WO2000067423A1 - Public-key signature methods and systems - Google Patents

Abstract

The invention provides for a cryptographic method for digital signature. A set S1 of k polynomial functions Pk(x1, ..., xn+v, y1, ..., y¿k¿) are supplied as a public key, where k, v, and n are integers, x¿1?, ..., xn+v are n+v variables of a first type, and y1, .., yk are k variables of a second type, the set S1 being obtained by applying a secret key operation on a given set S2 of k polynomial functions P'k(a1, ..., an+v, y1, ..., yk), a1, ..., an+v designating n+v variables including a set of n 'oil' and v 'vinegar' variables. A message to be signed is provided and submitted to a hash function to produce a series of k values b1, ..., bk. These k values are substituted for the k variables y1, ...,yk, of the set S2 to produce a set S3 of k polynomial functions P''k(a1, ..., an+v), and v values a'n+1, ..., a'n+v are selected for the v 'vinegar' variables. A set of equations P''k(a1, ..., a'n+v)=0 is solved to obtain a solution for a'1, ..., a'n and the secret key operation is applied to transform the solution to the digital signature.

Description

PUBLIC-KEY SIGNATURE METHODS AND SYSTEMS

FIELD OF THE INVENTION

The present invention generally relates to cryptography, and more particularly to public-key cryptography.

BACKGROUND OF THE INVENTION

The first public-key cryptography scheme was introduced in 1975.

Since then, many public-keys schemes have been developed and published. Many public-key schemes require some arithmetic computations modulo an integer n, where today n is typically between 512 and 1024 bits.

Due to the relatively large number of bits n, such public-key schemes are relatively slow in operation and are considered heavy consumers of random- access-memory (RAM) and other computing resources. These problems are particularly acute in applications in which the computing resources are limited, such as smart card applications. Thus, in order to overcome these problems, other families of public-key schemes which do not require many arithmetic computations modulo n have been developed. Among these other families are schemes where the public-key is given as a set of k multivariable polynomial equations over a finite mathematical field K which is relatively small, e.g., between 2 and 2⁶⁴.

The set of k multivariable polynomial equations can be written as follows:

yι = Pι(xι,...,x_n) y₂ = P₂(^χι,...,^χ _n)

where Pi,..., P_K are multivariable polynomials of small total degree, typically, less than or equal to 8, and in many cases, exactly two.

Examples of such schemes include the C* scheme of T. Matsumoto and H. Imai, the HFE scheme of Jacques Patarin, and the basic form of the "Oil and Vinegar" scheme of Jacques Patarin.

The C* scheme is described in an article titled "Public Quadratic Polynomial-tuples for Efficient Signature Verification and Message-encryption" in Proceedings of EUROCRYPT'88, Springer- Verlag, pp. 419 - 453. The HFE scheme is described in an article titled "Hidden Fields Equations (HFE) and Isomorphisms of Polynomials (IP): Two New Families of Asymmetric Algorithms" in Proceedings of EUROCRYPT'96, Springer- Verlag, pp. 33 - 48. The basic form of the "Oil and Vinegar" scheme of Jacques Patarin is described in an article titled "The Oil and Vinegar Signature Scheme" presented at the Dagstuhl Workshop on Cryptography in September 1997.

However, the C* scheme and the basic form of the "Oil and Vinegar" scheme have been shown to be insecure in that cryptanalysis of both the C* scheme and the basic form of the "Oil and Vinegar" scheme have been discovered and published by Aviad Kipnis and Adi Shamir in an article titled "Cryptanalysis of the Oil and Vinegar Signature Scheme" in Proceedings of CRYPTO'98, Springer- Verlag LNCS n°1462, pp. 257 - 266. Weaknesses in construction of the HFE scheme have been described in two unpublished articles titled "Cryptanalysis of the HFE Public Key Cryptosystem" and "Practical Cryptanalysis of the Hidden Fields Equations (HFE)", but at present, the HFE scheme is not considered compromised since for well chosen and still reasonable parameters, the number of computations required to break the HFE scheme is still too large. Some aspects of related technologies are described in the following publications

US Patent 5,263,085 to Shamir describes a new type of digital signature scheme whose security is based on the difficulty of solving systems of k polynomial equations in m unknowns modulo a composite n, and

US Patent 5,375,170 to Shamir describes a novel digital signature scheme which is based on a new class of birational permutations which have small keys and require few arithmetic operations

The disclosures of all references mentioned above and throughout the present specification are hereby incorporated herein by reference

SUMMARY OF THE INVENTION

The present invention seeks to improve security of digital signature cryptographic schemes in which the public-key is given as a set of k multivariable polynomial equations, typically, over a finite mathematical field K Particularly, the present invention seeks to improve security of the basic form of the "Oil and Vinegar" and the HFE schemes An "Oil and Vinegar" scheme which is modified to improve security according to the present invention is referred to herein as an unbalanced "Oil and Vinegar" (UOV) scheme An HFE scheme which is modified to improve security according to the present invention is referred to herein as an HFEV scheme

In the present invention, a set SI of k polynomial functions is supplied as a public-key The set SI preferably includes the functions Pι(xι, ,x„+_v, yi, ,yk), , Pk(xι, ,x_n+v, yi, ,yk), where k, v, and n are integers, xi, ,x_n+v are n+v variables of a first type, and yi, ,y are k variables of a second type The set SI is preferably obtained by applying a secret key operation on a set S2 of k polynomial functions P'ι(aι, ,a„₊v,yι, ,yύ, ,P\(aι, ,a_n+v,yι, ,y where a., ,a_n+v are n+v variables which include a set of n "oil" variables ai, ,a„, and a set of v "vinegar" variables a„+i, .,a„₊v It is appreciated that the secret key operation may include a secret affine transformation s on the n+v variables ai, ,a_n+v When a message to be signed is provided, a hash function may be applied on the message to produce a series of k values bι,... ,b_k. The series of k values bι,...,bk is preferably substituted for the variables yι,...,y_k of the set S2 respectively so as to produce a set S3 of k polynomial functions P"ι(aι,...,a„+v),..., P"k(ai,...,an+_V). Then, v values a'„+ι,...,a'„+v may be selected for the v "vinegar" variables a_n+ι,...,a„+v, either randomly or according to a predetermined selection algorithm.

Once the v values a'_n+ι, ...,a'_n+_v are selected, a set of equations P"ι(aι,...,a_n,aVι,...,a'_n+v)=0,..., P" (aι,...,a_n,a'_n+ι,...,a'_n+v)=0 is preferably solved to obtain a solution for a'ι,...,a'_n. Then, the secret key operation may be applied to transform a'ι,...,a'_n+v to a digital signature ei,...,en+_v.

The generated digital signature eι,...,e„+v may be verified by a verifier which may include, for example, a computer or a smart card. In order to verify the digital signature, the verifier preferably obtains the signature ei,...,e„+v, the message, the hash function and the public key. Then, the verifier may apply the hash function on the message to produce the series of k values bι,...,bk. Once the k values bι,...,bk are produced, the verifier preferably verifies the digital signature by verifying that the equations Pι(eι,...,en_+v,bι,...,bk)^0,..., P_k(eι,...,e„₊v, b,,...,b_k)=0 are satisfied.

There is thus provided in accordance with a preferred embodiment of the present invention a digital signature cryptographic method including the steps of supplying a set S 1 of k polynomial functions as a public-key, the set S 1 including the functions Pι(xι,...,x„_+V, yι, ..,yk),- ., Pk(xι, ..,x_n+v, yι....,yk), where k, v, and n are integers, xι,...,x„_+v are n+v variables of a first type, yι,...,yk are k variables of a second type, and the set S 1 is obtained by applying a secret key operation on a set S2 of k polynomial functions P',(aι,...,a_n+v,yι,...,yk),...,P'k(aι,...,a_n+v,yι,...,yk) where aι,...,a„_+v are n+v variables which include a set of n "oil" variables aι,...,a_n, and a set of v "vinegar" variables an+ι,...,an+_v, providing a message to be signed, applying a hash function on the message to produce a series of k values bι,...,bk, substituting the series of k values bι,...,bk for the variables yι,...,yk of the set S2 respectively to produce a set S3 of k polynomial functions P"ι(aι,...,a_n+V), - ., P"k(aι,...,an+_V), selecting v values a'_n+ι,...,a'_n+v for the v "vinegar" variables an+ι,...,an+_v, solving a set of equations P"ι(aι,...,a_n,a'_n+ι,...,a'n₊v)=0,... , P"_k(aι,...,a_n,a'_n+ι,...,a'n₊v)=0 to obtain a solution for a'ι,...,a'_n, and applying the secret key operation to transform a'ι,...,a'_n+v to a digital signature eι,...,en+_v-

Preferably, the method also includes the step of verifying the digital signature. The verifying step preferably includes the steps of obtaining the signature ei,...,en+_v, the message, the hash function and the public key, applying the hash function on the message to produce the series of k values bι,...,b_k, and verifying that the equations Pi(ei,...,en_+v,bi,...,b_k)=0,..., P_k(ei,...,en_+V, bι,...,b_k)=0 are satisfied.

The secret key operation preferably includes a secret affine transformation s on the n+v variables aι,...,a_n+v.

Preferably, the set S2 includes the set f(a) of k polynomial functions of the HFEV scheme. In such a case, the set S2 preferably includes an expression including k functions that are derived from a univariate polynomial. The univariate polynomial preferably includes a univariate polynomial of degree less than or equal to 100,000.

Alternatively, the set S2 includes the set S of k polynomial functions of the UOV scheme.

The supplying step may preferably include the step of selecting the number v of "vinegar" variables to be greater than the number n of "oil" variables. Preferably, v is selected such that q^v is greater than 2³², where q is the number of elements of a finite field K.

In accordance with a preferred embodiment of the present invention, the supplying step includes the step of obtaining the set SI from a subset S2' of k polynomial functions of the set S2, the subset S2' being characterized by that all coefficients of components involving any of the yi, ... ,y_k variables in the k polynomial functions P'ι(aι,...,aπ₊v,yι,...,y_k),...,P'_k(aι,...,a_n+v,yι,...,y_k) are zero, and the number v of "vinegar" variables is greater than the number n of "oil" variables.

Preferably, the set S2 includes the set S of k polynomial functions of the UOV scheme, and the number v of "vinegar" variables is selected so as to satisfy one of the following conditions: (a) for each characteristic p other than 2 of a field K in an "Oil and Vinegar" scheme of degree 2, v satisfies the inequality q^(v"n)"1* n⁴ > 2⁴⁰, (b) for p = 2 in an "Oil and Vinegar" scheme of degree 3, v is greater than n*(l + sqrt(3)) and lower than or equal to n 6, and (c) for each p other than 2 in an "Oil and Vinegar" scheme of degree 3, v is greater than n and lower than or equal to n⁴. Preferably, the number v of "vinegar" variables is selected so as to satisfy the inequalities v<n² and q^^"1*¹* n⁴ >2⁴⁰ for a characteristic p=2 of a field K in an "Oil and Vinegar" scheme of degree 2.

There is also provided in accordance with a preferred embodiment of the present invention an improvement of an "Oil and Vinegar" signature method, the improvement including the step of using more "vinegar" variables than "oil" variables. Preferably, the number v of "vinegar" variables is selected so as to satisfy one of the following conditions: (a) for each characteristic p other than 2 of a field K and for a degree 2 of the "Oil and Vinegar" signature method, v satisfies the inequality q^¹* _n ⁴ > 2⁴⁰, (b) for p = 2 and for a degree 3 of the "Oil and Vinegar" signature method, v is greater than n*(l + sqrt(3)) and lower than or equal to n³/6, and (c) for each p other than 2 and for a degree 3 of the "Oil and Vinegar" signature method, v is greater than n and lower than or equal to n⁴. Preferably, the number v of "vinegar" variables is selected so as to satisfy the inequalities v<n² and q^^{"1 "1}* n⁴ >2⁴⁰for a characteristic p=2 of a field K in an "Oil and Vinegar" scheme of degree 2.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be understood and appreciated more fully from the following detailed description, taken in conjunction with the drawings in which: Fig. 1 is a simplified block diagram illustration of a preferred implementation of a system for generating and verifying a digital signature to a message, the system being constructed and operative in accordance with a preferred embodiment of the present invention;

Fig. 2A is a simplified flow chart illustration of a preferred digital signature cryptographic method for generating a digital signature to a message, the method being operative in accordance with a preferred embodiment of the present invention; and

Fig. 2B is a simplified flow chart illustration of a preferred digital signature cryptographic method for verifying the digital signature of Fig. 2A, the method being operative in accordance with a preferred embodiment of the present invention.

Appendix I is an article by Aviad Kipnis, Jacques Patarin and Louis Goubin submitted for publication by Springer- Verlag in Proceedings of EUROCRYPT'99, the article describing variations of the UOV and the HFEV schemes.

DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT

Reference is now made to Fig. 1 which is a simplified block diagram illustration of a preferred implementation of a system 10 for generating and verifying a digital signature to a message, the system 10 being constructed and operative in accordance with a preferred embodiment of the present invention.

Preferably, the system 10 includes a computer 15, such as a general purpose computer, which communicates with a smart card 20 via a smart card reader 25. The computer 15 may preferably include a digital signature generator 30 and a digital signature verifier 35 which may communicate data via a communication bus 40. The smart card 20 may preferably include a digital signature generator 45 and a digital signature verifier 50 which may communicate data via a communication bus 55.

It is appreciated that in typical public-key signature scheme applications, a signer of a message and a receptor of a signed message agree on a public-key which is published, and on a hash function to be used. In a case that the hash function is compromised, the signer and the receptor may agree to change the hash function. It is appreciated that a generator of the public-key need not be the signer or the receptor. Preferably, the digital signature verifier 35 may verify a signature generated by one of the digital signature generator 30 and the digital signature generator 45. Similarly, the digital signature verifier 50 may verify a signature generated by one of the digital signature generator 30 and the digital signature generator 45. Reference is now made to Fig. 2A which is a simplified flow chart illustration of a preferred digital signature cryptographic method for generating a digital signature to a message in a first processor (not shown), and to Fig. 2B which is a simplified flow chart illustration of a preferred digital signature cryptographic method for verifying the digital signature of Fig. 2A in a second processor (not shown), the methods of Figs. 2A and 2B being operative in accordance with a preferred embodiment of the present invention. It is appreciated that the methods of Figs 2A and 2B may be implemented in hardware, in software or in a combination of hardware and software Furthermore, the first processor and the second processor may be identical Alternatively, the method may be implemented by the system 10 of Fig 1 in which the first processor may be comprised, for example, in the computer 15, and the second processor may be comprised in the smart card 20, or vice versa

The methods of Fig 2A and 2B, and applications of the methods of

Figs 2A and 2B are described in Appendix I which is incorporated herein The applications of the methods of Figs 2A and 2B may be employed to modify the basic form of the "Oil and Vinegar" scheme and the HFE scheme thereby to produce the

UOV and the HFEV respectively

Appendix I includes an unpublished article by Aviad Kipnis, Jacques

Patarin and Louis Goubin submitted for publication by Spπnger-Verlag in

Proceedings of EUROCRYPT'99 which is scheduled on 2 - 6 May 1999 The article included in Appendix I also describes variations of the UOV and the HFEV schemes with small signatures

In the digital signature cryptographic method of Fig 2 A, a set SI of k polynomial functions is preferably supplied as a public-key (step 100) by a generator of the public-key (not shown) which may be, for example, the generator 30 of Fig 1, the generator 45 of Fig 1, or an external public-key generator (not shown)

The set SI preferably includes the functions Pι(xι, ,x_n+v, yi, ..,y_k), , Pk(xι, ,x_n+v, yi, ,y_k), where k, v, and n are integers, x ,x_n+v are n+v variables of a first type, and yi, ,y_k are k variables of a second type The set SI is preferably obtained by applying a secret key operation on a set S2 of k polynomial functions P'ι(aι, ,a„₊v,yι, ,y_k), ,P\(aι, ,a„_+v,yι, ,y_k) where a_u ,a„_+v are n+v variables which include a set of n "oil" variables ai, ,a„, and a set of v "vinegar" variables a„₊ι, ..,a_n+v It is appreciated that the secret key operation may include a secret affine transformation s on the n+v variables ai, ,a_n+v

The terms "oil" variables and "vinegar" variables refer to "oil" variables and "vinegar" variables as defined in the basic form of the "Oil and

Vinegar" scheme of Jacques Patarin which is described in the above mentioned article titled "The Oil and Vinegar Signature Scheme" presented at the Dagstuhl Workshop on Cryptography in September 1997.

Preferably, when a message to be signed is provided (step 105), a signer may apply a hash function on the message to produce a series of k values bι,...,b_k (step 110). The signer may be, for example, the generator 30 or the generator 45 of Fig. 1. The series of k values bι,...,b is preferably substituted for the variables yι,...,yk of the set S2 respectively so as to produce a set S3 of k polynomial functions P"ι(aι,...,an+_V), .., P"_k(aι,...,an+_V) (step 115). Then, v values a'n+ι,...,a'_n+v may be randomly selected for the v "vinegar" variables a_n+ι,...,a_n+v (step 120). Alternatively, the v values a'_n+ι,...,a'_n+v may be selected according to a predetermined selection algorithm.

Once the v values aVι,...,a'_n+v are selected, a set of equations P"i(ai,...,an,a'_n+i,...,a'n₊v)=0,..., P"_k(aι,...,a_n,a'n₊ι,...,a'_n+v)=0 is preferably solved to obtain a solution for a'ι,...,a'_n (step 125). Then, the secret key operation may be applied to transform a'ι,...,a'_n+v to a digital signature eι,...,e_n+v (step 130).

The generated digital signature eι,...,en+_v may be verified according to the method described with reference to Fig. 2B by a verifier of the digital signature (not shown) which may include, for example, the verifier 35 or the verifier 50 of Fig. 1. In order to verify the digital signature, the verifier preferably obtains the signature ei,...,en+_v, the message, the hash function and the public key (step 200). Then, the verifier may apply the hash function on the message to produce the series of k values bι,...,b_k (step 205). Once the k values b_t,...,b_k are produced, the verifier preferably verifies the digital signature by verifying that the equations Pι(eι,...,e_n+v,b₁,...,b_k)=0,..., P_k(eι,...,en_+V, bι,...,b_k)=0 are satisfied (step 210). It is appreciated that the generation and verification of the digital signature as mentioned above may be used for the UOV by allowing the set S2 to include the set S of k polynomial functions of the UOV scheme as described in Appendix I. Alternatively, the generation and verification of the digital signature as mentioned above may be used for the HFEV by allowing the set S2 to include the set f(a) of k polynomial functions of the HFEV scheme as described in Appendix I. As mentioned in Appendix I, the methods of Figs 2A and 2B enable obtaining of digital signatures which are typically smaller than digital signatures obtained in conventional number theoretic cryptography schemes, such as the well known RSA scheme In accordance with a preferred embodiment of the present invention, when the set S2 includes the set S of k polynomial functions of the UOV scheme, the set SI may be supplied with the number v of "vinegar" variables being selected to be greater than the number n of "oil" variables Preferably, v may be also selected such that q^v is greater than 2³², where q is the number of elements of a finite field K over which the sets S 1 , S2 and S3 are provided

Further preferably, the SI may be obtained from a subset S2' of k polynomial functions of the set S2, the subset S2' being characterized by that all coefficients of components involving any of the yi, ,y_k variables in the k polynomial functions P'ι(aι, ,a„_+v,yι, ,y_k), ,P\(aι, ,a_n+v,yι, ,y_k) are zero, and the number v of "vinegar" variables is greater than the number n of "oil" variables

In the basic "Oil and Vinegar" scheme, the number v of "vinegar" variables is chosen to be equal to the number n of "oil" variables For such a selection of the v variables, Aviad Kipnis, who is one of the inventors of the present invention, and Adi Shamir have shown, in the above mentioned Proceedings of CRYPTO 98, Springer, LNCS n°1462, on pages 257 - 266, a cryptanalysis of the basic "Oil and Vinegar" signature scheme which renders the basic "Oil and Vinegar" scheme insecure Additionally, by applying the same method described by Kipnis and Shamir, the basic "Oil and Vinegar" scheme may be shown to be insecure for any number v of "vinegar" variables which is lower than the number n of "oil" variables The inventors of the present invention have found, as described in

Appendix I, that if the "Oil and Vinegar" scheme is made unbalanced by modifying the "Oil and Vinegar" scheme so that the number v of "vinegar" variables is greater than the number n of "oil" variables, a resulting unbalanced "Oil and Vinegar" (UOV) scheme may be secure Specifically, for a UOV of degree 2 and for all values of p other than

2, where p is a characteristic of the field K, p being the additive order of 1, the UOV scheme is considered secure for values of v which satisfy the inequality q^^{"1 1}* n⁴ > 2⁴⁰. For a UOV of degree 2 and for p=2, the number v of "vinegar" variables may be selected so as to satisfy the inequalities v<n² and q^(v~nH* n⁴>2⁴⁰. It is appreciated that for values of v which are higher than n²/2 but less than or equal to n², the UOV is also considered secure, and solving the set SI is considered to be as difficult as solving a random set of k equations. For values of v which are higher than n², the UOV is believed to be insecure.

Furthermore, for a UOV of degree 3 and for p = 2, the UOV scheme is considered secure for values of v which are substantially greater than n*(l + sqrt(3)) and lower than or equal to n 6. It is appreciated that for values of v which are higher than n³/6 but lower than or equal to n³/2, the UOV is also considered secure, and solving the set S 1 is considered to be as difficult as solving a random set of k equations. For values of v which are higher than n /2, and for values of v which are lower than n*(l + sqrt(3)), the UOV is believed to be insecure. Additionally, for a UOV of degree 3 and for p other than 2, the UOV scheme is considered secure for values of v which are substantially greater than n and lower than or equal to n⁴. It is appreciated that for values of v which are higher than n³/6 but lower than or equal to n⁴, the UOV is also considered secure, and solving the set SI is considered to be as difficult as solving a random set of k equations. For values of v which are higher than n⁴, and for values of v which are lower than n, the UOV is believed to be insecure.

Preferably, in a case that the set S2 includes the set f(a) of k polynomial functions of the HFEV scheme, the set S2 may include an expression which includes k functions that are derived from a univariate polynomial. Preferably, the univariate polynomial may include a polynomial of degree less than or equal to 100,000 on an extension field of degree n over K.

Example of parameters selected for the UOV and the HFEV schemes are shown in Appendix I.

It is appreciated that various features of the invention which are, for clarity, described in the contexts of separate embodiments may also be provided in combination in a single embodiment. Conversely, various features of the invention which are, for brevity, described in the context of a single embodiment may also be provided separately or in any suitable subcombination.

It will be appreciated by persons skilled in the art that the present invention is not limited by what has been particularly shown and described hereinabove. Rather the scope of the invention is defined only by the claims which follow.

APPENDIX I 14

Unbalanced Oil and Vinegar Signature

Schemes

Aviad Kipnis Jacques Patarin, Louis Goubin

NDS Technologies Bull SmartCards and Terminals

5 Hamarpe St. Har Hotzvim 68, route de Versailles - BP45

Jerusalem - Israel 78431 Louveciennes Cedex - France akipnis@ndsisrael.com {J. Patarin, L.Goubin}@frlv.bull.fr

Abstract

In [16], J. Patarin designed a new scheme, called "Oil and Vinegar" , for computing asymmetric signatures. It is very simple, can be computed very fast (both in secret and public key) and requires very little RAM in smartcard implementations. The idea consists in hiding quadratic equations in n unknowns called "oil" and υ = n unknowns called "vinegar" over a finite field K, with linear secret functions. This original scheme was broken in [10] by A. Kipnis and A. Shamir. In this paper, we study some very simple variations of the original scheme where v > n (instead of υ = n). These schemes are called "Unbalanced Oil and Vinegar" (UOV), since we have more "vinegar" unknowns than "oil" unknowns. We show that, when υ _ n, the attack of [10] can be extended, but when v > 2n for example, the security of the scheme is still an open problem. Moreover, when υ ~ , the security of the scheme is exactly equivalent (if we accept a very natural but not proved property) to the problem of solving a random set of n quadratic equations in unknowns (with no trapdoor) . However, we show that (in characteristic 2) when v > n² , finding a solution is generally easy. Then we will see that it is very easy to combine the Oil and Vinegar idea and the HFE schemes of [14]. The resulting scheme, called HFEV, looks at the present also very interesting both from a practical and theoretical point of view. The length of a UOV signature can be as short as 192 bits and for HFEV it can be as short as 80 bits.

Note: An extended version of this paper can be obtained from the authors.

1 Introduction

Since 1985, various authors (see [7], [9], [12], [14], [16], [17], [18], [21] for example) have suggested some public key schemes where the public key is given as a set of multivariate quadratic (or higher degree) equations over a small finite field K. The general problem of solving such a set of equations is NP-hard (cf [8]) (even in the quadratic case). Moreover, when the number of unknowns is, say, n > 16, the best known algorithms are often not significantly better than exhaustive search (when n is very small, Grobner bases algorithms are more efficient, cf [6]).

The schemes are often very efficient in terms of speed or RAM required in a smartcard implementation. (However, the length of the public key is generally > 1 Kbyte. Nevertheless, it is sometimes useful to notice that secret key computations can be performed without the public key). The most serious problem is that, in order to introduce a trapdoor (to allow the computation of signatures or to allow the decryption of messages when a secret is known) , the generated set of public equations generally becomes a small subset of all the possible equations and, in many cases, the algorithms have been broken. For example [7] was broken by their authors, and [12], [16], [21] were broken. However, many schemes are still not broken (for example [14], [17], [18], [20]), and also in many cases, some very simple variations have been suggested in order to repair the schemes. Therefore, at the present, we do not know whether this idea of designing public key algorithms with multivariate polynomials over small finite fields is a very powerful idea (where only some too simple schemes are insecure) or not.

In this paper, we will present two new schemes: UOV and HFEV. UOV is a very simple scheme: the original Oil and Vinegar signature scheme (of [16]) was broken (see [10]), but if we have significantly more "vinegar" unknowns than "oil" unknowns (a definition of the "oil" and "vinegar" unknowns can be found in section 2), then the attack of [10] does not work and the security of this more general scheme (called UOV) is still an open problem. We will also study Oil and Vinegar schemes of degree three (instead of two). Then, we will present another scheme, called HFEV. HFEV combines the ideas of HFE (of [14]) and of vinegar variables. HFEV looks more efficient than the original HFE scheme. Finally, in section 13, we present what we know about the main schemes in this area of multivariate polynomials.

2 The (Original and Unbalanced) Oil and Vinegar of degree two

Let K — _ _q be a small finite field (for example K = F₂). Let n and v be two integers. The message to be signed (or its hash) is represented as an element of Kⁿ, denoted by y = (j χ, ... , ?/„). Typically, qⁿ _ 2¹²⁸ (in section 8, we will see that qⁿ _ 2⁶⁴ is also possible). The signature x is represented as an element of jζⁿ+^v denoted by x = (xι , ..., x_n+_v)-

Secret key

The secret key is made of two parts:

1. A bijective and affine function s : K^n+V — ► K^n+V. By "affine" , we mean that each component of the output can be written as a polynomial of degree one in the n + v input unknowns, and with coefficients in K.

2. A set (<S) of n equations of the following type:

Vi,l < i < n,y_t = ∑7ι_]kaja'_k+∑\_ljka_J'a_k+∑ξ_tja_J+∑ξ_l'_Ja_]'+δ_t (S).

The coefficients _tJk, _jk- ζi_j, ζ_t'_J ^an<3 δ_t are the secret coefficients of these n equations. The values αi, ..., a_n (the "oil" unknowns) and a'_x, ..., a'_v (the "vinegar" unknowns) lie in K. Note that these equations (S) contain no terms in a_τa₃.

Public key

Let A be the element of K^n+V defined by A = (αi, ..., „, a[, ..., a'_υ). A is transformed into x = s^~1(A), where s is the secret, bijective and affine function from K^n+V to K^n+V . Each value y_t, 1 < i < n, can be written as a polynomial P_% of total degree two in the x_} unknowns, 1 < j < n + v. We denote by (V) the set of the following n equations:

Mi, l≤i≤n, y_l=P_t(x₁,...,x_n+υ) (V).

These n quadratic equations (V) (in the n + v unknowns x₃) are the public key.

Computation of a signature (with the secret key)

The computation of a signature x of y is performed as follows: Step 1: We find n unknowns αi ...., o„ of K and υ unknowns a , ..., a_v' of K such that the n equations (S) are satisfied. This can be done as follows: we randomly choose the v vinegar unknowns a, and then we compute the a_t unknowns from (<S) by Gaussian reductions (because - since there are no a_ta_j terms - the (S) equations are affine in the a_t unknowns when the a are fixed).

Remark: If we find no solution, then we simply try again with new random vinegar unknowns. After very few tries, the probability of obtaining at least one solution is very high, because the probability for a n x n matrix over F_q to be invertible is not negligible. (It is exactly (l-i)(l- -)...(l- ^τ). For 9 = 2, this gives approximately 30 %, and for q > 2, this probability is even larger.)

Step 2: We compute x — s^~l(A), where A = (αi, ..,a_n,a , ...,a'_υ). x is a signature of y.

Public verification of a signature

A signature x of y is valid if and only if all the (V) are satisfied. As a result, no secret is needed to check whether a signature is valid: this is an asymmetric signature scheme. Note: The name "Oil and Vinegar" comes from the fact that - in the equations (S) - the "oil unknowns" a_t and the "vinegar unknowns" a' are not all mixed together: there are no a_la_J products. However, in (V), this property is hidden by the "mixing" of the unknowns by the s transformation. Is this property "hidden enough" ? In fact, this question exactly means: "is the scheme secure ?" . When υ = n, we call the scheme "Original Oil and Vinegar" , since this case was first presented in [16]. This case was broken in [10]. It is very easy to see that the cryptanalysis of [10] also works, exactly in the same way, when v < n. However, the cases v > n are, as we will see, much more difficult. When v > n, we call the scheme "Unbalanced Oil and Vinegar" .

3 Cryptanalysis of the case v = n (from [10])

The idea of the attack of [10] is essentially the following: In order to separate the oil variables and the vinegar Λ-ariables, we look at the quadratic forms of the n public equations of (V), we omit for a while the linear terms. Let G for 1 < i < n be the respective matrix of the quadratic form of P_t of the public equations (V). The quadratic part of the equations in the set (S) is represented as a quadratic form with a corresponding 2n x 2n matrix of the form : I _R -, ) , the upper left n x n zero submatrix is due to the fact that an oil variable is not multiplied by an oil variable. After hiding the internal variables with the linear function s, we get a representation for the matrices

G_ι = S I _R _^l I S', where S is an invertible In x In matrix.

Definition 3.1: We define the oil subspace to be the linear subspace of all vectors in K²ⁿ whose second half contains only zeros.

Definition 3.2: We define the vinegar subspace as the linear subspace of all vectors in K²ⁿ whose first half contains only zeros.

Lemma 1 Let E and F be a 2n x 2n matrices with an upper left zero n x n submatrix. If F is inυertible then the oil subspace is an invariant subspace of EF-¹.

Proof: see [10].

Definition 3.4: For an invertible matrix G₃ , define G_t] = G_tG ^l.

Definition 3.5: Let O be the image of the oil subspace by 5^_1. In order to find the oil subspace, we use the following theorem:

Theorem 3.1 O is a common invariant subspace of all the matrices G_tJ . Proof:

_G„ = s _Bt A ) _W)- ( ° ^A _c> i 4-

The two inner matrices have the form of E and F in lemma 1. Therefore, the oil subspace is an invariant subspace of the inner term and 0 is an invariant subspace of G G^~l . The problem of finding common invariant subspace of set of matrices is studied in [10]. Applying the algorithms in [10] gives us O. We then pick V to be an arbitrary subspace of dimension n such that V + O = K²ⁿ, and they give an equivalent oil and vinegar separation. Once we have such a separation, we bring back the linear terms that were omitted, we pick random values for the vinegar variables and left with a set of n linear equations with n oil variables.

Note: Lemma 1 is not true any more when υ > n. The oil subspace is still mapped by E and F into the vinegar subspace. However ^"1 does not necessary maps the image by E of the oil subspace back into the oil subspace and this is why the cryptanalysis of the original oil and vinegar is not valid for the unbalanced case.

4 Cryptanalysis when v > n and v _ n

In this section, we will describe a modification of the above attack, that is applicable as long as υ — n is small (more precisely the expected complexity of the attack is approximately ς^(υ_n)_1 • n⁴).

Definition 4.1: We define in this section the oil subspace to be the linear subspace of all vectors in K^n+υ whose last v coordinates are only zeros.

Definition 4.2: We define in this section the vinegar subspace to be the linear subspace of all vectors in K^n+V whose first n coordinates are only zeros.

Here in this section, we start with the homogeneous quadratic terms of the equations: we omit the linear terms for a while. The matrices G_t have the representation

where the upper left matrix is the n x n zero matrix, A_t is a n x v matrix, B_τ is a v x n matrix, C_τ is a v x υ matrix and S is a (n + v) x (n + v) invertible linear matrix. 0 A_t

Definition 4.3: Define E, to be B_t d

Lemma 2 For any matrix E that has the form I _R „ 1 , the following holds: a) E transforms the oil subspace into the vinegar subspace. b) If the matrix E^_1 exists, then the image of the vinegar subspace by E^~x is a subspace of dimension v which contains the n-dimensional oil subspace

Proof: a) follows directly from the definition of the oil and vinegar subspaces. When a) is given then b) is immediate.

The algorithm we propose is probabilistic. It looks for an invariant subspace of the oil subspace after it is transformed by S. The probability for the algorithm to succeed on the first try is small. Therefore we need to repeat it with different inputs. We use the following property: any linear combination of the matrices

0 A ^'

Ei , ..., E_n is also of the form I _R _ J . The following theorem explains why an invariant subspace may exist with a certain probability.

Theorem 4.1 Let F be an invertible linear combination of the matrices Ei, ..., E„. Then for any k such that E_k ^l exists, the matrix FE_k ^λ has a non trivial invariant subspace which is also a subspace of the oil subspace, with probability not less than U for d = υ — n.

Proof: See the extended version of this paper.

Note: It is possible to get a better result for the expected number of eigenvectors and with much less effort: 7ι is a subspace with dimension not less than n — d and is mapped by FE^¹ into a subspace with dimension n. The probability for a non zero vector to be mapped to a non zero multiple of itself is ^qL_ . To get the expected value, we multiply it by the number of non zero vectors in Ji . It gives a value which is not less than ^^q~ ''„_₁ ^~ ' . Since every eigenvector is counted q — 1 times, then the expected number of invariant subspcaes of dimension 1 is not less than ^q ₁ ~ q .

We define O as in section 3 and we get the following result for O:

Theorem 4.2 Let F be an invertible linear combination of the matrices Gi ; ..., G_n. Then for any k such that G ¹ exists, the matrix FGI¹ has a non trivial invariant subspace, which is also a subspace of O with probability not less than ^ - for d = v - n. Proof:

= S(aιEι + ... +

= S(_aιEι + ... + a_nE_n)E_k ^l S^'1.

The inner term is an invariant subspace of the oil subspace with the required probability. Therefore, the same will hold for FG_k , but instead of a subspace of the oil subspace, we get a subspace of O.

How to find O ?

We take a random linear combination of G , ..., G_n and multiply it by an inverse of one of the G matrices. Then we calculate all the minimal invariant subspaces of this matrix (a minimal invariant subspace of a matrix A contains no non trivial invariant subspaces of the matrix A - these subspaces corresponds to irreducible factors of the characteristic polynomial of A). This can be done in probabilistic polynomial time using standard linear algebra techniques. This matrix may have an invariant subspace wich is a subspace of O.

The following lemma enables us to distinguish between subspaces that are contained in O and random subspaces.

Lemma 3 If H is a linear subspace and H c O, then for every x, y in H and every i, G_%(x, y) = 0 (here we regard G_τ as a bilinear form).

Proof: There are x' and y' in the oil subspace such that x' = xS and y' = yS.

G_t(χ,v) = _*s ( _B° _t ) sy = _*' ( ^ ) (y')' = o.

The last term is zero because x' and y' are in the oil subspace.

Lemma 3 gives a polynomial test to distinguish between subspaces of O and random subspaces. If the matrix we used has no minimal subspace which is also a subspace of O, then we pick another linear combination of Gi , ..., G_n, multiply it by an inverse of one of the G_k matrices and try again. After repeating this process approximately q^d~x times, we find with good probability at least one zero vector of O. We continue the process until we get n independent vectors of O. These vectors span O. The expected complexity of the process is proportional to q^{d~1 ■} n⁴. We use here the expected number of tries until we find a non trivial invariant subspace and the term n⁴ covers the computational linear algebra operations we need to perform for evey try.

_— 2 2

5 The cases v _ (or v > y)

Property

Let (A) be a random set of n quadratic equations in (n + v) variables n , ..., x +_υ. (By "random" we mean that the coefficients of these equations are uniformly and randomly chosen). When v ~ (and more generally when v _ ), there is probably - for most of such (A) - a linear change of variables (xi , ..., x_n+_υ) >-+ (x' , ..., x'_n+υ) such that the set (.4') of (A) equations written in (x , ..., x_n' _+v) is an "Oil and Vinegar" system (i.e. there are no terms in x ■ x'- with i < n and j < n).

An argument to justify the property

Let

^' Xi = ai X'i + ^Ql.2X₂ + — + aι,n+υ '_n+υ

, n+υ ⁼ C⁽n+v,l ι + ^Q-n+v, 2 ' ^{■ ■ ■} <^~ Ctn+v,n+vX_n+v

By writing that the coefficient in all the n equations of (A) of all the x ■ x_j' (i < n and j < n) is zero, we obtain a system of n ^■ n ^■ ^- quadratic equations in the (n + v) - n variables α^ (1 < i < n + v, 1 < j < n). Therefore, when υ > approximately , we may expect to have a solution for this system of equations for most of (A).

Remarks:

1. This argument is very natural, but this is not a complete mathematical proof.

2. The system may have a solution, but finding the solution might be a difficult problem. This is why an Unbalanced Oil and Vinegar scheme might be secure (for well chosen parameters): there is always a linear change of variables that makes the problem easy to solve, but finding such a change of variables might be difficult.

3. In section 7, we will see that, despite the result of this section, it is not recommended to choose v > n² (at least in characteristic 2) .

6 Solving a set of n quadratic equations in k unknowns, k > n, is NP-hard

(See the extended version of this paper.)

7 A generally (but not always) efficient algorithm for solving a random set of n quadratic equations in n² (or more) unknowns

In this section, we describe an algorithm that solves a system of n randomly chosen quadratic equations in n + v variables, when v > n². Let (S) be the following system:

∑ a_lJix,x₃+ ∑ b_tιx_t + δι=0 l<ι<3<n-{-h l<.ι<n+v

2_ Uj_j-nXiX + 2_ Oιn ι + O_n ⁼ U l<ι<j<n+v l<ι<n+v

The main idea of the algorithm consists in using a change of variables such as:

%l = C-1,121 + ^Q2,l2/2 + ••• + Cin+υ,iyn+v

■ Xn+v =

whose a_ltJ coefficients (for 1 < i < n, 1 < j < n + v) are found step by step, in order that the resulting system (S¹) (written with respect to these new variables 2/ι, ..., y_n+v) is easy to solve.

• We begin by choosing randomly αι,ι, ..., αι,„+„.

• We then compute 0₂,1, ....0:₂, _n+_u such that (S¹) contains no j/ιj/₂ terms. This condition leads to a system of n linear equations on the (n + v) unknowns α_2j (1 < j < n + v ): ^ α_tjkαι,_{l 2},_j =0 (1 < k < n).

\<ι<j<n+v

• We then compute 03,1, --•, ctz,n+v such that (S¹) contains neither j/ιj₃ terms, nor t₂2₃ terms. This condition is equivalent to the following system of 2n linear equations on the (n + v) unknowns α^,₃ (1 < j <n + v):

{ ∑ α_ljkαι_{tl 3},_j =0 (1 < k < n) l<ι<3<n+v ∑ α_ljkα₂,,α₃,_j =0 -≤k≤n)

_ι<]<n+v

Finally, we compute α„,ι...., α„,_n+t, such that (<S') contains neither yιy_n terms, nor j/₂2_n terms, ..., nor y_n-ιy_n terms. This condition gives the following system of (n — l)n linear equations on the (n + υ) unknowns OL_n,j (1 < j <n + v): α _kα_ltlα_n =0 (1 < k < n)

α_τjkα_n- _tlα_n -0 (1 < k < n)

In general, all these linear equations provide at least one solution (found by Gaussian reductions). In particular, the last system of n(n — 1) equations and (n + v) unknowns generally gives a solution, as soon as n + υ > n(n — 1), i.e. v > n(n — 2), which is true by hypothesis. O-l.l \ °t-n,\ \

Moreover, the n vectors ■ ' , ..., ^'• are very likely to be

\ O-l.n+v ) \ OL-n.n+v J linearly independent for a random quadratic system (<S).

The remaining α_tJ constants (i.e. those with n + 1 < i < n + υ and 1 < j < n + 1) are randomly chosen, so as to obtain a bijective change of variables.

By rewriting the system (<S) with respect to these new variables y_t, we are led to the following system:

Σ βi.lV² + ∑ VtLt.i n+l , ..., y_n+υ) + Ql(Vn+l , —, y_n+υ) = 0 »=1 ι=l

(S¹)

Σ βι,_ny² + ∑ yι _n{y_n+ι , ..., y_n+v) + Q_n(y_n+ι , —, y_n+v)

1=1 ι-\ where each L_ltJ is an affine function and each Q_τ is a quadratic function. We then compute y_n+ι , ■■■, yn+v such that:

Vi, 1 < i < n, V , 1 < j < n + v, L_ttJ (y_n+ι , ..., y_n+υ) = 0.

This is possible because we have to solve a linear system of n² equations and v unknowns, which generally provides at least one solution, as long as υ > n². We pick one of these solutions. In general, this gives the y² by Gaussian reduction. Then, in characteristic 2, since x *-+ x² is a bijection, we will then find easily a solution for the y_t from this expression of the y². In characteristic 2, it will also succeed when 2™ is not too large (i.e. when n < 40 for example). When n is large, there is also a method to find a solution, based on the general theory of quadratic forms. Due to the lack of space, this method will be found in the extended version of this paper.

8 A variation with twice smaller signatures

In the UOV described in section 2. the public key is a set of n quadratic equations yi = P_t (xi, ..., x_n+_v), for 1 < i < n, where y = (j/i , ..., t/„) is the hash value of the message to be signed. If we use a collision-free hash function, the hash value must at least be 128 bits long. Therefore, qⁿ must be at least 2¹²⁸, so that the typical length of the signature, if υ = 2n, is at least 3 x 128 = 384 bits.

As we see now, it is possible to make a small variation in the signature design in order to obtain twice smaller signatures. The idea is to keep the same polynomial P_τ (with the same associated secret key) , but now the public equations that we check are:

Vi, P_l(xι , ..., x_n+V) + L_t(y , ..., y_n, xι , ..., x_n+υ) = 0, where L_% is a linear function in (xχ . ..., _c_n+υ) and where the coefficients of L_t are generated by a hash function in (j/_{1 ;} ..., y„).

For example L_t(yι , ..., y_n, xι x_n+v) = ctιXι +a₂X2 + ■■■ + a_n+vx_n+v, where

(aι , a2 , —, a_n+v) = Hash (j/i , .... 2 „ || - Now, n can be chosen such that qⁿ > 2⁶⁴ (instead qⁿ > 2¹²⁸). (Note: qⁿ must be > 2⁶⁴ in order to avoid exhaustive search on a solution x). If υ = 2n and ςr^ra ~ 2⁶⁴, the length of the signature will be 3 x 64 = 192 bits.

9 Oil and Vinegar of degree three

The scheme

The quadratic Oil and Vinegar schemes described in section 2 can easily be extended to any higher degree. In the case of degree three, the set (S) of hidden equations are of the following type: for all i < n, yι ^~ __ "tuktctja i + _Z

+ _Z Vn_kθ!₃o!_k + ∑ ξ_t]a, + ∑ ξ^' + δ (S).

are xe .

The computation of the public key, the computation of a signature and the verification of a signature are done as before.

First cryptanalysis of Oil and Vinegar of degree three when v < n

We can look at the quadratic part of the public key and attack it exactly as for an Oil and Vinegar of degree two. This is expected to work when υ < n.

Note: If there is no quadratic part (i.e. is the public key is homogeneous of degree three), or if this attack does not work, then it is always possible to apply a random affine change of variables and to try again.

Cryptanalysis of Oil and Vinegar of degree three when υ < (1 + /3)n and K is of characteristic 2 (from an idea of D. Coppersmith, cf [4])

The key idea is to detect a "linearity" in some directions. We search the set V of the values d = (di , ..., d_n+υ) such that:

Vs, Vt, 1 < i < n, P_τ{x + d) + P_t{x - d) - 2P_t(x) (#). By writing that each x_k indeterminate has a zero coefficient, we obtain n - (n + v) quadratic equations in the (n + υ) unknowns d₃.

(Each monomial x_tx₃x_k gives (x₂ + d₃)(x + d_k)[xe + de) + (x₃ — d_J){x_k — d_k)(xe - d_e) - 2x_Jx_kxe, i.e. 2(x₃d_kde + x d_jdc + xed_jd_k).)

Furthermore, the cryptanalyst can specify about n — 1 of the coordinates d_k of d, since the vectorial space of the correct d is of dimension n. It remains thus to solve n - (n + v) quadratic equations in (v + 1) unknowns d_} . When v is not too large (typically when ^^v+ ₂ ' < n(n + υ), i.e. when v < (1 + y/3)n), this is expected to be easy. As a result when υ < approximately (1 + y/S)n and \K\ is odd, this gives a simple way to break the scheme.

Note 1: When υ is sensibly greater than (1 + /3)n (this is a more unbalanced limit than what we had in the quadratic case), we do not know at the present how to break the scheme.

Note 2: Strangely enough, this cryptanalysis of degre three Oil and Vinegar schemes does not work on degree two Oil and Vinegar schemes. The reason is that - in degree two -writing

Vx, Vi, 1 < i < n, P_t{x + d) + P_t(x - d) = 2P_t(x) only gives n equations of degree two on the (n + v) d unknowns (that we do not know how to solve). (Each monomial x₃x_k gives (x_} + d_j)(x_k + d_k) + (x_j — d_j)(x_k - d_k) - 2x_jX_k, i.e. 2d_jd_k.)

Note 3: In degree two, we have seen that Unbalanced Oil and Vinegar public keys are expected to cover almost all the set of n quadratic equations when v — ^! . In degree three, we have a similar property: the public keys are expected to cover almost all the set of n cubic equations when v _ *g- (the proof is similar).

10 Another scheme: HFEV

In the "most simple" HFE scheme (we use the notations of [14]), we have b = f(a), where: f(a) = ∑ β a*^θ-^{1 +}'^φ" -r- ∑ α.α^ + μo, (1)

where β_l , a_t and μo are elements of the field F_ρ« . Let v be an integer (v will be the number of extra x_% variables, or the number of "vinegar" variables that we will add in the scheme). Let a' — (a[, ■■■, '_v) be a υ-uple of variables of K. Let now each a_τ of (1) be an element of Ε_qn such that each of the n components of α₂ in a basis is a secret random linear function of the vinegar variables αi , ..., a'_v. And in (1), let now μ_o be an element of F₉n such that each one of the n components of μo in a basis is a secret random quadratic function of the variables a[ , ..., a'_υ. Then, the n + v variables oi , ..., α„, a[ , ..., a'_υ will be mixed in the secret affine bijection s in order to obtain the variables x , ..., x_n+_v. And, as before, t(bι , ..., b_n) = (yι , —, y_n), where t is a secret affine bijection. Then the public key is given as the n equations yi = Pi{x_\ , ..., x_n+υ). To compute a signature, the vinegar values a . ..., a'_υ will simply be chosen at random. Then, the values μo and α; will be computed. Then, the monovariate equations (1) will be solved (in o) in F_?™ .

Example: Let K = F₂. In HFEV, let for example the hidden polynomial be: f(a) = a¹⁷ + β₁₆a¹⁶ + a^l2 + a¹⁰ + a⁹ +β_sa^s + a⁶ + a⁵ +β₄a⁴ + a³ + β2a² +β₁a + βo, where a = (αι , ..., α„) (αi , ..., a_n are the "oil" variables), β , β₂, βι, βs and /?ι₆ are given by n secret linear functions on the v vinegar variables and βo is given by n secret quadratic functions on the υ vinegar variables. In this example, we compute a signature as follows: the vinegar variables are chosen at random and the resulting equation of degree 17 is solved in a.

Note: Unlike UOV, in HFEV we have terms in oilxoil (such as a¹⁷, a¹², a¹⁰, etc), oilxvinegar (such as βιea^lβ, β_%cP, etc) and vinegar x vinegar (in βo).

Simulations

Nicolas Courtois did some simulations on HFEV and, in all his simulations, when the number of vinegar variables is > 3, there is no affine multiple equations of small degree (which is very nice). See the extended version of this paper for more details.

11 Concrete examples of parameters for UOV

At the present, it seems possible to choose for example n — 64, υ = 128 (or v = 192) and K = F₂. The signature scheme is the one of section 8, and the length of a signature is only 192 bits (or 256 bits) in this case. More examples of possible parameters are given in the extended version of this paper.

Note: If we choose K = F₂ then the public key is often large. So it is often more practical to choose a larger K and a smaller n: then the length of the public key can be reduced a lot. However, even when K and n are fixed, it is always feasible to make some easy transformations on a public key in order to obtain the public key in a canonical way such that this canonical expression is slightly shorter than the original expression. See the extended version of this paper for details. 12 Concrete example of parameters for HFEV

At the present, it seems possible to choose a small value for v (for example v = 3) and a small value for d (for example n = 77, υ = 3, d = 33 and K — F₂). The signature scheme is described in the extended version of this paper (to avoid the birthday paradox). Here the length of a signature is only 80 bits ! More examples of possible parameters are given in the extended version of this paper.

13 State of the art (in May 1999) on Public-Key schemes with Multivariate Polynomials over a small finite field

Recently, many new ideas have been introduced to design better schemes, such as UOV or HFEV described in this paper. Another idea is to fix some variables to hide some algebraic properties, and another idea is to introduce a few really random quadratic equations and to mix them with the original equations: see the extended version of this paper. However, many new ideas have also been introduced to design better attacks on previous schemes, such as the - not yet published - papers [1], [2], [3], [5]. So the field is fast moving and it can look a bit confusing at first. Moreover, some authors use the word "cryptanalysis" for "breaking" and some authors use this word with the meaning "an analysis about the security" that does not necessary mean "breaking" . In this section, we describe what we know at the present about the main schemes.

In the large families of the public key based on multivariate polynomials over a small finite field, we can distinguish between five main families characterized by the way the trapdoor is introduced or by the difficult problem on which the security relies. In the first family are the schemes "with a Hidden Monomial" , i.e. the key idea is to compute an exponentiation x \- x^d in a finite field for secret key computation. In the second family are the schemes where a polynomial function (with more than one monomial) is hidden. In the third family, the security relies on an isomorphism problem. In the fourth family, the security relies on the difficulty of finding the decomposition of two multivariate quadratic polynomials from all or part of their composition. Finally, in the fifth family, the secret key computations are based on Gaussian computations. The main schemes in these families are described in the figure below. What may be the most interesting scheme in each family is in a rectangle.

• C* was the first scheme of all, and it can be seen as the ancestor of all these schemes. It was designed in [12] and broken in [13].

• Schemes with a Hidden Monomial (such as some Dragon schemes) were studied in [15], where it is shown that most of them are insecure. However, C* (studied in [20]) is (at the present) the most efficient signature scheme (in time and RAM) in a smartcard. The scheme is not broken Family 1: C* (1985-1995) Family 2: HFE, (polynomial) Dragons, HM

Schemes with a Hidden Monomial HM- (ex: Dragons with

one monomial)

C_* Family 4: (Original) Oil and Vinegar (1997-1998)

Family 3: | IP Unbalanced Oil and Vinegar (UOV)

Family 5: 2 Round schemes (2R) (£>**, 2R with S-boxes, Hybrid 2R)

(but it may seem too simple or too close to C* to have a large confidence in its security ...).

HFE was designed in [14]. The most recent results about its security are in [1] and [2]. In these papers, very clever attacks are described. However, at the present, it seems that the scheme is not broken since for well chosen and still reasonable parameters the computations required to break it are still too large. For example, the first challenge of US $500 given in the extended version of [14] has not been claimed yet (it is a pure HFE with n = 80 and d = 96 over F₂).

HFE- is just an HFE where some of the public equations are not published. Due to [1] and [2], it may be recommended to do this (despite the fact that original HFE may be secure without it). In the extended version of [14] a second challenge of US $500 is described on a HFE- .

HFEV is described in this paper. HFEV and HFEV- look very hard to break. Moreover, HFEV is more efficient than the original HFE and it can give public key signatures of only 80 bits !

HM and HM^" were designed in [20]. Very few analysis have been done in these schemes (but maybe we can recommend to use HM^~ instead of HM ?).

IP was designed in [14]. IP schemes have the best proofs of security so far (see [19]). IP is very simple and can be seen as a nice generalization of Graph Isomorphism. The original Oil and Vinegar was presented in [16] and broken in [10].

• UOV is described in this paper. With IP, they are certainly the most simple schemes.

• 2R was designed in [17] and [18]. Due to [3], it is necessary to have at least 128 bits in input, and due to [5], it may be wise to not publish all the (originally) public equations: this gives the 2R^~ algorithms (the efficiency of the decomposition algorithms given in [5] on the 2R schemes is not yet completely clear).

Remark 1 : These schemes are of theoretical interest but (at the exception of IP) their security is not directly relied to a clearly defined and considered to be difficult problem. So is it reasonable to implement them in real products ? We think indeed that it is a bit risky to rely all the security of sensitive applications on such schemes. However, at the present, most of the smartcard applications use secret key algorithms (for example Triple-DES) because RSA smartcards are more expensive. So it can be reasonable to put in a low-cost smartcard one of the previous public key schemes in addition to (not instead of) the existing secret key scheme. Then the security can only be increased and the price of the smartcard would still be low (no coprocessor needed). The security would then rely on a master secret key for the secret key algorithm (with the risk of depending on a master secret key) and on a new low-cost public-key scheme (with the risk that the scheme has no proof of security). It can also be noticed that when extremely short signature length (or short block encryption) are required, there is no real choice: at the present only multivariate schemes can have length between 64 and 256 bits.

Remark 2: When a new scheme is found with multivariate polynomials, we do not necessary have to explain how the trapdoor has been introduced. Then we will obtain a kind of "Secret-Public Key scheme" ! The scheme is clearly a Public Key scheme since anybody can verify a signature from the public key (or can encrypt from the public key) and the scheme is secret since the way to compute the secret key computations (i.e. the way the trapdoor has been introduced) has not been revealed and cannot be guessed from the public key. For example, we could have done this for HFEV (instead of publishing it).

14 Conclusion

In this paper, we have presented two new public key schemes with "vinegar variables" : UOV and HFEV. The study of such schemes has led us to analyze very general properties about the solutions of systems of general quadratic forms. Moreover, from the general view presented in section 13, we see that these two schemes are at the present among the most interesting schemes in two of the five main families of schemes based on multivariate polynomials over a small finite field. Will this still be true in a few years ? References

Anonymous, Cryptanalysis of the HFE Public Key Cryptosystem, not yet published.

Anonymous, Practical cryptanalysis of Hidden Field Equations (HFE), not yet published.

Anonymous, Cryptanalysis of Patarin 's 2-Round Public Key System with S Boxes, not yet published.

D. Coppersmith, personal communication, e-mail.

Z. Dai, D. Ye, K.-Y. Lam, Factoring-attacks on Asymmetric Cryptography Based on Mapping-compositions, not yet published.

J.-C. Faugere, personal communication.

H. Fell, W. Diffie, Analysis of a public key approach based on polynomial substitutions, Proceedings of CRYPTO'85, Springer- Verlag, vol. 218, pp. 340-349

M. Garey, D. Johnson, Computers and Intractability, a Guide to the Theory of NP-Completeness, Freeman, p. 251.

H. Imai, T. Matsumoto, Algebraic Methods for Constructing Asymmetric Cryptosystems, Algebraic Algorithms and Error Correcting Codes (AAECC-3), Grenoble, 1985, Springer-Verlag, LNCS n°229.

A. Kipnis, A. Shamir, Cryptanalysis of the Oil and Vinegar Signature Scheme, Proceedings of CRYPTO'98, Springer, LNCS n°1462, pp. 257- 266.

R. Lidl, H. Niederreiter, Finite Fields, Encyclopedia of Mathematics and its applications, volume 20, Cambridge University Press.

T. Matsumoto, H. Imai, Public Quadratic Polynomial-tuples for efficient signature-veriήcation and message-encryption, Proceedings of EU- ROCRYPT'88, Springer-Verlag, pp. 419-453.

Jacques Patarin, Cryptanalysis of the Matsumoto and Imai public Key Scheme ofEurocrypt'88, Proceedings of CRYPTO'95, Springer-Verlag, pp. 248-261.

J. Patarin, Hidden Fields Equations (HFE) and Isomorphisms of Polynomials (IP) : Two New Families of Asymmetric Algorithms, Proceedings of EUROCRYPT'96, Springer, pp. 33-48.

Jacques Patarin, Asymmetric Cryptography with a Hidden Monomial, Proceedings of CRYPTO'96, Springer, pp. 45-60. [16] J. Patarin, The Oil and Vinegar Signature Scheme, presented at the Dagstuhl Workshop on Cryptography, September 1997 (transparencies).

[17] J. Patarin, L. Goubin, Trapdoor One-way Permutations and Multivariate Polynomials, Proceedings of ICICS'97, Springer, LNCS n°1334, pp. 356- 368.

[18] J. Patarin, L. Goubin, Asymmetric Cryptography with S-Boxes, Proceedings of ICICS'97, Springer, LNCS n°1334, pp. 369-380.

[19] J. Patarin, L. Goubin, N. Courtois, Improved Algorithms for Isomorphisms of Polynomials, Proceedings of EUROCRYPT'98, Springer, pp. 184-200.

[20] J. Patarin, L. Goubin, N. Courtois, C_^* ₊ and HM: Variations Around Two Schemes of T. Matsumoto and H. Imai, Proceedings of ASIACRYPT'98, Springer, pp. 35-49.

[21] A. Shamir, A simple scheme for encryption and its cryptanalysis found by D. Coppersmith and J. Stern, presented at the Luminy workshop on cryptography, September 1995.

Claims

What is claimed is:CLAIMS

1. A digital signature cryptographic method comprising: supplying a set S 1 of k polynomial functions as a public-key, the set

SI including the functions Pι(^χι,...,x_n+v, yι,...,y_k),..., Pk(xι,...,x_n+v, yι,...,yk), where k, v, and n are integers, xι,...,x_n+_v are n+v variables of a first type, yι,...,yk are k variables of a second type, and the set SI is obtained by applying a secret key operation on a set S2 of k polynomial functions P'ι(aι,...,a_n+v,yι,...,yk),...,P'k(aι,...,a„₊v,yι,...,yk) where aι,...,a_n+v are n+v variables which include a set of n "oil" variables aι,...,an, and a set of v "vinegar" variables

providing a message to be signed; applying a hash function on the message to produce a series of k values bι,...,bt; substituting the series of k values bi, ... ,bk for the variables yi, ... ,y_k of the set S2 respectively to produce a set S3 of k polynomial functions P" ι(aι,...,a„₊v), ... , P"k(aι,...,a_n+v); selecting v values a'_n+ι,...,a'_n+v for the v "vinegar" variables

solving a set of equations P"ι(aι,...,a_n,a'_n+ι,...,a'_n+v)=0,..., P"_k(aι,...,a„,a'„₊ι,...,a'_n+v)⁼0 to obtain a solution for a'ι,...,a'_n; and applying the secret key operation to transform a'ι,...,a'_n+_v to a digital signature eι,...,en_+v.

2. A method according to claim 1 and also comprising the step of verifying the digital signature.

3. A method according to claim 2 and wherein said verifying step comprises the steps of: obtaining the signature eι,...,en_+v, the message, the hash function and the public key; applying the hash function on the message to produce the series of k values bι,...,bk; and verifying that the equations Pι(eι,...,en_+v,bι,...,b_k)=0,..., P_k(eι,...,e„₊v, bι,...,bk)=0 are satisfied.

4. A method according to claim 1 and wherein the set S2 comprises the set f(a) of k polynomial functions of the HFEV scheme.

5. A method according to claim 1 and wherein the set S2 comprises the set S of k polynomial functions of the UOV scheme.

6. A method according to claim 1 and wherein said supplying step comprises the step of selecting the number v of "vinegar" variables to be greater than the number n of "oil" variables.

7. A method according to claim 1 and wherein v is selected such that q^v is greater than 2³², where q is the number of elements of a finite field K.

8. A method according to claim 1 and wherein said supplying step comprises the step of obtaining the set SI from a subset S2' of k polynomial functions of the set S2, the subset S2' being characterized by that all coefficients of components involving any of the yι,...,yk variables in the k polynomial functions P'ι(aι,...,a„_+v,yι,...,y_k),...,P'k(aι,...,a_n+v,yι,...,yk) are zero, and the number v of "vinegar" variables is greater than the number n of "oil" variables.

9. A method according to claim 8 and wherein the set S2 comprises the set S of k polynomial functions of the UOV scheme, and the number v of "vinegar" variables is selected so as to satisfy one of the following conditions: (a) for each characteristic p other than 2 of a field K in an "Oil and Vinegar" scheme of degree 2, v satisfies the inequality q^(v"n * n⁴ > 2⁴⁰,

(b) for p = 2 in an "Oil and Vinegar" scheme of degree 3, v is greater than n*(l + sqrt(3)) and lower than or equal to n³/6, and

(c) for each p other than 2 in an "Oil and Vinegar" scheme of degree 3, v is greater than n and lower than or equal to n⁴.

10. A method according to claim 8 and wherein the set S2 comprises the set S of k polynomial functions of the UOV scheme, and the number v of "vinegar" variables is selected so as to satisfy the inequalities v<n² and q^^""*^"1* n⁴ >2⁴⁰ for a characteristic p=2 of a field K in an "Oil and Vinegar" scheme of degree 2.

11. A method according to claim 1 and wherein said secret key operation comprises a secret affine transformation s on the n+v variables aι,...,a„+_v.

12. A method according to claim 4 and wherein said set S2 comprises an expression including k functions that are derived from a univariate polynomial.

13. A method according to claim 12 and wherein said univariate polynomial includes a univariate polynomial of degree less than or equal to 100,000.

14. A cryptographic method for verifying the digital signature of claim 1, the method comprising: obtaining the signature eι,...,en+_v, the message, the hash function and the public key; applying the hash function on the message to produce the series of k values bι,...,b_k; and verifying that the equations Pι(eι,...,en_+v,b-,...,bk)=0,..., Pk(eι,...,e„₊v, bi, ... ,b_k)=0 are satisfied.

15. In an "Oil and Vinegar" signature method, an improvement comprising the step of using more "vinegar" variables than "oil" variables.

16. A method according to claim 15 and wherein the number v of "vinegar" variables is selected so as to satisfy one of the following conditions:

(a) for each characteristic p other than 2 of a field K and for a degree 2 of the "Oil and Vinegar" signature method, v satisfies the inequality _q(v-nH* _n4 > ₂4_0j

(b) for p = 2 and for a degree 3 of the "Oil and Vinegar" signature method, v is greater than n*(l + sqrt(3)) and lower than or equal to n³/6, and

(c) for each p other than 2 and for a degree 3 of the "Oil and Vinegar" signature method, v is greater than n and lower than or equal to n⁴.

17. A method according to claim 15 and wherein the set S2 comprises the set S of k polynomial functions of the UOV scheme, and the number v of "vinegar" variables is selected so as to satisfy the inequalities v<n² and q^(v"n * n⁴ >2⁴⁰ for a characteristic p=2 of a field K in an "Oil and Vinegar" scheme of degree 2.