Untitled

Abstract

Motivated by questions in cryptography, we look for diophantine equations that are hard to solve but for which determining the number of solutions is easy. Commitment schemesSolving a diophantine equation is typically hard but, given a point, it is typically easy to find a variety containing that point. This is an example of a "one-way function" with potential applications to cryptography. Our current (lack of) knowledge suggests that such a function is possibly quantum resistant and, therefore, cryptosystems based on these could be used for postquantum cryptography [BL17].An encryption system based on this principle was proposed by Akiyama and Goto [AG06; AG08], then broken by Ivanov and the author [IV09]. It was then fixed, broken again, fixed again. . . Current status unclear.The purpose of a commitment scheme is for a user to commit to a message without revealing it (e.g., vote, auction bid) by making public a value obtained from the message in such a way that one can check, after the message is revealed, that the public value confirms the message.Using such diophantine one-way functions for commitment schemes was proposed by Boneh and Corrigan-Gibbs [BCG14]. They also suggested working modulo an RSA modulus N . This could conceivably weaken the system. It will definitely no longer be quantum resistant. Some partial attacks on this particular system are presented in [ZW17].Here is the general format of a diophantine commitment scheme. Encode a message as point P over some field F. Make public a variety V /F with P ∈ V , with V taken from some fixed family of varieties. To check the commitment, one verifies that P satisfies the equations of V . We need the following conditions to be satisfied for this to work:• Given P, it is easy to construct V .• Given V , it is hard to find V (F) (hence P).