WO2002001792A1

WO2002001792A1 - Public key cryptographic methods based on the difficulty of finding natural values of an endomorphism of a module on any ring or algebra

Info

Publication number: WO2002001792A1
Application number: PCT/FR2001/002029
Authority: WO
Inventors: Jean-François GENESTE
Original assignee: Geneste Jean Francois
Priority date: 2000-06-28
Filing date: 2001-06-27
Publication date: 2002-01-03
Also published as: FR2811173A1; FR2811173B3; AU7067001A

Abstract

The invention concerns a public key cryptographic method applicable to data recorded in the form of bits on a medium operable by one or more calculating entities adapted to processing input data x to supply output data x', comprising at least a data processing step, enabling, in accordance with the form of embodiment, to supply an encryption procedure, a Fiat-Shamir zero-knowledge identity proof procedure, an electronic signature procedure or a procedure performing a one-way function, while using square matrices. If a message to be encrypted is a vector x of a module with dimension 3, E, x is completed to form the base {x, y, z}, the resulting matrix g<-1> is then taken into consideration, and if F is a matrix 3x3 capable of diagonalization which constitutes the public key, the encrypted message is (g<-1>Fg, xi (y,z)<i>xi</i> + y + z). The zero-knowledge proof can be produced by using said method but in returning to the strike holder the decrypted message and by operating on a fraction ring of a non-commutative ring. The signature procedure is derived directly from Guillou and Quisquater application to transform a zero-knowledge proof into a signature schema.

Description

Public key cryptographic procedures based on the difficulty of finding the eigenvalues of an endomorphism of a module on an arbitrary ring or algebra

The present invention relates to a public key cryptography method, applicable to data recorded in the form of bits on a medium usable by a calculation entity, which method, depending on how it is used can provide an encryption method, a method proof of identity zero-knowledge within the meaning of Fiat-Shamir, an electronic signature signing process or a process performing a so-called one-way function.

Since the mid-1970s, numerous public key cryptography systems have appeared, notably the RSA of Rivest Shamir and Adelman as well as the so-called Diffie-Hellmann public key exchange system. Other systems were proposed, the vast majority based on the problem of factorization. Few are based on other problems, but I will cite here those based on elliptical or hyper-elliptic curves. However, in all cases, the systems suggested have little to do with factorization and their robustness seems to depend more on the fact that we know little or nothing about the domain concerned (eg elliptical curves) than on the fact that the problem is really difficult to solve. We are thus in the presence of a worrying phenomenon. Either we use a public key cryptographic system based on factorization, or we use one based on a little known problem but can be not very difficult. So why not use those based on factorization? In fact, would someone who has found a deterministic polynomial time algorithm to factorize large numbers have an interest in publishing their discovery? A country like the USA which seeks to listen to all the communications of the earth via the NSA (National Security Agency) would not it be interesting to let believe that the problem of factorization is difficult so as, if necessary, to continue to listen, without being suspected, to the whole world?

In what follows, I will present a cryptographic process with public key which is, in general, much more complicated to "break" than to solve the problem of factorization. However, in certain identified cases, the problem in question will be equivalent to factorization. The user will only have to choose what he wants. I will then show that depending on how we use it we can obtain a zero-knowledge interactive proof process at indistinguishable result, an electronic signature process and a one-way function construction process. Finally, the processes presented here being parallelizable, I will show how to realize parallel integrated circuits which realize them and make it possible to do public key encryption in real time, which no other process of this type can do at the moment. current.

The calculations explained here are supposed to be made on data recorded in the form of bits, and executed by calculation entities of the "computer" type or, as the case may be, specific electronic circuits. The encryption will consist of processing the input data x to provide an output x ', the calculation unit performing a certain number of data processing steps, this processing using a number of functions, in particular matrix. For zero-knowledge identity proofs or electronic signatures, the same process will be used, but it will involve interactions between 2 computation entities which will process data also recorded in binary form.

m 1. Ratings - Reminders

Let A be an arbitrary ring and E an A-module of finite type. Let f be an endomorphism of E. We will say that a vector x e E * is an eigenvector of f if 3λeA / f x) = λx. For simplicity, we will only consider here the modules on the left, but the results described are the same and are also valid for the modules on the right. Similarly, λ is an eigenvalue of the endomorphism f if 3x e E * l f (x) = Ax. In the case where A is a commutative ring, one way to calculate the eigenvalues of f is to solve its characteristic polynomial.

When a draw is made at random it will mean that it is made with the uniform distribution on the considered set. The eigenvalues will, in general, be drawn in the center of the ring. If y and z are two vectors of E, then (y, z) is a one-way function from a subset of the bits of the last 2 coordinates of y and z in A, or, as the case may be, ξ {ά ) will be a one-way function from A to A. For example, in some cases, the function (y, z) could be the square elevation in A of the second coordinate of y.

In the following, when we say "Bob" or "Alice", we will hear the machine of Bob or Alice. This personalization of the computation entities seems to us to allow a better understanding.

m 2. Description in dimension 3

We place ourselves in a context where Bob wants to send a message to Alice. E is a A-module of dimension 3, and it is assumed that the messages to be sent are x _\ for the first up to x _m for the last. To make her public key Alice randomly draws 3 values distinct non-zero in A. Let λj, λ ₂ and λ _{3 be} these values. Alice then forms the matrix

F ₀ which

is invertible. It then forms the matrix F = A ^l FQ h which is the public key. In the following this matrix will be written

F = This public key is stored in an electronic directory

"hardware" searchable and "importable" from the outside via a connection, for example, of the Internet type.

Encryption algorithm of i ^{è &} message Xi

Given x _t Bob randomly draws 2 vectors y _t and ∑ _t such that {#, -, yz,} forms a base of E.

Let g.-Î be the matrix

formed of the coordinates of these vectors in column. It is obviously reversible. Bob then calculates / = g- ^-1 Fg and ξiy z _t ) Xi + y _t ⁺ ^ _< - Bob then sends Alice the couple (f, ξ (ι, zι) xι + yι + z _t ).

Ι— message decryption algorithm

As Alice knows the eigenvalues of f, Alice searches for 3 eigenvectors of f associated with each of the values λj. If we consider the

example then the latter is proportional

Similarly if v, = is the eigenvector associated with λ ₃ , we then have v, - which is proportional

a We then obtain the following system:

. We can then write these equations in the following form.

(gi2, gι, = (k "ι, k'vj) _a ^Q ), (g22, g2, s) = (kw ₂ , k'v ₂ ) (JJ) and (g ₃₂ , g3, ₃ )

-1

(kw ₃ , kV ₃ ) (^) - Recall that y =

\ ω φ I \ ψ '

our equations can then be written in the form

. What

Zi = ψ- 'U + φ ¹ k' i proves that y, and z _t are in the plane generated by the eigenvalues λ ₂ and λ ₃ . The ciphertext is composed of the matrix f and a random vector U = ^, z) x _t + y _t + z _t . Then write that

is collinear with any nonzero eigenvector associated with λi. Let us call this last vector μ. We

'Ui - (£>' + ψ ') kuϋ - (ω' + φ ')' vu = Wi then obtains TJ2 - (ρ '+ Ψ') kui2 - (ω '+ <p') k ' ₂ = ημ ₂ where the unknowns are

, ϋ ₃ - (e '+ Ψ') ku _i3 - (ω ^» + (p ') k ^τ v _i3 = ημ ₃ k, k' and η. This system is easily solved and has a unique solution which will give k and k 'and therefore will allow to find cr. The rest of the decryption is then trivial.

m 3. Difficulty breaking the system

The difficulty of breaking the previous system comes from the difficulty of finding the eigenvalues of a matrix with coefficients in any ring. We can in particular demonstrate that when the ring is Z / nZ where n = ρq is the product of 2 large prime numbers as in the RSA, the previous algorithm is as hard to break as it is difficult to factorize the number n . In this particular case, an interesting function for ξ is the elevation squared of the 2 coordinate ^lè of y modulo n.

m 4. Zero-knowledge proof

Consider R a non-commutative ring. Suppose that R satisfies the so-called Ore condition on the right. That is, V a, be R, 3 a ', b' e R / aa '= bb'. We then demonstrate that under this condition, the ring R admits a ring of fractions, i.e. elements of the type a / b where ae R and be S where S is a part of R on which we can construct a equivalence relation. In this framework, as long as ae S, the inverse of a / b is written b / a. The construction of such a fraction ring is unique once we have chosen S. This construction will therefore not be described here. On the other hand, the same construction exists for a condition called Ore on the left with the same result, but another ring structure. The result presented here is therefore valid for both cases. What is important is that we work on equivalence classes and not on digital objects directly. Then call Ci the encryption method in paragraph 2 and> ι the decryption method in paragraph 2. In the present scenario, Alice wants to prove her identity to Bob. As in conventional zero-knowledge protocols, it will show that it knows information known only to itself, without giving more information than the fact that it knows this information. Clearly, Alice will show that she knows the eigenvalues of F. The protocol proceeds as follows: Bob encrypts a message drawn at random in the module on the ring A of the fractions of R with C _\ and sends it to Alice. On reception, Alice checks that it is of the form (f, v) where f is a 3x3 matrix with coefficients in A and v is a vector of dimension 3 on A. If this is not the case, then Alice stops the protocol. Otherwise Alice decrypts with D _\ . It is easy to show that the message obtained is x ¹ if Bob's message is x and that each coordinate of x 'is in the same equivalence class as that corresponding to x. The two vectors are therefore equivalent and, from a theoretical point of view, the message has been deciphered. Nevertheless, from a practical point of view, we have, numerically, 2 potentially different equivalent vectors. There is no theoretical or practical reason to favor one form over another. On the other hand, only the holder of the eigenvalues can find an equivalent of x. On reception of x 'Bob checks the equivalence of the 2 vectors. If not, Bob refuses to identify Alice, otherwise Bob accepts.

We show that such a protocol is a Zero-knowledge interactive proof protocol in the sense of Fiat-Shamir with an unconditionally indistinguishable result.

m 5. Signature

We will be inspired here by a technique due to Jean-Jacques Quisquater and Louis Guillou which allows, from an interactive zero-knowledge proof system, to deduce an interactive signature system. As in paragraph 2, Alice builds her public matrix F. We assume here that the message to sign is me E. As in process i, Bob randomly draws 3 vectors such that {x, y, z} forms a base of E and we call g ^{~ l} the matrix formed of these vectors in column, as well as f = g ^_1 Fg. f is sent to Alice. On reception, Alice calculates as in paragraph 2, x, y and z as well as ûjn) and breaks it down on the basis {x, y, z}. It thus has f (m) = * ι + 1 + 1 ₃ . Alice then randomly draws 3 values a, β and y and sends Bob the couple (t _\ + βt ₂ + 7 ξ (a)). Bob breaks down f (m) on the basis (x, y, z}, obtains the t _t , breaks down t _\ + βtχ + τ ₃ on the basis of the t _h which gives him, β and y and calculates ξ (ά) to check that the second part of the couple matches well. Note that this algorithm works regardless of the ring considered, commutative or not, ring of fractions or not.

m 6. The choice of the ring

In the previous sections we have described processes that work in almost all types of rings. However, here we can give some sound advice and provide clarification. First of all, the processes Ci and D _\ work in any ring. When the ring is commutative, it is necessary to check that the problem of finding the eigenvalues is a difficult problem. A priori, but not exhaustive, a local ring can work. One way to construct such a ring is to choose in a ring R a prime ideal P. Let S = R - P. Then A = S ^"1 R is a local ring. For zero-knowledge proofs and signatures, the quotient ring of a non-commutative ring can be chosen. Again, even if the construction is a little different, we can choose a local ring. Finally, we don't have to be actually in a ring. indeed, the associativity of multiplication is not a necessary condition, so a suitable ring could be the following: Let R = O _{n be} the set of modulo n octonions where n = pq is the product of 2 prime numbers. S the set of elements of R of which none of the components is divisible by p. Let us then consider the non-associative ring of the fractions A = S ^-1 R. The previous algorithms work in such a ring.

All this is given only by way of example, the processes described working in almost all structures with 2 operations.

7. Description in dimension 4

The processes of dimension 3 can be adapted to dimension 4. We

let's use the same notations as before. Let FQ

of Alice where the λj are chosen at random non-zero and all distinct. Alice then randomly draws a

matrix h ^l ≈ and publishes the matrix F = h ^{~ l} F ₀ h. A message is always a

vector ue E, E which is this time of

dimension 4 on A. Message encryption

Bob wants to send u. He then randomly draws x and poses y - u - x. It completes by randomly choosing z and t such that {x, y, z, t} forms a base of E. Let us call g ^{~ l} = (gj _j ) the matrix formed from the columns of these vectors. Bob then sends Alice f = g ^_1 Fg followed by a vector of the type (z, t) (x + y) + z + t or ι (z, t) x + ξ ₂ z, t) y + z + t.

Message decryption

We reason as in paragraph 2 to find the vectors z and t by writing that the eigenvector associated with λ ₃ is proportional

ag ^~ By solving the

systems of equations we obtain z and t and therefore ξ (z, t) or the ξι (z, t) and therefore u in an obvious way.

Special property

From dimension 4 we can demonstrate that the system resists an adaptive attack with a chosen number, whereas in the case of dimension 3 the attack does not have to be adaptive.

generalizations

Such a scheme or that in dimension 3 can be easily generalized to dimensions greater than 4. This being immediate, we will not go further in the description of such systems. However, we will cite for the record the case of dimensions greater than or equal to 5 for which, in addition to the traditional difficulty of finding eigenvalues is added, in the case of a commutative ring in particular, the impossibility of the resolution by radicals of the characteristic polynomial.

m 8. Variants

We present here, in a non-exhaustive manner, some variants of the preceding methods so as to prove the power of the system. These variants are all in dimensions 3 or 4 but are generalized to other dimensions very easily. We will only give partial descriptions here, the rest being identical to the previous paragraphs. In addition, unless otherwise stated, we will mainly focus on the encryption aspects.

Variant number 1

In the Ci method, instead of sending to Alice (f, ξ (, z) x + y + z), Bob sends directly (f, x + y + z). It is shown that no security is provided by such a method if it is on a commutative ring. On the other hand, as soon as the ring is non-commutative, security is ensured (via a conjecture which is outside the scope of this text). Thus the encryption and decryption are simplified all the more for a non-commutative ring. Likewise, this variant can be extended to the zero-knowledge proof of paragraph 4 and to the signature of paragraph 5.

Variant number 2

We place ourselves here in dimension 4 and strictly in the case of a non-commutative ring. Under the condition that certain elements of the matrix g ^{~ l} are known and for example equal to 1, we can then modify the encryption as follows. Suppose that the equivalent of a line of g is known, for example _4> ι = g ^ ≈ g ₃ = gι, ₄ = 1, then it is enough for Bob to send the matrix f. Following the same type of reasoning as for D _\ Alice finds the vectors x, y, z and t and can therefore calculate x + y and z + t which then forms the message in clear.

Variant number 3

We are going to give here a zero-knowledge interactive proof system in dimension

2; for this we need an additional hypothesis, that Alice can find

(λι 0 \ the eigenvalues of a matrix 2 <2 in deterministic polynomial time. Let o = randomly drawn by Bob. The latter then randomly draws 2 vectors x and y forming a base of E and let g ^{-1 be} matrix formed of these vectors in column. Let F = g ^_1 Fo g. Bob then sends Alice the couple (F, x + y). Alice, who knows how to find the eigenvalues can then find x and y and she draws at random a and β, then sends to Bob (αx + y, ξ (μ)). On reception, Bob, who knows the basis of eigenvectors (x, y} finds a and β and calculates ξ (ά) to see the correspondence with the second element of the couple Alice sent her. If that is the case, Bob accepts, otherwise Bob refuses.

Such an algorithm is particularly well suited to the case where A≈Z / nZ and n = pq as in the RSA. Indeed, knowing the factorization of n, Alice can easily solve the characteristic polynomial using, among other things, the Chinese theorem of the remainders and in this case one can for example choose ξ {a) = a ² mod n.

Variant number 4

We give here, in dimension 3, an interactive zero-knowledge proof version which works in a commutative ring. As in paragraph 2, Bob encrypts a random message, x, using Ci. Alice decrypts it and therefore obtains x, y and z. It therefore refers to Bob (ax + βy + γz, ξ (a)) and Bob then checks as in variant number 3. Similar diagrams work in all dimensions.

Note

Variants 3 and 4 of course give rise to interactive signature systems of the Guillou-Quisquater type.

Variant number 5

Here is an encryption system based on the difficulty of finding the eigenvalues of an endomorphism when Alice knows information that allows her to calculate them. This is the typical case where we work in the set of integers modulo n and where only Alice knows the factorization of n. Bob, when he wants to speak to Alice, randomly draws a matrix and keeps it without modification as long as he corresponds with Alice.

The i ^th message is a vector Xj e E and Bob randomly draws yι and Zj so that the 3 vectors form a base of E. Let then be ^] the matrix formed of these vectors in column. Bob sends to Alice (fi ≈ g ^l Fg ;, ξ (y _t , z;) x, + yi + zi). To decipher, Alice calculates the eigenvalues of f _\ (only for the first message, which by the way can be public to make things even easier), and searches for a proper base of fi. It then breaks down ξiy _t , Zi) x _t + ι + z _{ on this basis, obtains y _t and z _; therefore ξ (x _t , yi) and consequently x, -.

Variant number 6

We present here a direct generalization of the algorithm presented in paragraph 2. If n is the dimension of E, we consider a matrix nxn, Alice's public key and of the form F = ( ¹ j or R is a non-diagonal matrix as in paragraph 2 but of size (nl) ^χ (nl) and which has eigenvalues λ, ..., λ „. The message is always a vector of E and Bob sends Alice the encrypted message (f = g ^_1 Fg, ξ (, z, t, ...) x + y + z + t + ...). The deciphering is then obvious taking into account what precedes.

m 9. Parallelization

In this paragraph, we will see two types of parallelization.

"9.1. Gross parallelization

Here, the operations are assumed to be wired into hardware. We then have several hardware bricks to carry out the operations. The goal is to minimize the number of series multiplications that we will have to do. The basic operations which are wired are multiplication, addition, subtraction and addition in ring A. They are represented schematically in Figures 1 to 4. We can then define the parallel multiplication of 2 matrices. Take the example in dimension 3. If P = ( _/ ) and if

is valid whether the ring is commutative or not. The multiplication formula of the matrices will be indicated according to the diagram in figure 5 and the detail carried out is according to figure 6. On this last figure we can see that the multiplication of 2 matrices between them can be done in the time of a series multiplication, since for i and j fixed we can perform the 3 multiplications in parallel. In accordance with custom, the time for calculating additions and subtractions is neglected. We could continue in this way and detail each operation necessary for the execution of each process described above. The thing being obvious, we will not go further, but it is easy to design an electronic circuit specific to each process which performs in parallel the maximum possible of operations so as to minimize the calculation time seen by the user. Thus, in a commutative ring, the time necessary, with such a circuit, to calculate Ci is the time of 5 series multiplications. For this evaluation, we considered that the time of a division is equivalent to that of a multiplication, which is common but can be optimistic. Conversely, in a fraction ring, the time of a division is negligible. Regarding D _\ , 7 series multiplications are necessary.

In the rings of non-commutative fractions, these times may vary somewhat depending on the inversion algorithm chosen for a matrix inversion. However, as the time of a division is negligible, we arrive there again, with excellent performances.

"9.2. Parallelization by microprocessors

The preceding parallelization has the advantage of providing the best possible bit rates. However, it has the disadvantage of not using all the power of the methods presented here. Indeed, in paragraph 9.1., Once the ring has been chosen, it can no longer be changed. As we said above, in the introduction, for the RSA for example, the day the factorization problem is solved, if possible, all the integrated circuits which perform this algorithm are good to throw in the trash . Worse, if we doubt (see what has been said on the NSA) we are trapped in the system and there is hardly any alternative. We therefore propose here a parallelization of a new type.

The reader is invited to repeat figures 1 to 4 above, and to consider that each "box" is a microprocessor for which one can program an operation in the ring of his choice, and that in an advanced language of the Mathematica type. We can then create macro microprocessors like that of figure 5 by paralleling the use of the first in a structure of the type of that of figure 6. It is only the compiler which will insert in each adequate part the "piece" of suitable algorithm. Continuing in this way, always with the concern of parallelization, the encryption and decryption processes are constructed like sorts of superprocessors.

The advantage of this technique is that if you have a doubt about a ring, you can change it immediately. The problem is then based on the very general case of the search for the eigenvalues of an endomorphism on a module on any ring, or even, as we said for the octonions, on any algebra which may not be associative . This problem, which includes that of factorization, is very broad and much more complex than the latter. H 10. A new one-way function

One-way functions are of utmost importance as cryptographic primitives. In this context, it is always interesting to have new ones available, since certain formal protocols exist and are built on the conjecture according to which such functions exist.

We therefore resume the process i but in a non-commutative fraction ring, where all the elements of g are drawn at random and the eigenvalues chosen with the uniform distribution over the entire ring and are distinct. Such a method, Ci, is then a one-way function which at x associates an image. The difficulty of finding x lies in the fact that in such a ring, in general, the search for an eigenvector is very difficult (e.g. the set of eigenvectors may not be a sub-module of module E).

Of course, this one-way function can be generalized to any dimension.

Claims

m Claims

1. A method of public key cryptography of data recorded in the form of bits on a medium usable by one or more calculation units capable of processing input data x to provide output data x ', comprising at least one step of data processing, characterized by the fact that the calculation unit or units manipulate square matrices with coefficients in a ring or an algebra, commutative or not, associative or not, the input data being considered as vectors belonging to modules on these rings or algebras, the binary manipulation possibly bringing in output a square matrix or a vector or a scalar or two options among the three or the three at the same time, the coefficients always remaining on the same rings or algebras.

2. Cryptographic method according to claim 1 characterized in that the matrix F constituting the public key is square and diagonalizable, in that the manufacture of the public key is done by drawing a matrix with coefficients in the algebra on which one is working, with the uniform distribution, and in that this matrix must be invertible.

3. Cryptographic method according to claims 1 and 2 characterized in that in one embodiment, the encryption of the vector which represents the clear text constitutes in the completion of uniform distribution (on a subset of the module) of this vector in base in the work module, this completion being "archived" in the calculation unit in the form of a square matrix, each column of this matrix being made up of one of the vectors of the base, the first being the message in clear, the continuation of the encryption being done by changing the matrix constituting the public key via a base change linked to the completion matrix mentioned above, the result being accompanied by the vector "message in clear" multiplied, possibly, by the result the application of a one-way function on the coordinates of the vectors completing the base, plus these completion vectors.

4. Cryptographic method according to any one of the preceding claims, allowing proof of identity zero-knowledge, characterized in that when using a ring or a non-commutative fraction algebra, in the mode of Realization of claim 3, the prover provides the verifier with the result of its decryption as proof of knowledge, namely a vector equal to the clear message which will have previously been drawn at random with the uniform distribution, the equality being established in the 'ring or the algebra of noncommutative fractions concerned, but in fact potentially a vector numerically different but equivalent to the message in clear, equivalence in the sense of that defined by the condition of Ore.

5. Cryptographic method according to claims 1, 2 and 3, allowing the electronic signature, characterized in that once the matrix f = g ^_1 Fg having been sent to the "manufacturer" of the public key F, the latter calculates the change base performed on F, decomposes the message to be signed on the basis of the module thus obtained and sends a linear combination of this decomposition accompanied by the image by a sense function one of the coefficients of the linear combination.

6. cryptographic method according to any one of the preceding claims, characterized in that an embodiment implements a parallelization of the calculations in a specific circuit, this circuit being programmable or not and therefore, as the case may be, allowing the choice or not, respectively, of the ring or algebra structure, retained to work.