Choosing subfields for LUOV and lifting fields for rainbow

Multivariate cryptography is one of the main candidates to guarantee the security of communication in a post quantum era. While multivariate signature schemes are very fast and require only modest computational resources, the key sizes of such schemes are quite large. In [17] Petzoldt et al. proposed a way to use Linear Recurring Sequences (LRS’s) for the key generation of the Unbalanced Oil and Vinegar (UOV) signature scheme by which they were able to reduce the public key size of this scheme by a factor of 7. In this paper we describe a modification of their scheme, which enables us not only to reduce the public key size, but also to speed up the verification process of the UOV scheme by a factor of 5.KeywordsMultivariate CryptographyUOV Signature SchemeKey Size ReductionFast Verification

With the rapid development of quantum computing technology, traditional public key cryptographic systems face serious threats. Post-quantum cryptographic algorithms have become an important research direction in the field of information security. The Unbalanced Oil and Vinegar (UOV) signature is one of the important candidate schemes in post-quantum cryptography. It can effectively resist quantum computing attacks. However, the extensive matrix multiplication and addition operations during key generation and the intensive computations in the random number generation stage consume substantial CPU resources. This causes the UOV key generation phase to account for more than 90% of the total UOV computational workload. To address these problems, this paper proposes a GPU parallel computing-based optimization scheme for UOV key generation. The approach focuses on accelerating two key components. First, GPU threads are used to parallelize matrix multiplication and addition operations. Thread-level parallel reconstruction and triangular matrix storage optimization are adopted. This achieves a 2.34× acceleration effect. Second, the natural parallel characteristics of AES-CTR mode are fully utilized. GPU multi-level buffering and batch processing techniques are used to optimize the Pseudo-Random Number Generator (PRNG) generation process for partial public key matrices. This obtains a significant 9.88× acceleration. Experimental results show that compared to the current optimal CPU implementation, the proposed GPU parallelization scheme achieves an overall 1.64× acceleration for the UOV algorithm key generation phase.

In this paper we show that solving systems coming from the public key of the Unbalanced Oil and Vinegar (UOV) signature scheme is on average at least as hard as solving a certain quadratic system with completely random quadratic part. In providing lower bounds on direct attack complexity we rely on the empirical fact that complexity of solving a non-linear polynomial system is determined by the homogeneous part of this system of the highest degree. Our reasoning explains, in particular, the results on solving the UOV systems presented by J.-C. Faugere and L. Perret at the SCC conference in 2008.

Round 1 of the the NIST post-quantum cryptography (PQC) standardization effort began on November 30th, 2017. The competition aims to select the most promising quantum-resistant algorithms, which are currently secure against large scale quantum computers. Multivariate cryptosystems belong to a promising group of PQC schemes and are based on multivariate polynomials over finite fields. Among them are the Unbalanced Oil and Vinegar (UOV) and Rainbow signature schemes, which have been extensively studied since 1999 and 2005, respectively. The main advantage of UOV is high confidence in its security, and the disadvantages include large key and signature sizes. Rainbow is a multi-layer version of UOV that offers better performance, smaller keys, and smaller signatures. This paper presents a high-speed FPGA implementation for the NIST Round 1 PQC submission of Rainbow. We discuss a high-speed design that uses a parameterized system solver, which can solve an n-byn system in n clock cycles. Compared to the previous state-of-the-art, we reduce the number of required multipliers by almost half, speed up execution, and implement Rainbow for higher security levels. Our design supports many parameter sets, which require operations in the fields GF(16) and GF(256). Additionally, in order to make benchmarking easier and fairer, our design follows a universal PQC hardware API, which allows for fair comparison with other post-quantum signature schemes. This design is being made open-source to increase transparency and speed up further optimization.

Authentication of public keys in asymmetric cryptography is an important objective to fulfil. Identity-based schemes are an efficient solution for this scenario. There are various identity-based schemes that are based on either factoring problem or DLP problem, but these problems can be solved in polynomial time using quantum computers. Multivariate cryptography is one of the main alternatives for the construction of post-quantum digital signature schemes. Digital signature construction needs modest computations in multivariate public key cryptography, so these schemes are considered quite efficient. In this paper, we present a new identity-based signature scheme in which the signature size and user key size are relatively small. The design of our proposed signature scheme is based on MQDSS construction.KeywordsMultivariate public key cryptographyMQ problemIdentity-based signature scheme

Multivariate public key cryptography is a set of cryptographic schemes built from the NP-hardness of solving quadratic equations over finite fields, amongst which the hidden field equations (HFE) family of schemes remain the most famous. However, the original HFE scheme was insecure, and the follow-up modifications were shown to be still vulnerable to attacks. In this paper, we propose a new variant of the HFE scheme by considering the special equation x2=x defined over the finite field F3 when x=0,1. We observe that the equation can be used to further destroy the special structure of the underlying central map of the HFE scheme. It is shown that the proposed public key encryption scheme is secure against known attacks including the MinRank attack, the algebraic attacks, and the linearization equations attacks. The proposal gains some advantages over the original HFE scheme with respect to the encryption speed and public key size.

In this paper, we present an evaluation of possible ARM instruction set extension for elliptic curve cryptography (ECC) over binary finite fields GF(2/sup m/). The use of elliptic curve cryptography is becoming common in embedded domain, where its reduced key size at a security level equivalent to standard public-key methods (such as RSA) allows for power consumption savings and more efficient operation. ARM processor was selected because it is widely used for embedded system applications. We developed an ECC benchmark set with three widely used public-key algorithms: Diffie-Hellman for key exchange, digital signature algorithm, as well as El-Gamal method for encryption/decryption. We analyzed the major bottlenecks at function level and evaluated the performance improvement, when we introduce some simple architectural support in the ARM ISA. Results of our experiments show that the use of a word-level multiplication instruction over binary field allows for an average 33% reduction of the total number of dynamically executed instructions, while execution time improves by the same amount when projective coordinates are used.

Post-Quantum Secure Inner Product Functional Encryption Using Multivariate Public Key Cryptography

Multivariate Public Key Cryptography(MPKC) has become one of a few options for security in the quantum model of computing. Though a few multivariate systems have resisted years of effort from the cryptanalytic community, many such systems have fallen to a surprisingly small pool of techniques. There have been several recent attempts at formalizing more robust security arguments in this venue with varying degrees of applicability. We present an extension of one such recent measure of security against a differential adversary which has the benefit of being immediately applicable in a general setting on unmodified multivariate schemes.

To design an efficient post-quantum linearly homomorphic signature scheme, using the pre-image sampling function, a lattice-based linearly homomorphic signature scheme over a binary field is proposed in this paper. Linear homomorphism is achieved through the homomorphism of the lattice-based hash function used in the proposed signature scheme. It is shown that the proposed scheme satisfies the privacy property. Based on the hardness of the short integer solution problem, the proposed scheme is unforgeable against the type 1 and type 2 adversaries in the random oracle model. Moreover, compared with a presented linearly homomorphic signature scheme in 2011, the proposed scheme has some advantages with respect to the public key size, signature length and computational cost.

This work presents an evaluation of different software implementations of algorithms to compute the most demanding operation in cryptographic schemes based on Elliptic Curve Cryptography (ECC), the scalar multiplication. Five different methods were studied, including traditional and more sophisticated methods for elliptic curve cryptography defined over prime and binary fields. For evaluation, the key generation algorithm in ECC consisting on a single scalar multiplication was implemented on a P500h LG smarthphone, which includes an ARM processor running at 600MHz. Both execution time and memory usage was evaluated. It was found that in general, scalar multiplication runs 8 times faster for ECC defined over prime fields, being the NAF the best performer method. For ECC over binary fields, the best performer method was wNAF. The results presented in this work could help a designer to select the most appropriate method when implementing ECC-based cryptographic schemes such as encryption or digital signatures on mobile devices like smartphones, meeting implementation requirements in terms of execution time and memory usage.

Elliptic curve digital signature algorithm (ECDSA) is elliptic curve analogue of digital signature algorithm. This paper presents implementation of ECDSA on NIST recommended Elliptic curves in binary fields of size 163 bits. The work involved implementation of different modules of ECDSA on reconfigurable hardware platform (Xilinx xc6vlx240T-1ff1156). The private key generation and binary weight calculation (used in scalar multiplication) is done in software using Microblaze (soft core of Xilinx). The private key along with the other global parameters for ECDSA are passed from Microblaze to the programmable logic of FPGA where final signature generation and verification is performed. Two implementations have been done based on different word sizes in Montgomery multiplication over binary fields. The first implementation requires 0.367 ms with 11040 slices for signature generation and 0.393 ms with 12846 slices for signature verification at a clocking frequency of 100 MHz. The second implementation requires 0.615 ms with 8773 slices for signature generation and 0.672 ms with 9967 slices for signature verification at the same clocking frequency. These implementations are faster compared to other implementations reported in literature for binary curves.

Code-based public key encryption (PKE) is a popular choice to achieve post-quantum security, partly due to its capability to achieve fast encryption/decryption. However, code-based PKE has larger ciphertext and public key sizes in comparison to conventional PKE schemes (e.g., those based on RSA). In 2018, Lau and Tan proposed a new rank metric code-based PKE scheme, which has smaller public key and ciphertext sizes compared to other code-based PKE schemes. They also proved that their scheme achieves IND-CPA security, assuming the intractability of the decisional rank syndrome decoding problem. It is known that IND-CCA2 security is the strongest and most popular security assurance for PKE schemes. Therefore, in this paper, we obtain a new code-based PKE scheme from Lau and Tan’s scheme, in order to inherit the underlying small public key and ciphertext sizes. However, our new scheme is shown to achieve IND-CCA2 security, instead of the weaker IND-CPA security. Specifically, the respective public key size and ciphertext size in our new scheme are 15.06 KB and 1.37 KB under 141-bit security level, and 16.76 KB and 1.76 KB under 154-bit security level. We then present a use case for the proposed scheme, that is for secure cloud storage.

In this paper, we provide a new multi-signature scheme that is proven secure in the plain public key model. Our scheme is practical and efficient according to computational costs, signature size and security assumptions. At first, our scheme matches the single ordinary discrete logarithm based signature scheme in terms of signing time, verification time and signature size. Secondly, our scheme requires only two rounds of interactions and each signer needs nothing more than a certified public key to produce the signature, meaning that our scheme is compatible with existing PKIs. Thirdly, our scheme has been proven secure in the random oracle model under standard discrete logarithm (DL) assumption. It outperforms a newly proposed multi-signature scheme by Bagherzandi, Cheon and Jarecki (BCJ scheme) in terms of both computational costs and signature size.

A lattice-based group signature scheme (LGSS) is an active cryptographic primitive, where each group member can sign messages anonymously in the name of the entire group and each valid signature should be traced to some group member on the lattice. In each LGSS, the size of the group signature usually depends on the number of group members and the security parameter. Thus, designing a constant-size LGSS is an interesting problem. At PKC 2018, Ling, Nguyen, Wang and Xu presented the first constant-size group signature scheme under lattice assumptions. Its design is based on a zero-knowledge argument of the knowledge of a valid message-signature pair for the Ducas-Micciancio signature scheme, which follows the sign-then-encrypt-then-prove protocol. In contrast to this work, we construct a new constant-size LGSS. The scheme adopts the sign-hybrid-encrypt approach and makes use of the Lyubashevsky signature scheme. Our work is efficient in the signing algorithm, more precise on the open algorithm and shorter in public key, secret key and signature size than previous studies. Furthermore, we prove that the scheme has full anonymity and full traceability under the Ring Learning With Errors and Ring Short Integer Solution assumptions in the random oracle model.