C*-+ and HM: Variations Around Two Schemes of T. Matsumoto and H. Imai

  • Authors:
  • Jacques Patarin;Louis Goubin;Nicolas Courtois

  • Affiliations:
  • -;-;-

  • Venue:
  • ASIACRYPT '98 Proceedings of the International Conference on the Theory and Applications of Cryptology and Information Security: Advances in Cryptology
  • Year:
  • 1998

Quantified Score

Hi-index 0.00

Visualization

Abstract

In [4], H. Imai and T. Matsumoto presented new candidate trapdoor one-way permutations with a public key given as multivariate polynomials over a finite field. One of them, based on the idea of hiding a monomial field equation, was later presented in [7] under the name C•. It was broken by J. Patarin in [8]. J. Patarin and L. Goubin then suggested ([9], [10], [11], [12]) some schemes to repair C•, but with slightly more complex public key or secret key computations. In part I, we study some very simple variations of C• - such as C• +• - where the attack of [8] is avoided, and where the very simple secret key computations are kept. We then design some new cryptanalysis that are efficient against some of - but not all - these variations. [C] is another scheme of [4], very different from C• (despite the name), and based on the idea of hiding a monomial matrix equation. In part II, we show how to attack it (no cryptanalysis had been published so far). We then study more general schemes, still using the idea of hiding matrix equations, such as HM. An extended version of this paper can be obtained from the authors.