά͞ΕͨΧΠೋ৐෼෍ʹै͍, ߴ͍֬཰Ͱ ∥e∥ ≈ √σ2π ·√√m ͱͳΔ. Ώ͑ʹ, ໨ඪϕ⊤Ϋτϧ b ͱͷ‫ ͕཭ڑ‬σ m ҎԼͱͳΔ q-ary ֨ࢠ Λq (A ) ্ͷ֨ࢠϕΫτϧ v Λ‫͚ͭݟ‬Δ͜ͱͰ, ϊΠζϕΫτϧ eΛ෮‫͢ݩ‬Δ͜ͱ͕Ͱ͖Δ.

2.1.2 NTRU ໰୊ͱ୅දతͳ‫ٻ‬ղ๏͜͜Ͱ͸ NTRU ໰୊ͱͦͷ୅දతͳ‫ٻ‬ղ๏Λ঺հ͢Δ. ·ͣҎԼͰ, NTRU ໰୊ʹ͍ͭͯड़΂Δɿ
ఆٛ 2.2 (NTRU ໰୊ [28]) 2 ͭͷਖ਼ͷ੔਺ n ͱ q ʹର͠, φ ∈ Z[x] Λ࣍਺ n ͷଟ߲ࣜͱ͠, Rq = Zq [x]/(φ) ͱ͢
Δ. ܎਺͕খ͍͞ 2 ͭͷଟ߲ࣜ f ∈ Rq× , g ∈ Rq ʹରͯ͠, h = g · f −1 ∈ Rq ͱ͢Δ. (ಛʹ f ͸‫ ؀‬Rq ͷՄ‫ݩٯ‬.) ͜ͷͱ͖, ༩͑ΒΕͨଟ߲ࣜ h ͔Β, f ·ͨ͸ g ͷଟ߲ࣜΛ෮‫͢ݩ‬Δ໰୊Λ (୳ࡧ) NTRU ໰୊ͱ͍͏.

NTRU ໰୊ʹ͓͚Δଟ߲ࣜ φ ͷબͼํͱͯ͠, φ = xn ± 1, xn − x − 1, xn − xn/2 + 1,

'n−1

i=0 x

i

ͳͲ͕͋Δ [6,Table 1]. (࠷‫ޙ‬ͷ φ ͷ࣍਺͸ n − 1 Ͱ͋Δ.) ·ͨ, ଟ߲ࣜ f (·ͨ͸ g) ͷબͼํͱͯ͠, {−1, 0, 1} ͳͲͷখ͍͞܎਺
Λ࣋ͭଟ߲ࣜ΍, খ͍͞ૉ਺ p ͱ܎਺͕খ͍͞ଟ߲ࣜ F ʹର͠ f = pF ·ͨ͸ f = pF + 1 ͱબͿ͜ͱ͕ଟ͍.

࣍ʹ, NTRU ໰୊ͷ୅දతͳ‫ٻ‬ղ๏Λ঺հ͢Δ. ·ͣ, ༩͑ΒΕͨଟ߲ࣜ h ∈ Rq ʹରͯ͠, h ͷ”rotation”ߦྻΛH ∈ Zn×n ͱ͢Δ. (n × n ੔਺ߦྻ H ͷ i ߦϕΫτϧΛଟ߲ࣜ xi−1 h ∈ Rq ͷ܎਺ϕΫτϧͱ͢Δ.) ͭ·Γ⎛Λຬͨ͢. ͜͜Ͱ, 2n × 2n ߦྻ B =

1
x
..
.

⎞

⎛

h
xh
..
.

⎞

⎜
⎟ ⎜
⎟
⎜
⎟ ⎜
⎟
H⎜
⎟=⎜
⎟ ∈ Rqn
⎝
⎠ ⎝
⎠
n−1
n−1
x
x
h
.
In H

ͷߦϕΫτϧͰੜ੒͞ΕΔ NTRU ֨ࢠΛ L ͱ͢Δ. ͜ͷͱ͖, 2n0 qIn
࣍‫ݩ‬ͷ NTRU ֨ࢠ L ͸୹͍ϕΫτϧ (f | g) ∈ Z2n Λ‫ؚ‬Ή. (ͨͩ͠, f , g ∈ Zn Λଟ߲ࣜ f, g ∈ Rq ͷ܎਺ϕΫτϧͱ͢Δ.) ࣮ࡍ, hf = g (mod q) ΑΓ, g = hf + qr Λຬͨ͢ଟ߲ࣜ r ∈ Rq ͕ଘࡏ͢Δ. ·ͨ, ଟ߲ࣜ r ͷ܎਺ϕΫτϧ11Λ r ∈ Zn ͱ͢Δͱ,

⎛

1
x
..
.

⎞

⎛

h
xh
..
.

⎞

⎛

1
x
..
.

⎞

⎛

1
x
..
.

⎞

⎜
⎟
⎜
⎟
⎜
⎟
⎜
⎟
⎜
⎟
⎜
⎟
⎜
⎟
⎜
⎟
g⎜
⎟ = g = hf + qr = f ⎜⎟ + qr ⎜⎟ = (fH + qr) ⎜⎟ ∈ Rq
⎝
⎠
⎝
⎠
⎝
⎠
⎝
⎠
n−1
n−1
n−1
n−1
x
x
h
x
x

ͱͳΔͷͰ, g = fH + qr ͕੒Γཱͭ. ͜ΕΑΓ, (f | g) = (f | fH + qr) = (f | r)B ∈ L ͕੒Γཱͭ. (ͭ·Γ, ϕΫτϧ (f | g) ͕ NTRU ֨ࢠ L ʹ‫·ؚ‬ΕΔ.) ϕΫτϧ (f | g) ∈ Z2n ͕े෼খ͘͞ NTRU ֨ࢠ L ্ͷ།Ұͷ࠷୹ϕΫτϧ
ͱԾఆ͢Δͱ, ͜Ε͸ NTRU ໰୊Λ, unique-SVP ʹ‫ؼ‬ணͰ͖Δ͜ͱΛ͍ࣔͯ͠Δ.

2.1.3 ֨ࢠ໰୊Λղ͘ΞϧΰϦζϜͱͦͷ‫͍ͯͭʹྔࢉܭ‬࠷୹ϕΫτϧ໰୊ (Shortest Vector Problem, SVP) ΍্‫঺Ͱه‬հͨ͠ LWE ໰୊ɾNTRU ໰୊ͳͲͷ֨ࢠ໰୊Λղ͘ͷʹ༗༻ͳٕज़ͱͯ֨͠ࢠ‫ج‬ఈ؆໿͕͋Δ. ֨ࢠ‫ج‬ఈ؆໿͸, ༩͑ΒΕͨ֨ࢠ L ͷ‫ج‬ఈ͔Β, ֤ϕΫτϧ bi ͕୹͘ɾ‫͍ޓ‬ͷϕΫτϧ͕௚ަʹ͍ۙ֨ࢠ L ͷ৽͍͠‫ج‬ఈ {b1 , b2 , . . . , bm } Λ‫͚ͭݟ‬Δૢ࡞Ͱ͋Δ. (໌֬ͳఆٛ͸ͳ͍͕,͜ͷΑ͏ͳ‫ج‬ఈΛ؆໿‫ج‬ఈ·ͨ͸ྑ͍‫ج‬ఈͱ‫Ϳݺ‬.)

2.1.3.1 ୅දతͳ֨ࢠ‫ج‬ఈ؆໿ΞϧΰϦζϜͷ঺հ‫ج‬ఈ؆໿ΞϧΰϦζϜΛ঺հ͢ΔͨΊʹ, Gram-Schmidt ͷ௚ަԽ (Gram-Schmidt orthogonalization, GSO)
Λઆ໌͢Δɿ‫ج‬ఈ {b1 , b2 , . . . , bm } ͷ GSO ϕΫτϧ b∗i ͸࣍ͷΑ͏ʹ࠶‫ؼ‬తʹఆ·Δɿb∗1 = b1 , b∗i = bi −'i−1∗
j=1 µi,j bj ,⟨bi ,b∗ ⟩µi,j = ∥b∗ ∥j2 . ·ͨ, ֤ 2 ≤ ℓ ≤ m ʹର͠ Rm ͔Β R-ϕΫτϧۭؒ ⟨b1 , b2 , . . . , bℓ−1 ⟩R ͷ௚ަิۭؒ
j΁ͷ௚ަࣹӨΛ πℓ ͱ͔͘. (ศ্ٓ π1 Λ߃౳ࣸ૾ͱ͢Δ.) ҎԼͰ, ୅දతͳ 2 ͭͷ֨ࢠ‫ج‬ఈ؆໿ΞϧΰϦζϜΛ঺հ͢Δɿ
˙LLL [31]؆໿ύϥϝʔλ 14 < δ < 1 ʹର͠, LLL ‫ج‬ఈ؆໿͸࣍ͷ 2 ৚݅Λຬͨ͢‫ج‬ఈ {b1 , b2 , . . . , bm } Λ‫ͭݟ‬͚Δ (࣍‫ ݩ‬m ʹؔ͢Δ) ଟ߲ࣜ࣌ؒΞϧΰϦζϜͰ͋Δɿ (i) ‫ج‬ఈ {b1 , b2 , . . . , bm } ͸αΠζ؆໿͞Ε͍ͯΔ. ͭ·Γ, GSO ܎਺͕ |µi,j | ≤ 12 (∀i > ∀j) Λຬͨ͢.

δ∥b∗k−1 ∥2 ≤ ∥πk−1 (bk )∥2 (2 ≤ ∀k ≤ m) Λຬͨ͢.

(ii) ‫ج‬ఈ {b1 , b2 , . . . , bm } ͸ Lovász ৚݅Λຬͨ͢. ͭ·Γ,ೖྗ‫ج‬ఈʹରͯ͠, Lovász ৚͕݅੒Γཱͨͳ͍ͱ͖ LLL ‫ج‬ఈ؆໿ΞϧΰϦζϜ಺ͰྡΓ߹͏‫ج‬ఈϕΫτϧ bk−1 ͱ bk ͷަ‫׵‬Λߦ͍, (i) ͱ (ii) ͷ 2 ৚݅Λຬͨ͢‫ج‬ఈΛ‫͚ͭݟ‬Δ.
˙BKZ [45]BKZ ‫ج‬ఈ؆໿ΞϧΰϦζϜ͸ϒϩοΫαΠζ β ʹΑΔ LLL ‫ج‬ఈ؆໿ΞϧΰϦζϜͷҰൠԽͰ͋Δ. LLL

ʹൺ΂, BKZ ‫ج‬ఈ؆໿ΞϧΰϦζϜͰΑΓྑ͍؆໿‫ج‬ఈΛ‫͚ͭݟ‬Δ͜ͱ͕ՄೳͰ͋Δ͕, ͦͷ‫ྔࢉܭ‬͸ β ʹؔͯ͠ࢦ਺࣌ؒͰ͋Δ. ಛʹ, BKZ ‫ج‬ఈ؆໿ΞϧΰϦζϜʹೖྗ͢ΔϒϩοΫαΠζ β Λ૿΍͢͝ͱʹ, ࣮ߦ͕࣌ؒඇৗʹ஗͘ͳΔ͕, ΑΓ୹͍‫ج‬ఈϕΫτϧΛग़ྗ͢Δ. ۩ମతʹ͸, ϒϩοΫαΠζ 2 ≤ β ≤ m ʹରͯ͠, BKZ ‫ج‬ఈ؆໿ΞϧΰϦζ

Ϝ͸࣍ͷ 2 ͭͷ৚݅Λຬͨ֨͢ࢠ L ͷ‫ج‬ఈ {b1 , b2 , . . . , bm } Λ‫͚ͭݟ‬Δɿ (i) ‫ج‬ఈ͸αΠζ؆໿͞Ε͍ͯΔ. (ii) ͢΂ͯͷ 1 ≤ j ≤ m ʹର͠ ∥b∗j ∥ = λ1 (L[j,k] ) Λຬͨ͢. ͨͩ͠, k = min(j + β − 1, m) ͱ͠, ϕΫτϧ πj (bj ), . . . , πj (bk )Ͱੜ੒͞ΕΔϒϩοΫࣹӨ֨ࢠΛ L[j,k] ͱ͢Δ. ೖྗ‫ج‬ఈʹରͯ͠, BKZ ‫ج‬ఈ؆໿ΞϧΰϦζϜ಺Ͱ͸ϒϩοΫࣹӨ֨
ࢠ L[j,k] ্ͷ SVP ΦϥΫϧΛ‫܁‬Γฦ͠‫ͩ͠ͼݺ‬, (i) ͱ (ii) ͷ 2 ৚݅Λຬͨ͢‫ج‬ఈΛ‫͚ͭݟ‬Δ.

2.1.3.2

BKZ ‫ج‬ఈ؆໿ΞϧΰϦζϜͷग़ྗ‫ج‬ఈͱ‫ྔࢉܭ‬͜Ε·Ͱ BKZ2.0 [20] ͳͲͷޮ཰తͳ BKZ ͷվྑΞϧΰϦζϜ͕ఏҊ͞Ε, ֨ࢠʹ‫ٕ߸҉ͮ͘ج‬ज़ͷ҆શੑධՁͰ
Α͘ར༻͞Ε͍ͯΔ. ҎԼͰ BKZ ͷग़ྗ‫ج‬ఈͱ‫ྔࢉܭ‬ධՁͷ‫ੵݟ‬΋Γʹ͍ͭͯ঺հ͢Δ (ৄࡉ͸ [6] Λࢀর) ɿ

12˙BKZ ͷग़ྗ‫ج‬ఈͷ‫ੵݟ‬΋Γ֨ࢠ‫ج‬ఈ؆໿ΞϧΰϦζϜ͕ग़ྗ͢Δ؆໿‫ج‬ఈͷʮྑ͞ʯΛଌΔࢦඪͱͯ͠ HermiteҼࢠ͕͋Δ. m ࣍‫ ࢠ֨ݩ‬L ͷ‫ج‬ఈ͕༩͑ΒΕͨͱ͖, ΞϧΰϦζϜ͕ग़ྗ͢Δ࠷୹ͳ‫ج‬ఈϕΫτϧΛ b ∈ L ͱ͢Δ.
∥b∥

͜ͷͱ͖, ͦͷ‫ج‬ఈ؆໿ΞϧΰϦζϜͷ Hermite Ҽࢠ͸ γ = vol(L)1/m Ͱఆٛ͞ΕΔ. (ͭ·Γ, Hermite Ҽࢠ͕খ͍͞΄Ͳ, ΑΓ୹͍‫ج‬ఈϕΫτϧͷग़ྗΛҙຯ͢Δ.) 100 Ҏ্ͷߴ࣍‫ݩ‬ͷϥϯμϜ֨ࢠʹର͠, LLL ΍ BKZ ͳͲͷ‫ج‬ఈ؆໿ΞϧΰϦζϜͷ Hermite Ҽࢠͷ m ৐ࠜ γ 1/m ͸ఆ਺ʹऩଋ͢Δ͜ͱ͕࣮‫ݧ‬తʹ஌ΒΕ͍ͯΔ. ߴ͍࣍‫ ݩ‬m ͷϥϯμϜ֨ࢠʹ͓͍ͯ, ϒϩοΫαΠζ β ≥ 50 ʹର͢Δ BKZ ‫ج‬ఈ؆໿ΞϧΰϦζϜͷ root Hermite Ҽࢠ͸͓͓Αͦ

1
6 2(β−1)
1
β
β
γ ≈
≈
(πβ)
ʹै͏͜ͱ͕࣮‫ݧ‬తʹ஌ΒΕ͍ͯΔ. ͨͩ͠, νβ ͸ β-࣍‫ݩ‬ͷ୯Ґ௒‫ٿ‬ͷମ
2πeੵͱ͢Δ. (ྫ͑͹ β = 85 Ͱ γ 1/m ≈ 1.01 ͱͳΔ.) ͜ͷ root Hermite Ҽࢠͷ‫ੵݟ‬΋ΓΛ༻͍ͯ, ֨ࢠʹ‫ٕ߸҉ͮ͘ج‬
1
m

5

−1
νβ β

1
6 β−1

5

ज़ͷ҆શੑධՁର৅ͷ֨ࢠ໰୊ͷ‫ٻ‬ղͰඞཁͱͳΔ BKZ ͷϒϩοΫαΠζ β Λ‫ٻ‬ΊΔ͜ͱ͕Ͱ͖Δ.

˙BKZ ͷ‫ྔࢉܭ‬ͷ‫ੵݟ‬΋Γ BKZ ‫ج‬ఈ؆໿ΞϧΰϦζϜͷ‫ྔࢉܭ‬͸, β ࣍‫্ࢠ֨ݩ‬ͷʮSVP ΦϥΫϧͷ‫ྔࢉܭ‬ʯͱʮ‫ݺ‬ͼग़͠ճ਺ʯͷੵͰ‫ੵݟ‬΋Δ͜ͱ͕Ͱ͖Δ. β ࣍‫্ࢠ֨ݩ‬ͷ SVP ΦϥΫϧʹదͨ͠ΞϧΰϦζϜͱͯ͠ᝲ (sieving) ͱ਺্͑͛ (enumeration) ͕͋Γ, ᝲͷํ͕઴ۙ‫͕ྔࢉܭ‬খ͍͞. (ͨͩ͠, ᝲͷۭؒ‫ྔࢉܭ‬͸ β ͷࢦ਺ؔ਺Ͱ, ਺্͑͛ʹൺ΂ͯඇৗʹେ͖͍.) β ࣍‫্ࢠ֨ݩ‬ͷᝲͷ‫ྔࢉܭ‬͸ 2cβ+o(β) Ͱ, ‫ݹ‬య‫Ͱ্ػࢉܭ‬͸ c = 0.292 Ͱ, Grover ΞϧΰϦζ
ϜʹΑͬͯྔࢠ‫ Ͱ্ػࢉܭ‬c = 0.265 ͱ‫ੵݟ‬΋ΒΕ͍ͯΔ. Ұํ, ਺্͑͛ͷ‫ྔࢉܭ‬͸‫ݹ‬య‫ Ͱ্ػࢉܭ‬2c1 βlogβ+c2 β+c32·ͨ͸ 2c1 β +c2 β+c3 Ͱ, Grover ΞϧΰϦζϜʹΑΓྔࢠ‫Ͱ্ػࢉܭ‬͸ͦͷࢦ਺෦෼͕൒෼ʹͳΔͱ‫ੵݟ‬΋ΒΕ͍ͯΔ.

(ఆ਺ c1 , c2 , c3 ʹؔͯ͠͸༷ʑͳධՁ͕͋Γ, ۩ମతͳ஋ʹ͍ͭͯ͸ [6, Table 4] Λࢀর.) ·ͨ, BKZ ಺ͷ SVP ΦϥΫϧͷ‫ͼݺ‬ग़͠ճ਺ʹ͍ͭͯ͸, β ·ͨ͸ 8m ͱ‫ੵݟ‬΋Δ͜ͱ͕ଟ͍. (β ͸ BKZ ͷϒϩοΫαΠζͰ, m ͸֨ࢠͷ࣍‫͢ͱݩ‬Δ.)

2.2 ୅දతͳ֨ࢠʹ‫ࣜํ߸҉ͮ͘ج‬ͷઆ໌ຊઅͰ͸, ֨ࢠʹ‫ͮ͘ج‬୅දతͳ҉߸ํࣜͱͯ͠, LWE ໰୊ʹ‫ ͮ͘ج‬Regev ʹΑΔ҉߸Խํࣜ [40], ͳΒͼʹ

Ring-LWE ໰୊ʹ‫ ͮ͘ج‬Brakerski ΒʹΑΔ҉߸Խํࣜ [15], ߋʹ NTRU ໰୊ʹ‫ ͮ͘ج‬Hoﬀstein ΒʹΑΔ҉߸Խํࣜ [28] ʹ͍ͭͯड़΂Δ.

2.2.1 LWE ʹ‫߸҉ͮ͘ج‬Խ
Regev ʹΑΔ҉߸Խํࣜ [40] ͷߏ੒ʹ͸, ҎԼͷ 4 ͭͷύϥϝʔλ͕ඞཁͰ͋Δ.
• n: ҆શੑύϥϝʔλ• m: LWE αϯϓϧͷ‫( ਺ݸ‬m ≥ 1.1 · nlogq ͱͳΔ࠷খͷ੔਺ΛબͿ)• q: ৒༨ύϥϝʔλ (q ͱͯ͠ n2 ≤ q ≤ 2n2 Λຬͨ͢ૉ਺ΛબͿ)√• α > 0: ϊΠζύϥϝʔλ (α = 1/( n · log2 n)ҎԼʹ۩ମతͳ҉߸ํࣜͷߏ੒Λࣔ͢.
ൿີ‫ݤ‬ͷੜ੒ Ұ༷ϥϯμϜʹ s ← Znq ΛબͿެ։‫ݤ‬ͷੜ੒ ൿີ‫ ݤ‬s, ৒༨ύϥϝʔλ q ϊΠζύϥϝʔλ α Λ࣋ͭ LWE ෼෍͔Βੜ੒ͨ͠ m ‫ݸ‬ͷαϯmn
ϓϧ (ai , bi )mi=1 ← As,χ Λެ։‫͢ͱݤ‬Δ. ֤ͨͩ͠ i ʹ͍ͭͯ, a ← Zq , ei ← χ = DZ,αq ͱͨ࣌͠,bi = ⟨ai , s⟩ + ei ∈ Zq ͱ͢Δ.

13

҉߸Խ ू߹ S Λ {1, 2, . . . , m} ͷத͔ΒҰ༷ϥϯμϜʹબΜͩ෦෼ू߹ͱ͢Δ. ͜ͷͱ͖, ฏจϏοτ͕ 0 ͷ҉߸จ''qi∈S bi ) ͱ͠, ฏจϏοτ͕ 1 ͷ҉߸จΛ (i∈S ai , ⌊ 2 ⌋ +i∈S bi ) ͱ͢Δ.
q҉߸จ (a, b) ʹର͠, b − ⟨a, s⟩ ∈ Zq ͕ ⌊ 2 ⌋ ΑΓ 0 ʹ͍ۙ৔߹, ෮߸݁Ռͱͯ͠ 0 Λग़ྗ͠, ͦΕҎ֎ͷ৔߹͸
Λ(

෮߸

'

i∈S ai ,'1 Λग़ྗ͢Δ.

෮߸ͷਖ਼౰ੑʹ͍ͭͯ. ฏจͷ 0 ʹରԠ͢Δ҉߸จ (a, b) = ('i∈S (bi − ⟨ai , s⟩) =

'

'

'

i∈S bi ) ͷ৔߹, b − ⟨a, s⟩'qqi∈S ei ͳͷͰ, − 4 <i∈S ei < 4 Ͱ͋Ε͹෮߸ʹ੒ޭ͠, 0 ͕ग़ྗ͞ΕΔ.

֤ϊΠζ ei ͸ Gauss ෼෍ χ = DZ,αq ͔Βબ͹Ε͍ͯΔͷͰ,͜͜Ͱ, ֤ύϥϝʔλͷબ୒ํ๏͔Β√'i∈S a,i∈S ei ͷඪ४ภࠩ͸ߴʑ√∈ Zq =

mαq ͱͳΔ.

mαq < q/logn Ͱ͋Γ, ඇৗʹߴ͍֬཰Ͱ෮߸ʹ੒ޭ͢Δ͜ͱ͕෼͔Δ. ·ͨฏจϏοτ͕ 1 ͷ҉߸จʹରͯ͠΋ಉ༷ͷٞ࿦͕੒Γཱͭ. ͜ͷ҉߸ํࣜͷ҆શੑʹ͍ͭͯ͸, LWE ԾఆͷԼͰ

CPA ҆શͰ͋Δ͜ͱ͕ূ໌͞Ε͍ͯΔ [46].
7 2 ) Ͱ, ҉߸จαΠζ΋ฏจαΠζͷ͜͜Ͱ঺հͨ͠ [40] ʹΑΔ҉߸ํࣜ͸, ެ։‫ݤ‬ͷαΠζ͕ (mnlogq) = O(n7O(nlogq) = O(n)ഒʹ૿Ճ͢ΔͨΊ, ܾͯ͠ޮ཰తͰ͸ͳ͍. ΑΓޮ཰తͳํࣜͱͯ͠͸ [39] ͳͲΛࢀর.

2.2.2 Ring-LWE ʹ‫߸҉ͮ͘ج‬ԽBrakerski ΒʹΑΔ Ring-LWE ໰୊ʹ΋ͱͮ͘҉߸Խํࣜ͸, ҉߸Խͨ͠··‫ݶ‬ఆճͷՃࢉͱ৐ࢉ͕Մೳͳ
somewhat ४ಉ‫ͯ͠ͱ߸҉ܕ‬ఏҊ͞Ε͍ͯΔ΋ͷͰ͋Δ. ͜ͷ҉߸ํࣜʹ͸, ҎԼͷ 4 ͭͷύϥϝʔλ͕ඞཁͰ͋Δ.
• n: 2 ΂͖੔਺Ͱ, ҉߸ํࣜΛߏ੒͢Δ‫ૅج‬తͳ‫ ؀‬R = Z[x]/(xn + 1) Λఆٛ͢Δ (n ͕ 2 ΂͖੔਺ͷ৔߹ͷΈ,ଟ߲ࣜ xn + 1 ͸ Z ্‫ط‬໿ͱͳΔ͜ͱʹ஫ҙ).

• q: q ≡ 1 (mod 2n) Λຬͨ͢ૉ਺Ͱ, ҉߸จۭؒͷ‫ ؀ૅج‬Rq = Zq [x]/(xn + 1) Λఆٛ͢Δ.
• t: ৚݅ t < q Λຬͨ͢੔਺Ͱ, ҉߸ํࣜͷฏจۭؒ Rt = Zt [x]/(xn + 1) Λఆٛ͢Δ.
• σ > 0: ϊΠζΛ༩͑ΔͨΊͷ཭ࢄΨ΢ε෼෍ͷύϥϝʔλ.

ҎԼʹ۩ମతͳ҉߸ํࣜͷߏ੒Λࣔ͢. ͳ͓, a0 + a1 x + · · · + an−1 xn−1 → (a0 , a1 , . . . , an−1 ) ʹΑͬͯ, ‫ ؀‬R Λ Zn
ͱಉҰࢹ͢Δ. ·ͨಉ༷ʹ Rq ͱ Zn
q ΛಉҰࢹ͢Δ.

‫ݤ‬ੜ੒ s ∈ R ← DZn ,σ Λબͼ, Ұ༷ϥϯμϜʹ pi ∈ Rq ΛऔΓ, খ͞ͳΤϥʔ e ← χ Λ‫ݻ‬ఆ͢Δ. ([15] Ͱ͸ s ← χΛҰ༷ϥϯμϜʹબ୒͢Δͷʹର͠, [32] Ͱ͸Ұ༷ϥϯμϜʹ͸બ୒͠ͳ͍఺͚͕ͩҟͳΔ). ͦ͜Ͱ, ެ։‫ݤ‬Λ

pk = (p0 , p1 ) ͱ͠ (ͨͩ͠, p0 = −(p1 s + te) ͱ͢Δ), ൿີ‫ݤ‬Λ sk = s ͱ͢Δ.

҉߸Խ ฏจ৘ใ m ∈ Rt ͱެ։‫ ݤ‬pk = (p0 , p1 ) ʹର͠, ·ͣ R ∋ u, f, g ← χ Λબͼ, ҉߸จΛ

Enc(m, pk) = (c0 , c1 ) = (p0 u + tg + m, p1 u + tf ),ͱఆٛ͢Δ. ͨͩ͠, ৚݅ t < q ΑΓ, ্‫ه‬ͷ਺ࣜͰ͸‫ ݩ‬m ∈ Rt Λ‫ ؀‬Rq ͷ‫͢ࢉܭͯ͠ͳݟͯ͠ͱݩ‬Δ. ͭ·Γ,্‫ه‬ͷ҉߸จ͸ (Rq )2 ͷ‫ͯ͠ͱݩ‬ද‫͞ݱ‬ΕΔ.
෮߸೚ҙͷ௕͞ͷ҉߸จ ct = (c0 , c1 , . . . , cξ ) ʹରͯ͠, ෮߸͸Dec(ct, sk) = [m̃]q mod t ∈ Rt ,Ͱ‫͖Ͱࢉܭ‬Δ. ͨͩ͠, m̃ =
2

ξ

'ξ

i=0 ci si∈ Rq Ͱ͋Γ, [m̃]q ͸‫ ݩ‬m̃ ͷ֤܎਺ͷ [−q/2, q/2) ΁ͷ৒༨ͱ͢Δ. ·

ͨ, s = (1, s, s , . . . , s ) ͱͨ͠ͱ͖, ͜ͷ෮߸ॲཧΛ Dec(ct, sk) = [⟨ct, s⟩]q mod t ͱॻ͖௚͢͜ͱ΋Ͱ͖Δ.

14

෮߸ͷਖ਼౰ੑʹ͍ͭͯ͸, ্‫ه‬ͷ҉߸ΞϧΰϦζϜͰಘΒΕΔ҉߸จ ct = (c0 , c1 ) ʹର͠, ؔ܎ࣜ p0 + p1 s = −te͕੒Γཱͭ͜ͱ͔Β, ⟨ct, s⟩ = (p0 u + tg + m) + s · (p1 u + tf ) = m + t · (g + sf − ue) ͕‫ ؀‬Rq ্Ͱ੒Γཱͭ.

͜͜Ͱ, ‫ ݩ‬m + t · (g + sf − ue) Λ‫ ؀‬R ͷ‫͖ͱͨ͠ͳݟͱݩ‬, ͦͷ֤܎਺͕ [−q/2, q/2) ಺ʹऩ·͍ͬͯΔ‫ݶ‬Γ,[⟨ct, s⟩]q = m + t · (g + sf − ue) ͕‫ ؀‬R ্Ͱ੒ཱ͢Δ (‫ ݩ‬e, f, g, u ← χ ͕े෼খ͞ͳϊΠζͱͯ͠બ୒͞Ε͍ͯΔ͜ͱʹ஫ҙ). ͜ͷ৔߹, ৒༨ mod t ͷૢ࡞Ͱਖ਼͍͠෮߸݁Ռ m ∈ Rt ͕ಘΒΕΔ.

·ͨ, ͜ͷ҉߸ํࣜͷ҆શੑʹ͍ͭͯ͸, Ring-LWE ໰୊ͷ‫ࠔྔࢉܭ‬೉ੑԾఆͷԼͰ KDM ҆શ (key dependent

message security) Ͱ͋Δ͜ͱ͕ূ໌͞Ε͍ͯΔ [15].

2.2.3 NTRU ໰୊ʹ‫߸҉ͮ͘ج‬Խ
Hoﬀstein ΒʹΑΔ NTRU ໰୊ʹ‫߸҉ͮ͘ج‬Խํࣜ NTRUEncrypt [28] ͷߏ੒ʹ͸࣍ͷύϥϝʔλ͕ඞཁͰ͋Δ.
• n : ਖ਼ͷ੔਺ (ηΩϡϦςΟύϥϝʔλ)• q : ਖ਼ͷ੔਺ (ૉ਺Ͱ͋Δඞཁ͸ͳ͍)• p : q ͱ‫ʹޓ‬ૉͰ p ≪ q Ͱ͋Δਖ਼ͷ੔਺• φ: ࣍਺ n ͷଟ߲ࣜͰ͋Γ‫ ؀‬Rp = Zp [x]/(φ), Rq = Zq [x]/(φ) Λఆٛ͢Δ (φ ͱͯ͠͸ྫ͑͹ xn ± 1, xn − x − 1౳)ҎԼʹ۩ମతͳ҉߸ํࣜͷߏ੒Λࣔ͢.
‫ݤ‬ੜ੒ ͢΂ͯͷ܎਺ͷઈର஋͕খ͍͞ೋͭͷଟ߲ࣜ f ∈ Rq , g ∈ Rq ΛબͿ. ͨͩ͠, f ͸ Rp , Rq ͷ྆ํʹ͓͍ͯՄ‫ͳٯ‬ཁૉͱ͢Δ. ͢ͳΘͪ, ͋Δ fp , fq ͕ଘࡏ͠, ҎԼΛຬͨ͢.

f p · f = 1 ∈ Rp , f q · f = 1 ∈ Rq
͜͜Ͱ f, fp Λൿີ‫͠ͱݤ‬, h = pfq · g ∈ Rq Λެ։‫͢ͱݤ‬Δ. ͳ͓ fp , fq ͳΒͼʹ g ͸ f ͱ h Λ༻͍ͯ෮‫ݩ‬ՄೳͰ͋Δ͜ͱʹ஫ҙ͢Δ.

҉߸Խ ฏจ৘ใͱͯ͠, ͢΂ͯͷ܎਺ͷઈର஋͕ p ΑΓখ͍͞ (ྫ͑͹ −1, 0, 1 ͷ͍ͣΕ͔Ͱ͋Δ) ཁૉ m ∈ Rq ͱ͠, ެ։‫ ݤ‬pk = h ʹର͠, r ∈ Rq Λ܎਺͕খ͍͞ଟ߲͔ࣜΒϥϯμϜʹબͼ, ҉߸จΛ

Enc(m, pk) = r · h + m ∈ Rq
ͱఆٛ͢Δ.
෮߸҉߸จ c ∈ Rq ʹର͠, ෮߸͸

Dnc(m, sk) = [fp · [f · c]q ]pͰ‫ٻ‬ΊΒΕΔ. ͨͩ͠ [a]q , [a]p ͸‫ ݩ‬a ∈ Rq ͷ֤܎਺ΛͦΕͧΕ [−q/2, q/2), [−p/2, p/2) ʹऩΊͨ΋ͷͱ͢Δ.
෮߸ͷਖ਼౰ੑʹ͍ͭͯ͸, ࣍ͷΑ͏ʹࣔ͞ΕΔ. [f ·c]q ͸, f ·c = f ·(r ·h+m) = f (r ·pfq ·g +m) = pr ·g +f ·m ∈ Rq

ͱม‫͞ܗ‬ΕΔ͕, r, g, f, m ‫ʹڞ‬, ܎਺͕খ͍͞΋ͷ͔Βநग़͓ͯ͠Γ, ·ͨ p ≪ q Ͱ͋Δ͜ͱ, ߋʹ܎਺͕ [−q/2, q/2)ʹऩΊΒΕ͍ͯΔ͜ͱ͔Βద੾ͳύϥϝʔλબ୒ʹΑΓ, ্‫ࣜه‬͸ q ʹΑΔ৒༨Λ൐Θͳ͍౳ࣜ, ͢ͳΘͪ f · c =pr · g + f · m ∈ Z[x]/(φ) ͕ຬͨ͞ΕΔ. ·ͨӈลୈҰ߲͸ p ഒ߲Ͱ͋Δ͜ͱ͔Β, ଓ͘ p ʹΑΔ৒༨Ͱফ‫͞ڈ‬Ε,
fp · (pr · g + f · m) = fp · f · m = m ∈ Rp ͱͳΓਖ਼͍͠෮߸݁Ռ m ͕ಘΒΕΔ.

͜ͷ NTRU Encrypt ҉߸ͷ҆શੑʹ͍ͭͯ͸ΞϧΰϦζϜఏҊ౰ॳ֨ࢠ໰୊΁ͷ҆શੑ‫ؼ‬ண͕͍͍ͭͯͳ͔͕ͬͨ,Stehlé Β [47] ʹΑΓ, standard model ͷ CPA Ծఆʹ‫ͮ͘ج‬ΠσΞϧ֨ࢠ্ͷ Ring-SIS (Small Integer Solution) ໰୊ɺͳΒͼʹ Ring-LWE ໰୊ʹ‫ؼ‬ண͞ΕΔ͜ͱ͕ࣔ͞Ε͍ͯΔ.

15

2.3 ۩ମతͳ҉߸ํࣜຊઅͰ͸, ֨ࢠ໰୊ͷࠔ೉ੑΛ҆શੑͷࠜ‫ࣜํ߸҉ͨ͠ͱڌ‬ͷ͏ͪ, ओཁͳ΋ͷΛ঺հ͢Δ. ࠜ‫ͳͱڌ‬Δ໰୊ͷଟ༷ੑͱߏ੒ͷ୯७͞Λ‫ج‬४ͱͯ͠બͿ. औΓ্͛ͨํࣜ͸શͯ, NIST ͕ओ࠵͢Δ଱ྔࢠ‫߸҉ػࢉܭ‬બఆϓϩδΣΫτͷ

Round 1 ީิͰ͋ͬͨ΋ͷͰ, ৄࡉͳ࢓༷ॻ͕ެ։͞Ε͍ͯΔ΋ͷͰ͋Δ. ·ͨ, ͍͔ͭ͘͸ޮ཰తͳ࣮૷ͷͨΊͷิॿαϒϧʔνϯΛ༻͍͍ͯΔ͕, ҉߸ํࣜͷ‫ݪ‬ཧʹϑΥʔΧε͢ΔͨΊʹ‫ྗۃ‬ল͍ͯ͋Δ. ྫ͑͹, NewHope [2] ౳Ͱ༻͍ΒΕ͍ͯΔཚ਺Λೖྗͱͯ͠ެ։‫༻ݤ‬ͷଟ߲ࣜ a Λग़ྗ͢Δؔ਺͸ল͖, ௚઀ʹ a Λ౉͢‫Ͱܗ‬ͷද‫ݱ‬Λ͍ͯ͠Δ.
֤҉߸ํࣜ͸ͦͷߏ੒ʹԠ༷ͯ͡ʑͳϊΠζΛ༻͍͍ͯΔද 2.1

ຊઅͰѻ͏ओཁͳ֨ࢠʹ‫ٕ߸҉ͮ͘ج‬ज़

จ‫ݙ‬

LOTUS [38]

҉߸Խ

‫׵ަݤ‬

˓

˓

ॺ໊

˓

NewHope [2, 3, 9, 10]˓Lizard [21, 18, 19]

˓

CRYSTALS-Dilithium [23, 22, 24]

˓

pqNTRUSign [17, 29, 30]

˓

2.3.1 LOTUS
LOTUS ͸, Phong Β [38] ʹΑΓ NIST ʹఏҊ͢Δ଱ྔࢠ҉߸ͱͯ͠։ൃ͞Εͨ. LWE ໰୊Λ҆શੑͷࠜ‫ͱڌ‬ஔ͍ͨ҉߸Խํࣜ͸, Regev[46] ʹΑΔ 1 Ϗοτͷ҉߸ԽΛߦ͏΋ͷ͕࠷ॳͰ͋Γ, ಉ༷ͷ‫ݪ‬ཧͰଟϏοτͷ҉߸ԽΛՄೳͱͨ͠ Lindner-Peikert ํࣜ [33] Λൃలͤͨ͞҉߸ํ͕ࣜଟ͘ఏҊ͞Ε͍ͯΔ. LOTUS *4 ͸ͦͷΑ͏ͳ҉߸ํࣜͷதͰ΋࠷΋୯७ͱߟ͑ΒΕΔ. ํࣜͷߏ੒͸, Lindner-Peikert ํࣜ (ද 2.2) ʹ౻࡚-Ԭຊม‫[ ׵‬26, 27] Λద༻͠, ඍमਖ਼Λߦͬͨ΋ͷͰ, ‫ܕݪ‬͸੨໺Βͷจ‫[ ݙ‬5, Sect. 4] ʹ‫ݟ‬ΒΕΔ.
LOTUS
ද 2.3 ʹུ֓Λࣔ͢. LWE ϊΠζ DZ,σ͸, σ = 8.0 ͷ཭ࢄΨ΢ε෼෍ DZ,8.0 Ͱ͋Δ. Knuth-Yao ΞϧΰϦζϜΛ

༻͍ͯ, ཧ૝తͳग़ྗͱͷ౷‫ ͕཭ڑܭ‬2−256 ҎԼͱͳΔ࣮૷Λߦ͍ͬͯΔ. ࣮૷࣌ͷ‫ڞ‬௨‫߸҉ݤ‬͸ AES-CTR Ͱ, ରԠ͢ΔηΩϡϦςΟϨϕϧ͝ͱʹϒϩοΫ௕ΛఆΊ͍ͯΔ. ϋογϡؔ਺͸ SHA-512 Λ༻͍, G(x) = SHA-512(x||0x01),

H(x) = SHA-512(x||0x02) ͱ͍ͯ͠Δ. શͯͷԋࢉ͸ Zq ্ͰߦΘΕ, ࣗಈతʹ۠ؒ (−q/2, q/2] ʹೖΔΑ͏ʹ‫͞ࢉܭ‬
ΕΔ.

*4Learning with errOrs based encryption with chosen ciphertexT secUrity for poSt quantum era ͷུশ

16ද 2.2ύϥϝʔλLindner-Peikert PKE

λ (ηΩϡϦςΟ), n, ℓ (࣍‫)ݩ‬, q (๏), σ (཭ࢄΨ΢ε෼෍ͷύϥϝʔλ)$λ‫ݤ‬ੜ੒ KeyGen(1 ) → (sk, pk)
҉߸Խ Enc(pk, M ∈ {0, 1}1×ℓ ) → ct

෮߸ Dec(sk, ct) → M ′

ද 2.3
ύϥϝʔλ
‫ڞ‬௨‫߸҉ݤ‬ϋογϡؔ਺
‫ݤ‬ੜ੒ KeyGen(1λ ) → (sk, pk)
҉߸Խ Enc(pk, M ∈ {0, 1}1×ℓ ) → ct

෮߸ Dec(sk, ct) → M ′A ←− Zn×n, R, S ← DZLOTUS
n×ℓ ,σ ɹqsk = S, pk = (A, P = R − AS (mod q))$

LOTUS
e1 , e2 ← DZLOTUS
1×n ,σ , e3 ←− DZ1×ℓ ,σc1 = e1 A + e2 (mod q), c2 = e1 P + e3 + M · ⌊q/2⌋ (mod q)
ct = (c1 , c2 )M = c1 S + c2 (mod q) := (M1 , M2 , . . . , Mℓ )// mod q ͷ݁Ռ͸۠ؒ [−q/2, q/2] ʹೖΔΑ͏ʹ‫͞ࢉܭ‬ΕΔ!
0 (if |Mi | < q/4)
Mi′ := (෮‫ݩ‬ϝοηʔδ M ′ ͷ i Ϗοτ໨) =1 (if otherwise)

LOTUS-PKE ͷུ֓ [38, Section 3.3]n, ℓ (࣍‫)ݩ‬, q (๏), σ = 8.0 (཭ࢄΨ΢ε෼෍ͷύϥϝʔλ)҉߸Խ SEK (m), ෮߸ SDK (c)G, H$

1: A ←− Zn×n
, R, S ← DZLOTUS
n×ℓ ,σq
2: sk = S, pk = (A, P = R − AS (mod q))$

1: str ←− {0, 1}ℓ , csym = SEG(str) (M ), h = H(str||csym )
$

$

LOTUS
2: e1 , e2 ←− DZLOTUS
1×n ,σ , e3 ←− DZ1×ℓ ,σ// h Λγʔυͱͯ͠, ཭ࢄΨ΢ε෼෍Λੜ੒
3: c1 = e1 A + e2 (mod q), c2 = e1 P + e3 + str · ⌊q/2⌋ (mod q)// ཚ਺ྻ str Λ҉߸Խ
4: ct = (c1 , c2 , csym )1: str = c1 S + c2 (mod q) := (s1 , s!2 , . . . , sℓ )2: str′ = (s′1 , s′2 , . . . , s′ℓ ) where s′i =3: h′ = H(str′ ||csym )$0
1(if |si | < q/4)
(if otherwise)
$

′
LOTUS
4: (੔߹ੑνΣοΫ) e′1 , e′2 ←− DZLOTUS
1×n ,σ , e3 ←− DZ1×ℓ ,σ′//h Λγʔυͱͯ͠, ཭ࢄΨ΢ε෼෍Λੜ੒
5: c′1 = e1 A + e2 (mod q); c′2 = e1 P + e3 + str′ · ⌊q/2⌋ (mod q)
6: (c′1 , c′2 ) = (c1 , c2 ) Ͱ͋Ε͹, ෮߸੒ޭͱͯ͠ M ′ = SDG(σ′ ) (csym ) Λग़ྗɹ
7: (c′1 , c′2 ) ̸= (c1 , c2 ) Ͱ͋Ε͹, ෮߸ࣦഊͱͯ͠ΤϥʔΛग़ྗɹ

17

ද 2.4

LOTUS-KEM ͷύϥϝʔλ [38, Table 2.5]҉߸จαΠζ

(n, q, s)҆શੑϨϕϧ

ެ։‫ݤ‬αΠζൿີ‫ݤ‬αΠζฏจαΠζ(576, 8192, 3.0)

128 bits

658.95KB

700.42KB

16B

1.144KB(704, 8192, 3.0)

192 bits

1025.0KB

1101.0KB

24B

1.456KB(832, 8192, 3.0)

256 bits

1471.0KB

1590.8KB

32B

1.768KB(‫ݤ‬ΧϓηϧԽ‫)ޙ‬҉߸จ͕ਖ਼͍͠৔߹, ෮߸ΞϧΰϦζϜͷεςοϓ 1 Ͱ‫͞ࢉܭ‬Εͨ str ͸

str = e1 R + e2 S + e3 + str · ⌊q/2⌋(mod q)LOTUS
Λຬͨ͢. ӈลͷ e1 R + e2 S + e3 ͷཁૉ͸શͯ DZ,σ͔Βੜ੒͞Εͨ੔਺ͷੵɾ࿨Ͱ͋ΔͨΊ, q/2 ͱൺ΂ͯখ͘͞, εςοϓ 2 ͷૢ࡞ʹΑΓ‫ݩ‬ͷཚ਺ྻ str ͕ߴ֬཰Ͱਖ਼͘͠෮‫͖Ͱݩ‬Δ͜ͱ͕Θ͔Δ. Αͬͯ, εςοϓ 3 ͷ h′ ͕҉߸Խ࣌ʹ༻͍ΒΕͨ h ͱಉҰͷϏοτྻͱͳΔͨΊ, Ҏ߱ͷ‫ࢉܭ‬͸҉߸Խ࣌ͷ΋ͷͱ౳͘͠ͳΓ, ੔߹ੑͷνΣοΫ͕
ՄೳͱͳΔ.

LWE ໰୊ͷࠔ೉ੑΛԾఆ͢Δͱ, LOTUS-PKE ͕ IND-CCA2 ҆શͰ͋Δ͜ͱ͕ূ໌Ͱ͖Δ [38, Theorem 3].
2017 ೥ 12 ݄຤ʹ LOTUS-KEM ͷ࣮૷ʹରͯ͠, બ୒҉߸จ߈ܸ͕ՄೳͱͳΔͱͷࢦఠ͕͋ͬͨ. ཌ೥ 1 ݄, ࢦఠ෦෼ͷίʔυΛमਖ਼͢Δ͜ͱͰղܾ͍ͯ͠Δ.

2.3.2 NewHope
NewHope ͸, Alkim Β [10] ʹΑΓࠃࡍձٞ Usenix Security ͰఏҊ͞Εͨ. ࠷ॳͷఏҊϓϩτίϧͰ͸ Reconciliation Λߦ͍͕ͬͯͨ, ‫ʹޙ‬ఏҊ͞Εͨ NewHope-Simple [9] Ͱ͸ͦͷ෦෼͕࡟ΒΕ, ΑΓ؆ૉͳϓϩτίϧͱͳ͍ͬͯΔ.

NIST ͷެืʹ͸ NewHope [2] ͕, ‫ʹޙ‬ඍमਖ਼Λࢪͨ͠ NewHope v1.01 [3] ͕ஶऀΒͷ Web ϖʔδͰެ։͞Ε͍ͯΔ. ද 2.5 ʹ‫ͳͱૅج‬Δ NewHope-CPA-PKE ͷ֓ཁΛड़΂Δ. ࣮ࡍͷϓϩτίϧʹ͸Ϗοτྻ΁ͷΤϯίʔυɾσίʔυͷؔ਺͕‫·ؚ‬Ε͍ͯΔ͕, ͜͜Ͱ͸লུͯ͋͠Δ. શͯͷԋࢉ͸‫ ؀‬Rq := Zq [x]/(xn + 1) ্ͷଟ߲ࣜͷૢ࡞ͱͯ͠ද‫͞ݱ‬Ε, ܎਺͸ࣗಈతʹ۠ؒ [−q/2, q/2) ಺ʹऩΊΒΕΔ΋ͷͱ͢Δ.
ํࣜͷಛ௃ͱͯ͠, ‫Ͱ؀‬ͷԋࢉΛߴ଎Խ͢ΔͨΊ, ਺࿦ม‫( ׵‬NTT, Number Theoretic Transform)[3, p. 7-8]

a=

n−1
8
i=0

ai xi ∈ Rq ⇔ NTT(a) :=

n−1
8
i=0

âxi , âi :=n−1
8

γ j aj ω ij(mod q)j=0Λߦ͍, a, b ∈ Rq ͷੵ͕ a ∗ b = NTT−1 (NTT(a) ◦ NTT(b)) Λຬͨ͢͜ͱΛར༻͍ͯ͠Δ. ͜͜Ͱ, ω ͸ 1 ͷ Zq Ͱͷn ৐ࠜ, γ :=√w (mod q) ͱ͠, ࣮૷࣌ʹ͸͋Β͔͡Ίఆ਺ͱͯ͠૊ΈࠐΜͰ͓͘΋ͷͱ͢Δ. ·ͨ, ‫ ◦ ߸ه‬͸ଟ߲ࣜͷ੒෼ಉ࢜ͷੵΛऔΔ͜ͱΛද͢. ࣮૷Ͱ͸্ͷఆٛࣜΛͦͷ··‫ͣͤࢉܭ‬, ߴ଎਺࿦ม‫׵‬Λ༻͍͍ͯΔ.

‫ݤ‬ੜ੒ͷεςοϓ 1 Ͱ͸, 32 όΠτ (=256 Ϗοτ) ͷཚ਺Λ SHAKE-256 ϋογϡؔ਺Λ༻͍ͯ 64 όΠτʹ৳௕͠, ͦͷલ൒Λެ։‫ ݤ‬â ∈ Rq ͷੜ੒ʹ, ‫ޙ‬൒Λൿີ‫ ݤ‬ŝ ͓ΑͼϊΠζ ê ͷੜ੒ʹ࢖͍ͬͯΔ. ͜ͷͱ͖, â, ŝ, ê ͸਺࿦ม‫ޙ׵‬ͷ‫֨Ͱࣜܗ‬ೲ͞ΕΔ. εςοϓ 2 ͷ GenA ؔ਺͸, ϋογϡؔ਺ͷग़ྗͷલ൒ z[0 : 31] Λγʔυͱͯ͠ϥϯμϜͳ Rq ͷ‫ݩ‬Λੜ੒͢Δ΋ͷͰ͋Δ. â ͕ϥϯμϜͳଟ߲ࣜͷ਺࿦ม‫͋Ͱ׵‬Δ͜ͱ͸, ϥϯμϜଟ߲ࣜͷ਺࿦ม‫ͨ·͕׵‬ϥϯμϜଟ߲ࣜͱͳΔ͜ͱ͔Βै͏.

18

ද 2.5

NewHope-CPA-PKE ͷ֓ཁ ([3, Algorithm 1-3] ΑΓҰ෦վม) ɹύϥϝʔλn (࣍‫)ݩ‬, q (๏), k (ϊΠζΤϥʔ), γ ∈ Zq (NTT)
Rq := Zq [x]/(xn + 1)‫ݤ‬ੜ੒ KeyGen(1λ ) → (sk, pk)

1: seed ←− {0, 1, . . . , 255}32 , z = SHAKE256(64, seed)//32 όΠτͷ seed Λ 64 όΠτʹ৳௕
2: â = GenA(z[0 : 31]) ∈ Rq
3: s = PolyBitRev(Sample(z[32 : 63], 0)) ∈ Rd ; ŝ = NTT(s)4: e = PolyBitRev(Sample(z[32 : 63], 1)) ∈ Rd ; ê = NTT(e)5: b̂ = â ◦ ŝ + ê
6: sk = ŝ, pk = (â, b̂)҉߸Խ Enc(pk, M ∈ {0, 1, . . . , 255}32 ) → ct

1: coin ←− {0, 1, . . . , 255}32 // ϥϯμϜγʔυɹ
2: s′ = PolyBitRev(Sample(coin, 0)) ∈ Rd ; t̂ = NTT(s′ )3: e′ = PolyBitRev(Sample(coin, 1)) ∈ Rd
4: e′′ ← Sample(coin, 2) ∈ Rd
5: û = â ◦ t̂ + NTT(e′ )6: v = NTT−1 (b̂ ◦ t̂) + e′′ + Encode(M )7: ct = (û, v)
1: M ′ = Decode(v − NTT−1 (û ◦ ŝ))$෮߸ Dec(sk, c = (û, v))

ද 2.6

$

NewHope CPA-KEM ͷύϥϝʔλ [2, Table 3].

҉߸จαΠζ

(n, q, k, γ)҆શੑϨϕϧ

ެ։‫ݤ‬αΠζൿີ‫ݤ‬αΠζฏจαΠζ(512, 12289, 8, 10968)

128 bits

928B

869B

32B

1088B

(1024, 12289, 8, 7)

256 bits

1824B

1792B

32B

2176B

(‫ݤ‬ΧϓηϧԽ‫)ޙ‬

2 ൪໨ͷύϥϝʔλ͸ Category 5 ʹೖΔͱओு͞Ε͍ͯΔ͕ɺද [2, Table 3] Ͱ͸ 233 bit-security ͱॻ͔Ε͍ͯΔ.

εςοϓ 3 ͓Αͼ 4 ͷ, Sample ؔ਺͸ Rq ͷ֤܎਺Λಠཱʹ ψ8 ͔ΒαϯϓϦϯάͨ͠΋ͷͰ͋Γ, ࣗવ਺ k ʹରͯ͠, ψk ͷग़ྗ͸ bi , b′i ∈ {0, 1}, i = 1, 2, . . . , k Λಠཱʹऔͬͨͱ͖ͷ'k′
i=1 (bi − bi ) ͱͯ͠ఆٛ͞ΕΔ. PolyBitRev ؔ'n−1਺͸ଟ߲ࣜ a = i=0 ai xi ʹରͯ͠, ࢦ਺෦෼ΛϏοτ൓సͨ͠ଟ߲ࣜ arev := i=0 ai xBitRev(i) Λग़ྗ͢Δ. ΑΓ۩
'h−1
'h−1
ମతʹॻ͘ͱ, h = log2 (n), i = j=0 bj 2j ͱ 2 ਐ਺ల։ͨ͠ͱ͖ʹ, BitRev(i) := j=0 bj 2h−j−1 Ͱ͋Δ. ࣮૷࣌ʹ'n−1

͸ BitRev Λ͋Β͔͡Ί‫ͨ͠ࢉܭ‬഑ྻΛ༻ҙ͠, ଟ߲ࣜͷ܎਺͕֨ೲ͞Ε͍ͯΔ഑ྻͷཁૉͷೖΕସ͑Λߦ͏͜ͱͰߴ
଎ॲཧ͕ՄೳͰ͋Δ. ߴ଎਺࿦ม‫׵‬Λߦ͏ͱ͖ͷ࣮૷্ͷཁ੥͔Β͋Β͔͡Ίࢦ਺෦෼ͷϏοτ൓సΛߦ͏ඞཁ͕͋Γ,‫ݤ‬ੜ੒͓Αͼ෮߸ΞϧΰϦζ಺Ͱ NTT ؔ਺ͷ௚લʹ͜ΕΛߦ͍ͬͯΔ*5 .
෮߸ΞϧΰϦζϜͷ Decode ؔ਺ͷத਎Λ‫͢ࢉܭ‬Δͱ,v − NTT−1 (û ◦ ŝ) = te + se′ + e′′ + Encode(M ) ∈ Rq
ͱͳΓ, ӈล͕ Encode(M ) + (ϊΠζ߲) ͱͳΔ͜ͱ͕Θ͔Δ. ϊΠζͷӨ‫ڹ‬Λड͚ͣʹ M Λਖ਼͘͠σίʔυՄೳͱ͢ΔͨΊ, Encode ؔ਺͸ 256 Ϗοτͷ M ͷ৘ใΛ n = 1024 ‫ݸ‬ͷ܎਺ʹ෼ࢄ͍ͤͯ͞Δ. ۩ମతʹ͸, 1 ͭͷϏοτͷ৘*5

ैͬͯ, ྫ͑͹‫ݤ‬ੜ੒ΞϧΰϦζϜͷεςοϓ 3 ͸ s ← Sample(z[32 : 63], 0) ∈ Rd ; ŝ = NTT(PolyBitRev(s)) ͱॻ͍ͨํ͕ࣗવ͔΋͠Εͳ͍͕, ‫ݪ‬ஶͷද‫ͨͬैʹݱ‬.

19

ද 2.7

Lizard PKE [21, Section 3.2.1]ύϥϝʔλλ (ηΩϡϦςΟ), n, m, ℓ (࣍‫)ݩ‬, p, q (๏), α, ρ, hr (ϊΠζ෼෍)‫ݤ‬ੜ੒ KeyGen(1λ ) → (sk, pk)

1: A ←− Zqm×n , s1 , s2 , . . . , sℓ ← ZOn (ρ), S = (s1 ||s2 || · · · ||sℓ ) ∈ Zqn×ℓ ,E ← DZLizard
m×ℓ ,αq ɹ
2: B = −AS + E (mod q)
3: sk = S, pk = (A||B)
1: r ← Bm,hr
2: a = ⌊(p/q) · AT r⌉, b = ⌊(p/q) · ((q/2) · m + B T r)⌉// ϕΫτϧʹର͢Δ Rounding ⌊·⌉ ͸੒෼͝ͱʹߦ͏ɹ
3: ct = (a, b) ∈ Zn×1
× Zℓ×1p"# p
2
1: M ′ ←(b + S T a)(mod 2)p$

҉߸Խ Enc(pk, M ∈ {0, 1}ℓ×1 ) → ct

෮߸ Dec(sk, ct) → M ′ใΛ 4 ‫ݸ‬ͷ܎਺ʹׂΓ౰ͯͯΤϯίʔυ͠, Decode ؔ਺಺Ͱ͸ 4 ͭ෼ͷ܎਺ͷ࿨ΛऔΔ͜ͱͰΤϥʔΛଧͪফ͢͜ͱ
Ͱ, ෮߸ͷ੒ޭ֬཰ΛߴΊ͍ͯΔ.

2.3.3 Lizard
Cheon Β [18] ʹΑͬͯ 2016 ೥ʹఏҊ͞Εͨ Lizard ͸ LWE ໰୊ͱ LWR ໰୊ͷࠔ೉ੑΛಉ࣌ʹԾఆ͢Δ͜ͱͰ,IND-CPA ҆શͰ͋Δ͜ͱ͕ূ໌͞ΕΔެ։‫͋Ͱࣜํ߸҉ݤ‬Δ. NIST ʹఏҊ͞Εͨ [21] ‫ޙ‬, ࠃࡍձٞ SCN2018 ʹ͓͍ͯ΋ൃද͞Ε͍ͯΔ [19]. ͜͜Ͱ͸, ‫ج‬ຊతͳެ։‫[ ࣜํ߸҉ݤ‬21, Section 3.2.1] ͷ֓ཁΛ঺հ͢Δ. ্‫ ه‬2 ͭͷํࣜͱ΄΅ಉ༷ʹ, ౻࡚-Ԭຊม‫[ ׵‬26, 27] Λ༻͍ͯ IND-CCA ҆શͳํࣜͱ͢Δ͜ͱ͕Ͱ͖Δ.
ද 2.7 ʹํࣜͷ֓ཁΛࣔ͢. ಺෦Ͱ༻͍ΒΕΔαϒϧʔνϯͱͯ͠, 3 छྨͷཚ਺ੜ੒ϧʔνϯ͕༻͍ΒΕΔ. ‫ݤ‬ੜ੒ͷεςοϓ 1 ʹ͓͚Δ ZO n (ρ) ͸, ֤੒෼Λ Pr[xi = 1] = Pr[xi = −1] = ρ/2, Pr[xi = 0] = 1 − ρ Λຬͨ֬͢཰ม਺

Lizard͔Βಠཱʹऔͬͨ n ࣍‫ྻݩ‬ϕΫτϧΛग़ྗ͢Δؔ਺Ͱ͋Δ. ߦྻ E Λੜ੒͢Δͱ͖ʹ༻͍ΔϊΠζ෼෍ DZ,αq͸, εέʔϧ αq ͷ཭ࢄΨ΢ε෼෍ DZ,αq ͱఆٛ͞Ε͍ͯΔ. ·ͨ, ҉߸Խͷεςοϓ 1 Ͱ༻͍Δ Bm,hr ͸, m ࣍‫ݩ‬ͷྻϕΫτϧͰ, ੒෼ͷ͏ͪ hr ‫ ͕ݸ‬+1 ΋͘͠͸ −1, ࢒Γ͕ 0 ͱͳΔ΋ͷΛҰ༷ϥϯμϜʹαϯϓϦϯάͨ͠΋ͷͱ͢Δ.
෮߸ΞϧΰϦζϜͷεςοϓ 1 ʹ͓͍ͯ, q ≫ p ͷ৔߹ʹ͸

b + ST a ≈

& p
p% T
q
p
A r + · m + BT r = · m + ET rq22q(mod p)͕ͳΓͨͪ, E T r ͕খ͍ͨ͞Ίʹ෮߸͕ߴ֬཰Ͱ੒ޭ͢Δ͜ͱ͕௚‫ײ‬తʹΘ͔Δ.

҆શੑͷࠜ‫ͳͱڌ‬Δ໰୊͸, sparse small secret LWE ͱ‫ݺ‬͹ΕΔ, LWE ໰୊ͷൿີϕΫτϧΛҰ༷෼෍Ͱ͸ͳ͘

ZOn (ρ) ͔ΒऔΔ΋ͷͰ͋Δ͕, ͜ͷ໰୊ͷࠔ೉ੑ͕ (ద౰ͳύϥϝʔλͷม‫ʹ׵‬ΑΓ) ௨ৗͷ LWE ໰୊ͱ౳͍͜͠
ͱ͕ূ໌͞Ε͍ͯΔ [16].

2.3.4 CRYSTALS-Dilithium
CRYSTALS-Dilithium ͸, Ducas ΒʹΑΓఏҊ͞Εͨॺ໊ํࣜͰ, Module-LWE ໰୊ͱ Module-SIS ໰୊ͷࠔ೉ੑΛ҆શੑͷࠜ‫͍ͯ͠ͱڌ‬Δ. ಉ࣌ʹఏҊ͞Εͨ KEM ͱͯ͠, CRYSTALS-KYBER ͕ଘࡏ͢Δ. NIST ΁ͷఏग़ [23]ͱલ‫ͯ͠ޙ‬, Cryptology ePrint Archive [22] ͓Αͼࠃࡍձٞ CHES 2018 ʹ͓͍ͯެ։͞Εͨ൛ [24] ͕ଘࡏ͢Δ͕,͜͜Ͱ͸ NIST ൛ͷུ֓Λ঺հ͢Δ.
ද 2.9 ʹུ֓Λࣔ͢. ԋࢉ͸શͯ‫ ؀‬Rq := Zq [x]/(xn + 1) ͷ্ͰߦΘΕ, ܎਺͸ࣗಈతʹ (− 2q , 2q ] ͷൣғʹऩΊΒΕ

20

ද 2.8

Lizard.CCA ͷύϥϝʔλ [21, p.22-24,31].

(n, m, ℓ, p, q, ρ)҆શੑϨϕϧ

ެ։‫ݤ‬αΠζൿີ‫ݤ‬αΠζฏจαΠζ҉߸จαΠζ

(536, 1024, 256, 512, 2048, 1/2)
(663, 1024, 256, 256, 1024, 1/4)
(816, 1024, 384, 512, 1024, 1/2)
(952, 1024, 384, 512, 2048, 1/4)
(1088, 2048, 512, 1024, 4096, 1/2)
(1300, 2048, 512, 512, 2048, 1/4)

128 bits
128 bits
192 bits
192 bits
256 bits
256 bits[B]
1130496B
1390592B
1720320B
1998848B
4584520B
2727936B[B]
8608B
10640B
19632B
22896B
34880B
41664B

[B]
32B
32B
48B
48B
64B
64B

[B]
17696B
10896B
26928B
31280B
35904B
42688B཭ࢄ Gauss ෼෍Λද‫͢ݱ‬Δύϥϝʔλ α ʹؔͯ͠, ࣮૷࣌ʹ͸ͦͷྦྷੵ෼෍ؔ਺Λۙࣅͨ͠਺දͱͯ͠༩͍͑ͯΔ.

DilithiumΔ΋ͷͱ͢Δ. ϊΠζੜ੒ؔ਺ DR
͸, Rq ͷ‫ݩ‬ͷதͰ܎਺ͷઈର஋͕ η ҎԼͷ΋ͷΛҰ༷ϥϯμϜʹग़ྗ͢Δؔq ,η਺ͱͯ͠ఆٛ͞ΕΔ. ੔਺ a ∈ Zq ͱ γ ʹରͯ͠, HighBits(a, γ), LowBits(a, γ) ؔ਺͸ͦΕͧΕ

a = HighBits(a, γ) · 2γ + LowBits(a, γ), ͨͩ͠ɹ − γ < LowBits(a, γ) ≤ γΛΈͨ͢, ͭ·Γ a Λ্ҐϏοτͱԼҐϏοτʹ੾Γ෼͚Δؔ਺Ͱ͋Δ*6 .
ॺ໊ͷεςοϓ 4 ʹ͓͍ͯެ։‫͔ݤ‬Β෼ղ͞Εͨ w1 ∈ Rqk×1 Λ, ࣍ͷεςοϓʹ͓͍ͯϋογϡؔ਺ H Λ༻͍ͯผͷଟ߲ࣜ c ∈ {ΒऔΒΕΔ.

'n−1i
i=0 ai x } ʹࣸ͢. ͨͩ͠, c ͷ܎਺ ai ͸ |ai | ≤ 1 ͔ͭ |ai | = 1 ͱͳΔ i ͕ 60 ‫ͳͱݸ‬Δ΋ͷͷू߹͔ॺ໊͕ਖ਼͍͠৔߹, ‫ূݕ‬ΞϧΰϦζϜͷεςοϓ 1 ʹ͓͍ͯ, Az − ct = Ay − cs2 ͱͳΔ. cs2 ͸࡞Γํ͔Β܎਺͕খ͍ͨ͞Ί, HighBits(Az − ct, 2γ2 ) = HighBits(Ay, 2γ2 ) ͭ·Γ w1 = w1′ ͕ͳΓͨͪॺ໊͕‫͞ূݕ‬ΕΔ.

҆શੑͷ‫ͳͱڌࠜͱ͞ڧ‬Δ໰୊ͷରԠ͕͍͔ͭٞ͘࿦͞Ε͍ͯΔ [24, Section 4]. ྫ͑͹, ‫ݤ‬ͷ҆શੑͷΈΛٞ࿦͢Δࡍʹ͸ Module-LWE ໰୊ͷࠔ೉ੑͷΈΛԾఆ͢Ε͹ྑ͍͜ͱ͕ࣔ͞Ε͍ͯΔ͕, ॺ໊ͷِ଄ʹؔͯ͠͸ Module-SIS
໰୊͓ΑͼͦͷมछͰ͋Δ SelfTargetModule-SIS ໰୊ͷࠔ೉ੑΛ༻͍Δ.

2.3.5 pqNTRUSignpqNTRUSign ͸, Chen ΒʹΑΔ NIST ΁ͷఏҊ [17] Ͱ͋Γ, ઌߦ͢Δ 2 ͭͷ࿦จ [29, 30] Λϕʔεͱ͍ͯ͠Δ. ࠷ॳʹఏҊ͞Εͨ 2014 ೥൛ [29] ʹ͓͍ͯ͸, ҆શੑূ໌͕໌‫͞ه‬Ε͍ͯͳ͔͕ͬͨ, 2017 ೥൛ [30] Ͱ͸֨ࢠ໰୊ͷҰछͰ͋Δ LWT (Learning with Truncation) ໰୊ͷ‫ٻ‬ղࠔ೉ੑΛॺ໊ͷِ଄ෆՄೳੑͷࠜ‫͓ͯ͠ͱڌ‬Γ, ͦͷ໰୊͕

LWR ໰୊ΑΓ΋೉͍͜͠ͱ͕ࣔ͞Ε͍ͯΔ [30, Section 3.5]. ಉ༷ʹ, ൿີ‫ݤ‬ͷ෮‫ͯؔ͠ʹݩ‬͸ SIS ໰୊΁ͷؐ‫ݩ‬Λߦ͍ͬͯΔ. ࣮ࡍͷύϥϝʔλઃఆ͸, ໰୊Λ uSVP ͷΠϯελϯεʹม‫ ʹޙͨ͠׵‬BKZ 2.0 ʹΑΔධՁ [20, 2] Λߦ͍ͬͯΔ.
·ͨ, 2014 ೥൛ͱ 2017 ೥൛ͷେ͖ͳҧ͍ͱͯ͠, ॺ໊ੜ੒࣌ʹ༻͍Δཚ਺ΛҰ༷෼෍͔Β཭ࢄΨ΢ε෼෍΁ͱมߋ
͢Δ͜ͱͰॺ໊αΠζΛ࡟‫͍ͯ͠ݮ‬Δ఺͕‫͛ڍ‬ΒΕΔ.
ΞϧΰϦζϜͷ֓ཁΛද 2.11 ʹࣔ͢. ΑΓ௚‫ײ‬తͳઆ໌ͱͯ͠, ެ։‫͔ݤ‬Β࡞ΒΕΔ֨ࢠ L Λ༻͍ͯ, ϝοηʔδµ ∈ Znp ʹର͢Δॺ໊ w ͸, v ≡ µ (mod p) Λຬͨ֨͢ࢠϕΫτϧͱΈΔ͜ͱ͕Ͱ͖Δ. ͜ͷؔ܎Λ NTRU ҉߸Λϕʔεʹߏ੒͢ΔͨΊ, ‫ࢉܭ‬Λଟ߲ࣜ‫ ؀‬R = Z[x]/(xn ± 1) ͷ‫*ݩ‬7 ͱͯ͠ߦ͍ͬͯΔ.
*6 ࣮ࡍʹ͸, ҆શੑͷͨΊʹ‫ڥ‬ք஋ʹ͓͚Δ‫ڍ‬ಈ͕ௐ੔͞Ε͍ͯΔ [23, Figure 3]*7ޮ཰తͳ࣮૷ͷͨΊ, ৒༨ଟ߲ࣜ͸ xn + 1 ΋͘͠͸ xn − 1 ͷͲͪΒ͔Ͱ͋Δͱ͍ͯ͠Δ͕, ΞϧΰϦζϜͷఆٛதͰ͸ xn + 1 ͕༻͍ΒΕ
͍ͯΔ.

21

ද 2.9ύϥϝʔλ‫ݤ‬ੜ੒ KeyGen(1λ ) → (sk, pk)

ॺ໊ Sign(sk, M ) → sig

CRYSTALS-Dilithium ॺ໊ํࣜ [23, Figure 1] ΑΓվมn, k, ℓ (࣍‫)ݩ‬, q (๏), η (ϊΠζ)
Rq := Zq [x]/(xn + 1)
Dilithium
Dilithium
1: s1 ← DR
, s 2 ← DR
ℓ×1
k×1
,η
,η
q

q

$

2: A ←− Rqk×ℓ
3: t = As1 + s2 ɹɹ
4: sk = (A, t, s1 , s2 ), pk = (A, t)
1: z ←⊥
2: while z =⊥ do
Dilithium3:y ← DR
ɹ
ℓ×1
,γ −1
q

1

4:
w1 ← HighBits(Ay, 2γ2 )5:c = H(M ||w1 ); z ← y + cs1
6:
if (∥z∥∞ ≥ γ1 − β) OR (∥LowBits(Ay − cs2 , 2γ2 )∥∞ ≥ γ2 − β) then: z =⊥7: sig ← (z, c)
1: w1′ = HighBits(Az − ct, 2γ2 )2: if (∥z∥∞ < γ1 − β) AND (c = H(M ||w1′ )) then accept else reject‫ ূݕ‬Verify(pk, M, sig)

ද 2.10CRYSTALS-Dilithium ॺ໊ํࣜͷύϥϝʔλ [23](n, k, ℓ, q, η)҆શੑϨϕϧ

ެ։‫ݤ‬αΠζൿີ‫ݤ‬αΠζॺ໊αΠζ(256, 4, 3, 8380417, 6)

128 bits

1184B

-

2044B

(256, 5, 4, 8380417, 5)

192 bits

1472B

-

2701B

(256, 6, 5, 8380417, 3)

256 bits

1760B

-

3366B

‫ݤ‬ੜ੒ΞϧΰϦζϜͷεςοϓ 1 ͓Αͼ 2 Ͱ͸, ‫غ‬٫αϯϓϦϯάΛ༻͍ͯ NORMF(·) ͷେ͖͘ͳ͍ଟ߲ࣜΛੜ੒
͢Δ. ͜͜Ͱ, ଟ߲ࣜ f (x) ∈ R ʹରͯ͠ NORMF(f ) ͸ଟ߲ࣜ t =͢Δ maxi |ti | ͱͯ͠ఆٛ͞ΕΔ.

'n−1

i=0 ti x

i

:=

'n−1

i
i=0 x f (x)(mod xn + 1) ʹରॺ໊ΞϧΰϦζϜʹ͓͍ͯ, ೖྗϝοηʔδ M ͷ‫͓ࣜܗ‬Αͼϋογϡؔ਺͸ಛʹࢦఆ͞Ε͓ͯΒͣ*8 , ͦͷग़ྗΛద੾ʹ 2 ͭͷଟ߲ࣜ up , vp ∈ Rq ʹຒΊࠐΉ͜ͱ͕Ͱ͖Ε͹ྑ͍ߏ଄ͱͳ͍ͬͯΔ.
pqNTRUSignεςοϓ 2 ͷ DRq ,σؔ਺͸, ֤܎਺Λ෼ࢄ͕ σ 2 ͱͳΔ཭ࢄΨ΢ε෼෍͔Βಠཱʹऔͬͨଟ߲ࣜ r Λग़ྗ͢Δ.

εςοϓ 5, 7 ͓Αͼ 8 ʹ͓͍༷ͯʑͳ‫Ͱܗ‬εΫϦʔχϯά͞Εͨ‫ʹޙ‬, ॺ໊ sig ͕ग़ྗ͞ΕΔ͕, ͜ΕΒͷ৚݅͸‫ূݕ‬࣌ͷΤϥʔ཰ΛԼ͛ΔͨΊʹߦΘΕ͍ͯΔ.

2.4 ·ͱΊ֨ࢠʹ‫ٕ߸҉ͮ͘ج‬ज़͸, LWE ໰୊, Ring-LWE ໰୊, NTRU ໰୊Λ҆શੑͷࠜ‫͢ͱڌ‬Δํ͕ࣜ͜Ε·Ͱ਺ଟ͘ఏ
Ҋ͞Ε, NIST PQC ϓϩδΣΫτͷީิ҉߸Ͱ͸࠷΋ଟ͘ͷ҉߸͕͜ͷΧςΰϦʔʹ෼ྨ͞Ε͍ͯΔ.
֨ࢠʹ‫ٕ߸҉ͮ͘ج‬ज़ͷ҆શੑͷࠜ‫ͳͱڌ‬Δ໰୊ͱͯ͠͸ɺ্‫ه‬Ҏ֎ʹ΋ Compact LWE ໰୊, Module-LWE ໰୊,

LWR (Learning With Rounding) ໰୊, BDD (Bounded Distance Decoding) ໰୊, SIS (Small Integer Solution) ໰୊ଞ, ଟ͘ͷόϦΤʔγϣϯ͕ଘࡏ͍ͯ͠Δ. Ұൠతͳ֨ࢠ໰୊Λղ͘ख๏ͱͯ͠͸, LLL ΞϧΰϦζϜ, BKZ Ξϧΰ*8 Reference Implementation Ͱ͸, ηΩϡϦςΟϨϕϧʹԠͨ͡௕͞ͷ SHA ΞϧΰϦζϜΛ༻͍͍ͯΔ.

22

ද 2.11

pqNTRUSign ॺ໊ํࣜ (཭ࢄ Gauss ෼෍ΛϊΠζͱͯ͠༻͍ͨόʔδϣϯ) [17, Algorithm 1-3]

ύϥϝʔλ

‫ݤ‬ੜ੒

KeyGen(1λ ) → (sk, pk)

ॺ໊ Sign(sk, M ) → sig‫ ূݕ‬Verify(pk, M, sig)

N (࣍‫ )ݩ‬p, q⎧(๏) d, s (ϊΠζ) Bk (‫ݤ‬ଟ߲ࣜͷϊϧϜͷ্ք)⎫⎪⎪ai ∈ {−1, 0, 1} ⎬⎨(NiT (d1 , d2 ) =i=0 ai x : number of + 1 is d1⎪⎪⎩⎭
number of − 1 is d2
1: mod q ͰՄ‫ ͔ͭٯ‬NORMF(f ) < Bk ΛΈͨ͢‫ ݩ‬f Λ T (d + 1, d) ͔ΒҰ༷ʹαϯϓϦϯά
2: mod q ͰՄ‫ ͔ͭٯ‬NORMF(g) < Bk ΛΈͨ͢‫ ݩ‬f Λ T (d + 1, d) ͔ΒҰ༷ʹαϯϓϦϯά
h = h/(p · f ) (mod q)
sk = (p · f, g), pk = h
1: (up , vp ) = H(M ||h)$pqNTRUSign
2: r ← DR, b ←− {0, 1}
q ,σ3: u1 = p · r + up ; v1 = u1 h (mod q)
4: a ← (vp − v1 ) · g −1 (mod p)
5: if (∥a · f ∥2 > Bs ) OR (∥a · g∥∞ > Bt ) goto step 2
6: v ← v1 + (−1)b ag
7: if (∥v∥∞ > q/2 − Bt ) goto step 2
8: return sig = r + (−1)b a · f with probability 1/(Ms exp(−∥a · f ∥/2σ 2 ) cosh(⟨b, a · f ⟩/σ 2 )9: goto step 2
1: (up , vp ) = H(M ||h)2: u = pB + up
3: if (∥u∥2 > p2 s2 N ) then reject
4: v = uh (mod q)
5: if (v ̸≡ vp (mod p)) OR (∥v∥∞ > q/2 − Bt ) then reject
6: accept

ද 2.12

pqNTRUSign ॺ໊ํࣜͷύϥϝʔλ [17].

(N, q, d, σ)҆શੑϨϕϧ

ެ։‫ݤ‬αΠζൿີ‫ݤ‬αΠζॺ໊αΠζ(1024, 216 + 1, 205, 250)

256 bits

2048B

-

1408B

จ‫[ ݙ‬17] ʹ͸ “For all 5 NIST’s required security levels, we suggest the use of Gaussian-1024 or Uniform-1024

parameter sets.” ͱ͋Γ, 1 ͭͷύϥϝʔληοτͰશͯͷΧςΰϦΛ‫ؚ‬Ή‫Ͱܗ‬༩͑ΒΕ͍ͯΔ.

ϦζϜ͕Α͘஌ΒΕ͓ͯΓ, LWE ໰୊ʹ͍ͭͯ͸ߋʹ SIS ໰୊΍ BDD ໰୊ʹؐ‫͢ݩ‬Δղੳख๏͕஌ΒΕ͍ͯΔɻ
֨ࢠ໰୊ͷࠔ೉ੑΛϕʔεͱͨ͠҉߸ํࣜͰ࠷ॳͷ΋ͷ͸, Ajtai[1] ʹΑΓ 1996 ೥ʹߦΘΕͨ, SIS ໰୊͕֨ࢠ໰
୊ͷ࠷ѱ࣌ΑΓ΋ࠔ೉Ͱ͋Δ͜ͱͷূ໌͓ΑͼͦΕΛ༻͍ͨ҉߸ֶతϋογϡؔ਺ͷߏ੒Ͱ͋Δ. ·ͨ, 1997 ೥ʹ͸Ajtai ͱ Dwork[8] ʹΑΓ, unique SVP ͷ࠷ѱࠔ೉ੑΛ҆શੑͷࠜ‫ެͨ͠ͱڌ‬։‫͕߸҉ݤ‬ఏҊ͞Ε͍ͯΔ. ͜ͷެ։‫ݤ‬҉߸ํࣜ͸ཌ೥, Nguyen ΒʹΑΔղಡ࣮‫[ ݧ‬37] ʹΑΓඞཁͳύϥϝʔλ͕௕େͱͳΓ࣮༻తͰͳ͍͜ͱ͕໌Β͔ʹ͞Εͨ΋ͷͷ, ͦͷ‫ޙ‬ͷ֨ࢠ҉߸ͷߏ੒ͷ‫͍ͯͬͳͱૅج‬Δ.

1996 ೥ʹ Hoﬀstein ΒʹΑͬͯఏҊ͞Εͨ NTRU ҉߸ [28]*9 ͸, ൃද౰ॳ҆શੑূ໌͕෇͚ΒΕ͓ͯΒͣ, ߈ܸͱमਖ਼͕‫܁‬Γฦ͞Ε͍͕ͯͨ, 2011 ೥ Stehlé Β [46] ʹΑΓํࣜΛमਖ਼͢Δ͜ͱͰΠσΞϧ֨ࢠ্ͷ໰୊ͷࠔ೉ੑʹؐ‫ݩ‬Մೳͳ͜ͱ͕ࣔ͞Ε͍ͯΔ. ҰํͰ, 2016 ೥ʹ͸ subfield attack[4] ͷΑ͏ͳମͷߏ଄Λ࢖ͬͯ֨ࢠͷ࣍‫ݩ‬Λѹॖ͢Δ*9จ‫্ݙ‬͸ 1998 ೥ͷࠃࡍձٞ ANTS ͕ͩ, ॳग़͸ CRYPTO1996 ͷ Rump Session Ͱ͋Δ.

23

߈ܸ΋ఏҊ͞Ε͓ͯΓ, ҉߸ͷߏ੒ͷͨΊʹ͸࣍‫ݩ‬΍๏ͷେ͖͚ͩ͞Ͱͳ͘, ‫؀‬ɾମͷߏ଄ʹ΋஫ҙΛ෷͏ඞཁ͕͋Δ.

2005 ೥ʹ Regev[40] ʹΑΓఏҊ͞Εͨ LWE ໰୊͸, ࿦จൃදͱಉ࣌ʹͦΕΛ҉߸ͷ҆શੑࠜ‫ͯ͠ͱڌ‬อো͢Δॏ
ཁͳࡾͭͷੑ࣭͕ࣔ͞Εͨ. ͻͱͭ͸໰୊ͷ average-case to worst case reduction, ͭ·ΓύϥϝʔλΛ‫ݻ‬ఆͨ͠ࡍ,໰୊ͷ (ൿີϕΫτϧ s ʹؔ͢Δ) ฏ‫ۉ‬తͳ‫͕ྔࢉܭ‬, ࠷ѱ‫( ྔࢉܭ‬೉͍͠ΠϯελϯεΛੜ੒͢ΔΑ͏ͳ s ͷू߹ʹର͢Δ‫ߴͱ )ྔࢉܭ‬ʑଟ߲ࣜഒͷҧ͍͔͠ແ͍͜ͱͰ͋Γ, ࢒Γͷೋͭ͸൑ఆ LWE ͱ୳ࡧ LWE ͷ౳Ձੑ, ͓ΑͼྔࢠΞϧΰϦζϜʹΑΔࠔ೉ͳ֨ࢠ໰୊΁ͷؐ‫͋Ͱݩ‬Δ. ͜ΕΒͷఆཧΛ૊Έ߹ΘͤΔ͜ͱʹΑΓ, Regev ࣗ਎ʹΑΓఏҊ͞Εͨެ։‫߸҉ݤ‬Λղಡ͢Δ͜ͱ͕ฏ‫ۉ‬తʹ೉͍͜͠ͱ͕ࣔ͞Ε, ͦͷ‫ޙ‬ͷ༷ʑͳ LWE ϕʔε҉߸ͷߏ੒ͷ‫ͨͬͳૅج‬.

LWE ֨ࢠ໰୊΁ͷؐ‫ͯؔ͠ʹݩ‬, 2013 ೥ʹ͸‫ݹ‬య‫ʹػࢉܭ‬ΑΔؐ‫ݩ‬΋ࣔ͞Ε͍ͯΔ [13].
LWE ໰୊ͷܽ఺Ͱ͋Δ‫ݤ‬αΠζͷେ͖͞Λվળ͢ΔͨΊ, 2010 ೥ʹ͸ Lyubashevsky Β [34, 35] ʹΑΓ Ring-LWE
໰୊͕, 2015 ೥ʹ͸ Langlois Β [36] ʹΑΓ Module-LWE ໰୊͕҉߸Խํࣜͱಉ࣌ʹఏҊ͞Ε, LWE ໰୊ʹ͓͚Δؔ
܎ͱྨࣅͷ, ղಡͷฏ‫ۉ‬తͳࠔ೉͕͞ূ໌͞Ε͍ͯΔ. ҰํͰ, ͜ΕΒͷมछͱΦϦδφϧͷ LWE ໰୊ͱͷؔ܎ੑ͸ࣗ໌Ͱ͸ͳ͘, ಉఔ౓ͷ೉͠͞Λ͔࣋ͭͲ͏͔͸ະղܾ໰୊Ͱ͋Δ. Ұൠతʹ Ring(Module)-LWE ໰୊ͷΠϯελϯ
ε͸ LWE ໰୊ͷΠϯελϯεͱͯ͠ॻ͖ͳ͓͢͜ͱ͕Ͱ͖ΔͨΊ, LWE ໰୊͸ Ring(Module)-LWE ໰୊ΑΓ΋ࠔ
೉Ͱ͋Δͱ͍͏ؔ܎͸ࣗ໌Ͱ͋Δ͕, ‫ٯ‬ͷؔ܎͸஌ΒΕ͍ͯͳ͍. ๏ q ͕େ͖͍৔߹ʹ͸, Ring-LWE ͸ Module-LWE
ΑΓ΋ࠔ೉Ͱ͋Δ͜ͱ͕஌ΒΕ͍ͯΔ [7].
࣮૷࣌ͷ໰୊ͱͯ͠, ཭ࢄ Gauss ෼෍Λਖ਼֬ʹੜ੒͢Δ͜ͱ͸೉͍͠. ϊΠζΛ͋Δ੔਺͔۠ؒΒҰ༷෼෍ͱͯ͠
औͬͨ৔߹Ͱ΋, ֨ࢠ໰୊΁ͱྔࢠ‫ؼ‬ண͕ՄೳͰ͋Δ͜ͱ͕ 2013 ೥ʹ Döttling Β [25] ʹΑΓࣔ͞Εͨ. ͜ͷํ޲ੑͷ‫ͯ͠ͱڀݚ‬, Bai Β [12] ʹΑΓఏҊ͞Εͨ, Rényi ΤϯτϩϐʔΛ༻͍ͨ, ཧ૝తͳ Gauss ෼෍Λ༻͍ͨ҉߸ํࣜͱͦ
ΕΛۙࣅతͳ෼෍ʹஔ͖‫ࣜํͨ͑׵‬ͷؒͰͷ҆શੑͷ௿ԼΛٞ࿦͢Δ΋ͷ͕͋Δ.
·ͨ, ύϥϝʔλઃఆख๏ʹؔͯ͠ 2016 ೥ΑΓ҉߸ղಡίϯςετ LWE Challenge[50] ͕։࠵͞Ε͍ͯΔ.
͜ΕΒͷ֨ࢠʹ‫ٕ߸҉ͮ͘ج‬ज़ͷ҆શੑͷࠜ‫ͳͱڌ‬Δ໰୊͸, ‫ݹ‬య‫ػࢉܭ‬ɾྔࢠ‫ػࢉܭ‬ͷ͍ͣΕʹ͓͍ͯ΋‫Ͱ఺࣌ݱ‬ޮ཰తͳղಡख๏͸‫͍ͳ͍͔ͯͬͭݟ‬.

24

ୈ 2 ষͷࢀߟจ‫ݙ‬[1] M. Ajtai, Generating hard instances of lattice problems, Proceedings of the Twenty-Eighth Annual ACM
Symposium on the Theory of Computing, pp. 99-108, 1996.
[2] E. Alkim, R. Avanzi, J. Bos, L. Ducas, A. de la Piedra, T. Pöppelmann, P. Schwabe, D. Stebila,
NewHope Algorithm Specifcations, and Supporting Documentation, https://newhopecrypto.org/data/
NewHope 2017 12 21.pdf[3] E. Alkim, R. Avanzi, J. Bos, L. Ducas, A. de la Piedra, T. Pöppelmann, P. Schwabe, D. Stebila, NewHope
Algorithm Specifications, and Supporting Documentation (Version 1.01), Updated December 2, 2018, https://newhopecrypto.org/data/NewHope 2018 12 02.pdf[4] M. Albrecht, S. Bai, L. Ducas, A subfield lattice attack on overstretched NTRU assumptions, Advances in
Cryptology – CRYPTO 2016 – 36th Annual International Cryptology Conference, Part I, Springer LNCS
vol. 9814, pp. 153-178, 2016.
[5] Y. Aono, X. Boyen, L. T. Phong, L Wang, Key-private proxy re-encryption under LWE, Progress in Cryptology – INDOCRYPT 2013 – 14th International Conference on Cryptology in India, Springer LNCS vol.
8250, pp. 1-18, 2013.
[6] M. R. Albrecht, B. R. Curtis, A. Deo, A. Davidson, R. Player, E. W. Postlethwaite, F. Virdia, T. Wunderer,
Estimate all the {LWE, NTRU} schemes!(2018), Security and Cryptography for Networks – 11th International
Conference, Springer LNCS vol. 11035, pp. 351-367, 2018.

[7] M. Albrecht, A. Deo, Large modulus Ring-LWE ≥ Module-LWE, Advances in Cryptology – ASIACRYPT

2017 – 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Part I, Springer LNCS vol. 10624, pp. 267-296, 2017.

[8] M. Ajtai, C. Dwork, A public-key cryptosystem with worst-case/average-case equivalence, Proceedings of theTwenty-Ninth Annual ACM Symposium on the Theory of Computing, pp. 284-293, 1997.
[9] E. Alkim, L. Ducas, T. Pöppelmann, P. Schwabe, NewHope without reconciliation, Cryptology ePrint
Archive, Report 2016/1157.
[10] E. Alkim, L. Ducas, T. Pöppelmann, P. Schwabe, Post-quantum key exchange – A New Hope, the 25th
USENIX Security Symposium, pp. 327-343, 2016.
[11] L. G. Bruinderink, A. Hülsing, T. Lange, Y. Yarom, Flush, gauss, and reload – A cache attack on the
BLISS lattice-based signature scheme, Cryptographic Hardware and Embedded Systems – CHES 2014 – 16th
International Workshop, Springer LNCS vol. 9813, pp. 323-345, 2016.
[12] S. Bai, T. Lepoint, A. R.-Langlois, A. Sakzad, D. Stehlé, R. Steinfeld, Improved security proofs in latticebased cryptography: Using the Rényi divergence rather than the statistical distance, Journal of Cryptology,

25

vol. 31, Iss. 2, pp. 610-640, 2018.
[13] Z. Brakerski, A. Langlois, C. Peikert, O. Regev, D. Stehlé, Classical hardness of learning with errors, Symposium on Theory of Computing Conference, STOC’13, pp. 575-584, 2013.
[14] A. Banerjee, C. Peikert, A. Rosen, Pseudorandom functions and lattices, Advances in Cryptology – EUROCRYPT 2012 – 31st Annual International Conference on the Theory and Applications of Cryptographic
Techniques, Springer LNCS vol. 7237, pp. 719-737, 2012.
[15] Z. Brakerski, V. Vaikuntanathan, Fully homomorphic encryption from ring-LWE and security for key dependent messages, Advances in Cryptology – CRYPTO 2011 – 31st Annual Cryptology Conference, Springer
LNCS vol. 6841, pp. 505-524, 2011.
[16] J. H. Cheon, K. Han, J. Kim, C. Lee, Y. Son, A practical post-quantum public-key cryptosystem based on
spLWE, Information Security and Cryptology – ICISC 2016 – 19th International Conference, Springer LNCS
vol. 10157, pp. 51-74.
[17] C. Chen, J. Hoﬀstein, W. Whyte, Z. Zhang, NIST PQ Submission: pqNTRUSign A modular lattice signaturescheme, https://csrc.nist.gov/CSRC/media/Projects/Post-Quantum-Cryptography/documents/round-1/submissions/pqNTRUsign.zip[18] J. H. Cheon, D. Kim, J. Lee, Y. Song, Lizard: Cut oﬀ the Tail! A Practical Post-Quantum Public-Key
Encryption from LWE and LWR, Cryptology ePrint Archive, Report 2016/1126.
[19] J. H. Cheon, D. Kim, J. Lee, Y. Song, Lizard: Cut oﬀ the Tail! A Practical Post-Quantum Public-Key
Encryption from LWE and LWR, Security and Cryptography for Networks – 11th International Conference,
Springer LNCS vol. 11035, pp. 160-177, 2018.
[20] Y. Chen, P. Q. Nguyen, BKZ 2.0: Better lattice security estimates, Advances in Cryptology – ASIACRYPT
2011 – 17th International Conference on the Theory and Application of Cryptology and Information Security,
Springer LNCS vol. 7073, pp. 1-20.
[21] J. H. Cheon, S. Park, J. Lee, D. Kim, Y. Song, S. Hong, D. Kim, J. Kim, S.-M. Hong, A. Yun, J. Kim, H. Park,E. Choi, K. kim, J.-S. Kim, J. Lee Lizard Public Key Encryption Submission to NIST proposal, Algorithm
specification, https://csrc.nist.gov/CSRC/media/Projects/Post-Quantum-Cryptography/documents/r
ound-1/submissions/Lizard.zip[22] L. Ducas, E. Kiltz, T. Lepoint, V. Lyubashevsky, P. Schwabe, G. Seiler, D. Stehlé, CRYSTALS – Dilithium:
Digital Signatures from Module Lattices, Cryptology ePrint Archive, Report 2017/633.
[23] L. Ducas, E. Kiltz, T. Lepoint, V. Lyubashevsky, P. Schwabe, G. Seiler, D. Stehlé, CRYSTALS-Dilithium
Algorithm Specifications and Supporting Documentation, https://csrc.nist.gov/CSRC/media/Projects/Post-Quantum-Cryptography/documents/round-1/submissions/CRYSTALS Dilithium.zip[24] L. Ducas, E. Kiltz, T. Lepoint, V. Lyubashevsky, P. Schwabe, G. Seiler, D. Stehlé, CRYSTALS – Dilithium:
Digital Signatures from Module Lattices, IACR Trans. Cryptogr. Hardw. Embed. Syst., 2018(1), pp. 238-268,
2018.
[25] N. Döttling, J. M.-Quade, Lossy codes and a new variant of the learning-with-errors problem, Advances in
Cryptology – EUROCRYPT 2013 – 32nd Annual International Conference on the Theory and Applicationsof Cryptographic Techniques, Springer LNCS vol. 7881, pp. 18-34, 2013.
[26] E. Fujisaki, T. Okamoto, Secure integration of asymmetric and symmetric encryption schemes, Advances in
Cryptology – CRYPTO ’99, 19th Annual International Cryptology Conference, Springer LNCS vol. 1666, pp.
26

537-554, 1999.
[27] E. Fujisaki, T. Okamoto, Secure integration of asymmetric and symmetric encryption schemes, Journal of Cryptology, vol.26, No.1, pp. 80-101, 2013.
[28] J. Hoﬀstein, J. Pipher, J. H. Silverman, NTRU: A ring-based public key cryptosystem, Algorithmic Number
Theory, Third International Symposium, ANTS-III, Springer LNCS vol. 1423, pp. 267-288, 1998.
[29] J. Hoﬀstein, J. Pipher, J. M. Schanck, J. H. Silverman, W. Whyte, Transcript secure signatures based on
modular lattices, Post-Quantum Cryptography – 6th International Workshop, Springer LNCS vol. 8772, pp.
142-159, 2014.
[30] J. Hoﬀstein, J. Pipher, W. Whyte, Z. Zhang, A signature scheme from learning with truncation, Cryptology
ePrint Archive, Report 2017/995.
[31] A. K. Lenstra, H. W. Lenstra, L. Lovász, Factoring polynomials with rational coeﬃcients, Mathematische
Annalen, 261(4), pp. 515-534, 1982.
[32] K. Lauter, M. Naehrig, V. Vaikuntanathan, Can homomorphic encryption be practical?, ACM workshop on
Cloud computing security workshop–CCSW 2011, ACM, pp. 113-124, 2011.
[33] R. Lindner, C. Peikert, Better Key sizes (and attacks) for LWE-Based encryption, Topics in Cryptology –CT-RSA 2011 – The Cryptographers’ Track at the RSA Conference 2011, Springer LNCS vol. 6558, pp.
319-339.
[34] V. Lyubashevsky, C. Peikert, O. Regev, On ideal lattices and learning with errors over rings, Advances in
Cryptology – EUROCRYPT 2010 – 29th Annual International Conference on the Theory and Applicationsof Cryptographic Techniques, Springer LNCS vol. 6110, pp. 1-23, 2010.
[35] V. Lyubashevsky, C. Peikert, O. Regev, On ideal lattices and learning with errors over rings, Journal of theACM, Vol. 60, Iss. 6, pp. 1-35, 2013.
[36] A. Langlois, D. Stehlé, Worst-case to average-case reductions for module lattices, Designs, Codes and Cryptography, Vol. 75, Iss. 3, pp. 565-599, 2015.
[37] P. Q. Nguyen, J. Stern, Cryptanalysis of the Ajtai-Dwork cryptosystem, Advances in Cryptology – CRYPTO’98, 18th Annual International Cryptology Conference, Springer LNCS vol. 1462, pp. 223-242, 1998.
[38] L. T. Phong, T. Hayashi, Y. Aono, S. Moriai, LOTUS specification https://csrc.nist.gov/CSRC/media/
Projects/Post-Quantum-Cryptography/documents/round-1/submissions/LOTUS.zip[39] C. Peikert, V. Vaikuntanathan, B. Waters, A framework for eﬃcient and composable oblivious transfer,
Advances in Cryptology – CRYPTO 2008, 28th Annual International Cryptology Conference, Springer LNCS
vol. 5157, pp. 554-571, 2008.
[40] O. Regev, On lattices, learning with errors, random linear codes, and cryptography, Proceedings of the 37th
Annual ACM Symposium on Theory of Computing, pp. 84-93.
[41] O. Regev, On lattices, learning with errors, random linear codes, and cryptography, Journal of the ACM,
Vol. 56, Iss. 6, pp. 1-40, 2009.
[42] O. Regev, The Learning with Errors Problem, https://cims.nyu.edu/~regev/papers/lwesurvey.pdf[43] O. Regev, The learning with errors problem (invited survey), Proceedings of the 25th Annual IEEE Conference on Computational Complexity, CCC 2010, pp. 191-204, 2010[44] M. Roşca, A. Sakzad, D. Stehlé, R. Steinfeld, Middle-product learning with errors, Advances in Cryptology- CRYPTO 2017 - 37th Annual International Cryptology Conference, Part III, Springer LNCS vol. 10403,
27

pp. 283-297, 2017.
[45] C. P. Schnorr, M. Euchner, Lattice basis reduction: Improved practical algorithms and solving subset sum
problmes, Mathematical programming, 66, pp. 181-199, 1994.
[46] D. Stehlé, R. Steinfeld, Making NTRU as secure as worst-case problems over ideal lattices, Advances in
Cryptology – EUROCRYPT 2011 – 30th Annual International Conference on the Theory and Applicationsof Cryptographic Techniques, Springer LNCS vol. 6632, pp. 27-47, 2011.
[47] D. Stehlé, R. Steinfeld, Making NTRUEncrypt and NTRUSign as secure as standard worst-case problems
over ideal lattices, Cryptology ePrint Archive, Report 2013/004.
[48] D. Stehlé, R. Steinfeld, K. Tanaka, K. Xagawa, Eﬃcient public key encryption based on ideal lattices,
Advances in Cryptology – ASIACRYPT 2009 – 15th International Conference on the Theory and Applicationof Cryptology and Information Security, Springer LNCS vol. 5912, pp. 617-635, 2009.
[49] N. P. Smart, F. Vercauteren, Fully homomorphic SIMD operations, Designs, Codes and Cryptography, Vol,
71, Iss. 1, pp. 57?81, 2014.
[50] TU Darmstadt UC San Diego, LWE Challenge, https://www.latticechallenge.org/lwe challenge/challenge.php

28

ୈ3ষ

ූ߸ʹ‫ٕ߸҉ͮ͘ج‬ज़ຊষͰ͸ූ߸ʹ‫ٕ߸҉ͮ͘ج‬ज़ʹ͍ͭͯ·ͱΊΔ. ූ߸ʹ‫ٕ߸҉ͮ͘ج‬ज़ͷ҆શੑ͸γϯυϩʔϜ෮߸໰୊Λղ͘‫ܭ‬ࢉͷࠔ೉ੑʹґଘ͍ͯ͠Δ.
˙४උ:ຊষͰ࢖༻͢Δ‫߸ه‬ɾ༻‫ޠ‬ΛҎԼʹ·ͱΊΔ. ҎԼͰ͸, q Λૉ਺ p ͷႈͱ͢Δ.

༗‫ݶ‬ମ:

Fq ͰҐ਺͕ q ͷ༗‫ݶ‬ମΛද͢.

ϋϛϯάॏΈͱϋϛϯά‫཭ڑ‬:Vn Λ༗‫ݶ‬ମ Fqm ্ͷ n ࣍‫ݩ‬ϕΫτϧۭؒͱ͢Δ.

• ϕΫτϧ v = (v1 , v2 , . . . , vn ) ∈ Vn ͷϋϛϯάॏΈͱ͸, ඇθϩͷ܎਺ͷ਺Ͱ͋Δ. ͢ͳΘͪ, HW(v) =#{vi | vi ̸= 0}.

• ϋϛϯά‫཭ڑ‬Λ dH (x, y) = HW(x − y) Ͱఆٛ͢Δ.

• SH (n, t) ͰϋϛϯάॏΈ͕ t ͷ n ࣍‫ݩ‬ϕΫτϧશମͷू߹Λද͢.

ϥϯΫॏΈͱϥϯΫ‫཭ڑ‬:Vn Λ༗‫ݶ‬ମ Fqm ্ͷ n ࣍‫ݩ‬ϕΫτϧۭؒͱ͠, β = (β1 , β2 , . . . , βm ) Λ Fqm ͷ Fq -‫ج‬ఈͱ͢Δ. fi : Fqm → Fq Λ, x ∈ Fqm ʹରͯ͠, fi (x) Λ‫ج‬ఈ β ͷԼͰͷ i ൪໨ͷ܎਺ͱ͢Δ. v =(v1 , v2 , . . . , vn ) ∈ Vn ʹରͯ͠, ߦྻ v̄ ∈ Mm,n (Fq ) Λ, v̄ij = fi (vj ) Ͱఆٛ͢Δ.

• ϕΫτϧ v ͷϥϯΫॏΈͱ͸, ରԠ͢Δߦྻ v̄ ͷϥϯΫ rank(v̄) Ͱఆٛ͞ΕΔ.
• ϥϯΫ‫཭ڑ‬Λ dR (x, y) = rank(x − y) Ͱఆٛ͢Δ.

• SR (n, t) ͰϥϯΫॏΈ͕ t ͷ n ࣍‫ݩ‬ϕΫτϧશମͷू߹Λද͢.

3.1 ූ߸ʹ‫ٕ߸҉ͮ͘ج‬ज़ͷ҆શੑͷࠜ‫ͳͱڌ‬Δ໰୊
ຊઅͰ͸ Learning Parity with Noise ʢLPNʣ ໰୊΍ූ߸ʹؔ࿈͢Δ໰୊ͷࠔ೉ੑʹ͍ͭͯௐࠪ݁ՌΛड़΂Δ.

3.1.1 LPN ໰୊ͱ͸
LPN ໰୊ͱ͸‫͖෇ࠩޡ‬ͷઢ‫ํܗ‬ఔࣜΛղ͚Δ͔Ͳ͏͔ͱ͍͏໰୊Ͱ͋Δ. 1993 ೥ʹ, Blum, Furst, Kearns,
Lipton [9] ͕ࠔ೉ͱࢥΘΕΔ໰୊ͱͯ͠‫͛ڍ‬, ఆࣜԽΛߦͬͨ. 2 ষʹ͓͍ͯ, ͜ͷ໰୊ΛҰൠԽͨ͠ LWE ໰୊Λ‫ʹط‬ѻ͍ͬͯΔ.

Berτ Ͱύϥϝʔλ τ ͷϕϧψʔΠ෼෍Λද͢͜ͱʹ͢Δ. (֬཰ τ Ͱ 1, ֬཰ 1 − τ Ͱ 0 ͱͳΔ F2 ্ͷ෼෍Ͱ͋Δ.) ·ͨ, ࣗવ਺ k ≥ 1 ʹ͍ͭͯ, Berkτ Ͱ, Berτ ͔Βಠཱʹ k ‫ݸ‬αϯϓϧΛऔͬͨͱ͖ͷ Fk2 ্ͷ෼෍Λද͢.

29

˙ LPN ໰୊:

F2 ্ͷ෼෍ χ ͓Αͼ s ∈ Fk2 ʹ͍ͭͯ, ΦϥΫϧ Os,χ ΛҎԼͰఆٛ͢Δ. (1) a Λ Fk2 ͔ΒϥϯμϜ

ʹબͼ, (2) e Λ෼෍ χ ʹै͍બͼ, (3) b = s · a⊤ + e ͱ‫͠ࢉܭ‬, (4) (a, b) Λग़ྗ͢Δ. ఆٛΑΓ, ·ͨ, ΦϥΫϧ U
Λ (a, b) ← Fk+1
ͱϥϯμϜͳ૊Λग़ྗ͢ΔΦϥΫϧͱͯ͠ఆٛ͢Δ.
2

ఆٛ 3.1 (୳ࡧ൛ LPN ໰୊) ୳ࡧ൛ LPN ໰୊ͱ͸, ΦϥΫϧ Os,χ ΁ͷΞΫηε͕Մೳͳͱ͖ʹ, s Λग़ྗ͢Δ໰୊Ͱ͋Δ.

ಛʹ χ = Berτ ͷͱ͖, LPNk,τ ໰୊ͱ‫Ϳݺ‬. ·ͨ LPNk,τ ໰୊ͰΦϥΫϧ͔Βͷαϯϓϧ਺͕ n = n(k) ʹ੍‫͞ݶ‬ΕΔ΋ͷΛ, LPNk,n,τ ໰୊ͱ‫Ϳݺ‬.
ఆٛ 3.2 (୳ࡧ൛ LPN Ծఆ) F2 ্ͷ֬཰෼෍ χ ʹ͍ͭͯ, ఢ A ͷ༏ҐੑΛ

AdvA (k) = Pr [AOs,χ (1k ) = s]s←Fk2Ͱఆٛ͢Δ. ೚ҙͷଟ߲ࣜ࣌ؒͷఢ A ʹ͍ͭͯ, ͦͷ༏Ґੑ͕ແࢹͰ͖Δͱ͖, ୳ࡧ൛ LPN Ծఆ͕੒ཱ͢Δͱ͍͏.
҉߸ϓϦϛςΟϒ΍҉߸ϓϩτίϧͷ҆શੑূ໌ͷͨΊʹ, ൑ఆ൛ LPN ԾఆΛ༻͍Δ͜ͱ΋ଟ͍. ൑ఆ൛ LPN ໰୊ͱ൑ఆ൛ LPN Ծఆ͸ҎԼͰఆٛ͞ΕΔ.
ఆٛ 3.3 (൑ఆ൛ LPN ໰୊) ൑ఆ൛ LPN ໰୊ͱ͸, ΦϥΫϧ Os,χ ·ͨ͸ΦϥΫϧ U ΁ͷΞΫηε͕༩͑ΒΕͨͱ͖ʹ, ͲͪΒͷΦϥΫϧʹΞΫηε͍ͯ͠Δ͔Λ൑ఆ͢Δ໰୊Ͱ͋Δ.

ఆٛ 3.4 (൑ఆ൛ LPN Ծఆ) F2 ্ͷ֬཰෼෍ χ ʹ͍ͭͯ, ఢ A ͷ༏ҐੑΛ9999AdvA (k) = 9 Pr [AOs,χ (1k ) = 1] − Pr[AU (1k ) = 1]9s←Fk2Ͱఆٛ͢Δ. ೚ҙͷଟ߲ࣜ࣌ؒͷఢ A ʹ͍ͭͯ, ͦͷ༏Ґੑ͕ແࢹͰ͖Δؔ਺Ͱ͋Δͱ͖, ൑ఆ൛ LPN Ծఆ͕੒ཱ͢
Δͱ͍͏.

୳ࡧ൛ LPN ໰୊ʹ͸ϥϯμϜࣗ‫ؼݾ‬ண͕ଘࡏ͢Δ [9]. ͢ͳΘͪ, ϥϯμϜʹબ͹Εͨ s ∈ Fk2 ʹ͍ͭͯ୳ࡧ൛ LPN

໰୊Λղ͚ΔͳΒ͹, ೚ҙͷ s ∈ Fk2 ʹ͍ͭͯ୳ࡧ൛ LPN ໰୊Λղ͘͜ͱ͕ग़དྷΔ.

Katz, Shin, Smith [32] ʹΑΕ͹, [9, 46] ͱಉ༷ʹ൑ఆ൛ LPN ԾఆΛ୳ࡧ൛ LPN Ծఆʹ‫ؼ‬ண͢Δ͜ͱ͕ग़དྷΔ.

ఆཧ 3.5 ([32]) ൑ఆ൛ LPNk,τ ԾఆΛഁΔ t εςοϓ, m ճͷΫΤϦ, ༏Ґੑ δ ͷఢ͕ଘࡏ͢ΔͱԾఆ͢Δ. ͜ͷͱ͖, ୳ࡧ൛ LPNn,τ ԾఆΛഁΔ t′ εςοϓ, m′ ճͷΫΤϦ, ༏Ґੑ δ ′ ͷఢ͕ଘࡏ͢Δ. ͜͜Ͱ,t′ = O(δ −2 tklogk), m′ = O(δ −2 mlogk), δ ′ ≥ δ/4.
˙มछ:Ҏ্ʹྻ‫ ͨ͠ڍ‬LPN ໰୊ɾԾఆͰ͸, ‫ͳͱૅج‬Δମͱͯ͠ F2 Λ༻͍͍ͯͨ. ମΛ Fq ʹมߋͨ͠ LPN ໰୊ɾԾఆ͕༻͍ΒΕΔ͜ͱ΋͋Δ. ಛʹ q Λૉ਺ͱͨ͠৔߹ʹ͸ LWE ໰୊ͱඇৗʹΑ͘ࣅͨ໰୊ɾԾఆͱͳΔ͕, ‫ޡ‬ࠩ෼෍ χ ͷఆ͕ٛҟͳΔ͜ͱ͕ଟ͍.

LWE ໰୊Ͱ͸৒༨‫ ؀‬Zq Λ༻͍͍ͯΔ. Ԡ༻ͷ‫͔఺؍‬Β͸, ‫ࠩޡ‬෼෍ χ ͔Βͷαϯϓϧ x ͷઈର஋͕ߴ͍֬཰Ͱখ
͍͜͞ͱ͕ॏࢹ͞ΕΔ. Ұํ, LPN ໰୊Ͱ͸༗‫ݶ‬ମ Fq Λ༻͍͍ͯΔ. ·ͨ, ූ߸͔Βͷཁ‫ͯ͠ͱٻ‬ϋϛϯάॏΈΛߟ͑
Δ͜ͱ͕ଟ͍ͨΊ, ‫ࠩޡ‬෼෍ χ ͸ 0 ΛऔΔ֬཰͕େ͖͍͜ͱ͕‫ٻ‬ΊΒΕΔ. ͨͱ͑͹, ϕϧψʔΠ෼෍ͷҰൠԽͱͯ͠,֬཰ τ Ͱ 0 Λ֬཰ 1 − τ Ͱ Fq \ {0} ͷϥϯμϜͳ஋ΛऔΔ෼෍͕༻͍ΒΕΔ. ͜Ε͸֨ࢠ໰୊ͱූ߸໰୊ͷΞφϩδʔͱͯ͠ߟ͑Δ͜ͱ͕Ͱ͖Δ.

30

3.1.2

LPN ໰୊ͷ֦ு

3.1.2.1 ෮߸໰୊ΦϥΫϧ͔Βͷαϯϓϧ਺Λ‫ݻ‬ఆ͠ n = n(k) ͱ͢Δ. LPNk,n,τ ໰୊Ͱͷ m ‫ݸ‬ͷαϯϓϧ (a1 , b1 ), (a2 , b2 ), . . . ,(an , bn ) ΛߦྻɾϕΫτϧදࣔͯ͠,k×n⊤⊤
A = [a⊤,b = s · A + e
1 a 2 . . . a n ] ∈ F2

ͱ͢Δ. ූ߸ཧ࿦ͷ‫͔఺؍‬Β͸, ϥϯμϜߦྻ A ∈ Fk×n Λੜ੒ߦྻ*1 ͱ͢Δ [n, k]q -ઢ‫߸ූܗ‬ͷड৴‫ ޠ‬b ͔Β‫ݩ‬ͷϝοηʔδ s Λ෮‫͢ݩ‬Δ໰୊ͱଊ͑Δ͜ͱ͕Ͱ͖Δ.

3.1.2.2 γϯυϩʔϜ෮߸໰୊ઌ΄Ͳ‫ͨ͛ڍ‬෮߸໰୊ͷ “૒ର” ͱͯ͠, γϯυϩʔϜ෮߸໰୊͕‫͛ڍ‬ΒΕΔ. γϯυϩʔϜ෮߸໰୊ SDk,n,w ͱ͸,(n−k)×n⊤⊤
H = [h⊤1 h 2 . . . h n ] ∈ F2

, u ∈ Fk2

͓Αͼࣗવ਺ w ͕༩͑ΒΕͨ࣌ʹ, e · H ⊤ = u ͔ͭϋϛϯάॏΈ͕ w ҎԼͱͳΔ e ∈ Fn
2 Λ‫ٻ‬ΊΔ໰୊Ͱ͋Δ.

A ∈ Fk×n Ͱੜ੒͞ΕΔූ߸ͷύϦςΟ‫*ྻߦࠪݕ‬2 Λ H ∈ F(n−k)×n ͱ͠, b · H ⊤ (= e · H ⊤ ) Λ u ͱ͢Ε͹,

LPNk,n,τ ໰୊΍෮߸໰୊ΛγϯυϩʔϜ෮߸໰୊ SDk,n,O(τ n) ʹม‫׵‬ՄೳͰ͋Δ.
3.1.2.3

Exact-LPN ໰୊‫ࠩޡ‬෼෍ͱͯ͠, e ← Bernτ Ͱ͸ͳ͘, ϋϛϯάॏΈ͕ஸ౓ w ͷ΋ͷ͚ͩΛߟ͑Δ. (͢ͳΘͪ e ← SH (n, w).) ͜ͷΑ͏ʹ‫ࠩޡ‬෼෍Λม͑ͨ໰୊Λ Exact-LPN ໰୊ͱ‫Ϳݺ‬.

3.1.2.4

Sparse-LPN ໰୊Ұ෦ͷ҉߸ํࣜͰ͸, s ͷϋϛϯάॏΈ͕খ͍͞, ͢ͳΘͪ, ૄ (sparse) Ͱ͋Δ͜ͱΛཁ‫͢ٻ‬Δ. Applebaum Β [3]͸ s Λ‫ࠩޡ‬෼෍Ͱ͋Δ χk ͔ΒબΜͩ৔߹ͷ LPN ໰୊ͱ s Λ Fk ͔ΒϥϯμϜʹબΜͩ৔߹ͷ໰୊ͱ͕౳ՁͰ͋Δ͜ͱΛ͍ࣔͯ͠Δ.

3.1.2.5

Toeplitz-LPN ໰୊

Gilbert, Robshaw, Seurin [26] ͕ೝূϓϩτίϧͷޮ཰ԽͷͨΊʹಋೖͨ͠.
ߦྻ A = {ai,j } ∈ Fk×n
͕ Toeplitz ߦྻͰ͋Δͱ͸, ೚ҙͷ i, j ʹ͍ͭͯ ai−1,j−1 = ai,j ͕੒ཱ͢Δ͜ͱͰ͋2

Δ. Toeplitz ߦྻΛද‫͢ݱ‬Δʹ͸ࠨ୺ͷྻϕΫτϧ͓Αͼ࠷΋্ͷߦϕΫτϧ͕͋Ε͹ྑ͍. ͦͷͨΊ A ͷද‫ݱ‬͸

k + n − 1 ϏοτͰՄೳͰ͋Δ.

෮߸໰୊ͷઅͰ, ୳ࡧ൛ LPN ໰୊Ͱͷαϯϓϧ (a1 , b1 ), (a2 , b2 ), . . . , (an , bn ) ΛߦྻɾϕΫτϧදࣔͯ͠,⊤⊤k×n
A = [a⊤,b = s · A + e
1 a2 . . . an ] ∈ FΛߟ͑ͨ. ΦϥΫϧ O (͓Αͼ U ) Λมߋ͠, A ͕ඞͣ Toeplitz ߦྻʹͳΔ৔߹ͷ LPN ໰୊Λߟ͑Δ. ͜ΕΛToeplitz-LPN ໰୊ͱ‫Ϳݺ‬.
*1*2[n, k]q -ઢ‫ ߸ූܗ‬C ͷੜ੒ߦྻͱ͸, ූ߸ C ͷ‫ج‬ఈϕΫτϧΛߦͱ͢Δߦྻ G ∈ Fk×n
Ͱ͋Δ.
q[n, k]q -ઢ‫ ߸ූܗ‬C ͷύϦςΟ‫ͱྻߦࠪݕ‬͸, ߦྻ H ∈ Fr×n
Ͱ, c ∈ Fnʹରͯ͠,c∈ C ͳΒ͹͔ͭͦͷ࣌ʹ‫ݶ‬Γ c · H ⊤ = 0 ͱͳΔqq΋ͷͰ͋Δ. H ͷߦ͕ઢ‫ܗ‬ಠཱͰ͋Ε͹, r = n − k Ͱ͋Δ.

31

3.1.2.6

Ring-LPN ໰୊

Heyse, Kiltz, Lyubashevsky, Paar, Pietrzak [28] ͸, Ring-LPN ໰୊Λఆٛͨ͠. ͜ͷ໰୊͸ Ring-LWE ໰୊(2.1.1.1 અ) ͱಉ༷ʹఆٛ͞ΕΔ.
ఆٛ 3.6 (୳ࡧ൛ Ring-LPN ໰୊) ద౰ͳ k ࣍ͷ Fq ܎਺ଟ߲ࣜ f (x) Λߟ͑, ‫ ؀‬Rq = Fq [x]/(f (x)) Λ‫ݻ‬ఆ͢Δ. Rq
্ͷ֬཰෼෍ χ Λ‫ݻ‬ఆ͢Δ.

Rq ্ͷ‫ࠩޡ‬෼෍ χ ͓Αͼ s ∈ Rq ʹ͍ͭͯ, ΦϥΫϧ Os,χ ΛҎԼͰఆٛ͢Δ. (1) a Λ Rq ͔ΒϥϯμϜʹબͼ,(2) e Λ෼෍ χ ʹै͍બͼ, (3) b = sa + e ͱ‫͠ࢉܭ‬, (4) (a, b) ∈ Rq2 Λग़ྗ͢Δ.

୳ࡧ൛ Ring-LPN ໰୊ͱ͸, ΦϥΫϧ Os,χ ΁ͷΞΫηε͕Մೳͳͱ͖ʹ, s ∈ Rq Λग़ྗ͢Δ໰୊Ͱ͋Δ.

3.1.3

LPN ໰୊ʹର͢ΔධՁ

αϯϓϧ਺Λ‫ݻ‬ఆͨ͠৔߹, A ͓Αͼ b ͷ࠷ѱ࣌Λߟ͑Δͱ NP ࠔ೉ʹͳΔ͜ͱ͕ Berlekamp, McEliece, vanTilborg [16] ʹΑͬͯࣔ͞Ε͍ͯΔ. ·ͨ, Håstad [27] ʹΑΓۙࣅ൛ LPN ໰୊ͷ NP ࠔ೉ੑ΋ࣔ͞Ε͍ͯΔ.
͔͠͠ฏ‫࣌ۉ‬ͷࠔ೉ੑʹ͍ͭͯ͸Α͘෼͔͍ͬͯͳ͍. ͦͷͨΊ LPN ໰୊Λղͨ͘ΊͷఏҊ͞ΕͨΞϧΰϦζϜʹ
͍ͭͯௐࠪΛߦͬͨ.

LPNk,n,τ ໰୊Λղͨ͘Ίͷૉ๿ͳํ๏ͱͯ͠, ࣌ؒ poly(n, k) · O(2n ) Ͱಈ࡞͢Δ૯౰ͨΓ๏͕͋Δ. ᮢ஋d ≥ 1 Λ‫ݻ‬ఆ͢Δ. s ∈ Fk2 ͷީิ͝ͱʹ, e = b − sA Λ‫͠ࢉܭ‬, e ͷϋϛϯάॏΈ͕ (1 + 1/d)τ n ҎԼͰ͋Ε͹ s Λղͱͯ͠ग़ྗ͢Δͱ͍͏΋ͷͰ͋Δ. Chernoﬀ ͷิ୊*3 ͔Β e ← Bernτ ͱͨ͠ͱ͖, d ≥ 1 ʹ͍ͭͯ

Pr[HW(e) ≤ (1 + 1/d)τ n] ≤ exp(−τ n/3d2 ) Ͱ͋Δ. ɹҎ߱Ͱ͸, O(2n ) ҎԼͷ࣌ؒͰղΛ‫ٻ‬ΊΔΞϧΰϦζϜʹ͍ͭͯߟ࡯͢Δ. ‫ࡏݱ‬, େผͯ͠ҎԼͷ 3 ͭͷΞϧΰϦζ

Ϝ͕஌ΒΕ͍ͯΔ.

1. Blum, Kalai, Wasserman [11] ͷ BKW ΞϧΰϦζϜ
2. Arora, Ge [4] ͷʮ࠶ઢ‫ܗ‬ԽʯΞϧΰϦζϜ
3. γϯυϩʔϜ෮߸໰୊ͱͯ͠ղ͘ΞϧΰϦζϜ

3.1.4 BKW ΞϧΰϦζϜ͓Αͼͦͷվྑ
Blum, Kalai, Wasserman [11] ͸ BKW ΞϧΰϦζϜͱ‫ݺ‬͹ΕΔΞϧΰϦζϜΛఏҊͨ͠.
‫ج‬ຊΞΠσΞ͸ҎԼͰ͋Δ. ΦϥΫϧ͔Βͷαϯϓϧ (a, b) ͕ৗʹ a = (1, 0, . . . , 0) ͱ͍͏‫͋Ͱܗ‬Ε͹, b = s1 + e
ͱͳΔ. ͜ͷΑ͏ͳαϯϓϧΛେྔʹूΊΕ͹, s1 Λଟ਺ܾ๏Ͱ‫ٻ‬ΊΔ͜ͱ͕ग़དྷΔ. Ұൠʹ uj Λ j ൪໨ͷ୯ҐϕΫτϧͱͯ͠, (uj , b) ͱ͍͏‫ܗ‬ͷαϯϓϧΛूΊΕ͹ sj Λଟ਺ܾ๏Ͱ‫ٻ‬ΊΒΕΔ. ͦ͜ͰΦϥΫϧ Os,τ ͔Βͷαϯϓ
ϧΛ༻͍ͯ, ্‫ه‬ͷΑ͏ͳαϯϓϧΛੜ੒͢Δ͜ͱΛ໨ࢦ͢.
˙BKW ΞϧΰϦζϜͷ֓ཁ:(t − 1)ℓ < k ≤ tℓ Λຬͨ͢ద౰ͳࣗવ਺ t, ℓ Λ‫ݻ‬ఆ͢Δ. ҎԼͰ͸,As,δ,i = {a ← Fk−iℓ× {0}iℓ , e ← Ber(1+δ)/2 : (a, s · a⊤ + e)}2*3

X , X , . . . , Xn Λ૬‫ʹޓ‬ಠཱͳ {0, 1} ֬཰ม਺ͱ͠, X = X1 + X2 + · · · + Xn ͷ‫ظ‬଴஋Λ µ ͱ͢Δͱ, Pr[X ≥ (1 + ϵ)µ] <! 1 2"µ
exp(ϵ)/(1 + ϵ)(1+ϵ) . ಛʹ, 0 < ϵ ≤ 1 ͷ৔߹, Pr[X ≥ (1 + ϵ)µ] < exp(−ϵ2 µ/3).

32ͱ͍͏ΦϥΫϧΛߟ͑Δ. As,δ,i ͔Βಘͨαϯϓϧ (a, b) ͸ a ͷ຤ඌ͔Β iℓ ‫ݸ‬ͷཁૉ͕ඞͣ 0 Ͱ͋Δ. i = 0,

δ = 1 − 2τ ͱ͢Ε͹, As,δ,i = Os,τ ͱͳΔ.
‫ج‬ຊΞϧΰϦζϜ͸ҎԼͰ͋Δ.

1. As,δ0 ,0 = Os,τ ͔ΒͷαϯϓϧΛ L0 ‫༻ݸ‬ҙ͢Δ.

2. i = 0, 1, . . . , t − 2 ʹ͍ͭͯ, αΠζ Li ͷ As,δi ,i ͔ΒͷαϯϓϧΛ༻͍ͯ, O(Li ) ࣌ؒͰαΠζ Li+1 = Li − 2k
ͷ As,δi2 ,i+1 ͔ΒͷαϯϓϧΛߏ੒͢Δ.

• αϯϓϧ (a, b) ∈ Li ʹ͍ͭͯ, a = (a1 , a2 , . . . , ak−iℓ , 0, . . . , 0) ∈ Fk2 ͷ (ak−(i+1)ℓ+1 , ak−(i+1)ℓ+2 , , . . . , ak−iℓ ) ∈Fℓ2 ʹैͬͯ෼ྨΛߦ͏.

• ֤૊Ͱ୅දΛҰͭͱΓ, ͦΕΛ (a∗ , b∗ ) ͱ͢Δ.

• ֤૊ͷ୅දҎ֎ͷཁૉ (a, b) Λ (a ⊕ a∗ , b ⊕ b∗ ) Ͱஔ͖‫͑׵‬Δ.

• શ૊Λ·ͱΊͯαΠζ Li − 2ℓ ͷ As,δi2 ,i+1 ͔Βͷαϯϓϧͱ͢Δ.

࠷ऴతʹ, αΠζ Lt−1 = L0 − (t − 1)2ℓ ͷ As,δ2t−1 ,t−1 ͔Βͷαϯϓϧ͕ಘΒΕΔ.
0

3. ಘΒΕͨ Lt−1 ‫ݸ‬ͷ As,δ2t−1 ,t−1 ͔ΒͷαϯϓϧΛ༻͍ͯ, sj Λ౤ථͰܾΊΔ.
0• j = 1, 2, . . . , k − (t − 1)ℓ ʹ͍ͭͯ, uj Λ Fk2 ͷඪ४‫ج‬ఈ j ൪໨ͷ୯ҐϕΫτϧͱ͢Δ. αϯϓϧ{(ai , bi )}i=1,2,...,m ͔Β z ‫ݸ‬ͷϕΫτϧΛ ai1 + ai2 + · · · + aiz = uj ͱͳΔΑ͏ʹ͏·͘બͿ. ͜ͷͱ͖,

bi1 + bi2 + · · · + biz = sj + ei1 + · · · + eiz ͱͳΓ, ‫ ͕ࠩޡ‬0 ʹͳΔ֬཰͸ Pr[ei1 + ei2 + . . . + eiz = 0] >1/2 + (1 − 2δ02

t−1

)z /2 Ͱ༩͑ΒΕΔ. ద౰ͳճ਺͜ͷࢼߦΛߦ͍, sj Λଟ਺ܾ౤ථͰܾΊΕ͹ྑ͍.
%&tBlum Βͷ‫ੵݟ‬΋ΓͰ͸, αϯϓϧ਺͓Αͼ‫ࢉܭ‬εςοϓ਺͸ δ0 = 1 − 2τ ͱͯ͠, poly δ0−2 , 2ℓ Ͱ͋ͬͨ.

τ < 1/2 Λఆ਺ͱ͠, t = 12 logk, ℓ = 2k/logk ͱ͢Ε͹, ࣌ؒ‫ྔࢉܭ‬ɾۭؒ‫ͱྔࢉܭ‬΋ʹ 2O(k/logk) ΛಘΔ.
˙LF ΞϧΰϦζϜ:Levieil ͱ Fouque [36] ͸ BKW ΞϧΰϦζϜͷҰ෦Λվྑ͠ LF1 ΞϧΰϦζϜΛఏҊͨ͠.

؆୯ͷͨΊʹ k = tℓ ΛԾఆ͢Δ. BKW ΞϧΰϦζϜͰ͸‫ج‬ຊΞϧΰϦζϜͷεςοϓ 3 ʹ͓͍ͯ s ͷ֤ཁૉΛ 1 ܾͭͣͭఆ͍ͯ͠Δ. εςοϓ 3 ʹ͓͍ͯಘΒΕͨαϯϓϧ͸, As,δ2t−1 ,t−1 ͔ΒͷαϯϓϧͰ͋ΔͨΊ,((a1 , a2 , . . . , ak , 0, . . . , 0), b) ͱ͍͏‫ܗ‬Λ͍ͯ͠Δ. ͜ͷͱ͖, b ='ℓ0i=1 ai si + e ͱͳΓ, αϯϓϧʹӨ‫ڹ‬Λ༩͑Δͷ͸,s ͷ ℓ Ϗοτ෼Ͱ͋Δ. LF ΞϧΰϦζϜͰ͸, s1 , s2 , . . . , sℓ Λ૯౰ΓͰ‫͢ࢉܭ‬Δ.
Levieil ͱ Fouque ͸ BKW ΞϧΰϦζϜ͓Αͼ LF1 ΞϧΰϦζϜ͕ඞཁͱ͢Δαϯϓϧ਺͓Αͼ‫ࢉܭ‬εςοϓ਺Λ, ҎԼͷΑ͏ʹৄࡉʹղੳͨ͠. *4
ఆཧ 3.7 k = tℓ ͱ͠, δ = 1 − 2τ ͱ͢Δ.
t

• BKW ΞϧΰϦζϜ͸ΫΤϦ਺ n = 20 ln(4k)2ℓ δ −2 , εςοϓ਺ T = O(ktn), ϝϞϦྔ M = kn, ੒ޭ֬཰θ = 1/2 Ͱ LPNk,n,τ ໰୊Λղ͘.

t• LF1 ΞϧΰϦζϜ͸ΫΤϦ਺ n = (8ℓ+200)δ −2 +(t−1)2ℓ , εςοϓ਺ T = O(ktn), ϝϞϦྔ M = kn+ℓ2ℓ .
੒ޭ֬཰ θ = 1/2 Ͱ LPNk,n,τ ໰୊Λղ͘.

Levieil ͱ Fouque ͸, LF1 ΞϧΰϦζϜʹҰ෦ͷώϡʔϦεςΟΫΛ૊Έ߹Θͤͨ LF2 ΞϧΰϦζϜ΋ఏҊ͍ͯ͠Δ.
ใࠂʹΑΕ͹, k = 99, τ = 1/4, n = 10000 ͷ LPN ໰୊Λ CPU: Pentium 4 (3GHz), RAM: 1GB ͷϚγϯͰղ͘͜ͱ͕ՄೳͰ͋Δ. Devadas, Ren, Xiao [19] ͸ LF2 ΞϧΰϦζϜʹ͍ͭͯৄࡉͳղੳΛ༩͑, BKW ΞϧΰϦζϜͱͷttൺֱΛߦ͍ͬͯΔ. Devadas ΒͷใࠂʹΑΕ͹, ϝϞϦΛ O(δ −2 ) ഒଟ͘࢖͏͕, ࣌ؒ‫ ͕ྔࢉܭ‬O(δ −2 ) ഒվળ͞Ε*4 ‫ʹޙ‬, Zhang, Jiao, Wang [48] ΒʹΑΓ, ͜ͷղੳʹ͸ώϡʔϦεςΟοΫ͕ඞཁͱͷࢦఠ͕͋ͬͨ.

33

Δͱͷ͜ͱͰ͋Δ.
˙Kirchner ͷࢦఠ:

Kirchner [29] ͸ϥϯμϜʹબ͹Εͨ s ΑΓ͸ Berτ ʹैͬͯબ͹ΕΔ‫ޡ‬ΓϕΫτϧ e ͷํ͕, ϋϛϯάॏΈ͕খ͘͞, औΓ͏Δ஋͕গͳ͍͜ͱʹண໨ͨ͠. ͦ͜Ͱ, LPN ໰୊Λ Sparse-LPN ໰୊ʹஔ͖‫Ͱ্ͨ͑׵‬໰୊Λղ͘͜ͱΛఏҊ͍ͯ͠Δ.

Kirchner ͷख๏͸ҎԼͷΑ͏ʹ·ͱΊΒΕΔ.
1. Applebaum Β [3] ͱಉ༷ͷख๏Λ༻͍ͯ, Os,χ ͱ͍͏ΦϥΫϧΛ e′ ← Berkτ ͱϥϯμϜʹબΜͩ৔߹ͷ Oe′ ,χͱ͍͏ΦϥΫϧʹม‫͢׵‬Δ.

2. BKW ΞϧΰϦζϜ΍ LF ΞϧΰϦζϜͱಉ༷ʹ‫ج‬ຊΞϧΰϦζϜͷεςοϓ 1, 2 Λߦ͍, Ae′ ,δ2t−1 ,t−1 ͔ΒͷαϯϓϧΛಘΔ.

3. εςοϓ 3 Ͱ, ℓ ϏοτΛܾఆ͢Δࡍʹ, e′ ͷ֘౰෦෼ͷॏΈ͕গͳ͍͜ͱΛߟྀͯ͠૯౰ΓΛߦ͏.
4. εςοϓ 1 ͷ‫ٯ‬Λߦ͍, e′ Λ s ʹ໭͢.
Ұൠͷ s Ͱ͋Ε͹, ૯౰Γʹඞཁͳճ਺͸ 2ℓ ͱͳΔ. Ұํ, e′ ͸εύʔεͰ͋Δ͜ͱ͕‫ظ‬଴͞ΕΔ. d ≥ 1 Λ‫ݻ‬ఆ͠ℓ ͕े෼ʹେ͖͍ͱ͢Δ. ͜ͷͱ͖, ѹ౗తͳ֬཰ͷԼͰ, ϋϛϯάॏΈ͸ (1 + 1/d)τ ℓ ҎԼͰ͋Δ. Αͬͯ, e′ ͷީิ)*ℓ਺͸ (1+1/d)τ
ℓ ҎԼͱͳΓ, ૯౰Γʹඞཁͳճ਺͕࡟‫͞ݮ‬ΕΔ.
˙Ring- LPN ໰୊΁ͷԠ༻:Bernstein ͱ Lange [12] ͸ Levieil ͱ Fouque ͷߴ଎Խख๏͓Αͼ Kirchner ͷΞΠσΞ

Λ༻͍Δ͜ͱʹΑΓ, Ring-LPN ໰୊ͷղ๏͕ߴ଎ԽͰ͖Δ͜ͱΛ͍ࣔͯ͠Δ.
˙ͦͷ‫ޙ‬ͷਐల:Guo, Johansson, Löndahl [25] ͸, covering codes ͱ‫ݺ‬͹ΕΔූ߸Λ༻͍ͯ Kirchner ͷख๏ͷߴ଎ԽΛఏҊ͍ͯ͠Δ. Kirchner ͷख๏Ͱ͸εςοϓ 3 Ͱ, Ae′ ,δ2t−1 ,t−1 ͔Βͷαϯϓϧ {(ai , bi )} ͕ಘΒΕΔ. ͜ͷ ai
Λ covering code ͷड৴‫ͱޠ‬Έͳ͢͜ͱͰ୳ࡧۭؒͷѹॖΛߦ͍, ߴ଎ԽΛߦ͍ͬͯΔ. *5

Zhang, Jiao, Wang [48] ͸ผͷූ߸Λ༻͍ͯ GJL ΞϧΰϦζϜΛվྑ͍ͯ͠Δ.
Bogos ͱ Vaudenay [17] ͸ GJL ΞϧΰϦζϜͷղੳ͕Ұ෦͚͍ܽͯΔ͜ͱΛ෼ੳ͠, ࠷దԽΛߦ͍ͭͭৄࡉͳ‫ࢉܭ‬ྔධՁΛ༩͑ͨ. Bogos Β͸ಉ࣌ʹ Gauss ΞϧΰϦζϜͱ‫ݺ‬͹ΕΔΞϧΰϦζϜʹ͍ͭͯ΋ղੳΛ༩͍͑ͯΔ.

Esser, Kübler, May [22] Ͱ͸ BKW ͓Αͼ Gauss ΞϧΰϦζϜʹΑΓৄࡉͳղੳΛߦͬͨ.
Esser, Heuer, Kübler, May, Sohler [21] ͸ BKW ΞϧΰϦζϜʹରͯ࣌ؒ͠ɾϝϞϦͷτϨʔυΦϑΛఏҊ͍ͯ͠Δ.
˙αϯϓϧ਺͕গͳ͍৔߹:͜Ε·Ͱʹ‫ ͖ͨͯ͛ڍ‬BKW ΞϧΰϦζϜ͓ΑͼͦͷվྑͰ͸, αϯϓϧ͕ O(2k/logk )‫ݸ‬ඞཁͰ͋ͬͨ. Lyubashevsky [38] ͸αϯϓϧ਺͕ k 1+ϵ ‫ͱݸ‬গͳ͍৔߹Ͱ͋ͬͯ΋, BKW ΞϧΰϦζϜΛద༻
Ͱ͖ΔΑ͏ͳࢦ਺‫ݸ‬ͷαϯϓϧͷߏ੒๏Λ͍ࣔͯ͠Δ. Kirchner [29] ΋ಉ༷ͷߏ੒๏Λ͍ࣔͯ͠Δ. ·ͨ, ্த୩ͱᅳኍ [31] ͸ BKW ΞϧΰϦζϜͱ Lyubashevsky ͷํ๏ͱΛิؒ͢ΔΑ͏ͳΞϧΰϦζϜΛఏҊ͍ͯ͠Δ. Esser,

Kubler, May [22] ͸αϯϓϧ਺͕গͳ͍৔߹ͷ BKW ͓Αͼ Gauss ΞϧΰϦζϜʹ͍ͭͯ, ΑΓৄࡉͳղੳΛߦͬͨ.

3.1.5 Arora-Ge ΞϧΰϦζϜ
Arora ͱ Ge [4] ͸ଟม਺ଟ߲ࣜ໰୊Ͱ‫͔͘ݹ‬Β༻͍ΒΕ͍ͯΔ࠶ઢ‫ܗ‬Խͱ‫ݺ‬͹ΕΔख๏Λ༻͍ͯ, LPN ໰୊Λղ͘͜ͱΛߟ͑ͨ. ͜ͷΞϧΰϦζϜΛ LPNk,n,τ ʹ༻͍ͨ৔߹, w = τ n ͱͯ͠, poly(k w ) ࣌ؒͰղ͘͜ͱ͕Ͱ͖Δ.
*5 ͨͩ͠, ࠃࡍձٞͰͷϓϨθϯςʔγϣϯͰ͸αϯϓϧ਺͕ෆ଍͍ͯͨ͠ͱͷใࠂ͕͋Γ, ‫ྔࢉܭ‬ɾϝϞϦɾαϯϓϧ਺ͷධՁ͸‫ݟ‬௚͞Ε͍ͯΔ. ৄ͘͠͸, [48] ͓Αͼ [17] Λࢀরͷ͜ͱ34

ද 3.1֬཰ 1/2 Ҏ্Ͱ SD ໰୊Λղ͘৔߹ͷύϥϝʔλྫ (Full Distance Decoding ͷ৔߹)lg(Time)/nඋߟ

Pra62 (Lee-Brickel)

0,121[45], [34]Stern89

0,117

[47]

MMT11

0,112

[40]

BJMM12

0,102

[10]

MO15

0,096 7

[41]

BM17

0,095 3[14]; MO15 Λ࠷దԽͨ͠΋ͷBM18

0,088 5[15]poly(k w ) = 2O(τ nlogk) Ͱ͋Δ͔Β, τ = o(k/(nlog2 k)) ͷΑ͏ʹΤϥʔ͕εύʔεͰ͋Ε͹, BKW ΞϧΰϦζϜΑΓ
΋ޮ཰͕ྑ͍.

3.1.6 SD ໰୊Λ‫ܦ‬༝͢ΔΞϧΰϦζϜ
(n−k)×n

LPNk,n,τ ʹରԠ͢ΔγϯυϩʔϜ෮߸໰୊Λߟ͑Δ. ॏΈΛ w ≈ τ n ͱ͠, H ∈ F2͑ΒΕ, e · H ⊤ = u ͱͳΔΑ͏ͳ, ॏΈ͕ w ҎԼͷ e ∈ Fn
2 Λ୳ࡧ͢Δ໰୊Ͱ͋Δ.

͓Αͼ u ∈ Fn−k͕༩2ରԠ͢Δઢ‫߸ූܗ‬ͷ࠷খ‫཭ڑ‬Λ d ͱஔ͘. (2 ਐූ߸ͷ৔߹, Gilvert-Varshamov ‫ݶ‬քʹΑΓ, k/n ≈ 1 − H(d/n) Ͱ͋Δ*6 .ʣw ≈ d ͷ৔߹Λ Full Distance Decoding ͷ৔߹ͱ‫ͼݺ‬, w ≈ d/2 ͷ৔߹Λ Half Distance Decoding ͱ‫Ϳݺ‬.

͜ͷ໰୊Λ૯౰ΓͰղ͘৔߹ʹ͸, ॏΈ͕ w ͷ n ࣍‫ݩ‬ϕΫτϧ e Λྻ‫͢ڍ‬Ε͹Α͍. ͦͷͨΊ, ࣌ؒ‫ྔࢉܭ‬͸

)n*
O( w
) ͱͳΔ.

ΑΓޮ཰తͳख๏ͱͯ͠, Prange ͸ “Information set decoding” ͱ‫ݺ‬͹ΕΔख๏ [45] ΛఏҊͨ͠. ‫ج‬ຊΞΠσΞ͸ҎԼͰ͋Δ:

1. ϥϯμϜʹ H ͷྻϕΫτϧΛೖΕସ͑, H̃ = H · P ͱ͢Δ.
2. H̃ Λ૊৫Խ͠, [In−k | Z] = S · H̃ ͱ͢Δ.
3. u′ = uS ⊤ Λ‫͢ࢉܭ‬Δ.

4. u′ ͷॏΈ͕ w ҎԼͰ͋Ε͹, ͜ͷஔ‫ ׵‬P Λ࠾༻͠ e = (u′ , 0k ) · P ⊤ Λग़ྗ͢Δ.
u′ ͷॏΈ͕ w ҎԼͰ͋ΔͨΊ, e ͷॏΈ΋ w ҎԼͰ͋Δ. ·ͨ, e · H ⊤ = (u′ , 0k ) · P ⊤ H ⊤ = (u′ , 0k ) · H̃ ⊤ =(u, 0k )S ⊤ H̃ ⊤ = (u, 0k ) · [In−k | Z]⊤ = u ͕੒ཱ͢Δ. Αͬͯ, εςοϓ 4 ͷνΣοΫΛ௨ΔͳΒ͹, e ͸γϯυϩʔ
)
*
)
* )n*
Ϝ෮߸໰୊ͷղͱͳ͍ͬͯΔ. ͜ͷΑ͏ͳஔ‫׵‬͸શ෦Ͱ n−k௨Γ͋ΔͨΊ, ୳ࡧͰ͖Δ֬཰͸ n−kw
w / w ͱͳΔ. ‫ظ‬) n * )n−k*଴‫ྔࢉܭ‬͸ poly(n, k) · O( w/ w ) ͱͳΓ, ઌ΄Ͳͷྻ‫ڍ‬๏ΑΓ΋଎͘ͳΔ.
Stern [47] Ҏ߱, ۭؒ‫ྔࢉܭ‬Λ٘ਜ਼ʹ͢Δ͜ͱͰ࣌ؒ‫ྔࢉܭ‬ΛҾ͖Լ͛ΔΞϧΰϦζϜ͕ଟ਺ఏҊ͞Ε͍ͯΔ. ҎԼͰ͸, Becker ͱ May [15] ʹΑΓ࣌ؒ‫ྔࢉܭ‬ͷදΛ, ද 3.1 ͓Αͼ 3.2 ʹࣔ͢. ͜ͷද͸, ࣌ؒ‫ྔࢉܭ‬Λ࠷খԽͨ͠৔߹
ͷ R = k/n ͷ࠷ѱ࣌ (1/2 ͷগ͠Լ) ʹ͍ͭͯ·ͱΊΒΕ͍ͯΔ. ͕ͨͬͯ͠, ໰୊ͷύϥϝʔλʹΑͬͯ͸, දͷ਺஋ΑΓ΋଎͘ղ͘͜ͱ͕ՄೳͱͳΔ.
ύϥϝʔλઃఆʹΑͬͯ͸, LPNk,n,τ ໰୊Λ SDk,n,O(τ n) ໰୊ʹஔ͖‫͑׵‬Δ͜ͱͰ, ͜ΕΒͷ SD ໰୊༻ΞϧΰϦζ

*6

͜͜Ͱ H(p) = −plog(p) − (1 − p)log(1 − p).

35

ද 3.2

֬཰ 1/2 Ҏ্Ͱ SD ໰୊Λղ͘৔߹ͷύϥϝʔλྫ (Half Distance Decoding ͷ৔߹)lg(Time)/nඋߟ

Pra62 (Lee-Brickel)

0,057 6[34]

Stern89

0,055 7[47]

BLP

0,055 5

[13]

MMT11

0,053 7[40]

BJMM120,049 4

[10]

MO15

0,047 3

[41]

BM18

0,046 5[15]Ϝ΋‫ݕ‬౼͢Δඞཁ͕͋Δ.

3.1.7 ྔࢠΞϧΰϦζϜ΁ͷ଱ੑ‫ࡏݱ‬ͷͱ͜Ζଟ߲ࣜ࣌ؒͰ LPN ໰୊Λղ͘ྔࢠΞϧΰϦζϜ͸ఏҊ͞Ε͍ͯͳ͍. ͔͠͠ྔࢠΞϧΰϦζϜΛར༻ͨ͠߈ܸͷߴ଎Խํ๏Λ Kachigar ͱ Tillich [33] ͕ఏҊ͍ͯ͠Δ*7 . Esser, Kübler, May [22] ͸, BKW ΍ Gauss ΞϧΰϦζϜͷมछΛྔࢠΞϧΰϦζϜͰߴ଎ԽͰ͖Δ఺Λࢦఠ͍ͯ͠Δ.

3.2 ୅දతͳූ߸ʹ‫ࣜํ߸҉ͮ͘ج‬ͷઆ໌ຊઅͰ͸, ූ߸ʹ‫ͮ͘ج‬୅දతͳ҉߸ํࣜͱॺ໊ํࣜͷઆ໌Λߦ͏. ҎԼͰ͸, Sn Ͱ n ࣍ରশ‫܈‬Λද͠, GLk (Fq ) Ͱk ࣍ͷ Fq ཁૉਖ਼ଇߦྻશମ͕ͳ͢‫܈‬Λද͢.

3.2.1 ҉߸ํࣜ 1: McEliece ҉߸ͱͦͷมछ
McEliece [39] ͕ఏҊͨ͠‫ݹ‬యతͳ҉߸ํࣜͰ͋Δ.
• k : ҆શੑύϥϝʔλ• n : αϯϓϧͷ‫਺ݸ‬• τ : ‫ࠩޡ‬ύϥϝʔλ (ྫ: τ = O(k) )• t : ‫ޡ‬Γగਖ਼ූ߸ͷ‫ޡ‬Γగਖ਼ೳྗ ( t = Ω(τ n) )‫ݤ‬ੜ੒:‫ޡ‬Γగਖ਼ೳྗ͕ t Ͱ͋Δ [n, k]2 -ઢ‫߸ූܗ‬ͷੜ੒ߦྻ G Λੜ੒͢Δ. S ← GLk (F2 ) ΛϥϯμϜʹબͿ.

P ← Sn ΛϥϯμϜʹબͿ. G̃ = SGP ͱ͢Δ.
ެ։‫ݤ‬Λ G̃ ͱ͠, ൿີ‫ݤ‬Λ (S, G, P ) ͱ͢Δ.
҉߸Խ:
෮߸:

ฏจΛ m ∈ Fk2 ͱ͢Δ. ཚ਺ e ← Bernτ Λબͼ, ҉߸จ c = mG̃ + e Λ‫͢ࢉܭ‬Δ.

v̂ = cP −1 Λ‫͢ࢉܭ‬Δ. v̂ Λ‫ޡ‬Γగਖ਼ූ߸Ͱగਖ਼͠෮߸͢Δͱ m′ = mS ΛಘΔ. m = m′ S −1 Λग़ྗ͢Δ.

*7 Kirshanova [30] ͕ Kachigar ͱ Tillich ͷ݁Ռ [33] ͷվྑΛఏҊ͍͕ͯͨ͠, ‫ޡ‬Γ͕͋ͬͨ͜ͱ͕ใࠂ͞Ε͍ͯΔ. ͦͷͨΊ, 2018 ೥࣌఺ͰͷϕετͳྔࢠΞϧΰϦζϜ͸ Kachigar ͱ Tillich [33] Ͱ͋Δͱߟ͑ΒΕΔ.

36෮߸ͷਖ਼౰ੑ͸ҎԼͰ֬ೝ͞ΕΔ. c = mG̃ + e ͱͯ͠, v̂ = cP −1 Λ‫͢ࢉܭ‬Δͱ,v̂ = mG̃P −1 + eP −1 = mSG + eP −1ΛಘΔ. mSG ͸ූ߸‫͋Ͱޠ‬Γ, eP −1 ͸‫ޡ‬ΓͰ͋Δ. eP −1 ͷॏΈ͕ t ҎԼͰ͋Ε͹, ‫ޡ‬Γగਖ਼ූ߸ͷ෮߸ʹΑΓ,m′ = mS ΛಘΔ. Αͬͯ, ߴ͍֬཰Ͱ෮߸ʹ੒ޭ͢Δ.
ฏจ m ͓Αͼ G̃ ͕ϥϯμϜͰ͋Ε͹, ҉߸จ c ͸ LPN ԾఆͷԼͰٙࣅϥϯμϜͰ͋Δ. G̃ ͕ٙࣅϥϯμϜͰ͋Δ
͜ͱΛ‫ͨ͏ݴ‬Ίʹ͸, McEliece Ծఆͱ‫ݺ‬͹ΕΔԾఆ͕ඞཁͱͳΔ.
ఆٛ 3.8 (McEliece Ծఆ) [n, k]q(n) -ූ߸ͷΫϥε C Λ‫ݻ‬ఆ͢Δ. ఢ A ͷ༏ҐੑΛ

9
9
9
9
n
AdvA (n) = 9 Pr[S ← GLk (Fq ), G ← C, P ← Sn : A(1n , G̃ = SGP ) = 1] − Pr[G̃ ← Fk×n
:
A(1
,
G̃)
=
1]
9
q

Ͱఆٛ͢Δ. ೚ҙͷଟ߲ࣜ࣌ؒͷఢ A ʹ͍ͭͯ, ͦͷ༏Ґੑ͕ແࢹͰ͖Δؔ਺Ͱ͋Δͱ͖, McEliece Ծఆ͕੒ཱ͢Δͱ͍͏.

ࠨଆͷఢ͸ McEliece ҉߸ͷެ։‫ͨ·( ݤ‬͸ Niederreiter ҉߸ͷެ։‫ݤ‬ͷ૒ର) Λड͚औ͍ͬͯΔ. ͦͷͨΊ, ͜ͷԾఆ͸, McEliece ҉߸ͷެ։‫ݤ‬͸ϥϯμϜͳಉαΠζͷߦྻͱ‫ݟ‬෼͚͕෇͔ͳ͍ͱ͍͏͜ͱΛҙຯ͢Δ.

3.2.2 ҉߸ํࣜ 2: Niederreiter ҉߸ͱͦͷมछ
Niederreiter [42] ͕ 1986 ೥ʹఏҊͨ͠. ͷͪʹ McEliece ҉߸ͱʮ౳ՁʯͰ͋Δ͜ͱ͕ࣔ͞Εͨ. ৄ͘͠͸ [35] Λࢀরͷ͜ͱ.

• k : ҆શੑύϥϝʔλ• n : αϯϓϧͷ‫਺ݸ‬• τ : ‫ࠩޡ‬ύϥϝʔλ (ྫ: τ = ck )• t : ‫ޡ‬Γగਖ਼ූ߸ͷ‫ޡ‬Γగਖ਼ೳྗ ( t = Ω(τ n) )‫ݤ‬ੜ੒:‫ޡ‬Γగਖ਼ೳྗ͕ t Ͱ͋Δ [n, k] -ઢ‫߸ූܗ‬ͷύϦςΟ‫ ྻߦࠪݕ‬H ∈ F(n−k)×n Λੜ੒͢Δ. T ← GLn−k (F)ΛϥϯμϜʹબͿ. Q ← Sn ΛϥϯμϜʹબͿ. H̃ = T HQ ͱ͢Δ.
ެ։‫ݤ‬Λ H̃ ͱ͠, ൿີ‫ݤ‬Λ (T , H, Q) ͱ͢Δ.
҉߸Խ:
෮߸:

ฏจΛ e ∈ S(n, t) ͱ͢Δ. ҉߸จ d = e · H̃ ⊤ ∈ Fn−k Λ‫͢ࢉܭ‬Δ.

ŵ = d · T −⊤ Λ‫͢ࢉܭ‬Δ. ŵ Λ‫ޡ‬Γగਖ਼ූ߸Ͱగਖ਼͠෮߸͠, ‫ޡ‬Γͱͯ͠ e′ = eP ⊤ ΛಘΔ. e = e′ P −⊤ Λग़ྗ͢Δ.

෮߸ͷਖ਼౰ੑ͸ҎԼͰ֬ೝ͞ΕΔ. d = e · H̃ ⊤ ͱͯ͠, ŵ = dT −⊤ Λ‫͢ࢉܭ‬Δͱ,v̂ = e · H̃ ⊤ T −⊤ = e · Q⊤ H ⊤ T ⊤ T −⊤ = eQ⊤ · H ⊤ΛಘΔ. eQ⊤ ͷॏΈ͕ t ҎԼͰ͋Ε͹, ‫ޡ‬Γగਖ਼ූ߸ͷ෮߸ʹΑΓ, e′ = eQ⊤ ΛಘΔ. Αͬͯ, ߴ͍֬཰Ͱ෮߸ʹ੒ޭ͢Δ.
ฏจ e ͓Αͼ H̃ ͕ϥϯμϜͰ͋Ε͹, ҉߸จ d ͸ LPN ԾఆͷԼͰٙࣅϥϯμϜͰ͋Δ. H̃ ͕ٙࣅϥϯμϜͰ͋Δ
͜ͱΛ‫ͨ͏ݴ‬Ίʹ͸, McEliece ҉߸ͱಉ༷ʹ McEliece ԾఆΛߟ͑Ε͹Α͍.

37

3.2.3 ҉߸ํࣜ 3: Alekhnovich ҉߸Alekhnovich ͸ [1] Ͱެ։‫ࣜํ߸҉ݤ‬Λ 2 ͭఏҊ͍ͯ͠Δ. ͜͜Ͱ͸γϯϓϧͳ 1 ͭ໨ͷ҉߸ํࣜΛऔΓ্͛Δ. ύϥϝʔλΛҎԼͱ͢Δ.

• n : ҆શੑύϥϝʔλ• m : LPN αϯϓϧͷ‫ྫ( ਺ݸ‬: m = 2n + 1 )• τ > 0 : ‫ࠩޡ‬ύϥϝʔλ (ྫ: τ = n−1/2−ϵ )͜ͷͱ͖ Alekhnovich ҉߸͸ҎԼͰߏ੒͞ΕΔ:
ൿີ‫ݤ‬ͷੜ੒:ެ։‫ݤ‬ͷੜ੒:ϥϯμϜʹ e ← Bermτ ΛબͿ.

mϥϯμϜʹ A ← Fn×mΛબͿ. ϥϯμϜʹ s ← Fn
2 ΛબͿ. b = sA + e ∈ F2 Λ‫͠ࢉܭ‬, B =2(m−n−1)×m
ͱ͢Δ. M ∈ F2
Λ ker(B ⊤ ) ͷ‫ج‬ఈͱ͠, ެ։‫ݤ‬Λ M ͱ͢Δ.
m−n−1m҉߸Խ: ฏจ͕ 0 ͷ৔߹, t ← F2
ͱ f ← Bermτ ΛϥϯμϜʹબͼ, c = tM + f ∈ F2 Λग़ྗ͢Δ.
ฏจ͕ 1 ͷ৔߹, ϥϯμϜʹ c ← Fm
2 Λબͼग़ྗ͢Δ.
෮߸: ҉߸จ c ∈ Fm
ʹ͍ͭͯ
,
δ
=
⟨c,
e⟩
Λ‫͢ࢉܭ‬Δ. δ Λग़ྗ͢Δ.
2

)A *
b

෮߸ͷਖ਼౰ੑʹ͍ͭͯҎԼߟ࡯͢Δ. ฏจ͕ 1 ͷ৔߹, ෮߸͸֬཰ 1/2 Ͱ੒ޭ͢Δ.
Ұํ, ฏจ͕ 0 ͷ৔߹, e ∈ Span(B) ͓Αͼ tM ∈ ker(B ⊤ ) ΑΓ tM e⊤ = 0 Ͱ͋Δ͜ͱʹ஫ҙ͢Δͱ,⟨c, e⟩ = tM · e⊤ + f e⊤ = ⟨f , e⟩ͳͷͰ, ⟨f , e⟩ = 0 Ͱ͋Ε͹෮߸ʹ੒ޭ͢Δ. ‫ޡ‬Γ֬཰ΛධՁ͢Δͱ, τ = n−1/2−ϵ ΑΓ, Pr[⟨f , e⟩ = 1] ≈ (1 − τ )τ m =o(1) ͱͳΓ, 1 − o(1) ͷ֬཰Ͱ෮߸ʹ੒ޭ͢Δ. ·ͨ, ্‫ه‬ͷ҉߸ํࣜͷ҆શੑʹ͍ͭͯ͸, ൑ఆ൛ LPN ԾఆͷԼͰ
CPA ҆શͰ͋Δ͜ͱ͕ূ໌͞ΕΔ.

͜͜Ͱ঺հͨ͠҉߸ํࣜ͸, 1 Ϗοτ҉߸Ͱ͋Γ, ෮߸‫ޡ‬Γͷ֬཰΋ߴ͍ͨΊ࣮༻తͰ͸ͳ͍. ಉ༷ͳԾఆɾύϥϝʔλͷԼͰޮ཰తͳ҉߸ํࣜͱͯ͠, 2 ͭ໨ͷ Alekhnovich ҉߸΍ ෳ਺ϏοτΛ҉߸ԽͰ͖Δ Lyubashevsky-Peikert-

Regev ෩ͷ҉߸Λࢀߟʹ͞Ε͍ͨ.

3.2.4 ҉߸ํࣜ 3: Lyubashevsky-Peikert-Regev ෩҉߸‫ڞݤ‬༗ํࣜͱͯ͠ߟ͑ΒΕ͍ͯΔ͕, ຊߘͰ͸҉߸ํࣜͱͯ͠ॻ͘. McEliece ҉߸Ͱ͸ެ։‫ݤ‬ͷٙࣅϥϯμϜੑͦͷ΋ͷΛ McEliece Ծఆͱͯ͠ಋೖ͍ͯͨ͠. Ұํ, Lyubashevsky-Peikert-Regev (LPR) ෩҉߸Ͱ͸ެ։‫ݤ‬ͷٙࣅϥϯμϜੑΛ൑ఆ൛ LPN Ծఆ͔Βࣔ͢͜ͱ͕Ͱ͖Δ.

• k : ҆શੑύϥϝʔλ• n = n1 + n2 : αϯϓϧͷ‫਺ݸ‬• τ : ‫ࠩޡ‬ύϥϝʔλ (ྫ: τ = ck )• t : ‫ޡ‬Γగਖ਼ූ߸ͷ‫ޡ‬Γగਖ਼ೳྗ ( t = Ω(τ n) )‫ݤ‬ੜ੒:

1 ×n2‫ޡ‬Γగਖ਼ೳྗ͕ t Ͱ͋Δ [n2 , ℓ] -ઢ‫߸ූܗ‬ͷੜ੒ߦྻ Gc Λੜ੒͢Δ. A ← Fk×n1 ͱ͢Δ. X ← Bern,τ2
Y ← Berk×n
ͱ͠, B = AX + Y ∈ Fk×n2 ͱ͢Δ.
τެ։‫ݤ‬Λ G̃ = [A | B] ∈ Fk×n ͱ͠, ൿີ‫ݤ‬Λ (A, B, X) ͱ͢Δ.

38

҉߸Խ:

n
ฏจΛ m ∈ Fℓ2 ͱ͢Δ. ཚ਺ s ← Berkτ ͱ ཚ਺ e ← Bernτ Λબͼ, ҉߸จ c = sG̃ + e + (0n1 , mGc ) ∈ FΛ‫͢ࢉܭ‬Δ.
෮߸:) *d = c · −XΛ‫͢ࢉܭ‬Δ. d Λ‫ޡ‬Γగਖ਼ූ߸Ͱగਖ਼͠෮߸͢Δͱ m ΛಘΔ.
In
2෮߸ͷਖ਼౰ੑ͸ҎԼͰ֬ೝ͞ΕΔ. c = sG̃ + e + (0n1 , mGc ) ͳͷͰ, લ൒෦Λ u = sA + e1 , ‫ޙ‬൒෦Λ

v = sB + e2 + mGc ͱॻ͘.
) *d = c · −XΛ‫͢ࢉܭ‬Δͱ,In
2

d = v − uX = mGc + sB + e2 − sAX − e1 X = mGc + (e2 − e1 X + sY )

ΛಘΔ. mGc ͸ූ߸‫͋Ͱޠ‬Γ, e2 − e1 X + sY ͸‫ޡ‬ΓϕΫτϧͰ͋Δ. Αͬͯ, e2 − e1 X + sY ͷॏΈ͕ t ҎԼͰ͋Ε͹, ‫ޡ‬Γగਖ਼ූ߸ͷ෮߸ʹΑΓ, m ΛಘΔ. Αͬͯ, ߴ͍֬཰Ͱ෮߸ʹ੒ޭ͢Δ.

G̃ ͕ϥϯμϜͰ͋Ε͹, ҉߸จ c ͸ LPN ԾఆͷԼͰٙࣅϥϯμϜͰ͋Δ. G̃ ͕ٙࣅϥϯμϜͰ͋Δ͜ͱΛ‫ͨ͏ݴ‬Ίʹ͸, B = AX + Y ͕ٙࣅϥϯμϜͰ͋Ε͹Α͍. ͜Ε͸, ύϥϝʔλΛมߋͨ͠ LPN ԾఆͷԼ, ੒ཱ͢Δ.

3.2.5 ॺ໊ํࣜ 1: CFS ॺ໊ͱͦͷมछ
Courtois, Finiasz, Sendrier ͕ 2001 ೥ʹఏҊͨ͠ [18]. ͷͪʹ, ҆શੑূ໌ʹ༻͍ΒΕͨԾఆ͕ఏҊύϥϝʔληοτͰ͸੒Γཱͨͳ͍͜ͱ͕ࣔ͞Εͨ [23, 24]. ͔͠͠‫ޙ‬ͷํࣜʹେ͖ͳӨ‫ڹ‬Λ༩͑ͨͨΊ, ͜͜ʹ‫͢ه‬. Niederreiter҉߸Λࢥ͍ग़͢ͱ, ൿີ‫ݤ‬Λ͍࣋ͬͯΔ৔߹, w ҎԼͷॏΈͷ‫ޡ‬Γ͸గਖ਼Ͱ͖Δ. ͔͠͠ గਖ਼ՄೳͳγϯυϩʔϜͷू߹ {eH̃ ∈ Fn−k | e ∈ S(n, w)} ͷαΠζ͸ Fn−k ͷαΠζʹൺ΂Ε͹ѹ౗తʹগͳ͍. ͦͷͨΊ, Full-Domain

Hash ๏Λ࢖͓͏ͱͯ͠, จॻͷϋογϡ஋Λ u ∈ Fn−k ʹࣸͨ͠৔߹, ਖ਼͘͠෮߸Ͱ͖ͳ͍ϋογϡ஋ʹͳΔ͜ͱ͕

ଟ͍. ͦ͜Ͱ CFS ॺ໊Ͱ͸, ϋογϡ஋Λ u = Hash(M, i) ͱ i ΛΠϯΫϦϝϯτ͠ͳ͕Β‫͢ࢉܭ‬Δ. ϋογϡ஋͕{eH̃ ∈ Fn−k | e ∈ S(n, w)} ʹೖΔ΋ͷΛ࠾༻͢Δ.
ॺ໊‫ݤূݕͱݤ‬:ύϦςΟ‫ ྻߦࠪݕ‬H̃ ∈ F(n−k)×n Λ‫͢ͱݤূݕ‬Δ. ·ͨൿີ‫ݤ‬Λ༻͍Δͱ, ॏΈ w ҎԼͷූ߸‫ޠ‬Λగਖ਼Ͱ͖Δ͜ͱͱ͢Δ.
ॺ໊:จॻ M ʹ͍ͭͯ,

1. i = 0 ͱ͢Δ
2. u = Hash(M, i) Λ‫͢ࢉܭ‬Δ
3. ॏΈ w ҎԼͷ e Ͱ, e · H̃ ⊤ = u ͱͳΔ΋ͷΛ‫͢ࢉܭ‬Δ. ͳ͚Ε͹ i ← i + 1 ͱͯ͠εςοϓ 2 ʹ໭Δ
4. σ = (e, i) Λग़ྗ͢Δ.
‫ূݕ‬:จॻ M ͱ σ = (e, i) ʹ͍ͭͯ, HW(e) ≤ w ͱ e · H̃ ⊤ = Hash(M, i) ͳΒ͹, डཧ͢Δ. ͦ͏Ͱͳ͍ͳΒ͹,ෆडཧͱ͢Δ.

҆શੑͷࠜ‫ͯ͠ͱڌ‬, ҎԼͷ 2 ͭͷԾఆΛඞཁͱ͢Δ.

• McEliece Ծఆ: τϥοϓυΞ͕ೖ͍ͬͯΔ H̃ ͸ϥϯμϜූ߸ͷύϦςΟ‫۠ͱྻߦࠪݕ‬ผ͕෇͔ͳ͍
• ୳ࡧ൛ SD Ծఆ: ୳ࡧ൛ SD ໰୊͕ࠔ೉

3.3 ۩ମతͳ҉߸ํࣜຊߘͰ͸ҎԼͷ҉߸ํࣜΛऔΓ্͛Δ.

39

1. Classic McEliece: ϋϛϯά‫཭ڑ‬Λ࠾༻, Niederreiter ҉߸Λ࠾༻, ූ߸ͷߏ੒͕ඇৗʹอकత, ͱ͍͏‫͔఺؍‬Β͜ΕΛऔΓ্͛Δ.

2. DAGS: ϋϛϯά‫཭ڑ‬Λ࠾༻, McEliece ҉߸Λ࠾༻, Quasi-Dyadic ූ߸Λ༻͍ͯ‫ݤ‬Λѹॖ͍ͯ͠Δ, ͱ͍͏‫఺؍‬͔Β͜ΕΛऔΓ্͛Δ.

3. RQC: ϥϯΫ‫཭ڑ‬Λ࠾༻, LPR ෩҉߸Λ࠾༻, Quasi-Cyclic ූ߸Λ༻͍ͯ‫ݤ‬Λѹॖ͍ͯ͠Δ, ͱ͍͏ಛ௃͔Β͜ΕΛऔΓ্͛Δ.

4. RankSing: ϥϯΫ‫཭ڑ‬Λ࠾༻, CFS ॺ໊Λ࠾༻ͱ͍͏ಛ௃͔ΒഁΕ͸͍ͯ͠Δ͕͜ΕΛऔΓ্͛Δ.
ද 3.3

ຊઅͰѻ͏ओཁͳූ߸ʹ‫ٕ߸҉ͮ͘ج‬ज़

จ‫ݙ‬

҉߸Խ

‫׵ަݤ‬

Classic McEliece [8]˓˓DAGS [6]˓˓

RQC [2]

˓

˓

ॺ໊

˓

RankSign [5]3.3.1 ҉߸ํࣜ 1: Classic McEliece• ఏ Ҋ ऀ: Bernstein, Chou, Lange, von Maurich, Misoczki, Niederhagen, Persichetti, Peters, Schwabe,
Sendrier, Szefer, Wang.

• ‫ج‬ຊํࣜͷઆ໌: Niederreiter ҉߸ํࣜʹ‫͍͍ͯͮج‬Δ. ‫ج‬ຊූ߸ํࣜͱͯ͠ 2 ਐ Goppa ූ߸Λར༻͍ͯ͠Δ.
‫ݤ‬ੜ੒:t ‫ޡ‬ΓΛగਖ਼Ͱ͖Δ 2 ਐ Goppa ූ߸ͷύϦςΟ‫ ྻߦࠪݕ‬H ΛϥϯμϜੜ੒͢Δ. ૊৫ූ߸Խ͠,(n−k)×kH̃ = [In−k | T ] ͱ͢Δ. ެ։‫ݤ‬Λ T ∈ F2

ͱ͢Δ. ෮߸‫ݤ‬Λූ߸ੜ੒ʹ࢖ͬͨύϥϝʔλͱ͢Δ.

(n−k)×k҉߸Խ E(pk, e) : ೖྗΛ, pk = T ∈ F2
ͱ e ∈ SH (n, t) ͱ͢Δ. H̃ = [In−k | T ] ͱ͠, ҉߸จͱͯ͠
n−kc = H̃ · e ∈ F2
Λग़ྗ͢Δ.

෮߸ D(sk, c) :ॏΈ t ͷϕΫτϧ e Λ෮߸͢Δ.

1. c ʹ k ‫ݸ‬θϩΛՃ͑, v = (c, 0k ) ∈ Fn Λߟ͑Δ

2. Goppa ූ߸ͷ෮߸ΞϧΰϦζϜΛ༻͍ͯ, v ͱ‫ ཭ڑ‬t ҎԼʹ͋Δූ߸‫ ޠ‬d Λ‫͢ࢉܭ‬Δ. (ͳ͚Ε͹ ⊥ Λ
ग़ྗ͢Δ)

3. e = v + d ͱ͢Δ.
4. HW(e) = t ͔ͭ c = H̃e ͳΒ͹ e Λग़ྗ͢Δ. (ͦ͏Ͱͳ͚Ε͹ ⊥ Λग़ྗ͢Δ.)• ‫ݤ‬ΧϓηϧԽํࣜͷઆ໌: ‫ج‬ຊํࣜΛܾఆੑͷެ։‫ͱ߸҉ݤ‬Έͳ͠, HU̸⊥m ม‫׵‬Λ͔͚ͨ΋ͷͱΈͳͤΔ. ҎԼͰ͸ϋογϡؔ਺ H : {0, 1}∗ → {0, 1}256 Λ༻͍Δ.
‫ݤ‬ੜ੒:

ެ։‫ݤ‬͸ಉ͡. ෮߸‫ʹݤ‬, n ϏοτͷϥϯμϜจࣈྻ s ΛՃ͑Δ.

‫ݤ‬ΧϓηϧԽ:

1. e ← S(n, t)

2. C0 = E(pk, e)

3. C1 = H(2, e) ͱ͠, C = (C0 , C1 ) ͱ͢Δ.
4. K = H(1, e, C) ͱ͢Δ.
5. ҉߸จ͸ C, ηογϣϯ‫ݤ‬͸ K.
σΧϓηϧ:

1. C = (C0 , C1 ) ∈ Fn−k
× Fℓ2 ͱύʔε͢Δ240

ද 3.4

Classic McEliece ͷύϥϝʔλ. ୯Ґ͸શͯ bit ͱ͢Δ.

ύϥϝʔλ໊

ެ։‫ݤ‬௕

ൿີ‫ݤ‬௕

҉߸จ௕

kem/mceliece6960119

8 373 911

8 484 818

1 803

kem/mceliece8192128

10 862 592

10 974 848

1 920

2. b = 1 ͱ͢Δ
3. e ← D(sk, C0 ) ͱ͢Δ. e = ⊥ Ͱ͋Ε͹, b = 0, e = s ͱ্ॻ͖͢Δ
4. C1′ = H(2, e) ͱ͢Δ.

5. C1′ ̸= C1 ͳΒ͹, b = 0, e = s ͱ্ॻ͖͢Δ.
6. K = H(b, e, C) Λ‫͢ࢉܭ‬Δ.
7. K Λग़ྗ͢Δ.
ද 3.4 ʹ‫ݤ‬ΧϓηϧԽํࣜͷ‫ݤ‬௕͓Αͼ҉߸จ௕Λ·ͱΊͨ. 2 ͭͷύϥϝʔληοτ (kem/mceliece6960119,

kem/mceliece8192128) ͕, ͲͪΒ΋ Category 5 ૬౰ͱͯ͠ఏҊ͞Ε͍ͯΔ.

3.3.2 ҉߸ํࣜ 2: DAGS• ఏҊऀ: Banegas, Barreto, Boidje, Cayrel, Dione, Gaj, Gueye, Haeussler, Klamti, N’diaye, Nguyen, Persichetti, Ricardini.

• ‫ج‬ຊํࣜͷઆ໌: k = k ′ + k ′′ ͱ͢Δ.
‫ݤ‬ੜ੒:

McEliece ҉߸ͱಉ༷ʹ pk = G̃ ∈ Fk×n ͱ͢Δ. ͨͩ͠, G̃ ͸ Quasi-Dyadic ͱͳΔΑ͏ʹ‫ج‬ຊූ߸ΛબΜͰ͍Δ.

҉߸Խ E(pk, m; ρ, e) :Λग़ྗ͢Δ.
‫ݤ‬ੜ੒ D(sk, c) :′′′ɹ m ∈ Fkq Λฏจͱ͠, ρ ∈ Fqk ͱ e ∈ Sq (n, t) Λཚ਺ͱ͢Δ. c = (ρ, m) · G̃ + e

McEliece ҉߸ͷ෮߸Λߦ͍, (ρ, m) ΛಘΔ. m Λग़ྗ͢Δ.

• ‫ݤ‬ΧϓηϧԽํࣜͷઆ໌: ‫ج‬ຊํࣜΛཚ୒ެ։‫ͱࣜํ߸҉ݤ‬Έͳ͠, QFO⊥m ม‫׵‬Λద༻ͨ͠΋ͷͱΈͳͤΔ. ҎԼͰ͸ϋογϡؔ਺ H, H′ : {0, 1}∗ → {0, 1}256 Λ༻͍Δ.
‫ݤ‬ੜ੒:

ಉ্.

‫ݤ‬ΧϓηϧԽ:′

1. m ← Fkq ͱ͢Δ.
′′′

2. r = (ρ, σ) = HG (m) ∈ Fkq × Fkq Λ‫͢ࢉܭ‬Δ.
3. e ∈ Sq (n, w) Λ σ ͔Β‫͢ࢉܭ‬Δ
4. c = E(pk, m; ρ, e) ͱ͢Δ.
5. d = H′ (m) Λ‫͢ࢉܭ‬Δ.
6. K = H(m) Λ‫͢ࢉܭ‬Δ.
7. ҉߸จΛ C = (c, d) ͱ͠, ‫ݤ‬Λ K ͱ͢Δ.
σΧϓηϧ:

1. sk Λ༻͍ͯ c Λ෮߸ͯ͠, µ′ = (ρ′ , m′ ) ͓Αͼ e′ ΛಘΔ.

2. ෮߸ʹࣦഊͨ͠Β, ⊥ Λग़ྗͯ͠ఀࢭ

3. HW (e′ ) ̸= w ͳΒ, ⊥ Λग़ྗͯ͠ఀࢭ
′′′4. r ′ = (ρ′′ , σ ′ ) = HG (m′ ) ∈ Fkq × Fkq Λ‫͢ࢉܭ‬Δ.

41

ද 3.5DGAS ͷύϥϝʔλ. ୯Ґ͸શͯ bit ͱ͢Δ.

ύϥϝʔλ໊

ެ։‫ݤ‬௕

ൿີ‫ݤ‬௕

҉߸จ௕

DAG 1

54 080

1 730 560

4 416

DAG 3

67 5845 136 384

7 552

DAG 5

92 92817 842 176

12 9285. e′′ ∈ Sq (n, w) Λ σ ′ ͔Β‫͢ࢉܭ‬Δ
6. d = H′ (m) Λ‫͢ࢉܭ‬Δ.

7. e ̸= e′′ or ρ′ ̸= ρ′′ or d ̸= d′ ͳΒ͹, ⊥ Λग़ྗͯ͠ఀࢭ
8. K = H(m′ ) Λ‫͠ࢉܭ‬, ग़ྗ͢Δ.

ද 3.5 ʹ‫ݤ‬ΧϓηϧԽํࣜͷ‫ݤ‬௕͓Αͼ҉߸จ௕Λ·ͱΊͨ. 3 ͭͷύϥϝʔληοτ͕ͦΕͧΕ Category 1, 3, 5૬౰ͱͯ͠ఏҊ͞Εͨ.

3.3.2.1 ߈ܸʹ͍ͭͯ
Barelli ͱ Couvreur ʹΑΓ߈ܸ͕ఏҊ͞Ε͍ͯΔ [7]. ൴ΒͷධՁʹΑΕ͹, ެ։‫͔ݤ‬Βൿີ‫ݤ‬Λ‫ٻ‬ΊΔʹ͸, Fq ্
2qͷૢ࡞Λ O(n3+ #G ) ճඞཁͱͷ͜ͱͰ͋Δ. ͜͜Ͱ, G ͸ූ߸ͷஔ‫͋Ͱ܈׵‬Δ. *8 ۩ମతͳύϥϝʔλʹ౰ͯ͸ΊͯFq ্ͷԋࢉճ਺Λ‫ੵݟ‬΋Δͱ, DAG 1 Ͱ 270 , DAG 3 Ͱ 280 , DAG 5 Ͱ 258 ͱͳΔ. Grobner ‫ج‬ఈΛ‫ٻ‬ΊΔΞϧΰϦ
ζϜΛ༻͍࣮ͯ‫ݧ‬తʹղ͍ͨ৔߹͸ DAG 1 19 ෼, DAG 5 Ͱ 1 ෼ະຬͰ͋ͬͨ.
͜ͷ߈ܸΛड͚, v2 ͱ͍͏ύϥϝʔληοτ͕ఏҊ͞Ε͍ͯΔ.

3.3.3 ҉߸ํࣜ 3: RQC• ఏҊऀ: Aguilar Melchor, Blazy, Aragon, Deneuville, Bettaieb, Gaborit, Bidoux, Zemor.

• ‫ج‬ຊํࣜͷઆ໌: ූ߸൛ͷ LPR ҉߸ํࣜʹ‫͖ͮج‬, ެ։‫߸҉ݤ‬Λߏ੒͍ͯ͠Δ. ‫ج‬ຊͱͳΔූ߸ʹϥϯΫ‫༻཭ڑ‬′ͷූ߸Λ࠾༻͍ͯ͠Δ. ҎԼͰ͸ n′ = n1 = n2 ͱ͢Δ. R = Fqm [X]/(X n − 1) ͱ͢Δ. ϥϯΫॏΈ w ·Ͱͷ‫ޡ‬ΓΛగਖ਼Ͱ͖Δ [n′ , ℓ] -ઢ‫߸ූܗ‬Λ࠾༻͠, ͦͷූ߸Խɾ෮߸ΞϧΰϦζϜΛ encode, decode ͱ͢Δ.
‫ݤ‬ੜ੒:a ← R, x, y ← SR (n′ , w) ͱ͠, b = ax + y Λ‫͢ࢉܭ‬Δ. pk = (a, b) ∈ R2 ͱ͠, sk = (x, y) ͱ͢Δ.

҉߸Խ E(pk, m, s, e1 , e2 ) :c = (u, v) = (sa + e1 , sb + e2 + encode(m)) Λग़ྗ͢Δ. ( e ← SR (n′ , we ),e1 , e2 ← SR (n′ , wr ) ͱ͍ͯ͠Δ)

෮߸ D(sk, c):c = (u, v) ʹରͯ͠, decode(v − ux) Λग़ྗ͢Δ.

• ‫ݤ‬ΧϓηϧԽํࣜ: ‫ج‬ຊํࣜΛཚ୒ͳެ։‫ͱ߸҉ݤ‬Έͳ͠, QFO⊥ ม‫׵‬Λద༻ͨ͠΋ͷͱΈͳͤΔ. ҎԼͰ͸ϋογϡؔ਺ H, H′ : {0, 1}∗ → {0, 1}256 Λ༻͍Δ. ·ͨ, XOF *9 ͱͯ͠ HG : {0, 1}→ {0, 1}∗ ΋༻͍Δ.
‫ݤ‬ੜ੒:

ಉ্‫ݤ‬ΧϓηϧԽ:

1. m ← Fℓqm ΛϥϯμϜʹͱΔ.

2. θ ← HG (m) Λ‫͢ࢉܭ‬Δ. θ ͔Β s, e1 , e2 Λੜ੒͢Δ.

3. c = (u, v) = E(pk, m, s, e1 , e2 ) Λ‫͢ࢉܭ‬Δ. d = H′ (m) ͱ͢Δ. K = H(m, c) ͱ͢Δ.
ූ߸ C ⊂ Fn
q m ʹ͍ͭͯ, P erm(C) = {σ ∈ Sn | σ(C) = C} ͷ͜ͱΛූ߸ C ͷஔ‫Ϳݺͱ܈׵‬.
9* eXtendable-Output Functions ͷུ. SHAKE128 ΍ SHAKE256 ͕ྫͱͯ͠஌ΒΕ͍ͯΔ.
*842

ද 3.6

RQC ͷύϥϝʔλ. ୯Ґ͸શͯ bit ͱ͢Δ.

ύϥϝʔλ໊

ެ։‫ݤ‬௕

ൿີ‫ݤ‬௕

҉߸จ௕

RQC-I

11 926

11 926

12 438RQC-II

21 92221 92222 434RQC-III

28 07828 07828 5904. ҉߸จ C = (c, d), ηογϣϯ‫ ݤ‬K Λग़ྗ͢Δ.
σΧϓηϧ:

1. m′ ← D(sk, c) Λ‫͢ࢉܭ‬Δ.

2. θ′ = HG (m′ ) Λ‫͢ࢉܭ‬Δ. θ′ ͔Β s′ , e′1 , e′2 Λੜ੒͢Δ.
3. c ̸= E(pk, m′ , s′ , e′1 , e′2 ) or d ̸= d′ ͳΒ͹ ⊥ Λग़ྗͯ͠ఀࢭ.
4. K = H(m, c) Λग़ྗ͢Δ.

ද 3.6 ʹ‫ݤ‬ΧϓηϧԽํࣜͷ‫ݤ‬௕͓Αͼ҉߸จ௕Λ·ͱΊͨ. 3 ͭͷύϥϝʔληοτ͕ͦΕͧΕ Category 1, 3, 5૬౰ͱͯ͠ఏҊ͞Εͨ.
ͳ͓, x, y Λ࡞Δࡍͷγʔυ͚͓֮ͩ͑ͯ͘͜ͱʹ͢Ε͹, ൿີ‫ݤ‬௕ΛॖΊΔ͜ͱ͕ՄೳͰ͋Δʢྫ͑͹ |sk| = 512

bitsʣ. ಉ༷ʹެ։‫ݤ‬ੜ੒ͷ a Λٙࣅཚ਺Ͱੜ੒͢Δ͜ͱʹ͢Ε͹, |pk ′ | = |pk|/2 + 512 bits ͱ໿൒෼ʹͳΔ.

3.3.4 ॺ໊ํࣜ 1: RankSign• ఏҊऀ: Nicolas Aragon, Olivier Ruatta, Philippe Gaborit, Gilles Zemor, Adrien Hauteville.

• ‫ج‬ຊํࣜͷઆ໌: ϥϯΫ‫཭ڑ‬ϕʔεͷ CFS ॺ໊Ͱ͋Δ. augmented Low-Rank Parity-Check ߦྻ͔Βූ߸Λߏ੒͍ͯ͠Δ఺͕৽͍͠.
‫ݤ‬ੜ੒:(n−k)×n

H ∈ Fq mϜͷੜ੒͢Δ.

(n−k)×t

Λ LRPC ූ߸ͷύϦςΟ‫͢ͱྻߦࠪݕ‬Δ. R ← Fqm, Q ← GLn+t (Fq ) Λϥϯμ͞Βʹ, [R | H] · Q Λ ύϦςΟ‫͢ͱྻߦࠪݕ‬Δ [n + t, k + t]qm ූ߸ C Λߟ͑Δ. ͜ͷූ߸ C ͷ૊৫ύϦ(n−k)×(n+t)ςΟ‫ྻߦࠪݕ‬Λ‫ ݤূݕ‬pk = H̃ = [In−k | R′ ] ∈ Fqm

ͱ͢Δ. ʢ͢ͳΘͪ, ͋Δߦྻ P ͕ଘࡏͯ͠, H̃ = P · [R | H]Q ͱͰ͖Δʣsk = (P , [R | H], Q) Λൿີ‫͢ͱݤ‬Δ.

ॺ໊:M Λฏจͱͯ͠,1. seed ← {0, 1}ℓ2. s = HG (M, seed)
3. e′ ← Sqm (n + t, t′ )4. s′ = s − e′ · H̃ ⊤5. (e1 , e2 , . . . , et ) ∈ Ftqm ΛϥϯμϜʹબͼ, ઢ‫ ۭؒܗ‬T = ⟨e1 , e2 , . . . , et ⟩ ͱ͢Δ.
6. s′′ = s′ P −⊤ − (e1 , e2 , . . . , et ) · R⊤ Λ‫͢ࢉܭ‬Δ.

7. ߦྻ H, ෦෼ۭؒ T ͓ΑͼγϯυϩʔϜ s′′ ʹରͯ͠ූ߸ͷ෮߸Λߦ͍, ॏΈ w′ = w − t′ ҎԼͷ ‫ޡ‬ΓϕΫτϧ (et+1 , et+2 , . . . , en+t ) Λ‫͢ࢉܭ‬Δ. s′′ ͕ T -෮߸ෆՄೳͳ৔߹, Step1 ʹ໭Δ.

8. e = e′ + (e1 , e2 , . . . , en+t ) · Q−⊤ ͱ͢Δ.
9. ॺ໊ͱͯ͠, σ = (seed, e) Λग़ྗ͢Δ.
‫ূݕ‬:e · H̃ = HG (M, seed) ͔ͭ w(e) ≤ r ͳΒ͹, ॺ໊Λडཧ͢Δ. ͦ͏Ͱͳ͍ͳΒ͹, ෆडཧͱ͢Δ.

43

ද 3.7

RankSign ͷύϥϝʔλ. ୯Ґ͸શͯ bit ͱ͢Δ.

ύϥϝʔλ໊

‫ݤূݕ‬௕

ॺ໊௕

RankSign I

80 640

11 008

RankSign II

96 76812 000

RankSign III

155 520

17 280

RankSign IV

228 480

23 424

ද 3.7 ʹ‫ݤ‬௕ͱॺ໊௕Λ·ͱΊͨ.

3.3.4.1 ߈ܸʹ͍ͭͯ
Debris-Alazard ͱ Tillich ʹΑΓ, ͢΂ͯͷύϥϝʔλྫ͕ഁΒΕ͍ͯΔ [20]. ॺ໊ੜ੒ͷޮ཰ੑΛॏࢹͨ݁͠Ռ, ඇৗʹ௿͍ϥϯΫॏΈͷූ߸‫ߏ͕ޠ‬੒ͨ͠ූ߸ʹଟ͘‫·ؚ‬Ε͍ͯͨ. ൴Β͸͜ͷΑ͏ͳූ߸‫ޠ‬Λ୳ࡧ͢Δ୅਺తΞϧΰϦζϜΛఏҊ͠, ·ͨͦͷූ߸‫ޠ‬Λ‫ͯ͠ʹݩ‬ൿີ‫ݤ‬૬౰ͷ৘ใΛ‫͖Ͱࢉܭ‬Δ͜ͱΛࣔͨ͠. ௿ϥϯΫॏΈූ߸‫ޠ‬Λ୳ࡧ͢ΔͨΊʹҰ෦Ͱଟม਺࿈ཱೋ࣍ଟ߲ࣜΛղ͘ඞཁ͕͋Δ. RankSign IV ͷύϥϝʔλઃఆͰ͋ͬͯ΋, ࣮‫ݧ‬తʹ͸ 260
ඵఔ౓Ͱූ߸‫ޠ‬Λ̍ͭ୳ࡧͰ͖Δͱใࠂ͞Ε͍ͯΔ. ʢ·ͨ৭ʑͳํ๏Ͱม਺আ‫ڈ‬Λߦ͏ͱ, ͢΂ͯͷύϥϝʔλઃఆͰํఔࣜͷ਺͕ม਺ͷ਺ΑΓଟ͍͜ͱ͕ࣔ͞Ε͍ͯΔ (Prop.4) ʣ͕ͨͬͯ͠, ύϥϝʔλͷऔΓํ͚ͩͰͳ͘ߏ੒ํ
๏ࣗମΛม͑Δඞཁ͕͋Δ.

3.4 ·ͱΊූ߸ʹ‫ٕ߸҉ͮ͘ج‬ज़͸ McEliece ʹΑΓ 40 ೥Ҏ্લʹఏҊ͞Ε͓ͯΓ, ύϥϝʔλ͸վగ͞Ε͍ͯΔ΋ͷͷ, ͍·ͩʹഁΒΕ͍ͯͳ͍҉߸ํࣜͰ͋Δ. Classic McEliece ͳͲͷΑ͏ʹ, ެ։‫ݤ‬΍ൿີ‫ݤ‬͸௕͍΋ͷͷ, ҉߸จ͸୹͍ํ
͕ࣜଟ͍. LPN ໰୊͸ֶशཧ࿦΍ූ߸ཧ࿦͔Β೿ੜͨ͠໰୊Ͱ͋Γ, ‫ޡ‬Γ֬཰ τ ͕े෼େ͖͍৔߹ͷ LPN ໰୊Λଟ߲ࣜ࣌ؒͰޮ཰తʹղ͘͜ͱ͸ࠔ೉Ͱ͋Δͱ༧૝͞Ε͍ͯΔ.
‫ڞ‬௨‫ݤ‬΍ެ։‫ݤ‬ͷ෼໺Ͱଟ͘ͷํ͕ࣜ LPN ໰୊ʹ‫͍ͯͮج‬ఏҊ͞Ε͍ͯΔ. LWE ໰୊ͱൺֱͨ͠৔߹, ར఺ͱͯ͠͸,

• F2 ͓Αͼͦͷ֦େମΛ‫ߏʹج‬੒͢ΔͨΊ, ϋʔυ΢ΣΞߏ੒ͱͷ૬ੑ͕ྑ͍఺• ‫ࠩޡ‬෼෍ͱͯ͠ϕϧψʔΠ෼෍΍ͦͷҰൠԽͨ͠෼෍Λ༻͍ΔͨΊ, ‫ࠩޡ‬ͷαϯϓϦϯά͕༰қͰ͋Δ఺͕‫͛ڍ‬ΒΕΔ. Ұํ, ܽ఺ͱͯ͠,• ‫ݤ‬΍҉߸จͷαΠζ͕େ͖͘ͳΓ΍͍͢఺• ID ϕʔε҉߸΍‫׬‬શ४ಉ‫ൃ͍ͨͬͱ߸҉ܕ‬లతͳԠ༻͕গͳ͍఺
͕‫͛ڍ‬ΒΕΔ.
҉߸ํࣜͷύϥϝʔλઃఆͷࡍʹ͸, 3.1 અͰ‫ͳ·͟·ͨ͛͞ڍ‬ΞϧΰϦζϜΛߟྀ͢Δඞཁ͕͋Δ. ΞϧΰϦζϜͷ
ߴ଎Խʹ͍ͭͯ੝Μʹ‫͞ڀݚ‬Ε͓ͯΓ, ಈ޲Λ஫ࢹ͢Δඞཁ͕͋Δ. ·ͨ, ߈ܸʹ༻͍ΒΕΔΞϧΰϦζϜͷ‫ڀݚ‬͸ཧ࿦తͳ΋ͷ͕ଟ͘, ߈ܸ࣮‫ݧ‬ใࠂ͸খ͍͞ύϥϝʔλʹରͯ͠ߦͬͨ΋ͷ͕ଟ͍. ͦͷͨΊ, ߈ܸ࣮‫ؔ͢ʹݧ‬Δ‫ڀݚ‬΋͜Ε͔ΒඇৗʹॏཁͰ͋Δ.
ެ։‫ݤ‬΍ൿີ‫ݤ‬Λѹॖ͠Α͏ͱಛघͳූ߸Λ࠾༻ͨ͠Γ, ‫཭ڑ‬ͷఆٛΛม͑ΔఏҊ΋ଟ͋͘Δ. ͜ΕΒ͸ղಡ߈ܸΛ44ड͚Δ͜ͱ΋ଟ͘, ఏҊ͞Εͯ೔ͷઙ͍҉߸ɾॺ໊ํࣜʹ͍ͭͯ͸஫ࢹ͕ඞཁͰ͋Δ.

45

ୈ 3 ষͷࢀߟจ‫ݙ‬[1] M. Alekhnovich. More on average case vs approximation complexity. Computational Complexity,
20(4):755–786, 2011.
[2] C. Aguilar Melchor, O. Blazy, N. Aragon, J.-C. Deneuville, S. Bettaieb, P. Gaborit, L. Bidoux,
G. Zemor. RQC NIST PQC ඪ४Խ Round 1 ౤ߘࢿྉ. https://csrc:nist:gov/projects/post-quantum-cryptography/round-1-submissions[3] B. Applebaum, D. Cash, C. Peikert, A. Sahai. Fast cryptographic primitives and circular-secure
encryption based on hard learning problems. In S. Halevi, editor, Advances in Cryptology - CRYPTO
2009, 29th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 16-20,
2009. Proceedings, volume 5677 of Lecture Notes in Computer Science, pages 595–618. Springer,
2009.
[4] S. Arora and R. Ge. New algorithms for learning in presence of errors. In L. Aceto, M. Henzinger, andJ. Sgall, editors, Automata, Languages and Programming - 38th International Colloquium, ICALP
2011, Zurich, Switzerland, July 4-8, 2011, Proceedings, Part I, volume 6755 of Lecture Notes in
Computer Science, pages 403–415. Springer, 2011.
[5] N. Aragon, O. Ruatta, P. Gaborit, G. Zemor, A. Hauteville. RankSign NIST PQC ඪ४Խ Round 1 ౤ߘࢿྉ. https://csrc:nist:gov/projects/post-quantum-cryptography/round-1-submissions[6] G. Banegas, P. S. L. M. Barreto, B. O. Boidje, P.-L. Cayrel, G. N. Dione, K. Gaj, C. T. Gueye,
R. Haeussler, J. B. Klamti, O. N’diaye, D. T. Nguyen, E. Persichetti, J. E. Ricardini. DAGS NISTPQC ඪ४Խ Round 1 ౤ߘࢿྉ. https://csrc:nist:gov/projects/post-quantum-cryptography/round-1-submissions[7] É. Barelli and A. Couvreur. An eﬃcient structural attack on NIST submission DAGS. In Peyrin and
Galbraith [44], pages 93–118.
[8] D. J. Bernstein, T. Chou, T. Lange, I. von Maurich, R. Misoczki, R. Niederhagen, E. Persichetti,
C. Peters, P. Schwabe, N. Sendrier, J. Szefer, W. Wang. Classic McEliece NIST PQC ඪ४Խ Round 1
౤ߘࢿྉ. https://csrc:nist:gov/projects/post-quantum-cryptography/round-1-submissions[9] A. Blum, M. L. Furst, M. J. Kearns, and R. J. Lipton. Cryptographic primitives based on hard learning
problems. In D. R. Stinson, editor, Advances in Cryptology - CRYPTO ’93, 13th Annual International
Cryptology Conference, Santa Barbara, California, USA, August 22-26, 1993, Proceedings, volume 773
of Lecture Notes in Computer Science, pages 278–291. Springer, 1993.
[10] A. Becker, A. Joux, A. May, and A. Meurer. Decoding random binary linear codes in 2n/20 : How46

1 + 1 = 0 improves information set decoding. In D. Pointcheval and T. Johansson, editors, Advancesin Cryptology - EUROCRYPT 2012 - 31st Annual International Conference on the Theory and Applications of Cryptographic Techniques, Cambridge, UK, April 15-19, 2012. Proceedings, volume 7237
of Lecture Notes in Computer Science, pages 520–536. Springer, 2012.
[11] A. Blum, A. Kalai, and H. Wasserman. Noise-tolerant learning, the parity problem, and the statisticalquery model. J. ACM, 50(4):506–519, 2003.
[12] D. J. Bernstein and T. Lange. Never trust a bunny. In J.-H. Hoepman and I. Verbauwhede, editors,
Radio Frequency Identification. Security and Privacy Issues - 8th International Workshop, RFIDSec
2012, Nijmegen, The Netherlands, July 2-3, 2012, Revised Selected Papers, volume 7739 of Lecture
Notes in Computer Science, pages 137–148. Springer, 2012.
[13] D. J. Bernstein, T. Lange, and C. Peters. Smaller decoding exponents: Ball-collision decoding. In
P. Rogaway, editor, Advances in Cryptology - CRYPTO 2011 - 31st Annual Cryptology Conference,
Santa Barbara, CA, USA, August 14-18, 2011. Proceedings, volume 6841 of Lecture Notes in Computer
Science, pages 743–760. Springer, 2011.
[14] L. Both and A. May. Optimizing BJMM with nearest neighbors: Full decoding in 22n/21 and McEliece
security. In WCC 2017, 2017. See http://wcc2017.suai.ru/proceedings.html.
[15] L. Both and A. May. Decoding linear codes with high error rate and its impact for LPN security. In
Lange and Steinwandt [37], pages 25–46.
[16] E. R. Berlekamp, R. J. McEliece, and H. C. A. van Tilborg. On the inherent intractability of certain
coding problems. IEEE Trans. Information Theory, 24(3):384–386, 1978.
[17] S. Bogos and S. Vaudenay. Optimization of LPN solving algorithms. In J.-H. Cheon and T. Takagi,
editors, Advances in Cryptology - ASIACRYPT 2016 - 22nd International Conference on the Theory and Application of Cryptology and Information Security, Hanoi, Vietnam, December 4-8, 2016,
Proceedings, Part I, volume 10031 of Lecture Notes in Computer Science, pages 703–728, 2016.
[18] N. Courtois, M. Finiasz, and N. Sendrier. How to achieve a McEliece-based digital signature scheme.
In C. Boyd, editor, Advances in Cryptology - ASIACRYPT 2001, 7th International Conference on
the Theory and Application of Cryptology and Information Security, Gold Coast, Australia, December
9-13, 2001, Proceedings, volume 2248 of Lecture Notes in Computer Science, pages 157–174. Springer,
2001.
[19] S. Devadas, L. Ren, and H. Xiao. On iterative collision search for LPN and subset sum. In Y. Kalai and
L. Reyzin, editors, Theory of Cryptography - 15th International Conference, TCC 2017, Baltimore,
MD, USA, November 12-15, 2017, Proceedings, Part II, volume 10678 of Lecture Notes in Computer
Science, pages 729–746. Springer, 2017.
[20] T. Debris-Alazard and J.-P. Tillich. Two attacks on rank metric code-based schemes: RankSign andan IBE scheme. In Peyrin and Galbraith [44], pages 62–92.
[21] A. Esser, F. Heuer, R. Kübler, A. May, and C. Sohler. Dissection-BKW. In H. Shacham and
A. Boldyreva, editors, Advances in Cryptology - CRYPTO 2018 - 38th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 19-23, 2018, Proceedings, Part II, volume 10992
of Lecture Notes in Computer Science, pages 638–666. Springer, 2018.
[22] A. Esser, R. Kübler, and A. May. LPN decoded. In J. Katz and H. Shacham, editors, Advances in47

Cryptology - CRYPTO 2017 - 37th Annual International Cryptology Conference, Santa Barbara, CA,
USA, August 20-24, 2017, Proceedings, Part II, volume 10402 of Lecture Notes in Computer Science,
pages 486–514. Springer, 2017.
[23] J.-C. Faugère, V. Gauthier-Umaña, A. Otmani, L. Perret, and J.-P. Tillich. A distinguisher forhigh rate McEliece cryptosystems. In 2011 IEEE Information Theory Workshop, ITW 2011, Paraty,
Brazil, October 16-20, 2011, pages 282–286. IEEE, 2011.
[24] J.-C. Faugère, V. Gauthier-Umaña, A. Otmani, L. Perret, and J.-P. Tillich. A distinguisher for
high-rate McEliece cryptosystems. IEEE Trans. Information Theory, 59(10):6830–6844, 2013.
[25] Q. Guo, T. Johansson, and C. Löndahl. Solving LPN using covering codes. In P. Sarkar and T. Iwata,
editors, Advances in Cryptology - ASIACRYPT 2014 - 20th International Conference on the Theory
and Application of Cryptology and Information Security, Kaoshiung, Taiwan, R.O.C., December 7-11,
2014. Proceedings, Part I, volume 8873 of Lecture Notes in Computer Science, pages 1–20. Springer,
2014.
[26] H. Gilbert, M. J. B. Robshaw, and Y. Seurin. HB# : Increasing the security and eﬃciency of HB+ .
In N. P. Smart, editor, Advances in Cryptology - EUROCRYPT 2008, 27th Annual International
Conference on the Theory and Applications of Cryptographic Techniques, Istanbul, Turkey, April 1317, 2008. Proceedings, volume 4965 of Lecture Notes in Computer Science, pages 361–378. Springer,
2008.
[27] J. Håstad. Some optimal inapproximability results. J. ACM, 48(4):798–859, 2001.
[28] S. Heyse, Eike Kiltz, Vadim Lyubashevsky, Christof Paar, and Krzysztof Pietrzak. Lapin: An eﬃcientauthentication protocol based on ring-LPN. In A. Canteaut, editor, Fast Software Encryption - 19thInternational Workshop, FSE 2012, Washington, DC, USA, March 19-21, 2012. Revised Selected
Papers, volume 7549 of Lecture Notes in Computer Science, pages 346–365. Springer, 2012.
[29] P. Kirchner. Improved generalized birthday attack. IACR Cryptology ePrint Archive, 2011:377, 2011.
[30] E. Kirshanova. Improved quantum information set decoding. In Lange and Steinwandt [37], pages
507–527.
[31] K. Kaminakaya and N. Kunihiro. LPN ໰୊ʹର͢Δ BKW ΞϧΰϦζϜͷ֦ு. SCIS 2015, pages
3E1–3, 2015.
[32] J. Katz, J. S. Shin, and A. D. Smith. Parallel and Concurrent Security of the HB and HB+ protocols.
J. Cryptology, 23(3):402–421, 2010.
[33] G. Kachigar and J.-P. Tillich. Quantum information set decoding algorithms. In T. Lange and T. Takagi, editors, Post-Quantum Cryptography - 8th International Workshop, PQCrypto 2017, Utrecht, The
Netherlands, June 26-28, 2017, Proceedings, volume 10346 of Lecture Notes in Computer Science,
pages 69–89. Springer, 2017.
[34] P. J. Lee and E. F. Brickell. An observation on the security of McEliece’s public-key cryptosystem.
In C. G. Günther, editor, Advances in Cryptology - EUROCRYPT ’88, Workshop on the Theory
and Application of of Cryptographic Techniques, Davos, Switzerland, May 25-27, 1988, Proceedings,
volume 330 of Lecture Notes in Computer Science, pages 275–280. Springer, 1988.
[35] Y. Li, R. H. Deng, and X. Wang. On the equivalence of McEliece’s and Niederreiter’s public-key
cryptosystems. IEEE Trans. Information Theory, 40(1):271–273, 1994.
48

[36] É. Levieil and P.-A. Fouque. An improved LPN algorithm. In R. De Prisco and M. Yung, editors,
Security and Cryptography for Networks, 5th International Conference, SCN 2006, Maiori, Italy,
September 6-8, 2006, Proceedings, volume 4116 of Lecture Notes in Computer Science, pages 348–
359. Springer, 2006.
[37] T. Lange and R. Steinwandt, editors. Post-Quantum Cryptography - 9th International Conference,
PQCrypto 2018, Fort Lauderdale, FL, USA, April 9-11, 2018, Proceedings, volume 10786 of Lecture
Notes in Computer Science. Springer, 2018.
[38] V. Lyubashevsky. The parity problem in the presence of noise, decoding random linear codes, and thesubset sum problem. In C. Chekuri, K. Jansen, J. D. P. Rolim, and L. Trevisan, editors, Approximation, Randomization and Combinatorial Optimization, Algorithms and Techniques, 8th International
Workshop on Approximation Algorithms for Combinatorial Optimization Problems, APPROX 2005
and 9th InternationalWorkshop on Randomization and Computation, RANDOM 2005, Berkeley, CA,
USA, August 22-24, 2005, Proceedings, volume 3624 of Lecture Notes in Computer Science, pages
378–389. Springer, 2005.
[39] R. J. McEliece. A public-key cryptosystem based on algebraic coding theory. Jet Propulsion Laboratory
DSN Progress Report, 42–44:114–116, January and February 1978. https://ipnpr.jpl.nasa.gov/p
rogress report2/42-44/44N.PDF.
[40] A. May, A. Meurer, and E. Thomae. Decoding random linear codes in Õ(20.054n ). In D. H. Lee andX. Wang, editors, Advances in Cryptology - ASIACRYPT 2011 - 17th International Conference on
the Theory and Application of Cryptology and Information Security, Seoul, South Korea, December
4-8, 2011. Proceedings, volume 7073 of Lecture Notes in Computer Science, pages 107–124. Springer,
2011.
[41] A. May and I. Ozerov. On computing nearest neighbors with applications to decoding of binary linear
codes. In E. Oswald and M. Fischlin, editors, Advances in Cryptology - EUROCRYPT 2015 - 34th
Annual International Conference on the Theory and Applications of Cryptographic Techniques, Sofia,
Bulgaria, April 26-30, 2015, Proceedings, Part I, volume 9056 of Lecture Notes in Computer Science,
pages 203–228. Springer, 2015.
2 i[42] H. Niederreiter. Knapsack-type cryptosystems and algebraic coding theory. Problemy Upravleniia
Teorii Informat2sii, 15:19–34, 1986.
[43] R. Nojima, H. Imai, K. Kobara, and K. Morozov. Semantic security for the McEliece cryptosystem
without random oracles. Des. Codes Cryptography, 49(1-3):289–305, 2008.
[44] T. Peyrin and S. D. Galbraith, editors. Advances in Cryptology - ASIACRYPT 2018 - 24th International Conference on the Theory and Application of Cryptology and Information Security, Brisbane,
QLD, Australia, December 2-6, 2018, Proceedings, Part I, volume 11272 of Lecture Notes in Computer
Science. Springer, 2018.
[45] E. Prange. The use of information sets in decoding cyclic codes. IRE Trans. Information Theory,8(5):5–9, 1962.
[46] O. Regev. On lattices, learning with errors, random linear codes, and cryptography. J. ACM,
56(6):34:1–34:40, 2009. Preliminary version was presented at STOC 2005.
[47] J. Stern. A method for finding codewords of small weight. In G. D. Cohen and J. Wolfmann, editors,
49

Coding Theory and Applications, 3rd International Colloquium, Toulon, France, November 2-4, 1988,
Proceedings, volume 388 of Lecture Notes in Computer Science, pages 106–113. Springer, 1988.
[48] B. Zhang, L. Jiao, and M. Wang. Faster algorithms for solving LPN. In M. Fischlin and J.-S. Coron,
editors, Advances in Cryptology - EUROCRYPT 2016 - 35th Annual International Conference on the
Theory and Applications of Cryptographic Techniques, Vienna, Austria, May 8-12, 2016, Proceedings,
Part I, volume 9665 of Lecture Notes in Computer Science, pages 168–195. Springer, 2016.

50

ୈ4ষ

ଟม਺ଟ߲ࣜʹ‫ٕ߸҉ͮ͘ج‬ज़ଟม਺ଟ߲ࣜʹ‫ެͮ͘ج‬։‫߸҉ݤ‬͸, ଟม਺ެ։‫( ߸҉ݤ‬Multivariate Public Key Cryptosystemsʣͱ‫ݺ‬͹ΕΔ. ଟม਺ެ։‫߸҉ݤ‬͸, ҉߸ํࣜ, ॺ໊ํࣜͷߏ੒ʹ༻͍Δ͜ͱ͕Ͱ͖, ͦͷଟ͘͸ (༗‫ݶ‬ମ্ͷʣଟม਺ଟ߲ࣜࣸ૾ͷ୅ೖධՁΛ҉߸Խ͓Αͼॺ໊‫͍͍ͯ༻ʹূݕ‬ΔͨΊ, ޮ཰తͳΞϧΰϦζϜΛ࣋ͭ͜ͱ͕ಛ௃ͷҰͭͰ͋Δ.
ଟม਺ެ։‫߸҉ݤ‬ͷ҆શੑ͸ओʹ, MP ໰୊͓Αͼ IP ໰୊Λղ͘‫ࢉܭ‬ͷࠔ೉ੑʹ‫͍ͯͬڌ‬Δ. ຊใࠂॻͰ͸, MP ໰୊ʹର͢Δղಡํ๏ͱ, ‫ࡏݱ‬ఏҊ͞Ε͍ͯΔଟ͘ͷํ͕ࣜ࠾༻͍ͯ͠Δ૒‫ܕۃ‬γεςϜΛத৺ʹղઆ͢Δ. ૒‫ܕۃ‬γεςϜʹΑΔํࣜ͸, ҆શੑͷͨΊʹ MQ ໰୊ͷղಡࠔ೉ੑΛඞཁͱ͢Δ. ·ͨ, IP ໰୊ͷ֦ு໰୊Ͱ͋Δ EIP ໰୊ͷղಡࠔ೉ੑ΋҆શੑΛߴΊΔͨΊʹඞཁͱͳΔ.
૒‫ܕۃ‬γεςϜҎ֎ͷํࣜͱͯ͠͸, MP ໰୊ͷղಡࠔ೉ੑΛ҆શੑͷࠜ‫͢ͱڌ‬Δର࿩‫ܕ‬ೝূํࣜΛ঺հ͢Δ.

Fiat-Shamir ม‫׵‬Λ༻͍Δ͜ͱͰଟม਺ଟ߲ࣜʹ‫ߏ͕ࣜํ໊ॺͮ͘ج‬੒͞ΕΔ.

4.1 ଟม਺ଟ߲ࣜʹ‫ٕ߸҉ͮ͘ج‬ज़ͷ҆શੑͷࠜ‫ͳͱڌ‬Δ໰୊
4.1.1 ଟม਺ެ։‫͍ͯͭʹ߸҉ݤ‬
1984 ೥ʹ Ong Β͕ఏҊͨ͠ॺ໊ํࣜ [28] ʹ͓͍ͯ, ॳΊͯެ։‫“ ʹ߸҉ݤ‬ଟม਺”͕औΓೖΕΒΕͨ. ͜ͷํࣜ͸,ϝοηʔδ m ʹର͠, ߹੒਺ N Λ๏ͱ͢Δ 2 ม਺߹ಉํఔࣜ

x2 + hy 2 ≡ m mod Nͷղ (x, y) = (x0 , y0 ) Λॺ໊ͱ͢Δ΋ͷͰ͋Γ, N ͷૉҼ਺෼ղͷࠔ೉ੑΛ҆શੑͷϕʔεͱ͍ͯ͠Δ. ͔͠͠, ͜ͷॺ໊ํࣜ͸, 1987 ೥ʹ Pollard ͱ Schnorr ʹΑͬͯ N ͷૉҼ਺෼ղΛ༻͍Δ͜ͱͳ͘ղಡ͞Εͨ [34]. ͦͷ‫ޙ‬, ม਺ͷ‫਺ݸ‬Λ૿΍ͨ͠ํࣜ [38] ΍, ඇՄ‫؀׵‬Λར༻ͨ͠ํࣜ [37] ͳͲʹ֦ு͞Ε͕ͨ, ͍ͣΕ΋‫ʹط‬ղಡ͞Ε͍ͯΔ. ͜ΕΒͷํࣜ΋, ૉҼ਺෼ղ໰୊Λ҆શੑͷϕʔεͱͯ͠ߏ੒͞Ε͓ͯΓ, ଟม਺ެ։‫ʹ߸҉ݤ‬͸‫·ؚ‬Εͳ͍.

1988 ೥ʹদຊͱࠓҪ͕ఏҊͨ͠҉߸ํࣜ [27] ʹ͓͍ͯ, ॳΊͯଟม਺ެ։‫߸҉ݤ‬ͷΞΠσΞ͕ࣔ͞Εͨ. ͜ͷ҉߸ํࣜ͸দຊ-ࠓҪํࣜ (͋Δ͍͸ C ∗ ํࣜʣͱ‫ݺ‬͹Ε͍ͯΔ. 1995 ೥, Patarin ͸দຊ-ࠓҪํࣜΛղಡ͠ [29], ཌ 96 ೥ʹদຊ-ࠓҪํࣜΛ֦ுͨ͠ HFE (Hidden Field EquationʣΛఏҊͨ͠ [30]. HFE ࣗମ͸, 1999 ೥ʹ Kipnis ͱ ShamirʹΑͬͯղಡ͞Εͨ [26] ͕, HFE−v [30] ͳͲ, HFE ͷ೿ੜํࣜʹ͸க໋తͳ߈ܸΛ໔Ε͍ͯΔ΋ͷ͕͋Δ.
Ұํ, Patarin ͸ 1997 ೥ʹ (balanced) Oil-Vineger ํࣜͱ‫ݺ‬͹ΕΔॺ໊ํࣜ [31] Λൃදͨ͠. দຊ-ࠓҪํࣜ΍

HFE ͸, ‫ૅج‬ମͱͳΔ༗‫ݶ‬ମͱ͸ผʹ, ͦͷ֦େମΛิॿతʹར༻ͯ͠ߏ੒͍ͯ͠Δͷʹର͠, Oil-Vineger ํࣜ͸, ‫ج‬ૅମҎ֎ͷ༗‫ݶ‬ମΛߏ੒ʹར༻͠ͳ͍఺͕Ұͭͷಛ௃Ͱ͋Δ. (લऀͷΑ͏ͳߏ੒๏Λ big field ๏, ‫ऀޙ‬ͷΑ͏ͳߏ੒๏
Λ single field ๏ͱ͍͏.) Oil-Vineger ํࣜ͸, 1998 ೥ʹ Kipnis ͱ Shamir ʹΑͬͯղಡ͞Εͨ [25] ͕, ҆શੑΛ‫ڧ‬Խ

51

ͨ͠ UOV (Unbalanced Oil-Vinegar ํࣜʣ͕ Kipnis, Patarin ΒʹΑͬͯཌ 99 ೥ʹఏҊ͞Ε͍ͯΔ [24]. ·ͨ, 2005
೥ʹ͸ UOV Λଟ૚Խͨ͠ॺ໊ํࣜ Rainbow ͕, Ding ͱ Schmidt ʹΑΓఏҊ͞Ε͍ͯΔ [12].
͜Ε·Ͱઆ໌ͨ͠ํࣜ͸͍ͣΕ΋, ૒‫ܕۃ‬γεςϜ [10] ͱ‫ݺ‬͹ΕΔଟม਺ެ։‫߸҉ݤ‬ͷߏ੒๏Λ༻͍͍ͯΔ. ͔͠͠, ଟม਺ެ։‫߸҉ݤ‬͸ඞͣ͠΋૒‫ܕۃ‬γεςϜͰߏ੒͞ΕΔඞཁ͸ͳ͘, ࣮ࡍ, ιχʔ‫ࣜג‬ձࣾͷ࡞ຊ, നҪ, ඉ౉͕2011 ೥ʹఏҊͨ͠ 3-pass ͱ 5-pass ͷೝূํࣜ [35] ͸૒‫ܕۃ‬γεςϜΛར༻͍ͯ͠ͳ͍. ͜ͷ 5-pass ͷೝূํࣜʹ
Fiat-Shamir ม‫׵‬Λద༻ͨ͠ॺ໊ํ͕ࣜ, 2016 ೥ʹఏҊ͞Ε͍ͯΔ [6].
҉߸ํࣜͰ͸, HFE Ҏ༷߱ʑͳํ͕ࣜఏҊ͞Ε͕ͨ, ‫ࡏݱ‬க໋తͳ߈ܸΛ໔Ε͍ͯΔ΋ͷ (͓ΑͼఏҊ೥ʣͱͯ͠͸,

Simple Matrix ํࣜ (2013) [41], EFC (ͷมछʣ(2016) [40], HFERP (2018) [23], EFLASH (2018) [4] ͕͋Δ.

4.1.2 ଟม਺ެ։‫߸҉ݤ‬ͷ҆શੑͷࠜ‫ͳͱڌ‬Δ໰୊ͱͦͷղಡ‫ྔࢉܭ‬Fq ͰҐ਺ q ͷ༗‫ݶ‬ମΛද͠, x = (x1 , x2 , . . . , xn ) Ͱ (୅਺తʹಠཱͳʣม਺ͷू߹Λද͢΋ͷͱ͢Δ. x ʹؔ͢Δ
Fq ্ͷଟม਺ଟ߲ࣜͷ૊, ͢ͳΘͪ, ଟม਺ଟ߲ࣜ pi (x) (i = 1, 2, . . . , m) ʹΑΓ, P (x) = (p1 (x), p2 (x), . . . , pm (x))ͱද͞ΕΔ΋ͷΛ (Fq ্ͷʣଟม਺ଟ߲ࣜ‫͢ʹͱ͜Ϳݺͱܥ‬Δ. ͜ͷଟม਺ଟ߲ࣜ‫ ܥ‬P (x) ͸୅ೖධՁʹΑΓ, Fqn ͔Β Fqm ΁ͷࣸ૾Λߏ੒͢Δ. ͜ͷ (ଟม਺ଟ߲ࣜʣࣸ૾Λ P : Fqn → Fqm ͱද͢͜ͱʹ͢Δ. ‫߸ه‬ͷҧ͍ʹΑΓ, ଟม਺ଟ߲ࣜ‫ ܥ‬P (x) ͱଟม਺ଟ߲ࣜࣸ૾ P Λ۠ผ͢Δ.

ଟม਺ެ։‫߸҉ݤ‬ͷਖ਼ࣜͳఆٛ͸ͳ͍ͱࢥΘΕΔ͕, ͜͜Ͱ͸ MP ໰୊ (Multivariate Polynomialʣ·ͨ͸ IP ໰୊(Isomorphisms of Polynomialsʣͷղಡࠔ೉ੑΛϕʔεͱͨ͠ެ։‫߸҉ݤ‬ͷ͜ͱΛଟม਺ެ։‫ͱ߸҉ݤ‬ཧղ͢Δ͜ͱʹ
͢Δ. MP ໰୊, IP ໰୊͸࣍ͷΑ͏ʹ‫ه‬ड़͞ΕΔ.

MP ໰୊ ଟม਺ଟ߲ࣜ‫ ܥ‬P (x) = (p1 (x), p2 (x), . . . , pm (x)) ͱ d ∈ Fqm ʹରͯ͠, ม਺ x ʹؔ͢Δํఔࣜ‫ܥ‬P (x) = dͷղ (ଘࡏ͢ΔͳΒʣগͳ͘ͱ΋ 1 ͭ‫ٻ‬ΊΑ.

IP ໰୊ S, T ΛͦΕͧΕ, Fqn , Fqm ্ͷΞϑΟϯಉ‫͢ͱ૾ࣸܕ‬Δ. ଟม਺ଟ߲ࣜ‫ ܥ‬P (x) = (p1 (x), p2 (x), . . . , pm (x))ʹର͠, ଟม਺ଟ߲ࣜ‫ ܥ‬P̃ (x) Λ߹੒ʹΑΓ, P̃ (x) = T ◦ P (x) ◦ S ͰఆΊΔ. ͜ͷͱ͖, P (x), P̃ (x) ͷ৘ใ͔
Β S, T Λ‫ٻ‬ΊΑ.

MP ໰୊͸, d ΛࠨลʹҠߦͯ͠ P (x) ʹ‫ٵ‬ऩͤ͞Δ͜ͱ͕Ͱ͖ΔͷͰ, ӈลΛ 0m (m ࣍ͷྵϕΫτϧʣͱͯ͠ද
‫͞ݱ‬ΕΔ৔߹΋͋Δ. MP ໰୊ʹ͓͍ͯ, P (x) ͷ͢΂ͯͷ੒෼ pi (x) ͕ 1 ࣍ҎԼͱͳΔ৔߹, MP ໰୊͸୯ʹઢ‫ํܗ‬ఔࣜΛղ͘໰୊ͱͳΓ, Ψ΢εͷফ‫ڈ‬๏ͳͲͰଟ߲ࣜ࣌ؒͰղΛ‫ٻ‬ΊΔ͜ͱ͕ՄೳͰ͋Δ. Αͬͯ, MP ໰୊Λߟ͑Δ৔߹
͸௨ৗ, pi (x) ͷ࣍਺͸͢΂ͯ 2 Ҏ্Ͱ͋ΔͱԾఆ͢Δ. ಛʹ, pi (x) ͷ࣍਺͕͢΂ͯ 2 ͱͳΔͱ͖, MP ໰୊͸ MQ ໰୊ (Multivariate Quadraticʣͱ‫ݺ‬͹ΕΔ. Fq = F2 ͷ৔߹, MQ ໰୊͸ NP ‫׬‬શͰ͋Δ͜ͱ͕஌ΒΕ͍ͯΔ [20].
্‫ه‬ͷ IP ໰୊͸ IP2S ໰୊ͱ΋‫ݺ‬͹ΕΔ. IP ໰୊ͷ T Λ߃౳ࣸ૾Ͱ‫ݻ‬ఆ͠, S ͷΈΛ‫ٻ‬ΊΔ IP ໰୊ͷผόʔδϣϯ͕ଘࡏ͠, ͜ΕΛ IP1S ໰୊ͱ‫Ϳݺ‬. Patarin ͸, IP2S ໰୊΍ IS1S ໰୊Λར༻ͨ͠ೝূํࣜΛఏҊ͍ͯ͠Δ [30].

IP ໰୊Λϕʔεͱͨ͠ެ։‫͕ࣜํݤ‬, MP ໰୊ (MQ ໰୊ʣͷͦΕʹൺ΂ͯఏҊ͞Εͨ਺͕ѹ౗తʹগͳ͍͜ͱͱ,NIST PQC ඪ४ԽϓϩδΣΫτʹ IP ໰୊Λϕʔεͱͨ͠ެ։‫͕ࣜํݤ‬౤ߘ͞Εͳ͔ͬͨ͜ͱͳͲΛߟྀ͠, ຊใࠂॻͰ͸, IP ໰୊ʹ͍ͭͯ͜ΕҎ্ߟ࡯͠ͳ͍͜ͱͱ͢Δ. ୠ͠, IP ໰୊ͷ֦ு໰୊Ͱ͋ΔҎԼͷ EIP ໰୊ (Extended

Isomorphisms of Polynomialsʣ͸, MP ໰୊ (MQ ໰୊ʣΛϕʔεͱ͢Δެ։‫ࣜํݤ‬ͷߏ଄ͷ 1 ͭͰ͋Δ૒‫ܕۃ‬γεςϜͷ҆શੑʹؔΘΔ͜ͱ͕͋ΔͨΊ, ࣍અͰ‫͢ٴݴ‬Δ.

52

EIP ໰୊ ଟม਺ଟ߲ࣜ‫ ܥ‬F (x) = (f1 (x), f2 (x), . . . , fm (x)) ͕, Fqn , Fqm ্ͷΞϑΟϯಉ‫ ૾ࣸܕ‬S, T ͱଟม਺ଟ߲ࣜ
‫ܥ‬ͷ͋ΔΫϥε C ʹଐ͢Δଟม਺ଟ߲ࣜ‫ ܥ‬G(x) ʹΑΓ, F (x) = T ◦ G(x) ◦ S Ͱ༩͑ΒΕ͍ͯΔͱ͢Δ. ͜ͷͱ͖, ෼ղ F (x) = T ′ ◦ G′ (x) ◦ S ′ Ͱ, S ′ , T ′ ͸ Fqn , Fqm ্ͷΞϑΟϯಉ‫૾ࣸܕ‬, G′ (x) ∈ C ͳΔ΋ͷΛ‫͚ͭݟ‬Α.

ຊઅͷ࢒ΓͰ͸, MP ໰୊ʹର͢Δղಡख๏ͱͦͷ‫͍ͯͭʹྔࢉܭ‬ղઆ͢Δ. MP ໰୊ʹର͢ΔҰൠతղಡํ๏ͱ͠
ͯ, ૯౰ͨΓ๏΍ XL [42], Gröbner ‫ج‬ఈ߈ܸ [10] ͕஌ΒΕ͍ͯΔ. Gröbner ‫ج‬ఈ߈ܸͱ͸, ΠσΞϧͷ Gröbner ‫ج‬ఈ‫[ ࢉܭ‬16, 17] Λར༻͢Δ MP ໰୊ͷղಡํ๏Ͱ͋Δ. ղಡ͍ͨ͠ MP ໰୊ͷӈลͷ d ΛࠨลʹҠߦ͠, P (x) ͷதʹ‫ٵ‬ऩͤͯ͞͠·͏͜ͱʹΑΓ, MP ໰୊͸,P (x) = (p1 (x), p2 (x), . . . , pm (x)) = 0mͷ‫ٻ‬ղ໰୊ͱද‫͖Ͱݱ‬Δ. ͜Ε͸, ΠσΞϧ I = ⟨p1 (x), p2 (x), . . . , pm (x)⟩ Ͱఆٛ͞ΕΔ୅਺ଟ༷ମͷ Fq -༗ཧ఺Λ‫ٻ‬qqΊΔ໰୊ͱಉ஋ʹͳΔ. ͞Βʹ, ΠσΞϧ I ͸ I ′ = ⟨p1 (x), p2 (x), . . . , pm (x), x1 − x1 , x2 − x2 , . . . , xqn − xn ⟩ ʹมߋ͢Δ͜ͱ͕Ͱ͖Δ.

͜͜Ͱ, ΠσΞϧ I ′ Λ௨ৗͷࣙॻ߲ࣜॱংʹؔ͢Δ Gröbner ‫ج‬ఈʹม‫͢ܗ‬Δ. I ′ ͷ Krull ࣍‫ ͕ݩ‬0 ͱͳΔ, ͢ͳΘͪ, I ′ ͕ Fq [x] ͷ‫ۃ‬େΠσΞϧͱͳΔͱ͖, I ′ ͷ Gröbner ‫ج‬ఈ I˜ ͸ҎԼͷ‫Ͱܗ‬ද͞ΕΔ.

⎧⎫p̃1 (x1 , x2 , . . . , xn ), ⎪
⎪
⎪
⎪
⎪
⎪
⎪
⎪
..
⎪
⎪
⎪
⎪
.
⎪
⎪
⎪
⎪
⎪
⎪
⎪
⎪
p̃
(x
,
x
,
.
.
.
,
x
),
⎪
⎪
i
−1
1
2
n
2
⎪
⎪
⎪
⎪
⎪
⎪
p̃
(x
,
x
,
.
.
.
,
x
),
⎪
⎪
i
2
3
n
2
⎨
⎬
.
˜
.
I=
.
⎪
⎪
⎪
⎪ p̃i (x3 , x4 , . . . , xn ), ⎪
⎪
⎪
⎪
3
⎪
⎪
⎪
⎪
⎪
⎪
.
⎪
⎪
.
⎪
⎪
⎪
⎪
.
⎪
⎪
⎪
⎪
⎪
⎪
⎪
⎪
p̃
(x
,
x
),
l−1
n−1
n
⎪
⎪
⎩
⎭
p̃l (xn )͜ͷ‫͔ܗ‬Β, I˜ Ͱఆٛ͞ΕΔ୅਺ଟ༷ମͷ༗ཧ఺ (ͷ 1 ఺ʣ͸ xn ͷ஋͔Βஞ࣍తʹ x1 ·Ͱ‫ٻ‬ΊΔ͜ͱ͕Ͱ͖Δ. ͜ͷ༗ཧ఺Λ v ∈ Fqn ͱ͢Δͱ, ͜Ε͸ I Ͱఆٛ͞ΕΔ୅਺ଟ༷ମͷ Fq -༗ཧ఺Ͱ΋͋ΔͷͰ, x = v ͕ MQ ໰୊ͷղͱͳΔ. ͜Ε͕ Gröbner ‫ج‬ఈ߈ܸͷ֓ཁͰ͋Δ.

Gröbner ‫ج‬ఈ߈ܸͷ‫ྔࢉܭ‬Λ‫ه‬ड़͢ΔͨΊͷ४උΛߦ͏. pm+1 (x) = xq1 − x1 , pm+2 (x) = xq2 − x2 , . . . , pm+n (x) =xqn − xn ͱ͓͘. ͜ΕʹΑΓ, I ′ = ⟨p1 (x), p2 (x), . . . , pm+n (x)⟩ ͱද͢͜ͱ͕Ͱ͖Δ. ֤ pi (x) (i = 1, 2, . . . , m + n)ʹର͠, ͦͷ࠷ߴ࣍੪࣍෦෼Λ phi (x) (di ࣍੪࣍ଟ߲ࣜʣ ͱද͠, Fq [x] ͷ੪࣍ΠσΞϧΛ J Λ

J = ⟨ph1 (x), ph2 (x), . . . , phm+n (x)⟩ͰఆΊΔ. d ≥ 0 ʹର͠, Fq [x]d Ͱ d-࣍੪࣍ଟ߲ࣜͷͳ͢ Fq [x] ͷ෦෼ϕΫτϧۭؒΛද͠, Jd := J ∩ Fq [x]d ͱ͢Δ.
࣍਺‫ ؀‬Fq [x]/J ==∞d=0 Fq [x]d /Jd ͷ Hilbert ‫਺ڃ‬͸

HSFq [x]/J (t) =

∞
8
d=0

dimFq (Fq [x]d /Jd ) td ∈ Z[[t]] (‫ࣜܗ‬త΂͖‫)਺ڃ‬Ͱఆٛ͞ΕΔ. J ͷ Krull-࣍‫ ͕ݩ‬0 ͱͳΔͱ͖, HSFq [x]/J (t) ͸ଟ߲ࣜͱͳΔ. ͜ͷͱ͖, dreg = deg(HSFq [x]/J (t)) + 1
ͱ͓͖, ͜ΕΛਖ਼ଇੑͷ࣍਺ (degree of regularity) ͱ‫Ϳݺ‬. ͜ͷ४උͷԼ, Gröbner ‫ج‬ఈ߈ܸͷ‫ྔࢉܭ‬͸ҎԼͷΑ͏ʹ

53ද͞ΕΔ [1].

O

55

n + dreg
n

6ω 6

.

(4.1)

͜͜Ͱ, 2 ≤ ω ≤ 3 ͸࿈ཱઢ‫ํܗ‬ఔࣜΛղͨ͘Ίʹར༻͢ΔΞϧΰϦζϜʹΑΓఆ·Δఆ਺Ͱ͋Δ.

೚ҙͷ S(t) ∈ Z[[t]] ʹର͠, [S(t)]+ ∈ Z>0 [[t]] Ͱ, S(t) ͷ࠷ॳʹ‫ݱ‬ΕΔඇਖ਼܎਺ͷ࣍਺Ҏ߱ (͜ͷ߲΋‫ؚ‬ΉʣΛ੾Γࣺͯͨଟ߲ࣜΛද͢͜ͱʹ͢Δ. ΋͠,

HSFq [x]/J (t) =

>?

m+n
di
i=1 (1 − t )n(1 − t)

@

=
+

>- m
A

i=1

di

(1 − t ).5

1 − tq
1−t

6n @

+

Λຬͨ͢ͳΒ͹, p1 (x), p2 (x), . . . , pm+n (x) ͸൒ਖ਼ଇͰ͋Δͱ͍ΘΕΔ. q ͕͋Δఔ౓େ͖͍ͳΒ͹, ೚ҙͷ m, n ʹରͯ͠, p1 (x), p2 (x), . . . , pm (x) ͷ܎਺ΛϥϯμϜʹબͿͱ, p1 (x), p2 (x), . . . , pm+n (x) ͸ଟ͘ͷ৔߹ʹ൒ਖ਼ଇͱͳΔ͜ͱ͕࣮‫ݧ‬తʹ͔֬ΊΒΕΔ. ͜ͷ‫ݱ‬৅Λཧ࿦తʹอূ͢Δ΋ͷͰ͸ͳ͍͕, ͜Εʹؔ࿈͢Δ༧૝ͱͯ͠ Fröberg ͷ༧૝[19] ͱ͍͏΋ͷ͕͋Γ, ͜ͷ‫ݱ‬৅ͷࠜ‫͍༻ʹڌ‬ΒΕΔ৔߹͕͋Δ. (༧૝ͷਖ਼֬ͳ‫ه‬ड़ʹ͸४උ͕ඞཁͳͨΊ, ͜͜Ͱ͸ड़΂ͳ͍.) ͱ͜Ζ͕, ଟม਺ެ։‫( ߸҉ݤ‬ಛʹ҉߸ํࣜʣʹ‫ݱ‬ΕΔଟ͘ͷଟม਺ଟ߲ࣜ‫ʹܥ‬ରͯ͠͸, ൒ਖ਼ଇʹ͸ͳΒͣ, άϨϒφʔ‫ج‬ఈ߈ܸ͕൒ਖ਼ଇͳ৔߹ΑΓ΋ޮՌతʹಇ͍ͯ͠·͏͜ͱ͸‫ڵ‬ຯਂ͍ࣄ࣮Ͱ͋Δ. pi (x) ͕͢΂ͯ 2 ࣍
Ͱ, ൒ਖ਼ଇͳΒ͹, m ͕Ұఆͷ৔߹΍ m = αn (α: ఆ਺) ͷ৔߹, Gröbner ‫ج‬ఈ߈ܸͷ‫ྔࢉܭ‬͸ O(2O(n) ) ͱͳΔ͜ͱ͕஌ΒΕ͍ͯΔ [1].

Gröbner ‫ج‬ఈ߈ܸʹ͸ผͷ‫ྔࢉܭ‬΋஌ΒΕ͍ͯΔ. ͜ͷ‫ه‬ड़΋४උ͕ඞཁͰ͋Δ. ·ͣ, ࣍਺‫ ؀‬A Λ A =Fq [x]/(xq1 , xq2 , . . . , xqn ) ͰఆΊ, Ak Ͱ A ͷ k ࣍੪࣍෦෼Λද͢͜ͱʹ͢Δ. ೚ҙͷਖ਼ͷ੔਺ d ʹର͠, ψd :
=m
'm
q h
q
h
h
h
i=1 Ad−di → Ad Λ ψd (b1 , b2 , . . . , bm ) =i=1 bi pi (x) ͰఆΊΔ. (pm+1 (x) = x1 , pm+2 (x) = x2 , . . . , pm+n (x) ='=mm
xqn ͸࢖Θͳ͍͜ͱʹ஫ҙ.) Rd Λ Rd = ker ψd , ͢ͳΘͪ, i=1 bi phi (x) = 0 ͱͳΔ (b1 , b2 , . . . , bm ) ∈ i=1 Ad−diͷશମͱ͢Δ. Td ΛҎԼͷ‫ܗ‬ͷ‫Ͱݩ‬ੜ੒͞ΕΔ Rd ͷ෦෼ۭؒͱ͢Δ.

(1)
(2)

(0, . . . , 0, b phj (x), 0, . . . , 0, b phi (x), 0 . . . , 0) (b ∈ Ad−di −dj ),(0, . . . , 0, b ((phi )q−1 − 1), 0, . . . , 0)(b ∈ Ad−di (q−1) ).

͜͜Ͱ, (1) ͷඇྵ੒෼͸ࠨ͔Βୈ i ੒෼ͱୈ j ੒෼Ͱ͋Γ, (2) ͷඇྵ੒෼͸ୈ i ੒෼Ͱ͋Δ. ͢΂ͯͷਖ਼ͷ੔਺ d ʹର͠, ঎ Rd /Td Λߟ͑ͨͱ͖, Rd /Td ̸= 0 ͱͳΔ࠷খͷ d ͕ଘࡏ͢Δ. ͜ͷ d Λ dFF ͱද͠, ͜ΕΛ࠷খ߱Լ࣍਺

(first fall degree) ͱ‫[ Ϳݺ‬11, 15]. ‫͑׵͍ݴ‬Δͱ, ඇࣗ໌ͳ'mh
i=1 bi pi (x) = 0 ͳΔؔ܎ΛੜΈग़͢࠷খͷ࣍਺Ͱ͋Δ.

͜ͷ४උͷԼ, 2 ͭ໨ͷ Gröbner ‫ج‬ఈ߈ܸͷ‫ྔࢉܭ‬͸ҎԼͷΑ͏ʹͳΔ.

O

55

n + dFF
n

6ω 6

.

(4.2)

͜͜Ͱ, 2 ≤ ω ≤ 3 ͸࿈ཱઢ‫ํܗ‬ఔࣜΛղͨ͘Ίʹར༻͢ΔΞϧΰϦζϜʹΑΓఆ·Δఆ਺Ͱ͋Δ. ಉ͡ Gröbner ‫ج‬ఈ߈ܸʹରͯ͠, (4.1), (4.2) ͷ 2 ͭͷ‫͕͋ྔࢉܭ‬Δͷ͸, ‫ྔࢉܭ‬ͷ‫ੵݟ‬΋Γํ (͋Δ͍͸࢖͏ΞϧΰϦζϜʣ͕গ͠ҧ͏ͨΊͰ͋Δ. (ͲͪΒ΋ Faugère ͷ F4/F5 ΞϧΰϦζϜͷ‫ͱྔࢉܭ‬આ໌͸͞Ε͍ͯΔ.) dreg ͱ dFF ͸, ଟ͘ͷ৔߹Ͱಉ͡஋ʹͳΔͱ༧૝͞Ε͍ͯΔ.

Gröbner ‫ج‬ఈ߈ܸ͸, ૯౰ͨΓ๏ͱϛοΫε͢Δ͜ͱͰ߈ܸ͕ΑΓޮ཰తʹͳΔ͜ͱ͕͋Δ. ͍͔ͭ͘ͷม਺ʹద౰ʹ஋Λ୅ೖ͠, ΑΓগͳ͍ม਺ͷ MP ໰୊Λߏ੒ͯ͠ Gröbner ‫ج‬ఈ߈ܸΛద༻͢Δ. ղ͕‫͔ͭݟ‬Βͳ͚Ε͹, ม਺΁ͷ୅ೖ͔Β΍Γ௚͢ͱ͍͏߈ܸͰ͋Δ. ͜ΕΛϋΠϒϦου߈ܸͱ͍͏.

54

4.2 ୅දతͳଟม਺ଟ߲ࣜʹ‫ࣜํ߸҉ͮ͘ج‬ͷઆ໌
4.2.1 ૒‫ܕۃ‬γεςϜଟม਺ެ։‫߸҉ݤ‬ͷଟ͘ͷํࣜͰ࠾༻͞Ε͍ͯΔ૒‫ܕۃ‬γεςϜ [10] ͱ‫ݺ‬͹ΕΔߏ଄ʹ͍ͭͯઆ໌͢Δ. ଟม਺ଟ߲ࣜ‫ ܥ‬P (x) ͷͱΓํʹΑͬͯ͸, ଟ͘ͷ d ∈ Fqm ʹର͢Δ MP ໰୊͕ޮ཰తʹ‫͖Ͱࢉܭ‬Δ৔߹͕͋Δ. ྫ∼

͑͹, K = Fqn Λ Fq ͷ n ֦࣍େମͱ͠, Fq -ઢ‫ܗ‬ಉ‫ ૾ࣸܕ‬φ : Fqn −→ K Λ 1 ͭ‫ݻ‬ఆ͢Δ. K ্ͷ΂͖৐ࣸ૾Pl : K ∋ X -→ X l ∈ K (l : ਖ਼ͷ੔਺) Λߟ͑, ଟม਺ଟ߲ࣜࣸ૾ Pl Λ Pl = φ−1 ◦ Pl ◦ φ ͱఆٛ͢Δͱ, ͜ΕʹରԠ͢
Δଟม਺ଟ߲ࣜ‫ ܥ‬Pl (x) ʹରͯ͠͸, MP ໰୊͕ޮ཰తʹղಡͰ͖Δ. ࣮ࡍ, Pl (x) = d ͷํఔࣜ‫ܥ‬͸, φ Λ௨ͯ͠, K্ͷ 1 ม਺ํఔࣜ X l = d′ ͷ‫ʹܗ‬ม‫͢׵‬Δ͜ͱ͕Ͱ͖, ͜Ε͸ l ৐ࠜ‫ࢉܭ‬Λ༻͍ͯޮ཰తʹղΛ‫ٻ‬ΊΔ͜ͱ͕Ͱ͖Δ.
͜ͷΑ͏ͳੑ࣭Λ࣋ͭ P (x) ͸୯ಠͰ͸ͳ͘, ‫ܥ‬౷తʹߏ੒Ͱ͖Δ৔߹͕͋Δ. ্ͷྫͷ৔߹΋, l ͷ஋Λಈ͔͢͜ͱͰ,Pl (x) ୡͷͳ͢Ϋϥε (=ଟม਺ଟ߲ࣜ‫ܥ‬ͷ͋Δू߹ʣ͕ߏ੒Ͱ͖Δ.
૒‫ܕۃ‬γεςϜͰ͸, ·ͣ, MP ໰୊͕ޮ཰తʹ‫͖Ͱࢉܭ‬Δଟม਺ଟ߲ࣜ‫ ܥ‬P (x) ͷΫϥε Ccent Λ 1 ͭ‫ݻ‬ఆ͢Δ.

G(x) ∈ Ccent ͱ Fqn , Fqm ্ͷΞϑΟϯಉ‫ ૾ࣸܕ‬S, T Λ߹੒ͨ͠ଟม਺ଟ߲ࣜ‫ ܥ‬F (x) = T ◦ G(x) ◦ S Λτϥοϓυ
Ξ෇͖Ұํ޲ؔ਺ͱͯ͠ར༻͠Α͏ͱ͍͏ͷ͕, ૒‫ܕۃ‬γεςϜͷΞΠσΞͰ͋Δ. ͨͩ͠, F (x) ͕࣮ࡍʹτϥοϓυ
Ξ෇͖Ұํ޲ؔ਺ͱͳΔ͔Ͳ͏͔͸ Ccent ͷͱΓํʹґଘ͢Δ. ૒‫ܕۃ‬γεςϜͷ‫ݤ‬ੜ੒͸࣍ͷΑ͏ʹߦ͏.

1. G(x) ∈ Ccent ΛϥϯμϜʹબͿ.

2. Fqn , Fqm ্ͷΞϑΟϯಉ‫ ૾ࣸܕ‬S, T ΛϥϯμϜʹબͿ.
3. F (x) = T ◦ G(x) ◦ S ͱ͢Δ.
͜ͷͱ͖, ެ։‫ݤ‬͸ F (x), ൿີ‫ݤ‬͸ G(x), S, T ͱͳΔ. (࣮ફతʹ͸, S, T ΑΓ΋ S −1 , T −1 Λൿີ‫ͯ͠ͱݤ‬อ࣋ͨ͠΄͏͕Α͍.) G(x) Λ (F (x) ͷʣத৺ࣸ૾ͱΑͿ. ૒‫ܕۃ‬γεςϜ͸҉߸ํࣜ, ॺ໊ํࣜͷߏ੒ʹ༻͍ΒΕΔ. ҉߸ํࣜͷ҉߸Խɾ෮߸͸࣍ͷΑ͏ʹߦ͏.
҉߸Խ ฏจ M ∈ Fqn ʹର͠, C = F (M ) Λ‫͢ࢉܭ‬Δ. C ͕҉߸จͱͳΔ.
෮߸҉߸จ C ∈ Fqm ʹର͠, (1) B1 = T −1 (C), (2) B2 = G−1 (B1 ), (3) M ′ = S −1 (B2 ) ͷॱʹ‫͢ࢉܭ‬Δ. M ′ ͕ฏจͱҰக͢Δ.

෮߸͕੒ޭ͢ΔͨΊʹ͸‫ج‬ຊతʹ, G(x) (͋Δ͍͸ F (x)ʣ͕୯ࣹͰ͋Δඞཁ͕͋Δ. গ͠৚݅Λ؇Ίͯ, ʮG(x) (͋Δ͍͸ F (x)ʣͷ‫૾ٯ‬ͷཁૉ͕͢΂ͯ‫ࢉܭ‬Մೳʯͱ͢Δ͜ͱ΋Ͱ͖Δ. ͜ͷ৔߹, M ′ ͕ෳ਺ಘΒΕΔ͜ͱʹͳΔͷͰ,ϋογϡ஋ͳͲΛ༻͍ͯฏจ M ͱҰக͢Δ M ′ Λಛఆ͢Δ. ॺ໊ํࣜͷ৔߹, ॺ໊ੜ੒ɾ‫ূݕ‬͸࣍ͷΑ͏ʹߦ͏.
ॺ໊ੜ੒ϝοηʔδ M ∈ Fqm ʹର͠, (1) B1 = T −1 (M ), (2) B2 = G−1 (B1 ), (3) σ = S −1 (B2 ) ͷॱʹ‫͢ࢉܭ‬Δ.

σ ͕ॺ໊ͱͳΔ.
‫ূݕ‬ॺ໊ σ ∈ Fqn ʹର͠, M ′ = F (σ) Λ‫͢ࢉܭ‬Δ. M = M ′ ͳΒ͹ॺ໊Λडཧ͠, ͦΕҎ֎͸ෆडཧͱ͢Δ.

ॺ໊ੜ੒͕͍ͭͰ΋࣮ߦͰ͖ΔͨΊʹ͸, ͲͷΑ͏ͳϝοηʔδ M ∈ Fqm ʹରͯ͠΋, B2 = G−1 (B1 ) ͷ‫͖Ͱ͕ࢉܭ‬Δ, ͢ͳΘͪ, G(x) (͋Δ͍͸ F (x)ʣ͕શࣹͰ͋Δඞཁ͕͋Δ.

૒‫ܕۃ‬γεςϜΛ༻͍ͯߏ ੒͞Εͨํࣜ͸, Ccent ͷબͼํʹԠͯ͡ํࣜͷ໊শ͕ܾ·Δ.

ྫ͑͹, Ccent ={Pl (x) | l ͷ q-ϋϛϯάॏΈ͕ 2} ͱͨ͠૒‫ܕۃ‬γεςϜͷ҉߸ํ͕ࣜ, দຊ-ࠓҪํࣜͰ͋Δ. (q-ϋϛϯάॏΈͷ৚݅͸, F (x), G(x) ͕ 2 ࣍ଟ߲͔ࣜΒͳΔ͜ͱΛอূ͢Δ.)55

૒‫ܕۃ‬γεςϜ͕҆શͰ͋ΔͨΊʹ͸, MP ໰୊ͷղಡࠔ೉ੑ͕ඞཁͱͳΔ. ࣮ࡍ, ҉߸ํࣜʹ͓͚Δ MP ໰୊

F (x) = C ΍, ॺ໊ํࣜʹ͓͚Δ MP ໰୊ F (x) = M ͕‫ڐ‬༰࣌ؒ಺Ͱ‫ٻ‬ղՄೳͰ͋ΔͳΒ͹, ૒‫ܕۃ‬γεςϜͷ҆શੑ͸่Εͯ͠·͏. ͜Εͱؔ࿈͢Δͷ͕, IP ໰୊ͷ֦ு໰୊Ͱ͋Δ EIP ໰୊Ͱ͋Δ.

EIP ໰୊ ଟม਺ଟ߲ࣜ‫ ܥ‬F (x) = (f1 (x), f2 (x), . . . , fm (x)) ͕, Fqn , Fqm ্ͷΞϑΟϯಉ‫ ૾ࣸܕ‬S, T ͱଟม਺ଟ߲ࣜ
‫ܥ‬ͷ͋ΔΫϥε C ʹଐ͢Δଟม਺ଟ߲ࣜ‫ ܥ‬G(x) ʹΑΓ, F (x) = T ◦ G(x) ◦ S Ͱ༩͑ΒΕ͍ͯΔͱ͢Δ. ͜ͷͱ͖, ෼ղ F (x) = T ′ ◦ G′ (x) ◦ S ′ Ͱ, S ′ , T ′ ͸ Fqn , Fqm ্ͷΞϑΟϯಉ‫૾ࣸܕ‬, G′ (x) ∈ C ͳΔ΋ͷΛ‫͚ͭݟ‬Α.
૒‫ܕۃ‬γεςϜʹ͓͍ͯ, C = Ccent ͱͨ͠ͱ͖ͷ EIP ໰୊͕ղಡՄೳͰ͋ΔͳΒ͹, ෼ղ F (x) = T ′ ◦ G′ (x) ◦ S ′Λ༻͍ͯ, ରԠ͢Δ MP ໰୊͸༰қʹղಡՄೳͱͳΔ. EIP ໰୊ͷղಡࠔ೉ੑ͸, Ϋϥε C ͷબͼํʹґଘ͓ͯ͠Γ,C = Ccent Ͱ͋ΔͳΒ͹, ͦͷํࣜʹԠͯ͡‫ݸ‬ʑʹղੳ͞ΕΔඞཁ͕͋Δ.

4.2.2 Simple field ๏ͱ big field ๏த৺ࣸ૾ G(x) ΍ ެ։‫ ݤ‬F (x) ͸ཧ࿦తʹ͸Ұൠ࣍਺ͷଟม਺ଟ߲͕ࣜར༻Ͱ͖Δ͕, ࣮ફతʹ͸Α͘ 2 ࣍ଟ߲͕ࣜར༻͞ΕΔ. ͜Ε͸‫ݤ‬௕Λ཈͑ΔͨΊͰ͋Δ. ͜͜Ͱ͸, 2 ࣍ଟ߲͔ࣜΒͳΔத৺ࣸ૾ (͓Αͼެ։‫ݤ‬ʣΛར༻ͨ͠ଟ
ม਺ެ։‫߸҉ݤ‬ͷํࣜΛ 2 ͭ঺հ͢Δ. ૒‫ܕۃ‬γεςϜͷ୅දతͳߏ੒๏ͱͯ͠, simple field ๏ͱ big field ๏͕͋Δ.

Simple field ๏͸த৺ࣸ૾ͷߏ੒ʹ Fq Ҏ֎ͷ༗‫ݶ‬ମ͸ར༻͠ͳ͍. Ұํ, big field ๏͸த৺ࣸ૾ͷߏ੒ʹ Fq ͷ n ࣍
֦େମ Fqn Λར༻͢Δ. Simple field ๏ͷ୅දͱͯ͠ॺ໊ํࣜ UOV, big field ๏ͷ୅දͱͯ͠ॺ໊ํࣜ HFE−v ʹ͍ͭͯઆ໌͢Δ.

4.2.2.1 ॺ໊ํࣜ UOV
UOV [24] ͷத৺ࣸ૾͸ 2 ࣍ଟ߲ࣜͰ͸͋Δ͕, ม਺ͷҰ෦ʹ୅ೖΛߦ͏͜ͱͰ, ‫ࢉܭ૾ࣸٯ‬Λઢ‫૾ࣸܗ‬ͷ‫ܭ૾ࣸٯ‬ࢉʹ‫ؼ‬ணͤ͞Δ͜ͱ͕Ͱ͖Δ. UOV ʹରͯ͠, க໋తͳ߈ܸ͸ࠓͷͱ͜Ζใࠂ͞Ε͍ͯͳ͍. ୠ͠, ҆શੑΛߟྀ͢Δͱ, ॺ໊௕Λϝοηʔδ௕ͷ໿ 3 ഒҎ্ʹ͢Δඞཁ͕͋Δ.

v, o Λਖ਼ͷ੔਺ͱ͠, m = o, n = v+o ͱ͢Δ. 2 ࣍ଟ߲͔ࣜΒͳΔଟม਺ଟ߲ࣜ‫ ܥ‬G(x) = (g1 (x),g2 (x),. . . ,gm (x))Λ࣍ͷ‫Ͱܗ‬༩͑Δ.

gk (x) =8

1≤i≤v
v+1≤j≤n
(k)

(k)

(k)

αi,j xi xj +8(k)βi,j xi xj +1≤i≤j≤v8(k)γi xi + η (k) (k = 1, 2, . . . , m).

1≤i≤n

(k)

͜͜Ͱ, αi,j , βi,j , γi , η (k) ∈ Fq Ͱ͋Δ. G(x) ͸‫૾ࣸٯ‬Λޮ཰తʹ‫͢ࢉܭ‬Δ͜ͱ͕Ͱ͖Δ. ۩ମతʹ͸, ೚ҙͷc = (c1 , c2 , . . . , cm ) ∈ Fqm ʹର͠, G−1 (c) (ͷҰͭʣ͕ҎԼͷΑ͏ʹ‫͖Ͱࢉܭ‬Δ.
1. b1 , b2 , . . . , bv ∈ Fq ΛϥϯμϜʹͱΔ.

2. g1 (x), g2 (x), . . . , gm (x) ʹ x1 = b1 , x2 = b2 , . . . , xv = bv Λ୅ೖ͠, xv+1 , xv+2 , . . . , xn ʹؔ͢Δ 1 ࣍ͷଟ߲ࣜ‫ ܥ‬ḡ1 (xv+1 , xv+2 , . . . , xn ), . . . , ḡm (xv+1 , xv+2 , . . . , xn ) ΛಘΔ. 1 ࣍ํఔࣜ⎧⎪⎨ ḡ1 (xv+1 , xv+2 , . . . , xn ) = c1..
.
⎪⎩ḡm (xv+1 , xv+2 , . . . , xn ) = cm

ͷղΛ Gauss ͷফ‫ڈ‬๏ͳͲͰ‫͠ࢉܭ‬, ͦΕΛ bv+1 , bv+2 , . . . , bn ͱ͓͘. ΋͠ղ͕ͳ͚Ε͹ 1 ʹ໭Δ.

3. (b1 , b2 , . . . , bn ) Λฦ͢.
56

(k)

(k)

(k)

αi,j , βi,j , γi , η (k) ∈ Fq Λಈ͔ͯ͠Ͱ͖Δ G(x) ͷू߹Λ CUOV ͱͨ͠ͱ͖, Ccent = CUOV ͱͯ͠ߏ੒͞ΕΔ૒‫ܕۃ‬γεςϜͷॺ໊ํࣜΛ UOV ͱ‫Ϳݺ‬. ୠ͠, ΞϑΟϯಉ‫ ૾ࣸܕ‬T ͸ UOV ͷ҆શੑʹ͸ߩ‫͍ͳ͠ݙ‬ͷͰ, ௨ৗ͸ T Λ߃౳ࣸ૾ͰબͿ. (UOV ͷଟ૚ԽͰ͋Δ Rainbow ʹରͯ͠͸, Ұൠͷ T ͕ඞཁͰ͋Δ.)‫ݤ‬ੜ੒

1. G(x) ∈ CUOV ΛϥϯμϜʹબͿ.

2. Fqn ্ͷΞϑΟϯಉ‫ ૾ࣸܕ‬S ΛϥϯμϜʹબͿ.
3. F (x) = G(x) ◦ S ͱ͢Δ.
ެ։‫ݤ‬͸ F (x), ൿີ‫ݤ‬͸ G(x), S Ͱ͋Δ.
ॺ໊ੜ੒

1. ϝοηʔδ M ∈ Fqm ʹର͠, ্Ͱઆ໌ͨ͠ํ๏Ͱ G−1 (c) ͷཁૉͷ̍ͭ b ∈ Fqn Λ‫ٻ‬ΊΔ.
2. σ = S −1 (b).
‫ূݕ‬

1. ॺ໊ σ ∈ Fqn ʹର͠, M ′ = F (σ) Λ‫͢ࢉܭ‬Δ. M = M ′ ͳΒ͹ॺ໊Λडཧ͠, ͦΕҎ֎͸ෆडཧͱ͢Δ.
4.2.2.2 ॺ໊ํࣜ HFE−v
HFE−v [30] ͸, ҉߸ํࣜ HFE [30] ͷ҆શੑΛ‫ڧ‬Խͭͭ͠ॺ໊ํࣜʹม‫ͨ͠ܗ‬΋ͷͰ͋Δ. HFE ͸, Kipnis ͱ
Shamir ʹΑͬͯղಡ͞Εͨ [26] ͕, HFE−v ʹରͯ͠͸, க໋తͳ߈ܸ͸ࠓͷͱ͜Ζใࠂ͞Ε͍ͯͳ͍. ·ͣ, ҉߸ํࣜ HFE ʹ͍ͭͯ؆୯ʹड़΂Δ. HFE ͸দຊ-ࠓҪํࣜͷ֦ுํࣜͱͯ͠ఏҊ͞Εͨ΋ͷͰ͋Δ. Fq ͷ n ֦࣍େମK = Fqn ΛͱΓ, Fq -ઢ‫ܗ‬ಉ‫ ૾ࣸܕ‬φ : Fqn → K Λ‫ݻ‬ఆ͢Δ. D Λਖ਼ͷ੔਺ͱͯ͠, K ্ͷ 1 ม਺ଟ߲ࣜ
G(X) =jq i +q8≤D0≤i≤j

αi,j X

q i +q j

+

i
q8
≤D

i

βi X q + γ

0≤i(αi,j , βi , γ ∈ K)

ΛͱΔ. (HFE ଟ߲ࣜͱ‫ݺ‬͹ΕΔ.) ͜ͷͱ͖, ଟม਺ଟ߲ࣜࣸ૾ G : Fqn → Fqn Λ G = φ−1 ◦ G ◦ φ ͱఆΊΔͱ, ରԠ͢Δଟม਺ଟ߲ࣜ‫ ܥ‬G(x) ͷ੒෼͸͢΂ͯ 2 ࣍ଟ߲ࣜͱͳΔ. αi,j , βi , γ ∈ K Λಈ͔ͯ͠Ͱ͖Δ G(x) ͷू߹Λ CHFEͱͨ͠ͱ͖, Ccent = CHFE ͱͯ͠ߏ੒͞ΕΔ૒‫ܕۃ‬γεςϜͷ҉߸ํࣜΛ HFE ͱ‫Ϳݺ‬. G(x) ʹΑΔ c ∈ Fqn ͷ‫ࣸٯ‬૾‫ࢉܭ‬͸ҎԼͷΑ͏ʹߦΘΕΔ.

1. B = φ(c) ∈ K Λ‫͢ࢉܭ‬Δ.

2. A = G −1 (B) Λ Cantor-Zassenhaus ΞϧΰϦζϜͳͲΛ༻͍ͯ‫͢ࢉܭ‬Δ.
3. φ−1 (A) Λ‫͢ࢉܭ‬Δ.

2 ͷ‫ࢉܭ‬Λޮ཰తʹ࣮ߦ͢ΔͨΊʹ͸ D Λ͋Δఔ౓খ͘͞ͱΔඞཁ͕͋Δ.
࣍ʹ, HFE−v ʹ͍ͭͯઆ໌͢Δ. ਖ਼ͷ੔਺ a ͱ v Λ‫ݻ‬ఆ͢Δ. ·ͣ, G(X) ͸࣍ͷΑ͏ʹมߋ͞ΕΔ.

G(X) =jq i +q8≤D0≤i≤j

αi,j X

q i +q j

+

i
q8
≤D

i

βi (xn+1 , xn+2 , . . . , xn+v )X q + γ(xn+1 , xn+2 , . . . , xn+v )0≤i(αi,j ∈ K). (4.3)͜ ͜ Ͱ, βi (xn+1 , xn+2 , . . . , xn+v ), γ(xn+1 , xn+2 , . . . , xn+v ) ͸ ‫ ʹ ڞ‬Fqv ͔ Β K(≃ Fqn ) ΁ ͷ ଟ ߲ ࣜ ࣸ ૾ Ͱ ͋ Γ,βi (xn+1 , xn+2 , . . . , xn+v ) ͸ 1 ࣍ଟ߲ࣜࣸ૾, γ(xn+1 , xn+2 , . . . , xn+v ) ͸ 2 ࣍ଟ߲ࣜࣸ૾Ͱ͋Δ. ଟม਺ଟ߲ࣜ
57‫ ܥ‬G(x) ͸, ଟม਺ଟ߲ࣜࣸ૾ G = φ−1 ◦ G ◦ (φ × idv ) : Fqn+v → Fqn ʹΑΓఆΊΔ. αi,j ∈ K ͱଟ߲ࣜࣸ૾

βi (xn+1 , xn+2 , . . . , xn+v ), γ(xn+1 , xn+2 , . . . , xn+v ) Λಈ͔ͯ͠Ͱ͖Δ G(x) ͷू߹Λ CHFE−ͱఆΊΔ. ‫ج‬ຊతʹ͸,v͜ΕΛ Ccent = CHFE−ͱͯ͠ߏ੒͞ΕΔ૒‫ܕۃ‬γεςϜΛߟ͑ΔͷͰ͋Δ͕, ૒‫ܕۃ‬γεςϜ΋ए‫ׯ‬มߋ͢Δ. S ͸v

Fqn+v ্ͷΞϑΟϯಉ‫૾ࣸܕ‬ͷ··ͰΑ͍͕, T ͸ Fqn ͔Β Fqn−a ΁ͷ࠷େϥϯΫͷΞϑΟϯࣸ૾ͱมߋ͢Δ. ެ։‫ݤ‬͸௨ৗͷ૒‫ܕۃ‬γεςϜͱಉ͡Α͏ʹ, F (x) = T ◦ G(x) ◦ S ͱఆΊΔ. Αͬͯ, F ͸ Fqn+v ͔Β Fqn−a ΁ͷଟม਺ଟ߲ࣜࣸ૾ͱͳΔ.
‫ݤ‬ੜ੒

1. G(x) ∈ CHFE−ΛϥϯμϜʹબͿ.
v

2. Fqn+v ্ͷΞϑΟϯಉ‫ ૾ࣸܕ‬S ͱ, ࠷େϥϯΫͷΞϑΟϯࣸ૾ T : Fqn → Fqn−a ΛϥϯμϜʹબͿ.
3. F (x) = T ◦ G(x) ◦ S ͱ͢Δ.

ެ։‫ݤ‬͸ F (x), ൿີ‫ݤ‬͸ G(x), S, T Ͱ͋Δ.
ॺ໊ੜ੒

1. ϝοηʔδ M ∈ Fqn−a ʹର͠, c = T −1 (M ) ∈ Fqn (ͷ 1 ͭʣΛ‫͢ࢉܭ‬Δ.
2. B = φ(c) ∈ K Λ‫͢ࢉܭ‬Δ.

3. b ∈ Fqv ΛϥϯμϜʹબͼ, A = G −1 (B∥b) Λ Cantor-Zassenhaus ΞϧΰϦζϜͳͲΛ༻͍ͯ‫͢ࢉܭ‬Δ.
G −1 (B∥b) ͕ଘࡏ͠ͳ͍৔߹͸, 1 ʹ໭Δ.

4. e = φ−1 (A) Λ‫͢ࢉܭ‬Δ.
5. σ = S −1 (e) Λ‫͢ࢉܭ‬Δ.
‫ূݕ‬

1. ॺ໊ σ ∈ Fqn+v ʹର͠, M ′ = F (σ) Λ‫͢ࢉܭ‬Δ. M = M ′ ͳΒ͹ॺ໊Λडཧ͠, ͦΕҎ֎͸ෆडཧͱ͢Δ.
HFE−v ͷެ։‫͔ݤ‬ΒಘΒΕΔଟม਺ଟ߲ࣜ‫ܥ‬͸, Ұൠʹ͸൒ਖ਼ଇʹ͸ͳΒͣ, ࠷খ߱Լ࣍਺ʹؔ͢ΔҎԼͷධՁ͕஌ΒΕ͍ͯΔ [13].

dFF ≤

B

(q−1)·(r−1+a+v)+22(q−1)·(r+a+v)+22

q ɿ‫ ͔ͭ ਺ۮ‬r + aɿ‫਺ح‬,ͦͷଞ.

͜͜Ͱ, r = ⌊logq (D − 1)⌋ + 1 Ͱ͋Δ. Gröbner ‫ج‬ఈ߈ܸͷ‫ྔࢉܭ‬͸ (4.2) Ͱ͋ΔͨΊ, dFF ͷ஋͕ͳΔ΂͘େ͖͘ͳ
ΔΑ͏ύϥϝʔλΛબ୒͢Δඞཁ͕͋Δ.

4.3 ۩ମతͳ҉߸ํࣜଟม਺ެ։‫߸҉ݤ‬ͷ۩ମతͳํࣜͱͯ͠, Rainbow [9], Gui [8], MQDSS [7] ͷ 3 ͭͷॺ໊ํࣜʹ͍ͭͯઆ໌͢Δ.
͜ΕΒ͸͍ͣΕ΋ NIST PQC ඪ४ԽϓϩδΣΫτʹ౤ߘ͞Ε͍ͯΔ. ͜ͷଞ, NIST PQC ඪ४ԽϓϩδΣΫτʹ౤ߘ͞Εͨ΋ͷͱͯ͠, HiMQ-3 [39], LUOV [3], GeMSS [5], DualModeMS [18] (͍ͣΕ΋ॺ໊ํࣜʣͳͲ͕͋Δ͕,HiMQ-3, LUOV ͸ Rainbow (͋Δ͍͸ UOVʣʹߏ଄͕ۙ͘, GeMSS, DualModeMS ͸ Gui ͱಉ͡ HFE−v Λϕʔεͱͨ͠ํࣜͰ͋ΔͨΊ, ୅දͯ͠ Rainbow, Gui, MQDSS ͷ 3 ͭΛઆ໌͢Δ͜ͱͱͨ͠.

NIST PQC ඪ४ԽϓϩδΣΫτ Round1 ͷࢿྉΛ‫ʹج‬, ҆શੑύϥϝʔλ΋‫ه‬ड़͍ͯ͠Δ. ҆શੑϨϕϧ͕ k ϏοτͰ͋Δͱ͸, k Ϗοτ‫ݤ‬Λ࣋ͭϒϩοΫ҉߸ͷ‫ͱࡧ୳ݤ‬ಉ౳ͷ҆શੑΛ͍࣋ͬͯΔ͜ͱΛҙຯ͢Δ.

58

ද 4.1ຊઅͰѻ͏ओཁͳଟม਺ଟ߲ࣜʹ‫ٕ߸҉ͮ͘ج‬ज़

จ‫ݙ‬

҉߸Խ

‫׵ަݤ‬

ॺ໊

Rainbow [12, 9]˓Gui [33, 8]˓

MQDSS [6, 7]

˓

4.3.1 Rainbow
Rainbow ͷ֓ཁ

4.3.1.1

ॺ໊ํࣜ Rainbow [12] ͸, ૒‫ܕۃ‬γεςϜΛ༻͍͓ͯΓ, ॺ໊ํࣜ UOV [24] Λଟ૚Խͨ͠ߏ଄Λ͍࣋ͬͯΔ. UOVΛଟ૚Խ͢Δ͜ͱʹΑΓ, UOV ΑΓ΋୹͍ॺ໊௕͕࣮‫͖Ͱݱ‬Δ.
ਖ਼ͷ੔਺ t, v1 , o1 , o2 , . . . , ot ʹର͠, vi+1 = vi + oi ʹΑΓ, v2 , v3 , . . . , vt+1 Λ‫ؼ‬ೲతʹఆΊΔ. ·ͨ, i = 1, 2, . . . , tʹର͠, Si = {1, 2, . . . , vi }, Oi = {vi + 1, vi + 2, . . . , vi+1 } ͱ͓͘. Si ͷ‫਺ݸ‬͸ vi Ͱ, Oi ͷ‫਺ݸ‬͸ oi Ͱ͋Δ. ม਺ͷ‫਺ݸ‬Λ n = vt+1 , ࣜ਺Λ m = n − v1 ͱ͢Δଟม਺ଟ߲ࣜ‫ ܥ‬G(x) = (gv1 +1 (x), gv1 +2 (x), . . . , gn (x)) Λ࣍ͷ‫Ͱܗ‬༩͑Δ.

gk (x1 , . . . , xn ) =8(k)αi,j xi xj +i∈Oh ,j∈Sh8(k)βi,j xi xj +8(k)γi xi + η (k) (k = v1 +1, . . . , n).

i∈Sh+1i,j∈Sh , i≤j

(k)

(k)

(k)

ୠ͠, h ͸ k ͕ଐ͢Δ૚൪߸, ͢ͳΘͪ, “k ∈ Oh ” Ͱఆ·Δ੔਺ 1 ≤ h ≤ t Ͱ͋Δ. αi,j , βi,j , γi , η (k) ∈ Fq Λಈ͔ͯ͠Ͱ͖Δ G(x) ͷू߹Λ CRainbow ͱఆΊ, ͜ΕΛ Rainbow ͷத৺ࣸ૾ͷΫϥεͱ͢Δ. Rainbow ʹඞཁͳύϥϝʔλ͸, ༗‫ݶ‬ମͷҐ਺ q, ͓Αͼ, t, v1 , o1 , o2 , . . . , ot Ͱ͋Δ. H : {0, 1}∗ → Fqm Λ҉߸ֶతϋογϡؔ਺ͱ͢Δ.
‫ݤ‬ੜ੒

1. G(x) ∈ CRainbow ΛϥϯμϜʹબͿ.

2. Fqn , Fqm ্ͷΞϑΟϯಉ‫ ૾ࣸܕ‬S, T ΛϥϯμϜʹબͿ.
3. S −1 , T −1 Λ‫͢ࢉܭ‬Δ.
4. F (x) = T ◦ G(x) ◦ S.
ެ։‫ݤ‬͸ F (x), ൿີ‫ݤ‬͸ G(x), S −1 , T −1 Ͱ͋Δ. ࣍ʹ, ॺ໊ੜ੒Ͱ͋Δ. ϝοηʔδΛ M ∈ {0, 1}∗ ͱ͢Δ.
ॺ໊ੜ੒

1. h ← H(M ).

2. c = (cv1 +1 , . . . , cn ) ← T −1 (h).

3. b1 , b2 , . . . , bv1 ∈ Fq ΛϥϯμϜʹͱΔ.
4. h = 1, 2, . . . , t ʹର͠, ҎԼΛ࣮ߦɿ

gvh +1 (x), . . . , gvh+1 (x) ʹ x1 = b1 , x2 = b2 , . . . , xvh = bvh Λ୅ೖ͠, xvh +1 , . . . , xvh+1 ʹؔ͢Δ 1 ࣍ͷଟ߲ࣜ‫ ܥ‬ḡvh +1 (xvh +1 , . . . , xvh+1 ), . . . , ḡvh+1 (xvh +1 , . . . , xvh+1 ) ΛಘΔ. 1 ࣍ํఔࣜ⎧⎪⎨ ḡvh +1 (xvh +1 , . . . , xvh+1 ) = cvh +1..
.
⎪⎩ḡvh+1 (xvh +1 , . . . , xvh+1 ) = cvh+1
59

ͷղΛ Gauss ͷফ‫ڈ‬๏ͳͲͰ‫͠ࢉܭ‬, ͦΕΛ bvh +1 , . . . , bvh+1 ͱ͓͘. ΋͠ղ͕ͳ͚Ε͹ 3 ʹ໭Δ.

5. b ← (b1 , . . . , bn ).
6. σ ← S −1 (b).

σ ͕ॺ໊ͱͳΔ. ࠷‫͋Ͱূݕʹޙ‬Δ.
‫ূݕ‬

1. h ← H(M ).
2. h′ ← F (σ).

3. h == h′ Λฦ͢.
‫ऀূݕ‬͸, h = h′ ͷͱ͖, ॺ໊Λडཧ͠, ͦΕҎ֎͸ෆडཧͱ͢Δ.

4.3.1.2

Rainbow ͷύϥϝʔλબ୒

Rainbow ࣗମ͸, ૚਺ t Λࣗ༝ʹઃఆͰ͖Δ͕, NIST PQC ඪ४ԽϓϩδΣΫτ Round1 ͷࢿྉ [9] Ͱ͸, 2 ૚(t = 2) ͷ Rainbow ͕ఏҊ͞Ε͍ͯΔ. 2 ૚ͷ Rainbow ͷઃ‫ʹܭ‬ඞཁͳύϥϝʔλ͸, ༗‫ݶ‬ମͷҐ਺ q, ૚ͷαΠζΛ
ܾΊΔύϥϝʔλ v1 , o1 , o2 Ͱ͋Δ. [9] Ͱ͸, ҎԼͷΑ͏ʹύϥϝʔλʹؔ͢Δσʔλ͕ࣔ͞Ε͍ͯΔ.

(q, v1 , o1 , o2 )҆શੑϨϕϧ

ެ։‫ݤ‬௕

ൿີ‫ݤ‬௕

ॺ໊௕(16, 32, 32, 32)

128 bits

148.5 kB

97.9 kB

512 bits(31, 36, 28, 28)

128 bits

148.3 kB

103.7 kB

624 bits(256, 40, 24, 24)

128 bits

187.7 kB

140.0 kB

832 bits(31, 64, 32, 48)

192 bits

512.1 kB

371.4 kB

896 bits(256, 68, 36, 36)

192 bits

703.9 kB

525.2 kB

1, 248 bits

(256, 92, 48, 48)

256 bits

1, 683.3 kB

1, 244.4 kB

1, 632 bits

[9] Ͱ͸, ެ։‫ ݤ‬F (x) ͱϝοηʔδ M ͔Β࡞ΒΕΔ MQ ໰୊ʹର͢Δ߈ܸͱ Rainbow ʹର͢Δ EIP ໰୊ʹର͢Δ
߈ܸ (UOV ߈ܸ [25], MinRank ߈ܸ [21], HighRank ߈ܸ [21], Rainbow-Band-Separation ߈ܸ [14]ʣʹ͍ͭͯղੳ
͞Ε, ্‫ه‬ͷύϥϝʔλ͕‫ੵݟ‬΋ΒΕ͍ͯΔ.

4.3.2 Gui
4.3.2.1

Gui ͷ֓ཁ

ॺ໊ํࣜ Gui [33] ͸, ૒‫ܕۃ‬γεςϜΛ༻͍͓ͯΓ, HFE−v Λ‫ج‬ຊߏ଄ͱͯ͠ߏ੒͞Ε͍ͯΔ. Gui ͷத৺ࣸ૾ͷΫϥε͸, § 4.2.2.2 ͷ CHFE−
ͰͱΔ. Gui Ͱ͸, ༗‫ݶ‬ମ͸ F2 (q = 2) ʹ‫ݻ‬ఆ͞Ε͍ͯΔ. Gui ʹඞཁͳύϥϝʔλ͸, ֦v
େ࣍਺ n, (4.3) ʹ‫ݱ‬ΕΔ D ͱ v, m ͷαΠζΛܾΊΔ a, ͓Αͼ, ॺ໊ੜ੒Ͱத৺ࣸ૾ͷ‫ࢉܭ૾ࣸٯ‬ͷճ਺ΛܾΊΔ k
Ͱ͋Δ. H : {0, 1}∗ → Fqn−a Λ҉߸ֶతϋογϡؔ਺ͱ͢Δ.
‫ݤ‬ੜ੒

1. G(x) ∈ CHFE−ΛϥϯμϜʹબͿ.
v

2. Fqn+v , Fqn ্ͷΞϑΟϯಉ‫ ૾ࣸܕ‬S, T ΛϥϯμϜʹબͿ.
3. S −1 , T −1 Λ‫͢ࢉܭ‬Δ.
4. F (x) = Projn−a ◦ T ◦ G(x) ◦ S.

(Projn−a : Fqn → Fqn−a ͸, ࠷ॳͷ n − a ੒෼΁ͷࣹӨΛද͢.)60ެ։‫ݤ‬͸ F (x), ൿີ‫ݤ‬͸ G(x), S −1 , T −1 Ͱ͋Δ. ࣍ʹ, ॺ໊ੜ੒Ͱ͋Δ. ϝοηʔδΛ M ∈ {0, 1}∗ ͱ͢Δ.
ॺ໊ੜ੒

1. l ← ⌈k · log2 q · (n − a)/|H|⌉(|H| ͸, H ͷग़ྗ௕Λද͢).

2. h̃ ← H(M )∥H(H(M ))∥ · · · ∥Hl (M )3. S0 ← 0n−a .

(Hl ͸, H ͷ l ճ߹੒Λද͢).

4. i = 1, 2, . . . , k ʹର͠, ҎԼΛ࣮ߦɿ
4-1 (h̃(i−1)log2 q·(n−a)+1 ∥ · · · , ∥h̃ilog2 q·(n−a) ) Λ Fn−aͷ‫ʹݩ‬ม‫ͨ͠׵‬΋ͷΛ di ͱ͓͘.
q

4-2 F −1 (di ⊕ Si−1 ) ͷ 1 ͭ e = (e1 , . . . , en+v ) Λ § 4.2.2.2 ʹ‫ͨ͠ࡌه‬ΞϧΰϦζϜΛ࢖ͬͯ‫ٻ‬ΊΔ.
4-3 Si ← (e1 , . . . , en−a ), Xi ← (en−a+1 , . . . , en+v ).

5. σ ← (Sk ∥Xk ∥ · · · ∥X1 ).

σ ͕ॺ໊ͱͳΔ. ࠷‫͋Ͱূݕʹޙ‬Δ.
‫ূݕ‬

1. l ← ⌈k · log2 q · (n − a)/|H|⌉.

2. h̃ ← H(M )∥H(H(M ))∥ · · · ∥Hl (M ).
3. i = 1, 2, . . . , k ʹର͠, ҎԼΛ࣮ߦɿ

3-1 (h̃(i−1)log2 q·(n−a)+1 ∥ · · · , ∥h̃ilog2 q·(n−a) ) Λ Fn−aͷ‫ʹݩ‬ม‫ͨ͠׵‬΋ͷΛ di ͱ͓͘.
q

4. i = k − 1, . . . , 0 ʹର͠, ҎԼΛ࣮ߦɿ
4-1 Si ← F (Si+1 ∥Xi+1 ) ⊕ di+1 .

5. S0 == 0n−a Λฦ͢.

‫ऀূݕ‬͸, S0 = 0n−a ͷͱ͖, ॺ໊Λडཧ͠, ͦΕҎ֎͸ෆडཧͱ͢Δ.

4.3.2.2

Gui ͷύϥϝʔλબ୒

NIST PQC ඪ४ԽϓϩδΣΫτ Round1 ͷࢿྉ [8] Ͱ͸, ҎԼͷΑ͏ʹύϥϝʔλʹؔ͢Δ 3 ͭͷσʔλ͕ࣔ͞Ε͍ͯΔ.
໊শ(n, D, a, v, k)҆શੑϨϕϧ

ެ։‫ݤ‬௕

ൿີ‫ݤ‬௕

ॺ໊௕

Gui-184(184, 33, 16, 16, 2)

128 bits

416.3 kB19.1 kB

360 bits

Gui-312(312, 129, 24, 20, 2)

192 bits

1, 955.1 kB

59.3 kB

504 bits

Gui-448(448, 513, 32, 28, 2)

256 bits

5, 789.2 kB

155.9 kB

664 bits[8] Ͱ͸, ެ։‫ ݤ‬F (x) ͱϝοηʔδ M ͔Β࡞ΒΕΔ MQ ໰୊ʹର͢Δ߈ܸͱࣝผ߈ܸ [32], Gui ʹର͢Δ EIP ໰୊ʹର͢Δ߈ܸ (Kipnis-Shamir ߈ܸ [26]ʣʹ͍ͭͯղੳ͞Ε, ্‫ه‬ͷύϥϝʔλ͕‫ੵݟ‬΋ΒΕ͍ͯΔ.

4.3.3 MQDSS
4.3.3.1

MQDSS ͷ֓ཁ

MQDSS [6] ͸, ιχʔ‫ࣜג‬ձࣾͷ࡞ຊ, നҪ, ඉ౉ʹΑΓఏҊ͞Εͨ 5-pass ͷೝূํࣜ [35] ʹର͠, Fiat-Shamir ม‫׵‬Λద༻ͨ͠΋ͷͰ͋Δ. ಛʹ, ૒‫ܕۃ‬γεςϜͰ͸ߏ੒͞Ε͓ͯΒͣ, ߈ܸର৅ͱͳΔ MQ ໰୊ʹτϥοϓυΞͷߏ଄͸ೖ͍ͬͯͳ͍. ͢ͳΘͪ, MQ ໰୊͸ҰൠతͱͳΓ, τϥοϓυΞʹΑΔ੬ऑੑ͸ͳ͍. ࣮ࡍ, MQ ໰୊ͷ average61case Ͱͷղಡࠔ೉ੑΛԾఆ͢Δͱ, ϥϯμϜΦϥΫϧϞσϧͷԼ, MQDSS ͸ EUF-CMA ҆શͰ͋Δ͜ͱ͕ࣔ͞Εͯ
͍Δ [6]. ͜ͷ 5-pass ͷೝূํࣜ (͓Αͼ, MQDSSʣΛ‫ه‬ड़͢ΔͨΊʹ, ίϛοτϝϯτ Com Λ 1 ͭ༻ҙ͢Δ. (ίϛοτϝϯτʹ͍ͭͯ͸, [22] Λࢀরͷ͜ͱ.) 5-pass ͷೝূํࣜͷ‫ݤ‬ੜ੒͸࣍ͷΑ͏ʹߦ͏.

1. Fq ্ͷଟ߲ࣜ‫ ܥ‬F (x) = (f1 (x), . . . , fm (x)) Ͱ, ͢΂ͯͷ fi (x) ͕ 2 ࣍ଟม਺ଟ߲ࣜͰ, ͔ͭఆ਺߲Λ࣋ͨͳ͍΋ͷΛϥϯμϜʹߏ੒͢Δ. (ࣸ૾ͱͯ͠͸, F : Fqn → Fqm ͱͳΔ.)

2. s ∈ Fqn ΛϥϯμϜʹબͿ.

3. v = F (s) ∈ Fqm Λ‫͢ࢉܭ‬Δ.
͜ͷͱ͖, s Λൿີ‫͠ͱݤ‬, (F (x), v) Λެ։‫͢ͱݤ‬Δ. ·ͨ, ଟม਺ଟ߲ࣜࣸ૾ G : Fq2n → Fqm ΛG(x, y) = F (x + y)?F (x)?F (y)(4.4)Ͱఆٛ͢Δ. G(x, y) ͸૒Ұ࣍ࣸ૾Ͱ͋Γ, ެ։‫ ݤ‬F (x) ͔Β୭Ͱ΋࡞Δ͜ͱ͕Ͱ͖Δ. ೝূ͸࣍ͷΑ͏ʹ࣮ߦ͞ΕΔ.
ূ໌ऀ ((F (x), v), s)r0 , t0 ∈ Fqn ,r1 ← s − r0‫( ऀূݕ‬F (x), v)

e0 ∈ Fqm ΛϥϯμϜʹબͿ.

c0 ← Com(r0 , t0 , e0 )c1 ← Com(r1 , G(t0 , r1 ) + e0 )t1 ← αr0 − t0

e1 ← αF (r0 ) − e0
Ch = 0 ͳΒ͹, Rsp ← r0
Ch = 1 ͳΒ͹, Rsp ← r1

(c0 ,c1 )

−−−−→
α
←−−−−

α ∈ Fq ΛϥϯμϜʹબͿ.

(t1 ,e1 )

−−−−→
Ch
←−−−−

Ch ∈ {0, 1} ΛϥϯμϜʹબͿ.

Rsp−−−−−→

Ch = 0 ͳΒ͹, Rsp = r0 ͱ‫͠ͳݟ‬, ࣍ΛνΣοΫ.
?

c0 = Com(r0 , αr0 − t1 , αF (r0 ) − e1 )

Ch = 1 ͳΒ͹, Rsp = r1 ͱ‫͠ͳݟ‬, ࣍ΛνΣοΫ.
?

c1 = Com(r1 , α(v − F (r1 )) − G(t1 , r1 ) − e1 )?

“ = ” ͷ౳͕ࣜ੒ΓཱͭͳΒ͹ 1 Λ, ͦ͏Ͱͳ͚Ε͹ 0 Λ‫ऀূݕ‬͸ग़ྗ͢Δ. ͜ͷೝূʹ͓͍ͯ, ෆਖ਼ূ໌ऀ͕౸ୡ
1
Ͱ͖Δ (࠷େͷʣ੒ޭ֬཰͸ 12 + 2q
ͱͳΔ.

MQDSS ͷ‫ݤ‬ੜ੒, ॺ໊ੜ੒, ‫ূݕ‬ΞϧΰϦζϜΛ‫ه‬ड़͢Δ. MQDSS ͷઃ‫ʹܭ‬ඞཁͳύϥϝʔλ͸, ༗‫ݶ‬ମͷҐ਺ q, ม਺ͷ‫͓( ਺ݸ‬Αͼࣜ਺ʣn, ϥ΢ϯυ਺ r ͷ 3 ͭͰ͋Δ. ҉߸ֶతϋογϡؔ਺Λ 3 ͭ༻ҙ͢Δɿ

H : {0, 1}∗ → {0, 1}k (k ͸҆શੑύϥϝʔλ), H1 : {0, 1}∗ → Fqr , H2 : {0, 1}∗ → {0, 1}r .
‫ݤ‬ੜ੒͸ 5-pass ͷೝূํࣜͷͦΕͱ‫ج‬ຊతʹಉ͡Ͱ͋Δ͕, m = n ͱ͢Δ఺ʹ஫ҙ͢Δ.

‫ݤ‬ੜ੒

1. Fq ্ͷଟ߲ࣜ‫ ܥ‬F (x) = (f1 (x), . . . , fn (x)) Ͱ, ͢΂ͯͷ fi (x) ͕ 2 ࣍ଟม਺ଟ߲ࣜͰ, ͔ͭఆ਺߲Λ࣋ͨͳ͍΋ͷΛϥϯμϜʹߏ੒͢Δ. (ࣸ૾ͱͯ͠͸, F : Fqn → Fqn ͱͳΔ.)

2. s ∈ Fqn ΛϥϯμϜʹબͿ.

3. v = F (s) ∈ Fqn Λ‫͢ࢉܭ‬Δ.
pk = (F (x), v), sk = s ͕ͦΕͧΕެ։‫ݤ‬, ൿີ‫ͳͱݤ‬Δ. ࣍ʹ, ॺ໊ੜ੒Ͱ͋Δ. ϝοηʔδΛ M ∈ {0, 1}∗ ͱ͢Δ.
62

ॺ໊ੜ੒

1. R ← H(sk∥M ).

2. D ← H(pk∥R∥M ).
(1)

(r)

(1)

(r)

(1)

(r)

3. r0 , . . . , r0 , t0 , . . . , t0 , e0 , . . . , e0 ∈ Fqn ΛϥϯμϜʹબͿ.
4. j = 1, 2, . . . , r ʹର͠, ҎԼΛ࣮ߦɿ
(j)

(j)

4-1 r1 ← s − r0 .
(j)

(j)

(j)

(j)

(j)

(j)

4-2 c0 ← Com(r0 , t0 , e0 ).
(j)

(j)

(j)

(G ͸ (4.4) Ͱఆٛ͞ΕΔ૒Ұ࣍ࣸ૾ʣ

4-3 c1 ← Com(r1 , G(t0 , r1 ) + e0 ).
4-4 com(j)(j) (j):= (c0 , c1 ).
(1)(2)

5. σ0 ← H(com∥ · · · ∥com(r) ).

∥com

6. ch1 = (α(1) , . . . , α(r) ) ← H1 (D, σ0 ) ∈ Fqr .
7. j = 1, 2, . . . , r ʹର͠, ҎԼΛ࣮ߦɿ
(j)

(j)

(j)

(j)

(j)

(j)

7-1 t1 ← α(j) r0 − t0 , e1 ← α(j) F (r0 ) − e0 .
(j)

(j)

(j)

7-2 resp1 := (t1 , e1 ).
(1)

(2)

(r)

8. σ1 ← (resp1 ∥resp1 ∥ · · · ∥resp1 ).

9. ch2 = (b(1) , . . . , b(r) ) ← H2 (D, σ0 , ch1 , σ1 ) ∈ {0, 1}r .

10. j = 1, 2, . . . , r ʹର͠, ҎԼΛ࣮ߦɿ
(j)

(j)

(1)

(2)

10-1 resp2 ← rb(j) .

(r)

(1)

(2)

(r)

11. σ2 ← (resp2 ∥resp2 ∥ · · · ∥resp2 ∥c1−b(1) ∥c1−b(2) ∥ · · · ∥c1−b(r) ).
σ = (R, σ0 , σ1 , σ2 ) ͕ॺ໊ͱͳΔ. ࠷‫ʹޙ‬, ‫͋Ͱূݕ‬Δ.
‫ূݕ‬

1. D ← H(pk∥R∥M ).

2. ch1 = (α(1) , . . . , α(r) ) ← H1 (D, σ0 ) ∈ Fqr .

3. ch2 = (b(1) , . . . , b(r) ) ← H2 (D, σ0 , ch1 , σ1 ) ∈ {0, 1}r .
(1)

(2)

(r)

(1)

(2)

(r)

4. σ1 Λ σ1 = (resp1 ∥resp1 ∥ · · · ∥resp1 ) ͳΔ࿈݁ͱ‫͢ͳݟ‬.
(1)

(2)

(r)

5. σ2 Λ σ2 = (resp2 ∥resp2 ∥ · · · ∥resp2 ∥c1−b(1) ∥c1−b(2) ∥ · · · ∥c1−b(r) ) ͳΔ࿈݁ͱ‫͢ͳݟ‬.
6. j = 1, 2, . . . , r ʹର͠, ҎԼΛ࣮ߦɿ
(j)

(j)

(j)

(j)

6-1 resp1 Λ resp1 = (t1 , e1 ) ͱ‫͢ͳݟ‬.
(j)

(j)

(j)

(j)

(j)

(j)

(j)

(j)

(j)

(j)

6-2 b(j) = 0 ͳΒ͹, r0 := resp2 , c0 ← Com(r0 , α(j) r0 − t1 , α(j) F (r0 ) − e1 ).
(j)ͦ͏Ͱͳ͚Ε͹, r1
(j)

(j)

(j)

(j)

(j)

(j)

(j)

:= resp2 , c1 ← Com(r1 , α(j) (v − F (r1 )) − G(t1 , r1 ) − e1 ).

6-3 com(j) := (c0 , c1 ).

7. σ0′ ← H(com(1) ∥com(2) ∥ · · · ∥com(r) ).
8. σ0′ == σ0 Λฦ͢.

‫ऀূݕ‬͸, σ0′ = σ0 ͷͱ͖, ॺ໊Λडཧ͠, ͦΕҎ֎͸ෆडཧͱ͢Δ.

4.3.3.2

MQDSS ͷύϥϝʔλબ୒

NIST PQC ඪ४ԽϓϩδΣΫτ Round1 ͷࢿྉ [7] Ͱ͸, ҎԼͷΑ͏ʹύϥϝʔλʹؔ͢Δ 2 ͭͷσʔλ͕ࣔ͞Ε
͍ͯΔ.

63

໊শ

(q, n, r)҆શੑϨϕϧ (= k/2)ެ։‫ݤ‬௕

ൿີ‫ݤ‬௕ॺ໊௕

MQDSS-31-48(31, 48, 269)

128 bits

62 B

32 B

32882 B

MQDSS-31-64(31, 64, 403)

192 bits

88 B

48 B

67800 B͜ͷύϥϝʔλ͸, ‫ݹ‬య‫ʹػࢉܭ‬ΑΔ߈ܸͰ͋ΔϋΠϒϦου߈ܸͱ, ϋΠϒϦου߈ܸͷҰ෦Λ Grover ͷΞϧΰϦζ
ϜͰஔ͖‫ܸ߈ࢠྔͨ͑׵‬ͷ‫͔ྔࢉܭ‬Β‫ੵݟ‬΋ΒΕ͍ͯΔ. ͳ͓, [7] Ͱ͸, ެ։‫ ݤ‬F (x) ͸ඞཁͱͳΔ౓ʹՄม௕ग़ྗؔ਺ (XOF) Λ༻͍ͯ, k Ϗοτͷจࣈྻ͔Β܎਺Λߏ੒͢Δͱ͍͏ख๏Λ༻͍͍ͯΔͨΊ, ެ։‫ݤ‬௕Λ (୯७ͳ F (x) ͷ܎਺ू߹ΑΓʣখ͘͢͞Δ͜ͱ͕Ͱ͖͍ͯΔ.

4.4 ·ͱΊ
1988 ೥ʹদຊ-ࠓҪํ͕ࣜఏҊ͞ΕͯҎདྷ, ༷ʑͳଟม਺ެ։‫߸҉ݤ‬ͷ҉߸ํࣜ, ॺ໊ํ͕ࣜఏҊ͞Ε͖ͯͨ. ҉߸ํࣜ͸, দຊ-ࠓҪํࣜΛ͸͡Ί, ఏҊ͞Εͨଟ͘ͷํ͕ࣜഁΒΕͯ͠·ͬͨ. ‫ࡏݱ‬க໋తͳ߈ܸΛ໔Ε͍ͯΔ΋ͷͱͯ͠͸, Simple Matrix ํࣜ (2013), EFC (ͷมछʣ(2016), HFERP (2018), EFLASH (2018) ͳͲ͕͋Δ͕, ͍ͣΕ΋ఏҊ͞Εͯ·ͩؒ΋ͳ͘, NIST PQC ඪ४ԽϓϩδΣΫτʹ͸౤ߘ͞Εͳ͔ͬͨ. ॺ໊ํࣜͰ͸, 1996 ೥ʹ HFE−v ͕,

1999 ೥ʹ UOV ͕ఏҊ͞Εͨ. ·ͨ, 2005 ೥ʹ͸ UOV Λଟ૚Խͨ͠ॺ໊ํࣜ Rainbow ͕ఏҊ͞Εͨ.
NIST PQC ඪ४ԽϓϩδΣΫτʹ͸, ଟม਺ެ։‫߸҉ݤ‬ͷॺ໊ํ͕ࣜଟ͘౤ߘ͞Εͨ. ͜ͷதͰ͸, UOV ‫ ͕ܥ‬3 ݅,HFE−v ‫ ͕ܥ‬3 ݅‫·ؚ‬Ε͍ͯͨ. ͜ͷใࠂॻͰ͸۩ମతͳํࣜͱͯ͠, NIST PQC ඪ४ԽϓϩδΣΫτʹ΋౤ߘ͞Εͯ
͍Δ Rainbow (UOV ‫ܥ‬୅දʣ, Gui (HFE−v ‫ܥ‬୅දʣ, MQDSS ͷ 3 ͭͷॺ໊ํࣜΛऔΓ্͛, ֓ཁΛઆ໌ͨ͠. ૒‫ۃ‬‫ܕ‬γεςϜͰߏ੒͞Ε͍ͯΔ Rainbow ͱ Gui ͸, ଟม਺ଟ߲ࣜ‫ܥ‬Λެ։‫ݤ‬, ൿີ‫͢ͱݤ‬ΔͨΊ‫ݤ‬௕͕๲େʹͳΔ͕, ॺ໊௕͸ൺֱతখ͍͞ͱ͍͏ಛ௃Λ࣋ͭ. ·ͨ, ‫ূݕ‬͸ଟ߲ࣜ΁ͷ୅ೖධՁͷΈͰ‫͞ࢉܭ‬ΕΔͨΊ, ޮ཰తͰ҆ఆͨ͠ύϑΥʔϚϯε͕ಘΒΕΔ. Ұํ, ର࿩‫ܕ‬ೝূͱ Fiat-Shamir ม‫ߏͰ׵‬੒͞Ε͍ͯΔ MQDSS ͸, ‫ݤ‬௕͸ͦΕ΄Ͳେ͖͘͸ͳ͍͕, ॺ໊௕͕ൺֱతେ͖͍ͱ͍͏ಛ௃Λ࣋ͭ.
Ұൠʹ, ଟม਺ެ։‫Ͱ߸҉ݤ‬͸, MP ໰୊ʹର͢ΔάϨϒφʔ‫ج‬ఈ߈ܸͷ‫ྔࢉܭ‬ͷ‫͔఺؍‬Β, ൒ਖ਼ଇͱ‫ݺ‬͹ΕΔ৚݅Λຬͨ͢ଟม਺ଟ߲ࣜ‫ܥ‬Λར༻͢Δ͜ͱ͕๬·͍͠. ॺ໊ํࣜ Rainbow ͸, ൒ਖ਼ଇͳଟม਺ଟ߲ࣜ‫ܥ‬Λར༻Ͱ͖͍ͯΔ.
ҰํͰ, ҉߸ํࣜʹରͯ͠͸, ൒ਖ਼ଇͳଟม਺ଟ߲ࣜ‫ܥ‬Λ༻͍ͨߏ੒͕೉͍͠ͷ͕‫ݱ‬ঢ়Ͱ͋Δ.

64

ୈ 4 ষͷࢀߟจ‫ݙ‬[1] M. Bardet, J.-C. Faugère, B. Salvy, B.-Y. Yang. Asymptotic expansion of the degree of regularity forsemi-regular systems of equations. In Eﬀective Methods in Algebraic Geometry (MEGA), pp. 71–74, 2004.
[2] L. Bettale, J.-C. Faugère, and L. Perret. Hybrid approach for solving multivariate systems over finite fields.
J. Math. Cryptol. vol. 3, Issue 3, pp. 177-197, 2009.
[3] W. Beullens, B. Preneel, A. Szepieniec, F. Vercauteren. LUOV. NIST PQC ඪ४ԽϓϩδΣΫτ Round 1 ީิࢿྉ. https://csrc.nist.gov/projects/post-quantum-cryptography/round-1-submissions[4] R. Cartor, D, Smith-Tone. EFLASH: A New Multivariate Encryption Scheme. SAC’18, to be appeared in
Springer LNCS, 2018.
[5] A. Casanova, J.-C. Faugère, G. Macario-Rat, J. Patarin, L. Perret, J. Ryckeghem. GeMSS. NIST PQC ඪ४ԽϓϩδΣΫτ Round 1 ީิࢿྉ. https://csrc.nist.gov/projects/post-quantum-cryptography/ro

und-1-submissions[6] M.-S. Chen, A. Hülsing, J. Rijneveld, S. Samardjiska, P. Schwabe. From 5-pass MQ-based identification to
MQ-based signatures. ASIACRYPT’16, Springer LNCS vol. 10032, pp. 135–165, 2016.
[7] M.-S. Chen, A. Hülsing, J. Rijneveld, S. Samardjiska, P. Schwabe. MQDSS. NIST PQC ඪ४ԽϓϩδΣΫ
τ Round 1 ީิࢿྉ. https://csrc.nist.gov/projects/post-quantum-cryptography/round-1-submis

sions[8] J. Ding, M.-S. Chen, A. Petzoldt, D. S. Schmidt, B.-Y. Yang. Gui. NIST PQC ඪ४ԽϓϩδΣΫτ Round
1 ީิࢿྉ. https://csrc.nist.gov/projects/post-quantum-cryptography/round-1-submissions[9] J. Ding, M.-S. Chen, A. Petzoldt, D. S. Schmidt, B.-Y. Yang. Rainbow. NIST PQC ඪ४ԽϓϩδΣΫτ Round
1 ީิࢿྉ. https://csrc.nist.gov/projects/post-quantum-cryptography/round-1-submissions[10] J. Ding, J. E. Gower, D. S. Schmidt. Multivariate Public Key Cryptosystems. Advances in Information
Security 25, Springer, 2006.
[11] J. Ding and T. J. Hodges. Inverting HFE Systems Is Quasi-Polynomial for All Fields. CRYPTO’11, Springer
LNCS vol. 6841, pp. 724–742, 2011.
[12] J. Ding and D. Schmidt. Rainbow, a New Multivariable Polynomial Signature Scheme. ACNS’05 Springer
LNCS vol. 3531, pp. 164–175, 2005.
[13] J. Ding, B.-Y. Yang. Degree of Regularity for HFEv and HFEv-. PQCrypto’13, Springer LNCS vol. 7932,
pp. 52–66, 2013.
[14] J. Ding, B.-Y. Yang, C.-H. O. Chen, M.-S. Chen, C. M. Cheng. New Diﬀerential-Algebraic Attacks andReparametrization of Rainbow. ACNS’08, Springer LNCS vol. 5037, pp. 242–257, 2008.
[15] V. Dubois and N. Gama. The Degree of Regularity of HFE Systems. ASIACRYPT’10, Springer LNCS vol.

65

6477, pp. 557–576, 2010.
[16] J.-C. Faugère. A new eﬃcient algorithm for computing Gröbner bases (F4). J. Pure Appl. Algebra, vol. 139
pp. 61–88, 1999.
[17] J.-C. Faugère. A new eﬃcient algorithm for computing Gröbner bases without reduction to zero (F5).
Proceedings of ISSAC’02, pp. 75–83. ACM Press, 2002.
[18] J.-C. Faugère, L. Perret, J. Ryckeghem. DualModeMS. NIST PQC ඪ४ԽϓϩδΣΫτ Round 1 ީิࢿྉ.
https://csrc.nist.gov/projects/post-quantum-cryptography/round-1-submissions[19] R. Fröberg. An inequarity for Hilbert series of graded algebras. Math. Scand., vol. 56, no. 2, pp. 117–144,
1985.
[20] M. R. Garay and D. S. Johnson. A Guide to the Theory of NP-Completeness. In Computers and Intractability,
W.H.Freeman, 1979.
[21] L. Goubin and N.T. Courtois. Cryptanalysis of the TTM Cryptsystem. ASIACRYPT’00, Springer LNCS
vol. 1976, pp. 44–57, 2000.
[22] S. Halevi and S. Micali. Practical and Provably-Secure Commitment Schemes from Collision-Free Hashing.
CRYPTO, Springer LNCS vol. 1109, pp. 201–215, 1996.
[23] Y. Ikematsu, R. Perlner, D. Smith-Tone, T. Takagi, J. Vates. HFERP - A New Multivariate Encryption
Scheme. PQCrypto’18, Springer LNCS vol. 10786, pp. 396- 416, 2018.
[24] A. Kipnis, L. Patarin, L. Goubin. Unbalanced Oil and Vinegar Schemes. EUROCRYPT’99, Springer LNCS
vol. 1592, pp. 206–222, 1999.
[25] A. Kipnis, and A. Shamir. Cryptanalysis of the Oil and Vinegar Signature Scheme. CRYPTO’98, Springer
LNCS vol. 1462, pp. 257–266, 1998.
[26] A. Kipnis, and A. Shamir.

Cryptanalysis of the HFE Public Key Cryptosystem by Relinearization.

CRYPTO’99. Springer LNCS, vol. 1666, pp. 19–33 1999[27] T. Matsumoto and H. Imai. Public Quadratic Polynomial-tuples for Eﬃcient Signature Verification andMessage Encryption. EUROCRYPT’88, Springer LNCS vol. 330, pp. 419–453, 1988.
[28] H. Ong, C.P. Schnorr and A. Shamir. An eﬃcient signature scheme based on quadratic equations. Proc.
16th ACM Symp. Theory Comp., pp. 208–216, 1984.
[29] J. Patarin. Cryptanalysis of the Matsumoto and Imai public key scheme of Eurocryptʟ88. CRYPTO’95,
Springer LNCS vol. 963, pp. 248–261, 1995.
[30] J. Patarin. Hidden Fields Equations (HFE) and Isomorphisms of Polynomials (IP): Two New Families ofAsymmetric Algorithms. EUROCRYPTO’96, Springer LNCS vol. 1070, pp. 33–48, 1996.
[31] J. Patarin. The Oil and Vineger Signature Scheme. Dagstuhl Workshop on Cryptography, 1997.
[32] R. Perlner, A. Petzoldt, D. Smith-Tone. Improved Cryptanalysis of HFEv- via Projection. PQCrypto’18,
Springer LNCS vol. 10786, pp. 375–395, 2018.
[33] A. Petzoldt, M.-S. Chen, B.-Y. Yang, C. Tao, J. Ding. Design principles for HFEv-based multivariate
signature schemes. ASIACRYPT’15, Springer LNCS vol. 9742, pp. 311–334, 2015.
[34] J.M. Pollard and C.P. Schnorr. An eﬃcient solution of the congruence x2 + ky 2 ≡ m (mod n). IEEE Trans.
Inf. Theory, IT-33, pp. 702–709, 1987.

[35] K. Sakumoto, T. Shirai, H. Hiwatari. public-key identification schemes based on multivariate quadratic
polynomials. CRYPTO’11, Springer LNCS vol. 6841, pp. 706–723, 2011.
66

[36] K. Sakumoto, T. Shirai, H. Hiwatari. On Provable Security of UOV and HFE Signature Schemes against
Chosen-Message Attack. PQCrypto’11, Springer LNCS vol. 7071, pp. 68–82, 2011.
[37] T. Satoh and K. Araki. On construction of signature scheme over a certain noncommutative ring. IEICE
Trans. Fundamentals, E80-A, pp. 702–709, 1997.
[38] A. Shamir. Eﬃcient signature schemes based on birational permutations. CRYPTO’93, Springer LNCS vol.
773, pp. 1–12, 1994.
[39] K.-A. Shim. HiMQ3. NIST PQC ඪ४ԽϓϩδΣΫτ Round 1 ީิࢿྉ. https://csrc.nist.gov/projects/post-quantum-cryptography/round-1-submissions[40] A. Szepieniec, J. Ding, B. Preneel. Extension Field Cancellation: A New Central Trapdoor for Multivariate
Quadratic Systems. PQCrypto’16, Springer LNCS vol. 9606, pp. 182–196, 2016.
[41] C. Tao, A. Diene, S. Tang, J. Ding. Simple Matrix Scheme for Encryption. PQCrypto’13, Springer LNCS
vol. 7932, pp. 231–242, 2013.
[42] B.-Y. Yang and J.-M. Chen. All in the XL Family: Theory and Practice. ICISC 2004, Springer LNCS vol.
3506, pp. 67–86, 2005.

67

ୈ5ষ

ಉछࣸ૾ʹ‫ٕ߸҉ͮ͘ج‬ज़ຊষͰ͸ಉछࣸ૾ʹ‫ٕ߸҉ͮ͘ج‬ज़ʹ͍ͭͯ·ͱΊΔ. ಉछࣸ૾ʹ‫ٕ߸҉ͮ͘ج‬ज़ͷ҆શੑ͸, छʑͷಉछࣸ૾໰୊
Λղ͘‫ࢉܭ‬ͷࠔ೉ੑʹґଘ͍ͯ͠Δ.

5.1 અͰ͸, ҆શੑͷࠜ‫ͳͱڌ‬Δ໰୊ͱͯ͠, ಉछࣸ૾໰୊ͷҰൠ‫ܗ‬, SIDH (Supersingular Isogeny Diﬃe–Hellman)‫ڞݤ‬༗ͷ҆શੑΛࠜ‫͚ͮڌ‬Δ໰୊, CSIDH (Commutative Supersingular Isogeny Diﬃe–Hellman) ‫ڞݤ‬༗ͷ҆શੑΛࠜ‫͚ͮڌ‬Δ໰୊ͷॱʹ, ͦͷ֓ཁΛ‫ه‬ड़͍ͯ͘͠. ͦͯ͠, ͦͷ࠷ऴઅ (5.1.4 અ) Ͱ, 3 ͭͷ‫ج‬ຊಉछࣸ૾໰୊ͷ઴ۙతղಡ࣌ؒΛ࢖༻͢ΔΞϧΰϦζϜͱ‫ʹڞ‬ൺֱ͢Δ. 5.2 અͰ͸, ୅දతͳ҉߸ํࣜͱͯ͠, SIDH ‫ڞݤ‬༗, CSIDH ‫ڞݤ‬༗ΛऔΓ্͛Δ. 5.3 અͰ͸, SIDH ‫ڞݤ‬༗ʹ‫۩͍ͨͮج‬ମతͳಉछࣸ૾ʹ‫ͯ͠ͱࣜํ߸҉ͮ͘ج‬, NIST ඪ४ԽʹఏҊ͞Εͨ SIKE (Supersingular Isogeny Key Encapsulation) Λ, ·ͣղઆ͢Δ. ͦͯ࣍͠અͰಉछࣸ૾ʹ‫ͮ͘ج‬ೝূ෇͖‫ڞݤ‬༗ɾάϧʔϓ‫ڞݤ‬༗ʹ৮Εͨ͋ͱ, ಉछࣸ૾ʹ‫͍ͯͭʹࣜํ໊ॺͮ͘ج‬ͷ‫ݱ‬ঢ়, ಛʹ CSIDH ϕʔεͷ SeaSign ॺ໊ํࣜΛ֓આ͢Δ.
ຊষͰ͸, ௒ಛҟପԁ‫ۂ‬ઢΛ༻͍ͨ҉߸ٕज़͔͠ѻΘͳ͍͕, ௨ৗପԁ‫ۂ‬ઢʹ‫ ͮ͘ج‬CRS (Couveignes–Rostovtsev–

Stolbunov) ‫ڞݤ‬༗๏Λվྑͨ͠ De Feo Β [20] ͷํࣜ, ͦΕࣗମ͸࣮༻తͳੑೳʹ͸·ͩԕ͍͕, ͔͠͠, ͦ͜ͰಘΒΕͨ஌‫ݟ‬͸, CSIDH ‫ڞݤ‬༗Λߏ੒͍ͯ͘͠ͷʹେ͖͘‫د‬༩ͨ͜͠ͱ͕஌ΒΕ͍ͯΔ.
ಉछࣸ૾ͷ਺ֶతৄࡉʹ͍ͭͯ͸, De Feo ͷ֓આ‫[ ࣄه‬17] ΍ Washington ͷପԁ‫ۂ‬ઢͷ‫ڭ‬Պॻ [52] Λࢀরͷ͜ͱ.
·ͨ, Galbraith–Vercauteren ʹΑΔಉछࣸ૾ؔ࿈໰୊ͷαʔϕΠ [30] ΋ࢀর͢Δ.
˙‫ه‬๏x ←R X ͸, x Λू߹ X ͔ΒҰ༷ϥϯμϜʹαϯϓϦϯά͢Δ͜ͱΛද͢. ҎԼͰ͸, ༗‫ݶ‬ମ্ʹఆٛ͞Εͨପԁ‫ۂ‬ઢͷΈΛѻ͍, ಉछࣸ૾҉߸Ͱ͸, ଟ͘ͷ৔߹, ϞϯΰϝϦ‫ܕ‬ͷପԁ‫ۂ‬ઢఆٛࣜ Ea,b : by 2 = x3 + ax2 + x ͕༻͍ΒΕΔ. ඪ਺ p ͷ༗‫ݶ‬ମ F ্ఆٛ͞Εͨପԁ‫ۂ‬ઢ E ʹର͠, OE ͸ E ͷແ‫ݶ‬ԕ఺Ͱ͋Γ, F ͷ֦େମ K ʹରͯ͠,K-༗ཧ఺‫܈‬͸ E(K) = {(x, y) ∈ K2 | (x, y) ͸ E ͷఆٛࣜΛຬͨ͢ } ∪ {OE } Ͱ༩͑ΒΕΔ. ·ͨ, E ͷ r-Ͷ͡Ε‫܈‬͸E[r] = {P ∈ E(Fp ) | rP = OE } Ͱ༩͑ΒΕΔ. ·ͨ, ༗‫ݶ‬ମΛࢦఆͤͣ, ୯ʹ P ∈ E ͱॻ͍ͨͱ͖͸, P ∈ E(Fp ) Λ
ҙຯ͢Δ.

5.1 ಉछࣸ૾ʹ‫ٕ߸҉ͮ͘ج‬ज़ͷ҆શੑͷࠜ‫ͳͱڌ‬Δ໰୊
ಉछࣸ૾໰୊ͷҰൠ‫ܗ‬, SIDH ‫ڞݤ‬༗ͷ҆શੑͷࠜ‫ͳͱڌ‬Δ໰୊, CSIDH ‫ڞݤ‬༗ͷ҆શੑͷࠜ‫ͳͱڌ‬Δ໰୊, ͦΕͧΕͷఆٛͱ, ‫ʹͰ·ࡏݱ‬஌ΒΕ͍ͯΔͦΕΒ໰୊ʹର͢Δղੳঢ়‫͍֓ͯͭʹگ‬આ͢Δ.

68

5.1.1 ಉछࣸ૾໰୊ͷҰൠ‫ܗ‬ಉछࣸ૾ͱ͸, 2 ͭͷପԁ‫ۂ‬ઢ E, E ′ ͷؒͷࣸ૾ φ Ͱ͋Γ, E ͷ࠲ඪ (x, y) ͷ༗ཧࣜͰ༩͑ΒΕΔͱ‫ʹڞ‬, ପԁ‫ۂ‬ઢͷՃ๏ߏ଄ʹؔ͢Δ४ಉ‫ܕ‬ੑ, ଈͪ φ(P + Q) = φ(P ) + φ(Q), Λ༗͢Δࣸ૾Ͱ͋Δ. (ͦͷਖ਼֬ͳఆٛ͸, લ‫ܝ‬ͷ֤จ‫ݙ‬Λࢀরͷ͜ͱ.) ·ͨ, E, E ′ ͷؒʹ, ಉछࣸ૾ φ ͕ଘࡏ͢Δ࣌ʹ, E ͱ E ′ ͸ಉछͰ͋Δͱ͍͏.
ಉछࣸ૾ φ ͸, ͦͷ֩ C = ker(φ) ʹΑܾͬͯ·ΔͷͰ, φ ͷఆٛҬ‫ۂ‬ઢ E ʹରͯ͠ φ ͷ஋ҬͱͳΔପԁ‫ۂ‬ઢΛ E/Cͱॻ͖ද͢, ͢ͳΘͪ, φ : E → E/C. ֩ C = ker(φ) ͷҐ਺͕ηΩϡϦςΟύϥϝʔλ λ ͷଟ߲ࣜαΠζͰ͋Ε͹,C = ker(φ) ͱͳΔ φ Λޮ཰తʹ‫͢ࢉܭ‬ΔΞϧΰϦζϜ͕ Vélu ʹΑͬͯ༩͑ΒΕ͍ͯΔ [51]. (ϞϯΰϝϦ‫ܕ‬ପԁ‫ۂ‬ઢʹର͢Δ Vélu ͷެࣜʹؔͯ͠͸, [44] Λࢀরͷ͜ͱ.) ͦͷޮ཰తͳಉछࣸ૾‫ج‬ຊԋࢉͷ߹੒͕ಉछࣸ૾҉߸Ͱͷެ։‫ݤ‬ੜ੒, ҉߸Խ, ͦͯ͠෮߸Λ༩͑Δ. ͦͯ͠, ͦͷ߹੒ʹ͓͚Δ‫ج‬ຊԋࢉͷ૊Έ߹Θͤํ๏͕, ൿີ‫ݤ‬৘ใΛ༩͑Δ.
ͭ·Γ, ಉछͳପԁ‫ۂ‬ઢͷؒͷಉछࣸ૾Λ‫͢ࢉܭ‬Δ͜ͱΛཁ‫͢ٻ‬Δ࣍ͷಉछࣸ૾໰୊͕, ۩ମతͳ҉߸ํࣜͷ҆શੑΛࠜ‫͚ͮڌ‬Δ࣍અҎ߱ͷ໰୊ͷ‫ڞ‬௨ςϯϓϨʔτΛ༩͑Δ.
ఆٛ 5.1 (Ұൠ‫ܗ‬ಉछࣸ૾໰୊ [30]) 2 ͭͷಉछͳପԁ‫ۂ‬ઢ E, E ′ ʹରͯ͠, ಉछࣸ૾ φ Λ‫ͤࢉܭ‬Α. (φ ͷίϯύΫτ
ͳද‫ݱ‬Λ༩͑Α.)͜͜Ͱ, ʮφ ͷίϯύΫτͳද‫ݱ‬ʯͱ͸, ྫ͑͹, deg(φ) ͕খૉ਺ ℓi ʹΑͬͯ? eiℓi ͱͳ͍ͬͯΔ৔߹ʹ͸, ͜ͷ෼ղʹԊͬͯ φ Λ෼ղ֤ͨ͠ ℓi ࣍ಉछࣸ૾ͷ૾ʹ‫ݱ‬ΕΔ஋Ҭପԁ‫ۂ‬ઢ (ຢ͸ j ෆมྔ) ͷྻ‫Ͱڍ‬༩͑ΒΕΔ. ·ͨ, SIDH‫ڞݤ‬༗ͷઃఆͰ͸, ֩ͷੜ੒఺͕, ಉछࣸ૾ͷίϯύΫτද‫ݱ‬Λ༩͑Δ. ͜Ε·Ͱ, ಉछࣸ૾҉߸Ͱ͸, খૉ਺ͷੵʹ෼ղ͢Δ࣍਺Λ΋ͭಉछࣸ૾͔͠ߟ͑ͳ͍.
ఆٛ 5.1 ʹ͓͍ͯ, φ ͷ࣍਺͕ଟ߲ࣜαΠζͰ͋Ε͹, ্‫ه‬໰୊͸؆୯ʹղ͚ΔͷͰ, φ ͷ࣍਺͸௨ৗ͸ࢦ਺αΠζͷ΋ͷΛߟ͑Δ. ·ͨ, Galbraith Β [30] ͸, j ෆมྔΛ࢖ͬͯ, ্‫ه‬໰୊ΛఆࣜԽ͍ͯ͠Δ͕, CSIDH ‫ڞݤ‬༗Ͱ͸, Fp -༗ཧͳପԁ‫ۂ‬ઢͷΈΛର৅ͱ͢ΔͷͰ, Fp -ಉ‫͋Ͱܕ‬Δ͕ Fp -ಉ‫͍ͳͰܕ‬πΠετ‫ۂ‬ઢΛ൑ผͯ͠ѻ͏ඞཁ͕ੜ͡ΔͨΊ,্Ͱ͸͋͑ͯ, ΑΓૉ๿ͳ‫ܗ‬Λ࠾༻ͯ͠, 2 ͭͷಉछͳପԁ‫ۂ‬ઢ E, E ′ Λ࢖ͬͯಉछࣸ૾໰୊Λఏࣔͨ͠.
ಉछࣸ૾໰୊ͷॳ‫ظ‬ͷߟ࡯ʹ͸, ࣗ‫ݾ‬४ಉ‫ࢉܭ؀ܕ‬Λѻͬͨ Kohel ͷത࢜࿦จ [36] ΍ Galbraith ʹΑΔಉछࣸ૾໰
୊ʹؔ͢Δ‫[ ڀݚ‬25] ‫ ͼٴ‬Couveignes ͱ Rostovtsev–Stolbunov ʹΑΔॳ‫ظ‬ͷ҉߸Ԡ༻΁ͷఏҊ [13, 45] ͕͋Δ. ͦͷ‫ޙ‬, Charles ΒʹΑΔಉछࣸ૾ʹ‫͍ͨͮج‬ϋογϡؔ਺ͷఏҊ [8] ͸, ಉछࣸ૾Ұํ޲ੑؔ਺ΛҰํ޲ੑͷ‫͔఺؍‬Β͚ͩͰͳ͘, িಥࠔ೉ੑͷ‫͔఺؍‬Β΋‫ݟ‬௚͢͜ͱʹͳΓ, ॳ‫ظ‬ͷಉछࣸ૾҉߸ͷ‫Ͱڀݚ‬͸ॏཁͳ໾ׂΛՌͨͨ͠. ಛʹ, ಉछࣸ૾άϥϑ͕ΤΫεύϯμʔάϥϑͰ͋Δ͜ͱʹண໨ͯ͠҉߸ʹԠ༻ͨ͠ҙٛ͸େ͖͍.
˙௒ಛҟಉछࣸ૾໰୊ͱ௨ৗಉछࣸ૾໰୊

ඪ਺ p ͷ༗‫ݶ‬ମ্ͷପԁ‫ۂ‬ઢ E ͷ p-Ͷ͡Ε‫ ܈‬E[p] ͕, E[p] = {OE } ͷ࣌, E Λ௒ಛҟପԁ‫ۂ‬ઢͱ͍͍, ͦ͏Ͱͳ͍࣌, E Λ௨ৗପԁ‫ۂ‬ઢͱ͍͏. ௒ಛҟପԁ‫ۂ‬ઢͷ j ෆมྔ͸, Fp2 ͷཁૉͰ͋Δ. ͭ·Γ, ௒ಛҟ j ෆมྔͷ‫਺ݸ‬͸, ༗‫͋Ͱݸݶ‬Γ, ۩ମతʹ p/12 + ϵ(ୠ͠ ϵ = 0, 1, 2) Ͱ༩͑ΒΕΔ. ௒ಛҟ, ௨ৗͱ͍͏ପԁ‫ۂ‬ઢͷੑ࣭͸, ಉछࣸ૾ʹΑͬͯอଘ͞ΕΔͨΊ, ಉछࣸ૾໰୊΋, ͜ͷ 2 ͭͷੑ࣭ʹΑͬͯ, ௒ಛҟಉछࣸ૾໰୊ͱ௨ৗಉछࣸ૾໰୊ͱ͍͏ 2 ͭͷ໰୊ʹ෼ྨ͞ΕΔ.

5.1.2 SIDH ‫ڞݤ‬༗ͷ҆શੑͷࠜ‫ͳͱڌ‬Δ໰୊௒ಛҟପԁ‫ۂ‬ઢؒͷಉछࣸ૾໰୊ͷࠔ೉ੑʹ‫ڞݤͮ͘ج‬༗๏ͱͯ͠, SIDH ‫ڞݤ‬༗ (5.2.1 અࢀর) ͕஌ΒΕ͍ͯΔ͕,ͦͷ҆શੑͷࠜ‫ͳͱڌ‬Δ‫ࢉܭ‬໰୊Λ [19, 30, 26, 21] ʹैͬͯ·ͱΊΔ.
Ұൠͷ௒ಛҟಉछࣸ૾໰୊ͱҟͳΔͷ͸, ඪ਺ p ͕ಛघͳ‫ܗ‬Λ͓ͯ͠Γ, ͦΕʹैͬͯ໰୊಺Ͱѻ͏ಉछࣸ૾ͷ࣍਺

69

͕ܾ·Δ͜ͱͱ, ໰୊ͷೖྗʹิॿ఺͕ՃΘ͍ͬͯΔ͜ͱͰ͋Δ. (࣮ࡍʹ, ௒ಛҟಉछࣸ૾໰୊ͱ SIDH ಉछࣸ૾໰୊
ͷղಡ‫͕ྔࢉܭ‬ҟͳΔ͜ͱ͕ 5.1.4 અʹ‫͞ࡌه‬ΕΔ.)
˙SIDH ‫ڞݤ‬༗ͷެ։ύϥϝʔλSIDH ‫ڞݤ‬༗Ͱ, ެ։ύϥϝʔλ͸ ppsidh = (ℓA , ℓB , eA , eB , f ; E, PA , QA , PB , QB ) ͰeA eB༩͑ΒΕΔ. ͜͜Ͱ, p + 1 = f · ℓA ℓB Ͱ, p ͸ૉ਺, ℓA , ℓB ͸ 2 ͭͷখૉ਺Ͱ͋Δ (f ͸খ͍͞ਖ਼੔਺Ͱ, ଟ͘ͷ৔߹
f = 1). ྫ͑͹, ℓA = 2, ℓB = 3. E ͸, Fp2 ্ఆٛ͞Εͨ௒ಛҟପԁ‫ۂ‬ઢͰ͋Γ, PA , QA ͸, E[ℓeAA ] ͷ‫ج‬ఈ, PB , QB ͸,
E[ℓeBB ] ͷ‫ج‬ఈͰ͋Δ. ·ͨ, ΞϦε (Alice) ଆ, Ϙϒ (Bob) ଆͷཚ਺ۭؒΛ, ͦΕͧΕ KA = Z/ℓeAA Z, KB = Z/ℓeBB Z ͱ͢
*1Δ.

˙SIDH ಉछࣸ૾໰୊, SIDH ໰୊, ͓Αͼͦͷ൑ఆ൛໰୊

SIDH ‫ڞݤ‬༗ʹؔͯ͠཭ࢄର਺໰୊ʹ͋ͨΔ‫ج‬ຊ໰୊͸,ఆٛ 5.2 ͷ SIDH ಉछࣸ૾໰୊Ͱ͋Γ, ͦΕʹ‫ ͍ͯͮج‬CDH, DDH ໰୊ʹ͋ͨΔͷ͸, ͦΕͧΕఆٛ 5.4 ͷ SIDH ໰୊, ఆٛ 5.5 ͷ൑ఆ൛ SIDH ໰୊Ͱ͋Δ.
ఆٛ 5.2 (SIDH ಉछࣸ૾໰୊ [19, 30]) SIDH ‫ڞݤ‬༗ެ։ύϥϝʔλ ppsidh ͱ, ͦ͜Ͱఆٛ͞Εͨ E ͱ ℓeAA -ಉछͳ

EA ͱ PB′ , Q′B ∈ EA [ℓeBB ] ͕༩͑ΒΕͨ࣌, PB′ = φA (PB ), Q′B = φA (QB ) ͱͳΔ࣍਺ ℓeAA ͷಉछࣸ૾ φA : E → EA Λ‫ͤࢉܭ‬Α. ಛʹ, φA ͷ֩ ker(φA ) ͷੜ੒‫ ݩ‬RA ∈ E[ℓeAA ] Λ‫ͤࢉܭ‬Α.

͜͜Ͱ͸, [30] ʹैͬͯ, ্‫ه‬໰୊Λ SIDH ಉछࣸ૾໰୊ͱ‫͕Ϳݺ‬, ͦΕ͸, [19] Ͱ͸ CSSI ໰୊ͱ‫ݺ‬͹Ε͍ͯΔ. ·
ͨ, ℓA ̸= ℓB Ͱ͋ΔͷͰ, SIDH ‫ڞݤ‬༗͸ඇରশͰ͋Γ, φB ͷ‫ࢉܭ‬Λཁ‫͢ٻ‬Δ (্ͱ͸ҟͳΔ) ໰୊΋ఆٛͰ͖Δ. ͦͷఆٛ͸ࣗ໌Ͱ͋ΔͷͰ, ͜͜Ͱ͸লུ͢Δ. ·ͨ, ࣍ͷ൑ఆ൛ SIDH ಉछࣸ૾໰୊ʹؔͯ͠΋ࣄ৘͸ಉ͡Ͱ͋Δ.

ैདྷͷ཭ࢄର਺໰୊ʹରͯ͠͸ଘࡏ͠ͳ͍, ఆٛ 5.2 ͷ൑ఆ൛ͷ໰୊͕ Galbraith–Vercauteren [30] ʹΑͬͯҎԼͷΑ͏ʹఆࣜԽ͞Ε͍ͯΔ.
ఆٛ 5.3 (൑ఆ൛ SIDH ಉछࣸ૾໰୊ [30]) SIDH ‫ڞݤ‬༗ެ։ύϥϝʔλ ppsidh ͱ, EA ͱ PB′ , Q′B ∈ EA [ℓeBB ], 0 < n ≤eA ͕༩͑ΒΕͨ࣌, PB′ = φA (PB ), Q′B = φA (QB ) ͱͳΔ࣍਺ ℓnA ͷಉछࣸ૾ φA : E → EA ͕ଘࡏ͢Δ͔Ͳ͏͔Λ൑ఆͤΑ.

͜͜Ͱ͸, [30] ʹैͬͯ, ্‫ه‬໰୊Λ൑ఆ൛ SIDH ಉछࣸ૾໰୊ͱ‫͕Ϳݺ‬, ิॿ఺৘ใΛ‫ͣ·ؚ‬, ࣍਺ʹؔ͢Δ৚݅΋ҟͳΔྨࣅͷ໰୊͕, [19] Ͱ͸ DSSI ໰୊ͱ‫ݺ‬͹Ε͍ͯΔ.
஫໨͢΂͖͸, Galbraith–Vercauteren [30] ‫ ͼٴ‬Thormarker [50] ʹΑͬͯ, SIDH ಉछࣸ૾໰୊͔Β൑ఆ൛ SIDHಉछࣸ૾໰୊΁ͷ (ଟ߲ࣜ࣌ؒ) ‫ؼ‬ண͕ࣔ͞Ε͍ͯΔ͜ͱͰ͋Δ. ͭ·Γ, ྆໰୊͸, ଟ߲ࣜ࣌ؒ‫ؼ‬ணͷҙຯͰಉఔ౓ʹࠔ೉ͳ໰୊Ͱ͋Γ, ߈ܸ͠΍͘͢‫͑ݟ‬Δ൑ఆ൛ SIDH ಉछࣸ૾໰୊Λ߈ܸͷର৅ʹ͢Ε͹े෼Ͱ͋Δ͜ͱ͕Θ͔Δ.
ఆٛ 5.4 (SIDH ໰୊ [19, 26]) SIDH ‫ڞݤ‬༗ެ։ύϥϝʔ λ ppsidh ʹର͠, ཚ਺ kA ←R KA ʹΑΔ఺ RA =PA +kA QA ʹΑͬͯ֩ ker(φA ) = ⟨RA ⟩ ͕ੜ੒͞ΕΔಉछࣸ૾Λ φA : E → EA , ཚ਺ kB ←R KB ʹΑΔ఺ RB = PB +kB QBʹΑͬͯ֩ ker(φB ) = ⟨RB ⟩ ͕ੜ੒͞ΕΔಉछࣸ૾Λ φB : E → EB ͱ͢Δ. ௒ಛҟପԁ‫ۂ‬ઢ E, EA , EB ͱͦͷ্ͷ఺φA (PB ), φA (QB ) ∈ EA , φB (PA ), φB (QA ) ∈ EB ͕༩͑ΒΕͨ࣌, E/⟨RA , RB ⟩ ͷ j ෆมྔΛ‫ͤࢉܭ‬Α.

͜͜Ͱ͸, [26] ʹैͬͯ, ্‫ه‬໰୊Λ SIDH ໰୊ͱ‫͕Ϳݺ‬, ͦΕ͸, [19] Ͱ͸ SSCDH ໰୊ͱ‫ݺ‬͹Ε, [21] Ͱ͸ SI-CDH໰୊ͱ‫ݺ‬͹Ε͍ͯΔ.

*1 [19] ͳͲ SIDH ‫ڞݤ‬༗ͷॳ‫ظ‬ͷจ‫Ͱݙ‬͸, ಉछࣸ૾ φA ͷ֩ੜ੒఺ RA Λ RA = mA PA + nA QA ͱ͍͕ͯͨ͠, SIKE ఏҊ [34] ͳͲ࠷ۙͷจe‫Ͱݙ‬͸, RA = PA + kA QA ͱ͍ͯ͠ΔͷͰ, ͜͜Ͱ͸ (ΞϦεଆͷ) ཚ਺ۭؒ͸ KA = Z/ℓA A Z ͱͯ͠ཚ਺͸ kA ←R KA ͱੜ੒͢Δ.

70

ఆٛ 5.5 (൑ఆ൛ SIDH ໰୊ [19, 21]) SIDH ‫ ڞݤ‬༗ެ ։ύ ϥϝʔ λ ppsidh ʹର͠, ཚ਺ kA ←R KA ʹΑΔ ఺

RA = PA + kA QA ʹΑͬͯ֩ ker(φA ) = ⟨RA ⟩ ͕ੜ੒͞ΕΔಉछࣸ૾Λ φA : E → EA , ཚ਺ kB ←R KB ʹΑΔ఺RB = PB + kB QB ʹΑͬͯ֩ ker(φB ) = ⟨RB ⟩ ͕ੜ੒͞ΕΔಉछࣸ૾Λ φB : E → EB ͱ͢Δ. ࣍ͷ 2 ͭͷ෼෍Λ൑ผͤΑ.

• ௒ಛҟପԁ‫ۂ‬ઢ E, EA , EB ͱͦͷ্ͷ఺ φA (PB ), φA (QB ) ∈ EA , φB (PA ), φB (QA ) ∈ EB ͓Αͼ E/⟨RA , RB ⟩ ͷ j ෆมྔ͔ΒͳΔ෼෍, ·ͨ͸• ௒ಛҟପԁ‫ۂ‬ઢ E, EA , EB ͱͦͷ্ͷ఺ φA (PB ), φA (QB ) ∈ EA , φB (PA ), φB (QA ) ∈ EB ͓Αͼ௒ಛҟ j ෆมྔͷू߹͔ΒҰ༷ϥϯμϜʹαϯϓϦϯά͞Εͨ j ෆมྔ͔ΒͳΔ෼෍.

͜͜Ͱ͸, SIDH ໰୊ͷ൑ఆ൛Ͱ͋ΔͷͰ, ্‫ه‬໰୊Λ൑ఆ൛ SIDH ໰୊ͱ‫͕Ϳݺ‬, ͦΕ͸, [19] Ͱ͸ SSDDH ໰୊ͱ‫ݺ‬͹Ε, [21] Ͱ͸ SI-DDH ໰୊ͱ‫ݺ‬͹Ε͍ͯΔ. ·ͨ, ఆٛ 5.5 ͸, [19, 21] ಺ͷఆٛͱগ͠ҟͳΔ. [19, 21] Ͱ͸ʮ௒ಛҟ j ෆมྔͷू߹͔ΒҰ༷ϥϯμϜʹαϯϓϦϯά͞Εͨ j ෆมྔʯͷ୅ΘΓʹ, ʮ(ద੾ͳ) ϥϯμϜ఺ RA′ , RB′ ʹΑ
Δ E/⟨RA′ , RB′ ⟩ ͷ j ෆมྔʯͱ͍ͯ͠Δ. ఆٛ 5.5 ͷํ͕ద੾ͱࢥΘΕΔ.
˙௒ಛҟପԁ‫ۂ‬ઢ ℓ-ಉछࣸ૾άϥϑ্‫ه‬໰୊͸, શͯ௒ಛҟପԁ‫ۂ‬ઢؒͷ ℓ-ಉछࣸ૾͔ΒͳΔಉछࣸ૾άϥϑ (ύΠβʔάϥϑ [43] ͱ΋͍͏) ͷ্ͷ໰୊ͱͯ͠ఆࣜԽ͢Δͷ͕ࣗવͰ͋Δ. ͦͷ௖఺ू߹͸, ௒ಛҟ j ෆมྔͰ༩͑ΒΕͯ, ͦͷลू߹͸, ℓ-ಉछࣸ૾Ͱ༩͑ΒΕΔ. ͦͯ͠, ͜ͷάϥϑ͸, ϥϚψδϟϯάϥϑͱ͍͏࠷దͳ֦ு཰Λ΋ͭΤΫεύϯμʔάϥϑʹͳ͍ͬͯΔ͜ͱ͕҆શੑ্ॏཁͰ͋Γ, ͦͷ‫ͯ͠ͱ݁ؼ‬, άϥϑ্, ൺֱతগͳ͍εςοϓ਺ͷ΢ΥʔΫΛߦ͏͜ͱͰ, ऴ఺෼෍͕Ұ༷෼෍Λେมྑ͍ਫ਼౓Ͱۙࣅ͢Δ͜ͱ͕Θ͔Δ ([43, 8] Λࢀর). ͜ΕʹΑΓ, ௖఺਺ O(p) ͷάϥϑͰͷҰ༷෼෍͕ηΩϡϦςΟύϥϝʔλ λ ͷଟ߲ࣜ࣌ؒͰಘΒΕΔ.
˙ࣗ‫ݾ‬४ಉ‫ࢉܭ؀ܕ‬໰୊ͱͷؔ܎ಉछࣸ૾໰୊ͷॳ‫ظ‬ͷߟ࡯Ͱ͋Δ Kohel ͷത࢜࿦จ [36] ͸, ͦͷ୊໨͕ࣔ͢௨Γ,༗‫ݶ‬ମ্ͷପԁ‫ۂ‬ઢͷࣗ‫ݾ‬४ಉ‫؀ܕ‬Λ‫͢ࢉܭ‬ΔΞϧΰϦζϜΛࣔͨ͠΋ͷͰ͋Γ, ͦͷաఔͰࣗવʹಉछࣸ૾‫ࢉܭ‬໰୊͕ؔ࿈͢Δ͜ͱ͕ࣔ͞Ε͍ͯΔ.
ͦͷ‫ޙ‬, 2014 ೥ʹ, Kohel Β [37] ʹΑΓ, ಉछࣸ૾໰୊ͱಉछࣸ૾άϥϑͰͷಓ୳ࡧ໰୊ͷؔ܎͕ௐ΂ΒΕ, ͦΕΛ‫ͯ͠ʹج‬, Eisenträger Β [16] ʹΑͬͯ, ͍͔ͭ͘ͷώϡʔϦεςΟοΫͳԾఆͷԼͰ͸, ಉछࣸ૾໰୊ͱࣗ‫ݾ‬४ಉ‫؀ܕ‬‫ࢉܭ‬໰୊ͷؒʹ྆ํ޲ͷଟ߲ࣜ࣌ؒ‫ؼ‬ண͕෇͘͜ͱ͕ࣔ͞Εͨ. ಛघͳପԁ‫ۂ‬ઢ͸, ؆໌ͳࣗ‫ݾ‬४ಉ‫؀ܕ‬Λ࣋ͭ͜ͱ͔Β, ͦͷΑ͏ͳପԁ‫ۂ‬ઢΛ࢝఺ʹબΜͩ৔߹ͷ҆શੑʹ͍ͭͯ΋, [42, 16] ʹ͓͍ͯௐ΂ΒΕ͍ͯΔ.

5.1.3 CSIDH ‫ڞݤ‬༗ͷ҆શੑͷࠜ‫ͳͱڌ‬Δ໰୊
ૉମ Fp ্ఆٛ͞Εͨ௒ಛҟପԁ‫ۂ‬ઢؒͷಉछࣸ૾໰୊ͷࠔ೉ੑʹ‫ڞݤͮ͘ج‬༗๏ͱͯ͠, CSIDH ‫ڞݤ‬༗ (5.2.2 અࢀর) ͕ 2018 ೥ʹͳͬͯ Castryck ΒʹΑͬͯఏҊ͞Εͨ [7]. ͦͷ҆શੑͷࠜ‫ͳͱڌ‬Δ‫ࢉܭ‬໰୊Λ [13, 48] ʹैͬͯ·ͱΊΔ.
˙CSIDH ‫ڞݤ‬༗ͷެ։ύϥϝʔλCSIDH ‫ڞݤ‬༗Ͱ, ެ։ύϥϝʔλ͸ ppcsidh = (O, (l1 , l2 , . . . , ln ), E, B) Ͱ༩͑ΒΕΔ. ͜͜Ͱ, O ͸‫ ڏ‬2 ࣍୅਺ମͷ੔‫( ؀‬Φʔμʔ), l1 , l2 , . . . , ln ͸ϊϧϜ͕খ͍͞‫ح‬ૉ਺ ℓi ʹͳΔ O ͷૉΠσΞϧͰ,ℓi ͸ ℓi = li li (i = 1, 2, . . . , n) ͱ 2 ‫ݸ‬ͷҟͳΔૉΠσΞϧ li , li ͷੵʹ෼ղ͍ͯ͠Δ. ͦͯ͠ p + 1 = 4 · ℓ1 · · · ℓn ͱͨ࣌͠, p ͸ૉ਺Ͱ͋Δඞཁ͕͋Δ. খ‫ح‬ૉ਺ ℓi ͸, ྫ͑͹, ℓ1 = 3, ℓ2 = 5, . . . Ͱ͋Δ. E ͸, Fp ্ఆٛ͞Εͯ, O Λ Fp -ࣗ‫ݾ‬४ಉ‫ʹ؀ܕ‬΋ͭ௒ಛҟପԁ‫ۂ‬ઢͰ͋Δ. B ͸ࢦ਺ ei ͷϊϧϜͷ্‫ݶ‬஋, ͢ͳΘͪ −B ≤ ei ≤ B ͱͳΔࢦ਺ ei Λ

CSIDH ‫ڞݤ‬༗Ͱ͸࢖͏.

71

˙CSIDH ‫ڞݤ‬༗ͷந৅‫ܗ‬

CSIDH ‫ڞݤ‬༗Ͱͷ‫ج‬ຊԋࢉ͸, Fp -ࣗ‫ݾ‬४ಉ‫ ڏʹ؀ܕ‬2 ࣍୅਺ମͷ੔‫( ؀‬Φʔμʔ)O Λ΋ͭପԁ‫ۂ‬ઢू߹ X ʹର͢Δ O ͷΠσΞϧྨ‫ ܈‬G = cl(O) ͷ‫( ༻࡞܈‬g, x) -→ gx ∈ X (ୠ͠ g ∈ G, x ∈ X) ͱͯ͠ཧղͰ͖Δ. ͦͷ‫༻࡞܈‬͸, ࣗ༝͔ͭਪҠతͰ͋Δ. ͜ͷ‫༻࡞܈‬ͷৄࡉʹؔͯ͠͸, 5.2.1 અΛࢀর. ͦͷ‫ه‬๏ʹै͑͹,

CSIDH ‫ڞݤ‬༗ʹ͓͚Δಉछࣸ૾໰୊͸, ͜ͷ‫༻࡞܈‬ͷ (G ʹؔ͢Δ) ‫( ਺ؔٯ‬x, gx) -→ g Λ‫͢ࢉܭ‬Δ໰୊ͱཧղͰ͖Δ.

͜ͷ͜ͱ͔Β, CSIDH ‫ڞݤ‬༗‫ج‬ຊԋࢉ͸, Ұํ޲ੑ‫༻࡞܈‬ͷಛघྫͰ͋Γ, ·ͨ, ͜ͷΑ͏ͳҰํ޲ੑ‫༻࡞܈‬Λ΋ͭ (౳࣭) ۭؒ X ͸, Hard Homogeneous Space (HHS) ͱ‫ݺ‬͹ΕΔ [13, 48]*2 .
˙CSIDH ϕΫτϧԽ໰୊, CSIDH ฒྻԽ໰୊

CSIDH ‫ڞݤ‬༗ʹؔͯ͠཭ࢄର਺໰୊ʹ͋ͨΔ‫ج‬ຊ໰୊͸, ҎԼͷ

CSIDH ϕΫτϧԽ໰୊ 1(CSIDH Vectorization ໰୊ 1) Ͱ͋Γ, ߋʹ, ͦΕʹ‫ ͍ͨͮج‬CDH ໰୊͸, CSIDH ฒྻԽ໰୊ 1(CSIDH Parallelization ໰୊ 1) Ͱ͋Δ.
ఆٛ 5.6 (CSIDH ϕΫτϧԽ໰୊ 1 [13, 7, 48]) CSIDH ‫ڞݤ‬༗ެ։ύϥϝʔλ ppcsidh ͱ, Fp ্ఆٛ͞Ε͓ͯΓFp -ࣗ‫ݾ‬४ಉ‫ ؀ܕ‬O Λ΋ͭ௒ಛҟପԁ‫ۂ‬ઢ E, EA ͕༩͑ΒΕͨ࣌, EA = [a]E ͱͳΔ O ͷΠσΞϧ a Λ‫ͤࢉܭ‬Α. ୠ
͠, a ͷ E ΁ͷ࡞༻͕ޮ཰తʹ‫ࢉܭ‬Մೳͳ৔߹ʹ‫ݶ‬Δ. ྫ͑͹, a ͕খ͍࣍͞਺ͷΠσΞϧੵͰ༩͑ΒΕΔ৔߹ͳͲͰ
͋Δ.
͜͜Ͱ͸, [13, 48] ʹैͬͯ, ্‫ه‬໰୊Λ CSIDH ϕΫτϧԽ໰୊ 1 ͱ‫͕Ϳݺ‬, ͦΕ͸, [7] Ͱ͸ CSIDH ‫ݤ‬෮‫( ݩ‬CSIDH

Key Recovery) ໰୊ͱ‫ݺ‬͹Ε͍ͯΔ.
ఆٛ 5.7 (CSIDH ฒྻԽ໰୊ 1 [13, 7, 48]) CSIDH ‫ڞݤ‬༗ެ։ύϥϝʔλ ppcsidh ͱ, Fp ্ఆٛ͞Ε͓ͯΓ Fp -ࣗ‫ݾ‬४ಉ‫ ؀ܕ‬O Λ΋ͭ௒ಛҟପԁ‫ۂ‬ઢ E, EA = [a]E, EB = [b]E(ୠ͠, a, b ͸‫཰ޮ͕༻࡞܈‬తʹ‫͖Ͱࢉܭ‬Δ O ͷΠσΞϧ) ͕༩͑ΒΕͨ࣌, [ab]E = [b]EA = [a]EB Λ‫ͤࢉܭ‬Α.

͜͜Ͱ͸, [13, 48] ʹैͬͯ, ্‫ه‬໰୊Λ CSIDH ฒྻԽ໰୊ 1 ͱ‫Ϳݺ‬.
‫ࡏݱ‬, ΠσΞϧྨ‫ ܈‬G = cl(O) ͷߏ଄‫ࢉܭ‬Λଟ߲ࣜ࣌ؒͰߦ͏ (‫ݹ‬య) ΞϧΰϦζϜ͸஌ΒΕ͍ͯͳ͍ͨΊ, G ্ͷҰ༷෼෍͔Βͷޮ཰తͳαϯϓϦϯά๏΋஌ΒΕ͍ͯͳ͍. Αͬͯ, ۙࣅతʹͦͷҰ༷αϯϓϦϯάΛߦ͏ޮ཰తͳ (ൿີ‫ )ݤ‬αϯϓϦϯά๏Λ༻͍ͯ CSIDH ‫ڞݤ‬༗͸༩͑ΒΕΔ (5.2.2 અࢀর). ͦΕʹैͬͯ, ্‫ه‬ͷ໰୊΋ͦΕͧΕमਖ਼͞Εͯ, ͦΕΒΛ CSIDH ϕΫτϧԽ໰୊ 2, CSIDH ฒྻԽ໰୊ 2 ͱͯ͠ҎԼʹ༩͑Δ.
ఆٛ 5.8 (CSIDH ϕΫτϧԽ໰୊ 2 [7, 18]) CSIDH ‫ڞݤ‬༗ެ։ύϥϝʔλ ppcsidh ͱ, Fp ্ఆٛ͞Ε͓ͯΓ Fp -ࣗ‫ݾ‬४ಉ‫ ؀ܕ‬O Λ΋ͭ௒ಛҟପԁ‫ۂ‬ઢ E, ͓Αͼ [−B, B]n ⊂ Zn ͔ΒҰ༷ʹબΜͩ (e1 , e2 , . . . , en ) ʹΑΓ a =ͱͳΔ a ʹΑͬͯ EA = [a]E ͱͳΔ EA ͕༩͑ΒΕͨ࣌, a ͱಉ஋ͳ a′ , i.e., a′ ∈ [a] Λ‫ͤࢉܭ‬Α.

?nei
i=1 liఆٛ 5.9 (CSIDH ฒྻԽ໰୊ 2 [7, 18]) CSIDH ‫ڞݤ‬༗ެ։ύϥϝʔλ ppcsidh ͱ, Fp ্ఆٛ͞Ε͓ͯΓ Fp -ࣗ‫ݾ‬४ಉ‫ ؀ܕ‬O Λ΋ͭ௒ಛҟପԁ‫ۂ‬ઢ E, EA = [a]E, EB = [b]E(ୠ͠, a, b ͸‫ʹڞ‬, [−B, B]n ⊂ Zn ͔ΒҰ༷ʹબΜͩ(e1 , e2 , . . . , en ) ʹΑΓ?nei
i=1 li ͱද͞ΕΔΠσΞϧ) ͕༩͑ΒΕͨ࣌, [ab]E = [b]EA = [a]EB Λ‫ͤࢉܭ‬Α.

˙CSIDH ϕΫτϧԽ໰୊ʹର͢Δ४ࢦ਺࣌ؒͰͷྔࢠ߈ܸG ͷ X ΁ͷ࡞༻͕ࣗ༝͔ͭਪҠతͰ͋ΔͳΒ, ‫ٯ༻࡞܈‬໰୊͸, ӅΕγϑτ໰୊ʹ‫ؼ‬ண͞Εͯ, ͦΕ͸ߋʹೋ໘ମ‫ؔ͢ʹ܈‬ΔӅΕ෦෼‫܈‬໰୊ (DHSP) ʹ‫ؼ‬ண͢Δ. DHSP ʹ͸,४ࢦ਺࣌ؒͰಈ͘ྔࢠΞϧΰϦζϜ͕஌ΒΕ͍ͯΔͷͰ, ҰൠʹҰํ޲ੑ‫ࣜํ߸҉͍ͨͮجʹ༻࡞܈‬͸, ྔࢠ‫ʹػࢉܭ‬ରͯ͠४ࢦ਺࣌ؒ҆શੑ͔͠΋ͨͳ͍.
*2 ૬઒Β [55] ͸, ‫ڧ‬౳࣭ۭؒͱ͍͏༁‫ޠ‬Λ͍͋ͯͯΔ.

72

5.1.4 અͰ, CSIDH ϕΫτϧԽ໰୊ʹରͯ͠, ४ࢦ਺࣌ؒͷྔࢠΞϧΰϦζϜ͕͋Δ͜ͱʹ৮ΕΔ. ͦΕʹΑΓ,
CSIDH ฒྻԽ໰୊΋४ࢦ਺࣌ؒͰྔࢠ߈ܸՄೳͰ͋Δ͜ͱ͕Θ͔Δ͕, ࠷ۙ, ͦͷ‫ٯ‬, ฒྻԽ໰୊Λղ͘ΦϥΫϧΛ༻͍ͯϕΫτϧԽ໰୊Λղ͘ଟ߲ࣜ࣌ؒྔࢠ‫ؼ‬ணΞϧΰϦζϜ͕ఏҊ͞Ε͍ͯΔ [24].

5.1.4 3 ͭͷ‫ج‬ຊಉछࣸ૾໰୊ͷ઴ۙతղಡ࣌ؒൺֱ
લઅ·Ͱʹ‫ͨݟ‬௒ಛҟಉछࣸ૾໰୊, SIDH ಉछࣸ૾໰୊, CSIDH ϕΫτϧԽ໰୊ͱ͍͏ 3 ͭͷ‫ج‬ຊ໰୊ʹରͯ͠઴ۙతղಡ͕࣌ؒ࠷଎ͷ‫ط‬஌ΞϧΰϦζϜʹ͍ͭͯ, ද 5.1 ͱ, ͦΕʹଓ͘Օ৚ॻ͖Ͱ·ͱΊΔ. ͦͷϔουϥΠϯ, ྫ͑͹, [௒ಛҟɾ‫ݹ‬య] ͸, ௒ಛҟಉछࣸ૾໰୊ʹର͢Δ‫ݹ‬యΞϧΰϦζϜʹؔ͢Δઆ໌Ͱ͋Δ.
ද 5.1,
3 ͭͷಉछࣸ૾໰୊ͷ઴ۙతղಡ࣌ؒൺֱ. ͜͜Ͱ, Lp [α, c] = exp (c + o(1)) (logp)α (loglogp)1−α ͱ͢Δ.

௒ಛҟಉछࣸ૾໰୊

SIDH ಉछࣸ૾໰୊
CSIDH ϕΫτϧԽ໰୊‫ݹ‬య‫ʹػࢉܭ‬ΑΔղಡ࣌ؒྔࢠ‫ʹػࢉܭ‬ΑΔղಡ࣌ؒ√√Õ( 4 p)√Õ( 6 p)√Lp [1/2, 3/2]

Õ( p)√
Õ( 4 p)√Õ( 4 p)√• [௒ಛҟɾ‫ݹ‬య] Galbraith [25] ʹΑΔதؒҰக߈ܸͰ, ղಡ࣌ؒ͸ Õ( p) Ͱ͋Δ.
√• [௒ಛҟɾྔࢠ] Biasse Β [4] ʹΑͬͯ࣌ؒ‫ ͕ྔࢉܭ‬Õ( 4 p) ͷྔࢠΞϧΰϦζϜ͕஌ΒΕ͍ͯΔ. ͜Ε͸, Fp ্ͷ௒ಛҟପԁ‫ۂ‬ઢͷಉछࣸ૾໰୊ʹର͢Δ४ࢦ਺࣌ؒྔࢠΞϧΰϦζϜ [9] ͱ Grover ΞϧΰϦζϜʹ‫ͮ͘ج‬√Õ( 4 p) ͷಓ୳ࡧΞϧΰϦζϜΛ݁߹ͨ͠΋ͷͰ͋Δ.
√• [SIDHɾ‫ݹ‬య] SIDH ಉछࣸ૾໰୊Ͱ͸, Θ( p) ࣍ͷಉछࣸ૾໰୊ʹ Galbraith ʹΑΔதؒҰக߈ܸ [25] Λద√༻͢ΔͷͰ, ͦͷղಡ࣌ؒ͸ Õ( 4 p) Ͱ͋Δ.
√
• [SIDHɾྔࢠ] Θ( p) ࣍ͷಉछࣸ૾໰୊ʹ, ୩ͷΫϩʔ୳ࡧ (claw finding) ΞϧΰϦζϜ [49] Λద༻ͯ͠, ͦͷ√ղಡ࣌ؒ͸ Õ( 6 p) Ͱ͋Δ.
• [CSIDHɾ‫ݹ‬య] Fp ্ͷ௒ಛҟପԁ‫ۂ‬ઢͷಉछࣸ૾໰୊ʹର͢Δ Delfs–Galbraith [15] ͷ (‫ݹ‬య) ΞϧΰϦζϜ
√Λద༻ͯ͠, ͦͷղಡ࣌ؒ͸ Õ( 4 p) Ͱ͋Δ.
• [CSIDHɾྔࢠ] Childs Β [9] ʹΑΔ௨ৗಉछࣸ૾໰୊ʹର͢Δྔࢠ४ࢦ਺࣌ؒΞϧΰϦζϜ͸, CSIDH ϕΫτϧԽ໰୊ʹରͯ͠΋༗ޮͰ͋Δ. (‫ʹط‬, 5.1.3 અͰ΋৮Εͨ.) Galbraith–Stolbunov [29] ʹΑͬͯվળΞϧΰϦζϜ͕ఏҊ͞Εͨ. ·ͨ, ࠷ۙ, Biasse [3] Β͸, ϝϞϦ࢖༻ྔΛ࡟‫͢ݮ‬Δͱͱ΋ʹ, ྔࢠϝϞϦ࢖༻Λ‫ݹ‬యϝϞϦ࢖༻ʹసՇ͢ΔΞϧΰϦζϜΛఏҊ͢Δ͜ͱͰ, ΑΓ࣮‫ݱ‬ੑΛߴΊΔ౒ྗ͕ߦΘΕ͍ͯΔ.
˙CSIDH ϕΫτϧԽ໰୊ྔࢠΞϧΰϦζϜͷৄࡉͳղੳ

ಛʹ, CSIDH ϕΫτϧԽ໰୊ʹର͢Δྔࢠ߈ܸͷਖ਼֬ͳ‫ݟ‬ੵ΋Γ͸, ༩͑ΒΕͨ҆શੑϨϕϧΛୡ੒͢Δ p ͷϏοτ௕ΛܾΊΔͷʹॏཁͰ͋Δ. ैͬͯ, SIDH ‫ڞݤ‬༗ͱ CSIDH‫ڞݤ‬༗ͷͲͪΒ͕ޮ཰త͔ͱ͍͏໰୊ͱؔ࿈ͯ͠, ͜ͷৄࡉͳධՁ͸, ‫ࡏݱ‬, ஫໨ΛूΊ͍ͯΔ.

Bonnetain–Schrottenloher [6] ͸, ৄࡉʹ CSIDH ߈ܸྔࢠΞϧΰϦζϜΛ‫ݕ‬౼ͯ͠, ͜Ε·Ͱߟ͑ΒΕ͍ͯͨΑΓޮ཰తʹ߈ܸՄೳͰ͋Δͱओு͍ͯ͠Δ. ͦΕʹΑΓ, ൴Β͸, Castryck Β [7] ͕ 56 Ϗοτྔࢠ҆શੑϨϕϧͱओுͯ͠
͍ͨύϥϝʔλ͕, ࣮ࡍʹ͸ 38 ϏοτϨϕϧͷྔࢠ҆શੑ͔֬͠อͰ͖ͳ͍ͷͰͳ͍͔, ͱ͍͏ࢼࢉΛड़΂͍ͯΔ.
·ͨ, Ұํ, Bernstein Β [2] ͸, CSIDH ‫༻࡞܈‬Λߦ͏ྔࢠճ࿏ͷαΠζΛ۩ମతʹ‫ੵݟ‬΋Δ͜ͱͰ, ্‫ه‬ͷ४ࢦ਺࣌ؒΞϧΰϦζϜ͕, ैདྷߟ͑ΒΕ͍ͯͨΑΓ‫ࢉܭ‬Φʔόʔϔου͕େ͖͍ͷͰͳ͍͔, ͭ·Γ, ߈ܸ͢Δͷ͸ΑΓࠔ೉Ͱ

73

͋Ζ͏ͱओு͍ͯ͠Δ.
લऀ͸, CJS (Childs–Jao–Soukharev) ΞϧΰϦζϜ [9] ͦͷ΋ͷΛର৅ͱ͍ͯ͠Δͷʹର͠, ‫ऀޙ‬͸, ͦ͜Ͱαϒϧʔνϯͱͯ͠࢖͏ CSIDH ‫༻࡞܈‬ͷྔࢠճ࿏Λର৅ͱ͍ͯ͠ΔͷͰ, ྆ऀ͸૬ิతͰ͋Δ. ͜ΕʹΑΓ, ࠓ‫ޙ‬΋ߋͳΔৄࡉղੳ͕ඞཁͱ͞ΕΔ.

5.2 ୅දతͳಉछࣸ૾ʹ‫ࣜํ߸҉ͮ͘ج‬ͷઆ໌
De Feo ͱ Jao ʹΑΔσΟϑΟʔ–ϔϧϚϯ‫ܕ‬ͷ SIDH ‫ڞݤ‬༗ [19] ʹΑͬͯ, ಉछࣸ૾ʹ‫ެ͍ͨͮج‬։‫͕࢝߸҉ݤ‬Ίͯ༩͑ΒΕͨ. ࠷ۙʹͳΓ, CRS ‫ڞݤ‬༗ͷΞΠσΞʹ‫ ͖ͮج‬CRS ‫ڞݤ‬༗ΑΓ΋࣮‫ݱ‬ੑ͕ߴ͍ CSIDH ‫ڞݤ‬༗ [7] ΋ఏҊ͞Ε͍ͯΔͷͰ, ͦΕ΋·ͱΊΔ.

5.2.1 SIDH ‫ڞݤ‬༗
De Feo Β [19] ʹैͬͯ SIDH ‫ڞݤ‬༗Λ‫ه‬ड़͢Δ. 5.1.2 અͰఆٛͨ͠Α͏ʹ, p + 1 = f · ℓeAA ℓeBB Ͱ, p ͸ૉ਺,ℓA , ℓB ͸ 2 ͭͷখૉ਺Ͱ͋Δ, ྫ͑͹, ℓA = 2, ℓB = 3, ͦͯ͠ ℓeAA ≈ ℓeBB = 2Θ(λ) ͱͳΔΑ͏ʹૉ਺ p Λੜ੒͢Δ. ୠ͠, ͜͜Ͱ λ ͸ηΩϡϦςΟύϥϝʔλ. ͦͷ࣌, Fp2 ্ఆٛ͞Εͨ௒ಛҟପԁ‫ۂ‬ઢ E ͷ Fp2 -༗ཧ఺‫܈‬͸,E(Fp2 ) ≃ (Z/(p ± 1)Z)2 ⊇ (Z/ℓeAA Z)2 ⊕ (Z/ℓeBB Z)2 ͱͳΔ. ΞϦε͸, 2 ࣍‫( ۭؒݩ‬Z/ℓeAA Z)2 ಺ͷ 1 ࣍‫ݩ‬෦෼ۭؒΛࣗ෼ͷൿີಉछࣸ૾ φA ͷ֩ ker φA = ⟨RA ⟩ ⊂ E[ℓeAA ] ͱͯ͠, Ϙϒ͸, 2 ࣍‫( ۭؒݩ‬Z/ℓeBB Z)2 ಺ͷ 1 ࣍‫ݩ‬෦෼ۭؒΛࣗ෼ͷൿີಉछࣸ૾ φB ͷ֩ ker φB = ⟨RB ⟩ ⊂ E[ℓeBB ] ͱ͢Δ. ͜͜Ͱ, (Z/ℓeAA Z)2 ಺ͷ 1 ࣍‫ݩ‬෦෼ۭؒ͸, ℓeAA +1 ‫ݸ‬, ͭ·Γ√O( p) ‫͋ݸ‬Δ͜ͱʹ஫ҙ͢Δ. (Z/ℓeBB Z)2 ಺ͷ 1 ࣍‫ݩ‬෦෼ۭؒʹ͍ͭͯ΋ಉ༷. ͦͯ͠, ΞϦεͱϘϒͷؒͷ SIDH ‫ݤ‬‫ڞ‬༗ͷࠎ֨͸, ҎԼͷՄ‫׵‬ਤࣜʹΑͬͯ༩͑ΒΕΔ.

E
⏐
⏐
φB D

ୠ͠

φA

−−−−→ EA = E/⟨RA ⟩
⏐
⏐φ
D AB

ker φA = ⟨RA ⟩ ⊂ E[ℓeAA ],ker φB = ⟨RB ⟩ ⊂ E[ℓeBB ],ker φBA = ⟨φB (RA )⟩ ⊂ EB [ℓeAA ],φBA

ker φAB = ⟨φA (RB )⟩ ⊂ EA [ℓeBB ].

EB = E/⟨RB ⟩ −−−−→ E/⟨RA , RB ⟩্‫ه‬ͷՄ‫׵‬ਤࣜΛϓϩτίϧͱͯ͠੒ΓཱͨͤΔͨΊʹ, E[ℓeAA ] = ⟨PA , QA ⟩, E[ℓeBB ] = ⟨PB , QB ⟩ ͱͳΔ‫ج‬ఈ(PA , QA ), (PB , QB ) Λબͼ, ެ։ύϥϝʔλ ppsidh = (ℓA , ℓB , eA , eB , f ; E, PA , QA , PB , QB ) Λੜ੒͢Δ. ·ͨ, ΞϦεଆ, Ϙϒଆͷཚ਺ۭؒΛ, ͦΕͧΕ KA = Z/ℓeAA Z, KB = Z/ℓeBB Z ͱ͢Δ. ͜ͷެ։ύϥϝʔλͷԼ, SKAlice = SKBob Λ‫ڞ‬༗‫͢ͱݤ‬Δ SIDH ‫ڞݤ‬༗͸ҎԼͰ༩͑ΒΕΔ.
ΞϦεϘϒkA ←R KA : ΞϦεͷൿີ‫ݤ‬,R A = PA + k A Q A ,φA : E → EA = E/⟨RA ⟩,EA , φA (PB ), φA (QB )−−−−−−−−−−−→←−−−−−−−−−−−EB , φB (PA ), φB (QA )RBA = φB (PA ) + kA φB (QA ),kB ←R KB : Ϙϒͷൿີ‫ݤ‬,R B = PB + k B Q B ,φB : E → EB = E/⟨RB ⟩,RAB = φA (PB ) + kB φA (QB ),SKAlice = j(EB /⟨RBA ⟩).

SKBob = j(EA /⟨RAB ⟩).
ਤ 5.1

SIDH ‫ڞݤ‬༗ͷ֓ཁ.

͜͜Ͱ, ⟨φB (PA ) + kA φB (QA )⟩ = ⟨φB (RA )⟩ = ker φBA ͔ͭ ⟨φA (PB ) + kB φA (QB )⟩ = ⟨φA (RB )⟩ = ker φAB Ͱ͋ΔͷͰ,j-ෆมྔΛ༻͍Δ͜ͱͰ, ‫ڞݤ‬༗ͷਖ਼͠͞ SKAlice = j(EB / ker φBA ) = j(E/⟨RA , RB ⟩) = j(EA / ker φAB ) = SKBob ͕ಘ74ΒΕΔ͜ͱʹ஫ҙ͢Δ.
˙҆શੑྫ͑͹, ΞϦεͷެ։‫ݤ‬͸, ࣗ਎ͷପԁ‫ۂ‬ઢ EA ͱ‫ʹڞ‬, EA ্ͷ఺ φA (PB ), φA (QB ) Λิॿ৘ใͱͯ͠‫ؚ‬Ή͜ͱ͔Β, ͦͷ҆શੑ͸, ൑ఆ൛ SIDH ໰୊ͷࠔ೉ੑʹ‫ͮ͘ج‬. ·ͨ, Galbraith Β [27] ʹΑͬͯ, SIDH ‫ڞݤ‬༗Ͱ͸ެ։‫ࠔ͕ূݕݤ‬೉Ͱ͋Δ͜ͱ͕ࢦఠ͞Εͯ, ͦΕΛར༻ͨ͠ೳಈత (ΞΫςΟϒ) ߈ܸ͕͋Δ͜ͱ͕ࣔ͞Εͨ. ͦͷ߈ܸΛճආ͢ΔͨΊʹ͸, Kirkwood Βͷରࡦ [35] ͕஌ΒΕ͍ͯΔ.
˙࣮૷‫ڀݚ‬

SIDH ‫ڞݤ‬༗͸, Ұൠతʹ, ଞͷ଱ྔࢠެ։‫ͱ߸҉ݤ‬ൺ΂ͯ, σʔλαΠζ͸୹͘཈͑ΒΕΔར఺Λ΋ͭ൓໘, ԋࢉॲཧ͕࣌ؒ௕͘ͳΔ܏޲ʹ͋ΔͷͰ, ͍͔ʹ‫ؒ࣌ࢉܭ‬Λ୹ॖ͢Δ͔ͱ͍͏ͷ͕ॏཁͳ՝୊Ͱ͋Δ.

Costello Β [11, 10] ʹΑΓ, ચ࿅͞Εͨ SIDH ࣮૷‫ͨͬ·͕࢝ڀݚ‬. ࠷ۙ΋, Hutchinson–Karabina [32] ʹ͓͍ͯ,
SIDH ‫ڞݤ‬༗಺Ͱͷಉछࣸ૾ͷ࠷ద‫ࢉܭ‬๏Λฒྻ‫ࢉܭ‬ઃఆͰߟ͑ͨ࣌ͷߴ଎Խʹ͍ͭͯఏҊ͞Ε͍ͯΔ.
ϞόΠϧ‫ثػ‬ɾ૊ΈࠐΈ‫Ͱڀݚ૷࣮͚޲ثػ‬͸, Seo Β [47] ʹΑͬͯ, 32 Ϗοτͷ ARMv7-A ϓϩηοα্Ͱ࣮༻্
໰୊ͳ͍࣮ߦ͕࣌ؒୡ੒Ͱ͖Δ͜ͱ͕ࣔ͞Εͨ. Ұํ, Koppermann Β [38] ʹΑͬͯ, 32 Ϗοτ ARMv7-M4 ͳͲͷ‫ࢉܭ‬ೳྗͷ௿͍ϓϩηοα্Ͱ͸࣮༻తͳιϑτ΢ΣΞ࣮૷Λ࣮‫͢ݱ‬Δͷ͸೉͍͠ͷͰ͸ͳ͍͔, ͱ͍͏ࢦఠ΋ͳ͞Ε
͍ͯΔ.

5.2.2 CSIDH ‫ڞݤ‬༗
Castryck Β [7] ʹΑΓఏҊ͞Εͨ CSIDH ‫ڞݤ‬༗Λ‫ه‬ड़͢Δ. CSIDH ‫ڞݤ‬༗͸, Ұํ޲ੑ‫༻࡞܈‬Λ΋ͭ౳࣭ۭؒ
(X, G) ্Ͱߏ੒͞ΕΔ. ͜͜Ͱ, X = Eℓℓp (O) ͸, Fp ্ఆٛ͞Εͯ Fp -༗ཧࣗ‫ݾ‬४ಉ‫ݻ͕؀ܕ‬ఆ͞Εͨ‫ ڏ‬2 ࣍੔‫؀‬(Φʔμʔ)O Ͱ͋Δ௒ಛҟପԁ‫ۂ‬ઢͷू߹Ͱ͋Γ, G = cl(O) ͸ O ͷΠσΞϧྨ‫͋Ͱ܈‬Δ. Castryck Β [7] ͸, 5.1.3 અͰఆٛͨ͠ CSIDH ฒྻԽ໰୊ 2 ͷ൑ఆ൛໰୊ͷࠔ೉ੑʹ‫͍ͯͮج‬, CSIDH ‫ڞݤ‬༗ํࣜΛఏҊͨ͠.

K Λ‫ ڏ‬2 ࣍୅਺ମ, O ⊂ K Λͦͷ੔‫͢ͱ؀‬Δ, ͢ͳΘͪϥϯΫ 2 ͷࣗ༝ Z-Ճ‫͋Ͱ܈‬Δ K ͷ෦෼‫͋Ͱ؀‬Δ. O ͷ෼਺ΠσΞϧ͸, α ∈ K ∗ ͱ O-ΠσΞϧ a ʹΑͬͯ αa ͱද͞ΕΔ K ಺ͷ O-෦෼Ճ‫͋Ͱ܈‬Δ. ab = O ͱͳΔ O-෼਺ΠσΞϧ b ͕ଘࡏ͢Δ࣌ʹ (O-෼਺ΠσΞϧ)a ͸Մ‫͋Ͱٯ‬Δͱ͍͏. ͦͯ͠, ͦͷΑ͏ͳ b ͕ଘࡏ͢ΔͳΒ͹, a−1 = b
ͱఆٛ͢Δ. Մ‫ٯ‬෼਺ΠσΞϧͷू߹ I(O) ͸ΠσΞϧੵʹؔͯ͠Ξʔϕϧ‫܈‬Λͳ͢. ͜ͷ‫ʹ܈‬͸ओΠσΞϧ͔ΒͳΔ෦෼‫ ܈‬P (O) ͕‫·ؚ‬Ε͓ͯΓ, O ͷΠσΞϧྨ‫܈‬͸঎‫ ܈‬cl(O) = I(O)/P (O) ʹΑͬͯఆٛ͞ΕΔ. ͲͷΠσΞϧྨ[a] ∈ cl(O) ʹ΋੔ΠσΞϧ͕ଘࡏͯͦ͠ͷ୅දͱͯ͠࢖͏͜ͱ͕Ͱ͖Δ. O ͷͲͷ੔ΠσΞϧ a ΋ O-ΠσΞϧͷੵͱͯ͠ as ̸⊆ πO ͱͳΔ as ʹΑͬͯ (πO)r as ͱදͤΔ. ͜͜Ͱ, π ͸, p ৐ϑϩϕχ΢εࣸ૾. ͜ͷදࣔʹΑΓ, ੔ΠσΞϧ a ʹରͯ͠ପԁ‫ۂ‬ઢ E/E[a] ͱͦ͜΁ͷ N (a) ࣍ಉछࣸ૾ ϕa : E → E/E[a] ͕ҎԼͷΑ͏ʹఆٛ͞ΕΔ. ͜͜

Ͱ, N (a) = # (O/a) ͸ a ͷϊϧϜͰ͋Δ. ϕa ͷ෼཭తͳ෦෼͸ E[a] = ∩α∈as ker α Λ֩ʹ΋ͭಉछࣸ૾Ͱ͋Γ, ७ඇ෼཭తͳ෦෼͸ϑϩϕχ΢εࣸ૾ π ͷ r ճͷ‫܁‬Γฦ͠Ͱ༩͑ΒΕΔ. ಉछࣸ૾ ϕa ͓Αͼ஋Ҭ‫ۂ‬ઢ E/E[a] ͸‫ ʹڞ‬Fp্ఆٛ͞Ε͓ͯΓ Fp -ಉ‫ܕ‬Λআ͍ͯҰҙతʹܾ·Δ. ͜͜ͰओΠσΞϧ͸ࣗ‫ݾ‬४ಉ‫ʹ૾ࣸܕ‬ରԠ͍ͯ͠ΔͷͰ, 2 ͭͷΠσΞϧ͕ಉ͡ΠσΞϧྨʹଐ͢Δ͜ͱͱ, ରԠ͢Δಉछࣸ૾͕ಉ‫ͳܕ‬஋Ҭ‫ۂ‬ઢΛ༩͑Δ͜ͱͱ͸ಉ஋Ͱ͋Δ. ߋʹ,Eℓℓp (O) ʹଐ͢Δ 2 ͭͷପԁ‫ۂ‬ઢؒͷ Fp -ಉछࣸ૾ ψ ͸͢΂্ͯ‫ه‬ͷରԠʹΑΓՄ‫ ͳٯ‬O-ΠσΞϧ͔ΒಘΒΕΔ. ͦͯ͠෼཭෦෼ as ͸ ψ ͔Β as = {α ∈ O | ker α ⊇ ker ψ} ʹΑͬͯ෮‫͖Ͱݩ‬Δ. ͦͷରԠ͸ҎԼͷఆཧʹ·ͱΊΒΕΔ.

ఆཧ 5.10 ([53, 46, 7]) O Λ‫ ڏ‬2 ࣍୅਺ମ಺ͷ੔‫( ؀‬Φʔμʔ) ͱ͢Δ. ΋͠ Eℓℓp (O) ͕ۭू߹Ͱͳ͚Ε͹, ΠσΞϧྨ‫ ܈‬cl(O) ͸ Eℓℓp (O) ʹҎԼͷΑ͏ʹ࡞༻͢Δ.

cl(O) × Eℓℓp (O)([a], E)75

→ Eℓℓp (O)→E/E[a],

͜͜Ͱ, a ͸ྨ [a] Λ୅ද͢Δ੔ΠσΞϧͰ͋Γ, ্ͷ࡞༻͸ࣗ༝Ͱ͋Δ. ߋʹ, Eℓℓp (O) ͕௒ಛҟପԁ‫ۂ‬ઢΛ‫ؚ‬Ή৔߹ʹ͸, ͜ͷ࡞༻͸ਪҠతͰ͋Γ, ‫͍ͳ·ؚ‬৔߹͸, ͜ͷ࡞༻͸ஸ౓ 2 ͭͷ‫ي‬ಓ͔ΒͳΔ.

ҎԼͰ͸ E/E[a] Λ [a]E ͱॻ͘͜ͱʹ͢Δ. ্‫ه‬ͷ‫͍ͯͮجʹ༻࡞܈‬, ҎԼͷΑ͏ʹ CSIDH ‫ڞݤ‬༗ϓϩτίϧ

(Fig. 5.2) Λఆٛ͢Δ. ԼͷਤͰ, a ← cl(O) ͱॻ͍ͨͷ͸, ࣮ࡍʹ͸ΠσΞϧྨ‫ ܈‬cl(O) ͔ΒͷαϯϓϦϯάͱͯ͠,ఆٛ 5.8 ͷ CSIDH ϕΫτϧԽ໰୊͓Αͼఆٛ 5.9 ͷ CSIDH ฒྻԽ໰୊ʹ‫͞ࡌه‬Εͨ a ͷαϯϓϦϯά๏Λ༻͍Δ.
ϞϯΰϝϦ‫ܕ‬ପԁ‫ۂ‬ઢ E : y 2 = x3 + ax2 + x ʹରͯ͠, ܎਺ a ͸, E ͷϞϯΰϝϦ܎਺ͱ‫ݺ‬͹ΕΔ. CSIDH ‫ڞݤ‬༗Ͱ͸, ࢝఺‫ۂ‬ઢ E : y 2 = x3 + x ʹରͯ͠, ΞϦεͱϘϒʹΑͬͯ‫͞ࢉܭ‬ΕΔପԁ‫ۂ‬ઢ͸͢΂ͯϞϯΰϝϦ‫ܕ‬ପԁ‫ۂ‬ઢͰ
͋Δ.
ΞϦε

Ϙϒ
[a]E

a ← cl(O) : ΞϦεͷൿີ‫ݤ‬,b ← cl(O) : Ϙϒͷൿີ‫ݤ‬,−−−−−−→←−−−−−−[a] E (ͷϞϯΰϝϦ܎਺) Λ‫ࢉܭ‬,[b] E (ͷϞϯΰϝϦ܎਺) Λ‫ࢉܭ‬,[b]ESKAlice = [a] ([b]E) ͷϞϯΰϝϦ܎਺.
ਤ 5.2

SKBob = [b] ([a]E) ͷϞϯΰϝϦ܎਺.
CSIDH ‫ڞݤ‬༗ͷ֓ཁΠσΞϧྨ‫ ܈‬cl(O) ͸Մ‫ͳ׵‬ͷͰ, [a] ([b]E) = [ab]E = [ba]E = [b] ([a]E) Ͱ͋Γ, ͦͷϞϯΰϝϦ܎਺Λߟ͑Ε͹

SKAlice = SKBob ͱͳΔͷͰ, ΞϦεͱϘϒ͸ಉ͡‫ݤ‬Λ‫ڞ‬༗Ͱ͖Δ. ͦͷ‫ࢉܭ‬ΞϧΰϦζϜʹ͍ͭͯ͸, Castryck Β[7] ͓Αͼ Meyer–Reith [41] Λࢀরͷ͜ͱ. ͦͷ҆શੑ͸, ൑ఆ൛ͷ CSIDH ฒྻԽ໰୊ 2 ͷࠔ೉ੑʹ‫ͮ͘ج‬.

5.3 ۩ମతͳ҉߸ํࣜ
5.3.1 અͰ, NIST ඪ४ԽʹఏҊ͞Εͨ SIKE ެ։‫ ͱ߸҉ݤ‬SIKE ‫ݤ‬ΧϓηϧԽํࣜ (KEM) Λ֓આͯ͠, 5.3.2 અͰ,ಉछࣸ૾ʹ‫ͮ͘ج‬ೝূ෇͖‫ڞݤ‬༗ɾάϧʔϓ‫ڞݤ‬༗ʹ͍ͭͯͷ‫ݱ‬ঢ়Λ؆୯ʹड़΂Δ. ͦͯ͠, 5.3.3 અͰ, ಉछࣸ૾ʹ‫ج‬͍ͮͨॺ໊ํࣜͷ‫ݱ‬ঢ়, ಛʹ, ࠷ۙ‫ ͨͬ·͕࢝ڀݚ‬CSIDH ϕʔεͷॺ໊ํࣜͰ͋Δ SeaSign ॺ໊ʹ͍ͭͯগ͠ৄ͘͠
આ໌͢Δ.
ද 5.2

ຊઅͰѻ͏ओཁͳಉछࣸ૾ʹ‫ٕ߸҉ͮ͘ج‬ज़จ‫ݙ‬

SIKE [34]

҉߸Խ

‫׵ަݤ‬

˓

˓

ॺ໊

˓

SeaSign [18]5.3.1 SIKEɿSIDH ϕʔεެ։‫ݤͱ߸҉ݤ‬ΧϓηϧԽํࣜ
NIST ඪ४ԽʹఏҊ͞Εͨ SIKE [34] ʹ͍ͭͯड़΂Δ. ओͨΔఏҊऀ͸, Waterloo େֶͷ David Jao Ͱ͋Γ, ଞʹ‫ऀڀݚۀا‬͸ Microsoft, InfoSec Global, Amazon, TI ͔Β, େֶ‫ऀڀݚ‬͸ Florida Atlantic େֶ, UVSQ & Inria,

Radboud େֶ͔Β໊Λ࿈Ͷ͍ͯΔ.
ϞϯΰϝϦ‫ܕ‬ପԁ‫ۂ‬ઢ Ea,b /Fp2 : by 2 = x3 + ax2 + x Λ༻͍ͨεΧϥʔഒࢉ, ಉछࣸ૾‫ࢉܭ‬Λ༻͍ͯߏ੒͞Ε͓ͯΓ, ૉ਺ p ͸, p = 2e2 3e3 − 1 Ͱ͋Γ, ࢝఺‫ۂ‬ઢ͸ E0,1 /Fp2 : y 2 = x3 + x Λ༻͍͍ͯΔ. ࢦ਺෦෼ (e2 , e3 ) ʹ͸, 3 ͭͷ஋ (e2 , e3 ) = (250, 159), (372, 239), (486, 301) ͕࠾༻͞Ε͓ͯΓ, ͜ͷެ։ύϥϝʔλ஋͸, ͦΕͧΕɺSIKEp503,

76

SIKEp751, SIKEp964 ͱ‫ݺ‬͹Ε͍ͯΔ. ͜͜Ͱ, ஋ 503, 751, 964 ͸, ͦΕͧΕૉ਺ p ͷϏοτ௕Λද͢. ͜ΕΒͷύϥϝʔλ͸, ͦΕͧΕ, ҆શੑϨϕϧ k = 128, 192, 256 Λຬͨ͢ͱ͞ΕΔ͕, ͦͷࠜ‫ڌ‬͸, ֤ύϥϝʔλʹରͯ͠, ‫ݹ‬య,ྔࢠ‫ػࢉܭ‬ͷͦΕͧΕʹ͍ͭͯ, ҆શੑ໨ඪͱ҆શੑ‫ੵݟ‬΋ΓΛ‫ͨ͠ࢉܭ‬Լͷද 5.3 ʹΑΓ༩͑ΒΕΔ. ͜͜Ͱ, ‫ݹ‬య҆શੑ‫ੵݟ‬Γ, ྔࢠ҆શੑ‫ੵݟ‬Γ͸, ͦΕͧΕਤ 5.1 Ͱ, [SIDHɾ‫ݹ‬య], [SIDHɾྔࢠ] ཝʹ‫͞ࡌه‬Εͨ‫ੵݟ‬Γ஋Λ࢖ͬͯ༩͑ΒΕ͍ͯΔ.
ද 5.3

҆શੑϨϕϧΛܾΊΔͨΊͷ҆શੑ‫ੵݟ‬΋Γ҆શੑϨϕϧ

‫ݹ‬య҆શੑ໨ඪ

k

k−1

2

128

2127

SIKEp751

192

191

2

SIKEp964

256

2255

SIKEp503‫ݹ‬య҆શੑ‫ੵݟ‬΋Γ√ྔࢠ҆શੑ໨ඪ

√ྔࢠ҆શੑ‫ੵݟ‬΋Γ

2k√√min( 3 2e2 , 3 3e3 )1.00 · 2125

264

1.26 · 283

1.45 · 2238

2128

min( 2e2 ,1.00 · 2

√

3e3 )

186

96

2

1.00 · 2124
1.02 · 2159

ҎԼͰ, ؔ਺ isogenℓ (sk) ͸, ࢝఺‫ۂ‬ઢ E ͔Βൿີ‫ ݤ‬sk ʹैͬͯ, ℓ-ႈ࣍ͷಉछࣸ૾Λ‫ͨ͠ࢉܭ‬ऴ఺ͷ‫ۂ‬ઢͱͦͷ্ͷิॿ఺͔ΒͳΔ SIDH ‫ڞݤ‬༗ͷެ։‫͋Ͱݤ‬Δ. ·ͨ, isoexℓ (pk, sk) ͸, εΧϥʔ sk Λ࢖ͬͯ pk ʹ‫·ؚ‬ΕΔପԁ‫ۂ‬ઢ͔Β ℓ-ႈ࣍ͷಉछࣸ૾Λ‫ͨ͠ࢉܭ‬ऴ఺ͷ‫ۂ‬ઢͷ j ෆมྔ (SIDH ‫ڞݤ‬༗ͷ‫ڞ‬༗‫ )ݤ‬Λද͢. ҎԼͰ͸, ‫( ۭؒݤ‬ཚ਺ۭؒ) Λ K2 = Z/2e2 Z, K3 = Z/3e3 Z ͱ͢Δ.
˙SIKE ެ։‫ ߸҉ݤ‬௨ৗͷ DH ‫ڞݤ‬༗ํࣜΛ‫ ʹج‬ElGamal ҉߸Λߏ੒͢Δͷͱಉ͡ཁྖͰ, SIDH ‫ڞݤ‬༗ํࣜΛެ։‫ʹ߸҉ݤ‬ม‫ͨ͠׵‬΋ͷ͕ SIKE ެ։‫͋Ͱ߸҉ݤ‬Δ.

• ‫ݤ‬ੜ੒ɿ ‫ ۭؒݤ‬K3 ͔ΒϥϯμϜͳ‫ݤ‬Λੜ੒͢Δɿsk3 ←R K3 . sk3 ʹैͬͯ, ಉछࣸ૾Λ‫ͦͯ͠ࢉܭ‬ͷ஋Ҭ‫ۂ‬ઢ‫఺ॿิͼٴ‬Λੜ੒͢Δɿpk3 = isogen3 (sk3 ). ൿີ‫ ݤ‬sk = sk3 , ެ։‫ ݤ‬pk = pk3 ͱ͢Δ.

• ҉߸Խɿ ެ։‫ ݤ‬pk = pk3 ͱϝοηʔδ m ∈ M Λೖྗͱ͢Δ. ‫ ۭؒݤ‬K2 ͔ΒϥϯμϜͳ஋Λੜ੒͢Δɿ
sk2 ←R K2 . sk2 ʹैͬͯ, ಉछࣸ૾Λ‫ͦͯ͠ࢉܭ‬ͷ஋Ҭ‫ۂ‬ઢ‫఺ॿิͼٴ‬Λੜ੒͢Δɿc0 = isogen2 (sk2 ). pk3

ͱ sk2 ͔Β, SIDH ‫ڞ‬༗‫ͨ͋ʹݤ‬Δ j ෆมྔΛ‫͢ࢉܭ‬Δɿj = isoex2 (pk3 , sk2 ). ‫ݤ‬ಋग़ؔ਺ F Λ༻͍ͯϏοτྻ΁ม‫͢׵‬Δɿh = F (j). ϝοηʔδ m ΛϚεΫ͢Δɿc1 = h ⊕ m. ҉߸จ (c0 , c1 ) Λग़ྗ͢Δ.

• ෮߸ɿ ൿີ‫ ݤ‬sk = sk3 ͱ҉߸จ (c0 , c1 ) Λೖྗͱ͢Δ. c0 ͱ sk3 ͔Β, SIDH ‫ڞ‬༗‫ͨ͋ʹݤ‬Δ j ෆมྔΛ‫ࢉܭ‬

͢Δɿj = isoex2 (c0 , sk3 ). ‫ݤ‬ಋग़ؔ਺ F Λ༻͍ͯϏοτྻ΁ม‫͢׵‬Δɿh ← F (j). c1 ͷϚεΫΛऔΓআ͘ɿm ← h ⊕ c1 . ϝοηʔδ m Λग़ྗ͢Δ.

ఆཧ 5.11 ([34]) SIKE ެ։‫߸҉ݤ‬͸, ϥϯμϜΦϥΫϧϞσϧʹ͓͍ͯ, SIDH ໰୊ࠔ೉ੑͷԾఆͷԼͰ, બ୒ฏจ߈ܸʹରͯࣝ͠ผෆՄ (IND-CPA) ҆શͰ͋Δ.
˙SIKE ‫ݤ‬ΧϓηϧԽํࣜ

SIKE ‫ݤ‬ΧϓηϧԽํࣜ (KEM) ͸, ϥϯμϜΦϥΫϧϞσϧͰ, SSDDH ԾఆͷԼͰ

IND-CCA ҆શͰ͋Δ. Ԭຊ–౻࡚ม‫׵‬Λ‫ ͨ͠ʹج‬Hofheinz Βͷม‫[ ׵‬31] Λࢪͯ͠, IND-CPA ҆શͳެ։‫߸҉ݤ‬Λ,
IND-CCA ҆શͳ‫ݤ‬ΧϓηϧԽํࣜʹม‫ͨ͠׵‬΋ͷͰ͋Δ.
ҎԼͰ͸, લஈམʹ‫ ͨ͠ࡌه‬SIKE ެ։‫߸҉ݤ‬ͷ҉߸Խ, ෮߸ΛͦΕͧΕ Enc, Dec ͱ‫ͯ͠ࡌه‬, ຊஈམͰͷ KEM ҉
߸Խ, KEM ෮߸಺Ͱαϒϧʔνϯͱͯ͠༻͍Δ.

• ‫ݤ‬ੜ੒ɿ ‫ ۭؒݤ‬K3 ͔ΒϥϯμϜͳ‫ݤ‬Λੜ੒͢Δɿsk3 ←R K3 . sk3 ʹैͬͯ, ಉछࣸ૾Λ‫ͦͯ͠ࢉܭ‬ͷ஋Ҭ77‫ۂ‬ઢ‫఺ॿิͼٴ‬Λੜ੒͢Δɿpk3 = isogen3 (sk3 ). ϥϯμϜͳϏοτྻ s Λੜ੒͢Δɿs ←R {0, 1}n . ൿີ‫ݤ‬

sk = (s, sk3 ), ެ։‫ ݤ‬pk = pk3 ͱ͢Δ.

• ‫ݤ‬ΧϓηϧԽɿ ެ։‫ ݤ‬pk = pk3 Λೖྗͱ͢Δ. ϥϯμϜͳϏοτྻ m Λੜ੒͢Δɿm ←R {0, 1}n . ϋογϡؔ਺ G Λ༻͍ͯཚ਺஋ r Λੜ੒͢Δɿr = G(m || pk3 ). ެ։‫ ݤ‬pk3 ͱཚ਺஋ r Λ༻͍ͯ m Λ҉߸Խ͢Δɿ

(c0 , c1 ) = Enc(pk3 , m; r). ‫ݤ‬ಋग़ؔ਺ H Λ༻͍ͯ‫ڞ‬༗‫ ݤ‬K Λੜ੒͢ΔɿK = H(m || (c0 , c1 )). ҉߸จ (c0 , c1 )ͱ‫ڞ‬༗‫ ݤ‬K Λग़ྗ͢Δ.

• σΧϓηϧɿ ൿີ‫ ݤ‬sk = (s, sk3 ), ެ։‫ ݤ‬pk = pk3 ͱ҉߸จ (c0 , c1 ) Λೖྗͱ͢Δ. ൿີ‫ ݤ‬sk3 Λ༻͍ͯ(c0 , c1 ) Λ෮߸͢Δɿm′ = Dec(sk3 , (c0 , c1 )). ϋογϡؔ਺ G Λ༻͍ͯཚ਺஋ r′ Λੜ੒͢Δɿr′ = G(m′ || pk3 ).

r′ ʹैͬͯ, ಉछࣸ૾Λ‫ͦͯ͠ࢉܭ‬ͷ஋Ҭ‫ۂ‬ઢ‫఺ॿิͼٴ‬Λੜ੒͢Δɿc′0 = isogen2 (r′ ). c′0 = c0 ͕੒ཱ
͢Δ͔Ͳ͏͔ʹΑͬͯ, ‫ݤ‬ಋग़ؔ਺ H Λ༻͍ͯ‫ڞ‬༗‫ ݤ‬K ΛҎԼͷΑ͏ʹੜ੒͢Δɿ΋͠ c′0 = c0 Ͱ͋Ε͹,K = H(m′ || (c0 , c1 )), ΋͠ c′0 ̸= c0 Ͱ͋Ε͹, K = H(s || (c0 , c1 )). ‫ڞ‬༗‫ ݤ‬K Λग़ྗ͢Δ.
ఆཧ 5.12 ([34]) SIKE ‫ݤ‬ΧϓηϧԽํࣜ͸, ϥϯμϜΦϥΫϧϞσϧʹ͓͍ͯ, SIDH ໰୊ࠔ೉ੑͷԾఆͷԼͰ, બ୒҉߸จ߈ܸʹରͯࣝ͠ผෆՄ (IND-CCA) ҆શͰ͋Δ.

[34] ʹैͬͯ, ද 5.4 ʹ, SIKE ‫ݤ‬ΧϓηϧԽํࣜͷ‫߸҉ͱݤ‬จͷαΠζΛόΠτ௕Ͱࣔ͢. ·ͨ, [34] ʹै͍, ൿີ‫ݤ‬αΠζཝʹ͸ਖ਼ຯͷൿີ‫ݤ‬αΠζͱͱ΋ʹެ։‫ݤ‬΋Ճ͑ͨαΠζ΋‫ʹ಺ހׅ‬ซ‫͢ه‬Δ.
ද 5.4

SIKE ‫ݤ‬ΧϓηϧԽํࣜͷ‫ݤ‬ɾ҉߸จͷαΠζ (όΠτ)ൿີ‫ؚ( ݤ‬Ήެ։‫)ݤ‬

ެ։‫ݤ‬

҉߸จ

‫ڞ‬༗‫ݤ‬56 (434)

378

402

16

SIKEp751

80 (644)

564

596

24

SIKEp964

100 (826)

726

766

32

SIKEp503

2019 ೥ 1 ݄ʹެ։͞Εͨ NIST PQC ඪ४Խͷ‫گݱ‬ใࠂॻ [1] ʹΑΔͱ, ଞͷ PQC ީิʹൺ΂ͯ࠷΋‫ݤ‬αΠζ͕খ͍͜͞ͱ͕ SIKE ͷ 1 ͭͷಛ௕Ͱ͋Δ. ද 5.4 ʹ‫ݟ‬ΔΑ͏ʹ, 256 Ϗοτͷ҆શੑϨϕϧͱ͞ΕΔ SIKEp964 ‫ݤ‬ΧϓηϧԽํࣜͰ΋, ͦͷެ։‫ݤ‬αΠζ͕ 750 όΠτΛԼճ͍ͬͯΔ͜ͱ͕ [1] Ͱಛච͞Ε͍ͯΔ.
·ͨ, ଞʹ΋, NIST ใࠂॻ [1] Ͱࢦఠ͞Εͨ SIKE ํࣜͷಛ௕ͱऑ఺Λ؆୯ʹ·ͱΊΔ. ͦͷಛ௕ͱͯ͠͸, ্ʹࢦఠͨ͠ଞͷ PQC ީิʹൺ΂ͯ࠷΋‫ݤ‬αΠζ͕খ͍͜͞ͱͷଞʹ, ͜Ε·Ͱͷପԁ‫ۂ‬ઢ҉߸ͷ࣮૷‫ߴ͍ͨͮجʹڀݚ‬଎࣮૷΍଱αΠυνϟωϧ࣮૷ͷ‫ڀݚ‬஝ੵ͕͋Δ͜ͱ, ͦͯ͠ैདྷͷପԁ‫ۂ‬ઢ҉߸ͱͷ‫ݹ‬య/଱ྔࢠ҆શϋΠϒϦουํࣜͷߏ੒༰қ͕͞ࢦఠ͞Ε͍ͯΔ. ͦͷऑ఺ͱͯ͠͸, ଞͷ PQC ީิʹൺ΂ͯ, ‫ج‬ຊ໰୊Ͱ͋Δಉछࣸ૾໰୊ͷ҆શੑ‫ݕ‬౼͕·ͩෆे෼Ͱ͋Δ͜ͱ΍ಉछࣸ૾‫͔͔͕ؒ࣌ʹࢉܭ‬Δ͜ͱ͕‫͛ڍ‬ΒΕ͍ͯΔ. (࠷৽ͷ҆શੑ‫ݕ‬౼ใࠂͱͯ͠

[33, 12] ͕͋Δ. )5.3.2 ಉछࣸ૾ʹ‫ͮ͘ج‬ೝূ෇͖‫ڞݤ‬༗ɾάϧʔϓ‫ڞݤ‬༗˙ೝূ෇͖‫ڞݤ‬༗ೝূ෇͖‫ڞݤ‬༗͸, ௕͍‫ڀݚ‬ͷྺ࢙Λ͕࣋ͭ, ಉछࣸ૾ʹ‫ͮ͘ج‬, ಛʹ SIDH ϕʔεͷೝূ෇͖‫ݤ‬‫ڞ‬༗͸, 2018 ೥ʹͳͬͯ Galbraith [26], LeGrow Β [39], Longa [40], ౻ԬΒ [21] ʹΑͬͯ૬͍࣍ͰఏҊ͞Εͨ. ·ͨ,࠷ۙ, CSIDH ʹ‫ͮ͘ج‬ೝূ෇͖‫ڞݤ‬༗΋, ౻ԬΒ [22] ʹΑͬͯఏҊ͞Εͨ.

78˙άϧʔϓ‫ڞݤ‬༗ 2 Ϣʔβؒͷ‫ڞݤ‬༗Λෳ਺Ϣʔβͷ‫ڞݤ‬༗ʹ֦ு͢Δάϧʔϓ‫ڞݤ‬༗΋௕͘‫͞ڀݚ‬Ε͖͍ͯͯΔ͕,ಉछࣸ૾ʹ‫ͮ͘ج‬΋ͷͱͯ͠͸, ࠷ۙ, ‫ݹ‬઒Β [23] ʹΑͬͯ SIDH ϕʔεάϧʔϓ‫ڞݤ‬༗͕ఏҊ͞Εͨ. ·ͨ, BonehΒ [5] ͸, ಉछࣸ૾ʹ‫ͮ͘ج‬ඇର࿩άϧʔϓ‫ڞݤ‬༗ͷՄೳੑΛ͓ࣔࠦͯ͠Γ, ͦΕΛԠ༻ͯ͠ 1 ϥ΢ϯυೝূάϧʔϓ‫ݤ‬‫ڞ‬༗΋, ౻ԬΒ [22] ʹΑͬͯ‫ݕ‬౼͞Ε͍ͯΔ.

5.3.3 ಉछࣸ૾ʹ‫ࣜํ໊ॺͮ͘ج‬
SIDH ‫ڞݤ‬༗ʹ‫[ ໊ॺͮ͘ج‬28] ʹ؆୯ʹ৮Εͨ‫ޙ‬, CSIDH ‫ڞݤ‬༗ʹ‫[ ໊ॺͮ͘ج‬18, 14] ํࣜͰ͋Δ SeaSign ॺ໊Λઆ໌͢Δ.
˙SIDH ϕʔεॺ໊SIDH ‫ڞݤ‬༗Λϕʔεʹͯ͠, 1 Ϗοτͣͭূ໌͍ͯ͘͠Ұൠతͳθϩ஌ࣝର࿩ূ໌Λద༻ͯ͠,Fiat-Shamir ม‫ʹ׵‬ΑΔॺ໊Λߏ੒͢Ε͹, ޮ཰͸ඇৗʹѱ͍͕, ‫ݩ‬ͷ SIDH ‫ڞݤ‬༗ͱಉ͡ԾఆͷԼͰॺ໊ํ͕ࣜͰ͖
Δ [54, 28]. Galbraith Β [28] ͸, SIDH ಉछࣸ૾໰୊Ͱ͸ͳ͘ (Ұൠతͳ) ௒ಛҟಉछࣸ૾໰୊ͷࠔ೉ੑʹ‫ॺ͍ͨͮج‬໊ํࣜ΋ߏ੒ͨ͠.
˙SeaSign ॺ໊: CSIDH ϕʔεॺ໊De Feo ͱ Galbraith [18] ʹΑΓ, લઅͷॺ໊ํࣜΑΓ͸ޮ཰తͳ CSIDH ϕʔεॺ໊͕ఏҊ͞Εͨ. ͜Ε͸, CSIDH ‫ڞݤ‬༗ͷ਺ֶతͳߏ଄Λར༻ͨ͠΋ͷͰ͋Γ, ද 5.3.3 ʹ‫ݟ‬ΔΑ͏ʹ, ·࣮ͩ༻తͱ͸‫͍ݴ‬೉͍͕, ‫࣮ݱ‬తͳ‫ʹؒ࣌ࢉܭ‬ऩ·Δॺ໊ํࣜͱͳ͍ͬͯΔ. ҎԼͰ͸, [18] Ͱ, ʮ‫ج‬ຊ‫ܗ‬ʯͱ‫ݺ‬͹ΕΔ SeaSignॺ໊ํࣜΛ‫͢ࡌه‬Δ. [18] Ͱ͸, ߋʹ, ‫ج‬ຊ‫Ͱܗ‬΋࢖ΘΕͨύϥϝʔλ t ͱ‫ʹڞ‬, ύϥϝʔλ s Λಋೖͯ͠, ॺ໊͕୹͍
ํࣜ΍ެ։‫͍ͨͬͱࣜํ͍୹͕ݤ‬ม‫ࣜํܗ‬Λఆ͍ٛͯ͠Δ.
‫ޙ‬ଓ‫[ ڀݚ‬14] ʹ͓͍ͯ, ߋͳΔߴ଎Խ͕ਤΒΕ͍ͯΔ͕, ·࣮ͩ༻తͱ͸‫͍ݴ‬೉͘, SeaSign ॺ໊Λվྑ͢Δ͜ͱͰ,࣮༻తͳ଎౓ੑೳΛୡ੒Ͱ͖Δ͔Ͳ͏͔Λ‫ۃݟ‬ΊΔ͜ͱ͸, ࠓ‫ޙ‬ͷಉछࣸ૾ϕʔεॺ໊‫ͯͬͱʹڀݚ‬ॏཁͳ՝୊Ͱ͋Δ.
ҎԼͰ͸, ϕΫτϧ e ͷ֤੒෼͸ ei (i = 1, 2, . . . , n) ͱ͢Δ, ଈͪ, e = (e1 , e2 , . . . , en ) Ͱ͋Δ. ϕΫτϧ fk , zk ʹ͍ͭͯ΋ಉ༷ͷ‫ه‬๏Λ༻͍Δ.

• ‫ݤ‬ੜ੒ɿ ެ։ύϥϝʔλ ppcsidh = (O, (l1 , l2 , . . . , ln ), E, B), ͢ͳΘͪ, ‫ ڏ‬2 ࣍੔‫ ؀‬O, ΠσΞϧ l1 , l2 , . . . , ln ,Fp -༗ཧͳ௒ಛҟପԁ‫ۂ‬ઢ E, ্‫ݶ‬஋ B Λೖྗͱ͢Δ. ܎਺ϕΫτϧ e ←R [−B, B]n Λੜ੒͢Δ. EA =?n
[ i=1 lei i ] E Λ‫ͯ͠ࢉܭ‬, ൿີ‫ ݤ‬sk = e, ެ։‫ ݤ‬pk = EA ͱ͢Δ.

• ॺ໊ੜ੒ɿ ެ։ύϥϝʔλ ppcsidh , ϝοηʔδ msg, ެ։‫ ݤ‬pk = EA , ൿີ‫ ݤ‬sk = eEΛೖྗͱ͢Δ. ֤?n fk,i Fnk = 1, 2, . . . , t ʹରͯ͠, ܎਺ϕΫτϧ fk ←R [−(nt + 1)B, (nt + 1)B] Λੜ੒ͯ͠, Ek =E Λ‫ܭ‬
i=1 liࢉ͢Δ. ϋογϡ஋Λ b1 || · · · ||bt = H(j(E1 ), . . . , j(Et ), msg) ͱϏοτ෼ղ͢Δ. ֤ k = 1, 2, . . . , t ʹରͯ͠, ΋͠ bk = 0 Ͱ͋Ε͹, zk = fk ͱͯ͠, ΋͠ bk = 1 Ͱ͋Ε͹, zk = fk − e ͱͯ͠, ΋͠ zk ̸∈ [−ntB, ntB]n Ͱ͋Ε͹ ⊥ Λग़ྗ͢Δ. ͦ͏Ͱͳ͚Ε͹, ॺ໊ σ = (z1 , z2 , . . . , zt , b1 , b2 , . . . , bt ) Λग़ྗ͢Δ.

• ॺ໊‫ূݕ‬ɿ ެ։ύϥϝʔλ ppcsidh , ϝοηʔδ msg, ެ։‫ ݤ‬pk = EA , ॺ໊ σ Λೖྗͱ͢Δ. ·ͣ, ॺ໊ σ ͕,

σ = (z1 , z2 , . . . , zt , b1 , b2 , . . . , bt ) ͱ͍͏σʔλʹͳ͍ͬͯΔ͜ͱΛ֬ೝ͢Δ. ֤ k = 1, 2, . . . , t ʹରͯ͠, ΋
G?n zk,i H
G?n zk,i H͠ bk = 0 Ͱ͋Ε͹, Ek =E Λ‫ͯ͠ࢉܭ‬, ΋͠ bk = 1 Ͱ͋Ε͹, Ek =EA Λ‫͢ࢉܭ‬Δ.
i=1 li
i=1 liϋογϡ஋Λ b′1 || · · · ||b′t = H(j(E1 ), . . . , j(Et ), msg) ͱϏοτ෼ղ͢Δ. ΋͠, (b′1 , b′2 , . . . , b′t ) = (b1 , b2 , . . . , bt )Ͱ͋Ε͹, डཧΛग़ྗͯ͠, ͦ͏Ͱͳ͚Ε͹, ෆडཧΛग़ྗ͢Δ.

ఆཧ 5.13 ([18]) SeaSign ॺ໊ํࣜ͸, ϥϯμϜΦϥΫϧϞσϧʹ͓͍ͯ, CSIDH ϕΫτϧԽ໰୊ 2 ࠔ೉ੑͷԾఆͷԼͰ, બ୒จॻ߈ܸʹରͯ͠ଘࡏతِ଄ෆՄ (EUF-CMA) ҆શͰ͋Δ.

79

ද 5.5

SeaSign ॺ໊‫ج‬ຊ‫ܗ‬, ୹ॺ໊ํࣜ, ୹ެ։‫ࣜํݤ‬ͷσʔλαΠζͱॲཧ࣌ؒ‫ੵݟ‬Γ ([18], 2018/9/6 ʹ౤ߘ͞Εͨ൛ͷ ePrint ࿦จ). ͜͜Ͱ, (λ, n, B, log2 (p)) = (128, 74, 5, 16, 500) ͔ͭୈ 1 ྻ໨Ͱ͸ (s, t) = (1, 128), ୈ

2,3 ྻ໨Ͱ͸ (s, t) = (16, 8). ୯Ґ KiB ͸ 1 KiB = 210 όΠτ = 1024 όΠτͱ͢Δ. ·ͨ, ࣌ؒ‫ੵݟ‬Γ͸ [7] ͱಉ༷ʹ, [B, −B]n ಺ͷϕΫτϧ͕ପԁ‫ۂ‬ઢ E ʹ࡞༻͢Δ‫༻࡞܈‬ԋࢉ 1 ճʹ (ଟ͘ͱ΋)0.1 ඵ͔͔ΔͷΛ‫ج‬४ʹͯ͠‫ੵݟ‬΋͍ͬͯΔ.

‫ج‬ຊ‫ܗ‬୹ॺ໊ํࣜ୹ެ։‫ࣜํݤ‬ॺ໊αΠζ19600 B

944 B

3092 Bެ։‫ݤ‬αΠζ63 B4032 KiB

32 Bൿີ‫ݤ‬αΠζ

32 B

16 B

1024 KiB‫ݤ‬ੜ੒࣌ؒ‫ੵݟ‬Γ

0.1 ඵ

6554 ඵ

6554 ඵ

ॺ໊ੜ੒ɾ‫ੵݟؒ࣌ূݕ‬Γ

123136 ඵ

474 ඵ

474 ඵ

5.4 ·ͱΊຊষͰ͸, ಉछࣸ૾ʹ‫ ͍ͨͮج‬SIDH ‫ڞݤ‬༗, CSIDH ‫ڞݤ‬༗ʹؔ࿈ͯ͠, ͦͷํࣜ‫ه‬ड़, ҆શੑ‫ڀݚ‬, NIST ඪ४Խͷಈ޲, ͦͯ͠, ͦΕΒΛ‫ͱ·͍ͯͭʹͲͳࣜํ໊ॺͨ͠ʹج‬Ί͖ͯͨ.

[13] ʹΑΔͱ, Couveignes ͸, 1997 ೥ͷ École Normale Supérieure ͰͷηϛφʔͰ‫ʹط‬ಉछࣸ૾ʹ‫ٕ߸҉ͮ͘ج‬ज़ΛఏҊ͓ͯ͠Γ, ΄΅ಉ࣌‫ ʹظ‬Kohel[36] ΍ Galbraith[25] ΋, ಉछࣸ૾໰୊ʹؔ͢Δ‫ڀݚ‬Λ࢝Ί͍ͯͨ. ͭ·Γ, ಉछࣸ૾҉߸ٕज़ͷ‫ڀݚ‬͸‫ ʹط‬20 ೥Ҏ্ͷྺ࢙Λ΋ͭ. ͦͯ͠, ࠷ۙʹͳΓ, ଱ྔࢠ‫߸҉ػࢉܭ‬ͷඞཁੑ͕ߴ·Δ͜ͱͰ,ಉछࣸ૾҉߸ٕज़͸஫໨͞Εͯ‫͕ڀݚ‬ਐΜͰ͓Γ, ࠓ‫ޙ‬, ߋʹ༷ʑͳํ޲ੑͷ‫͕ڀݚ‬ਐΉͱࢥΘΕΔ. ΋ͪΖΜ, ະ஌ͷಉछࣸ૾҉߸ํࣜ΍ະ஌ͷ߈ܸ͕, ࠓ‫ޙ‬ଓ͘Մೳੑ΋͋ΔͷͰ, ࠷৽‫ڀݚ‬ಈ޲ΛҾ͖ଓ͖‫͍ͯ͘͠ࢹ؂‬ඞཁ͕͋Δ͕, ‫ݱ‬ࡏ஌ΒΕͨํࣜ΍҆શੑٞ࿦ʹؔͯ͠΋, ࠓ‫ޙ‬, ಛʹ஫ҙ͢΂͖͜ͱ਺఺ʹ͍ͭͯҎԼʹ·ͱΊ͓ͯ͘.

• NIST ҉߸ඪ४ԽʹఏҊ͞Εͨಉछࣸ૾҉߸͸, 5.3.1 અʹ‫ ͨ͠ࡌه‬SIKE ํ͚ࣜͩͰ͋ΔͷͰ, SIKE ํࣜͷಈ޲͸ॏཁͰ͋Δ. ಛʹ IND-CCA ҆શੑΛୡ੒͢Δ SIKE ‫ݤ‬ΧϓηϧԽํࣜͷ҆શੑɾ࣮૷‫ڀݚ‬ͷಈ޲ʹ͸, ஫໨͢Δඞཁ͕͋Δ.

• SIKE ํࣜͷ‫͋Ͱج‬Δ SIDH ‫ڞݤ‬༗ͷޮ཰Խ, ಛʹ‫ؒ࣌ࢉܭ‬ͷ୹ॖ΍૊ΈࠐΈ‫Ͱثػ‬ͷߴ଎࣮૷๏͸, ଞͷ଱ྔࢠެ։‫ͱ߸҉ݤ‬ൺ΂ͨ࣌ʹ, ॏཁͳ‫ڀݚ‬՝୊Ͱ͋Δ.

• 5.1.4 અͰड़΂ͨΑ͏ʹ, CSIDH ‫ڞݤ‬༗ʹର͢Δ४ࢦ਺࣌ؒྔࢠΞϧΰϦζϜͷৄࡉͳղੳɾ‫ੵݟ‬΋Γ͸, ·ͩࠓ‫ޙ‬ͷ՝୊Ͱ͋Δ. ͦΕʹ‫͍ͯͮج‬, SIDH ‫ڞݤ‬༗ͱ CSIDH ‫ڞݤ‬༗ͷൺֱ͕ߦΘΕ͍ͯ͘ͷͰ, SIKE ํࣜͷඪ४Խͱ͍͏‫͔఺؍‬Β΋ॏཁͰ͋Δ.

• 5.3.3 અͰड़΂ͨΑ͏ʹ, ࣮༻తͳಉछࣸ૾ϕʔεॺ໊͸, ·ͩଘࡏ͠ͳ͍. ‫ࡏݱ‬, ΋ͬͱ΋࣮༻ʹ͍ۙ SeaSignॺ໊Λվྑ͢Δ͜ͱͰୡ੒Ͱ͖Δͷ͔, ৽ͨͳॺ໊ߏ੒๏Λ։୓͢Δඞཁ͕͋Δͷ͔, ͳͲ͸ࠓ‫ޙ‬ͷ՝୊ͱͯ͠
࢒͞Ε͍ͯΔ.

80

ୈ 5 ষͷࢀߟจ‫ݙ‬[1] G. Alagic, J. Alperin-Sheriﬀ, D. Apon, D. Cooper, Q. Dang, Y.-K. Liu, C. Miller, D. Moody, R. Peralta,
R. Perlner, A. Robinson, and D. Smith-Tone. Status report on the first round of the NIST post-quantum
cryptography standardization process. NISTIR 8240, NIST, January 2019.
[2] D. J. Bernstein, T. Lange, C. Martindale, and L. Panny. Quantum circuits for the CSIDH: optimizing quantum evaluation of isogenies. IACR Cryptology ePrint Archive, 2018:1059, 2018. To appear in EUROCRYPT
2019.
[3] J.-F. Biasse, A. Iezzi, and M.J. Jacobson Jr. A note on the security of CSIDH. In INDOCRYPT 2018, pages
153–168, 2018.
[4] J.-F. Biasse, D. Jao, and A. Sankar. A quantum algorithm for computing isogenies between supersingularelliptic curves. In INDOCRYPT 2014, pages 428–442, 2014.
[5] D. Boneh, D. Glass, D. Krashen, K. Lauter, S. Sharif, A. Silverberg, M. Tibouchi, and M. Zhandry. Multiparty non-interactive key exchange and more from isogenies on elliptic curves. In MATHCRYPT 2018, 2018.
https://eprint.iacr.org/2018/665.
[6] X. Bonnetain and A. Schrottenloher. Quantum security analysis of CSIDH and ordinary isogeny-based
schemes. IACR Cryptology ePrint Archive, 2018:537, 2018.
[7] W. Castryck, T. Lange, C. Martindale, L. Panny, and J. Renes. CSIDH: An eﬃcient post-quantum commutative group action. In ASIACRYPT 2018, Part III, pages 395–427, 2018.
[8] D.X. Charles, K. E. Lauter, and E.Z. Goren. Cryptographic hash functions from expander graphs. J. Crypt.,22(1):93–113, 2009.
[9] A.M. Childs, D. Jao, and V. Soukharev. Constructing elliptic curve isogenies in quantum subexponential
time. J. Math. Crypt., 8(1):1–29, 2014.
[10] C. Costello, D. Jao, P. Longa, M. Naehrig, J. Renes, and D. Urbanik. Eﬃcient compression of SIDH publickeys. In EUROCRYPT 2017, Part I, pages 679–706, 2017.
[11] C. Costello, P. Longa, and M. Naehrig. Eﬃcient algorithms for supersingular isogeny Diﬃe–Hellman. In
CRYPTO 2016, Part I, pages 572–601, 2016.
[12] C. Costello, P. Longa, M. Naehrig, J. Renes, and F. Virdia. Improved classical cryptanalysis of the computational supersingular isogeny problem. IACR Cryptology ePrint Archive, 2019:298, 2019.
[13] J.M. Couveignes. Hard homogeneous spaces. IACR Cryptology ePrint Archive, 2006:291, 2006.
[14] T. Decru, L. Panny, and F. Vercauteren. Faster SeaSign signatures through improved rejection sampling.
IACR Cryptology ePrint Archive, 2018:1109, 2018.
[15] C. Delfs and S.D. Galbraith. Computing isogenies between supersingular elliptic curves over Fp . Des. Codes

81

Cryptography, 78(2):425–440, 2016.
[16] K. Eisenträger, S. Hallgren, K. E. Lauter, T. Morrison, and C. Petit. Supersingular isogeny graphs andendomorphism rings: Reductions and solutions. In EUROCRYPT 2018, Part III, pages 329–368, 2018.
[17] L. De Feo. Mathematics of isogeny based cryptography. CoRR, abs/1711.04062, 2017.
[18] L. De Feo and S.D. Galbraith. SeaSign: Compact isogeny signatures from class group actions. IACR
Cryptology ePrint Archive, 2018:824, 2018. We refer to the version which was posted at 6th September,
2018. To appear in EUROCRYPT 2019.
[19] L. De Feo, D. Jao, and J. Plût. Towards quantum-resistant cryptosystems from supersingular elliptic curveisogenies. J. Math. Crypt., 8(3):209–247, 2014.
[20] L. De Feo, J. Kieﬀer, and B. Smith. Towards practical key exchange from ordinary isogeny graphs. In
ASIACRYPT 2018, Part III, pages 365–394, 2018.
[21] A. Fujioka, K. Takashima, S. Terada, and K. Yoneyama. Supersingular isogeny Diﬃe–Hellman authenticated
key exchange. In ICISC 2018, pages 177–195, 2018.
[22] A. Fujioka, K. Takashima, and K. Yoneyama. One-round authenticated group key change from isogenies.
IACR Cryptology ePrint Archive, 2018:1033, 2018.
[23] S. Furukawa, N. Kunihiro, and K. Takashima. Multi-party key exchange protocols from supersingularisogenies. In ISITA 2018. IEEE Xplore, 2019.
[24] S. Galbraith, L. Panny, B. Smith, and F. Vercauteren. Quantum equivalence of the DLP and CDHP forgroup actions. IACR Cryptology ePrint Archive, 2018:1199, 2018.
[25] S.D. Galbraith. Constructing isogenies between elliptic curves over finite fields. Journal of Computational
Mathematics, 2:118–138, 1999.
[26] S.D. Galbraith. Authenticated key exchange for SIDH. IACR Cryptology ePrint Archive, 2018:266, 2018.
[27] S.D. Galbraith, C. Petit, B. Shani, and Y.B. Ti. On the security of supersingular isogeny cryptosystems. In
ASIACRYPT 2016, Part I, pages 63–91, 2016.
[28] S.D. Galbraith, C. Petit, and J. Silva. Identification protocols and signature schemes based on supersingularisogeny problems. In ASIACRYPT 2017, Part I, pages 3–33, 2017.
[29] S.D. Galbraith and A. Stolbunov. Improved algorithm for the isogeny problem for ordinary elliptic curves.
Applicable Algebra in Engineering, Communication and Computing, 24(2):107–131, 2013.
[30] S.D. Galbraith and F. Vercauteren. Computational problems in supersingular elliptic curve isogenies. Quantum Information Processing, 17(10):265, 2018.
[31] D. Hofheinz, C.K. Hövelmanns, and E. Kiltz. A modular analysis of the Fujisaki-Okamoto transformation.
In TCC 2017, Part I, pages 341–371, 2017.
[32] A. Hutchinson and K. Karabina. Constructing canonical strategies for parallel implementation of isogeny
based cryptography. In INDOCRYPT 2018, pages 169–189, 2018.
[33] S. Jaques and J.M. Schanck. Quantum cryptanalysis in the RAM model: Claw-finding attacks on SIKE.
IACR Cryptology ePrint Archive, 2019:103, 2019.
[34] D. Jao, R. Azarderakhsh, M. Campagna, C. Costello, L. De Feo, B. Hess, A. Jalali, B. Koziel, B. LaMacchia,
P. Longa, M. Naehrig J. Renes, V. Soukharev, and D. Urbanik. Supersingular isogeny key encapsulation.
submission to NIST PQC Standardization, 2017.
[35] D. Kirkwood, B.C. Lackey, J. McVey, M. Motley, J.A. Solinas, and D. Tuller. Failure is not an option: Stan82

dardization issues for post-quantum key agreement, 2015. Workshop on Cybersecurity in a Post-Quantum
World.
[36] D. Kohel. Endomorphism rings of elliptic curves over finite fields. PhD thesis, University of California at
Berkeley, 1996.
[37] D. Kohel, K. Lauter, C. Petit, and J.-P. Tignol. On the quaternion ℓ-isogeny path problem. LMS Journalof Comupational Mathematics, 17:418–432, 2014.
[38] P. Koppermann, E. Pop, J. Heyszl, and G. Sigl. 18 seconds to key exchange: Limitations of supersingularisogeny Diﬃe–Hellman on embedded devices. IACR Cryptology ePrint Archive, 2018:932, 2018.
[39] J. LeGrow, D. Jao, and R. Azarderakhsh. Modeling quantum-safe authenticated key establishment, and an
isogeny-based protocol. IACR Cryptology ePrint Archive, 2018:282, 2018.
[40] P. Longa. A note on post-quantum authenticated key exchange from supersingular isogenies. IACR Cryptology ePrint Archive, 2018:267, 2018.
[41] M. Meyer and S. Reith. A faster way to the CSIDH. In INDOCRYPT 2018, pages 137–152, 2018.
[42] C. Petit. Faster algorithms for isogeny problems using torsion point images. In ASIACRYPT 2017, Part II,
pages 330–353, 2017.
[43] A.K. Pizer. Ramanujan graphs and Hecke operators. Bull. AMS, 23(1):127–137, 1990.
[44] J. Renes. Computing isogenies between montgomery curves using the action of (0, 0). In PQCrypto 2018,
pages 229–247, 2018.
[45] A. Rostovtsev and A. Stolbunov. Public-key cryptosystem based on isogenies. IACR Cryptology ePrint
Archive, 2006:145, 2006.
[46] R. Schoof. Nonsingular plane cubic curves over finite fields. Journal of Combinatorial Theory, Series A,
46(2):183–208, 1987.
[47] H. Seo, Z. Liu, P. Longa, and Z. Hu. SIDH on ARM: faster modular multiplications for faster post-quantum
supersingular isogeny key exchange. IACR Trans. Cryptogr. Hardw. Embed. Syst., 2018(3):1–20, 2018.
[48] B. Smith. Pre- and post-quantum Diﬃe–Hellman from groups, actions, and isogenies. In WAIFI 2018, pages
3–40, 2018.
[49] S. Tani. Claw finding algorithms using quantum walk. Theor. Comput. Sci., 410(50):5285–5297, 2009.
[50] E. Thormarker. Post-quantum cryptography: Supersingular isogeny Diﬃe–Hellman key exchange. Master’s
thesis, Stockholm University, 2017.
[51] J. Vélu. Isogénies entre courbes elliptiques. C.R. Acad. Sc. Paris, Séries A., 273:238–241, 1971.
[52] L.C. Washington. Elliptic Curves: Number Theory and Cryptography. CRC Press, 2nd edition, 2008.
[53] W.C. Waterhouse. Abelian varieties over finite fields. Annales scientifiques de l’É.N.S., 4e série, 2(4):521–
560, 1969.
[54] Y. Yoo, R. Azarderakhsh, A. Jalali, D. Jao, and V. Soukharev. A post-quantum digital signature scheme onsupersingular isogenies. In FC 2017, pages 163–181, 2017.
[55] ૬઒༐ี, ࢁ࡚౒, খ؏‫࢙ܒ‬, ߴ໦߶. ಉछࣸ૾҉߸ CSIDH ͷ‫ྔࢉܭ‬ධՁͱߴ଎Խύϥϝʔλ. In SCIS 2019,
3B3-2, 2019.

83

CRYPTREC
耐量子計算機暗号の研究動向調査報告書[CRYPTREC TR-2001-2018]
不許複製 禁無断転載
発行日2019 年 4 月 5 日

第1版

発行者
・〒184-8795
東京都小金井市貫井北町四丁目 2 番 1 号
国立研究開発法人情報通信研究機構（サイバーセキュリティ研究所 セキュリティ基盤研究室）
NATIONAL INSTITUTE OFINFORMATION AND COMMUNICATIONS TECHNOLOGY

4-2-1 NUKUI-KITAMACHI,KOGANEITOKYO,184-8795 JAPAN・〒113-6591
東京都文京区本駒込二丁目 28 番 8 号
独立行政法人情報処理推進機構（セキュリティセンター セキュリティ技術評価部 暗号グループ）
INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN
2-28-8 HONKOMAGOME,BUNKYO-KU

TOKYO,113-6591 JAPAN