This paper presents a new fast public key cryptosystem namely : a key exchange algorithm,
a public key encryption algorithm and a digital signature algorithm, based on the difficulty to
invert the following function : F(x) = (a * x)Mod(2 power p)Div(2 power q) .
Mod is modulo operation , Div is integer division operation , a , p and q are integers where
(p > q) .
In this paper we also evaluate the hardness of this problem by reducing it to SAT 

Abdelhak Azhari

Samir Bouftass

Cryptology ePrint Archive

On a new fast public key cryptosystemAbdelhak Azhari1 and Samir Bouftass21University Hassan II , e-mail : aazhari2001@yahoo.fr.2Crypticator.Inc , e-mail : crypticator@gmail.com.October 29, 2015AbstractThis paper presents a new fast public key cryptosystem namely : a key exchange algorithm,a public key encryption algorithm and a digital signature algorithm, based on the difficulty toinvert the following function : F (x) = (a× x)Mod(2p)Div(2q) .Mod is modulo operation , Div is integer division operation , a , p and q are integers where(p > q) .In this paper we also evaluate the hardness of this problem by reducing it to SAT .Keywords : key exchange, public key encryption, digital signature, boolean satisfability problem,Multivariate polynomials over F(2) .1 Introduction :Since its invention by Withfield Diffie and Martin Hellman [1] , Public key cryptography hasimposed itself as the necessary and indispensable building block of every IT Security architecture.But in the last decades it has been proven that public key cryptosystems based on number theoryproblems are not immune againt quantum computing attacks [3]. The advent of low computingressources mobile devices such wirless rfid sensors, smart cellphones, ect has also put demands onvery fast and lightweight public key algorithms .Public key cryptosystem presented in this paper is not based on number theory problems and isvery fast compared to Diffie-Hellman [1] and RSA algorithms [2]. It is based on the difficulty toinvert the following function : F (x) = (a× x)Mod(2p)Div(2q) .Mod is modulo operation , Div is Integer division operation , a , p and q are known integers where(p > q) . In this paper we construct three public key algorithms based on this problem namely akey exchange algorithm, a public key encryption algorithm and a digital signature algorithm.We prove its efficiency compared to Diffie-Hellman and RSA, and that the underlying problem canbe a hard SAT instance [4] or a equations set of multivariate polynomials over F(2) .12 Secret key exchange algorithm :Before exchanging a secret key, Alice and Bob shared a knowledge of :Integers [ l, m, p, q, r, Z ] satisfying following conditions :q = l + m− p , p > m + q + r, Z is l bits long.To exchange a secret key :- 1 Bob chooses randomly a integer X. [ X ] is m bits and a private knowledge of Bob.- 2 Computes number U = (X × Z)Mod(2p)Div(2q) , and sends it to Alice.- 3 Alice chooses randomly a integer Y . [ Y ] is m bits and a private knowledge of Alice.- 4 Computes number V = (Y × Z)Mod(2p)Div(2q) , and sends it to Bob.- 5 Bob computes number Wa = (X × V )Mod(2p−q)Div(2m+r).- 6 Alice computes number Wb = (Y × U)Mod(2p−q)Div(2m+r).Our experiments shows us that Pr[Wa = Wb] = 1− 0.3 ∗ 2−r.If Bob and Alice chooses r great enough say superior to 128, Pr[Wa 6= Wb] will be negligible,they can use then this protocol as a key exchange algorithmSecrete key exchanged is the number :W = (X × V )Mod(2(p−q))Div(2m+r) = (Y × U)Mod(2(p−q))Div(2m+r)A python implementation of this algorithm is provided in Appendix A23 Public key encryption algorithm :3.1 Encryption :In order to send a encrypted message to Bob, Alice performs the following steps :-1 She gots his public key composed by integers [ l, m, p, q, r, Z, U ] , satisfying :q = l + m− p, p > m + q + r , U = (X × Z)Mod(2p)Div(2q), Z is l bits long.[ X ] is the m bits long private key of Bob.- 2 She chooses randomly a integer Y which is m bits long .- 3 She computes number V = (Y × Z)Mod(2p)Div(2q), then the secret keyW = (Y × U)Mod(2p−q)Div(2m+r).- 4 She encrypts with secret key W her plaintext and sends corresponding ciphertextand number V to Bob.3.2 Decryption :In order to decrypt the ciphertext recieved from Alice, Bob performs the following steps :- 1 With his private key X and number V recieved from Alice,he computes secret key W = (X × V )Mod(2p−q)Div(2m+r).- 2 With secret key W , he decrypts the ciphertext recieved from Alice.34 Digital signature Algorithm :Bob’s public key is composed by integers [ l, m, p, q, r, Z, U ] , satisfying :q = l + m− p , p > l + q + r, U = (X × Z)Mod(2p)Div(2q), X is m bits whereas Z is l bits long.4.1 Signature :In order to sign a Message Msg, Bob performs the following steps :- 1 He chooses randomely an m bit long integer Y .- 2 Hashes Msg by a hash function HF and gets a digest H which length in bits is the sameas elements Z of his public key . with his private key [X], he computes :S1 = (Y × Z)Mod(2p)Div(2q) and S2 = (H × (X + Y ))Mod(2p)Div(2q)- 3 Sends Message Msg and signature (S1, S2) to Alice.4.2 Verification :In order to verify that Message Msg is sent by Bob, Alice performs the following steps :- 1 She gots his public key.- 2 Hashes Msg by HF and gets a digest H which the length in bits is l the same as Zs.- 3 From digest H, signature (S1, S2) and the elements [ p, q, l, U , Z ] of Bob’s public key,She computes Wa = (H×(S1+U))Mod(2p−q)Div(2l+r) and Wb = (Z×S2)Mod(2p−q)Div(2l+r).- 4 Compares Wa to Wb , Msg is sent by Bob if Wa = WbA python implementation of this algorithm is provided in Appendix B45 Efficiency :In comparaison to standardised key exchange algorithms such as Diffie-Hellman in the multiplicatifgroup and RSA that have time complexities of O(n3), The key exchange algorithm presented inthis paper can be realised by a multiplication circuit where some leftmost and righmost output bitsare discarded, meaning that it has a time complexity of O(n2) and with a same securiy parametern, it can be n time faster than Diffie-Hellman in the multiplicatif group and RSA algorithms.6 Security :The Security of presented public key cryptosystem is based on the difficulty of finding X and Ywhile knowing Z, l, m, p, q, r, U = (X × Z)Mod(2p)Div(2q), V = (Y × Z)Mod(2p)Div(2q)l + m = p + q, p > m + q + r, Z is l bit long , X and Y are m bits.To get X from U and Y from V , a attacker should :1 - Invert F (X) = U = (Z ×X)Mod(2p)Div(2q)2 - Invert F (Y ) = V = (Z × Y )Mod(2p)Div(2q).Puting it otherwise, presented public key cryptosystem is based on the difficulty to invert the fol-lowing function :F (x) = y = (a× x)Mod(2p)Div(2q).a, x, p and q are known integers, while a and x are respectively n and m bits long, (n > m) and(p > q) .At first glance we can notice that it is easy to verify a solution but it is difficult to find one, implyingthat this problem is in NP.In our knowlege it has never been mentioned in the literature. In subsequent section we will reduceit to SAT in order to evaluate its hardness.56.1 Hardness evaluation :Let A, X, Y , n, m be integers where A, X are rescpectively n and m bits long (m ≤ n).The binary representation of A is a(n−1)...a(i+1)a(i)...a(0).The binary representation of X is x(m−1)...x(i+1)x(i)...x(0) .The binary representation of Y is y(n+m−1)...y(i+1)y(i)...y(0) .Y is the arithmetic product of A and X, Y ’s bits in function of A’s bits and X’s bits can betranslated by the following set of algebric equations (1) :c0 = 0For ( j = 0 to m− 1 ) :yj = ((j∑i=0a(j−i) × xi) + cj)Mod(2) and cj+1 = ((j−1∑i=0a(j−i) × xi) + cj)Div(2)For ( j = m− 1 to n− 1 ) :yj = ((m−1∑i=0a(j−i) × xi) + cj)Mod(2) and cj+1 = ((m−1∑i=0a(j−1−i) × xi) + cj)Div(2)For ( j = n− 1 to m + n− 1 ) :yj = ((m−1∑i=j−n+1a(j−i) × xi) + cj)Mod(2) and cj+1 = ((m−1∑i=j−na(j−i) × xi) + cj)Div(2)cj is the retenue bit of multiplication product (Y = A×X) at column j.In our problem we have as unknowns bits Y0→q and Yp→(m+n−1) (1) become then following set ofalgebric equations (2) :For ( j = q to m− 1 ) :yj = ((j∑i=0a(j−i) × xi) + cj)Mod(2) and cj+1 = ((j−1∑i=0a(j−i) × xi) + cj)Div(2)For ( j = m− 1 to n− 1 ) :yj = ((m−1∑i=0a(j−i) × xi) + cj)Mod(2) and cj+1 = ((m−1∑i=0a(j−1−i) × xi) + cj)Div(2)6For ( j = n− 1 to p ) :yj = ((m−1∑i=j−n+1a(j−i) × xi) + cj)Mod(2) and cj+1 = ((m−1∑i=j−na(j−i) × xi) + cj)Div(2)Set of algebric equations (2) can be translated to following set of logical equations (3).If (j ≤ m) cj = Fj(x(j−1), ..., x(k+1), x(k), ..., x0, c(j−1))If (m ≤ j) cj = Fj(xm, ..., x(k+1), x(k), ..., x0, c(j−1))∧mj=q((⊕ji=0(a(j−i) ∧ xi)⊕ cj) = yj) = true∧nj=m((⊕ji=j−m(a(j−i) ∧ xi)⊕ cj) = yj) = true∧pj=n((⊕ni=j−n(a(j−i) ∧ xi)⊕ cj) = yj) = trueNotice this set of logical equation is practicaly the same set resulting from reducing FACT to SAT,In paper [9] Authors had suggested to use FACT as a source of Hard SAT Instances, moreover SATSolvers to this day are still inefficient in solving this sort of SAT instances.Every logical function can be realised by nands gates , if we replace ¬xi by (1− xi) , ( xi ∧ xj )by ( xi × xj ) (3) can also be translated to following set of multivariate polynomials equations :If (q ≤ j ≤ m− 1) :yj = ((j∑i=0a(j−i) × xi) + Fj(x0, ....xm))Mod(2)If (m− 1 ≤ j ≤ n− 1) :yj = ((m−1∑i=0a(j−i) × xi) + Fj(x0, ....xm))Mod(2)If (n− 1 ≤ j ≤ p) :yj = ((m−1∑i=j−n+1a(j−i) × xi) + Fj(x0, ....xm))Mod(2)Where Fj ’s are multivariate polynomials corresponding to carries cjSumming it up, to break presented public key cryptosystem one had to solve SAT instances re-sulting from logical equations containing lot of Xors which is not that evident if the number ofunknown bits are high enough [6].Or solve sets of multivariate polynomials equations over F(2) with degrees superior or equal toparameter q.77 Conclusion , open question and future work :In this paper we have presented a new fast public key cryptosystem based on the difficulty of in-verting the following function : F (x) = (a× x)Mod(2p)Div(2q) .Mod is modulo operation , Div is integer division operation , a , p and q are known integers where(p > q) .We have proved its efficiency compared to Diffie Hellman and RSA cryptosystems. We have alsoproved that its security is based on a new problem that can be viewed as a hard sat instance or aset of multivariate polynomial equations over F(2) .The fact that its security is not based on number theory problems is also a proof of its resistanceagainst current quantum computing attacks [3].The last decade have seen a enormous progress of SAT Solvers but they are still inefficient in solvinglogical statements containg a lot of xors which is the case of our problem [5][6][7].SAT is NP complete, meaning that solving it can take exponential time. It is has been found thatthe hardest instances of a SAT problem depends on its constraindness which is defined as the ratioof clauses to variables [8].This lead us to ask what forms should have the integers composing public parameters of our PKCSin order to produce hard SAT instances even to a eventual SAT Solver that have not problems withxor clauses.Recently we have found a way to build public key cryptosystems based on the difficulty of invertingthe following function : F (x) = (a× x)Mod(bp)Div(bq) .Mod is modulo operation , Div is integer division operation , a , b , p and q are known integerswhere (p > q) .This work will be the subject of a future paper.8References[1] Whitfield Diffie, Martin E.Hellman. New Directions in cryptography, IEEE Trans. on Info.Theory, Vol. IT-22, Nov. 1976 (1976)[2] R.L. Rivest , A. Shamir , L. Adleman. A method of obtaining digital signatures and public keycryptosystems , SL Graham, RL Rivest* Editors (1978)[3] Daniel J Bernstein, Johannes Buchmann, Erik Dahman. Post-Quantum Cryptography, (2009),Springer Verlag , Berlin Heidelberg .[4] Thomas J Schaefer. The complexity of satisfability problems , (1978), Departement of Mathe-matics University of California, Berkeley .[5] Stefan Schoenmackers, Anna Cavender. Satisfy This: An Attempt at Solving Prime Factor-ization using Satisfiability Solvers , (2005), Department of Computer Science, University ofWashington .[6] Mate Soosy, Karsten Nohlz, and Claude Castellucciay. Extending SAT Solvers to CryptographicProblems, (2009), INRIA Rhone-Alpes, University of Virginia .[7] Tero Laitinen, Tommi Junttila, Ilkka NiemelConflict-Driven XOR-Clause Learning , (2014),Logic in Computer Science .[8] Eugene Nudelman, Kevin Leyton-Brown, Holger H. Hoos, Alex Devkar, Yoav Shoham Under-standing Random SAT: Beyond the Clauses-to-Variables Ratio , (1978), Principles and Practiceof Constraint Programming CP 2004 Lecture Notes in Computer Science Volume 3258, 2004 .[9] Satoshi Horie, Osamu Watanabe Hard instance generation for SAT , Algorithm and Computa-tion, Lecture Notes in Computer Science Volume 1350,1997, pp 22-31 , Date 29 Jul 200598 Appendix A :Following python script is a ” practical ” proof of correctness of key exchange algorithm presentedin this paper. (pycrypto library is needed )========================================================import sysfrom Crypto.Util.number import getRandomNBitIntegerdef ModDiv(A,B,C) :return (A % B ) // Cl = sys.argv[1]m = sys.argv[2]p = sys.argv[3]q = sys.argv[4]r = sys.argv[5]try:l = int(l)m = int(m)p = int(p)q = int(q)r = int(r)except ValueError:print(’Invalid Arguments’)if m + q + r ≥ p :print(””)print(”Public Parameter l = %d” %l)print(”Public Parameter m = %d” %m)print(”Public Parameter p = %d” %p)print(”Public Parameter q = %d” %q)print(”Public Parameter r = %d” %r)print(””)print(’Condition (p > m + q + r) is not fulfilled !’)else :” Size in bits of public pararameter Z is l ”10Z = getRandomNBitInteger(l,randfunc=None)” Size in bits of private parameters X and Y is m ”X = getRandomNBitInteger(m,randfunc=None)Y = getRandomNBitInteger(m,randfunc=None)M = pow(2,p)M1 = pow(2,p-q)D = pow(2,q)D1 = pow(2,m+r)” If r = 0, In 30 % percents, the keys computed by Alice and Bob are not identical : ”” Wa = Wb± 1, this is due to bit carry propagation, if r is increased by one ”” the probability that Wa is diffrent to Wb is devided by two. ”U = ModDiv(Z*X,M,D)V = ModDiv(Z*Y,M,D)Wa = ModDiv(U*Y,M1,D1)Wb = ModDiv(V*X,M1,D1)print(””)print(”Public Parameters :”)print(”===================”)print(””)print(”Public Parameter l = %d” %l)print(”Public Parameter m = %d” %m)print(”Public Parameter p = %d” %p)print(”Public Parameter q = %d” %q)print(”Public Parameter r = %d” %r)print(”Public Parameter Z = %d” %Z)print(””)print(”Private Parameters :”)print(”====================”)print(””)print(”Alice Private Parameter X = %d” %X)print(”Bob Private Parameter Y = %d” %Y)print(””)11print(”Shared Parameters :”)print(”=============”)print(””)print(”Parameter shared with Bob by Alice U = %d” %U)print(”Parameter shared with Alice by Bob V = %d” %V)print(””)print(”Exchanged Secret Key :”)print(”======================”)print(””)print(”Secret key computed by Alice Wa = %d” %Wa)print(”Secret key computed by Bob Wb = %d” %Wb)print(””)sys.exit========================================================You can download this script from : https : //github.com/Crypticator/ModDiv/blob/master/Kex.py9 Appendix B :Following python script is a ” practical ” proof of correctness of digital signature algorithm pre-sented in this paper. (pycrypto library is needed )========================================================import sysfrom Crypto.Util.number import getRandomNBitIntegerdef ModDiv(A,B,C) :return (A % B ) // Cl = sys.argv[1]m = sys.argv[2]p = sys.argv[3]q = sys.argv[4]r = sys.argv[5]12try:l = int(l)m = int(m)p = int(p)q = int(q)r = int(r)except ValueError:print(’Invalid Arguments’)if m + q + r ≥ p :print(””)print(”Public Parameter l = %d” %l)print(”Public Parameter m = %d” %m)print(”Public Parameter p = %d” %p)print(”Public Parameter q = %d” %q)print(”Public Parameter r = %d” %r)print(””)print(’Condition (p > m + q + r) is not fulfilled !’)else :” Size in bits of public pararameter Z is l ”Z = getRandomNBitInteger(l,randfunc=None)” a hash value of a hypothetical file ”H = getRandomNBitInteger(l,randfunc=None)” Size in bits of private parameters X and Y is m ”X = getRandomNBitInteger(m,randfunc=None)Y = getRandomNBitInteger(m,randfunc=None)M = pow(2,p)M1 = pow(2,p-q)D = pow(2,q)D1 = pow(2,l+r)U = ModDiv(Z*X,M,D)S1 = ModDiv(Z*Y,M,D)S2 = ModDiv(H*(X+Y) ,M,D)Wa = ModDiv(H*(S1+U),M1,D1)Wb = ModDiv(Z*S2,M1,D1)13print(””)print(”Public Parameters :”)print(”===================”)print(””)print(”Public Parameter l = %d” %l)print(”Public Parameter m = %d” %m)print(”Public Parameter p = %d” %p)print(”Public Parameter q = %d” %q)print(”Public Parameter r = %d” %r)print(”Public Parameter Z = %d” %Z)print(”Public Parameter H = %d” %H)print(””)print(”Private Parameters :”)print(”====================”)print(””)print(”Private key X = %d” %X)print(”Ephemeral key Y = %d” %Y)print(””)print(”Signature:”)print(”==========”)print(””)print(”S1 = %d” %S1)print(”S2 = %d” %S2)print(””)print(”Verification :”)print(”==============”)print(””)print(”Wa = %d” %Wa)print(”Wb = %d” %Wb)print(””)sys.exit========================================================You can download this script from : https : //github.com/Crypticator/ModDiv/blob/master/moddiv/Sig.py14

On a new fast public key cryptosystem

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive