A failure in decryption process for bivariate polynomial reconstruction problem cryptosystem

TL;DR

This paper identifies a decryption failure in a bivariate polynomial-based cryptosystem when errors exceed a certain threshold.

Contribution

The paper introduces a new upper bound to prevent decryption failure in bivariate polynomial reconstruction cryptosystems.

Findings

Decryption failure occurs when error weight exceeds the number of monomials in the secret polynomial.

An upper bound is established to avoid decryption failure in the cryptosystem.

Abstract

In 1999, the Polynomial Reconstruction Problem (PRP) was put forward as a new hard mathematics problem. A univariate PRP scheme by Augot and Finiasz was introduced at Eurocrypt in 2003, and this cryptosystem was fully cryptanalyzed in 2004. In 2013, a bivariate PRP cryptosystem was developed, which is a modified version of Augot and Finiasz's original work. This study describes a decryption failure that can occur in both cryptosystems. We demonstrate that when the error has a weight greater than the number of monomials in a secret polynomial, p, decryption failure can occur. The result of this study also determines the upper bound that should be applied to avoid decryption failure.

Figures

Full text

Introduction

1

A valid and secure cryptosystem can be designed using a good hard mathematical problem in cryptography. Cryptography is an important mechanism in data security where the cryptography algorithm makes communication possible in the presence of an adversary [8], [30]. User's private data in embedded system needs to be protected and authenticated. It is essential for users to ensure that data consumed is valid [10], [28]. Shor's algorithm has successfully solved classical problems such as the integer factorization problem (IFP) and the discrete logarithm problem (DLP) in polynomial time, where a quantum computer can attack cryptosystems that rely on such difficult mathematical problems [1], [3], [34]. Among the well-known cryptographic schemes that are algorithmically insecure in post quantum cryptography are RSA, El-Gamal, and Elliptic Curve Cryptosystem [7], [22]. The National Institute of Standards and Technology (NIST) has called for a search for quantum-resistant algorithms [4], [11], [13], [33].

Hence, this shows that post-quantum cryptography is preferable for information security purposes. Post-quantum cryptography is a cryptographic algorithm that is believed to be secure from the attack of quantum computer [21]. Post-quantum cryptography also consists of five major types which are lattice-based, code-based, isogeny-based, hash-based and multivariate-based cryptography [9], [19]. The Quantum Algorithm Zoo website lists useful hard mathematical problems that may be immune to a quantum computing attack [20]. Thus, cryptographers must investigate diverse hard problems so that the new design cryptosystems are safe from the attack of quantum computers [18]. The evaluation of time intricacy and memory space for the attack is to ensure and validate the safety of the cryptosystems [26], [27].

Quantum Algorithm Zoo introduced the PRP as a difficult mathematical problem in post-quantum cryptography [20]. This problem was introduced in 1999 when PRP developed a formulation equivalent to Reed-Solomon error-correcting codes [6], [29], [31]. The problem also contains the full intricacy against the quantum computers with the complexity of $[eqn]$ in which q contains n bits of prime. Besides that, a wide range of research on the PRP has been conducted based on the solvability and robustness [25].

This problem can be easily solved if the error's weight, w, is at most $[eqn]$ . The parameter n represents the number of elements of the vector, while the parameter k represents the polynomial degree. This equation has been upgraded into $[eqn]$ [16]. Augot and Finiasz suggested a univariate PRP cryptosystem in 2003, where we call this scheme the AF-Cryptosystem. A univariate polynomial is used in the AF-Cryptosystem [23], [24]. The AF-Cryptosystem also applied two PRP types: the first PRP is defined in [20], and the second PRP is built to guarantee the process of decryption. The second PRP is denoted as the Augot and Finiasz Solvable PRP (AF-SPRP), which is described below:

Definition 1***(Augot and Finiasz Solvable PRP)*** Given n, k, t and $[eqn]$ , output any polynomial p such that $[eqn]$ and $[eqn]$ for at least t values of i where $[eqn]$ .

From Definition 1, the decryption process can occur in the AF-Cryptosystem. From the Cartesian plane, if we obtain t points, a polynomial is required to be yielded in which this polynomial consists of all the points where t is the zero element in a vector. The decryption process in the AF-Cryptosystem can be done using Lagrange interpolation.

Nevertheless, the AF-Cryptosystem was managed to be fully cryptanalyzed by Coron [12]. Next, a bivariate PRP cryptosystem was proposed in 2013 by Ajeena et al.; this cryptosystem is called the AAK-Cryptosystem [2]. The AAK-Cryptosystem is the modified version of the AF-Cryptosystem where they used bivariate polynomial and Vandermonde method. The creators of AAK-Cryptosystem mentioned that if the amount of variables increases, then the cryptosystem's security level can be improved.

Our contribution. In this paper, we analyze the decryption process for both cryptosystems, which is different from our published papers in [36], [37]. In our published papers, we put forward results that discusses the AAK-Cryptosystem is not indistinguishable chosen plaintext attack (IND-CPA) secure and how to retrieve the private key from the AAK-Cryptosystem. While our findings in this paper indicate that decryption errors can occur in both cryptosystems if the weight of the big error vector E is greater than the number of monomials in the secret polynomial p.

Organization of the article. This paper's setup is as follows: in Section 2, we put forward the fundamentals of PRP, Lagrange interpolation, and Vandermonde method and outline both AF-Cryptosystem and AAK-Cryptosystem. In Section 3, we explain our propositions for decryption failure in both cryptosystems and give an example for this analysis. Finally, we discuss our result in Section 4 and we conclude our findings in Section 5.

Materials and methods

2

This section explains the fundamental knowledge about PRP, Lagrange interpolation, Vandermonde method, AF-Cryptosystem and AAK-Cryptosystem.

PRP

2.1

The PRP is known since the generalized Reed-Solomon list decoding problem has been reduced to it [32]. Next, we describe PRP based on [20], which shown down below:

Definition 2***(PRP from Quantum Zoo)*** Let $[eqn]$ be a polynomial over finite field $[eqn]$ . One is given access to the oracle and query value of $[eqn]$ where $[eqn]$ then output coefficients $[eqn]$ to determine $[eqn]$ .

From Definition 2, this shows that when the oracle input $[eqn]$ , then it will output $[eqn]$ . Then, this provides us the coefficients $[eqn]$ [20]. Classically, we need $[eqn]$ queries to identify the number of coefficients. Therefore, the query complexity in PRP for a univariate polynomial with a degree equal to k is $[eqn]$ .

Computational complexity of PRP

2.2

We know that $[eqn]$ has a degree equal to k, and $[eqn]$ contains $[eqn]$ coefficients, equivalent to $[eqn]$ , hence $[eqn]$ . Thus,

$$[eqn]$$

It is impractical for us to query input x if $[eqn]$ is exponentially large. This shows that solving PRP would take exponential time, which is $[eqn]$ .

Lagrange interpolation

2.3

The Lagrange interpolation method can identify a polynomial based on the observed value at each observed point. Besides that, Lagrange interpolation is regularly utilized in cryptography to share secret and coding computing [14]. The Lagrange interpolation is where we are provided n real values $[eqn]$ and $[eqn]$ , then output a polynomial p that contains real coefficients which satisfies $[eqn]$ where $[eqn]$ [17]. Polynomial p must have a degree less than the real values where $[eqn]$ . The Lagrange interpolation formula with nth order is as follows,

$$[eqn]$$

The AF-Cryptosystem utilized Lagrange interpolation in decryption process.

Vandermonde method

2.4

An interpolation polynomial with two or more dimensions is determined using the Vandermonde method. Given points that have two variables where $[eqn]$ , for each point, one must obtain the polynomial values $[eqn]$ , correspondingly. The two variables polynomial with the degree of $[eqn]$ can be obtained by using the following steps,

• 1.Formulate the formula of a polynomial with the degree $[eqn]$ where this polynomial contains two variables.
• 2.Calculate the polynomial at the given points.
• 3.Solve the system of linear equations.

The problem can be presented in the form $[eqn]$ where V is a Vandermonde matrix with the dimension of $[eqn]$ , also known as coefficients matrix [15], [35]. Parameter Z contains z values, while parameter c is the coefficient vector. The AAK-Cryptosystem applied the Vandermonde method in the decryption process.

AF-cryptosystem

2.5

Augot and Finiasz introduced a univariate PRP cryptosystem which describes down below [5]. Considering that n is the number of elements in the vector and the AF-cryptosystem applied the following parameters in Table 1.Table 1. Parameters.Table 1. ParameterRemark $[eqn]$ A finite field of size q**nThe number of elements in the vectorkIts dimensionWThe weight of big error vector, E where PRP is hard when, $[eqn]$ [2]wThe weight of small error vector, e that enabling the PRP to decrypt the ciphertext when $[eqn]$ [12]

Remark 1The parameter w is the vector's maximum number of nonzero elements.

Remark 2The parameter $[eqn]$ is known as the number of zero elements of the vector. The proposed AF-Cryptosystem is as follows:

Algorithm 1Key generation process.Algorithm 1

Algorithm 2Encryption process.Algorithm 2

Algorithm 3Decryption process.Algorithm 3

Proof of correctness

2.5.1

Proposition 1 The message polynomial $[eqn]$ can be obtained through the decryption algorithm in AF-Cryptosystem.

ProofRefer to Appendix A. □

AAK-cryptosystem

2.6

The AF-Cryptosystem was altered by Ajeena et al. to create the bivariate PRP cryptosystem that is described below [2]. The AAK-Cryptosystem applied the parameters in Table 1. The proposed modified cryptosystem is as follows:

Algorithm 4Key generation process.Algorithm 4

Algorithm 5Encryption process.Algorithm 5

Algorithm 6Decryption process.Algorithm 6

Proof of correctness

2.6.1

Proposition 2 The proof of the decryption algorithm in AAK-Cryptosystem is correct.

ProofRefer to Appendix B. □

The decryption failure

3

This section explains how decryption failure can occur in the AF-Cryptosystem and AAK-Cryptosystem. A numerical illustration is also provided.

Decryption failure in AF-cryptosystem

3.1

Proposition 3 If the weight of nonzero element in big error E is $[eqn]$ , then the decryption process in AF-Cryptosystem cannot occur.

ProofRefer to Appendix C. □

Numerical illustration for Proposition 3

3.1.1

In this section, inline with Proposition 3, we put forward a numerical example where the system owner incorrectly sets the system parameters such that $[eqn]$ which would lead to the system owner unable to decrypt the ciphertext.

Example 1Let $[eqn]$ , $[eqn]$ , $[eqn]$ and $[eqn]$ in $[eqn]$ . Given $[eqn]$ . We start with the key generation process by taking the private polynomial,

$$[eqn]$$

and big error vector E,

$$[eqn]$$

The public key is:

$$[eqn]$$

Vector C is obtained by the evaluation of $[eqn]$ where:

$$[eqn]$$ $$[eqn]$$

Hence, $[eqn]$ . Then, compute PK as follows,

$$[eqn]$$

Next, in encryption process, we evaluate $[eqn]$ codeword μ which shown as follows,

$$[eqn]$$ $$[eqn]$$

Thus, we have

$$[eqn]$$

Next, we generate a constant $[eqn]$ and a small error vector, e where

$$[eqn]$$

Observe that the weight for the small error vector is $[eqn]$ . Then, the CT is:

$$[eqn]$$

In the decryption process, based on the AF-Cryptosystem, we need to consider the position of zero elements in E where $[eqn]$ . From E, we have

$$[eqn]$$

Therefore, we obtain two shadows $[eqn]$ . Next, Lagrange interpolation is applied to find $[eqn]$ . The degree of polynomial $[eqn]$ must be $[eqn]$ . From $[eqn]$ , we have

$$[eqn]$$

Hence, the unique polynomial $[eqn]$ is as follows,

$$[eqn]$$

As we can see here, $[eqn]$ has a degree of 1, which is smaller than $[eqn]$ . Therefore, we cannot identify $[eqn]$ due to the small size of $[eqn]$ . Hence, the decryption process is a failure.

Decryption failure in AAK-cryptosystem

3.2

This section presents the scenario where the decryption process in AAK-Cryptosystem is a failure. A larger size of W, will make it difficult to determine the message polynomial, $[eqn]$ .

Proposition 4 If the weight of nonzero element in big error E is larger than number of monomial of secret polynomial $[eqn]$ , then the decryption process in AAK-Cryptosystem cannot occur.

ProofRefer to Appendix D. □

Numerical illustration of Proposition 4

3.2.1

In this section, inline with Proposition 4, we put forward a numerical example where the system owner incorrectly sets the system parameters such that $[eqn]$ which would lead to the system owner unable to decrypt the ciphertext.

Example 2Let $[eqn]$ , $[eqn]$ , $[eqn]$ and $[eqn]$ in $[eqn]$ . Given $[eqn]$ and $[eqn]$ . We start with the key generation process by taking the secret polynomial,

$$[eqn]$$

and big error vector E,

$$[eqn]$$

The public key is:

$$[eqn]$$

Vector C is obtained where the $[eqn]$ is evaluated down below:

$$[eqn]$$ $$[eqn]$$

Thus, $[eqn]$ . Then, the PK is as follows,

$$[eqn]$$

Next, in encryption process, we evaluate $[eqn]$ codeword μ which shown as follows,

$$[eqn]$$ $$[eqn]$$

Hence, we obtain

$$[eqn]$$

Next, we generate a secret value $[eqn]$ and a small error vector, e such that

$$[eqn]$$

Observe that the weight for the small error vector is $[eqn]$ . Then, CT is:

$$[eqn]$$

In the decryption process, based on the AAK-cryptosystem, we need to consider the position of zero elements in E where $[eqn]$ . From E we have

$$[eqn]$$

Thus, we contain three shadows $[eqn]$ . The next step is to find a unique polynomial $[eqn]$ using the Vandermonde method. Polynomial $[eqn]$ must be with the degree of $[eqn]$ for X and Y. Let $[eqn]$ , we have,

$$[eqn]$$ $$[eqn]$$ $$[eqn]$$

We need to determine the coefficients for $[eqn]$ by using Gaussian elimination,

$$[eqn]$$

Then, the equation of the system is

$$[eqn]$$

As we can see here, the system shows that $[eqn]$ is a free variable and is not a unique solution. Hence, we cannot identify $[eqn]$ . From $[eqn]$ , we have insufficient information to identify unique polynomial $[eqn]$ . Hence, the decryption process cannot be done.

Discussion

4

Based on the results, we need to ensure the weight of big error vector W, is less than the number of monomials of the secret polynomial p, for both AF-Cryptosystem and AAK-cryptosystem. The users of these cryptosystems need to take into consideration information regarding the boundary value for W, to prevent decryption failure from occurring.

Conclusion

5

This paper presents that decryption failure can occur in AF-Cryptosystem and AAK-Cryptosystem. When W is greater than the number of monomials of secret polynomial p, then we cannot determine unique polynomial q. Hence, we cannot decrypt the ciphertext, CT, to identify the message polynomial, μ. Thus, the recommended weight for big error vector, E to be used in AF-Cryptosystem and AAK-Cryptosystem are $[eqn]$ and $[eqn]$ respectively so that decryption process can occur. For the future works, we would suggest an investigation into whether the size of the message polynomial that is used in both cryptosystems could also contribute towards decryption failure.

Availability of data and materials

Not applicable.

Consent of publication

Not applicable.

CRediT authorship contribution statement

Siti Nabilah Yusof: Writing – original draft, Methodology, Formal analysis, Conceptualization. Muhammad Rezal Kamel Ariffin: Writing – review & editing, Validation, Supervision, Funding acquisition. Sook-Chin Yip: Writing – review & editing, Funding acquisition. Terry Shue Chien Lau: Formal analysis. Zahari Mahad: Formal analysis. Ji-Jian Chin: Funding acquisition, Formal analysis. Choo-Yee Ting: Formal analysis.

Declaration of Competing Interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.