Introduction to Multivariate Public Key Cryptography Geovandro - - PowerPoint PPT Presentation
Introduction to Multivariate Public Key Cryptography Geovandro Carlos C. F. Pereira PhD advisor: Prof. Dr. Paulo S. L. M. Barreto LARC - Computer Architecture and Networking Lab Department of Computer Engineering and Digital Systems Escola
Slide 1
PhD advisor: Prof. Dr. Paulo S. L. M. Barreto
LARC - Computer Architecture and Networking Lab Department of Computer Engineering and Digital Systems Escola Politécnica University of Sao Paulo
Slide 2
Slide 3
Internet of Things (IoT) Any object connected to the internet
Slide 4
Smartcard (Java Card) Sensor node Arduino
Slide 5
Smartcard (Java Card) Sensor node Arduino
Slide 6
Slide 7
Security relies on a few computational problems.
Slide 8
Security relies on a few computational problems. “Complex” operations (e.g. multiple-precision arithmetic).
Slide 9
Security relies on a few computational problems. “Complex” operations (e.g. multiple-precision arithmetic). Threats in medium and long-terms:
Quantum algorithm for DLP e IFP
Slide 10
Security relies on a few computational problems. “Complex” operations (e.g. multiple-precision arithmetic). Threats in medium and long-terms:
Quantum algorithm for DLP e IFP
Conventional algorithms for DLP over binary fields in quase-polynomial time End of pairings over binary fields (it was the most suitable for WSNs)
Slide 11
Security relies on a few computational problems. “Complex” operations (e.g. multiple-precision arithmetic). Threats in medium and long-terms:
Quantum algorithm for DLP e IFP
Conventional algorithms for DLP over binary fields in quase-polynomial time End of pairings over binary fields (it was the most suitable for WSNs)
Slide 12
Cryptosystems that resist to quantum algorithms.
Slide 13
Cryptosystems that resist to quantum algorithms. Main lines of research:
Slide 14
Cryptosystems that resist to quantum algorithms. Main lines of research:
Slide 15
Cryptosystems that resist to quantum algorithms. Main lines of research:
Slide 16
Cryptosystems that resist to quantum algorithms. Main lines of research:
Slide 17
Slide 18
Signature generation in 804 cycles by Ding [ASAP 2008].
Slide 19
Signature generation in 804 cycles by Ding [ASAP 2008].
Slide 20
Slide 21
Slide 22
𝑄 𝑦1, ⋯ , 𝑦𝑜 = (𝑞1 𝑦1, ⋯ , 𝑦𝑜 , 𝑞2 𝑦1, ⋯ , 𝑦𝑜 , ⋯ , 𝑞𝑛(𝑦1, ⋯ , 𝑦𝑜))
Slide 23
Slide 24
𝑄 𝑁 = 𝑞1 𝑦1, ⋯ , 𝑦𝑜 , ⋯ , 𝑞𝑛 𝑦1, ⋯ , 𝑦𝑜 = (𝑑1, ⋯ , 𝑑𝑛)
Slide 25
𝑄 𝑁 = 𝑞1 𝑦1, ⋯ , 𝑦𝑜 , ⋯ , 𝑞𝑛 𝑦1, ⋯ , 𝑦𝑜 = (𝑑1, ⋯ , 𝑑𝑛)
feasible to invert the quadratic map to find the plaintext:
𝑦1, ⋯ , 𝑦𝑜 = 𝑄−1 𝑑1, ⋯ , 𝑑𝑛
Slide 26
𝑄 𝑦1, ⋯ , 𝑦𝑜 = 𝑞1 𝑦1, ⋯ , 𝑦𝑜 , ⋯ , 𝑞𝑛 𝑦1, ⋯ , 𝑦𝑜
Slide 27
𝑄 𝑦1, ⋯ , 𝑦𝑜 = 𝑞1 𝑦1, ⋯ , 𝑦𝑜 , ⋯ , 𝑞𝑛 𝑦1, ⋯ , 𝑦𝑜
Slide 28
𝑄 𝑦1, ⋯ , 𝑦𝑜 = 𝑞1 𝑦1, ⋯ , 𝑦𝑜 , ⋯ , 𝑞𝑛 𝑦1, ⋯ , 𝑦𝑜
𝑦1, ⋯ , 𝑦𝑜 = 𝑄−1 ℎ1, ⋯ , ℎ𝑛
Slide 29
𝑄 𝑦1, ⋯ , 𝑦𝑜 = 𝑞1 𝑦1, ⋯ , 𝑦𝑜 , ⋯ , 𝑞𝑛 𝑦1, ⋯ , 𝑦𝑜
𝑦1, ⋯ , 𝑦𝑜 = 𝑄−1 ℎ1, ⋯ , ℎ𝑛
Slide 30
𝑄 𝑦1, ⋯ , 𝑦𝑜 = 𝑞1 𝑦1, ⋯ , 𝑦𝑜 , ⋯ , 𝑞𝑛 𝑦1, ⋯ , 𝑦𝑜
𝑦1, ⋯ , 𝑦𝑜 = 𝑄−1 ℎ1, ⋯ , ℎ𝑛
Slide 31
𝑄 𝑁 = 𝑄 𝑞1 𝑦1, ⋯ , 𝑦𝑜 , ⋯ , 𝑞𝑛 𝑦1, ⋯ , 𝑦𝑜 = (𝑑1, ⋯ , 𝑑𝑛)
Slide 32
𝑄 𝑁 = 𝑄 𝑞1 𝑦1, ⋯ , 𝑦𝑜 , ⋯ , 𝑞𝑛 𝑦1, ⋯ , 𝑦𝑜 = (𝑑1, ⋯ , 𝑑𝑛)
with 𝑜 variables is NP-complete.
Slide 33
𝑄 𝑁 = 𝑄 𝑞1 𝑦1, ⋯ , 𝑦𝑜 , ⋯ , 𝑞𝑛 𝑦1, ⋯ , 𝑦𝑜 = (𝑑1, ⋯ , 𝑑𝑛)
with 𝑜 variables is NP-complete.
systems.
Slide 34
Slide 35
𝑄(𝑦1, ⋯ , 𝑦𝑜) = 𝑀1 ∘ 𝐺 ∘ 𝑀2(𝑦1, ⋯ , 𝑦𝑜)
Slide 36
𝑄(𝑦1, ⋯ , 𝑦𝑜) = 𝑀1 ∘ 𝐺 ∘ 𝑀2(𝑦1, ⋯ , 𝑦𝑜)
Slide 37
𝑄(𝑦1, ⋯ , 𝑦𝑜) = 𝑀1 ∘ 𝐺 ∘ 𝑀2(𝑦1, ⋯ , 𝑦𝑜)
Slide 38
𝑄(𝑦1, ⋯ , 𝑦𝑜) = 𝑀1 ∘ 𝐺 ∘ 𝑀2(𝑦1, ⋯ , 𝑦𝑜)
Slide 39
variables x = (𝑦1, ⋯ , 𝑦𝑜), solve the system: 𝑞1 𝑦 = ⋯ = 𝑞𝑛 𝑦 = 0
Slide 40
variables x = (𝑦1, ⋯ , 𝑦𝑜), solve the system: 𝑞1 𝑦 = ⋯ = 𝑞𝑛 𝑦 = 0
1, 𝐺2: 𝐿𝑜 ⟶ 𝐿𝑛.
The problem is to look for two linear transformations 𝑀1 and 𝑀2 (if they exist) s.t.: 𝐺
1(𝑦1, ⋯ , 𝑦𝑜) = 𝑀1 ∘ 𝐺 ∘ 𝑀2(𝑦1, ⋯ , 𝑦𝑜)
Slide 41
Polynomial notation: Vector notation: 𝑞𝑙 𝑦1, … , 𝑦𝑜 = 𝑦𝑄 𝑙 𝑦𝑈 + 𝑀(𝑙)𝑦 + 𝑑(𝑙)
𝑞𝑙 𝑦1, … , 𝑦𝑜 ≔ 𝑄
𝑗𝑘 𝑙 𝑦𝑗𝑦𝑘 𝑗,𝑘
+ 𝑀𝑗
𝑙 𝑦𝑗 𝑗
+ 𝑑(𝑙)
Slide 42
𝑄(𝑙) 𝑦 𝑦𝑈 = ℎ𝑙 𝒬 𝑦 = ℎ ⇔ 𝑦 𝑄(𝑙) 𝑦𝑈 = ℎ𝑙 (𝑙 = 1, … , 𝑛)
Slide 43
encryption scheme.
C* construction.
Slide 44
Slide 45
= 𝑙 𝑦 /((𝑦)) a degree 𝑜 extension of 𝑙.
Slide 46
= 𝑙 𝑦 /((𝑦)) a degree 𝑜 extension of 𝑙.
→ 𝑙𝑜 and 𝜚−1: 𝑙𝑜 → 𝐿 .
𝜚 𝑏0 + 𝑏1𝑦 + ⋯ + 𝑏𝑜−1𝑦𝑜−1 = (𝑏0, 𝑏1, ⋯ , 𝑏𝑜−1)
Slide 47
= 𝑙 𝑦 /((𝑦)) a degree 𝑜 extension of 𝑙.
→ 𝑙𝑜 and 𝜚−1: 𝑙𝑜 → 𝐿 .
𝜚 𝑏0 + 𝑏1𝑦 + ⋯ + 𝑏𝑜−1𝑦𝑜−1 = (𝑏0, 𝑏1, ⋯ , 𝑏𝑜−1)
:
𝐺 = 𝑀1 ∘ 𝜚 ∘ 𝐺 ∘ 𝜚−1 ∘ 𝑀2
where the 𝑀𝑗 are randomly chosen invertible maps over 𝑙𝑜
Slide 48
= 𝑙 𝑦 /((𝑦)) a degree 𝑜 extension of 𝑙.
→ 𝑙𝑜 and 𝜚−1: 𝑙𝑜 → 𝐿 .
𝜚 𝑏0 + 𝑏1𝑦 + ⋯ + 𝑏𝑜−1𝑦𝑜−1 = (𝑏0, 𝑏1, ⋯ , 𝑏𝑜−1)
:
𝐺 = 𝑀1 ∘ 𝜚 ∘ 𝐺 ∘ 𝜚−1 ∘ 𝑀2
where the 𝑀𝑗 are randomly chosen invertible maps over 𝑙𝑜
is related to the IP Problem
Slide 49
𝐺 ∶ 𝐿 ⟶ 𝐿 𝑌 ⟼ 𝑌𝑟𝜄+1
Slide 50
𝐺 ∶ 𝐿 ⟶ 𝐿 𝑌 ⟼ 𝑌𝑟𝜄+1
𝐺 𝑦1, ⋯ , 𝑦𝑜 = 𝜚 ∘ 𝐺 ∘ 𝜚−1 𝑦1, ⋯ , 𝑦𝑜 = (𝐺
1
𝑦1, ⋯ , 𝑦𝑜 , ⋯ , 𝐺
𝑛(𝑦1, ⋯ , 𝑦𝑜))
Slide 51
𝐺 ∶ 𝐿 ⟶ 𝐿 𝑌 ⟼ 𝑌𝑟𝜄+1
𝐺 𝑦1, ⋯ , 𝑦𝑜 = 𝜚 ∘ 𝐺 ∘ 𝜚−1 𝑦1, ⋯ , 𝑦𝑜 = (𝐺
1
𝑦1, ⋯ , 𝑦𝑜 , ⋯ , 𝐺
𝑛(𝑦1, ⋯ , 𝑦𝑜))
are quadratic polynomials because the map 𝑌 ⟼ 𝑌𝑟𝜄 is linear (it is the Frobenius automorphism of
Slide 52
𝐺 = 𝑀1 ∘ 𝜚 ∘ 𝐺 ∘ 𝜚−1 ∘ 𝑀2
where 𝑀𝑗 are affine maps over 𝑙𝑜.
Slide 53
𝐺 = 𝑀1 ∘ 𝜚 ∘ 𝐺 ∘ 𝜚−1 ∘ 𝑀2
where 𝑀𝑗 are affine maps over 𝑙𝑜.
𝐺 −1 = 𝑀2
−1 ∘ 𝜚 ∘ 𝐺−1 ∘ 𝜚−1 ∘ 𝑀1 −1
Slide 54
to ensure the invertibility of the decryption map 𝐺
−1
Slide 55
to ensure the invertibility of the decryption map 𝐺
−1
where 𝑢 × 𝑟𝜄 + 1 ≡ 1 𝑛𝑝𝑒(𝑟𝑜 − 1).
= (𝐺
1
, ⋯ , 𝐺
𝑜
)
.
Slide 56
Slide 57
vinegar variables: 𝑊 ≔ (𝑦1
′, … , 𝑦𝑤 ′)
Slide 58
vinegar variables: 𝑊 ≔ (𝑦1
′, … , 𝑦𝑤 ′)
Slide 59
𝑔
𝑙 𝑦1, ⋯ , x𝑝, 𝑦1 ′, … , 𝑦𝑤 ′ = ℎ𝑙 =
= 𝐺𝑗𝑘
𝑙 𝑦𝑗𝑦′𝑘 𝑃×𝑊
+ 𝐺𝑗𝑘
𝑙 𝑦′𝑗𝑦′𝑘 𝑊×𝑊
+ 𝑀𝑗
𝑙 𝑦𝑗 𝑃
+ 𝑀𝑗
𝑙 𝑦′𝑗 𝑊
+ 𝑑(𝑙)
′, … , 𝑦𝑤 ′)
Slide 60
𝑔
𝑙 𝑦1, ⋯ , x𝑝, 𝑦1 ′, … , 𝑦𝑤 ′ = ℎ𝑙 =
= 𝐺𝑗𝑘
𝑙 𝑦𝑗𝑦′𝑘 𝑃×𝑊
+ 𝐺𝑗𝑘
𝑙 𝑦′𝑗𝑦′𝑘 𝑊×𝑊
+ 𝑀𝑗
𝑙 𝑦𝑗 𝑃
+ 𝑀𝑗
𝑙 𝑦′𝑗 𝑊
+ 𝑑(𝑙)
′, … , 𝑦𝑤 ′
Slide 61
𝑔
𝑙 𝑦1, ⋯ , x𝑝, 𝑦1 ′, … , 𝑦𝑤 ′ = ℎ𝑙
= 𝐺𝑗𝑘
𝑙 𝑦𝑗𝑦′𝑘 𝑃×𝑊
+ 𝐺𝑗𝑘
𝑙 𝑦′𝑗𝑦′𝑘 𝑊×𝑊
+ 𝑀𝑗
𝑙 𝑦𝑗 𝑃
+ 𝑀𝑗
𝑙 𝑦′𝑗 𝑊
+ 𝑑(𝑙)
′, … , 𝑦𝑤 ′
Slide 62
𝑔
𝑙 𝑦1, ⋯ , x𝑝, 𝑦1 ′, … , 𝑦𝑤 ′ =
= 𝐺𝑗𝑘
𝑙 𝑦𝑗𝑦′𝑘 𝑃×𝑊
+ 𝐺𝑗𝑘
𝑙 𝑦′𝑗𝑦′𝑘 𝑊×𝑊
+ 𝑀𝑗
𝑙 𝑦𝑗 𝑃
+ 𝑀𝑗
𝑙 𝑦′𝑗 𝑊
+ 𝑑(𝑙)
Slide 63
𝐺(𝑙) =
Vinegar variables Oil variables
𝒚𝟐 … 𝒚𝒘 … 𝒚𝒐 𝒚𝟐 ⋮ 𝒚𝒘 𝒚𝒐 ⋮
Vinegar variables Oil variables
Slide 64
Slide 65
Scheme
Public Key (KiB)
113.4 99.4 77.7 66.7 14.5 11.0 10.2
Slide 66
Slide 67
Slide 68
Slide 69
Public matrix of coefficients 𝑁𝑄
Slide 70
𝑄(1) 𝑄(2)
𝑁𝑄 =
𝑛𝑦l ′ l ′ = 𝑜 𝑜 + 1 2 𝑄(𝑛)
Public matrix of coefficients 𝑁𝑄
Slide 71
𝑁𝑄 =
𝑛𝑦l ′
l
=
𝑛𝑦l ′ l l = 𝑤 𝑤 + 1 2 + 𝑛𝑤, l ′ = 𝑜 𝑜 + 1 2
Private matrix of coefficients 𝑁𝐺
Slide 72
𝐺 1 𝐺 2 𝐺 𝑛
𝑁𝐺 =
𝑛𝑦l ′ l ′ = 𝑜 𝑜 + 1 2
l
l = 𝑤 𝑤 + 1 2 + 𝑛𝑤,
Private matrix of coefficients 𝑁𝐺
Slide 73
𝑁𝐺 =
l = 𝑤 𝑤 + 1 2 + 𝑛𝑤,
=
𝑛𝑦l ′ l l ′ = 𝑜 𝑜 + 1 2
𝑛𝑦l ′ l
Slide 74
𝑁𝐺 =
𝑛𝑦l ′
𝑁𝑄 =
𝑛𝑦l ′
𝐶 = 𝐺 ∙ 𝐵𝑉𝑃𝑊(S)
𝑏𝑗𝑘
𝑠𝑡 = 𝑡𝑠𝑗. 𝑡𝑡𝑗,
𝑗 = 𝑘 𝑡𝑠𝑗. 𝑡𝑡𝑘 + 𝑡𝑠𝑘. 𝑡𝑡𝑗, 𝑗 ≠ 𝑘
1 ≤ 𝑗 ≤ 𝑤, 𝑗 ≤ 𝑘 ≤ 𝑜 1 ≤ 𝑠 ≤ 𝑤, 𝑠 ≤ 𝑡 ≤ 𝑜
l l
By choosing 𝐵𝑉𝑃𝑊(𝑇) invertible:
−1
Slide 75
𝐺 = 𝐶 ∙ 𝐵𝑉𝑃𝑊
−1
By choosing 𝐵𝑉𝑃𝑊(𝑇) invertible:
−1
Slide 76
𝐺 = 𝐶 ∙ 𝐵𝑉𝑃𝑊
−1
By choosing 𝐵𝑉𝑃𝑊(𝑇) invertible:
−1
𝐶 = 0 does not result in a valid F, 𝐶 = Identity blocks, reveals too much info of 𝐵𝑉𝑃𝑊
−1 ,
𝐶 circulant was adopted by [Petzoldt et. al, 2010]
Slide 77
𝐺 = 𝐶 ∙ 𝐵𝑉𝑃𝑊
−1
By choosing 𝐵𝑉𝑃𝑊(𝑇) invertible:
−1
𝐶 = 0 does not result in a valid F, 𝐶 = Identity blocks, reveals too much info of 𝐵𝑉𝑃𝑊
−1 ,
𝐶 circulant was adopted by [Petzoldt et. al, 2010]
Slide 78
𝐺 = 𝐶 ∙ 𝐵𝑉𝑃𝑊
−1
Petzoldt et. al. showed by theorem that the choice of a circulant 𝐶 provides consistent UOV signatures.
Adopting 𝐶 circulant:
Slide 79
𝑁𝑄 =
𝑛𝑦l ′
|𝑵𝑸| = l + 𝑛(l ′ − l)
𝒄 = (𝑐1, ⋯ , 𝑐l)
𝑛𝑦l ′
l
⋯
l
Public matrices 𝑄 𝑙
Slide 80
𝑄 1
Public matrices 𝑄 𝑙
Slide 81
𝑄 2
Public matrices 𝑄 𝑙
Slide 82
𝑄 3
Public matrices 𝑄 𝑙
Slide 83
𝑄 4
Public matrices 𝑄 𝑙
Slide 84
given public key system.
Slide 85
given public key system.
Slide 86
given public key system.
Slide 87
𝑄(𝑗) = 𝑇𝐺(𝑗)𝑇𝑈, 1 ≤ 𝑗 ≤ 𝑛
Slide 88
𝑄(𝑗) = 𝑇𝐺(𝑗)𝑇𝑈, 1 ≤ 𝑗 ≤ 𝑛
𝑄(𝑗) = 𝑇𝐺(𝑗)𝑇𝑈 = 𝑇′𝐺′(𝑗)𝑇′𝑈, 1 ≤ 𝑗 ≤ 𝑛 where matrices 𝐺′(𝑗) share with 𝐺(𝑗) the same trapdoor structure?
Slide 89
𝑄 𝑗 = 𝑇Ω−1Ω𝐺 𝑗 Ω𝑈Ω𝑈−1𝑇𝑈
Slide 90
𝑄 𝑗 = 𝑇Ω−1Ω𝐺 𝑗 Ω𝑈Ω𝑈−1𝑇𝑈
Slide 91
Ω1 Ω2 Ω3 Ω4 𝐺
1
𝐺2 𝐺3
=
𝐺′(𝑗) 𝐺(𝑗)
𝜍
Ω1
𝑈
Ω3
𝑈
Ω2
𝑈
Ω4
𝑈
𝑤 𝑛 𝑤 𝑛 𝑤 𝑛 𝑤 𝑛 𝑤 𝑛 𝑤 𝑛
Ω ΩT
𝜍 = Ω3𝐺
1 + Ω4𝐺3 Ω3 𝑈 + Ω3𝐺2Ω4 𝑈 = 0
and Ω3 = 0 is a solution.
Slide 92
Ω1 Ω2 Ω4
Ω =
𝑤 𝑛 𝑤 𝑛
𝑄 𝑗 = 𝑇Ω−1(Ω𝐺 𝑗 Ω𝑈)Ω𝑈−1𝑇𝑈
Slide 93
𝑄 𝑗 = 𝑇Ω−1(𝐺′(𝑗))Ω𝑈−1𝑇𝑈
Slide 94
𝑄 𝑗 = 𝑇Ω−1(𝐺′(𝑗))Ω𝑈−1𝑇𝑈
𝑄 𝑗 = 𝑇′𝐺′(𝑗)𝑇′𝑈
Slide 95
Slide 96
Ω1
−1
𝑇′ = 𝑇Ω−1 = 𝑇1 𝑇2 𝑇3 𝑇4
Ω2
−1
Ω4
−1
𝑤 𝑛 𝑤 𝑛
Ω−1 𝑇
Ω1
−1 Ω2 −1
Ω4
−1
−1, it is possible to get:
𝑇1
′ = 𝐽𝑤𝑦𝑤
𝑇2
′ = 0𝑤𝑦𝑛
𝑇4
′ = 𝐽𝑛𝑦𝑛
what implies 𝑇3
′ = 𝑇3𝑇1 −1𝑇2𝑇1 −1 + 𝑇4(𝑇4 − 𝑇3𝑇1 −1𝑇2)−1
Slide 97
Slide 98
𝑇′ = 𝑇3
′
𝑛 𝑤 𝑛 𝑤
𝑇′𝐺′(𝑗)(𝑇′)𝑈 = (𝑇Ω−1) Ω𝐺 𝑗 Ω𝑈 𝑇Ω−1 𝑈 = 𝑄 𝑗 and 𝐺′(𝑗) have the desired trapdoor structure.
Slide 99
𝑇′ = 𝑇3
′
𝑛 𝑤 𝑛 𝑤
Slide 100
Slide 101