the problem of solving a random set of n quadratic equations in n2 .... Remark: If we nd no solution, then we simply try again with new random vinegar...

2 downloads 0 Views 287KB Size

Aviad Kipnis NDS Technologies 5 Hamarpe St. Har Hotzvim Jerusalem - Israel e-mail : [email protected] Jacques Patarin, Louis Goubin Bull SmartCards and Terminals 68 route de Versailles - BP 45 78431 Louveciennes Cedex - France e-mail : fjacques.patarin,[email protected]

Abstract

In [15], J. Patarin designed a new scheme, called \Oil and Vinegar", for computing asymmetric signatures. It is very simple, can be computed very fast (both in secret and public key) and requires very little RAM in smartcard implementations. The idea consists in hiding quadratic equations in n unknowns called \oil" and v = n unknowns called \vinegar" over a nite eld K , with linear secret functions. This original scheme was broken in [9] by A. Kipnis and A. Shamir. In this paper, we study some very simple variations of the original scheme where v > n (instead of v = n). These schemes are called \Unbalanced Oil and Vinegar" (UOV), since we have more \vinegar" unknowns than \oil" unknowns. We show that, when v ' n, the attack of [9] can be extended, but 2when v 2n for example, the security of the scheme is still an open problem. Moreover, when v ' n2 , the security of the scheme is exactly equivalent (if we accept a very natural but not proved property) to the problem of solving a random set of n quadratic equations in n22 unknowns (with no trapdoor). However, we show that (in characteristic 2) when v n2 , nding a solution is generally easy. In this paper, we also present some practical values of the parameters, for which no attacks are known. We also study schemes with public keys of degree three instead of two. We show that no signi cant advantages exist at the present to recommend schemes of degree three instead of two. However, we show that it is very easy to combine the Oil and Vinegar idea and the HFE schemes of [13]. The resulting scheme, called HFEV, looks at the present also very interesting both from a practical and theoretical point of view. In UOV, the number of vinegar variables must be > n, but in HFEV this number can be very small or very large. The length of a UOV signature can be as short as 192 bits and the length of a HFEV signature can be as short as 80 bits.

Note: This paper is the extended version of the paper with the same title published at EURO-

CRYPT'99.

1 Introduction Since 1985, various authors (see [6], [8], [11], [13], [15], [16], [17], [20] for example) have suggested some public key schemes where the public key is given as a set of multivariate quadratic (or higher degree) equations over a small nite eld K . The general problem of solving such a set of equations is NP-hard (cf [7]) (even in the quadratic case). Moreover, when the number of unknowns is, say, n 16, the best known algorithms are often not signi cantly better than exhaustive search (when n is very small, Grobner bases algorithms might be ecient, cf [5]). The schemes are often very ecient in terms of speed or RAM required in a smartcard implementation. (However, the length of the public key is generally 1 Kbyte. Nevertheless it is sometimes useful 1

to notice that secret key computations can be performed without the public key). The most serious problem is that, in order to introduce a trapdoor (to allow the computation of signatures or to allow the decryption of messages when a secret is known), the generated set of public equations generally becomes a small subset of all the possible equations and, in many cases, the algorithms have been broken. For example [6] was broken by their authors, and [11], [15], [20] were broken. However, many schemes are still not broken (for example [13], [16], [17], [19]), and also in many cases, some very simple variations have been suggested in order to repair the schemes. Therefore, at the present, we do not know whether this idea of designing public key algorithms with multivariate polynomials over small nite elds is a very powerful idea (where only some too simple schemes are insecure) or not. In this paper, we will present two new schemes: UOV and HFEV. UOV is a very simple scheme: the original Oil and Vinegar signature scheme (of [15]) was broken (see [9]), but if we have signi cantly more \vinegar" unknowns than \oil" unknowns (a de nition of the \oil" and \vinegar" unknowns can be found in section 2), then the attack of [9] does not work and the security of this more general scheme (called UOV) is still an open problem. Moreover, we show that, when we have approximately n22 vinegar unknowns for n oil unknowns, the security of UOV is exactly equivalent (if we accept a natural but not proved property) to the problem of solving a random set of n quadratic equations in n22 unknowns (with no trapdoor). This result suggests that some partial proof of security (related to some simple to describe and supposed very dicult to solve problems) might be found for some schemes with multivariate polynomials over a nite eld. However, we show that most of the systems of n quadratic equations in n2 (or more) variables can be solved in polynomial complexity... As a result, at the present, we rather recommend v ' 3n for example than v ' n22 for security in UOV. We also study Oil and Vinegar schemes of degree three (instead of two). HFEV combines the ideas of HFE (of [13]) and of vinegar variables. HFEV looks more ecient than the original HFE scheme.

2 The (Original and Unbalanced) Oil and Vinegar of degree two

Let K = Fq be a small nite eld (for example K = F2 ). Let n and v be two integers. The message to be signed (or its hash) is represented as an element of K n , denoted by y = (y1 ; :::; yn). Typically, qn ' 2128. The signature x is represented as an element of K n+v denoted by x = (x1; :::; xn+v).

Secret key

The secret key is made of two parts: 1. A bijective and ane function s : K n+v ! K n+v . By \ane", we mean that each component of the output can be written as a polynomial of degree one in the n + v input unknowns, and with coecients in K . 2. A set (S ) of n equations of the following type:

8i; 1 i n; yi =

X

ijk aj a0k +

X

ijk a0j a0k +

X

ij aj +

X

ij0 a0j + i

(S ):

The coecients ijk , ijk , ij , ij0 and i are the secret coecients of these n equations. The values a1 , ..., an (the \oil" unknowns) and a01, ..., a0v (the \vinegar" unknowns) lie in K . Note that these equations (S ) contain no terms in ai aj .

Public key

Let A be the element of K n+v de ned by A = (a1; :::; an; a01; :::; a0v). A is transformed into x = s?1 (A), where s is the secret, bijective and ane function from K n+v to K n+v . Each value yi , 1 i n, can be written as a polynomial Pi of total degree two in the xj unknowns, 1 j n + v . We denote by (P ) the set of these n equations:

8i; 1 i n; yi = Pi(x ; :::; xn v) (P ): These n quadratic equations (P ) (in the n + v unknowns xj ) are the public key. 1

2

+

Computation of a signature (with the secret key)

The computation of a signature x of y is performed as follows: Step 1: We nd n unknowns a1 , ..., an of K and v unknowns a01 , ..., a0v of K such that the n equations (S ) are satis ed. This can be done as follows: we randomly choose the v vinegar unknowns a0i , and then we compute the ai unknowns from (S ) by Gaussian reductions (because { since there are no ai aj terms { the (S ) equations are ane in the ai unknowns when the a0i are xed).

Remark: If we nd no solution, then we simply try again with new random vinegar unknowns.

After very few tries, the probability of obtaining at least one solution is very high, because the probability for a n n matrix over Fq to be invertible is not negligible. (It is exactly (1 ? q1 )(1 ? q12 ):::(1 ? qn1?1 ). For q = 2, this gives approximately 30 %, and for q > 2, this probability is even larger.) Step 2: We compute x = s?1 (A), where A = (a1; ::; an; a01; :::; a0v). x is a signature of y .

Public veri cation of a signature

A signature x of y is valid if and only if all the (P ) are satis ed. As a result, no secret is needed to check whether a signature is valid: this is an asymmetric signature scheme.

Note: The name \Oil and Vinegar" comes from the fact that { in the equations (S ) { the \oil

unknowns" ai and the \vinegar unknowns" a0j are not all mixed together: there are no ai aj products. However, in (P ), this property is hidden by the \mixing" of the unknowns by the s transformation. Is this property \hidden enough" ? In fact, this question exactly means: \is the scheme secure ?". When v = n, we call the scheme \Original Oil and Vinegar", since this case was rst presented in [15]. This case was broken in [9]. It is very easy to see that the cryptanalysis of [9] also works, exactly in the same way, when v < n. However, the cases v > n are, as we will see, much more dicult. When v > n, we call the scheme \Unbalanced Oil and Vinegar".

3 A short description of the attack of [9]: cryptanalysis of the case v=n The idea of the attack of [9] is essentially the following: In order to separate the oil variables and the vinegar variables, we look at the quadratic forms of the n public equations of (P ), we omit for a while the linear terms. Let Gi for 1 i n be the respective matrix of the quadratic form of Pi of the public equations (P ). The quadratic part of the equations in the set (!S ) is represented as a quadratic form with a correA , the upper left n n zero submatrix is due to the sponding 2n 2n matrix of the form : 0B C fact that an oil variable is not multiplied by an oil variable. After hiding the internal variables with the linear function s, we get a representation for the matrices ! 0 A Gi = S B Ci S t, where S is an invertible 2n 2n matrix. i

i

De nition 3.1: We de ne the oil subspace to be the linear subspace of all vectors in K n whose 2

second half contains only zeros.

De nition 3.2: We de ne the vinegar subspace as the linear subspace of all vectors in K n whose 2

rst half contains only zeros. Lemma 1 Let E and F be a 2n 2n matrices with an upper left zero n n submatrix. If F is invertible then the oil subspace is an invariant subspace of EF ?1. 3

Proof: E and F map the oil subspace into the vinegar subspace. If F is invertible, then this mapping

between the oil subspace and the vinegar subspace is one to one and onto (here we use the assumption that v = n). Therefore F ?1 maps back the vinegar subspace into the oil subspace this argument explains why the oil subspace is transformed into itself by EF ?1 .

De nition 3.4: For an invertible matrix Gj , de ne Gij = GiG?j . 1

De nition 3.5: Let O be the image of the oil subspace by S ? . 1

In order to nd the oil subspace, we use the following theorem:

Theorem 3.1 O is a common invariant subspace of all the matrices Gij . Proof: GiG?j 1 = S

!

Ai S t(S t)?1 0 Aj Bi Ci Bj Cj 0

!?

1

S ?1 = S

Ai Bi Ci 0

!

Aj Bj Cj

0

!?

1

S ?1

The two inner matrices have the form of E and F in lemma 1. Therefore, the oil subspace is an invariant subspace of the inner term and O is an invariant subspace of Gi G?j 1. The problem of nding common invariant subspace of set of matrices is studied in [9]. Applying the algorithms in [9] gives us O. We then pick V to be an arbitrary subspace of dimension n such that V + O = K 2n, and they give an equivalent oil and vinegar separation. Once we have such a separation, we bring back the linear terms that were omitted, we pick random values for the vinegar variables and left with a set of n linear equations with n oil variables.

Note: Lemma 1 is not true any more when v > n. The oil subspace is still mapped by E and F into

the vinegar subspace. However F ?1 does not necessary maps the image by E of the oil subspace back into the oil subspace and this is why the cryptanalysis of the original oil and vinegar is not valid for the unbalanced case. This corresponds to the fact that, if the submatrix of zeros in the top left corner of F is smaller than n n, then F ?1 does not have (in general) a submatrix of zeros in the bottom right corner. For example:

1 0 1 0 0 3 1 ? 1 2 ?5 4 [email protected] 1 2 2 C A = 3 [email protected] 2 ?2 1 CA : 2 1 2 ?3 6 ?3 1

However, when v ? n is small, we see in the next section how to extend the attack.

4 Cryptanalysis when v > n and v ' n In this section, we discuss the case of Oil and Vinegar schemes where v > n, although a direct application of the attack described in [9] and in the previous section does not solve the problem, a modi cation of the attack exists, that is applicable as long as v ? n is small (more precisely the expected complexity of the attack is approximately q (v?n)?1 n4 ).

De nition 4.1: We de ne in this section the oil subspace to be the linear subspace of all vectors in

K n+v whose last v coordinates are only zeros.

De nition 4.2: We de ne in this section the vinegar subspace to be the linear subspace of all vectors in K n+v whose rst n coordinates are only zeros. Here in this section, we start with the homogeneous quadratic terms of the equations: we omit the linear terms for a while. 4

The matrices Gi have the representation

!

Gi = S B ACi S t i i 0

where the upper left matrix is the n n zero matrix, Ai is a n v matrix, Bi is a v n matrix, Ci is a v v matrix and S is a (n + v ) (n + v ) invertible linear matrix.

De nition 4.3: De ne Ei to be

!

Ai Bi Ci . 0

Lemma 2 For any matrix E that has the form

!

0 A , the following holds: B C

a) E transforms the oil subspace into the vinegar subspace. b) If the matrix E ?1 exists, then the image of the vinegar subspace by E ?1 is a subspace of dimension v which contains the n-dimensional oil subspace in it.

Proof: a) follows directly from the de nition of the oil and vinegar subspaces. When a) is given

then b) is immediate. The algorithm we propose is a probabilistic algorithm. It looks for an invariant subspace of the oil subspace after it is transformed by S . The probability for the algorithm to succeed on the rst try is small. Therefore we need to repeat it with dierent inputs. We use !the following property: any linear combination of the matrices E1, ..., En is also of the form 0B A C . The following theorem explains why an invariant subspace may exist with a certain probability.

Theorem 4.1 Let F be an invertible linear combination of the matrices E , ..., En. Then for any k 1

such that Ek?1 exists, the matrix FEk?1 has a non trivial invariant subspace which is also a subspace of q?1 for d = v ? n. the oil subspace, with probability not less than q2d ?1

Proof: The matrix F maps the oil subspace into the vinegar subspace, the image by F of the oil subspace is mapped by Ek?1 into a subspace of dimension v that contains the oil subspace { these are due to lemma 1. We write v = n + d, where d is a small integer. The oil subspace and its image by FEk?1 are two subspaces with dimension n that reside in a subspace of dimension n + d. Therefore, their intersection is a subspace of the oil subspace with dimension not less than n ? d. We denote the oil subspace by I0 and the intersection subspace by I1 . Now, we take the inverse images by FEk?1 of I1: this is a subspace of I0 (the oil subspace) with dimension not less than n ? d and the intersection between this subspace and I1 is a subspace of I1 with dimension not less than n ? 2d. We call this subspace I2 . We can continue this process and de ne I` to be the intersection of I`?1 and its inverse image by FEk ?1. These two subspaces have co-dimension not more than d in I`?2 . Therefore, I` has a co-dimension not more than 2d in I`?2 or a co-dimension not more than d in I`?1 . We can carry on this process as long as we are sure that the inverse image by FEk?1 of I` has a non trivial intersection with I` . This is ensured as long as the dimension of I` is greater than d, but when the dimension is d or less than d, there is no guaranty that these two subspaces { that reside in I`?1 { have a non trivial intersection. We end the process with I` that has dimension d that resides in I`?1 with dimension not more than 2d. We know that the transformation (EG?k 1)?1 maps I` into I`?1 . With probability not less than qq2d??11 , there is a non zero vector in I` that is mapped to a non zero mutiple of itself { and therefore there is a non trivial subspace of FEk ?1 which is also a subspace of the oil subspace.

5

Note: It is possible to get a better result for the expected number of eigenvectors and with much less eort: I is a subspace with dimension not less than n ? d and is mapped by FEk? into a subspace 1

1

with dimension n. The probability for a non zero vector to be mapped to a non zero multiple of itself is qqn??11 . To get the expected value, we multiply it by the number of non zero vectors in I1 . It gives n?d a value which is not less than (q?1)(qnq?1 ?1) . Since every eigenvector is counted q ? 1 times, then the n?d expected number of invariant subspcaes of dimension 1 is not less than q qn ??1 1 q ?d . We de ne O as in section 3 and we get the following result for O: Theorem 4.2 Let F be an invertible linear combination of the matrices G1; ..., Gn. Then for any k such that G?k 1 exists, the matrix FG?k 1 has a non trivial invariant subspace, which is also a subspace of O with probability not less than qq2d??11 for d = v ? n.

Proof:

FG?k 1 = (1G1 + ::: + n Gn)G?k 1 = S (1E1 + ::: + n En )S t(S t)?1 Ek?1S ?1 = S (1E1 + ::: + n En )Ek?1S ?1:

The inner term is an invariant subspace of the oil subspace with the required probability. Therefore, the same will hold for FG?k 1 , but instead of a subspace of the oil subspace, we get a subspace of O.

How to nd O ?

We take a random linear combination of G1, ..., Gn and multiply it by an inverse of one of the Gk matrices. Then we calculate all the minimal invariant subspaces of this matrix (a minimal invariant subspace of a matrix A contains no non trivial invariant subspaces of the matrix A { these subspaces corresponds to irreducible factors of the characteristic polynomial of A). This can be done in probabilistic polynomial time using standard linear algebra techniques. This matrix may have an invariant subspace wich is a subspace of O. The following lemma enables us to distinguish between subspaces that are contained in O and random subspaces. Lemma 3 If H is a linear subspace and H O, then for every x, y in H and every i, Gi(x; y) = 0 (here we regard Gi as a bilinear form).

Proof: There are x0 and y!0 in the oil subspace such that! x0 = xS ? and y0 = yS ? . ! 1

1

Gi(x; y) = xS B0 ACi S tyt = (x0S ?1)S B0 ACi ((y0S ?1)S )t = x0 B0 ACi (y0)t = 0: i i i i i i The last term is zero because x0 and y 0 are in the oil subspace. This lemma gives a polynomial test to distinguish between subspaces of O and random subspaces. If the matrix we used has no minimal subspace which is also a subspace of O, then we pick another linear combination of G1, ..., Gn , multiply it by an inverse of one of the Gk matrices and try again. After repeating this process approximately q d?1 times, we nd with good probability at least one zero vector of O. We continue the process until we get n independent vectors of O. These vectors span O. The expected complexity of the process is proportional to q d?1 n4 . We use here the expected number of tries until we nd a non trivial invariant subspace and the term n4 covers the computational linear algebra operations we need to perform for evey try.

5 The cases v ' n2 (or v n2 ) 2

Property

2

Let (A) be a random set of n quadratic equations in (n + v ) variables x1 , ..., xn+v . (By \random" we mean that the coecients of these equations are uniformly and randomly chosen). When v ' n22 (and more generally when v n22 ), there is probably { for most of such (A) { a linear change of variables (x1; :::; xn+v ) 7! (x01 ; :::; x0n+v) such that the set (A0) of (A) equations written in (x01; :::; x0n+v ) is an \Oil and Vinegar" system (i.e. there are no terms in x0i x0j with i n and j n). 6

An argument to justify the property

Let

8x > < > :x

= 1;1x01 + 1;2x02 + ::: + 1;n+v x0n+v .. . n+v = n+v;1 x01 + n+v;2 x02 + ::: + n+v;n+v x0n+v By writing that the coecient in all the n equations of (A) of all the x0i x0j (i n and j n) is zero, we obtain a system of n n n+1 quadratic equations in the (n + v ) n variables i;j (1 i n + v , 2 1 j n). Therefore, when v approximately n22 , we may expect to have a solution for this system of equations for most of (A). 1

Remarks:

1. This argument is very natural, but this is not a complete mathematical proof. 2. The system may have a solution, but nding the solution might be a dicult problem. This is why an Unbalanced Oil and Vinegar scheme might be secure (for well chosen parameters): there is always a linear change of variables that makes the problem easy to solve, but nding such a change of variables might be dicult. 3. In section 7, we will see that, despite the result of this section, it is not recommended to choose v n2 .

6 Solving a set of n quadratic equations in k unknowns, k > n, is NP-hard We present in section 7 an algorithm that solves in polynomial complexity more than 99% of the sets of n quadratic equations in n2 (or more) variables (i.e. it will probably succeed in more than 99% of the cases when the coecients are randomly chosen). Roughly speaking, we can summarize this result by saying that solving a \random" set of n quadratic equations in n2 (or more) variables is feasible in polynomial complexity (and thus is not NP-hard if P 6= NP ). However, we see in the present section that the problem of solving any (i.e. 100%) set of n quadratic equations in k n variables (so for example in k = n2 variables) is NP-hard ! To see this, let us assume that we have a black box that takes any set of n quadratic equations with k variables in input, and that gives one solution when at least one solution exists. Then we can use this black box to nd a solution for any set of n quadratic equations in n variables (and this is NP-hard). We proceed (for example) as follows. Let (A) be a set of (n ? 1) quadratic equations with (n ? 1) variables x1, x2 , ..., xn?1 . Then let y1 , ..., y be more variables. Let (B) be the set of (A) equations plus one quadratic equation in y1 , ..., y (for example the equation: (y1 + ::: + y )2 = 1). Then (B) is a set of exactly n quadratic equations in (n + 1 + ) variables. It is clear that from the solution of (B) we will immediately nd one solution for (A).

Note 1: (B) has a very special shape ! This is why there is a polynomial algorithm for 99% of the equations without contradicting the fact that solving these sets (B) of equations is a NP-hard problem. Note 2: For (B), we can also add more than one quadratic equations in the yi variables and we can linearly mix these equations with the equations of (A). In this case, (B) is still of very special form but this very special form is less obvious at rst glance since all the variables xi and yj are in all the equations of (B).

7 A generally ecient algorithm for solving a random set of n quadratic equations in n2 (or more) unknowns In this section, we describe an algorithm that solves a system of n randomly chosen quadratic equations in n + v variables, when v n2 . 7

Let (S ) be the following system:

P

8 > > < (S ) > > :

ij n+v

1

.. P.

ij n+v

1

aij1xixj + P bi1xi + 1 = 0 in+v

1

aijnxi xj + P binxi + n = 0 in+v

1

The main idea of the algorithm consists in using a change of variables such as: 8 x1 = 1;1y1 + 2;1y2 + ::: + n;1yn + n+1;1yn+1 + ::: + n+v;1 yn+v > < . . > : xn.+v = 1;n+v y1 + 2;n+v y2 + ::: + n;n+v yn + n+1;n+v yn+1 + ::: + n+v;n+v yn+v whose i;j coecients (for 1 i n, 1 j n + v ) are found step by step, in order that the resulting system (S 0) (written with respect to these new variables y1 , ..., yn+v ) is easy to solve. We begin by choosing randomly 1;1, ..., 1;n+v . We then compute 2;1, ..., 2;n+v such that (S 0) contains no y1y2 terms. This condition leads to a system of n linear equations on the (n + v ) unknowns 2;j (1 j n + v ): X aijk 1;i2;j = 0 (1 k n): ij n+v

1

We then compute ; , ..., ;n v such that (S 0) contains neither y y terms, nor y y terms. This 31

3

+

1 3

2 3

condition is equivalent to the following system of 2n linear equations on the (n + v ) unknowns 3;j (1 j n + v): 8 P a =0 (1 k n) > < 1ijn+v ijk 1;i 3;j P a =0 (1 k n) > ijk 2;i 3;j : ij n+v

1

... Finally, we compute n; , ..., n;n v such that (S 0) contains neither y yn terms, nor y yn terms, ..., nor yn? yn terms. This condition gives the following system of (n ? 1)n linear equations on the (n + v ) unknowns n;j (1 j n + v ): 8 P a =0 (1 k n) > ijk ;i n;j > i j n v < .. > P. a = 0 > (1 k n) ijk n? ;i n;j : 1

+

1

2

1

1

1

+

1

ij n+v

1

In general, all these linear equations provide at least one solution (found by Gaussian reductions). In particular, the last system of n(n ? 1) equations and (n + v ) unknowns generally gives a solution, as soon as n + v > n(n ? 1),0i.e. v > n1(n ? 2), 0 which is1true by hypothesis.

n;1

1;1

Moreover, the n vectors B @ ...

1;n+v

CA, ..., B @ ...

n;n+v

CA are very likely to be linearly independent for a

random quadratic system (S ). The remaining i;j constants (i.e. those with n + 1 i n + v and 1 j n + 1) are randomly chosen, so as to obtain a bijective change of variables. By rewriting the system (S ) with respect to these new variables yi , we are led to the following system:

8 Pn > i; yi + y L ; (yn ; :::; yn v) + ::: + yn Ln; (yn ; :::; yn v) + Q (yn ; :::; yn v) = 0 > > i < (S 0) > ... Pn > : i i;nyi + y L ;n(yn ; :::; yn v) + ::: + yn Ln;n (yn ; :::; yn v) + Qn (yn ; :::; yn v) = 0 =1

1

2

2

=1

1

11

+1

+

1

1

+1

+

1

+1

+1

8

+

+

1

+1

+1

+

+

where each Li;j is an ane function and each Qi is a quadratic function. We then compute yn+1 , ..., yn+v such that:

8i; 1 i n; 8j; 1 j n + v; Li;j (yn ; :::; yn v) = 0: +1

+

This is possible because we have to solve a linear system of n2 equations and v unknowns, which generally provides at least one solution, as long as v n2 . We pick one of these solutions. It remains to solve the following system of n equations on the n unknowns y1 , ..., yn :

8 Pn > i yi = > > i < (S 00) > ... > > Pn inyi = n : i 1

=1

2

1

2

=1

where k = ?Qk (yn+1 ; :::; yn+v ) (1 k n). In general, this gives the yi2 by Gaussian reduction. Then, in characteristic 2, since x 7! x2 is a bijection, we will then nd a solution for the yi from this expression of the yi2 .

Note: In characteristic 6= 2, this algorithm will also succeed when 2n is not too large (i.e. when n 40 for example). (However, when 2n 2 and when the characteristic is 6= 2, this algorithm 64

requires too many computations.)

8 A variation with twice smaller signatures In the UOV described in section 2, the public key is a set of n quadratic equations yi = Pi (x1, :::, xn+v ), for 1 i n, where y = (y1; :::; yn) is the hash value of the message to be signed. If we use a collision-free hash function, the hash value must at least be 128 bits long. Therefore, q n must be at least 2128, so that the typical length of the signature, if v = 2n, is at least 3 128 = 384 bits.

As we see now, it is possible to make a small variation in the signature design in order to obtain twice smaller signatures. The idea is to keep the same polynomial Pi (with the same associated secret key), but now the public equations that we check are:

8i; Pi(x ; :::; xn v) + Li(y ; :::; yn; x ; :::; xn v) = 0; 1

+

1

1

+

where Li is a linear function in (x1; :::; xn+v) and where the coecients of Li are generated by a hash function in (y1 ; :::; yn). For example Li (y1; :::; yn; x1; :::; xn+v ) = 1 x1 + 2 x2 + ::: + n+v xn+v , where (1 ; 2; :::; n+v) = Hash (y1 , :::, yn jji). Now, n can be chosen such that q n 264 (instead q n 2128). (Note: q n must be 264 in order to avoid exhaustive search on a solution x). If v = 2n and q n ' 264, the length of the signature will be 3 64 = 192 bits.

9 Oil and Vinegar of degree three 9.1 The scheme

The quadratic Oil and Vinegar schemes described in section 2 can easily be extended to any higher degree. We now present the schemes in degree three.

Variables

Let K be a small nite eld (for example K = F2 ). Let a1, ..., an be n elements of K , called the \oil" unknowns. Let a01 , ..., a0v be v elements of K , called the \vinegar" unknowns.

9

Secret key.

The secret key is made of two parts: 1. A bijective and ane function s : K n+v ! K n+v . 2. A set (S ) of n equations of the following type: for all i n,

yi =

X

ijk` aj a0k a0` +

X

ijk` a0j a0k a0` +

X

ijk aj a0k +

X

ijk a0j a0k +

X

ij aj +

X

ij0 a0j + i

(S ):

The coecients ijk , ijk` , ijk , ijk , ij , ij0 and i are the secret coecients of these n equations. Note that these equations (S ) contain no terms in aj ak a` or in aj ak : the equations are ane in the aj unknowns when the a0k unknowns are xed.

Public key

Let A be the element of K n+v de ned by A = (a1 ; :::; an; a01; :::; a0v). A is transformed into x = s?1 (A), where s is the secret, bijective and ane function from K n+v to K n+v . Each value yi , 1 i n, can be written as a polynomial Pi of total degree three in the xj unknowns, 1 j n + v . We denote by (P ) the set of the following n equations:

8i; 1 i n; yi = Pi(x ; :::; xn v) 1

+

(P ):

These n equations (P ) are the public key.

Computation of a signature

Let y be the message to be signed (or its hash value). Step 1: We randomly choose the v vinegar unknowns a0i , and then we compute the ai unknowns from (S ) by Gaussian reductions (because { since there are no ai aj terms { the (S ) equations are ane in the ai unknowns when the a0i are xed. (If we nd no solution for this ane system of n equations and n \oil" unknowns, we just try again with new random \vinegar" unknowns.) Step 2: We compute x = s?1 (A), where A = (a1; :::; an; a01; :::; a0v). x is a signature of y .

Public veri cation of a signature

A signature x of y is valid if and only if all the (P ) are satis ed.

9.2 First cryptanalysis of Oil and Vinegar of degree three when v n

We can look at the quadratic part of the public key and attack it exactly as for an Oil and Vinegar of degree two. This is expected to work when v n.

Note: If there is no quadratic part (i.e. is the public key is homogeneous of degree three), or if this

attack does not work, then it is always possible to apply a random ane change of variables and to try again. Moreover, we will see in section 9.3 that, surprisingly, there is an even easier and more ecient attack in degree three than in degree two !

p 9.3 Cryptanalysis of Oil and Vinegar of degree three when v (1 + 3)n and K is of characteristic 6= 2 (from an idea of [2])

The key idea is to detect a \linearity" in some directions. We search the set V of the values d = (d1; :::; dn+v) such that:

8x; 8i; 1 i n; Pi (x + d) + Pi(x ? d) = 2Pi(x)

(#):

By writing that each xk indeterminate has a zero coecient, we obtain n (n + v ) quadratic equations in the (n + v ) unknowns dj . (Each monomial xi xj xk gives (xj + dj )(xk + dk )(x` + d` ) + (xj ? dj )(xk ? dk )(x` ? d` ) ? 2xj xk x` , i.e. 2(xj dk d` + xk dj d` + x` dj dk ).) 10

Furthermore, the cryptanalyst can specify about n ? 1 of the coordinates dk of d, since the vectorial space of the correct d is of dimension n. It remains thus to solve n (n + v ) quadratic equations in p(v +1) 2 n(n + v), i.e. when v (1 + 3)n), unknowns dj . When v is not too large (typically when (v+1) 2 this is expected to be easy. p As a result when v approximately (1 + 3)n and jK j is odd, this gives a simple way to break the scheme.

p Note 1: When v is sensibly greater than (1 + 3)n (this is a more unbalanced limit than what we had in the quadratic case), we do not know at the present how to break the scheme.

Note 2: Strangely enough, this cryptanalysis of degre three Oil and Vinegar schemes does not work on degree two Oil and Vinegar schemes. The reason is that { in degree two {writing 8x; 8i; 1 i n; Pi(x + d) + Pi(x ? d) = 2Pi(x) only gives n equations of degree two on the (n + v ) dj unknowns (that we do not know how to solve). (Each monomial xj xk gives (xj + dj )(xk + dk ) + (xj ? dj )(xk ? dk ) ? 2xj xk , i.e. 2dj dk .)

Note 3: In degree two, we have seen that Unbalanced Oil and Vinegar public keys are expected to cover almost all the set of n quadratic equations when v ' n22 . In degree three, we have a similar property: the public keys are expected to cover almost all the set of n cubic equations when v ' n63 (the proof is similar).

10 Public key length

If we choose K = F2 then the public key is often large. So it is often more practical to choose a larger K and a smaller n: then the length of the public key can be reduced a lot (see the examples in section 14). However, even when K and n are xed, it is always feasible to make some easy transformations on a public key in order to obtain the public key in a canonical way such that this canonical expression is slightly shorter than the original expression.

First, it is always possible to publish only the homogeneous part of the quadratic equations (and not the linear part), because if we know the secret ane change of variables in an Oil and Vinegar scheme with a public key P , then we can solve P (x) + L(x) = y , where L is any linear expression with exactly the same ane change of variables. It is thus possible to publish only the homogeneous part of P and to choose a convention for computing the linear part L of the public key (instead of publishing L). For example, this convention can be that the linear terms of L in the equation number i (1 i n) are computed from Hash(ijjId) (or from Hash(ijjP )), where Hash is a public hash function and where Id is the identity of the owner of the secret key.

Remark: It is also possible to decide that the linear part is always zero. However, from a

theoretical point of view, this may be less secure because we cannot exlude the possibility that some ecient attacks exist against the homogeneous Oil and Vinegar without nding the secret key (and without breaking the non-homogeneous case). On the equations, it is also possible to: 1. Make linear and bijective changes of variable x0 = A(x). 2. Compute a linear and bijective transformation on the equation: P 0 = t(P ). (For example, the new rst equation can be the old rst plus the old third equation, etc). By combining easily these two transformations, it is always possible to decrease slightly the lenght of the public key. 11

Idea 1: It is possible to make a change of variables such that the rst equation is in a canonical

form (see [10], chapter 6). With this presentation of the public key, the length of the public key will be approximately n?n 1 times the initial length.

Idea 2: Another ideapis to use the idea of section 7, i.e. to create a square of zeros in the coecients, where ' n + v. With this presentation, the lenght of the public key is approximately 2 n v ?n v n v

( + ) ( + ) ( + )2

times the initial length.

Remark: As we will see in section 13, the most ecient way of reducing the length of the public key is to choose carefully the values q and n.

11 Another variation of the schemes: Unbalanced Oil, Vinegar and Salt

The scheme

Let (A) be a set of n quadratic \Oil and Vinegar" equations, as described above, with n oil variables and v vinegar variables. We denote by (q1 ; :::; qn) these equations. Let (A0 ) be a set of r truly trandom quadratic equations in all the variables (i.e. we can have terms in ai aj where ai and aj are oil variables in (A0) but not in (A)). We denote by (q10 ; :::; qn0 ) these equations. We will call these r equations the \salt" equations. Let t be a secret ane permutation of K n+r ! K n+r . Let (P ) be the set of the equations t(q1 , :::, qn , q10 , :::, qr0 ). We denote by P1, ..., Pn+r these equations of (P ). (P ) will be the public key (i.e. we have \mixed" Oil and Vinegar quadratic equations and truly random quadratic equations with a secret ane permutation (P ). Let y 2 K n+r be the hash of a message M to be signed (or y =Hash(M jj0010jjR)) where R is a random value with no 0010 in base 2). Let x 2 K n+v . Then x is a valid signature of y if P (x) = y (i.e. if 8i, 1 i n + r, Pi (x) = yi ). When the secret ane functions s and t are known, it is feasible to compute a valid signature after approximately O(q r ) computations because we will easily compute a solution for the n equations (A) as before, and the probability that this solution also satis es the r equations (A0 ) is q1r (we will try again with another random R until we succeed). When q r is small (for example if q 256 and r 2), this is clearly feasible. (The name \salt" comes from the fact that we cannot put a lot of salt equations since q r must stay small for eciency.)

Cryptanalysis when v = n

Here we assume that v = n. Let Gi and Gj be random linear sums of the n + r equations (P ). The probability that Gi and Gj are linear sums of only the n equations (A) is (1=q r )2 (because it is 1=q r for Gi and 1=q r for Gj ). If this occurs, then from Gi and Gj , we will attack the scheme exactly as described in [9]. Therefore, if v = n, the scheme can be attacked with a complexity approximately q2r (and for the legitimate user, computing a signature has a complexity approximately O(q r )). As a result, we do not recommend to use this variation when v = n.

The case v > n

For well chosen parameters, we have seen that we do not know how to attack Unbalanced Oil and Vinegar schemes. Therefore, of course, we do not know either how to attack the schemes when the two ideas { v > n and mixing the equations with truly random equations { are combined together. However, the idea of choosing v > n seems at the present to be a stronger idea (both for security and for practical implementations) than the idea of mixing Oil and Vinegar with truly random equations.

12

12 Another scheme: HFEV The Unbalanced Oil and Vinegar schemes and the HFE schemes of [13] can very easily be combined, as we will see in this section. Moreover, the combined scheme looks very ecient since (at the present) we are able to avoid all the known attacks with more ecient choices of the parameters. So this HFEV schemes look both more ecient (because a smaller degree d looks sucient for security) and more secure compared to the original HFE scheme. HFEV is also more ecient (but more complex) compared to UOV, because very few vinegar variables are needed.

The scheme (HFEV)

In the \most simple" HFE scheme (we use the notations of [13]), we have b = f (a), where:

f (a) =

X i;j

ij aq ij +q ij +

'

X i

iaqi + 0;

(1)

where ij , i and 0 are elements of the eld Fqn . Let v be an integer (v will be the number of extra xi variables, or the number of \vinegar" variables that we will add in the scheme). Let a0 = (a01 ; :::; a0v) be a v -uple of variables of K . Let now each i of (1) be an element of Fqn such that each of the n components of i in a basis is a secret random linear function of the vinegar variables a01 , ..., a0v . And in (1), let now 0 be an element of Fqn such that each one of the n components of 0 in a basis is a secret random quadratic function of the variables a01 , ..., a0v . Then, the n + v variables a1 , ..., an , a01 , ..., a0v will be mixed in the secret ane bijection s in order to obtain the variables x1 , ..., xn+v . And, as before, t(b1 ; :::; bn) = (y1 ; :::; yn), where t is a secret ane bijection. Then the public key is given as the n equations yi = Pi (x1; :::; xn+v ). To compute a signature, the vinegar values a01 , ..., a0v will simply be chosen at random. Then, the values 0 and i will be computed. Then, the monovariate equations (1) will be solved (in a) in Fqn .

Simulations

Nicolas Courtois did some simulations on HFEV and, in all his simulations, when the number of vinegar variables is 3, there is no ane multiple equations of small degree (which is very nice).

Example: Let K = F . In HFEV, we can, for example, choose the hidden polynomial to be: 2

f (a) = a17 + 16a16 + a12 + a10 + a9 + 8a8 + a6 + a5 + 4a4 + a3 + 2a2 + 1a + 0; where:

a = (a ; :::; an), where a , ..., an are the \oil" variables. , , , and are given by n secret linear functions on the v vinegar variables. is given by n secret quadratic functions on the v vinegar variables. 1

1

2

1

4

8

16

0

In this example, we compute a signature as follows: the vinegar variables are chosen at random and the resulting equation of degree 17 is solved in a.

Note: Unlike UOV, in HFEV we have terms in oiloil (such as a , a , a , etc), oilvinegar (such as a , a , etc) and vinegarvinegar (in ). 17

16

16

8

8

0

13

12

10

13 Summary of the results for UOV

The underlying eld is K = Fq with q = pm . Its characteristic is p. \As dicult as random" means that the problem of breaking the scheme is expected to be as dicult as the problem of solving a system of equations in v variables when the coecients are randomly chosen (i.e. with no trapdoor). Degree

Broken

Not Broken

2 (for all p) v n or vp' n 2p n v n22 3 3 (for p = 2) v (1 + 3)n (1 + 3)n v n6 3 (for p 6= 2) v n or v ' n 2n v n63

Not broken and as Broken (despite as dicult as random dicult as random) n2 2 n3 6 n3 6

v n3 v n vn

2

2 4

v n32 v n6 v n4

In this table, we have summarized our current results on the attacks on Unbalanced Oil and Vinegar schemes. The original paper ([9]) was only studying the case v = n for quadratic equations.

14 Concrete examples of parameters for UOV In all the examples below, we do not know how to break the scheme. We have arbitrary chosen v = 2n (or v = 3n) in all these examples (since v n and v n2 are insecure).

Example 1: K = F , n = 128, v = 256 (or v = 384). The2 signature scheme is the one of section 2. The length of the public key is approximately n ( n v ) bits. This gives here a huge value: 2

( + ) 2

approximately 1.1 Mbytes (or 2 Mbytes) ! The length of the secret key (the s matrix) is approximately (n + v )2 bits, i.e. approximately 18 Kbytes. However, this secret key can always be generated from a small secret seed of, say, 64 bits.

Example 2: K = F , n = 64, v = 128 (or v = 192). The signature scheme is the one section 8. The 2

length of the public key is 144 Kbytes (or 256 Kbytes).

Example 3: K = F16, n = 16, v = 32 (or v = 48). s is a secret ane bijection of F16. The signature scheme is the one section 8. The length of the public key is 9 Kbytes (or 16 Kbytes). Example 4: K = F16, n = 16, v = 32 (or v = 48). s is a secret ane bijection of F16 such that all its coecients lie in F2 . Moreover, the secret quadratic coecients are also chosen in F2 , so that the public functions Pi , 1 i n, are n quadratic equations in (n + v ) unknowns of F16, with coecients in F2. In this case (the signature scheme is still the one of section 8), the length of the public key is 2.2 Kbytes (or 4 Kbytes). Note: In all these examples, n 16 in order to avoid Grobner bases algorithms to nd a solution x (cf [5]), and q n 2 in order to avoid exhaustive search on x. 64

15 Concrete example of parameters for HFEV At the present, it seems possible to choose a small value for v (for example v = 3) and a small value for d (for example d = 17 if K = F2).

16 State of the art (in May 1999) on Public-Key schemes with Multivariate Polynomials over a small nite eld Recently, many new ideas have been introduced to improve the schemes, such as UOV or HFEV described in this paper. Another idea is to x some variables to hide some algebraic properties (see below). However, many new ideas have also been introduced to design better attacks on previous 14

schemes, such as the { not yet published { papers [21], [3], [1], [4]. So the eld is fast moving and it can look a bit confusing at rst. Moreover, some authors use the word \cryptanalysis" for \breaking" and some authors use this word with the meaning \an analysis about the security" that does not necessary mean \breaking". In this section, we describe what we know at the present about the main schemes. In the large families of the schemes with a public key based on multivariate polynomials over a small nite eld, we can distinguish between 5 main families characterized by the way the trapdoor is introduced or on the dicult problem on which the security relies. In the rst family are the schemes \with a Hidden Monomial", i.e. the key idea is to compute an exponentiation x 7! xd in a nite eld for secret key computation and to \hide" such a function in the public key. In the second family are the schemes where a polynomial function (with more than one monomial) is hidden. In the third family, the security relies on an isomorphism problem. In the fourth family, the security relies on the diculty of nding the decomposition of two multivariate quadratic polynomials from all or part of their composition. Finally, in the fth family, the secret key computations are based on Gaussian computations. The main schemes in these families are described in the gure below. The most interesting schemes in each family are in a rectangle. Family 1: C (1985-1995) Schemes with a Hidden Monomial (ex: Dragons with one monomial)

C ??

Family 2: HFE, Dragons (with a polynomial), HM

[email protected]@ @@ ??

HFE? , HFE+ , HFEF

HFEV, HFEV?

HM ?

Family 4: (Original) Oil and Vinegar (1997-1998) Unbalanced Oil and Vinegar (UOV)

Family 3: IP

Family 5: 2 Round schemes (2R) (D, 2R with S-boxes) 2R?

C was the rst scheme of all, and it can be seen as the ancestor of all these schemes. It was

designed in [11] and broken in [12]. Schemes with a Hidden Monomial (such as some Dragon schemes) were studied in [14], where it is shown that most of the simplest variations of C are insecure. However, C ?? (studied in [19]) is (at the present) the most ecient signature scheme (in time and RAM) in a smartcard. The scheme is not broken (but it may seem too simple or too close to C to have a large con dence in its security ...). HFE was designed in [13]. The most recent results about its security are in [21] and [3]. In these papers, very clever attacks are described. However, at the present, it seems that the scheme is not broken since for well chosen and still reasonable parameters the computations required to break it are still too large (moreover, asymptotically, the cryptanalysis is not polynomial if d increases as d = O(n) for example). For example, the rst challenge of US $500 given in the extended version of [13] has not been claimed yet (it is a pure HFE with n = 80 and d = 96 over F2 ). HFE? is just an HFE where k of the originally public equations are not publish. Due to [21] and [3], it may be recommended to do this (despite the fact that original HFE may be secure without 15

it). In the extended version of [13] a second challenge of US $500 is described on a HFE? . In an encryption scheme, k must be small, but in a signature scheme, k may be large. HFEV is described in this paper. HFEV and HFEV? look very hard to break. Moreover, HFEV is more ecient than the original HFE and it can give public key signatures of only 80 bits ! In a signature scheme, the number v of \vinegar variables" can be large, but in an encryption scheme, v must be small. HFE+ is just an HFE scheme where the n originally public equations have been linearly mixed with k truly random equations. In a signature scheme, k must be small, but in an encryption scheme, k may be large. HFEF is just an HFE scheme where k of the variables xi have been xed. In a signature scheme, k must be small, but in an encryption scheme, k may be large. HFEVF+? is just an HFE scheme where all these \perturbations" (V, F, +, ?) have been applied on the public key. HM and HM ? were designed in [19]. Very few analysis have been done in these schemes (but maybe we can recommend to use HM ? instead of HM ?). IP was designed in [13]. IP schemes have the best proofs of security so far (see [18]). IP is very simple and can be seen as a nice generalization of Graph Isomorphism. Oil and Vinegar was presented in [15] and broken in [9]. UOV is described in this paper. With IP, they are certainly the most simple schemes. 2R was designed in [16] and [17]. Due to [1], it is necessary to have at least 128 bits in input in the \2R with S-boxes" scheme, and due to [4], it may be wise to not publish all the (originally) public equations in all the 2R schemes: this gives the 2R? algorithms (the eciency of the decomposition algorithms given in [4] on the 2R schemes is not yet completely clear).

Remark 1: When a new scheme is found in these families, we do not necessary have to explain how

the trapdoor has been introduced. Then we have a \Secret-Public Key scheme" ! The scheme is clearly a Public Key scheme since anybody can verify a signature from the public key (or can encrypt from the public key) and the scheme is secret since the way to compute the secret key computations (i.e. the way the trapdoor has been introduced) has not been revealed. For example, we could have done this for HFEV (instead of publishing it).

Remark 2: These schemes are of theoretical interest but (at the exception of IP) their security is

not directly relied to a clearly de ned and considered to be dicult problem. So is it reasonable to implement them in real products ? We think indeed that it is a bit risky to rely all the security of sensitive applications on such scheme. However, at the present, most of the smartcard applications use secret key algorithms because RSA smartcards are more expensive. So it can be reasonable to put in a low-cost smartcard one of the previous public key schemes in addition to (not instead of) the existing secret key schemes (such as Triple-DES). Then the security can only be increased, the price of the smartcard would still be low (no coprocessor needed). The security would then rely on a master secret key for the secret key algorithm (with the risk of depending on a master secret key) and on a new low-cost public-key scheme (with the risk that the scheme has no proof of security).

17 Conclusion In this paper, we have presented two new public key schemes: UOV and HFEV. The study of such schemes has led us to analyze very general properties about the solutions of systems of general quadratic forms. Moreover, from the general view presented in section 15, we see that these two schemes are at the present among the most interesting schemes in two of the ve main families of schemes based on multivariate polynomials over a small nite eld. Will this still be true in a few years ? 16

References [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21]

E. Biham, Cryptanalysis of Patarin's 2-Round Public Key System with S Boxes, not yet published. D. Coppersmith, personal communication, e-mail. N. Courtois, Practical cryptanalysis of Hidden Field Equations (HFE), not yet published. Z. Dai, D. Ye, K.-Y. Lam, Factoring-attacks on Asymmetric Cryptography Based on Mappingcompositions, not yet published. J.-C. Faugere, personal communication. H. Fell, W. Die, Analysis of a public key approach based on polynomial substitutions, Proceedings of CRYPTO'85, Springer-Verlag, vol. 218, pp. 340-349 M. Garey, D. Johnson, Computers and Intractability, a Guide to the Theory of NP-Completeness, Freeman, p. 251. H. Imai, T. Matsumoto, Algebraic Methods for Constructing Asymmetric Cryptosystems, Algebraic Algorithms and Error Correcting Codes (AAECC-3), Grenoble, 1985, Springer-Verlag, LNCS no 229. A. Kipnis, A. Shamir, Cryptanalysis of the Oil and Vinegar Signature Scheme, Proceedings of CRYPTO'98, Springer, LNCS no 1462, pp. 257-266. R. Lidl, H. Niederreiter, Finite Fields, Encyclopedia of Mathematics and its applications, volume 20, Cambridge University Press. T. Matsumoto, H. Imai, Public Quadratic Polynomial-tuples for ecient signature-veri cation and message-encryption, Proceedings of EUROCRYPT'88, Springer-Verlag, pp. 419-453. J. Patarin, Cryptanalysis of the Matsumoto and Imai public Key Scheme of Eurocrypt'88, Proceedings of CRYPTO'95, Springer-Verlag, pp. 248-261. J. Patarin, Hidden Fields Equations (HFE) and Isomorphisms of Polynomials (IP) : Two New Families of Asymmetric Algorithms, Proceedings of EUROCRYPT'96, Springer, pp. 33-48. J. Patarin, Asymmetric Cryptography with a Hidden Monomial, Proceedins of CRYPTO'96, Springer, pp. 45-60. J. Patarin, The Oil and Vinegar Signature Scheme, presented at the Dagstuhl Workshop on Cryptography, september 1997 (transparencies). J. Patarin, L. Goubin, Trapdoor One-way Permutations and Multivariate Polynomials, Proceedings of ICICS'97, Springer, LNCS no 1334, pp. 356-368. J. Patarin, L. Goubin, Asymmetric Cryptography with S-Boxes, Proceedings of ICICS'97, Springer, LNCS no 1334, pp. 369-380. J. Patarin, L. Goubin, N. Courtois, Improved Algorithms for Isomorphisms of Polynomials, Proceedings of EUROCRYPT'98, Springer, pp. 184-200. J. Patarin, L. Goubin, N. Courtois, C? + and HM: Variations Around Two Schemes of T. Matsumoto and H. Imai, Proceedings of ASIACRYPT'98, Springer, pp. 35-49. A. Shamir, A simple scheme for encryption and its cryptanalysis found by D. Coppersmith and J. Stern, presented at the Luminy workshop on cryptography, september 1995. A. Shamir, A. Kipnis, Cryptanalysis of the HFE Public Key Cryptosystem, to be published at CRYPTO'99. 17