# pptx - PQCrypto 2013

```Multivariate Signature Scheme
Takanori Yasuda (ISIT)
Joint work with
Tsuyoshi Takagi (Kyushu Univ.), Kouichi Sakurai (Kyushu Univ.)
This work was partially supported by the Japan Science and Technology Agency (JST) Strategic Japanese-Indian
Cooperative Programme for Multidisciplinary Research Fields, which aims to combine Information and
Communications Technology with Other Fields. The first author is supported by Grant-in-Aid for Young
Scientists (B), Grant number 24740078.
1
Contents
1.
2.
3.
4.
5.
Multivariate Signature Schemes
Multivariate System defined by Quadratic Forms
Application to Signature Scheme
Comparison with Rainbow
1.
2.
3.
Efficiency of Signature Generation
Key Sizes
Security
6. Conclusion
2
MPKC Signature
:   →   : multivariate polynomial map
Vector space
Vector space

= − ()
Signature

Inverse function
−1
Message
For any message M, there must exist the corresponding signature.
F is surjective.
3
New Multivariate
Polynomial Map
• We introduce a multivariate polynomial map not
surjective, and apply it to signature scheme.
Multivariate polynomial map
For a symmetric matrix A,
() = . .
where  =  is a matrix of variables of size  × .
is a map which assigns a matrix to a matrix.
G can be regarded as
2
2
a multivariate polynomial map   →   .
(+1)/2
4
Questions
Is G applicable to signature scheme or not?
Questions
1. Can its inverse map be computed efficiently?
Necessary to compute  −1 M for a message M
in order to generate a signature.
2. Is it surjective or not?
For any message M,
necessary to generate its signature.
5
• Definition 1
: Field with odd characteristic (or 0)
: Natural number
:   →  is a quadratic form
= . .   for some symmetric matrix
• Definition 2
,  : quadratic forms associated to ,
and  are isometric
. .   =  for some  ∈ (, )
6
Translation of questions of
• Equation
(, : symmetric matrices)
() = . .   =
• Restrict solution  ∈ (, )
o Problem 1 For  ,  , isometric each other,
find a translation matrix  efficiently.
o Problem 2 For any  ,  ,
determine whether  and  isometric or not?
7
How to compute the
inverse map
Simple case
1
=  =
0
⋱
0
1
Problem 1 is equivalent to
Problem 1’: Find an orthonormal basis of
with respect to  .
Orthonormal basis: 1 , …  in
= 1 for  = 1, … , ,
,
≔  . .

= 0 for  ≠
8
Real field Case
•  =  : real field
Gram-Schmidt orthonormalization provides an efficient
algorithm to solve Problem 1’.
It uses special property of  =  .
Fact:  =  is anisotropic.
Definition:
for any  (≠ 0)   , () ≠ 0
We want to apply Gram-Schmidt orthonormalization technique
to the case of finite fields.
9
Finite Field Case
Fact Let  be a finite field.
Any quadratic form on   ( ≥ 3) is not anisotropic.
We cannot apply Gram-Schmidt orthonormalization directly.
• However, we can extend Gram-Schmidt orthonormalization
by inserting a step:
If   = 0, then find another element ′ such that  ′ ≠ 0.
Solve Problem 1
10
2-dimensional case (1)
Operation for Matrices of 2×2 is fundamental.

(1)  =

( ≠ 0)
In this case, apply the usual GS orthonormalization.
11
2-dimensional case (2)

(2)  =

( = 0)
• There are two cases:  = 0 or  ≠ 0.
⇒
apply the usual GS-normalization.
12
2-dimensional case (3)
• We obtained
•
0
′ =
(,  ≠ 0)
0
There is a matrix  such that
1 0

. ’.  =
.
0 ′
This completes the Extended GS-normalization.
13
Problem 2
• Definition
: quadratic form associated to .
is nondegenerate
det() ≠ 0
Classification theorem
Any nondegenerate quadratic form is isometric to either
1 or  .
14
Classification Theorem
• For any (nondegenerate) message , either
•
•
•
•
∙ 1 ∙   =  or  ∙  ∙   =
has a solution.
1 or  is determined by det().
In the degenerate case, both equations have solutions.
=  ∙ 1 ∙   or   =  ∙  ∙   is not surjective.
However, we can apply these maps to MPKC signature
scheme.
15
Application to MPKC
Signature Scheme
• Secret Key
1 ,   (, )
1 ≔ 1 . 1 . 1  ,  ≔  .  .   ,
1  = . 1 . ,
:   →   ,
• Public Key
= .  .
:   →   , affine transformations
=
+1
2
,
= 2
1 :   →   defined by 1 = °1 °,
:   →   defined by  = ° °,
16
Signature Generation
For a symmetric matrix ,
• Step 1 Compute ’ = −1 () .
• Step 2 Apply the extended Gram-Schmidt
orthornormalization to ′.
o Find a solution  =  of either
∙ 1 ∙   = ′ or
∙  ∙   = ′
• Step 3 Compute  = 1 −1 .  or  =  −1 . .
=  is a solution of 1  =  or   = .
• Step 4 Compute  = −1 ().
17
Property of Our Scheme
• Respective map 1 or  is not surjective.
• However, the union of images of these maps covers the
whole space.
For any M, there exists the corresponding signature.

M
18
Other Signature Schemes
Multivariate Polynomial Maps
Rainbow
Surjective
HFE
UOV
MI
Not
Surjective
Proposal
19
Security of Our Scheme
• There are several attacks of MPKC signature schemes
which depend on the structure of central map.
• For example, UOV attack is an attack which transforms
public key into a form of central map of UOV scheme.
o Central maps of UOV are surjective.
o The public key of our scheme cannot be transformed into any
surjective map.
• These attacks is not applicable against our scheme.
（Other examples: Rainbow-band-separation attack,
UOV-Reconciliation attack）
• However, attacks which is independent of scheme, like
direct attacks, are applicable to our scheme.
20
Comparison with
Rainbow
Compared in the case that  and  are same
for public key F :   →
• Equivalent with respect to cost of verification and public key
length.
• Cost of signature generation (number of mult.)
o Proposal
(2 )
o Rainbow
(3 )
⇒ 8 or 9 times more efficient at the level of 88-bit security.
• Secret Key Size (number of elements of field)
o Proposal
o Rainbow
21
Conclusion
• We propose a new MPKC signature scheme using quadratic
forms. The multivariate polynomial map used in the scheme
is not surjective.
• Signature generation uses an extended Gram-Schmidt
orthonormalization. It is 8 or 9 times more efficient than that
of Rainbow at the level of 88-bit security.
Future Work
• Security analysis
• Application to encryption scheme
22
```

– Cards

– Cards

– Cards

– Cards

– Cards