Ultra-Short Multivariate Public Key Signatures { with Public Keys of Degree 2 { Jacques Patarin1, Gilles Macario-Rat2, Maxime Bros3, and Eliane Koussa1 1 Versailles Laboratory of Mathematics, UVSQ, CNRS, University of Paris-Saclay
[email protected],
[email protected] 2 Orange, Orange Gardens, 46 avenue de la R´epublique,F-92320 Ch^atillon,France
[email protected] 3 University of Limoges, CNRS, XLIM, UMR 7252, F-87000 Limoges, France
[email protected] Abstract. In this paper, we study and construct multivariate schemes with \ultra-short" signatures. We focus on the classic case where the public key is a set of multivariate polynomials of degree 2. To design ultra-short signature schemes, we consider that signing a mes- sage and verifying a signature could require up to 1 minute of computa- tion on a modern personal computer. Shorter time could be considered but at the cost of a few additional bits in the signatures, more generally, a trade-off may be found between computation time and signature size, depending on the applications one is targeting. Despite the fact that a time of 1 minute is far bigger than the time re- quired by general purpose multivariate-based signature schemes, such as Rainbow, GeMMS, and Quartz, it enables us to reach ultra-short signa- ture lengths; for instance, around 70 bit-long signatures for a security of 80 bits. In a first part, we describe generic and specific attacks against multivari- ate public key signature schemes and use them to derive the minimal parameters that an ultra-short signature scheme could have.