Abstract
Recently, by an interesting confluence, multivariate schemes with the minus modifier have received attention as candidates for multivariate encryption. Among these candidates is the twenty year old HFE\(^-\) scheme originally envisioned as a possible candidate for both encryption and digital signatures, depending on the number of public equations removed.
HFE has received a great deal of attention and a variety of cryptanalyses over the years; however, HFE\(^-\) has escaped these assaults. The direct algebraic attack that broke HFE Challenge I is provably more complex on HFE\(^-\), and even after two decades HFE Challenge II is daunting, though not achieving a security level we may find acceptable today. The minors modeling approach to the Kipnis-Shamir (KS) attack is very efficient for HFE, but fails when the number of equations removed is greater than one. Thus it seems reasonable to use HFE\(^-\) for encryption with two equations removed.
This strategy may not be quite secure, however, as our new approach shows. We derive a new key recovery attack still based on the minors modeling approach that succeeds for all parameters of HFE\(^-\). The attack is polynomial in the degree of the extension, though of higher degree than the original minors modeling KS-attack. As an example, the complexity of key recovery for HFE\(^-(q=31,n=36,D=1922,a=2)\) is \(2^{52}\). Even more convincingly, the complexity of key recovery for HFE Challenge-2, an HFE\(^-(16,36,4352,4)\) scheme, is feasible, costing around \(2^{67}\) operations. Thus, the parameter choices for HFE\(^-\) for both digital signatures and, particularly, for encryption must be re-examined.
The rights of this work are transferred to the extent transferable according to title 17 § 105 U.S.C.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Shor, P.W.: Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM J. Sci. Stat. Comp. 26, 1484 (1997)
Group, C.T.: Submission requirements and evaluation criteria for the post-quantum cryptography standardization process. NIST CSRC (2016). http://csrc.nist.gov/groups/ST/post-quantum-crypto/documents/call-forproposals-nal-dec-2016.pdf
Matsumoto, T., Imai, H.: Public quadratic polynomial-tuples for efficient signature-verification and message-encryption. In: Barstow, D., et al. (eds.) EUROCRYPT 1988. LNCS, vol. 330, pp. 419–453. Springer, Heidelberg (1988). doi:10.1007/3-540-45961-8_39
Patarin, J.: Hidden fields equations (HFE) and isomorphisms of polynomials (IP): two new families of asymmetric algorithms. In: Maurer, U. (ed.) EUROCRYPT 1996. LNCS, vol. 1070, pp. 33–48. Springer, Heidelberg (1996). doi:10.1007/3-540-68339-9_4
Tao, C., Diene, A., Tang, S., Ding, J.: Simple matrix scheme for encryption. In: Gaborit, P. (ed.) PQCrypto 2013. LNCS, vol. 7932, pp. 231–242. Springer, Heidelberg (2013). doi:10.1007/978-3-642-38616-9_16
Ding, J., Petzoldt, A., Wang, L.: The cubic simple matrix encryption scheme. In: [25], pp. 76–87 (2014)
Porras, J., Baena, J., Ding, J.: ZHFE, A new multivariate public key encryption scheme. In: [25], pp. 229–245 (2014)
Szepieniec, A., Ding, J., Preneel, B.: Extension field cancellation: a new central trapdoor for multivariate quadratic systems. In: [26], pp. 182–196 (2016)
Faugère, J.-C., Joux, A.: Algebraic cryptanalysis of hidden field equation (HFE) cryptosystems using Gröbner bases. In: Boneh, D. (ed.) CRYPTO 2003. LNCS, vol. 2729, pp. 44–60. Springer, Heidelberg (2003). doi:10.1007/978-3-540-45146-4_3
Kipnis, A., Shamir, A.: Cryptanalysis of the HFE public key cryptosystem by relinearization. In: Wiener, M. (ed.) CRYPTO 1999. LNCS, vol. 1666, pp. 19–30. Springer, Heidelberg (1999). doi:10.1007/3-540-48405-1_2
Bettale, L., Faugère, J., Perret, L.: Cryptanalysis of HFE, multi-HFE and variants for odd and even characteristic. Des. Codes Crypt. 69, 1–52 (2013)
Moody, D., Perlner, R.A., Smith-Tone, D.: An asymptotically optimal structural attack on the ABC multivariate encryption scheme. In: [25], pp. 180–196 (2014)
Moody, D., Perlner, R.A., Smith-Tone, D.: Key recovery attack on the cubic ABC simple matrix multivariate encryption scheme. PQCrypto 2017. LNCS, vol. 10346, pp. 272–288. Springer, Cham (2017)
Perlner, R.A., Smith-Tone, D.: Security analysis and key modification for ZHFE. In: [26], pp. 197–212 (2016)
Perret, L.: Grobner basis techniques in post-quantum cryptography. Presentation - Post-Quantum Cryptography - 7th International Workshop, PQCrypto 2016, Fukuoka, Japan, 24–26 February 2016. https://www.youtube.com/watch?v=0q957wj6w2I
Ding, J., Kleinjung, T.: Degree of regularity for HFE-. IACR Cryptology ePrint Archive 2011, p. 570 (2011)
Daniels, T., Smith-Tone, D.: Differential properties of the HFE cryptosystem. In: [25], pp. 59–75 (2014)
Dubois, V., Fouque, P.-A., Shamir, A., Stern, J.: Practical cryptanalysis of SFLASH. In: Menezes, A. (ed.) CRYPTO 2007. LNCS, vol. 4622, pp. 1–12. Springer, Heidelberg (2007). doi:10.1007/978-3-540-74143-5_1
Matsumoto, T., Imai, H.: Public quadratic polynomial-tuples for efficient signature-verification and message-encryption. In: Barstow, D., et al. (eds.) EUROCRYPT 1988. LNCS, vol. 330, pp. 419–453. Springer, Heidelberg (1988). doi:10.1007/3-540-45961-8_39
Berlekamp, E.R.: Factoring polynomials over large finite fields. Math. Comput. 24, 713–735 (1970)
Faugère, J., Din, M.S.E., Spaenlehauer, P.: Computing loci of rank defects of linear matrices using Gröbner bases and applications to cryptology. In: Koepf, W., (ed.) Symbolic and Algebraic Computation, International Symposium, ISSAC 2010, Proceedings, Munich, Germany, 25–28 July 2010, pp. 257–264. ACM (2010)
Fröberg, R.: An inequality for Hilbert series of graded algebras. Math. Scand. 56, 117–144 (1985)
Bosma, W., Cannon, J., Playoust, C.: The Magma algebra system. I. The user language. J. Symbolic Comput. 24, 235–265 (1997). Computational algebra and number theory, London (1993)
Barker, E., Roginsky, A.: Transitions: recommendation for transitioning the use of cryptographic algorithms and key lengths. NIST Special Publication (2015). http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar1.pdf
Mosca, M. (ed.): PQCrypto 2014. LNCS, vol. 8772. Springer, Cham (2014). doi:10.1007/978-3-319-11659-4
Takagi, T. (ed.): PQCrypto 2016. LNCS, vol. 9606. Springer, Cham (2016). doi:10.1007/978-3-319-29360-8
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
A Toy Example
A Toy Example
To illustrate the attack, we present a complete key recovery for a small odd prime field instance of HFE\(^-\). We simplify the exposition by considering a homogeneous key.
Let \(q=7\), \(n=8\), \(D=14\) and \(a=2\). We construct the degree n extension \(\mathbb {K}=\mathbb {F}_7[x]/\langle x^8+4x^3+6x^2+2x+3 \rangle \) and let \(b\in \mathbb {K}\) be a fixed root of this irreducible polynomial.
We randomly select \(f:\mathbb {K}\rightarrow \mathbb {K}\) of degree D,
and two invertible linear transformations T and U:
Since \(b^{1093971}/2=b^{4937171}\), we have
We fix \(\varPi :\mathbb {F}_q^8\rightarrow \mathbb {F}_q^6\), the projection onto the first 6 coordinates. Then the public key \(P=\varPi \circ T\circ F\circ U\) in matrix form over \(\mathbb {F}_q\) is given by:
1.1 A.1 Recovering a Related HFE Key
This step in key recovery is a slight adaptation of the program of [11]. First, we recover the related private key of Theorem 2. To do this, we solve the MinRank instance on the above \(6=n-2\) \(n\times n\) matrices with target rank \(\lceil log_q(D)\rceil +a=2+2=4\). We may fix one variable to make the ideal generated by the \(5\times 5\) minors zero-dimensional. There are \(n=8\) solutions, each of which consists of the Frobenius powers of the coordinates of
The combination \(L=\sum _{i=0}^5v_i\mathbf {P_i}\) is now a rank 4 matrix with entries in \(\mathbb {K}\).
We next form \(\widehat{v}\) from v by appending \(a=2\) random nonzero values from \(\mathbb {K}\) to v. Now we compute
Next we let \(K_i\) be the left kernel matrix of the \(n-i\)th Frobenius power of L for \(i=0,1,\ldots ,a+1\). We then recover a vector w simultaneously in the right kernel of \(K_i\) for all i. For this example, each such element is a multiple in \(\mathbb {K}\) of
Then we may compute
At this point we can recover \(\phi ^{-1}\circ f'\circ \phi =T'^{-1}\circ P\circ U'^{-1}\), and have a full private key for the related instance HFE(7, 8, 686). The transformations \(T'\) and \(U'\) and the matrix representation of \(f'\) as a quadratic form over \(\mathbb {K}\) are given by
1.2 A.2 Recovery of Equivalent HFE\(^-\) Key
Now we describe the full key recovery given the related HFE key. We know that there exists a degree \(D=14\) map \(f''(x)=f''_{0,0}x^2+2f''_{0,1}x^8+f''_{1,1}x^{14}\) with associated quadratic form
and a polynomial \(\pi (x)=x+p_1x^7+p_2x^{49}\) such that \(f'=\pi \circ f''\). Thus we obtain the bilinear system of equations by equating \(\mathbf {F'}\) to:
We clearly have the values of \(f''_{0,0}\) and \(f''_{0,1}\). Then the equations on the highest diagonal are linear in \(p_i\). We obtain \(\pi =x+b^{1948142}x^7+b^{398370}x^{49}\) and continue to solve the now linear system to recover \(f''(x)=b^{416522}x^2+b^{1559326}x^8+b^{1121420}x^{14}\).
We then obtain the matrix form of \(\pi \) over \(\mathbb {F}_q\) and compose with \(T'\):
Replacing the last two rows of \(T'\circ \widehat{\pi }\) to make a full rank matrix produces \(T''\). Then the original public key P is equal to \(\varPi \circ T''\circ \phi ^{-1}\circ f''\circ \phi \circ U'\).
Rights and permissions
Copyright information
© 2017 Springer International Publishing AG (outside the US)
About this paper
Cite this paper
Vates, J., Smith-Tone, D. (2017). Key Recovery Attack for All Parameters of HFE-. In: Lange, T., Takagi, T. (eds) Post-Quantum Cryptography . PQCrypto 2017. Lecture Notes in Computer Science(), vol 10346. Springer, Cham. https://doi.org/10.1007/978-3-319-59879-6_16
Download citation
DOI: https://doi.org/10.1007/978-3-319-59879-6_16
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-59878-9
Online ISBN: 978-3-319-59879-6
eBook Packages: Computer ScienceComputer Science (R0)