Circulant UOV and Circulant Rainbow are new variants of UOV (unbalanced oil and vinegar signature scheme) and Rainbow respectively. In this short report, we study the security of these new variants Circulant UOV and Circulant Rainbow

Yasufumi Hashimoto

Cryptology ePrint Archive

On the security of Circulant UOV/RainbowYasufumi Hashimoto ∗AbstractCirculant UOV and Circulant Rainbow are new variants of UOV (unbalanced oil and vinegarsignature scheme) and Rainbow respectively. In this short report, we study the security of thesenew variants Circulant UOV and Circulant Rainbow.Keywords. UOV, Rainbow, Circulant UOV, Circulant Rainbow, multivariate public-key cryp-tosystem (MPKC)1 IntroductionThe unbalanced oil and vinegar signature scheme (UOV) [7, 3] and Rainbow [2] are multivariatesignature schemes, considered to secure and efficient enough under suitable parameter selections.In fact, several variants of these two schemes are submitted to NIST’s post-quantum cryptographystandardization project [6]. Recently in [9, 8], new variants of UOV and Rainbow were proposed.They are called Circulant UOV and Circulant Rainbow respectively, since circulant matrices appearin the process of signature generation. It is known that inverting circulant matrices are faster thandoing random matrices, and then the signature generation of these circulant variants are fasterthan the original schemes. However, such “circulant” structures weaken the security critically. Inthis short report, we study the security of Circulant UOV/Rainbow and conclude that these twocirculant variants are not secure against Kipnis-Shamir’s attack [4, 3].2 UOVWe first describe the unbalanced oil and vinegar signature scheme (UOV) [7, 3] and Kipnis-Shamir’sattack on UOV [4, 3].Let o, v ≥ 1 be integers with v ≥ o, n := o + v and q a power of prime. Denote by Fq a finitefield of order q and define a quadratic map G : Fnq → Foq, x = t(x1, . . . , xn) 7→ t(g1(x), . . . , go(x)) bygl(x1, . . . , xn) =∑1≤i≤oxi · (linear form of xo+1, . . . , xn)+ (quadratic form of xo+1, . . . , xn),for 1 ≤ l ≤ o, where the coefficients in the right hand side are elements of Fq. The unbalanced oiland vinegar signature scheme (UOV) is constructed as follows.Secret key. An invertible affine map S : Fnq → Fnq and the quadratic map G.Public key. The quadratic map F := G ◦ S : Fnq → Foq.∗Department of Mathematical Science, University of the Ryukyus, e-mail: hashimoto@math.u-ryukyu.ac.jp12 Y. HashimotoSignature generation. Let m = (m1, . . . , mo) ∈ Foq be a message to be signed. Chooseu1, . . . , uv ∈ Fq randomly, and find (y1, . . . , yo) ∈ Foq withg1(y1, . . . , yo, u1, . . . , uv) = m1,...go(y1, . . . , yo, u1, . . . , uv) = mo.(1)The signature for m is z := S−1(y1, . . . , yo, u1, . . . , uv).Signature verification. Check whether F (z) = m.Note that, due to the definition of G, the equations in (1) are linear equations of (y1, . . . , yo).Then a signature is generated in time O(n3) on UOV. For the security of UOV, we should discussKipnis-Shamir’s attack [4, 3] given below.Kipnis-Shamir’s attack. It is well-known that UOV with o = v (balanced oil and vinegarsignature scheme, [7]) is broken by Kipnis-Shamir’s attack [4]. The basic idea is as follows.Let Gl, Fl (1 ≤ l ≤ o) be n× n symmetric matrices withgl(x) =txGlx + (linear form of x),fl(x) =txFlx + (linear form of x).By the definitions of the quadratic maps G,F , we see that the matrices Gl, Fl are written byGl =(0o ∗∗ ∗v), Fl = tSGlS = tS(0o ∗∗ ∗v)S.It is easy to see that, if o = v, it holds(0o ∗∗ ∗v)−1 (0o ∗∗ ∗v)=(∗o ∗0 ∗v).Then, for two linear sums W1,W2 of F1, . . . , Fo, we haveW−11 W2 = S−1(0o ∗∗ ∗v)−1 (0o ∗∗ ∗v)S = S−1(∗o ∗0 ∗v)S.This means that there exists an invertible n× n matrix S1 withS−11 W−11 W2S1 =(∗o ∗0 ∗v),and such a matrix S1 satisfiesSS1 =(∗o ∗0 ∗v).SincetS1FlS1 = t(SS1)Gl(SS1) =(0o ∗∗ ∗v),the matrix S1 is enough to generate dummy signatures of UOV. It is known that S1 can be recoveredin polynomial time (see [4] for the detail).When v > o, the original Kipnis-Shamir’s attack [4] is not available since(0o ∗∗ ∗v)−1 (0o ∗∗ ∗v)6=(∗o ∗0 ∗v).This attack was arranged to be available also for v > o in [3]. However, its complexity is no longerpolynomial time but O(qv−o · (polyn.)). Thus v is taken sufficiently larger than o for the originalUOV.On the security of Circulant UOV/Rainbow 33 Circulant UOVCirculant UOV [9] is a variant of UOV constructed as follows.For 1 ≤ l ≤ o, let Al, Bl be v × o and v × v matrices respectively, cl ∈ Fnq a row vector anddl ∈ Fq such thatgl(x) = tx(0o tAlAl Bl)x + clx + dl.In the original UOV, Al, Bl, cl, dl are chosen randomly. On the other hand in Circulant UOV, Aland cl are given as follows.A1 = (a1,a2,a3, . . . ,ao),A2 = (ao,a1,a2, . . . ,ao−1),A3 = (ao−1,ao,a1, . . . ,ao−2),...Ao = (a2,a3,a4, . . . ,ao,a1),c1 = (c1, c2, c3, . . . , co, c(1)o+1, . . . , c(1)n ),c2 = (co, c1, c2, . . . , co−1, c(2)o+1, . . . , c(2)n ),c3 = (co−1, co, c1, . . . , co−2, c(3)o+1, . . . , c(3)n ),...co = (c2, c3, c4, . . . , co, c1, c(o)o+1, . . . , c(o)n ),(2)where a1, . . . ,ao ∈ Fvq are column vectors and c1, . . . , co, c(1)o+1, . . . , . . . , c(o)n ∈ Fq are constants. Notethat Bl and dl are chosen randomly. We can easily check that, for such Al, cl, the linear equations(1) solved in the process of signature generation of UOV are given byα1 α2 α3 . . . αoαo α1 α2 . . . αo−1αo−1 αo α1 . . . αo−2.......... . ....α2 α3 α4 . . . α1y1y2y3...yo=β1β2β3...βo,where α1, . . . , αo, β1, . . . , βo ∈ Fq. It is known that the matrix in the left hand side of the equationabove is inverted in time O(n2) [5], which is smaller than O(n3) for the original UOV. Thus thesignature generation of Circulant UOV is faster than that of the original UOV.4 Kipnis-Shamir’s attack on Circulant UOVIn this section, we explain why Circulant UOV is vulnerable against Kipnis-Shamir’s attack.Due to (2), we see thatAl = A1P l−1for 1 ≤ l ≤ o, where P :=1. . .11 is an o× o matrix representing a cyclic permutation. Itis easy to check that(0o (A1C1)tA1C1 B′1)−1 ( 0o (A1C2)tA1C2 B′2)=(∗o ∗0 ∗v)for o× o matrices C1, C2 and v × v matrices B′1, B′2, if C1 is invertible. This means thatW−11 W2 = S−1(∗o ∗0 ∗v)Seven if v > o. This situation is almost the same to the original UOV with o = v. Thus the attackercan recover an n × n matrix S1 satisfying SS1 =(∗o ∗0 ∗v)in polynomial time similarly to the4 Y. HashimotoTable 1: Running times of Kipnis-Shamir’s attack on Circulant UOVq n m o v Time (Security)31 99 33 34 65 0.59s (80bit)31 123 41 43 80 1.64s (100bit)31 156 52 53 103 6.54s (128bit)original UOV with o = v [4].Table 1 describes the results of experiments of Kipnis-Shamir’s attack against Circulant UOV onMagma [1] ver.2.22-3 on Windows 8.1, Core(TM)i7-4800MQ, 2.70GHz for the parameter selectionsgiven in [9] as 80-, 100- and 120-bit security parameters. In this table, the numbers m of quadraticforms in F do not coincide with o since the “minus” is used on Circulant UOV (see §5 of [9]). Notethat the “minus” does not disturb Kipnis-Shamir’s attack. Due to the results in this table, we canconclude that Circulant UOV is not secure at all against Kipnis-Shamir’s attack.5 Rainbow and Circulant RainbowRainbow is a multi-layer version of UOV (see, e.g. [2] for the detail) and Circulant Rainbow [8] canbe constructed similarly. The original Rainbow has been considered to be secure enough againstknown attacks including Kipnis-Shamir’s attack under a suitable parameter selections. However,due to §4, we can easily check that Kipnis-Shamir’s attack is also available on Circulant Rainbowand it recovers an equivalent secret key in polynomial time. We thus conclude that CirculantRainbow is also insecure similar to Circulant UOV.Acknowledgment. The author was supported by JST CREST no.JPMJCR14D6 and JSPSGrant-in-Aid for Scientific Research (C) no. 17K05181.References[1] W. Bosma, J. Cannon, C. Playoust, The Magma algebra system. I. The user language. J.Symbolic Comput. 24 (1997), pp.235–265.[2] J. Ding, D. Schmidt, Rainbow, a new multivariate polynomial signature scheme, ACNS’05,LNCS 3531 (2005), pp.164–175.[3] A. Kipnis, J. Patarin, L. Goubin, Unbalanced oil and vinegar signature schemes, Eurocrypt’99,LNCS 1592 (1999), pp.206–222, extended in citeseer/231623.html, 2003-06-11.[4] A. Kipnis, A. Shamir, Cryptanalysis of the oil and vinegar signature scheme, Crypto’98, LNCS1462 (1998), pp.257–267.[5] I. Kra, S. R. Simanca, On circulant matrices, Notices AMS, 59 (2012), pp. 368-377.[6] NIST, Post-quantum cryptography standardization,https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/Post-Quantum-Cryptography-Standardization.[7] J. Patarin, The Oil and Vinegar Signature Scheme, the Dagstuhl Workshop on Cryptography,1997.[8] Z. Peng, S. Tang, Circulant Rainbow: A new Rainbow variant with shorter private key andfaster signature generation, IEEE Access 5 (2007), pp. 11877 - 11886.[9] Z. Peng, S. Tang, Circulant UOV: a new UOV variant with shorter private key and fastersignature generation, KSII Transactions on Internet and Information Systems, 12 (2018), pp.1376-1395.

On the security of Circulant UOV/Rainbow

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive