SLIDE 1 Crypto 2011, Santa Barbara Inverting HFE Systems is Quasi-Polynomial for All Fields
Jintai Ding1,2 and Timothy Hodges2
Southern Chinese University of Technology1 University of Cincinnati2
August 18, 2011
SLIDE 2 Outline
1 Introduction 2 Our main results 3 The future work
SLIDE 3 Outline
1 Introduction 2 Our main results 3 The future work
SLIDE 4 Hidden Field Public Key Cryptosystems
F ⊂ K finite fields, |F| = q, [F: K] = n, |K| = qn K
P
− − − − → K
σ
τ
{p1,...,pn}
− − − − − − → Fn Private Key Public Key P(X) ∈ K[X]/
- X qn − X
- pi(x1, . . . , xn) ∈ F[x1, . . . , xn]/
- xq
1 − x1, . . . , xq n − xn
- σ, τ invertible affine linear maps
SLIDE 5 Patarin’s HFE System
P(X) is K
P(X)
− − − − → K
σ
τ
{p1,...,pn}
− − − − − − → Fn
SLIDE 6 Patarin’s HFE System
P(X) is
(efficient decryption). K
P(X)
− − − − → K
σ
τ
{p1,...,pn}
− − − − − − → Fn
SLIDE 7 Patarin’s HFE System
P(X) is
(efficient decryption). quadratic over F so that pi(x1, . . . , xn) are quadratic (efficient encryption) K
P(X)
− − − − → K
σ
τ
{p1,...,pn}
− − − − − − → Fn
SLIDE 8 Patarin’s HFE System
P(X) is
(efficient decryption). quadratic over F so that pi(x1, . . . , xn) are quadratic (efficient encryption) K
P(X)
− − − − → K
σ
τ
{p1,...,pn}
− − − − − − → Fn P(X) =
aijX qi+qj +
biX qi + c where aij, bi, c ∈ K.
SLIDE 9 Direct Algebraic Attack
Use efficient Gr¨
- bner basis (algebraic) algorithms to solve the
system of equations: p1(x1, . . . , xn) = y1 p2(x1, . . . , xn) = y2 . . . pn(x1, . . . , xn) = yn
SLIDE 10 Direct Algebraic Attack
Use efficient Gr¨
- bner basis (algebraic) algorithms to solve the
system of equations: p1(x1, . . . , xn) = y1 p2(x1, . . . , xn) = y2 . . . pn(x1, . . . , xn) = yn Algorithm terminates significantly quicker on HFE systems than on random systems. How does the restriction on the degree D of P affect the complexity of algebraic solvers? Granboulan, Joux, Stern (Crypto 2006): If q = 2, complexity is quasi-polynomial.
SLIDE 11 Degree of Regularity
Degree of Regularity: Lowest degree at which non-trivial “degree falls” occur. deg
gipi
Trivial degree falls: pq−1
i
pi = pq
i = pi,
pjpi − pipj = 0
SLIDE 12 Degree of Regularity
Degree of Regularity: Lowest degree at which non-trivial “degree falls” occur. deg
gipi
Trivial degree falls: pq−1
i
pi = pq
i = pi,
pjpi − pipj = 0 Gr¨
- bner basis algorithms terminate shortly after this degree
is reached.
SLIDE 13 Degree of Regularity of Leading Terms
Let ph
i be the highest degree part of pi considered as an element of
the truncated polynomial ring ph
i ∈ F[x1, . . . , xn]
1 , . . . , xq n
SLIDE 14 Degree of Regularity of Leading Terms
Let ph
i be the highest degree part of pi considered as an element of
the truncated polynomial ring ph
i ∈ F[x1, . . . , xn]
1 , . . . , xq n
- Degree of Regularity of ph
1, . . . , ph n is first degree at which
non-trivial relations occur. deg
fiph
i
Trivial relations: (ph
i )q−1ph i = 0,
ph
j ph i − ph i ph j = 0
SLIDE 15 Degree of Regularity of Leading Terms
Let ph
i be the highest degree part of pi considered as an element of
the truncated polynomial ring ph
i ∈ F[x1, . . . , xn]
1 , . . . , xq n
- Degree of Regularity of ph
1, . . . , ph n is first degree at which
non-trivial relations occur. deg
fiph
i
Trivial relations: (ph
i )q−1ph i = 0,
ph
j ph i − ph i ph j = 0
Then Dreg(p1, . . . , pn) = Dreg(ph
1, . . . , ph n)
SLIDE 16 Dubois-Gama Reduction
1, . . . , ph n) ≤ Dreg(ph 1, . . . , ph j )
SLIDE 17 Dubois-Gama Reduction
1, . . . , ph n) ≤ Dreg(ph 1, . . . , ph j )
Recall that P(X) =
aijX qi+qj +
biX qi + c Define P0(X1, . . . , Xn) =
- aijXiXj ∈ K[X1, . . . , Xn]/
- X q
1 , . . . , X q n
- Galois theory and filtered-graded arguments yield the key result:
SLIDE 18 Dubois-Gama Reduction
1, . . . , ph n) ≤ Dreg(ph 1, . . . , ph j )
Recall that P(X) =
aijX qi+qj +
biX qi + c Define P0(X1, . . . , Xn) =
- aijXiXj ∈ K[X1, . . . , Xn]/
- X q
1 , . . . , X q n
- Galois theory and filtered-graded arguments yield the key result:
- Theorem. Dreg(ph
1, . . . , ph n) ≤ Dreg(P0)
SLIDE 19 Outline
1 Introduction 2 Our main results 3 The future work
SLIDE 20
The main theorem
We give a global upper bound on the degree of regularity (in the sense of DG) of an HFE system.
SLIDE 21
The main theorem
We give a global upper bound on the degree of regularity (in the sense of DG) of an HFE system. Main Theorem. The degree of regularity of the system defined by P is bounded by Rank(P0)(q − 1) 2 + 2 ≤ (q − 1)(⌊logq(D − 1)⌋ + 1) 2 + 2 if Rank(P0) > 1. Here Rank(P0) is the rank of the quadratic form P0.
SLIDE 22
The main theorem
We give a global upper bound on the degree of regularity (in the sense of DG) of an HFE system. Main Theorem. The degree of regularity of the system defined by P is bounded by Rank(P0)(q − 1) 2 + 2 ≤ (q − 1)(⌊logq(D − 1)⌋ + 1) 2 + 2 if Rank(P0) > 1. Here Rank(P0) is the rank of the quadratic form P0. These are universal bounds that require no additional assumption.
SLIDE 23
The contribution of GJS
Granboulan, Joux and Stern outlined a new way to bound the degree of regularity in the case q = 2.
SLIDE 24
The contribution of GJS
Granboulan, Joux and Stern outlined a new way to bound the degree of regularity in the case q = 2. Their approach – lift the problem back up to the extension field K.
SLIDE 25
The contribution of GJS
Granboulan, Joux and Stern outlined a new way to bound the degree of regularity in the case q = 2. Their approach – lift the problem back up to the extension field K. They sketched a way to connect the degree of regularity of an HFE system to the degree of regularity of a lifted system over the big field.
SLIDE 26 The key assumptions of GJS
Assuming
1 the degree of regularity of an HFE system = the degree of
regularity of a lifted system over the big field.
2 the degree of regularity of a subsystem ≥ than that of the
3 asymptotic analysis results of the degree of regularity of
random systems;
4 the subsystem is generic or random,
SLIDE 27 The key assumptions of GJS
Assuming
1 the degree of regularity of an HFE system = the degree of
regularity of a lifted system over the big field.
2 the degree of regularity of a subsystem ≥ than that of the
3 asymptotic analysis results of the degree of regularity of
random systems;
4 the subsystem is generic or random,
they derived heuristic asymptotic bounds for the case q = 2.
SLIDE 28 The key assumptions of GJS
Assuming
1 the degree of regularity of an HFE system = the degree of
regularity of a lifted system over the big field.
2 the degree of regularity of a subsystem ≥ than that of the
3 asymptotic analysis results of the degree of regularity of
random systems;
4 the subsystem is generic or random,
they derived heuristic asymptotic bounds for the case q = 2.
SLIDE 29 The key assumptions of GJS
Assuming
1 the degree of regularity of an HFE system = the degree of
regularity of a lifted system over the big field.
2 the degree of regularity of a subsystem ≥ than that of the
3 asymptotic analysis results of the degree of regularity of
random systems;
4 the subsystem is generic or random,
they derived heuristic asymptotic bounds for the case q = 2. To derive any definitive general bounds on the degree of regularity for general q and n – an open problem.
SLIDE 30 Interest in the odd q case
The work by Ding, Schmidt, Werner. The role of the field equations X q
1 − X2, . . . , X q n − X1.
SLIDE 31 Interest in the odd q case
The work by Ding, Schmidt, Werner. The role of the field equations X q
1 − X2, . . . , X q n − X1.
No asymptotic analysis for systems over odd q.
SLIDE 32
The work of Dubois and Gama
A breakthrough in the case of general q came in the recent work of Dubois and Gama DG – a rigorous mathematical foundation for the arguments in GJS.
SLIDE 33
The work of Dubois and Gama
A breakthrough in the case of general q came in the recent work of Dubois and Gama DG – a rigorous mathematical foundation for the arguments in GJS. A new method to compute the degree of regularity over any field and an inductive algorithm that can be used to calculate a bound for the degree of regularity for any choice of q, n and D.
SLIDE 34
The work of Dubois and Gama
A breakthrough in the case of general q came in the recent work of Dubois and Gama DG – a rigorous mathematical foundation for the arguments in GJS. A new method to compute the degree of regularity over any field and an inductive algorithm that can be used to calculate a bound for the degree of regularity for any choice of q, n and D. No closed formula.
SLIDE 35 Our approach
Recall:
1, . . . , ph n) ≤ Dreg(P0)
SLIDE 36 Our approach
Recall:
1, . . . , ph n) ≤ Dreg(P0)
We find a bound for Dreg(P0).
SLIDE 37 Our approach
Recall:
1, . . . , ph n) ≤ Dreg(P0)
We find a bound for Dreg(P0). The proof is a constructive proof – explicitly constructing non-trivial syzygies.
SLIDE 38
The Constructive Proof
finding Dreg(P0) = finding low-degree non-trivial annihilators in an associated graded algebra.
SLIDE 39
The Constructive Proof
finding Dreg(P0) = finding low-degree non-trivial annihilators in an associated graded algebra. explicit construction of non-trivial annihilators.
SLIDE 40
The Constructive Proof
finding Dreg(P0) = finding low-degree non-trivial annihilators in an associated graded algebra. explicit construction of non-trivial annihilators. basis of the constructions – the classification of quadratic forms.
SLIDE 41 The case when q is even
A quadratic polynomial in the polynomial algebra K[X1, . . . , Xn] is equivalent to an polynomial of one of the following forms for some r ≤ n:
1 X1X2 + ... + Xr−1Xr 2 X1X2 + ... + Xr−2Xr−1 + X 2
r
3 X1X2 + ... + Xr−1Xr + X 2
r−1 + cX 2 r where c ∈ K\{0} satisfies
TRK(c) = 1.
SLIDE 42
An example of annihilator
when rank is 4: x1x2 + x3x4.
SLIDE 43 An example of annihilator
when rank is 4: x1x2 + x3x4. The annihilators: xq−1
1
xq−1
3
, xq−1
1
xq−1
4
, xq−1
2
xq−1
3
, xq−1
2
xq−1
4
SLIDE 44 An example of annihilator
when rank is 4: x1x2 + x3x4. The annihilators: xq−1
1
xq−1
3
, xq−1
1
xq−1
4
, xq−1
2
xq−1
3
, xq−1
2
xq−1
4
(x1x2 + x3x4)xq−1
1
xq−1
3
= xq
1 x2x3 + x1xq 3 x4 = 0.
SLIDE 45 An example of annihilator
when rank is 4: x1x2 + x3x4. The annihilators: xq−1
1
xq−1
3
, xq−1
1
xq−1
4
, xq−1
2
xq−1
3
, xq−1
2
xq−1
4
(x1x2 + x3x4)xq−1
1
xq−1
3
= xq
1 x2x3 + x1xq 3 x4 = 0.
Proof that the annihiltor is non-trivial.
SLIDE 46
Conclusion
For fixed q the degree of regularity is O(logq D). Assuming that the proper parameter: D = O(nα), the complexity will be quasi-polynomial.
SLIDE 47
Conclusion
For fixed q the degree of regularity is O(logq D). Assuming that the proper parameter: D = O(nα), the complexity will be quasi-polynomial. Conjecture: assume 1) q itself is of scale O(n), 2) the bound above is asymptotically sharp, then the degree of regularity will be at least of the scale O(n), so inverting HFE systems will be exponential.
SLIDE 48
Our bound not optimal.
SLIDE 49
Our bound not optimal. A detailed comparison of our bound with the bound calculated in DG.
SLIDE 50
Our bound not optimal. A detailed comparison of our bound with the bound calculated in DG.
SLIDE 51
Our bound not optimal. A detailed comparison of our bound with the bound calculated in DG. As n becomes large relative to q, the two bounds appear to be getting very close.
SLIDE 52 Outline
1 Introduction 2 Our main results 3 The future work
SLIDE 53
Future (or current) work
The Square case: P(X) = X 2. (JD, IACR eprint) The HFE Minus case. (JD and T. Kleinjung) The higher degree (non-quadratic) case (TH and J. Schlather) Exact calculation of Dreg(P0) (TH and J. Schlather) Better comparison with DG’s results. Better bounds Apply our technique to other systems and provable security.
SLIDE 54
Acknowledgment
The support of NSF China and the Taft Research Center.
SLIDE 55
Acknowledgment
The support of NSF China and the Taft Research Center. The help from V. Dubois and N. Gama.
SLIDE 56
Acknowledgment
Thank you and questions?
