Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Public-Key Identification Schemes Based on
Multivariate Polynomials
Cassius Puodzius
Technische Universit¨t Darmstadt
a
July 19, 2012

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Outline
Outline of the talk
Preliminary
Identification Schemes
MQ Problem
MQ-based Identification Scheme
3-pass Protocol
Soundness
Zero-Knowledge
Parameters
Implementation
Further Schemes
MQ 5-pass Protocol
MC 3,5-pass Protocol
MP 3,5-pass Protocol

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Identification Schemes
Problem
Peggy wants to prove Victor that she is actually Peggy. On the
other hand, Victor wants to be sure that Oscar is not trying to
impersonate Peggy.
Protocol
Peggy Victor

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Identification Schemes
Challange-Response
Challange: Victor prepares a challenge, which is solvable with
the knowledge of some secret that belongs to Peggy.
Response: Peggy sends back the challenge response to Victor.

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Identification Schemes
Interactive Proof
(Challenge)
←−

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Identification Schemes
Interactive Proof
(Response)
−→

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Identification Schemes
Interactive Proof
(Challenge)
←−
(Response)
−→
Many times!

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Identification Schemes
Completeness
If the prover knows the secret, after the interaction, then Victor
can trust that the prover is actually Peggy (with very high
probability).
Soundness
If the prover is not Peggy, then he/she cannot fool Victor (with
very high probability).

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Identification Schemes
Completeness
If the prover knows the secret, after the interaction, then Victor
can trust that the prover is actually Peggy (with very high
probability).
Soundness
If the prover is not Peggy, then he/she cannot fool Victor (with
very high probability).

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Identification Schemes
Quite good... but not enough!
Could Victor prepare challenges in order to learn Peggy’s secret
and be able to impersonate her in the future?
Conformation
In order to avoid Victor specifically crafted challenges, this step is
replaced by:
1 Peggy chooses a bunch of challenge candidates and send them
to Victor
2 Victor choose one of them and send it back to Peggy

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Identification Schemes
Quite good... but not enough!
Could Victor prepare challenges in order to learn Peggy’s secret
and be able to impersonate her in the future?
Conformation
In order to avoid Victor specifically crafted challenges, this step is
replaced by:
1 Peggy chooses a bunch of challenge candidates and send them
to Victor
2 Victor choose one of them and send it back to Peggy

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Identification Schemes
Zero-Knowledge
A interactive proof which grant no further information to the
verifier beyond those he could get himself.

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Cut-and-choose
Cut-and-choose Paradigm
Peggy divides her secret into shares and prove the knowledge
of (some) them, according to the choice of Victor
Moreover, Peggy does not reveal any share of the secret itself

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ Problem
MQ Function
Given x ∈ Fn , a function fl : Fn → Fq is defined as:
q q
fl (x) = Σn Σn al,i,j xi xj + Σn bl,i xi
i=1 j=i i=1
A MQ Function, F : Fn → Fm , is then defined as:
q q
F (x) = (f1 , . . . , fm )
The family of MQ functions is denoted by MQ(n, m, Fq ).
Polar Form
G (x, y ) = F (x + y ) − F (x) − F (y )
G (x, y ) is bilinear.

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ Problem
MQ Function
Given x ∈ Fn , a function fl : Fn → Fq is defined as:
q q
fl (x) = Σn Σn al,i,j xi xj + Σn bl,i xi
i=1 j=i i=1
A MQ Function, F : Fn → Fm , is then defined as:
q q
F (x) = (f1 , . . . , fm )
The family of MQ functions is denoted by MQ(n, m, Fq ).
Polar Form
G (x, y ) = F (x + y ) − F (x) − F (y )
G (x, y ) is bilinear.

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ Problem
MQ Function
Given x ∈ Fn , a function fl : Fn → Fq is defined as:
q q
fl (x) = Σn Σn al,i,j xi xj + Σn bl,i xi
i=1 j=i i=1
A MQ Function, F : Fn → Fm , is then defined as:
q q
F (x) = (f1 , . . . , fm )
The family of MQ functions is denoted by MQ(n, m, Fq ).
Polar Form
G (x, y ) = F (x + y ) − F (x) − F (y )
G (x, y ) is bilinear.

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ Problem
MQ Function
Given x ∈ Fn , a function fl : Fn → Fq is defined as:
q q
fl (x) = Σn Σn al,i,j xi xj + Σn bl,i xi
i=1 j=i i=1
A MQ Function, F : Fn → Fm , is then defined as:
q q
F (x) = (f1 , . . . , fm )
The family of MQ functions is denoted by MQ(n, m, Fq ).
Polar Form
G (x, y ) = F (x + y ) − F (x) − F (y )
G (x, y ) is bilinear.

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ Problem
Multivariate Quadratic Polynomials over a Finite Field
Given y = F (x), it is not feasible to get some x , such that
F (x ) = y .
Features of MQ functions
There is no known quantum algorithm able to solve MQ
problem
Decision problem is know to be NP-complete
General attack: Gr¨bner basis. Which is exponential in time
o
and memory (if m = Θ(n))

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ Problem
Multivariate Quadratic Polynomials over a Finite Field
Given y = F (x), it is not feasible to get some x , such that
F (x ) = y .
Features of MQ functions
There is no known quantum algorithm able to solve MQ
problem
Decision problem is know to be NP-complete
General attack: Gr¨bner basis. Which is exponential in time
o
and memory (if m = Θ(n))

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ Problem
Multivariate Quadratic Polynomials over a Finite Field
Given y = F (x), it is not feasible to get some x , such that
F (x ) = y .
Features of MQ functions
There is no known quantum algorithm able to solve MQ
problem
Decision problem is know to be NP-complete
General attack: Gr¨bner basis. Which is exponential in time
o
and memory (if m = Θ(n))

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ Problem
Multivariate Quadratic Polynomials over a Finite Field
Given y = F (x), it is not feasible to get some x , such that
F (x ) = y .
Features of MQ functions
There is no known quantum algorithm able to solve MQ
problem
Decision problem is know to be NP-complete
General attack: Gr¨bner basis. Which is exponential in time
o
and memory (if m = Θ(n))

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
String Commitment Function
1 s is a fixed and ρ a is random string
2 c is statistically hiding and computationally binding
String Commitment Scheme
1 Peggy computes c ← Com(s; ρ) and sends it to Victor
2 Peggy sends s and ρ to Victor, which verifies whether
?
c = Com(s; ρ)

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
String Commitment Function
1 s is a fixed and ρ a is random string
2 c is statistically hiding and computationally binding
String Commitment Scheme
1 Peggy computes c ← Com(s; ρ) and sends it to Victor
2 Peggy sends s and ρ to Victor, which verifies whether
?
c = Com(s; ρ)

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Statistically hiding
No receiver is able to distinguish between Com(s1 ; ρ1 ) and
Com(s2 ; ρ2 )
Computationally binding
No sender is able to find in polynomial-time (s2 ; ρ2 ) such that
Com(s1 ; ρ1 ) = Com(s2 ; ρ2 )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Statistically hiding
No receiver is able to distinguish between Com(s1 ; ρ1 ) and
Com(s2 ; ρ2 )
Computationally binding
No sender is able to find in polynomial-time (s2 ; ρ2 ) such that
Com(s1 ; ρ1 ) = Com(s2 ; ρ2 )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Setup
Public known MQ(n, m, Fq ):
n → input dimension
m → number of equations
Fq → chosen finite field
Coefficients of MQ(n, m, Fq ) or a seed
From Peggy:
Secret key → s
Public key → v = F(s)
Victor’s Goal
From MQ(n, m, Fq ) and v decide whether the prover is indeed
Peggy.

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Setup
Public known MQ(n, m, Fq ):
n → input dimension
m → number of equations
Fq → chosen finite field
Coefficients of MQ(n, m, Fq ) or a seed
From Peggy:
Secret key → s
Public key → v = F(s)
Victor’s Goal
From MQ(n, m, Fq ) and v decide whether the prover is indeed
Peggy.

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Setup
Public known MQ(n, m, Fq ):
n → input dimension
m → number of equations
Fq → chosen finite field
Coefficients of MQ(n, m, Fq ) or a seed
From Peggy:
Secret key → s
Public key → v = F(s)
Victor’s Goal
From MQ(n, m, Fq ) and v decide whether the prover is indeed
Peggy.

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Why is G (x, y ) necessary?
Cut technique
Secret key s, Secret key v = F(s)
First cuts:
s = r0 + r1
v = F(r0 + r1 ) = F(r0 ) + F(r1 ) + G(r0 , r1 )
G(r0 , r1 ) still depends on r0 and r1 .
Repeat cut for r0 = t0 + t1 and F(r0 ) = e0 + e1
v = F(r0 ) + F(r1 ) + G(t0 + t1 , r1 )
= e0 + e1 + F(r1 ) + G(t0 , r1 ) + G(t1 , r1 )
= (G(t0 , r1 ) + e0 ) + (F(r1 ) + G(t1 , r1 ) + e1 )
Shares depends directly either on (r1 , t0 , e0 ) or (r1 , t1 , e1 ).

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Why is G (x, y ) necessary?
Cut technique
Secret key s, Secret key v = F(s)
First cuts:
s = r0 + r1
v = F(r0 + r1 ) = F(r0 ) + F(r1 ) + G(r0 , r1 )
G(r0 , r1 ) still depends on r0 and r1 .
Repeat cut for r0 = t0 + t1 and F(r0 ) = e0 + e1
v = F(r0 ) + F(r1 ) + G(t0 + t1 , r1 )
= e0 + e1 + F(r1 ) + G(t0 , r1 ) + G(t1 , r1 )
= (G(t0 , r1 ) + e0 ) + (F(r1 ) + G(t1 , r1 ) + e1 )
Shares depends directly either on (r1 , t0 , e0 ) or (r1 , t1 , e1 ).

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Why is G (x, y ) necessary?
Cut technique
Secret key s, Secret key v = F(s)
First cuts:
s = r0 + r1
v = F(r0 + r1 ) = F(r0 ) + F(r1 ) + G(r0 , r1 )
G(r0 , r1 ) still depends on r0 and r1 .
Repeat cut for r0 = t0 + t1 and F(r0 ) = e0 + e1
v = F(r0 ) + F(r1 ) + G(t0 + t1 , r1 )
= e0 + e1 + F(r1 ) + G(t0 , r1 ) + G(t1 , r1 )
= (G(t0 , r1 ) + e0 ) + (F(r1 ) + G(t1 , r1 ) + e1 )
Shares depends directly either on (r1 , t0 , e0 ) or (r1 , t1 , e1 ).

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Why is G (x, y ) necessary?
Cut technique
Secret key s, Secret key v = F(s)
First cuts:
s = r0 + r1
v = F(r0 + r1 ) = F(r0 ) + F(r1 ) + G(r0 , r1 )
G(r0 , r1 ) still depends on r0 and r1 .
Repeat cut for r0 = t0 + t1 and F(r0 ) = e0 + e1
v = F(r0 ) + F(r1 ) + G(t0 + t1 , r1 )
= e0 + e1 + F(r1 ) + G(t0 , r1 ) + G(t1 , r1 )
= (G(t0 , r1 ) + e0 ) + (F(r1 ) + G(t1 , r1 ) + e1 )
Shares depends directly either on (r1 , t0 , e0 ) or (r1 , t1 , e1 ).

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Why is G (x, y ) necessary?
Cut technique
Secret key s, Secret key v = F(s)
First cuts:
s = r0 + r1
v = F(r0 + r1 ) = F(r0 ) + F(r1 ) + G(r0 , r1 )
G(r0 , r1 ) still depends on r0 and r1 .
Repeat cut for r0 = t0 + t1 and F(r0 ) = e0 + e1
v = F(r0 ) + F(r1 ) + G(t0 + t1 , r1 )
= e0 + e1 + F(r1 ) + G(t0 , r1 ) + G(t1 , r1 )
= (G(t0 , r1 ) + e0 ) + (F(r1 ) + G(t1 , r1 ) + e1 )
Shares depends directly either on (r1 , t0 , e0 ) or (r1 , t1 , e1 ).

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Why is G (x, y ) necessary?
Cut technique
Secret key s, Secret key v = F(s)
First cuts:
s = r0 + r1
v = F(r0 + r1 ) = F(r0 ) + F(r1 ) + G(r0 , r1 )
G(r0 , r1 ) still depends on r0 and r1 .
Repeat cut for r0 = t0 + t1 and F(r0 ) = e0 + e1
v = F(r0 ) + F(r1 ) + G(t0 + t1 , r1 )
= e0 + e1 + F(r1 ) + G(t0 , r1 ) + G(t1 , r1 )
= (G(t0 , r1 ) + e0 ) + (F(r1 ) + G(t1 , r1 ) + e1 )
Shares depends directly either on (r1 , t0 , e0 ) or (r1 , t1 , e1 ).

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Why is G (x, y ) necessary?
Cut technique
Secret key s, Secret key v = F(s)
First cuts:
s = r0 + r1
v = F(r0 + r1 ) = F(r0 ) + F(r1 ) + G(r0 , r1 )
G(r0 , r1 ) still depends on r0 and r1 .
Repeat cut for r0 = t0 + t1 and F(r0 ) = e0 + e1
v = F(r0 ) + F(r1 ) + G(t0 + t1 , r1 )
= e0 + e1 + F(r1 ) + G(t0 , r1 ) + G(t1 , r1 )
= (G(t0 , r1 ) + e0 ) + (F(r1 ) + G(t1 , r1 ) + e1 )
Shares depends directly either on (r1 , t0 , e0 ) or (r1 , t1 , e1 ).

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Why is G (x, y ) necessary?
Cut technique
Secret key s, Secret key v = F(s)
First cuts:
s = r0 + r1
v = F(r0 + r1 ) = F(r0 ) + F(r1 ) + G(r0 , r1 )
G(r0 , r1 ) still depends on r0 and r1 .
Repeat cut for r0 = t0 + t1 and F(r0 ) = e0 + e1
v = F(r0 ) + F(r1 ) + G(t0 + t1 , r1 )
= e0 + e1 + F(r1 ) + G(t0 , r1 ) + G(t1 , r1 )
= (G(t0 , r1 ) + e0 ) + (F(r1 ) + G(t1 , r1 ) + e1 )
Shares depends directly either on (r1 , t0 , e0 ) or (r1 , t1 , e1 ).

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Why is G (x, y ) necessary?
Cut technique
Secret key s, Secret key v = F(s)
First cuts:
s = r0 + r1
v = F(r0 + r1 ) = F(r0 ) + F(r1 ) + G(r0 , r1 )
G(r0 , r1 ) still depends on r0 and r1 .
Repeat cut for r0 = t0 + t1 and F(r0 ) = e0 + e1
v = F(r0 ) + F(r1 ) + G(t0 + t1 , r1 )
= e0 + e1 + F(r1 ) + G(t0 , r1 ) + G(t1 , r1 )
= (G(t0 , r1 ) + e0 ) + (F(r1 ) + G(t1 , r1 ) + e1 )
Shares depends directly either on (r1 , t0 , e0 ) or (r1 , t1 , e1 ).

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Why is G (x, y ) necessary?
Cut technique
Secret key s, Secret key v = F(s)
First cuts:
s = r0 + r1
v = F(r0 + r1 ) = F(r0 ) + F(r1 ) + G(r0 , r1 )
G(r0 , r1 ) still depends on r0 and r1 .
Repeat cut for r0 = t0 + t1 and F(r0 ) = e0 + e1
v = F(r0 ) + F(r1 ) + G(t0 + t1 , r1 )
= e0 + e1 + F(r1 ) + G(t0 , r1 ) + G(t1 , r1 )
= (G(t0 , r1 ) + e0 ) + (F(r1 ) + G(t1 , r1 ) + e1 )
Shares depends directly either on (r1 , t0 , e0 ) or (r1 , t1 , e1 ).

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Protocol
Pick r0 , t0 ∈R Fn , e0 ∈R Fm
q q
r1 ← s − r0
t1 ← r0 − t0
e1 ← F(r0 ) − e0
c0 ← Com(r1 , G(t0 , r1 ) + e0 )
c1 ← Com(t0 , e0 )
c2 ← Com(t1 , e1 )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Protocol
Pick r0 , t0 ∈R Fn , e0 ∈R Fm
q q
r1 ← s − r0
t1 ← r0 − t0
e1 ← F(r0 ) − e0
c0 ← Com(r1 , G(t0 , r1 ) + e0 )
c1 ← Com(t0 , e0 )
c2 ← Com(t1 , e1 )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Protocol
Pick r0 , t0 ∈R Fn , e0 ∈R Fm
q q
r1 ← s − r0
t1 ← r0 − t0
e1 ← F(r0 ) − e0
c0 ← Com(r1 , G(t0 , r1 ) + e0 )
c1 ← Com(t0 , e0 )
c2 ← Com(t1 , e1 )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Protocol
Pick r0 , t0 ∈R Fn , e0 ∈R Fm
q q
r1 ← s − r0
t1 ← r0 − t0
e1 ← F(r0 ) − e0
c0 ← Com(r1 , G(t0 , r1 ) + e0 )
c1 ← Com(t0 , e0 )
c2 ← Com(t1 , e1 )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Protocol
(c0 ,c1 ,c2 )
−→

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Protocol
Pick Ch ∈R {0, 1, 2}

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Protocol
Ch
←−

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Protocol
If Ch = 0, then
Rsp ← (r0 , t1 , e1 )
If Ch = 1, then
Rsp ← (r1 , t1 , e1 )
If Ch = 2, then
Rsp ← (r1 , t0 , e0 )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Protocol
If Ch = 0, then
Rsp ← (r0 , t1 , e1 )
If Ch = 1, then
Rsp ← (r1 , t1 , e1 )
If Ch = 2, then
Rsp ← (r1 , t0 , e0 )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Protocol
If Ch = 0, then
Rsp ← (r0 , t1 , e1 )
If Ch = 1, then
Rsp ← (r1 , t1 , e1 )
If Ch = 2, then
Rsp ← (r1 , t0 , e0 )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Protocol
If Ch = 0, then
Rsp ← (r0 , t1 , e1 )
If Ch = 1, then
Rsp ← (r1 , t1 , e1 )
If Ch = 2, then
Rsp ← (r1 , t0 , e0 )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Protocol
Rsp
−→

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Protocol
If Ch = 0, parse Rsp = (r0 , t1 , e1 ) and check:
?
c1 = Com(r0 − t1 , F(r0 ) − e1 )
?
c2 = Com(t1 , e1 )
If Ch = 1, parse Rsp = (r1 , t1 , e1 ) and check:
?
c0 = Com(r1 , v − F(r1 ) − G(t1 , r1 ) − e1 )
?
c2 = Com(t1 , e1 )
If Ch = 2, parse Rsp = (r1 , t0 , e0 ) and check:
?
c0 = Com(r1 , G(t0 , r1 ) + e0 )
?
c1 = Com(t0 , e0 )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Protocol
If Ch = 0, parse Rsp = (r0 , t1 , e1 ) and check:
?
c1 = Com(r0 − t1 , F(r0 ) − e1 )
?
c2 = Com(t1 , e1 )
If Ch = 1, parse Rsp = (r1 , t1 , e1 ) and check:
?
c0 = Com(r1 , v − F(r1 ) − G(t1 , r1 ) − e1 )
?
c2 = Com(t1 , e1 )
If Ch = 2, parse Rsp = (r1 , t0 , e0 ) and check:
?
c0 = Com(r1 , G(t0 , r1 ) + e0 )
?
c1 = Com(t0 , e0 )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Protocol
If Ch = 0, parse Rsp = (r0 , t1 , e1 ) and check:
?
c1 = Com(r0 − t1 , F(r0 ) − e1 )
?
c2 = Com(t1 , e1 )
If Ch = 1, parse Rsp = (r1 , t1 , e1 ) and check:
?
c0 = Com(r1 , v − F(r1 ) − G(t1 , r1 ) − e1 )
?
c2 = Com(t1 , e1 )
If Ch = 2, parse Rsp = (r1 , t0 , e0 ) and check:
?
c0 = Com(r1 , G(t0 , r1 ) + e0 )
?
c1 = Com(t0 , e0 )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Protocol
If Ch = 0, parse Rsp = (r0 , t1 , e1 ) and check:
?
c1 = Com(r0 − t1 , F(r0 ) − e1 )
?
c2 = Com(t1 , e1 )
If Ch = 1, parse Rsp = (r1 , t1 , e1 ) and check:
?
c0 = Com(r1 , v − F(r1 ) − G(t1 , r1 ) − e1 )
?
c2 = Com(t1 , e1 )
If Ch = 2, parse Rsp = (r1 , t0 , e0 ) and check:
?
c0 = Com(r1 , G(t0 , r1 ) + e0 )
?
c1 = Com(t0 , e0 )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Protocol
If Ch = 0, parse Rsp = (r0 , t1 , e1 ) and check:
?
c1 = Com(r0 − t1 , F(r0 ) − e1 )
?
c2 = Com(t1 , e1 )
If Ch = 1, parse Rsp = (r1 , t1 , e1 ) and check:
?
c0 = Com(r1 , v − F(r1 ) − G(t1 , r1 ) − e1 )
?
c2 = Com(t1 , e1 )
If Ch = 2, parse Rsp = (r1 , t0 , e0 ) and check:
?
c0 = Com(r1 , G(t0 , r1 ) + e0 )
?
c1 = Com(t0 , e0 )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Protocol
If Ch = 0, parse Rsp = (r0 , t1 , e1 ) and check:
?
c1 = Com(r0 − t1 , F(r0 ) − e1 )
?
c2 = Com(t1 , e1 )
If Ch = 1, parse Rsp = (r1 , t1 , e1 ) and check:
?
c0 = Com(r1 , v − F(r1 ) − G(t1 , r1 ) − e1 )
?
c2 = Com(t1 , e1 )
If Ch = 2, parse Rsp = (r1 , t0 , e0 ) and check:
?
c0 = Com(r1 , G(t0 , r1 ) + e0 )
?
c1 = Com(t0 , e0 )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Protocol
If Ch = 0, parse Rsp = (r0 , t1 , e1 ) and check:
?
c1 = Com(r0 − t1 , F(r0 ) − e1 )
?
c2 = Com(t1 , e1 )
If Ch = 1, parse Rsp = (r1 , t1 , e1 ) and check:
?
c0 = Com(r1 , v − F(r1 ) − G(t1 , r1 ) − e1 )
?
c2 = Com(t1 , e1 )
If Ch = 2, parse Rsp = (r1 , t0 , e0 ) and check:
?
c0 = Com(r1 , G(t0 , r1 ) + e0 )
?
c1 = Com(t0 , e0 )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Completeness
Peggy will always give the right answer to Victor, since she has
sent (c0 , c1 , c2 ) and once that r0 , t0 and e0 are set, there is no
further randomness.
Soundness
RF = (v, x) ∈ Fm × Fn : v = F(x)
q q
Theorem. The 3-pass protocol is argument of knowledge for RF
with knowledge error 2/3 when the commitment scheme Com is
computationally binding.[5]
After enough rounds, the probability of impersonation by
Oscar is negligible.

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Completeness
Peggy will always give the right answer to Victor, since she has
sent (c0 , c1 , c2 ) and once that r0 , t0 and e0 are set, there is no
further randomness.
Soundness
RF = (v, x) ∈ Fm × Fn : v = F(x)
q q
Theorem. The 3-pass protocol is argument of knowledge for RF
with knowledge error 2/3 when the commitment scheme Com is
computationally binding.[5]
After enough rounds, the probability of impersonation by
Oscar is negligible.

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Completeness
Peggy will always give the right answer to Victor, since she has
sent (c0 , c1 , c2 ) and once that r0 , t0 and e0 are set, there is no
further randomness.
Soundness
RF = (v, x) ∈ Fm × Fn : v = F(x)
q q
Theorem. The 3-pass protocol is argument of knowledge for RF
with knowledge error 2/3 when the commitment scheme Com is
computationally binding.[5]
After enough rounds, the probability of impersonation by
Oscar is negligible.

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Completeness
Peggy will always give the right answer to Victor, since she has
sent (c0 , c1 , c2 ) and once that r0 , t0 and e0 are set, there is no
further randomness.
Soundness
RF = (v, x) ∈ Fm × Fn : v = F(x)
q q
Theorem. The 3-pass protocol is argument of knowledge for RF
with knowledge error 2/3 when the commitment scheme Com is
computationally binding.[5]
After enough rounds, the probability of impersonation by
Oscar is negligible.

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Zero-Knowledge
Theorem. The 3-pass protocol is statically zero knowledge when
the commitment scheme Com is statistically hiding.[5]
Victor has access only to r0 or r1 , t0 or t1 , e0 or e1 , which are
completely random.
Cut-and-choose
Private-key separated between (t0 , e0 ) part and (t1 , e1 ) part.

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Zero-Knowledge
Theorem. The 3-pass protocol is statically zero knowledge when
the commitment scheme Com is statistically hiding.[5]
Victor has access only to r0 or r1 , t0 or t1 , e0 or e1 , which are
completely random.
Cut-and-choose
Private-key separated between (t0 , e0 ) part and (t1 , e1 ) part.

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Zero-Knowledge
Theorem. The 3-pass protocol is statically zero knowledge when
the commitment scheme Com is statistically hiding.[5]
Victor has access only to r0 or r1 , t0 or t1 , e0 or e1 , which are
completely random.
Cut-and-choose
Private-key separated between (t0 , e0 ) part and (t1 , e1 ) part.

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Theoretical Security on the Protocol
Victor needs almost as many rounds as the desired security
level[2]
Practical Security on the Keys
For MQ(80, 84, F2 ): Best attack: improved exhaustive search
algorithm −→ 288.7 .[5][3]

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Theoretical Security on the Protocol
Victor needs almost as many rounds as the desired security
level[2]
Practical Security on the Keys
For MQ(80, 84, F2 ): Best attack: improved exhaustive search
algorithm −→ 288.7 .[5][3]

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Theoretical Security on the Protocol
Victor needs almost as many rounds as the desired security
level[2]
Practical Security on the Keys
For MQ(80, 84, F2 ): Best attack: improved exhaustive search
algorithm −→ 288.7 .[5][3]

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Theoretical Security on the Protocol
Victor needs almost as many rounds as the desired security
level[2]
Practical Security on the Keys
For MQ(80, 84, F2 ): Best attack: improved exhaustive search
algorithm −→ 288.7 .[5][3]

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Efficiency
Impersonation probability less than 2−30 [5]:
Number of rounds −→ 52
System parameter (bit) −→ 285, 600 (reducible to a seed of
128 bits)
Public key (bit) −→ 80
Secret key (bit) −→ 84
Communication (bit) −→ 20, 640
Arithmetic ops. (times/field) −→ 226 /F2
Hash function (times) −→ 4

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Efficiency
Impersonation probability less than 2−30 [5]:
Number of rounds −→ 52
System parameter (bit) −→ 285, 600 (reducible to a seed of
128 bits)
Public key (bit) −→ 80
Secret key (bit) −→ 84
Communication (bit) −→ 20, 640
Arithmetic ops. (times/field) −→ 226 /F2
Hash function (times) −→ 4

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Efficiency
Impersonation probability less than 2−30 [5]:
Number of rounds −→ 52
System parameter (bit) −→ 285, 600 (reducible to a seed of
128 bits)
Public key (bit) −→ 80
Secret key (bit) −→ 84
Communication (bit) −→ 20, 640
Arithmetic ops. (times/field) −→ 226 /F2
Hash function (times) −→ 4

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Efficiency
Impersonation probability less than 2−30 [5]:
Number of rounds −→ 52
System parameter (bit) −→ 285, 600 (reducible to a seed of
128 bits)
Public key (bit) −→ 80
Secret key (bit) −→ 84
Communication (bit) −→ 20, 640
Arithmetic ops. (times/field) −→ 226 /F2
Hash function (times) −→ 4

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Efficiency
Impersonation probability less than 2−30 [5]:
Number of rounds −→ 52
System parameter (bit) −→ 285, 600 (reducible to a seed of
128 bits)
Public key (bit) −→ 80
Secret key (bit) −→ 84
Communication (bit) −→ 20, 640
Arithmetic ops. (times/field) −→ 226 /F2
Hash function (times) −→ 4

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Efficiency
Impersonation probability less than 2−30 [5]:
Number of rounds −→ 52
System parameter (bit) −→ 285, 600 (reducible to a seed of
128 bits)
Public key (bit) −→ 80
Secret key (bit) −→ 84
Communication (bit) −→ 20, 640
Arithmetic ops. (times/field) −→ 226 /F2
Hash function (times) −→ 4

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Efficiency
Impersonation probability less than 2−30 [5]:
Number of rounds −→ 52
System parameter (bit) −→ 285, 600 (reducible to a seed of
128 bits)
Public key (bit) −→ 80
Secret key (bit) −→ 84
Communication (bit) −→ 20, 640
Arithmetic ops. (times/field) −→ 226 /F2
Hash function (times) −→ 4

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Protocol
Efficiency
Impersonation probability less than 2−30 [5]:
Number of rounds −→ 52
System parameter (bit) −→ 285, 600 (reducible to a seed of
128 bits)
Public key (bit) −→ 80
Secret key (bit) −→ 84
Communication (bit) −→ 20, 640
Arithmetic ops. (times/field) −→ 226 /F2
Hash function (times) −→ 4

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Implementation
Implementation

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
3-Pass Parallel version
Features
Require only one round, instead of multiple rounds
Still secure against active attacker

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
5-Pass Protocol
Features
Different cuts, i.e., αr0 = t0 + t1 and αF(r0 ) = e0 + e1 ; α ∈ Fq
and chosen by Victor.
Victor makes a challenge Ch ∈ {0, 1} and Peggy reveals
(r0 , t1 , e1 ) or (r1 , t1 , e1 )
For q = 2, Oscar has a higher chance to win a round than for
3-pass scheme
Larger system parameter for the same level of security
Larger key sizes for the same level of security
More efficient

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
5-Pass Protocol
Features
Different cuts, i.e., αr0 = t0 + t1 and αF(r0 ) = e0 + e1 ; α ∈ Fq
and chosen by Victor.
Victor makes a challenge Ch ∈ {0, 1} and Peggy reveals
(r0 , t1 , e1 ) or (r1 , t1 , e1 )
For q = 2, Oscar has a higher chance to win a round than for
3-pass scheme
Larger system parameter for the same level of security
Larger key sizes for the same level of security
More efficient

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
5-Pass Protocol
Features
Different cuts, i.e., αr0 = t0 + t1 and αF(r0 ) = e0 + e1 ; α ∈ Fq
and chosen by Victor.
Victor makes a challenge Ch ∈ {0, 1} and Peggy reveals
(r0 , t1 , e1 ) or (r1 , t1 , e1 )
For q = 2, Oscar has a higher chance to win a round than for
3-pass scheme
Larger system parameter for the same level of security
Larger key sizes for the same level of security
More efficient

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
5-Pass Protocol
Features
Different cuts, i.e., αr0 = t0 + t1 and αF(r0 ) = e0 + e1 ; α ∈ Fq
and chosen by Victor.
Victor makes a challenge Ch ∈ {0, 1} and Peggy reveals
(r0 , t1 , e1 ) or (r1 , t1 , e1 )
For q = 2, Oscar has a higher chance to win a round than for
3-pass scheme
Larger system parameter for the same level of security
Larger key sizes for the same level of security
More efficient

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
5-Pass Protocol
Features
Different cuts, i.e., αr0 = t0 + t1 and αF(r0 ) = e0 + e1 ; α ∈ Fq
and chosen by Victor.
Victor makes a challenge Ch ∈ {0, 1} and Peggy reveals
(r0 , t1 , e1 ) or (r1 , t1 , e1 )
For q = 2, Oscar has a higher chance to win a round than for
3-pass scheme
Larger system parameter for the same level of security
Larger key sizes for the same level of security
More efficient

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
5-Pass Protocol
Features
Different cuts, i.e., αr0 = t0 + t1 and αF(r0 ) = e0 + e1 ; α ∈ Fq
and chosen by Victor.
Victor makes a challenge Ch ∈ {0, 1} and Peggy reveals
(r0 , t1 , e1 ) or (r1 , t1 , e1 )
For q = 2, Oscar has a higher chance to win a round than for
3-pass scheme
Larger system parameter for the same level of security
Larger key sizes for the same level of security
More efficient

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MC 3,5-pass protocol
MC Function
Given x ∈ Fn , a function fl : Fn → Fq is defined as:
q q
fl (x) = Σn Σn Σn al,i,j,k xi xj xk + Σn Σn bl,i,j xi xj + Σn cl,i xi
i=1 j=i k=j i=1 j=i i=0
A MC Function, FMC : Fn → Fm , is then defined as:
q q
FMC (x) = (f1 , . . . , fm )
Polar Form
Mapping (x, y ) → FMC (x + y ) − FMC (x) − FMC (y ) is not
bilinear anymore.
Definition of a linear-in-one-argument (LOA) form of FMC :
GMC (x, y ) − GMC (y , x) = FMC (x + y ) − FMC (x) − FMC (y )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MC 3,5-pass protocol
MC Function
Given x ∈ Fn , a function fl : Fn → Fq is defined as:
q q
fl (x) = Σn Σn Σn al,i,j,k xi xj xk + Σn Σn bl,i,j xi xj + Σn cl,i xi
i=1 j=i k=j i=1 j=i i=0
A MC Function, FMC : Fn → Fm , is then defined as:
q q
FMC (x) = (f1 , . . . , fm )
Polar Form
Mapping (x, y ) → FMC (x + y ) − FMC (x) − FMC (y ) is not
bilinear anymore.
Definition of a linear-in-one-argument (LOA) form of FMC :
GMC (x, y ) − GMC (y , x) = FMC (x + y ) − FMC (x) − FMC (y )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MC 3,5-pass protocol
MC Function
Given x ∈ Fn , a function fl : Fn → Fq is defined as:
q q
fl (x) = Σn Σn Σn al,i,j,k xi xj xk + Σn Σn bl,i,j xi xj + Σn cl,i xi
i=1 j=i k=j i=1 j=i i=0
A MC Function, FMC : Fn → Fm , is then defined as:
q q
FMC (x) = (f1 , . . . , fm )
Polar Form
Mapping (x, y ) → FMC (x + y ) − FMC (x) − FMC (y ) is not
bilinear anymore.
Definition of a linear-in-one-argument (LOA) form of FMC :
GMC (x, y ) − GMC (y , x) = FMC (x + y ) − FMC (x) − FMC (y )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MC 3,5-pass protocol
MC Function
Given x ∈ Fn , a function fl : Fn → Fq is defined as:
q q
fl (x) = Σn Σn Σn al,i,j,k xi xj xk + Σn Σn bl,i,j xi xj + Σn cl,i xi
i=1 j=i k=j i=1 j=i i=0
A MC Function, FMC : Fn → Fm , is then defined as:
q q
FMC (x) = (f1 , . . . , fm )
Polar Form
Mapping (x, y ) → FMC (x + y ) − FMC (x) − FMC (y ) is not
bilinear anymore.
Definition of a linear-in-one-argument (LOA) form of FMC :
GMC (x, y ) − GMC (y , x) = FMC (x + y ) − FMC (x) − FMC (y )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MC 3,5-pass protocol [1]
3-pass Protocol
Same key sizes
More rounds
System parameter almost 30 times bigger
Almost 80% bits more to transmit
Less efficient
Hash function (times) −→ 4
5-pass Protocol
Smaller key sizes (88/132 bits against 120/180 bits)
System parameter almost 4.5 times bigger
Almost 80% bits more to transmit
Less efficient

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MC 3,5-pass protocol [1]
3-pass Protocol
Same key sizes
More rounds
System parameter almost 30 times bigger
Almost 80% bits more to transmit
Less efficient
Hash function (times) −→ 4
5-pass Protocol
Smaller key sizes (88/132 bits against 120/180 bits)
System parameter almost 4.5 times bigger
Almost 80% bits more to transmit
Less efficient

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MC 3,5-pass protocol [1]
3-pass Protocol
Same key sizes
More rounds
System parameter almost 30 times bigger
Almost 80% bits more to transmit
Less efficient
Hash function (times) −→ 4
5-pass Protocol
Smaller key sizes (88/132 bits against 120/180 bits)
System parameter almost 4.5 times bigger
Almost 80% bits more to transmit
Less efficient

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MC 3,5-pass protocol [1]
3-pass Protocol
Same key sizes
More rounds
System parameter almost 30 times bigger
Almost 80% bits more to transmit
Less efficient
Hash function (times) −→ 4
5-pass Protocol
Smaller key sizes (88/132 bits against 120/180 bits)
System parameter almost 4.5 times bigger
Almost 80% bits more to transmit
Less efficient

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MC 3,5-pass protocol [1]
3-pass Protocol
Same key sizes
More rounds
System parameter almost 30 times bigger
Almost 80% bits more to transmit
Less efficient
Hash function (times) −→ 4
5-pass Protocol
Smaller key sizes (88/132 bits against 120/180 bits)
System parameter almost 4.5 times bigger
Almost 80% bits more to transmit
Less efficient

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MC 3,5-pass protocol [1]
3-pass Protocol
Same key sizes
More rounds
System parameter almost 30 times bigger
Almost 80% bits more to transmit
Less efficient
Hash function (times) −→ 4
5-pass Protocol
Smaller key sizes (88/132 bits against 120/180 bits)
System parameter almost 4.5 times bigger
Almost 80% bits more to transmit
Less efficient

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MC 3,5-pass protocol [1]
3-pass Protocol
Same key sizes
More rounds
System parameter almost 30 times bigger
Almost 80% bits more to transmit
Less efficient
Hash function (times) −→ 4
5-pass Protocol
Smaller key sizes (88/132 bits against 120/180 bits)
System parameter almost 4.5 times bigger
Almost 80% bits more to transmit
Less efficient

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MC 3,5-pass protocol [1]
3-pass Protocol
Same key sizes
More rounds
System parameter almost 30 times bigger
Almost 80% bits more to transmit
Less efficient
Hash function (times) −→ 4
5-pass Protocol
Smaller key sizes (88/132 bits against 120/180 bits)
System parameter almost 4.5 times bigger
Almost 80% bits more to transmit
Less efficient

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MC 3,5-pass protocol [1]
3-pass Protocol
Same key sizes
More rounds
System parameter almost 30 times bigger
Almost 80% bits more to transmit
Less efficient
Hash function (times) −→ 4
5-pass Protocol
Smaller key sizes (88/132 bits against 120/180 bits)
System parameter almost 4.5 times bigger
Almost 80% bits more to transmit
Less efficient

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MC 3,5-pass protocol [1]
3-pass Protocol
Same key sizes
More rounds
System parameter almost 30 times bigger
Almost 80% bits more to transmit
Less efficient
Hash function (times) −→ 4
5-pass Protocol
Smaller key sizes (88/132 bits against 120/180 bits)
System parameter almost 4.5 times bigger
Almost 80% bits more to transmit
Less efficient

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MC 3,5-pass protocol
ZK (3)
Introduction of new variables Xij = xi xj (1 ≤ i ≤ j ≤ n) in (xi ) in
order to get:
fl (x) = Σn n
1≤i≤j≤k≤n al,i,j,k Xij xk + Σ1≤i≤j≤n bl,i,j Xij + Σi=1 cl,i xi
Features
Larger public key
More communication bits
Lower number of communications

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MC 3,5-pass protocol
ZK (3)
Introduction of new variables Xij = xi xj (1 ≤ i ≤ j ≤ n) in (xi ) in
order to get:
fl (x) = Σn n
1≤i≤j≤k≤n al,i,j,k Xij xk + Σ1≤i≤j≤n bl,i,j Xij + Σi=1 cl,i xi
Features
Larger public key
More communication bits
Lower number of communications

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MC 3,5-pass protocol
ZK (3)
Introduction of new variables Xij = xi xj (1 ≤ i ≤ j ≤ n) in (xi ) in
order to get:
fl (x) = Σn n
1≤i≤j≤k≤n al,i,j,k Xij xk + Σ1≤i≤j≤n bl,i,j Xij + Σi=1 cl,i xi
Features
Larger public key
More communication bits
Lower number of communications

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MC 3,5-pass protocol
ZK (3)
Introduction of new variables Xij = xi xj (1 ≤ i ≤ j ≤ n) in (xi ) in
order to get:
fl (x) = Σn n
1≤i≤j≤k≤n al,i,j,k Xij xk + Σ1≤i≤j≤n bl,i,j Xij + Σi=1 cl,i xi
Features
Larger public key
More communication bits
Lower number of communications

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MP 3,5-pass protocol
MP function
Given x ∈ Fn , a function of degree d, fl : Fn → Fq is defined as:
q q
fl (x) = Σn 1 ≤...≤id al,i1 ,...,id xi1 · · · xid +
1≤i
Σn 1 ≤...≤id−1 al,i1 ,...,id−1 xi1 · · · xid−1 + · · · +
1≤i
Σn 1 n al,i1 xi1
1≤i
A MP Function, FMP : Fn → Fm , is then defined as:
q q
FMP (x) = (f1 , . . . , fm )
Polar Form
GMP (r0 , r1 , . . . , rd−1 ) = Σd (−1)d−1 ΣS⊂{0,...,d−1} FMP(
i=1 j∈S rj )
|S|=i

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MP 3,5-pass protocol
MP function
Given x ∈ Fn , a function of degree d, fl : Fn → Fq is defined as:
q q
fl (x) = Σn 1 ≤...≤id al,i1 ,...,id xi1 · · · xid +
1≤i
Σn 1 ≤...≤id−1 al,i1 ,...,id−1 xi1 · · · xid−1 + · · · +
1≤i
Σn 1 n al,i1 xi1
1≤i
A MP Function, FMP : Fn → Fm , is then defined as:
q q
FMP (x) = (f1 , . . . , fm )
Polar Form
GMP (r0 , r1 , . . . , rd−1 ) = Σd (−1)d−1 ΣS⊂{0,...,d−1} FMP(
i=1 j∈S rj )
|S|=i

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MP 3,5-pass protocol
MP function
Given x ∈ Fn , a function of degree d, fl : Fn → Fq is defined as:
q q
fl (x) = Σn 1 ≤...≤id al,i1 ,...,id xi1 · · · xid +
1≤i
Σn 1 ≤...≤id−1 al,i1 ,...,id−1 xi1 · · · xid−1 + · · · +
1≤i
Σn 1 n al,i1 xi1
1≤i
A MP Function, FMP : Fn → Fm , is then defined as:
q q
FMP (x) = (f1 , . . . , fm )
Polar Form
GMP (r0 , r1 , . . . , rd−1 ) = Σd (−1)d−1 ΣS⊂{0,...,d−1} FMP(
i=1 j∈S rj )
|S|=i

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MP 3,5-pass protocol [4]
Features
Generalization
No practical advantage

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
The End
That’s it! Questions? Remarks?

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
Bibliography
References
Public-key identification schemes based on multivariate cubic polynomials.
In PKC, pages 172–189, 2012.
Mihir Bellare and Oded Goldreich.
On defining proofs of knowledge.
pages 390–420. Springer-Verlag, 1998.
Charles Bouillaguet, Hsieh-Chung Chen, Chen-Mou Cheng, Tung Chou, Ruben
Niederhagen, Adi Shamir, and Bo-Yin Yang.
Fast exhaustive search for polynomial systems in f2.
In Proceedings of the 12th international conference on Cryptographic hardware
and embedded systems, CHES’10, pages 203–218, Berlin, Heidelberg, 2010.
Springer-Verlag.
Val´rie Nachef, Jacques Patarin, and Emmanuel Volte.
e
Zero-knowledge for multivariate polynomials.
IACR Cryptology ePrint Archive, 2012:239, 2012.
Koichi Sakumoto, Taizo Shirai, and Harunaga Hiwatari.
Public-key identification schemes based on multivariate quadratic polynomials.
In CRYPTO, pages 706–723, 2011.

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ 3-Pass Protocol (Completeness)
Proof
r1 ← s − r0 , t1 ← r0 − t0 , e1 ← F(r0 ) − e0
c0 ← Com(r1 , G(t0 , r1 ) + e0 )
c1 ← Com(t0 , e0 )
c2 ← Com(t1 , e1 )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ 3-Pass Protocol (Completeness)
Proof
If Ch = 0:
∆
r0 − t1 = r1
∆
F(r0 ) − e1 = e0

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ 3-Pass Protocol (Completeness)
Proof
If Ch = 1:
G(t0 , r1 ) + e0 = G(r0 − t1 , r1 ) + e0
= G(r0 , r1 ) − G(t1 , r1 ) + e0
= F(r0 + r1 ) − F(r0 ) − F(r1 ) − G(t1 , r1 ) + e0
∆
= v − F(r1 ) − G(t1 , r1 ) − e1

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ 3-Pass Protocol (Completeness)
Proof
If Ch = 2:

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ 3-Pass Protocol (Soundness)
Proof
Say that Oscar takes F and v and tries to fool Victor in order to
impersonate Peggy. Let Ch∗ ∈ {0, 1, 2} a Oscar’s prediction of
which value Victor is not going to choose.

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ 3-Pass Protocol (Soundness)
Proof
Say that Oscar takes F and v and tries to fool Victor in order to
impersonate Peggy. Let Ch∗ ∈ {0, 1, 2} a Oscar’s prediction of
which value Victor is not going to choose.

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ 3-Pass Protocol (Soundness)
Proof
Commitments preparation:
Oscar take at random s , r 0 , t 0 ∈R Fn , e 0 ∈R Fm
q q
And computes r 1 ← s − r 0 and t 1 ← r 0 − t 0 .

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ 3-Pass Protocol (Soundness)
Proof
If Ch∗ = 0:
e 1 ← v − F(s ) + F(r 0 ) − e 0
c0 ← Com(r 1 , G(t 0 , r 1 ) + e 0 )
c1 ← Com(t 0 , e 0 )
c2 ← Com(t 1 , e 1 )
Note that if Ch = 1, then:
∆
v − F(r 1 ) − G(t 1 , r 1 ) − e 1 = −G(t 1 , r 1 ) + G(r 0 , r 1 ) + e 0
= G(r 0 − t 1 , r 1 ) + e 0
∆
= G(t 0 , r 1 ) + e 0

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ 3-Pass Protocol (Soundness)
Proof
If Ch∗ = 0 and Ch = 0:
e 1 = v − F(s ) + F(r 0 ) − e 0 = F(r 0 ) − e 0

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ 3-Pass Protocol (Soundness)
Proof
If Ch∗ = 1:
e 1 ← F(r 0 ) − e 0
c0 ← Com(r 1 , G(t 0 , r 1 ) + e 0 )
c1 ← Com(t 0 , e 0 )
c2 ← Com(t 1 , e 1 )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ 3-Pass Protocol (Soundness)
Proof
If Ch∗ = 1 and Ch = 1:
∆
v − F(r 1 ) − G(t 1 , r 1 ) − e 1 = v − F(r 1 ) + G(t 1 , r 1 )
−F(r 0 ) − e 0
∆
= v − F(s ) + G(t 0 , r 1 ) − e 0
= G(t 0 , r 1 ) − e 0

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ 3-Pass Protocol (Soundness)
Proof
If Ch∗ = 2:
e 1 ← F(r 0 ) − e 0
c0 ← Com(r 1 , v − F(r 1 ) − G(t 1 , r 1 ) − e 1 )
c1 ← Com(t 0 , e 0 )
c2 ← Com(t 1 , e 1 )

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ 3-Pass Protocol (Soundness)
Proof
If Ch∗ = 2 and Ch = 2:
G(t 0 , r 1 ) − v − F(r 1 ) − G(t 1 , r 1 ) − e 1 = G(t 0 , r 1 ) − e 0

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ 3-Pass Protocol (Soundness)
Proof
Conclusion: Error knowledge = 2/3.

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ 3-Pass Protocol (Zero Knowledge)
Proof
For each o Chi (i ∈ {0, 1, 2}), Victor receives (c0 , c1 , c2 ) and Rspi ,
with whom he calculates two commitments from (c0 , c1 , c2 ) during
the protocol. Say that for Rspi , cj is the remainder commitment.
Also say that C = r0 if i = 0, otherwise C = t1 + r1 , a vector
obtained from Rspi . R is a random string indistinguishable from cj .

Outline Preliminary MQ-Based Identification Scheme Further Schemes Appendix
MQ 3-Pass Protocol (Zero Knowledge)
Proof
Suppose that the scheme is not Zero Knowledge, then Victor is
able to learn something from the set of challenges or the responses.
Challenges: Victor is able to learn from cj .
Responses: Victor is able to learn from C = s − r1 , if
Ch = 0, otherwise C = s − t0 .
If Victor is able to learn from the challenges, than Victor is also
able to learn from R, once that cj and R are indistinguishable. But
that is clearly absurd, because there is nothing to learn from R.
If Victor is able to learn from responses, than he is able to learn
from s and r0 or t0 , which are truly random. But again it is clearly
absurd.