Kuang Randy, Perepechaenko Maria, Barbeau Michel
Quantropi Inc., Ottawa, Ontario, K1Z 8P8, Canada.
School of Computer Science, Carleton University, Ottawa, K1S 5B6, Canada.
Sci Rep. 2022 Aug 1;12(1):13168. doi: 10.1038/s41598-022-15843-x.
We propose a new quantum-safe digital signature algorithm called Multivariate Polynomial Public Key Digital Signature (MPPK/DS). The core of the algorithm is based on the modular arithmetic property that for a given element g, greater than equal to two, in a prime Galois field GF(p) and two multivariate polynomials P and Q, if P is equal to Q modulo p-1, then g to the power of P is equal to g to the power of Q modulo p. MPPK/DS is designed to withstand the key-only, chosen-message, and known-message attacks. Most importantly, making secret the element g disfavors quantum computers' capability to solve the discrete logarithm problem. The security of the MPPK/DS algorithm stems from choosing a prime p associated with the field GF(p), such that p is a sum of a product of an odd prime number q multiplied with a power x of two and one. Given such a choice of a prime, choosing even coefficients of the publicly available polynomials makes it hard to find any private information modulo p-1. Moreover, it makes it exponentially hard to lift the solutions found modulo q to the ring of integers modulo p-1 by properly arranging x and q. However, finding private information modulo the components q and power x of two is an NP-hard problem since it involves solving multivariate equations over the chosen finite field. The time complexity of searching a private key from a public key or signatures is exponential over GF(p). The time complexity of perpetrating a spoofing attack is also exponential for a field GF(p). MPPK/DS can achieve all three NIST security levels with optimized choices of multivariate polynomials and the generalized safe prime p.
我们提出了一种名为多元多项式公钥数字签名(MPPK/DS)的新型抗量子数字签名算法。该算法的核心基于模运算性质:对于素伽罗瓦域GF(p)中给定的大于等于2的元素g以及两个多元多项式P和Q,若P模p - 1等于Q,则g的P次幂模p等于g的Q次幂。MPPK/DS旨在抵御仅密钥攻击、选择消息攻击和已知消息攻击。最重要的是,将元素g保密不利于量子计算机解决离散对数问题的能力。MPPK/DS算法的安全性源于选择与域GF(p)相关联的素数p,使得p是一个奇素数q与2的幂x的乘积再加上1的和。给定这样的素数选择,选择公开可用多项式的偶数系数使得难以找到模p - 1的任何私有信息。此外,通过适当安排x和q,将模q找到的解提升到模p - 1的整数环上是指数困难的。然而,找到模两个分量q和2的幂x的私有信息是一个NP难问题,因为它涉及在所选有限域上求解多元方程。从公钥或签名中搜索私钥的时间复杂度在GF(p)上是指数级的。对于域GF(p),实施欺骗攻击的时间复杂度也是指数级的。通过对多元多项式和广义安全素数p进行优化选择,MPPK/DS可以达到所有三个NIST安全级别。