Building Secure Tame-like Multivariate Public-Key Cryptosystems: The New TTS

Abstract

Abstract. Multivariate public-key cryptosystems (sometimes polynomial-based PKC's or just multivariates) handle polynomials of many variables over relatively small fields instead of elements of a large ring or group. The "tame-like" or "sparse" class of multivariates are distinguished by the relatively few terms that they have per central equation. We explain how they differ from the "big-field" type of multivariates, represented by derivatives of C * and HFE, how they are better, and give basic security criteria for them. The last is shown to be satisfied by efficient schemes called "Enhanced TTS" which is built on a combination of the Oil-and-Vinegar and Triangular ideas. Their security levels are estimated. In this process we summarize and in some cases, improve rank-based attacks, which seek linear combinations of certain matrices at given ranks. These attacks are responsible for breaking many prior multivariate designs.

New Differential-Algebraic Attacks and Reparametrization of Rainbow

“…We can see a good example of what can go wrong in [15] if we try to construct an encryption scheme, where the initial vinegar variables is determined through an initial block of equations. Example 1. enTTS (20,28) of [25] has structure (8, 9, 1, 1, 9) and this central map: 27 . Note: x 0 does not appear until the last block, which will be signi cant later.…”

“…TTS schemes have a relatively small private key and even better e ciency, but may be exposed to additional risks. Regardless, the same techniques that we shall describe below are security concerns for all schemes of the rainbow type including TTS, TRMS, and Rainbow [7,20,25].…”

“…Dual Rank (or High Rank) attack [5,14], which nds a variable appearing the fewest number of times in a central equation cross-term. If this least number is s, [25] gives…”

“…Oil-and-Vinegar Separation [16,17,22], which nds an Oil subspace that is su ciently large (estimates as corrected in [25]). …”

“…Lately the Rainbow class of signatures [7,20,25], based on repeated applications of the Unbalanced Oil-and-Vinegar principle, shows some promise on systems of low computational resources.…”