HMFEv - An Efficient Multivariate Signature Scheme

Petzoldt, Albrecht; Chen, Ming-Syan; Ding, Jíntai; Yang, Bo‐Yin

doi:10.1007/978-3-319-59879-6_12

Cited by 16 publications

(10 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Then, similar to the multi-HFE, the number N cannot be large since the complexity of solving it is exponential for N . In [5] (see Table 1), Petzeldt et al selected the parameters of HM-FEv with N = 2, 3 as a signature scheme secure and efficient enough for practical use.…”

Section: Hmfevmentioning

confidence: 99%

“…Since the condition that the rank of A is at most R is equivalent that the determinants of arbitrary (R + 1) × (R + 1)minor matrices in A are zero, the min-rank attack requires to solve a system of polynomial equations of degree (at most) N + v + 1 and of m variables. Based on the result in [3], the authors in [5] claimed that the complexity of the min-rank attack is O m+N +v+1 N +v+1 w where 2 ≤ w < 3 is an exponent of the Gaussian elimination. This means that, if one takes v sufficiently large, HMFEv is secure enough against the min-rank attack.…”

Section: Min-rank Attackmentioning

confidence: 99%

“…Recently in PQCrypto 2017, a vinegar variant of multi-HFE, called HMFEv, was proposed by Petzoldt et al [5]. This vinegar variant succeeds to enhance the security against the known attacks [2][3][4] and then HM-FEv had been expected to be one of signature schemes, secure and efficient enough under suitable parameter selections [5] (see Table 1). However, the security against the high-rank attack had not been studied yet at all.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

High-rank attack on HMFEv

Hashimoto

2018

JSIAM Letters

View full text Add to dashboard Cite

HMFEv is a new multivariate signature scheme proposed at PQCrypto 2017. This is a vinegar variant of multi-HFE (Chen et al., 2008). While the original multi-HFE is known to be insecure against the direct attack (Huang et al., 2015), the min-rank attack (Bettale et al., 2013) and the attack using a diagonalization approach (Hashimoto, 2017), HMFEv is considered to be secure enough against these attacks. However, the security against the high-rank attack had not been studied at all. In the present paper, we study the structure of HMFEv and discuss its security against the high-rank attack.

show abstract

Section: Hmfevmentioning

confidence: 99%

Section: Min-rank Attackmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

High-rank attack on HMFEv

Hashimoto

2018

JSIAM Letters

View full text Add to dashboard Cite

show abstract

“…Still, no such attacks are reported in literature. One could say that the idea of decomposing a system to make it easier to solve is not very promising because in big-field schemes such as Gui [24] and medium-field schemes such as HMFEv [23] the systems are decomposed with the objective of making them harder to solve for an attacker.…”

Section: Security Analysis Of the New Schemementioning

confidence: 99%

Field Lifting for Smaller UOV Public Keys

Beullens

Preneel

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Most Multivariate Quadratic (MQ) signature schemes have a very large public key, which makes them unsuitable for many applications, despite attractive features such as speed and small signature sizes. In this paper we introduce a modification of the Unbalanced Oil and Vinegar (UOV) signature scheme that has public keys which are an order of magnitude smaller than other MQ signature schemes. The main idea is to choose UOV keys over the smallest field F2 in order to achieve small keys, but to lift the keys to a large extension field, where solving the MQ problem is harder. The resulting Lifted UOV signature scheme is very competitive with other post-quantum signature schemes in terms of key sizes, signature sizes and speed.

show abstract

“…This approach is regarded as one candidate for post-quantum cryptography, in particular as a signature scheme [CJL + 16]. We refer the reader to the thesis of Wolf [Wol05] for an overview, and the recent article [PCDY17] and references therein for recent advances in this area. IQF1S and related problems play an important role in such schemes.…”

Section: Introductionmentioning

confidence: 99%

Algorithms Based on *-Algebras, and Their Applications to Isomorphism of Polynomials with One Secret, Group Isomorphism, and Polynomial Identity Testing

Ivanyos¹,

Qiao²

2019

SIAM J. Comput.

View full text Add to dashboard Cite

We consider two basic algorithmic problems concerning tuples of (skew-)symmetric matrices. The first problem asks to decide, given two tuples of (skew-)symmetric matrices (B 1 , . . . , B m ) and (C 1 , . . . , C m ), whether there exists an invertible matrix A such that for every i ∈ {1, . . . , m}, A t B i A = C i . We show that this problem can be solved in randomized polynomial time over finite fields of odd size, the reals, and the complex numbers. The second problem asks to decide, given a tuple of square matrices (B 1 , . . . , B m ), whether there exist invertible matrices A and D, such that for every i ∈ {1, . . . , m}, AB i D is (skew-)symmetric. We show that this problem can be solved in deterministic polynomial time over fields of characteristic not 2. For both problems we exploit the structure of the underlying * -algebras (algebras with an involutive antiautomorphism), and utilize results and methods from the module isomorphism problem.Applications of our results range from multivariate cryptography, group isomorphism, to polynomial identity testing. Specifically, these results imply efficient algorithms for the following problems. (1) Test isomorphism of quadratic forms with one secret over a finite field of odd size. This problem belongs to a family of problems that serves as the security basis of certain authentication schemes proposed by Patarin (Eurocrypt 1996). (2) Test isomorphism of p-groups of class 2 and exponent p (p odd) with order p in time polynomial in the group order, when the commutator subgroup is of order p O( √ ) . (3) Deterministically reveal two families of singularity witnesses caused by the skew-symmetric structure. This represents a natural next step for the polynomial identity testing problem, in the direction set up by the recent resolution of the non-commutative rank problem (Garg-Gurvits-Oliveira-Wigderson, FOCS 2016; Ivanyos-Qiao-Subrahmanyam, ITCS 2017).

show abstract

HMFEv - An Efficient Multivariate Signature Scheme

Cited by 16 publications

References 14 publications

High-rank attack on HMFEv

High-rank attack on HMFEv

Field Lifting for Smaller UOV Public Keys

Algorithms Based on *-Algebras, and Their Applications to Isomorphism of Polynomials with One Secret, Group Isomorphism, and Polynomial Identity Testing

Contact Info

Product

Resources

About