Quadratic compact knapsack public-key cryptosystem

Abstract

a b s t r a c tKnapsack-type cryptosystems were among the first public-key cryptographic schemes to be invented. Their NP-completeness nature and the high speed in encryption/decryption made them very attractive. However, these cryptosystems were shown to be vulnerable to the low-density subset-sum attacks or some key-recovery attacks. In this paper, additive knapsack-type public-key cryptography is reconsidered. We propose a knapsack-type public-key cryptosystem by introducing an easy quadratic compact knapsack problem. The system uses the Chinese remainder theorem to disguise the easy knapsack sequence. The encryption function of the system is nonlinear about the message vector. Under the relinearization attack model, the system enjoys a high density. We show that the knapsack cryptosystem is secure against the low-density subset-sum attacks by observing that the underlying compact knapsack problem has exponentially many solutions. It is shown that the proposed cryptosystem is also secure against some brute-force attacks and some known key-recovery attacks including the simultaneous Diophantine approximation attack and the orthogonal lattice attack.

Cryptanalysis of a quadratic knapsack cryptosystem

“…In this section, we briefly review the features of the quadratic compact knapsack public key system that are relevant to our attack. Further details about the encryption and decryption operations as well as the key setup can be found in [6].…”

“…Furthermore, this class of attacks is very unlikely to succeed in finding the original message M because many other vectors in the corresponding attack lattice are shorter than M [6].…”

“…The suggested security parameter for this system (n = 100) corresponds to a public-key size of about 6157 bits, and knapsack density of about 1.27 which is sufficiently high to prevent low density attacks. Furthermore, according to the analysis presented in [6], because of the non injectivity property of the system, the low-density subset-sum attack can find the valid plaintext only with probability ≈ 1 2 151 .…”

“…However, for the quadratic knapsack system under consideration, utilizing the knowledge of M to directly attack a smaller instance of the knapsack in the form of Eq. (1) using the traditional lattice reduction based attack (where the unknown vector would be of length n−l instead of n) does not allow us to recover the remaining unknown coordinates of M since, as explained in [6], the unknown vector is very likely to be larger than the basis of the reduced lattice. Our proposed attack proceeds in the following steps:…”

“…In [6], B. Wang and Y. Hu proposed a knapsack-type public-key cryptosystem by introducing an easy quadratic compact knapsack problem and then using the Chinese remainder theorem to disguise the easy knapsack instant into a seemingly hard one. The authors showed that their cryptosystem achieves a high knapsack density [3] under the re-linearization attack model.…”