A Digital Signature Scheme Based on MST₃ Cryptosystems

Abstract

As special types of factorization of finite groups, logarithmic signature and cover have been used as the main components of cryptographic keys for secret key cryptosystems such as PGM and public key cryptosystems like 𝑀𝑆𝑇₁, 𝑀𝑆𝑇₂, and 𝑀𝑆𝑇₃. Recently, Svaba et. al proposed a revised 𝑀𝑆𝑇₃ encryption scheme with greater security. Meanwhile, they put forward an idea of constructing signature schemes on the basis of logarithmic signatures and random covers. In this paper, we firstly design a secure digital signature scheme based on logarithmic signatures and random covers. In order to complete the task, we devise a new encryption scheme based on 𝑀𝑆𝑇₃ cryptosystems.

1. Introduction

With the interdisciplinary development of information science, physical science, and biological science, a lot of new technology appeared in the field of cryptography and has made new progress. The new branches of cryptography mainly consist of quantum cryptography, chaotic cryptography, DNA cryptography, and so forth. The security of quantum cryptography is based on the Heisenberg uncertainty principle. Quantum cryptography is the only one that can realize unconditional security at present [1–4]. Matthews [5] firstly applied chaos theory in cryptography and proposed a chaotic stream cipher scheme based on revised logistic map. From then on, chaotic cryptography has attracted wide attention [6, 7]. Most of the researches in chaotic cryptography focus on secret key cryptography. With the recent constructions due to Wang et al. [8–14], chaos-based public key cryptographic protocols come to us. DNA cryptography, which utilizes DNA computing, is a new branch of cryptography in recent years [15, 16]. Using the high storage density and high parallelism of DNA molecular, DNA cryptography can realize the encryption, authentication, signature, and so forth [17].

Meanwhile, cryptographers look forward to applying new intractable mathematical problems in classical cryptography. Currently, most public cryptographic primitives are based on the perceived intractability of certain mathematical problems in very large finite abelian groups [18]. Prominent hard problems consist of the problem of factoring large integers, the discrete logarithm problem over a finite field 𝐹_𝑞 or an elliptic curve, and so forth. However, due to quantum algorithms for factoring integer and solving the discrete logarithm problem, most known public-key cryptosystems will be insecure when quantum computers become practical. Therefore, it is an imminent work to design effective cryptographic schemes which can resist quantum attacks. Actually, since the 1980s, several experts have been trying to design new cryptography schemes based on difficult problems in group theory. In 1985, Wagner and Magyarik [19] proposed an approach to designing public-key cryptosystems based on groups and semigroups with undecidable word problem. In 2000, Ko et al. [20] developed the theory of braid-based cryptography based on the hardness of the conjugator search problem (CSP) in braid groups. In 2004, Eick and Kahrobaei [21] proposed a new cryptosystem based on polycyclic groups. In 2005, Shpilrain and Ushakov [22] suggested that Thompson’s group may be a good platform for constructing public-key cryptosystems. Recently, Kahrobaei et al. [23] proposed a public key exchange on the basis of matrices over group rings. Meanwhile, an active branch of noncommutative cryptography based on the hardness of group factorization problem has achieved great success during the last two decades. In 1986, Magliveras [24] proposed a symmetric cryptosystem 𝑃𝐺𝑀 based on a special type of factorization of finite groups named logarithmic signatures for finite permutation groups. Then, the algebraic properties of logarithmic signatures and cryptosystem 𝑃𝐺𝑀 were specifically discussed in [25, 26]. In 2002, Magliveras et al. [27] put forward two public key cryptosystems 𝑀𝑆𝑇₁ and 𝑀𝑆𝑇₂. In 2009, Lempken et al. [18] designed a new public key cryptosystem 𝑀𝑆𝑇₃ on the basis of random covers and logarithmic signatures for nonabelian finite groups. Meanwhile, there are some interesting papers studying attacks on 𝑀𝑆𝑇₁, 𝑀𝑆𝑇₂, and 𝑀𝑆𝑇₃ [28–33]. In 2010, Svaba and van Trung [34] constructed an 𝑒𝑀𝑆𝑇₃ cryptosystem by adding a homomorphism as a component of secret key. However, until now, there is no paper on constructing digital signature schemes on the basis of 𝑀𝑆𝑇 cryptosystem. Hence, Svaba and van Trung put forward an open problem on constructing digital signature schemes based on random covers and logarithmic signatures.

Our main contribution is to devise a digital signature scheme based on random covers and logarithmic signatures. In this process, we also construct a secure and more efficient encryption scheme based on 𝑀𝑆𝑇₃ cryptosystems.

The rest of contents are organized as follows. Necessary preliminaries are given in Section 2. In Section 3, we specifically describe a new encryption scheme and give corresponding security analysis. In Section 4, we propose a digital signature scheme based on random covers and logarithmic signatures; The related comparisons and illustrations are presented in Section 5.

2. Preliminaries

2.1. Cover and Logarithmic Signature

Let 𝐺 be a finite abstract group and let 𝑋=[𝑥₁,𝑥₂,…,𝑥_𝑟] and 𝑌=[𝑦₁,𝑦₂,…,𝑦_𝑠] be two elements in 𝐺^[ℤ]. Then 𝑋⊗𝑌=𝑥₁𝑦₁,…,𝑥₁𝑦_𝑠,𝑥₂𝑦₁,…,𝑥₂𝑦_𝑠,…,𝑥_𝑟𝑦₁,…,𝑥_𝑟𝑦_𝑠. (1) If 𝑋=[𝑥₁,…,𝑥_𝑟]∈𝐺^[ℤ], 𝑋 denotes the element ∑^𝑟_𝑖=1𝑥_𝑖 in the group ring ℤ𝐺.

Definition 1 (cover and logarithmic signature [18, 27]). Suppose that 𝛼=[𝐴₁,𝐴₂,…,𝐴_𝑠] is a sequence of 𝐴_𝑖∈𝐺^[ℤ], such that ∑^𝑠_𝑖=1|𝐴_𝑖| is bounded by a polynomial in log|𝐺|. Let 𝐴₁⋅𝐴₂⋯𝐴_𝑠=_𝑔∈𝐺𝑎_𝑔𝑔,𝑎_𝑔∈ℤ. (2)
Let 𝑆 be a subset of 𝐺. Then 𝛼 is (i)a cover for 𝐺 (or 𝑆) if 𝑎_𝑔>0 for all 𝑔∈𝐺 (𝑔∈𝑆),(ii)a logarithmic signature for 𝐺 (or 𝑆) if 𝑎_𝑔=1 for every 𝑔∈𝐺 (𝑔∈𝑆).

The sequences 𝐴_𝑖 are called the blocks; the vector (𝑟₁,…,𝑟_𝑠) with 𝑟_𝑖=|𝐴_𝑖| is the type of 𝛼 and the length of 𝛼 is defined to be 𝑙(𝛼)=∑^𝑠_𝑖=1𝑟_𝑖.

More generally, if 𝛼=[𝐴₁,𝐴₂,…,𝐴_𝑠] is a logarithmic signature (cover) for 𝐺, then each element 𝑔∈𝐺 can be expressed uniquely (at least one way) as a product of the form [18] 𝑔=𝑎₁⋅𝑎₂⋯𝑎_𝑠, (3) for 𝑎_𝑖∈𝐴_𝑖. 𝛼 is called tame (factorizable) if the factorization above can be achieved in polynomial in the width 𝑤 of 𝐺.

Definition 2 (cover (logarithmic signature) mappings [35]). Let 𝛼=[𝐴₁,𝐴₂,…,𝐴_𝑠] be a cover (logarithmic signature) of type (𝑟₁,𝑟₂,…,𝑟_𝑠) for 𝐺 with 𝐴_𝑖=[𝑎_𝑖,1,𝑎_𝑖,2,…,𝑎_{𝑖,𝑟𝑖}], where 𝑚=∏^𝑠_𝑖=1𝑟_𝑖. Let 𝑚₁=1 and 𝑚_𝑖=∏^𝑖−1_𝑗=1𝑟_𝑗 for 𝑖=2,…,𝑠. Let 𝜏 denote the canonical bijection 𝜏∶ℤ_𝑟1×ℤ_𝑟2×⋯×ℤ_𝑟𝑠⟶ℤ_𝑚𝜏𝑗₁,𝑗₂,…,𝑗_𝑠=^𝑠_𝑖=1𝑗_𝑖⋅𝑚_𝑖. (4)
Then the surjective (bijection) mapping 𝛼^′∶ℤ_𝑚→𝐺 induced by 𝛼 is 𝛼^′(𝑥)=𝑎_1𝑗1⋅𝑎_2𝑗2⋯𝑎_𝑠𝑗𝑠, (5) where (𝑗₁,𝑗₂,…,𝑗_𝑠)=𝜏⁻¹(𝑥).

2.2. MST₃ Cryptosystems and Suzuki 2-Groups

In [18], Lempken et al. utilized logarithmic signatures and random covers to construct a generic 𝑀𝑆𝑇₃ encryption scheme. In this scheme, the public key consists of a tame logarithmic signature as well as some random numbers, and the secret key is composed of a random cover and a sandwich transformation of the cover [27]. The intractability assumptions of this scheme are group factorization problem on nonabelian groups.

Furthermore, motivated by attacks in [31], Svaba and van Trung devised an enhanced version of the generic scheme [34] named 𝑒𝑀𝑆𝑇₃ cryptosystems. In this scheme, they introduced a secret homomorphism to mask the secret logarithmic signature with a transformation of a random cover. Meanwhile, they proposed a new setup with random encryption.

Until now, the only instantiation of 𝑀𝑆𝑇₃ cryptosystems is a Suzuki 2-group of order 𝑞² with 𝑞=2^𝑚 (𝑚≥3) [18, 34]. From [34], the Suzuki 2-group of order 𝑞² can be denoted by 𝐴(𝑚,𝜃), where 𝜃 is an automorphism of 𝔽_𝑞 with an odd order. Moreover, the group 𝐴(𝑚,𝜃) can be represented by a matrix group 𝐺 and 𝐺=𝑆(𝑎,𝑏)∣𝑎,𝑏∈𝔽_𝑞, (6) where 𝑆(𝑎,𝑏)=1𝑎𝑏01𝑎^𝜃001 (7) is a 3×3 matrix over 𝔽_𝑞. Hence, 𝐺 is of order 𝑞² and the center 𝒵(𝐺)={𝑆(0,𝑏)∣𝑏∈𝐹_𝑞}. Besides, to store the group elements conveniently, 𝑆(𝑎,𝑏) can be denoted by (𝑎,𝑏,𝑎^𝜃), so the product of two elements in group 𝐺 is 𝑆𝑎₁,𝑏₁𝑆𝑎₂,𝑏₂=𝑆𝑎₁,𝑏₁,𝑎^𝜃₁𝑆𝑎₂,𝑏₂,𝑎^𝜃₂=𝑎₁+𝑎₂,𝑏₁+𝑏₂+𝑎₁𝑎^𝜃₂,𝑎^𝜃₁+𝑎^𝜃₂, (8) and the computation of the product just requires a single multiplication and four additions in 𝔽_𝑞.

Furthermore, the inverse of an element in group 𝐺 is 𝑆𝑎,𝑏,𝑎^𝜃−1=𝑆𝑎,𝑎^𝜃⋅𝑎+𝑏,𝑎^𝜃=𝑆𝑎,𝑎^𝜃+1+𝑏,𝑎^𝜃, (9) and it also requires a single multiplication and one addition in 𝔽_𝑞. If 𝑔=𝑆(𝑥,𝑦)∈𝐺 and 𝑥,𝑦∈𝐹_𝑞, then 𝑥 and 𝑦 can be denoted by 𝑔_⋅𝑎 and 𝑔_⋅𝑏, respectively. Hence, 𝑔=𝑆(𝑔_⋅𝑎,𝑔_⋅𝑏), where 𝑔_⋅𝑎 and 𝑔_⋅𝑏 are the corresponding projections of 𝑔 along the first and second coordinates.

3. Building Block: A New MST₃ Encryption Scheme

Through comparison and analysis, we find that it is rather difficult to devise signature schemes based on the two 𝑀𝑆𝑇₃ encryption schemes [18, 34]. Therefore, in order to complete the task, we design a new encryption scheme based on logarithmic signatures and random covers. In our scheme, the original secret key 𝑓 becomes a component of public key, and the encryption process is also simplified. Meanwhile, compared with original schemes, our scheme has a bit improvement in efficiency.

3.1. Description of the Scheme

Key Generation

 Input: a large group 𝐺=𝐴(𝑚,𝜃), 𝑞=2^𝑚. Output: a public key [𝛼,𝛾,𝑓] with corresponding private key [𝛽,(𝑡₀,…,𝑡_𝑠)]. (1) Choose a tame logarithmic signature 𝛽=[𝐵₁,𝐵₂,…,𝐵_𝑠]=(𝑏_𝑖𝑗)=(𝑆(0,𝑏_{(𝑖𝑗)⋅𝑏})) of type (𝑟₁,𝑟₂,…,𝑟_𝑠) for 𝒵, where 𝑏_𝑖𝑗∈𝐺 and 𝑏_{(𝑖𝑗)⋅𝑏}∈𝔽_𝑞. (2) Select a random cover 𝛼=[𝐴₁,𝐴₂,…,𝐴_𝑠]=(𝑎_𝑖𝑗)=(𝑆(𝑎_{(𝑖𝑗)⋅𝑎},𝑎_{(𝑖𝑗)⋅𝑏})) of the same type as 𝛽 for a certain subset 𝐽 of 𝐺 such that 𝐴₁,…,𝐴_𝑠⊆𝐺⧵𝒵, where 𝑎_𝑖𝑗∈𝐺, 𝑎_{(𝑖𝑗)⋅𝑎}∈𝔽_𝑞⧵{0}, and 𝑎_{(𝑖𝑗)⋅𝑏}∈𝔽_𝑞. (3) Choose 𝑡₀,𝑡₁,…,𝑡_𝑠∈𝐺⧵𝒵. (4) Construct a homomorphism 𝑓∶𝐺→𝒵 defined by 𝑓(𝑆(𝑎,𝑏))=𝑆(0,𝑎). (5) Compute 𝛾∶=(ℎ_𝑖𝑗)=(𝑆(ℎ_{(𝑖𝑗)⋅𝑎},ℎ_{(𝑖𝑗)⋅𝑏})), where ℎ_𝑖𝑗=𝑡⁻¹_𝑖−1⋅𝑓(𝑎_𝑖𝑗)⋅𝑏_𝑖𝑗⋅𝑡_𝑖. (6) Output public key [𝛼,𝛾,𝑓] and private key [𝛽,(𝑡₀,…,𝑡_𝑠)].

Encryption Input: a message 𝑥∈𝒵 and the public key [𝛼,𝛾,𝑓]. Output: a ciphertext (𝑦₁,𝑦₂) of the message 𝑚. (1) Choose a random 𝑅∈ℤ_|𝒵|. (2) Compute 𝑦₁=𝛼^′(𝑅)𝑦⋅𝑚,₂=𝛾^′(𝑅)=𝑡₀⁻¹⋅𝑓𝛼^′(𝑅)⋅𝛽^′(𝑅)⋅𝑡_𝑠. (10) (3) Output (𝑦₁,𝑦₂).

Decryption Input: a ciphertext pair (𝑦₁,𝑦₂) and the private key [𝛽,𝑡₀,…,𝑡_𝑠]. Output: the message 𝑚∈𝒵 corresponding to ciphertext (𝑦₁,𝑦₂). (1) Compute 𝑅=𝛽^′−1(𝑦₂𝑡_𝑠⁻¹𝑓(𝑦₁)⁻¹𝑡₀). (2) Compute 𝑚=𝛼^′(𝑅)⁻¹⋅𝑦₁. (3) Output 𝑚.

Correctness For 𝑚∈𝒵 and 𝑅∈ℤ_|𝒵|, we have 𝑦₁=𝛼^′(𝑅)𝑦⋅𝑚,₂=𝛾^′(𝑅)=𝑏_1𝑗𝑖𝑡₀⁻¹𝑓𝑎_1𝑗1𝑡₁⋯𝑏_𝑠𝑗𝑠𝑡⁻¹_𝑠−1𝑓𝑎_𝑠𝑗𝑠𝑡_𝑠=𝑏_1𝑗𝑖𝑏_2𝑗2⋯𝑏_𝑠𝑗𝑠𝑡₀⁻¹𝑓𝑎_1𝑗1𝑎_2𝑗3⋯𝑎_𝑠𝑗𝑠𝑡_𝑠=𝛽^′(𝑅)⋅𝑡₀⁻¹⋅𝑓𝛼^′(𝑅)⋅𝑡_𝑠=𝛽^′(𝑅)⋅𝑡₀⁻¹⋅𝑓𝛼^′(𝑅)⋅𝑚⋅𝑡_𝑠=𝛽^′(𝑅)⋅𝑡₀⁻¹⋅𝑓𝑦₁⋅𝑡_𝑠⟹𝛽^′(𝑅)=𝑦₂⋅𝑡_𝑠⁻¹⋅𝑓𝑦₁⁻¹⋅𝑡₀; (11) then using 𝛽^′−1 we can recover the random number 𝑅 by 𝛽^′−1𝛽^′(𝑅)=𝛽^′−1𝑦₂𝑡_𝑠⁻¹𝑓𝑦₁⁻¹𝑡₀=𝑅. (12) Consequently, using 𝑦₁ we can recover message 𝑚 by 𝑚=𝛼^′(𝑅)⁻¹⋅𝑦₁. (13)

3.2. Security Analysis

3.2.1. Attack on Private Key

(a) In general, the adversary tries to obtain 𝛽 and (𝑡₀,𝑡_𝑠) from the equation 𝛽^′(𝑅)=𝑦₂⋅𝑡_𝑠⁻¹⋅𝑓𝑦₁⁻¹⋅𝑡₀, (14) where 𝑅∈ℤ_|𝒵|, 𝑦₁=𝛼^′(𝑅)⋅𝑚, 𝑦₂=𝛾^′(𝑅), and 𝑓(𝑦₁)⁻¹∈𝒵.

The adversary mainly attempts to compute enough values 𝛽^′(𝑅_𝑖) in order to construct 𝛽 using the corresponding conclusion in [27]. If 𝛽 is of type (𝑟₁,𝑟₂,…,𝑟_𝑠), then one can construct a logarithmic signature equivalent to 𝛽 by using 𝑛 selected values 𝛽^′(𝑅_𝑖), where 𝑛=1−𝑠+∑^𝑠_𝑘=1𝑟_𝑘. Let {𝑅₁,𝑅₂,…,𝑅_𝑛} be a collection of random numbers chosen by the adversary. Then 𝛽^′𝑅_𝑖=𝑦_𝑖2𝑡_𝑠⁻¹𝑓𝑦_𝑖1⁻¹𝑡₀=𝑓𝑦_𝑖1⁻¹𝑦_𝑖2𝑡_𝑠⁻¹𝑡₀,𝑖=1,…,𝑛, (15) where 𝑦_𝑖1=𝛼^′(𝑅_𝑖)⋅𝑚, 𝑦_𝑖2=𝛾^′(𝑅_𝑖), and 𝑓(𝑦_𝑖1)⁻¹∈𝒵. Note that in the equation above, 𝑓(𝑦_𝑖1)⁻¹ and 𝑦_𝑖2 are known and 𝛽^′(𝑅_𝑖)∈𝒵; then we have 𝑓𝑦_𝑖1⁻¹𝑦_𝑖2𝑡_𝑠⁻¹𝑡₀∈𝒵⟹𝑡₀∈𝑡_𝑠𝑦⁻¹_𝑖2𝑓𝑦_𝑖1𝒵. (16) Since 𝑡_𝑠∈𝐺⧵𝒵, there are 𝑞²−𝑞 possibilities for 𝑡_𝑠. If 𝑡_𝑠 is chosen, from 𝑡₀∈𝑡_𝑠𝑦⁻¹_𝑖2𝑓(𝑦_𝑖1)𝒵, there are 𝑞 possibilities for 𝑡₀. Hence, there are 𝑞(𝑞²−𝑞) suitable pairs (𝑡₀,𝑡_𝑠). Besides, for each solution pair (𝑡₀,𝑡_𝑠), there are 𝑞 equivalent solutions (𝑡₀𝑧,𝑡_𝑠𝑧) with 𝑧∈𝒵. Consequently, there are 𝑞²−𝑞 different solutions, so the success probability of the attacker is 1/𝑞(𝑞−1).

(b) In this attack, an adversary mainly wants to utilize equivalent secret key [𝛽^∗,(𝑡^∗₀,…,𝑡^∗_𝑠)] to replace the real secret key [𝛽,(𝑡₀,…,𝑡_𝑠)]. From [34], we can see that the adversary only needs to let 𝑡^∗_𝑖=𝑡_𝑖𝑧_𝑖 (1≤𝑖≤𝑠) and 𝑏^∗_𝑖𝑗=𝑏_𝑖𝑗𝑐_𝑖𝑗 (1≤𝑖≤𝑠,1≤𝑗≤𝑟_𝑖) for 𝑧_𝑖,𝑐_𝑖𝑗∈𝒵. So for the first block of 𝛾, we have ℎ_1𝑗=𝑏_1𝑗𝑡₀^∗−1𝑧₀𝑓𝑎_1𝑗𝑡₁. (17) Let 𝑏^∗_𝑖1=𝑖𝑑; then 𝑐_𝑖1=𝑏_𝑖1; we have ℎ₁₁=𝑏^∗₁₁𝑐₁₁𝑡₀^∗−1𝑧₀𝑓𝑎₁₁𝑡₁=𝑏^∗₁₁𝑡₀^∗−1𝑓𝑎₁₁𝑡₁𝑐₁₁𝑧₀⟹𝑡^∗₁=𝑡₁𝑐₁₁𝑧₀,ℎ_1𝑗=𝑏_1𝑗𝑡₀^∗−1𝑧₀𝑓𝑎_1𝑗𝑡^∗₁𝑐₁₁𝑧₀𝑗=2,…,𝑟₁,𝑏^∗_1𝑗=𝑏_1𝑗𝑐_1𝑗=ℎ_1𝑗𝑡₁^∗−1𝑓𝑎_1𝑗⁻¹𝑡^∗₀⟹𝑐_1𝑗=𝑐₁₁=𝑏₁₁,ℎ₂₁=𝑏^∗₂₁𝑐₂₁𝑡₁^∗−1𝑐₁₁𝑧₀𝑓𝑎₂₁𝑡₂⟹𝑡^∗₂=𝑡₂𝑐₂₁𝑐₁₁𝑧₀,ℎ_2𝑗=𝑏_2𝑗𝑡₁^∗−1𝑐₁₁𝑧₀𝑓𝑎_2𝑗𝑡^∗₂𝑐₂₁𝑐₁₁𝑧₀𝑗=2,…,𝑟₂,𝑏^∗_2𝑗=𝑏_2𝑗𝑐_2𝑗=ℎ_2𝑗𝑡₂^∗−1𝑓𝑎_2𝑗⁻¹𝑡^∗₁⟹𝑐_2𝑗=𝑐₂₁=𝑏₂₁⋮ (18) We can get that 𝑐_𝑖𝑗=𝑐_𝑖1=𝑏_𝑖1 for all 𝑖=1,…,𝑠. If we denote 𝑐_𝑖𝑗=𝑐_𝑖, then 𝑡^∗_𝑖=𝑡_𝑖𝑧₀∏^𝑖_𝑘=1𝑐_𝑘. Consider 𝛾^′(𝑅)=𝛽^′(𝑅)𝑡₀⁻¹𝑓𝛼^′(𝑅)𝑡_𝑠=𝛽^′(𝑅)𝑡₀^∗−1𝑧₀⁻¹𝑓𝛼^′(𝑅)𝑡^∗_𝑠𝑧₀^𝑠_𝑘=1𝑐_𝑘=𝛽^′(𝑅)^𝑠_𝑘=1𝑐_𝑘𝑡₀^∗−1𝑓𝛼^′(𝑅)𝑡^∗_𝑠. (19) Let 𝛽^′(𝑅)=𝑏_1𝑥1𝑏_2𝑥2⋯𝑏_𝑠𝑥𝑠, 𝛽^∗∶=(𝑏^∗_𝑖𝑗), and 𝑏^∗_𝑖𝑗=𝑏_𝑖𝑗𝑐_𝑖 for 𝑐_𝑖∈𝒵; then 𝛽^∗(𝑅)=𝑏^∗_1𝑥1𝑏^∗_2𝑥2⋯𝑏^∗_𝑠𝑥𝑠=𝑏_1𝑥1𝑐₁𝑏_2𝑥2𝑐₂⋯𝑏_𝑠𝑥𝑠𝑐_𝑠=𝛽^′(𝑅)^𝑠_𝑘=1𝑐_𝑘. (20) Since 𝛽^∗ is tame, so the adversary can use forgery secret key [𝛽^∗,(𝑡^∗₀,…,𝑡^∗_𝑠)] to recover the random number 𝑅. Meanwhile, from conclusions in [31], as there are 𝑞=|𝐺/𝒵| possible choices for 𝑡₀ in 𝑡₀𝒵, the complexity for this attack is 𝒪(𝑞). Since the center 𝒵 of Suzuki 2-group has a large order 𝑞, so the attack is computationally infeasible.

3.2.2. Attack on Ciphertext

OW (onewayness). In the stage of encryption, from the equation 𝑦₁=𝛼^′(𝑅)⋅𝑥, we can get that 𝑥=𝛼^′(𝑅)⁻¹⋅𝑦₁. Hence, if the adversary wants to recover message 𝑥, he either directly seeks the random number 𝑅 or recovers 𝑅 from 𝛾^′(𝑅). However, since 𝑞 is large enough and 𝛾^′ is a one-way map, so the attack is computationally infeasible.

IND (indistinguishability). Although we cannot give a formal proof on the indistinguishability of the scheme, we would like to analyse it in a heuristic manner. Suppose that (𝑦^∗₁,𝑦^∗₂) is the ciphertext of 𝑚₀ or 𝑚₁, where 𝑦^∗₁=𝛼^′(𝑅)⋅𝑚_𝛿, 𝑦^∗₂=𝛾^′(𝑅), 𝛿=0 or 1, 𝑚₀, and 𝑚₁ are randomly selected by the adversary. Then we can analyse the following two cases: 𝑦₁=𝛼^′(𝑅)⋅𝑚₀𝑦₂=𝛾^′(𝑅),𝑦^′₁=𝛼^′𝑅^′⋅𝑚₁𝑦^′₂=𝛾^′𝑅^′. (21) Since 𝑅 and 𝑅^′ are randomly selected, and they admit the same distribution, thus, 𝑅 and 𝑅^′ are statistically indistinguishable for the adversary. It can be denoted by 𝑅≈_𝑠𝑅^′. Meanwhile, since 𝛼^′ and 𝛽^′ are both one-way maps, so we can get that 𝛼^′(𝑅)≈_𝑠𝛼^′(𝑅^′) and 𝛾^′(𝑅)≈_𝑠𝛾^′(𝑅^′). Besides, since 𝑚₀≈_𝑠𝑚₁, so 𝛼^′(𝑅)⋅𝑚₀≈_𝑠𝛼^′(𝑅^′)⋅𝑚₁. Consequently, we can get that (𝑦₁,𝑦₂)≈_𝑠(𝑦^′₁,𝑦^′₂).

4. A Digital Signature Scheme Based on the New MST₃ Cryptosystem

In this section, we utilize the encryption scheme above to construct a digital signature scheme based on random covers and logarithmic signatures.

4.1. Description of the Scheme

Key Generation Input: a large group 𝐺=𝐴(𝑚,𝜃) and 𝑞=2^𝑚. Output: a public key [𝛼,𝛾,𝑓,𝐻] with corresponding private key [𝛽,(𝑡₀,…,𝑡_𝑠)]. (1) Choose a tame logarithmic signature 𝛽=[𝐵₁,𝐵₂,…,𝐵_𝑠]∶=(𝑏_𝑖𝑗)=(𝑆(0,𝑏_{(𝑖𝑗)⋅𝑏})) of type (𝑟₁,𝑟₂,…,𝑟_𝑠) for 𝒵, where 𝑏_𝑖𝑗∈𝐺 and 𝑏_{(𝑖𝑗)⋅𝑏}∈𝔽_𝑞. (2) Select a random cover 𝛼=[𝐴₁,𝐴₂,…,𝐴_𝑠]∶=(𝑎_𝑖𝑗)=(𝑆(𝑎_{(𝑖𝑗)⋅𝑎},𝑎_{(𝑖𝑗)⋅𝑏})) of the same type as 𝛽 for a certain subset 𝐽 of 𝐺 such that 𝐴₁,…,𝐴_𝑠⊆𝐺⧵𝒵, where 𝑎_𝑖𝑗∈𝐺, 𝑎_{(𝑖𝑗)⋅𝑎}∈𝔽_𝑞⧵{0}, and 𝑎_{(𝑖𝑗)⋅𝑏}∈𝔽_𝑞. (3) Choose 𝑡₀,𝑡₁,…,𝑡_𝑠∈𝐺⧵𝒵. (4) Construct a homomorphisms 𝑓∶𝐺→𝒵 defined by 𝑓(𝑆(𝑎,𝑏))=𝑆(0,𝑎). (5) Compute 𝛾∶=(ℎ_𝑖𝑗)=(𝑆(ℎ_{(𝑖𝑗)⋅𝑎},ℎ_{(𝑖𝑗)⋅𝑏})), where ℎ_𝑖𝑗=𝑡⁻¹_𝑖−1⋅𝑓(𝑎_𝑖𝑗)⋅𝑏_𝑖𝑗⋅𝑡_𝑖. (6) Define a hash function 𝐻∶𝐺×𝐺→𝐺. (7) Output public key [𝛼,𝛾,𝑓,𝐻] and private key [𝛽,(𝑡₀,…,𝑡_𝑠)].

Signature Input: a message 𝑚∈𝐺 and private key [𝛽,(𝑡₀,…,𝑡_𝑠)]. Output: signature 𝜎=(𝑆₁,𝑆₂). (1) Randomly select 𝑧∈𝒵 and compute a random element 𝑟=𝑡₀⁻¹𝑧𝑡_𝑠∈𝐺. Let 𝑐₂=𝑟, 𝑐₁=𝐻(𝑚,𝑟). (2) Compute 𝑆₁=𝛽^′−1(𝑓(𝑐₁)⁻¹⋅𝑡₀⋅𝑐₂⋅𝑡_𝑠⁻¹) and 𝑆₂=𝛼^′(𝑆₁)⁻¹⋅𝑐₁. (3) Output 𝜎=(𝑆₁,𝑆₂).

Verification Input: the message 𝑚∈𝐺, signature 𝜎=(𝑆₁,𝑆₂), and public key [𝛼,𝛾,𝑓,𝐻]. Output: 0 or 1. (1) Compute 𝐴=𝛼^′(𝑆₁)⋅𝑆₂ and 𝐵=𝐻(𝑚,𝛾^′(𝑆₁)⋅𝑓(𝑆₂)). (2) If 𝐴=𝐵, output 1; otherwise output 0.

Correctness. For a given message 𝑚∈𝐺, 𝛾^′𝑆₁=𝑡₀⁻¹⋅𝑓𝛼^′𝑆₁⋅𝛽^′𝑆₁⋅𝑡_𝑠⟹𝑆₁=𝛽^′−1𝑓𝛼^′𝑆₁⁻¹⋅𝑡₀⋅𝛾^′𝑆₁⋅𝑡_𝑠⁻¹. (22)

Meanwhile, 𝑆₁=𝛽^′−1(𝑓(𝑐₁)⁻¹⋅𝑡₀⋅𝑐₂⋅𝑡_𝑠⁻¹) and 𝑐₁=𝛼^′(𝑆₁)⋅𝑆₂.

Hence, 𝑓𝛼^′𝑆₁⁻¹⋅𝑡₀⋅𝛾^′𝑆₁⋅𝑡_𝑠⁻¹=𝑓𝑐₁⁻¹⋅𝑡₀⋅𝑐₂⋅𝑡_𝑠⁻¹=𝑓𝛼^′𝑆₁⋅𝑆₂⁻¹⋅𝑡₀⋅𝑐₂⋅𝑡_𝑠⁻¹=𝑓𝛼^′𝑆₁⁻¹⋅𝑡₀⋅𝑓𝑆₂⁻¹⋅𝑐₂⋅𝑡_𝑠⁻¹⟹𝛾^′𝑆₁=𝑓𝑆₂⁻¹⋅𝑐₂⟹𝑐₂=𝛾^′𝑆₁⋅𝑓𝑆₂. (23) Consequently, we have 𝐻𝑚,𝑐₂=𝑐₁⟹𝐻𝑚,𝛾^′𝑆₁⋅𝑓𝑆₂=𝛼^′𝑆₁⋅𝑆₂. (24)

4.2. Security Analysis

4.2.1. Attack on Private Key

(a) Compared with the encryption scheme in Section 3, we add a secure hash function in the signature scheme. Hence, analysis of the security of the signature scheme is similar to that in the encryption scheme. In the signature scheme, the goal of the general attack is also to determine 𝛽 and (𝑡₀,𝑡_𝑠) from the equation 𝛽^′(𝑅)=𝑦₂𝑡_𝑠⁻¹𝑓𝑦₁⁻¹𝑡₀, (25) where 𝑦₁=𝛼^′(𝑅)⋅𝑥, 𝑦₂=𝛾^′(𝑅), and 𝑓(𝑦₁)⁻¹∈𝒵. Let {𝑅₁,𝑅₂,…,𝑅_𝑛} be a collection of random numbers chosen by the adversary. Then we have 𝛽^′𝑅_𝑖=𝑦_𝑖2𝑡_𝑠⁻¹𝑓𝑦_𝑖1⁻¹𝑡₀=𝑓𝑦_𝑖1⁻¹𝑦_𝑖2𝑡_𝑠⁻¹𝑡₀, (26) where 𝑦_𝑖1=𝛼^′(𝑅_𝑖)⋅𝑥, 𝑦_𝑖2=𝛾^′(𝑅_𝑖), and 𝑓(𝑦_𝑖1)⁻¹∈𝒵. Then 𝑓𝑦_𝑖1⁻¹𝑦_𝑖2𝑡_𝑠⁻¹𝑡₀∈𝒵⟹𝑡₀∈𝑡_𝑠𝑦⁻¹_𝑖2𝑓𝑦_𝑖1𝒵. (27) As described in Section 3, there are 𝑞²−𝑞 different solutions; the success probability of the adversary is 1/𝑞(𝑞−1).

(b) In our signature scheme, we construct a ciphertext pair (𝑐₁,𝑐₂) then obtain the signature 𝜎=(𝑆₁,𝑆₂) by decrypting the pair (𝑐₁,𝑐₂). Therefore, analysis of the equivalent key is similar to that in Section 3. In this attack, an adversary mainly wants to utilize equivalent secret key [𝛽^∗,(𝑡^∗₀,…,𝑡^∗_𝑠)] to replace the real secret key [𝛽,(𝑡₀,…,𝑡_𝑠)]. As described in Section 3, for a random number 𝑅∈ℤ_|𝒵|, 𝛾^′(𝑅)=𝛽^′(𝑅)𝑡₀⁻¹𝑓𝛼^′(𝑅)𝑡_𝑠=𝛽^′(𝑅)𝑡₀^∗−1𝑧₀𝑓𝛼^′(𝑅)𝑡^∗_𝑠𝑧₀^𝑠_𝑘=1𝑐_𝑘=𝛽^′(𝑅)^𝑠_𝑘=1𝑐_𝑘𝑡₀^∗−1𝑓𝛼^′(𝑅)𝑡^∗_𝑠. (28) Let 𝛽^′(𝑅)=𝑏_1𝑥1𝑏_2𝑥2⋯𝑏_𝑠𝑥𝑠 and 𝛽^∗∶=(𝑏^∗_𝑖𝑗), 𝑏^∗_𝑖𝑗=𝑏_𝑖𝑗𝑐_𝑖; then 𝛽^∗(𝑅)=𝑏^∗_1𝑥1𝑏^∗_2𝑥2⋯𝑏^∗_𝑠𝑥𝑠=𝑏_1𝑥1𝑐₁𝑏_2𝑥2𝑐₂⋯𝑏_𝑠𝑥𝑠𝑐_𝑠=𝛽^′(𝑅)^𝑠_𝑘=1𝑐_𝑘. (29) Consequently, the complexity for this attack is 𝒪(𝑞). While, due to the center 𝒵 of Suzuki 2-group having a large order 𝑞, so the attack is computationally infeasible.

4.2.2. Unforgeability

Suppose that Eve attempts to forge a message-signature pair (𝑚^∗,𝑆^∗₁,𝑆^∗₂) such that 𝛼𝑆^∗₁⋅𝑆^∗₂=𝐻𝑚^∗,𝛾^′𝑆^∗₁⋅𝑓𝑆^∗₂. (30)

Case 1. Eve chooses a random number 𝑆^∗₁∈ℤ_|𝒵| and 𝑆^∗₂∈𝐺 then computes 𝛼(𝑆^∗₁)⋅𝑆^∗₂ and 𝛾(𝑆^∗₁)⋅𝑓(𝑆^∗₂). If Eve can get a message 𝑚^∗ satisfying the above equation, then he can answer the preimage of hash function 𝐻, but it is infeasible since 𝐻 is a secure cryptographic hash function.

Case 2. Eve randomly selects two elements 𝑚^∗∈𝐺 and 𝑆^∗₂∈𝐺 and computes 𝑐^∗₂=𝐻(𝑚^∗,𝑐^∗₁). In order to obtain a valid 𝑆^∗₁, Eve selects 𝑐^∗₁ and computes 𝑦=𝐻(𝑚^∗,𝑐^∗₁⋅𝑓(𝑆^∗₂))⋅(𝑆^∗₂)⁻¹. Getting a right 𝑆^∗₁ such that 𝛼(𝑆^∗₁)⋅𝑆^∗₂=𝐻(𝑚^∗,𝛾^′(𝑆^∗₁)⋅𝑓(𝑆^∗₂)) is equivalent to solving the equations 𝑐^∗₁=𝛾^′(𝑆^∗₁) and 𝑦=𝛼^′(𝑆^∗₁). Since 𝛼^′ and 𝛾^′ are both one-way functions, so Eve cannot answer right 𝑆^∗₁ by considering the corresponding ciphertext (𝑐^∗₁,𝑦).

Case 3. Eve randomly chooses one pair (𝑚^∗,𝑆^∗₁) and 𝑟∈𝒵 then computes 𝑆^∗₂=𝛼^′(𝑆^∗₁)⁻¹⋅𝐻(𝑚^∗,𝛾^′(𝑆^∗₁)⋅𝑟). If 𝑓(𝑆^∗₂)=𝑟, then Eve can forge one valid signature. Note that the probability of this case is Pr[𝑓(𝑆^∗₂)=𝑟]=1/𝑞 for |𝒵|=𝑞. Since 𝑞 is large enough, this attack is computationally infeasible.

5. Comparisons and Illustrations

5.1. Comparisons

In this subsection, we compare 𝑒𝑀𝑆𝑇₃ encryption scheme in [34] and our encryption scheme on number of basic operations. Then, we make further efforts to show the performance of our signature scheme. We summarize the number of basic operations (addition (ADD), multiplication (MULT), exponentiation with 𝜃 (EXP(𝜃)), etc.).

Table 1 shows the number of operations required for 𝑒𝑀𝑆𝑇₃ scheme and our scheme. The corresponding operations are namely addition (ADD), multiplication (MULT), exponentiation with 𝜃 (EXP(𝜃)), generation of m-bit random R (PRNG) [36], and factorization of 𝛽^′(𝑅)∈𝒵 with respect to a logarithmic signature 𝛽 using the Algorithms 9, 10, and 11 (FACTOR) [34].

Table 1 

Number of basic operations for one encryption/decryption.

Table 2 presents the number of operations required for public key and secret key. The corresponding operations are, namely, addition (ADD) and multiplication (MULT) generation of 𝑚-bit random 𝑅 (PRNG) [36].

Table 2 

Number of basic operations for public key generation.

For example, when 𝑠=26, 𝑣=52, the number of multiplication for secret key 𝛽 is 1792 and the number of generation of 𝑚-bit random 𝑅 is 760; when 𝑠=23, 𝑣=44, the number of multiplication for secret key 𝛽 is 2688 and the number of generation of 𝑚-bit random 𝑅 is 948; when 𝑠=20, 𝑣=58, the number of multiplication for secret key 𝛽 is 4864 and the number of generation of 𝑚-bit random 𝑅 is 712.

Table 3 indicates the performance of the signature scheme. Table 4 indicates parameter size in our schemes. Here, we mainly analyse the number of elements in Suzuki 2-group.

Table 3 

Number of basic operations for digital signature scheme.

Table 4 

Parameter size.

Remark 3. In the community of cryptography based on chaos theory, a lot of efforts were focused on secret key cryptography in early years [5–7]. Recently, Wang et al. [8–14] made progress on building public key agreement protocols by using chaos theory. The corresponding schemes also have high efficiency and strong security. Being different from quantum cryptography, chaotic cryptography, and DNA cryptography, 𝑀𝑆𝑇₃ cryptosystem is a public key cryptosystem of classical cryptography. The hardness of our encryption scheme is based on a type of intractable mathematical problem called group factorization problem. Meanwhile, our encryption scheme and signature scheme are efficient in classical computer.

5.2. A Toy Example

In this subsection, we present a toy example of signing a random element 𝑚∈𝔽_𝑞. In fact, our method is universal in the sense that it can be used to sign documents or realize authentication protocols based on images.

Key Generation Input: a Suzuki 2-group 𝐺=𝐴(𝑚,𝜃) with 𝑚=8, 𝑞=2⁸ and 𝑠=2. Output: public key [𝛼,𝛾,𝑓,𝐻] and private key [𝛽,𝑡₀,𝑡₁,𝑡₂].

In general, let a pair (𝑎,𝑏) denote an element of group 𝐺. For simplicity, we use a binary number of an element 𝑏∈𝔽_𝑞 to present (0,𝑏)∈𝒵 and a binary numbers pair to present (𝑎,𝑏)∈𝐺.

(i) For simplicity, we use a one-way function 𝐻 as the hash function in our scheme. That is, 𝐻: 𝐺×𝐺→𝐺 is given by 𝐻𝑎₁,𝑏₁,𝑎₂,𝑏₂=𝑎^𝑎2₁,𝑏^𝑏2₁. (31) Actually, one can also use standard hash functions like SHA1 and so forth.

(ii) A factorizable logarithmic signature 𝛽=[𝐵₁,𝐵₂]=(𝑏_𝑖,𝑗)=(𝑆(0,𝑏_{(𝑖𝑗)⋅2})) of type (𝑟₁,…,𝑟_𝑠) for 𝒵.

(1) We first construct canonical logarithmic signature [𝐵^∗₁,𝐵^∗₂,𝐵^∗₃] of type (4,8,8) in standard form: 𝐵^∗₁=,,,,𝐵00000000010000001000000011000000_∗2=,,,,,,,,𝐵1100000001001000010100000001100000100000001010001111000011111000_∗3=,,,,,,,.1101000011110001010100101111101101101100011101011010011001111111 (32)

(2) Fuse blocks 𝐵^∗₁, 𝐵^∗₃ to construct the product 𝐵₂=(𝐵^∗₁⋅𝐵^∗₃) and let 𝐵₁=𝐵^∗₂. That is, 𝐵₁, 𝐵₂ is the logarithmic signature of type (𝑟₁,𝑟₂) (𝑟₁=8,𝑟₂=32) 𝐵₁=,,,,,,,,1100000001001000010100000001100000100000001010001111000011111000𝐵₂=,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,.1101000011110001010100101111101101101100011101011010011001111111100100001011000100010010101110110010110000110101111001100011111101010000011100011101001001111011111011001111010100100110111111110001000000110001100100100011101110101100101101010110011010111111 (33)(34)

(i) A random cover 𝛼=[𝐴₁,𝐴₂]=(𝑎_𝑖𝑗)=(𝑆(𝑎_{(𝑖𝑗)⋅1},𝑎_{(𝑖𝑗)⋅2})) of the same type as 𝛽𝐴₁=,,,,,,,,,,,,,,,,𝐴01010101001010000110001000000100101110101111000011111010010111101111100010011110110001110001010001011011111010110001001110101111₂=,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,.01011101001111100011001000001000010010101110001111001100000010111110100110011110100010111011000000111011110110100111010101011101001100010111110000101110001001101101111111001011010000111100011001110111100100111010010010100001111000001100111000000001001011001110110100100010110000000000010001101111100000010010000011000000110110100001101001001010010111001111011100101010100101111110010101001110101110111111101001001100111101001001110000000011101011100000110010101101111110010010100000001101010000100101110101101011 (35)

(ii) Select 𝑡₀,𝑡₁,𝑡₂∈𝐺⧵𝒵: 𝑡₀=,,𝑡1111010011111001₁=,,𝑡0010001001001111₂=11101011,10110000. (36)

(iii) Construct a homomorphism 𝑓: 𝐺→𝒵: 𝑓(𝑎,𝑏)=(0,𝑎).

(iv) Compute 𝛾=(ℎ_𝑖,𝑗), ℎ_𝑖,𝑗=𝑡⁻¹_𝑖−1⋅𝑓(𝑎_𝑖,𝑗)⋅𝑏_𝑖,𝑗⋅𝑡_𝑖=[𝑉₁,𝑉₂], and 𝑖=0,1,2: 𝑉₁=,,,,,,,,,,,,,,,,11010110101011111101011000010000110101101101000011010110110110001101011011100010110101101101010111010110100100011101011011010001𝑉₂=,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,.11001001110111111100100110010001110010010100101011001001011001011100100111010111110010011010110011001001110011111100100101011000110010011111001111001001110011011100100110011111110010011010101011001001000010011100100111000011110010010101010011001001011011001100100111101111110010011110001111001001111011111100100100001001110010010110010011001001111011011100100110000011110010010011101011001001000011001100100110011001110010010011010011001001011010101100100111110010110010010001111011001001001110011100100110110000 (37)(38)

Signature

(i) Choose a message 𝑀=(10011101, 11010101).

(ii) Sample 𝑧=(00000000, 10011010) (∈𝒵) and compute 𝑟=𝑡₀⁻¹⋅𝑧⋅𝑡₂𝑐₂,,𝑐=𝑟=0001111100011011₁()=,.=𝐻𝑀,𝑟0001010101100100 (39)

(iii) Signature 𝜎=(𝑆₁,𝑆₂): 𝑆₁=71∈ℤ_𝑞,𝑆₂=00111011,01010110. (40)

Verification

(i) Compute 𝑌₁=𝛼^′𝑆₁⋅𝑆₂=00010101,01100100. (41)

(ii) Compute 𝛾^′𝑆₁=,,𝑓𝑆0001111100100000₂=,,𝑌0000000000111011₂=𝛾^′𝑆₁⋅𝑓𝑆₂=00011111,00011011. (42)

Since 𝑌₁−𝑐₁=00000000 and 𝑌₂−𝑐₂=00000000, so we can get that 𝐻(𝑀,𝛾^′(𝑆₁)⋅𝑓(𝑆₂))=𝛼^′(𝑆₁)⋅𝑆₂.

Conflict of Interests

The authors declare that there is no conflict of interests regarding the publication of this paper.

Acknowledgments

This work is partially supported by the National Natural Science Foundation of China (NSFC) (nos. 61103198, 61121061, 61370194) and the NSFC A3 Foresight Program (no. 61161140320).