Cryptanalysis of the Matsumoto and Imai Public Key Scheme of Eurocrypt’88

Patarin, Jacques

doi:10.1007/3-540-44750-4_20

Cited by 261 publications

(224 citation statements)

References 1 publication

Supporting

Mentioning

218

Contrasting

Unclassified

Order By: Relevance

“…, , , , @ @ @ @ -C * was the first scheme of all, and it can be seen as the ancestor of all these schemes. It was designed in [12] and broken in [13]. -Schemes with a Hidden Monomial (such as some Dragon schemes) were studied in [15], where it is shown that most of them are insecure.…”

Section: State Of the Art (In May 1999) On Public-key Schemes With Mumentioning

confidence: 99%

See 1 more Smart Citation

Unbalanced Oil and Vinegar Signature Schemes

Kipnis

Patarin²,

Goubin³

1999

Lecture Notes in Computer Science

Self Cite

370

251

View full text Add to dashboard Cite

Abstract. In [16], J. Patarin designed a new scheme, called "Oil and Vinegar", for computing asymmetric signatures. It is very simple, can be computed very fast (both in secret and public key) and requires very little RAM in smartcard implementations. The idea consists in hiding quadratic equations in n unknowns called "oil" and v = n unknowns called "vinegar" over a finite field K, with linear secret functions. This original scheme was broken in [10] by A. Kipnis and A. Shamir. In this paper, we study some very simple variations of the original scheme where v > n (instead of v = n). These schemes are called "Unbalanced Oil and Vinegar" (UOV), since we have more "vinegar" unknowns than "oil" unknowns. We show that, when v n, the attack of [10] can be extended, but when v ≥ 2n for example, the security of the scheme is still an open problem. Moreover, when v n 2 2 , the security of the scheme is exactly equivalent (if we accept a very natural but not proved property) to the problem of solving a random set of n quadratic equations in n 2 2 unknowns (with no trapdoor). However, we show that (in characteristic 2) when v ≥ n 2 , finding a solution is generally easy. Then we will see that it is very easy to combine the Oil and Vinegar idea and the HFE schemes of [14]. The resulting scheme, called HFEV, looks at the present also very interesting both from a practical and theoretical point of view.

show abstract

Section: State Of the Art (In May 1999) On Public-key Schemes With Mumentioning

confidence: 99%

“…HFEV looks more efficient than the original HFE scheme. Finally, in section 13, we present what we know about the main schemes in this area of multivariate polynomials.…”

Section: Introductionmentioning

confidence: 99%

Unbalanced Oil and Vinegar Signature Schemes

Kipnis

Patarin²,

Goubin³

1999

Lecture Notes in Computer Science

Self Cite

370

251

View full text Add to dashboard Cite

show abstract

“…They try to recover a secret key by solving a system of algebraic equations. Algebraic attacks were first applied to Matsumoto-Imai Public Key Scheme in [19] by Jacques Patarin and a similar attack was also applied in [15]. Algebraic attacks were also applied to block ciphers in [6], where the complexity for attacking AES and Serpent was evaluated.…”

Section: Introductionmentioning

confidence: 99%

Comparison Between XL and Gröbner Basis Algorithms

Ars

Faugère

Imai

et al. 2004

Advances in Cryptology - ASIACRYPT 2004

View full text Add to dashboard Cite

Abstract. This paper compares the XL algorithm with known Gröbner basis algorithms. We show that to solve a system of algebraic equations via the XL algorithm is equivalent to calculate the reduced Gröbner basis of the ideal associated with the system. Moreover we show that the XL algorithm is also a Gröbner basis algorithm which can be represented as a redundant variant of a Gröbner basis algorithm F4. Then we compare these algorithms on semi-regular sequences, which correspond, in conjecture, to almost all polynomial systems in two cases: over the fields F2 and Fq with q n. We show that the size of the matrix constructed by XL is large compared to the ones of the F5 algorithm. Finally, we give an experimental study between XL and the Buchberger algorithm on the cryptosystem HFE and find that the Buchberger algorithm has a better behavior.

show abstract

“…Even though this scheme was broken by Patarin in [12] since 1995, Patarin proposed various countermeasures to increase the security. One variation is the Minus transformation, suggested by Shamir in [17], and is a classical solution to avoid Patarin's or Gröbner basis attack.…”

Section: Introductionmentioning

confidence: 99%

Key Recovery on Hidden Monomial Multivariate Schemes

Fouque¹,

Macario-Rat

Stern³

Advances in Cryptology – EUROCRYPT 2008

View full text Add to dashboard Cite

Abstract. The problem we study in this paper is the key recovery problem on the C * schemes and generalizations where the quadratic monomial of C * (the product of two linear monomials) is replaced by a product of three or more linear monomials. This problem has been further generalized to any multivariate polynomial hidden by two invertible linear maps and named the Isomorphism of Polynomials (IP ) problem by Patarin et al. Some cryptosystems have been built on this appearing hard problem such as a traitor tracing scheme proposed by Billet and Gilbert. Here we show that if the hidden multivariate monomial is a quadratic monomial, as in SFLASH, or a cubic (or higher) monomial as in the traitor tracing scheme, then it is possible to recover an equivalent secret key in polynomial time O(n d ) where n is the number of variables and d is the degree of the public polynomials.

show abstract

Cryptanalysis of the Matsumoto and Imai Public Key Scheme of Eurocrypt’88

Cited by 261 publications

References 1 publication

Unbalanced Oil and Vinegar Signature Schemes

Unbalanced Oil and Vinegar Signature Schemes

Comparison Between XL and Gröbner Basis Algorithms

Key Recovery on Hidden Monomial Multivariate Schemes

Contact Info

Product

Resources

About