Linear Recurring Sequences for the UOV Key Generation Revisited

With the rapid development of quantum computing technology, traditional public key cryptographic systems face serious threats. Post-quantum cryptographic algorithms have become an important research direction in the field of information security. The Unbalanced Oil and Vinegar (UOV) signature is one of the important candidate schemes in post-quantum cryptography. It can effectively resist quantum computing attacks. However, the extensive matrix multiplication and addition operations during key generation and the intensive computations in the random number generation stage consume substantial CPU resources. This causes the UOV key generation phase to account for more than 90% of the total UOV computational workload. To address these problems, this paper proposes a GPU parallel computing-based optimization scheme for UOV key generation. The approach focuses on accelerating two key components. First, GPU threads are used to parallelize matrix multiplication and addition operations. Thread-level parallel reconstruction and triangular matrix storage optimization are adopted. This achieves a 2.34× acceleration effect. Second, the natural parallel characteristics of AES-CTR mode are fully utilized. GPU multi-level buffering and batch processing techniques are used to optimize the Pseudo-Random Number Generator (PRNG) generation process for partial public key matrices. This obtains a significant 9.88× acceleration. Experimental results show that compared to the current optimal CPU implementation, the proposed GPU parallelization scheme achieves an overall 1.64× acceleration for the UOV algorithm key generation phase.

In this paper we show that solving systems coming from the public key of the Unbalanced Oil and Vinegar (UOV) signature scheme is on average at least as hard as solving a certain quadratic system with completely random quadratic part. In providing lower bounds on direct attack complexity we rely on the empirical fact that complexity of solving a non-linear polynomial system is determined by the homogeneous part of this system of the highest degree. Our reasoning explains, in particular, the results on solving the UOV systems presented by J.-C. Faugere and L. Perret at the SCC conference in 2008.

Multivariate public key cryptography is one of the main candidates for post‐quantum cryptography. Rainbow, an improved (multi‐layer) version of unbalanced oil and vinegar (UOV), is one of the most famous multivariate signature schemes that is a promising candidate for NIST standardisation. At INDOCRYPT 2017, Beullens and Preneel introduced a new variant LUOV of UOV. Their idea is to generate a UOV scheme over the binary field and then lift it into a bigger field and hence dramatically reduce the public key size. In this study, the authors first theoretically deduce the choice for the subfield L (which is different from ) which results in smaller signature sizes (up to 40%). Moreover, they extend the idea to Rainbow and theoretically yield the optimal choice for the subfield L over which a Rainbow is generated before being lifted to K . As a result, they can reduce the public key size of the obtained Rainbow scheme up to at least 36%.

Round 1 of the the NIST post-quantum cryptography (PQC) standardization effort began on November 30th, 2017. The competition aims to select the most promising quantum-resistant algorithms, which are currently secure against large scale quantum computers. Multivariate cryptosystems belong to a promising group of PQC schemes and are based on multivariate polynomials over finite fields. Among them are the Unbalanced Oil and Vinegar (UOV) and Rainbow signature schemes, which have been extensively studied since 1999 and 2005, respectively. The main advantage of UOV is high confidence in its security, and the disadvantages include large key and signature sizes. Rainbow is a multi-layer version of UOV that offers better performance, smaller keys, and smaller signatures. This paper presents a high-speed FPGA implementation for the NIST Round 1 PQC submission of Rainbow. We discuss a high-speed design that uses a parameterized system solver, which can solve an n-byn system in n clock cycles. Compared to the previous state-of-the-art, we reduce the number of required multipliers by almost half, speed up execution, and implement Rainbow for higher security levels. Our design supports many parameter sets, which require operations in the fields GF(16) and GF(256). Additionally, in order to make benchmarking easier and fairer, our design follows a universal PQC hardware API, which allows for fair comparison with other post-quantum signature schemes. This design is being made open-source to increase transparency and speed up further optimization.

Multivariate Cryptography is one of the alternatives to guarantee the security of communication in the post-quantum world. One major drawback of such schemes is the huge size of their keys. In [PB10] Petzoldt et al. proposed a way how to reduce the public key size of the UOV scheme by a large factor. In this paper we extend this idea to the Rainbow signature scheme of Ding and Schmidt [DS05]. By our construction it is possible to reduce the size of the public key by up to 62%.KeywordsMultivariate CryptographyRainbow Signature SchemeKey Size Reduction

In this paper, we motivate the need for efficient multisignature schemes in delegated mobile services. With the schemes, delegates can be identified and delegated accesses can be controlled. First, we give a new digital signature scheme with message recovery. Based on the digital signature scheme, two digital multisignature schemes are proposed: the parallel multisignature scheme and the serial multisignature scheme. The parallel multisignature scheme allows each user to sign the same message separately and independently, and then combines all individual signatures into a multisignature. The serial multisignature scheme allows a group of users to sign the message serially, and does not need to predetermine the signing order. Both multisignature schemes can withstand the attacks that aim to forge the signatures or to get the private keys of the signers.

Information systems are developing and improving very fast. The requirements for synchronization for such systems also increase. In such systems linear recurrent sequences are widely used for synchronization. In this paper filtration algorithms of linear recurrent sequences sequences are synthesized. The synthesized algorithms can be classified as quasi-noncoherent (subincoherent) algorithms, as opposed to quasi-coherent algorithms, which use phase estimate of the received signal, or to noncoherent algorithms that use averaging over the entire region of phase uncertainty. The results of computer simulation of developed algorithms for various signal-to-noise ratios and accumulation time are presented.

Let $(x_n)_{n\geq 0}$ be a linear recurrence sequence of order $k\geq 2$ satisfying $$ \begin{align*}x_n=a_1x_{n-1}+a_2x_{n-2}+\dots+a_kx_{n-k}\end{align*} $$ for all integers $n\geq k$ , where $a_1,\dots ,a_k,x_0,\dots , x_{k-1}\in \mathbb {Z},$ with $a_k\neq 0$ . In 2017, Sanna posed an open question to classify primes p for which the quotient set of $(x_n)_{n\geq 0}$ is dense in $\mathbb {Q}_p$ . In a recent paper, we showed that if the characteristic polynomial of the recurrence sequence has a root $\pm \alpha $ , where $\alpha $ is a Pisot number and if p is a prime such that the characteristic polynomial of the recurrence sequence is irreducible in $\mathbb {Q}_p$ , then the quotient set of $(x_n)_{n\geq 0}$ is dense in $\mathbb {Q}_p$ . In this article, we answer the problem for certain linear recurrence sequences whose characteristic polynomials are reducible over $\mathbb {Q}$ .

The best known linear recurrence sequence is the Fibonacci Sequence 1,1,2,3,5,8,..., where each term (after the first two terms) is a sum of the two preceding terms. We may extend it to become a “doubly infinite” sequence $$ ..., - 8,5, - 3,2, - 1,1,0,1,1,2,3,5,8,... . $$ .

We investigate the decidability of termination, reachability, coverability and deadlock-freeness of Petri nets endowed with a hierarchy of places, and with inhibitor arcs, reset arcs and transfer arcs that respect this hierarchy. We also investigate what happens when we have a mix of these special arcs, some of which respect the hierarchy, while others do not. We settle the decidability status of the above four problems for all combinations of hierarchy, inhibitor, reset and transfer arcs, except the termination problem for two combinations. For both these combinations, we show that deciding termination is as hard as deciding the positivity problem on linear recurrence sequences -- a long-standing open problem.

Based on the newly introduced d-decisional Diffie-Hellman (d-DDH) intractable problem, a signature scheme and a multi-signature scheme are proposed. The main method in the constructions is a transformation of a knowledge proof on the equality of two discrete logarithms. The two schemes are proved secure in the random oracle model and the security reductions to the d-DDH problem are tight. Moreover, one can select different d for different security demand of applications. Thus the schemes are secure, efficient and practical.

We investigate the decidability of the monadic second-order (MSO) theory of the structure (N; <, P1,…,Pk), for various unary predicates P1,…,Pk ⊆ N. We focus in particular on 'arithmetic' predicates arising in the study of linear recurrence sequences, such as fixed-base powers Powk = {kn : n ∈ N}, k-th powers Nk = {nk : n ∈ N}, and the set of terms of the Fibonacci sequence Fib = {0, 1, 2, 3, 5, 8, 13,…} (and similarly for other linear recurrence sequences having a single, non-repeated, dominant characteristic root). We obtain several new unconditional and conditional decidability results, a select sample of which are the following:

The main purpose of this paper is using the combinatorial method, the properties of the power series and characteristic roots to study the computational problem of the symmetric sums of a certain second-order linear recurrence sequences, and obtain some new and interesting identities. These results not only improve on some of the existing results, but are also simpler and more beautiful. Of course, these identities profoundly reveal the regularity of the second-order linear recursive sequence, which can greatly facilitate the calculation of the symmetric sums of the sequences in practice.

Gelfond proved that for coprime 𝑏 − 1 and 𝑑 sums of digits of 𝑏-ary expressions of natural numbers are uniformly distributed on arithmetic progressions with the common difference 𝑑. Later, similar result was proved for the representations of natural numbers based on linear recurrent sequences. We consider the remainder term of the corresponding asymptotic formula and study the dichotomy between the logarithmic and power estimates of the remainder term. In the case 𝑑 = 2, we obtain some sufficient condition for the validity of the logarithmic estimate. Using them, we show that the logarithmic estimate holds for expansions based on all second-order linear recurrenct sequences and on infinite family of third-order sequences. Also we construct an example of the linear reccurent sequence of an arbitrary order with such property. On the other hand, we give an example of a third-order linear recurrent sequence for which the logarithmic estimate does not hold. We also show that for 𝑑 = 3 the logarithmic estimate does not hold even in the simplest case of the expansions based on Fibonacci numbers. In addition, we consider the representations of natural numbers based on the denominators of partial convergents of the continued fraction expansions of irrational numbers. In this case, we prove the uniformity of the distribution of sums of digits over arithmetic progressions with the common difference 2 with the logarithmic remainder term.

We establish consequences of the moving form of Schmidt’s Subspace Theorem. Indeed, we obtain inequalities that bound the logarithmic greatest common divisor of moving multivariable polynomials evaluated at moving S S -unit arguments. In doing so, we complement recent work of Levin. As an additional application, we obtain results that pertain to the greatest common divisor problem for algebraic linear recurrence sequences. These observations are motivated by previous related works of Corvaja-Zannier, Levin, and others.