Embedded Surface Attack on Multivariate Public Key Cryptosystems from Diophantine Equation A dissertation submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy Department of Mathematical Sciences College of Arts and Sciences University of Cincinnati Author: Ai Ren Chair: Professor Jintai Ding Degrees: B.S. Mathematics, 2004, University of Science and Technology of China M.S. Information Systems, 2008, Benedictine University ii Abstract In 2011, Gao and Heindl proposed a family of Multivariate Public Key Cryp- tosystems by combining the triangular scheme and the oil-vinegar scheme. The new design was claimed to be secured under known attacks. Besides that, they also used the Medium-Field Multivariate Public Key Cryptosystem as an ex- ample of their general frame and explained how it works. Later, by introducing several Diophantine equations into their design, they presented the Diophan- tine Equations Multivariate Public Key Cryptosystem (DEMPKC) with three sets of suggested parameters and the claimed security level were high. In this paper, we present our cryptanalysis on DEMPKC. Our cryptanalysis uses embedded surfaces associated with the DEMPKC and shows the attack can break the system efficiently. Our work provides an example of more general embedded surfaces other than linearization type of equations can be very useful to attack cryptosystems. iii c by Ai Ren. All rights reserved. Acknowledgments Firstly, I want to thank Dr. Jintai Ding for his endless support, his patience, and immense knowledge. Jintai is very famous in the area of cryptography. He and his remarkable work provide us the opportunity of doing the important research. To me, he is not just an advisor but my family member. His guidance walked me throughout the graduate life in University of Cincinnati. Besides my advisor, I would like to thank many professors. They are Dr. Shuang Zhang, Dr. Bingyu Zhang, Dr. Ning Zhong, Dr. Donald A French, Dr. Seung Ki Kim, and Dr. Benjamin L Vaughan. With their help and support, my study and research became much easier. Last but most importantly, I would like to thank my family for their love and encouragement. For my lovely wife who has been so supportive, so en- couraging, and so patient. For my parents who raised me with love and have been showing faith in me and providing me everything. For my lovely kids who are the pride and joy of my life. My family, you are the best thing that has ever happened to me. v Contents Abstract iii Copyright iv Acknowledgments v 1. Introduction 1 1.1. Public Key Cryptography . 1 1.2. RSA . 8 1.3. Elliptic Curves Cryptography . 12 1.4. Quantum Computers and Shor's algorithm . 15 1.5. Post-Quantum Cryptography . 22 1.6. Multivariate Public Key Cryptography . 37 1.6.1. Family one: Explicit . 39 1.6.2. Family two: Implicit . 40 1.6.3. Matsumoto-Imai . 43 1.6.4. Encryption and Decryption . 46 1.6.5. Perturbation Masumoto-Imai . 48 1.6.6. HFE . 49 1.6.7. The Diophantine Equation MPKC . 49 2. Triangular Encryption Schemes 51 3. Oil-Vinegar Systems 56 vi 4. Combine Oil-Vinegar Scheme and Triangular Encryption Scheme 62 4.1. Define Extended Polynomial Ring . 62 4.2. Combing . 63 4.3. Example: Mediam Field Encryption (MFE) . 67 5. Cryptosystem from Diophantine Equations 70 5.1. Polynomial Identities and Diophantine Equations . 70 5.2. The Central Map . 79 5.3. Inverting the Central Map . 81 5.4. Practical Parameters and security claims . 84 6. Embedded surface attack 86 6.1. Embedded surface attack . 86 6.2. Step 1. Embedded surface attack . 99 6.3. Step 2. Derive new equations from the embedded surfaces . 103 6.4. Step 3. Reduce three variables . 108 6.5. Step 4. Solve the system . 110 6.6. General introduction on F4 . 110 6.7. The complexity of the attack . 113 6.8. The complexity for attacking the other two systems . 114 6.9. Experiments results . 115 7. Conclusion 117 7.1. Summary of accomplishments . 117 7.2. Impact of our work . 118 7.3. Ideas for future research . 118 Bibliography 120 A. Appendix 125 vii Chapter 1 Introduction 1.1. Public Key Cryptography Cryptography is the study and practice of methods for secure communication. During the communication process of sending private information from the sender to the intended receiver, the private information will be exposed to unexpected parties and will face the risk of being changed or stolen by the unexpected parties. The cryptography will help us to secure the communica- tion of confidential information. In this confidential information transaction process, we call the original information as plain text and the encrypted infor- mation as cipher text. Cryptography is concerned with four main facts of data transfer: Integrity, Authenticity, Confidentiality and Non-repudiation. To ac- complish those, cryptography has various solutions. According to the way how 1 the system shares keys, there are two types of cryptography systems: private key cryptography and public key cryptography. Private key cryptography requires two parties, the sender and the intended receiver, to share the key before they start to exchange messages confidentially over a public channel. This key is called Private Key because it must be kept in private in order to avoid being used to restore the original message by the unexpected third party during the communication. Caesar's cipher is one of the most ancient and famous methods of private key cryptography. It was named after Julius Caesar and was used to protect military message. The general idea of Caesar's cipher was a simple shift of the alphabet. For instance, with a left shift of 3, Z would be replaced by W, Y would be replaced by V, X would be replaced by U and so on. The private key of this Caesar's cipher could be described as the following table: plain text A B C D E F G H I J K L M cipher text X Y Z A B C D E F G H I J plain text N O P Q R S T U V W X Y Z cipher text K L M N O P Q R S T U V W To encrypt a message, the sender encodes the original message by looking up each individual letter in plain text as described above and finding the cor- responding cipher text. The decryption can be done reversely. 2 A modern way to describe the Caesar's cipher is given as follows: we assign an index number to each of the 26 letters, in the ring Z=26Z. More precisely, index letter A to 0, B to 1, C to 2. , X to 23, Y to 24, and Z to 25. Every letter has a unique index. This assignment allows us to convert any plain text into a string of numbers between 0 and 25. With a left shift of 3, we can simply apply the function as follows: F : Z=26Z ! Z=26Z F (m) = m + 3 mod 26: where m is the index of the letter from original information. It is very clear that if some unexpected party learned the private key, which is left shift of 3 in this case, the cipher text can be decrypted easily. For private key cryptography, therefore, the private key must be kept in private . Public key cryptography does not require the sender and the receiver to exchange any private keys prior to the communications. Unlike private key cryptography, knowledge of the sender's private key does not help anyone to compute the receiver's private key. This is the reason why public key cryp- tography is also called asymmetric cryptography. In 1976, Whitfield Diffie and Martin Hellman firstly published the idea [DH06]. In their design, the holder firstly needs to establish a pair of keys: one public key for encryption purpose and one matching private key for decryption. This public key will 3 be published in an open channel and the private key must be kept securely by the holder. Any party, other than the holder, who is willing to send mes- sages or information to the holder confidentially needs to use the public key and the cryptosystem algorithm to encrypt the message or information into a cipher text. Then this cipher text can be sent from the sender to the private key holder. After the holder received the cipher text, the private key can be used to decrypt the cipher text and the plain text { the original message is restored. The information transaction is over a public channel which means there might be a third party who can also obtain the cipher text. Without knowing holder's private key or successfully cryptanalyzing the private key, the third party would not be able to decrypt the cipher text nor the original mes- sage. The significant difference between the private key cryptography and the public key cryptography is that it is possible to create a secured communica- tion channel for any two parties without any prior contact or any preliminary information exchange. Public key cryptography makes the modern world communication safe and possible. Nowadays, people are no longer forced to go out and wait in the line for shopping during the ice cold weather. People can stay at home, sit in front of computer, browse the webs and pay through the internet on eBay. Without public key cryptography, online shopping would be incredibly insecured. At Christmas, eBay posts many deals and great products to the customers. Tom and Jerry decided to celebrate Christmas this year and buy themselves some 4 nice gifts. Jerry liked American cheese which was on sale on eBay.