A Polynomial-Time Key-Recovery Attack on MQQ Cryptosystems - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2015

A Polynomial-Time Key-Recovery Attack on MQQ Cryptosystems

Jean-Charles Faugère
Ludovic Perret
  • Fonction : Auteur
  • PersonId : 935330
  • IdRef : 123278864

Résumé

We investigate the security of the family of MQQ public key cryptosystems using multivariate quadratic quasigroups (MQQ). These cryptosystems show especially good performance properties. In particular, the MQQ-SIG signature scheme is the fastest scheme in the ECRYPT benchmarking of cryptographic systems (eBACS). We show that both the signature scheme MQQ-SIG and the encryption scheme MQQ-ENC, although using different types of MQQs, share a common algebraic structure that introduces a weakness in both schemes. We use this weakness to mount a successful polynomial time key-recovery attack. Our key-recovery attack finds an equivalent key using the idea of so-called {\it good keys} that reveals the structure gradually. In the process we need to solve a MinRank problem that, because of the structure, can be solved in polynomial-time assuming some mild algebraic assumptions. We highlight that our theoretical results work in characteristic $2$ which is known to be the most difficult case to address in theory for MinRank attacks. Also, we emphasize that our attack works without any restriction on the number of polynomials removed from the public-key, that is, using the minus modifier. This was not the case for previous MinRank like-attacks against \MQ\ schemes. From a practical point of view, we are able to break an MQQ-SIG instance of $80$ bits security in less than $2$ days, and one of the more conservative MQQ-ENC instances of $128$ bits security in little bit over $9$ days. Altogether, our attack shows that it is very hard to design a secure public key scheme based on an easily invertible MQQ structure.
Fichier principal
Vignette du fichier
811.pdf (487.04 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01074194 , version 1 (23-12-2014)

Identifiants

  • HAL Id : hal-01074194 , version 1

Citer

Jean-Charles Faugère, Danilo Gligoroski, Ludovic Perret, Samardjiska Simona, Enrico Thomae. A Polynomial-Time Key-Recovery Attack on MQQ Cryptosystems. IACR International Conference on Practice and Theory of Public-Key Cryptography (PKC'15), Mar 2015, Maryland, United States. ⟨hal-01074194⟩
444 Consultations
189 Téléchargements

Partager

Gmail Facebook X LinkedIn More