Extended abstract In this work, we present a public key cryptosystem, called OTWO, based on octonions algebra and NTWO cryptosystem  We change the underlying algebraic structure of NTWO and use a different lattice for key generation and decryption that it increases complexity of decryption. Furthermore, the nonassociativity of underlying algebraic structure and existence of different lattice for key generation and decryption improve the security of cryptosystem markedly. Method: The octonion algebra can be consider over a field or any arbitrary commutative ring R [4]. In our work, we use the bivariate convolution polynomial ring R = Z[X]/(X N − 1) 

Kadijeh Bagheri

Mohammad-Reza Sadeghi

CiteSeerX

A New Non-Associative Cryptosystem Based on NTOW
Public Key Cryptosystem and Octonions Algebra
Kadijeh Bagheri, Mohammad-Reza Sadeghi
Amirkabir University of Technology (Iran)
msadeghi@aut.ac.ir
Extended abstract
In this work, we present a public key cryptosystem, called OTWO, based on octonions algebra
and NTWO cryptosystem [1] which is a multivariate version of NTRU [2]. Inherent security of this
system relies on the difficulty of the shortest vector problem (SVP) in a certain type of lattices
with a hybrid norm. Since the octonions are non-associative (power-associative) and alternative
algebra, they do not have a matrix isomorphic representation. So, normally lattice attacks [3]
against this cryptosystem are impossible. The only way to cryptanalysis and to find the private
key for decryption in this cryptosystem is to expand the equation of public key as a linear system
of equations and form a non-circular lattice. However, this type of attack seems to has no chance
to succeed.
We change the underlying algebraic structure of NTWO and use a different lattice for key
generation and decryption that it increases complexity of decryption. Furthermore, the non-
associativity of underlying algebraic structure and existence of different lattice for key generation
and decryption improve the security of cryptosystem markedly.
Method: The octonion algebra can be consider over a field or any arbitrary commutative
ring R [4]. In our work, we use the bivariate convolution polynomial ring R′ = Z[X]/(XN − 1) =
Z[x, y]/(xn−1, yn−1) which n is a fixed prime number. Hence, we define A, Ap and Aq as the three
octonion algebras over the rings R′, R′p = Zp[X]/(XN −1) and R′q = Zq[X]/(XN −1), respectively
with bilinear multiplication (denoted by the symbol ◦), as follows
A :=
{
f0(x, y) +
∑7
i=1 fi(x, y) · ei
∣∣ f0(x, y), . . . , f7(x, y) ∈ R′},
Ap :=
{
f0(x, y) +
∑7
i=1 fi(x, y) · ei
∣∣ f0(x, y), . . . , f7(x, y) ∈ R′p},
Aq :=
{
f0(x, y) +
∑7
i=1 fi(x, y) · ei
∣∣ f0(x, y), . . . , f7(x, y) ∈ R′q}.
where {1, e1, e2, e3, e4, e5, e6, e7} are the basis of the algebras and they have the following
rules
e2i = −1, i = 1, . . . , 7
ei · ej = −ej · ei i 6= j, i, j = 1, . . . , 7
ei · ej = ek → ei+1 · ej+1 = ek+1 i 6= j, i, j = 1, . . . , 7
ei · ej = ek → e2i · e2j = e2k i 6= j, i, j = 1, . . . , 7
and the indices greater than 7 should be reduced mod 7. For simplification we use the notation
fi , fi(x, y), for i = 0, 1, 2, 3.
We denote the conjugate and inverse of the octonion F by F ? = f0 −
∑7
i=1 fi · ei and F−1 =
(
∑7
i=1 fi
2)−1 · F ?, respectively.
In OTWO, the public parameters (n, p, q, d) play the same role as the alternative parameters
do in NTWO, i.e., n is an integer number such that n|(q − 1), p and q are two different prime
numbers such that gcd(p, q) = gcd(n, q) = 1 and q  p. The subsets Lf , Lg, Lφ and Lm of R′
contain small polynomials which are polynomials with coefficients with small Euclidian norm and
small Hamming norm (defined as the number of nonzero coefficient of a polynomial).
Let Jq = Qq +
∑7
i=1Qq · ei, where Qq = 〈σ =
∑
(a,b)∈T λ(a,b)〉 is an ideal generated by σ and
λ(a,b)’s are Lagrange interpolators as follows
λ(a,b) =
ab(xn − 1)(yn − 1)
n2(x− a)(y − b)
.
T is a small subset of L, the set of pairs of n-th roots of unity. We define Qq similar to NTWO.
Clearly, Jq is an ideal of Aq = R′q +
∑7
i=1R
′
q · ei and it contains the ideal 〈xn − 1, yn − 1〉 of A.
It can be shown that J = 〈Jq, q〉 is an ideal of A = R′ +
∑7
i=1R
′ · ei. Indeed, once can prove
J = Q +
∑7
i=1Q · ei where Q = 〈σ, q〉. We call J private ideal and use it for key generation and
decryption.
0.1 Key generation
For creating public and private keys, we randomly choose two quaternion polynomials F and G in
A with small coefficients
F = f0 +
∑7
i=1 fi · ei, f0, . . . , f7 ∈ Lf
G = g0 +
∑7
i=1 gi · ei, g0, . . . , g7 ∈ Lg
where F and G both are invertible over A/J and also F must be invertible over Ap (i.e., the
polynomials
∑7
i=1 fi
2 and
∑7
i=1 gi
2 should be nonzero and invertible over its underlying ring R′/Q
and R′p (A/J is a octonion algebra over the ring R′/Q).
The inverses of the quaternion F over A/J and Ap are denoted by F−1J and F−1p respectively. If
one of the above inverses does not exist, we generate a new quaternion F such that
∑7
i=1 fi
2 6= 0.
To generate the public key, compute H̃ = F−1J ◦ G (mod J). Thus we have H̃ = F
−1
J ◦ G +
ϑ (mod q) where ϑ ∈ Jq and it is unknown to attacker. Then
H̃ = F−1J ◦G+ ϑ (mod q)
is published as the public key which satisfies F ◦ H̃ + ξ ≡ G (mod q), where ξ ∈ Jq. Subsequently,
the private key consists (G,F, ξ).
With the same public parameters (n, p, q, d), the key generation in OTWO is 64 times slower
than that of NTWO because public key is multiplied by 64 convolutional products. This means we
can choose a smaller dimension n in OTWO without reducing its security.
0.2 Encryption
To encrypt a binary message m, it is mapped to an octonion M = m0 +
∑7
i=1mi · ei ∈ A
where mi ∈ Lm for i = 0, . . . , 7 are eight small polynomials. Then a random octonion Φ =
φ0 +
∑7
i=1 φi · ei is generated such that φi ∈ Lφ for i = 0, . . . , 7. Now, the encrypted message is
as follows
C = p.H̃ ◦ Φ +M ∈ A/J.
In this cryptosystem, eight messages set up once as one octonion and they are encrypted simulta-
neously. So, in the same dimension, the encryption process in OTWO is eight times slower than
NTWO.
0.3 Decryption
According to the non-associativity of octonions algebra for removing the term F−1J from (F
−1
J ◦
G)) ◦ Φ, the receiver multiply C by the private key F on the left and then on the right. Since
octonions algebra are alternative, using Moufang identities we have:
E = ((F ◦ C) ◦ F = p.(F ◦ (H̃ ◦ Φ) ◦ F ) + (F ◦M) ◦ F ∈ A/J
= p.(F ◦ H̃) ◦ (Φ ◦ F ) + (F ◦M) ◦ F ∈ A/J
= p.(F ◦ (F−1J ◦G)) ◦ (Φ ◦ F ) + (F ◦M) ◦ F ∈ A/J
= p.G ◦ (Φ ◦ F ) + (F ◦M) ◦ F ∈ A/J.
In this way, the octonion F−1J with very large norm is removed and the polynomials with small
norm remain in E. On the other hand, E is equivalent to
E′ = p.G ◦ (Φ ◦ F ) + (F ◦M) ◦ F +B ∈ Aq,
where B ∈ J is unknown to the receiver. In order to perform a feasible decryption the receiver
must have p.G ◦ (Φ ◦ F ) + (F ◦M) ◦ F ∈ Aq. For this purpose, the octonion B is found and is
subtracted from E′.
When we consider and fixe a basis for A (for example monomial basis) then A is isomorphic to
Zn2+
∑7
i=1 Zn
2 · ei ∼= Z8n
2
as an additive group. Thus, we have J ⊂ A ∼= Z8n
2
and J will be a lattice
in A. Indeed, B is the closest vector of this lattice to E with a high probability. Upon finding the
closest vector in private lattice J and subtracting it from E′, the octonion p.G◦(Φ◦F )+(F ◦M)◦F ∈
Aq would be available to the receiver and decryption process can be continued easily.
If the public parameters in the cryptosystem are chosen suitably, the coefficients of eight polyno-
mials in p.G◦(Φ◦F )+(F ◦M)◦F will lie in the interval [− q−12 ,
q−1
2 ] and the decryption will not fail
so the reduction modulo q will superfluous. Then, the receiver can reduce p.G◦(Φ◦F )+(F ◦M)◦F
modulo p and obtain the term (F ◦M) ◦ F ∈ Ap. Finally, message recovery (F ◦M) ◦ F ∈ Ap is
multiplied on the right and then on the left by F−1p .
Furthermore, it can be estimated that the decryption process of OTWO is 16 times slower than
NTWO, whereas its encryption process is almost 8 times slower. So, decryption speed is at least
half of the encryption speed that is one of advantages of OTWO. Moreover, we can compensate the
speed decrease of OTWO by considering a lower dimension n. In addition, if one can undertake
more cost for parallelization, OTWO can be implemented in higher speed than NTWO and achieve
a higher security.
0.4 The OTWO Lattice
We said only way for cryptanalysis and finding the private key (G,F, ξ) for decryption is to expand
the octonion equation F ◦ H̃ + ξ ≡ G (mod q) for a given octonion H̃ as the following
(f0 ∗ h0 − f1 ∗ h1 − f2 ∗ h2 − f3 ∗ h3 − f4 ∗ h4 − f5 ∗ h5 − f6 ∗ h6 − f7 ∗ h7) + ξ0 = g0 + qu0
(f0 ∗ h1 + f1 ∗ h0 + f2 ∗ h4 + f3 ∗ h7 − f4 ∗ h2 + f5 ∗ h6 − f6 ∗ h5 − f7 ∗ h3) + ξ1 = g1 + qu1
(f0 ∗ h2 − f1 ∗ h4 + f2 ∗ h0 + f3 ∗ h5 + f4 ∗ h1 − f5 ∗ h3 + f6 ∗ h7 − f7 ∗ h6) + ξ2 = g2 + qu2
(f0 ∗ h3 − f1 ∗ h7 − f2 ∗ h5 + f3 ∗ h0 + f4 ∗ h6 + f5 ∗ h2 − f6 ∗ h4 + f7 ∗ h1) + ξ3 = g3 + qu3
(f0 ∗ h4 + f1 ∗ h2 − f2 ∗ h1 − f3 ∗ h6 + f4 ∗ h0 + f5 ∗ h7 + f6 ∗ h3 − f7 ∗ h5) + ξ4 = g4 + qu4
(f0 ∗ h5 − f1 ∗ h6 + f2 ∗ h3 − f3 ∗ h2 − f4 ∗ h7 + f5 ∗ h0 + f6 ∗ h1 + f7 ∗ h4) + ξ5 = g5 + qu5
(f0 ∗ h6 + f1 ∗ h5 − f2 ∗ h7 + f3 ∗ h4 − f4 ∗ h3 − f5 ∗ h1 + f6 ∗ h0 + f7 ∗ h2) + ξ6 = g6 + qu6
(f0 ∗ h7 + f1 ∗ h3 + f2 ∗ h6 − f3 ∗ h1 + f4 ∗ h5 − f5 ∗ h4 − f6 ∗ h2 + f7 ∗ h0) + ξ7 = g7 + qu7,
where ∗ is the convolution product.
Let us denote the ordered monomials of the form xiyj, 0 ≤ i, j ≤ n, by Xα for 0 ≤ α ≤ n2.
Then for two polynomials k and h in R′ we have
k ∗ h = (k0, · · · kn2−1)H = (k0, · · · kn2−1)

h
X ◦ h
...
XN2 ◦ h
 . (1)
Note that the matrix H is no longer a circulant matrix. Indeed, each row of H is a permutation of
first row and these permutations are related to the monomial order that we have used. Upon the
above notations, we can set up the lattice, denoted by ΛOTWO, that is generated by the rows of the
matrix  qI8n2 0 0H I8n2 0
D 0 I8n2
 ,
where
H =

+H0 +H1 +H2 +H3 +H4 +H5 +H6 +H7
−H1 +H0 −H4 −H7 +H2 −H6 +H5 +H3
−H2 +H4 +H0 −H5 −H1 +H3 −H7 +H6
−H3 +H7 +H5 +H0 −H6 −H2 +H4 −H1
−H4 −H2 +H1 +H6 +H0 −H7 −H3 +H5
−H5 +H6 −H3 +H2 +H7 +H0 −H1 −H4
−H6 −H5 +H7 −H4 +H3 +H1 +H0 −H2
−H7 −H3 −H6 +H1 −H5 +H4 +H2 +H0

,D =

D 0 · · · 0
0 D · · · 0
...
...
. . .
...
0 0 · · · D
 .
Eeach Dn2×n2 consist of all Lagrange interpolators λ(a,b), where (a, b) ∈ L and each Hi for
i = 0, . . . , 7 has the form of matrix H in Equation (1). Clearly, the vector (G,F, ξ) belongs to
ΛOTWO. Moreover, if we consider a hybrid metric on A3 which is Euclidean on the first two
components and Hamming on the third component, the private key (G,F, ξ) will be the smallest
vector in the lattice with high probability. Thus, the security of this cryptosystem relies on the
difficulty of the shortest vector problem in the hybrid lattice of dimension 24n2. To the best of our
knowledge, lattice basis reduction algorithms such as LLL [5] and BKZ [6] or BKZ 2.0 [7] have not
been developed to solve SVP with this hybrid metric. Consequently, this cryptosystem is capable of
having a high security.
One can estimate that for any selection of public parameters (n, p, q, d), OTWO has a security
equal to that of NTWO with (8n, p, q, d). But NTWO with dimension 8n is 64 times slower than
NTWO with dimension n while QTWO acts approximately four times slower, compared to NTWO.
As a result, OTWO with dimension n has a security equal to NTWO with dimension 8n but OTWO
with dimension n is 8 times faster than NTWO with dimension 8n. Consequently, the main
advantage of applying non-associative algebra in OTWO is that it can present a higher security
than NTWO with smaller dimensions.
References
[1] M. Caboara, F. Caruso and C. Traverso, “Grobner Bases for Public Key Cryptography”, Symbolic and
algebraic computation Proc. ISSAC ’08, ACM, pp. 315-323, 2008.
[2] J. Hoffstein, J. Pipher and J.H. Silverman, “NTRU, a ring-based public-key cryptosystem”, Algorithmic
number theory, Portland, OR, Springer, vol. 1423, pp. 267288, 1996.
[3] D. Coppersmith and A. Shamir, “Lattice attacks on NTRU”, In Lecture Notes in Computer Science,
Berlin / Heidelberg, Springer, vol. 1233, pp. 52-61, 1997.
[4] J. H. Conway and D. A. Smith and A K Peters “On Quaternions and Octonions: their geometry,
arithmetic, and symmetry, A K”, 2003.
[5] A. K. Lenstra, H. W. Lenstra, Jr., and L. Lovasz, “Factoring Polynomials with Rational Coefficients”,
Mathematische Annalen, vol. 261, pp. 513534, 1982.
[6] C. P. Schnorr and M. Euchner, “Lattice basis reduction: improved practical algorithms and solving
subset sum problems”, Math. Programming, pp.181199, 1993.
[7] Y. Chen and P.Q. Nguyen “BKZ 2.0: better lattice security estimates”, In Advances in Cryptology
ASIACRYPT 2011, Lecture Notes in Computer Science, Springer, Heidelberg, vol. 7073, pp. 120, 2011.


A new non-associative cryptosystem based on NTOW public key cryptosystem and octonions algebra

http://citeseerx.ist.psu.edu/viewdoc/download;jsessionid=A1EEC724E20F46FF395C8649AB51BA81?doi=10.1.1.1074.446&rep=rep1&type=pdf

A new non-associative cryptosystem based on NTOW public key cryptosystem and octonions algebra

Abstract

Similar works

Full text

Available Versions

CiteSeerX