ECRYPT

PQCrypto 2006
International Workshop on
Post-Quantum Cryptography

23–26 May 2006
Leuven, Belgium

Program committee:

Daniel J. Bernstein, University of Illinois at Chicago, USA
Johannes Buchmann, Technische Universität Darmstadt,
Germany
Jintai Ding, University of Cincinnati, USALouis Goubin, Université de Versailles, France
Tanja Lange, Danmarks Tekniske Universitet, Denmark
Phong Nguyen, École Normale Supérieure, France
Tatsuaki Okamoto, NTT Laboratories, JapanLouis Salvail, Aarhus Universitet, Denmark
Alice Silverberg, University of California at Irvine, USA
Joe Silverman, Brown University, USA
Martijn Stam, École Polytechnique Fédérale de Lausanne,
Switzerland
Christopher Wolf, École Normale Supérieure, France

Invited speakers:

Sean Hallgren, NEC Laboratories, USA
Phong Nguyen, École Normale Supérieure, France
Oded Regev, Tel-Aviv University, Israel
Nicolas Sendrier, Institut National de Recherche en
Informatique et en Automatique, France
Jacques Stern, École Normale Supérieure, France
Michael Szydlo, RSA Laboratories, USA
Lieven Vandersypen, Technische Universiteit Delft, theNetherlands

Contributors:

Koichiro Akiyama, Toshiba Corporation, Japan
Chia-Hsin Owen Chen, National Taiwan University, Taiwan
Jiun-Ming Chen, National Taiwan University / Chinese Data
Security, Inc., Taiwan
Jintai Ding, University of Cincinnati, USA
Jean-Charles Faugère, LIP6, France
Ryou Fujita, Institute of Information Security, Japan
Nicolas Gama, École Normale Supérieure, France
Yasuhiro Goto, Hokkaido University of Education, Japan
Aline Gouget, Gemplus, France
Jason Gower, University of Cincinnati, USA
Jeff Hoffstein, Brown University / NTRU Cryptosystems, USA
Nick Howgrave-Graham, NTRU Cryptosystems, USA
Lei Hu, Chinese Academy of Sciences, China
Atsushi Kanai, NTT Information Sharing Platform
Laboratories, Japan
Elham Kashefi, Institute for Quantum Computing, Canada
Iordanis Kerenidis, CNRS, Universite Paris-Sud, France
Tetsutaro Kobayashi, NTT Information Sharing Platform
Laboratories, Japan
Jianyu Li, Chinese Academy of Sciences, China
Toshiyuki Miyazawa, NTT Information Sharing Platform
Laboratories, Japan
Ichizo Nakamura, NTT Information Sharing Platform
Laboratories, Japan
Phong Nguyen, École Normale Supérieure, France
Xuyun Nie, Chinese Academy of Sciences, China
Satoshi Oda, NTT Information Sharing Platform Laboratories,
Japan
Jacques Patarin, University of Versailles, France
Ludovic Perret, Université Catholique de Louvain, Belgium
Jill Pipher, Brown University / NTRU Cryptosystems, USA
Bart Preneel, Katholieke Universiteit Leuven, Belgium
Dieter Schmidt, University of Cincinnati, USA
Joseph H. Silverman, Brown University / NTRU
Cryptosystems, USA
Kohtaro Tadaki, Chuo University, Japan
Shigeo Tsujii, Institute of Information Security, Japan
John Wagner, University of Cincinnati, USA
William Whyte, NTRU Cryptosystems, USA / Ireland
Christopher Wolf, École Normale Supérieure, France
Bo-Yin Yang, Tamkang University, Taiwan

Local organization:

Nessim KisserliÖzgül KüçükJoseph Lano
Péla Noë
Jasper Scholten
Koen Simoens
Saartje Verheyen
Christopher Wolf
Elvira Wouters

Program and table of contents:

23 May 17:20–17:30 Opening (in room 00.54)
23 May 17:30–18:20 Vandersypen: Can quantum computers be built? . . . . . . . . . . 1
23 May 18:20–19:00 Registration and reception (in room 00.62)
23 May 19:00–20:00 Reception continues
24 May 09:00–09:40 Registration (in room 01.57)
24 May 09:40–09:50 Essential information (in room 00.54)
24 May 09:50–10:40 Hallgren: Quantum algorithms . . . . . . . . . . . . . . . . . . . . . . . 3
24 May 10:40–11:10 Coffee
24 May 11:10–12:00 Szydlo: Post-quantum hash-based cryptography . . . . . . . . . . . 5
24 May 12:00–14:00 Lunch (in Alma 3)
24 May 14:00–14:30 Kashefi, Kerenidis: Statistical zero knowledge andquantum one-way functions . . . . . . . . . . . . . . . . . . . . . . . . . 7
24 May 14:30–14:45 Discussion
24 May 14:45–15:35 Stern: Post-quantum multivariate quadratic public key
schemes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
24 May 15:35–16:05 Coffee
24 May 16:05–16:35 Gouget, Patarin: Probabilistic multivariate cryptography . . . 27
24 May 16:35–16:50 Discussion
24 May 16:50–17:20 Ding, Wolf, Yang: l-invertible cycles for multivariate
quadratic public key cryptography . . . . . . . . . . . . . . . . . . . . 47
24 May 17:20–17:35 Discussion
24 May 17:35–18:05 Faugère, Perret: Polynomial equivalence problems:
algorithmic and theoretical aspects . . . . . . . . . . . . . . . . . . . 67

25 May 09:30–10:20 Regev: More quantum algorithms . . . . . . . . . . . . . . . . . . . . 85
25 May 10:20–10:50 Coffee
25 May 10:50–11:20 Ding, Hu, Nie, Li, Wagner: High order linearization
equation (HOLE) attack on multivariate public key
cryptosystems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
25 May 11:20–11:35 Discussion
25 May 11:35–12:05 Tsujii, Tadaki, Fujita: Proposal for piece in hand matrixver. 2: enhancing security of multivariate public key
cryptosystems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
25 May 12:05–14:00 Lunch (in room 01.57)
25 May 14:00–14:30 Akiyama, Goto: A public-key cryptosystem using algebraic
surfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
25 May 14:30–14:45 Discussion
25 May 14:45–15:35 Nguyen: Post-quantum lattice-based cryptography . . . . . . . 139
25 May 15:35–16:05 Coffee
25 May 16:05–16:35 Hoffstein, Howgrave-Graham, Pipher, Silverman, Whyte:
NTRUEncrypt and NTRUSign: efficient public key
algorithms for a post-quantum world . . . . . . . . . . . . . . . . . 141
25 May 16:35–16:50 Discussion
25 May 16:50–17:20 Gama, Howgrave-Graham, Nguyen: Symplectic lattice
reduction and NTRU . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
25 May 17:20–17:35 Discussion
25 May 17:35–18:05 Miyazawa, Kobayashi, Oda, Nakamura, Kanai:
Implementation of “Improved Quantum Public-Key
Cryptosystem” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
25 May 18:05–19:30 Free time
25 May 19:30–22:00 Conference dinner (in Wok Dynasty)
26 May 09:30–10:20 Sendrier: Post-quantum code-based cryptography . . . . . . . . 193
26 May 10:20–10:50 Coffee
26 May 10:50–11:20 Wolf, Preneel: Equivalent keys in multivariate quadratic
public key systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
26 May 11:20–11:35 Discussion
26 May 11:35–12:05 Chen, Yang, Chen: The limit of XL implemented withsparse matrices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
26 May 12:05–12:20 Discussion
26 May 12:20–12:50 Ding, Gower, Schmidt: Zhuang-Zi: a new algorithm forsolving multivariate polynomial equations over a finite
field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
26 May 12:50–13:00 Closing
26 May 13:00–14:15 Lunch (in Alma 3)

Can quantum computers be built?
Lieven Vandersypen
Technische Universiteit Delft

1

PQCrypto 2006 Workshop Record

Quantum algorithms
Sean Hallgren
NEC Laboratories

3

PQCrypto 2006 Workshop Record

Post-quantum hash-based cryptography
Michael Szydlo
RSA Laboratories

The Merkle-tree construction promises to offer authentication and digital signatures which areresistant to quantum attacks. One of the first proposals in public key cryptography (1979), thisconstruction relies only on a hash function for its security. While RSA and other number theory
based algorithms will succumb to efficient quantum algorithms, a hash function need not have a“number-theoretic” basis. Without this structure, a quantum Fourier transform based algorithm
seems less likely to appear. In this talk we will review the Merkle tree constructions and focus
on recent advances which make the Merkle-tree construction more efficient and practical. We
explain the space-time tradeoffs inherent in the Merkle construction, which historically made themless appealing than other authentication and digital signature schemes. However, we suggest thatrecent efficiency improvements render Merkle trees more practical today, and the threat of quantum
algorithms makes this well accepted construction even more appealing.

5

PQCrypto 2006 Workshop Record

Statistical Zero Knowledge and quantum one-way functions
Elham Kashefi
IQC - University of Waterloo &Christ Church - University of Oxford
ekashefi@iqc.ca

Iordanis Kerenidis
Dept. of Mathematics
MIT
jkeren@math.mit.edu

May 2, 2006

Abstract
One-way functions are a fundamental notion in cryptography, since they are the necessary
condition for the existence of secure encryption schemes. Most examples of such functions,
including factoring, discrete Logarithm or the RSA function, can be, however, inverted with thehelp of a quantum computer. Hence, it is very important to study the possibility of quantum
one-way functions, i.e. functions which are easily computable by a classical algorithm but are
hard to invert even by a quantum adversary. In this paper, we provide for the first time a setof problems that are good candidates for quantum one-way functions. These problems include
Graph Non-Isomorphism, approximate Closest Lattice Vector and Group Non-Membership.
More generally, we show that any hard instance of Circuit Quantum Sampling gives rise to aquantum one-way function. By the work of Aharonov and Ta-Shma [2], this implies that any
language in Statistical Zero Knowledge which is hard-on-average for quantum computers, leads
to a quantum one-way function. Moreover, extending the result of Impagliazzo and Luby [9] tothe quantum setting, we prove that quantum distributionally one-way functions are equivalent
to quantum one-way functions.

1

Introduction

One-way functions are at the core of modern cryptography. The fundamental task of cryptography
is that of secure encryption of information against malicious parties. The existence of such secure
encryption schemes implies that there is an efficient way of generating instances of problems together
with some auxiliary information, such that it is easy to solve these instances with the help of theauxiliary information but hard to solve on average without it.
This concept is exactly captured by the definition of one-way functions, which are the necessary
condition for the existence of cryptography. Moreover, one-way functions have many theoreticalapplications, for example in their connections to cryptographic primitives like bit commitment andoblivious transfer, Zero Knowledge Proof Systems and pseudorandom generators.
However, proving that one-way functions exist would imply that P 6= NP and hence, we only
have “candidate” one-way functions. Such candidate problems include Factoring, Discrete Logarithm, Graph Isomorphism, Quadratic Residuosity, approximate Shortest Vector and Closest Vector
and the RSA function. These problems seem to belong to a class called NP-Intermediate, i.e. they
are NP problems for which we do not know any efficient algorithm, but they don’t seem to be NPhard. Moreover, many of the candidate problems belong to the class of Statistical Zero Knowledge(SZK). In fact, Ostrovsky [15] showed that if SZK contains any hard-on-average problem, then
one-way functions exist.

7

PQCrypto 2006 Workshop RecordKashefi, Kerenidis

The emergence of quantum computation and communication has provided the field of cryptography with many new strengths and challenges. The possibility of unconditionally secure key
distribution shows that the laws of quantum mechanics can allow for the secure transmission of information over quantum channels. Moreover, Shor’s celebrated algorithm for factoring and discrete
logarithm implies that many classical one-way functions and hence cryptosystems, including RSA,
will not be secure against quantum adversaries. It is a very important question to ask whether we
can construct cryptosystems which are secure even against quantum attacks. To this end, we needto find good candidates for quantum one-way functions, i.e. functions which are easily computable
by a classical algorithm but hard to invert even by a quantum adversary.
Several other applications of quantum one-way functions have also been studied in a series of
papers. For example, the connections between quantum one-way functions and quantum computationally secure bit commitment schemes were explored in [4, 1, 3]. On the other hand, Gottesmanet.al. [6] proposed a digital signature scheme based on a quantum one-way function with classicalinputs but quantum outputs and proved the informational security of their protocol. Moreover,
Kashefi et.al. [10] and Kawachi et.al. [11] presented a necessary and sufficient condition for testing
the one-wayness of a given permutation in the quantum setting based on the efficiency of constructing a family of reflection operators. Recently, Watrous [18] proved that several classical interactive
proof systems are statistically zero-knowledge against quantum attacks. In addition, he showedthat Computational Zero Knowledge against quantum attacks for NP is implied by the existenceof quantum one-way permutations.
Despite the importance of the applications of quantum one-way functions, there had been no
results so far that provided good candidate problems. Here, we prove the quantum analogue ofOstrovsky’s result and show that if there exists a problem in Statistical Zero Knowledge which is
hard-on-average for a quantum computer, then quantum one-way functions exist. This is the first
result that provides a set of problems that are good candidates for quantum one-way functions.
The key insight in our result is the connection of quantum one-way functions to the problem
of Circuit Quantum Sampling. Informally speaking, quantum sampling is the ability to prepare
efficiently a superposition that corresponds to a samplable classical probability distributions, i.e. asuperposition whose amplitudes are the square roots of the probabilities of a classical distribution
from which one can efficiently sample. The hardness of this task depends on the structure of theunderlying set. For example, it is well known that being able to quantumly sample from the setof homomorphisms of a given input graph is sufficient to solve the notorious Graph Isomorphism
problem. Aharanov and Ta-shma [2] have introduced this framework of circuit quantum sampling
and have shown that many problems in quantum computation, including Graph Isomorphism,
Discrete Logarithm, Quadratic Residuosity and approximate Closest Lattice Vector (CVP), are all
instances of it.
We relate the problem of quantum sampling to quantum one-way functions by giving a simple
proof that any hard instance of the quantum sampling problem implies the existence of a quantum
one-way function. We first prove our results for the case of one-to-one one-way functions, theexistence of which seems to be a stronger assumption than that of general one-way functions.
Then, we generalize our results for many-to-one one-way functions. We show that a hard instanceof the CQS problem implies a quantum distributionally one-way function and then prove that aquantum distributionally one-way function implies a quantum one-way function. The notion ofclassical distributionally one-way functions was introduced by Impagliazzo-Luby in [9], where theyalso prove their equivalence to classical one-way functions.
Aharonov and Ta-Shma showed that any Statistical Zero Knowledge language (SZK) can be
reduced to a family of instances of the CQS problem. Using our result that a hard instance of CQS

PQCrypto 2006 Workshop Record

8Statistical zero knowledge and quantum one-way functions

implies the existence of a quantum one-way function, we conclude that if there exists a languagein Statistical Zero Knowledge which is hard-on-average, then quantum one-way functions exist.

2

Preliminaries

In this section we provide a brief overview of classical one-way functions and quantum computation.
For an excellent exposition on quantum computation we refer the reader to [14] and for one-way
functions to [5].

2.1Classical one-way functions

Definition 1 A function f : {0, 1}∗ → {0, 1}∗ is a one-way function, if the following conditions
are satisfied:(i) easy to compute: f can be computed by a polynomial size classical circuit.
(ii) hard to invert: There exists a polynomial p(·) such that for any probabilistic polynomial timealgorithm I and for all sufficiently large n ∈ N,
1 X
1Prob[I(f (x), 1n ) ∈ f −1 (f (x))] ≤ 1 −
2n
p(n)
n
x∈{0,1}

A classical one-way function f is defined in terms of uniform family of functions fn , one for each
input length n. The inverter I of the function takes as input the value f (x) and the size n in unary.
For simplicity, in the following definitions we omit the parameter n. One can also assume, without
loss of generality that the function f , is length regular i.e. for every x, y ∈ {0, 1}∗ , if |x| = |y| then|f (x)| = |f (y)| and length preserving i.e. for every x ∈ {0, 1}∗ , |f (x)| = |x| (see [5]).
Furthermore, Impagliazzo and Luby [9] defined a seemingly weaker notion of one-wayness formany-to-one functions, called distributionally one-way function, and proved that, in fact, the existence of a distributionally one-way function implies the existence of a one-way function.
Definition 2 A function f : {0, 1}∗ → {0, 1}∗ is a distributionally one-way function, if the following conditions are satisfied:(i) easy to compute: f can be computed by a polynomial size classical circuit.
(ii) hard to sample: There exists a polynomial p(·) such that for any probabilistic polynomial timealgorithm S and for all sufficiently large n ∈ N, the distribution defined by (x, f (x)) and the1
distribution defined by (S(f (x)), f (x)) are statistically distinguishable by at least p(n)whennx ∈ {0, 1} is chosen uniformly.

2.2

Quantum Computation

Let H denote a 2-dimensional complex vector space, equipped with the standard inner product. We
pick an orthonormal basis for thislabel space, the two basis vectors |0i and |1i, and for simplicity
10
identify them with the vectors
and, respectively. A qubit is a unit length vector in
0
1
this space, and so can be expressed as a linear combination of the basis states:α0
α0 |0i + α1 |1i =.
α1

9

PQCrypto 2006 Workshop RecordKashefi, Kerenidis

Here α0 , α1 are complex amplitudes, and |α0 |2 + |α1 |2 = 1.
An m-qubit system is a unit vector in the m-fold tensor space H ⊗ · · · ⊗ H. The 2m basis statesof this space are the m-fold tensor products of the states |0i and |1i. For example, the basis statesof a 2-qubit system are the four 4-dimensional unit vectors |0i ⊗ |0i, |0i ⊗ |1i, |1i ⊗ |0i, and |1i ⊗ |1i.
We abbreviate, e.g. , |1i ⊗ |0i to |0i|1i, or |1, 0i, or |10i, or even |2i (since 2 is 10 in binary). With
these basis states, an m-qubit state |φi is a 2m -dimensional complex unit vector
X
αi |ii.
|φi =i∈{0,1}m

We use hφ| = |φi∗ to denote the conjugate transpose of the vector |φi, and (φ , ψ) = hφ| · |ψi for
the inner product between
states |φi and |ψi. These two states are orthogonal if (φ , ψ) = 0. Thepnorm of |φi is kφk = |(φ , φ)|.
A quantum state can evolve by a unitary operation or by a measurement. A unitary transformation is a linear mapping that preserves the `2 norm. If we apply a unitary U to a state |φi, it
evolves to U |φi.
The most general measurement allowed by quantum mechanics is specified by a family
P of positive
semidefinite operators Ei = Mi∗ Mi , 1 ≤ i ≤ k, subject to the condition thati Ei = I. A
projective measurement is defined in the special case where the operators are projections. Let|φi be an m-qubit state and B = {|b1 i, . . . , |b2m i} an orthonormal basis of the m-qubit space. A
projective measurement of the state |φi in the B basis means that we apply the projection operators
Pi = |bi ihbi | to |φi. The resulting quantum state is |bi i with probability pi = |(φ , bi )|2 .

2.3

Quantum SamplingLet {Ci } be a uniform classical circuit family and for every input size n define DCn to be thenmdistribution over outputs ofPthe circuit
p Cn : {0, 1} → {0, 1} when the input distribution is
uniform. Denote by |Cn i = z∈{0,1}m DCn (z)|zi, the quantum sample of outputs of Cn .
Definition 3 Given a uniform family of classical circuit {Ci } and a real number 0 ≤  < 21 , define
QSC to be an efficient quantum circuit which for any sufficiently large input size n, prepares a statethat is -close to the quantum sample |Cn i, i.e. |(QSC (|0i, 1n ) , |Cn i)|2 ≥ 1 − .
The problem of finding such a quantum circuit QSC for any given uniform family of classicalcircuits {Ci } was introduced by Aharanov and Ta-shma in [2], as the Circuit Quantum Sampling
Problem (CQS). In fact, they defined CQS as |QSC (|0i, 1n ) − |Cn i| ≤ , however both definitions
suffice for the proof that Statistical Zero Knowledge reduces to a family of instances of the CQS
problem. We say that the quantum sampling problem for {Ci } is hard if there exists no efficient
QS for any constant  ∈ [0, 1/2].

3

Definitions of quantum one-way functions

A quantum one-way function is defined similarly to the classical case, where now the inverter I isa polynomial size uniform quantum circuit family. For clarity, we follow again the convention ofomiting the parameter of the input size n.
Definition 4 A one-to-one function f : {0, 1}∗ → {0, 1}∗ is a quantum one-way function, if thefollowing conditions are satisfied:

PQCrypto 2006 Workshop Record

10Statistical zero knowledge and quantum one-way functions(i) easy to compute: f can be computed by a polynomial size classical circuit.
(ii) hard to invert: There exists a polynomial p(·) such that for any quantum polynomial timealgorithm I and all sufficiently large n ∈ N,
12n

X

Prob[I(f (x)) ∈ f −1 (f (x))] ≤ 1 −x∈{0,1}n1p(n)In the quantum case, the probability of success of the inverter I is defined as the square of theinner product between the outcome of I and the outcome of the perfect inverter P , where
P : |f (x)i|βi 7→ |f (x)i|x ⊕ βi
In other words, for the case of one-to-one functions
Prob[I(f (x)) ∈ f −1 (f (x))] = Prob[I(f (x)) = x] = |(I(|f (x)i|βi) , |f (x)i|x ⊕ βi)|2 .
One can also define another type of average case quantum one-way function (called strong oneway function), where we require that any quantum algorithm inverts the function with negligible
probability (instead of just failing with non-negligible probability). However, similar to the classicalcase, if there exists a weak quantum one-way function (Definition 4), then there exists a strong
quantum one-way function as well [7, 5, 10].
We now provide an alternative definition for a one-to-one quantum one-way function, which
is more suitable for constructing the relation between quantum one-way functions and the CQS
problems and prove the equivalence of the two definitions.
Definition 5 A one-to-one function f : {0, 1}∗ → {0, 1}∗ is a quantum one-way function if:(i) f can be computed by a polynomial size classical circuit.
(ii) There exists a polynomial p(·) such that there exists no quantum polynomial time algorithm
I 0 with the property that for all sufficiently large n ∈ N:
I 0 : |f (x)i|βi 7→ af (x) |f (x)i|x ⊕ βi + bf (x) |f (x)i|Gf (x) iwhere Gf (x) is a garbage state, 21n
bers.

(1)

1
2
x∈{0,1}n af (x) ≥ 1 − p(n) and af (x) are positive real num-P

It is clear that definition 4 implies definition 5 and we also prove the converse:
Theorem 1 If a one-to-one function f is quantum one-way according to definition 5, then it isalso quantum one-way according to definition 4.
Proof.
Let f : {0, 1}∗ → {0, 1}∗ be a quantum one-way function according to definition 5.
Assume for contradiction that this function is not one-way according to definition 4. Then, for all
polynomials p(·) there exists a quantum polynomial time algorithm I 0 with the property that for
all sufficiently large n ∈ N:
12n

X

Prob[I(f (x)) ∈ f −1 (f (x))] ≥ 1 −x∈{0,1}n

11

1
p(n)

PQCrypto 2006 Workshop RecordKashefi, Kerenidis

or equivalently
I : |f (x)i|βi 7→ cf (x) |f (x)i|x ⊕ βi + df (x) |ψf (x) i

(2)

P
1
. Without loss of generality wewhere |ψf (x) i is a garbage state and 21n x∈{0,1}n |cf (x) |2 ≥ 1 − p(n)can assume that cf (x) are real numbers. We use this inverter to construct the following unitarythat achieves the positive amplitudes. For clarity, here and in subsequent places in the paper weonly show the unitary construction for the case where the ancilla registers are set to |0i, unless thegeneral ancilla state is required for the construction. It is clear of course how to unitarily extend
the |0i ancilla to the other basis states.
|f (x)i|0i|0i|0i →(CNOT)1,3
→I1,2
→I3,4
→(CNOT)1,3 (CNOT)2,4|f (x)i|0i|f (x)i|0i(cf (x) |f (x)i|xi + df (x) |ψf (x) i)|f (x)i|0i
c2f (x) |f (x)i|xi|f (x)i|xi + cf (x) df (x) |f (x)i|xi|ψf (x) i+
df (x) cf (x) |ψf (x) i|f (x)i|xi + d2f (x) |ψf (x) i|ψf (x) ic2f (x) |f (x)i|xi|0i|0i + bf (x) |ψf0 (x) iwhere |ψf0 (x) i is the new garbage state, orthogonal to the ideal state |f (x)i|xi|0i|0i and by the factthat the average of the squares is larger than the square of the average we have
1 P
1 P
1 2
1
4
2
2
x∈{0,1}n cf (x) ≥ ( 2nx∈{0,1}n cf (x) ) ≥ (1 − p(n) ) ≥ 1 − p0 (n)2nHence we have a new inverter
I 0 : |f (x)i|βi 7→ af (x) |f (x)i|x ⊕ βi + bf (x) |ψf0 (x) i

(3)

P
1
with 21n x∈{0,1}n a2f (x) ≥ 1 − p(n)and af (x) = c2f (x) being positive real numbers. Finally, we canobtain the required form of the garbage state:|f (x)i|0i|0i →(CNOT)1,2
0→I2,3→(CNOT)1,2|f (x)i|f (x)i|0i
af (x) |f (x)i|f (x)i|xi + bf (x) |f (x)i|ψf0 (x) iaf (x) |f (x)i|0i|xi + bf (x) |f (x)i|Gf (x) i

We reached a contradiction and therefore the function f is one-way according to definition 4. Notethat for simplicity of presentation we dropped the |0i registers that are constant for all x.
2
In the standard definition, a many-to-one function is called one-way if there exists no inverter
that outputs with high probability an arbitrary preimage of f (x). For many-to-one functions,
Impagliazzo-Luby [9] defined a seemingly weaker notion, the distributionally one-way function. In
this case, an inverter is required to output a random preimage of f (x) and not just an arbitrary
one. However, they prove that, in fact, the existence of a distributionally one-way function implies
the existence of a one-way function. We also define quantum distributionally one-wayness formany-to-one functions and will prove its equivalence to the quantum one-way functions.
Definition 6 A many-to-one function f : {0, 1}∗ → {0, 1}∗ is a quantum distributionally one-way
function, if the following conditions are satisfied:(i) f can be computed by a polynomial size classical circuit.

PQCrypto 2006 Workshop Record

12Statistical zero knowledge and quantum one-way functions(ii) hard to invert: There exists a polynomial p(·) such that for any quantum polynomial timealgorithm S and all sufficiently large n ∈ N,
12nXx∈{0,1}nwhere |Hf (x) i = √ −11|f|(S(|f (x)i|0i) , |f (x)i|Hf (x) i)|2 ≤ 1 −(f (x))|

1
,
p(n)

P

x∈f −1 (f (x)) |xi.

Note that one could potentially consider different definitions for quantum distributionally one-way
functions, for example the quantum inverter could return a superposition with equal amplitudes
but different phases. We believe that our quantum definition captures the essence of the classicalone and moreover, we only use the above notion as an intermediate step in our proofs. Similar tothe case of one-to-one functions we also give an equivalent definition
Definition 7 A many-to-one function f : {0, 1}∗ → {0, 1}∗ is a quantum distributionally one-way
function if:(i) f can be computed by a polynomial size classical circuit.
(ii) There exists a polynomial p such that there exists no quantum polynomial time algorithm S 0
with the property for all sufficiently large n ∈ N
S 0 : |f (x)i|0i 7→ af (x) |f (x)i|Hf (x) i + bf (x) |f (x)i|Gf (x) i

(4)

P
1
where |Gf (x) i is a garbage state, 21n x∈{0,1}n a2f (x) ≥ 1 − p(n), af (x) are positive real numbers
P1|xi.
and |Hf (x) i = √ −1x∈f −1 (f (x))|f(f (x))|

We can easily extend the above algorithm S 0 into a unitary operation by mapping every other basisnstate |f (x)i|βi to |f (x)i|Tfβ(x) i, where the set {|Hf (x) i, Tf1(x) , . . . , Tf2(x)−1 } is any orthonormal basis.
Following the same steps as in the proof of Theorem 1 we have that
Theorem 2 If a many-to-one function f is quantum one-way according to definition 7, then it isalso quantum one-way according to definition 6.

4

Circuit quantum sampling and one-way functions

In this section, we show that hard instances of the Circuit Quantum Sampling problem are goodcandidates for quantum one-way functions.

4.1

One-to-one one-way functions

We first focus our attention to the case of one-to-one one-way functions. The existence of one-to-one
one-way functions is a seemingly stronger assumption than that of the existence of general oneway functions, since a one-way function doesn’t immediately imply a one-to-one one-way function.
However, this case illustrates the main ideas of our construction. In the following sections, we
generalize our results for the case of many-to-one functions.

13

PQCrypto 2006 Workshop RecordKashefi, Kerenidis

Theorem 3 Assume for a classical circuit family {Cn }, which computes a one-to-one function,
the corresponding CQS problem is hard , i.e. there exists no efficient quantum circuit implementing
QSC . Then the function f : {0, 1}∗ → {0, 1}∗ which is defined for every input size n as fn : x 7→
Cn (x) is a quantum one-way function.
Proof. For clarity, we are going to omit the parameter of the input size n from the inverter.
Since, the circuit is efficient, one can implement the unitary map
Uf : |xi|0i 7→ |xi|f (x)i(5)

The theorem follows by proving the contrapositive. Assume that f is not a quantum one-way
function. Then according to definition 5, for every polynomial p there exists a quantum circuit I 0
which succeeds in approximately inverting f , i.e. for all sufficiently large n ∈ N we haveI 0 : |f (x)i|βi 7→ af (x) |f (x)i|x ⊕ βi + bf (x) |f (x)i|Gf (x) iwhere |Gf (x) i is a garbage state, 21nequations 5 and 6 we have:

(6)

1
2
x af (x) > 1 − p(n) and the af (x) ’s are positive.

P

Now, from|xi|f (x)i|xi|0i →Uf→SWAP |f (x)i|xi
0→I 0
af (x) |f (x)i|0i + bf (x) |f (x)i|Gf (x) iStarting with a uniform superposition of x ∈ {0, 1}n we have
1
2n/2

X

|xi|0i →x∈{0,1}n

1 X
2n/2

0

( af (x) |f (x)i|0i + bf (x) |f (x)i|Gf (x) i ) ≡ |Qn ix

We claim that theabove circuit that on input (|0i, 1n ) outputs |Qn i is a quantum sampler for
1 P
C. Let |Cn i = 2n/2 x |f (x)i|0i be the quantum sample of the circuit C, then
1 X
1 X 2 2|hQn |Cn i|2 = | n
af (x) |2 ≥ | na| > (1 − 1/p(n))2 > 1 − .
2 x
2 x f (x)This is a contradiction to C being a hard instance of the CQS problem and hence f is a quantum
one-way function.
2

4.2

Many-to-one one-way functions

The previous section dealt with the case of one-to-one one-way functions. Here, we generalize ourresults to the case of many-to-one functions. We show that the existence of a hard instance of
CQS problem, where the circuit family {Cn } is many-to-one, implies the existence of a quantum
distributionally one-way function. In the next section we prove that a quantum distributionallyone-way function implies a quantum one-way function.
Theorem 4 Assume for a classical circuit family {Cn }, which computes a many-to-one function,
the corresponding CQS problem is hard , i.e. there exists no efficient quantum circuit implementing
QSC . Then the function f : {0, 1}∗ → {0, 1}∗ which is defined for every input size n as fn : x 7→
Cn (x) is a quantum distributionally one-way function.

PQCrypto 2006 Workshop Record

14Statistical zero knowledge and quantum one-way functions

Proof. Since the classical circuit is efficient one can implement the unitary map
Uf : |xi|0i 7→ |xi|f (x)iAssume that f is not a quantum distributional one-way, then according to definition 7 for every
polynomial p there exists a quantum polynomial time algorithm S 0 which succeeds in approximately
implementing a sampler for f , i.e. for all sufficiently large n ∈ N we have
S 0 : |f (x)i|0i 7→ af (x) |f (x)i|Hf (x) i + bf (x) |f (x)i|Gf (x) iwhere 21n(7)

12x∈{0,1}n af (x) > 1 − p(n) and the af (x) ’s are positive.

P

Using the above unitaries, we can construct a quantum sampler QSC that for every input nconstructs a quantum sample for Cn :1

X
x∈{0,1}n2|xi|0i
n/2

X

≡

p

|f −1 (f (x))||Hf (x) i|0i
2n/2

f (x)

→Uf

X

p

|f −1 (f (x))||Hf (x) i|f (x)i
2n/2

f (x)

→SWAP

X

p

|f −1 (f (x))||f (x)i|Hf (x) i
2n/2

f (x)

→S 0

X
f (x)

p

|f −1 (f (x))|( af (x) |f (x)i|0i + bf |f (x)i|Gf (x) i) ≡ |Qn i
2n/2

The quantum sample for the circuit Cn is |Cn i =proof of Theorem 3:|hQn |Cn i|2 = |X |f −1 (f (x))|
f (x)

2n

1
af (x) |2 = | n2Xx∈{0,1}

P

√ −1
|f

f (x)

1
af (x) |2 ≥ | n
2n(f (x))||f (x)i|0i.
2n/2XSimilarly to thea2f (x) |2 > (1−1/p(n))2 > 1−.

x∈{0,1}nThis is a contradiction and hence, f is a quantum distributionally one-way function.

4.3

2

From quantum distributionally one-way functions to quantum one-way functions

In the classical setting, Impagliazzo and Luby [9] proved that the existence of a distributionallyone-way function implies the existence of a one-way function. In this section, we describe the mainideas of their construction and show how to prove the equivalent result in the quantum setting.
Theorem 5 If there exists a quantum distributionally one-way function then there exists a quantum
one-way function.

15

PQCrypto 2006 Workshop RecordKashefi, Kerenidis

4.3.1

The Impagliazzo-Luby construction

Let f : {0, 1}∗ → {0, 1}∗ be a candidate distributionally one-way function. Then, there exists afunctions g such that an inverter I for g implies the existence of a sampler S for f . Without lossof generality the inverter for g outputs ⊥ when it’s given as input something which is not in theimage of g.
Lets us fix the size of input to n, this can be done as we are working with a uniform circuit
family. Now, in order to make the ideas of the construction clear, first assume that for a given f (x)we know the size of the preimage |f −1 (f (x))| and let k = blog |f −1 (f (x))|c + O(log n). We define
the function g asg(x, hk ) = (f (x), hk , hk (x))
In other words, g takes as inputs an x and a random string hk which can be thought of as a randomhash function hk : {0, 1}n → {0, 1}k . The output of g is the value f (x), the random hash function
and the output of the hash function on x.
There are two observations to be made about the random hash function. First, since the rangeof the hash function is slightly larger than the number of x’s in the preimage of f (x), with highprobability the mapping x 7→ hk (x) for {x ∈ f −1 (f (x))} is a one-to-one mapping. This implies,that if we could pick uniformly an element from the set {hk (x)|x ∈ f −1 (f (x))} then the inverter ofg on input (f (x), hk , hk (x)) would return a uniform x ∈ f −1 (f (x)).
Second, it’s indeed possible to pick a uniform element of the set {hk (x)|x ∈ f −1 (f (x))}. Since
the range of the hash function is not too much larger than the size of the preimage of f (x), if
we pick a random element rk ∈ {0, 1}k , then with non negligible probability rk = hk (x) for somex ∈ f −1 (f (x)).
The above two properties enable one to prove that, when one knows the size of the preimage off (x), the following procedure is a sampler for f (x):Partial Sampler PS(f(x),k)
Repeat a polynomial number of times
Pick a random hash function hk and rk ∈ {0, 1}k .
If I(f (x), hk , rk ) 6=⊥ then output it and exit.
Output ⊥The only remaining issue is that the sampler doesn’t know the size of the preimage of f (x).
Suppose we pick the range of the hash function to be much larger than the actual size of the preimageof f (x). Then the above sampler outputs ⊥ with very high probability. However, conditioned on
it producing an output x, then this x is still almost uniformly distributed in {f −1 (f (x))}. This istrue since the hash function randomly hashes |f −1 (f (x))| values of x to a much larger range, andtherefore, the mapping is with very high probability one-to-one.
Hence, we can construct a sampler for f by starting with the largest possible value for the rangeof the hash function and keep decreasing it until there is an outcome:
Sampler S(f(x))
For j = n + O(log n) to O(log):
If P S(f (x), j) 6=⊥ output it and exit.
Output ⊥.
The analysis of the sampler for f is based on two observations. First, as we already said, if the

PQCrypto 2006 Workshop Record

16Statistical zero knowledge and quantum one-way functions

sampler produces an output for a j ≥ k, then this x is guaranteed to be almost uniform. Second,
the probability that the sampler actually produces an output for j ≥ k is, in fact, very close to 1.
Impagliazzo and Luby make this argument rigorous in [9], taking also into account the fact thatthe inverter I of g is not perfect. Picking the right parameters in their construction, we have
Lemma 1 [9] Let pj be the probability that the Partial Sampler P S(f (x), j) produces a legal output.
Then, for all j ≥ k = blog |f −1 (f (x))|c + log n 2k−j !
 2k−j1
1(1 − o(1)) 1 −≤ pj ≤ 1 −
n
n
4.3.2

The construction of the Quantum Sampler

Here, we reproduce the Impagliazzo-Luby construction in the quantum setting. As before, let
f : {0, 1}∗ → {0, 1}∗ be the candidate quantum distributionally one-way function, fix the input size
to be n, and define g(x, hk ) = (f (x), hk , hk (x)). Assuming that we have a quantum inverter I forg, our goal is to construct a quantum sampler for f , namely the following unitary
QSampler: |f (x)i|0i 7→ af (x) |f (x)i|Hf (x) i + bf (x) |Gf (x) i,
where 21n2
x∈{0,1}n af (x) ≥ 1 − o(1) and |Hf (x) iP= √ −11|fP(f (x))|x∈f −1 (f (x)) |xi.

First, we assume that for a given f (x) we know the size of the preimage |f −1 (f (x))| andk = blog |f −1 (f (x))|c + O(log n). The following unitary operations are the quantum equivalents ofpicking a random hash function hk and a random string rk ∈ {0, 1}k and are efficiently constructible:
X
X
Q : |ki|0i → |ki|hk i , B : |ki|0i → |ki
|rk i
rk

hk

Moreover, we describe the quantum inverter of g as
|f (x)i|hk i|hk (x)i|0i|0i → |f (x)i|hk i|hk (x)i|xi|0i
I :|f (x)i|hk i|sk i|0i|0i→ |f (x)i|hk i|sk i|0i|1iwhere the random strings rk have been divided into hk (x), which are the strings such that there
is a unique x ∈ f −1 (f (x)) mapped to hk (x) and sk , which are the strings for which there is nox ∈ f −1 (f (x)) mapped to sk . The error parameter → accounts for the errors of the Inverter,
including the cases where more than one x is mapped to the same hk (x). The last register in I acts
as an “error flag”. Last, recall that hk is an efficient hash function and hence, having |hk i and |xi
one can efficiently compute |hk (x)i and construct the following unitary:
T : |hk i|hk (x)i|xi → |hk i|0i|xi
We are now ready to define a partial quantum sampler for f (x), when we know the size of its
preimage. Denote by pk,f (x) the probability that the perfect inverter would return a legal output
for given values of f (x), k. In the following, we drop the second subscript and have pk = pk,f (x) .

17

PQCrypto 2006 Workshop RecordKashefi, Kerenidis

Partial Quantum Sampler PQS(f(x),k)|f (x)i|ki|0i|0i|0i|0i
Q3 ⊗B4→|f (x)i|ki

X|hk i|rk i|0i|0i(i)

hk ,rkI1,3,4,5→√

pk |f (x)i|ki

X|hk i|hk (x)i|xi|0i +Xp|hk i|sk i|0i|1i
1 − pk |f (x)i|ki

T3,4,5→√

pk |f (x)i|ki

X|hk i|0i→√X

pk |f (x)i|ki|0i|0i|Hf (x) i|0i +where |Hf (x) i = √ −11|f(f (x))||xi|0i +Xp|hk i|sk i|0i|1i (iii)
1 − pk |f (x)i|kix∈f −1 (f (x))

hk
Q†3

P

(ii)

hk ,skhk ,hk (x)hk ,skp
1 − pk |f (x)i|ki|Gf (x),k i|1ix∈f −1 (f (x)) |xi.

(iv)

In the first step, we construct a uniform super-

position of all possible hash functions hk and random strings rk ∈ {0, 1}k . In the second step,
we perform the Inverter of g. If the inverter was perfect and the mapping x 7→ hk (x) was truly
one-to-one, then the state would be exactly the one in (ii). The first term corresponds to the strings
rk ∈ {0, 1}k such that rk = hk (x) for a unique x ∈ f −1 (f (x)) and this happens with probability
pk . The second term corresponds to the rest of the strings. The error parameter  accounts forthe errors of the Inverter and the fact that the mapping is not exactly one-to-one. In the third
step, we uncompute hk (x) and in the last step we uncompute the superposition of hk . The final
state in the perfect case consists of two terms. The first one is |f (x)i|ki|Hf (x) i, where the third
register contains a uniform superposition of the preimages of f (x) and the second term denotesthat the Sampler has failed (“error flag” register is 1). The norm of the first term is pk , which isthe probability that the inverter outputs a legal output for the given values k, f (x).
Our partial quantum sampler imitates exactly the Impagliazzo-Luby one and hence we canuse their analysis to show rigorously that conditioned on our sampler not failing, the actual state
produced at the end is very close to the state |f (x)i|ki|Hf (x) i. Moreover, since we picked k =blog |f −1 (f (x))|c + O(log n) the norm of the term |f (x)i|ki|Hf (x) i is not negligible.
Though the classical and quantum partial samplers seem identical, there is, in fact, a difference.
In the above procedure, for superposition inputs, different values of |ki and |f (x)i get entangled
and so the naive way of implementing the classical sampler S(f (x)) as a quantum circuit will
fail. This can be overcome by applying the classical procedure in a “clean” way i.e. garbage-freewhere the garbage in this case is the |ki register. However, since the classical procedure consistsof a “While Loop” (a loop with an exit command) the procedure of un-computing the garbage ismore demanding than the usual case where one deals with a “For Loop”. To do so, instead of
implementing the while loop of the classical algorithm we prepare a weighted superposition of all
k’s as an ancilla register which then leads to our garbage-free quantum sampler.
First we construct a partial ancilla preparation circuit for the case where the value of k is
known. Basically, we apply our partial quantum sampler twice in order to “clean” the register that
contains |H(f (x))i, while copying the “error flag” in between.

PQCrypto 2006 Workshop Record

18Statistical zero knowledge and quantum one-way functions

Partial Ancilla Preparation, PAP(f(x),k)

P QS(f (x),k)→(ctrl−NOT)4,5→
P QS(f (x),k)†

→
+
=
=

|f (x)i|ki|0i|0i|0ip√
pk |f (x)i|ki|Hf (x) i|0i|0i + 1 − pk |f (x)i|ki|Gf (x),k i|1i|0ip√
pk |f (x)i|ki|Hf (x) i|0i|0i + 1 − pk |f (x)i|ki|Gf (x),k i|1i|1i
p√ √
pk pk |f (x)i|ki|0i|0i + 1 − pk |f (x)i|ki|00i⊥ |0ipp√
1 − pk1 − pk |f (x)i|ki|0i|0i + pk |f (x)i|ki|00i⊥ |1ipp|f (x)i|ki|0i|0i pk |0i + (1 − pk )|1i + |f (x)i|ki|00i⊥ ( pk (1 − pk )|0i + pk (1 − pk )|1i)|f (x)i|ki pk |0i + (1 − pk )|1i |0i + |f (x)i|Gf,k i|1i

In the last equation we have just rearranged the registers and put the “error flag” register at theend. We are now going to describe a circuit for the ancilla preparation when we start our algorithm
for a large value of k and decrease it at each step by one. For clarity, the quantum registers containthe values n to 1 instead of n + O(log n) to O(log n) which are the real values for which the Sampler is run. Furthermore, all the operations are controlled by the “error flag” being the last register.
Ancilla Preparation AP(f(x))

P AP1,2,3→

ctr3 −P AP 1,4,5→|f (x)i|ni|0i|n − 1i|0i · · · |1i|0i|0i|f (x)i|ni pn |0i + (1 − pn )|1i |n − 1i|0i · · · |1i|0i|0i + |Gi|1i|f (x)i|nipn |0i|n − 1i|0i · · · |1i|0i|0i +|f (x)i|ni(1 − pn )|1i|n − 1i pn−1 |0i + (1 − pn−1 )|1i · · · |1i|0i|0i +|G0 i|1i

ctr5 −P AP 1,6,7→|f (x)i|nipn |0i|n − 1i|0i · · · |1i|0i|0i +|f (x)i|ni(1 − pn )|1i|n − 1ipn−1 |0i · · · |1i|0i|0i +|f (x)i|ni(1 − pn )|1i|n − 1i(1 − pn−1 )|1i|n − 2i pn−2 |0i + (1 − pn−2 )|1i · · · |1i|0i|0i +|G00 i|1i..
.
→|f (x)i|ni · · · |1iX

qj |ji|0i + |Gf i|1ijQ
where qj = j−1
i=1 (1 − pi )pj is the probability that the sampler P QS succeeds at the j-th roundand has failed on all previous rounds. Since the registers that contain the values n to 1 are notentangled with f (x) we can ignore them and haveX
AP : |f (x)i|0i|0i 7→ |f (x)iqj |ji|0i + |Gf i|1ij

Now we can present the garbage-free quantum sampler for the general case where we don’tknow the size of the pre-image for a given f (x). For clarity, we don’t explicitly write down all the19

PQCrypto 2006 Workshop RecordKashefi, Kerenidis

necessary |0i registers in every step and also all the unitaries are performed when the “error flag”
is 0.
Quantum Sampler, QS(f(x))

AP→|f (x)i|0i|0i
X|f (x)iqj |ji|0i + |G1f (x) i|1ij

P QS

|f (x)iX=|f (x)i

X

AP †

X

→

√

p
qj |ji pj |Hf (x) i|0i + 1 − pj |G2f (x),j i|1i |0i + |G1f (x) i|1ij√qj pj |ji|Hf (x) i|0i + |G3f (x) i|1ij→√
qj2 pj |f (x)i|Hf (x) i|0i + |G4f (x) i|1ijwhere the last step follows from the unitarity of AP † , i.e. from|f (x)iX

qj |ji|0i + |G1f (x) i|1iAP †√qj pj |ji|0i

AP †

→

|f (x)i|0i|0ij|f (x)iX→

α|f (x)i|0i|0i + β|Gi|1i

j



 P
P
P √
√
we conclude that α = hf (x)| j qj hj|h0| + hG1f (x) |h1| |f (x)i j qj pj |ji|0i = j qj2 pj .
It remains to compute the P
success probability of the Garbage-free Quantum Sampler, i.e to√calculate the square of the sum j qj2 pj . Proving that it is 1−o(1), then we obtain a contradiction
to f being a quantum distributionally one-way function and hence we conclude that g is aP
quantum
one-way function. Note that the success probability of the Impagliazzo-Luby sampler is j qj andP
Lemma 1 proves that for j ≥ k = blog |f −1 (f (x))|c + O(log n) one obtains j≥k qj = 1 − o(1).
Here, we have a slightly more complicated expression that can still be shown to be large.
P √Lemma 2 The procedure QS is a quantum sampler for f with probability 1−o(1), i.e. j qj2 pj ≥1 − o(1).
Proof. We are going to bound this sum by showing that there exists a particular m for which the
2 √pterm qmm is 1 − o(1). In order to do so, we slightly change the procedure we described above
and instead of starting from j = n + log n and decreasing j at each step by 1, we pick a random
offset r ∈ [log log n], start with j = n + log n + r and decrease j at each step by log log n. Also, let
k = blog |f −1 (f (x))|c + log n. The values of pj for different j’s can be estimated using Lemma 1
 2k−j 2k−j !
1
1(1 − o(1)) 1 −≤ pj ≤ 1 −nnFirst, we bound the probability that the algorithm fails in all the rounds for j = n + log n + r toj ≥ k + (1 + ) log log n, where for example  = log log1 log n . Note that at each round j is decreased

PQCrypto 2006 Workshop Record

20Statistical zero knowledge and quantum one-way functions

by log log n. Since pj is an decreasing function of j the minimum probability of failure is obtained
for r = 0 and is
n+log
Yn

n+log
Yn

(1 − pj ) ≥j=k+(1+) log log nj=k+(1+) log log n 2k−j Y  2−(`+) log log n
1
1
=
n
n

Y  1 (log n)−(`+)  1 ==nnP`≥1 (log n)`≥1−(`+)`≥11 
1 (log n)1+ −1= 1 − o(1)≈nMoreover, for any j ∈ [k +  log log n, k + (1 − ) log log n, ] we have thatpj ≥ 1 − 2−(1−) log log n (log n)−(1−) (log n)
1
1
1
=1−
=1−
= 1 − o(1)nn2Since we pick a random initial offset r ∈ [log log n], then with probability (1 − 2) over r thealgorithm is run for an m ∈ [k +  log log n, k + (1 − ) log log n]. In this case, we have already shownthat pm = 1 − o(1) and, moreover,
for all previous rounds we have j ≥ k + (1 + ) log log n and henceQ
the probability of failure is j>m (1−pj ) = 1−o(1). To sum up, with probability (1−2) = 1−o(1)our algorithm is run for an m such that
X √
Y
2 √
qj2 pj ≥ qm
pm =(1 − pj )2 p5/2
m = 1 − o(1)jj>mand therefore the overall success probability of the algorithm is 1 − o(1).

2This concludes the proof of Theorem 5 and together with Theorem 4 we have
Theorem 6 Assume for a classical circuit C, which computes a many-to-one function, the corresponding CQS problem is hard , i.e. there exists no poly(|C|) size quantum circuit implementing
QSC . Then there exists a quantum one-way function.

5

Statistical Zero Knowledge and quantum one-way functions

The CQS problem has an interesting connection to the classical complexity class of Statistical Zero
Knowledge (SZK) languages:
Theorem 7 [2] Any language L ∈ SZK can be reduced to a set of instances of the CQS problem.
The proof is based on a reduction of the following SZK-complete problem to a quantum sampling
problem.
Definition 8 [16] Consider two constants 0 ≤ β < α ≤ 1 such that α2 > β. Statistical Difference(SDα,β ) is the promise problem of deciding for any two given classical circuits C0 and C1 whether
their output distributions are close to or far from each other, i.e. whether:||DC0 − DC1 || ≥ αor21||DC0 − DC1 || ≤ β

PQCrypto 2006 Workshop RecordKashefi, Kerenidis

It’s not hard to see that the above problem can be reduced to the problem of quantum sampling
the circuits C0 and C1 . Indeed, if one could efficiently construct the quantum samples |C0 i and|C1 i, then, by performing a SWAP-test, one could decide whether the two circuit distributions areclose to or far from each other. Equivalently, the above problem can be reduced to the problem
4of quantum sampling the circuit C = C0 ⊗ C1 , since a SWAP-test would again decide whether thetwo circuit distributions are close or far. Based on this result, we obtain the quantum analog ofOstrovsky’s result [15]:Theorem 8 Assume there exists a language L ∈ SZKrAvgBQP, then quantum one-way functions
exist.
Proof.
Assume L ∈ SZK r AvgBQP. For every input size n, let {C x }x∈{0,1}n be the set ofclassical circuits which decide L via reduction to the complete language in Definition 8. Denoteby m = poly(n) the size of the input to the circuits from this set. Since the language L is not
in AvgBQP, for any sufficiently large input size n, there exists a samplable distribution Dn suchthat for x ∼ Dn , the language L can not be decided with high probability with a polynomial
time quantum algorithm. Equivalently there is no polynomial quantum algorithm that produces
a quantum sample of C x for an average x ∼ Dn . We can assume this distribution to be uniform[8] and hence we have a uniform family of sets of circuits {{C x }x∈{0,1}n }n∈N , such that for any
polynomial time quantum algorithm Q, any constant  ∈ [0, 1/2), and all sufficiently large n ∈ N
Q : |xi|0i 7→ cx |xi|C x i + dx |Gx i
with

1 X
1 X
|(Q(|xi|0i) , |xi|C x i)|2 = n|cx |2 < 1 − 
n
2 x
2 x

We define the function fC : {0, 1}∗ → {0, 1}∗ such that fC : (x, y) 7→ (x, C x (y)) and prove that it isa quantum one-way function. We assume that f is one-to-one otherwise from Theorem 5, we canobtain the same result. Suppose that the function fC is not one-way, then there exists an inverter
such that
I : |f (x, y)i|0i|0i 7→ af (x,y) |f (x, y)i|xi|yi + bf (x,y) |Gf (x,y) i,or equivalently
I : |xi|C x (y)i|0i 7→ af (x,y) |xi|C x (y)i|yi + bf (x,y) |Gf (x,y) i,
1 P
12
where 2n+mx,y af (x,y) ≥ 1 − p(n) (the average is taken over x, y) and the af (x,y) ’s are positive.
We start from a uniform superposition of all y and use the inverter to create a circuit that is agood-on-average quantum sampler (similar to the proof of Theorem 3):
1 P
1 P
x
|xi 2m/2|xi 2m/2
y |yi|0i →Uf
y |yi|C (y)i
1 P
x
→SWAP |xi 2m/2 y |C (y)i|yi
1 P
x
0
→I
|xi 2m/2
y (af (x,y) |C (y)i|0i + bf (x,y) |Gf (x,y) i) ≡ |xi|Tm i

and hence for an average x
1 X|hx|hTm ||xi|C x i|2 =2n x

1 X 1 X
1 X
| m
af (x,y) |2 ≥ | n+m
af (x,y) |2
n
2 x 2
2
y
x,y
X
1
1 2
≥ | n+m
a2f (x,y) |2 ≥ (1 −) ≥ 1−2p(n)x,yThis is a contradiction and hence the function fC is a quantum one-way.

PQCrypto 2006 Workshop Record

222Statistical zero knowledge and quantum one-way functions

6

Conclusions

In this paper we prove that the existence of any problem in SZK which is hard-on-average for aquantum computer, implies the existence of quantum one-way functions. Our proofs go through the
problem of quantum sampling. Aharonov and Ta-Shma cast many important problems as quantum
sampling problems and described a possible way for attacking them. It is, hence, very interesting
to investigate the real hardness of quantum sampling. We already know that if SZK 6⊆ AvgBQP
then there exist hard instances of quantum sampling. Under what other assumptions can one provethe existence of hard instances of the CQS problem and consequently quantum one-way functions?
Furthermore, we saw that our candidate one-way problems include some of the most notorious
problems in quantum computing, like Graph Non-Isomorphism and approximate Closest Lattice
Vector problem. Could we construct one-way functions from other problems, such as the hidden
subgroup problem in the dihedral or other non-abelian groups?
Last, Watrous [18] proved that computational zero knowledge for NP is implied by the existenceof quantum one-way permutations. What other implications does the existence of quantum one-way
functions have?

Acknowledgements
We wish to thank Oded Regev, Ben Reichardt and Alain Tapp for useful discussions and Andrej
Bogdanov for sharing with us his notes on [9]. EK was partially supported by the ARDA, MITACS,
ORDCF, and CFI projects. IK gratefully acknowledges professor Peter w. Shor who has supported
his research from a scholarly allowance provided from his appointment as the holder of the Henry
Adams Morss and Henry Adams Morss, Jr. Professorship and from NSF CCF-0431787.

References[1] M. Adcock and R. Cleve. A quantum goldreich-levin theorem with cryptographic applications.
In Proceedings of 19th Annual Symposium on Theoretical Aspect of Computer Sciences, page323, 2002.
[2] D. Aharonov and A. Te-shma. Adiabatic quantum state generation and statistical zero knowledge. In Proceedings of STOC’02 – Symposium on the Theory of Computing. ACM, 2001.
[3] C. Crépeau, F. Légaré, and L. Salvail. How to convert the flavor of a quantum bit commitment.
In Advances in Cryptology — EUROCRYPT 2001, 2001.
[4] P. Dumais, D. Mayers, and L. Salvail. Perfectly concealing quantum bit commitment from any
one-way permutation. In B. Preneel, editor, Advances in Cryptology – EUROCRYPT 2000,
number 1807 in Lecture Notes in Computer Science, Berlin — Heidelberg — New York, 2000.
Springer Verlag.
[5] O. Goldreich. Foundations of Cryptography - Volume 1. Cambridge University Press, 2001.
[6] D. Gottesman and I. Chuang. Quantum digital signatures. quant-ph/0105032, 2001.
[7] J. Grollmann and A. Selman. Complexity measures for public-key cryptosystems. SIAM
journal of Computing, 17:309, 1988.

23

PQCrypto 2006 Workshop RecordKashefi, Kerenidis[8] R. Impagliazzo and L. A. Levin. No better ways to generate hard np instances than picking
uniformly at random. In Proceedings of FOCS’90 – Symposium on Foundations of Computer
Science, 1990.
[9] R. Impagliazzo and M. Luby. One-way functions are essential for complexity based cryptography. In Proceedings of FOCS’89 – Symposium on Foundations of Computer Science, 1989.
[10] E. Kashefi, H. Nishimura, and V. Vedral. On quantum one-way permutations. Quantum
Information and Computation, 2:379, 2002.
[11] A. Kawachi, H. Kobayashi, T. Koshiba, and R. H. Putra. Universal test for quantum one-way
permutations. In Proceedings of MFCS’04 – The 29th International Symposium on Mathematical Foundations of Computer Science, 2004.
[12] A. Kitaev and J. Watrous. Parallelization, amplification, and exponential time simulation ofquantum interactive proof systems. In Proceedings of STOC’00 – Symposium on the Theoryof Computing, page 608, 2000.
[13] E. Knill. Quantum randomness and nondeterminism. arXiv.org e-Print quant-ph/9610012,
1996.
[14] M. Nielsen and I. Chuang. Quantum Computation and Quantum Information. Cambridge
University Press, Cambridge, 2000.
[15] R. Ostrovsky One-way functions, hard on average problems and Statistical Zero Knowledge
proofs. IEEE Conference on Structure in Complexity Theory, 1991
[16] A. Sahai and S. P. Vadhan. A complete promise problem for Statistical Zero Knowledge. In
Proceedings of FOCS’97 – Symposium on Foundations of Computer Science, page 448, 1997.
[17] J. Watrous. Succinct quantum proofs for properties of finite groups. In Proceedings of
FOCS’2000 – Symposium on Foundations of Computer Science, page 537, 2000.
[18] J. Watrous. Zero knowledge against quantum attacks. quant-ph/0511020.

PQCrypto 2006 Workshop Record

24Post-quantum multivariate-quadratic public key schemes
Jacques Stern
École Nationale Supérieure

Since the invention of public key cryptography by Diffie and Hellman in 1976, very few public
key schemes have been deployed in applications, besides the celebrated RSA algorithm designed
by Rivest, Shamir, and Adleman. While millions of RSA keys are used in WEB browsers, mostpublic key cryptosystems are only present in textbooks, despite the fact that, if ever it happens,
the advent of quantum computers would render RSA insecure.
There are however, several challenging lines of research proposing public key schemes of adifferent flavour. Among these is multivariate cryptography, which stems from considering themathematical formula describing RSA as a univariate modular polynomial, and attempts to use
multivariate polynomials instead, hoping that the cost of encryption and/or decryption will belower.
While the original proposals based on this idea have been shown insecure, many further schemes
have been designed. In turn, these have been subject to active cryptanalytic work. The aim of thetalk is to review some of the schemes, to explain some of the methods that have been used toattack them, and to assess their level of security. In other words, is multivariate cryptography now
ready for practical applications? Or do we have to wait until quantum computers are built?

25

PQCrypto 2006 Workshop Record

Probabilistic Multivariate Cryptography
Aline Gouget?1 and Jacques Patarin2
1

2

France Telecom R&D, 42 rue des Coutures, F-14000 Caen, France.
University of Versailles, 45 avenue des Etats-Unis, F-78035 Versailles, France.

Abstract. In public key schemes based on multivariate cryptography,
the public key is a finite set of m (generally quadratic) polynomial equations and the private key is a trapdoor allowing the owner of the private
key to invert the public key. In existing schemes, a signature or an answer
to an authentication is valid if all the m equations of the public key aresatisfied. In this paper, we study the idea of probabilistic multivariate
cryptography, i.e., a signature or an authentication value is valid when atleast α equations of the m equations of the public key are satisfied, where
α is a fixed parameter of the scheme (or more generally when at least α1of the first m1 equations of the public key are satisfied, and at least α2of the m2 next equations of the public key are satisfied, etc., and at leastα` of the last m` equations are satisfied, where α1 , . . . , α` , m1 , . . . , m`and ` are well chosen integers with m1 + · · · + m` = m). We show thatmany new public key signature and authentication schemes can be built
using this concept. We apply this concept on some known multivariate
schemes and we show how it can improve the security of the schemes.

1

Introduction

The security of most of the public key schemes relies on the difficulty of solving one of the two problems that are currently considered to be hard, i.e., theproblem of factoring large integers and the problem of computing discrete logarithms. However, the techniques for solving these two famous problems improve
continually. Then, it becomes very important to find alternative problems andto proceed further to the study of known candidates that are considered to beminors until now. Furthermore, some new attractive properties may be achievedby using alternative difficult problems.
One possibility for secure public key schemes is based on the problem ofsolving multivariate nonlinear equations over small finite fields. In multivariate
cryptography, the public key is a set A of m polynomial equations in n variables
over a small finite field K. Public key schemes for encryption, signature or authentication can be built with such public keys. Most of the time, the equations
are chosen quadratic since solving quadratic systems is already N P-complete
and also hard on average.
?

New affiliation: Gemplus, 34 rue Guynemer, F-92447 Issy-les-Moulineaux, France.

27

PQCrypto 2006 Workshop Record

Gouget, Patarin

1.1

Related work

Since the introduction of the first multivariate schemes [5, 13, 7] in 1985, many
schemes have been proposed. Most of these schemes have been broken but several
schemes are still unbroken. Recently, C. Wolf and B. Preneel proposed a taxonomy [23] of public key schemes based on the problem of multivariate quadratic
equations. They grouped the known schemes into a taxonomy of only four
schemes: Matsumoto Imai (C ∗ ) [13], Hidden Field Equations (HFE) [16], Stepwise Triangular Systems (STS) [22] and Unbalanced Oil and Vinegar (UOV) [8].
Some of these schemes [13, 22] are broken. However, from these four basic
schemes, it is possible to design more schemes by applying a perturbation inorder to improve the security of the basic scheme. For instance, the scheme
C ∗−− which is a variant of the C* scheme using the perturbation minus (i.e.,a part of the public key is kept secret) is still unbroken. Recently, J. Ding [4]proposed another variant of the C ∗ cryptosystem using a new perturbation calledinternal perturbation which was next broken by P-A. Fouque et al. [6]. However
the internal perturbation can be applied on HFE for instance.
The security of the unbroken schemes is most of the time an open problem
since it consists in checking that all known attacks do not apply. However, multivariate schemes have attractive properties that cannot be reached using classicalpublic key schemes based on factorization or discrete logarithm. For instance, it
becomes possible to get very short signatures or very fast computations. Furthermore, the study of multivariate schemes is interesting from a theoretical pointof view since it leads to the study of some new specific problems.
A notion close to the idea of probabilistic multivariate cryptography presented
in this paper is given in [1] but the context is different since it is the traitor
tracing based on the IP problem.
1.2

OutlineIn Section 2, we first present the general problem of multivariate polynomials
and the public key of multivariate schemes. Then, we compare how this public
key is used in classical (non-probabilistic) schemes and in probabilistic schemes.
In Section 3, we explain how a probabilistic scheme can be built from a classical
trapdoor. This construction will sometimes also hide the trapdoor in a muchbetter way than in a classical construction. In Sections 4 and 5, we present some
explicit probabilistic multivariate schemes: in Section 4, we present an adaptationof the multivariate scheme C ∗ in a probabilistic way and we discuss several
variants of the proposed scheme, and in Section 5, we present an adaptation of
the multivariate scheme UOV. Finally, we conclude in Section 6.

2

Public key of multivariate schemes

In this section, we first recall the general difficult problem underlying multivariate cryptography. Next, we briefly describe public key schemes (i.e. authentication, signature and public key encryption schemes) in the context of classical

PQCrypto 2006 Workshop Record

28

Probabilistic multivariate cryptography

multivariate cryptography (i.e. the multivariate cryptography of the state of theart). Then, we describe the public key protocols in the context of probabilistic
multivariate cryptography.
2.1

Problem of polynomial equations in finite fields

Let K be a finite field. Let A = (a1 , . . . , am ) be a system of m ∈ N polynomial
equations in n ∈ N variables with degree d ∈ N. Given y = (y1 , . . . , ym ) ∈ K m ,the problem is to find a solution x = (x1 , . . . , xn ) ∈ K n of the system:
y1 = a1 (x1 , . . . , xn )
y2 = a2 (x1 , . . . , xn )
..


.



ym = am (x1 , . . . , xn )Most of the time, the polynomial equations of a multivariate cryptographic
scheme are quadratic (i.e. d = 2) since the problem of solving such system is N P complete and hard on average. In this case, the problem is called Multivariate
Quadratic Equations problem and for every i, 1 ≤ i ≤ m, the polynomial ai has
the form:
X
X
X
ai =
γi,j,k xj xk +δi,j xj + ξi ,1≤j≤n 1≤k≤n

1≤j≤n

where the coefficients γi,j,k , δi,j and ξi are elements of K.
2.2

Classical multivariate schemes

A classical multivariate scheme relies on the knowledge of a trapdoor TA inconnection with a system A of m polynomial equations in n variables over afinite field K. Then:– the public key is the system A;– the private key is the trapdoor TA that allows to compute, for any given valuey = (y1 , . . . , ym ), a value x = (x1 , . . . , xn ) such that, yi = ai (x1 , . . . , xn ) for
every i, 1 ≤ i ≤ m (or equivalently such that y = A(x)).
On the one hand, the computation of x such that y = A(x) must be easyusing the trapdoor TA , and on the other hand, the computation of x without
the knowledge of the trapdoor TA must be computationally difficult (i.e. thenumber of operations must be greater than 280 ).
Multivariate signature Given a message M , one can compute the hash value yof the message M , i.e. y = H(M ), where H is a collision resistant hash function.
Then, given a hash value y of a message M , a signature of the message M isa value x such that y = A(x). Only the owner of the private key can compute
such a value x, and any verifier can check that y = A(x) for the hash value y ofa given message M , its signature x and the public key A.

29

PQCrypto 2006 Workshop Record

Gouget, Patarin

Multivariate authentication An authentication between a prover and a verifier works as follows. The verifier sends a challenge y to the prover. Then, byusing the trapdoor TA , the prover computes the value x such that y = A(x),and he sends x to the verifier. At last, the verifier computes A(x) and the authentication protocol is valid if and only if the equality y = A(x) holds.
Multivariate public key encryption For an encryption scheme, anybody can
encrypt a message x by using the public key A, that is, anybody can computes
the ciphertext y = A(x). Furthermore, only the owner of the private key TA candecrypt the value y = A(x) and recovers the value x.
Then, in classical multivariate schemes, all the m equations of the system
y = A(x) must be satisfied in order to validate a protocol.
2.3

Probabilistic multivariate schemes

In this paper, we focus on authentication protocols and signature schemes (it may
also be possible to build probabilistic encryption scheme but this is a difficult
problem that we will not study here).
In a probabilistic multivariate scheme, the public key is a system A of mpolynomial equations in n variables. A signature (resp. a response to a challenge)
will be valid if at least α equations of the system A are satisfied where α isa fixed parameter of the scheme (or more generally, if at least α1 of the m1
first equations of A are satisfied, and at least α2 equations of the m2 next
equations of A are satisfied etc., and at least α` of the m` last equations of A
are satisfied, where α1 , . . . , α` , m1 , . . . , m` and ` are well chosen integers with
m1 + · · · + m` = m).
General description when m1 = m. Let K be a finite field (generally, we
have K = GF (2)). The public key A is a system of m polynomial equations in
n variables,y1 = a1 (x1 , . . . , xn )
y2 = a2 (x1 , . . . , xn )
A= .
..





ym = am (x1 , . . . , xn )where x1 , . . . , xn , y1 , . . . , ym are variables defined over K and a1 , . . . , am are polynomials of degree d with coefficients in K.
The construction of a probabilistic multivariate scheme relies on the existenceof a trapdoor TA such that, given a value y, it is possible with a probability close
to 1, to find a value x such that at least α equations of the m equations of A are
satisfied. The parameter α is fixed; for instance, if K = GF (2), then we have
α> m
2 . In exchange, the probability to find a value x (such that α equations of
A are satisfied) without the knowledge of TA must be very close to 0.
Assuming that such a trapdoor exists, one can construct a probabilistic multivariate scheme for signature or authentication:

PQCrypto 2006 Workshop Record

30

Probabilistic multivariate cryptography– In an authentication protocol, the verifier generates a random value y calleda challenge and sends it to the prover.
– In a signature scheme, y is the hash value of the message M to be signed(i.e. y = H(M )) and x is the signature of y. In the following, we assume thatthe hash function H is not only collision resistant but also near-collisionresistant, i.e., we assume that it is difficult to find y and y 0 such that H(y) ⊕H(y 0 ) has low Hamming weight3 .
A value x such that at least α equations of the m equations of A are satisfied isa valid authentication value or a valid signature. Then, given a challenge (resp.
a hash value of a message) y, the verification of the authentication (resp. thesignature) x consists in verifying that the number of equations of A for the pairvalue (x, y) which are satisfied is greater than or equal to α.
The motivation for studying probabilistic multivariate cryptography are twofold. First, many multivariate schemes have been broken. Sometimes, modifiersor perturbations are applied on these basic schemes in order to get secure multivariate schemes. Probabilistic multivariate cryptography is an alternative way to
get secure multivariate schemes from basic known trapdoors. Second, there arefew known basic trapdoors in the context of classical multivariate cryptography.
Furthermore, the existence of many more basic trapdoors is uncertain. It would
be very interesting (but certainly very difficult) to find new basic trapdoors andit may be easier to find a basic trapdoor for probabilistic multivariate schemes
than for classical multivariate schemes.
In this paper, we only consider the construction of probabilistic multivariate
schemes based on known trapdoors.

3

Design of a probabilistic multivariate schemes from aclassical trapdoor

Let A denote the public key of the probabilistic multivariate scheme that wewill build (A will be a system of m polynomials equations in n variables). Let B
denote the public key of a classical multivariate scheme (i.e. B is a system of mpolynomials equations in n variables) and let TB denote the trapdoor associated
to B.
3.1

General construction

Construction of the public key A. For simplicity, we set the finite field K
to be GF (2). Recall that B = (b1 , . . . , bm ) is a system of m ∈ N polynomial
equations in n ∈ N variables with degree d ∈ N and TB denotes the trapdoor
associated to B. Let C := (c1 , . . . , cm ) be a system of m ∈ N polynomial equations
3

Assuming this additional condition on the hash function H is one technique to avoid
existential forgery; alternative techniques will be presented in the full version of thispaper.

31

PQCrypto 2006 Workshop Record

Gouget, Patarin

in n ∈ N variables such that ci (x1 , . . . , xn ) = 0 with probability κ, where κ > 21 .
Then, as we will see, we will obtain a probabilistic scheme with a public key A
of the form:
y1 = b1 (x1 , . . . , xn )+ c1 (x1 . . . , xn ) = a1 (x1 , . . . , xn )
y2 = b2 (x1 , . . . , xn )+ c2 (x1 . . . , xn ) = a2 (x1 , . . . , xn )
A=
..


.



ym = bm (x1 , . . . , xn ) + cm (x1 . . . , xn ) = am (x1 , . . . , xm )Remark 1. The system B can be constructed using any basic trapdoor and thepolynomials ci can be seen as perturbations of this basic trapdoor. In otherwords, the system C allows to mask the algebraic structure of the system B. In
Section 4, we use the C ∗ scheme and in Section 5, we use the Oil and Vinegar
system. It is also possible to use for example a FLASH scheme, i.e. the C ∗−−scheme [18] or the HFE scheme [16].
We now describe the general execution of a probabilistic multivariate authentication protocol based on a known trapdoor. We do not describe the general
execution of a probabilistic multivariate signature scheme based on a known
trapdoor. We only mention that one solution is to assume the knowledge of anear-collision hash function H and to replace the challenge y sent by the verifier
into the authentication protocol by the hash value y = H(M ) of the message
M to be signed; alternative solutions will be presented in the full version of thispaper.
Authentication scheme
1. The verifier randomly chooses a challenge y = (y1 , . . . , ym ) in ∈ K m andsends it to the prover.
2. The prover follows three steps:(a) For every i ∈ [1; m], the value yi is replaced by yi ⊕ 1 with probability
β (where β is a fixed parameter such that β 6= 0 4 ), i.e. we have yi0 = yiwith probability 1 − β and yi0 6= yi with probability β. Then, the prover0
gets the value y 0 = (y10 , . . . , ym). In average, βm values of y are modified
0
to get y .
(b) Using the trapdoor TB , the prover computes the value x = (x1 , . . . , xn )such that for every i ∈ [1; m], we have
yi0 = bi (x1 , . . . , xn )(c) The prover checks that for at least α integers i of [1; m], the equation
yi = bi (x1 , . . . , xn ) + ci (x1 , . . . , xn )is satisfied. If not, then the prover restart at the beginning of step 2, else
the prover sends x = (x1 , . . . , xn ) to the verifier.
4

the reason why β must be different from 0 will be explained in Section 3.2

PQCrypto 2006 Workshop Record

32Probabilistic multivariate cryptography

3. Finally, the verifier checks that at least α equations of the system : ?
y1 = a1 (x1 , . . . , xn )
..
.



?
ym = am (x1 , . . . , xn )are satisfied.
The general execution of a probabilistic scheme is summarized in Figure 1.
y = (y1 , y2 , . . . , ym )First perturbation:
modification of the vector y0y 0 = (y10 , y20 , . . . , ym)

Inversion of y’ with respect
to the system B from T B

Computation of x = (x1 , x2 , . . . , xn )such that y’ = B(x)Second perturbation:
testing of the solution x withrespect to the system A

Is yi =? a(x) forat least α integer i?
noyes

x = (x1 , x2 , . . . , xn )Fig. 1. Example of a probabilistic scheme

Remark 2. In practice, the indices i such that yi 6= yi0 are chosen with a pseudorandom algorithm that depends only of (y1 , . . . , ym ) such that for every i, 1 ≤i ≤ m, we have yi 6= yi0 with probability β and of the current run. Then, if thechallenge y = (y1 , . . . , ym ) is given twice, then the prover will always answer
with the same x = (x1 , . . . , xn ). Here the aim is to prevent the attacker from
replaying the same challenge several times in order to get information on thesystem C.

33

PQCrypto 2006 Workshop Record

Gouget, Patarin

Remark 3. The value of the parameter κ is fixed by choosing the polynomials
ci , 1 ≤ i ≤ m (for instance, in Section 4, the quadratic polynomials ci are chosensuch that κ = 43 ); the values of the parameters α and κ are discussed in thefollowing of the section.
Remark 4. In the signature scheme, y is the hash value of the message M , i.e.
y = H(m), where H is near-collision resistant. This condition on H is to avoid thefollowing attack. Assume that (M, y = H(M ), x) is a valid tuple such that there
are α+a equations satisfied with a > 0. Then, one can construct a new pair (y 0 , x)
by changing up to a component in y. Thus, if H is not near-collision resistant,then an attacker will be able to construct a valid tuple (M 0 , y 0 = H(M 0 ), x).
3.2

The parameter β must be different from 0

Recall that β is the probability that a bit yi of the received challenge y is modified
by the prover (before inverting the system). The role of the perturbation system
C is to mask the algebraic structure of the system B (the aim is to prevent theattacker from accessing the system B). However, in order to prevent the attacker
to reconstruct the system C, and then, to retrieve the system B, the parameterβ must be chosen in a better way.
Suppose that β = 0. Then, for every pair (x, y) the attacker would know that
all the equations of B are satisfied by (x, y) with probability 1. If β = 0, thenfrom O(n2 ) pairs (x, y), an attacker will be able to reconstruct the system B
with probability 1 by Gaussian reductions (on the quadratic coefficients of theequations of B). In this case the difficulty of breaking the system is equivalent
to the difficulty of breaking the original trapdoor associated to the system B.
Thus C has no interest anymore since it can be removed. So β must be different
from zero.
When β is different from zero, the attacker has to deal with several cases:– if a relation yi = a(x) is valid, then:
1. yi equals yi0 and ci (x) = 0 happens with probability (1 − β)(1 − κ) (onaverage);
2. yi is different from yi0 and ci (x) = 1 happens with probability βκ (onaverage);– if a relation yi is different from a(x), then:
1. yi equals yi0 and ci (x) = 1 happens with probability (1−β)κ (on average);
2. yi is different from yi0 and ci (x) = 0 happens with probability β(1 − κ)(on average).
Then, the value of the parameter β must be chosen in accordance with thevalue of κ (the value κ is fixed by choosing the polynomials ci , 1 ≤ i ≤ m).
3.3

Relation between the parameters α, β and κ

Recall that α is the number of equation of the public key that must be satisfied tovalid an authentication or a signature. The parameters β and κ concerns the two

PQCrypto 2006 Workshop Record

34

Probabilistic multivariate cryptography

perturbations involved in a multivariate probabilistic scheme based on a known
trapdoor: the value β is the probability that a bit of the received challenge y
is modified by the prover before inverting the system, and the value κ is theprobability that a polynomial equation of the perturbation system C equals 1.
?

The value α depends on the probability that the equation yi = ai (x1 , . . . , xn ),1 ≤ i ≤ m, is not satisfied, that is, α depends on the two values β and κ. There are(on average) κm integers i ∈ [1; m] such that yi0 = bi (x1 , . . . , xn ) + ci (x1 , . . . , xn )and the prover has changed βm values of y. Thus, the parameter α must be
chosen such that:
α ' (κ − β)m .
Since the probability κ is fixed by choosing the polynomials ci , 1 ≤ i ≤ m,
the values of α and β must be chosen in accordance with the value of κ. Noticethat we must choose α such that α > m
2 in order to prevent that a random value
1
is valid with a probability 2 and β must be different from 0.
3.4

Size of the public key

Let K = GF (2) and assume that the equations of the public key look as random
equations of degree d for an adversary who do not have the secret key. We havem
2 < α ≤ m. Let λ be the value defined by α = λm. Then, in order to ensure asecurity in 280 , the number m of equations of a public key must be chosen such
that:
µ
¶
ln λ
ln(1 − λ)m 1+λ+ (1 − λ)' 80 .
ln 2
ln 2
Details of this approximation are given in Appendix A.
9
Example 1. For λ = 34 , we get m ' 423, and for λ = 10
, we get m ' 150
equations.

Remark 5. As a consequence, the public key is larger in a probabilistic scheme
than in a non-probabilistic where at least about 80 equations are required.

4

The probabilistic multivariate scheme C ∗ + LL0

The Matsumoto-Imai scheme (also called C ∗ ) was presented in [13] and cryptanalysed in [14, 3]. We first briefly recall the description of C ∗ . Next, we present
a probabilistic variation of the C ∗ scheme, called C ∗ + LL0 where no attack is
known; another way to repair the C ∗ scheme is for example the FLASH schemeof [18].
In this section, the public key A = B + C will be constructed such that B isa public key of a C ∗ scheme and C is a set of product of linear forms (B and C
are kept secret).

35

PQCrypto 2006 Workshop Record

Gouget, Patarin

4.1

Matsumoto-Imai Scheme (C ∗ )Let K = Fq be a finite field and E be an extension field of dimension n over K.
Let Φ be an isomorphism from E to K n . Let f be the function defined over E byθf : x 7−→ x1+q ,where θ ∈ N. If the finite field K has characteristic 2 and gcd(q n − 1, q θ + 1) = 1,
then f is a bijection. Furthermore, the restriction on θ allows an efficient inversion
0of the function f . Indeed, f −1 (y) = y h , where h0 is the inverse of 1 + q θ modulo
q n − 1.
The public key is the function A := x 7→ T ◦ Φ ◦ f ◦ Φ ◦ S(x). The hardness of
the Matsumoto-Imai scheme is based on the IP-problem, that is, the difficultyof finding transformations S and T for given polynomials equations P and P 0 .
4.2

Construction of the public key A

Let K = GF (2). Let B be the public key of a C ∗ scheme, that is, B is a set of nquadratic equations in n variables over GF (2) of the form
yi = bi (x1 , . . . , xn )with 1 ≤ i ≤ n and x1 , . . . , xn , y1 . . . , yn are elements of K. The trapdoor
associated to B is denoted by TB . Notice that both B and TB are kept secret.
Let L1 , . . . , Ln , L01 , . . . , L0n be 2n secret linear forms in the variables x1 , . . . , xn .
For every i, 1 ≤ i ≤ n, let ci = Li · L0i . Then, the public key A of the schemeC ∗ + LL0 is the set of the n quadratic equations in n variables:y= b1 (x1 , . . . , xn ) + L1 (x1 , . . . , xn ) · L01 (x1 , . . . , xn ) = a1 (x1 , . . . , xn )

 1
..
A=
.


y
= bn (x1 , . . . , xn ) + Ln (x1 , . . . , xn ) · L0n (x1 , . . . , xn ) = an (x1 , . . . , xn )nRemark 6. The classification of quadratic forms over GF (q) (for q odd or even)is well-known; it is given for example in [11] pp. 278-289 and recalled in Appendix B. We are interested here in the case q even since q is generally a powerof two. Then, we have only one or two canonic forms when n is fixed and non
degenerate, so we have at least 2n possible canonic forms when q is fixed.
Parameter κ. For all i, 1 ≤ i ≤ n, we have Li (x1 , . . . , xn ) = 0 with a probability 21 and we also have L0i (x1 , . . . , xn ) = 0 with a probability 12 . Thus, we haveLi (x1 , . . . , xn ) · L0i (x1 , . . . , xn ) = 0 with a probability κ = 34 .
Recall that the parameter α is a fixed value such that:µ¶3
α ' (κ − β) m =−β m ,
4
where β is a fixed parameter such that 0 < β < 41 .
PQCrypto 2006 Workshop Record

36Probabilistic multivariate cryptography

4.3

The scheme C ∗ + LL0

As usual, y = (y1 , . . . , yn ) is the challenge of an authentication scheme or thehash value of the message to be signed in a signature scheme. The value x =(x1 , . . . , xn ) will be a successful authentication value or a valid signature if at
least α equations of A are satisfied.
Computation of the value x. Let y = (y1 , . . . , yn ) be the challenge or thehash value of the message to be signed. In order to compute x = (x1 , . . . , xn ),the prover proceeds as follows.
1. Each yi is changed with probability β and then the value y 0 = (y10 , . . . , yn0 )is obtained. The indices i such that yi 6= yi0 are chosen with a deterministic
pseudo-random algorithm that depends only of (y1 , . . . , yn ) and of the current run. Thus, if the same challenge is given twice, the prover will always
answer with the same (x1 , . . . , xn ).
2. Using the trapdoor TB , the prover computes the value x = (x1 , . . . , xn ) suchthat:∀i, 1 ≤ i ≤ n, yi0 = bi (x1 , . . . , xn ) .
Verification of the value x. The value x is valid if at least α equations of the
public key, i.e. if at least α equations of the form?

yi = a(x1 , . . . , xn )where 1 ≤ i ≤ m, are valid.
For every i, 1 ≤ i ≤ m, we have Li (x1 , . . . , xn ) · L0i (x1 , . . . , xn ) = 0 with probability κ = 43 . Then, we have yi0 = bi (x1 , . . . , xn ) + Li (x1 , . . . , xn ) · L0i (x1 , . . . , xn )with a probability 34 . Next, we have yi = yi0 with a probability (1 − β). Thus, we
deduce that we have:yi = fi (x1 , . . . , xn ) + Li (x1 , . . . , xn ) · L0i (x1 , . . . , xn )with a probability greater than or equal to 34 − β.
Then, the expectation value of the¡ number¢ N of equations of A that aresatisfied is greater than or equal to 34 − β n ' α. For a given (y1 , . . . , yn ),if N is lower than α, then we can try again at step 1 by computing another(y10 , . . . , yn0 ) with again about βn values changed from (y1 , . . . , yn ) chosen witha deterministic pseudo-random algorithm that depends only of (y1 , . . . , yn ) andof the current run. After a few tries, we get a solution (x1 , . . . , xn ) with at least
α equations of B that are satisfied, i.e., a valid signature or a valid answer to achallenge.
Remark 7. For a security greater than or equal to 280 , we need n ≥ 423 when β
1
is small. For instance, with β = 10
and n ' 500, no attack of this scheme exists
to the best of our knowledge.

37

PQCrypto 2006 Workshop Record

Gouget, Patarin

4.4

Variants of the scheme C ∗ + LL0

First variant: C ∗ + LL0 + L00 L000 . The first variant consists in replacing thelinear product LL0 by the linear product LL0 + L00 L000 (as a consequence, thevalue of the parameter κ is modified). We keep the same notations, that is, B isa public key of a C ∗ scheme and A is the set of n equations of the form:
yi = bi (x1 , . . . , xn ) + ci (x1 , . . . , xn ) = ai (x1 , . . . , xn ) ,where ci , 1 ≤ i ≤ n, is a product a linear forms which is defines as follows.
Let Li , L0i , L00i and L000
i , 1 ≤ i ≤ n, be 4n secret linear forms in the n variables
x1 , . . . , xn . The set C is defined by:y1 =b1 (x1 , . . . , xn ) + L1 (x1 , . . . , xn )L01 (x1 , . . . , xn )





+L001 (x1 , . . . , xn )L000
1 (x1 , . . . , xn )

..
C=
.




yn =
bn (x1 , . . . , xn ) + Ln (x1 , . . . , xn )L0n (x1 , . . . , xn )
+L00n (x1 , . . . , xn )L000
n (x1 , . . . , xn )The value of the parameter κ is the probability that the equation Li · L0i +?

10
L00i · L000
i = 0 is satisfied, that is, κ = 16 according to the figure 2.

0
00
000
Li L0i L00i L000
i Li · Li + Li · Li
1 1 1 10
1 1 1 01
1 1 0 11
1 1 0 01
1 0 1 11
1 0 1 00
1 0 0 10
1 0 0 00
0 1 1 11
0 1 1 00
0 1 0 10
0 1 0 00
0 0 1 11
0 0 1 00
0 0 0 10
0 0 0 00

Fig. 2. Truth table of Li L0i + L00i L000i
10Since we have 12 < κ = 16
< 34 , the scheme C ∗ +LL0 +L00 L000 will generally beless efficient than the scheme C ∗ +LL0 . However, it may be difficult to distinguishthe public key of C ∗ + LL0 + L00 L000 from random quadratic equations than the

PQCrypto 2006 Workshop Record

38

Probabilistic multivariate cryptography

public key of C ∗ +LL0 , and thus, for C ∗ public key B, the scheme C ∗ +LL0 +L00 L000
may be more secure than the scheme C ∗ + LL0 .
More generally, from [11], we know what can be the exact numbers of solutions x1 , . . . , xn of any quadratic form q(x1 , . . . , xn ) = 0. For instance, thenumber of (x1 , . . . , xn ) ∈ Fn2 such that x1 x2 + x3 x4 + · · · + xn−1 xn = 0 with nn−2even is 2n−1 + 2 2 , i.e.:
µ
¶
1
n−1
1+ n
2
22
instead of 2n−1 for an average quadratic form of n variables.
Second variant: decomposing A in sets of equations with various probability. Instead of having about 423 equations C ∗ + LL0 in A, we can for example have 40 equations that come from a C ∗−− scheme (these equations will
have to be satisfied with a probability 100%) and 160 equations that come froma C ∗ + LL0 scheme and at least 120 of these equations will have to be satisfied.
Many other examples are possible for the parameters.
Third variant: public key of degree 3 instead of 2 When using a public
key formed with quadratic polynomials, it is not possible to prevent the attacker
that observe an equation yi 6= a(x) from distinguishing between the two cases :1. yi = yi0 and Li (x) · L0i (x) = 1
2. yi 6= yi0 and Li (x) · L0i (x) = 0
Indeed, we have yi = yi0 with probability (1−β) and we have Li (x)·L0i (x) = 0
with probability κ. Then, in order to prevent the attacker from distinguishing
between case 1 and case 2, we have to choose the values of β and κ such that:(1 − β)(1 − κ) = βκFurthermore, we have α ≈ (κ − β)n ≥ m
2 . That comes to choose the values of κand β such that: κ + β = 1 and κ − β > 21 .
These conditions imply that κ > 34 . When the public key has degree 2 then,the higher value of κ is 34 (c.f. the weight distribution of quadratic forms). If
κ = 34 , then there is no solution β fulfilling both κ + β = 1 and κ − β > 12 .
This property can be achieved by using public key of degree 3. In a C ∗θscheme, a monomial b = a1+q is hidden by affine transformations. In [15], theθθϕpossibility of replacing b = a1+q by b = a1+q +q is studied; the public key
has degree 3 instead of 2. The attack of the scheme C ∗ given in [14] does not
apply directly on the scheme “C ∗ of degree 3”. However the scheme is insecure
as it is shown in [15]. We use the scheme “C ∗ of degree 3” as a basic scheme toconstruct a probabilistic multivariate scheme.
Let B be the public key of a scheme “C ∗ of degree 3”, that is B is a set of nequations in n variables of degree 3 over K of the form yi = bi (x1 , . . . , xn ) where
39

PQCrypto 2006 Workshop Record

Gouget, Patarin

1 ≤ i ≤ n and x1 , . . . , xn , y1 , . . . , yn are elements of K. The trapdoor associatedto B is denoted by TB .
Let L1 , . . . , Ln , L01 , . . . , L0n , L001 , . . . , L00n be 3n secret linear forms in the variables x1 , . . . , xn . Then, the public key A is the set of the n equations of degree
3 in n variables:y= b1 (x1 , . . . , xn ) + L1 (x1 , . . . , xn )L01 (x1 , . . . , xn )L01 (x1 , . . . , xn )

 1
..
A=
.


y
b1 (x1 , . . . , xn ) + Lm (x1 , . . . , xn )L0m (x1 , . . . , xn )L0m (x1 , . . . , xn )m =Parameter κ. For all i, 1 ≤ i ≤ n, we have Li (x1 , . . . , xn ) = 0 with a probability 12 and we also have L0i (x1 , . . . , xn ) = 0 and L00i (x1 , . . . , xn ) = 0 with aprobability 12 . Thus, we have L1 (x1 , . . . , xn )L01 (x1 , . . . , xn )L01 (x1 , . . . , xn ) = 0
with probability κ = 87 .
Parameters α and β. Recall that the three parameters α, β and κ must satisfy
the relation:
3nα ' (κ − α)n = n ≥.
4
2
By choosing β = 1−κ = 18 , an attacker would not be able to distinguish between
the two possible cases when a relation of the public key is not satisfied.

5

The probabilistic multivariate scheme U OV + LL0

The scheme Oil and Vinegar was introduced in [17] and it was broken in [9].
Next, a generalisation of the original scheme, called Unbalanced Oil and Vinegar(UOV), was introduced in [8]; the scheme UOV is not broken for well-chosenparameters. In this section, we will be able to use more possible parameters
since some attacks valid for UOV will not work any more for UOV+LL’. We
briefly describe the scheme UOV.
5.1

The scheme UOVLet K = Fq be a small finite field. Let m, n and p be three positive integers. The
hash value y of the message to be signed is an element of K m , and the signaturex is an element of K n .
The public key is a set A of m polynomials in n variables of the form:
yi = fi (x1 , . . . , xn ),1≤i≤m .

There exists a bijective affine function s : K n → K n such that:(x1 , . . . , xn ) = s(o1 , . . . , on−p , v1 , . . . , vp )PQCrypto 2006 Workshop Record

40Probabilistic multivariate cryptography

and such that for every i, 1 ≤ i ≤ m:
yi =

n−p
p
XX

γi,j,k oj vk +

p
p X
X

µi,j,k vj vk +δi,j oj +j=1

j=1 k=1

j=1 k=1

n−p
X

p
X

νi,j bj + ξi

j=1Note that the vinegar variables vi ’s are combined quadratically while the oil variables oi ’s are only combined with vinegar variables in a quadratic way. Therefore assigning random values to the vinegar variables results in a system of linear
equations in the oil variables which can be solved, for instance, by using gaussianelimination.
The scheme UOV+LL’ proceeds exactly as the scheme C ∗ + LL0 except that
the C ∗ equations are changed with UOV equations. Since this UOV+LL’ scheme
looks particularly interesting, we will describe it completely in this section andgive some remarks on its efficiency.
5.2

Construction of the public key A

Let K = GF (2) and B be the public key of a UOV scheme, i.e., B is a set of m
quadratic equations in n variables (x1 , . . . , xn ) over GF (2). Each equation of B
is of the form:
yi = fi (x1 , . . . , xn )with x1 , . . . , xn , yi ∈ K, and fi is a quadratic function.
There are n − p oil variables denoted by o1 , . . . , on−p ∈ K and p vinegar
variables denoted by v1 , . . . , vp ∈ K and there is a secret affine and invertible
transformation s such that:(x1 , . . . , xn ) = s(o1 , . . . , on−p , v1 , . . . , vp )and such that each yi of B written in the o1 , . . . , on−p , v1 , . . . , vp variables (instead of x1 , . . . , xn variables) is of the form:
yi =

n−p
p
XX
j=1 k=1

γi,j,k oj vk +

p X
p
X

µi,j,k vj vk +

n−p
X
j=1

j=1 k=1

δi,j oj +pXνi,j vj + ξi

j=1

where γi,j,k , µi,j,k , δi,j , νi,j and ξi are elements of K. Notice that we do not have
any term in ai aj : we can have oil × vinegar, vinegar × vinegar but never oil ×
oil.
Let L1 , . . . , Lm , L01 , . . . ; L0m be 2m secret linear forms in x1 , . . . , xn (or equivalently in the variables a1 , . . . , ah , b1 , . . . , bv ). Let A be the set of the m quadratic
equations:yi = fi (x1 , . . . , xn ) + Li (x1 , . . . , xn ) · L0i (x1 , . . . , xn ) .
The set A will be the public key of the scheme UOV+LL’ (while fi , B, Li , L0iand s are kept secret).

41

PQCrypto 2006 Workshop Record

Gouget, Patarin

5.3

The scheme U OV + LL0

As usual y = (y1 , . . . , ym ) is the challenge in an authentication scheme, orthe hash value of the message to be signed in a signature scheme. The valuex = (x1 , . . . , xn ) is a valid signature or¡a successfulauthentication if at least α¢3equations of A are satisfied, with α ' 4 − β m, where β is a fixed parameter
1(for example, we can choose β ' 10).
Computation of the value x. In order to compute x = (x1 , . . . , xn ) with thesecrets, the prover proceeds as follows.
0) is
1. yi is changed with probability β and then the value y 0 = (y10 , . . . , ym
0
obtained. The indices i such that yi 6= yi are chosen with a deterministic
pseudo-random algorithm that depends only of (y1 , . . . , ym ). Thus, if thesame challenge is given twice, the prover will always answer with the same
(x1 , . . . , xn ).
2. The prover randomly chooses the vinegar variables v1 , . . . , vp . These random variables are chosen with a deterministic pseudo-random algorithm
that depend only of (y1 , . . . , ym ). Thus, as above, if twice the same challenge (y1 , . . . , ym ) is given, the prover will always answer with the same
(x1 , . . . , xn ).
3. The prover computes the values a1 , . . . , am such that:∀i, 1 ≤ i ≤ m, yi0 = fi (x1 , . . . , xn ) = fi (s(o1 , . . . , on−p , v1 , . . . , vp ))Here we have a linear system of m equations in the variables o1 , . . . , on−p . If
we have no solution we try again with other random vinegar values v1 , . . . , vp .
For all i, 1 ≤ i ≤ m, we have:
yi0 = fi (x1 , . . . , xn ) + Li (x1 , . . . , xn ) · L0i (x1 , . . . , xn ) .
with a probability 34 . Moreover, with a probability (1 − β), we have yi = yi0 .
Thus, with a probability greater than or equal to 43 − β we have:yi = fi (x1 , . . . , xn ) + Li (x1 , . . . , xn ) · L0i (x1 , . . . , xn ).
Then, the expectation value¡ 3of the¢ number N of equations of A that are satisfied
is greater than or equal to 4 − β ' α. If we have N < α, then we can try again
with new random vinegar variables.
Remark 8. If we compare UOV and UOV+LL’, we can notice that in UOV+LL’
we do not need any more to have v ≥ 2m in order to avoid the Shamir-Kipnis
attack of [9]. Moreover in the equations of UOV, we have oil × oil, oil × vinegar
and vinegar × vinegar, so the scheme might be more secure for smaller valuesof the parameters.
Remark 9. The variations given in Section 3.2 and 3.3 for C ∗ + LL0 are also
possible variants for U OV + LL0 .

PQCrypto 2006 Workshop Record

42Probabilistic multivariate cryptography

6

Conclusion

Probabilistic Multivariate Cryptography is a new concept in public key cryptography with many possible schemes. It opens new opportunities and new questions
that we think are interesting, both from a practical and from a theoretical pointof view. In this paper we have presented some new public key schemes (C* + L
L’ and UOV + LL’ for example) based on this idea of probabilistic Multivariate
Cryptography with some explicit examples for the parameters. These schemes
were built from the transformation of non-probabilistic multivariate schemes
to probabilistic multivariate schemes in order to get more security or more efficiency. An interesting problem is to find a trapdoor for probabilistic multivariate
schemes which allows directly to find an approximation of the solution associatedto the challenge or the message to be signed. Another interesting problem is tofind probabilistic multivariate schemes for encryption (not only for signatures orauthentications).

Acknowledgements
The authors wish to thank the anonymous referees for useful comments.

References
1. Julien Bringer, Herv Chabanne, and Emmanuelle Dottax. Perturbing and protecting a traceable block cipher. http://eprint.iacr.org/, 2006.
2. N. Courtois. The security of hidden field equations (HFE). In Progress in Cryptology - CT-RSA 2001: The Cryptographers’ Track at RSA Conference 2001, volume
2020, pages 266–281, San Francisco, CA, USA, 2001.
3. P. Delsarte, Y. Desmedt, A.M. Odlyzko, and P. Piret. Fast cryptanalysis of the
Matsumoto-Imai public key scheme. In Advances in Cryptology: Proceedings ofEurocrypt’84 - A workshop on the Theory and Application of Cryptographic Techniques, volume 209, pages 142–149, Paris, France, 1984.
4. J. Ding. A new variant of the Matsumoto-Imai cryptosystem through perturbation.
In Public Key Cryptography PKC 2004: 7th International Workshop on Theory
and Practice in Public Key Cryptography, volume 2947, pages 305–318, Singapore,
2004.
5. H. Fell and W. Diffie. Analysis of a public key approach based on polynomial
substitution. In Lecture notes in computer sciences on Advances in Cryptology –Crypto’85, volume 218, pages 340–349. Springer-Verlag, 1986.
6. P-A. Fouque, L. Granboulan, and J. Stern. Differential cryptanalysis for multivariate schemes. In Advances in Cryptology EUROCRYPT 2005: 24th Annual
International Conference on the Theory and Applications of Cryptographic Techniques, volume 3494, pages 341–353, Aarhus, Denmark, 2005.
7. H. Imai and T. Matsumoto. Algebraic methods for constructing asymetric cryptosystems. In Proceedings of Algebraic Algorithms and Error-Correctings Codes –AAECC, pages 108–119. Lecture Note in Computer Science, Springer-Verlag, 1985.
8. A. Kipnis, J. Patarin, and L. Goubin. Unbalanced oil and vinegar signatureschemes. In Lecture Notes in Computer Science on Advances in Cryptology –Eurocrypt’99, volume 1592, pages 206–222. Springer-Verlag, 1999.

43

PQCrypto 2006 Workshop Record

Gouget, Patarin

9. A. Kipnis and A. Shamir. Cryptanalysis of the oil & vinegar signature scheme.
In Lecture Notes in Computer Science on Advances in Cryptology – Crypto’98,
volume 1462, pages 257–266, London, UK, 1998. Springer-Verlag.
10. A. Kipnis and A. Shamir. Cryptanalysis of the HFE public key cryptosystem by
relinearization. In Lecture Notes in Computer Science on Advances in Cryptology– Crypto’99, volume 1666, pages 19–30. Springer-Verlag, 1999.
11. R. Lidl and H. Niederreiter. Finite fields, volume 20 of Encyclopedia of Mathematics
and its applications. Cambridge University Press, New York, NY, USA, 1997.
12. F. J. MacWilliams and N. J. A. Sloane. The theory of error-correcting codes.
Elsevier, North-Holl., 1977.
13. T. Matsumoto and H. Imai. Public quadratic polynomial-tuples for efficientsignature-verification and message-encryption. In Lecture Notes in Computer
Science on Advances in Cryptology – Eurocrypt’88, volume 330, pages 419–453.
Springer-Verlag, 1988.
14. J. Patarin. Cryptanalysis of the Matsumoto and Imai public key scheme of Eurocrypt’88. In Lecture Notes in Computer Science on Advances in Cryptology– Crypto’95, volume 963, pages 248–261, Santa Barbara, California, USA, 1995.
Springer-Verlag.
15. J. Patarin. Asymmetric cryptography with a hidden monomial. In Lecture Notes
in Computer Science on Advances in Cryptology – Crypto’96, volume 1109, pages
45–60, Santa Barbara, California, USA, 1996. Springer-Verlag.
16. J. Patarin. Hidden Fields Equations (HFE) and Isomorphisms of Polynomials(IP): Two new families of asymmetric algorithms. In Lecture Notes in Computer
Science on Advances in Cryptology - EUROCRYPT’96, volume 1070, pages 33–48,
Saragossa, Spain, 1996.
17. J. Patarin. The oil and vinegar signature scheme. Presented at the Dagstuhl
Workshop on Cryptography, 1997.
18. J. Patarin, N. Courtois, and L. Goubin. Flash, a fast multivariate signature algorithm. In CT-RSA 2001: Proceedings of the 2001 Conference on Topics in Cryptology, pages 298–307, London, UK, 2001. Springer-Verlag.
19. J. Patarin, N. Courtois, and L. Goubin. Quartz, 128-bit long digital signatures. In
CT-RSA 2001: Proceedings of the 2001 Conference on Topics in Cryptology, pages
282–297, London, UK, 2001. Springer-Verlag.
∗
20. J. Patarin, L. Goubin, and N. Courtois. C−+
and HM: Variations around two
schemes of T. Matsumoto and H. Imai. In Advances in Cryptology - ASIACRYPT’98: International Conference on the Theory and Application of Cryptology and Information Security, volume 1514, pages 35–49, Beijing, China, 1998.

21. A. Shamir. Efficient signature schemes based on birational permutations. In Advances in Cryptology - CRYPTO ’93: 13th Annual International Cryptology Conference, volume 773, pages 1–12, Santa Barbara, California, USA, 1994.
22. C. Wolf, A. Braeken, and B. Preneel. Efficient cryptanalysis of RSE(2)PKC andRSSE(2)PKC. In In Conference on Security in Communication Networks – SCN
2004, Lecture notes in computer sciences, volume 3352, pages 145–151.
23. C. Wolf and B. Preneel. Taxonomy of public key schemes based on the
problem of multivariate quadratic equations.
this paper is available at
http://www.esat.kuleuven.ac.be/cosic/.

PQCrypto 2006 Workshop Record

44Probabilistic multivariate cryptographyA

Size of the public key

Let K = GF (2). We want to evaluate the minimum number of equations of apublic key in order to ensure a security in 280 . Notice that, we also assume thatthe equations look as random equations of degree d for an adversary who do nothave the secret key.
Given a hash value of a message or a challenge y ∈ K m , an adversary canchoose a random value x ∈ K n for the signature¡mthe¢ authentication value. For
Pm or1each try, the attacker has a probability 2m i=α i to have α or more satisfied
equations. Then, m must be chosen such that:
m µ ¶
1 X m
1
≤ 80 .
m
2 i=α i2
We have m
2 < α ≤ m. Let λ be the value defined¡mα¢= λm.
¡m¢If λ is sufficiently
Pm by1
different from 2 , then thedominant term in i=α i is α . More¡ precisely,¢
Pm ¡m¢
we can overvalue i=α i by a geometric sum with the first term m
α . Thus,
we want to evaluate:
µ ¶
1 m
1
m!
1
m!
=
·
=
.
2m α
2m α!(m − α)!
2m (λm)! (m(1 − λ))!
√From stirling formula n! ∼ nn exp−n 2πn, we get:
√
µ ¶
1 m
1
mm exp−m 2πm
p
√
.
≈ m
2m α
2 (λm)λm exp−λm 2πλm · (m(1 − λ))m(1−λ) exp−m(1−λ) 2πm(1 − λ)After simplifications, we get:
µ ¶
1
1 m
´p
³
≈
.
ln(1−λ)
ln λ
2m α
m
2
1 + λ ln 2 + (1 − λ) ln 22πmλ(1 − λ)In first approximation, this will be about 2180 when m³ln(1−λ)λ
1 + λ ln
ln 2 + (1 − λ) ln 2

´
'

80 .

B

Classification of quadratic forms over GF (q)The classification of quadratic forms over GF (q) (for q odd or even) is wellknown; it is given for example in [11] pp. 278-289. We are interested here in thecase q even since q is generally a power of two. Then, we recall here the twomain theorems for the case q even.
Theorem 1 ([11] p.287). Let GF (q) be a finite field with q even. Let f ∈GF (q)[x1 , . . . , xn ] be a non degenerate quadratic form. If n is odd, then f isequivalent to:x1 x2 + x3 x4 + . . . , xn−2 xn−1 + x2n .
If n is even, then f is equivalent to one of the two forms:

45

PQCrypto 2006 Workshop Record

Gouget, Patarin

1. x1 x2 + x3 x4 + . . . , xn−1 xn
2. x1 x2 + x3 x4 + . . . , xn−1 xn + x2n−1 + ax2nwhere a ∈ GF (q) satisfies T rGF (q) (a) = 1.
Theorem 2 ([11] p.288). Let GF (q) be a finite field with q even. Let b ∈GF (q).
For odd n, the number of solutions of the equation
x1 x2 + x3 x4 + ... + xn−2 xn−1 + x2n = b
in GF (q)n is q n−1 .
For even n, the number of solutions of the equation
x1 x2 + x3 x4 + ... + xn−1 xn = b
n−2

in GF (q)n is q n−1 + ν(b)q 2 , with ν(b) = −1 if b 6= 0 and ν(0) = q − 1.
For even n and a ∈ GF (q) with T rGF (q) (a) = 1, the number of solutions of theequationx1 x2 + x3 x4 + ... + xn−1 xn + x2n−1 + ax2n = b
n−2

in GF (q)n is q n−1 − ν(b)q 2 , with ν(b) = −1 if b 6= 0 and ν(0) = q − 1.
Then, we have only one or two canonic forms when n is fixed and nondegenerate, so we have at most 2n possible canonic forms when q is fixed. This
number is generally too small to give any useful information in our schemes, forexample when the transformation LL0 is applied.

PQCrypto 2006 Workshop Record

46`-Invertible Cycles for Multivariate Quadratic
Public Key Cryptography
Jintai Ding1 , Christopher Wolf2 , and Bo-Yin Yang3
1 ding@math.uc.edu, University of Cincinnati, Cincinnati, Ohio, USA.
2 Christopher.Wolf@ens.fr,chris@Christopher-Wolf.de,École Normale Supérieure, Paris, France.
3 by@moscito.org, Tamkang University and Taiwan Info. Security Center.

Abstract
We propose a new basic trapdoor `IC (`-Invertible Cycles) for Multivariate Quadratic
public key cryptosystems of the mixed field type. While `IC is distantly related to the wellknown C ∗ or Matsumoto-Imai Scheme A (MIA) trapdoor, and share some features of thestagewise triangular systems, it has distinctive properties that sets it apart as a new basic
trapdoor in the context of Multivariate Quadratic public key systems. This is the first new
basic trapdoor since the invention of Unbalanced Oil and Vinegar in 1997, nearly a decadeago. In practice, `IC is much faster than MIA, and can even match the speed of single-field
Multivariate Quadratic schemes. We also introduce formally a new modifier, the so-called“embedding”, which can be used to construct mixed field schemes without decryption failure.
Keywords: Public Key, Multivariate Quadratic, Basic Trapdoor, Encryption, Signing

1

Introduction

We discuss Multivariate Quadratic (MQ) public key cryptosystems. These first appeared in the
English literature in the mid ’80s [FD85, IM85] as alternatives to RSA and other traditional PKCs.
Often it is remarked that we should maintain active research into alternative asymmetric cryptoalgorithms for ecological diversity. Quite true when Quantum Computers and poly-time cracking
of factoring and discrete-log-based PKCs (Shor’s algorithm [Sho97]) creeps closer to practicality.
We also hope to show that MQ PKCs are independently interesting on their own merits.
input x ∈ Fn?

x = (x1 , . . . , xn )private: S?

x0
private: P 0?

public:(p1 , . . . , pm )y0private: T

The finite field F of q elements is called the base field. P 0 ∈MQ(Fn , Fm ) is a system of m quadratic polynomials in nvariables in F, called the central map and its components
central polynomials. Composition with the affine maps S, T
masks the structure of P 0 and gives the public map:?

output y ∈ Fm ¾

P = (p1 , . . . , pm ) := T ◦ P 0 ◦ S(1)We usually write, for 1 ≤ i ≤ m, 1 ≤ j ≤ k ≤ n,PPpi (x1 , . . . , xn ) := 1≤j≤k≤n γi,j,k xj xk + nj=1 βi,j xj + αi

where αi is usually normalized to zero. The mn(n + 3)/2
coefficients γijk , βij ∈ F form the public key.

Figure 1: Illustration of Terminology and Notation for an modern MQ-trapdoor

We need to invert P 0 efficiently for PKCs. A simple method to build P 0 for consequent inversion
is a basic trapdoor. Trapdoors can be combined or modified slightly to create variants. “Modifiers”
are systemic ways to derive new trapdoors from old (cf. Sec. 4, [WP05b, Sec. 4]).

47

PQCrypto 2006 Workshop Record

Ding, Wolf, Yang

There are four previously known basic trapdoors (in the terminology of [WP05b]):Mixed-Field (or “Big Field”): Operates mostly over a much larger extension field E = F k .
MIA: Matsumoto-Imai Scheme A or C ∗ ([IM85], Imai-Matsumoto, ’85).
HFE: Hidden Field Equations ([Pat96], Patarin, ’96), a generalization of MIA.
Single-Field (or “True”): Works for the most part on the individual components of x 0 and y 0 .
UOV: Unbalanced Oil and Vinegar ([Pat97, KPG99], Patarin et al, ’97 onwards).
STS: Stepwise Triangular System (in Japanese – lectures seen in 1985 – [TKI + 86], Tsujii);[Sha93], Shamir 1993). Generalized later to its present form [GC00, WBP04].
Recent combination trapdoors MFE/TRMC or enTTS/TRMS/Rainbow [DS05b, WHL + 05,
WYHL06, YC05] are built from triangular stages — in layers or coupled with UOV.
Outline. In the next section, we introduce our new trapdoor and discuss its basic properties. In
particular, we show that certain instances can be inverted very quickly. Section 3 give cryptanalytic
properties of this basic trapdoor and enumerates possible attacks. Section 4 discusses countermeasures to these attacks, i.e., modifiers. We give the practical instances in Section 5. These weverify to withstand known attacks. The main text of the paper concludes with Section 6.
We list some pertinent background and results in the appendices. Appendix A discusses
possible extensions of `IC. Appendix C investigates the space of linearizing equations. Appendix B
discusses the state of the art for equation solvers and how they relate to `IC. The last appendix
discuss how to find parameters for secure signature schemes.

2`-Invertible Cycles (`IC)

In this section, we will introduce a new basic trapdoor for Multivariate Quadratic (MQ) publickey cryptography. We want to stress that this trapdoor does not fit into the taxonomy developedin [WP05b], and hence, we have a fifth basic trapdoor, next to MIA (Matsumoto-Imai SchemeA), HFE (Hidden Field Equations), UOV (Unbalanced Oil and Vinegar), and STS (Stepwise
Triangular System). Our new trapdoor has properties which are in between MIA on the one hand
and STS on the other hand.
It has practical value in that we can expect it to run faster, especially in resource-limited
environments (e.g. smart cards). Due to its structure, we call it “`-Invertible Cycles” (`IC).
Before motivating this name, we will first introduce the trapdoor.

2.1

Basic Trapdoor

A Cremona Transformation is a map on the projective plane that is quadratic in the homogeneous
coordinates [Ful89]. A standard example is the map (A1 , A2 , A3 ) → (A2 A3 , A3 A2 , A1 A2 ) whicheasily checks to be well-defined. The map is uniquely and efficiently invertible when A1 A2 A3 6= 0.
We extend this idea below to any integral cycle length ` ≥ 2; we illustrate with the case ` = 3
since (unfortunately) the case ` = 2 is a bit more technical.
Note that we write N for the non-negative integers, i.e., we have N := Z + ∪ {0}. To express
properly the successor in {1, . . . , `} we define½
1
for i = `µ : {1, . . . , `} → {1, . . . , `} : µ(i) :=(2)
i + 1 otherwise

PQCrypto 2006 Workshop Record

48l-invertible cycles for multivariate quadratic public key cryptography

A1
λ1

Aq1 A2 ­
­

­

­

­

­­JJ

J

­

q λ3

J A3 A1
J
J
J
J

λ2

Aq2 A3

A2

A3

Figure 2: Graphical Representation of 3-Invertible Cycles

Definition 2.1 Fix an integer ` ≥ 2 as the length of the cycle. Let F be the base field with
q := |F| elements and E :=GF(q k ) its k th -degree extension for some k ∈ Z+ . Computationsin E are modulo the irreducible polynomial π(t) ∈ F[t]. We denote Q := |E| = q k and havem = n = `k for the number of variables and equations over the ground field F, respectively. In
addition, let S, T ∈ Aff−1 (Fn ) be two invertible affine mappings and the vector Λ := (λ1 , . . . , λ` ) ∈{0, . . . , k − 1}` . We now have the following mapping:
λ`−1

λ1

λ`

P : E` → E` : (A1 , . . . , A` ) → (Aq1 A2 , . . . , Aq`−1 A` , Aq` A1 )(3)

Identifying the corresponding coefficients in the vector spaces Fn and E` , we get a canonical bijection
φ : Fn → E` : (x1 , . . . , xn ) → (x01 + x02 t + . . . x0k tk−1 , . . . , x0n−k+1 + x0n−k+2 t + x0n tk−1 ) (4)and its inverse φ−1 . The public key is computed as the composition
P : Fn → Fm : P := T ◦ φ−1 ◦ P ◦ φ ◦ S .

(5)

We then call such a Multivariate Quadratic public key system of the `IC-type.
The name “invertible cycle” is motivated by the structure of P as the variables A 1 , . . . , A` canbe drawn in the form of a cycle, see Figure 2 for the case ` = 3. The variables A 1 , A2 , A3 are theλinodes while each edge stands for a product Aqi Aµ(i) with i = 1, 2, 3.
Note that the use of the canonical bijection φ is similar for the Matsumoto-Imai Scheme A(MIA) and Hidden Field Equations (HFE). However, we have ` = 1 here, and also a different formof the central mapping P ∈ E[X]. In the sequel, we denote the output of P by
λ`−1

λ1

λ`

B1 := Aq1 A2 , . . . , B`−1 := Aq`−1 A` , B` := Aq` A1λi

Remark 2.2 The mapping Aqi is linear over the ground field F. Hence, the central equation P
can be expressed as a system of Multivariate Quadratic polynomials over the ground field F.
qλ

λi

κi

q
for 1 ≤ i ≤ ` and some κi ∈ N does not increase
Remark 2.3 Replacing Ai i Aµi by Aqi Aµ(i)λi −κi (mod k)

the security of `IC: we can always reduce the second expression to Aiq
Aµ(i) by using
Frobenius transformations. In a nutshell, we exploit that Frobenius transformations are invertible
linear mappings over the vector spaces Fn and Fk , respectively, and can hence be “absorbed” into
the mappings S, T ∈ Aff−1 (Fn ). For Multivariate Quadratic system, this idea has been introduced
under the name Frobenius sustainers [WP05a].

49

PQCrypto 2006 Workshop Record

Ding, Wolf, Yang

2.2

Singularities

To use `IC in as an encryption or as a signature scheme, we need to invert the central map P ,i.e., we need to find a solution (A1 , . . . , A` ) ∈ E` for given input (B1 , . . . , B` ) ∈ E` . Unfortunately,
this is not possible in all cases; due to its form `IC has following singularities:{ (A1 , . . . , A` ) ∈ E` | A1 = 0 ∨ . . . ∨ A` = 0}
Having Q := |E| and exploiting that Q in contrast to ` is usually “big” for practical and secureschemes we can approximate the probability that a singularity occurs byÃ!
X̀
`(Q − 1)`−1 /Q` ≈Q
i=1

In the Matsumoto-Imai Scheme A, we do not have this problem as MIA forms a bijection. In
comparison, Hidden Field Equations does not allow to compute an inverse in about 40% of allcases for a practical choice of parameters [Pat96, CGP01, WP04]. Our new trapdoor `IC is hence
between these two extreme cases. Practical values for Q will be discussed in Sec. 5.

2.3

Inversion

As we have as many free variables Ai as conditions Bi for 1 ≤ i ≤ `, we may expect one solution on
average when inverting P . Alas, this is not always true, as shown by the obvious counterexample:(B1 , B2 ) := P (A1 , A2 ) := (A1 A2 , A2 A1 ) ∈ E2 .
So there are instances of `IC that cannot be inverted usefully. For practical use, we constructbelow a sequence of specific `IC instances which allows easy inversion.
Lemma 2.4 For a fixed ` ≥ 2, let our `IC central map P : (A1 , . . . , A` ) 7→ (B1 , . . . , B` ) be½
A1 A2 for ` odd and,B1 :=Aq1 A2 for ` even
Bi := Ai Aµ(i) for 2 ≤ i ≤ ` .
Then the inverse image of (B1 . . . B` ), where Bi ∈ E ∗ := E\{0} for i = 1 · · · `, is given by r Q(`−1)/2
B2i+1

i=0

for ` odd andQ(`−1)/2


i=1

A1 :=

Ai :=






rQ

q−1

B2i

`/2−1
B2i+1
i=0
Q`/2
i=1 B2ifor ` evenBifor i = `, . . . , 2Aµ(i)Proof.
Case ` = 3: We have B1 :=p A1 A2 , B2 := A2 A3 , B3 := A3 A1 . Simple computations yield therequired result A1 := B1 B3 /B2 , A3 := B3 /A1 , A2 := B2 /A3 .

PQCrypto 2006 Workshop Record

50l-invertible cycles for multivariate quadratic public key cryptography

Case ` odd, ` > 3: We use induction to extend the result from ` = 3 to all odd ` > 3. Therefore
we observe that the structure of the central mapping P allows us to write equations of theifor 1 < i < ` by eliminating the variable Aµ(i) . Hence, the fraction
form Ai = Aµ(µ(i)) BBi+1
Bi
Bi+1 can be inserted in the inversion formula for A1 in the case (` − 2).

Case ` even: The proof for this case is analogous. Wepstart our induction with ` = 2 and haveB1 := Aq1 A2 , B2 := A2 A1 and its inverse A1 := q−1 B1 /B2 , A2 := B2 /A1 .

¤Bijectivity. For ` odd and F of characteristic 2, the above mapping is a bijection in (E ∗ )` . For` even, the situation is more difficult as (q − 1) | (q a − 1) for any a ∈ Z+ , and we loose bijectivity
for any q > 2. However, for q = 2, we obtain a bijection. Moreover, inversion now only costs two
divisions in the extension field E and we need not solve any nontrivial equations.
Special instances. We give specific names to some `IC instances given by the formulæ inLemma 2.4. These will come in useful when constructing practical schemes. We call the case
` = 2 Binary Invertible Cycle (BIC). The case ` = 3 is called Delta Invertible Cycle (DIC) due tothe form of the corresponding cycle, see Fig. 2. We may call the ` = 4 and ` = 5 cases analogously
the Square and Penta Invertible Cycles (or SIC and PIC). We will now obtain some cryptanalytic
properties of `IC before constructing actual schemes and discussing an optimal choice for `.
Extensions. Extensions of this idea are given in App. A.

3

Cryptanalytic Properties of `IC

We herein discuss some basic cryptanalytic properties of the new trapdoor. This serves a dual
purpose: We find an easy cryptanalysis for `IC in its basic form. Simultaneously, we effectively
put `IC through the same screening process as other MQ trapdoors, particularly Matsumoto Imai
Scheme A. This points us toward ways to build practical, more resilient `IC-based schemes.

3.1

Patarin Relations

We start with an extension of the Patarin relations used to cryptanalyse MIA [Pat95]. This wasused by Fouque, Granboulan, and Stern to cryptanalyse the internally perturbed MIA encryption
scheme (PMI/MIAi) [FGS05]. As is more customarily employed against symmetric cryptosystems,
we examine this multivariate differential :P (A1 , . . . , A` ) − P (A1 − δ1 , . . . , A` − δ` ) + P (δ1 , . . . , δ` )
λ1

λ1

λ`

λ`

= (A1q δ2 + A2 δ1q , . . . , Aq` δ1 + A1 δ`q )We observe that the above equations are linear in the unknowns Ai ∈ E for any given values δi ∈ E
and 1 ≤ i ≤ `. Now we simply pick δi at random and compute many differentials of the public
key. Soon we recover enough linear relations to invert the public map. This effectively finds anequivalent private key. App. C estimates the number of linearization equations for F = GF(2).
This resembles MIA and HFE in that the Patarin attack is very efficient against the former,
and an extended version of the attack defeats the latter if bijective central maps are used [Pat95,
Pat96].

51

PQCrypto 2006 Workshop Record

Ding, Wolf, Yang

3.2

Rank Attacks

In a rank attack, the quadratic parts central and public polynomials of a given Multivariate Quadratic public key system are written as symmetric matrices. We try to recover the private key
by finding linear combinations of the public matrices with certain specific ranks. They are first
introduced to cryptology by Coppersmith, Stern, and Vaudenay in the cryptanalysis of Birational
Permutations [CSV93]. See the later [GC00, WBP04, YC05] for further extensions and analysis.
Very elegant (in terms of pure algebra) versions have been presented. However Goubin and
Courtois in [GC00] has the most straightforward exposition of rank attacks. There are two distinct
types: In one the cryptanalyst randomly tries to hit kernel vectors of a linear combination of the
public matrices with the lowest rank R. The running time is proportional to q Rbm/nc . In the otherrandom linear combination are taken, hoping to locate a precipitous fall in rank. This takes time
proportional to q u , where u counts the central equations whose coefficients must vanish.
For `IC, we want to write matrices in blocks corresponding to pairs of variable in the larger field
E. Express central matrices as H1 , . . . , H` ∈ E`×` and their E-blocks as ηi,j,k ∈ E for 1 ≤ i, j, k ≤ `.

 Mλi if i = j, k = µ(i)M T if i = k, j = µ(i)
ηi,j,k := λi
0otherwiser

Where Mr is the matrix in Fk×k that correspond to the Frobenius map A 7→ Aq . Note that thesematrices are symmetric. In the case of DIC, i.e., ` = 3, they effectively specialize to






0 1 0
0 0 0
0 0 1
H1 :=  1 0 0  , H2 :=  0 0 1  , H3 :=  0 0 0  .
0 0 0
0 1 0
1 0 0

All these matrices have essentially rank 2 over the extension field E. For the actual attack, wewould need to transfer M ∈ E`×` to Fn×n . However the overall attack complexity is not affectedby this change of vector space. Just as in other schemes using extension fields (e.g. cf. MFE[WYHL06]), when performed in F we have a rank of 2k for all these matrices. We may see thatthe running time of the both the above algorithms are Q2 = q 2k times some polynomial factor
in n and m. This factor is the order of O(nω ) where ω is the order of matrix multiplication. In
practice, the size of the matrices are small enough that we can take ω = 3 (Gauss).
Note that there are instances in which one or the other rank attack simply fails to work. One
example is the case of BIC, i.e., for ` = 2. Here rank attacks will not apply as any nontrivial
linear combination of the private polynomials (matrices) have the maximum rank n = 2k. We
have checked rank attacks against `IC with some small scale examples.

3.3

Gröbner Basis Computations

Another important attack are Gröbner attacks as used against Hidden Field equations by Faugèreand Joux [FJ03]. The algorithms of the Faugère-Lazard type essentially involves doing eliminations
on an extended Macaulay matrix. These includes the methods F4 /F5 and the related algorithm
that is known in crypto circles as XL [CKPS00, Fau99, Fau02] plus their variations.
We know from the cryptanalysis of MIA and HFE that their easy algebraic structure leads
to a low running time of the corresponding Gröbner algorithm. Due to the very easy structureof `IC, we expect a similar behaviour here. This is in line small scale experiments using Magma[MAG]. A modifier is needed to disrupt the regular structure. In general, when the structure of
the system is sufficiently perturbed, the behavior is as studied by Bardet, Faugère et al [BFS04,
BFSY05, YC04b, YC04a]. Some further details are given in the Appendix B.

PQCrypto 2006 Workshop Record

52l-invertible cycles for multivariate quadratic public key cryptography

3.4

Separation of Oil and Vinegar

In the original DIC, we see that variables corresponding to the components of A 1 is only multipliedwith those of A2 and A3 . this makes for a UOV type of attack [KPG99] which has a complexity
roughly proportional to n4 q d , where d is the difference between the size of the oil and vinegar sets.
We can proceed similarly for other choices of `. We see that the UOV attack has time complexity∼ Q for odd ` and very small complexity for even `.
This would be enough to do any `IC encryption scheme in except that the “plus” modifier
disrupt the structure so that the UOV attack does not work; the minus modifier does not change
the complexity of the UOV attack, so for the parameters we choose below UOV is conjectured
not to be a problem. This is consistent with small-scale tests.

3.5

Branching

The original MIA/C∗ scheme of Matsumoto and Imai used a technique called “branching” toobtain higher speed. At first glance, branching looks quite similar to the idea of `IC: operations
in a big extension field GF(q n ) are replaced by operations in smaller extension fields GF(q k ) forsome k ¿ n. The most efficient algorithm to break branching we are aware of is from Felke[Fel04]. It separates the different branches of a given system in O(n6 ). However, there is an
important difference between `IC and branching: the operations in the different branches of C ∗were independent while there is a strong interaction between the different components of `IC.
This statement remains true even for the restricted version of Lemma 2.4. We have investigatedthis matter and concluded that the attacks against branching do not apply against `IC. Moreover,there is no known way to attack modified versions of MIA — either with the minus modification(cf Sec. 4.1) or with internal perturbation (cf Sec. 4.3).

3.6

Further Attacks

Another kind of attacks are algorithms of the XL family to solve systems of Multivariate Quadratic equations over finite fields [CKPS00]. Due to recent work [AFI+ 04, YC04a] we know thesealgorithms are variants of known Gröbner basis algorithms. A different class are algorithms from[CGMT02] which deal with the case n À m. As we usually have m = n, or n ≈ m for theembedding modification (cf Sec. 4.4), these algorithms are not applicable to our setting.
Nevertheless, due to the effectiveness of the attacks considered above, we need to apply modifiers [WP05b, Sec. 4] to the basic trapdoor to obtain secure schemes. This is the same situation as
for MIA and HFE. There may be other attacks, but to the best of our knowledge we have named
every known attack against a system of this type.

4

Modified Versions

4.1`-Invertible Cycles Minus (`IC-)

The first modification is the so-called “minus” modification. Here, we use a reduction or projection
R : Fr+m → Fm : (y1 , . . . , ym ) := (y1 , . . . , ym+r )and have r := n − m as “reduction parameter”. The public key is now constructed as
P := R ◦ T ◦ φ−1 ◦ P ◦ φ ◦ S .

53

PQCrypto 2006 Workshop Record

Ding, Wolf, Yang

In contrast to (5), we have inserted the reduction R after the affine transformation T . In effect,
this means that we drop the last r equations. When inverting `IC, we assign random values tothese missing r coordinates over F. Hence, we have q r possible inputs for each message y ∈ Fm .
As for Matsumoto-Imai Scheme A and Hidden Field Equations, the effect of the minus modification is two-fold. First, it increases the complexity of the Patarin attack (Sec. 3.1) by a factor
of q r . The argument is the same as for the original Patarin-attack against MIA: instead of one
possible solution, the attacker now faced with an r-dimensional vector space over F of possible
solutions. To our current knowledge, picking the right one requires brute force and hence at leastq r operations. Second, the attack complexity of the Faugère-Joux attack [FJ03] also increases byat least q r . The matrix algebra adds another factor of nω , cf. Sec. 3.2.
In effect, the situation resembles that of MIA/C ∗ . We cannot use `IC- for encryption schemes
but only as signature schemes: as there are r equations missing, the legitimate user has thesame workload for recovering the correct solution x ∈ Fn . As our security assumption is that q rcomputations are not possible, we reached a contradiction if we assume that the legitimate user
can obtain the message x while the attacker cannot.
As for Stepwise-Triangular Systems, the rank attack is not affected by the minus modification.
Hence, every construction using `IC- has to make sure that this attack is infeasible.

4.2`-Invertible Cycles Plus (`IC+)

The generic plus modification adds a ∈ Z+ random equations in n input variables each to theprivate key. As there is no trapdoor for these equations, they will slow down signature generation
by q a as we only have a chance of q −a that these additional conditions on the output of the `IC
mapping P will be met. For encryption, we do not have such a problem as these equations are
fulfilled by definition.
More formally, we consider P ∗ := φ−1 ◦ P ◦ φ the `IC mapping over the ground field F andP̂ ∈R MQ(Fn , Fa ) a system of a polynomials in n variables each, uniformly randomly chosen fromthe set MQ(Fn , Fa ). Moreover, we have T ∈ Aff−1 (Fn+a ) and consequently m := n + a for thenumber of equations. Defining (p01 , . . . , p0n ) := P ∗ and (p0n+1 , . . . , p0n+a ) := P̂ for the individual
polynomials of the `IC mapping P ∗ and the a random polynomials from P̂, we can express the
new trapdoor as
P : Fn → Fm : P := T ◦ P 0 ◦ S
for P 0 := (p01 , . . . , p0n , p0n+1 , . . . , p0n+a ).
Patarin relations and Gröbner attacks are not affected by the plus modification. However,
it is still useful to build an encryption scheme. In the case of MIA because the “plus” helps toovercome some attacks against the internally perturbated modification. Here, it also prevents a
UOV attack.

4.3`-Invertible Rings Internally Perturbated (`ICi)

Internal perturbation has been introduced for MIA under the name Perturbated Matsumoto-Imai— PMI [Din04]. It is also known under the name MIAi. Moreover, internal perturbation has beenused with HFE (ipHFE or HFEi) [DS05a]. As PMI/MIAi has been broken in [FGS05], a newvariant PMI+/MIAi+ has been proposed [DG05]. Due to space limitations in this paper we do
not go into details, but we want to stress that PMI+ is not affected by the attack from [FGS05].
Hence, combining the two modifications internal perturbation and plus allows the construction ofan efficient encryption scheme. However, there is one condition: the central mapping P 0 and all

PQCrypto 2006 Workshop Record

54l-invertible cycles for multivariate quadratic public key cryptography

its components need to have full rank. In our setting, this means that we we cannot use any othercycle length but ` = 2, i.e., BIC.
After talking about the impact of the internal perturbation modification, we now properly
introduce it: Let w ∈ Z+ for w < n be the perturbation dimension, P i ∈R MQ(Fw , Fn ) a
uniformly randomly chosen system in w input variables and n equations, and S i ∈ Aff−1 (Fn , Fw )the so-called “perturbation space”. Note that the perturbation space has the same input variables
x1 , . . . , xn as the affine transformation S ∈ Aff−1 (Fn ). However, it has only dimension w. Hence0 ) := S i (x , . . . , x ) for the perturbation variables z 0 , . . . , z 0 . As for the
we can write (z10 , . . . , zw
1nw
1plus modification, we denote with P ∗ := φ−1 ◦ P ◦ φ the `IC mapping over the ground field F.
The public key for `ICi is now composed as
P := T ◦ [(P ∗ ◦ S) + (P i ◦ S i )] ,i.e., we add the perturbation polynomials to the original `IC-polynomials. To invert this modified
trapdoor, i.e., to compute x ∈ Fn for given y ∈ Fm , we need to guess correctly the values of the0 ) ∈ Fw — which translates to a workload proportional to q w . As
perturbation variables (z10 , . . . , zw
the number of equations and the number of variables matches, we expect one solution on average
for any given input y ∈ Fm . However, when used as an encryption scheme, there is at least one
valid output x ∈ Fn . We know that the i modifier by itself is not secure, and it must be combinedwith the + modifier as shown by the F-G-S differential attack [FGS05].

4.4`-Invertible Cycles Embedded (`IC%) without Singularities

In this section, we introduce the previously not known modifier embedding (%). It is motivatedby the practical need to avoid singularities in trapdoors of the `IC-type.
When combined with the minus modification, singularities are of no concern: they are too
few and we can always change the input in the missing equations to obtain a possible signature.
However, when `IC is used in the context of an encryption scheme, its singularities pose a problem
as they lead to decryption failures. The modification described in this section can also be usedin other schemes which suffer from a decryption failure such as [WYHL06]. In fact, it is a newgeneric modifier and can be used in any Multivariate Quadratic construction.
For our new embedding modifier we embedding the following translation:
Fk−1 → Fk(x1 , . . . , xk−1 ) → (x1 , . . . , xk−1 , 1)
In effect, we have eliminated the zero-point from the vector space Fk . As we used the canonicalbijection φ between the vector space Fk and the extension field E, the zero of E cannot be reachedanymore for any given input (x1 , . . . , xk−1 ) ∈ F. The price we pay are less input variables, i.e.,
we now obtain an overdetermined system of polynomials.
The above idea can be easily extended to all ` variables A1 , . . . , A` ∈ E. Calling the corresponding transformation ν : Fn → Fn−` and setting k := (n − `)/` for k ∈ N we obtain thefollowing construction for the public key
P = T ◦ φ−1 ◦ P ◦ ν ◦ S .

(6)

To obtain a singularity free `IC for signing, the “inverse” transformation
ν −1 : (y1 , . . . , yk−1 , 1) → (y1 , . . . , yk−1 )55

PQCrypto 2006 Workshop Record

Ding, Wolf, Yangneeds to be inserted between the affine transformation T and the `IC mapping P . To the same
effect, we could have used the construction of (6). However, this would have slowed down signature
generation by a factor of q ` as we have ` additional equations over F to satisfy for any given input
B1 , . . . , B` ∈ E.

5Practical Instances

Herein we use the cryptanalytic results from the previous section to develop practical instancesof `IC. Main purpose is to see how variations on `IC scales up for different security levels.

5.1

Signature

To obtain a secure signature scheme, we use `IC- as this seems the most suitable modificationfor our purpose. In particular, the security of the minus modification is well understood; we are
therefore able to give instances of `IC for several security levels. Different choices of parameters
are discussed in App. D. We restrict to the case q = 256 as this allows efficient implementationon 8-bit microprocessors which are still dominant in low-end smart cards. We summarize optimal
choices in Table 1. It is very different for encryption, which everyone believes to be more difficult.
Table 1: `IC- over GF(256) with Different Security Levels for Signing

ClaimedSecurity

Input[bits]

Output[bits]

nm

Parameters
` k
r

280
296

160
192

240
288

30
36

20
24

3
3

10
12

20
24

280
296

285
2104

9.92
16.8

1.86
2.59

2128

256

384

48

32

3

16

32

2130

2137

39.20

4.70

5.2

Attack ComplexityGröbner Rank/UOVKey Size [kBytes]
PublicPrivateEncryption

We base our proposed encryption scheme on BICi+%, i.e., 2-Invertible Cycles with internal
perturbation, added equations, and embedding. We have the following reasons for this choice:first, we cannot use `IC or BIC in its original form, due to Patarin attacks. Second, to use internal
perturbation, we need `IC with full rank. This implies ` = 2 and hence BIC. Moreover, internal
perturbation alone is not secure, due to the efficient attack from [FGS05]. Therefore, we need
the plus modification. Last but not least we want to avoid decryption errors and hence include
the embedding modification. With this choice of scheme, we suggest the following parameters:
q = 2, n = 132, m = 146, ` = 2, k = 67, w = 6, a = 12. This leads to a public key of 160.2 kBytes
and a private key of 5.7 kBytes, respectively. The claimed security level is 280 . Our choice ofparameters is based on [DG05]. Due to space limitations in this paper we do not repeat theirarguments but point to [DG05]. However, we want to stress that at present, our understandingof the security of the internal perturbation modification is limited although there some results
on Gröbner bases in [DGS+ 05]. This means in particular that we do not have precise security
estimations for higher security levels.

PQCrypto 2006 Workshop Record

56

l-invertible cycles for multivariate quadratic public key cryptography

5.3

Implementation and Speed

A good overview on implementing finite field operations can be found in [LD00]. Computing
direct division in finite fields is given in [FW02]. Counting operations for the inversion formulain Lemma 2.4 over E =GF(q k ), we see that we need ` division, (` − 2) multiplications, and one
root. Note that the operations do not take place in a big field GF(q n ) but in a much smaller
extension field GF(q k ). It is difficult to give a closed formula for the speed of basic arithmetic
operations as they largely depend on the model used, e.g., hardware vs. software, operations on
bits vs. operations on processor words. Nevertheless, when counting our costs in operations in
the ground field F, we can roughly say that we have O(a2 ) for squaring/multiplying and O(a3 )for division/exponentiation. Here we have l ∈ Z+ the extension degree of the corresponding field
E = GF(q a ) over the ground field F = GF(q). We have to keep this in mind when comparing `ICwith the other two mixed field schemes MIA and HFE.
Comparison with MIA and HFE. Inverting the mixed field scheme MIA costs one exponentiation with large exponent [CGP02]. In a nutshell, this translates to n squaring operations and1/2n multiplications in GF(q n ). Therefore, we obtain an overall workload of O(n3 ). Tricks to
speed this operation up can be found in [ACDG03]. In the case of HFE, the situation is even worse
as we need to execute a complete root finding algorithm to invert the central mapping [CGP01].
Its running time is estimated to be in O(n3 d2 + n2 d3 ) for d the total degree of the central mapping[Pat96]. In practice, we have d = 129 . . . 257.
We can summarize our results for the three maps MIA, HFE, and `IC as follows: the firstneeds O(n3 ) operations in the ground field F for n the extension degree as it needs to compute
Y h for given Y ∈ GF(q n ) and h ∈ Z+ , i.e., an exponentiation. The second needs to solve a
univariate polynomial equation P (X) = Y for P being a polynomial of fixed degree d ∈ Z + . The
corresponding running time is about O(n3 d2 + n2 d3 ) operations in the ground field F. Finally,`IC needs O(`k 3 + `k 2 + d2 k 3 + d3 k 2 ) operations over the ground field F although some choices of`, d allow a lower running time (see above).
A choice for MIA is Sflashv2 with q = 128, n = 37 [CGP02]. For HFE, we have q = 2,
n = 103 in Quartz [CGP01]. Choices for `IC are given in Sec. 5.2 and Table 1, respectively. Both
trapdoors have a claimed security level of 280 3DES computations as required in NESSIE [NES].
Note that Quartz uses the underlying trapdoor four times to achieve very short signatures of 128
bit. This special construction is called a “Chained Patarin Construction” (CPC). We summarize
our comparison in Table 2. preliminary runs shows that signing with m = 24, n = 36 is at least
3–5 times as fast as SFLASH (which also means it is faster than enTTS [YC05]).
Further Speed up. Using two arithmetic units, we can speed up the above inversion: as soon
as we have the value for A1 , we can compute the values Ai for i ≥ 2 using the cycle in the otherdirection.

6

Conclusions

In this article, we have constructed a new basic Multivariate Quadratic trapdoor called `-invertible
cycles (`IC). It is the first time since nearly a decade that a basic trapdoor has been found. The
main motivation for this new trapdoor is speed: instead of computing operations in the big
finite field E = GF(q n ) for q := |F| and n the number of variables, we compute in the muchsmaller extension field E = GF(q k ) for n = `k for some cycle length `. Typical choices of ` are
2 . . . 6. Depending on the architecture, finite field arithmetic costs up to O(n3 ). Hence, decreasing

57

PQCrypto 2006 Workshop Record

Ding, Wolf, Yang

the size of the extension field E results in a significant speed-up in practice. In particular, ourimplementation is expected to outperform the previously fasted trapdoor Matsumoto-Imai Scheme
A (MIA). In addition, we have formally introduced the new embedding modifier (%). It is
motivated by the practical need to achieve `IC-type schemes without decryption failure. Apartfrom `IC, constructions like [WYHL06] suffer from this problem.
Table 2: Mixed Field Trapdoors with Claimed Security Level 280

Trapdoor

Complexity to
Invert Trapdoor

Parameters

Key Size [kBytes]
PublicPrivateHFE (Quartz)
MIA (Sflash)O(n3 d2 + n2 d3 )O(n3 )

q = 2, n = 103, d = 129
q = 128 n = 37

71
15.4

3
2.45

`IC, ` = 3

O(`k 3 + `k 2 + d2 k 3 + d3 k 2 )q = 256, k = 10, d = 255

9.92

1.86

Table 2 shows the different complexities, parameters and public key sizes for trapdoors ofthe mixed field types with a claimed security level of 280 . Unfortunately, we do not have exact
estimations on their inherent complexity but asymptotic ones. Nevertheless, we see that `ICfor a similar security level is expected to perform significantly better than the two other basic
trapdoors HFE (using parameters from Quartz) and MIA (parameters from Sflash v2 ). Apart from
this, we have shown that `IC can be used both in signature schemes of various security levels aswell as in an encryption scheme. We want to stress here that trapdoors from the single field class,i.e., Unbalanced Oil and Vinegar (UOV) and Stepwise-Triangular Schemes (STS) do not allow
constructions leading to encryption schemes.
So as an overall conclusion, we have presented a new trapdoor which is both interesting froma theoretical point of view and also has advantages over previously known schemes. At present
we have to leave it as an open question if other forms of `IC than these given in Lemma 2.4 allow
efficient inversion. Some leads to this question have been given in App. A.
We stress that it is still an original sin that no list of possible attacks can be exhaustive. Multivariate Quadratic schemes are still in need of some provable security results. But we hope to haveshown that the variety available in the genre keeps it in play and interesting.

References[ACDG03] Mehdi-Laurent Akkar, Nicolas T. Courtois, Romain Duteuil, and Louis Goubin. A
fast and secure implementation of SFlash. In Public Key Cryptography — PKC 2003,
volume 2567 of Lecture Notes in Computer Science, pages 267–278. Y. Desmedt, editor,
Springer, 2002.
[AFI+ 04]

Gwénolé Ars, Jean-Charles Faugère, Hideki Imai, Mitsuru Kawazoe, and Makoto
Sugita. Comparison between xl and gröbner basis algorithms. In Advances in Cryptology — ASIACRYPT 2004, volume 3329 of Lecture Notes in Computer Science, pages
338–353. Pil Joong Lee, editor, Springer, 2004.

[BFS04]

M. Bardet, J.-C. Faugère, and B. Salvy. On the complexity of gröbner basis computation of semi-regular overdetermined algebraic equations. In Proceedings of theInternational Conference on Polynomial System Solving, pages 71–74, 2004.

PQCrypto 2006 Workshop Record

58

l-invertible cycles for multivariate quadratic public key cryptography[BFSY05] M. Bardet, J.-C. Faugère, B. Salvy, and B.-Y. Yang. Asymptotic expansion of thedegree of regularity for semi-regular systems of equations. In P. Gianni, editor, MEGA
2005 Sardinia (Italy), 2005.
[CGMT02] Nicolas Courtois, Louis Goubin, Willi Meier, and Jean-Daniel Tacier. Solving underdefined systems of multivariate quadratic equations. In Public Key Cryptography —PKC 2002, volume 2274 of Lecture Notes in Computer Science, pages 211–227. David
Naccache and Pascal Paillier, editors, Springer, 2002.
[CGP01]

Nicolas Courtois, Louis Goubin, and Jacques Patarin. Quartz: Primitive specification (second revised version), October 2001. https://www.cosic.esat.kuleuven.
be/nessie Submissions, Quartz, 18 pages.

[CGP02]

Nicolas Courtois, Louis Goubin, and Jacques Patarin. Sflash: Primitive specification (second revised version), 2002. https://www.cosic.esat.kuleuven.be/nessie,
Submissions, Sflash, 11 pages.

[CKPS00] Nicolas T. Courtois, Alexander Klimov, Jacques Patarin, and Adi Shamir. Efficientalgorithms for solving overdefined systems of multivariate polynomial equations. In
Advances in Cryptology — EUROCRYPT 2000, volume 1807 of Lecture Notes in
Computer Science, pages 392–407. Bart Preneel, editor, Springer, 2000. Extended
Version: http://www.minrank.org/xlfull.pdf.
[Cr93]

Douglas R. Stinson, editor. Advances in Cryptology — CRYPTO 1993, volume 773 ofLecture Notes in Computer Science. Springer, 1993. ISBN 3-540-57766-1.

[CSV93]

Don Coppersmith, Jacques Stern, and Serge Vaudenay. Attacks on the birational
permutation signature schemes. In Cr [Cr93], pages 435–443.

[DG05]

Jintai Ding and Jason E. Gower. Inoculating multivariate schemes against differential attacks. In Public Key Cryptography — PKC 2006, Lecture Notes in Computer Science. Springer, 2005. 12 pages, to appear at PKC’06, preliminary version at
http://eprint.iacr.org/2005/255.

[DGS+ 05] Jintai Ding, Jason E. Gower, Dieter Schmidt, Christopher Wolf, and Z. Yin. Complexity estimates for the F4 attack on the perturbed Matsumoto-Imai cryptosystem.
In Cryptography and Coding - 10th IMA International Conference, volume 3796 of
Lecture Notes in Computer Science, pages 262–277. Nigel P. Smart, editor, Springer,
2005.
[Din04]

Jintai Ding. A new variant of the Matsumoto-Imai cryptosystem through perturbation.
In Public Key Cryptography — PKC 2004, volume 2947 of Lecture Notes in Computer
Science, pages 305–318. Feng Bao, Robert H. Deng, and Jianying Zhou (editors),
Springer, 2004.

[DS05a]Jintai Ding and Dieter Schmidt. Cryptanalysis of HFEv and internal perturbation of
HFE. In PKC [PKC05], pages 288–301.

[DS05b]

Jintai Ding and Dieter Schmidt. Rainbow, a new multivariable polynomial signaturescheme. In Conference on Applied Cryptography and Network Security — ACNS 2005,
volume 3531 of Lecture Notes in Computer Science, pages 164–175. Springer, 2005.

59

PQCrypto 2006 Workshop Record

Ding, Wolf, Yang

[Fau99]Jean-Charles Faugère. A new efficient algorithm for computing Gröbner bases (F 4 ).
Journal of Pure and Applied Algebra, 139:61–88, June 1999.

[Fau02]

Jean-Charles Faugère. A new efficient algorithm for computing Gröbner bases without reduction to zero (F5 ). In International Symposium on Symbolic and Algebraic
Computation — ISSAC 2002, pages 75–83. ACM Press, July 2002.

[FD85]

Harriet Fell and Whitfield Diffie. Analysis of public key approach based on polynomial
substitution. In Advances in Cryptology — CRYPTO 1985, volume 218 of Lecture
Notes in Computer Science, pages 340–349. Hugh C. Williams, editor, Springer, 1985.

[Fel04]

Patrick Felke. On the affine transformations of HFE-cryptosystems and systems with
branches. Cryptology ePrint Archive http://eprint.iacr.org, Report 2004/367,
2004. http://eprint.iacr.org/2004/367, version from 2004-12-17, 10 pages.

[FGS05]

Pierre-Alain Fouque, Louis Granboulan, and Jacques Stern. Differential cryptanalysis
for multivariate schemes. In Advances in Cryptology — EUROCRYPT 2005, Lecture
Notes in Computer Science. Ronald Cramer, editor, Springer, 2005. 341–353.

[FJ03]

Jean-Charles Faugère and Antoine Joux. Algebraic cryptanalysis of Hidden Field
Equations (HFE) using Gröbner bases. In Advances in Cryptology — CRYPTO 2003,
volume 2729 of Lecture Notes in Computer Science, pages 44–60. Dan Boneh, editor,
Springer, 2003.

[Ful89]William Fulton. Algebraic curves. An introduction to algebraic geometry, a Reprintof 1969 original in Advanced Book Classics. Addison-Wesley Publishing Company,
Redwood City, CA, 1989. ISBN: 0-201-51010-3.

[FW02]

Patrick Fitzpatrick and Christopher Wolf. Direct division in factor rings. Electronic
Letters, 38(21):1253–1254, October 2002. Extended version: http://eprint.iacr.
org/2004/353, 7 pages.

[GC00]Louis Goubin and Nicolas T. Courtois. Cryptanalysis of the TTM cryptosystem.
In Advances in Cryptology — ASIACRYPT 2000, volume 1976 of Lecture Notes in
Computer Science, pages 44–57. Tatsuaki Okamoto, editor, Springer, 2000.

[IM85]

Hideki Imai and Tsutomu Matsumoto. Algebraic methods for constructing asymmetric cryptosystems. In Algebraic Algorithms and Error-Correcting Codes, 3rd International Conference, AAECC-3, Grenoble, France, July 15-19, 1985, Proceedings,
volume 229 of Lecture Notes in Computer Science, pages 108–119. Jacques Calmet,
editor, Springer, 1985.

[KPG99]Aviad Kipnis, Jacques Patarin, and Louis Goubin. Unbalanced Oil and Vinegar signature schemes. In Advances in Cryptology — EUROCRYPT 1999, volume 1592 of
Lecture Notes in Computer Science, pages 206–222. Jacques Stern, editor, Springer,
1999.

[LD00]

Julio Lopéz and Ricardo Dahab. An overview of elliptic curve cryptography. Technicalreport, Institute of Computing, State University of Campinas, Brazil, 22 nd of May
2000. http://citeseer.nj.nec.com/333066.html or http://www.dcc.unicamp.
br/ic-tr-ftp/2000/00-14.ps.gz.

PQCrypto 2006 Workshop Record

60

l-invertible cycles for multivariate quadratic public key cryptography[MAG]

Computational Algebra Group, University of Sydney. The MAGMA Computational
Algebra System for Algebra, Number Theory and Geometry. http://magma.maths.
usyd.edu.au/magma/.

[NES]

NESSIE: New European Schemes for Signatures, Integrity, and Encryption. Information Society Technologies programme of the European commission (IST-1999-12324).
http://www.cryptonessie.org/.

[Pat95]

Jacques Patarin. Cryptanalysis of the Matsumoto and Imai public key scheme ofEurocrypt’88. In Advances in Cryptology — CRYPTO 1995, volume 963 of Lecture
Notes in Computer Science, pages 248–261. Don Coppersmith, editor, Springer, 1995.

[Pat96]

Jacques Patarin. Hidden Field Equations (HFE) and Isomorphisms of Polynomials(IP): two new families of asymmetric algorithms. In Advances in Cryptology — EUROCRYPT 1996, volume 1070 of Lecture Notes in Computer Science, pages 33–48.
Ueli Maurer, editor, Springer, 1996. Extended Version: http://www.minrank.org/
hfe.pdf.

[Pat97]

Jacques Patarin. The oil and vinegar signature scheme. presented at the Dagstuhl
Workshop on Cryptography, September 1997. transparencies.

[PKC05]Serge Vaudenay, editor. Public Key Cryptography — PKC 2005, volume 3386 ofLecture Notes in Computer Science. Springer, 2005. ISBN 3-540-24454-9.

[Sha93]Adi Shamir. Efficient signature schemes based on birational permutations. In Cr[Cr93], pages 1–12.

[Sho97]

Peter W. Shor. Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM Journal on Computing, 26(5):1484–1509,
October 1997.

[TKI+ 86]

S. Tsujii, K. Kurosawa, T. Itoh, A. Fujioka, and T. Matsumoto. A public key cryptosystem based on the difficulty of solving a system of nonlinear equations. ICICE
Transactions (D) J69-D, 12:1963–1970, 1986.

[WBP04]

Christopher Wolf, An Braeken, and Bart Preneel.
Efficient cryptanalysis of
RSE(2)PKC and RSSE(2)PKC. In Conference on Security in Communication Networks — SCN 2004, volume 3352 of Lecture Notes in Computer Science, pages 294–
309. Springer, September 8–10 2004. Extended version: http://eprint.iacr.org/
2004/237.

[WHL+ 05] Lih-Chung Wang, Yuh-Hua Hu, Feipei Lai, Chun-Yen Chou, and Bo-Yin Yang.
Tractable rational map signature. In PKC [PKC05], pages 244–257.
[WP04]

Christopher Wolf and Bart Preneel. Asymmetric cryptography: Hidden Field Equations. In European Congress on Computational Methods in Applied Sciences andEngineering 2004. P. Neittaanmäki, T. Rossi, S. Korotov, E. Oñate, J. Périaux,and D. Knörzer, editors, Jyväskylä University, 2004. 20 pages, extended version:
http://eprint.iacr.org/2004/072/.

[WP05a]Christopher Wolf and Bart Preneel. Equivalent keys in HFE, C∗ , and variations. In
Proceedings of Mycrypt 2005, volume 3715 of Lecture Notes in Computer Science, pages

61

PQCrypto 2006 Workshop Record

Ding, Wolf, Yang

33–49. Serge Vaudenay, editor, Springer, 2005. Extended version http://eprint.
iacr.org/2004/360/, 15 pages.
[WP05b]Christopher Wolf and Bart Preneel. Taxonomy of public key schemes based on the
problem of multivariate quadratic equations. Cryptology ePrint Archive http://
eprint.iacr.org, Report 2005/077, 12th of May 2005. http://eprint.iacr.org/
2005/077/, 64 pages.

[WYHL06] Lih-Chung Wang, Bo-Yin Yang, Yuh-Hua Hu, and Feipei Lai. A “medium-field”
multivariate public-key encryption scheme. In CT-RSA, volume 3860 of Lecture Notes
in Computer Science, pages 132–149. David Pointcheval, editor, Springer, 2006.
[YC04a]Bo-Yin Yang and Jiun-Ming Chen. All in the XL family: Theory and practice. In
ICISC 2004, pages 67–86. Springer, 2004.

[YC04b]

Bo-Yin Yang and Jiun-Ming Chen. Theoretical analysis of XL over small fields. In
ACISP 2004, volume 3108 of LNCS, pages 277–288. Springer, 2004.

[YC05]

Bo-Yin Yang and Jiun-Ming Chen. Building secure tame-like multivariate public-key
cryptosystems: The new TTS. In ACISP 2005, volume 3574 of LNCS, pages 518–531.
Springer, July 2005.

A

Extensions

The trapdoor `IC we described in this article can be extended in several ways. Due to efficiency
considerations, we only discuss extensions which allow a public key P of maximal degree 2, i.e.,
we discard constructions of cubic or higher type.
Even with this restriction, there are two obvious extensions. For the first we observe that theprivate key matrices are of degree 2k. As this allows rank attacks (see Sec. 3.2), we would like toobtain a higher rank for the private key matrices. We can do this by allowing more input variables
Ai per coordinate Bi with 1 ≤ i ≤ `. In its most general form, we can associate to each coordinate
Bi a set of quintuples from the following set:
S := {(i, j, λ, κ, γ) ∈ N4 × E∗ | 1 ≤ i ≤ j ≤ ` ∧ 0 ≤ λ, κ < k}We now have an `-tuple of sets Bi ⊂ S for each output Bi :Xλ
κγAqi Aqj for 1 ≤ i ≤ `
Bi :=

(7)

(8)

(i,j,λ,κ,γ)∈Bi

The challenge is to find sets Bi , safe against all known attacks but still allowing easy inversion.
More Complicated Structures To effect inversion with product-type structures like in `IC,
where each equation only has two variables, we will have a cycle-like structure like somewhere.
This shows that the `IC is in some sense a basic trapdoor as we claimed.
Double cycles. A solution for the first is the Double Cycle paradigm for ` > 3:
Bi := {(i, µ(i), 0, 0, 1), (i, µ(µ(i)), 0, 0, 1)} for 1 ≤ i ≤ `(9)Note that we have 0 ∈ N but 1 ∈ E∗ here. Unfortunately, these formulæ do not permit an easyclosed inversion although they offer more protection against rank attacks as `IC polynomials do.

PQCrypto 2006 Workshop Record

62l-invertible cycles for multivariate quadratic public key cryptography

HFE-like polynomials. The second variation is in the spirit of the HFE system: instead of
having monomials, we allow polynomials in the two input variables Ai Aµ(i) for each coordinate
Bi and 1 ≤ i ≤ `. More formally, we have
Bi := {(i, µ(i), λ, κ, γ)} for 1 ≤ i ≤ `(10)

To allow fast inversion, we will in most cases have some maximal degree d ∈ N and hence q λ +q κ ≤ d
as additional condition in the sets from (10). However, the fact that we have polynomials insteadof monomials will defeat certain attacks. In particular, Gröbner base algorithms (see Sec. 3.3)
and Patarin-type attacks (see Sec. 3.1) are more difficult now. Obviously, it is possible to combine
both idea and hence have high-rank HFE-like systems.
All trapdoors of the form (8) lead to Multivariate Quadratic public key systems. However,
inversion becomes more costly so we have to leave it as an open question if these schemes haveadvantages in practice.

B

More About Gröbner Basis Attacks

When attacking with FXL or any more advanced algorithms of the Lazard-Faugeère family, andwhen the resulting matrix equation is solved in the same order as the Lanczos/Wiedemann type:
( µ
¶
¾¾
¶2 µ
µ
¶¶¯¯
½
µ
n+d−f
(1 − t2 )m (1 − tq )n−f¯
f n+d−fD<0min q
c0 + c1 lg
D
:
[t
]
d
:=
min
¯
¯
d
d
(1 − t)n+1−f (1 − t2q )mThe analysis is extremely complex. Bardet et al investigated the issue found the asymptotic
estimates for the degree [BFS04, BFSY05, YC04b]. It is shown by Yang and Chen that for
generic systems some measure of guessing to get overdeterminedness is always correct [YC04a].
The current consensus is that for m = n = 20 and q = 256, the complexity of solving a generic
MQ instance is anywhere between 272 to 280 3DES blocks using guessing and sparse matrices.
With parameters in this heneral range, for every 4 variables and equations added, the complexity
goes up by ∼ 210 . As m = n increases, the best-case generic solving using a Lazard-Faugère typesolver with optimized guessing goes up with 22.4n times a polynomial. For q = 2, the best-casetiming for generic polynomials should go up with 20.785n times a polynomial.

C

The Space of Linearization Equations

To know if the Patarin attack from Sec. 3.1 is efficient, we need to know the number of linearization
equations. In particular, if this number is higher than expected, this attack becomes more efficient.
To simplify the proof, we restrict to ` = 2, q = 2. However, the ideas presented in this section
can be easily extended although the overall proof becomes more technical. As usual, we have E
the `th degree extension of F.
Let P be the `IC-mapping, i.e., a map E × E to itself with
(B1 , B2 ) := P (A1 , A2 ) = (A1 A2 , A2 Aq1 )The quadruple (B1 , B2 , A1 , A2 ) forms a surface in E4 . We are interested in finding the linearization
equations over F.
There are four obvious types:
B1q A1 + B2 Aq1 = 0, B1 Aq2 + B2 A2 = 0, B2 A1 + B1q = 0, B1 A2 + B2 = 0.

63

(11)

PQCrypto 2006 Workshop Record

Ding, Wolf, Yang

We now want to check if there are any other linearization equations then the ones coming fromthe linear combination of these four types. As we will see below, the answer is no.
Proposition C.1 For q = 2, any linearization equation comes from a linear combination of (11).
Proof. If there is any linearization equation, we know from [DGS+ 05] that it must come from a
nontrivial equation of the form:
`−1
X

i

j

a1,i,j B1q Aq1 +

i,j=0

+

`−1
X

i

j

i

`−1
X

i

ci Aq1 +

i=0

`−1
X

`−1
X

j

b1,i,j B1q Aq2 +i,j=0

b02,i,j B2q Aq2 +

i,j=0

`−1
X

i

j

a02,i,j B2q Aq1

i,j=0
j

dj Aq2 +

j=0

`−1
X

`−1
X

i

ei B1q +i=0i

fi B2q + g = 0.

i=0For a1,i,j , b1,i,j , a02,i,j , b02,i,j , ci , dj , ei , fi , g ∈ GF(2) with 0 ≤ i, j < `. The above equation can be
written as
`−1
X

j

i

a1,i,j (A1 A2 )q Aq1 +

+

i

j

i

b02,i,j (A1 Aq2 )q Aq2 +

`−1
X

i

ci Aq1 +i

ja02,i,j (A1 Aq2 )q Aq1

i,j=0
j

dj Aq2 +`−1X

iei (A1 A2 )q +

`−1
X

i

fi (A1 Aq2 )q + g = 0,

i=0

i=0

j=0

i=0

i,j=0

`−1
X

`−1
X

j

b1,i,j (A1 A2 )q Aq2 +

i,j=0

i,j=0
`−1
X

`−1
X

for any pair (A1 , A2 ). This implies Ci = 0, dj = 0 for 0 ≤ i, j < ` and g = 0. Therefore thisequation simplifies to
`−1
X

i

j

i

a1,i,j Aq1 +q Aq2 +

i,j=0

`−1
X

i

i

j

b1,i,j Aq1 A2q +q +

i,j=0
`−1
X

i,j=0

`−1
X

i

j

i+1

a02,i,j Aq1 +q Aq2

+

i,j=0

i+1
j
i
b02,i,j Aq1 Aq2 +q +

`−1
X
i=0

i
i
ei Aq1 Aq2 +

`−1
X

i

i+1

fi Aq1 Aq2

= 0.

i=0

It is clear that
1. if i 6= j we have a1,i,j = 0, b1,i,j = 0 and a02,i,j = 0 except for a01,i−1,i , a1,i,i−1 because q i + q j
is not a power of q
2. if i + 1 6= j we have b02,i,j = 0, except for b02,i,i , b1,i,i+1 because q i+1 + q j is not a power of q.

PQCrypto 2006 Workshop Record

64l-invertible cycles for multivariate quadratic public key cryptography

Moreover, we have
`−1
X

`−1
X

i
i−1
i
a1,i,i−1 Aq2 Aq1 +q +i−1

a01,i−1,i Aq2

Aq1 +q

i

i−1

i

i+1

i

i+1

i

i+2

+

i,j=0

i,j=0
`−1
X

i

b1,i,i+1 A1 q i Aq2 +q

i+1

+

`−1
X

i

b02,i,i Aq1 A2q +q

+

i,j=0

i,j=0
`−1
X

i+1
i
a1,i,i Aq1 Aq2 +

i,j=0
`−1
X

`−1
X

b1,i,i Aq1 Aq2

+

i,j=0
i+1

a02,i,i Aq1

i+1

Aq2

`−1
X

+

b02i,i+1 Aq1 Aq2

+

i,j=0

i,j=0
`−1
X

i
i
ei Aq1 Aq2 +

`−1
X

i+1

i

fi Aq1 Aq2

= 0.

i=0

i=0

This impliesb02,i,i = b1,i,i+1 , a01,i−1,i = a1,i,i−1 , a1,i,i = b02,i,i+1 = 0, a02,i,i = ei+1 , b1,i,i = fi .
In other words, all linearization equations come from the following form:
`−1
X

i−1

i

a1,i,i−1 B1q Aq1

a1,i,i−1 B2q

i−1

i

Aq1 +

i,j=0

i,j=0
`−1
X

`−1
X

+

i

i+1

b1,i,i+1 B1q Aq2

+

i,j=0

`−1
X

i

i

b1,i,i+1 B2q Aq2 +

i,j=0
`−1
X

ei B2q

i−1

i−1

Aq1

+

i=0

`−1
X

i

i

`−1
X

i

ei B1q +

i=0
`−1
X

fi B1q Aq2 +fi B2q

i

= 0

i=0

i=0

This can be rewritten as`−1X

a1,i,i−1 (z1q A1 + z2 Aq1 )q

i−1

+

`−1
X

i

b1,i,i+1 (z1 Aq2 + z2 A2 )q +

i,j=0

i,j=0
`−1
X

i
ei (B2 A1 + B1q )q +`−1X

fi (B1 A2 + B2 )q

i

= 0.

i,j=0

i,j=0

¤
Similarly we can show that the dimension of the space of linearization equations is exactly
4`. We also see that if we substitute values for Z1 , Z2 , we can solve for A1 , A2 . In particular thismeans that linear equations derived for given ciphertext is of full rank.

65

PQCrypto 2006 Workshop Record

Ding, Wolf, Yang

D

Choices of Parameters

We investigate several choices for a signature scheme based on `IC- with given security level. Aim
is to find an optimal point in terms of efficiency and key size. The data is too long to give here
and fit within a reasonable limit, but the conclusion is: ` = 3 is best for signature and ` = 2 forencryption (with a “plus” modifier).

PQCrypto 2006 Workshop Record

66This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

More quantum algorithms
Oded Regev
Tel-Aviv University

In this talk I will describe some attempts to construct quantum algorithms to deal with problems
not addressed by Shor’s algorithms and subsequent developments. A particular emphasis will be
put on quantum algorithms for lattice problems, as those are one of our best candidates for postquantum cryptography. Among other things, I will describe the connection to the dihedral hidden
subgroup problem, and show how the ability to create certain quantum states implies interesting
quantum algorithms.

85

PQCrypto 2006 Workshop Record

High Order Linearization Equation (HOLE)
Attack on Multivariate Public Key
Cryptosystems
Jintai Ding1, Lei Hu2 , Xuyun Nie2 , Jianyu Li2 , John Wagner1
1

Department of Mathematical Sciences,
University of Cincinnati,
Cincinnati, OH, 45220, USA
2
State Key Laboratory of Information Security,
Graduate School of Chinese Academy of Sciences,
Beijing 100049, China
ding@math.uc.edu, {hu, nxy04b, ljy}@is.ac.cn, wagnerjh@email.uc.edu

Abstract. In the CT-track of the 2006 RSA conference, a new multivariate public key cryptosystem, which is called the Medium Field Equation (MFE) multivariate public key cryptosystem, is proposed by Wang,
Yang, Hu and Lai. We use the second order linearization equation attack
method by Patarin to break MFE. Given a ciphertext, we can derive
the plaintext within 223 F216 -operations, after performing once for any
public key a computation of complexity less than 252 . We also propose ahigh order linearization equation (HOLE) attack on multivariate publickey cryptosystems, which is a further generalization of the ( first andsecond order) linearization equation (LE). This method can be used toattack extensions of the current MFE.
Keywords: multivariate public key cryptosystem, quadratic polynomial,
algebraic cryptanalysis, high order linearization equation.

1

Introduction

For the last three decades, public key cryptosystems, as a revolutionary breakthrough in cryptography, have developed into an indispensable element of ourmodern communication system. For RSA and other number theory based cryptosystems, their security depends on the assumption about the difficulty of certain number theory problems, such as the Integer Prime Factorization Problem
or the Discrete Logarithm Problem. However, due to the quantum computer attack by Shor [Sho99] and the demand for more efficient cryptosystems for small
devices, there is a great challenge to build new public key cryptosystems, inparticular ones that could survive future attacks utilizing quantum computers[PQ].
One such research direction utilizes a set of multivariate polynomials over afinite field, in particular, quadratic polynomials, as the public key of the cipher,which are called multivariate public key cryptosystems (MPKC). This method

87

PQCrypto 2006 Workshop Record

Ding, Hu, Nie, Li, Wagner

is based on the proven theorem that solving a set of multivariate quadratic
polynomial equations over a finite field generally is an NP-hard problem. Note,however, this does not guarantee that these new cryptosystems are secure. In thelast decade, there has been tremendous amount of work devoted to this area. In
2004, one such cryptosystem, Sflash [ACDG03] [PCG01a], was accepted as oneof the final selections in the New European Schemes for Signatures, Integrity,and Encryption: IST-1999-12324. A more efficient family of Rainbow signatureschemes was also proposed last year [DS05] [YC05] [WHLCY05].
In the development of MPKC, one particular interesting and important newarea is the development of the so-called algebraic attack. This new attack method
started from the linearization equation (LE) attack by Patarin [Pat95], which
is used to break Matsumoto-Imai cryptosystems. A linearization equation is anequation in the form:
X
XX
aij uivj +bi ui +
cj vj + d = 0,
where the ui are components of the plaintext and the vj are components of theciphertext.
Later, Patarin, Courtois, Shamir, and Kipnis generalized this method by1αnmultiplying high order terms uα
1 · · · un of the plaintext variables but using
only linear terms of ciphertext variables (vj ), which is called the XL method[CKPS00]. The method is closely related to the new Gröbner basis method byFaugere [Fau99] [AFIKS04]. Furthermore, this new algebraic method was used
to attack symmetric ciphers like AES and others [CPi02]. One can see thatalgebraic attacks are becoming increasingly important in cryptography.
Another generalization of LE also by Patarin[Pat96,PCG01a,C00], which is
not as well-known, is the type of equations in the form:
X
X
X
X
X
aijk uivj vk +bij ui vj +ci ui +
djkvj vk +ej vj + f = 0.
As a further extension, we propose to call the equations that that use high orderterms of the ciphertext variables (vj ) while using only linear terms of plaintext
variables (ui), high order linearization equations (HOLE). The total degree of thehighest order of the ciphertext variables (vj ) is called the order of the HOLE andthe equation above is thus called a second order linearization equation (SOLE).
For any MPKC, if we can derive such equations, then for any given ciphertext,
we can insert it into the HOLEs, producing linear equations satisfied by theplaintext and these equations can be used to attack the system.
It turns out that the SOLEs can be used efficiently to break the Medium
Field Equation (MFE) multivariate public key cryptosystem proposed by Wang,
Yang, Hu and Lai in the CT-track of the 2006 RSA conference [WYH06].
MFE is an encryption scheme. Many encryption schemes of MPKC havebeen proposed, and many of them have been broken, for example, the TTM
cryptosystem family [Moh99] [GC00] [CM01] [DS03a] [DS03b] [MCY04]. A very
different direction goes along the idea started by Matsumoto and Imai [MI88],
which can be generally called the ”Big Field” idea.

PQCrypto 2006 Workshop Record

88High order linearization equation (HOLE) attack on multivariate public key cryptosystems

Given a multivariate public key cryptosystem, the public key is defined as amap over the vector space Kn, where K is a small finite field with q elements.
However from the theory of finite fields, Kn can also be identified with a ”big”
finite field E, which is a degree n extension of K. That is, there is a standard
K-linear vector space isomorphism that identifies E with Kn . The idea of the”Big Field” is that we can find a map, say φ2, that is easy to invert on E. Under
the isomorphism we can build a map φ˜2: Kn → Kn as:
φ˜2 (u1, ..., un) 7→ (g1(u1 , ..., un), · · · , gn(u1 , ..., xn)).
Then we use φ1 and φ3, two randomly chosen invertible affine linear maps over
Kn which are the key part of the private key to ”hide” φ2 . The public key isgiven byφ¯2(u1 , ..., un) = φ3 ◦ φ˜2 ◦ φ1(u1 , ..., un)= (h1(u1 , ..., un), h2(u1, ..., un), · · · , hn(u1 , ..., un)).
The Matsumoto-Imai (MI) cryptosystem was broken by Patarin [Pat95],
and later Patarin developed the HFE cryptosystem [Pat96]. The only difference between HFE and the MI is that they choose different φ2. Currently themore promising cryptosystems are new variants of the MI and the HFE throughOil-Vinegar constructions and internal perturbations [Din04a] [FGS05] [DG05][DS04a]. The idea to put several ”big fields” together to build a cryptosystem isalso used [MI88] [Pat96]. The new MFE cryptosystem [WYH06] uses what thedesigners call ”Medium Field Encryption”. The non-linear critical part of the
public key is a function over an extension of the base field K of degree smaller
than what would be called the ”big field”. Another key difference between MFE
and HFE is that MFE uses functions derived from a matrix structure while theMI and the HFE use only polynomials of a single variable.
In the attack on MFE, we first use second order linearization equations(SOLEs), which we derive from the special algebraic structure of the crucial
nonlinear map in MFE. This is the most essential step in our attack. Any given
ciphertext can be inserted into the SOLEs to produce a set of equations linear in
the plaintext variables. Solutions to these equations are finally plugged back into
the original public key polynomial equations, providing a set of new quadratic
equations that could be easily solved. The complexity of our break is less than
252 one-time computations over K for any given public key, and the practicalcomplexity of recovering a ciphertext is less than 223 K-operations.
The current MFE is based on matrices of size 2 × 2 and one may extend it
to a construction using matrices of bigger size. The HOLEs of higher order canbe extended to attack such an extension of the current MFE and the order of
HOLE corresponds exactly to the size of the matrices.
We organize the paper as follows. We introduce the MFE cryptosystem in
Section 2, and present our attack in Section 3. In Section 4, we discuss theconnection of HOLE with the XL method. In the final section, we present theconclusion.

89

PQCrypto 2006 Workshop Record

Ding, Hu, Nie, Li, Wagner

2

MFE Public Key Cryptosystem

Let K be a finite field, generally F216 . Let L be its degree r extension field; L is
considered the ”Medium Field”.
In MFE, we always identify L with Kr by a K-linear isomorphism π : L → Kr .
Namely we take a basis of L over K, {θ1 , · · · , θr }, and define π by π(a1 θ1 + · · ·+ar θr ) = (a1 , · · · , ar ) for any a1, · · · , ar ∈ K. It is natural to extend π to two
K-linear isomorphisms π1 : L12 → K12r and π2 : L15 → K15r .
A private key of MFE consists of two invertible linear affine transformations
φ1 and φ3; and φ1 is defined on K12r , and φ3 on K15r . Let φ2 : L12 → L15 be thecentral nonlinear quadratic map of MFE. Note φ2 is fixed except for the threecomponents Q1, Q2, and Q3 , which have randmly chosen coefficients. The corresponding public key is 15r quadratic polynomials h1(u1 , ..., u12r), h2(u1, ..., u12r), · · · ,and h15r (u1, ..., u12r) given by(h1 (u1, ..., u12r), · · · , h15r (u1, ..., u12r)) = φ3 ◦ π2 ◦ φ2 ◦ π1−1 ◦ φ1(u1, ..., u12r). (1)Let φ2(X1 , · · · , X12) = (Y1 , · · · , Y15). The expressions of the Yi are given by
Y1 = X1 + X5 X8 + X6 X7 + Q1;Y2 = X2 + X9 X12 + X10X11 + Q2 ;Y3 = X3 + X1 X4 + X2 X3 + Q3;Y 5 = X1 X6 + X2 X8 ;
 Y 4 = X1 X5 + X2 X7 ;Y 6 = X3 X5 + X4 X7 ;Y 7 = X3 X6 + X4 X8 ;
(2)


Y
=
X
X
+
X
X
;
Y
=
X
X
+
X
X
;

8
1 9
2 11
9
1 10
2 12



Y
=
X
X
+
X
X
;
Y
=
X
X
+
X
X12 ;

10
3
9
4
11
11
3
10
4



Y
=
X
X
+
X
X
;
Y
=
X
X
+
X

12
5 9
7 11
13
5 10
7 X12 ;

Y14 = X6 X9 + X8 X11;
Y15 = X6 X10 + X8 X12 .
Here Q1 , Q2, and Q3 form a triple (Q1 , Q2, Q3) which is a triangular map fromK3r to itself as follows. Let π(X1 ) = (x1 , · · · , xr ), π(X2 ) = (xr+1 , · · · , x2r ),π(X3 ) = (x2r+1 , · · · , x3r ), and let qi ∈ K[x1, · · · , xi−1] for 2 ≤ i ≤ 3r. Then

r
P


Q
(X
)
=
qi (x1, · · · , xi−1)θi ,
1
1



i=2


2r
P
Q2 (X1 , X2) =qi (x1, · · · , xi−1)θi ,

i=r+1


3r

P


qi (x1, · · · , xi−1)θi .
 Q3 (X1 , X2, X3 ) =i=2r+1

The qi can be any randomly chosen quadratic polynomials. A specific ”tower”structural choice for them is given in §5 of [WYH06].
The encryption of MFE is the evaluation of public key polynomials, namely
given a plaintext (u1, · · · , u12r ), its ciphertext is(v1 , · · · , v15r ) = (h1 (u1, · · · , u12r ), · · · , h15r(u1 , · · · , u12r)).

PQCrypto 2006 Workshop Record

90High order linearization equation (HOLE) attack on multivariate public key cryptosystems

Given a valid ciphertext (v1 , · · · , v15r ), the decryption of MFE is to calcu−1−1−1late in turn φ−11 ◦ π1 ◦ φ2 ◦ π2 ◦ φ3 (v1 , · · · , v15r ). Here the point is how toinvert φ2, its basic idea is to use the triangular structure of φ2. Relating to our
cryptanalysis, the method of computing φ−1
is listed as follows, see §4.2 and2Appendix B of [WYH06].
Write X1 , · · · , X12, Y4, · · · , Y15 as six 2 × 2 matrices:






X1 X2
X5 X6
X9 X10, M2 =, M3 =,M1 =X3 X4 12
 X7 X8
 X11 X
Y4 Y5
Y8 Y9
Z3 = M1 M2 =, Z2 = M1 M3 =,(3)
Y10 Y11
Y6 Y7 
Y12 Y13
Z1 = M2T M3 =.
Y14 Y15Then det(M1 ) · det(M2 ) = det(Z3 ),det(M1 ) · det(M3 ) = det(Z2 ),
det(M2 ) · det(M3 ) = det(Z1 ).

When M1 , M2 , and M3 are all invertible, we can get values of det(M1 ), det(M2 ),and det(M3 ) from det(Z1 ), det(Z2 ), and det(Z3 ), for instance, det(M1 ) = det(Z2 )·1/2
det(Z3 )/det(Z1 ). The square root operation is easy to handle over a field of
characteristic 2.
With values of det(M1 ), det(M2 ), and det(M3 ), we solve the following triangular map over K3r Y1 = X1 + Q1 + det(M2 )
Y2 = X2 + Q2 + det(M3 )(4)
Y3 = X3 + Q3 + det(M1 )to get in turn x1 , · · · , xr , xr+1, · · · , x2r , x2r+1, · · · , and x3r . Thus, we recover
X1 , X2, and X3 . From X1 X4 +X2X3 = det(M1 ) we then get X4 provided X1 6= 0.
The X5 , · · · , X12 are consequently solved from the 4th to 11th equations of (2).
Appendix B of [WYH06] presents the method of computing the Xi in the casewhen X1 = 0. It is slightly easier than the case of X1 6= 0.
If there is a non-invertible matrix among M1 , M2 , and M3 , then the decryption mentioned above will not work. This decryption failure exists in MFE[WYH06]. We call a plaintext singular if its corresponding M1 , M2 , and M3
are not all invertible, otherwise it is called nonsingular. The ciphertext of anonsingular plaintext is called a nonsingular ciphertext.
It is easy to prove that the ratio of singular plaintexts among all plaintexts is
at most 4|L|−1; when L = F264 , the ratio is at most 2−62 and is very small. See
Appendix A. In the next section we only consider how to recover nonsingularciphertext.
There are two typical instances of MFE proposed by the designers of MFE.
1) MFE-1, where K = F216 and r = 4. The public key has 60 polynomials
with 48 variables.
2) MFE-10 , where K = F216 and r = 5. The public key has 75 polynomials
and 60 variables.

91

PQCrypto 2006 Workshop Record

Ding, Hu, Nie, Li, Wagner

There is also a mini-version of MFE (MFE-0) using K = F28 and r = 4,
which has the same number of polynomials and variables as MFE-1.

3

Cryptanalysis on MFE

The designers of MFE noted they should avoid the linearization attack of Patarin(§6.2 of [WYH06]), and this is indeed the case. In the design of MFE, the lastequations of (2) in MFE is defined such that Z1 = M2T M3 (see (2)), not Z1 =M2M3 , otherwise we would have Z3 M3 = M1 Z1 (= M1 M2 M3 ), and this would
have produced linearization equations for the cryptosystem. However we can use
the HOLE, in particular the SOLE, to attack this cryptosystem.
3.1

Second Order Linearization EquationsFirst, we will show algebraically why the MFE has second order linearization
equations.
ab∗Denote by M the associated matrix of a square matrix; for M =
,
cd


d −b
its associated matrix is M ∗ =. From (3), we have−c a
Z3 = M1 M2,

Z2 = M1 M3 .

(5)

From these, we can derive
M3 M3∗ M1∗ M1 M2 = M3 (M1 M3 )∗ (M1 M2 ) = M3 Z2∗ Z3 ,M3 M3∗ M1∗ M1 M2 = (M3 M3∗ )(M1 M1∗ )M2 = det(M3 )det(M1 )M2 = det(Z2 )M2 ,and hence,
M3Z2∗ Z3 = det(Z2 )M2 ,that is,

X9 X10
X11 X12Y11 −Y9−Y10 Y8



Y4 Y5
Y6 Y7



= (Y8 Y11 − Y9 Y10)

Expanding (7), we get four equations of the form
X
a0ijkXi Yj Yk = 0,

(6)


X5 X6
X7 X8



.

(7)

(8)

which hold for any corresponding pair (X1 , · · · , X12, Y1, · · · , Y15). For any nonsingular plaintext, if we substitute all the Yi by its corresponding value in thefour equations of the form (8) derived from (7), we would get four linear equations with Xi as itsvariables,four and these equations are linearly independent,
Y11 Y9Y4 Y5
since the matrices
andare invertible.
Y10 Y8
Y6 Y7

PQCrypto 2006 Workshop Record

92High order linearization equation (HOLE) attack on multivariate public key cryptosystems

Substituting (X1 , · · · , X12) = π1−1 ◦ φ1 (u1, · · · , u12r ) and (Y1 , · · · , Y15) =π2−1 ◦ φ−1
3 (v1 , · · · , v15r ) into (8), we get 4r equations of the form


X
X
X
X
X
ui 
aijk vj vk +bij vj + ci  +djkvj vk +ej vj + f = 0, (9)
i

j≤k

j

j≤k

j

where the coefficients aijk , bij , ci , djk, ej , f ∈ K, and the summations are respectively over 1 ≤ i ≤ 12r, 1 ≤ j ≤ k ≤ 15r and 1 ≤ j ≤ 15r. These equations,which are linear in plaintext components ui and quadratic in ciphertext components vj , are second order linearization equations (SOLEs). It is easy toshow that when all the vj are substituted by any nonsingular ciphertext, the 4r
SOLEs derived from (9) become linearly independent linear equations in ui .
Similarly to (6), we can deduce from (5) another equation
M2Z3∗ Z2 = det(Z3 )M3 ,(10)

or in its matrix form,






X5 X6
Y7 −Y5
Y8 Y9
X9 X10= (Y4 Y7 − Y5 Y6 ).
X7 X8
−Y6 Y4Y10 Y11X11 X12(11)

The 4r SOLEs resulted from (11) are clearly different from the ones corresponding to (9). Furthermore, we can show that the 8r SOLEs obtained from (9) and(11) are all linearly independent. However, we note that when the vi in these
8r SOLEs derived from (7) and (11) are assigned any nonsingular ciphertext,
we will get only 4r linearly independent linear equations in ui . In other words,
once the values of vi are given, as linear equations in Xi , (10) is completely
equivalent to (6), and one can deduce (10) directly from (6) and vice versa. One
can see this by the fact that multiplying from the right the both sides of (6)by Z3∗ Z2 /det(Z2 ) (this is a constant invertible matrix if the yi values are given)gives (10).
Now, it is obvious that there are more SOLEs. We apply the above trick that
results (6) and (10) from (5) to obtain
M2 (Z1T )∗ Z2T = det(Z1 )M1T ,(12)

M1T (Z2T )∗ Z1T = det(Z2 )M2 ,(13)from Z2 = M1 M3 and Z1 = M2T M3. We can also obtain
M1T (Z3T )∗ Z1 = det(Z3 )M3 ,(14)

M3 (Z1 )∗ Z3T = det(Z1 )M1T ,(15)from Z3 = M1 M2 and Z1 = M2T M3 . It is not hard to check that the polynomial
equations derived from (6), (10), and (12)-(15) in terms of Xi and Yj are all
linearly independent. Thus, we get at least 24r linearly independent SOLEs in
ui and vi over K.

93

PQCrypto 2006 Workshop Record

Ding, Hu, Nie, Li, Wagner

To find all SOLEs, we need to evaluate sufficiently many plain/cipher-textsin (9) to get a system of linear equations on the aijk , bij , · · · , f. Let s be the(l)(l)
dimension of its solution space and (aijk, bij , · · · , f (l) ), 1 ≤ l ≤ s, be its s
linearly independent solutions. As mentioned above, we know s ≥ 24r. For attack
purposes, we only need to do the computation to get all the SOLEs once for any
given public key.
Similarly to the relation between (6) and (10), as linear equations in Xi , (12)is equivalent to (13), and (14) is equivalent to (15) provided that the Yi areassigned a nonsingular ciphertext value.
In addition, we can show that if we are given the values of vi of a nonsingularciphertext, from the 24r linearly independent SOLEs we derived above, we willproduce only 8r linearly independent linear equations in ui . Write (12) in its
matrix form:






X5 X6
Y15 −Y14
Y8 Y10
X1 X3= (Y12Y15 − Y13 Y14)
, (16)X7 X8−Y13 Y12
Y9 Y11
X2 X4
which results in 4r SOLEs. Given the values of Yi of a nonsingular ciphertext,
the eight linear equations in Xi derived from (16) and (7) are linearly independent, because the coefficient matrix corresponding to the set of eight linear
equations, with the four equations from (16) as the first four ones, is in the formI∗0
, where each row is scaled by a factor Y8 Y11 − Y9 Y10 or Y12 Y15 − Y13 Y14
0I∗
correspondingly, and I and 0 are respectively the identity matrix and the zeromatrix of order 4. This matrix is clearly of rank 8. This shows that the s0 introduced in the next subsection is at least 8r. The reason that the other SOLEs
will not produce any new linear equations on ui for any given values of vi of anonsingular ciphertext is that when the Yi are assigned a nonsingular value, (14)can be easily deduced from (6) and (12).
3.2

Ciphertext-only Attack

Now assume we have found a basis of the linear space of all SOLEs.
0
Given a ciphertext (v10 , · · · , v15r), our aim is to recover its plaintext (u01, · · · , u012r ).
0
We plug the values of ciphertext (v10 , · · · , v15r
) into the basis SOLEs:!

P (l) 0 0 P (l) 0
P (l) 0 0 P (l) 0
P
(l)
+
ui
aijkvj vk + bij vj + ci
djk vj vk + ej vj + f (l) = 0
i
j
j
j≤k
j≤k


1≤l≤s
(17)
giving us a linear system on u1, · · · , u12r. Assume it has s0 linearly independent
solutions. From the previous subsection, we know 8r ≤ s0 ≤ 12r. We can represent s0 of variables u1, · · · , u12r by linear affine expressions of the remaining
t := 12r − s0 . Let w1 , · · · , wt be these t variables.
Substitute these s0 linear expressions into the original public key polynomif2 (w1, ..., wt), · · · , andals to get 15r new quadratic polynomials f
h1(w1 , ..., wt), hhg
15r (w1 , ..., wt).
PQCrypto 2006 Workshop Record

94High order linearization equation (HOLE) attack on multivariate public key cryptosystems

Let S be the solution space of (17). Let Yi0 and Zi0 be components and matrices0
corresponding to the given (v10 , · · · , v15r), namely
0
0(Y10 , · · · , Y15) = π2−1 ◦ φ3−1(v10 , · · · , v15r),
 0 0
 0 0
 0 0 Y4 Y5
Y8 Y9
Y12 Y13000
Z3 =, Z2 =, Z1 =
.
0
0
0
0
0
0
Y6 Y7
Y10 Y11
Y14
Y15

We have found a basis of all SOLEs and each SOLE is a linear combination ofthis basis. This fact holds when the variables vi in the equations are substitutedby vi0 . Applying this fact to (7), we know the four resulting equations in ui fromM3 (Z20 )∗ · Z30 = det(Z20 )M2(18)

are all linear combinations of the equations in (17). In other words, (18) holds−1
on S. Let P23 = det(Z20 ) ((Z20 )∗ · Z30 ) ; then M3 = M2 P23. P23 is a constantmatrix dependent only on the ciphertext.
Now we have that M2T M3 = Z1 always holds on K12r , therefore, we havethat M3T M3 = M3T M2P23 = Z1 P23 holds on S. That is,

 

2
X92 + X11
Y12 Y13
X9 X10 + X11X12
=
P23
(19)
2
2
X9 X10 + X11X12
X10
+ X12
Y14 Y15
holds on S. Comparing the diagonal entries of the matrices in the both sides22
2
of (19), we find X92 + X11
and X10+ X12
are linear combinations of the Yi .
Applying φ1 and φ3 to these combinations and utilizing the fact that squaring isa linear operation on a field of characteristic 2, we have, on S,Pthe 2r expressions2
2
2
corresponding to X92 + X11
and X10+ X12
are of the form
a0iu2i + b0 and Klinear combinations of h1(u1 , ..., u12r), h2(u1, ..., u12r), · · · , h15r (u1, ..., u12r) and1 (constant).
f1 (w1, ..., wt), · · · , hg
Thus, of linear combinations of h15r (w1 , ..., wt) and 1, there
must exist 2r which contain only squaring terms and a constant term and cor222
respond to X92 + X11
and X10+ X12.
It is easy to solve the following linear system on the aei and bej :
 15r
t
P
P e
bej wj2 + e
aei hi(w1 , ..., wt) +
c=0
(20)
i=1
j=1

∀w1 , ..., wt ∈ K
Essentially, this is to solve a linear equation system whose coefficients are thecoefficients of the cross-terms and linear terms of the hei(w1 , ..., wt).
(l) e (l)e (l)Let (ae1 (l) , · · · , ag
15r , b1 , · · · , bt ), 1 ≤ l ≤ p, be a basis of the solutionsof (20). Set


1/2
1/2
 15r
t

P (l) 0
(l)
P
(l)
e
bj
wj +
aei vi + e
c
=0
(21)
j=1
i=1

1 ≤ l ≤ p
95

PQCrypto 2006 Workshop Record

Ding, Hu, Nie, Li, Wagner

For each (u1, ..., u12r) ∈ S, its corresponding (w1, ..., wt) satisfies (21). From(21) we can represent p of the variables w1, ..., wt by the remaining t − p linearly.
Totally, s0 + p components of the plaintext vector (u01 , ..., u012r) are represented
linearly by the remaining 12r − s0 − p.
Note that we surely have s0 + p ≥ 10r, since the matrix of the coefficients on
2 1/2
2
2 1/2
X1
, X2, · · ·, X12 of ten expansions in (16), (7), (X92 +X11
) , and (X10
+X12
)


I∗ 0
1010

is 0 I ∗  , where A =, and the matrix is obviously of rank 10. In
0101
00A
other words, solving two systems (17) and (21) eliminates at least 10r variablesof the plaintext components. If p = 0, i.e.,
is no nonzero linear combination
P there0 2
eof the hi(w1 , ..., wt) being of the form
aiwi + b0, then we must have s0 ≥ 10r
and after the first elimination (i.e., via (17)), the expressions corresponding to2
2
2
X92 + X11
and X10+ X12have been constants.
3.3

Finding the Plaintext

We substitute the linear expressions resulted by solving (21) into f
h1(w1 , ..., wt), · · · ,gh15r (w1, ..., wt) and get 15r new quadratic polynomials on 12r − s0 − p (≤ 2r)
0
c1 , · · · , hd
variables. Denote them by h
15r . Since 12r − s − p is very small (at most
8 and 10 for MFE-1 and MFE-10, respectively), in principle, we can use theGröbner basis method to solve the systemhbi = vi0 ,∀ i = 1, · · · , 15r(22)very easily and to find the plaintext finally.
However, we know here that we start from 15r equations, therefore we expectthat we will get much more than 2r (the number of variables) equations. Thismeans we can solve it easily, for example, using the XL method [CKPS00]. In
our experiments, this set of equations does turn out to be very easy to solve.
3.4

A Practical Attack Procedure, Its Complexity and Experimental
Verification

Our attack can be divided into the following four steps:
Step 1 of the attack: Find a basis of the linear space of the coefficient
vectors (aijk , bij , · · · , f) of all SOLEs.
As mentioned in §3.1, this is to solve a system of linear equations obtainedby 15r+2
evaluating sufficiently many plain/cipher-texts in (9). There are 12r+1
1
2
α β γ
monomials of the form ui vj vk on ui and vj (α, β, γ = 0 or 1). This number is92659 and 178486 for r = 4 and 5, respectively, and is somewhat large. Choosing
a number of plain/cipher-text pairs slightly more than the number of unknowns,
say 1000, we can completely find the solution space in general. The complexity isrespectively 926593 < 250 and 1784863 < 252 using a naive Gaussian elimination.
(l)(l)
This step is a one time computation for any given public key. Let (aijk , bij , · · · , f (l) ),1 ≤ l ≤ s, be a basis of the equation system.

PQCrypto 2006 Workshop Record

96High order linearization equation (HOLE) attack on multivariate public key cryptosystems

Our computer experiments confirm that that the dimension of SOLE is indeed 24r for both MFE-1 and MFE-10.
0Step 2 of the attack: Given a valid ciphertext (v10 , · · · , v15r), we plug it into(17) and solve the system of linear equations to obtain linear expressions of theremaining 12r − s0 in terms of the other s0 variables of the plaintext components.
The complexity of this step is 15rs2 < (15r)3, and is less than 219.
Substitute these linear expressions into the original public key polynomials
f1 (w1, ..., wt), · · · , and hg
to get new quadratic polynomials h
15r (w1 , ..., wt).
Step 3 of the attack: Solve the system (20) and obtain its solution basis(l) e (l)(l)
e (l)(ae1 , · · · , ag
15r , b1 , · · · , bt ), 1 ≤ l ≤ p. Then solve the system (21) to findexpression of the p components of the plaintext by the remaining 12r − s0 − plinearly.
The complexity of solving (20) is (15r + t)3 < (30r)3 < 222, and that for (21)
is pt2 < (15r)3 < 219.
Our computer experiments show that indeed s0 is 8r and p is 2r for both
MFE-1 and MFE-10 .
c1 , · · · , hd
Step 4 of the attack: Derive new public key polynomials (h15r )from the solutions of (21), solve the system (22) and finally obtain the value of pcomponents of the plaintext by using a Gröbner base or a linearization method.
Then we use the linear expressions on the remaining plaintext components derived in in steps 2 and 3 to find the eliminated components.
In 1000 experimental samples we have done, we find that after Step 3, thenumber of linearly independent quadratic equations are actually 20 for MFE1 and 25 for MFE-10 . We actually solve them by finding a set of 2r linearly
independent linear equations inside the space spanned by these equations. It
takes no time.
Therefore the total attack complexity is less than 252. The complexity of theattack recovering the plaintext (steps 2, 3 and 4) is less than 223.
3.5

Extension of MFE and High Order Linearization Attack

The construction of MFE relies on the multiplicative structure of 2 × 2 matrices
and it is not difficult to see that one can extend this construction in a straightforward way by using matrices of larger sizes m × m, for example, 3 × 3 or 4 × 4,
to build new MFE cryptosystems.
For any such an construction using matrix of m × m, it is not difficult to
see that the m-th order LE can be applied to attack the cryptosystem. The
fundamental reason behind is the formula that for any matrix Q of size m × m,
we know that
1
Q−1 =
Q∗ ,
det(Q)
where Q∗ is the associated matrix of Q.
In terms of algebraic formulas for det(Q) and Q∗ , we know that det(Q) canbe expressed as a degree m polynomial of the components Qij of Q and eachcomponent of Q∗ can be expressed in terms of the a degree m − 1 polynomial

97

PQCrypto 2006 Workshop Record

Ding, Hu, Nie, Li, Wagnerof the components Qij of Q. With this and the formulas (6) and (10) and othersimilar formulas, we can see that, for such a case, the order m linearization
equations exists and they can be used to attack such a system. Therefore thecurrent design of MFE needs to increase m substantially to avoid such an attack.

4

The Connection of HOLE with XL

One important point we want to make is that the HOLE method is closely related
to the XL method [CKPS00]. In particular one may also explore the possibility of
combining these two algebraic method together to develop additional techniques.
Assume we are given a system of equationsfi (u1, · · · , un) = vi0 , 1 ≤ i ≤ m.
Let U = (u1 , · · · , un) and gi(U ) = fi (U )−vi0 . For any nonnegative integral vectorαnα1α = (α1, · · · , αn), denote uα
1 · · · un by U . Similarly, for β = (β1 , · · · , βm ),
β1
β
1
βm
βm
denote f1 · · · fm
by F β and g1 · · · gm
by Gβ .
The XL method first translates the equation system above into another system of equations of the form
Paα,i U αgi (U ) = 0,(23)
where 1 ≤ i ≤ m and α are nonnegative integral vectors with small componentsum (upper-bounded by some small integer D). Then define all terms U αU γ as
new unknowns and solve the resulted linear equation system.
On the other hand, the HOLE method attempts to solve a system of equationsof the form
Pai,β ui Gβ = 0,
(24)
i,β

where 1 ≤ i ≤ n and β are chosen small vectors. Since the fi (U ) are equivalent
to the gi (U ) under affine transformations, the above system is equivalent to thatofP
bi,β ui F β = 0.
(25)
i,β

Our attack presented in the previous section actually finds identical equations
0βmwith the form (25), and hence we can substitute F β by v10β1 · · · vm
and get alinear system that the plaintext satisfies.
As a comparison, we find that if a HOLE with order D could be used tosuccessfully attack a system by finding linear equations, then one should expectthat the XL method should work as well. But the order of XL should be of degree
2D − 1 (the total degree is 2D + 1), because the vi in general are of degree 2.
From this consideration, we conclude that though HOLE definitely cannot be a
replacement for the XL method, there could be cases that the HOLE method
would be much more efficient than XL. In one case we consider polynomials ofdegree D + 1 (HOLE), while in the other case, we consider polynomials of degree
2D + 1 (XL). Another critical point is that when we use the HOLE method, the

PQCrypto 2006 Workshop Record

98High order linearization equation (HOLE) attack on multivariate public key cryptosystems

computation of HOLEs is performed only once for a given public key, then the
HOLEs are used for any ciphertext; while the general XL algorithm needs to run
its main part each time for different values of ciphertext. Thus one should think
HOLE as a possibly more efficient alternative to XL, if it can work, and there
should be cases that HOLE can work practically while the XL cannot.
More importantly, one may consider unifying the XL and HOLE methods.
We may expect to efficiently solve the system of equations of the form:
Paα,β U αGβ = 0.
(26)
α,β

From the point view of algebraic geometry, this definitely makes sense, which
could allow us to produce more useful equations. We already have some idea
about how this can be done, but at this moment, we have not yet found any
example where such a method could indeed be more efficient in an attack on
multivariate public key cryptosystems.

5

Conclusion

In this paper, we use an extension of the linearization equation attack method ofPatarin, which we call the high order linearization equation method, to break the
MFE multivariate public key cryptosystem in CT-RSA 2006. This shows thatthe high order linearization equation method is indeed an important algebraic
attack method. For any multivariate public key cryptosystem, one should take
into account this new method. Furthermore, one can expect that this method
may be used to attack other cryptosystems, such as symmetric ciphers.

99

PQCrypto 2006 Workshop Record

Ding, Hu, Nie, Li, Wagner

References[ACDG03] Mehdi-Laurent Akkar, Nicolas T. Courtois, Romain Duteuil, and Louis
Goubin. A fast and secure implementation of Sflash. In PKC-2003, LNCS,
volume 2567, pages 267–278. Springer, 2003.
[AFIKS04] Gwénolé Ars and Jean-Charles Faugère and Hideki Imai and Mitsuru
Kawazoe and Makoto Sugita Comparison between XL and Gröbner Basis Algorithms, Asiacrypt 2004, LNCS, V. 3329.
[MFSY05] M. Bardet, J-C. Faugre, B. Salvy and B-Y. Yang Asymptotic Behaviourof the Degree of Regularity of Semi-Regular Polynomial Systems MEGA
2005, Eighth International Symposium on Effective Methods in Algebraic
Geometry, Porto Conte, Alghero, Sardinia (Italy), May 27th - June 1st,
2005, 15 pages.
[C00]
Nicolas T. Courtois The security of hidden field equations (HFE) In C.
Naccache, editor, Progress in cryptology, CT-RSA, LNCS, volume 2020,
pages 266–281. Springer, 2001
[CKPS00] Nicolas Courtois, Alexander Klimov, Jacques Patarin, and Adi Shamir. Efficient algorithms for solving overdefined systems of multivariate polynomial
equations. In B. Preenel, editor, Advances in cryptology, Eurocrypt 2000,
LNCS, volume 1807, pages 392–407. Springer, 2000.
[CPi02]
Nicolas Courtois, Josef Pieprzyk: Cryptanalysis of Block Ciphers with
Overdefined Systems of Equations. ASIACRYPT 2002, LNCS 2501, 267287, Springer 2002.
[CM01]
J. Chen and T. Moh. On the Goubin-Courtois attack on TTM. Cryptology
ePrint Archive, 72, 2001. http://eprint.iacr.org/2001/072.
[DH76]
Whitfield Diffie and Martin Hellman. New directions in cryptography. IEEE
Transactions on Information Theory, 22(6):644–654, 1976.
[Din04a] Jintai Ding. A new variant of the Matsumoto-Imai cryptosystem throughperturbation. In F. Bao, R. Deng, and J. Zhou, editors, the 7th International
Workshop on Practice and Theory in Public key Cryptography, Singapore,(PKC’04), LNCS, volume 2947, pages 305–318. Springer, 2004.
[DG05]
Jintai Ding and Jason Gower Inoculating Multivariate Schemes Against
Differential Attacks. Accepted for PKC-2006, IACR eprint 2005/255.
[DS03a] J. Ding and D. S. Schmidt. A common defect of the TTM cryptosystem.
In Proceedings of the technical track of the ACNS’03, ICISA Press, pages
68–78, 2003. http://eprint.iacr.org.
[DS03b] J. Ding and D. S. Schmidt. The new TTM implementation is not secure. In
H. Niederreiter K.Q. Feng and C.P. Xing, editors, Proceedings of International Workshop on Coding, Cryptography and Combinatorics (CCC 2003),
pages 106–121, 2003.
[DS04a] Jintai Ding, and D. S. Schmidt Cryptanalysis of HFEV and the internal
perturbation of HFE. The 8th International Workshop on Practice and Theory in Public key Cryptography, Jan. 2005, Switzerland (PKC’05), Lecture
Notes in Computer Sciences, volume 3386, pages 288-301 Springer, 2005.
[DS05]
Jintai Ding, and D. S. Schmidt Rainbow, a new multivariate public key
signature scheme. The Third International Conference of Applied Cryptography and Network Security (ACNS 2005), New York, June 7-10, 2005,
Lecture Notes in Computer Science 3531, Page 164-175, Springer, 2005.
[Fau99]Jean-Charles Faugère A new efficient algorithm for computing Gröbner
bases (F4 ), Journal of Pure and Applied Algebra, V. 139, P. 61-88, June
199.

PQCrypto 2006 Workshop Record

100High order linearization equation (HOLE) attack on multivariate public key cryptosystems[FGS05]P.-A. Fouque, L. Granboulan, and J. Stern. Differential Cryptanalysis forMultivariate Schemes Advances in Cryptology - EUROCRYPT 2005, Lecture Notes in Computer Science 3494 Springer 2005, Page 341-353.
[GC00]
L. Goubin and N. Courtois. Cryptanalysis of the TTM cryptosystem. LNCS,
Springer Verlag, 1976:44–57, 2000.
[KS99]
Aviad Kipnis and Adi Shamir. Cryptanalysis of the HFE public key cryptosystem by relinearization. In M. Wiener, editor, Advances in crytology –Crypto ’99, LNCS, volume 1666, pages 19–30. Springer, 1999.
[MI88]
T. Matsumoto and H. Imai. Public quadratic polynomial-tuples for efficientsignature verification and message encryption. In C. G. Guenther, editor,
Advances in cryptology – EUROCRYPT’88, LNCS, volume 330, pages 419–
453. Springer, 1988.
[Moh99] T. T. Moh. A fast public key system with signature and master key functions. Lecture Notes at EE department of Stanford University., May 1999.
http://www.usdsi.com/ttm.html.
[MCY04] T.Moh and J.M.Chen and Boyin Yang Building Instances of TTM Immune
to the Goubin-Courtois Attack and the Ding-Schmidt Attack. IACR eprint
2004/168, http://eprint.iacr.org.
[NES]
NESSIE. European project IST-1999-12324 on New European Schemes for
Signature, Integrity and Encryption. http://www.cryptonessie.org.
[Pat95]
J. Patarin. Cryptanalysis of the Matsumoto and Imai public key scheme ofEurocrypt’88. In D. Coppersmith, editor, Advances in Cryptology – Crypto’95, LNCS, volume 963, pages 248–261, 1995.
[Pat96]
J. Patarin. Hidden field equations (HFE) and isomorphism of polynomials(IP): Two new families of asymmetric algorithms. In U. Maurer, editor,
Eurocrypt’96, LNCS, volume 1070, pages 33–48. Springer, 1996.
[Pat97]
J. Patarin. The oil and vinegar signature scheme. Dagstuhl Workshop on
Cryptography, September 1997, 1997.
[PCG01a] Jacques Patarin, Nicolas Courtois, and Louis Goubin. Flash, a fast multivariate signature algorithm. In LNCS, volume 2020, pages 298–307.
Springer, 2001.
∗
and HM: vari[PGC98] Jacques Patarin, Louis Goubin, and Nicolas Courtois. C−+ations around two schemes of T. Matsumoto and H. Imai. In K. Ohta
and D. Pei, editors, ASIACRYPT’98, LNCS, volume 1514, pages 35–50.
Springer, 1998.
[PQ]
PQCrypto 2006: International Workshop on Post-Quantum Cryptography
http://postquantum.cr.yp.to/[RSA78] Ronald Rivest, Adi Shamir, and Leonard M. Adleman. A method for obtaining digital signatures and public key cryptosystems. ACM, 21(2):120–126,
1978.
[Sho99]Peter Shor. Polynomial-time algorithms for prime factorization and discrete
logarithms on a quantum computer. SIAM Rev., 41(2):303–332, 1999.
[WHLCY05] Lih-Chung Wang and Yuh-Hua Hu and Feipei Lai and Chun-Yen Chouand Bo-Yin Yang, Tractable Rational Map Signature, Public Key Cryptosystems 2005, LNCS 3386, Springer, P. 244-257.
[WYH06] Lih-Chung Wang, Bo-yin Yang, Yuh-Hua Hu and Feipei Lai, A MediumField Multivariate Public key Encryption Scheme, CT-RSA 2006: The
Cryptographers’ Track at the RSA Conference 2006, LNCS 3860, 132-149,
Springer, 2006.

101

PQCrypto 2006 Workshop Record

Ding, Hu, Nie, Li, Wagner[YC05]

B. Yang and J. Chen. Building Secure Tame-like Multivariate Public key
Cryptosystems–The New TTS. Information Security and Privacy: 10th Australasian Conference–ACISP 2005, LNCS 3574, 2005, Springer, P. 518-531.

PQCrypto 2006 Workshop Record

102Proposal for Piece In Hand Matrix Ver.2:
General Concept for Enhancing Security of Multivariate
Public Key Cryptosystems
Shigeo Tsujii†

Kohtaro Tadaki‡

Ryou Fujita†† Institute of Information Security

2–14–1 Tsuruya-cho, Kanagawa-ku, Yokohama-shi, 221–0835 Japan‡ 21st Century Center Of Excellence Program, Chuo University
1–13–27 Kasuga, Bunkyo-ku, Tokyo, 112–8551 Japan
Abstract. We proposed the concept, piece in hand (soldiers in hand) matrix and havedeveloped the framework based on the concept so far. The piece in hand (PH, for short)matrix is a general concept which can be applicable to any type of multivariate publickey cryptosystems to enhance their security. In this paper, we make improvements in
the PH matrix method as follows. (i) In the PH matrix method, an arbitrary number of
additional variables can be introduced to the random polynomial term in the public key,which is eliminated by the multiplication of the public key by the PH matrix during thedecryption. Thus these additional variables enables the public key to have more than
one solution, and therefore increases the difficulty to solve the public key. We show, inan experimental manner, that the PH matrix method improved in this way is secure
even against the Gröbner basis attack. (ii) In the nonlinear PH matrix method proposed
previously, the degree of polynomials in the public key is more than two, and this may
cause an undesirable increase in the size of the public key. In this paper, we propose anonlinear PH matrix method, where the degree of polynomials in the public key is kept
the same as the degree of polynomials in the public key of the original cryptosystem,
which is normally two.
Key words: public key cryptosystem, multivariate polynomial, multivariate public key
cryptosystem, piece in hand concept, soldiers in hand

1

Introduction

The research of multivariate public key cryptosystems started with the works by Matsumoto etal. [13] in 1983 and Tsujii et al. [18] in 1986.1 Especially, the multivariate public key cryptosystem which was proposed by Matsumoto and Imai [14] in 1988 is known as the Matsumoto-Imaicryptosystem nowadays. In 1995 Patarin constructed an attack against the Matsumoto-Imai cryptosystem in a heuristic manner [16] and then proposed an improvement of the cryptosystem, called
HFE, in 1996 [17]. Subsequently, Kipnis and Shamir introduced a general technique, called relinearization, to solve system of multivariate polynomial equations, and used it to attack HFE in 1999
1

This paper deals only with encryption schemes and not signature schemes. The piece in hand matrix method,which is considered in this paper, can be applied to signature schemes in general as well. For simplicity, however, weonly describe the application of the method to encryption schemes in this paper.

103

PQCrypto 2006 Workshop Record

Tsujii, Tadaki, Fujita[12]. Recently, Faugère and Joux showed in an experimental manner that computing a Gröbner
basis of the public key is likely to be an efficient attack to HFE [5]. Because of the simplicityof this attack, it may be a threat to many types of proposed multivariate public key cryptosystems, and now seems to be thought of as one of the major attacks against multivariate public key
cryptosystems.
On the other hand, in the work [18] Tsujii et al. proposed a multivariate public key cryptosystem
by introducing a trapdoor called the sequential solution method. The cryptosystem was then broken
by Hasegawa and Kaneko [7] for the special case where rational functions are used. Later on,
in 1989, [19] proposed the revised version of [18], where birational transformation, named coretransformation, was employed.2 No attack to this revised version has been succeeded so far.
In 2000 Kasahara and Sakai proposed a multivariate public key cryptosystem with randomvariables [8] and have improved the cryptosystem in a series of works such as [9, 10, 11]. Wolf,
Braeken, and Preneel [25] introduced the notion of a class of multivariate public key cryptosystems
called the stepwise triangular systems which is a generalization of the cryptosystems RSE(2)PKC[9] and RSSE(2)PKC [10] proposed by Kasahara and Sakai. They then showed, in the same
paper [25], that the stepwise triangular systems, which includes RSE(2)PKC and RSSE(2)PKC,
to be by no means secure. On the other hand, by introducing random terms to the MatsumotoImai cryptosystem, Ding proposed a multivariate public key cryptosystem called the perturbed
Matsumoto-Imai cryptosystem [4]. (See e.g. [26] for the bibliographical details of multivariate
public key cryptosystems in general.)In 2003 one of us [20] proposed the concept, piece in hand matrix. Thereafter we have developed
the framework based on the concept in a series of works [21, 22, 23, 24] so far. The concept of thepiece in hand (PH, for short) matrix has the following properties: (i) The PH matrix is a general
concept which can be applicable to any type of multivariate public key cryptosystems to enhancetheir security. (ii) In a framework of the PH matrix, the original public key, which is represented
by a polynomial vector, is randomized by adding a random polynomial term and then published.
In the decryption, the legitimate receiver can obtain the cipher text of the original cryptosystem
by multiplying the PH matrix and eliminating the random term, and then can recover the plain
text according to the decryption of the original cryptosystem. (iii) There are two types of the PH
matrices: a linear matrix whose elements are constants and a nonlinear matrix whose elements arefunctions of the plain text or random numbers.
In this paper, we make improvements in the PH matrix methods as follows: (i) In PH matrix
methods in general, an arbitrary number of additional variables can be introduced to the randompolynomial term in the public key, which is eliminated by the multiplication of the public key by
the PH matrix during the decryption. Thus the number of variables can be increased more than thenumber of polynomials in the public key, where random numbers are substituted to the additionalvariables on the encryption, and therefore these additional variables in the public key can be madeto have exponentially many solutions. We show in an experimental manner that the PH matrix
method improved in this way is secure even against the Gröbner basis attack. (ii) In the nonlinear
PH matrix method [22] proposed previously, the degree of polynomials in the public key is morethan two, and this may cause an undesirable increase in the size of the public key. In this paper,
we propose a nonlinear PH matrix method, where the degree of polynomials in the public key is
kept the same as the degree of polynomials in the public key of the original cryptosystem, which is2

The paper [19] was originally written in Japanese. An English translation of [19] is included in [22] as an appendix.

PQCrypto 2006 Workshop Record

104Proposal for piece in hand matrix ver. 2: enhancing security of multivariate public key cryptosystems

normally two.

1.1

Organization

This paper is organized as follows. We begin in Section 2 with some basic notation and a brief introduction of the schemes of multivariate public key cryptosystems in general. In Section 3, we recall
the primitive form of the general prescription for enhancing the security of any given multivariate
public key cryptosystem by the linear PH matrix method, introduced in [22]. We then reconsider
the enhancement of security against the Gröbner basis attack. Based on the consideration, as one of
the countermeasures against the Gröbner basis attack, we propose a new linear PH matrix methodwith random variables in Section 4. We then show, based on computer experiments, that the new
method properly provides substantial robustness against the Gröbner basis attack. In Section 5,
we present another countermeasure against the Gröbner basis attack by improving the nonlinear
PH matrix method originally proposed in the work [22]. This new nonlinear PH matrix method isa practical one, compared with the previous proposal, since it holds down an undesirable increasein the size of the public key. We conclude this paper with a discussion about the future directionof our work in Section 6.

2

Preliminaries

In this preliminary section we review the schemes of multivariate public key cryptosystems ingeneral after introducing some notation about fields, polynomials, and matrices.

2.1

Notation

Fq is a finite field which has q elements with q ≥ 2. Fq [x1 , . . . , xk ] is the set of all polynomials
in variables x1 , x2 , . . . , xk with coefficients in Fq . For every nonempty set S and every positive
integers n and l, S n×l denotes the set of all n × l matrices whose entries are in S, and S n denotes
the set of all column vectors consisting n components in S. Therefore S n×1 = S n . We represent acolumn vector in general by bold face symbols such as p, E, and X. For every matrix A ∈ S n×l ,AT ∈ S l×n denotes the transpose of A. Let


f1


f =  ... 
fn

and



g1


g =  ... gk

be polynomial column vectors in Fq [x1 , . . . , xk ]n and Fq [x1 , . . . , xm ]k , respectively, where f1 , . . . , fn ∈Fq [x1 , . . . , xk ] and g1 , . . . , gk ∈ Fq [x1 , . . . , xm ]. Then the substitution f (g) ∈ Fq [x1 , . . . , xm ]n of g

105

PQCrypto 2006 Workshop Record

Tsujii, Tadaki, Fujita

for the variables in f is defined by



h1


f (g) ≡  ...  ,hnwhere each hi is the polynomial in Fq [x1 , . . . , xm ] obtained by substituting g1 , . . . , gk for the variables x1 , . . . , xk in fi , respectively. Thus, for every f ∈ Fq [x1 , . . . , xk ]n and every p ∈ Fq k , f (p)denotes simply the vector in Fq n obtained by substituting p1 , . . . , pk for the variables x1 , . . . , xk
in f , respectively, where p = (p1 , . . . , pk )T with p1 , . . . , pk ∈ Fq . For every polynomial matrix
N ∈ Fq [x1 , . . . , xk ]n×l and every polynomial column vector g ∈ Fq [x1 , . . . , xm ]k , the substitution
N (g) ∈ Fq [x1 , . . . , xm ]n×l of g for the variables in N is defined in the same manner.

2.2

Schemes of Multivariate Public Key Cryptosystems

A multivariate public key cryptosystem such as in [13, 18, 14, 19, 17, 15, 8, 4, 9, 10, 25, 11] can beconsidered to comply with the following scheme: A plain text is represented by a column vectorp = (p1 , . . . , pk )T ∈ Fq k , and a cipher text is represented by a column vector c = (c1 , . . . , cn )T ∈Fq n . Then, q, k, and a polynomial column vector E ∈ Fq [x1 , . . . , xk ]n form the public key of thecryptosystem. The encryption is given by the following transformation from p to c:c = E(p).
The secret key of the cryptosystem gives an efficient method to solve the system E = c of polynomial
equations on (x1 , . . . , xk ) for any given c ∈ Fq n . Thus, E has to be constructed so that, without
the knowledge about this method, it is difficult to find p for any given c in polynomial-time.
Let us consider the situation that the legitimate receiver, Bob, has the secret key and the sender,
Alice, wants to transmit her cipher text c ≡ E(p) to Bob. When Bob receives the cipher text csent from Alice, using the secret key he can efficiently decipher it to obtain the plain text p. On
the other hand, it has to be intractable for the eavesdropper, Catherine, to recover p from c, basedon the fact that she has no knowledge about the secret key.
In most multivariate public key cryptosystems, the public key E ∈ Fq [x1 , . . . , xk ]n has thefollowing form:
E = B G(Ax).

(1)

Here x denotes (x1 , . . . , xk )T ∈ Fq [x1 , . . . , xk ]k . A and B are invertible matrices in Fq k×k and
Fq n×n , respectively. G is a polynomial column vector in Fq [x1 , . . . , xk ]n , where the polynomial
vector Ax ∈ Fq [x1 , . . . , xk ]k is substituted for the variables x1 , . . . , xk in G according to our convention above. In this type of cryptosystem, while keeping A and B secret (and so G in somecryptosystems) from anyone else, Bob publishes the public key E in the form of a system oftrimmed multivariate polynomials obtained by simplifying the right-hand side of (1). Normally,
G consists only of polynomials in Fq [x1 , . . . , xk ] of total degree at most two in order to avoid the
blowup of the size of the public key E. In such a case, the multivariate public key cryptosystem iscalled a quadratic multivariate public key cryptosystem.

PQCrypto 2006 Workshop Record

106Proposal for piece in hand matrix ver. 2: enhancing security of multivariate public key cryptosystems

3

The Previous Method and the Gröbner Basis Attack

In this section, we recall the primitive form of the general prescription for enhancing the securityof any given multivariate public key cryptosystem by our linear PH matrix method, introduced by[22]. We then reconsider the enhancement of security against the Gröbner basis attack and explore
possible improvements in the linear PH matrix method.

3.1

General Prescription for Enhancement by the linear PH Matrix Method

The primitive form of the general prescription for the enhancement by the linear PH matrix method[22] is described as follows.
Let K be an arbitrary quadratic multivariate public key cryptosystem whose public key is given
by E ∈ Fq [x1 , . . . , xk ]n , as described in Subsection 2.2. In our linear PH matrix method, we cone from the given multivariate public
struct a new quadratic multivariate public key cryptosystem Ke ∈ Fq [x1 , . . . , xk ]l of
key cryptosystem K for the purpose of enhancing the security. A public key E
e is constructed from the original public key E of K by the transformation:Ke ≡ SE + RX.
E(2)Here X denotes the column vector whose components are all monomials in Fq [x1 , . . . , xk ] of total
degree at most two, enumerated in any order. Thus, X can be chosen asX ≡ (x1 x1 , x1 x2 , . . . , xk−1 xk , xk xk , x1 , x2 , . . . , xk , 1)T .
S is a matrix in Fq l×n . In order to make our PH matrix method work properly, we assume thatl > n. On the other hand, R is a matrix in Fq l×t , where t is the number of components of X. Notee Hencethat t = k+2= (k 2 + 3k + 2)/2 for q ≥ 3.3 The term RX plays a role in randomizing E.
2
R has to be chosen so that neither the hidden original public key E nor any equivalent polynomial
vector which enables an eavesdropper to obtain Alice’s plain text can be identified in the actuale A plain text of K
e is represented by a vector in Fq k in the same way as in K. For
public key E.
ke the corresponding cipher text of K
e is represented by a vector
any plain text vector p ∈ Fq of K,leec ∈ Fq and is calculated by ec = E(p).
In addition to the matrices S and R, we introduce the PH matrix M ∈ Fq n×l as a secret key of
e In the key-generation stage, the matrices R, M , and S are chosen in sequence so as to satisfyK.
the following three conditions. We can show that this choice is efficiently possible.
Condition 1. l ≥ n + rank R.
Condition 2. M R = 0 and rank M = n.
Condition 3. M S = In , where In is the identity matrix in Fq n×n .
e by the PH matrix M from the left
By the above conditions we see that the multiplication of Eesimplifies E and results in the original public key E as follows:3

e = E.
ME

In the case of q = 2, we can eliminate the monomials x21 , . . . , x2k from(i = 1, . . . , k). Thus t is calculated to be (k2 + k + 2)/2 in such a case.

107

(3)

X using the so-called field equations x = x2ii

PQCrypto 2006 Workshop Record

Tsujii, Tadaki, Fujita

This is a crucial property of the PH matrix in our PH matrix methods in general.
e forms the public key of K.
e On the other hand, the PH matrix M ,Then, the triple (q, k, E)
together with the secret key of K corresponding to the public key (q, k, E) of K, forms the secret
e The decryption of K
e proceeds as follows. Based on the relation (3), on receiving the
key of K.
ecipher text ec ≡ E(p) for a plain text p, Bob can efficiently calculate c ≡ E(p) = Mec by themultiplication of ec by M from the left. Then, according to the decryption procedure of K, Bob canrecover the plain text p using the secret key of K.
The encryption and decryption processes in the PH matrix method are schematically represented
in Figure 1.
• Encryption

e
E

=

l×1
vectorSE+

l×n n×1
matrix vectorRl×t
matrix• Decryption
PH matrix

M

e
E

=

(

E

X

t×1
vectorM S = In ,M R = 0.

n×l
matrixFigure 1: The encryption and decryption in the PH matrix method

3.2

Countermeasures against the Gröbner Basis Attack

Recently, Faugère and Joux [5] showed in an experimental manner that computing a Gröbner basisof the public key is likely to be an efficient attack to HFE [17], which is one of the major variantsof multivariate public key cryptosystem. The attack is simply to compute a Gröbner basis for theideal generated by polynomial components in E − c, where E is a public key and c is a cipher text
vector. Thus, because of the simplicity of this attack, it may be a threat to many types of proposed
multivariate public key cryptosystems.
Especially, from the point of view of Gröbner bases, the secret invertible matrix B may beuseless in a scheme whose public key has the form (1). This is because any ideal I generated bypolynomials remains unchanged under the transformation of the generators of I by an invertible
matrix. Thus, by the following reason, the PH matrix concept might be also useless to the Gröbner
basis attack in its primitive implementation presented in the previous subsection. We first note,e − ce) = E − c, where ce ≡ E(p)eby the relation (3), that M (E∈ Fq l is a cipher text vector of

PQCrypto 2006 Workshop Record

108Proposal for piece in hand matrix ver. 2: enhancing security of multivariate public key cryptosystems

e and c ≡ E(p) ∈ Fq n is the corresponding cipher text vector of thethe enhanced cryptosystem K
original cryptosystem K. We can then show that there exist linear combinations g1 , . . . , gl−n , withcoefficients in Fq , of ee1 − e
c1 , . . . , eel − e
cl such thathee1 − ec1 , . . . , eel − ecl i = he1 − c1 , . . . , en − cn , g1 , . . . , gl−n i,(4)where (c1 , . . . , cn )T ≡ c and (ec1 , . . . , ecl )T ≡ ce, and (e1 , . . . , en )T ≡ E ∈ Fq [x1 , . . . , xk ]n ande ∈ Fq [x1 , . . . , xk ]l are the public keys of K and K,
e respectively. Thus, from(ee1 , . . . , eel )T ≡ Eethe point of view of Gröbner bases, the system E − ce = 0 of polynomial equations on (x1 , . . . , xk )might not be necessarily more difficult to solve than the system E − c = 0 of polynomial equations
on (x1 , . . . , xk ) due to the existence of the additional polynomial equations g1 = 0, . . . , gl−n = 0
for the former. In such a case, the linear PH matrix method might be useless to the Gröbner
basis attack. This paper proposes two types of new PH matrix methods which may overcome thisweakness, through elaborations of the original linear PH matrix method described in the previous
subsection.
In the next section, we introduce a linear PH matrix method with random variables and consider its security. In the above consideration, the polynomials e1 , . . . , en are assumed to be inFq [x1 , . . . , xk ] implicitly, and therefore the weakness of the original linear PH matrix method
against the Gröbner basis attack is of concern. Hence, one of the countermeasures against thee of K.
e Under thisweakness is to introduce additional variables xk+1 , . . . , xm to the public key E
countermeasure, the gi ’s in (4) are no longer polynomials in Fq [x1 , . . . , xk ], but in Fq [x1 , . . . , xm ],e − ce = 0 of polynomial equations on (x1 , . . . , xm ) seems to be
and therefore solving the system E
more difficult than solving the system E − c = 0 of polynomial equations on (x1 , . . . , xk ). Thisis done by introducing to the term RX in (2) the additional variables xk+1 , . . . , xm which are set
to random values by Alice on the encryption. In the next section, we describe a new linear PH
matrix method based on this idea, and we show that the new method properly works and provides
substantial robustness against the Gröbner basis attack, based on computer experiments.
In Section 5 we also present another countermeasure against the Gröbner basis attack througha nonlinearization of the PH matrix. In the previous work [22], we already proposed a nonlinear PH
matrix method. However, the degree of polynomials in the public key of the enhanced cryptosysteme is more than two in the previous method, and this may cause an undesirable increase in the sizeKof the public key of the enhanced cryptosystem. In a new nonlinear PH matrix method, the degree
e is always the same as the degree of polynomials in the publicof polynomials in the public key of K
key of the original cryptosystem K. Thus, the new nonlinear PH matrix method is a practical one,compared with the previous proposal.

4

Linear PH Matrix Method with Random Variables

In this section, as a countermeasure against the Gröbner basis attack, we introduce a new linear PH
matrix method with random variables, based on the primitive linear PH matrix method describedin Subsection 3.1. The point of the modification is to introduce additional variables to the public
key of the enhanced cryptosystem. By this countermeasure, the computational complexity of theGröbner basis attack is likely to increase exponentially in the number of the additional variables,
as is suggested by the experimental results reported below.

109

PQCrypto 2006 Workshop Record

Tsujii, Tadaki, Fujita

4.1

The New Linear PH Matrix Method

Let K be an arbitrary quadratic multivariate public key cryptosystem whose public key is given
by E ∈ Fq [x1 , . . . , xk ]n , as described in Subsection 2.2. We construct a new quadratic multivariate
e based on K as follows for the purpose of enhancing the security evenpublic key cryptosystem K
against the Gröbner basis attack. Let p and m be any positive integers with p < k < m.
Key-Generation. In the key-generation stage, the public key and secret key of K are chosene ∈ Fq [x1 , . . . , xm ]l of K
e is constructed from the original public key E offirst. Then, a public key E
K by the following transformation:e ≡ SE x
E
+ RZ,
(5)
Az
where x = (x1 , . . . , xp )T ∈ Fq [x1 , . . . , xp ]p and z = (x1 , . . . , xm )T ∈ Fq [x1 , . . . , xm ]m . A is arandomly chosen matrix in Fq (k−p)×m . Note that, in the right-hand side of (5), the vector Az ∈Fq [x1 , . . . , xm ]k−p is substituted for the variables xp+1 , . . . , xk in the original public key E while
keeping the variables x1 , . . . , xp in E unchanged. This Az is needed to prevent an eavesdropperfrom forging the PH matrix, as is explained in Subsection 4.3 below. Z denotes the column vector
whose components are all monomials in Fq [x1 , . . . , xm ] of total degree at most two, enumerated inany order. Thus, Z can be chosen asZ ≡ (x1 x1 , x1 x2 , . . . , xm−1 xm , xm xm , x1 , x2 , . . . , xm , 1)T .
S is a matrix in Fq l×n . In order to make this PH matrix method work properly, we assume thatl > n. On the other hand, R is a matrix in Fq l×s , where s is the number of components of Z.
Note that s = (m2 + 3m + 2)/2 for q ≥ 3. In addition to the matrices S and R, we introduce the
e The matrices R, M , and S are randomly chosen in
PH matrix M ∈ Fq n×l as a secret key of K.
sequence so as to satisfy Conditions 1, 2, and 3 in Subsection 3.1. Note that, as in the case of theoriginal method, this choice can be efficiently possible.
e p) forms the public key of K.
e Bob publishes it after the keyThen, the quadruple (q, m, E,
generation. On the other hand, the PH matrix M , together with the secret key of K correspondingeto the public key (q, k, E) of K, forms the secret key of K.
e is represented by a vector in Fq p . Now, assume that Alice wants
Encryption. A plain text of K
e is represented by ato send Bob a plain text vector p ∈ Fq p . The corresponding cipher text of Klvector ce ∈ Fq , and is calculated by Alice through


e p ,
ce ≡ E(6)rwhere r ∈ Fq m−p is chosen randomly by Alice on the encryption of p.

e proceeds as follows. We first note that, by Conditions 2 andDecryption. The decryption of K3,

e=E x ,ME
(7)
Az

PQCrypto 2006 Workshop Record

110Proposal for piece in hand matrix ver. 2: enhancing security of multivariate public key cryptosystems

where x = (x1 , . . . , xp )T ∈ Fq [x1 , . . . , xp ]p and z = (x1 , . . . , xm )T ∈ Fq [x1 , . . . , xm ]m . Thus, on
receiving the cipher text ce corresponding to a plain text p, Bob can efficiently obtain the value
E

 p 
d

from the multiplication of ec by M , where d is a column vector in Fq k−p given by
 p 
.
d≡A
r

Then, according to the decryption procedure of K, Bob can efficiently recover the plain text p using
the secret key of K. Note that d is discarded after the decryption.

4.2

Strength against the Gröbner Basis Attack

Based on the experimental results, we show that the linear PH matrix method described in theprevious subsection may be secure against the Gröbner basis attack.
For any cipher text vector ce, the corresponding plain text vector p is unique in (6). On the other
hand, r is not necessarily unique, since A is not necessarily invertible and R is chosen randomly.
The nonuniqueness of r may provides substantial robustness against the Gröbner attack, as issuggested by the experimental results shown below.
cryptosystems
HFE(128 < d < 513)

p

the enhanced HFEby the PH method(d < 513)

10
10
10
10
10
10

k
10
25
28
20
20
20
20
20
20

m

l

30
35
37
32
36
38

25
25
25
28
28
28

running-times in second
<1
686
1404
1364
5301
8788
3437
9903
15091

Table 1: Comparison between running-times for HFE and the enhanced HFE by the PH method.

We report in Table 1 the time required to compute reduced Gröbner bases of the public keys bothof HFE and of the HFE enhanced by the linear PH method with random variables. The runningtimes are given for hp AlphaServer ES45 workstation with Alpha 21264 (EV68) processor at 1250
MHz and 32GB of RAM. We use the algorithm F4 implemented on the computational algebra
system Magma V2.12-14. Note that n = k and q = 2 for the public keys E ∈ Fq [x1 , . . . , xk ]n of
HFE by its specifications. In the table, d denotes the degree of the univariate polynomial in theencryption of the HFE scheme. In the lower half of the table, the linear PH matrix method withrandom variables is applied to the public keys of HFE with q = 2, n = k = 20, and rank R = l − n.
The table shows that the increase of the number m−k of random variables xk+1 , . . . , xm increases thee ∈ F 2 [x1 , . . . , xm ]lrunning-time required to compute a reduced Gröbner basis of the public key E

111

PQCrypto 2006 Workshop Record

Tsujii, Tadaki, Fujita

e Thus, it would seem that the linear PH matrix method withof the enhanced cryptosystem K.
random variables provides substantial robustness against the Gröbner basis attack.
In the above examples on the enhanced HFE by the PH method, due to the constraint ofcomputing ability, only the cases of p = 10 and l = 25, 28 are computed where the ratios p/l ofplain text to cipher text are 10/25 = 40% and 10/28 ≈ 36%, which seem to be inefficient. In
realistic situations, however, p will usually be selected to be more than 100 and l − p be 10 ∼ 20.
Thus the ratio is not so inefficient in practice. We will continue to make examples for more large
parameters.

4.3

Strength against Other Possible Attacks

As a countermeasure against the Gröbner basis attack, we appended additional variables to thee However, a naive introduction of additional variables
public key of the enhanced cryptosystem K.
might allow another type of attack described below. In order to fend off such an attack against
e we substituted the polynomial vector Az for partial variables in thethe enhanced cryptosystem K,
original public key E of K in the right-hand side of (5).
It is not desirable that the eavesdropper, Catherine, can find the PH matrix M itself, or anye p) of K.
e This ismatrix which works just like M , from a cipher text ce and the public key (q, m, E,
because, if so, then she can easily obtain the value
E

 p 
d

due to the equation (7). However, in this PH matrix method with random variables, it would seemdifficult to do so because of the existence of the vector Az ∈ Fq [x1 , . . . , xm ]k−p substituted for thevariables xp+1 , . . . , xk in the original public key E of K in the right-hand side of (5).
Assume, contrarily to the fact, that p = k and Az disappears from E in the right-hand side of(5). Then we havee ≡ SE + RZ,
E(8)where E ∈ Fq [x1 , . . . , xk ]n remains unchanged from the original public key of K. In such a case,e Catherine may construct a matrix M 0 ∈by trying to eliminate the variables xk+1 , . . . , xm in M 0 E,
n×l
e = E. This M 0 works in the same manner as the original PH matrix
which satisfies that M 0 E
Fq
M , and therefore she may be able to calculate the value E(p) ∈ Fq n from the cipher text vectorce ∈ Fq l defined by (6).
This possibility seems to be excluded by substituting Az for partial variables in E in the righthand side of (5). This is because, since Az is a linear combination of all variables x1 , . . . , xm ingeneral, E in (5) also may contain all these variables and therefore Catherine loses the targets toeliminate. Thus, the attack by constructing a matrix M 0 which behaves just like the original PH
matrix M may not be successful in this PH matrix method with random variables.

5

Nonlinearization of the PH Matrix

Another countermeasure against the Gröbner basis attack is to nonlinearize the PH matrix, i.e.,
to employ, as a PH matrix, a polynomial matrix N whose entries are in Fq [x1 , . . . , xk ]. Since an

PQCrypto 2006 Workshop Record

112Proposal for piece in hand matrix ver. 2: enhancing security of multivariate public key cryptosystems

ideal I generated by polynomials may change under the replacement of the generators of I by the
product of N and them, the nonlinear PH matrix N may provide substantial robustness against
the Gröbner basis attack, unlike in the case of the primitive implementation of a linear PH matrix
method described in Subsection 3.1. In the previous work [22], we already proposed a nonlinear PH
matrix method. However, the degree of polynomials in the public key of the enhanced cryptosysteme is more than two in the previous method due to the use of Fermat’s little theorem. This may
Kcause an undesirable increase in the size of the public key of the enhanced cryptosystem. In thissection, we propose a new nonlinear PH matrix method without using Fermat’s little theorem,e can be always the same as the degree of
where the degree of polynomials in the public key of K
polynomials in the public key of the original cryptosystem K. Thus, the new nonlinear PH matrix
method is more practical than the previous proposal, from the point of view of the size of the public
key. The new nonlinear method is described in what follows.
Let K be an arbitrary quadratic multivariate public key cryptosystem whose public key is given
by E ∈ Fq [x1 , . . . , xk ]n , as described in Subsection 2.2. We construct a new quadratic multivariate
e based on K as follows. Let l and h be any positive integers with l ≥ h.
public key cryptosystem K
Key-Generation. In the key-generation stage, the public key and secret key of K are chosene ∈ Fq [x1 , . . . , xk ]l+h of K
e is constructed from the original public key
first. Then, a public key E
E of K as follows. In the construction, a quadratic polynomial vector C ∈ Fq [x1 , . . . , xk ]h , amatrix T ∈ Fq n×h , and a vector u ∈ Fq n are randomly chosen first. Then polynomial vectors
F ∈ Fq [x1 , . . . , xk ]n and E ∈ Fq [x1 , . . . , xk ]l are calculated in sequence by the following equations:F ≡ E − T C − u,


1
E≡S
+ RX.
F
Here X is defined in the same manner as in Subsection 3.1. S is a matrix in Fq l×(n+1) . In orderto make this nonlinear PH matrix method work properly, we assume that l > n + 1. On the other
hand, R is a matrix in Fq l×t . We also introduce the linear PH matrix M ∈ Fq (n+1)×l together with
S and R. The matrices R, M , and S are randomly chosen in sequence so as to satisfy the following
three conditions. This choice is efficiently possible, as in the case of the linear PH matrix methods
in the previous sections.
Condition 4. l ≥ (n + 1) + rank R.
Condition 5. M R = 0 and rank M = n + 1.
Condition 6. M S = In+1 , where In+1 is the identity matrix in Fq (n+1)×(n+1) .
The nonlinear PH matrix N ∈ Fq [x1 , . . . , xk ](n+1)×l is then defined byN ≡ (T C + u

In )M.

e of Ke is calculated by the following equation:
Finally, a public key Ee≡B E ,
E
C

113

(9)

(10)

PQCrypto 2006 Workshop Record

Tsujii, Tadaki, Fujita

where B is a randomly chosen invertible matrix in Fq (l+h)×(l+h) .
e forms the public key of K.
e Bob publishes it after the key-generation.
Then, the triple (q, k, E)−1
On the other hand, B , T , u, and M , together with the secret key of K corresponding to theepublic key (q, k, E) of K, forms the secret key of K.
We here check that, by Conditions 5 and 6,1
N E =(T C + u In )M S
+ (T C + u In )M RXF1=(T C + u In )F
=T C + u + F=E.
Hence we have
N E = E,(11)and therefore N properly works as a PH matrix although it is a polynomial matrix. We can also
e is certainly a quadratic polynomial vector as desired.
check that the public key E
e is represented by a vector in Fq k in the same way as in K. Now,
Encryption. A plain text of K
assume that Alice wants to send Bob a plain text vector p ∈ Fq k . The corresponding cipher textee is represented by a vector ce ∈ Fq l+h , and is calculated through ce ≡ E(p)of K
by Alice.
e proceeds as follows. We first note, by (10), that
Decryption. The decryption of K


E(p)
e
= B −1 E(p).
C(p)
Thus, on receiving the cipher text ce corresponding to a plain text p, Bob can efficiently obtain thevalues E(p) and C(p) from the multiplication of ce by B −1 from the left. Since
N (p) = (T C(p) + u In )M

e It follows fromby (9), Bob can then calculate N (p) using the value C(p) and the secret key of K.
(11) that
N (p)E(p) = E(p).
Thus, using the values N (p) and E(p), Bob can efficiently calculate the value E(p). Then, according to the decryption procedure of K, Bob can finally recover the plain text p using the secret key
of K.
Remark 5.1. In the above, for simplicity, we only describe the nonlinear PH matrix method ina primitive form. For the purpose of enhancing the security further, it is possible to construct anonlinear PH matrix method with random variables in the same manner as we made changes andimprovements in the primitive linear PH matrix method described in Subsection 3.1 to obtain thelinear PH matrix method with random variables in Subsection 4.1. Thus, the resulting nonlinear
PH matrix method with random variables might provide more security against the Gröbner basis
attack than the linear PH matrix method with random variables.

PQCrypto 2006 Workshop Record

114Proposal for piece in hand matrix ver. 2: enhancing security of multivariate public key cryptosystems

6

Concluding Remarks

In this paper, we have elaborated the piece in hand (PH) matrix methods in order that the securityof a wide class of multivariate public key cryptosystems is likely to be enhanced by them even against
the Gröbner basis attack. In the future work, we will demonstrate the enhancement of security
both by the linear PH matrix method with random variables (Section 4) and by the nonlinear PH
matrix method (Section 5) against the Gröbner basis attack in an experimental manner for all
proposed multivariate public key cryptosystems extensively.
Besides the Gröbner basis attack, several attacks are proposed so far against multivariate publickey cryptosystems in general. For example, Fouque, Granboulan, and Stern recently adapted
differential cryptanalysis to multivariate public key cryptosystems in [6]. In the linear PH matrix
method with random variables described in Section 4, the public key of the enhanced cryptosysteme has additional variables. Thus, it might be an effective attack against this PH matrix method toK
reduce the number of variables by fixing some of these additional variables with appropriate values
prior to computing a Gröbner basis of the public key (see [1] for this attack). The effectivenessof these attacks against our PH matrix methods proposed in this paper will be considered in the
future work.
From the practical point of view, it is also important to evaluate the key length and the efficiencyof encryption and decryption in the enhanced cryptosystem. However, since the aim of the present
paper is mainly to improve the framework of PH matrix method, this issue is discussed in anotherpaper. Because of the same reason, we have not considered the stronger security such as INDe for a multivariate public key
CCA type security but considered just the encryption primitive E
cryptosystem whose security is enhanced by the PH matrix method. We leave the consideration of
the stronger security to a future study.

Acknowledgments
The authors are grateful to Mr. Gwénolé Ars for discussions and helpful comments. Especially,
he pointed out that the relation (4) holds for the original linear PH matrix method proposed
previously.

References[1] N. Courtois, M. Daum, and P. Felke. On the security of HFE, HFEv- and Quartz. Proc. PKC
2003, Lecture Notes in Computer Science, Vol.2567, pp.337–350, Springer, 2003.
[2] N. Courtois, A. Klimov, J. Patarin, and A. Shamir. Efficient algorithms for solving overdefinedsystems of multivariate polynomial equations. Proc. EUROCRYPT 2000, Lecture Notes in
Computer Science, Vol.1807, pp.392–407, Springer, 2000.
[3] A. Kipnis, J. Patarin, and L. Goubin. Unbalanced Oil and Vinegar signature schemes.
Proc. EUROCRYPT 1999, Lecture Notes in Computer Science, Vol.1592, pp.206–222,
Springer, 1999.
[4] J. Ding. A new variant of the Matsumoto-Imai cryptosystem through perturbation. Proc. PKC
2004, Lecture Notes in Computer Science, Vol.2947, pp.305–318, Springer, 2004.

115

PQCrypto 2006 Workshop Record

Tsujii, Tadaki, Fujita[5] J. C. Faugère and A. Joux. Algebraic cryptanalysis of hidden field equation (HFE) cryptosystems using Gröbner bases. Proc. CRYPTO 2003, Lecture Notes in Computer Science, Vol.2729,
pp.44–60, Springer, 2003.
[6] P. A. Fouque, L. Granboulan, and J. Stern. Differential cryptanalysis for multivariate
schemes. Proc. EUROCRYPT 2005, Lecture Notes in Computer Science, Vol.3494, pp.341–353,
Springer, 2005.
[7] S. Hasegawa and T. Kaneko. An attacking method for a public-key cryptosystem based on the
difficulty of solving a system of non-linear equations. Proc. 10th SITA, JA5-3, November 1987.
In Japanese.
[8] M. Kasahara and R. Sakai. A new principle of public key cryptosystem and its realization.
Technical Report of IEICE, ISEC2000-92 (2000-11), November 2000. In Japanese.
[9] M. Kasahara and R. Sakai. A construction of public key cryptosystem for realizing ciphertextof size 100 bit and digital signature scheme. IEICE Transactions, E87-A, No.1 (2004), 102–109.
[10] M. Kasahara and R. Sakai. A construction of publickey cryptosystem based on singular simultaneous equations. Proc. SCIS2004, 1B5-1, 2004.
[11] M. Kasahara and R. Sakai. A construction of public-key cryptosystem based on singular simultaneous equations and its variants. Technical Report of IEICE, ISEC2005-7 (2005-05), May
2005.
[12] A. Kipnis and A. Shamir. Cryptanalysis of the HFE public key cryptosystem by relinearization.
Proc. CRYPTO ’99, Lecture Notes in Computer Science, Vol.1666, pp.19–30, Springer, 1999.
[13] T. Matsumoto, H. Imai, H. Harashima, and H. Miyakawa. A class of asymmetric cryptosystems
using obscure representations of enciphering functions. 1983 National Convention Record on
Information Systems, IECE Japan, S8-5, 1983. In Japanese.
[14] T. Matsumoto and H. Imai. Public quadratic polynomial-tuples for efficient signatureverification and message-encryption. Proc. EUROCRYPT ’88, Lecture Notes in Computer
Science, Vol.330, pp.419–453, Springer, 1988.
[15] T. T. Moh. A public key system with signature and master key functions. Communications in
Algebra, 27, 2207–2222, 1999.
[16] J. Patarin. Cryptanalysis of the Matsumoto and Imai public key scheme of Eurocrypt ’88.
Proc. CRYPTO ’95, Lecture Notes in Computer Science, Vol.963, pp.248-261, Springer, 1995.
[17] J. Patarin. Hidden fields equations (HFE) and isomorphisms of polynomials (IP): two new families of asymmetric algorithms. Proc. EUROCRYPT ’96, Lecture Notes in Computer Science,
Vol.1070, pp.33–48, Springer, 1996.
[18] S. Tsujii, K. Kurosawa, T. Itoh, A. Fujioka, and T. Matsumoto. A public-key cryptosystem
based on the difficulty of solving a system of non-linear equations. IEICE Transactions (D),J69-D, No.12 (1986), 1963–1970. In Japanese.

PQCrypto 2006 Workshop Record

116Proposal for piece in hand matrix ver. 2: enhancing security of multivariate public key cryptosystems[19] S. Tsujii, A. Fujioka, and Y. Hirayama. Generalization of the public-key cryptosystem basedon the difficulty of solving a system of non-linear equations. IEICE Transactions (A), J72-A,
No.2 (1989), 390–397. In Japanese.
[20] S. Tsujii. A new structure of primitive public key cryptosystem based on soldiers in hand
matrix. Technical Report TRISE 02-03, Chuo University, July 2003.
[21] S. Tsujii, R. Fujita, and K. Tadaki. Proposal of MOCHIGOMA (piece in hand) concept for
multivariate type public key cryptosystem. Technical Report of IEICE, ISEC2004-74 (2004-09),
September 2004.
[22] S. Tsujii, K. Tadaki, and R. Fujita. Piece in hand concept for enhancing the security ofmultivariate type public key cryptosystems: public key without containing all the informationof secret key. Cryptology ePrint Archive, Report 2004/366, December 2004. Available at URL:
http://eprint.iacr.org/2004/366 .
[23] S. Tsujii, K. Tadaki, and R. Fujita. Piece in hand concept for enhancing the security ofmultivariate type public key cryptosystems: public key without containing all the informationof secret key. Proc. SCIS2005, 2E1-3, pp.487–492, 2005.
[24] S. Tsujii, K. Tadaki, and R. Fujita. Proposal for piece in hand (soldiers in hand) matrix— general concept for enhancing security of multivariate public key cryptosystems — Ver.2.
Proc. SCIS2006, 2A4-1, 2006. In Japanese.
[25] C. Wolf, A. Braeken, and B. Preneel. Efficient cryptanalysis of RSE(2)PKC and RSSE(2)PKC.
Proc. SCN 2004, Lecture Notes in Computer Science, Vol.3352, pp.294–309, Springer, 2004.
[26] C. Wolf and B. Preneel. Taxonomy of Public Key Schemes based on the problem of Multivariate
Quadratic equations. Cryptology ePrint Archive, Report 2005/077, December 2005. Available
at URL: http://eprint.iacr.org/2005/077 .

117

PQCrypto 2006 Workshop Record

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

Post-quantum lattice-based cryptography
Phong Nguyen
École Nationale Supérieure

139

PQCrypto 2006 Workshop Record

NTRUEncrypt and NTRUSign: efficient public key algorithms for a
post-quantum world
Jeff Hoffstein, Nick Howgrave-Graham, Jill Pipher, Joseph H. Silverman, William Whyte
NTRU Cryptosystems,
35 Nagog Park, Acton, MA 01720, USA{jhoffstein,nhowgravegraham,jpipher,jsilverman,wwhyte}@ntru.com

Abstract. We provide an overview of the algorithms NTRUEncrypt and NTRUSign. These algorithms
have attractive operating speed and keysize and are based on hard problems that are not known
to have polynomial-time quantum algorithms. We discuss the state of current knowledge about the
security of both algorithms and identify areas of research where progress could help the algorithms togain acceptance.

1

Introduction

In considering what cryptographic techniques may be of use if practical quantum computers are ever developed, it is natural to look at algorithms based on lattice reduction. Lattice reduction is a reasonably
well-studied hard problem that is currently not known to be solved by any polynomial time, or even subexponential time, quantum algorithms [37, 27]. The NTRUEncrypt and NTRUSign algorithms are currently
the most attractive public key algorithms whose security rests on lattice reduction: in common with otherlattice-based algorithms, they have fast running times (typically O(k 2 ) for security levels of k bits), but
unlike other lattice-based algorithms the public keys, signatures, and ciphertexts are of size O(k) rather
than O(k 2 ). In fact, at the 112-bit security level and above, NTRUSign public keys are actually smaller thanequivalent-strength RSA keys. Published performance figures for NTRUEncrypt and NTRUSign show them
to be among the fastest public-key algorithms currently known. The algorithms are therefore of interest evenin the classical computing world, and are clearly prime candidates for widespread adoption should quantum
computers ever be invented.
This paper presents an overview of operations, performance, and security considerations for both algorithms. The most up-to-date descriptions of NTRUEncrypt and NTRUSign are included in [21] and [20],respectively. This paper summarizes, and draws heavily on, the material presented in those papers.
This paper is structured as follows. First, we introduce and describe the algorithms NTRUEncrypt and
NTRUSign. We then survey known results about the security of these algorithms, including their security
against known quantum algorithms. We then present performance characteristics of the algorithms.

2

NTRUEncrypt: Overview

2.1

Parameters and Definitions

An implementation of the NTRUEncrypt encryption primitive is specified by the following parameters:Nqp
Df , Dg
Dm
Dr

Degree Parameter. A positive integer. The associated NTRU lattice has dimension 2N .
Large Modulus. A positive integer. The associated NTRU lattice is a convolution modular
lattice of modulus q.
Small Modulus. An integer or a polynomial.
Private Key Spaces. Sets of small polynomials from which the private keys are selected.
Plaintext Space. Set of polynomials that represent encryptable messages. It is the responsibility of the encryption scheme to provide a method for encoding the message that one
wishes to encrypt into a polynomial in this space.
Blinding Value Space. Set of polynomials from which the temporary blinding value usedduring encryption is selected.

141

PQCrypto 2006 Workshop Record

Hoffstein, Howgrave-Graham, Pipher, Silverman, Whyte

centerCentering Method. A means of performing mod q reduction on decryption.

Definition 1. The Ring of Convolution Polynomials is
R=

Z[X]
.
(X N − 1)

Multiplication of polynomials in this ring corresponds to the convolution product of their associated vectors,
defined by
¶
N
−1µ
X
X
(f ∗ g)(X) =fi · gj X k .
k=0

i+j≡k

(mod N ). Convolution operations in the ring Rq are referred to as modular
We also use the notation Rq = (Z/qZ)[X](X N −1)
convolutions.

Definition 2. A polynomial a(X) = a0 + a1 X + · · · + aN −1 X N −1 is identified with its vector of coefficients
PN −1
a = [a0 , a1 , . . . , aN −1 ]. The mean ā of a polynomial a is defined by ā = N1 i=0 ai . The centered norm kakof a is defined byÃN −1 !2
N
−1
X
1 X
2
2
kak =
ai −
ai .
(1)
N i=0
i=0
Definition 3. The width Width(a) of a polynomial or vector is defined by
Width(a) = Max(a0 , . . . , aN −1 ) − Min(a0 , . . . , aN −1 ) .
Definition 4. A binary polynomial is one whose coefficients are all in the set {0, 1}. A trinary polynomial is
one whose coefficients are all in the set {0, ±1}. If one of the inputs to a convolution is a binary polynomial,
the operation is referred to as a binary convolution. If one of the inputs to a convolution is a trinary
polynomial, the operation is referred to as a trinary convolution.
Definition 5. Define the polynomial spaces BN (d), TN (d), TN (d1 , d2 ) as follows. Polynomials in BN (d) haved coefficients equal to 1 and the other coefficients are 0. Polynomials in TN (d) have d + 1 coefficients equal
to 1, have d coefficients equal to −1, and the other coefficients are 0. Polynomials in TN (d1 , d2 ) have d1
coefficients equal to 1, have d2 coefficients equal to −1, and the other coefficients are 0.
2.2“Raw” NTRUEncrypt

Key Generation NTRUEncrypt key generation consists of the following operations:
1. Randomly generate polynomials f and g in Df , Dg respectively.
2. Invert f in Rq to obtain fq , invert f in Rp to obtain fp , and check that g is invertible in Rq [14].
3. The public key h = p ∗ g ∗ fq (mod q). The private key is the pair (f, fp ).
Encryption NTRUEncrypt encryption consists of the following operations:
1. Randomly select a “small”polynomial r ∈ Dr .
2. Calculate the ciphertext e as e ≡ r ∗ h + m (mod q).
Decryption NTRUEncrypt decryption consists of the following operations:
1. Calculate a ≡ center(f ∗ e), where the centering operation center reduces its input into the interval[A, A + q − 1].
2. Recover m by calculating m ≡ fp ∗ a (mod p).
To see why decryption works, use h ≡ p ∗ g ∗ fq and e ≡ r ∗ h + m to obtaina ≡ p ∗ r ∗ g + f ∗ m (mod q) .

(2)

For appropriate choices of parameters and center, this is an equality over Z, rather than just over Zq .
Therefore step 2 recovers m: the p ∗ r ∗ g term vanishes, and fp ∗ f ∗ m = m (mod p).

PQCrypto 2006 Workshop Record

142

NTRUEncrypt and NTRUSign: efficient public key algorithms for a post-quantum world

2.3

Encryption schemes: NAEP

In order to protect against adaptive chosen ciphertext attacks, we must use an appropriately defined encryption scheme. The scheme described in [18] gives provable security in the random oracle model [2, 3] with atight (ie linear) reduction. We briefly outline it here.
NAEP uses two hash functions:
G : {0, 1}N −l × {0, 1}l → Dr

H : {0, 1}N → {0, 1}N

To encrypt a message M ∈ {0, 1}N −l using NAEP one uses the functions
compress(x) = (x (mod q)) (mod 2),
B2P : {0, 1}N → Dm ∪ “error”, P2B : Dm → {0, 1}N
The function compress puts the coefficients of the modular quantity x (mod q) in to the interval [0, q), andthen this quantity is reduced modulo 2. The role of compress is simply to reduce the size of the input tothe hash function H for gains in practical efficiency.The function B2P converts a bit string into a binary
polynomial, or returns “error” if the bit string does not fulfil the appropriate criteria – for example, if it does
not have the appropriate level of combinatorial security. The function P2B converts a binary polynomial toa bit string.
The encryption algorithm is then specified by:R

1. Pick b ← {0, 1}l .
2. Let r = G(M, b), m = B2P( (M ||b) ⊕ H(compress(r ∗ h)) ).
3. If B2P returns “error”, go to step 1.
4. Let e = r ∗ h + m ∈ Rq .
Step 3 ensures that only messages of the appropriate form will be encrypted.
To decrypt a message e ∈ Rq one does the following:
1. Let a = center(f ∗ e (mod q)).
2. Let m = fp−1 ∗ a (mod p).
3. Let s = e − m.
4. Let M ||b = P2B(m) ⊕ H(compress(P2B(s))).
5. Let r = G(M, b).
6. If r ∗ h = s (mod q), and m ∈ Dm , then return the message M , else return the string “invalid ciphertext”.
The use of the scheme NAEP introduces a single additional parameter:l

2.4

Random Padding Length. The length of the random padding b concatenated with M instep 1.

Instantiating NAEP: SVES-3

The EESS#1 v2 standard [5] specifies an instantiation of NAEP known as SVES-3. In SVES-3, the following
specific design choices are made:– To allow variable-length messages, a one-byte encoding of the message length in bytes is prepended tothe message. The message is padded with zeroes to fill out the message block.
– The hash function G which is used to produce r takes as input M ; b; an OID identifying the encryption
scheme and parameter set; and a string htrunc derived by truncating the public key to length lh bits.
SVES-3 includes htrunc in G so that r depends on the specific public key. Even if an attacker were to findan (M, b) that gave an r with an increased chance of a decryption failure, that (M, b) would apply only toa single public key and could not be used to attack other public keys. However, the current recommended
parameter sets do not have decryption failures and so there is no need to input htrunc to G. We will therefore
use SVES-3but set lh = 0.

143

PQCrypto 2006 Workshop Record

Hoffstein, Howgrave-Graham, Pipher, Silverman, Whyte

3

NTRUSign: Overview

3.1

Parameters

An implementation of the NTRUSign primitive uses the following parameters:Nq
Df , DgNβ3.2

polynomials have degree < N
coefficients of polynomials are reduced modulo q
polynomials in T (d) have d + 1 coefficients equal to 1, have d coefficients equal to −1, andthe other coefficients are 0.
the norm bound used to verify a signature.
the balancing factor for the norm k · kβ . Has the property 0 < β ≤ 1.

“Raw” NTRUSignKey Generation NTRUSign key generation consists of the following operations:
1. Randomly generate “small” polynomials f and g in Df , Dg respectively such that f and g are invertible
modulo q.
2. Find polynomials F and G such thatf ∗G−g∗F=q ,(3)
and F and G have sizep
kFk ≈ kGk ≈ kfk N/12 .

(4)This can be done using the methods of [19]3. Denote the inverse of f in Rq by fq , and the inverse of g in Rq by gq The public key h = F ∗ fq (mod q) =G ∗ gq (mod q). The private key is the pair (f, g).
Signing The signing operation involves rounding polynomials. For any a ∈ Q, let bae denote the integer
closest to a, and define {a} = a − bae. (For numbers a that are midway between two integers, we specify
that {a} = + 21 , rather than − 12 .) If A is a polynomial with rational (or real) coefficients, let bAe and {A}be A with the indicated operation applied to each coefficient.
“Raw” NTRUSign signing consists of the following operations:
1. Map the digital document D to be signed to a vector m ∈ [0, q)N using an agreed hash function.
2. Setµ¶µ¶−m ∗ g m ∗ f
G −F(x, y) = (0, m)
/q =
,
.
−g f
q
q
3. Set² = −{x}and²0 = −{y} .

(5)

4. Calculate s, the signature, as
s = ²f + ²0 g .

(6)Verification Verification involves the use of a balancing factor β and a norm bound N . To verify, therecipient does the following:
1. Map the digital document D to be verified to a vector m ∈ [0, q)N using the agreed hash function.
2. Calculate t = s ∗ h mod q, where s is the signature and h is the signer’s public key.
3. Calculate the norm
¢1/2¡.
ν = min ks + k1 qk2 + β 2 k(t − m) + k2 qk2
k1 ,k2 ∈R

4. If ν ≤ N , the verification succeeds. Otherwise, it fails.

PQCrypto 2006 Workshop Record

144

(7)

NTRUEncrypt and NTRUSign: efficient public key algorithms for a post-quantum world

3.3

Why NTRUSign works

Given any positive integers N and q and any polynomial h ∈ R, we can construct a lattice Lh contained inR2 ∼= Z2N as follows:¯©
ªLh = Lh (N, q) = (r, r0 ) ∈ R × R ¯ r0 ≡ r ∗ h (mod q) .
This sublattice of Z2N is called a convolution modular lattice. It has dimension equal to 2N and determinantequal to q N .
Since
¶
µ
f F
=q
det
gG
and we have defined h = F/f = G/g mod q, we know that
µ
¶
µ
¶
f F
1h
and
gG
0q
are bases for the same lattice. Here, as in [19], a 2-by-2 matrix of polynomials is converted to a 2N -by-2N
integer matrix matrix by converting each polynomial in the polynomial matrix to its representation as an
N -by-N circulant matrix, and the two representations are regarded as equivalent.
Signing consists of finding a close lattice point to the message point (0, m) using Babai’s method: express
the target point as a real-valued combination of the basis vectors, and find a close lattice point by rounding
off the fractional parts of the real coefficients to obtain integer combinations of the basis vectors. The error
introduced by this process will be the sum of the rounding errors on each of the basis vectors, and therounding error will by definition be between − 21 and 12 . In NTRUSign, the basis vectors are all of the sameplength, so the expected error introduced by 2N roundings of this type will be N/6
p times this length.
In NTRUSign, the private basis is chosen such that kfk = kgk and kFk ∼ kGk ∼ N/12kfk. The expected
error in signing will therefore bep√
N/6kfk + β(N/6 2)kfk.
(8)
In contrast, an attacker who uses only the public key will likely produce a signature with N incorrect
coefficients, and those coefficients will be distributed randomly mod q. The expected error in generating asignature with a public key is thereforep
β N/12q .
(9)(We discuss security considerations in more detail in Section 9 and onwards; the purpose of this section is
to argue that it is plausible that the private key allows the production of smaller signatures than the publickey).
It is therefore clear that it is possible to choose kfk and q such that knowledge of the private basis allows
the creation of smaller signing errors than knowledge of the public basis alone. Therefore, by ensuring thatthe signing error is less than could be expected to be produced by the public basis, a recipient can verify
that the signature was produced by the owner of the private basis and is therefore valid.
3.4

NTRUSign signature schemes: chosen message attacks, hashing and message preprocessing

To prevent chosen message attacks the message representative m must be generated in some pseudo-random
fashion from the input document D. The currently recommended hash function for NTRUSign is a simple
Full Domain Hash. First the message is hashed to a “seed” hash value Hm . Hm is then hashed in countermode to produce the appropriate number of bits of random output, which are treated as N numbers mod q.
Since q is a power of 2, there are no concerns with bias.
The above mechanism is deterministic. If parameter sets were chosen that gave a significant chance of
signature failure, the mechanism can be randomized as follows. The additional input to the process is rlen ,the length of the randomizer in bits.
On signing:
1. Hash the message as before to generate Hm .

145

PQCrypto 2006 Workshop Record

Hoffstein, Howgrave-Graham, Pipher, Silverman, Whyte

2. Select a randomizer r consisting of rlen random bits.
3. Hash Hm kr in counter mode to obtain enough output for the message representative m.
4. On signing, check that the signature will verify correctly.
(a) If the signature does not verify, repeat the process with a different r.
(b) If the signature verifies, send the tuple (r, s) as the signature
On verification, the verifier uses the received r and the calculated Hm as input to the hash in countermode to generate the same message representative as the signer used.
The size of r should be related to the probability of signature failure. An attacker who is able to determine
through timing information that a given Hm required multiple rs knows that at least one of those rs resulted
in a signature that was too big, but does not know which message it was or what the resulting signature was.
It is an open research question to quantify the appropriate size of r for a given signature failure probability,
but in most cases rlen = 8 or 32 should be sufficient.
3.5

NTRUSign signature schemes: perturbations

To protect against transcript attacks, the raw NTRUSign signing algorithm defined above is modified asfollows.
On key generation, the signer generates a secret perturbation distribution function.
On signing, the signer uses the agreed hash function to map the document D to the message representative m. However, before using her private key, she chooses an error vector e drawn from the perturbation
distribution function that was defined as part of key generation. She then signs m + e, rather than m alone.
The verifier calculates m, t, and the norms of s and t − m and compares the norms to a specified boundN as before. Since signatures with perturbations will be larger than unperturbed signatures, N and in fact
all of the parameters will in general be different for the perturbed and unpertubed cases.
NTRU currently recommends the following mechanism for generating perturbations.
Key generation At key generation time, the signer generates B lattices L1 . . . LB . These lattices are
generated with the same parameters as the private and public key lattice, L0 , but are otherwise independentof L0 and of each other. For each Li , the signer stores fi , gi , hi .
Signing When signing m, for each Li starting with LB , the signer does the following:³´
i m∗fi
1. Set (x, y) == −m∗g,.
qq
2. Set ² = −{x}and²0 = −{y} .
3. Set si = ²fi + ²0 gi .
4. Set s = s + si .
5. If i = 0 stop and output s; otherwise, continute
6. Set ti = si ∗ hi mod q
7. Set m = ti − (si ∗ hi−1 ) mod q.
The final step translates back to a point of the form (0, m) so that all the signing operations can use only
the f and g components, allowing for greater efficiency. Note that steps 6 and 7 can be combined into thesingle step of setting m = si ∗ (hi − hi−1 to improve performance.
The parameter sets defined in [20] take B = 1.

4

NTRUEncrypt performance

4.1

NTRUEncrypt parameter sets

There are many different ways of choosing “small” polynomials. This section reviews NTRU’s current recommendations for choosing the form of these polynomials for best efficiency. We focus here on choices that
improve efficiency; security considerations are looked at in Section 8.

PQCrypto 2006 Workshop Record

146

NTRUEncrypt and NTRUSign: efficient public key algorithms for a post-quantum world

Form of f Published NTRUEncrypt parameter sets [21] take f to be of the form f = 1 + pF. This guarantees
that fp = 1, eliminating one convolution on decryption.
Form of F, g, r NTRU currently recommends two different forms for F and R. If F and r take binary form,
they are drawn from BN (d), the set of binary polynomials with d 1s and N − d 0s. If F and r take productRform, then F = f1 ∗ f2 + f3 , with f1 , f2 , f3 ← BN (d), and similarly for r. (The value d is considerably lower
in the product-form case than in the binary case). In both cases, it turns out that the best security andR
performance is obtained by taking g ← BN (bN/2c).
A binary convolution requires dN adds mod q. The best efficiency is therefore obtained when d is as low
as possible consistent with the security requirements.
Plaintext size For k-bit security, we want to transport 2k bits of message and we we require l ≥ k, l
the random padding length. SVES-3 uses 8 bits to encode the length of the transported message. N must
therefore be at least 3k + 8. Smaller N will in general lead to lower bandwidth and faster operations.
Form of p, q The parameters p and q must be relatively prime. This admits of various combinations, suchas (p = 2, q = prime), (p = 3, q = 2m ), (p = 2 + X, q = 2m ), The only combination that allows q < 256
for typical security levels without creating the possibility of decryption failures is (p = 2, q = prime). The
current parameter sets therefore take p and q to be of this form.
The B2P function The polynomial m produced by the B2P function will be a random binary polynomial.
As the number of 1s (or 0s) diverges from N/2, the strength of the ciphertext against both lattice andcombinatorial attacks will decrease. The B2P function therefore contains a check that the number of 1s in m
is no less than a value dm0 . This value is chosen such that the chance that a randomly chosen polynomial
lies outside this range is no more than 2−40 .
4.2

NTRUEncrypt performance

Table 1 and Table 2 give parameter sets and running times (in terms of operations per second) for binary andproduct-form cases respectively at different security levels corresponding to k bits of security. “Size” is thesize of the public key in bits. In the case of NTRUEncrypt and RSA this is also the size of the ciphertext; in thecase of some ECC encryption schemes, such as ECIES, the ciphertext may be a multiple of this size. Times
given are for unoptimized C implementations on a 1.7 GHz Pentium and include time for all encryption
scheme operations, including hashing, random number generation, as well as the primitive operation. dm0 is
the same in both the binary and product-form case and is omitted from the product-form table.
For comparison, we provide the times given in [4] for raw elliptic curve point multiplication (not includinghashing or random number generation times) over the NIST prime curves. These times were obtained on a 400
MHz SPARC and have been converted to operations per second by simply scaling by 400/1700. Times given
are for point multiplication without precomputation, as this corresponds to common usage in encryption
and decryption. Precomputation improves the point multiplication times by a factor of 3.5-4. We also givethe speedup for NTRUEncrypt decryption versus a single ECC point multiplication.

5

NTRUSign performance

5.1

NTRUSign parameter sets

Form of f, g The current recommended parameter sets take f and g to be trinary, i.e. drawn from TN (d).
Trinary polynomials allow for higher combinatorial security than binary polynomials at a given value of N
and admit of efficient implementations. A trinary convolution requires (2d + 1)N adds and one subtract
mod q. The best efficiency is therefore obtained when d is as low as possible consistent with the security
requirements.

147

PQCrypto 2006 Workshop Record

Hoffstein, Howgrave-Graham, Pipher, Silverman, Whyte

RSA ECCECC Speedup
enc/s dec/s
size
size
mult/s wrt ECC
80 251 48 70 197 2008 1024 163 21607 11558 1632
7.08
112 347 66 108 269 3033 ∼ 2048 224 10449 5805 1075
5.4
128 397 74 128 307 3501 3072 256 8198 4729 661
7.15
160 491 91 167 367 4383 4096 320 5427 3078——
192 587 108 208 439 5193 7680 384 3985 2263 196
11.55
256 787 140 294 587 7690 15360 512 2574 1416 115
12.31
Table 1. Final Parameter Sets for different values of k using binary polynomials.
kN

d dm0 qsize

RSA ECC Speedup Speedup
size
size wrt binary wrt ECC
80 251 8 293 2259 1024 163
2.00
18.63
112 347 11 541 3370 ∼ 2048 224
2.00
14.88
128 397 12 659 3890 3072 256
2.06
19.40
160 491 15 967 4870 4096 320
2.02
29.22
192 587 17 1229 6347 7680 384
2.12
31.29
256 787 22 2027 8459 15360 512
2.12
30.72
Table 2. Final Parameter Sets for different values of k using product form polynomials.
k

N d

q

size

Form of p, q The parameters q and N must be relatively prime. For efficiency, we take q to be a power of2.
Signing Failures A low value of N , the norm bound, gives the possibility that a validly generated signature
will fail. This affects efficiency, as if the chance of failure is non-negligible the signer must randomize themessage before signing and check for failure on signature generation. For efficiency, we want to set N
sufficiently high to make the chance of failure negligible. To do this, we denote the expected size of asignature by E and define the signing tolerance ρ by the formulaN = ρE .
As ρ increases beyond 1, the chance of a signing failure appears to drop off exponentially. In particular, experimental evidence indicates that the probability that a validly generated signature will fail the normboundtest with parameter ρ is smaller than e−C(N )(ρ−1) , where C(N ) > 0 increases with N . In fact, under theassumption that each coefficient of a signature can be treated as a sum of independent identically distributed
random variables, a theoretical analysis indicates that C(N ) grows quadratically in N . The parameter sets
below were generated with ρ = 1.1, which appears to give a vanishingly small probability of valid signature
failure for N in the ranges that we consider. It is an open research question to determine precise signature
failure probabilities for specific parameter sets, i.e. to determine the constants in C(N ).
5.2

NTRUSign performanceWith one perturbation, signing takes time equivalent to two “raw” signing operations (as defined in Section 3.2) and one verification. Research is ongoing into alternative forms for the perturbations that could
reduce this time.
Table 3 gives the parameter sets for a range of security levels, corresponding to k-bit security, and theperformance (in terms of signatures and verifications per second) for each of the recommended parameter
sets. We compare signature times to a single ECC point multiplication with precomputation from [4]; without precomputation the number of ECC signatures/second goes down by a factor of 3.5-4. We compare
verification times to ECDSA verification times without memory constraints from [4]. As in Tables 1 and 2,
NTRUSign times given are for the entire scheme (including hashing, etc), not just the primitive operation,
while ECDSA times are for the primitive operation alone.

PQCrypto 2006 Workshop Record

148

NTRUEncrypt and NTRUSign: efficient public key algorithms for a post-quantum world

Above the 80-bit security level, NTRUSign signatures are smaller than the corresponding RSA signatures.
They are larger than the corresponding ECDSA signatures by a factor of about 4. An NTRUSign private
key consists of sufficient space to store f and g for the private key, plus sufficient space to store fi , gi and hi
for each of the B perturbation bases. Each f and g can be stored in 2N bits, and each h can be stored in
N log2 (q) bits, so the total storage requred for the one-perturbation case is is 16N bits for the 80- to 128-bit
parameter sets below and 17N bits for the 160- to 256-bit parameter sets, or approximately twice the sizeof the public key.
public key andsign/svfy/ssignature sizek N d q NTRU ECDSA key ECDSA sig RSA NTRU ECDSA Ratio NTRU ECDSA Ratio
80 157 29 256 1256
192
384
1024
4560
5140 0.89 15955 1349 11.83
112 197 28 256 1576
224
448
∼ 2048 3466
3327 1.04 10133
883 11.48
128 223 32 256 1784
256
512
3072
2691
2093 1.28
7908
547 14.46
160 263 45 512 2367
320
640
4096
1722
—
—
5686
—
—
192 313 50 512 2817
384
768
7680
1276
752
1.69
4014
170 23.61
256 349 75 512 3141
512
1024
15360
833
436
1.91
3229
100 32.29
Table 3. Performance measures for different NTRUSign parameter sets
Parameters

6

Security: overview

We quantify security in terms of bit strength k, evaluating how much effort an attacker has to put in to
break a scheme. All the attacks we consider here have variable running times, so we describe the strength ofa parameter set using the notion of cost. For an algorithm A with running time t and probability of successε, the cost is defined as
CA = t/ε .
This definition of cost is not the only one that could be used. For example, in the case of indistinguishability against adaptive chosen-ciphertext attack the attacker outputs a single bit i ∈ {0, 1}, and obviously
has a chance of success of at least 21 . Here the probability of success is less important than the attacker’s
advantage, defined asadv(A(ind)) = 2.(Pr[Succ[A]] − 1/2) .
However, in this paper the cost-based measure of security is appropriate.
Our notion of cost is derived from [25] and related work. An alternate notion of cost, which is thedefinition above multiplied by the amount of memory used, is proposed in [38]. The use of this measure would
allow significantly more efficient parameter sets, as the meet-in-the-middle attack described in Section 7.1 isessentially a time-memory tradeoff that keeps the product of time and memory constant. However, current
practice is to use the measure of cost above.
We also acknowledge that the notion of comparing public-key security levels with symmetric security
levels, or of reducing security to a single headline measure, is inherently problematic — see an attempt to do
so in [33], and useful comments on this in [22]. In particular, extrapolation of breaking times is an inexact
science, the behavior of breaking algorithms at high security levels is by definition untested, and one cannever disprove the existence of an algorithm that attacks NTRUEncrypt (or any other system) more efficiently
than the best currently known method.

7

Common security considerations

This section deals with security considerations that are common to NTRUEncrypt and NTRUSign.
Most public key cryptosystems, such as RSA [35] or ECC [24, 30], are based on a one-way function forwhich there is one best-known method of attack: factoring in the case of RSA, Pollard-rho in the case of

149

PQCrypto 2006 Workshop Record

Hoffstein, Howgrave-Graham, Pipher, Silverman, Whyte

ECC. In the case of NTRU, there are two primary methods of approaching the one-way function, both ofwhich must be considered when selecting a parameter set.
7.1

Combinatorial Security

Polynomials are drawn from a known space S. This space can best be searched by using a combinatorialtechnique originally due to Odlyzko [17], which can be used to recover f or g from h or r and m from e. We
denote the combinatorial security of polynomials drawn from S by Comb[S]
¡N/2¢
d/2

Comb[BN (d)] ≥ √

N

.

(10)

For trinary polynomials in TN (d), we findµComb[T (d)] >

¶
√
N
/ N.
d+1

(11)

For product-form polynomials in PN (d), defined as polynomials of the form a = a1 ∗ a2 + a3 , where a1 , a2 , a3
are all binary with da1 , da2 , da3 1s respectively, da1 = da2 = da3 = da , and there are no further constraints
on a, we find [21]:³µN − dN/de¶2
Comb[PN (d)] ≥ min
,
d−1
Ãµ
!
¶µ
N ¶ µ ¶e
N − d Nd e N − d d−)
N
max
,
,
d−1
2d
d−2
µµ ¶µ
¶ µ
N ¶¶
N
N
N − d 2d
e
max
,
d
d−1
2d − 1´

7.2

Lattice Security

An ntru public key h describes a 2N -dimensional NTRU lattice containing the private key (f, g) or (f,F). When f is of the form f = 1 + pF, the best lattice attack on the private key involves solving a Close
Vector Problem (CVP).1 When f is not of the form f = 1 + pF, the best lattice attack involves solving an
Approximate Shortest Vector Problem (apprSVP). Experimentally, it has been found that an NTRU latticeof this form can usefully be characterized by two quantities
a = N/q,pc = 4πekFkkgk/q (NTRUEncrypt),p= 4πekfkkFk/q (NTRUSign).
p(For product-form keys the norm kFk is variable but always obeys |F| ≥ D(N − D)/N , D = d2 + d. We
use this value in calculating the lattice security of product-form keys, knowing that in practice the value ofc will typically be higher.)This is to say that for constant (a, c), the experimentally observed running times for lattice reduction
behave roughly aslog(T ) = AN + B ,for some experimentally-determined constants A and B.
Table 4 summarizes experimental results for breaking times for NTRU lattices with different (a, c) values.
We represent the security by the constants A and B. The breaking time in terms of bit security is AN + B.
It may be converted to time in MIPS-years using the equality 80 bits ∼ 1012 MIPS-years.
1

Coppersmith and Shamir [6] propose related approaches which turn out not to materially affect security.

PQCrypto 2006 Workshop Record

150

NTRUEncrypt and NTRUSign: efficient public key algorithms for a post-quantum worldcaAB
1.73 0.53 0.3563 −2.263
2.6 0.8 0.4245 −3.440
3.7 2.7 0.4512 +0.218
5.3 1.4 0.6492 −5.436
Table 4. Extrapolated bit security constants depending on (c, a).

For constant (a, c), increasing N increases the breaking time exponentially. For constant (a, N ), increasingc increases the breaking time. For constant (c, N ), increasing a decreases the breaking time, although theeffect is slight. More details on this table are given in [15].
Note that the effect of moving from the “standard” NTRUEncrypt lattice to the “transpose” NTRUSignlattice is to increase c by a factor of (N/12)1/4 . This allows for a given level of lattice security at lower
dimensions for the transpose lattice than for the standard lattice. Since NTRUEncrypt uses the standard
lattice, NTRUEncrypt key sizes given in [21] are greater than the equivalent NTRUSign key sizes at the samelevel of security.
The technique known as zero-forcing [15, 28] can be used to reduce the dimension of an NTRU lattice
problem. The precise amount of the expected performance gain is heavily dependent on the details of theparameter set; we refer the reader to [15, 28] for more details. In practice this reduces security by about 6-10
bits.
7.3

Other Security Considerations

The following parameter selection criteria must also be taken into account for both NTRUEncrypt and
NTRUSign.
Choosing N — The degree parameter N must be prime. (See [7].)8NTRUEncrypt security considerations

Parameter sets for NTRUEncrypt at a k-bit security level are selected subject to the following constraints:– The work to recover the private key or the message through lattice reduction must be at least k bits,
where bits are converted to MIPS-years using the equality 80 bits ∼ 1012 MIPS-years.
– The work to recover the private key or the message through combinatorial search must be at least 2k
binary convolutions.
– There must be no decryption failures.
8.1

Decryption Failure Security

NTRU decryption can fail on validly encrypted messages if the center method returns the wrong value ofA, or if the coefficients of prg + fm do not lie in an interval of width q. Decryption failures leak information
about the decrypter’s private key [16, 34]. The recommended parameter sets ensure that decryption failures
will not happen by setting q to be greater than the maximum possible width of prg + m + pFm. q should be
as small as possible while respecting this bound, as lowering q increases the lattice constant c and hence thelattice security. Centering then becomes simply a matter of reducing into the interval [0, q − 1].
It would be possible to improve performance by relaxing the final condition to require only that theprobability of a decryption failure was less than 2−K . However, this would require improved techniques for
estimating decryption failure probabilities.

151

PQCrypto 2006 Workshop Record

Hoffstein, Howgrave-Graham, Pipher, Silverman, Whyte

8.2

N , q and p

The small and large moduli p and q must be relatively prime in the ring R. Equivalently, the three quantitiesp,q,

XN − 1

must generate the unit ideal in the ring Z[X]. (As an example of why this is necessary, in the extreme casethat p divides q, the plaintext is equal to the ciphertext reduced modulo p.)

8.3

Factorization of X N − 1 (mod q)

If F(X) is a factor of X N − 1 (mod q), and if h(X) is a multiple of F(X), i.e., if h(X) is zero in the field
K = (Z/qZ)[X]/F(X), then an attacker can recover the value of m(X) in the field K.
If q has order t (mod N ), then
X N − 1 ≡ (X − 1)F1 (X)F2 (X) · · · F(N −1)/t (X) in (Z/qZ)[X] ,where each Fi (X) has degree t and is irreducible mod q. If Fi (X) has degree t, the probability that h(X)or r(X) is divisible by Fi (X) is presumably 1/q t . To avoid attacks based on the factorization of h or r, we
will require that for each prime divisor P of q, the order of P (mod N ) must be N − 1 or (N − 1)/2. Thisrequirement has the useful side-effect of increasing the probability that randomly chosen f will be invertiblein Rq [36].
8.4

Information leakage from encrypted messages

The transformation a → a(1) is a ring homomorphism, and so the ciphertext e has the property thate(1) = r(1)h(1) + m(1) .
An attacker will know h(1), and for many choices of parameter set r(1) will also be known. Therefore, theattacker can calculate m(1). The larger |m(1) − N/2| is, the easier it is to mount a combinatorial or lattice
attack to recover the msssage, so the sender should always ensure that kmk is sufficiently large. In theseparameter sets, we set a value dm0 such that there is a probability of less than 2−40 that the number of 1s
or 0s in a randomly generated m is less than dm0 . We then calculate the security of the ciphertext against
lattice and combinatorial attacks in the case where m has exactly this many 1s and require this to be greaterthan 2k for k bits of security.

8.5

NTRUEncrypt security: summary

In this section we present a summary of the security measures for the parameter sets under consideration.
Table 5 gives security measures for binary keys. Table 6 gives security measures for product-form keys. The
measure blatt is the lattice security in bits without taking zero-forcing into account, r is the number of zeroes
forced in zero-forcing, and bzf
latt is the measure including zero-forcing. In the product-form parameters table,
Hw(F) is the Hamming weight of F. dm0 is the same in both the binary and product-form case and is omitted
from the product-form table.

9

NTRUSign security considerations

This section considers security considerations that are specific to NTRUSign.

PQCrypto 2006 Workshop Record

152

NTRUEncrypt and NTRUSign: efficient public key algorithms for a post-quantum world

k N d dm0 q c(f, g) c(r, m) blatt r bzf
latt
80 251 48 70 197 2.93 2.77 103.1 29 97.98
112 347 66 108 269 2.94 2.83 143.9 31 138.26
128 397 74 128 307 2.93 2.84 165.1 33 159.17
160 491 91 167 367 2.98 2.90 205.0 35 198.75
192 587 108 208 439 2.97 2.91 245.7 37 239.21
256 787 140 294 587 2.95 2.91 330.6 41 323.45
Table 5. NTRUEncrypt security measures for different values of k using binary polynomials.
k N d Hw(F) q c(f, g) c(r, m) blatt r bzf
latt
80 251 8 72 293 2.57 2.43 87.2 20 80.1
112 347 11 132 541 2.21 2.13 117.8 16 118.7
128 397 12 156 659 2.24 2.17 136.3 17 136.6
160 491 15 210 967 2.08 2.02 171.3 16 170.1
192 587 17 306 1229 2.02 1.97 203.3 14 204.6
256 787 22 462 2027 1.78 1.75 278.1 14 276.7
Table 6. NTRUEncrypt security measures for different values of k using product-form polynomials

9.1

Security against forgery

We quantify the probability that an adversary, without knowledge of f, g, can compute a signature s on agiven document D. The constants N, q, δ, β, N must be chosen to ensure that this probability is less than
2−k , where k is the desired bit level of security. To investigate this some additional notation will be useful:
1. Expected length of s: Es
2. Expected length of t − m: Et
By Es , Et we mean respectively the expected values of ksk and kt − mk (appropriately reduced modq)
when generated by the signing procedure described in Section 3.2. These will be independent of m but
dependent on N, q, δ. A genuine signature will then have expected lengthq
E = Es2 + β 2 Et2
and we will set
N =ρ

q
Es2 + β 2 Et2 .

(12)

As in the case of recovering the private key, an attack can be made by combinatorial means, by lattice
reduction methods or by some mixing of the two. By balancing these approaches we will determine theoptimal choice of β, the public scaling factor for the second coordinate.
9.2

Combinatorial forgery

Let us suppose that N, q, δ, β, N , h are fixed. An adversary is given m, the image of a digital document D
under the hash function H. His problem is to locate an s such thatk(s mod q, β(h ∗ s − m) mod q)k < N .
In particular, this means that for an appropriate choice of k1 , k2 ∈ R(k(s + k1 qk2 + β 2 kh ∗ s − m + k2 q)k2 )1/2 < N .
A purely combinatorial attack that the adversary can take is to choose s at random to be quite small, andthen to hope that the point h∗s−m lies inside of a sphere of radius N /β about the origin after its coordinates
are reduced modq. The attacker can also attempt to combine guesses. Here, the attacker would calculate aseries of random si and the corresponding ti and ti − m, and file the ti and the ti − m for future reference. If

153

PQCrypto 2006 Workshop Record

Hoffstein, Howgrave-Graham, Pipher, Silverman, Whytea future sj produces a tj that is sufficiently close to ti − m, then (si + sj ) will be a valid signature on m. As
with the previous meet-in-the-middle attack, the core insight is that filing the ti and looking for collisions
allows us to check l2 t-values while generating only l s-values.
An important element in the running time of attacks of this type is the time that it takes to file a tvalue. We are interested not in exact collisions, but in two ti that lie close enough to allow forgery. In asense, we are looking for a way to file the ti in a spherical box, rather than in a cube as is the case for thesimilar attacks on private keys. It is not clear that this can be done efficiently. However, for safety, we willassume that the process of filing and looking up can be done in constant time, and that the running time of
the algorithm is dominated by the process of searching the s-space. Under this assumption, the attacker’s
expected work before being able to forge a signature is:
s
µ ¶N
π N/2
N
·
.
(13)
p(N, q, β, N ) <Γ (1 + N/2)qβ
If k is the desired bit security level it will suffice to choose parameters so that the right hand side of (13)is less than 2−k .
9.3

Signature forgery through lattice attacks

On the other hand the adversary can also launch a lattice attack by attempting to solve a closest vector
problem. in particular, he can attempt to use lattice reduction methods to locate a point (s, βt) ∈ Lh (β)
sufficiently close to (0, βm) that k(s, β(t − m))k < N . We’ll refer to k(s, β(t − m))k as the norm of theintended forgery.
The difficulty of using lattice reduction methods to accomplish this can be tied to another importantlattice constant:N√γ(N, q, β) =.
(14)σ(N, q, δ, β) 2NThis is the ratio of the√ required norm of the intended forgery over the norm of the√ expected smallest vectorof Lh (β), scaled by 2N . For usual NTRUSign parameters the ratio, γ(N, q, β) 2N , will be larger than 1.
Thus with high probability there will exist many points of Lh (β) that will work as forgeries. The task of an
adversary is to find one of these without the advantage that knowledge of the private key gives. As γ(N, q, β)decreases and the ratio approaches 1 this becomes measurably harder.
Experiments have shown that for fixed γ(N, q, β) and fixed N/q the running times for lattice reduction
to find a point (s, t) ∈ Lh (β) satisfying√
k(s, t − m)k < γ(N, q, β) 2N σ(N, q, δ, β)behave roughly aslog(T ) = AN + B
as N increases. Here A is fixed when γ(N, q, β), N/q are fixed, increases as γ(N, q, β) decreases and increases
as N/q decreases. Experimental results are summarized in Table 7.
Our analysis shows that lattice strength against forgery is maximized, for a fixed N/q, when γ(N, q, β)
is as small as possible. We haverπe
· (Es2 /β + βEt2 )(15)γ(N, q, β) = ρ
2N 2 qand so clearly the value for β which minimizes γ is β = Es /Et . This optimal choice yieldss
πeEs Et
γ(N, q, β) = ρ
.
N 2q

(16)

Referring to (13) we see that increasing β has the effect of improving combinatorial forgery security. Thus
the optimal choice will be the minimal β ≥ Es /Et such that p(N, q, β, N ) defined by (13) is sufficiently small.
An adversary could attempt a mixture of combinatorial and lattice techniques, fixing some coefficientsand locating the others via lattice reduction. However, as explained in [19], the lattice dimension can only
be reduced a small amount before a solution becomes very unlikely. Also, as the dimension is reduced, γdecreases, which sharply increases the lattice strength at a given dimension.

PQCrypto 2006 Workshop Record

154

NTRUEncrypt and NTRUSign: efficient public key algorithms for a post-quantum world

bound for γ and N/qωlf (N )γ < 0.1774 and N/q < 1.305 0.995113N − 82.6612
γ < 0.1413 and N/q < 0.707 1.16536N − 78.4659
γ < 0.1400 and N/q < 0.824 1.14133N − 76.9158
Table 7. Bit security against lattice forgery attacks, ωlf , based on experimental evidence for different values of(γ, N/q)

10

Transcript security

NTRUSign is not zero-knowledge. This means that, while NTRUEncrypt can have provable security (in thesense of a reduction from an online attack method to a purely offline attack method), there is no known
method for establishing such a reduction with NTRUSign. NTRUSign is different in this respect from established signature schemes such as ECDSA and RSA-PSS, which have reductions from online to offline
attacks. Research is ongoing into quantifying what information is leaked from a transcript of signatures andhow many signatures an attacker needs to observe to recover the private key or other information that would
allow the creation of forgeries. This section summarizes existing knowledge about this information leakage.
10.1

Transcript security for raw NTRUSignFirst, consider raw NTRUSign. In this case, an attacker studying a long transcript of valid signatures will
have a list of pairs of polynomials of the forms = ²f + ²0 g,

t − m = ²F + ²0 G

where the coeffcients of ², ²0 lie in the range [−1/2, 1/2]. In other words, the signatures lie inside a parallopiped
whose sides are the good basis vectors. The attacker’s challenge is to discover one edge of this parallelopiped.
Since the ²s are random, they will average to 0. To base an attack on averaging s and t − m, the attacker
must find something that does not average to zero. To do this he uses the reversal of s and t − m. The
reversal of a polynomial a is the polynomialā(X) = a(X −1 ) = a0 +N
−1X

aN −i X i .

i=1

We then setâ = a ∗ ā.
Notice that â has the form
â =

N
−1µN
−1
X
X
k=0

¶
ai ai+k X k .

i=0P
In particular, â0 = i a2 . This means that as the attacker averages over a transcript of ŝ, t −ˆ m, the crossterms will essentially vanish and the attacker will recoverN(f̂ + ĝ)12
for s and similarly for t − m, where h.i denotes the average of . over the transcript.
We refer to the product of a measurable with its reverse as its second moment. In the case of raw
NTRUSign, recovering the second moment of a transcript reveals the Gram Matrix of the private basis. Experimentally, it appears that significant information about the Gram Matrix is leaked after 10,000 signatures
for all of the parameter sets in this paper. A recent paper by Nguyen and Regev [31] demonstrates an attackon parameter sets without perturbations that combines Gram matrix recovery with creative use of averaging
moments over the signature transcript to recover the private key after seeing a transcript of approximately
70,000 signatures. It is not clear that this attack has been optimized and the use of unperturbed NTRUSignis strongly discouraged.
Obviously, something must be done to reduce information leakage from transcripts, and this is the role
played by perturbations.
h²̂0 i(f̂ + ĝ) =155

PQCrypto 2006 Workshop Record

Hoffstein, Howgrave-Graham, Pipher, Silverman, Whyte

10.2

Transcript security for NTRUSign with perturbations

In the case with B perturbations, the expectation of ŝ and t̂ − m̂ is (up to lower order terms)
E(ŝ) = (N/12)(f̂0 + ĝ0 + . . . + f̂B + ĝB )andE(t̂ − m̂) = (N/12)(f̂0 + ĝ0 + . . . + f̂B + ĝB ).
Note that this second moment is no longer a Gram matrix but the sum of (B + 1) Gram matrices. Likewise,
the signatures in a transcript do not lie within a parallelopiped but within the sum of (B +1) parallelopipeds.
This complicates matters for an attacker. The best currently known technique for B = 1 is to calculate
the second moment hŝi
the fourth moment hŝ2 i
the sixth moment hŝ3 i .
Since, for example, hŝi2 6= hŝ2 i, the attacker can use linear algebra to eliminate f1 and g1 and recover theGram matrix, whereupon the attack of [31] can be used to recover the private key. It is an interesting open
research question to determine whether there is any method open to the attacker that enables them toeliminate the perturbation bases without recovering the sixth moment (or, in the case of B perturbation
bases, the (4B + 2)-th moment). For now, the best known attack is this algebraic attack, which requires therecovery of the sixth moment. It is an open research problem to discover analytic attacks based on signaturetranscripts that improve on this algebraic attack.
We now turn to estimate τ , the length of transcript necessary to recover the sixth moment. Consider
an attacker who attempts to recover the sixth moment by averaging over τ signatures and rounding to thenearest integer. This will give a reasonably correct answer when the error in many coefficients (say at leasthalf) is less than 1/2. To compute the probability that an individual coefficient has an error less than 1/2,
write (12/N )ŝ as a main term plus an error, where the main term converges to fˆ0 + ĝ0 + fˆ1 + ĝ1 . The error
will converge to 0 at about the same rate as the main term converges to its expected value. If the probability
that a given coefficient is further than 1/2 from its expected value is less than 1/(2N ) then we can expect atleast half of the coefficients to round to their correct values. (Note that this convergence cannot be speeded
up using lattice reduction in, for example, the lattice ĥ, because the terms fˆ, ĝ are unknown and are larger
than the expected shortest vector in that lattice).
The rate of convergence of the error and its dependence on τ can be estimated by an application ofChernoff-Hoeffding techniques [26], using an assumption of a reasonable amount of independence and uniform
distribution of random variables within the signature transcript. This assumption appears to be justified byexperimental evidence, and in fact benefits the attacker by ensuring that the cross-terms converge to zero.
Using this technique, we estimate that to have a single coefficient in the 2k-th moment with error lessthan 21 , the attacker must analyze a signature transcript of length τ > 22k+4 d2k /N . Here d is the number of
1’s in the trinary key. Experimental evidence for the second moment indicates that the required transcript
length will in fact be much longer than this. For one perturbation, the attacker needs to recover the sixth
moment accurately, leading to required transcript lengths τ > 230 for all the recommended parameter setsin this paper.

11

NTRUSign security: summary

In this section we present a summary of the security measures for the parameter sets under consideration.
The security measures have the following meanings:
ωlk
c
ωcmb
ωfrg
γ
ωlf

The security against key recovery by lattice reduction
The lattice characteristic c that governs key recovery times
The security against key recovery by combinatorial means
The security against forgery by combinatorial means
The lattice characteristic γ that governs forgery times
The security against forgery by lattice reduction

The parameter sets in Table 8 were generated with ρ = 1.1 and selected to give the shortest possible
signing time σS .

PQCrypto 2006 Workshop Record

156

NTRUEncrypt and NTRUSign: efficient public key algorithms for a post-quantum world

Parameters
k N d qβN
80 157 29 256 0.38407 150.02
112 197 28 256 0.51492 206.91
128 223 32 256 0.65515 277.52
160 263 45 512 0.31583 276.53
192 313 50 512 0.40600 384.41
256 349 75 512 0.18543 368.62

Security Measuresωcmb cωlk ωfrg γ
ωlf log2 (τ )104.43 5.34 93.319 80 0.139 102.27 31.9
112.71 5.55 117.71 112 0.142 113.38 31.2
128.63 6.11 134.5 128 0.164 139.25 32.2
169.2 5.33 161.31 160 0.108 228.02 34.9
193.87 5.86 193.22 192 0.119 280.32 35.6
256.48 7.37 426.19 744 0.125 328.24 38.9

Table 8. Parameters and relevant security measures for trinary keys, one perturbation, ρ = 1.1, q = power of 2

12

Conclusions: the NTRU algorithms after quantum computers

At the moment it is unclear what effect quantum computers may have on the security of the NTRU algorithms. The paper [27] describes a quantum algorithm that square-roots asymptotic lattice reduction runningtimes for a specific lattice reduction algorithm. However, since in practice lattice reduction algorithms perform much better than they are theoretically predicted to, it is not clear what effect this improvement inasymptotic running times has on practical security. On the combinatorial side, Grover’s algorithm [9] provides
a means for square-rooting the time for a brute-force search. However, the combinatorial security of NTRU
keys depends on a meet-in-the-middle attack and we are not currently aware of any quantum algorithms to
speed this up.
At the moment it seems reasonable to speculate that quantum algorithms will be discovered that willsquare-root times for both lattice reduction and meet-in-the-middle searches. If this is the case, NTRU key
sizes will have to approximately double and running times will increase by a factor of approximately 4 togive the same security levels. As demonstrated in the performance tables in this paper, this still results inperformance that is competitive with public key algorithms that are in use today. As quantum computers
are seen to become more and more feasible, NTRUEncrypt and NTRUSign should be seriously studied witha view to wide deployment.

References
1. ANSI X9.62, Public Key Cryptography for the Financial Services Industry: The Elliptic Curve Digital Signature
Algorithm (ECDSA), 1999.
2. M. Bellare and P. Rogaway. Optimal asymmetric encryption. In Proc. of Eurocrypt ’94, volume 950 of LNCS,
pages 92–111. IACR, SpringerVerlag, 1995.
3. D. Boneh, Simplified OAEP for the RSA and Rabin functions, In proceedings of Crypto ’2001, Lecture Notes in
Computer Science, Vol. 2139, Springer-Verlag, pp. 275-291, 2001
4. M. Brown, D. Hankerson, J. López, and A. Menezes, Software Implementation of the NIST Elliptic Curves Over
Prime Fields, CT-RSA 2001, D. Naccache (Ed.), LNCS 2020, 250–265, Springer-Verlag, 2001.
5. Consortium for Efficient Embedded Security, Efficient Embedded Security Standard #1 version 2, available fromhttp://www.ceesstandards.org.
6. D. Coppersmith and A. Shamir, Lattice Attack on NTRU, Advances in Cryptology - Eurocrypt’97, SpringerVerlag
7. C. Gentry, Key recovery and message attacks on NTRU-composite, Advances in Cryptology —Eurocrypt ’01,
LNCS 2045. Springer-Verlag, 2001
8. C. Gentry, M Szydlo, Cryptanalysis of the Revised NTRU SignatureScheme, Advances in Cryptology—
Eurocrypt ’02, Lecture Notes in Computer Science, Springer-Verlag, 2002.
9. L. Grover, A fast quantum mechanical algorithm for database search, Proceedings, 28th Annual ACM Symposiumon the Theory of Computing, 1996.
10. D. Hankerson, J. Hernandez, A. Menezes, Software implementation of elliptic curve cryptography over binary
fields, Proceedings of CHES 2000, Lecture Notes in Computer Science, 1965 (2000), 1-24
11. J. Hoffstein, J. Pipher, J.H. Silverman, NTRU: A new high speed public key cryptosystem, in Algorithmic Number
Theory (ANTS III), Portland, OR, June 1998, Lecture Notes in Computer Science 1423 (J.P. Buhler, ed.),Springer-Verlag, Berlin, 1998, 267–288.

157

PQCrypto 2006 Workshop Record

Hoffstein, Howgrave-Graham, Pipher, Silverman, Whyte

12. J. Hoffstein and J. H. Silverman. Optimizations for NTRU. In Publickey Cryptography and Computational
Number Theory. DeGruyter, 2000. Available at [4].
13. J. Hoffstein and J. H. Silverman, Random Small Hamming Weight Products With Applications To Cryptography,
Discrete Applied Mathematics, to appear, Available from http://www.ntru.com.
14. J. Hoffstein and J. H. Silverman. Invertibility in truncated polynomial rings. Technical report, NTRU Cryptosystems, October 1998. Report #009, version 1, available at http://www.ntru.com.
15. J. Hoffstein, J. H. Silverman, W. Whyte, Estimated Breaking Times for NTRU Lattices, Technical report, NTRU
Cryptosystems, June 2003 Report #012, version 2, available at http://www.ntru.com.
16. N. A. Howgrave-Graham, P. Nguyen, D. Pointcheval, J. Proos, J. H. Silverman, A. Singer, W. Whyte, The
Impact of Decryption Failures on the Security of NTRU Encryption, Advances in Cryptology—Crypto 2003,
Lecture Notes in Compputer Science 2729, Springer-Verlag, 2003, 226-246.
17. N. A. Howgrave-Graham, J. H. Silverman, W. Whyte, A Meet-in-the-Middle Attack on an NTRU Private key,
Technical report, NTRU Cryptosystems, June 2003. Report #004, version 2, available at http://www.ntru.com.
18. N. Howgrave-Graham, J. H. Silverman, A. Singer and W. Whyte. NAEP: Provable Security in the Presence ofDecryption Failures IACR ePrint Archive, Report 2003-172, http://eprint.iacr.org/2003/172/
19. J. Hoffstein, N. Howgrave-Graham, J. Pipher, J. Silverman, W. Whyte, NTRUSign: Digital Signatures Using the
NTRU Lattice, CT-RSA 2003,
20. J. Hoffstein, N. Howgrave-Graham, J. Pipher, J. Silverman, W. Whyte, Performance Improvements and a Baseline Parameter Generation Algorithm for NTRUSign, Workshop on Mathematical Problems and Techniques in
Cryptology, Barcelona, Spain, June 2005
21. N. A. Howgrave-Graham, J. H. Silverman, W. Whyte, Choosing Parameter Sets for NTRUEncrypt with NAEP
and SVES-3, CT-RSA 2005, to appear.
22. B. Kaliski, Comments on SP 800-57, Recommendation for Key Management, Part 1: General Guidelines. Available
from http://csrc.nist.gov/CryptoToolkit/kms/CommentsSP800-57Part1.pdf.
23. E. Kiltz, J. Malone-Lee, A General Construction of IND-CCA2 Secure Public Key Encryption, In: Cryptography
and Coding, pages 152–166. Springer-Verlag, December 2003.
24. N. Koblitz. Elliptic curve cryptosystems. Mathematics of Computation, 48, pages 203–209, 1987.
25. A. K. Lenstra, E. R. Verheul, Selecting cryptographic key sizes, Journal of Cryptology vol. 14, no. 4, 2001, 255-293.
Available from http://www.cryptosavvy.com.
26. Kirill Levchenko, Chernoff Bound, available at http://www.cs.ucsd.edu/ klevchen/techniques/chernoff.pdf
27. C. Ludwig: A Faster Lattice Reduction Method Using Quantum Search, TU-Darmstadt Cryptography and Computeralgebra Technical Report No. TI-3/03, revised version published in Proc. of ISAAC 2003
28. A. May, J.H. Silverman, Dimension reduction methods for convolution modular lattices, in Cryptography and
Lattices Conference (CaLC 2001), J.H. Silverman (ed.), Lecture Notes in Computer Science 2146, SpringerVerlag, 2001
29. T. Meskanen and A. Renvall. Wrap Error Attack Against NTRUEncrypt. Proc. of WCC ’03.
30. V. Miller. Uses of elliptic curves in cryptography. In Advances in Cryptology: Crypto ’85, pages 417–426, 1985.
31. P. Nguyen, O. Regev Learning a Parallelepiped: Cryptanalysis of GGH and NTRU Signatures Eurocrypt 2006.
32. NIST, Digital Signature Standard, FIPS Publication 186-2, February 2000.
33. NIST Special Publication 800-57, Recommendation for Key Management, Part 1: General Guideline, January
2003. Available from http://csrc.nist.gov/CryptoToolkit/kms/guideline-1-Jan03.pdf.
34. J. Proos Imperfect Decryption and an Attack on the NTRU Encryption Scheme, IACR ePrint Archive, report
02/2003. http://eprint.iacr.org/2003/002/.
35. R. Rivest, A. Shamir, L. M. Adleman, A method for obtaining digital signatures and public-key cryptosystems,
Communications of the ACM, 21 (1978), 120-126.
36. J. H. Silverman, Invertibility in Truncated Polynomial Rings, Technical report, NTRU Cryptosystems, October
1998 Report #009, version 1, available at http://www.ntru.com.
37. P. Shor, Polynomial time algorithms for prime factorization and discrete logarithms on a quantum computer.
Preliminary version appeared in Proc. of 35th Annual Symp. on Foundations of Computer Science, Santa Fe,
NM, Nov 20-22, 1994. Final version published in SIAM J. Computing 26 (1997) 1484. Published in SIAM
J.Sci.Statist.Comput.26:1484,1997 e-Print Archive: quant-ph/9508027
38. Robert D. Silverman, A Cost-Based Security Analysis of Symmetric and Asymmetric Key Lengths. RSA Labs
Bulletin 13, April 2000. available from http://www.rsasecurity.com/rsalabs.

PQCrypto 2006 Workshop Record

158This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

This useless page in the online workshop record
corresponds to a copyright-restricted page in the printed workshop record.
Sorry!

Implementation of Improved“Quantum Public-Key Cryptosystem”
Toshiyuki Miyazawa, Tetsutaro Kobayashi, Satoshi Oda,
Ichizo Nakamura, and Atsushi Kanai
NTT Information Sharing Platform Laboratories
1-1 Hikari-no-oka, Yokosuka-shi, Kanagawa-ken, 239-0847 Japan
Email: miyazawa.toshiyuki@lab.ntt.co.jp
Tel: +81-468-59-2193
Fax: +81-468-59-3365

Abstract. In 2000, Okamoto, Tanaka, and Uchiyama proposed the concept of the “quantum public-key cryptosystem” and a concrete scheme called OTU2000 [15]. OTU2000 is
secure against attacks using quantum computers and uses these computers to generate akey pair. Thus, it is thought that OTU2000 will be actualized after quantum computers are
actualized. We improve the original OTU2000 scheme so that it can be executed using current computers and show implementation results, using the multiplicative group of the ringof integers modulo a 640-bit composite number. The key generation procedure requires lessthan 2 hours, the encryption procedure requires approximately 4.4 msec, and the decryption
procedure requires approximately 7.6 msec on a PC (Pentium 4 3.2 GHz). These results
show that the OTU2000 can be implemented using current computers.

1

Introduction

1.1

BackgroundIn 2000, Okamoto, Tanaka, and Uchiyama proposed the concept of the “quantum
public-key cryptosystem” [15]. The quantum public-key cryptosystem is a securepublic-key cryptosystem that deters attacks using quantum computers. In [15], theauthors also proposed the concrete scheme (OTU2000) that satisﬁes the requirements for the quantum public-key cryptosystem. This scheme is a knapsack-based
cryptosystem that overcomes the weak points of previous schemes, e.g., the ChorRivest scheme [4] and Merkle-Hellman scheme [10]. The subset sum problem, uponwhich knapsack-based cryptosystems are based, is an NP-complete problem. Since
no eﬃcient quantum algorithm solving NP-complete problems is known, OTU2000
is secure against attacks using quantum computers.
OTU2000 also uses quantum computers to generate a key pair. The key generation procedure of this scheme includes solving the discrete logarithm problem(DLP) in a ﬁnite ﬁeld, and Shor’s algorithm [23] can solve the DLP using quantum
computers. Thus, it is thought that the OTU2000 will be actualized after quantum
computers are actualized.
1.2

Related WorkThe DLP over a small ﬁnite ﬁeld can be solved using classical computers. Recently,
techniques to solve the DLP have improved. The fastest method to solve the DLP
181

PQCrypto 2006 Workshop Record

Miyazawa, Kobayashi, Oda, Nakamura, Kanai

is the number ﬁeld sieve method [20]. Currently, the world record for solving the
DLP is held by Joux and Lercier, and they solved the DLP over a 130-digit primeﬁnite ﬁeld using the number ﬁeld sieve method [7]. This requires approximately
3 weeks. Another technique for solving the DLP is Pollard’s method [17] and the√baby-step/giant-step method [18], which requires O( q) time, where q is the orderof the cyclic group.
We use these methods to generate the key for OTU2000 instead of using quantum
computers.
1.3

Our Results

We improve the original OTU2000 scheme so that it can be executed using current computers and without quantum computers. In [15], quantum computers are
employed only to solve the DLP over a ﬁnite ﬁeld and the other computations are
executable by current computers. The proposed concept is to employ the ring ofintegers modulo a composite number, instead of the ﬁnite ﬁeld.
We also implemented the proposed scheme, using N as a composite number of 640
bits and N = q1 q2 q3 q4 q5 , where qi is a random prime of 128 bits. As a result, the key
generation procedure requires less than 2 hours, the encryption procedure requires
approximately 4.4 msec, and the decryption procedure requires approximately 7.6
msec on a Pentium 4 3.2-GHz PC. This result shows that our scheme is executableon current computers.
Roadmap This paper is organized as follows. We improve the original scheme of
OTU2000 so that it can be easily executed on current computers. The improved
scheme is described in Section 2. Next, we discuss the security of the improved
scheme in Section 3. In Section 4, we present the selection of parameters and theexecution data.

2

Improved Version of OTU2000

Our improved scheme is based on the rational version of OTU2000 in Appendix Aof [15]. In the original scheme the key generation algorithm must solve the DLP ina ﬁnite ﬁeld. Thus, quantum computers are used to generate a key pair.
Here, we improve the original scheme by replacing the ﬁnite ﬁeld with the ringof integers modulo a composite number. Details are given below:
Key Generation
Input : Positive integers n,h
Output : Secret key SK = (g, d, N, p1, ..., pn , k) and public key P K = (n, k, b1 , ..., bn )PQCrypto 2006 Workshop Record

182

Implementation of “Improved Quantum Public-Key Cryptosystem”

Step 1. Randomly select h primes q1 , ..., qh , that satisfy the following conditions:(a) The length of qj is nh bits for j = 1, ..., h.
(b) The greatest common number of qj1 − 1 and qj2 − 1 is 2 for 1 ≤ j1 <j2 ≤ h.

Step 2. Compute N = hj=1 qj .
Step 3. Compute L = 2−h+1 hj=1 (qj − 1), that is the largest common multiple of{qj − 1 : j = 1, ..., h}.
Step 4. Randomly select generator gj ∈ (Z/qj Z)× for j = 1, ..., h.
Step 5. Compute g ∈ (Z/NZ)× such that g ≡ gj (mod qj ) for any 1 ≤ j ≤ husing the Chinese remainder theorem.
Step 6. Choose n integers p1 , ..., pn , that satisfy the following conditions:– 
p1 , ...,pn are co-prime.
 p 
pi
i
= ... =
for i = 1, ..., n.
–q1
qhStep 7. Compute discrete logarithms ai,j such thatpi ≡ g ai,j(mod qj ),where i = 1, ..., n and j = 1, ..., h.
Step 8. Compute ai ∈ Z/LZ for i = 1, ..., n such thatai ≡ ai,j(mod qj − 1)for j = 1, ..., h (by using a variant of the Chinese remainder theorem).
Step 9. Randomly select d ∈ Z/LZ.
Step 10. Compute bi = ai + d mod L for each 1 ≤ i ≤ n.
Step 11. Compute integer k such that for any subset {pi1 , ..., pik } ⊂ {p1 , ..., pn },kpis < N.

s=1

Step 12. Output secret key SK = (g, d, N, p1, ..., pn , k) and public key P K =(n, k, b1 , ..., bn ).
We note that the choice of pi is restricted. Since N is a composite number, themultiplicative group (Z/NZ)× is not cyclic. Hence, it is not true that pi ∈ g forany pi ∈ (Z/NZ)× . To overcome this problem, we select modulus N whose factor
satisﬁes the condition in Step 1 and the generator g ∈ (Z/NZ)× in Step 4. If suchan N and g are employed, the following proposition can be proved:
Proposition 1. Let N = q1 · · · qh , g ∈ (Z/NZ)× and gj ∈ (Z/qj Z)× (1 ≤ j ≤ h) be
as above. Then the natural homomorphism
f : g −→h(Z/qj Z)×j=1

f (g x ) = (g x mod q1 , g x mod q2 , ..., g x mod qh )183

PQCrypto 2006 Workshop Record

Miyazawa, Kobayashi, Oda, Nakamura, Kanai

is injective andαIm(f ) = {(gj j mod qj )1≤j≤h ; αj1 ≡ αj2(mod 2) for any 1 ≤ j1 < j2 ≤ h}.

Proof. The injectivity of f is trivial from Chinese remainder theorem. Let S =α{(gj j mod qj )1≤j≤h ; αj1 ≡ αj2 (mod 2) for any 1 ≤ j1 < j2 ≤ h}. Since S ⊃ Im(f ),we will show S ⊂ Im(f ).
αLet (gj j mod qj )1≤j≤h ∈ S. From the condition of qj ’s, qj − 1 is equal to 2rj forsome rj ∈ Z such that gcd(rj1 , rj2 ) = 1 for any 1 ≤ j1 < j2 ≤ h. Then x ∈ Z can befound such that it satisﬁes the congruent equationsx ≡ α1x ≡ α1x ≡ α2..
.

(mod 2)(mod r1 )(mod r2 )x ≡ αh(mod rh )αusing the Chinese remainder theorem. We can see that f (g x ) = (gj j mod qj )1≤j≤h ;hence, S ⊂ Im(f ). 
Because of Proposition 1, f : g → S is an isomorphism. Then, instead ofchecking whether pi ∈ g, we can check the following condition:
aj1 ≡ aj2

(mod 2) (1 ≤ j1 < j2 ≤ h), where pi ≡ g ajt(mod qjt ).

This condition is checked in Step 6 of the key generation algorithm.
The encryption and decryption algorithms are the same as the original version
in OTU2000.
Encryption 
Input : Public key P K and plaintext M with log2 nk bits.
Output : Ciphertext C
Step 1. Encode M into binary string m = (m1 , ..., mn ) of length n and Hamming
weight k (i.e., having exactly k 1’s) as follows:(a) Set l ← k(b) For i from 1 to n perform the following: 
If M ≥ n−ithen set mi ← 1, M ← M − n−i, l ← l − 1.
l
l

l
Otherwise set mi ← 0.(Note that 0 = 1 for l ≥ 0, and 0l = 0
for l ≥ 1.)

Step 2. Compute ciphertext C as C = ni=1 mi bi
Decryption
Input : Secret key SK and ciphertext C
Output : Plaintext M

PQCrypto 2006 Workshop Record

184Implementation of “Improved Quantum Public-Key Cryptosystem”

Step 1. Compute r = C − kd.
Step 2. Compute u = g r mod N.
Step 3. For i from 1 to n perform the following:If pi |u, then set mi ← 1, otherwise set mi ← 0.
Step 4. Set m = (m1 , ..., mn ).
Step 5. Decode m into plaintext M as follows:(a) Set M ← 0, l ← k.
(b) For i from 1 to n perform the following: 
If mi = 1, then set M ← M + n−i
and l ← l − 1.
lCorrectness and remarks
1. [Decryption] We show that the decryption works. We observe thatu ≡ g r (mod N)≡ g C−kd (mod N)n≡ g ( i=1 mi bi )−kd (mod N)
n≡ g i=1 mi ai (mod N)n(g ai )mi (mod N)
≡
i=1

≡

n


i
pm
i

(mod N)

i=1

=

n


i
pm
i .

i=1

Since the product of any
among {p1 , · · · , pn } is less than N andn k elementsmip1 , · · · , pn are co-prime, i=1 pi (mod N) is uniquely factorized by {p1 , · · · , pn }.
Thus, a ciphertext is uniquely deciphered to m (i.e., M).
2. [Density] Since bi ∈ [0, L] and L  2−h+1 N, the bit length of bi is slightly lessnof our scheme is slightly greater than
than n. Hence, density [8] d = log max
bi
2
one.

3

Security Consideration

In this section, we discuss the security parameters for the proposed scheme.
3.1

Solving Knapsack

Since the security of OTU2000 depends on the subset sum problem, we should use
parameters such that the knapsack becomes suﬃciently diﬃcult to solve.
185

PQCrypto 2006 Workshop Record

Miyazawa, Kobayashi, Oda, Nakamura, Kanai

Meet-in-the-Middle
Attacks The obviousn
n meet-in-the-middle attack computes
two lists of k/2 : namely L1 the list of all i=1 bi xi where x = (x1 , ..., xn ) has theHamming weight of k/2, and L2 the list of all c − ni=1 bi xi where x = (x1 , ..., xn )has the Hamming weight of k/2. Then the attack determines the intersection of L1and L2 , since collisions between n  L1 and L2 clearly disclose the knapsack solutions.
.
The cost is approximately k/2
There is however a more eﬃcient meet-in-the-middle attack. This attack is performed by adapting Coppersmith’s meet-in-the-middle attack for solving a discrete
log√with a low Hamming weight exponent (see [19]).
n/2Roughly speaking, we apply aO( k) meet-in-the-middle attack at the cost of k/2 .
1. Select a random subset B⊂ {1, ..., n} of size n/2.
2. Let L1 be the list of all ni=1 bi xi where x =1 , ..., xn ) ∈ B has the Hamming
(xnweight of k/2, and L2 be the list of all c − i=1 bi xi where x = (x1 , ..., xn ) ∈ B
has the Hamming weight of k/2.
3. Find collisions between L1 and L2 .
4. If there are no collisions, restart at the beginning.
√
In [19], it was shown that the number of iterations to ﬁnd a collision is O( k). Thisis related to the probability of exactly splitting the k-element subset deﬁning thesolution of the knapsack √problemn/2 when selecting B. The overall cost (up to somelogarithmic factor) is O( k) k/2 . Thus, parameters n and k must be selected in
√  
n
and k n/2
are both suﬃciently large.
such a way that k/2
k/2
Lattice Attack Recently Nguy˜ên and Stern showed eﬃcient provable reductions
from the knapsack problem with a low Hamming weight to the lattice problems: theshortest vector problem (SVP) and the closest vector problem (CVP) [13]. Thesestudies indicate that OTU2000 can be attacked by the CVP/SVP-oracle.
However, the “ideal” CVP/SVP-oracle does not exist that can solve the SVP/CVP
in a polynomial time because these problems are NP-hard [1, 2]. There exist only
lattice reduction algorithms, for example LLL [9] and BKZ [21], that perform as
an approximate SVP/CVP-oracle. If a dimension of the lattice is suﬃciently large,
these algorithms cannot solve exactly SVP/CVP in practice.
Today, the world record for the largest lattice dimension solved is the 350dimensional GGH decryption challenge [11]. In the case of a lattice constructedfrom a knapsack-type cryptosystem, Schnorr and Hörner failed to decrypt the ChorRivest ciphertext that corresponds to a lattice dimension of around 200-250 [22].
The smallest parameter for the NTRU cryptosystem, whose security is based on lattice problems, corresponds to a 502-dimensional lattice. According to these results,
in order to avoid a lattice attack using reduction algorithms, the proposed scheme
is suﬃciently secure if the lattice dimension becomes 500 or more.
Moreover, if the density is close to one, a lattice attack using reduction algorithms
is more diﬃcult in practice [22]. The density of our scheme is slightly greater thanone. Thus, a lattice attack against our scheme using reduction algorithms cannot beeasy.
PQCrypto 2006 Workshop Record

186

Implementation of “Improved Quantum Public-Key Cryptosystem”

3.2

Key Exposure Attack
Nguy˜ên and Stern showed that if N is composite and one of qj can be guessed, there
is a possibility that the whole secret key can be recovered [12]. Here, we show theoutline of a possible attack.
1. Recovering pi ’s
For any tuple (pi , pj , pl ),b −bj bi −bj
b −b b −b
pj≡ pl i j pj l jpi l(mod qj ).

Because pj  N 1/k , a tuple (pi , pj , pl ) can be found by exhaustive search. Oncesuch a tuple (pi , pj , pl ) has been found, other pi ’s can be found easily.
2. Recovering N
If all pi are known, N can be found using the following procedure:(a) Compute (ε2 , ..., εn ) ∈ Zn−1 satisfying the linear equationmεi (bi − b1 ) = 0

i=2

using a lattice reduction algorithm.
(b) Let A and B ⊂ {2, ..., n} be A = {i : 2 ≤ i ≤ n & εi > 0} and B = {i : 2 ≤i ≤ n & εi < 0}.
(c) Since
i∈B −εi  ε i∈A εi

−εi
pi p1
≡
pi i p1(mod N),i∈B

i∈A

subtracting the left side of the congruence from the right side, the multipleof N can be found.
(d) Given two such (ε2 , ..., εn ), N can be found using the gcd computation.
3. Recovering g
If N and two of the pi ’s are known, g can be found using the following procedure:(a) Factor N = q1 · · · qh . 1(b) Compute gj ∈ (Z/qj Z)× such thatb −bi2i1
pi1 p−1i2 ≡ gj(mod qj )for each j (1 ≤ j ≤ h).
(c) Compute g ∈ (Z/NZ)× such thatg ≡ gj(mod qj ) for all j (1 ≤ j ≤ h)using the Chinese reminder theorem.
4. Recovering d
If N, g, and one of pi ’s are known, g d can be found from g d ≡ g bi /pi (mod N). For
decryption, d is not necessary because instead of computing u ≡ g C−kd (mod N),u ≡ g C /(g d)k (mod N) can be computed, and the rest of the decryption process
can be applied.
According to the above consideration, if one of qj is guessed, the proposed scheme
can be solved. Thus, all qj should be suﬃciently large.
1

It would be an appropriate assumption in the “post-quantum” age.

187

PQCrypto 2006 Workshop Record

Miyazawa, Kobayashi, Oda, Nakamura, Kanai

4

Implemented Data

In this section, we show the performance of the improved scheme.
4.1

Parameter Selection

We set n = 640 and h = 5, i.e., |qj | = 128. To maximize the Hamming weight, k, we
select pi such that pi are the smallest n primes that satisfy the condition in Step 6of the key generation algorithm. Then,equal to 38.
cost of√ The computational
n/2 k is164.38
n/2
103.15the meet-in-the-middle attack is k  2
and k k/2  2. The latticedimension of this parameter is nearly equal to 640 (see [22, 13]), i.e., greater than500. Thus, n = 640 is considered to be secure against a lattice attack.
The number of 128 bit primes is approximately equal to 283.87 . Then |qj | = 128
is considered to be secure against a key exposure attack.
The Bit Length of Each Parameter In the case of n = 640, h = 5, and k = 38,
the length of each parameter is given in Table 1.
parameters length (bits)
Plaintext204
Cipertext
641
Public Key 407,056
Secret Key
12,802
Table 1. Bit Length of Each Parameter (n = 640, k = 38, h = 5)

4.2

Performance of Our Scheme

Using Smooth Numbers In order to generate a key pair more easily, we selectqj such that qj − 1 is 240 -smooth for each j = 1, ..., 5. We implemented the proposed
scheme in the environment described below.
– Language ... GP/PARI Calculator Version 2.2.9 [16]– OS ... Windows XP– CPU ... Pentium 4, 3.2 GHz– Memory ... 2 GB
The GP/PARI calculator uses the baby-step/giant-step method to solve the DLP.
The average cost and best/worst cost of each procedure is shown in Table 2.
In our trial, we randomly selected N = q1 q2 q3 q4 q5 satisfying the condition in Step1of the key generation algorithm. We tried the key generation 10 times, and theencryption and the decryption 10,000 times.
PQCrypto 2006 Workshop Record

188Implementation of “Improved Quantum Public-Key Cryptosystem”

AverageBest
Worst
Key Generation 116 minutes 67 minutes 280 minutes
Encryption
4.4 ms––Decryption
7.6 ms––Table 2. Performance of Proposed Scheme (n = 640, h = 5)

Using Number Field Sieve The fastest method for solving the DLP is the number
ﬁeld sieve [20]. The current world record for solving the DLP in a 130-digit prime
ﬁeld is held by Joux and Lercier using the number ﬁeld sieve method [7]. It takes
about 3 weeks.
To generate a key pair, we need only calculate the DLP in a 128-bit prime.
Even if qj − 1 is not smooth, it easy enough to solve the DLP for the proposed key
generation algorithm.
Comparison with RSA and elliptic curve cryptosystem We compare theperformance of our scheme with that of RSA and ECC. We implemented the primitives of the RSA and ElGamal elliptic curve cryptosystem (EC-ElGamal) in theenvironment described above. The average of each procedure is shown in Table 3.
In our trial, we tried the encryption and the decryption 10,000 times. We use
the RSA of a 1024 bit modulus and the exponent e = 65537 of a public key. The
parameters of the EC-ElGamal are secp160k1 of a 160 bit prime ﬁeld in [24].
Proposed Scheme 1024-bit RSA 160-bit EC-ElGamal
Encryption
4.4 ms0.3 ms
5.7 msDecryption
7.6 ms27.1 ms
2.9 msTable 3. Performance Comparison of Proposed Scheme, RSA, and ECC

The performances of encryption and decryption of proposed scheme is not different from RSA and ECC.

5

Conversions to Stronger Security

In the previous sections, we proposed a trapdoor one-way function, or a primitive
functionality of a public-key encryption. It is easy to convert practically such aprimitive public-key function to a public-key encryption scheme with the strongest
security (non-malleable against adaptively chosen ciphertext attacks) in the random oracle model. For example, some generic and eﬃcient conversions have been
proposed, e.g., Fujisaki-Okamoto [6].
189

PQCrypto 2006 Workshop Record

Miyazawa, Kobayashi, Oda, Nakamura, Kanai

6

Concluding Remarks

This paper presented a new approach to achieve a public-key cryptosystem based ona knapsack (subset-sum) problem that is secure even after the quantum computeris actualized. This new approach employed the ring of integers modulo a composite number Z/NZ that provides us with a huge degree of freedom for choosing
trapdoor parameters and enables key generation without quantum computers. We
implemented the proposed scheme and showed that the key-generation procedure requires less than 2 hours, the encryption procedure requires approximately 4.4 msec,
and the decryption procedure requires approximately 7.6 msec on a common PC.
These results show that our scheme can be executed on current computers.
Finally, we note that our approach can be applied to the number ﬁeld case of
OTU2000.
Acknowledgement
The authors thank Dr. Phong Q. Nguy˜ên and Dr. Jacques Stern for their helpful comments concerning the security of our scheme. We also thank Dr. Tatsuaki
Okamoto for suggesting the improved scheme.

References
1. M. Ajtai. “The shortest vector problem in L2 is NP-hard for randomized reductions,” in Proc. of 30th
STOC. ACM (1998).
2. P. van Emde Boas. “Another NP-complete problem and the complexity of computing short vectors ina lattice,” Technical report, Mathematische Instituut, University of Amsterdam, Report 81-04 (1981).
3. M. Bellare and P. Rogaway,“Optimal Asymmetric Encryption,” Proc. of Eurocrypt’94, LNCS 950,
Springer-Verlag pp. 92-111 (1995).
4. B. Chor and R.L. Rivest “A knapsack-type public key cryptosystem based on arithmetic in ﬁnite ﬁelds,”
IEEE Trans. on Information Theory-34, pp. 901-909 (1988)
5. M.J. Coster, A. Joux, B.A. LaMacchia, A.M. Odlyzko, C.P. Schnorr, and J. Stern. “Improved lowdensity subset sum algorithms,” Computational Complexity, 2, pp. 111-128 (1992)
6. E. Fujisaki and T. Okamoto,“Secure Integration of Asymmetric and Symmetric Encryption Schemes,”
Proc. of Crypto’99, Springer-Verlag, LNCS 1666, pp. 535–554 (1999).
7. A. Joux and R. Lercier. “Discrete logarithms in GF(p) --- 130 digits,” 18 Jun 2005. NMBRTHRY Mailing List. Available at http://listserv.nodak.edu/cgi-bin/wa.exe?A2=ind0506&L=
nmbrthry&F=&S=&P=2037
8. J.C. Lagarias and A.M. Odlyzko. “Solving low-density subset sum problems,” Journal of the Association
for Computing Machinery, 32, pp. 229-246 (1985)
9. A.K. Lenstra, H.W. Lenstra, and L. Lovász. “Factoring polynomials with rational coeﬃcients,” Mathematische Annalen 261, 515-534 (1982)
10. R.C. Merkle and M. Hellman. “New directions in cryptography,” IEEE Trans. on Information Theory19, pp. 525-530 (1973)
11. P.Q. Nguy˜ên, “Cryptoanalysis of the Goldreich-Goldwasser-Halevi cryptosystem from Crypto ’97,”
Proc. of Asiacrypt ’99, LNCS 1666, pp. 288-304, Springer-Verlag (1999).
12. P.Q. Nguy˜ên and J. Stern, private communication (2005-2006).
13. P.Q. Nguy˜ên and J. Stern “Adapting Density Attacks to Low-Weight Knapsacks,” Proc. of Asiacrypt
2005, LNCS 3788, pp. 41-58, Springer-Verlag (2005).
14. T.Okamoto and D.Pointcheval, “REACT : Rapid Enhanced-security Asymmetric Cryptosystem Transform”, In CT-RSA’01, LNCS 2020, pp.159-175, Springer-Verlag,Berlin (2001).
15. T. Okamoto, K. Tanaka, and S. Uchiyama.“Quantum Public Key Cryptosystems,” Proc. of CRYTPTO
2000, LNCS 1880, pp. 147-165, Springer-Verlag (2000).
16. PARI/GP, version 2.1.7, Bordeaux, 2005, http://pari.math.u-bordeaux.fr/.

PQCrypto 2006 Workshop Record

190

Implementation of “Improved Quantum Public-Key Cryptosystem”

17. J. Pollard. “Monte Carlo methods for index computation for index computations mod p,” Math.
Comp., 32, pp. 918-924 (1978).
18. D. Shanks. “Class number, a theory of factorization and genera,” In Proc. Symp. Pure Math. 20(1971),
AMS, Providence, R.I., pp. 415-440, 1971.
19. D.R. Stinson. “Some baby-step giant-step algorithms for the low Hamming weight discrete logarithm
problem,” Mathematics of Computation, 71 (2002), pp. 379-391.
20. O. Schirokauer. “Discrete logarithms and local units, ” Phil. Trans. R. Soc. Lond. A 345 (1993).
21. C.P. Schnorr and M. Euchner, “Lattice Basis Reduction: Improved Practical Algorithms and Solving
Subset Sum Problems,” Mathematical Programming, Vol. 66, pp. 181-191 (1994)
22. C. Schnorr and H. Hörner, “Attacking the Chor-Rivest Cryptosystem by Improved Lattice Reduction,”
Advances in Cryptology - Eurocrypt ’95 LNCS, Vol. 921, pp. 1-12, (1995)
23. P.W. Shor, “Algorithms for quantum computation: Discrete logarithms and factoring,” Proc. 35nd
Annual Symposium on Foundations of Computer Science (Shaﬁ Goldwasser, ed.), IEEE Computer
Society Press (1994), 124-134.
24. Standards for Eﬃcient Cryptography Group, “SEC 2: Recommended Elliptic Curve Domain Parameters”, http://www.secg.org/download/aid-386/sec2_final.pdf (2000)

191

PQCrypto 2006 Workshop Record

Post-quantum code-based cryptography
Nicolas Sendrier
Institut National de Recherche en Informatique et en Automatique193

PQCrypto 2006 Workshop RecordEquivalent Keys in Multivariate Quadratic Public Key Systems
Christopher Wolf1,2 , and Bart Preneel1
1

K.U.Leuven, ESAT-COSIC
Kasteelpark Arenberg 10, B-3001 Leuven-Heverlee, Belgium{Christopher.Wolf, Bart.Preneel}@esat.kuleuven.beor chris@Christopher-Wolf.de
http://www.esat.kuleuven.ac.be/cosic/2

École Normale Supérieure, Département d’Informatique
45 rue d’Ulm, F-75230 Paris Cedex 05, France
Christopher.Wolf@ens.fr or chris@Christopher-Wolf.de
Abstract
Multivariate Quadratic public key schemes have been suggested back in 1985 by Matsumoto andImai as an alternative for the RSA scheme. Since then, several other schemes have been proposed,
for example Hidden Field Equations, Unbalanced Oil and Vinegar schemes, and Stepwise Triangular
Schemes. All these schemes have a rather large key space for a secure choice of parameters. Surprisingly,
the question of equivalent keys has not been discussed in the open literature until recently. In this article,
we show that for all basic classes mentioned above, it is possible to reduce the private — and hence thepublic — key space by several orders of magnitude. For the Matsumoto-Imai scheme, we are even able
to show that the reductions we found are the only ones possible, i.e., that these reductions are tight.
While the theorems developed in this article are of independent interest themselves as they broaden our
understanding of Multivariate Quadratic public key systems, we see applications of our results both incryptanalysis and in memory efficient implementations of MQ-schemes.

Keywords: Multivariate Quadratic Polynomials, Public Key signature, Hidden Field Equations, MatsumotoImai scheme A, C∗ , Unbalanced Oil and Vinegar, Stepwise Triangular Systems

1

Initial Considerations

In the last 20 years, several schemes based on the problem of Multivariate Quadratic equations (or MQ
for short) have been proposed. The most important ones certainly are MIA / C ∗ [MI88] and Hidden Field
Equations (HFE, [Pat96b]) plus their variations MIA- / C∗−− , HFE-, HFEv, and HFEv- [KPG99, Pat96a,
Pat96b]. Both classes have been used to construct signature schemes for the European cryptography
project NESSIE [NES], namely the MIA- variation in Sflash [CGP03], the HFEv- variation in Quartz[CGP01] and the HFE- variation in the tweaked version Quartz-7m [WP04]. Unbalanced Oil and Vinegar
schemes [KPG99] and Stepwise Triangular Schemes [WBP04] are also important in practice. While thefirst is secure with the correct choice of parameters, the second forms the basis of nested constructions likethe enhanced TTM [YC04], Tractable Rational Maps [WHL+ 05], or Rainbow [DS05].
The aim of this paper is to systematically study the question of equivalent keys of MQ-schemes. At
first glance, this question seems to be purely theoretical. But for practical applications, we need memory
and time efficient instances of Multivariate Quadratic public key systems. One important point in thiscontext is the overall size of the private key: in restricted environments such as smart cards, we want it
as small as possible. Hence, if we can show that a given private key is only a representative of a muchlarger class of equivalent private keys, it makes sense to compute (and store) only a normal form of thiskey. Similar, we should construct new Multivariate Quadratic schemes such that they do not have a large
number of equivalent private keys but only a small number, preferable only one, per equivalence class. Thisway, we make optimal use of the randomness in the private key space and neither waste computation time
nor storage space without any security benefit.
All systems based on MQ-equations use a public key of the formpi (x1 , . . . , xn ) :=X

γi,j,k xj xk +1≤j≤k≤n195

n
X

βi,j xj + αi ,j=1

PQCrypto 2006 Workshop Record

Wolf, Preneel

with n ∈ Z+ variables and m ∈ Z+ equations. Moreover, we have 1 ≤ i ≤ m; 1 ≤ j ≤ k ≤ n and
αi , βi,j , γi,j,k ∈ F (constant, linear, and quadratic terms). We write the set of all such systems of polynomials
as MQ(Fn , Fm ). Moreover, the private key consists of the triple (S, P 0 , T ) where S ∈ Aff−1 (Fn ), T ∈Aff−1 (Fm ) are bijective affine transformations. Details on affine transformation are given in Section 2.1).
Moreover, we have P 0 ∈ MQ(Fn , Fm ) is a polynomial-vector P 0 := (p01 , . . . , p0m ) with m components; eachcomponent is a polynomial in n variables x01 , . . . , x0n . Throughout this paper, we will denote componentsof this private vector P 0 by a prime 0 . In contrast to the public polynomial vector P ∈ MQ(Fn , Fm ),0.
the private polynomial vector P 0 does allow an efficient computation of x01 , . . . , x0n for given y10 , . . . , ym
Still, the goal of MQ-schemes is that this inversion should be hard if the public key P alone is given.
The main difference between MQ-schemes lies in their special construction of the central equations P 0
and consequently the trapdoor they embed into a specific class of MQ-problems. An introduction toMultivariate Quadratic public key systems is given in [WP05c].

1.1

Related WorkIn their cryptanalysis of HFE, Kipnis and Shamir report the existence of “isomorphic keys” [KS99]. A
similar observation for Unbalanced Oil and Vinegar Schemes can be found in [KPG99]. In both cases,
there has not been a systematic study of the structure of equivalent key classes. In addition, Patarin
observed the existence of some equivalent keys for MIA / C∗ [Pat96a] — however, his method is different
from the one presented in this article, as he concentrated on modifying the central monomial rather thanusing special affine transformations. Moreover, Toli observed that there exists an additive sustainer inthe case of Hidden Field Equations [Tol03] but did not extend his result to other Multivariate Quadratic
schemes. Additive sustainers will be introduced in Section 3.1. In the case of symmetric ciphers, [BCBP03]
used a similar idea in the study of S-boxes. A different angle of the idea of equivalent keys can be found in[HWyCL05] where the authors compute normal forms of the public key. Main reason here is to save somememory in the public but particularily in the private key. Using the techniques suggested in [HWyCL05],
the latter can be reduced by up to 50%.
This article is based on the two conference papers [WP05b, WP05a] which deal with the classes MIA,
HFE, and UOV. In this article, the proofs have been simplified and also extended to the STS class. In
addition, a tightness proof for the case of MIA is given.

1.2

OutlineThis paper is organized as follows: after this general introduction, we move on to the necessary mathematicalbackground in Section 2. This includes particularly a definition of the term equivalent keys. In Section 3,
we concentrate on a subclass of affine transformations, denoted sustaining transformations, which can beused to generate equivalent keys. These transformations are applied to different variations of Multivariate
Quadratic equations in Section 4. In Section 5, we give a tightness proof for the case of MIA/MIO. This
paper concludes with Section 6.

2

Mathematical Considerations

Before discussing concrete schemes, we start with some general observations and definitions. Obviously,
the most important term in this article is “equivalent private keys”. We give a graphical representation ofthis idea in Figure 1. We can also express this idea in the following definition:
Definition 2.1 We call two private keys
(S, P 0 , T ), (S̃, P̃ 0 , T̃ ) ∈ Aff−1 (Fn ) × MQ(Fn , Fm ) × Aff−1 (Fm )“equivalent” if they lead to the same public key, i.e., if we haveT ◦ P 0 ◦ S = P = T̃ ◦ P̃ 0 ◦ S̃ .

PQCrypto 2006 Workshop Record

196

Equivalent keys in multivariate quadratic public key systems

input x?
x = (x1 , . . . , xn )private: S

σ −1 ◦ S?
x0

private: P 0

τ ◦ P0 ◦ σ?
y0public:(p1 , . . . , pn )T ◦ τ −1?
output y ¾

private: T

Fig. 1: Equivalent private keys using affine transformations σ, τIn the above definition, Aff−1 (·) denotes the class of bijective affine transformations. We give more details on affine transformations in Section 2.1. In order to find equivalent keys, we consider the following
transformations:Definition 2.2 Let (S, P 0 , T ) ∈ Aff−1 (Fn ) × MQ(Fn , Fm ) × Aff−1 (Fm ), and consider the four transformations σ, σ −1 ∈ Aff−1 (Fn ) and τ, τ −1 ∈ Aff−1 (Fm ). Moreover, let
P = T ◦ τ −1 ◦ τ ◦ P 0 ◦ σ ◦ σ −1 ◦ S .

(1)

We call the pair (σ, τ ) ∈ Aff−1 (Fn ) × Aff−1 (Fm ) “sustaining transformations” for an MQ-system if the“shape” of P 0 is invariant under the transformations σ and τ . For short, we write (σ, τ ) • (S, P 0 , T ) for(2.2) and (σ, τ ) sustaining transformations. This idea has already been outlined in Figure 1.
Remark. In the above definition, the meaning of “shape” is still open. In fact, its meaning has to be
defined for each MQ-system individually. For example, in HFE (cf Section 4.1), it is the bounding degreed ∈ Z+ of the polynomial P 0 (X 0 ) ∈ E[X 0 ]. In the case of MIA, the “shape” is the fact that we have asingle monomial with factor 1 as the central equation (cf Section 4.2). In general and for σ, τ sustaining
transformations, we are now able to produce equivalent keys for a given private key by (σ, τ ) • (S, P 0 , T ).
A trivial example of sustaining transformations is the identity transformation, i.e., to set σ = τ = id.
Lemma 2.3 Let σ ∈ Aff−1 (Fn ), τ ∈ Aff−1 (Fm ) be sustaining transformations. If the two structures G :=(σ, ◦) and H := (τ, ◦) form a subgroup of the affine transformations, they produce equivalence relations
within the private key space.
Proof. We start with a proof of this statement for G := (σ, ◦). First, we have reflexivity as the identity
transformation is contained in the subgroup G. Second, we also have symmetry as subgroups are closed
under inversion. Third, we have transitivity as subgroups are closed under composition. Therefore, thesubgroup G partitions the private key space into equivalence classes. The proof for the subgroup H := (τ, ◦)is analogous.
¤
Remark. We want to point out that the above proof does not use special properties of sustaining transformations, but the fact that we dealt with subgroups of the group of affine transformations. Hence, the proof
does not depend on the term “shape” and is therefore valid even if the latter is not rigorously defined yet. In
any case, instead of proving that sustaining transformations form a subgroup of the affine transformations,
we can also consider normal forms of private keys. As we see below, normal forms have some advantages
to avoid double counts in the private key space.

197

PQCrypto 2006 Workshop Record

Wolf, Preneel

2.1

Affine Transformations

Given that our main tool to construct equivalent keys are special subclasses of affine transformations, westart with some general observations on them. As we only deal with bijective affine transformations Aff −1 (·)
and bijective linear transformations Hom−1 (·) in this article, the following lemma proves useful:Qn−1
Lemma 2.4 Let F be a finite field with q := |F| elements. Then we have i=0 q n − q i invertible (n × n)matrices over F.
Next, we recall some basic properties of affine transformations over the finite fields F and E.
Definition 2.5 Let MS ∈ Fn×n be an invertible (n × n) matrix and vs ∈ Fn a vector and let S(x) :=MS x + vs . We call this the “matrix representation” of the affine transformation S.
Definition 2.6 Moreover, let s1 , . . . , sn be n polynomials of degree 1 at most over F, i.e., si (x1 , . . . , xn ) :=βi,1 x1 + . . . + βi,n xn + αi with 1 ≤ i, j ≤ n and αi , βi,j ∈ F. Let S(x) := (s1 (x), . . . , sn (x)) for x :=(x1 , . . . , xn ) as a vector over Fn . We call this the “multivariate representation” of the affine transformation
S.
Remark. The multivariate and the matrix representation of an affine transformation S are interchangeable.
We only need to set the corresponding coefficients to the same values: (MS )i,j ↔ βi,j and (vS )i ↔ αi for1 ≤ i, j ≤ n. However, the first is useful in the context of matrix equations while the latter is preferable
when dealing with affine transformations in the context of term substitution.
In addition, we can also use the “univariate representation” over the extension field E of the transformation S.
Pn−1
i
Definition 2.7 Let 0 ≤ i < n and A, Bi ∈ E. Moreover, let the polynomial S(X) := i=0 Bi X q + A be
an affine transformation. We call this the “univariate representation” of the affine transformation S(X).
Lemma 2.8 An affine transformation in univariate representation can be transfered efficiently in multivariate representation and vice versa.
Proof. This lemma follows from [KS99, Lemmata 3.1 and 3.2] by a simple extension from the linear to
the affine case. A more elaborated proof can be found in [Wol05, Lemma 2.2.7].
¤

3

Sustaining Transformations

In this section, we discuss several examples of sustaining transformations. In particular, we consider theireffect on the central transformation P 0 .

3.1

Additive Sustainer

For n = m, i.e., the number of equations is equal to the number of variables, let σ(X) := (X + A) andτ (X) := (X + A0 ) for some elements A, A0 ∈ E. As long as the transformations σ, τ keep the shape of thecentral equations P 0 invariant, they form sustaining transformations.
In particular, we are able to change the constant parts vs , vt ∈ Fn or VS , VT ∈ E of the two affine
transformations S, T ∈ Aff−1 (Fn ) to zero, i.e., to obtain a new key (Ŝ, P̂ 0 , T̂ ) with Ŝ, T̂ ∈ Hom−1 (Fn ). The
constant terms of S, T have now been moved to the central equation P 0 and as a result, Ŝ, T̂ are now linear
rather than affine transformations over Fn .
Remark. This result is very useful for cryptanalysis as it allows us to “collect” the constant terms in
the central equations P 0 . For cryptanalytic purposes, we therefore only need to consider the case of linear
transformations S, T ∈ Hom−1 (Fn ).
The additive sustainer also works if we interpret it over the vector space F n rather than the extension
field E. To distinguish this case from the setting above, we write a ∈ Fn , a0 ∈ Fm here. In particular,
we can also handle the case n 6= m now. However, in this case it may happen that we have a 0 ∈ Fm andconsequently τ : Fm → Fm . Nevertheless, we can still collect all constant terms in the central equations P 0 .

PQCrypto 2006 Workshop Record

198

Equivalent keys in multivariate quadratic public key systems

If we look at the central equations as multivariate polynomials, the additive sustainer will affect theconstants αi and βi,j ∈ F for 1 ≤ i ≤ m and 1 ≤ j ≤ n. A similar observation is true for central equations
over the extension field E: in this case, the additive sustainer affects the additive constant A ∈ E and thelinear factors Bi ∈ E for 0 ≤ i < n.

3.2

Big Sustainer

We now consider multiplication in the (big) extension field E, i.e., we have σ(X) := (BX) and τ (X) :=(B 0 X) for B, B 0 ∈ E∗ . Again, we obtain a sustaining transformation if this operation does not modify theshape of the central equations as (BX), (B 0 X) ∈ Aff−1 (Fn ).
The big sustainer is useful if we consider schemes defined over extension fields as it does not affect theoverall degree of the central equations over this extension field. Note that we only allow non-zero elementsof the extension field E for B, B 0 as BX, B 0 X are not invertible otherwise.

3.3

Small Sustainer

We now consider vector-matrix multiplication over the (small) ground field F, i.e., we have σ(x) :=Diag(b1 , . . . , bn )x and τ (x) := Diag(b01 , . . . , b0m )x for the non-zero coefficients b1 , . . . , bn , b01 , . . . , b0m ∈ F∗
and Diag(b), Diag(b0 ) the diagonal matrices on both vectors b ∈ Fn and b0 ∈ Fm , respectively.
In contrast to the big sustainer, the small sustainer is useful if we consider schemes which define thecentral equations over the ground field F as it only introduces a scalar factor in the polynomials (p 01 , . . . , p0m ).
As for the big sustainer, we require non-zero elements, i.e., we have bi , b0i ∈ F∗ .

3.4

Permutation Sustainer

For the transformation σ, this sustainer permutes input-variables of the central equations while for thetransformation τ , it permutes the polynomials of the central equations themselves. As each permutation
has a corresponding, invertible permutation-matrix, both σ ∈ Sn and τ ∈ Sm are also affine transformations.
The effect of the central equations is limited to a permutation of these equations and their input variables,
respectively.

3.5

Gauss Sustainer

Here, we consider Gauss operations on matrices, i.e., row and column permutations, multiplication of rows
and columns by scalars from the ground field F, and the addition of two rows/columns. As all these
operations can be performed by invertible matrices, they form a subgroup of the affine transformations andare hence a candidate for a sustaining transformation.
The effect of the Gauss sustainer is similar to the permutation sustainer and the small sustainer. In
addition, it allows the addition of multivariate quadratic polynomials. This will not affect the shape ofsome MQ-schemes.

3.6

Frobenius Sustainer

Definition 3.1 Let F be a finite field with q := |F| elements and E its n-dimensional extension. Moreabover, let H := {i ∈ Z : 0 ≤ i < n}. For a, b ∈ H we call σ(X) := X q and τ (X) := X q Frobeniustransformations.
Obviously, Frobenius transformations are linear transformations with respect to the ground field F. The
following lemma establishes that they also form a group:
Lemma 3.2 Frobenius transformations are a subgroup in Hom−1 (Fn ).
Proof. First, Frobenius transformations are linear transformations, so associativity is inherited fromthem. Second, the set H from Definition 3.1 is not empty for any given F and n ∈ Z + . Hence, thecorresponding set of Frobenius transformations is not empty either. In particular, we notice that the199

PQCrypto 2006 Workshop Record

Wolf, Preneel0

Frobenius transformation X q coincides with the neutral element of the group of linear transformations(Hom−1 (Fn ), ◦).
In addition, the inverse of a Frobenius transformation is also a Frobenius transformation: Let σ(X) :=a
X q for some a ∈ H. Working in the multiplicative group E∗ we observe that we need q a · A0 ≡ 1
0(mod q n − 1) for A0 ∈ Z+ to obtain the inverse function of σ. We notice that A0 := q a for a0 := n − a0a(mod n) yields the required and moreover σ −1 := X q is a Frobenius transformation as a0 ∈ H.
So all left to show is that for any given Frobenius transformations σ, τ , the composition σ ◦ τ is also a
Frobenius transformation, i.e., that we have closure.
aba+b
Let σ(X) := X q and τ (X) := X q for some a, b ∈ H. So we can write σ(X) ◦ τ (X) = X q . If
a + b < n we are done. Otherwise n ≤ a + b < 2n, so we can write q a+b = q n+s for some s ∈ H. Again,
working in the multiplicative group E ∗ yields q n+s ≡ q s (mod q n − 1) and hence, we established that σ ◦ τis also a Frobenius transformation. This completes the proof that all Frobenius transformations form agroup.
¤
Frobenius transformations usually change the degree of the central equation P 0 . But taking τ := σ −1
cancels this effect and hence preserves the degree of P 0 . Therefore, we can speak of a Frobenius sustainer(σ, τ ). Fore a given extension field E, there are n Frobenius sustainers.
It is tempting to extend this result to the case of powers of the characteristic of F. However, this is notpossible as xcharF is not a linear transformation in F for q 6= p where p denotes the characteristic of thefinite field F and q := |F| the number of its elements.
Remark. All six sustainers presented so far form groups and hence partition the private key space
into equivalence classes. The relation between partitions and groups has been previously discussed in
Lemma 2.3.

3.7

Reduction Sustainer

Reduction sustainers are quite different from the transformations studied so far, because they are appliedwith a different construction of the trapdoor of P. In this new construction, we define the public key
equations as P := R ◦ T ◦ P 0 ◦ S where R : Fn → Fn−r denotes a reduction or projection while S, P 0 , T havethe same meaning as before, i.e., they are affine invertible transformations and a system of Multivariate
Quadratic polynomials, respectively. Less loosely speaking, we consider the function R(x 1 , . . . , xn ) :=(x1 , . . . , xn−r ), i.e., we neglect the last r components of the vector (x1 , . . . , xn ). Although this modification
looks rather easy, it proves powerful to defeat a wide class of cryptographic attacks against several MQschemes, including HFE and MIA, e.g., the attack introduced in [FJ03].
For the corresponding sustainer, we consider the affine transformation T in matrix representation, i.e.,
we have T (x) := M x + v for some invertible matrix M ∈ Fm×m and a vector v ∈ Fm . We observe that any
change in the last r columns of M or v does not affect the result of R (and hence P). Therefore, we canchoose these last r columns without affecting the public key. Inspecting Lemma 2.4, we see that this gives
us a total of
n−1
Y ¡
¢
qr
qn − qii=n−r−1choices for v and M , respectively, that do not affect the public key equations P.
When applying the reduction sustainer together with other sustainers, we have to make sure that we do
not count the same transformation twice. We will show how to deal with this difficulty in the corresponding
proofs.

4

Application to Multivariate Quadratic Schemes

Having all necessary tools at hand, we show now how to apply suitable sustaining transformations to theMultivariate Quadratic schemes. We want to stress that the reductions in size we achieve in this section
represent lower rather than upper bounds: additional sustaining transformations may further reduce thekey space of these schemes. The only exception for this rule are the MIA/MIO class: due to the tightness

PQCrypto 2006 Workshop Record200Equivalent keys in multivariate quadratic public key systems

proof in Section 5, we know that only the big sustainer and the Frobenius sustainer can be applied here.
Unfortunately, the details of this tightness proof are cumbersome and we do not see how it can be extended
to the other schemes discussed in this section.

4.1

Hidden Field Equations

We start with the HFE class as the overall proof ideas can be demonstrated most clearly here. In fact,
we will use some of these ideas again for the MIA class. The Hidden Field Equations (HFE) have been
proposed by Patarin [Pat96b]. Its main characteristic is the exceptional low degree of the central polynomial
P 0 (X 0 ) ∈ E[X 0 ].
Definition 4.1 Let E be a finite field and P 0 (X 0 ) a polynomial over E. For
X
X
k
i
j
0
Bk0 X 0q + A0
X 0q +q +Ci,jP 0 (X 0 ) :=0≤i,j≤dq i +q j ≤d0≤k≤d
q k ≤d 0ij Ci,j X q +q
k
q
0
where
 B0k XA

0
∈ E are the quadratic terms,
for Ci,j0
for Bk ∈ E are the linear terms, andfor A0 ∈ E is the constant term

and a degree d ∈ Z+ , we say the central equations P 0 are in HFE-shape.
Due to the special form of P 0 (X 0 ), we can express it as a Multivariate Quadratic equation P 0 over F. A
proof of this fact for the case F =GF(2) can be found in [MIHM85]. It has been elaborated and further
extended in [Wol05, Section 2.4]. Polynomials of cubic and higher degree have been discussed in [KS99,
Lemma 3.3]. The bound of the degree of the polynomial P 0 (X 0 ) has a different motivation: this allows
efficient inversion of the equation P (X) = Y for given Y ∈ E and is hence necessary to obtain efficient
schemes. So the shape of HFE is in particular this degree d of the private polynomial P . Moreover, we0
observe that there are no restrictions on its coefficients Ci,j
, Bk0 , A0 ∈ E for i, j, k ∈ Z+ and q i , q i + q j ≤ d.
Hence, we can apply both the additive and the big sustainer from sections 3.1 and 3.2 without changing
the shape of this central equation.
Theorem 4.2 For K := (S, P, T ) ∈ Aff−1 (Fn ) × E[X 0 ] × Aff−1 (Fn ) a private key in HFE, we haven.q 2n (q n − 1)2equivalent keys.
Proof. To prove this theorem, we consider normal forms of private keys: let S̃ ∈ Aff−1 (Fn ) being theaffine transformation we start with. First we compute Ŝ(X) := S̃(X) − S̃(0), i.e., we apply the additive
sustainer. Obviously, we have Ŝ(0) = 0 after this transformation and hence a special fix-point. Second
we define S(X) := Ŝ(X).Ŝ(1)−1 , i.e., we apply the big sustainer. As the transformation Ŝ : E → E is abijection and we have Ŝ(0) = 0, we know that Ŝ(1) must be non-zero. Hence, we have S(1) = 1, i.e., we
add a new fix-point but still keep the old fix-point as we have S(0) = Ŝ(0) = 0. Similar we can computean affine transformation T (X) with T (0) = 0 and T (1) = 1 as a normal form of the affine transformationT̃ ∈ Aff−1 (Fn ). Note that both the additive sustainer and the big sustainer keep the degree of the central
polynomial P (X) so we can apply both sustainers on both sides without changing the “shape” of P (X).
Applying the Frobenius sustainer is a little more technical. First we observe that this sustainer keeps
the fix-points S(0) = T (0) = 0 and S(1) = T (1) = 1 so we are sure we still deal with equivalenceclasses, i.e., each given private key has a unique normal form, even after the Frobenius sustainer has been
applied. Now we pick an element C ∈ E\{0, 1} for which g := S(C) is a generator of E ∗ , i.e., we haveE∗ = {g i | 0 ≤ i < q n }. As E is a finite field we know that such a generator g exists. Given that S isqisurjective we know that we can find the corresponding C ∈ E\{0, 1}. Now we compute g i := S(C) for0 ≤ i < n. Using any total ordering “<”, we obtain gc := min{g0 , . . . , gn−1 } for some c ∈ N as the smallest
element of this set. One example of such a total ordering would be to use a bijection between the setsE ↔ {0, . . . , q n − 1} and then exploiting the ordering of the natural numbers to derive an ordering on the201

PQCrypto 2006 Workshop Record

Wolf, Preneelcelements of the extension field E. Finally, we define S(X) := [S(X)]q as new affine transformation. To
n−ccancel the effect of the Frobenius sustainer, we define T (X) := [T (X)]q .
Hence, we have now computed a unique normal form for a given private key. Moreover, we can “reverse”
these computations and derive an equivalence class of size n.q 2n .(q n − 1)2 this way as we havec

(BX q + A, B 0 X qn−c+ A0 ) • (S, P 0 , T ) for B, B 0 ∈ E∗ , A, A0 ∈ E and 0 ≤ c < n .
¤Remark. To the knowledge of the authors, the additive sustainer for HFE has first been reported in[Tol03]; it was used there for reducing the affine transformations to linear ones. In addition, a weakerversion of the above theorem can be found in [WP05b].
For q = 2 and n = 80, the number of equivalent keys per private key is ≈ 2326 . In comparison, thenumber of choices for S and T is ≈ 212,056 . This special choice of parameters has been used in HFE
Challenge 1 [Pat96b].
4.1.1

HFE-

We recall that HFE- is the original HFE-class with the minus modification from Section 3.7 applied.
In particular, this means that the “shape” of the central polynomial P 0 (X 0 ) is still the same, i.e., allconsiderations from the previous theorem also apply to HFE-.
Theorem 4.3 For K := (S, P, T ) ∈ Aff−1 (Fn ) × E[X] × Aff−1 (Fn ) a private key in HFE and a reduction
parameter r ∈ Z+ we haven−1
Y
(q n − q i )n.q 2n (q n − 1)(q n−r − 1)
i=n−r−1

equivalent keys. Hence, the key-space of HFE- can be reduced by this number.

Proof. This proof uses the same ideas as the proof of Theorem 4.2 to obtain a normal form of the affine
transformation S, i.e., applying the additive sustainer, the big sustainer and the Frobenius sustainer on
this side. Hence, we have a reduction by n.q n (q n − 1) keys here.
For the affine transformation T , we also have to take the reduction sustainer into account: we useT̃ (X) : Fn → Fn−r and fix T̃ (0) = 0 by applying the additive sustainer and T̃ (1) = 1 by applying the
big sustainer, which gives us q n−r and q n−r − 1 choices, respectively. To avoid double counting withthe reduction sustainer, all computations were performed in Ẽ := GF(q n−r ) rather than E. Again, we cancompute a normal form for a given private key and reverse these computations to obtain the full equivalenceclass for any Q
given private key in normal form. Moreover, we observe that the resulting transformation T̃
n−1
allows for q r i=n−r−1 (q n − q i ) choices for the original transformation T : Fn → Fn without affecting theoutput of T̃ and hence, keeping the two fix points T̃ (0) = 0 and T̃ (1) = 1. Therefore, there are a total of
Qn−1
q n−r · q r · (q n−r − 1) · i=n−r−1 (q n − q i ) possibilities for the transformation T without changing the public
key equations. Multiplying out the intermediate results for S and T yields the theorem.
¤
For q = 2, r = 7 and n = 107, the number of equivalent keys for each private key is ≈ 2 2129 . In
comparison, the number of choices for S and T is ≈ 223,108 . This special choice of parameters has beenused in Quartz-7m [WP04].
4.1.2

HFEv

Another important variation of Hidden Field Equations is HFEv. In particular, it was used in the signaturescheme Quartz [CGP01]. HFEv was introduced in [KPG99]. The HFEv scheme is characterized in thefollowing definition.
Definition 4.4 Let E be a finite field with degree n0 over F, v ∈ Z+ the number of vinegar variables,
and P(X) a polynomial over E. Moreover, let (z1 , . . . , zv ) := sn−v+1 (x1 , . . . , xn ), . . . , sn (x1 , . . . , xn ) forsi the polynomials of S(x) in multivariate representation and X 0 := φ−1 (x01 , . . . , x0n0 ), using the canonical

PQCrypto 2006 Workshop Record

202

Equivalent keys in multivariate quadratic public key systems

bijection φ−1 : Fn → E and x0i := si (x1 , . . . , xn ) for 1 ≤ i ≤ n0 as hidden variables. Then define the central
equation as
X
X
i
j
k
Pz010 ,...,zv0 (X 0 ) :=Bk (z1 , . . . , zv )X 0q
Ci,j X 0q +q +0≤i,j≤d0≤k≤dq i +q j ≤dq k ≤d0 0
0+A (z1 , . . . , zv )
 0
0q i +q j Ci,j X

where







Bk0 (z10 , . . . , zv0 )X 0q

k





0
0 0


 A (z1 , . . . , zv )0
for Ci,j∈ E are thequadratic terms,
for Bk0 (z10 , . . . , zv0 ) depending
linearly on z10 , . . . , zv0 and
for A0 (z10 , . . . , zv0 ) depending
quadratically on z10 , . . . , zv0

and a degree d ∈ Z+ , we say the central equations P 0 are in HFEv-shape.
The condition that the Bk0 (z10 , . . . , zv0 ) are affine functions (i.e., of degree 1 in the zi0 at most) and A0 (z10 , . . . , zv0 )is a quadratic function over F ensures that the public key is still quadratic over F.
Theorem 4.5 For K := (S, P 0 , T ) ∈ Aff−1 (Fn ) × E[X 0 ] × Aff−1 (Fm ) a private key in HFEv, v ∈ Z+ thenumber of vinegar variables, E an n0 -dimensional extension of F where n0 := n − v = m we have00

n0 q n+n +vm (q n − 1)2v−1Y(q v − q i )i=0equivalent keys. Hence, the key-space of HFEv can be reduced by this number.
Proof. In contrast to HFE-, the difficulty now lies in the computation of a normal form for the affine
transformation S rather than the affine transformation T . For the latter, we can still apply the big sustainer
00
and the additive sustainer and obtain a total of q m · (q m − 1) = q n · (q n − 1) equivalent keys for a given
transformation T . Moreover, the HFEv modification does not change the “absorbing behaviour” of thecentral polynomial P 0 and hence, the proof from Theorem 4.2 is still applicable.
Instead, we have to concentrate on the affine transformation S here. In order to simplify the following
argument, we apply the additive sustainer on S and obtain a linear transformation. This reduces the keyspace by q n . In order to make sure that we do not count the same linear transformation twice, we consider
a normal form for the now (linear) transformation Sµ¶
Em Fvmwith Em ∈ Fm×m , Fvm ∈ Fm×v .
0
Iv
In the above definition, we also have Iv the identity matrix in Fv×v . Moreover, the left-lower corner is the
all-zero matrix in Fv×m . The reason for this non-symmetry: we may not introduce vinegar variables in theset of oil variables, but due to the form of the vinegar equations, we can introduce oil variables in the setof vinegar variables. This is done by the following matrix. In particular, for each invertible matrix M S , wehave a unique matrix¶µIm0with an invertible matrix Hv ∈ Fv×v .
Gvm Hv
which transfers MS to the normal form from above. Again, Im Q
is an identity matrix in Fm×m . Moreover,
v−1 v
v
v×m
vm
i
we have some matrix Gm ∈ F. This way, we obtain q
i=0 (q − q ) equivalent keys in the “v”
modification alone. As stated previously, the identity matrix Im ensures that the input of the HFE component is unaltered. However, we do not have such a restriction on the input of the vinegar part and canhence introduce the two matrices Gvm and Hv : they are “absorbed” into the random terms of the vinegar
polynomials Bk0 (z10 , . . . , zv0 ) and A0 (z10 , . . . , zv0 ).
0
For the HFE component over E, we can now apply the big sustainer to S and obtain a factor of (q n −1).
In addition, we apply the Frobenius sustainer to the HFE component, which yields an additional factor of203

PQCrypto 2006 Workshop Record

Wolf, Preneel

n0 . Note that the Frobenius sustainer can be applied both to S and T , and hence, we can make sure thatit cancels out and does not affect the degree of the central polynomial Pz1 ,...,zv (X). Again, we can reverse
all computations and therefore obtain equivalence classes of equal size for each given private key in normalform.
¤
For the case q = 2, v = 7 and n = 107, the number of equivalent keys for each private is ≈ 2 1160 . In
comparison, the number of choices for S and T is ≈ 221,652 .
4.1.3

HFEv-

Here, we combine both the HFEv and the HFE- modification to obtain HFEv-. In fact, the original Quartz
scheme [CGP01] was of this type.
Theorem 4.6 For K := (S, P 0 , T ) ∈ Aff−1 (Fn ) × E[X 0 ] × Aff−1 (Fm+v , Fm+r ) a private key in HFEv-,v ∈ Z+ vinegar variables, a reduction parameter r ∈ Z+ and E an n0 -dimensional extension of F wheren0 := n − v and n0 = m + r we have
0 r+2n0 +vn0

nq

(q

n0

− 1)

2

v−1
Y

v

i

(q − q )

i=0

0
nY
−1

0

(q n − q i )i=n0 −r−1

equivalent keys. Hence, the key-space of HFEv- can be reduced by this number.
Proof. This proof is a combination of the two cases HFEv and HFE-. Given that the difficulty for the
HFE- modification was in the T -transformation while the difficulty of HFEv was in the S-transformation,
we can safely combine the known sustainers without any double-counting.
¤
For the case q = 2, r = 3, v = 4 and n = 107, n0 = 103, the number of redundant keys is ≈ 21258 . In
comparison, the number of choices for S and T is ≈ 222,261 . This special choice of parameters has beenused in the original version of Quartz [CGP01], as submitted to NESSIE [NES].

4.2

Matsumoto-Imai Scheme A

As HFE, the MIA class uses a finite field F and an extension field E. However, the choice of the central
equation is far more restrictive than in HFE as we only have one monomial here.
Definition 4.7 Let E be an extension field of dimension n over the finite field F with even characteristicand λ ∈ Z+ an integer with gcd(q n − 1, q λ + 1) = 1. We then say that the following central equation is of
MIA-shape:
λP 0 (X 0 ) := X 0q +1 .
The restriction gcd(q n − 1, q λ + 1) = 1 is necessary first to obtain a permutation polynomial and second toallow efficient inversion of P 0 (X 0 ). In this setting, we cannot apply the additive sustainer as this monomial
does not allow any linear or constant terms. Moreover, the monomial requires a factor of one. Hence, wehave to preserve this property. As we will see in Section 5, the only sustainers suitable here are the big
sustainer, see Section 3.2, and the Frobenius sustainer from Section 3.6.
Remark. In the paper [MI88], MIA was introduced under the name C∗ . Moreover, it used the branching
modifier [WP05c, 4.4] by default. As branching has been attacked very successfully, C ∗ has been usedwithout this modification for any later construction, e.g., [CGP00b, CGP02, CGP00a, CGP03]. However,
without the branching condition, the “new” scheme C∗ coincides with the previously suggested “Scheme A”
from [IM85]. To acknowledge this historical development, we decided to come back to the earlier notationand call the scheme presented in this section “MIA” for “Matsumoto-Imai Scheme A”. This has beenpreviously suggested in [WP05c].
Theorem 4.8 For K := (S, P 0 , T ) ∈ Aff−1 (Fn ) × E[X 0 ] × Aff−1 (Fn ) a private key in MIA we haven(q n − 1)
equivalent keys. Hence, the key-space of MIA can be reduced by this number.

PQCrypto 2006 Workshop Record

204Equivalent keys in multivariate quadratic public key systems

Proof. To prove this statement, we consider normal forms of keys in MIA. In particular, we concentrate
on a normal form of the affine transformation S where S is in univariate representation. As for HFE andw.l.o.g., let B := S(1) be a non-zero coefficient on Input 1. Unlike HFE we cannot enforce that S(0) = 0,
so we may have S(1) = 0. However, in this case set B := S(0). Applying σ −1 (X) := B −1 X will ensure anormal form for S. In order to “repair” the monomial P 0 (X 0 ), we have to apply an inverse transformation
λto T . So let τ (X) := (B q +1 )−1 X. This way we obtainP=

T ◦ τ −1 ◦ τ ◦ P 0 ◦ σ ◦ σ −1 ◦ S==

T̃ ◦ (B (q +1).(−1) .B q +1 .X 0q +1 ) ◦ S̃T̃ ◦ P 0 ◦ S̃ ,

λ

λ

λ

where S̃ is in normal form. In contrast to HFE in Theorem 4.2, we cannot chose the transformations σ
and τ independently: each choice of σ implies a particular τ and vice versa. However, the fix point 1 isstill preserved by the Frobenius sustainer and so we can apply this sustainer to the transformation S. As
for HFE, we compute a normal form for a given generator and a total ordering of E; again, we “repair” theλmonomial X 0q +1 by applying an inverse Frobenius sustainer to T and hence havecλ

(BX q , B −q −1 X qn−c) • (S, P 0 , T ) where B ∈ E∗ and 0 ≤ c < n for c ∈ N ,which leads to a total of n · (q n − 1) equivalent keys for any given private key. Since all these keys form
equivalence classes of equal size, we reduced the private key space of MIA by this factor.
¤
We want to point out that there is also a variation of MIA defined over odd characteristic. This variation
has been suggested in [WP05c, Sect. 7.1] and uses exactly the same structure for the private key. For
technical reasons, the condition on the gcd is replaced by gcd(q n − 1, q λ + 1) = 2. However, this is irrelevant
for our purpose and we have hence the following corollary.
Corollary 4.9 For K := (S, P 0 , T ) ∈ Aff−1 (Fn ) × E[X 0 ] × Aff−1 (Fn ) a private key in MIO we haven(q n − 1)
equivalent keys. Hence, the key-space of MIO can be reduced by this number.
The above corollary can be proved in exactly the same way as Theorem 4.8. In particular, the fact that
MIO is defined over odd rather than even characteristic does not impose a restriction in this context.
Remark. Patarin observed that it is possible to derive equivalent keys by changing the monomial P 0[Pat96a]. As the aim of this article is the study of equivalent keys by chaining the affine transformations
S, T alone, we did not make use of this property. A weaker version of the above theorem can be found in[WP05b]; in particular, it does not take the MIO class into account.
Moreover, we observed in this section that it is not possible for MIA to change the transformations S, T
from affine to linear. But Geiselmann et al. showed how to reveal the constant parts of these transformations[GSB01]. Hence, having S, T affine instead of linear does not enhance the overall security of MIA.
For q = 128 and n = 67, we obtain ≈ 2469 equivalent private keys per class. The number of choices for
S, T is ≈ 263,784 in this case.
4.2.1

MIA-

We want to point out that MIA itself is insecure, due to a very efficient attack by Patarin [Pat95]. However,for well-chosen parameters q, r, its variation MIA- (also known as C∗−− ) is believed to be secure: as in thecase of HFE and HFE-, we use the original MIA scheme and apply the minus modification from Section
3.7.
Theorem 4.10 For K := (S, P, T ) ∈ Aff−1 (Fn ) × E[X] × Aff−1 (Fn ) a private key in MIA and a reduction
number r ∈ Z+ we haven−1
Y
(q n − q i )n.(q n − 1)q r
i=n−r−1

equivalent keys. Hence, the key-space of MIA- can be reduced by this number.

205

PQCrypto 2006 Workshop Record

Wolf, Preneel

Proof. This proof is similar to the one of MIA, i.e., we apply both the Frobenius and the big sustainer
to S and the corresponding inverse sustainer to the transformation T . This way, we “repair” the change
λon the central monomial X q +1 . All in all, we obtain a factor of n · (q n − 1) equivalent keys for a given
private key.
Next we observe that the reduction sustainer applied to the transformation T alone allows us to changenn×n
the last r rows of the vector. This yields an
Qn−1 vT ∈ F and also the last r rows of the matrix MT ∈ F
additional factor of q r i=n−r−1 (q n − q i ) on this side.
Note that the changes on the side of the transformation S and the changes on the side of the transformation T are independent: the first computes a normal form for S while the second computes a normal
form on T . Hence, we may multiply both factors to obtain the overall number of independent keys.
¤
For q = 128, r = 11 and n = 67, we obtain ≈ 26180 equivalent private keys per class. The number ofchoices for S, T is ≈ 263,784 in this case. This particular choice of parameters has been used in Sflash v3[CGP03].

4.3

Unbalanced Oil and Vinegar Schemes

In contrast to the two schemes before, we now consider a class of MQ-schemes which does not mix
operations over two different fields E and F but only performs computations over the ground field F.
Moreover, Unbalanced Oil and Vinegar schemes (UOV) omit the affine transformation T but use S ∈Aff−1 (Fn ). To fit in our framework, we set it to be the identity transformation, i.e., we have T := τ := id.
UOV were proposed in [KPG99].
00∈ F. We
Definition 4.11 Let F be a finite field and n, m ∈ Z+ with n ≥ 2m. Moreover, let αi0 , βi,j, γi,j,k
say that the polynomials below are central equations in UOV-shape:

p0i (x01 , . . . , x0n ) :=

n
m X
X

0
x0j x0k +γi,j,knX0x0j + αi0 .
βi,j

j=1

j=1 k=1

In this context, the variables x0i for 1 ≤ i ≤ m are called the “vinegar” variables and x0i for m < i ≤ n
the “oil” variables. Note that the vinegar variables are combined quadratically while the oil variables
are only combined with vinegar variables in a quadratic way. Therefore, assigning random values to thevinegar variables, results in a system of linear equations in the oil variables which can than be solved, e.g.,using Gaussian elimination. So the “shape” of UOV is the fact that a system in the oil variables alone islinear. Hence, we may not mix oil variables and vinegar variables in our analysis but may perform affine
transformations within one set of these variables. So for UOV, we can apply the additive sustainer andalso the Gauss sustainer, introduced in sections 3.1 and 3.5. However, in order to ensure that the shape ofthe central equations does not change, we have to ensure that the Gauss sustainer influences the vinegar
and oil variables separately.
Theorem 4.12 Let K := (S, P 0 , id) ∈ Aff−1 (Fn ) × MQ(Fn , Fm ) × Aff−1 (Fm ) be a private key in UOV.
Then we have
m−1
n−m−1
Y
Y
(q m − q i )(q n−m − q i )q n+mni=0

i=0equivalent keys. Hence, the key-space of UOV can be reduced by this number.

Proof. As in the case of the schemes before, we compute a normal form for a given private key. First,
applying the additive sustainer reduces the affine transformation S to a linear transformation. This results
in a factor of q n in terms of equivalent keys. Second, applying the Gauss sustainer separately within vinegar
and oil variables, we can enforce the following structure, denoted R ∈ Fn×n , on the matrix MS ∈ Fn×n ofthe (now only) linear transformation S:


Im
0
Am
n−2m 
R :=  0 In−2m Bm
.
0
0
Im

PQCrypto 2006 Workshop Record

206

Equivalent keys in multivariate quadratic public key systems

In this context, the matrices Im , In−2m are the identity elements of Fm×m and F(n−2m)×(n−2m) , respectively.
n−2mMoreover, we have the matrices Am ∈ Fm×m and Bm∈ F(n−2m)×m . For a given central equation P 0 ,each possible matrix R leads to the same number of equivalent keys. Let
µ
¶
Fn−m
0
E :=
Hm
Gm
n−m
be an (n × n)-matrix. Here, we require that the matrices Fn−m ∈ F(n−m)×(n−m) and Hm ∈ Fm×m are
m×(n−m)invertible and hence the counting from Lemma 2.4 applies. For Gm, we have no restrictions.
n−m ∈ F
This way, we define the transformation σ(x) := Ex where x ∈ Fn . Note that these transformations σ form
a subgroup within the affine transformations. So we have
(Ex + a, id) • (S, P 0 , id) for a ∈ Fn and E as defined above.
As this choice of σ partitions the private key space into equivalence classes of equal size, anddue to the reQn−m−1
strictions on E, we reduced the size of the private key space by an additional factor of q mn i=0(q n−m −Qm−1 miiq ) i=0 (q − q ) .
¤For q = 2, m = 64, n = 192, we obtain 232,956 equivalent keys per key — in comparison to 237,054 choices
for S. If we increase the number of variables to n = 256, we obtain 257,596 and 265,790 , respectively. Bothchoices of parameter have been used in [KPG03].

4.4

Stepwise-Triangular Systems

Unbalanced Oil and Vinegar schemes and Stepwise-Triangular Systems (STS) are quite similar as both aredefined over small ground fields rather than ground fields and extension fields. In addition, they enforce
a special structure on the input variables. In the case of UOV we have two sets of variables while we use
L ∈ Z+ such sets in the case of STS, each forming one layer or step. These layers form a generalized
triangular structure, hence the name of these schemes. We capture this intuition more formally below.
Stepwise Triangular Schemes were introduced in [WBP04].
Definition 4.13 Let n1 , . . . , nL ∈ Z+ be L integers such that n1 + · · · + nL = n, the number of variables,and m1 , . . . , mL ∈ Z+ such that m1 + · · · + mL = m, the number of equations. Here nl represents thenumber of new variables (step-width) and ml the number of equations (step-height), both in Step l for1 ≤ l ≤ L. By convention, we set n0 := m0 := 0. Now let P 0 ∈ MQ(Fn , Fm ) be a system of Multivariate
Quadratic polynomials such that the ml private quadratic polynomials p0m0 +...+ml−1 +1 , . . . , p0ml of each layerPll contain only the variables x0k with k ≤ j=1 nj , i.e., only the variables defined in all previous steps plus
nl new ones. Then we call (S, P 0 , T, ) ∈ Aff−1 (Fn ) × MQ(Fn , Fm ) × Aff−1 (Fm ) a private key in Stepwise
Triangular System shape. If n1 = . . . = nL = m1 = . . . = mL = r for some r ∈ Z+ , we call this a regular
Stepwise Triangular System.
We want to stress in this context that we do not assume any additional structure for the private polynomials
00p01 , . . . , p0m here. In particular, all coefficients γi,j,k, βi,j, αi0 ∈ F for these polynomials may be chosen at
random.
As STS and UOV are based on a similar concept, the following proof on Stepwise Triangular Schemes
uses the same ideas as the proof for the UOV class. As for UOV we exploit the fact that we can use Gauss
operations within any given layer — and use again the fact that equations of Layer l depend on all variablesof the layers 1, . . . , l, i.e., we may also perform Gauss operations on these previous layers, as long as theresult only affects the given Layer l.
Theorem 4.14 Let F be a finite field with q := |F| elements, n ∈ Z+ the number of variables, m ∈ Z+ theLnumber of equations and L ∈ Z+ the number of layers. Moreover, let (n1 , . . . , nL ) ∈ (Z+ ) be a vector of+
integers such that n1 + . . . + nL = n and m1 , . . . , mL ∈ Z integers such that m1 + . . . + mL = m. Thenfor K := (S, P 0 , T ) ∈ Aff−1 (Fn ) × MQ(Fn , Fm ) × Aff−1 (Fm ) a private key in STS we have




nY
mY
L
L
i −1
i −1
Pi
Pi
Y
Y
q ni (n− j=1 nj )
q mi (m− j=1 mj )q m+n
(q ni − q j )(q mi − q j )
i=1

i=1

j=0

207

j=0

PQCrypto 2006 Workshop Record

Wolf, Preneel

equivalent keys. Hence, the key-space of STS can be reduced by this number.
Proof. For this proof, we apply both the additive sustainer and the Gauss sustainer. The latter is applied
independently on each layer.
First, we observe that we can apply the additive sustainer both to the transformation S ∈ Aff −1 (Fn )and T ∈ Aff−1 (Fm ) to obtain the fix point S(0) = T (0) = 0. As a result, we obtain a factor of q m+n andmay assume S ∈ Hom−1 (Fn ) and T ∈ Hom−1 (Fm ) for the remainder of this proof.
As in the proof of Theorem 4.12, we impose a special structure on the linear transformation S. Therefore,
we consider the matrix


∗
∗
···
∗
∗
I n1
 0 I n2
∗
∗ 


 0

0
I
n
3






 ..
.
..
.. 
MS :=  .

.








∗
∗
I
n
L−2


 0
0
InL−1
∗ 
0
0
···
0
0
I nL
In MS ∈ Fn×n , sub-matrices Ini are identity matrices in Fni ×ni for 1 ≤ i ≤ n. The left lower portion of
MS is zero while the upper right portion of MS consists of elements of F. To obtain this matrix MS , wemake use of


0
0
···
0
0
An1
 ∗
0
0 
A n2


 ∗

∗
A
n3






 ..
.
.
.. 
..
E :=  .









0
0
A
nL−2


 ∗
0 
∗
AnL−1
∗
∗
···
∗
∗
A nL

In this matrix E ∈ Fn×n , we have invertible components Ani ∈ Fni ×ni for 1 ≤ i ≤ L. Moreover, the upper
right portion of the matrix E is zero while the left lower portion of E consists of elements of F. We seethat the above matrix is sufficient to impose this special structure on M S . Moreover, for each choice of E,
we obtain another linear transformation S and hence, MS is a normal form of S.
Using Lemma 2.4, we can now count the number of possible matrices E and obtain


nY
L
i −1
Pi
Y
q ni (n− j=1 nj )(q ni − q j )
i=1

j=0

for the number of possibilities.
see the correctness of the above computation, we specialise it for n 1 :
Qn1 −1 Tojhere we have the term j=0(q n1 −q ) which computes the number of choices for the matrix An1 while
q n1 (n−n1 ) gives the number of choices in the (n1 × (n − n1 )) column over F below the matrix An1 . By
induction on ni we obtain the above formula for 1 ≤ i ≤ L. In particular, as MS is in normal form, there
exists exactly one matrix E of the above form for any given S ∈ Hom−1 (Fn ). Hence, we have establishedthe existence of an equivalence class of this size.
The corresponding proof for the transformation T is analogous, so we can define matrix E 0 ∈ Fm×m
similar to matrix E. We only have to replace variables by equations here to reflect the different roles thetransformations S and T play. Note that we are allowed to add equations of lower layers to equations ofhigher layers and hence, may perform the same Gauss operations on equations that we could apply on
variables. So we have
(Ex + a, E 0 x + a0 ) • (S, P 0 , T ) for a ∈ Fn , a0 ∈ Fm and E, E 0 defined as above.

PQCrypto 2006 Workshop Record

208Equivalent keys in multivariate quadratic public key systems

As this choice of σ, τ partitions the private key space into equivalence classes of equal size, and due to therestrictions on E, E 0 , we reduced the size of the private key space by the above number.
¤Corollary 4.15 For regular STS with step-width r ∈ Z+ , L ∈ Z+ layers and n := Lr variables, the above
formula simplifies to
ÃL
!2
r−1
Y
Y
2n
r(n−(l−1)r)
r
i L
q
q
(q − q )
.
i=0

l=1

Choosing a regular STS scheme and q = 2, r = 4, L = 25, n = 100, we obtain 2 11,315 equivalent keys foreach given private key. For comparison: the number of choices for the two affine transformations S, T is
220,096 . Changing the number of layers to 20, and consequently having r = 5, we obtain a total of 2 11,630
equivalent keys. These special choices of parameters have been suggested in [KS04].

5

Tightness for MIA and MIO

All theorems in the previous section suffer from the same problem: we do not know if the size-reductions
are “tight”, i.e., if the sustainers applied are the only ones possible. In this section we proof that for the
MIA/MIO class, the big sustainer and the Frobenius sustainer are actually the only possible way to achieveequivalent keys for MIA and MIO. We recall that both classes use a finite field F with q := |F| elements
λand an extension field E of dimension n over F. Over E, they use the monomial Y 0 := X 0q +1 as central
equation for 1 ≤ λ < n. While MIA needs q to be even, MIO is defined for q being odd. The proof for the
MIA case is based on an unpublished observation by Dobbertin. Its extension to the MIO class is due tothe authors.
The starting point of the proof is the following equation which needs to hold for any two equivalent keys
for the MIA / MIO class. This is due to the fact that Definition 2.1 restricts us to affine transformations
to transfer one private key into. Hence we have the following equation:λλX q +1 = T ◦ X q +1 ◦ S ,which we can rewrite asλλX q +1 ◦ S −1 = T ◦ X q +1 .

(2)

We know from Section 2.1 that affine transformations form a group. Moreover, we can use Definition 2.7
to obtain a univariate representation for any given affine transformation. We can hence express (2) asÃn−1!qλ +1 n−1
X ³ λ ´q i
Xqi
B̃i X q +1
Bi X + A=+ Ã ,i=0

i=0

for some coefficients A, Ã, Bi , B̃i ∈ E. Note that we have (A+B)p = Ap +B p in a finite field of characteristic
p and consequently (A + B)q = Aq + B q for q = pk and some k ∈ Z+ . We now use a matrix representationof the above equation, similar to the matrix used by Kipnis and Shamir in their cryptanalysis of HFE[KS99]. This yields

q λ+n−1 q λ+n−1
q λ+1 q λ+1
qλ qλq λ +1
AB0 X

A








λ
λ
B0q +1 X q +1λλ
B1 B0q X q +qλ
B 0 Aq Xλ
B 1 Aq X q

X

AB1

λ
λ+1
+1
B0 B1q X qλλ+1
q +1 q
+q
B1
X

.
..

.
..

λ

Bn−1 Aq X q



Ã

 0


=
 ..
 .

0

n−1

λ

λ

Bn−1 B0q X q +qn−1

λBn−1 B1q X q

λB̃0q +1 X q +1
0

0

0

.
..
λ



0
0

λ+1
+q q λ+1 +q
B̃1q
X

..
0

...
..
.

λ+n−1
qλ
+1
B0 Bn−1
Xq
λ
λ+n−1
q
q
+q
B1 Bn−1 X+q n−1 . . . B q +1 X q λ+n−1 +q n−1
n−1

...

0
λ

λ+1

X

. . . ABn−1

.

...

209

0
.
..
q λ +(n−1)+q n−1

B̃n−1

Xq

λ+n−1

+q n−1











 (∗)



PQCrypto 2006 Workshop Record

Wolf, Preneel

As we work in E which has a multiplicative group of q n − 1 elements, we can reduce all powers larger thanor equal to q n by q n − 1.
Lemma 5.1 For F a finite field with q > 2 elements, we can only use the big sustainer and the Frobenius
sustainer to derive equivalent private keys within the MIA and the MIO class.
Proof. For this proof we show that the equations given by (∗) imply that A = 0 and all B i for 0 ≤ n < nexcept one are zero. Note that B0 = . . . = Bn−1 = 0 implies that S(X) is no bijection anymore but thetransformation S(X) = A for any input X ∈ E and fixed A ∈ E. Hence, there must exist at least one
non-zero coefficient Bi . W.l.o.g., we assume that B0 is non-zero. Note that this lemma is trivially true foran extension field of degree n = 1. Hence, we assume that E is a proper extension of F and therefore n ≥ 2.
For the proof, we make use of the fact that we can reduce all powers in E by q n − 1. For powers of theform q i this means that we can reduce the power i by n, i.e., all computations are done in the ring Z/nZ
and we can hence assume 0 ≤ a, b, c, d < n in the sequel. Moreover, we can distinguish the following three
types of equations in (∗):
bλλ

1. Equations of the form AB q +a + Bbq Aq = 0 for a + λ ≡ b (mod n). We call them equations of typeb
A. Note that they are related to terms with monomial of the form X q for 0 ≤ b < n.
λ+a

b

λ+a

b

2. Equations of the form Baq Bbq = 0 with the condition a + λ ≡ b (mod n) on the powers. We callthem equations of Hamming weight 1 and say that they are self-dual. Note that each row / column
in the above matrix contains exactly one equation of Hamming weight 1 and that they correspond tobterms with a monomial of the form X 2q for 0 ≤ b > n. As we have q > 2 there is no reduction of
the power here.
λ+cd

3. Equations of the form Baq Bbq + Bcq Bdq = 0 with the following conditions on their powers: first,
we have a 6= b, c 6= d, as we otherwise would include equations from the diagonal. Obviously, we
cannot make the assumption anymore that the right-hand side is equal to zero in this case. Second,
we have a + λ 6≡ b (mod n) and c + λ 6≡ d (mod n) as we obtain equations of Hamming weight 1otherwise. Third, we need a + λ ≡ d (mod n) and c + λ ≡ b (mod n) to ensure that the powers inbd
the monomial X q +q actually match. We call the pair (a, b) the dual of the pair (c, d). Note that
this relation is reflexive, i.e., (c, d) is the dual of (a, b). We call these equations of type B.
Note that equations of type A and equations of Hamming weight 1 do not mix as we have q > 2. Moreover,equations of Hamming weight 1 may not lie on the diagonal as we would have λ + a ≡ a (mod n) in thiscase and hence λ ≡ 0 (mod n), but this violates 0 < λ < n. So far, we did not include any equation fromthe diagonal in our analysis. We come back to them later.
λλInspecting the equation B0q Bλq = 0 of Hamming weight 1, we see that it implies Bλ = 0 as we haveλλλB0 6= 0 (see above). In addition, this implies A = 0 as we have AB0q +Bλq Aq = 0 as an equation of type A.
λ

b

λ+c

λ

For n = 2, we are done. For n ≥ 3, we can now use all equations of type B of the form B 0q Bbq +Bcq Bλq =0. We notice that we need to meet the following conditions: b 6= 0, λ and c 6= 0, λ but c + λ ≡ b (mod n).
We see that we can construct pairs (b, c) meeting this conditions for all b ∈ Z/nZ\{0, λ, 2λ} with 0 < b < n.
Using the above equation we have established that all coefficients B b = 0 as B0 6= 0 and Bλ = 0. Note that
λ 6≡ 2λ (mod n) as we have 0 < λ < n. Moreover, 2λ 6≡ 0 (mod n) is not true either, which we see withthe following argument: due to the size condition on λ, we know that we need to have 2λ = n to make theabove equation hold. We use the condition gcd(q n − 1q λ + 1) = 1 for MIA and gcd(q n − 1q λ + 1) = 2 for
MIO to show that 2λ = n is impossible. Therefore we observe that (q 2λ − 1) = (q λ + 1)(q λ − 1), i.e., thegcd condition is violated for n = 2λ.
All left to show is that the coefficient B2λ is also equal to zero. To this end, we use the equation
q 3λ q 0
q0
q 3λ
B2λ
B0 + B−λB3λ= 0 of type B. In order to force the coefficient B2λ equal to zero, we need B−λ = 0 orB3λ = 0. Therefore, we use the equation B−λ q 0 B0 q 0 = 0 of type Hamming weight 1. As we have B0 6= 0,
this implies B−λ and hence B2λ = 0.
We have now established that all coefficients A = B1 = . . . = Bn−1 = 0. Using the equations on the
diagonal, these conditions also propagate through to the coefficients of the affine transformation T , i.e., to

PQCrypto 2006 Workshop Record

210Equivalent keys in multivariate quadratic public key systems

Ã, B̃a for 0 < a < n. Given that all coefficients but B0 are zero, all equations which have terms of the form
Ba Bb for a 6= 0, b 6= 0 on the left hand side are now also zero, i.e., they do not influence the equations of
j
λ+j
i
λ+i
the form Biq Biq = B̃jq B̃jq for some i, j with 0 ≤ i, j < n. We can not assume i = j here as the matrix
on the right hand side may have been rotated by a constant r ∈ Z+ with 0 ≤ r < n. This is equivalent tothe application of a Frobenius transformation. Still, we established that S, T may have only one non-zerocoefficient in their univariate representation. Therefore, we know that the big sustainer and the Frobenius
sustainer are the only two sustainers applicable to Multivariate Quadratic systems of the MIA and the
MIO type.
¤
Unfortunately, the above proof is not valid in the case q = 2. The reason is that the equations of type Abλλ+aq λ+a−1 q b−1
Bb−1 = 0+ Bbq Aq + Ba−1
and Hamming weight 1 are mapped to one type of equation, namely AB aq
for a + λ ≡ b (mod n). All other powers are also reduced (mod n). However, as soon as we assume A = 0,
the above equation collapses to the original equation of Hamming weight 1, and the rest of the proof isagain applicable. Alternatively, we could assume that any Bi = 0, and derive a similar proof starting withequations of type B. This leads to the following
Corollary 5.2 For q = 2, the affine transformation S in univariate representation either has all coefficients
A, B0 , . . . , Bn−1 not equal to zero or exactly one coefficient Bi non-equal to zero and all other coefficientsequal to zero. The same condition holds for the coefficients Ã, B̃0 , . . . , B̃n−1 of the transformation T .
Still, we were not able to derive a contradiction with the assumption that all of the above values are nonequal to zero, so we have to leave the proof for the case q = 2 as an open problem. However, due to thevery high number of equations of O(n2 ) compared to only O(n) free variables, we conjecture that the abovelemma also holds for q = 2 although we expect a far more technical proof in this case.

6

Conclusions

In this article, we showed through the examples of Hidden Field Equations (HFE), Matsumoto-Imai Scheme
A (MIA), Unbalanced Oil and Vinegar schemes (UOV), and Stepwise-Triangular Systems (STS) thatMultivariate Quadratic systems allow many equivalent private keys and hence have a lot of redundancy
in their key spaces. These results have been summarized in tables 1 and 2. The first gives an overview on
Table 1: Summary of the reduction results of this article

Scheme (Section)
UOV (4.3)
STS (4.4)

MIA (4.2)
MIA- (4.2.1)
HFE (4.1)
HFE- (4.1.1)
HFEv (4.1.2)
HFEv- (4.1.3)

ReductionQ
Qm−1
n−m−1 n−m
q n+mn i=0(q− q i ) i=0 (q m − q i )
´
³
Pi
QL
Qni −1 ni
q m+n i=1 q ni (n− j=1 nj ) j=0(q − q j )´
QL ³ mi (n−Pi mj ) Qmi −1 mi
j
j=1
−
q
)
q
(q
j=0
i=1
n

n(q − 1)qn(q n − 1)Qn−1r

i=n−r−1 (qn− qi )

nq 2n (q n − 1)2
Qn−1
nq (q − 1)(q n−r − 1) i=n−r−1 (q n − q i )Qv−1
00n0 q n+n +vm (q n − 1)2 i=0 (q v − q i )Qn0 −1Qv−1
0
0
00n0 q r+2n vn (q n − 1)2 i=0 (q v − q i ) i=n0 −r−1 (q n − q i )2nn

the formulae achieved while the latter features some numerical examples. The symbols used in Table 1 aredefined as follows: n ∈ Z+ denotes the number of variables, m ∈ Z+ is the number of equations, q := |F|is the number of elements in the ground field F, L the number of layers for STS, and n l , ml for 1 ≤ l ≤ L
the number of new variables and equations, respectively.

211

PQCrypto 2006 Workshop Record

Wolf, Preneel

Table 2: Numerical examples for the reduction results of this article

SchemeParameters

UOV

q = 2, m = 64, n = 192
q = 2, m = 64, n = 256
q = 2, r = 4, L = 25, n = 100
q = 2, r = 5, L = 20, n = 100
q = 2, n = 80
q = 2, r = 7, n = 107
q = 2, v = 7, n = 107
q = 2, r = 3, v = 4, n = 107
q = 128, n = 67
q = 128, r = 11, n = 67STS
HFE
HFEHFEv
HFEvMIA
MIA-

Choices for S, T
(in log2 )37,05465,79020,09620,096
12,056
23,10821,652
22,261
63,78463,784

Reduction(in log2 )32,95657,596
11,315
11,630
326
2129
1160
1258
469
6180

We see applications of our results in different contexts. First, they can be used for memory efficient
implementations of the above schemes: using the normal forms outlined in this chapter, the memory
requirements for the private key can be reduced without jeopardising the security of these schemes. Second,
they apply to cryptanalysis as they allow to concentrate on special forms of the private key: an immediate
consequence from the existence of the additive sustainers from Section 3.1 is that HFE does not gain any
additional strength from the use of affine rather than linear transformations. Hence, this system should be
simplified accordingly. Third, constructors of new schemes should keep these sustaining transformations
in mind: there is no point in having a large private key space — if it can be reduced immediately by anattacker who can just apply some sustainers. Moreover, the results obtained in this article shine new lighton cryptanalytic results, in particular key recovery attacks: as each private key is only a representative of alarger class of equivalent private keys, each key recovery attack can only recover it up to these equivalences
as the public key P cannot contain information about individual private keys but the equivalence classused to construct P.
We want to stress that the sustainers from Section 3 are probably not the only ones possible. We
therefore state as an open problem to look for even more powerful transformations. The only case where
we know for certain that we found all sustainers possible, is the MIO/MIA class. The corresponding proof
can be found in Section 5. We also state as an open problem to find such proofs for the other schemes
discussed in this article. In addition, there are other multivariate schemes which could not be discussed inthis article, due to space limitations. We are confident that they can be analysed using similar techniques
as outlined in this article but have to leave the concrete proof as an open problem.

References[BCBP03]

Alex Biryukov, Christophe De Cannière, An Braeken, and Bart Preneel. A toolbox for cryptanalysis:
Linear and affine equivalence algorithms. In Advances in Cryptology — EUROCRYPT 2003, volume2656 of Lecture Notes in Computer Science, pages 33–50. Eli Biham, editor, Springer, 2003.

[BWP05]

An Braeken, Christopher Wolf, and Bart Preneel. A study of the security of Unbalanced Oil andVinegar signature schemes. In The Cryptographer’s Track at RSA Conference 2005, volume 3376 of
Lecture Notes in Computer Science. Alfred J. Menezes, editor, Springer, 2005. 13 pages, cf http://eprint.iacr.org/2004/222/.

[CGP00a]

Nicolas Courtois, Louis Goubin, and Jacques Patarin. Flash: Primitive specification and supporting
documentation, 2000. https://www.cosic.esat.kuleuven.be/nessie, submissions, 9 pages.

[CGP00b]

Nicolas Courtois, Louis Goubin, and Jacques Patarin. Sflash: Primitive specification and supporting
documentation, 2000. https://www.cosic.esat.kuleuven.be/nessie, submissions, Sflash, 10 pages.

PQCrypto 2006 Workshop Record

212Equivalent keys in multivariate quadratic public key systems[CGP01]

Nicolas Courtois, Louis Goubin, and Jacques Patarin. Quartz: Primitive specification (second revised version), October 2001. https://www.cosic.esat.kuleuven.be/nessie Submissions, Quartz,
18 pages.

[CGP02]

Nicolas Courtois, Louis Goubin, and Jacques Patarin. Sflash: Primitive specification (second revised
version), 2002. https://www.cosic.esat.kuleuven.be/nessie, Submissions, Sflash, 11 pages.

[CGP03]

Nicolas Courtois, Louis Goubin, and Jacques Patarin. Sflashv3 , a fast asymmetric signature scheme— Revised Specification of Sflash, version 3.0, October 17th 2003. ePrint Report 2003/211, http://eprint.iacr.org/, 14 pages.

[DS05]

Jintai Ding and Dieter Schmidt. Rainbow, a new multivariable polynomial signature scheme. In
Conference on Applied Cryptography and Network Security — ACNS 2005, volume 3531 of Lecture
Notes in Computer Science, pages 164–175. Springer, 2005.

[FJ03]

Jean-Charles Faugère and Antoine Joux. Algebraic cryptanalysis of Hidden Field Equations (HFE)
using Gröbner bases. In Advances in Cryptology — CRYPTO 2003, volume 2729 of Lecture Notes in
Computer Science, pages 44–60. Dan Boneh, editor, Springer, 2003.

[GSB01]

W. Geiselmann, R. Steinwandt, and Th. Beth. Attacking the affine parts of SFlash. In Cryptography and
Coding - 8th IMA International Conference, volume 2260 of Lecture Notes in Computer Science, pages
355–359. B. Honary, editor, Springer, 2001. Extended version: http://eprint.iacr.org/2003/220/.

[HWyCL05] Yuh-Hua Hu, Lih-Chung Wang, Chun yen Chou, and Feipei Lai. Similar keys of multivariate quadratic
public key cryptosystems. In Yvo Desmedt, Huaxiong Wang, Yi Mu, and Yongqing Li, editors, Cryptology and Network Security, 4th International Conference, CANS 2005, Xiamen, China, December
14-16, 2005, Proceedings, volume 3810 of Lecture Notes in Computer Science, pages 211–222. Springer,
2005.
[IM85]

Hideki Imai and Tsutomu Matsumoto. Algebraic methods for constructing asymmetric cryptosystems.
In Algebraic Algorithms and Error-Correcting Codes, 3rd International Conference, AAECC-3, Grenoble, France, July 15-19, 1985, Proceedings, volume 229 of Lecture Notes in Computer Science, pages
108–119. Jacques Calmet, editor, Springer, 1985.

[KPG99]Aviad Kipnis, Jacques Patarin, and Louis Goubin. Unbalanced Oil and Vinegar signature schemes. In
Advances in Cryptology — EUROCRYPT 1999, volume 1592 of Lecture Notes in Computer Science,
pages 206–222. Jacques Stern, editor, Springer, 1999.

[KPG03]Aviad Kipnis, Jacques Patarin, and Louis Goubin. Unbalanced Oil and Vinegar signature schemes —extended version, 2003. 17 pages, citeseer/231623.html, 2003-06-11.

[KS99]

Aviad Kipnis and Adi Shamir. Cryptanalysis of the HFE public key cryptosystem. In Advances in
Cryptology — CRYPTO 1999, volume 1666 of Lecture Notes in Computer Science, pages 19–30. Michael
Wiener, editor, Springer, 1999. http://www.minrank.org/hfesubreg.ps or http://citeseer.nj.
nec.com/kipnis99cryptanalysis.html.

[KS04]

Masao Kasahara and Ryuichi Sakai. A construction of public key cryptosystem for realizing ciphtertextof size 100 bit and digital signature scheme. IEICE Trans. Fundamentals, E87-A(1):102–109, January
2004. Electronic version: http://search.ieice.org/2004/files/e000a01.htm\#e87-a,1,102.

[MI88]

Tsutomu Matsumoto and Hideki Imai. Public quadratic polynomial-tuples for efficient signature verification and message-encryption. In Advances in Cryptology — EUROCRYPT 1988, volume 330 ofLecture Notes in Computer Science, pages 419–545. Christoph G. Günther, editor, Springer, 1988.

[MIHM85]

Tsutomu Matsumoto, Hideki Imai, Hiroshi Harashima, and Hiroshi Miyakawa. A cryptographicallyuseful theorem on the connection between uni and multivariate polynomials. Transactions of the IECE
of Japan, 68(3):139–146, March 1985.

[NES]

NESSIE: New European Schemes for Signatures, Integrity, and Encryption. Information Society Technologies programme of the European commission (IST-1999-12324). http://www.cryptonessie.org/.

[Pat95]

Jacques Patarin. Cryptanalysis of the Matsumoto and Imai public key scheme of Eurocrypt’88. In
Advances in Cryptology — CRYPTO 1995, volume 963 of Lecture Notes in Computer Science, pages
248–261. Don Coppersmith, editor, Springer, 1995.

[Pat96a]Jacques Patarin. Asymmetric cryptography with a hidden monomial. In Advances in Cryptology —CRYPTO 1996, volume 1109 of Lecture Notes in Computer Science, pages 45–60. Neal Koblitz, editor,
Springer, 1996.

213

PQCrypto 2006 Workshop Record

Wolf, Preneel[Pat96b]

Jacques Patarin. Hidden Field Equations (HFE) and Isomorphisms of Polynomials (IP): two new
families of asymmetric algorithms. In Advances in Cryptology — EUROCRYPT 1996, volume 1070
of Lecture Notes in Computer Science, pages 33–48. Ueli Maurer, editor, Springer, 1996. Extended
Version: http://www.minrank.org/hfe.pdf.

[PKC05]Serge Vaudenay, editor. Public Key Cryptography — PKC 2005, volume 3386 of Lecture Notes in
Computer Science. Springer, 2005. ISBN 3-540-24454-9.

[Tol03]

Ilia Toli. Cryptanalysis of HFE, June 2003. arXiv preprint server, http://arxiv.org/abs/cs.CR/
0305034, 7 pages.

[WBP04]

Christopher Wolf, An Braeken, and Bart Preneel. Efficient cryptanalysis of RSE(2)PKC andRSSE(2)PKC. In Conference on Security in Communication Networks — SCN 2004, volume 3352
of Lecture Notes in Computer Science, pages 294–309. Springer, September 8–10 2004. Extended
version: http://eprint.iacr.org/2004/237.

[WHL+ 05]

Lih-Chung Wang, Yuh-Hua Hu, Feipei Lai, Chun-Yen Chou, and Bo-Yin Yang. Tractable rational
map signature. In PKC [PKC05], pages 244–257.

[Wol02]Christopher Wolf. Hidden Field Equations (HFE) - variations and attacks. Diplomarbeit, UniversitätUlm, December 2002. http://www.christopher-wolf.de/dpl, 87 pages.

[Wol04]

Christopher Wolf. Efficient public key generation for HFE and variations. In Cryptographic Algorithms
and Their Uses 2004, pages 78–93. Dawson, Klimm, editors, QUT University, 2004.

[Wol05]Christopher Wolf. Multivariate Quadratic Polynomials in Public Key Cryptography. Ph.D. thesis, Katholieke Universiteit Leuven, Belgium, November 2005. http://hdl.handle.net/1979/148,
156+xxiv pages.

[WP04]

Christopher Wolf and Bart Preneel. Asymmetric cryptography: Hidden Field Equations. In European
Congress on Computational Methods in Applied Sciences and Engineering 2004. P. Neittaanmäki, T.
Rossi, S. Korotov, E. Oñate, J. Périaux, and D. Knörzer, editors, Jyväskylä University, 2004. 20 pages,
extended version: http://eprint.iacr.org/2004/072/.

[WP05a]Christopher Wolf and Bart Preneel. Equivalent keys in HFE, C∗ , and variations. In Proceedingsof Mycrypt 2005, volume 3715 of Lecture Notes in Computer Science, pages 33–49. Serge Vaudenay,
editor, Springer, 2005. Extended version http://eprint.iacr.org/2004/360/, 15 pages.

[WP05b]Christopher Wolf and Bart Preneel. Superfluous keys in Multivariate Quadratic asymmetric systems.
In PKC [PKC05], pages 275–287. Extended version http://eprint.iacr.org/2004/361/.

[WP05c]Christopher Wolf and Bart Preneel. Taxonomy of public key schemes based on the problem of multivariate quadratic equations. Cryptology ePrint Archive http://eprint.iacr.org, Report 2005/077,
12th of May 2005. http://eprint.iacr.org/2005/077/, 64 pages.

[YC04]

Bo-Yin Yang and Jiun-Ming Chen. Rank attacks and defence in Tame-like multivariate PKC’s.
Cryptology ePrint Archive http://eprint.iacr.org, Report 2004/061, 29 rd September 2004. http://eprint.iacr.org/, 21 pages.

PQCrypto 2006 Workshop Record

214

The Limit of XL Implemented with Sparse Matrices
Chia-Hsin Owen Chen∗

Bo-Yin Yang†‡

Jiun-Ming Chen§¶

May 16, 2006

Abstract
System-solving algorithms attracted a lot of attention when Jean-Charles Faugèresolved the HFE Challenge 1 using his F5 algorithm. Today, they are the centerpieceof what is known as algebraic attacks and very much a vital technique in cryptology.
Methods that find a Gröbner Bases through the manipulation of extended Macaulay
matrices are called Lazard-Faugère solvers. The state-of-the-art F5 as well as its predecessor F4 , and XL (eXtended Linearization) variants are Gröbner Basis Solvers of theLazard-Faugère family, which solve a polynomial system by manipulating extended
Macaulay matrices. We explore their uses in cracking some multivariate public-key
cryptosystems and try to learn how to optimize system-solving in some cryptologicallysignificant situations. In the process, we try to implement and evaluate XL using sparse
matrices, and arrive at the conclusion that for generic mid-sized field and systems in
the practical range, FXL can potentially outperform more sophisticated F4 -F5 based
methods.
Keywords: system-solving, Gröbner bases, F5 , XL, finite field, optimization.

1

Introduction and Early History

Problem MQ: To solve a polynomial system l1 (x) = l2 (x) = · · · = lm (x) = 0 of m ≥ n(usually quadratic) equations in n variables x = (x1 , x2 , . . . , xn ) over a field F = GF(q).
MQ, or Multivariate Quadratic system-solvings is provably NP-hard generically ([18]).
Any cryptosystem that deals with many variables in a small finite field and not one big unit
depends on its difficulty (including all MQ-schemes a.k.a. multivariates). Among the mostprominent of the cryptosystems is the Rijndael Block Cipher, otherwise known as AES.
Algebraic Attacks means loosely the concept of finding algebraic relations in the structureof a cryptosystem, usually solving it in some fashion to break the scheme. While consensus∗

Dept. of Electrical Engineering, National Taiwan University, Taipei, Taiwan 106, owenhsin@gmail.com
Dept. of Mathematics, Tamkang University, Tamsui, Taiwan 251, by@moscito.org‡
TWISC (Taiwan Information Security Center) at Nat’l Taiwan U. of Sci. and Tech.
§
Dept. of Electrical Eng., Nat’l Cheng-Kung University, Tainan, Taiwan 600, jmchen@cryptomath.com¶
Dept. of Mathematics, National Taiwan University, Taipei, Taiwan†

215

PQCrypto 2006 Workshop RecordChen, Yang, Chenis that Algebraic Attacks do not yet threaten AES [8], it has changed the landscape of
cryptology, leading directly to an earthquake in the field of stream ciphers [9].
We discuss modern methods to solve such problems in a cryptology context. Each descends from Buchberger’s algorithm of finding lex-ordered Gröbner Bases [5]. This is ubiquitous in symbolic mathematics packages, both commercial (e.g., Maple) and free (e.g.,
Singular).
Prof. Daniel Lazard [22] suggested tweaking the original Buchberger algorithm by reducing all computations to an elimination on what is called an extended Macaulay matrix[23]. Based on this idea, his student Jean-Charles Faugère proposed a great improvement of
Buchberger algorithm called F4 . F4 has been implemented in MAGMA [24]. A later version,
F5 , made headlines 3 years later [17] when it was used to solve the HFE Challenge 1.
Meanwhile, the idea is rediscovered independently in 1999 by Courtois-Klimov-PatarinShamir [11] as XL. Courtois et al development two useful variants or rather techniques
complementary to XL. One, XL2, proved to be a rough equivalent to the idea behind F4 .
Fixing (guessing variables) was proved to be a further improvement by Yang et al. The otherideas (XFL, XLF and XL’) turned out not to have been such great improvements [29, 30].
In the following, we will briefly go over known theory and consensus in the area. Thenwe will report on some relevant experiments. They have been for the most part in line withtheoretical predictions. We also discuss some practical implications on cryptography.

2

The XL, F4, and F5 Algorithms

F4 , F5 , and XL algorithms were analyzed in depth recently [2, 3, 11, 12, 15, 16, 17, 28, 29, 30].
2
In the following, we denote by xb the monomial xb11 xb2 · · · xbnn , and its total degree |b| =b1 + · · · + bn . T = T (D) = {xb : |b| ≤ D} is the set of degree-D-or-lower monomials.

2.1

XL

Multiply each equation li by all monomials xb ∈ T (D−2) . Reduce as a linear system theequations R(D) = {xb lj (x) = 0 : 1 ≤ j ≤ m, |b| ≤ D − 2}, with the monomials xb ∈ T (D)as independent variables. Repeat with higher D until we have a solution, a contradiction, or
reduce the system to a univariate equation in some variable. The number of monomials will
be denoted T (D) = T = |T |, total number of equations R(D) = R = |R|, and the number of
independent equations I (D) = I = dim(spanR).
(1 − tq )nwhich reduces
Proposition 1 ([2, 28]) The number of monomials is T = [tD ](1 − t)n+1¡n+D¢
to D when q is large. We can then find R = R(D) = mT (D−2) .
Proposition 2 ([28]) If equations li are semi-regular, then for all D < DXL , we have for
XL
µ
¶m
q n
1 − tkD
D (1 − t ).
(1)
T − I = [t ] Gm,n (t) = [t ](1 − t)n+1 1 − tkq

PQCrypto 2006 Workshop Record

216

The limit of XL implemented with sparse matrices

The degree of regularity DXL := min{D : [tD ] Gm,n (t) ≤ 0} is the smallest D such that Eq. 1
cannot hold if the system has a solution. D0 , the (minimal) operative degree, is never greaterthan and usually equal to DXL . If (li )i=1···m are non-semi-regular, I can only decrease.
Proposition 3 ([12, 29]) T − I = [tD ] ((1 − t)m−n−1 (1 + t)m ) for generic quadratic equa∞∞), where DXL
is the degree of the lowest term with a non-positive cotions if D ≤ min(q, DXL∞
m−n−1efficient in of Gm,n (t) = (1−t)(1+t)m . For non-generic equations I may only decrease.
Lazard proposed a matrix form [22] but in short we multiply every degree k equation by
all monomials up to degree D − k, then solve a deg ≤ D system linear in all monomials.

2.2

XL2

XL2 is an improved version of XL whose most up-to-date version can be written as follows[29]: Start by tagging each equation with its maximal degree. Run an elimination on thesystem with monomials in degree-reverse-lex. In the remaining (row echelon form) system,
multiply by each variable x1 , x2 · · · all remaining equations with the maximum tagged degree
and eliminate again. When we cannot eliminate all remaining monomials of the maximum
degree, increment the operating degree and reallocate more memory.

2.3

F4 and F5

We can say that XL/XL2 is a primitive F4 , or (since XL came first) that F4 and F5 are an
improved version of XL/XL2. In F4 , the matrix is not built at once and there is elimination
in between expansion stages, which compresses the number of rows that needs to be handled.
F5 is a further refinement of F4 . The set of equations is actually build generated one by
one (or the matrix row by row). In the process, an algebraic criterion is used to determine,ahead of an elimination process, whether a row will be reduced to zero or not and only
the meaningful rows are retained. A complication resulting from the tagging is that theelimination must be done in a strictly ordered way corresponding to no row exchanges everin a Gaussian.
For complete details of F4 /F5 , we refer you to [15, 16]. There are two separate conceptsof degree here, an apparent operating degree DF 4 and a higher intrinsic degree. The latter isthe degree of the equivalent XL system. XL2 and F4 have similar operating characteristics
and they are shown to be roughly equivalent [29].
Proposition 4 ([3, 29]) If equations li are semi-regular, F4 -F5 terminates at operating
degreeµ¶m¾½
q n
1 − tkD (1 − t )<0 .
Dreg := min D : [t ](1 − t)n1 − tkq

217

PQCrypto 2006 Workshop RecordChen, Yang, Chen

m−n
0
1
2

DXL
Dreg
m
2
m
m
d m+1
e
2√
m+2− m+2
m+1
d 2 e d
e
2

n=9
6.090
1.240
20.320n = 1046.7708.970
2.230

n = 11350.53053.73012.450n = 123322.630
413.780
88.180n = 13sigmem2538.870
436.600

Table 1: System-solving time (seconds): MAGMA 2.12, 2GB RAM, Athlon64x2 2.2GHz

2.4

Current Limitations of Solvers

Table 1 gives some test results with MAGMA 2.12 for generic equations over GF(256):
That we only have 2GB memory is not critical to our inability to solve equations in therealm of 20 byte-sized variable in as many equations, because we also ran into a SIGMEM(out of memory) error with a 15-variable, 15-equation system on a 4-core, 16 GB RAM
system.
Table 1 also confirms that guessing is important in generic systems. Simulations by
Christopher Wolf [27] establishes at least for the MAGMA implementation of F4 , guessing
at the correct number of variables does speed up operations also for GF(2). For larger fields,
F4 -F5 (or XL2) need m − n ≥ 1, while XL need m − n ≥ 2. The optimal [29, 30] is often
more.
As mentioned before, F4 -F5 represents the state of the art in system-solving today. In
the rest of this text, we will look at ways to speed up a Lazard-Faugère solver.

3

Gaussian and Generalized Gaussian Elimination

According to the description we received from the MAGMA project and Dr. Faugère, eventhough memory management is very critical, elimination is still relatively straightforwardin F4 -F5 , and in the process we see reasonably dense matrices, not extremely sparse ones.
There are many ways to solve or reduce a system Ax = b. The best one depends on thecontext.

3.1

Alternative Elimination Methods

The classical method of equation-solving is suggested by Karl Friedrich Gauss.The timecomplexity or the number of operations (in particular multiplications) is ∼ N 3 /3 where N
is the number of variables or columns. If we are operating with a very unbalanced system
of M rows where M − N is large, then [7] the cost is usually given as ∼ M (N 2 /2 − M 2 /6)
or N 2 M/3.
In theory, far better ways to reduce than a straight Gaussian exist, because any methodof rapidly multiplying two matrices can be adapted into a method of reducing a matrix, byusing Bernstein’s Generalized Gaussian Elimination [4]. Berstein showed that if two N × N
matrices can be multiplied in time ∼ αN ω , then an M × N matrix equation can be reducedωωM ω−1 N + (2αMin time ≤ 2α(1+γ)− 4). Thus, from the often-citedω −1) , where γ := (7α)/(2(2ω −2)

PQCrypto 2006 Workshop Record

218

The limit of XL implemented with sparse matrices

Coppersmith-Winograd method which is ∝ N 2.368 or the more common Strassen’s Blocking[25] we can build elimination methods. For the latter we can reduce systems in ∼ 4N 2.8 [6].

3.2

Why Simple is Often BestIn these kind of papers, authors often blithely invoke the Coppersmith-Winograd Boundof N 2.368 without mentioning the context. The CW method is elegant and mathematically
beautiful. It is however often neglected in these analyses that those constant factors do
count.
To show why this is the case, let’s take the Bunch-Hopcroft version of Strassen’s Blocking
Elimination (which cuts each matrix into equal quarters and do 7 sub-reductions per halving)which is already distinctly non-trivial. The number of multiplications is optimistically 4N 2.8
which means no savings in multiplications until a quarter of a million rows (N = 2.5 × 105 ).
Add bookkeeping overhead and memory locality issues, and we may conclude that Gaussian elimination will dominate more intricate methods until we are almost out of “practical”
range even as we approach the hundred-gigabyte machine, especially if we consider this trick(initially due to Jintai Ding to the best of our knowledge and research):
Streaming Gaussian: Let’s take for example F = GF(28 ), with each element represented bya byte, and each row be stored contiguously in memory. Assume that we wish to conduct theelimination of the first column pivoted at the top left corner. We may facilitate the processby building all 255 multiples of the first row and index them by the leading element. Since weare dealing with a char-2 field, we may now XOR each row with the appropriate multiple ofthe first row. With appropriate prefetching (today often in hardware) and long SIMD units,a multiplication is now reduced to nearly a single byte written out to memory at streaming
speed.
We give an example of how well this works. A current PC based around a Pentium 4 3GHz
CPU can write out to memory at nearly 10GB/s, on a dual channel, double-pumped 400
MHz memory bus, ≈ 0.3 cycles per multiplication. The upcoming Opterons are reputedly
capable of doing 16GB/s with the CPU speed at 2GHz, or 1 cycle per 8 multiplications.
A “normal” multiplication (see below) takes a bit more than 3 L1 cache access times (10cycles for K8, 15 cycles for the P4) for a edge to the Gaussian by a factor of 50–80 or ≈ 26 .
This factor gets worse, not better when we work on larger char-2 fields. Suppose weare working with GF(216 ) which is stored as two additive bytes. We only need to build a510-rows-long table (with the leading element being hex 0001, 0002, . . . 00FF, then hex 0100,
0200, . . . , FF00). Now we can reduce a multiplication to two byte of streamed writes, whenthe multiplications takes about 3.5 times as long (using a form of Karatsuba [20]).
Note that this type of speed-up is not always possible in versions of F4 -F5 where rows
are generated and reduced one by one. So while on GF(2) the elegant F5 is impressively
good, it is hard [on a mid-sized char-2 field] to top the Courtois-Yang variant of XL2 with
Streaming Gaussian. An obvious answer is to take advantage of the sparsity of Macaulay
matrix.

219

PQCrypto 2006 Workshop RecordChen, Yang, Chen

3.3

Wiedemann for XL

Three well-known methods (all utilizing the existence of Krylov subspaces) adapt to sparse
matrices: Conjugate Gradient, Lanczos, and Wiedemann. There are two reasons that wewill choose Wiedemann. While Lanczos and CG usually takes about N (as opposed to
3N ) multiplications by the matrix A, they are restricted to symmetric matrices. Anothersignificant issue is that the matrix is not square. Usually R/T is on the order of “a few”. If
we multiply by AT A instead, we are giving away half of our advantages already. It is alsobothersome that in finite fields there is the problem of self-orthogonal vectors which despite
attempted improvements using randomization [14, 21] that we tried to implement, leads toa rate of failure that is way too high – with n = 10 or so we can fail more than 1000 times
before getting a good answer.
How do we handle this problem? Earlier in 2004, Nicolas Courtois conjectured that wemay pick (1 + ²)T of the R equations and have a linearly independent set. Jintai Ding
gave heuristic arguments, that if we pick rows at random under the constraint that we haveenough equations at each level (this is computable by techniques in [29]), then usually wewill have a linearly independent set. We evaluated the pessimistic probability of having agood system as & 1/3 for T up to hundreds of thousands and & 1/10 into the billions.
In all our tests in the overwhelming majority of the cases we had a consistent system on
the first attempt when the system is solvable and never tested more than twice.
Lastly, Prof. Faugère communicated to us that if we eliminate with a Gaussian thematrices will evolve into non-sparse ones and the same ideas don’t apply. So not only are
we doing Wiedemann’s method for speed, we are also doing it for memory considerations.

4

Implementing Wiedemann for XL

Dr. Douglas Wiedemann [26] proposed this approach to solve a sparse system of equations
over finite fields. It is based on the fact that, when a square matrix is repeatedly applied
to a vector, the resulting vector sequence is linearly recursive. The problem is to solve thelinear system Ax = b. Suppose A is a nonsingular N × N matrix and f (z) is the minimal
polynomial of A. Since A is nonsingular, z is not a factor of f (z), and it can be normalized
as f (z) = cm z m + cm−1 z m−1 + · · · + c1 z + 1. If f is found, we havex = −(cm Am−1 b + cm−1 Am−2 b + · · · c1 b)
because f (A)b = (cm Am + cm−1 Am−1 + · · · + c1 A + IN )b vanishes.

4.1

A Brief Description of Our Sparse Matrix Solver

Suppose u is a unit column vector. Since the sequence {Aj b}j=0 satisfies the linear recurrence©
ªassociated to f , the sequence uT Aj b j=0 also satisfies the linear recurrence fu which is aproper divisor of f . Therefore, we may invoke
algorithm to compute© the Berlekamp-Masseyªfu from the first 2N terms of the sequence uT Aj b j=0 . A schematic of the algorithm is:

PQCrypto 2006 Workshop Record

220

The limit of XL implemented with sparse matrices

1. Compute Ai b for j = 0 · · · 2N − 1.
2. Set k = 0 and g0 (z) = 1.
3. Set uk+1 to be the (k + 1)-st unit vector
4. Extract the sequence from the result of step 1 (the (k+1)-st component of each vector).
5. Apply gk as a difference operator to this sequence.
6. Run Berlekamp-Massey on the produced sequence and find minimal polynomial fk+1 (z).
7. Set gk+1 := fk+1 gk and k := k + 1. If deg(gk ) < N and k < n, go to step 3.
8. Compute the solution xwith f = gk and the table obtained in step 1,
This takes 2N multiplications by A if we have enough space (2N 2 slots) to store thevectors, plus the time to run Berlekamp-Massey. 1 multiplication by A takes wN multiplications in F where w counts the nonzero elements per row (. n(n + 3)/2). When we don’t
have that space (as is often the case when A is sparse), we may throw away vectors as webuild them and recompute, bringing us up to 3N multiplications by A.

4.2

Testing Procedure over GF(28 )1. Generate a testing quadratic equation set with specific n and m and store it into a file.
2. Read the file and setup system.
3. Raise the system to a certain degree DXL as in Section 2.
4. Randomly select rows to form a new system, Ax = b.
5. Apply Wiedemann’s method to solve x.
6. Obtain the solution from the last few elements of x and check its correctness.
The matrix is in log-form (multiplying in GF(28 )is typically done with a log table) to savetime.
We have also tested systems that are unsolvable (this can be checked via XL with Gaussian) when possible. Note that XL with Wiedemann will only work for f = m − n ≥ 2(cf. [29]).

5

Results and Discussion

The theoretical timing for XL with Wiedmann is given by 3rT 2 (c0 +c1 lg T ) and c0 T 3 /3. Herer is the bound on the number of non-zero coefficient in each equation, usually (n+1)(n+2)/2.
However, as we showed above, c0 can be made very small. In practice c1 is very small andc0 /c0 ∼ 26 . So in trying to find an optimal solver, we need to take into account these effects.

221

PQCrypto 2006 Workshop RecordChen, Yang, Chen

f
2

3

4

5

n
D
CXL
M
M’
D
CXL
M
M’
D
CXL
M
M’
D
CXL
M
M’

3
3

4
4

5
4

6
5

7
5

2.03 · 10−2

1.24 · 10−22.50 · 10−2

1.30 · 10−1

4.11 · 10−1

210.0
219.9
3

212.7
220.0
3

214.0
220.0
4

216.5
220.2
4

217.6
220.4
5

1.56 · 10−2

1.56 · 10−2

2.05 · 10−2

4.53 · 10−2

4.08 · 10−1

10.2

2
219.9
3

11.4

2
219.9
3

14.0

2
220.0
4

15.1

2
220.0
4

17.7

2
220.5
4

9.40 · 10−3

6.20 · 10−3

1.88 · 10−2

3.76 · 10−2

9.84 · 10−2

10.5

2
219.9
3

11.5

2
219.9
3

14.3

2
220.0
3

15.3

2
220.1
4

16.1

2
220.2
4

8
6
6.71
220.1
221.4
5
1.22
218.6
220.5
5
1.44
218.8
220.6
4

7.80 · 10−3

1.57 · 10−2

1.41 · 10−2

4.23 · 10−2

8.72 · 10−2

1.91 · 10−1

210.6
220.0

211.7
220.0

212.6
220.0

215.4
220.1

216.2
220.2

217.0
220.3

9
6

10
7

11
7

12
8

13
8

2.87 · 10

5.24 · 102

1.58 · 103

2.87 · 104

8.44 · 104

221.0
222.1
6

223.5
224.3
6

224.4
225.2
6

226.8
227.5
7

227.7
228.4
7

2.88 · 10

8.61 · 10

2.89 · 102

4.44 · 103

1.20 · 104

21.2

22.0

22.8

2
223.7
6

25.3

2
226.1
6

226.1
226.8
7

2.87 · 102

5.98 · 102

1.19 · 104

22.9

2
223.7
5

23.7

2
224.5
6

226.2
226.9
6

2.87 · 10

5.98 · 102

1.44 · 103

221.1
222.1

223.7
224.5

224.4
225.2

2
222.2
5
3.39
219.6
221.1
5
3.39
219.7
221.1

2
222.9
5
9.35
220.3
221.5
5
9.69
220.4
221.6

Table 2: Final Results for XL-Wiedemann, MS C++ 7; P-D 3.0GHz, 2GB DDR2-533
Pre-allocated memory size: 219.9 , M: theoretical memory size, M’: actual memory size, T: average time inseconds. For small n, the required memory the pre-allocated memory size. As n increases, it requires
approximately 1.6 times of the theoretical memory size (due to the memory alignment).

5.1

How Optimized is this Algorithm

We may compute that for m = 15, n = 13, DXL = 8 and T = 203490. We did some 1.3×1013
multiplications in GF(28 ). This averages out to a bit less than 20 cycles per multiply.
Since if we arrange the matrix first by rows then by columns we will need to read ina matrix element (log-form), then read a vector component (log-form), then look up theanti-log and add, all the latencies concatenate and we have at least 3 L1 access times plus
various arithmetic and logical instructions. For Pentium 4’s, the L1 latency is 4 cycles anda tight limit should be about 17 cycles per field multiplication. With some overhead, we areat about 85% of the theoretical optimum. Also note that T before goes up over 1024 , thelogarithmic term is zero, and it takes a long time to get there.

5.2

Comparison to XL-Gauss

It is long known that [17] for MQ, the equations R in XL is structured and the top ¡block of¢the elimination is the rate determining step in XL-Gauss. This let us substitute T ∗ = T +D−1
D
instead of the original T . Mr. Yu-Hua Hu [19] produced these timings: (m, n) = (10, 8): 1
second; (m, n) = (11, 9): 17.9 seconds; (m, n) = (12, 10): 173.11 seconds. He is twice theprogrammer we are, since his speed is twice that of ours. Indeed, he is running at about
0.38 cycles a multiplication, which is very close to optimal (cf. Section 3.2). There is a highcoefficient of linearity dependence so our cycle count estimates are fairly good for larger
systems.
However, extrapolating from these numbers, our XL-Wiedemann will match his XL-

PQCrypto 2006 Workshop Record

222

The limit of XL implemented with sparse matrices

Gauss at around m = 14, n = 12, and it would take a computer with 26GB of RAM for him
to run his
at m = 15, n = 13, because an XL-Gauss program would need to hold¡ program¢at least 20=
125970equations of the top block (actually more) at 200,000 entries a row.
8

5.3

Possibly Overtaking F4 (or F5 )By virtue of having to guess at one fewer variable, F4 -F5 (or XL2) should enjoy a great
advantage when n is small. At the moment, FXL-Wiedemann is able to solve 8 by 8 system(a set of 8 variables in 8 quadratic equations) over GF(28 )reliably in 4 × 103 seconds, a 9 by
9 in 1.4 × 104 seconds (4 hours) and 10 by 10 in 2.2 × 105 seconds (3 days). This is a lot
slower than F F4 , since according to Table 1, a 14 by 14 system can be done in 7.5 days with
one guess.
However, we expect that for large enough systems, FXL will eventually be faster even if
we discount the memory problem. Asymptotics similar to that of [30] shows that a LazardFaugère solver using Gaussian elimination uses time O(23.4n · poly(n)) on a system with nequations and variables over GF(256) (this is roughly in line with Table 1) and O(22.8n ·poly(n)) when using a Strassen-like solver. Compare this with O(22.4n · poly(n)) when usinga Lanczos-class sparse solver, and we can estimate that FXL will catch up with F F4 (F4with guessing) around m = n = 19. Actually, with 3 guesses FXL takes almost exactly 280
cycles for m = n = 20. If from the data we have about current F4 -F5 implementations, we
guesstimate that the rate-determining step for F F4 is a Gaussian-class elimination on the
top-degree block at D = Dreg , then we see a MAGMA-like F4 -based solver with sufficient
memory be overtaken around m = n = 20, and a F4 -based solver using Strassen-classelimination will be overtaken by FXL (with Wiedemann) around m = n = 23.

References[1] M. Bardet. Étude des systémes algébriques surdéterminés. Applications aux codes correcteurs et é la cryptographie. PhD thesis, Universitè Paris VI, Décembre 2004.
[2] M. Bardet, J.-C. Faugère, and B. Salvy. On the complexity of Gröbner basis computation of semi-regular overdetermined algebraic equations. In Proc. ICPSS, 2004.
[3] M. Bardet, J.-C. Faugère, B. Salvy, and B.-Y. Yang, Asymptotic Behaviour of the Degreeof Regularity of Semi-Regular Polynomial Systems, Proc. MEGA’05 (Alghero, 2005).
[4] D. Bernstein, Matrix Inversion Made Difficult, preprint at http://cr.yp.to.
[5] B. Buchberger Ein Algorithmus zum Auffinden der Basiselemente des Restklassenringes
nach einem nulldimensionalen Polynomideal. PhD thesis, Innsbruck, 1965.
[6] J. R. Bunch and J. E. Hopcroft, Triangular Factorizations and Inversion by Fast Matrix
Multiplication, Math. Computations, 24 (1974), p. 231–236.

223

PQCrypto 2006 Workshop RecordChen, Yang, Chen

[7] R. Burden and J. D. Faires, Numerical Analysis, 7th ed., PWS-Kent Publ. Co., 2000.
[8] C. Cid, G. Leurent, An Analysis of the XSL Algorithm, Asiacrypt 2005, lncs 3788,
p. 333–345.
[9] N. Courtois and W. Meier, Algebraic Attacks on Stream Ciphers with Linear Feedback,Eurocrypt 2003, lncs 2656, p. 345–359.
[10] D. Coppersmith and S. Winograd, Matrix Multiplication via Arithmetic Progressions,J. Symb. Comput. 9 (1990) p. 251–280.
[11] N. Courtois, A. Klimov, J. Patarin, and A. Shamir, Efficient Algorithms for Solving
Overdefined Systems of Multivariate Polynomial Equations, Eurocrypt 2000, lncs 1807,
p. 392–407.
[12] C. Diem. The XL-Algorithm and a Conjecture from Commutative Algebra. Asiacrypt
2004, lncs 3329, p. 323–337.
[13] J. Ding, private communication.
[14] W. Eberly, E. Kaltofen, On Randomized Lanczos Algorithms, Proc. ISSAC ’97, p. 176–
183, ACM Press ’97.
[15] J.-C. Faugère. A new efficient algorithm for computing Gröbner bases (F4 ). J. Pure
Appl. Algebra, 139(1-3):61–88, 1999. Proc. MEGA’98 (Saint-Malo, 1998).
[16] J.-C. Faugère. A new efficient algorithm for computing Gröbner bases without reduction
to zero F5. In T. Mora, editor, Proceedings of ISSAC, p. 75–83. ACM Press, July 2002.
[17] J.-C. Faugère and A. Joux. Algebraic cryptanalysis of Hidden Field Equation (HFE)
cryptosystems using Gröbner bases. Crypto 2003, lncs 2729, p. 44–60.
[18] M. Garey and D. Johnson, Computers and Intractability, A Guide to the Theory of
NP-completeness, W. H. Freeman, NYC 1979.
[19] Y.-H. Hu, private communication.
[20] A. Karatsuba and Yu. Ofman, Multiplication of Many-Digital Numbers by AutomaticComputers, Doklady Akad. Nauk SSSR 145(1962), p. 293-294. Translation in PhysicsDoklady 7(1963), p. 595-596.
[21] B. LaMacchia and A. Odlyzko, Solving Large Sparse Linear Systems over Finite Fields,
Crypto ’90, lncs 537, p. 109–133.
[22] D. Lazard. Gaussian Elimination and Resolution of Systems of Algebraic Equations.
EUROCAL 83, lncs 162, p. 146–157.

PQCrypto 2006 Workshop Record

224

The limit of XL implemented with sparse matrices[23] F. S. Macaulay. The algebraic theory of modular systems., vol. xxxi, Cambridge Mathematical Library. Camb. Univ. Press, 1916.
[24] MAGMA Computational Algebra System (http://magma.maths.usyd.edu.au/).
[25] V. Strassen, Gaussian Elimination is not Optimal, Numer. Math. 13 (1969) p. 354-356.
[26] D. Wiedemann, Solving Sparse Linear Equations over Finite Fields, IEEE Trans. on
Info. Theo., v. IT-32 (1976), no. 1, p. 54–62.
[27] C. Wolf, private communication.
[28] B.-Y. Yang and J.-M. Chen, Theoretical Analysis of XL over Small Fields, ACISP 2004,
lncs 3108, p. 277-288.
[29] B.-Y. Yang and J.-M. Chen, All in the XL Family: Theory and Practice, ICISC 2004,
lncs 3506, p. 67–86.
[30] B.-Y. Yang, J.-M. Chen and N. Courtois, On Asymptotic Security Estimates in XL andGröbner Bases-Related Algebraic Cryptanalysis, ICICS 2004, lncs 3269, p. 401-413.

225

PQCrypto 2006 Workshop Record

Zhuang-Zi: A New Algorithm for Solving
Multivariate Polynomial Equations over a Finite
Field
Jintai Ding1, Jason E. Gower1 and Dieter S. Schmidt2
Department of Mathematical Sciences1
Department of Electrical & Computer Engineering and Computer Science2
University of Cincinnati
Cincinnati, OH 45220
USA
ding@math.uc.edu, gowerj@math.uc.edu, dieter.schmidt@uc.edu

Abstract. We present the Zhuang-Zi algorithm, a new method for solving multivariate polynomial equations over a finite field. We describe thealgorithm and present examples, some of which cannot be solved withthe fastest known algorithms.
Keywords: multivariate polynomials, Hidden Field Equation, polynomial roots

1

Introduction

Solving a single variable polynomial equation or a set of multivariate polynomial
equations has always been at the center of the development of mathematics. It
is not only inspired by our curiosity, but also by the ubiquitous role these simple
but fundamental problems play in all branches of science.
Though the Babylonians did not invent the notion of an “equation,” theyfound the first algebraic solution to problems, which gave rise to what we call asingle variable quadratic equation today. The first known solution of this problem
is given in the Berlin papyrus from the Middle Kingdom of Egypt (circa 2160–
1700 BC) [Smi52].
Though the first great success is surely solving the single variable quadratic
equation, the next successes came much later with Ferro solving the single variable cubic equation and Ferrari solving the single variable quartic in the 16th
century. However Galois’ theory put an end to the hope of finding an elegant
algebraic formula for higher order single variable equations.
The situation is very different in the multivariate case. The real great successis the Gröbner basis method [Buc65], which comes from the ideas of modern
algebraic geometry. Solving polynomial equations over the integers is also a very
interesting direction, for example Fermat’s last theorem, but it is a completely
different story which we will omit here.
227

PQCrypto 2006 Workshop Record

Ding, Gower, Schmidt

A very different and modern direction is to solve multivariate equations overa finite field. Recently much effort in this area has been inspired by the appearance of multivariate public key cryptography. For the single variable case,there are very efficient algorithms, such as the Berlekamp algorithm, for factoring polynomials of relatively low degree. For the multivariate case, one can also
use an extension of the Gröbner basis.
The idea of a public key cryptosystem was first suggested by Diffie andHellman. The first practical implementations were the Diffie–Hellman Protocol,
which uses discrete logarithm, and RSA, which uses the product of two large
prime numbers. Public key cryptography allows any two parties to communicate securely over an open communication channel, like the Internet, and it now
plays a fundamental role in our communication systems. However recent developments in quantum computing, in particular Peter Shor’s polynomial-time
integer factorization algorithm, shows that a quantum computer can be used tobreak RSA. Thus there has been great interest in constructing other public key
cryptosystems.
One alternative is to use multivariate polynomials, and in particular quadratic
polynomials. The security of such constructions is suggested by the proven theorem that solving a set of multivariate polynomial equations over a finite field is,in general, an NP-hard problem [GJ79]. Nevertheless, this result is not enoughto guarantee the security of such a cryptosystem.
Recent research in multivariate public key cryptography has stimulated asearch for new methods for solving multivariate polynomial equations over afinite field, along the line of Gröbner bases. Examples include XL [CKPS00]
and the enhanced Gröbner bases methods F4 and F5 of Faugère [Fau99,Fau02].
Inspired by the work in this area, we propose a new algorithm to solve a set of
multivariate polynomial equations over a finite field.

2

BackgroundLet k be a finite field with q elements and suppose we have m polynomials
f0, f1 , . . . , fm−1 ∈ k[x0, x1, . . . , xn−1]. We wish to find all (a0, a1, . . . , an−1) ∈ kn ,such thatf0 (a0 , a1, . . . , an−1) = 0
f1 (a0 , a1, . . . , an−1) = 0(1)..
.
fm−1 (a0, a1, . . . , an−1) = 0
We may as well work in the ringk[x0, x1, . . . , xn−1]/(xq0 − x0, xq1 − x1, . . . , xqn−1 − xn−1),
though for convenience we will abuse notation and write k[x0, x1, . . . , xn−1].
The key idea of our new algorithm is to shift perspectives from the space ofpolynomials k[x0, x1, . . . , xn−1] with coefficients in the small field k, to a spaceof polynomials K[X] with coefficients in some suitably chosen extension field K.
PQCrypto 2006 Workshop Record

228

Zhuang-Zi: a new algorithm for solving multivariate polynomial equations over a finite fieldTo simplify matters, let us assume that m = n. Choose any irreducible polynomial g(y) ∈ k[y] of degree n. Then K = k[y]/(g(y)) is a degree n field extensionof k. Let φ be the standard k-linear map that identifies K with the n-dimensional
vector space kn , i.e., φ : kn −→ K, defined by
φ(a0, a1, . . . , an−1) = a0 + a1 y + · · · + an−1yn−1(2)

Let f : kn −→ kn be the polynomial map defined by f = (f0 , f1, . . . , fn−1).
We can lift f up to the extension field K using φ to create a map F : K −→ K
defined by
F = φ ◦ f ◦ φ−1 .
Using the Lagrangian interpolation formula, we can think of F as a polynomialin K[X], where X is an intermediate. In fact, F has a unique representation innthe quotient space K[X]/(X q − X). For any given f, the corresponding F canbe calculated by solving a set of linear equations. The following theorem tells us
the exact form of this representation.
Theorem 1. Using the notation as defined above, for a linear polynomial map
f = (f0 , f1, . . . , fn−1) we have
F (X) =n−1
Xi

βi X q + αnmod (X q − X),

i=0

for some βi , α ∈ K. If f is a quadratic polynomial map, thenF (X) =

n−1
X n−1
X
i=0 j=iijγij X q +q +

n−1
X

i

n

βi X q + α mod (X q − X),

i=0

for some γij , βi, α ∈ K. Representations for higher order polynomial maps are
similarly described. In the case of q = 2, the formulas are slightly different.
In this paper, we will identify the map F with its corresponding representation
given in Theorem 1.
It is now clear that we can move freely between multivariate functions andsingle variable functions, and we will do so in order to solve the original system of
equations. This is the basic idea of Matsumoto-Imai, Patarin, Kipnis and Shamir[MI88,Pat00,KS99], and is also the basis of our algorithm. Given a system of
equations such as (1), the basic strategy will be to lift the associated polynomial
map f to the map F in the extension field K. The roots of the representationof F given in Theorem 1 correspond exactly with the solutions to the original
system of equations defined over k. Once we have the roots in K, we can descend
down to kn with φ−1. It remains to develop techniques for reducing the degree ofF , which if successful, will allow us to use efficient algorithms for solving single
variable polynomial equations.
We note a fundamental difference between our algorithm and others whichis that ours can be used only with finite fields and cannot be used with fields of229

PQCrypto 2006 Workshop Record

Ding, Gower, Schmidt

characteristic zero. The reason for this is that the lifting from the multivariate
system to a single variable equation works very well for a finite field, but notfor characteristic zero cases. However, in the case of finite fields, our algorithm
unifies the two problems of solving single variable and multivariate polynomial
equations into a single problem. We have named this algorithm after Zhuang-Zi,
an ancient Chinese philosopher who we believe was one of the first to propose
the idea of shifting from a local view of problems to a global view.
The remainder of this paper is organized as follows. We will explain thebasic algorithm, including a method to reduce the degree of F , and present a
toy example in order to show how the algorithm works. We then present moremeaningful examples and conclude with a discussion of future work.

3

The Zhuang-Zi Algorithm

We will start with the standard case of m = n, where we have the same number of variables and equations. The Zhuang-Zi algorithm takes the polynomials f0 , f1, . . . , fn−1 ∈ k[x0, x1, . . . , xn−1] and a positive integer D as its input,
where D is the upper bound on the degree of a polynomial equation which
can be solved efficiently. When successful the algorithm returns all n-tuples(a0, a1, . . . , an−1) ∈ kn such that fi (a0 , a1, . . . , an−1) = 0, for i = 0, 1, . . ., n − 1.
Step 1: Choose any degree n irreducible polynomial g(y) ∈ k[y] and define K =k[y]/(g(y)). Let φ : kn −→ K be as defined in (2). Define f = (f0 , f1, . . . , fn−1),lift this to K by F = φ ◦ f ◦ φ−1, and compute the polynomial representationnof F (X) modulo X q − X. If the deg (F (X)) ≤ D, then go to the last step;otherwise continue to the next step.
Step 2: Let G = Gal(K/k) be the Galois group of K over k consisting of theiFrobenius maps Gi (X) = X q , for i = 0, 1, . . ., n − 1. Calculate
Fi(X) = Gi ◦ F (X) = F (X)qinmod (X q − X),

for i = 0, 1, . . ., n − 1. Note that F0(X) = F (X).
Step 3: Let N be the total number of monomials that appear in any Fi (X).
For each Fi(X) create a row vector in K N , where the entries are the coefficientsof Fi (X) listed in decreasing order, and construct an n × N matrix using theserow vectors. Then use Gaussian elimination to produce a new set of t basis
polynomials S = {S0(X), S1 (X), . . . , St−1(X)}. In other words eliminate themonomials in the order of the highest degree first. Label the elements of S sothat St−1(X) is the element of lowest degree. If deg (St−1 (X)) ≤ D, then go to
the last step; otherwise continue to the next step.
Step 4: It must be that the polynomial of minimal degree in S has degree greaterthan D. For each i = 0, 1, . . ., t − 1 and j = 0, 1, . . ., n − 1 computej

X q Si (X)PQCrypto 2006 Workshop Recordnmod (X q − X).
230

Zhuang-Zi: a new algorithm for solving multivariate polynomial equations over a finite field

As before, apply Gaussian elimination to the matrix associated with this set ofpolynomials to produce a set S 0 of new basis polynomials. Let St00 −1 (X) be thepolynomial in S 0 of minimal degree. If deg (St00 −1(X)) ≤ D, then go to the laststep; otherwise replace S with S 0 and repeat this step.
Step 5: At this point we have a polynomial G(X) with deg (G(X)) ≤ D. Find
the roots of G(X) = 0 with a suitable method to obtain a set W = {α ∈K | G(α) = 0}. The solutions of F (X) = 0 will be the subset {α ∈ W | F (α) = 0}.
Remark 1. Since the complexity of any polynomial root finding method depends
on the degree of the given polynomial and the size of the field, so too does thecomplexity of the Zhuang-Zi algorithm. Improvements in the area of polynomial root finding methods will translate directly into an improvement for theZhuang-Zi algorithm. It is possible to run several such algorithms in parallelon intermediate polynomials, while at the same time the Zhuang-Zi algorithm
continues to find polynomials of lower degrees. When one process finds the roots
then the entire computation can be stopped.
Remark 2. A straight forward method for finding the roots of F (X) = 0 is tomake F (X) square free and then to computengcd(X q − X, F (X)),
which will return the product of all linear factors [Knu81]. The answer can thenbe obtained quickly from it, in particular when F (X) has only one or a few linear
factors. The only difficulty is that the direct approach is time consuming since qn
can be very large, and it is better to use the Frobenius operation X q mod F (X)and repeated squaring before finding the gcd. More efficient methods for finding
the roots of a polynomial in a finite field exist and they are described for example
in [GCL92,LN03,vG03].
Remark 3. If f consists of quadratic polynomials then the only powers of X thatiijmay arise in Steps 1–3 are either of the form X q or X q +q . Each application ofl
Step 4 then multiplies these monomials by X q . At the first application of Step 4ijlterms of of the form X q +q +q appear, that is third order terms in k[x0, . . . , xn],
and at the next iteration fourth order terms and so on. All possible monomials
will have been generated after no more than nq steps, since there are only nqnpossible monomials in K[X]/(X q − X).
Remark 4. If no k-linear combination of the polynomials f0 , f1, . . . , fn−1 is zeroin k[x0, x1, . . . , xn−1] (modulo xq0 − x0, xq1 − x1, . . . , xqn−1 − xn−1), then no Klinear combination of the polynomials F0 , F1, . . . , Fn−1 is zero in K[X] (modulonX q − X), since such a linear combination of the Fi will have degree at mostqn − 1.
Remark 5. The Zhuang-Zi algorithm works also when m 6= n. In this case one
has to use the maximum of m and n. When m < n, there are fewer equations
than variables and one simply introduces n − m polynomials identical to 0. If
there are more equations than variables (m > n) then one can simply introduce
m − n fictitious variables xn , . . . , xm−1.
231

PQCrypto 2006 Workshop Record

Ding, Gower, Schmidt

Remark 6. It should be noted that if m is too small then we know that there will
be a large number of solutions (roughly qn−m−1), and therefore the polynomials
in the ideal generated by the Fi(X) will have high degree. If the Zhuang-Zi
algorithm is unable to generate a polynomial of sufficiently small degree, thenwe may never reach the factorization step.

4

ExamplesWe present an illustrative example to see how the Zhuang-Zi algorithm works
in practice. We then present two non-trivial examples where Zhuang-Zi succeeds
and Gröbner bases fail.
4.1

A Toy Example

In order to show how the algorithm works we first present a simple example oftwo quadratic equations in two variables with coefficients in the field k = GF (22).
We define the polynomial map f : k2 −→ k2 by its components
f0 (x0 , x1) = x20 + x1 + 1
f1 (x0 , x1) = x21 + x0 x1 + 1
in k[x0, x1].
The nonzero elements in the field k = GF (4) form a multiplicative group,
which is generated by an element that we denote by a. The addition and multiplication table for elements in GF (4) can be written in terms of a as follows.
+ 0 1 a a2
0 0 1 a a2
1 1 0 a2 a
a a a2 0 1
a2 a2 a 1 0* 0 1 a a2
0 0 0 0 0
1 0 1 a a2
a 0 a a2 1
a2 0 a2 1 a

One irreducible polynomial of degree two with coefficients in k isg(y) = y2 + y + a2 .
The mapping φ : k2 −→ K is defined byφ(x0 , x1) = x0 + x1y = X,
while φ−1 : K −→ k2 is defined by (using matrix notation)


1+y 1
−1
4
φ (X) = (X, X )= (x0 , x1)
y 1
With this notation, the polynomial map F = φ ◦ f ◦ φ−1 is given by
F (X) = yX 8 + yX 5 + X 4 + X 2 + X + y + 1.
PQCrypto 2006 Workshop Record

232

Zhuang-Zi: a new algorithm for solving multivariate polynomial equations over a finite field

Since this is a trivial example, we could factor F (X) directly and obtain
F (X) = y(X + y)(X 3 + X 2 + 1)(X 4 + (y + 1)X 3 + aX 2 + (ay + 1)X + a2)
from which we can see that X = y is the only solution of the equation F (X) = 0
in K. If we write y = 0+1·y, we see that this solution corresponds to the solution(x0, x1) = (0, 1) ∈ k2 of the system f0 = f1 = 0. In general we would expect
the degree of F (X) to be much larger, and so we have designed our method
to reduce the degree to a reasonable level that can be handled by an efficientpolynomial root finding method such as the distinct degree factorization.
In order to illustrate how the algorithm works, we compute the functionsi
Fi(X) = F (X)q mod (X ( 16) − X) for i = 0, 1, noting that here n = 2 andq = 4. So we haveF0(X) = F (X) = yX 8 + yX 5 + X 4 + X 2 + X + y + 1
F1(X) = F 4(X) = X 8 + (y + 1)X 5 + X 4 + (y + 1)X 2 + X + y
We then create a 2 × 9 matrix with ij th entry equal to the coefficient of X 8−jin Fi (X), where i = 0, 1 and j = 0, 1, . . ., 8. This matrix is brought into row
echelon form via the Gaussian algorithm, which produces the new polynomials
S0 (X) and S1 (X).
S0 (X) = X 8 + (a2 y + 1)X 4 + a2 yX 2 + (a2 y + 1)X + a2 + 1
S1 (X) = X 5 + (y + a2)X 4 + (y + a)X 2 + (y + a2)X + y + a
In order to reduce the degree further, we now multiply S0 (X) and S1 (X)each by X and X 4 , and then add these additional four polynomials to the given
set of polynomials. Once again Gaussian elimination is applied and produces theset of six polynomials S0 (X), S1 (X), . . . , S5 (X).
S0 = X 12 + (ay + 1)X 3 + (ay + a)X 2 + a2yX + a
S1 = X 9 + (y + 1)X 3 + (a2 y + a2)X 2 + (a2 y + a2)X + ay + a2
S2 = X 8 + aX 3 + (a2y + a2)X 2 + (y + a)X + a2y
S3 = X 6 + aX 3 + (a2y + 1)X 2 + a2yX + a2y + a
S4 = X 5 + (ay + a)X 3 + (ay + 1)X 2 + (ay + 1)X + a2
S5 = X 4 + (ay + 1)X 3 + (a2 y + a)X 2 + a2X + y + a2
Since the degree reduction was not significant, we repeat the process. Multiplying each Si (X) by X and X 4 , adding these polynomials to the associatedmatrix, and then applying Gaussian elimination reduces the set of eighteen poly233

PQCrypto 2006 Workshop Record

Ding, Gower, Schmidt

nomials to eleven polynomials S0 (X), S1 (X), . . . , S10(X).
S0 (X) = X 13 + (y + a)X + a
S1 (X) = X 12 + (y + 1)X + ay + a
S2 (X) = X 10 + a2yX + a2 y
S3 (X) = X 9 + (y + 1)X + a2 y
S4 (X) = X 8 + (a2 y + 1)X + a2y
S5 (X) = X 7 + (ay + a)X + a2 y + a2
S6 (X) = X 6 + (a2 y + 1)X + y + a
S7 (X) = X 5 + yX + y
S8 (X) = X 4 + (ay + 1)X + ay
S9 (X) = X 3 + (a2 y + 1)X + 1
S10 (X) = X 2 + (y + 1)X + y
The factorization of S10 (X) = (X + 1)(X + y) shows that spurious solutions
can appear, and must be screened for and discarded. If the process were to
be repeated, the set of fourteen polynomials S0 (X), S1 (X), . . . , S13(X) will be
generated and the spurious solution will disappear.
S0 = X 14 + ay + a,
S1 = X 13 + a2 y + 1,
S2 = X 12 + ay + 1,
S3 = X 11 + ay,
S4 = X 10 + a,
S5 = X 9 + a2 y + a2,
S6 = X 8 + y + a,
S7 = X 7 + a2 y + a,
S8 = X 6 + a2 y,
S9 = X 5 + a2 ,S10 = X 4 + y + 1,
S11 = X 3 + ay + a2 ,S12 = X 2 + y + a2 ,S13 = X + y.
As expected each polynomial has the factor X + y. The set of polynomials asgiven is now invariant when our process is again applied, which must eventuallyoccur since we are working in a finite field.
PQCrypto 2006 Workshop Record

234

Zhuang-Zi: a new algorithm for solving multivariate polynomial equations over a finite fieldOf course this simple example could have been solved more easily by finding
the Gröbner basis {x0, x1 + 1} for the equations
f0 (x0, x1) = 0
f1 (x0, x1) = 0
x40 − x0 = 0
x41 − x1 = 0
4.2

Generating Non-Trivial Examples

The Zhuang-Zi algorithm works of course for linear systems of equations andcan give insight into how subspaces of kn are represented in the bigger field
K. Nevertheless, the main application is to the nonlinear multivariate problem
where Gröbner bases methods do not succeed. As mentioned earlier, the ZhuangZi algorithm requires that we work in a finite field, whereas Göbner bases do not.
When a Gröbner basis is computed in a finite field, it is accomplished usuallyby augmenting the original set of equations with those defining the finite field.
Examples that can be solved easily by the Zhuang-Zi algorithm, but onlywith great difficulties via Gröbner bases, can be constructed easily. The idea
is to select a function F (X) : K −→ K of low enough degree, so that it canbe factored easily, while the corresponding mapping f : kn −→ kn must becomplicated. The degree of the components f0 , f1, . . . , fn−1 of f depends oniwhich powers of X have been selected in F . Terms in F of the form X q giveijrise to linear terms in the components of f, X q +q leads to quadratic terms,ijl
X q +q +q leads to cubic terms, and so on. By keeping the exponents i, j, l, . . . in
i
i
j
i
j
l
X q , X q +q , X q +q +q , . . . small, we can choose a polynomial F of low enoughdegree so as to be easily factored, while the corresponding components of f will
be quadratic, cubic, or higher degree polynomials in k[x0, x1, . . ., xn−1]. This idea
is reminiscent of what has been suggested for the HFE public key encryption
scheme [Pat96]. We now generate such an example.
Let k = GF (23) and let K = k[y]/(g(y)) be a degree n extension of k, forsome irreducible g(y) ∈ k[y]. We use a polynomial of low degree in K[X]:F (X) = X 72 + a1 X 65 + a2X 64 + a3 X 16 + a4 X 9 + a5 X 8 + a6 X 2 + a7 X + a8 , (3)where the coefficients aj , for j = 1, . . ., 8, are chosen at random from k, treatedas a subfield of K via the standard embedding. With q = 8, all powers of Xijiin (3) can be written in the form X 8 +8 or X 8 , and so it is clear that (3)f = φ−1 ◦ F ◦ φ is a quadratic polynomial map from kn to kn . As in the previous
example, it is helpful to write φ−1 : K −→ kn using matrix notation
A X = x,01n−1where X = (X 8 , X 8 , . . . , X 8 )T , x = (x0, x1, . . . , xn−1)T , and A is an n × nimatrix with entries from K that can easily be found by writing each X 8 as apolynomial in y with coefficients in k[x0, x1, . . . , xn−1].
235

PQCrypto 2006 Workshop Record

Ding, Gower, Schmidt

The polynomial (3) can be factored easily by a computer algebra system like
Magma [CAG05]. Depending on the coefficients a1 , . . . , a8 of F , and on the valueof n, F may have zero, one, or more linear factors in X. Each linear factor X + α
with α ∈ K gives rise to a solution of the corresponding polynomial equations
fi (x0, x1, . . . , xn−1) = 0, i = 0, 1, . . ., n − 1. Finding the corresponding solutions
directly with the help of a good Gröbner bases program such as Faugère’s F4version in Magma [Fau99] requires exponential time with increasing n as seen in
Figure 1.

12

10log(time)

8

6

4

2

0

9

10

11

12
n

13

14

15

Fig. 1. Computing time for finding a Gröbner basis for n quadratic polynomials in nvariables

The quadratic polynomials components of f have too many terms to be
displayed here. It could be said that this is an unfair comparison, since we aresolving F (X) = 0 directly and forcing Faugère’s algorithm F4 to work on asystem with a huge number of terms. However, the Gröbner bases algorithm inMagma is very efficient, and removing even a few of the terms in (3) made itmuch more difficult to find examples where F4 fails even for large n. It is easy
to see why this is to be expected. In principle our algorithm should be better
if the degree D of F is fixed due to the complexity estimate O(D log qn) for aroot finding algorithm [vG03]. On the other hand the complexity of the Gröbner
bases algorithm is expected to be exponential in n, the number of variables.
This first non-trivial example shows that the Zhuang-Zi algorithm, even inits most simple form using only Step 1 and the Berlekamp algorithm, sometimes
has an advantage over the best Gröbner bases algorithms.
PQCrypto 2006 Workshop Record

236

Zhuang-Zi: a new algorithm for solving multivariate polynomial equations over a finite field

4.3

A Non-Trivial Example

We now give a non-trivial example where F (X) is of very high degree and therefore cannot be solved with the simplest form of the Zhuang-Zi algorithm as
discussed in the previous section.
Let q = 4, k = GF (q), as in Section 4.1, take g(y) ∈ k[y] to be the irreducible
polynomial
g(y) = y12 + y11 + ay10 + ay9 + y8 + y7 + y5 + a2 y4 + ay3 + a2y2 + ay + a,and define K = k[y]/(g(y)), a degree n = 12 extension of k.
Let F (X) ∈ K[X] be the polynomial
F (X) =a2 X 17664 + X 5440 + aX 5376 + X 4416 + aX 4096 + aX 1360
+ X 1344 + X 1280 + a2 X 1024 + a2 X 336 + aX 320 + a2 X 276+ X 85 + aX 84 + aX 64 + aX 21 + X 20 + a
It is easy to check that each exponent of X in F (X) is a sum of powers of four,and that the exponent with the most powers of four is 5440 = 43 + 44 + 45 + 46.
Therefore the components of f = φ−1 ◦ F ◦ φ will be of degree four. As before,
there are too many terms in each fi (x0 , x1, . . ., xn−1) to be displayed here.
The degree of F prevents us from finding the roots of F (X) = 0 directly. Also,
the F4 implementation in Magma failed to find a Gröbner basis for f0 , f1 , . . ., fn−1
due to the fact that memory requirements exceeded the available resources on
our PC (1.73 GHz, 1 GB of RAM). However, the Zhuang-Zi algorithm found thepolynomial
S(X) = X 276 + aX 85 + a2 X 84 + a2X 64 + a2X 21 + aX 20 + a
and with it the solutions {1, a} of F (X) = 0.
Other similar examples whose solutions can not be obtained from the Gröbner
bases algorithm, and which require several iterations of the full algorithm, canbe generated in this way. We omit them here due to space constraints.

5

Discussion

What we propose here is not just a new algorithm, but a new way to look at
the problem of solving a set of multivariate polynomial equations over a finite
field. We lift the problem to an extension field where it becomes a single variable problem, and then use existing efficient techniques for solving a polynomial
equation in a single variable over a finite field. In this way we actually unify themultivariate case and the single variable case. This also means that sometimes it
can be beneficial to view a single variable polynomial equation over a given finite
field as a set of multivariate polynomial equations over a smaller finite field. We
believe that this is an approach that merits further investigation.
237

PQCrypto 2006 Workshop Record

Ding, Gower, Schmidt

Our experiments above have shown that there are cases where the Zhuang-Zi
algorithm will succeed in finding a solution to a set of polynomial equations,whereas Gröbner bases algorithms will fail due to space and/or time limitations.
There are many interesting directions for further research. One question isthe complexity of the Zhuang-Zi algorithm for a set of n nonlinear equations in nvariables. In general the complexity will be exponential in n, though for certain
types of equations the Zhuang-Zi algorithm will be much faster. A very good
testing ground is the class of equations that arise in connection with the HFE
multivariate public key cryptosystem, which we are currently investigating.
Another important task is to make a systematic comparison of the ZhuangZi algorithm with other algorithms, for example with the new Gröbner basis
algorithms like F4 and F5, will give a better understanding of its complexity.
The Zhuang-Zi algorithm will not be better in a general way, but rather, we
believe that the algorithms can be complimentary to each other.
One interesting point of the Zhuang-Zi algorithm is that it is actually closely
related to the XL algorithm. If in Step 3 we do not look for a polynomial oflowest degree but instead we look for a polynomial of the form
n−1
X

i

Ai X q + B,

i=0

then the Zhuang-Zi algorithm is equivalent to the XL algorithm. It would beinteresting to consider how to combine the two algorithms together.
If F (X) is known to have a large number of solutions (larger than the threshold for factorization degree D), then the Zhuang-Zi algorithm cannot succeed.
One strategy that can be employed is to add randomly chosen polynomials
fn, . . . , fn0 −1 to the original set of polynomial f0 , f1, . . . , fn−1. It is very likelythat the resulting new system of equations will have fewer solutions, and that
Zhuang-Zi may be successful. If not, we can start over with a new set of randomly
chosen polynomials.
A much more general consideration is of the so-called hard cases, those equations that are generically hard to solve using any kind of general algorithm. We
believe our approach may provide some insight into how to look at this problem.
Among other applications, any result in this direction will have a very strong
connection and impact on the provable security of multivariate public key cryptosystems.
There is considerable room to improve and optimize the implementation of
the algorithm. For example, the algorithm relies very much on how the big field
K is implemented. Also, we expect that it is possible to speed up the Gaussian elimination process by using sparse matrices. If the Zhuang-Zi algorithm isviewed as a philosophy for solving equations, then it is clear that there is great
flexibility to create efficient variants in the degree reduction steps, variants tailored to fit with specific efficient polynomial equation solvers and factorization
algorithms.
PQCrypto 2006 Workshop Record

238

Zhuang-Zi: a new algorithm for solving multivariate polynomial equations over a finite field

References[Buc65]

Bruno Buchberger. Ein Algorithmus zum Auffinden der Basiselemente des
Restklassenrings nach einem nulldimensionalen Polynomideal. Universität
Innsbruck, 1965.
[CAG05] University of Sydney Computational Algebra Group.
The MAGMA
computational algebra system for algebra, number theory and geometry.
http://magma. maths.usyd.edu.au/magma/, 2005.
[CKPS00] Nicolas Courtois, Alexander Klimov, Jacques Patarin, and Adi Shamir. Efficient algorithms for solving overdefined systems of multivariate polynomial
equations. In B. Preenel, editor, Advances in cryptology, Eurocrypt 2000,
volume 1807 of LNCS, pages 392–407. Springer, 2000.
[Fau99] Jean-Charles Faugère. A new efficient algorithm for computing Gröbner
bases (F4 ). Journal of Pure and Applied Algebra, 139:61–88, June 1999.
[Fau02] Jean-Charles Faugère. A new efficient algorithm for computing Gröbner
bases without reduction to zero (F5 ). In International Symposium on Symbolic and Algebraic Computation — ISSAC 2002, pages 75–83. ACM Press,
July 2002.
[GCL92] Keith O. Geddes, Stepen R. Czapor, and George Labahn. Algorithms for
Computer Algebra. Amsterdam, Netherlands: Kluwer, 1992.
[GJ79]
Michael R. Garey and David S. Johnson. Computers and intractability, A
Guide to the theory of NP-completeness. W.H. Freeman, 1979.
[Knu81] Donald Knuth. The Art of Computer Programming. Adison Wesley, 2ndedition, 1981.
[KS99]
Aviad Kipnis and Adi Shamir. Cryptanalysis of the HFE public key cryptosystem by relinearization. In M. Wiener, editor, Advances in cryptology –Crypto ’99, volume 1666 of LNCS, pages 19–30. Springer, 1999.
[LN03]
Rudolf Lidl and Harald Niederreiter. Finite Fields, volume 20 of Encyclopedia of Mathematics and its Application. Cambridge University Press, 2ndedition, 2003.
[MI88]
Tsutomu Matsumoto and Hideki Imai. Public quadratic polynomial-tuples
for efficient signature verification and message encryption. In C. G. Guenther, editor, Advances in cryptology – EUROCRYPT ’88, volume 330 of
LNCS, pages 419–453. Springer, 1988.
[Pat96] Jacques Patarin. Hidden Field Equations (HFE) and Isomorphism of Polynomials (IP): Two new families of asymmetric algorithms. In U. Maurer,
editor, Eurocrypt’96, volume 1070 of LNCS, pages 33–48. Springer, 1996.
Extended Version: http://www.minrank.org/hfe.pdf.
[Pat00] Jacques Patarin. Cryptanalysis of the Matsumoto and Imai public key
scheme of Eurocrypt’88. Designs, Codes and Cryptography, 20:175–209,
2000.
[Smi52] David E. Smith. History of Mathematics, volume 1 and 2. New York: Dover,
1951, 52.
[vG03]
Joachim von zur Gathen and Jürgen Gerhard. Modern Computer Algebra.
Cambridge University Press, 2nd edition, 2003.

239

PQCrypto 2006 Workshop Record

Ding, Gower, Schmidt

Appendix: Zhuang Zi
Zhuang Zi, also known as Zhuang Zhou, Chuang Tzu, Chuang Tse, and Chuang
Chou (369 BC – 286 BC), was a Chinese philosopher, who lived during theWarring States era. He also lived in a time, which is called a time of the Hundred
Schools of Thoughts, during which most major schools of Chinese Philosophy
were originated. Zhuang is actually his family name and Zhou the first name.
The name Zhuang Zi is used as a way to show respect for him. He categoricallybelongs to the school of Taoism.
One the most famous stories about him and his philosophy is from his bookalso known as Zhuang Zi.
Once upon a time, I, Zhuang Zhou, dreamt I was a butterfly, fluttering
here and there. I was conscious only of my being as a butterfly, unawarethat I was Zhou. Soon I awaked, and there I was, myself again. Now I
am confused and do not know whether I was then a man dreaming I wasa butterfly, or whether I am now a butterfly, dreaming I am a man.
The first author has proposed this algorithm and he envisions the transition
between the vector space on a small finite field and the equivalent large field tobe just like the idea of Zhuang Zhou and the butter fly. For this reason he hassuggested to name this algorithm after Zhuang Zi.

PQCrypto 2006 Workshop Record

240