1. Field
The present invention relates generally to communications, and more specifically, to an improved cryptosystem for encrypting traffic transmitted on communication networks.
2. Background
In both wired and wireless communication systems, a need exists to be able to transmit information secure from both inadvertent eavesdroppers and intentional wrongdoers. Due to the public nature of the transmission media for wireless communications, privacy is a particularly important issue for many mobile handheld users. Although various encryption techniques exist for concealing private matters from public scrutiny, implementation of encryption techniques in small, resource-limited devices, such as mobile handheld units, are often problematic. The computational complexity of a secure encryption scheme can be immense, which slows the speed at which information can be encrypted. A fundamental goal in the art of encryption design is to provide security without sacrificing speed.
Methods and apparatus are presented herein to address the need stated above. In one aspect, a method is presented for creating two private keys and a public key for a ring-based cryptosystem, the method comprising: selecting a primary vector from a primary ring RXOR, wherein the primary ring RXOR has elements from the set of N-dimensional vectors with integer coefficients ZN and is distinguished by the specified operations; computing a first private key from a secondary ring RXOR,q, wherein RXOR,q comprises the elements of RXOR reduced modulo q, such that the first private key is a multiplicative inverse of the primary vector in RXOR,q; computing a second private key from a secondary ring RXOR,p, wherein RXOR,p comprises the elements of RXOR reduced modulo p, such that the second private key is a multiplicative inverse of the primary vector in RXOR,p, and q and p are co-prime integer values; and using the first private key and a secondary vector from the primary ring RXOR to generate a public key, wherein the public key is for encrypting a message and the second private key is used for decrypting the message.
In another aspect, a method is presented for efficiently generating two private keys and a public key for a ring-based cryptosystem, the method comprising: selecting a primary vector from a primary ring RXOR, wherein the primary ring RXOR has elements from the set of N-dimensional vectors with integer coefficients ZN and is distinguished by the specified operations; computing a transform of the primary vector; computing a first private key from a secondary ring RXOR,q, wherein RXOR,q comprises the elements of RXOR reduced modulo q, and the first private key is computed using the multiplicative inverse reduced modulo q of each component of the transformed primary vector; computing a second private key from a secondary ring RXOR,p, wherein RXOR,p comprises the elements of RXOR reduced modulo p, and the second private key is computed using the multiplicative inverse reduced modulo p of each component of the transformed primary vector, and q and p are co-prime integer values; and using the first private key to generate a public key, wherein the public key is for encrypting a message and the second private key is used decrypting the message.
In another aspect, a method is presented for extracting a message from a ciphertext, wherein the ciphertext is a product of a public key generated from a ring-based cryptosystem, comprising: computing a first vector by multiplying the ciphertext with a first private key in a secondary ring RXOR,q; reducing the first vector modulo p in order to derive a second vector; and computing the message by multiplying a second private key with the second vector in a secondary ring RXOR,p.
In other aspects, memory elements and processing elements are presented to implement the methods described herein.
Voice and data traffic transmitted over the wireless and wired portions of a communication system can be subject to interception or diversion to unintended recipients. In order to ensure that private matters remain private, various encryption techniques can be implemented within a communication system. One technique that can be utilized in both wireless and wired communication systems is called public key cryptography. In public key cryptography, any party can use the public key to encrypt a transmission but only the party holding the private key can decrypt the transmission. While straightforward to implement, generic public key cryptosystems suffer from the problems of slow speed and vulnerability to attacks, such as man-in-the-middle attacks and replay attacks.
One particular public key cryptosystem that is designed to be fast and less vulnerable to attacks is the NTRU cryptosystem, presented in U.S. Pat. No. 6,298,137 B1, entitled, “Ring-Based Public Key Cryptosystem Method.” In the NTRU cryptosystem, the encryption is based upon polynomial algebra and the decryption is based upon probability theory.
The parameters of an NTRU cryptosystem are (N, q, p, Lf, Lg, Lφ), where N, q and p are integers and Lf, Lg and Lφ are descriptions of sets of vectors. It is assumed that the greatest common denominator of p and q is 1, and that q is always considerably larger than p. The elements and operations for a NTRU cryptosystem are defined over the polynomial ring R=Z[X]/(XN−1). Lf, Lg and Lφ are sets in the polynomial ring R=Z[X]/(XN−1). An element f is defined on the ring R as a polynomial or vector in the form:
The addition operation “+” in the ring R is defined component-wise by the relationship:
(f+g)[i]=f[i]+g[i].
The multiplication operation ‘*’ in the ring R represents a cyclic convolution product on ring R, so that h=f*g represents the convolution:
It should be noted that ring theory allows one of skill in the art to illustrate the concepts such as those described herein without detailed, complex mathematical equations, which can be obscure. The example above illustrates this “shorthand,” wherein h=f*g on the ring R=Z[X]/(XN−1) is equivalent to the above calculations for h[k] over the set of integers.
The first step in the NTRU cryptosystem is the creation of the private and public keys using polynomial algebra. Polynomials f and g are chosen. The polynomial g is randomly chosen from the set Lg. The polynomial f is chosen randomly from the set Lf, with the constraint that polynomial f must have inverses modulo q and modulo p, referred to as fq and fp, respectively. The inverses can be described mathematically by the following equations:
fq*f≡1(mod q), and
fp*f≡1(mod p).
After the polynomials f and g are chosen, the polynomials are used to generate a public key h in accordance to the relationship:
h≡fq*g(mod q).
The polynomial f is used as the private key by a private key holder. Polynomial g is also held private. The public key h can be sent to individual parties or can be placed in a location accessible to the public. Note that the parameters (N, q, p, Lf, Lg, Lφ) are also accessible to the public.
At the second step, encryption takes place. A party with a message m acquires the public key h and encrypts the message m by computing the following equation:
e≡pφ*h+m(mod q),
wherein e is the encrypted message, and φ is a random polynomial from the set Lφ. The encrypted message e is transmitted to the private key holder.
At the third step, the private key holder receives the encrypted message e and computes the polynomial a in accordance with the following equation:
a≡f*e(mod q),
wherein the coefficients of a are reduced so that the coefficients are within the range (−q/2, q/2]. Polynomial a is then used to decrypt the encrypted message e by computing:
m=fp*a(mod p).
The polynomial fp is already known by the private key holder. Note that the polynomial a is computed to satisfy:
The decryption is based on the proposition that if f, g and φ are in the sets Lf, Lg and Lφ respectively, then there is a high probability that the coefficients of (pφ*g) and (f*m) are within (−q/2, q/2]. Hence, when the private key holder computes a≡f*e(mod q) within the interval (−q/2, q/2], she is recovering, with high probability, the polynomial a=pφ*g+f*m in the polynomial ring R=Z[X]/(XN−1).
Due to the nature of convolutional products, the NTRU cryptosystem requires N2 multiplications for each product to be computed. This requirement reduces the speed at which encryption and decryption takes place. The embodiments presented herein are improvements to the NTRU cryptosystem by reducing the complexity of the operations needed to generate keys, to encrypt messages, and to decrypt messages.
The improvement to the NTRU cryptosystem is referred to as the Ring Encryption using XOR (REX) cryptosystem. In the REX cryptosystem, a primary ring RXOR and two secondary rings RXOR,q and RXOR,p are used to reduce the number of operations required to compute the keys, to perform the encryption process, and to perform the decryption process.
Let ZN be the set of vectors of dimension N with integer coefficients. Define the elements of the primary ring RXOR as vectors in ZN with integer components, such that an element f is defined as (f[0], . . . , f[N−1]). Two operations are defined on the primary ring. The addition operation “+” is defined component-wise by the relationship:
(f+g)[i]=f[i]+g[i].
The multiplication operation “·” in RXOR is defined by the relationship:
and the multiplicative identity is the vector (1, 0, . . . , 0). Note that neither operation involves the modular reduction of the components, unlike the operations within the NTRU cryptosystem. Moreover, even though the primary ring RXOR has the same elements as ZN, RXOR is not equal to ZN, since a multiplication operation is not defined over ZN.
The secondary rings RXOR,q and RXOR,p are then defined with the same operations as RXOR. However, the elements of RXOR,q are the elements of the primary ring RXOR with the components reduced modulo q, and the elements of RXOR,p are the elements of the primary ring RXOR with the components reduced modulo p.
Addition of f and g in RXOR,q can be computed by first computing (f+g) in RXOR and then reducing the components modulo q. Similarly, multiplication of f and g in RXOR,q can be computed by first computing (f·g) in RXOR and then reducing the components modulo q. Addition and multiplication in RXOR,p can be computed similarly.
In the embodiments described herein, RXOR,q is defined as the set of vectors of dimension N, with components in the range (−q/2, q/2], subject to the above definitions for addition and multiplication. Under these conditions, RXOR,q forms a ring. Similarly, RXOR,p forms a ring. The multiplicative identity is the vector (1, 0, . . . , 0, 0) in all three rings RXOR, RXOR,q and RXOR,p.
The embodiments describing the REX cryptosystem illustrate a four-step process, which comprises a parameter generation step, a public key creation step, an encryption step and a decryption step. In one embodiment of the parameter generation step, six parameters (N, q, p, Lf, Lg, Lφ) are chosen to attain a certain level of security and to ensure that decryption is successful with high probability. The choice of parameters are conducted in accordance with the following rules:
The parameters are chosen to attain a certain level of security and to ensure that decryption is successful with high probability. In addition to the above rules, p and q must be co-prime. In one embodiment, N and q must also be co-prime in order to apply the inverse Walsh-Hadamard transform as described below.
At step 100, Alice chooses a random or pseudo-random vector f from the set Lf.
At step 110, Alice computes the vector inverse fq−1 of f in RXOR,q.
At step 120, Alice computes the vector inverse fp−1 of f in RXOR,p.
At step 130, Alice chooses a random or pseudo-random vector g from the set Lg.
At step 140, Alice computes the vector h corresponding to:
h≡fq−1*(pg)(mod q),
wherein pg has the components of g multiplied by the integer p.
At step 150, Alice designates the vector h as the public key, the vectors f as the first private key and the vector fp−1 as the second private key. The vector g is not required for encryption or decryption and may be discarded. Once a public key is created, Alice can post the public key in a public forum or may send the public key directly to any party that wishes to transmit encrypted messages to Alice.
At step 200, Bob chooses a random or pseudo-random vector φ from the set Lφ.
At step 210, Bob computes a vector e≡(φ·h)+m (mod q).
At step 220, Bob transmits the vector e to Alice, wherein vector e is the encrypted message.
At step 330, Alice computes the vector b≡a (mod p).
At step 340, Alice computes the vector c≡fp−1·b (mod p), wherein the vector fp−1 is the second private key of Alice that was computed earlier.
At step 350, Alice designates the vector c as the message m with high probability.
The steps of
First, note that the following equations hold true:
Define A1=(pg·φ) if modular reduction is performed and A2=(f·m) where no modular reduction is performed.
The parameters Lf, Lg and Lφ are chosen so that all the components of A1 and A2 are “small enough”. The components are “small enough” when the expression (A1+A2) has entries in the range (−q/2, q/2] most of the time. If this is true, then a′=A1+A2, without modular reduction, and
Hence,
In another embodiment, the Walsh-Hadamard Transform can be used to increase the speed of the REX cryptosystem. The Walsh-Hadamard Transform of a vector a is the polynomial A with components:
A[i]=Σja[j](−1)(i,j), for 0≦i≧N−1,
where (i, j)≡Σkikjk(mod 2). Note that ik is the kth bit of the binary representation of i. For each component A[i], the Walsh-Hadamard transform can be computed using log2 N addition or subtraction operations on the components of a. (For illustrative ease only, it is assumed that subtraction operations are of the same complexity as addition operations.) Thus, computing the Walsh-Hadamard transform of the vector a requires (N log2 N) operations.
The inverse Walsh-Hadamard transform of polynomial A maps the polynomial A back to the vector a and is computed component-wise as:
For each component a[i], the inverse Walsh-Hadamard transform can be computed using log2 N addition (or subtraction) operations on the components of A, and a multiplication by a factor of 1/N. Thus, computing the complete inverse Walsh-Hadamard transform vector a requires N log2 N addition (or subtraction) operations on the components of vector a and N multiplication operations.
The REX cryptosystem can be implemented using the Walsh-Hadamard transforms as described above in order to increase the speed of the cryptosystem. From a practical standpoint, the number of operations required to manipulate the Walsh-Hadamard transformations are fewer than the number of operations required to calculate the products of vectors. In particular, the steps described above can be performed due to the determination of certain characteristics of the vector space.
The first attribute of the Walsh-Hadamard transform on the ring RXOR is if c=a·b, then C[i]=A[i] B[i], for 0≦i≦N−1. The proof is as follows:
A second attribute of the Walsh-Hadamard transform on the ring RXOR,q is that if c=a·b (mod q), then C[i]=A[i] B[i] (mod q). Thus, the product c=a·b (mod q) can be computed by computing the Walsh-Hadamard transforms of the vectors a and b, and the inverse Walsh-Hadamard transform c of C. An advantage of using the Walsh-Hadamard transformation is the reduction in the number of operations being performed for the REX cryptosystem. The computation of the Walsh-Hadamard transforms A and B from vectors a and b requires only 2N log2 N addition (or subtraction) operations. The computation of C[i]=A[i]B[i](mod q) requires only N multiplication operations. The computation of the inverse Walsh-Hadamard transform c of C requires 2N log2 N addition (or subtraction) operations and N multiplication operations. Hence, the implementation of the Walsh-Hadamard transform in the REX cryptosystem is very efficient when computing inverses in the ring RXOR, RXOR,q and RXOR,p.
A third attribute of an implementation of the Walsh-Hadamard transform is the savings due to pre-computing some of the transforms. For example, the Walsh-Hadamard transform of the identify vector (1, 0, . . . , 0) on the ring RXOR=ZqN is the vector (1, 1, . . . , 1). The Walsh-Hadamard transform Fq−1 of fq−1 satisfies Fq−1[i]≡F[i]−1(mod q), for 0≦i≦N−1. The Walsh-Hadamard transform Fp−1 of fp−1 satisfies Fp−1[i]≡F[i]−1(mod p), for 0≦i≦N−1. Furthermore, f has an inverse modulo q and p if and only if F[i]≠0 (mod q) and F[i]≠0 (mod p), for 0≦i≦N−1.
At step 410, Alice computes the Walsh-Hadamard transform F of f, wherein the computation is not performed modular q.
At step 420, Alice computes the vector inverse Fq−1 of F by determining Fq−1[i]≡F[i]−1(mod q), for 0≦i≦N−1.
At step 430, Alice computes the vector inverse Fp−1 of F by determining Fp−1[i]≡F[i]−1(mod p), for 0≦i≦N−1.
At step 440, Alice chooses a random or pseudo-random vector g from the set Lg.
At step 450, Alice computes the Walsh-Hadamard transform G of g.
At step 460, Alice computes the Walsh-Hadamard transform H of h≡fq−1·(pg) (mod q), by computing:
H[i]≡Fq−1[i]pG[i](mod q), for 0≦i≦N−1.
At step 470, Alice designates the private key as being the two Walsh-Hadamard transforms F and Fp−1. The vector g is not required for encryption or decryption, so it may be discarded. However, the vector g should remain secret. In addition, the Alice designates the public key as the Walsh-Hadamard transform H.
At step 500, Bob computes the Walsh-Hadamard transform M of m.
At step 510, Bob chooses a random or pseudo-random vector φ from Lφ.
At step 520, Bob computes the Walsh-Hadamard transform Φ of vector φ.
At step 530, Bob computes the Walsh-Hadamard transform E of the vector e, wherein the vector e is defined as:
e≡(φ·h)+m(mod q).
Hence, the Walsh-Hadamard transform E is determined by the following relationship:
E[i]≡Φ[i]H[i]+M[i](mod q), for 0≦i≦N−1.
At step 540, the Bob transmits the Walsh-Hadamard transform E to Alice, wherein the Walsh-Hadamard transform E is the encrypted message.
A[i]≡F[i]E[i](mod q), for 0≦i≦N−1.
At step 610, Alice computes the inverse Walsh-Hadamard transform a of polynomial A (reducing modulo q). Alice ensures that all components of inverse Walsh-Hadamard transform a lie in the range of (−q/2, q/2], noting that:
a≡f·e(mod q).
At step 620, Alice computes the vector b a (mod p).
At step 630, Alice computes the Walsh-Hadamard transform B of vector b modulo p.
At step 640, Alice uses private key vector Fp−1 to compute:
C[i]≡Fp−[i]B[i](mod p), for 0≦i≦N−1.
At step 650, Alice computes the inverse Walsh-Hadamard transform c of (C modulo p), noting that c≡fp−1·b (mod p).
At step 660, Alice designates the vector c as the message m with high probability.
The embodiments described above that implement the Walsh-Hadamard transform within the REX cryptosystem uses a reduced number of operations, which correspondingly reduces the complexity of the cryptosystem. This complexity reduction is in addition to the complexity reduction for computing public keys. Part of the complexity reduction arises due to the reduced number of transformations performed in the overall encoding and decoding of a message.
Those of skill in the art would understand that information and signals may be represented using any of a variety of different technologies and techniques. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referenced throughout the above description may be represented by voltages, currents, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof.
The embodiments of the REX cryptosystem described above may be implemented by software, hardware, or combination thereof. At least one processing element and at least one memory element may be communicatively coupled to execute a software program or set of microcodes to implement the method steps described above.
Those of skill would further appreciate that the various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the embodiments of the REX cryptosystem disclosed herein may be implemented as electronic hardware, computer software, or combinations of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.
The various illustrative logical blocks, modules, and circuits described in connection with the embodiments disclosed herein may be implemented or performed with a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing devices, e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.
The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor. The processor and the storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In the alternative, the processor and the storage medium may reside as discrete components in a user terminal.
The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the invention. Thus, the present invention is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Number | Name | Date | Kind |
---|---|---|---|
6081597 | Hoffstein et al. | Jun 2000 | A |
6298137 | Hoffstein et al. | Oct 2001 | B1 |
6788788 | Kasahara et al. | Sep 2004 | B1 |
7031468 | Hoffstein et al. | Apr 2006 | B2 |
7080255 | Kasahara et al. | Jul 2006 | B1 |
7136484 | Koh | Nov 2006 | B1 |
20040151309 | Gentry et al. | Aug 2004 | A1 |
Number | Date | Country | |
---|---|---|---|
20040179679 A1 | Sep 2004 | US |