Multivariate Signature Scheme using Quadratic Forms Takanori Yasuda (ISIT) Joint work with Tsuyoshi Takagi (Kyushu Univ.), Kouichi Sakurai (Kyushu Univ.) 1 This work was partially supported by the Japan Science and Technology Agency (JST) Strategic Japanese-Indian Cooperative Programme for Multidisciplinary Research Fields, which aims to combine Information and Communications Technology with Other Fields. The first author is supported by Grant-in-Aid for Young Scientists (B), Grant number

Contents 1.Multivariate Signature Schemes 2.Quadratic Forms 3.Multivariate System defined by Quadratic Forms 4.Application to Signature Scheme 5.Comparison with Rainbow 1.Efficiency of Signature Generation 2.Key Sizes 3.Security 6.Conclusion 2

MPKC Signature Signature Message For any message M, there must exist the corresponding signature. F is surjective. 3

New Multivariate Polynomial Map We introduce a multivariate polynomial map not surjective, and apply it to signature scheme. For a symmetric matrix A, 4

Questions Is G applicable to signature scheme or not? Questions 5

Quadratic Forms 6

7

How to compute the inverse map Simple case Problem 1 is equivalent to 8

Real field Case Gram-Schmidt orthonormalization provides an efficient algorithm to solve Problem 1’. Definition: We want to apply Gram-Schmidt orthonormalization technique to the case of finite fields. 9

Finite Field Case However, we can extend Gram-Schmidt orthonormalization by inserting a step: We cannot apply Gram-Schmidt orthonormalization directly. Solve Problem 1 10

2-dimensional case (1) 11

2-dimensional case (2) 12 ⇒ apply the usual GS-normalization.

2-dimensional case (3) 13

Problem 2 14

Classification Theorem 15

Application to MPKC Signature Scheme 16

Signature Generation 17

Property of Our Scheme For any M, there exists the corresponding signature. M 18

Other Signature Schemes Multivariate Polynomial Maps Rainbow UOV HFE MI Proposal Surjective Not Surjective 19

Security of Our Scheme There are several attacks of MPKC signature schemes which depend on the structure of central map. For example, UOV attack is an attack which transforms public key into a form of central map of UOV scheme. o Central maps of UOV are surjective. o The public key of our scheme cannot be transformed into any surjective map. These attacks is not applicable against our scheme. （ Other examples: Rainbow-band-separation attack, UOV-Reconciliation attack ） However, attacks which is independent of scheme, like direct attacks, are applicable to our scheme. 20

Comparison with Rainbow 21

Conclusion We propose a new MPKC signature scheme using quadratic forms. The multivariate polynomial map used in the scheme is not surjective. Signature generation uses an extended Gram-Schmidt orthonormalization. It is 8 or 9 times more efficient than that of Rainbow at the level of 88-bit security. Future Work Security analysis Application to encryption scheme 22