Copyright 2012, Toshiba Corporation. A Survey on the Algebraic Surface Cryptosystems Koichiro Akiyama ( TOSHIBA Corporation ) Joint work with Prof. Yasuhiro Goto 2013/03/02

2 Contents 1.Introduction Public key cryptosystem, Motivation 2.Section Finding Problem A Computational Hard Problem on Algebraic Surface 3.Algebraic Surface Public-key Cryptosystem Encryption/Decryption/Key Generation Algorithms 4.Known Attacks － Rational Point Attack － Ideal Factorization Attack 5.Conclusion and Future Research A Survey on the Algebraic Surface Cryptosystems

3 Contents 1.Introduction Public key cryptosystem, Motivation 2.Section Finding Problem A Computational Hard Problem on Algebraic Surface 3.Algebraic Surface Public-key Cryptosystem Encryption/Decryption/Key Generation Algorithms 4.Known Attacks － Rational Point Attack － Ideal Factorization Attack 5.Conclusion and Future Research A Survey on the Algebraic Surface Cryptosystems

4 sHueLjOl8k7 Public key Cryptosystem ( Concept ) B’s Public Key Ex. Integer Factorization Computational Hard Problem Security of public key cryptosystem relies on the the problem which is hard to compute. Hello World B’s Secret Key Hello World Sender A Receiver B A Survey on the Algebraic Surface Cryptosystems

5 Motivation Want to construct public-key cryptosystems having following features –Resistant against known attacks by quantum computer. ( Not based on the factorization or discrete logarithm problems. ) –Fast in process time & compact in size. –Based on a hard problem in algebraic geometry. Our target is an algebraic surface A Survey on the Algebraic Surface Cryptosystems

6 Comparison with other cryptosystems RSA Elliptic Curve Cryptosystem Multivariate Cryptosystems Fast & compact Algebraic Surface Cryptosystem (1) Short Public key (2) Higher Dimensional Equations Public key size : number of valuables higher degree (>3) equationsQuadratic equations A Survey on the Algebraic Surface Cryptosystems

7 This talk Easy for Quantum Computer Design Encryption Algorithm Next talk Construction for Public Key Cryptosystem Selection of Hard Problem Call for Attack Start Define the secure parameters Elementary Algorithm Optimized Algorithms Practical implementation Improvement Attack Success! Security Proof Size of the parameter Hardness Security requirement RSA Cryptosystem Factoring Problem Easy Hard Algebraic Surface Cryptosystem Hard even for Quantum Computer Easy Section Hard The Section Finding Problem Algebraic Surface Secure parameter A Survey on the Algebraic Surface Cryptosystems

8 Contents 1.Introduction Public key cryptosystem, Motivation 2.Section Finding Problem A Computational Hard Problem on Algebraic Surface 3.Algebraic Surface Public-key Cryptosystem Encryption/Decryption/Key Generation Algorithms 4.Known Attacks － Rational Point Attack － Ideal Factorization Attack 5.Conclusion and Future Research A Survey on the Algebraic Surface Cryptosystems

9 Algebraic Surface An algebraic surface (we use) is a 2-dimensional affine algebraic variety with fibration. We consider algebraic surfaces defined over a finite field. where is small enough to calculate, but need not be 2. A Survey on the Algebraic Surface Cryptosystems

10 Section Finding Problem ( SFP ) Algebraic Surface section hard easy A Survey on the Algebraic Surface Cryptosystems

11 General Solution of SFP To solve the SFP, we put the section as follows: ( are variables ) The SFP is reduced to multivariable equations Substitute into, we obtain A Survey on the Algebraic Surface Cryptosystems

12 Contents 1.Introduction Public key cryptosystem, Motivation 2.Section Finding Problem A Computational Hard Problem on Algebraic Surface 3.Algebraic Surface Public-key Cryptosystem Encryption/Decryption/Key Generation Algorithms 4.Known Attacks － Rational Point Attack － Ideal Factorization Attack 5.Conclusion and Future Research A Survey on the Algebraic Surface Cryptosystems

13 （ are given ） Keys 1.System parameters –Size of finite field : prime –Degree of section : 2.Public key –Algebraic surface –Form of the plaintext polynomial –Form of the divisor polynomial 3.Secret key –Section (example) ( are given ） A Survey on the Algebraic Surface Cryptosystems

14 Form of the plaintext polynomial For example, and Form described the formula as fllows: indicates an element of are designated. A Survey on the Algebraic Surface Cryptosystems

15 plaintext m embedded to m(x,y,t) In the case of In the case of plaintext must be divided into 2bits block So the plaintext described as Therefore m embedded to m(x,y,t) as coefficients A Survey on the Algebraic Surface Cryptosystems

16 Encryption Random polynomial Divisor polynomial Public Key ： algebraic surface Randomize （ operations ） message embed Message poly. Cipher text A Survey on the Algebraic Surface Cryptosystems

17 Decryption Secret key: Section message polynomial Cipher factoring Section substitute message Public key PlaintextRandom Solve linear equations Random A Survey on the Algebraic Surface Cryptosystems

18 Key generation Public key: algebraic surface Coefficients other than constant term Secret key : section Select randomly Calculate the constant term A Survey on the Algebraic Surface Cryptosystems

19 Contents 1.Introduction Public key cryptosystem, Motivation 2.Section Finding Problem A Computational Hard Problem on Algebraic Surface 3.Algebraic Surface Public-key Cryptosystem Encryption/Decryption/Key Generation Algorithms 4.Known Attacks － Rational Point Attack － Ideal Factorization Attack 5.Conclusion and Future Research A Survey on the Algebraic Surface Cryptosystems

20 Rational point attack ( 1 ) where subtract Remove the plaintext polynomial A Survey on the Algebraic Surface Cryptosystems

21 Rational point attack ( 2 ) substitution = construct Solve Linear Equation factoring extract Success! rational points A Survey on the Algebraic Surface Cryptosystems

22 Rational point attack ( 3 ) = = substitution reconstruct Solve linear equations rational points A Survey on the Algebraic Surface Cryptosystems

23 which is in the same form of and satisfy. If is a solution, there exists polynomial For arbitrary which is in the same form of, We can avoid the attack, when we select the form of which has enough polynomials not to be able to identify the correct one. Counter measure against RPA = and are in the same form This is also another solution A Survey on the Algebraic Surface Cryptosystems

24 Ideal factorization attack Cipher text Ideal Factoring where Solve Linear Eq. A Survey on the Algebraic Surface Cryptosystems

25 Sequence of events on ASC Jan st version was proposed in domestic conference May st version was presented in international conference PQC2006 Jintai Ding pointed out a flaw in our system Oct nd version was presented in AMS conference.. Jan 2007 Shigenori Uchiyama proposed an attack against 2 nd version. Apr 2007 Felipe Voloch proposed another attack against 2 nd version Jan rd version was proposed in domestic conference. Mar rd was presented in international conference PKC2009 May 2010 Jean-Charles Faugere( INRIA ) proposed an attack against 3rd version. Now We are preparing 4 th version whose security is equivalent to SFP. A Survey on the Algebraic Surface Cryptosystems

26 Contents 1.Introduction Public key cryptosystem, Motivation 2.Section Finding Problem A Computational Hard Problem on Algebraic Surface 3.Algebraic Surface Public-key Cryptosystem Encryption/Decryption/Key Generation Algorithms 4.Known Attacks － Rational Point Attack － Ideal Factorization Attack 5.Conclusion and Future Research A Survey on the Algebraic Surface Cryptosystems

27 Conclusions We showed a new type of public-key cryptosystem using an algebraic surface. –We showed the algorithm for encryption, decryption and key generation. Our contributions are –The public key size is O(n). –Our cryptosystem is associated higher general equations than multivariate cryptosystems. ( contains equation which degree is more than 3) A Survey on the Algebraic Surface Cryptosystems

28 Next Talk Construct a secure algorithm –We try to construct a provable secure cryptosystem Determine the recommendable parameter size –We developed an efficient algorithm to solve the SFP. –Now we estimate computational complexity by computational experimentation. Open Problems A Survey on the Algebraic Surface Cryptosystems

29The Algebraic Surface Cryptosystem and its security