This document contains the Intellectual Property Statement and the technical
description of the MQQ-SIG - a new public key digital signature scheme. The
complete scientific publication covering the design rationale and the security
analysis will be given in a separate publication. MQQ-SIG consists of $n -
\frac{n}{4}$ quadratic polynomials with $n$ Boolean variables where n=160, 196,
224 or 256

Faugère, Jean-Charles

Gligoroski, Danilo

Jensen, Rune Erlend

Knapskog, Svein Johan

Markovski, Smile

Perret, Ludovic

Ødegård, Rune Steinsmo

English

arXiv

This document contains the Intellectual Property Statement and the technical description of the MQQ-SIG - a new public key digital signature scheme. The complete scientific publication covering the design rationale and the security analysis will be given in a separate publication. MQQ-SIG consists of $n - \frac{n}{4}$ quadratic polynomials with $n$ Boolean variables where $n=160$, $192$, $224$ or $256$

Danilo Gligoroski

Rune Steinsmo \O deg\aa rd

Rune Erlend Jensen

Ludovic Perret

Jean-Charles Faugère

Svein Johan Knapskog

Smile Markovski

Cryptology ePrint Archive

The Digital Signature Scheme MQQ-SIGIntellectual Property Statement and Technical DescriptionFirst published: 10 October 2010, Last update: 20 December 2010Danilo Gligoroski1 and Rune Steinsmo Ødeg̊ard2 and Rune Erlend Jensen2 and Ludovic Perret4 andJean-Charles Faugère5 and Svein Johan Knapskog2 and Smile Markovski31 Department of Telematics, Faculty of Information Technology, Mathematics and Electrical Engineering,The Norwegian University of Science and Technology (NTNU), O.S.Bragstads plass 2E, N-7491 Trondheim,NORWAY, danilog@item.ntnu.no2 Norwegian University of Science and Technology Centre for Quantifiable Quality of Service inCommunication Systems. O.S. Bragstads plass 2E, N-7491 Trondheim, NORWAY, knapskog@Q2S.ntnu.no,rune.odegard@q2s.ntnu.no, runeerle@stud.ntnu.no3 “Ss Cyril and Methodius” University, Faculty of Natural Sciences and Mathematics, Institute ofInformatics, P.O.Box 162, 1000 Skopje, MACEDONIA, smile@ii.edu.mk4 Pierre and Marie Curie University - Paris, Laboratory of Computer Sciences, Paris 6, 104 avenue duPrésident Kennedy 75016 Paris FRANCE, ludovic.perret@lip6.fr5 UPMC, Université Paris 06, LIP6 INRIA, Centre Paris-Rocquencourt, SALSA Project-team CNRS, UMR7606, LIP6 4, place Jussieu 75252 Paris, Cedex 5, FRANCE jean-charles.faugere@inria.frAbstract: This document contains the Intellectual Property Statement and the technical descrip-tion of the MQQ-SIG - a new public key digital signature scheme. The complete scientific publicationcovering the design rationale and the security analysis will be given in a separate publication. MQQ-SIG consists of n − n4 quadratic polynomials with n Boolean variables where n = 160, 192, 224 or256.Keywords: Public Key Cryptosystems, Fast signature generation, Multivariate Quadratic Poly-nomials, Quasigroup String Transformations, Multivariate Quadratic Quasigroup1 Intellectual Property StatementWe, the seven names given in the title of this document and undersigned on this statement, theauthors and designers of MQQ-SIG digital signature scheme, do hereby agree to grant any interestedparty an irrevocable, royalty free licence to practice, implement and use MQQ-SIG digital signaturescheme, provided our roles as authors and designers of the MQQ-SIG digital signature scheme arerecognized by the interested party as authors and designers of the MQQ-SIG digital signature scheme.Name Signature Place Date1. Danilo Gligoroski Trondheim2. Svein Johan Knapskog Trondheim3. Smile Markovski Skopje4. Rune Steinsmo Ødegård Trondheim5. Rune Erlend Jensen Trondheim6. Ludovic Perret Paris7. Jean-Charles Faugère Paris2 Description of the MQQ-SIG digital signature schemeA generic description for our scheme can be expressed as a 34 truncation of a typical multivariatequadratic system: S ◦ P ′ ◦ S′ : {0, 1}n → {0, 1}n where S′ = S · x + v (i.e. S′ is a bijective affinetransformation), S is a nonsingular linear transformation, and P ′ is a bijective multivariate quadraticmapping on {0, 1}n.The bijective multivariate quadratic mapping P ′ : {0, 1}n → {0, 1}n is defined in Table 1.Bijective multivariate quadratic mapping P ′(x)Input: A vector x = (f1, . . . , fn) of n linear Boolean functions of n variables. We implicitlysuppose that a multivariate quadratic quasigroup ∗ is previously defined, and that n = 32k,k ∈ {5, 6, 7, 8} is also previously determined.Output: 8 linear expressions P ′i (x1, . . . , xn), i = 1, . . . , 8 and n − 8 multivariate quadraticpolynomials P ′i (x1, . . . , xn), i = 9, . . . , n1. Represent a vector x = (f1, . . . , fn) of n linear Boolean functions of n variables x1, . . . , xn, asa string x = X1 . . . Xn8where Xi are vectors of dimension 8;2. Compute y = Y1 . . . Yn8where: Y1 = X1, Yj+1 = Xj ∗ Xj+1, for even j = 2, 4, . . ., andYj+1 = Xj+1 ∗ Xj , for odd j = 3, 5, . . .3. Output: y.Table 1. Definition of the bijective multivariate quadratic mapping P ′ : {0, 1}n → {0, 1}nThe algorithm for generating the public and private key is defined in the Table 2.Algorithm for generating Public and Private key for the MQQ-SIG schemeInput: Integer n, where n = 32 × k and k ∈ {5, 6, 7, 8}.Output: Public key P: n− n4 multivariate quadratic polynomials Pi(x1, . . . , xn), i = 1+n4 , . . . , n,Private key: Two permutations σ00 and σ10 of the numbers {1, . . . , n}, and 81 bytes for encoding aquasigroup ∗ .1. Generate an MQQ ∗ according to equations (1) . . . (4).2. Generate a nonsingular n × n Boolean matrix S and affine transformation S′ according toequations (5), . . . , (8).3. Compute y = S(P ′(S′(x))), where x = (x1, . . . , xn).4. Output: The public key is y as n − n4 multivariate quadratic polynomials Pi(x1, . . . , xn) i =1 + n4 , . . . , n, and the private key is the tuple (σ00 , σ10 , ∗).Table 2. Generating the public and private keyThe algorithm for signing by the private key (σ00 , σ10 , ∗) is defined in Table 3.Algorithm for digital signature with the private key (σ00 , σ10 , ∗)Input: A document M to be signed.Output: A signature sig = (x1, . . . , xn).1. Compute y = (y1, . . . , yn) = H(M)|n, where M is the message to be signed, H() is a standard-ized cryptographic hash function such as SHA-1, or SHA-2, with a hash output of not less than nbits. The notation H(M)|n denotes the least significant n bits from the hash output H(M).2. Set y′ = S−1(y).3. Represent y′ as y′ = Y1 . . . Yn8where Yi are Boolean vectors of dimension 8.4. By using the left and right parastrophes \ and / of the quasigroup ∗ compute x′ = X1 . . . Xn8,such that: X1 = Y1, Xj = Xj−1\Yj , for even j = 2, 4, . . ., and Xj = Yj/Xj−1, for odd j = 3, 5, . . ..5. Compute x = S−1(x′) + v = (x1, . . . , xn).6. The MQQ-SIG digital signature of the document M is the vector sig = (x1, . . . , xn).Table 3. Digital signingThe algorithm for signature verification with the public key P = {Pi(x1, . . . , xn) | i = 1+ n4 , . . . , n}is given in Table 4.Algorithm for signature verification with a public key P = {Pi(x1, . . . , xn) | i = 1 + n4 , . . . , n}Input: A document M and its signature sig = (x1, . . . , xn).Output: TRUE or FALSE.1. Compute y = (y1+n4, . . . , yn) = H(M)|n−n4, where M is the signed message, H() is a stan-dardized cryptographic hash function such as SHA-1, or SHA-2, with a hash output of not lessthan n bits, and the notation H(M)|n−n4denotes the least significant n − n4 bits from the hashoutput H(M).2. Compute z = (z1+n4, . . . , zn) = P(sig).3. If z = y then return TRUE, else return FALSE.Table 4. Digital verification3 Multivariate Quadratic QuasigroupsA Multivariate Quadratic Quasigroup (MQQ) ∗ of order 2d used in this version of MQQ-SIG can bedescribed shortly by the following expression:x ∗ y ≡ B ·U(x) ·A2 · y +B ·A1 · x+ c (1)where x = (x1, . . . , xd), y = (y1, . . . , yd), the matrices A1, A2 and B are nonsingular in GF (2), ofsize d× d, the vector c is a random d-dimensional vector with elements in GF (2) and all of them aregenerated by a uniformly random process. The matrix U(x) is an upper triangular matrix with alldiagonal elements equal to 1, and the elements above the main diagonal are linear expressions of thevariables of x = (x1, . . . , xd). It is computed by the following expression:U(x) = I +d−1∑i=1Ui ·A1 · x, (2)where the matrices Ui have all elements 0 except the elements in the rows from {1, . . . , i} that arestrictly above the main diagonal. Those elements can be either 0 or 1.Once we have a multivariate quadratic quasigroup∗vv(x1, . . . , xd, y1, . . . , yd) = (f1(x1, . . . , xd, y1, . . . , yd), ..., fd(x1, . . . , xd, y1, . . . , yd))we will be interested in those quasigroups that will satisfy the following conditions:∀i ∈ {1, . . . , d}, Rank(Bfi) ≥ 2d− 4, (3a)∃j ∈ {1, . . . , d}, Rank(Bfj ) = 2d− 2 (3b)where matrices Bfi are 2d× 2d Boolean matrices defined from the expressions fi asBfi = [bj,k], bj,d+k = bd+k,j = 1, iff xjyk is a term in fi. (4)Proposition 1. For d = 8, a multivariate quadratic quasigroup that satisfies the conditions (1), . . . ,(4) can be encoded in a unique way with 81 bytes.4 Nonsingular Boolean matrices in MQQ-SIGIn MQQ-SIG the nonsingular matrices S are defined by the following expression:S−1 =n16⊕i=0Iσ0i ⊕n16+1⊕i=0Iσ1i , (5)where Iσ0i , i = {0, 1, 2, . . . ,n16} and Iσ1i , i = {0, 1, 2, . . . ,n16 +1} are permutation matrices of size n, theoperation ⊕ is a bitwise exclusive or of the elements in the permutation matrices and permutationsσ0i and σ1i are permutations on n elements. They are defined by the following expressions:σ00 − random permutation on {1, 2, . . . n},σ0i = RotateLeft(σ0i−1, 8), for i = 1, . . . ,n16 ,σ10 − random permutation on {1, 2, . . . n},σ1i = RotateLeft(σ1i−1, 8), for i = 1, . . . ,n16 + 1,(6)We chose the permutations σ00 and σ10 until we obtain a non-singular matrix S−1. Once we have anonsingular matrix S−1 we will compute its inverse obtainingS = (S−1)−1and from there we will obtain the affine transformationS′(x) = S · x+ v, (7)where the vector v is n–dimensional Boolean vector defined from the values of the permutationσ10 = (s1, s2, . . . , sn) by the following expression:v = (v1, v2, . . . , vn),where vi =((s1+⌊ i−18 ⌋) mod 16)×162(8−i) mod 8+ ( s65+⌊ i−18 ⌋2(8−i) mod 8) mod 2. (8)In words: we construct the bits of the vector v by constructing two arrays. The first array isconstructed by taking the four least significant bits of the values s1, . . . , sn8 and each of them isshifted by four positions to the left. The second array is just simple extraction of the values s65, . . . ,s65+n8 . Finally we XOR correspondingly those two arrays of values in order to produce the vector vof n bits.Proposition 2. The linear transformation S−1 can be encoded in a unique way with 2n bytes.5 Characteristics of the MQQ-SIG digital signature schemeThe main characteristics of our MQQ-SIG digital signature scheme can be briefly summarized asfollows:• there is no message expansion;• the length of the signature is n bits where (n = 160, 192, 224 or 256);• its conjectured security level is 2n2 ;• its verification speed is comparable to the speed of other multivariate quadratic PKCs;• in software its signing speed is in the range of 300–7,000 times faster than RSA and ECCschemes;• in hardware its signing or verification speed is more than 10,000 times faster than RSA andECC schemes;• it is also well suited for producing short signatures in smart cards and RFIDs;5.1 The size of the public and the private keyThe size of the public key is 0.75× n× (1 + n(n+1)2 ) bits. The private key of our scheme is the tuple(σ00 , σ10 , ∗). The corresponding memory size needed for storage of the private key is 2n+ 81 bytes. InTable 5 we give the size of the public key (in KBytes) and the size of the private key (in bytes) forn ∈ {160, 192, 224, 256}.nSize of thepublic key (KBytes)Size of theprivate key (bytes)160 188.69 401192 325.71 465224 516.82 529256 771.02 593Table 5. Memory size in KBytes for the public key and in bytes for the private key5.2 Performance of the software and hardware implementation of the MQQ-SIGalgorithmWe have implemented MQQ-SIG in C for the SUPERCOP benchmarking system http://bench.cr.yp.to/supercop.html and tested it together with the corresponding RSA and ECC. In Table 6 wegive the comparison of MQQ-SIG with RSA and ECC in 64-bit mode of operation on Intel Core i7920X machine running at 2 GHz. The numbers in the table represent CPU cycles. Although, our Ccode is not yet optimized for the key generation part, we expect that the performance of key generationpart would be the most time consuming part of our algorithm.On the other hand, from the Table 6 it is clear that in signing of 59 bytes MQQ-SIG is faster thanRSA in the range from 565 up to 6836 times, and is faster than ECC in the range from 325 up to 517times.The verification speed in our code is not so distinctively faster than the corresponding RSA andECC since it is programmed for one core. We expect that the high parallelizable nature of MQQ-SIGcan be used to achieve much higher speeds in multicore systems (CPUs or GPUs).Security in bits Algorithm KeyGenSigning of59 bytesVerification of asignature of 59bytesRSA1024 102,869,553 2,230,848 61,11680 ECC160 1,201,188 1,284,800 1,476,196MQQSIG160 1,062,182,500 3,440 97,644RSA1536 322,324,721 7,346,420 123,14096 ECC192 1,799,284 1,895,752 2,242,988MQQSIG192 1,882,301,276 4,260 72,680RSA2048 786,466,598 14,815,324 174,792112 ECC224 2,022,896 2,108,556 2,501,108MQQSIG224 2,539,322,544 4,160 92,960RSA3072 2,719,353,538 31,941,760 315,904128 ECC256 2,296,976 2,418,968 2,833,856MQQSIG256 4,896,642,448 4,932 138,148Table 6. Comparison between performance of RSA, ECC and MQQ-SIG in CPU cycles in 64-bit mode ofoperation on Intel Core i7 920X machine running at 2 GHz.

The Digital Signature Scheme MQQ-SIG

The Digital Signature Scheme MQQ-SIG

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive