Solving Systems of Quadratic Equations I) General HFE Systems II) The Affine Multiple Attack Magnus Daum / Patrick Felke

Overview of Part I Review of HFE Systems: parameters, hidden polynomial Solving by Using Buchberger Algorithm special properties of HFE systems simulations: 3) Number of solutions of HFE-Systems HFE polynomials  general polynomials systems of arbitrary quadratic equations HFE systems  10.11.2018 Solving Systems of Quadratic Equations, Part I

Review of HFE Systems

Review: Parameters of an HFE System public parameters n – number of polynomials and variables blocklength field extension degree q – cardinality of the smaller finite field (fields: Fq and Fq n) d – degree of the hidden polynomial 10.11.2018 Solving Systems of Quadratic Equations, Part I

Solving Systems of Quadratic Equations, Part I Review: Example + secret affine transformations public key 10.11.2018 Solving Systems of Quadratic Equations, Part I

Review: Example - Decryption Ciphertext: 0 0 1 1 10.11.2018 Solving Systems of Quadratic Equations, Part I

Review: Example - Decryption Plaintext: ? ? ? ? ? Ciphertext: 0 0 1 1 without secret key: solve system directly OR find transformation to univariate polynomial of low degree with secret key: transform back to univariate polyno- mial of low degree 10.11.2018 Solving Systems of Quadratic Equations, Part I

Review: Hidden Polynomial transformation from univariate HFE-polynomial f to HFE-System is always possible (construction of the public key) transformation from system of quadratic equations to an univariate polynomial representing this system is always possible but: expected degree d= q2(n-1) finding zeros is not feasible 10.11.2018 Solving Systems of Quadratic Equations, Part I

Review: Example - Decryption Plaintext: ? ? ? ? ? Ciphertext: 0 0 1 1 without secret key: try to solve system directly OR try to find transformation to univariate polynomial of low degree with secret key: transform back to univariate polyno- mial of low degree Idee: nochmal Rückblick als Überleitung 10.11.2018 Solving Systems of Quadratic Equations, Part I

Solving HFE Systems Using Buchberger Algorithm Oder: „(by) Applying Buchberger Algorithm“??

General Approach : Example +1 10.11.2018 Solving Systems of Quadratic Equations, Part I

General Approach : Example Buchberger algorithm 10.11.2018 Solving Systems of Quadratic Equations, Part I

General Approach : Example 10.11.2018 Solving Systems of Quadratic Equations, Part I

General Approach: Problems in general only feasible for up to 10 variables degree of output poly-nomials may get very big Buchberger algorithm has exponential worst case complexity compute all solutions in algebraic closure … Praktische Komplexität!!!!!!!! 10.11.2018 Solving Systems of Quadratic Equations, Part I

HFE Systems are Special defined over a very small finite field include only quadratic polynomials need only solutions in the base field Fq hidden polynomial of low degree 10.11.2018 Solving Systems of Quadratic Equations, Part I

HFE Systems are Special defined over a very small finite field include only quadratic polynomials need only solutions in the base field Fq hidden polynomial of low degree 10.11.2018 Solving Systems of Quadratic Equations, Part I

Solutions in the Base Field solutions we are looking for fulfil Proposition: 10.11.2018 Solving Systems of Quadratic Equations, Part I

Solutions in the Base Field: Example Buchberger algorithm 10.11.2018 Solving Systems of Quadratic Equations, Part I

Solutions in the Base Field: Example 10.11.2018 Solving Systems of Quadratic Equations, Part I

Solutions in the Base Field: Example Buchberger algorithm Advantages: we compute only informa-tion we need degree of polynomials involved in this compu-tation is bounded 10.11.2018 Solving Systems of Quadratic Equations, Part I

HFE Systems are Special defined over a very small finite field include only quadratic polynomials need only solutions in the base field Fq hidden polynomial of low degree 10.11.2018 Solving Systems of Quadratic Equations, Part I

HFE Systems are Special defined over a very small finite field include only quadratic polynomials need only solutions in the base field Fq hidden polynomial of low degree 10.11.2018 Solving Systems of Quadratic Equations, Part I

Solving Systems of Quadratic Equations, Part I Hidden Polynomial Patarin / Courtois: if hidden polynomial is of low degree or special form there are many relations between the polynomials in the HFE system one main idea of Buchberger algorithm is to make use of such relations in a sophisticated way Vergleich relations mit gaussian elimination, easy to combine to eliminate variables Also: kleine d vielleicht schneller lösbar mit Buchberger algorithm 10.11.2018 Solving Systems of Quadratic Equations, Part I

HFE Systems are Special defined over a very small finite field include only quadratic polynomials need only solutions in the base field Fq hidden polynomial 10.11.2018 Solving Systems of Quadratic Equations, Part I

Solving Systems of Quadratic Equations, Part I Simulations 96000 simulations parameters: HFE systems and random quadratic systems in each simulation: generate system of quadratic equations (HFE or random) add polynomials solve by using Buchberger algorithm (with FGLM) 10.11.2018 Solving Systems of Quadratic Equations, Part I

Simulations: Dependency on n random 10.11.2018 Solving Systems of Quadratic Equations, Part I

Simulations: Dependency on n q=3 d=12 q=2 d=20 q=3 d=30 q=3 d=90 q=2 d=128 20,00 19,00 18,00 17,00 16,00 15,00 14,00 13,00 12,00 11,00 10,00 9,00 8,00 7,00 6,00 5,00 4,00 log(time) n Noch asymptotische Laufzeiten exponential time complexity not feasible for n greater than about 30-40 10.11.2018 Solving Systems of Quadratic Equations, Part I

Simulations: Dependency on d time  An Tafel erklären wenn Zeit time depends on rather than on d 10.11.2018 Solving Systems of Quadratic Equations, Part I

Simulations: Dependency on logqd random thresholds exist, so that for greater d the time needed to solve the HFE system is not significantly faster then for a random quadratic system Zufällig ersetzen durch random und „ungefähr gleich n“ if d is not too small (approx. ) HFE systems behave like systems of random quadratic equations (at least concerning Buchberger algorithm) 10.11.2018 Solving Systems of Quadratic Equations, Part I

Conclusion of this Section Buchberger algorithm is not feasible for solving HFE systems of usual parameters (small q, , ) but: if d is very small, computation is much faster HFE systems with usual parameters seem to be very similar to systems of random quadratic equations 10.11.2018 Solving Systems of Quadratic Equations, Part I

Number of Solutions of HFE Systems Noch rein, eine oder zwei Folien mit ergebnissen aus simulationen, wichtig: HFE-Systeme entsprechen schon für relativ kleinen Grad einem allgemeinen quadratischen System Mass für Injektivität/Surjektivität

Distribution of Numbers of Solutions 0,0033 0,0160 0,0604 0,1832 0,3705 0,3665 share 250 1210 4565 13852 28012 27710 number of systems with k solutions >4 4 3 2 1 k very similar to Poisson distribution: 0,0153 0,0613 0,1839 0,3679 (k!e)-1 4 3 2 1 k 10.11.2018 Solving Systems of Quadratic Equations, Part I

Hints Supporting this Assumption system’s number of solutions hidden polynomial’s number of zeros = numbers of zeros of general polynomials are distributed according to the Poisson distribution arithmetic mean and variance of the distribution of the numbers of zeros of HFE polynomials of bounded degree is very similar to that of a Poisson distribution 10.11.2018 Solving Systems of Quadratic Equations, Part I

Solving Systems of Quadratic Equations, Part I Applications to HFE gives another hint that we may consider HFE systems as systems of arbitrary quadratic equations allows to estimate the probabilities that encryption or signing will fail and to compute the amount of redundancy needed 10.11.2018 Solving Systems of Quadratic Equations, Part I

Solving Systems of Quadratic Equations I) General HFE Systems II) The Affine Multiple Attack

Solving Systems of Quadratic Equations I) General HFE Systems II) The Affine Multiple Attack