Equivalent keys in ℳultivariate uadratic public key systems

Multivariate Quadratic public key schemes have been suggested back in 1985 by Matsumoto and Imai as an alternative for the RSA scheme. Since then, several other schemes have been proposed, for example Hidden Field Equations, Unbalanced Oil and Vinegar schemes, and Stepwise Triangular Schemes. All these schemes have a rather large key space for a secure choice of parameters. Surprisingly, the question of equivalent keys has not been discussed in the open literature until recently. In this article, we show that for all basic classes mentioned above, it is possible to reduce the private | and hence the public | key space by several orders of magnitude. For the Matsumoto-Imai scheme, we are even able to show that the reductions we found are the only ones possible, i.e., that these reductions are tight. While the theorems developed in this article are of independent interest themselves as they broaden our understanding of Multivariate Quadratic public key systems, we see applications of our results both in cryptanalysis and in memory e‐cient implementations of MQ-schemes.

Multivariate public key cryptography is a set of cryptographic schemes built from the NP-hardness of solving quadratic equations over finite fields, amongst which the hidden field equations (HFE) family of schemes remain the most famous. However, the original HFE scheme was insecure, and the follow-up modifications were shown to be still vulnerable to attacks. In this paper, we propose a new variant of the HFE scheme by considering the special equation x2=x defined over the finite field F3 when x=0,1. We observe that the equation can be used to further destroy the special structure of the underlying central map of the HFE scheme. It is shown that the proposed public key encryption scheme is secure against known attacks including the MinRank attack, the algebraic attacks, and the linearization equations attacks. The proposal gains some advantages over the original HFE scheme with respect to the encryption speed and public key size.

Weil descent methods have recently been applied to attack the Hidden Field Equation (HFE) public key systems and solve the elliptic curve discrete logarithm problem (ECDLP) in small characteristic. However the claims of quasi-polynomial time attacks on the HFE systems and the subexponential time algorithm for the ECDLP depend on various heuristic assumptions.In this paper we introduce the notion of the last fall degree of a polynomial system, which is independent of choice of a monomial order. We then develop complexity bounds on solving polynomial systems based on this last fall degree.We prove that HFE systems have a small last fall degree, by showing that one can do division with remainder after Weil descent. This allows us to solve HFE systems unconditionally in polynomial time if the degree of the defining polynomial and the cardinality of the base field are fixed. For the ECDLP over a finite field of characteristic 2, we provide computational evidence that raises doubt on the validity of the first fall degree assumption, which was widely adopted in earlier works and which promises sub-exponential algorithms for ECDLP. In addition, we construct a Weil descent system from a set of summation polynomials in which the first fall degree assumption is unlikely to hold. These examples suggest that greater care needs to be exercised when applying this heuristic assumption to arrive at complexity estimates.These results taken together underscore the importance of rigorously bounding last fall degrees of Weil descent systems, which remains an interesting but challenging open problem.KeywordsHFEECDLPWeil descentSolving equationsFirst fall degreeLast fall degree

In 1984, Shamir proposed the concept of the ID-based cryptosystem (IBC). Instead of generating and publishing a public key for each user, the ID-based scheme permits each user to choose his name or network address as his public key. This is advantageous to public-key cryptosystems because the public-key verification is so easy and direct. In such a way, a large public key file is not required. Since new cryptographic schemes always face security challenges and many integer factorization and discrete logarithm based cryptographic systems have been deployed, therefore, the purpose of this paper is to design a transformation process that can transfer the entire integer factorization problem and discrete logarithm problem based cryptosystems into the ID-based systems rather than re-invent a new system. We consider the security against a conspiracy of some entities in the proposed system and show the possibility of establishing a more secure system. Rapid advances in computer technology and the development of the Internet are changing the way, we conduct our daily and business lives. Secrecy is an important issue with respect to sensitive data transferred over insecure public channels. In an open network environment, secret session key needs to be shared between two users before it establishes a secret communication. While the number of users in the network is increasing, key distribution will become a serious problem. In 1976, Diffie and Hellman (4) introduced the concept of the public key distribution system (PKDS). In the PKDS, each user needs to select a secret key and compute a corresponding public key and store in the public directory. The common secrete session key, which will be shared between two users can then be determined by either user, based on his own secret key and the partner's public key. Although the PKDS provides an elegant way to solve the key distribution problem, the major concern is the authentication of the public keys used in the cryptographic algorithm. Many attempts have been made to deal with the public key authentication issue. Kohnfelder (5) used the RSA digital signature scheme to provide public key certification. His system involves two kinds of public key cryptography: one is in modulo p, where p is a large prime number; the other is in modulo N, where N = pq, and p and q are large primes. Blom (7) proposed a symmetric key generation system (SKGS) based on secret sharing schemes. The problems of SKGS however, are the difficulty of choosing a suitable threshold value and the requirement of large memory space for storing the secret shadow of each user. In 1984, Shamir (1) introduced the concept of an identity. In this system, each user needs to visit key authentication center (KAC) and identify himself before joining the network. Once a user's identity is accepted, the KAC will provide him with a secret key.

Public-key encryption is extensively used to provide digital data confidentiality and deliver the security features, such as nonrepudiation (digital signature) and secure key exchange. Conventional public-key schemes are based on mathematical problems with inflexible constraints, and the security of digital contents relies on computational complexity. In the era of emerging technologies, most public-key image encryption schemes are susceptible to various threats. We propose a novel public-key encryption in this article with near-ring criteria and provide confidentiality to private data with the microstates of the Einstein crystal model. The virtual oscillator generated by microstates of initial oscillators for the common secrets with the public-key scheme produces unique states to encrypt digital data. The privacy-preserved structure, that mimics the data stream of digital content with the behavior of the improved Einstein crystal model, describes a system in terms of microstates to generate diffusion in the plain data with unique states of a virtual oscillator. The performance and digital forensic evaluations, such as randomness, histogram uniformity, pixels’ correlation, pixels’ similarity, visual strength, pixels’ incongruity, key sensitivity, linear and differential attacks, noise, and occlusion attacks analyses, certify the resistivity of the proposed algorithm against potential threats and provide superior capacity in comparison to existing methodologies to hostile certain attacks.

In this article, we investigate the question of equivalent keys for two ${\mathcal M}$ultivariate ${\mathcal Q}$uadratic public key schemes HFE and C*−− and improve over a previously known result, which appeared at PKC 2005. Moreover, we show a new non-trivial extension of these results to the classes HFE-, HFEv, HFEv-, and C*−−, which are cryptographically stronger variants of the original HFE and C* schemes. In particular, we are able to reduce the size of the private — and hence the public — key space by at least one order of magnitude and several orders of magnitude on average. While the results are of independent interest themselves as they broaden our understanding of ${\mathcal M}$ultivariate ${\mathcal Q}$uadratic schemes, we also see applications both in cryptanalysis and in memory efficient implementations.

In the Internet, securing email has always been an important issue. Various standards and products have been created. One of the most successful standards is OpenPGP by J. Callas et al. (1998), which uses public key cryptography (R. L. Rivest et al. (1977) and others) and is implemented in systems like Pretty Good Privacy according to P. Zimmerman (1995), Gnu Privacy Guard by W. Koch, Hushmail, and others. A well-known difficulty with the use of public key cryptographic systems is the verification and distribution of the public keys. OpenPGP solves the problem of verifying the authenticity of a public key by having users certify each others keys, building a Web of Trust described by P. Feisthammel (1997) by bundling these key certificates with each users public key. Therefore, adding a new public key and updating an existing public key (or replacing it by a new version) are the two most important operations of any PGP public key repository. To allow easy distribution of PGP public keys, the OpenPGP community established a network of open access public keyservers, allowing users of OpenPGP software to freely exchange public keys. The nodes of this keyserver network synchronise their database by exchanging new public keys and key updates amongst each other, virtually building one global key database. At the moment, this synchronisation is done with an inefficient and ineffective email based protocol. This paper describes the implementation of an alternative protocol - KX - on the popular pksd keyserver according to M. Horowitz (1997), based on direct TCP connections between the keyservers and unambiguous identifiers for every key update or new key. With the dropping of the dependency on a working mail system and the improved fault mechanisms, KX is a lightweight alternative in terms of used network, disk and CPU resources.

Suppose we have a signature scheme for signing elements of message space \(\mathcal{M}_1\), but we need to sign messages from \(\mathcal{M}_2\). The traditional approach of applying a collision resistant hash function from \(\mathcal{M}_1\) to \(\mathcal{M}_2\) can be inconvenient when the signature scheme is used within more complex protocols, for example if we want to prove knowledge of a signature. Here, we present an alternative approach in which we can combine a signature for \(\mathcal{M}_1\), a pairwise independent hash function with key space \(\mathcal{M}_1\) and message space \(\mathcal{M}_2\), and a non-interactive zero knowledge proof system to obtain a signature scheme for message space \(\mathcal{M}_2\). This transform also removes any dependence on state in the signature for \(\mathcal{M}_1\).As a result of our transformation we obtain a new signature scheme for signing a vector of group elements that is based only on the decisional linear assumption (DLIN). Moreover, the public keys and signatures of our scheme consist of group elements only, and a signature is verified by evaluating a set of pairing-product equations, so the result is a structure-preserving signature. In combination with the Groth-Sahai proof system, such a signature scheme is an ideal building block for many privacy-enhancing protocols.

The RSA public key cryptosystem is based on a single modular equation in one variable. A natural generalization of this approach is to consider systems of several modular equations in several variables. In this paper we consider Patarin’s Hidden Field Equations (HFE) scheme, which is believed to be one of the strongest schemes of this type. We represent the published system of multivariate polynomials by a single univariate polynomial of a special form over an extension field, and use it to reduce the cryptanalytic problem to a system of ∈m 2 quadratic equations in m variables over the extension field. Finally, we develop a new relinearization method for solving such systems for any constant ∈ > 0 in expected polynomial time. The new type of attack is quite general, and in a companion paper we use it to attack other multivariate algebraic schemes, such as the Dragon encryption and signature schemes. However, we would like to emphasize that the polynomial time complexities may be infeasibly large for some choices of the parameters, and thus some variants of these schemes may remain practically unbroken in spite of the new attack.KeywordsQuadratic EquationSignature SchemeUnivariate PolynomialMultivariate PolynomialMultivariate Signature SchemeThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

One-time signature schemes (OTSS) are based on efficient one-way functions. They achieve fast signing and verification, and sign the message at most 1 time. OTSSs are used to replace asymmetric signatures that incur highercosts in cases where performance is critical. For example, OTSSs are employed in chip cards where low computation complexity is required. The secret key and public key of an OTSS are used only once; this creates a problem when we use a certificate-based public key system with the OTSS since the public key certification will cause the certification authority CA to offer public key evidence to the signer every time the OTSS is used. It appears that this evidence is unnecessary and impractical. In this paper, we discuss the certificate problems faced in the OTSS public key system. In our proposed scheme based on the self-certified public key system, it is recess any to contact the CA only 1 time and only 1 certificate needs to be obtained from the CA. The communication costs of the signer and CA are greatly reduced as comparing to that in case of the tree-authentication-based scheme proposed by Merkle [6].

RETRACTED: A public key size homomorphic encryption scheme based on the sum of sparse subsets and integers

A public key encryption cryptography system can be utilized to generate ciphertext of a message using a public key. However, this public key encryption cryptography system cannot be utilized if you want to generate ciphertext using several different keys. Solving the problems above can use the Chosen Ciphertext Secure Public Key Threshold Encryption scheme but are the securities from Threshold Encryption really strong in securing messages, therefore the above problems can be analyzed for Data Security Against Chosen Ciphertext Secure Public Key Attacks Using Threshold Encryption Schemes. The work process starts from Setup which functions to generate the server's private key and public key. Then, the process is continued with ShareKeyGen which functions to generate private keys based on the user's identity. After that, the process continues with ShareVerify which serves to verify the key generated from the ShareKeyGen process. The process will be continued again with Combine which serves to generate a private key that will be used in the decryption process. After that, the process will continue with the encryption process of the secret message. The ciphertext obtained will be sent to the recipient. The receiver verifies the ciphertext by running ValidateCT. Finally, the ciphertext is decrypted by running Decrypt. The software created can be used to display the workflow process of the Threshold schema. In addition, it makes it easier to test intercepts of ciphertext messages to other users so that generic securities analysis is carried out in testing the resulting ciphertext. The results of the implementation of Threshold Encryption algorithm scheme can protect important personal data, because it involves human rights, namely the right to access, the right to delete, the right to correct, the right to be corrected and the right to transfer personal data safely from attacks.

In this paper we show that solving systems coming from the public key of the Unbalanced Oil and Vinegar (UOV) signature scheme is on average at least as hard as solving a certain quadratic system with completely random quadratic part. In providing lower bounds on direct attack complexity we rely on the empirical fact that complexity of solving a non-linear polynomial system is determined by the homogeneous part of this system of the highest degree. Our reasoning explains, in particular, the results on solving the UOV systems presented by J.-C. Faugere and L. Perret at the SCC conference in 2008.

A new image cipher in time and frequency domains

Today, we see a large dependence on systems developed with cryptography. Especially in terms of public key cryptosystems, which are widely used on the Internet. However, public key cryptography was threatened and new sources began to be investigated when Shor in 1997 developed a polynomial time algorithm for factoring integers and to compute the discrete logarithm with a quantum computer. In this context, Patarin proposed Hidden Field Equations (HFE), a trapdoor based on MQ (Multivariate Quadratic) and IP (Isomorphism of Polynomials) problems. Such problems are not affected by the Shor algorithm, moreover MQ Problem was proved by Patarin and Goubin to be NP-complete. Despite the basic HFE has been broken, there are variants that are secure, obtained by a generic modification. The Quartz - digital signature scheme based on HFEv-, with special choice of parameters - is a good example of this resistance to algebraic attacks aimed at the recovery of the private key, because even today it remains secure. Furthermore, it also generates short signatures. However, Joux and Martinet, based on axioms of Birthday Paradox Attack, proved that Quartz is malleable, showing that if the adversary has a valid pair (message, signature), he can get a second signature with 2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">50</sup> computations and 2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">50</sup> calls to the signing oracle, so that the estimated current security standards are at least 2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">112</sup> . Thus, based on Quartz, we present a new digital signature scheme, achieving the adaptive chosen message attacks that make calls to the random oracle, with a security level estimated at 2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">112</sup> . Our cryptosystem also provides an efficiency gain in signature verification algorithm and vector initializations that will be used for signing and verification algorithms. Furthermore we provide an implementation of Original Quartz and Enhanced Quartz in the Java programming language.