Cryptosystem for communication networks

Abstract

The REX cryptosystem presented herein is a variant of the NTRU cryptosystem. In the REX cryptosystem, a primary ring RXOR and two secondary rings RXOR,q and RXOR,p are used to reduce the number of operations required to compute the keys, to perform the encryption process, and to perform the decryption process. The REX cryptosystem may also be implemented using Walsh-Hadamard transformations to significantly increase speed.

Description

BACKGROUND

[0001] 1. Field

[0002] The present invention relates generally to communications, and more specifically, to an improved cryptosystem for encrypting traffic transmitted on communication networks.

[0003] 2. Background

[0004] In both wired and wireless communication systems, a need exists to be able to transmit information secure from both inadvertent eavesdroppers and intentional wrongdoers. Due to the public nature of the transmission media for wireless communications, privacy is a particularly important issue for many mobile handheld users. Although various encryption techniques exist for concealing private matters from public scrutiny, implementation of encryption techniques in small, resource-limited devices, such as mobile handheld units, are often problematic. The computational complexity of a secure encryption scheme can be immense, which slows the speed at which information can be encrypted. A fundamental goal in the art of encryption design is to provide security without sacrificing speed.

SUMMARY

[0005] Methods and apparatus are presented herein to address the need stated above. In one aspect, a method is presented for creating two private keys and a public key for a ring-based cryptosystem, the method comprising: selecting a primary vector from a primary ring RXOR, wherein the primary ring RXOR has elements from the set of N-dimensional vectors with integer coefficients ZN and is distinguished by the specified operations; computing a first private key from a secondary ring RXOR,q, wherein RXOR,q comprises the elements of RXOR reduced modulo q, such that the first private key is a multiplicative inverse of the primary vector in RXOR,q; computing a second private key from a secondary ring RXOR,p, wherein RXOR,p comprises the elements of RXOR reduced modulo p, such that the second private key is a multiplicative inverse of the primary vector in RXOR,p, and q and p are co-prime integer values; and using the first private key and a secondary vector from the primary ring RXOR to generate a public key, wherein the public key is for encrypting a message and the second private key is used for decrypting the message.

[0006] In another aspect, a method is presented for efficiently generating two private keys and a public key for a ring-based cryptosystem, the method comprising: selecting a primary vector from a primary ring RXOR, wherein the primary ring RXOR has elements from the set of N-dimensional vectors with integer coefficients ZN and is distinguished by the specified operations; computing a transform of the primary vector; computing a first private key from a secondary ring RXOR,q, wherein RXOR,q comprises the elements of RXOR reduced modulo q, and the first private key is computed using the multiplicative inverse reduced modulo q of each component of the transformed primary vector; computing a second private key from a secondary ring RXOR,p, wherein RXOR,p comprises the elements of RXOR reduced modulo p, and the second private key is computed using the multiplicative inverse reduced modulo p of each component of the transformed primary vector, and q and p are co-prime integer values; and using the first private key to generate a public key, wherein the public key is for encrypting a message and the second private key is used decrypting the message.

[0007] In another aspect, a method is presented for extracting a message from a ciphertext, wherein the ciphertext is a product of a public key generated from a ring-based cryptosystem, comprising: computing a first vector by multiplying the ciphertext with a first private key in a secondary ring RXOR,q; reducing the first vector modulo p in order to derive a second vector; and computing the message by multiplying a second private key with the second vector in a secondary ring RXOR,p.

[0008] In other aspects, memory elements and processing elements are presented to implement the methods described herein.

BRIEF DESCRIPTION OF THE DRAWINGS

[0009] FIG. 1 describes the public key creation step of the REX cryptosystem.

[0010] FIG. 2 describes the encryption step of the REX cryptosystem.

[0011] FIG. 3 describes the decryption step of the REX cryptosystem.

[0012] FIG. 4 describes an embodiment of the REX public key creation step that uses the Walsh-Hadamard transform.

[0013] FIG. 5 describes the encryption step of the REX using the Walsh-Hadamard transform.

[0014] FIG. 6 describes the decryption step that is performed when an encrypted message vector E is received.

DETAILED DESCRIPTION

[0015] Voice and data traffic transmitted over the wireless and wired portions of a communication system can be subject to interception or diversion to unintended recipients. In order to ensure that private matters remain private, various encryption techniques can be implemented within a communication system. One technique that can be utilized in both wireless and wired communication systems is called public key cryptography. In public key cryptography, any party can use the public key to encrypt a transmission but only the party holding the private key can decrypt the transmission. While straightforward to implement, generic public key cryptosystems suffer from the problems of slow speed and vulnerability to attacks, such as man-in-the-middle attacks and replay attacks.

[0016] One particular public key cryptosystem that is designed to be fast and less vulnerable to attacks is the NTRU cryptosystem, presented in U.S. Pat. No. 6,298,137 B1, entitled, “Ring-Based Public Key Cryptosystem Method.” In the NTRU cryptosystem, the encryption is based upon polynomial algebra and the decryption is based upon probability theory.

[0017] The parameters of an NTRU cryptosystem are (N, q, p, Lf, Lg, Lφ), where N, q and p are integers and Lf, Lg and Lφ are descriptions of sets of vectors. It is assumed that the greatest common denominator of p and q is 1, and that q is always considerably larger than p. The elements and operations for a NTRU cryptosystem are defined over the polynomial ring R=Z[X]/(XN−1). Lf, Lg and Lφ are sets in the polynomial ring R=Z[X]/(XN−1). An element f is defined on the ring R as a polynomial or vector in the form: 1$f=\sum _{i=1}^{N-1}f\left[i\right]x^i=\left(f\left[0\right],f\left[1\right],K,f\left[N-i\right]\right).$

[0018] The addition operation “+” in the ring R is defined component-wise by the relationship:

(f+g)[i]=f[i]+g[i].

[0019] The multiplication operation ‘*’ in the ring R represents a cyclic convolution product on ring R, so that h=f*g represents the convolution: 2$h\left[k\right]=\sum _{i=0}^{k}f\left[i\right]g\left[k-i\right]+\sum _{i=k+1}^{N-1}f\left[i\right]g\left[N+k-i\right]=\sum _{i+j\equiv k\left(\mathrm{mod}N\right)}f\left[i\right]g\left[j\right].$

[0020] It should be noted that ring theory allows one of skill in the art to illustrate the concepts such as those described herein without detailed, complex mathematical equations, which can be obscure. The example above illustrates this “shorthand,” wherein h=f*g on the ring R=Z[X]/(XN−1) is equivalent to the above calculations for h[k] over the set of integers.

[0021] The first step in the NTRU cryptosystem is the creation of the private and public keys using polynomial algebra. Polynomials f and g are chosen. The polynomial g is randomly chosen from the set Lg. The polynomial f is chosen randomly from the set Lf, with the constraint that polynomial f must have inverses modulo q and modulo p, referred to as fq and fp, respectively. The inverses can be described mathematically by the following equations:

f q *f≡ 1(mod q), and

f p *f≡ 1(mod p).

[0022] After the polynomials f and g are chosen, the polynomials are used to generate a public key h in accordance to the relationship:

h≡f q *g (mod q).

[0023] The polynomial f is used as the private key by a private key holder. Polynomial g is also held private. The public key h can be sent to individual parties or can be placed in a location accessible to the public. Note that the parameters (N, q, p, Lf, Lg, Lφ) are also accessible to the public.

[0024] At the second step, encryption takes place. A party with a message m acquires the public key h and encrypts the message m by computing the following equation:

e≡pφ*h+m (mod q),

[0025] wherein e is the encrypted message, and φ is a random polynomial from the set Lφ. The encrypted message e is transmitted to the private key holder.

[0026] At the third step, the private key holder receives the encrypted message e and computes the polynomial a in accordance with the following equation:

a≡f*e (mod q),

[0027] wherein the coefficients of a are reduced so that the coefficients are within the range (−q/2, q/2]. Polynomial a is then used to decrypt the encrypted message e by computing:

m=f p *a (mod p).

[0028] The polynomial fp is already known by the private key holder. Note that the polynomial a is computed to satisfy: 3$\begin{array}{c}a\equiv f*e\equiv f*p\phi *h+f*m\left(\mathrm{mod}q\right)\\ =f*p\phi *F_q*g+f*m\left(\mathrm{mod}q\right)\\ =p\phi *g+f*m\left(\mathrm{mod}q\right).\end{array}$

[0029] The decryption is based on the proposition that if f, g and φ are in the sets Lf, Lg and Lφ respectively, then there is a high probability that the coefficients of (pφ*g) and (f*m) are within (−q/2, q/2]. Hence, when the private key holder computes a≡f*e (mod q) within the interval (−q/2, q/2], she is recovering, with high probability, the polynomial a=pφ*g+f*m in the polynomial ring R=Z[X]/(XN−1).

[0030] Due to the nature of convolutional products, the NTRU cryptosystem requires N2 multiplications for each product to be computed. This requirement reduces the speed at which encryption and decryption takes place. The embodiments presented herein are improvements to the NTRU cryptosystem by reducing the complexity of the operations needed to generate keys, to encrypt messages, and to decrypt messages.

[0031] The improvement to the NTRU cryptosystem is referred to as the Ring Encryption using XOR (REX) cryptosystem. In the REX cryptosystem, a primary ring RXOR and two secondary rings RXOR,q and RXOR,p are used to reduce the number of operations required to compute the keys, to perform the encryption process, and to perform the decryption process.

[0032] Let ZN be the set of vectors of dimension N with integer coefficients. Define the elements of the primary ring RXOR as vectors in ZN with integer components, such that an element f is defined as (f[0], . . . , f[N−1]). Two operations are defined on the primary ring. The addition operation “+” is defined component-wise by the relationship:

(f+g)[i]=f[i]+g[i].

[0033] The multiplication operation “·” in RXOR is defined by the relationship: 4$\left(f·g\right)\left[i\right]=\sum _{j=0,K,N-1}\left(f\left[j\right]g\left[i\otimes j\right]\right),\mathrm{for}0\le i\le N-1,$

[0034] and the multiplicative identity is the vector (1, 0, . . . , 0). Note that neither operation involves the modular reduction of the components, unlike the operations within the NTRU cryptosystem. Moreover, even though the primary ring RXOR has the same elements as ZN, RXOR is not equal to ZN, since a multiplication operation is not defined over ZN.

[0035] The secondary rings RXOR,q and RXOR,p are then defined with the same operations as RXOR. However, the elements of RXOR,q are the elements of the primary ring RXOR with the components reduced modulo q, and the elements of RXOR,p are the elements of the primary ring RXOR with the components reduced modulo p.

[0036] Addition of f and g in RXOR,q can be computed by first computing (f+g) in RXOR and then reducing the components modulo q. Similarly, multiplication of f and g in RXOR,q can be computed by first computing (f·g) in RXOR and then reducing the components modulo q. Addition and multiplication in RXOR,p can be computed similarly.

[0037] In the embodiments described herein, RXOR,q is defined as the set of vectors of dimension N, with components in the range (−q/2, q/2], subject to the above definitions for addition and multiplication. Under these conditions, RXOR,q forms a ring. Similarly, RXOR,p forms a ring. The multiplicative identity is the vector (1, 0, . . . , 0, 0) in all three rings RXOR, RXOR,q and RXOR,p.

[0038] The embodiments describing the REX cryptosystem illustrate a four-step process, which comprises a parameter generation step, a public key creation step, an encryption step and a decryption step. In one embodiment of the parameter generation step, six parameters (N, q, p, Lf, Lg, Lφ) are chosen to attain a certain level of security and to ensure that decryption is successful with high probability. The choice of parameters are conducted in accordance with the following rules:

N  Dimensionality value. All elements of RXOR are of dimension N. Must be a
   power of two, i.e., N = 2n. This differs from the NTRU parameter N in that the
   NTRU parameter N may be any integer.
q  Modulus for the secondary ring RXOR,q. The encrypted message is a vector in
   RXOR,q.
p  Modulus for secondary ring RXOR,p. The message is a vector in RXOR,p.
Lf The set of allowable vectors for selecting f. There must exist a vector fq−1 ∈
   RXOR,q such that f • fq−1 ≡ 1 (mod q) and there must exist a vector fp−1 ∈ RXOR,p such
   that f • fp−1 ≡ 1 (mod p). In some embodiments, Lf is defined using a parameter df
   wherein the vector f must have df components equal to 1 and (df−1) components
   equal to −1, and the remaining components are equal to 0.
Lg The set of allowable vectors for selecting g. In some embodiments, Lg is defined
   using a parameter dg wherein the vector g must have dg components equal to each
   of 1 and −1, and the remaining components are equal to 0.
Lφ The set of allowable vectors for selecting φ. The message is hidden by adding
   some randomness, which is provided by a vector φ. In some embodiments, Lφ is
   defined using a parameter dφ, wherein the vector φ must have dφ components
   equal to each of 1 and −1, and the remaining components are equal to 0.

[0039] The parameters are chosen to attain a certain level of security and to ensure that decryption is successful with high probability. In addition to the above rules, p and q must be co-prime. In one embodiment, N and q must also be co-prime in order to apply the inverse Walsh-Hadamard transform as described below.

[0040] FIG. 1 describes the public key creation step. Each entity that wishes to receive secure communications using the REX cryptosystem must perform a public key creation step. This entity is referred to hereinafter as “Alice.”

[0041] At step 100, Alice chooses a random or pseudo-random vector f from the set Lf.

[0042] At step 110, Alice computes the vector inverse fq−1 off in RXOR,q.

[0043] At step 120, Alice computes the vector inverse fp−1 off in RXOR,p.

[0044] At step 130, Alice chooses a random or pseudo-random vector g from the set Lg.

[0045] At step 140, Alice computes the vector h corresponding to:

h≡f q −1 *(pg)(mod q),

[0046] wherein pg has the components of g multiplied by the integer p.

[0047] At step 150, Alice designates the vector h as the public key, the vectors f as the first private key and the vector fp−1 as the second private key. The vector g is not required for encryption or decryption and may be discarded. Once a public key is created, Alice can post the public key in a public forum or may send the public key directly to any party that wishes to transmit encrypted messages to Alice.

[0048] FIG. 2 describes the encryption step. Let message m be a vector with components in the range [0, . . . , p−1]. Hence, message m can be considered as a vector in the ring RXOR,p. Given the public key h, an entity that wished to encrypt a message targeted for Alice can perform the following steps to encrypt the message m. The entity that wishes to encrypt the message is referred to hereinafter as “Bob.”

[0049] At step 200, Bob chooses a random or pseudo-random vector φ from the set Lφ.

[0050] At step 210, Bob computes a vector e≡(φ·h)+m (mod q).

[0051] At step 220, Bob transmits the vector e to Alice, wherein vector e is the encrypted message.

[0052] FIG. 3 describes the decryption step. At step 300, Alice receives a transmission e. At step 310, Alice computes the vector a≡f·e(mod q), wherein f is the first private key of Alice that was computed earlier. At step 320, Alice chooses the components of a so that the components lie within the range (−q/2, q/2].

[0053] At step 330, Alice computes the vector b≡a(mod p).

[0054] At step 340, Alice computes the vector c≡fp−1·b(mod p), wherein the vector fp−1 is the second private key of Alice that was computed earlier.

[0055] At step 350, Alice designates the vector c as the message m with high probability.

[0056] The steps of FIGS. 1, 2, and 3 are used together to form a cryptosystem wherein the keys and messages are ring elements. Using operations defined upon a ring, it is likely that a message can have more than one possible expression that results from an encryption transformation. In other words, a message vector could be mapped to more than one encryption vector. Hence, the decryption process is premised on probability theory. In particular, the cryptosystem assumes that an encrypted message can be accurately decrypted with high probability if the values of the components are limited to a specific range. The decryption assumption is based upon the following proof.

[0057] First, note that the following equations hold true: 5$\begin{array}{c}a\equiv f·e\left(\mathrm{mod}q\right)\\ \equiv \left(f·\left(h·\phi \right)\right)+\left(f·m\right)\left(\mathrm{mod}q\right)\\ \equiv \left(\left(f·h\right)·\phi \right)+\left(f·m\right)\left(\mathrm{mod}q\right)\\ \equiv \left(pg·\phi \right)+\left(f·m\right)\left(\mathrm{mod}q\right).\end{array}$

[0058] Define A1=(pg·φ) if modular reduction is performed and A2=(f·m) where no modular reduction is performed.

[0059] The parameters Lf, Lg and Lφ are chosen so that all the components of A1 and A2 are “small enough”. The components are “small enough” when the expression (A1+A2) has entries in the range (−q/2, q/2] most of the time. If this is true, then a′=A1+A2, without modular reduction, and 6$\begin{array}{c}b\equiv a^{\prime }\left(\mathrm{mod}p\right)\\ \equiv A_1\left(\mathrm{mod}p\right)+A_2\left(\mathrm{mod}p\right)\\ \equiv \left(pg·\phi \right)\left(\mathrm{mod}p\right)+A_2\left(\mathrm{mod}p\right)\\ \equiv 0\left(\mathrm{mod}p\right)+A_2\left(\mathrm{mod}p\right)\\ \equiv A_2\left(\mathrm{mod}p\right)\\ \equiv f·m\left(\mathrm{mod}p\right).\end{array}$

[0060] Hence, 7$\begin{array}{c}c\equiv f_p^{-1}·b\left(\mathrm{mod}p\right)\\ \equiv f_p^{-1}·\left(f·m\right)\left(\mathrm{mod}p\right)\\ \equiv \left(f_p^{-1}·f\right)·m\left(\mathrm{mod}p\right)\\ \equiv m\left(\mathrm{mod}p\right).\end{array}$

[0061] In another embodiment, the Walsh-Hadamard Transform can be used to increase the speed of the REX cryptosystem. The Walsh-Hadamard Transform of a vector a is the polynomial A with components:

A[i]=Σ j a[j] (−1)(i, j), for 0≦i≧N−1,

[0062] where (i, j)≡Σkikjk (mod 2). Note that ik is the kth bit of the binary representation of i. For each component A[i], the Walsh-Hadamard transform can be computed using log2N addition or subtraction operations on the components of a. (For illustrative ease only, it is assumed that subtraction operations are of the same complexity as addition operations.) Thus, computing the Walsh-Hadamard transform of the vector a requires (Nlog2N) operations.

[0063] The inverse Walsh-Hadamard transform of polynomial A maps the polynomial A back to the vector a and is computed component-wise as: 8$a\left[i\right]=\frac{1}{N}\sum _{j}A\left[j\right]{\left(-1\right)}^{\left(i,j\right)},\mathrm{for}0\le i\le N-1.$

[0064] For each component a[i], the inverse Walsh-Hadamard transform can be computed using log2N addition (or subtraction) operations on the components of A, and a multiplication by a factor of 1/N. Thus, computing the complete inverse Walsh-Hadamard transform vector a requires Nlog2N addition (or subtraction) operations on the components of vector a and N multiplication operations.

[0065] The REX cryptosystem can be implemented using the Walsh-Hadamard transforms as described above in order to increase the speed of the cryptosystem. From a practical standpoint, the number of operations required to manipulate the Walsh-Hadamard transformations are fewer than the number of operations required to calculate the products of vectors. In particular, the steps described above can be performed due to the determination of certain characteristics of the vector space.

[0066] The first attribute of the Walsh-Hadamard transform on the ring RXOR is if c=a·b, then C[i]=A[i] B[i], for 0≦i≦N−1. The proof is as follows: 9$\begin{array}{c}C\left[i\right]=\sum _{j}b\left[j\right]{\left(-1\right)}^{\left(i,j\right)}\\ =\sum _j\sum _{k}a\left[k\right]b\left[j\otimes k\right]{\left(-1\right)}^{\left(i,k\right)+\left(i,j\otimes k\right)}\\ =\sum _{j}a\left[k\right]{\left(-1\right)}^{\left(i,k\right)}\sum _{k}b\left[j\otimes k\right]{\left(-1\right)}^{\left(i,j\otimes k\right)}\\ =\sum _{j}a\left[k\right]{\left(-1\right)}^{\left(i,k\right)}\sum _{l}b\left[l\right]{\left(-1\right)}^{\left(i,l\right)}\\ =A\left[i\right]B\left[i\right]\end{array}$

[0067] A second attribute of the Walsh-Hadamard transform on the ring RXOR,q is that if c=a·b (mod q), then C[i]=A[i] B[i] (mod q). Thus, the product c=a·b (mod q) can be computed by computing the Walsh-Hadamard transforms of the vectors a and b, and the inverse Walsh-Hadamard transform c of C. An advantage of using the Walsh-Hadamard transformation is the reduction in the number of operations being performed for the REX cryptosystem. The computation of the Walsh-Hadamard transforms A and B from vectors a and b requires only 2Nlog2N addition (or subtraction) operations. The computation of C[i]=A[i]B[i](mod q) requires only N multiplication operations. The computation of the inverse Walsh-Hadamard transform c of C requires 2Nlog2N addition (or subtraction) operations and N multiplication operations. Hence, the implementation of the Walsh-Hadamard transform in the REX cryptosystem is very efficient when computing inverses in the ring RXOR, RXOR,q and RXOR,p.

[0068] A third attribute of an implementation of the Walsh-Hadamard transform is the savings due to pre-computing some of the transforms. For example, the Walsh-Hadamard transform of the identify vector (1, 0, . . . , 0) on the ring RXOR=ZqN is the vector (1, 1, . . . , 1). The Walsh-Hadamard transform Fq−1 of fq−1 satisfies Fq−1[i]≡F[i]−1(mod q), for 0≦i≦N−1. The Walsh-Hadamard transform Fp−1 of fp−1 satisfies Fp−1[i]≡F[i]−1(mod p), for 0≦i≦N−1. Furthermore, f has an inverse modulo q and p if and only if F[i]≠0(mod q) and F[i]≠0(mod p), for 0≦i≦N−1.

[0069] FIG. 4 describes an embodiment of the REX public key creation step that uses the Walsh-Hadamard transform. At step 400, Alice chooses a random or pseudo-random vector f from the set Lf.

[0070] At step 410, Alice computes the Walsh-Hadamard transform F off, wherein the computation is not performed modular q.

[0071] At step 420, Alice computes the vector inverse Fq−1 of F by determining Fq−1[i]≡F[i]−1(mod q), for 0≦i≦N−1.

[0072] At step 430, Alice computes the vector inverse Fp−1 of F by determining Fp−1[i]≡F[i]−1(mod p), for 0≦i≦N−1.

[0073] At step 440, Alice chooses a random or pseudo-random vector g from the set Lg.

[0074] At step 450, Alice computes the Walsh-Hadamard transform G of g.

[0075] At step 460, Alice computes the Walsh-Hadamard transform H of h≡fq−1·(pg) (mod q), by computing:

H[i]≡F q −1 [i]p G[i] (mod q), for 0≦i≦N−1.

[0076] At step 470, Alice designates the private key as being the two Walsh-Hadamard transforms F and Fp−1. The vector g is not required for encryption or decryption, so it may be discarded. However, the vector g should remain secret. In addition, the Alice designates the public key as the Walsh-Hadamard transform H.

[0077] FIG. 5 describes the encryption step of the REX using the Walsh-Hadamard transform. Let message m be a vector with components in the range [0, p −1]. Hence, message m can be considered as a vector in the ring RXOR,p. Given the public key h, Bob can perform the following steps to encrypt the message m.

[0078] At step 500, Bob computes the Walsh-Hadamard transform M of m.

[0079] At step 510, Bob chooses a random or pseudo-random vector φ from Lφ.

[0080] At step 520, Bob computes the Walsh-Hadamard transform Φ of vector φ.

[0081] At step 530, Bob computes the Walsh-Hadamard transform E of the vector e, wherein the vector e is defined as:

e≡ (φ·h)+m(mod q).

[0082] Hence, the Walsh-Hadamard transform E is determined by the following relationship:

E[i]≡Φ[i]H[i]+M[i] (mod q), for 0≦i≦N−1.

[0083] At step 540, the Bob transmits the Walsh-Hadamard transform E to Alice, wherein the Walsh-Hadamard transform E is the encrypted message.

[0084] FIG. 6 describes the decryption step that is performed by Alice when Alice receives an encrypted message vector E. At step 600, Alice uses private key vector F to compute A[i] in accordance with the relationship:

A[i]≡F[i]E[i] (mod q), for 0≦i≦N−1.

[0085] At step 610, Alice computes the inverse Walsh-Hadamard transform a of polynomial A (reducing modulo q). Alice ensures that all components of inverse Walsh-Hadamard transform a lie in the range of (−q/2, q/2], noting that:

a≡f·e (mod q).

[0086] At step 620, Alice computes the vector b a (mod p).

[0087] At step 630, Alice computes the Walsh-Hadamard transform B of vector b modulo p.

[0088] At step 640, Alice uses private key vector Fp−to compute:

C[i]≡F p − [i]B[i] (mod p), for 0≦i≦N−1.

[0089] At step 650, Alice computes the inverse Walsh-Hadamard transform c of (C modulo p), noting that c≡fp−1·b(mod p).

[0090] At step 660, Alice designates the vector c as the message m with high probability.

[0091] The embodiments described above that implement the Walsh-Hadamard transform within the REX cryptosystem uses a reduced number of operations, which correspondingly reduces the complexity of the cryptosystem. This complexity reduction is in addition to the complexity reduction for computing public keys. Part of the complexity reduction arises due to the reduced number of transformations performed in the overall encoding and decoding of a message.

[0092] Those of skill in the art would understand that information and signals may be represented using any of a variety of different technologies and techniques. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referenced throughout the above description may be represented by voltages, currents, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof.

[0093] The embodiments of the REX cryptosystem described above may be implemented by software, hardware, or combination thereof. At least one processing element and at least one memory element may be communicatively coupled to execute a software program or set of microcodes to implement the method steps described above.

[0094] Those of skill would further appreciate that the various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the embodiments of the REX cryptosystem disclosed herein may be implemented as electronic hardware, computer software, or combinations of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.

[0095] The various illustrative logical blocks, modules, and circuits described in connection with the embodiments disclosed herein may be implemented or performed with a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing devices, e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.

[0096] The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor. The processor and the storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In the alternative, the processor and the storage medium may reside as discrete components in a user terminal.

[0097] The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the invention. Thus, the present invention is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method of creating two private keys and a public key for a ring-based cryptosystem, comprising: selecting a primary vector from a primary ring RXOR, wherein the primary ring RXOR has elements from the set of N-dimensional vectors with integer coefficients ZN and is distinguished by the operations: 10(f+g)⁡[i]=f⁡[i]+g⁡[i],and(f·g)⁡[i]=∑j=0,K,N-1⁢(f⁡[j]⁢g⁡[i⊗j]),for⁢ ⁢0≤i≤N-1;⁢ computing a first private key from a secondary ring RXOR,q, wherein RXOR,q comprises the elements of RXOR reduced modulo q, such that the first private key is a multiplicative inverse of the primary vector in RXOR,q; computing a second private key from a secondary ring RXOR,p, wherein RXOR,p comprises the elements of RXOR reduced modulo p, such that the second private key is a multiplicative inverse of the primary vector in RXOR,p, and q and p are co-prime integer values; and using the first private key and a secondary vector from the primary ring RXOR to generate a public key, wherein the public key is for encrypting a message and the second private key is used for decrypting the message.

2. A method for efficiently generating two private keys and a public key for a ring-based cryptosystem, comprising: selecting a primary vector from a primary ring RXOR, wherein the primary ring RXOR has elements from the set of N-dimensional vectors with integer coefficients ZN and is distinguished by the operations: 11(f+g)⁡[i]=f⁡[i]+g⁡[i],and⁢(f·g)⁡[i]=∑j=0,K,N-1⁢(f⁡[j]⁢g⁡[i⊕j]),for⁢ ⁢0≤i≤N-1;computing a transform of the primary vector; computing a first private key from a secondary ring RXOR,q, wherein RXOR,q comprises the elements of RXOR reduced modulo q, and the first private key is computed using the multiplicative inverse reduced modulo q of each component of the transformed primary vector; computing a second private key from a secondary ring RXOR,p, wherein RXOR,p comprises the elements of RXOR reduced modulo p, and the second private key is computed using the multiplicative inverse reduced modulo p of each component of the transformed primary vector, and q and p are co-prime integer values; and using the first private key to generate a public key, wherein the public key is for encrypting a message and the second private key is used decrypting the message.

3. The method of claim 2, wherein the transform is a Walsh-Hadamard transform.

4. A method for extracting a message from a ciphertext, wherein the ciphertext is a product of a public key generated from a ring-based cryptosystem, comprising: computing a first vector by multiplying the ciphertext with a first private key in a secondary ring RXOR,q; reducing the first vector modulo p in order to derive a second vector; and computing the message by multiplying a second private key with the second vector in a secondary ring RXOR,p.

5. An apparatus for creating two private keys and a public key for a ring-based cryptosystem, comprising: at least one memory element; and at least one processing element configured to execute a set of instructions stored in the at least one memory element, the set of instructions for: selecting a primary vector from a primary ring RXOR, wherein the primary ring RXOR has elements from the set of N-dimensional vectors with integer coefficients ZN and is distinguished by the operations: 12(f+g)⁡[i]=f⁡[i]+g⁡[i],and⁢(f·g)⁡[i]=∑j=0,K,N-1⁢(f⁡[j]⁢g⁡[i⊕j]),for⁢ ⁢0≤i≤N-1;computing a first private key from a secondary ring RXOR,q, wherein RXOR,q comprises the elements of RXOR reduced modulo q, such that the first private key is a multiplicative inverse of the primary vector in RXOR,q; computing a second private key from a secondary ring RXOR,p, wherein RXOR,p comprises the elements of RXOR reduced modulo p, such that the second private key is a multiplicative inverse of the primary vector in RXOR,p, and q and p are co-prime integer values; and using the first private key and a secondary vector from the primary ring RXOR to generate a public key, wherein the public key is for encrypting a message and the second private key is used for decrypting the message.

6. An apparatus for efficiently generating two private keys and a public key for a ring-based cryptosystem, comprising: at least one memory element; and at least one processing element configured to execute a set of instructions stored in the at least one memory element, the set of instructions for: selecting a primary vector from a primary ring RXOR, wherein the primary ring RXOR has elements from the set of N-dimensional vectors with integer coefficients ZN and is distinguished by the operations: 13(f+g)⁡[i]=f⁡[i]+g⁡[i],and⁢(f·g)⁡[i]=∑j=0,K,N-1⁢(f⁡[j]⁢g⁡[i⊕j]),for⁢ ⁢0≤i≤N-1;computing a transform of the primary vector; computing a first private key from a secondary ring RXOR,q, wherein RXOR,q comprises the elements of RXOR reduced modulo q, and the first private key is computed using the multiplicative inverse reduced modulo q of each component of the transformed primary vector; computing a second private key from a secondary ring RXOR,p, wherein RXOR,p comprises the elements of RXOR reduced modulo p, and the second private key is computed using the multiplicative inverse reduced modulo p of each component of the transformed primary vector, and q and p are co-prime integer values; and using the first private key to generate a public key, wherein the public key is for encrypting a message and the second private key is used decrypting the message.

7. An apparatus for extracting a message from a ciphertext, wherein the ciphertext is a product of a public key generated from a ring-based cryptosystem, comprising: at least one memory element; and at least one processing element configured to execute a set of instructions stored in the at least one memory element, the set of instructions for: computing a first vector by multiplying the ciphertext with a first private key in a secondary ring RXOR,q; reducing the first vector modulo p in order to derive a second vector; and computing the message by multiplying a second private key with the second vector in a secondary ring RXOR,p.