New Differential-Algebraic Attacks and Reparametrization of Rainbow

Abstract

Abstract. A recently proposed class of multivariate Public-Key Cryptosystems, the Rainbow-Like Digital Signature Schemes, in which successive sets of central variables are obtained from previous ones by solving linear equations, seem to lead to e cient schemes (TTS, TRMS, and Rainbow) that perform well on systems of low computational resources. Recently SFLASH (C * − ) was broken by Dubois, Fouque, Shamir, and Stern via a di erential attack. In this paper, we exhibit similar algebraic and di ential attacks, that will reduce published Rainbow-like schemes below their security levels. We will also discuss how parameters for Rainbow and TTS schemes should be chosen for practical applications. Keywords: rank, di erential attack, algebraic attack, oil-and-vinegar Note: This is an update to the paper to appear at ACNS 2008, New York 1 Outline Multivariate Public-Key Cryptosystems (MPKCs, or trapdoor MQ schemes) are cryptosystems for which the public key is a set of polynomials P = (p 1 , . . . , p m ) in variables x = (x 1 , . . . , x n ) where all variables and coe cients are in K = GF(q). In practice this is always accomplished viaIn any given scheme, the central map Q belongs to a certain class of quadratic maps whose inverse can be computed relatively easily. The maps S, T are a ne. The polynomials giving y i in x are called the central polynomials, and the x j are called the central variables.In 1999, the Unbalanced Oil-and-Vinegar multivariate structure is proposed by Patarin et al [16]. Lately the Rainbow class of signatures [7,20,25], based on repeated applications of the Unbalanced Oil-and-Vinegar principle, shows some promise on systems of low computational resources.Given that the well-known C * − class of signature schemes including SFLASH was broken by di erential attacks [8], we examine similar attacks on Rainbow, with the following conclusions:Di erentials improve on the High-Rank attacks on Rainbow-like systems.

SSE Implementation of Multivariate PKCs on Modern x86 CPUs

“…To execute a private map, we replace the "minus" components if needed, invert T , invert Q, invert S, and if needed verify a prefix/perturbation. Most small-field MPKCs -TTS, Rainbow, oil-and-vinegar [11,12,17,29] seem to behave the same over small odd prime fields and over F 2 k . Big-field MPKCs in odd-characteristic were mentioned in [35], but not much researched until recently.…”

“…In 2004, traditional signature schemes using RSA or ECC are much slower than TTS/4 and SFLASH [1,10,37], but the latter have both been broken [17,18]. Although TTS/7 and 3IC-p seem ok today [8], the impending doom of SHA-1 [33] will force longer message digests and thus slower MPKCs while leaving RSA untouched.…”

“…-The segment structure is given by a sequence 0 < v 1 [8,17]. According to their criteria, the former instance should not be more secure than Rainbow/TTS at (F 31 , 24, 20, 20) and roughly the same as (F 31 , 16,16,8,16).…”

Selecting Parameters for the Rainbow Signature Scheme

“…To cover these, we have to adapt the upper formula slightly. So, a cryptosystem, which shall be secure in the year y, must reach the security level To translate this security bound into the corresponding number of field multiplications, we use a data-point computed by J. Ding et al in [DY08]. There the authors solve a system of 37 quadratic equations in 22 variables over GF (2 8 ) in about 1.06 · 10 6 seconds on a single 2.2 GHz Opteron machine by XL-Wiedemann.…”

“…A good overview of these attacks can be found in [GC00]. Special attacks on Rainbow-like schemes were proposed by Ding and Yang in [DY08]. There have also been some attempts to derive appropriate parameters from the complexities of these attacks [CC08].…”