Skip to main content
SpringerLink
Log in

Key Recovery Attack for ZHFE

  • Conference paper
  • First Online:
Book cover Post-Quantum Cryptography (PQCrypto 2017)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 10346))

Included in the following conference series:

Abstract

At PQCRYPTO 2014, Porras, Baena and Ding introduced ZHFE, an interesting new technique for multivariate post-quantum encryption. The scheme is a generalization of HFE in which a single low degree polynomial in the central map is replaced by a pair of high degree polynomials with a low degree cubic polynomial contained in the ideal they generate. We present a key recovery attack for ZHFE based on the independent discoveries of the low rank property of ZHFE by Verbel and by Perlner and Smith-Tone. Thus, although the two central maps of ZHFE have high degree, their low rank property makes ZHFE vulnerable to the Kipnis-Shamir (KS) rank attack. We adapt KS attack pioneered by Bettale, Faugère and Perret in application to HFE, and asymptotically break ZHFE.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Baena, J.B., Cabarcas, D., Escudero, D.E., Porras-Barrera, J., Verbel, J.A.: Efficient ZHFE key generation. In: Takagi [27], pp. 213–232. http://dx.doi.org/10.1007/978-3-319-29360-8_14

  2. Bettale, L., Faugère, J.C., Perret, L.: Cryptanalysis of HFE, multi-HFE and variants for odd and even characteristic. Des. Codes Crypt. 69(1), 1–52 (2013)

    Article  MathSciNet  MATH  Google Scholar 

  3. Bosma, W., Cannon, J., Playoust, C.: The Magma algebra system I. The user language. J. Symbolic Comput. 24(3–4), 235–265 (1997). http://dx.doi.org/10.1006/jsco.1996.0125, computational algebra and number theory (London, 1993)

    Article  MathSciNet  MATH  Google Scholar 

  4. Cartor, R., Gipson, R., Smith-Tone, D., Vates, J.: On the differential security of the HFEV- signature primitive. In: Takagi [27], pp. 162–181. http://dx.doi.org/10.1007/978-3-319-29360-8_11

  5. Chen, M.S., Yang, B.Y., Smith-Tone, D.: PFLASH - secure asymmetric signatures on smart cards. In: Lightweight Cryptography Workshop 2015 (2015). http://csrc.nist.gov/groups/ST/lwc-workshop.2015/papers/session3-smith-tone-paper.pdf

  6. Daniels, T., Smith-Tone, D.: Differential properties of the HFE cryptosystem. In: Mosca [20] , pp. 59–75. http://dx.doi.org/10.1007/978-3-319-11659-4_4

  7. Ding, J., Hodges, T.J.: Inverting HFE systems is quasi-polynomial for all fields. In: Rogaway, P. (ed.) CRYPTO 2011. LNCS, vol. 6841, pp. 724–742. Springer, Heidelberg (2011). http://dx.doi.org/10.1007/978-3-642-22792-9_41

    Chapter  Google Scholar 

  8. Ding, J., Petzoldt, A., Wang, L.: The cubic simple matrix encryption scheme. In: Mosca [20], pp. 76–87. http://dx.doi.org/10.1007/978-3-319-11659-4_5

  9. Ding, J., Schmidt, D.: Rainbow, a new multivariable polynomial signature scheme. In: Ioannidis, J., Keromytis, A., Yung, M. (eds.) ACNS 2005. LNCS, vol. 3531, pp. 164–175. Springer, Heidelberg (2005). http://dx.doi.org/10.1007/11496137_12

    Chapter  Google Scholar 

  10. Ding, J., Yang, B.Y.: Degree of regularity for HFEV and HFEV. In: Gaborit [15], pp. 52–66. http://dx.doi.org/10.1007/978-3-642-38616-9

  11. Dubois, V., Gama, N.: The degree of regularity of HFE systems. In: Abe, M. (ed.) ASIACRYPT 2010. LNCS, vol. 6477, pp. 557–576. Springer, Heidelberg (2010). http://dx.doi.org/10.1007/978-3-642-17373-8_32

    Chapter  Google Scholar 

  12. Faugère, J.C., Din, M.S.E., Spaenlehauer, P.J.: Gröbner bases of bihomogeneous ideals generated by polynomials of bidegree: algorithms and complexity. J. Symbolic Comput. 46(4), 406–437 (2011)

    Article  MathSciNet  MATH  Google Scholar 

  13. Faugère, J.C., El Din, M.S., Spaenlehauer, P.J.: Computing loci of rank defects of linear matrices using gröbner bases and applications to cryptology. In: Proceedings of the 2010 International Symposium on Symbolic and Algebraic Computation, ISSAC 2010, pp. 257–264. ACM, New York (2010)

    Google Scholar 

  14. Faugère, J.-C., Gligoroski, D., Perret, L., Samardjiska, S., Thomae, E.: A polynomial-time key-recovery attack on MQQ cryptosystems. In: Katz, J. (ed.) PKC 2015. LNCS, vol. 9020, pp. 150–174. Springer, Heidelberg (2015). http://dx.doi.org/10.1007/978-3-662-46447-2_7

    Google Scholar 

  15. Gaborit, P. (ed.): PQCrypto 2013. LNCS, vol. 7932. Springer, Heidelberg (2013). http://dx.doi.org/10.1007/978-3-642-38616-9

    MATH  Google Scholar 

  16. Kipnis, A., Patarin, J., Goubin, L.: Unbalanced oil and vinegar signature schemes. In: Stern, J. (ed.) EUROCRYPT 1999. LNCS, vol. 1592, pp. 206–222. Springer, Heidelberg (1999). http://dx.doi.org/10.1007/3-540-48910-X_15

    Google Scholar 

  17. Kipnis, A., Shamir, A.: Cryptanalysis of the HFE public key cryptosystem by relinearization. In: Wiener, M. (ed.) CRYPTO 1999. LNCS, vol. 1666, pp. 19–30. Springer, Heidelberg (1999). doi:10.1007/3-540-48405-1_2

    Chapter  Google Scholar 

  18. Moody, D., Perlner, R.A., Smith-Tone, D.: An asymptotically optimal structural attack on the ABC multivariate encryption scheme. In: Mosca [20], pp. 180–196. http://dx.doi.org/10.1007/978-3-319-11659-4_11

  19. Moody, D., Perlner, R.A., Smith-Tone, D.: Key recovery attack on the cubic ABC simple matrix multivariate encryption scheme. In: Lange, T., Takagi, T. (eds.) PQCrypto 2017. LNCS, vol. 10346, pp. 289–308. Springer, Cham (2017)

    Google Scholar 

  20. Mosca, M. (ed.): PQCrypto 2014. LNCS, vol. 8772. Springer, Cham (2014). http://dx.doi.org/10.1007/978-3-319-11659-4

    MATH  Google Scholar 

  21. Patarin, J., Courtois, N., Goubin, L.: QUARTZ, 128-bit long digital signatures. In: Naccache, D. (ed.) CT-RSA 2001. LNCS, vol. 2020, pp. 282–297. Springer, Heidelberg (2001). http://dx.doi.org/10.1007/3-540-45353-9_21

    Chapter  Google Scholar 

  22. Perlner, R.A., Smith-Tone, D.: A classification of differential invariants for multivariate post-quantum cryptosystems. In: Gaborit [15], pp. 165–173. http://dx.doi.org/10.1007/978-3-642-38616-9

  23. Perlner, R.A., Smith-Tone, D.: Security analysis and key modification for ZHFE. In: Takagi[27], pp. 197–212. http://dx.doi.org/10.1007/978-3-319-29360-8_13

  24. Porras, J., Baena, J., Ding, J.: ZHFE, a new multivariate public key encryption scheme. In: Mosca, M. (ed.) PQCrypto 2014. LNCS, vol. 8772, pp. 229–245. Springer, Cham (2014). doi:10.1007/978-3-319-11659-4_14

    Google Scholar 

  25. Shor, P.W.: Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM Rev. 41(2), 303–332 (1999). (electronic)

    Article  MathSciNet  MATH  Google Scholar 

  26. Smith-Tone, D.: On the differential security of multivariate public key cryptosystems. In: Yang, B.-Y. (ed.) PQCrypto 2011. LNCS, vol. 7071, pp. 130–142. Springer, Heidelberg (2011). doi:10.1007/978-3-642-25405-5_9

    Chapter  Google Scholar 

  27. Takagi, T. (ed.): PQCrypto 2016. LNCS, vol. 9606. Springer, Cham (2016). http://dx.doi.org/10.1007/978-3-319-29360-8

    MATH  Google Scholar 

  28. Tao, C., Diene, A., Tang, S., Ding, J.: Simple matrix scheme for encryption. In: Gaborit [15], pp. 231–242. http://dx.doi.org/10.1007/978-3-642-38616-9

  29. Verbel, J.A.: Efficiency and security of ZHFE. Master’s thesis, Universidad Nacional de Colombia, Sede Medellín (2016)

    Google Scholar 

  30. Zhang, W., Tan, C.H.: On the security and key generation of the ZHFE encryption scheme. In: Ogawa, K., Yoshioka, K. (eds.) IWSEC 2016. LNCS, vol. 9836, pp. 289–304. Springer, Cham (2016). doi:10.1007/978-3-319-44524-3_17

    Chapter  Google Scholar 

Download references

Acknowledgements

This work was partially supported by “Fondo Nacional de Financiamiento para la Ciencia, la Tecnología y la Innovación Francisco José de Caldas”, Colciencias (Colombia), Project No. 111865842333 and Contract No. 049-2015. We would like to thank Ludovic Perret and John B. Baena for useful discussions. We would also like to thank the reviewers of PQCrypto for some constructive reviews and suggestions.

Author information

Authors and Affiliations

  1. Universidad Nacional de Colombia, Sede Medellín, Medellín, Colombia

    Daniel Cabarcas & Javier A. Verbel

  2. University of Louisville, Louisville, USA

    Daniel Smith-Tone

  3. National Institute of Standards and Technology, Gaithersburg, USA

    Daniel Smith-Tone

Authors
  1. Daniel Cabarcas
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Daniel Smith-Tone
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Javier A. Verbel
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Javier A. Verbel .

Editor information

Editors and Affiliations

  1. Technische Universiteit Eindhoven, Eindhoven, The Netherlands

    Tanja Lange

  2. Kyushu University , Fukuoka, Japan

    Tsuyoshi Takagi

A Appendix

A Appendix

1.1 A.1 Toy Example

We provide a small example of the MinRank attack for ZHFE with parameters \(n =8\), \(q = 3\) and \(D =9\). The small field is \(\mathbb {F} = \mathbb {F}_{q}\), the extension field is \(\mathbb {K} = \mathbb {F}/\langle g(y)\rangle \), where \(g(y) = y^8 + 2y^5 + y^4 + 2y^2 + 2y + 2 \in \mathbb {F}[y]\), and b is a primitive root of the irreducible polynomial g(y).

For ease of presentation, we consider a homogeneous public key and linear transformations. An easy adaptation for the general case can be done following the ideas expressed in [2].

The matrices associated with our private key \(\left( (F,\tilde{F}),S,T\right) \) are

figure a

and \(\mathbf T = [\mathbf T _{1}|\mathbf T _{2}]\), where

figure b

This private key gives us a public key represented by the matrices \(\mathbf P _{1},\mathbf P _{2},\ldots ,\mathbf P _{2n}.\)

figure c

Recovering T : The first and harder step to recover an equivalent linear transformation T is to solve the MinRank problem associated with the public matrices \(\mathbf P _{1},\ldots , \mathbf P _{16}\) and \(r+1\), with \(r = \lceil \log _{q} D\rceil = 2\). Using the minors modeling, we construct a degree 4 polynomial system in 2n variables. We can fix the two first coordinates of the vector \(\mathbf u '{'} = (u'_{0},u'_{1},\ldots ,u'_{7})\) as 1 and 0 respectively. A solution for this system is

$$\mathbf u ' = (1, 0, b^{5854}, b^{4879}, b^{2843}, b^{2676}, b^{6279}, b^{1845}, b^{6102}, b^{5619}, b^{5448}, b^{6022}, b^{1721}, b^{2632}, b^{3738}, b^{6170}).$$

Next we compute

$$\begin{aligned} \mathbf K {'}=\ker \left( \sum _{i = 0}^{2n-1} u'_{i}{} \mathbf P _{i+1}\right) = \begin{pmatrix} 1 &{} 0 &{} 0 &{} 0 &{} 0 &{}b^{6158} &{} b^{1567} &{} b^{6415}\\ 0 &{} 1 &{} 0 &{} 0 &{} 0 &{} b^{3943} &{} b^{4591} &{} b^{95}\\ 0 &{} 0 &{} 1 &{} 0 &{} 0 &{} b^{4461} &{} b^{4216} &{} b^{3027}\\ 0 &{} 0 &{} 0 &{} 1 &{} 0 &{} b^{3577} &{} b^{5899} &{}b^{1096}\\ 0 &{} 0 &{} 0 &{} 0 &{} 1 &{} b^{6554} &{} b^{4266} &{} b^{907} \end{pmatrix}, \end{aligned}$$

and by solving the linear system

$$\begin{aligned} \mathbf K {'} \left( \sum _{i=0}^{2n-1} x_{i}{} \mathbf P _{i+1}\right) = \mathbf 0 _{(n-r)\times n}, \end{aligned}$$

we get another solution

$$\mathbf v '\! :=\! (b^{1519 }\!, b^{4750 }\!, b^{4454 }\!, b^{3326 }\!, b^{2077 }\!, b^{4519 }\!, b^{3525}\!, b^{1978}, b^{5511}, b^{315}, b^{715}, b^{4722}, b^{5003}, b^{1895 }, b^{2665 }, b^{4505}).$$

Once we have two solution for the MinRank problem we compute

$$\begin{aligned} \mathbf T ''^{-1} = \mathbf U'' {} \mathbf M _{16}^{-1}, \end{aligned}$$

with \(\mathbf U '' := [\mathbf u '\vert \cdots \vert \mathbf u '^{q^{n-1}}\vert \mathbf v '\vert \cdots \vert \mathbf v '^{q^{n-1}}]\), invert the output matrix to obtain \(\mathbf T '' = [\mathbf T _{1}''|\mathbf T _{2}'']\), with

$$ \mathbf T _{1} '' = \begin{pmatrix} 2 &{} 0 &{} 2 &{} 1 &{} 1 &{} 0 &{} 1 &{} 0 \\ 1 &{} 2 &{} 2 &{} 2 &{} 0 &{} 2 &{} 0 &{} 0 \\ 1 &{} 1 &{} 0 &{} 2 &{} 0 &{} 0 &{} 0 &{} 2 \\ 2 &{} 2 &{} 1 &{} 2 &{} 0 &{} 1 &{} 0 &{} 0 \\ 0 &{} 2 &{} 2 &{} 0 &{} 2 &{} 0 &{} 0 &{} 0 \\ 2 &{} 1 &{} 0 &{} 1 &{} 1 &{} 2 &{} 0 &{} 0 \\ 2 &{} 1 &{} 1 &{} 1 &{} 1 &{} 1 &{} 0 &{} 0 \\ 2 &{} 2 &{} 1 &{} 0 &{} 2 &{} 1 &{} 0 &{} 1 \\ 0 &{} 0 &{} 2 &{} 0 &{} 0 &{} 1 &{} 2 &{} 0 \\ 1 &{} 2 &{} 2 &{} 0 &{} 0 &{} 0 &{} 0 &{} 1 \\ 0 &{} 1 &{} 1 &{} 2 &{} 2 &{} 2 &{} 2 &{} 2 \\ 2 &{} 2 &{} 0 &{} 1 &{} 0 &{} 1 &{} 2 &{} 1 \\ 1 &{} 0 &{} 0 &{} 1 &{} 1 &{} 0 &{} 0 &{} 1 \\ 1 &{} 2 &{} 2 &{} 1 &{} 1 &{} 2 &{} 1 &{} 0 \\ 1 &{} 0 &{} 0 &{} 1 &{} 1 &{} 0 &{} 1 &{} 0 \\ 0 &{} 0 &{} 2 &{} 0 &{} 2 &{} 2 &{} 1 &{} 1 \end{pmatrix}, \mathbf T _{2} '' = \begin{pmatrix} 1 &{} 1 &{} 0 &{} 0 &{} 2 &{} 1 &{} 1 &{} 1 \\ 1 &{} 0 &{} 0 &{} 1 &{} 0 &{} 2 &{} 1 &{} 1 \\ 2 &{} 1 &{} 1 &{} 2 &{} 2 &{} 1 &{} 1 &{} 0 \\ 1 &{} 2 &{} 2 &{} 1 &{} 2 &{} 2 &{} 0 &{} 0 \\ 0 &{} 1 &{} 1 &{} 2 &{} 0 &{} 1 &{} 2 &{} 1 \\ 2 &{} 0 &{} 2 &{} 1 &{} 2 &{} 0 &{} 1 &{} 2 \\ 2 &{} 0 &{} 2 &{} 2 &{} 2 &{} 0 &{} 2 &{} 1 \\ 2 &{} 2 &{} 1 &{} 0 &{} 2 &{} 2 &{} 0 &{} 1 \\ 2 &{} 1 &{} 0 &{} 1 &{} 2 &{} 1 &{} 1 &{} 0 \\ 0 &{} 1 &{} 2 &{} 1 &{} 0 &{} 2 &{} 1 &{} 1 \\ 2 &{} 2 &{} 2 &{} 1 &{} 1 &{} 0 &{} 1 &{} 2 \\ 0 &{} 0 &{} 0 &{} 0 &{} 1 &{} 2 &{} 2 &{} 0 \\ 0 &{} 2 &{} 0 &{} 0 &{} 2 &{} 1 &{} 1 &{} 0 \\ 0 &{} 1 &{} 2 &{} 0 &{} 1 &{} 1 &{} 2 &{} 1 \\ 1 &{} 2 &{} 0 &{} 2 &{} 0 &{} 1 &{} 2 &{} 1 \\ 1 &{} 2 &{} 0 &{} 0 &{} 0 &{} 1 &{} 1 &{} 0 \end{pmatrix}$$

Recovering S : To find \(\mathbf W '' := \mathbf S '' \mathbf M _{n} = [\mathbf w '' | \mathbf w ''^{q}|\cdots | \mathbf w ''^{q^{n-1}}]\), we find its first column \(\mathbf w ''\), which satisfy \(\text {Frob}_{j+1}(\mathbf K ')\mathbf w '' = \mathbf 0 \), for \(j = n - r,\ldots ,n-1 = 7,8\).

By solving the overdetermined system

$$\begin{aligned} \begin{pmatrix} \mathbf K ' \\ \text {Frob}_{7}(\mathbf K ') \end{pmatrix}{} \mathbf w '' = \begin{pmatrix} 1 &{} 0 &{} 0 &{} 0 &{} 0 &{} b^{6158 } &{}b^{1567 } &{}b^{6415} \\ 0 &{} 1 &{} 0 &{} 0 &{} 0 &{} b^{3943 } &{}b^{4591} &{}b^{95} \\ 0 &{} 0 &{} 1 &{} 0 &{} 0 &{} b^{4461} &{}b^{4216 } &{}b^{3027} \\ 0 &{} 0 &{} 0 &{} 1 &{} 0 &{} b^{3577 } &{}b^{5899 } &{}b^{1096} \\ 0 &{} 0 &{} 0 &{} 0 &{} 1 &{} b^{6554 } &{}b^{4266 } &{}b^{907} \\ 1 &{} 0 &{} 0 &{} 0 &{} 0 &{} b^{6426 } &{}b^{2709 } &{}b^{4325} \\ 0 &{} 1 &{} 0 &{} 0 &{} 0 &{} b^{3501 } &{}b^{3717 } &{}b^{4405} \\ 0 &{} 0 &{} 1 &{} 0 &{} 0 &{} b^{1487 } &{}b^{3592 } &{}b^{1009} \\ 0 &{} 0 &{} 0 &{} 1 &{} 0 &{} b^{3379 } &{}b^{4153 } &{}b^{2552} \\ 0 &{} 0 &{} 0 &{} 0 &{} 1 &{} b^{6558 } &{}b^{1422 } &{}b^{2489} \end{pmatrix}{} \mathbf w '' =\mathbf 0 , \end{aligned}$$

we obtain \(\mathbf w '' = (b^{929}, b^{2174}, b^{2323}, b^{4231}, b^{3677}, b^{6313}, b^{2372}, b^{3245})\). We then compute

$$\begin{aligned} \mathbf W '' = \begin{pmatrix} b^{929 } &{} b^{2787 } &{} b^{1801 } &{} b^{5403 } &{} b^{3089 } &{} b^{2707 } &{} b^{1561 } &{} b^{4683} \\ b^{2174 } &{} b^{6522 } &{} b^{6446 } &{} b^{6218 } &{} b^{5534 } &{} b^{3482 } &{} b^{3886 } &{} b^{5098} \\ b^{2323 } &{} b^{409 } &{} b^{1227 } &{} b^{3681 } &{} b^{4483 } &{} b^{329 } &{} b^{987 } &{} b^{2961} \\ b^{4231 } &{} b^{6133 } &{} b^{5279 } &{} b^{2717 } &{} b^{1591 } &{} b^{4773 } &{} b^{1199 } &{} b^{3597} \\ b^{3677 } &{} b^{4471 } &{} b^{293 } &{} b^{879 } &{} b^{2637 } &{} b^{1351 } &{} b^{4053 } &{} b^{5599} \\ b^{6313 } &{} b^{5819 } &{} b^{4337 } &{} b^{6451 } &{} b^{6233 } &{} b^{5579 } &{} b^{3617 } &{} b^{4291} \\ b^{2372 } &{} b^{556 } &{} b^{1668 } &{} b^{5004 } &{} b^{1892 } &{} b^{5676 } &{} b^{3908 } &{} b^{5164} \\ b^{3245 } &{} b^{3175 } &{} b^{2965 } &{} b^{2335 } &{} b^{445 } &{} b^{1335 } &{} b^{4005 } &{} b^{5455} \end{pmatrix}, \end{aligned}$$

and

$$\begin{aligned} \mathbf S '' = \mathbf W '' \mathbf M _{8}^{-1} = \begin{pmatrix} 2 &{} 2 &{} 2 &{} 1 &{} 2 &{} 0 &{} 0 &{} 2\\ 1 &{} 2 &{} 1 &{} 1 &{} 2 &{} 0 &{} 1 &{} 2\\ 2 &{} 1 &{} 0 &{} 2 &{} 0 &{} 2 &{} 1 &{} 0\\ 2 &{} 2 &{} 1 &{} 1 &{} 2 &{} 1 &{} 2 &{} 2\\ 0 &{} 2 &{} 1 &{} 2 &{} 0 &{} 0 &{} 0 &{} 2\\ 1 &{} 0 &{} 1 &{} 0 &{} 1 &{} 1 &{} 1 &{} 2\\ 1 &{} 0 &{} 2 &{} 0 &{} 1 &{} 2 &{} 2 &{} 0\\ 0 &{} 1 &{} 1 &{} 0 &{} 2 &{} 2 &{} 0 &{} 1 \end{pmatrix} \end{aligned}$$

Recovering Core Polynomials: To find our equivalent core polynomials \(H'\) and \(\tilde{H}'\) we calculate \(\mathbf H ' = \mathbf W {''}^{-1}\left( \sum _{i=0}^{7}u{'}_{i}{} \mathbf P _{i+1}\right) \mathbf W {''}^{-t}\) as well as the value of \(\tilde{\mathbf{H }}{'} = \mathbf W ''^{-1}\left( \sum _{i=0}^{7}v{'}_{i}{} \mathbf P _{i+1} \right) \mathbf W {''}^{-t}\) and obtain

figure d

Recovering the Low Degree Polynomial: Once the core polynomials \(\mathbf H ' = [h_{ij}],\; \tilde{\mathbf{H }}' = [\tilde{h}_{ij}]\) are recovered, our target is to build the low degree polynomial \(\varPsi ''\) fundamental for the attacker to be able decrypt. So, we solve the following overdetermined systems

$$\begin{aligned} \begin{bmatrix} h_{1, r + 1}&h_{1, r + 2}&\cdots&h_{1, n-1}&h_{1, n} \\ \tilde{h}_{1, r + 1}&\tilde{h}_{1, r + 2}&\cdots&\tilde{h}_{1, n- 1}&\tilde{h}_{1, n} \end{bmatrix}^{\top }\begin{bmatrix} x_{0} \\ x_{1} \end{bmatrix}= & {} \begin{bmatrix} b^{5159}&b^{4953}&b^{4144}&b^{6518}&b^{3920}&b^{4127} \\ b^{3075}&b^{2869}&b^{2060}&b^{4434}&b^{1836}&b^{2043} \end{bmatrix}^{\top } \begin{bmatrix} x_{0} \\ x_{1} \end{bmatrix} = \mathbf 0 , \\ \\ \begin{bmatrix} h_{2, r + 1}&h_{2, r + 2}&\cdots&h_{2, n-1}&h_{2, n} \\ \tilde{h}_{2, r + 1}&\tilde{h}_{2, r + 2}&\cdots&\tilde{h}_{2, n- 1}&\tilde{h}_{2, n} \end{bmatrix}^{\top }\begin{bmatrix} y_{0} \\ y_{1} \end{bmatrix}= & {} \begin{bmatrix} b^{5229}&b^{5023}&b^{4214 }&b^{28}&b^{3990}&b^{4197} \\ b^{1832}&b^{1626 }&b^{817}&b^{3191 }&b^{593 }&b^{800} \end{bmatrix}^{\top }\begin{bmatrix} y_{0} \\ y_{1} \end{bmatrix} = \mathbf 0 , \end{aligned}$$

and we obtain the solutions \([x_{0}, x_{1}]^{\top } = [b^{1418},\; b^{222}]^{\top }\) and \( [y_{0}, y_{1}]^{\top } = [b^{2162},\; b^{2279} ]^{\top } \). Then, we compute \(b^{1418}{} \mathbf H ' + b^{222}\tilde{\mathbf{H }}'\) and \(b^{2162}{} \mathbf H ' + b^{2279}\tilde{\mathbf{H }}'\) obtaining respectively

$$\begin{aligned} \begin{pmatrix} b^{106} &{} b^{6092} &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0\\ b^{6092}&{} b^{3643}&{} b^{4437}&{} b^{4231}&{} b^{3422}&{} b^{5796} &{} b^{3198}&{} b^{3405}\\ 0 &{} b^{4437} &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0\\ 0 &{} b^{4231} &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0\\ 0 &{} b^{3422} &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0\\ 0 &{} b^{5796} &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0\\ 0 &{} b^{3198} &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0\\ 0 &{} b^{3405} &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 \end{pmatrix}, \begin{pmatrix} b^{1294 }&{} b^{536} &{} b^{3144} &{} b^{2938} &{} b^{2129} &{} b^{4403} &{} b^{1905} &{} b^{2112}\\ b^{536} &{} b^{844} &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0\\ b^{3144} &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0\\ b^{2938} &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0\\ b^{2129} &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0\\ b^{4503} &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0\\ b^{1905} &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0\\ b^{2112} &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 \end{pmatrix}. \end{aligned}$$

Finally, we form the system

$$\begin{aligned} \begin{bmatrix} b^{4437}&b^{4231}&b^{3422}&b^{5796}&b^{3198}&b^{3405} \\ b^{3144}&b^{2938}&b^{2129}&b^{4403}&b^{1905}&b^{2112} \end{bmatrix}^{\top } \begin{bmatrix} z_{0} \\ z_{1} \end{bmatrix} = \mathbf 0 , \end{aligned}$$

we a solution \([z_{0},\; z_{1}]^{\top } = [b^{1024},\; b^{5597}]^{\top }\), and we use it to compute our low degree polynomial,

$$\begin{aligned} \varPsi ''&= b^{1024}X(b^{1418}H' + b^{222}\tilde{H}' ) +X^{q}(b^{2162}H' + b^{2279}\tilde{H}') \\&= b^{6441}X^{9} + b^{2097}X^{7} + b^{852}X^{5} + b^{1130}X^{3} \end{aligned}$$

1.2 A.2 Low Rank Matrix Forms

figure e

Rights and permissions

Reprints and permissions

Copyright information

© 2017 Springer International Publishing AG

About this paper

Cite this paper

Cabarcas, D., Smith-Tone, D., Verbel, J.A. (2017). Key Recovery Attack for ZHFE. In: Lange, T., Takagi, T. (eds) Post-Quantum Cryptography . PQCrypto 2017. Lecture Notes in Computer Science(), vol 10346. Springer, Cham. https://doi.org/10.1007/978-3-319-59879-6_17

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-59879-6_17

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-59878-9

  • Online ISBN: 978-3-319-59879-6

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation