New candidates for multivariate trapdoor functions

. We present a new method for building pairs of HFE polynomials of high degree, such that the map constructed with such a pair is easy to invert. The inversion is accomplished using a low degree polynomial of Hamming weight three, which is derived from a special reduction via Hamming weight three polynomials produced by these two HFE polynomials. This allows us to build new candidates for multivariate trapdoor functions in which we use the pair of HFE polynomials to fabricate the core map. We performed the security analysis for the case where the base ﬁeld is GF (2) and showed that these new trapdoor functions have high degrees of regularity, and therefore they are secure against the direct algebraic attack. We also give theoretical arguments to show that these new trapdoor functions over GF (2) are secure against the MinRank attack as well.


Introduction
The public key cryptosystems currently used in practice are based on the difficulty of factoring large integers or solving the Discrete Logarithm Problem.In 1996 P. Shor published an algorithm to solve both problems in polynomial time on a quantum computer [17].Some experts argue that it is possible to build in the coming years a quantum computer, which is a threat to our modern communication system.This leads to the recent fast development of Post-Quantum Cryptography .Post-Quantum Cryptography refers to the study of cryptosystems that have the potential to resist the possible future quantum computer attacks [1].
Multivariate Public Key Cryptography (MPKC) is part of the Post-Quantum Cryptography.In MPKC, the public key consists of a set of multivariate quadratic polynomials over a finite field.One of the main cryptosystems in MPKC is named Hidden Field Equations (HFE), proposed by Patarin in 1996 [16].The public key in HFE is formed by "hiding" a core polynomial F by two invertible affine transformations, and using the vector space structure of a field extension of the base field.
A crucial part in HFE is the choice of the degree D of the core polynomial F .The degree D cannot be too big, since otherwise the decryption process would not be efficient.The main attacks against HFE, direct algebraic attack ( [10,5,6,14,15]) and the Kipnis-Shamir MinRank attack (KS attack [13]), exploit this fact.For characteristic 2, HFE is vulnerable to the direct algebraic attack [10].Recently, some authors improved the KS attack and were able to break certain HFE systems, over both odd and even characteristic [2].
We propose a special reduction method to construct new candidates for trapdoor functions using HFE polynomials of high degree.The use of these high degree polynomials prevents the known attacks against HFE.This opens the possibility to build a secure variant of the HFE cryptosystem.
The idea of the construction is inspired by the first steps of the Zhuang-Zi algorithm [7].Given a finite field k of size q and a field extension K of degree n, we consider two high degree HFE polynomials over K of the form F (X) = a ij X q i +q j + b i X q i + c and F (X) = ãij X q i +q j + bi X q i + c, where the coefficients a ij , b i , c, ãij , bi , c ∈ K are to be determined.The idea behind the method is to construct a low degree polynomial Ψ of Hamming weight three of the form where F 0 , F 1 , • • • , F n−1 are the Frobenius powers of F , and F0 , F1 , • • • , Fn−1 are the Frobenius powers of F .
To obtain such a polynomial Ψ we need to determine the coefficients of F and F , also the scalars α i and β i , such that the degree of Ψ is less than or equal to a fixed positive integer D 0 (the integer D 0 is such that we can easily invert Ψ using Berlekamp's algorithm).To achieve this, we derive a system of equations from the vanishing coefficients of the terms in Ψ of degree higher than D 0 .After randomly choosing in this system the scalars α i and β i , we get a linear system with more variables than equations, and thus we can guarantee nontrivial solutions for it.This linear system has about n 3 variables and therefore we have to deal with huge matrices to reach large values of n.On the plus side we have that these matrices are sparse, which is an advantage in terms of efficiency.
The new multivariate trapdoor function is built in a similar way to the HFE scheme (composition with invertible affine transformations), except that now the core map is replaced by the map G = (F, F ).The main part of the inversion of the trapdoor function is to invert the map G, which is achieved using the low degree Hamming weight three polynomial Ψ and the scalars α i , β i .
To construct our new candidate for trapdoor function we use these high degree HFE polynomials for the core map with the expectation that this trapdoor function has high degree of regularity, very different from what was observed by Faugère and Joux [10] for a system of quadratic equations derived from a single HFE polynomial with low degree.For the case of q = 2, our extensive experiments confirmed that the new trapdoor function has high degree of regularity (it increases as n increases).This high degree of regularity shows that our new candidates for multivariate trapdoor functions are secure against the direct algebraic attack.
Furthermore, for the case of q = 2, we can give a theoretical argument to show why the MinRank attack does not work against the new trapdoor functions, based on some results about the degree of regularity obtained by Ding and Hodges [8].From those results, we see that, for q = 2, it suffices to make sure that our trapdoor function has a high degree of regularity to conclude that both the direct algebraic and KS MinRank attacks do not work against these new trapdoor functions.We show that this is indeed the case and that our new trapdoor functions are secure against these two attacks.For larger values of q, this argument cannot be used and the MinRank attack must be directly performed against these new trapdoor functions.
The method described here was not our first attempt to reduce high degree HFE polynomials along the same line.Among failed attempts, we considered using a single polynomial F , but the linear systems we needed to solve had more equations than variables and then we could not guarantee nontrivial solutions for them.This lead us to use two HFE polynomials instead of one in order to get a linear system with more variables than equations and this gives the construction in this paper.This paper is organized as follows.First, we present some background material about HFE cryptosystems.Secondly, we describe the method for building the new candidates for multivariate trapdoor functions.Next, we present a toy example to explain step by step our method, and two big examples.Then, we carry out a security analysis and discuss future work.In the appendix we show some data about the generation of the new trapdoor function.

Background
The cryptosystem Hidden Field Equations (HFE) was proposed by Patarin in 1996 [16].The public key is formed by "hiding" a core polynomial F via two invertible affine transformations, and taking advantage of the vector space structure of an extension of the base field.
Let k be a finite field of size q.Fix n ∈ N and take an irreducible polynomial g over k of degree n.Consider the field extension K = k[y]/ (g(y)).Then K ∼ = k n , via the isomorphism ϕ : K → k n defined by We say that a polynomial has Hamming weight W if the maximum of the q-Hamming weights of all its exponents is W .The q-Hamming weight of a non-negative integer is the sum of the q-digits of its q-nary expansion.Let F : K → K be a Hamming weight two polynomial of the form where the coefficients a ij , b i , c are chosen randomly in K.Such a polynomial F is called an HFE polynomial.If in addition, we require that deg(F ) ≤ D, where D is a fixed positive integer, we say that F is an HFE polynomial with bound D.
For a fixed D, an HFE cryptosystem is built as follows.First, we randomly choose an HFE polynomial with bound D, say F : K → K.Then, we randomly choose two invertible affine transformations S and T over k n .The public key P is the composition of F with the transformations S and T , together with the isomorphism ϕ, i.e., Notice that P is an n−tuple of the form where each P i is a multivariate quadratic polynomial.The private key consists of the core map F together with the transformations S and T .
When constructing an HFE cryptosystem we need to be very careful with the choice of the bound D. This bound cannot be too high, since this would affect the decryption process, making it inefficient.Also, D cannot be too small, because this would make the system vulnerable to the algebraic and KS attacks.
Many attempts have been made to build safe HFE variants for both digital signatures and encryption schemes [12,9,4,11].However, most of them have not been successful.One of the latest, Multi-HFE [11], proposes to use as core map a system of multivariate polynomials over K, instead of a single HFE polynomial.This cryptosystem was broken by means of a generalization of the Kipnis-Shamir MinRank attack [2].
In the next section we present a procedure to generate a low degree polynomial of Hamming weight three, which can be used to invert a map constructed with two high degree HFE polynomials.This idea enables us to build candidates for trapdoor functions using high degree HFE core polynomials, preventing the attacks that we mentioned earlier.

Construction of new candidates for multivariate trapdoor functions
The weakness of the HFE cryptosystem lies on the use of a low degree core polynomial F .This polynomial is used for both encryption and decryption.
The process of decryption involves inverting the map F (search of pre-images).Therefore, if we take a polynomial of high degree the decryption could be impossible, and if otherwise we take a polynomial of low degree the attacks mentioned above would work.
To overcome this weakness, we developed a method for building pairs of HFE polynomials of very high degree, and such that the map constructed with such a pair is easy to invert, using a low degree polynomial derived from a special reduction via Hamming weight three polynomials.This low degree polynomial is easy to invert by means of Berlekamp's algorithm.In this way, we are able to use two HFE polynomials of high degree to construct a new candidate for a trapdoor function, and a polynomial of small degree as the trapdoor used to invert such trapdoor function.

The Reduction method
Let F : K → K and F : K → K be two high degree HFE polynomials of the form where the coefficients and Fi (X) = F (X) Let D 0 be an upper bound for the degree of a univariate polynomial equation that can be solved efficiently using Berlekamp's algorithm.
The key part of this method is to construct a polynomial Ψ of the form Notice that Ψ is a Hamming weight three polynomial.
To accomplish this, we need to determine the coefficients of F and F , also the scalars α i and β i , such that the coefficients of the terms in Ψ of degree greater than D 0 are equal to zero.We derive a system of equations from these vanishing coefficients in Ψ of degree higher than D 0 .This yields a system of equations of the form where the variables z 1 , z 2 , • • • , z N are the coefficients of F and F , together with the scalars α i and β i .
The number t of equations of this system depends on how small we want the degree bound D 0 to be.More precisely, t is the number of different terms in Ψ with degree higher than D 0 .To invert the trapdoor function, which we will describe in Section 3.3, via the use of the polynomial Ψ, we require that the polynomial Ψ has degree smaller than D 0 .
If we write each variable z j in terms of the basis 1, y, • • • , y n−1 , we obtain a system of quadratic equations.More precisely, each variable z j in this system can be written in the form where u 1j , • • • , u nj are n new variables.Next, by the linearity of the Frobenius powers, we get After we write each power y m as a linear combination of the elements of the basis 1, y, • • • , y n−1 with coefficients in k, and group like terms, we get that where each h ij is a linear function with coefficients in k.
We now write each variable of the system g 1 = 0, • • • , g t = 0 in the form (1), and proceed like in (2) and (3).By comparing the coefficients of the elements of the basis 1, y, y 2 , • • • , y n−1 we obtain a system of nt quadratic equations in n [n(n + 1) + 6n + 2] = n 3 + 7n 2 + 2n variables over k.These equations are in fact bilinear, i.e., each term of these equations has the product of a variable that comes from the coefficients and a variable that comes from the scalars.Thus, if we randomly fix the variables associated to the scalars we obtain a sparse linear system coming from the coefficients of F and F .Due to its construction, this linear system has more variables than equations, i.e., nt < n 3 + 7n 2 + 2n, and hence we can always get nontrivial solutions.We then randomly choose one of those solutions to build the high degree polynomials F and F and the reduced polynomial Ψ of degree less than or equal to D 0 , as explained above.
One could be tempted to randomly choose the variables coming from the coefficients of F and F , and then try to solve the linear system for the variables coming from the scalars, with the purpose of having generic core polynomials F and F .However, this approach leads to a linear system with more equations than variables, and thus, in general, this system has no nontrivial solutions.

Complexity of the reduction method and dimension of the solution space
The described method leads to a sparse linear system over the small field k with more variables than equations.This system has about n 3 variables and thus the complexity of the reduction method is polynomial: O n 3 ω , where ω is a constant that depends on the elimination algorithm used to solve the sparse linear system.
On the other hand, after we choose the 4n scalars α i and β i in the system we get a new system over the big field K with t equations and N − 4n variables (the coefficients of F and F ). Therefore, in this new system the number of variables exceeds the number of equations by (N − 4n) − t.Hence the final linear system over the small field k has at least n ((N − 4n) − t) free variables.Then we have at least q n((N −4n)−t) > q n possible choices for the coefficients of the polynomials F and F .Thus, if we choose large parameters q and n, and if we randomly choose a solution from the solution space, it is impossible for anyone to guess correctly the polynomials we will use.The large dimension of the solution space also ensures that there are sufficiently many choices for the core map.

How to build and invert the trapdoor function
For building a new candidate for multivariate trapdoor function, we make use of a map of the form G = (F, F ) : K → K × K, in which F and F have been constructed by the method described in Section 3.1.We select two invertible affine transformations S : k n → k n and T : k 2n → k 2n .Similar to HFE, the multivariate trapdoor function will be the composition from k n to k 2n given by P = T • (ϕ × ϕ) • G • ϕ −1 • S (see Figure 1).The crucial part to invert the trapdoor function is to invert the core map G = (F, F ), since the transformations S and T , and the isomorphism ϕ, are easy to invert.In what follows we explain how to invert G. Consider an element be the Frobenius powers of F .By the construction of F and F , there exist scalars α Fi−1 has degree less than or equal to D 0 .
We define F = F − Y 1 and F = F − Y 2 , and Clearly, F (X 0 ) = 0 and F (X 0 ) = 0, and therefore Ψ (X 0 ) = 0. Given that 2 , the polynomial Ψ , just like Ψ, has degree less than or equal to D 0 , when we choose D 0 ≥ q.Thus, we can find the roots of Ψ by means of Berlekamp's algorithm and therefore we can recover the common root X 0 of the polynomials F and F .
We now discuss the complexity of the trapdoor function inversion.The isomorphism ϕ and its inverse ϕ −1 can be represented in matrix form [2]. Thus, except for the inversion of the core map G, the computational cost of each step of the algorithm to invert the trapdoor function is the cost of a matrix multiplication.The degrees of the polynomials F and F , which are the components of the map G, are extremely high (usually close to q n−1 ), which makes impossible to invert G directly for practical values of n.However, as noted above, the inversion of the map G can be reduced to finding the roots of the low degree polynomial Ψ , which can be done efficiently using Berlekamp's algorithm.For the particular case of q = 2, in all the computations that we performed we were able to obtain a function Ψ of degree less than 500, whose roots can be found very quickly using Berlekamp's algorithm.Therefore, inverting the trapdoor function is a very efficient process.

Examples
We now show some examples built by the method described in Section 3.1.We begin by presenting a toy example in which we explain step by step the procedure.We next show two large scale cases.
Example 1.Let q = 2 and n = 2, and consider the field with two elements k = GF (2).We select the irreducible polynomial g(y) = y ).We choose a generator b ∈ K of the multiplicative group of K such that g(b) = 0. Two HFE polynomials in the ring K[X]/ X q n − X are of the form The Frobenius powers of F and F , in that order, are: . We now multiply the Frobenius powers by X and X q and we obtain Then we form the polynomial Ψ = X(α In this example we want to determine the coefficients a ij , b i , c, ãij , bi , c and the scalars α i , β i such that the terms of degree ≥ 2 in Ψ vanish.In order to do that, we have to solve the following two equations ).Then we write the variables a 01 , b 0 , b 1 , c, ã01 , b0 , b1 , c in terms of the basis 1, y, • • • , y n−1 , as follows: Proceeding as explained in Section 3.1, we get the linear equations u 1 + u 7 + u 10 + u 14 + u 16 = 0, u 1 + u 7 + u 10 + u 13 + u 16 = 0, u 4 + u 5 + u 6 + u 11 + u 13 = 0, One of the solutions of this system is This solution leads to the coefficients With these coefficients we get the polynomials F = X 2 + b 2 X + b 2 and F = bX 3 + b 2 X 2 + b 2 X + b.Then, we use the scalars α i and β i to form the reduced polynomial Ψ = b 2 X.
Example 3.With q = 2 and n = 60, and taking the coefficients and the scalars in the big field K, we found a pair of polynomials F and F with the same degree D and log q D = 59.The reduced polynomial Ψ that we found has degree 386.Hence, we can invert easily the map G = (F, F ) via the low degree polynomial Ψ using Berlekamp's algorithm.These polynomials are too big to be displayed here.In this example we needed to deal with a sparse matrix of size 208080 × 226800 and the time and memory used were 4.6 days and 52.7 GB, respectively.

Security analysis
As we noted before, there are two attacks that have threatened the security of HFE schemes: direct algebraic attack and Kipnis-Shamir MinRank attack.Here we analyze these attacks against the new candidates for multivariate trapdoor functions in the special case q = 2.
We would like to recall the recent result on the degree of regularity of Ding and Hodges [8].We know that for an HFE system P the degree of regularity is bounded by (q − 1) Q-Rank(P ) 2 + 2, where Q-Rank(P ) is the quadratic rank for the quadratic operator P .So for q = 2 we have that this degree of regularity is bounded by Since the corresponding quadratic rank used in the Kipnis-Shamir MinRank attack is given by Q-Rank(P ), we see that if an HFE system has a high degree of regularity, this HFE system must have a high quadratic rank for the Kipnis-Shamir attack.From this we conclude that it suffices to show that our new trapdoor functions have high degree of regularity, in order to demonstrate that the MinRank attack will not work against these new trapdoor functions.We dedicate the rest of this section to discuss the algebraic attack against the new trapdoor functions.
Suppose that someone, who does not know the private trapdoor information, wants to invert the multivariate trapdoor function P : (P 1 , . . ., P 2n ), i.e., she wants to find a pre-image of an element (y 1 , . . ., y 2n ) ∈ Im P ⊆ k 2n .This person only has access to the trapdoor function P .Attempting to solve directly the system of equations is what we call the direct algebraic attack.One way to do this is with the help of a Gröbner basis.We ran extensive experiments using the F 4 algorithm of MAGMA, [3], to perform the direct algebraic attack for q = 2 and several values of n, on a Sun X4440 server, with four Quad-Core AMD OpteronTM Processor 8356 CPUs and 128 GB of main memory (each CPU is running at 2.3 GHz).
For the trapdoor functions used in these experiments we utilized D 0 = 500.The results of our experiments are shown in Table 1 and 2, and Figure 2, 3 and 4. The F 4 function of MAGMA is the most efficient implementation of the Gröbner F 4 algorithm that is currently available.
In Table 1 and Figure 2 we can observe that the time needed to solve the equations by F 4 has an exponential growth in n.We can also see this behaviour with the memory used by the F 4 algorithm.This situation is different from the one observed by Faugere and Joux in [10].The difference lies on the fact that in [10] the quadratic equations are produced using a polynomial of fixed low degree as core map in the HFE cryptosystem, and in our new trapdoor function the quadratic equations are generated via two high degree polynomials.In our experiments, in general, these two high degree polynomials have the same degree D and this degree increases as n increases (see Table 1).This is the fundamental security improvement of our new method.Another evidence that the complexity of the algebraic attack against the new trapdoor functions is exponential, is that the degree of regularity of the trapdoor function increases as n increases.This behaviour can be observed in Figure 3.As we mentioned earlier, the fact that this degree of regularity increases as n increases, not only says that the direct algebraic does not work against the new trapdoor functions, but also that the Kipnis-Shamir MinRank attack is not successful against these new trapdoor functions.
We also chose random quadratic equations of the same dimensions (k n → k 2n ) and found that the time needed to solve such equations using Gröbner bases is essentially the same that is needed to solve the quadratic equations from the new trapdoor function.Table 2. Algebraic attack comparison between the new trapdoor function and random equations for q = 2.
In Table 2 we can notice that the degree of regularity of the new trapdoor function is the same as the degree of regularity of the set of random equations.In both cases we observe that the degree of regularity increases as n increases.From all the information we collected with our experiments, it seems that the F 4 algorithm is no more efficient in solving the equations from the new trapdoor function than a set of random equations of the same dimensions.In other words, with respect to the direct algebraic attack, the new trapdoor function behaves as if it were a system of random quadratic equations.

Conclusions and future work
We have created a procedure to build candidates for multivariate trapdoor functions using pairs of HFE polynomials of high degree.The way to invert these trapdoor functions is through a low degree polynomial of Hamming weight three.We have shown how the main attacks against HFE do not work for these new trapdoor functions for the particular case of q = 2.The next step in our research is to use the ideas of this paper to construct candidates for multivariate trapdoor functions for larger values of q.The benefit of doing this is that the larger the value of q is, the smaller the value of n is, and so the smaller the sizes of the matrices needed to construct the trapdoor functions are.This would significantly reduce the time and memory needed to construct the multivariate trapdoor functions.It would also be important to study the effect that the matrix sparsity has on the complexity of the algorithm used to construct the new trapdoor functions.
In Section 5 we saw that for q = 2 it suffices to show that the new trapdoor functions have high degree of regularity to conclude that the Kipnis-Shamir MinRank attack does not work against these trapdoor functions.However, for larger values of q this argument cannot be used and the MinRank attack must be directly performed against these new trapdoor functions.We are currently starting to work these cases and we will publish the results in an upcoming paper.

Figure 1 .
Figure 1.New candidate for multivariate trapdoor function.

Figure 4 .
Figure 4. Algebraic attack comparison between the new trapdoor function and random equations.

Table 1 .
Algebraic attack against the new trapdoor function for q = 2.

Table 2 and
Figure 4show this comparison between the new trapdoor functions and random equations for different values of n.