Preimage Selective Trapdoor Function: How to Repair an Easy Problem

Algorithm 1

Onion Algorithm.

(1) Compute 𝑓_𝑛1,𝑓_𝑛2 according to (13).

(2) if  gcd^𝐮_𝑛−1,gcd^𝐯_𝑛−1∈AIP_⟨𝑛⟩12  then

(3)  Search for 𝑓_𝑛1,𝑓_𝑛2 in Sub-𝑇_⟨𝑛⟩12 generated by

    𝐅_𝑛modgcd^𝐮_𝑛−1,gcd^𝐯_𝑛−1 to get 𝑓_𝑛∈𝐅_𝑛 such that

    𝑓_𝑛modgcd^𝐮_𝑛−1,gcd^𝐯_𝑛−1=𝑓_𝑛1,𝑓_𝑛2. Store 𝑓_𝑛.

(4) end if

(5) if  gcd^𝐮_𝑛−1,gcd^𝐯_𝑛−1∈AIP^𝑇_⟨𝑛⟩12  then

(6)  Search for 𝑓_𝑛2,𝑓_𝑛1 in Sub-𝑇_⟨𝑛⟩12 generated by

    𝐅_𝑛modgcd^𝐯_𝑛−1,gcd^𝐮_𝑛−1 to get 𝑓_𝑛∈𝐅_𝑛 such that

    𝑓_𝑛modgcd^𝐯_𝑛−1,gcd^𝐮_𝑛−1=𝑓_𝑛2,𝑓_𝑛1. Store 𝑓_𝑛.

(7) end if

(8) for  𝑖=𝑛−1,…,2  do

(9)   Compute (18) and

     𝑓_𝑖1,𝑓_𝑖2=𝑠_𝑖1𝑢_𝑖gcd^𝐮_𝑖⁻¹modgcd^𝐮_𝑖−1gcd^𝐮_𝑖,𝑠_𝑖2𝑣_𝑖gcd^𝐯_𝑖⁻¹modgcd^𝐯_𝑖−1gcd^𝐯_𝑖. (*)

(10)  if  gcd^𝐮_𝑖−1/gcd^𝐮_𝑖,gcd^𝐯_𝑖−1/gcd^𝐯_𝑖∈AIP_⟨𝑖⟩12  then

(11)  Search the column in Sub-𝑇_⟨𝑖⟩12  generated

   by 𝐅_𝑖 modulo gcd^𝐮_𝑖−1/gcd^𝐮_𝑖,gcd^𝐯_𝑖−1/gcd^𝐯_𝑖

   for 𝑓_𝑖1,𝑓_𝑖2 such that 𝑓_𝑖1,𝑓_𝑖2=

   𝑓_𝑖modgcd^𝐮_𝑖−1/gcd^𝐮_𝑖,gcd^𝐯_𝑖−1/gcd^𝐯_𝑖. Store

   𝑓_𝑖.

(12)  end if

(13)  if  gcd^𝐮_𝑖−1/gcd^𝐮_𝑖,gcd^𝐯_𝑖−1/gcd^𝐯_𝑖∈AIP^𝑇_⟨𝑖⟩12  then

(14)   Search the column in Sub-𝑇_⟨𝑖⟩12 generated

   by 𝐅_𝑖 modulo gcd^𝐯_𝑖−1/gcd^𝐯_𝑖,gcd^𝐮_𝑖−1/gcd^𝐮_𝑖

   for 𝑓_𝑖2,𝑓_𝑖1 such that 𝑓_𝑖2,𝑓_𝑖1=

   𝑓_𝑖modgcd^𝐯_𝑖−1/gcd^𝐯_𝑖,gcd^𝐮_𝑖−1/gcd^𝐮_𝑖. Store

   𝑓_𝑖.

(15)  end if

(16) end for

(17) Compute and store 𝑓₁=𝑠₁−∑^𝑛_𝑖=2𝑢_𝑖𝑓_𝑖/𝑢₁.

(18) return  𝐱=(𝑓₁,…,𝑓_𝑛).