Linear Bandwidth Naccache-Stern Encryption

Authors:
Benoît Chevallier-Mames;David Naccache;Jacques Stern
Affiliations:
DCSSI, Laboratoire de cryptographie, Paris, France 75700;École normale supérieure, Équipe de cryptographie, Paris cedex 05, France F-75230;École normale supérieure, Équipe de cryptographie, Paris cedex 05, France F-75230
Venue:
SCN '08 Proceedings of the 6th international conference on Security and Cryptography for Networks
Year:
2008

Citing 5
Cited 3

Constructive combinatorics

Constructive combinatorics
Gauss' algorithm revisited

Journal of Algorithms
Secure Integration of Asymmetric and Symmetric Encryption Schemes

CRYPTO '99 Proceedings of the 19th Annual International Cryptology Conference on Advances in Cryptology
A new public-key cryptosystem

EUROCRYPT'97 Proceedings of the 16th annual international conference on Theory and application of cryptographic techniques
Cryptocomputing with rationals

FC'02 Proceedings of the 6th international conference on Financial cryptography

Chosen-Ciphertext Secure RSA-Type Cryptosystems

ProvSec '09 Proceedings of the 3rd International Conference on Provable Security
A public key cryptosystem based upon euclidean addition chains

SETA'10 Proceedings of the 6th international conference on Sequences and their applications
Improved cryptanalysis of a knapsack-based probabilistic encryption scheme

Information Sciences: an International Journal

Quantified Score

Hi-index	0.00

Visualization

Abstract

The Naccache-Stern (ns) knapsack cryptosystem is an original yet little-known public-key encryption scheme. In this scheme, the ciphertext is obtained by multiplying public-keys indexed by the message bits modulo a prime p. The cleartext is recovered by factoring the ciphertext raised to a secret power modulo p.nsencryption requires a multiplication per two plaintext bits on the average. Decryption is roughly as costly as an rsadecryption. However, nsfeatures a bandwidth sublinear in log p, namely log p/ log log p. As an example, for a 2048-bit prime p, nsencryption features a 233-bit bandwidth for a 59-kilobyte public key size.This paper presents new nsvariants achieving bandwidths linearin log p. As linear bandwidth claims a public-key of size log3p/ log log p, we recommend to combine our scheme with other bandwidth optimization techniques presented here.For a 2048-bit prime p, we obtain figures such as 169-bit plaintext for a 10-kilobyte public key, 255-bit plaintext for a 20-kilobyte public key or a 781-bit plaintext for a 512-kilobyte public key. Encryption and decryption remain unaffected by our optimizations: As an example, the 781-bit variant requires 152 multiplications per encryption.