Improved Asymmetric Cipher Based on Matrix Power Function with Provable Security

Abstract

The improved version of the author’s previously declared asymmetric cipher protocol based on matrix power function (MPF) is presented. Proposed modification avoids discrete logarithm attack (DLA) which could be applied to the previously declared protocol. This attack allows us to transform the initial system of MPF equations to so-called matrix multivariate quadratic (MMQ) system of equations, which is a system representing a subclass of multivariate quadratic (MQ) systems of equations. We are making a conjecture that avoidance of DLA in protocol, presented here, should increase its security, since an attempt to solve the initial system of MPF equations would appear to be no less complex than solving the system of MMQ equations. No algorithms are known to solve such a system of equations. Security parameters and their secure values are defined. Security analysis against chosen plaintext attack (CPA) and chosen ciphertext attack (CCA) is presented. Measures taken to prevent DLA attack increase the security of this protocol with respect to the previously declated protocol.

1. Introduction

In this paper we present the improvement of the matrix power function (MPF) asymmetric cipher published in [1]. The purpose of this improvement is the prevention of discrete logarithm attack (DLA), which allows us to transform the initial system of MPF equations to the matrix multivariate quadratic (MMQ) system of equations. So far, it has not been proved that the MMQ problem is also NP -complete, but nevertheless we are making a conjecture that this problem is hard, since, in general, the corresponding system of MMQ equations is neither underdefined, nor overdefined. It is known that a certain class of underdefined or overdefined systems of MQ equations can be solved in polynomial time.

MPF was previously used to construct cryptographic primitives in [2,3]. Implementation of these primitives in computationally restricted environments was analyzed in [4,5]. The results have shown that suggested protocols can be effectively implemented in Internet of Things (IoT) systems.

Formally, MPF used in our construction can be defined as a function of matrix Q as a parameter and matrices $(X,Y)$ as function arguments parameters denoted by $F_Q(X,Y)$ and expressed by the formula

$$F_Q(X,Y)=E$$

where E is a matrix representing the function value.

In the previous protocol, the entries of matrix Q were chosen in the specially constructed multiplicative group ${\mathit{Z}}_n^{♯}$ of integers with multiplication operation performed modulo n. In this paper we would like discuss some aspects of this structure and present an alternative algebraic structure, which can be used to execute the proposed protocol more efficiently and prevent discrete logarithm attack.

The cryptographic protocols and algorithms constructed on the base of MPF (see [1,2]) belong to the branch of non-commutiative cryptography. The survey of non-commutative cryptography can be found in [6]. Some initial investigation in this field can be found in [7,8,9] where the authors investigated the so-called Sakalauskas, Tvarijonas, Raulynaitis (STR) key agreement protocol published in [3]. Moreover, in [8] it is shown that STR protocol can be effectively realized in microprocessors.

In Section 5 we present a proof of our protocol resistance to chosen plaintext attack (CPA) and chosen ciphertext attack (CCA).

The prevention of DLA attack is also presented in subsequent sections.

2. Our Previous Work

Let us recall some definitions from our previous paper.

We consider a commutative multiplicative semigroup $\mathit{S}$. The multiplicative order of semigroup $\mathit{S}$ is defined as the smallest integer t, such that $a^t=e,\forall a\in \mathit{S}$, where e is a neutral element in $\mathit{S}$. Hence the powers of elements of $\mathit{S}$ can be defined in a commutative numeric ring ${\mathit{Z}}_t$, where addition and multiplication are defined modulo t.

We construct a semigroup of square $m\times m$ matrices with entries defined in semigroup $\mathit{S}$ and denote it by ${\mathit{M}}_{\mathit{S}}$. We call this matrix semigroup a platform semigroup. Analogously we construct a ring of square $m\times m$ matrices ${\mathit{M}}_{\mathit{R}}$ with entries of these matrices defined in numerical ring $R={\mathit{Z}}_t$. This ring is called a power ring.

The matrix power function (MPF) for a fixed parameter matrix $Q\in {\mathit{M}}_{\mathit{S}}$ is a mapping ${\mathit{M}}_{\mathit{R}}\times {\mathit{M}}_{\mathit{R}}\to {\mathit{M}}_{\mathit{S}}$ which is denoted as follows:

$${}^X{Q}^Y=E,$$

(1)

where matrices $X=\{x_{ij}\}$ and $Y=\{y_{ij}\}$ are defined in a power ring ${\mathit{M}}_{\mathit{R}}$ and matrix $Q=\{q_{ij}\}$ is defined in a platform semigroup ${\mathit{M}}_{\mathit{S}}$. The entries of matrix $E=\{e_{ij}\}$ are calculated in a following way:

$$e_{ij}=\prod _{k=1}^m\prod _{l=1}^m{q}_{kl}^{x_{ik}{y}_{lj}}.$$

(2)

To demonstrate further clarity, let us assume that all matrices are the square of second order. The elements are then computed as follows:

$$\left\{\begin{array}{cccccc}{q}_{11}^{x_{11}{y}_{11}}& q_{12}^{x_{11}{y}_{21}}& q_{21}^{x_{12}{y}_{11}}& q_{22}^{x_{12}{y}_{21}}& =& e_{11}\\ q_{11}^{x_{11}{y}_{12}}& q_{12}^{x_{11}{y}_{22}}& q_{21}^{x_{12}{y}_{12}}& q_{22}^{x_{12}{y}_{22}}& =& e_{12}\\ q_{11}^{x_{21}{y}_{11}}& q_{12}^{x_{21}{y}_{21}}& q_{21}^{x_{22}{y}_{11}}& q_{22}^{x_{22}{y}_{21}}& =& e_{21}\\ q_{11}^{x_{21}{y}_{12}}& q_{12}^{x_{21}{y}_{22}}& q_{21}^{x_{22}{y}_{12}}& q_{22}^{x_{22}{y}_{22}}& =& e_{22}\end{array}\right.$$

We will refer to matrices X and Y as matrix powers or power matrices, Q as a base matrix and E as a matrix power value. Recall from our previous paper, that under chosen algebraic structures the following properties hold for MPF:

$${\left({}^{X}Q\right)}^Y={}^X\left(Q^Y\right)={}^X{Q}^Y$$

(3)

$${}^X{\left({}^U{Q}^V\right)}^Y={}^{\left(XU\right)}{Q}^{\left(VY\right)}={}^{XU}{Q}^{VY}$$

(4)

To define a platform semigroup we previously considered a multiplicative semigroup ${\mathit{Z}}_n$ = $\{0,1,\dots ,n-1\}$, where $n=pq$ is a composite integer and p, q are distinct odd primes with $p>q$. We defined an ideal of this semigroup $I{d}_q({\mathit{Z}}_n)=\{j=i·q;i=1,...,p-1\}$ and used it to construct a new multiplicative semigroup ${\mathit{Z}}_n^{♯}$ in a following way:

$${\mathit{Z}}_n^{♯}={\mathit{Z}}_n^{*}\cup I{d}_q({\mathit{Z}}_n),$$

(5)

where ${\mathit{Z}}_n^{*}$ is a multiplicative group consisting of elements coprime with n. It is well-known, that the multiplicative order of elements of ${\mathit{Z}}_n^{*}$ is determined by Carmichael function $\lambda (n)$. For our goals we suggested to use $n=3p$, since in this case $\lambda (n)=p-1$ and hence

$$\lambda (n)=|I{d}_q({\mathit{Z}}_n)|,$$

where $|·|$ denotes the cardinality of the set. The latter identity makes it possible to define power ring over ring ${\mathit{Z}}_{\lambda (n)}$.

The protocol suggested in [1] is described below. We name this protocol as Matrix Power Asymmetric Cipher (MPAC) protocol.

3. Previous Asymmetric Cipher Protocol

Alice and Bob agree on the following public data:

• platform semigroup ${\mathit{M}}_{\mathit{S}}$ and power ring ${\mathit{M}}_{\mathit{R}}$;
• the base matrix Q;
• two non-commuting matrices $Z_1$ and $Z_2$.

Alice randomly selects non-singular secret matrix X in ${\mathit{M}}_{\mathit{R}}$ and two sets of coefficients (not necessarily distinct) in numerical ring $\mathit{R}$ to define two polynomials ${\mathit{P}}_{a1}(·)$ and ${\mathit{P}}_{a2}(·)$. To construct her private and public data she performs the following actions:

• computes a secret matrix U as a product of two polynomials of $Z_1$ and $Z_2$ i.e., U = ${\mathit{P}}_{a1}(Z_1)·{\mathit{P}}_{a2}(Z_2)$;
• computes matrices $X{Z}_1{X}^{-1}=A_1,X{Z}_2{X}^{-1}=A_2,{}^X{Q}^U=E$.

Alice keeps her private key $Pr{K}_A$ = $(X,U)$ a secret and publishes her public key $Pu{K}_A=(A_1,A_2,E)$.

Bob takes Alice’s public key $Pu{K}_A$ and performs a following encryption protocol:

• Bob chooses randomly a non-singular matrix Y in ${\mathit{M}}_{\mathit{R}}$;
• He selects two sets of coefficients in numerical ring $\mathit{R}$ to define two polynomials ${\mathit{P}}_{b1}(·)$ and ${\mathit{P}}_{b2}(·)$ and computes a secret matrix V = ${\mathit{P}}_{b1}(Z_1)$·${\mathit{P}}_{b2}(Z_2)$. Then he takes matrices $A_1$ and $A_2$ and computes a matrix ${\mathit{P}}_{b1}(A_1)$·${\mathit{P}}_{b2}(A_2)$ = $XV{X}^{-1}=W$;
• He raises matrix ${}^X{Q}^U$ to the obtained power matrix $W=XV{X}^{-1}$ on the left and obtains ${}^{XV}{Q}^U$ since $WX=XV$;
• He raises the result matrix to the power matrix Y on the right and obtains ${}^{XV}{Q}^{UY}$ = K and converts it to a bit string. One of the possible ways to do this is to write all the elements of matrix K in a string of the form

  $$k_{11}{k}_{12}\dots k_{1m}{k}_{21}{k}_{22}\dots k_{2m}\dots k_{mm}$$

  and convert every $k_{ij}\in \mathit{S}$ into its binary representation. Then bit string of matrix K is a concatenation of all binary representations of $k_{ij}$. The obtained bit string is used as a key to encrypt the message M and compute the ciphertext C;
• Bob computes the ciphertext C = $K\oplus M$, where ⊕ is bitwise sum modulo 2 of all entries of bitstings K and M;
• Bob computes three matrices $(Y^{-1}{Z}_{1}Y=B_1,Y^{-1}{Z}_{2}Y=B_2,{}^V{Q}^Y=F)$ which we denote by encryptor ε and sends it to Alice together with C.

To decrypt Bob’s message Alice does the following:

• Using given matrices $B_1$ and $B_2$ Alice computes ${\mathit{P}}_{a1}(B_1)$·${\mathit{P}}_{a2}(B_2)$ = $Y^{-1}UY$, since U = ${\mathit{P}}_{a1}(Z_1)$·${\mathit{P}}_{a2}(Z_2)$;
• Alice raises matrix ${}^V{Q}^Y$ to the power $Y^{-1}UY$ on the right and then raises the result matrix to the power X on the left and hence obtains a matrix $K={}^{XV}{Q}^{UY}$ and converts it to a bitstring.
• Alice can now decrypt a ciphertext C using encryption key K and relation

  $$M=K\oplus C=K\oplus K\oplus M.$$

Since discrete logarithm can be applied to both sides of Equation (1), it can be transformed to the following matrix equation

$$X({\mathrm{ld}}_{g}Q)Y={\mathrm{ld}}_{g}E.$$

Security of this protocol relies on the following problem:

Definition 1.

The problem of finding matrices X and Y, satisfying the following system of equations

$$\left\{\begin{array}{c}XTY=S\\ X^{-1}AX=C\\ Y^{-1}BY=D\end{array}\right.,$$

(6)

for some known values of T, S, A, B, C, D is called the matrix multivariate quadratic (MMQ) problem.

Note, that in the case of our protocol $T={\mathrm{ld}}_{g}Q$ ,$S={\mathrm{ld}}_{g}E$, $A=Z_1$, $B=A_1$, $C=Z_2$, $D=A_2$.

An example of MPAC protocol is presented in [1]. A minor modification we use in this paper is converting the obtained encryption key K to a bitstring. An example of this transformation is presented below.

Example 1.

Let us assume, that Bob has obtained the following encryption key K

$$K=\left(\begin{array}{ccc}1& 2& 2\\ 1& 14& 14\\ 14& 1& 14\end{array}\right)$$

To convert it to a bitstring we consider the string

$$1,2,2,1,14,14,14,1,14.$$

We convert each element to binary form to obtain a bitsring

$$000100100010000111101110111000011110,$$

where the first four bits represent an element 1, next four bits represent an element 2 and so on.

4. Improvements of the Asymmetric Cipher Protocol

Let the parameter n of multiplicative group ${\mathit{Z}}_n^{*}$ be a composite integer (factors of this number are irrelevant) and let $\lambda (n)$ be of the form $\lambda (n)=pq$ where p is prime and $\gcd (p,q)=1$. According to the Sylow theorem [10] the Sylow subgroup of the prime order p exists in ${\mathit{Z}}_n^{*}$. We denote this subgroup as ${\mathbf{\Gamma }}_{p,n}$. Since, according to the Lagrange theorem, the order of the element γ has to divide p, the only orders possible in group ${\mathbf{\Gamma }}_{p,n}$ are 1 and p. Therefore, every non-identity element γ is the generator of ${\mathbf{\Gamma }}_{p,n}$. We can use this group to ensure the maximum entropy of the entries of the result matrix E. However, it can be shown (see Section 5) that using a cyclic group as the platform makes MPF vulnerable to algebraic cryptanalysis. Consequently we have to construct a structure similar to ${\mathit{Z}}_n^{♯}$.

Let j be an idempotent of semigroup ${\mathit{Z}}_n$. Since the order of the element is a multiplicative function, we can multiply each element of group ${\mathbf{\Gamma }}_{p,n}$ by j to obtain a new cyclic group ${\mathit{J}}_{p,n}=j{\mathbf{\Gamma }}_{p,n}$. The identity of this group is j and the order of every non-identity element is p. We construct a semigroup ${\mathbf{\Gamma }}_{p,n}^{♯}$ as a union of ${\mathbf{\Gamma }}_{p,n}$ and ${\mathit{J}}_{p,n}$ i.e.,

$${\mathbf{\Gamma }}_{p,n}^{♯}={\mathbf{\Gamma }}_{p,n}\cup {\mathit{J}}_{p,n}$$

(7)

We can use this semigroup to avoid direct application of a discrete logarithm function to MPF, since ${\mathit{J}}_{p,n}$ is the ideal of ${\mathbf{\Gamma }}_{p,n}^{♯}$. Note that no additional constraints for parameter n and the entries of Q are needed as compared to ${\mathit{Z}}_n^{♯}$.

The main advantage of ${\mathbf{\Gamma }}_{p,n}^{♯}$ is the prime order of non-idempotent elements. Since the order of ${\mathbf{\Gamma }}_{p,n}^{♯}$ determines the modulo of entries of matrices of power ring ${\mathit{M}}_{\mathit{R}}$ , we obtain a power ring defined over the field ${\mathit{Z}}_p$ . Therefore, conjugation constrains

$$X{Z}_1{X}^{-1}=A_1,X{Z}_2{X}^{-1}=A_2$$

(8)

are defined over the field ${\mathit{Z}}_p$. Furthermore, this semigroup also provides security against chosen cipertext and chosen plaintext attacks (see Section 5) since entries of matrix exponent are uniformly distributed either in ${\mathbf{\Gamma }}_{p,n}$ or in ${\mathit{J}}_{p,n}$ depending on the entries of power matrices.

Note, that the set of solutions of the latter equations depends on the canonical Jordan form of matrices $Z_1$ and $Z_2$ . More precisely we have to consider Jordan blocks of Jordan matrix $J_1$ and $J_2$, which are similar to matrices $Z_1$ and $Z_2$ respectively. It was shown in [1], that if a Jordan matrix J is defined over the field ${\mathit{Z}}_p$ and has the form

$$\left(\begin{array}{cccccc}\mu & 1& 0& ...& 0& 0\\ 0& \mu & 1& ...& 0& 0\\ 0& 0& \mu & ...& 0& 0\\ ...& ...& ...& ...& ...& ...\\ 0& 0& 0& ...& \mu & 1\\ 0& 0& 0& ...& 0& \mu \end{array}\right),$$

i.e., it consists of a single Jordan block of size m with eigenvalue μ, then each equation in (8) has exactly $p^{m-1}(p-1)$ solutions.

To construct ${\mathbf{\Gamma }}_{p,n}^{♯}$ we have to consider finding a suitable value of parameter n; and finding an idempotent j in the semigroup ${\mathit{Z}}_n$.

To find a suitable value of n we can consider all odd square-free integers of the form $n=p_1{p}_2$, where $p_1$ and $p_2$ are primes. It is known from the definition of the Carmichael function $\lambda (·)$, that

$$\lambda (p_1{p}_2)=\mathrm{lcm}(p_1-1,p_2-1).$$

According to Sylow theorem, the multiplicative group ${\mathit{Z}}_n^{*}$ has a Sylow group of the fixed size p, if p divides $\lambda (p_1{p}_2)$ and $p^2$ does not divide $\lambda (p_1{p}_2)$. To satisfy this condition it is enough to find the value of $p_1$ such, that

$$p_1=kp+1,$$

where k is the least possible even number for $p_1$ to be prime. To minimize the value of n we can set $p_2=3$. The idempotent j can be obtained by solving the following system of congruences:

$$\left\{\begin{array}{c}j\equiv 1mod{p}_1\\ j\equiv 0mod3\end{array}\right..$$

The main parameters of the semigroup ${\mathbf{\Gamma }}_{p,n}^{♯}$ are the following:

• Size of the Sylow group ${\mathbf{\Gamma }}_{p,n}$ p;
• Parameter n, which defines the multiplicative semigroup ${\mathit{Z}}_n$;
• The prime factor $p_1$ of the parameter n;
• Generator of the Sylow group ${\mathbf{\Gamma }}_{p,n}$ γ;
• Idempotent $j\in {\mathit{Z}}_n$;

Values of the main parameters of ${\mathbf{\Gamma }}_{p,n}^{♯}$ for a fixed value of p are presented in

Table 1. Values of main parameters of ${\mathbf{\Gamma }}_{p,n}^{♯}$.

p	n	${\mathit{p}}_1$	γ	j
5	33	11	4	12
7	87	29	7	30
13	159	53	10	54
17	309	103	13	207
19	573	191	25	192
23	141	47	4	48
29	177	59	4	60
31	933	311	7	312

.

The newly defined multiplicative semigroup ${\mathbf{\Gamma }}_{p,n}^{♯}$ can be used to define a platform semigroup ${\mathit{M}}_{\mathit{S}}$. MPAC protocol is executed as presented in Section 3.

5. Security Analysis

As it was pointed out above, by preventing DLA application to MPAC protocol [1] we are forcing an adversary to deal with the initial MPF system of Equation (2) to break our protocol. Hence the security of the improved version of the MPAC protocol relies on the complexity of the MPF problem, which is defined in the following way:

Definition 2.

The problem of finding matrix powers X and Y, satisfying Equation (1), when Q and E are given, is called an MPF problem.

In our research we are considering MPF problem with two conjugation constrains, i.e., the following system of matrix equations:

$$\left\{\begin{array}{c}{}^X{Q}^Y=E\\ X^{-1}AX=C\\ Y^{-1}BY=D\end{array}\right.,$$

(9)

where matrices Q and E are in a platform semigroup and matrices $A,B,C,D$ are in a power ring. These matrices are publicly known. The only unknown matrices are X and Y.

The NP-hardness of MPF problem in (9) can be proved using the polynomial-time reduction of of known NP-hard problem to MPF problem. In previuos paper [11] author proved that the so-called multivariate quadratic power problem is NP-complete. The reduction is provided using randomly generated MQ problem, which is NP-complete. Referencing to this result and the fact that MMQ problem is conceptually related to MPF problem the NP-completeness of MPF problem can be proved by proving that MMQ problem is NP-complete. Then reduction from MMQ to MPF problem can be constructed automatically referencing to [11].

Unfortunately, the NP-completeness of MMQ problem remains an open question yet. We are making a conjecture, that the MPF problem is at least no less complex than the MMQ problem. Hence avoidance of transformation of MPF equations in protocol, presented here, should increase its security, since at this time well-known Grobner bases and other algorithms can be applied to try to solve MMQ system of equation and so far we have no knowledge of how to deal with the system of MPF equations. In this case unknowns are also multivariate quadratic monomials, but they are presented in the powers of entries of certain known matrix.

We provide the security considerations by proving that the proposed algorithm is secure against chosen ciphertext attack (CCA) and chosen plaintext attack (CPA). This analysis is performed by considering entropy of entries of matrix exponent E. For this purpose we use generators of some cyclic group $\mathit{G}$. In this case we can estimate the statistical security of MPF using the following known propositions:

Proposition 1.

For any generator g of group $\mathit{G}$ and $\alpha \in {\mathit{Z}}_{\left|\mathit{G}\right|}$ chosen at random, the power term $g^{\alpha }$ has the same distribution in G as α in ${\mathit{Z}}_{\left|\mathit{G}\right|}$ [10].

Proposition 2.

Let $a\in {\mathit{Z}}_{\left|\mathit{G}\right|}$ be an arbitrary element. Choosing at random $b\in {\mathit{Z}}_{\left|\mathit{G}\right|}$ and setting $c=ab$ gives the same distribution for c as choosing random c [10].

We can now formulate the following corollary.

Corollary 1.

For any two generators of group G $g_1$ and $g_2$ and two uniformly chosen elements $\alpha ,\beta \in {\mathit{Z}}_{\left|\mathit{G}\right|}$ the element z, computed by the expression

$$z=g_1^{\alpha }{g}_2^{\beta }$$

is uniformly distributed in $\mathit{G}$.

The latter corallary implies that element z as a function of $\alpha ,\beta$ is strongly universal${}_2$ as defined by authors in [12] (notation of strongly universal function is taken from the same paper), i.e., $g_1^{\alpha }$ and $g_1^{\beta }$ are two independent elements uniformly distributed in $\mathit{G}$. This result can also be generalized for any entry of the matrix exponent E in (1), i.e., each entry of this matrix is a strongly universal function. In [13] this property is defined as a perfect $m^2$-wise decorrelation (as denoted by the author).

The statistical security of MPF in case of $S={\mathit{Z}}_n^{*}$ and $R={\mathit{Z}}_{\lambda (n)}$ is also considered in [14]. The parameter n is selected as a composite number of the form $n=3p$, where $p=2s+1$ and both p and s are prime numbers. The main outcome of that paper is the following proposition:

Proposition 3.

If a base matrix $Q\in {\mathit{M}}_{\mathit{G}}$ implying power matrices $X,Y\in {\mathit{M}}_{\mathit{R}}$ where $R={\mathit{Z}}_{\left|\mathit{G}\right|}$, and if the entries of power matrices are chosen at random with uniform distribution, then the system (9) yields the matrix E which entries are also uniformly distributed.

Note also, that the last step of our protocol is similar to the Vernam cipher. According to [13] this cipher has perfect 1-wise decorrelation. Due to Proposition 3 if matrices X and Y are chosen randomly with uniform distribution of their entries then the key matrix K has perfect $m^2$-wise decorrelation. It was shown in [13], that in this case our cipher is secure against CCA and CPA respectively (Theorem 7).

Corollary 2.

MPAC protocol is CPA and CCA secure.

However, using a cyclic group $\mathit{G}$ to define a platform semigroup does not provide any security against a specific algebraic attack. This so-called discrete logarithm attack (DLA) is based on a ordinary discrete logarithm function, which can be generalized to matrix semigroups. This generalization is performed as follows:

$$\begin{array}{cccc}{\mathrm{ld}}_{g}Q=P,& \mathrm{if}& \forall i,j=1,2,\dots ,m& p_{ij}={\mathrm{ld}}_g{q}_{ij},\end{array}$$

(10)

where ${\mathrm{ld}}_g(·)$ is the discrete logarithm function, g is a generator of a semigroup $\mathit{S}$ and $Q,P$ are square $m\times m$ matrices in ${\mathit{M}}_{\mathit{S}}$. Note, that we do not consider both ordinary and matrix discrete logarithm problems (DLP) as hard, since we will not use a large semigroup S to define the platform semigroup and hence ${\mathrm{ld}}_{g}Q$ can be obtained easily if $\mathit{S}=\mathit{G}$.

The generalized discrete logarithm function can be applied to MPF Equation (1) to obtain

$${\mathrm{ld}}_g\left({}^X{Q}^Y\right)=X·\left({\mathrm{ld}}_{g}Q\right)·Y=XTY={\mathrm{ld}}_{g}E,$$

(11)

where $T={\mathrm{ld}}_{g}Q$.

The way to break the presented asymmetric cipher specification is to solve either system of matrix Equation (9) or an MMQ problem corresponding to an MPF problem with the same conjugation constrains, i.e., the system (6), where all equations are defined in a power ring.

Despite the fact that a MMQ problem is a subclass of well-known multivariate quadratic (MQ) problems, which is NP-complete, the NP-completeness of MMQ problem has thus far not been proved. However, it was shown in [11] that MQ power problem is NP-complete over any semigroup ${\mathit{Z}}_n$.

Note, that choosing $\mathit{S}={\mathit{Z}}_n^{*}$, where $n=pq$ does not provide security against DLA as well, since Chinese Remainder Theorem (CRT) can be used to define the following mapping:

$$\phi :\left(g_p^a;g_q^b\right)\to \left(a;b\right),$$

(12)

where $g_p$ and $g_q$ are generators of multiplicative cyclic groups ${\mathit{Z}}_p^{*}$ and ${\mathit{Z}}_q^{*}$ respectively.

The semigroup ${\mathbf{\Gamma }}_{p,n}^{♯}$ however does not have this flaw, i.e it cannot be split into two multiplicative cyclic groups and therefore the isomorphism φ cannot be used to define the discrete logarithm. To demonstrate this we present the following example:

Example 2.

Let us consider the multiplicative group $Z_{33}^{*}=\{a|gcd(a,33)=1\}$. The isomorphism implied by Chinese reminder theorem is as follows:

$$\phi :{\mathit{Z}}_{33}^{*}\to {\mathit{Z}}_3^{*}\times {\mathit{Z}}_{11}^{*}.$$

Let ${\mathbf{\Gamma }}_{5,33}^{♯}=\{1,3,4,9,12,15,16,25,27,31\}$. Evidently this semigroup has no non-trivial isomorphism, which can be used to split this semigroup into a direct product of two or more separate (semi)groups. Therefore, the discrete logarithm function is not defined in ${\mathbf{\Gamma }}_{5,33}^{♯}$.

However semigroup ${\mathbf{\Gamma }}_{p,n}^{♯}$ has a non-trivial isomorphism

$$\psi :{\mathbf{\Gamma }}_{p,n}\to {\mathit{J}}_{p,n}.$$

The latter isomorphism can be used to perform reduction of the initial MPF problem to an MMQ problem. This can be done by defining a mapping

$${\psi }^{\prime }=\left\{\begin{array}{ccc}a& \mathrm{if}& a\in {\mathbf{\Gamma }}_{p,n}\\ {\psi }^{-1}(a)& \mathrm{if}& {\mathit{J}}_{p,n}\end{array}\right.$$

and using it on each entry of MPF value matrix E in (1), thus transforming it into an MMQ problem

$$X{\psi }^{\prime }(Q)Y={\psi }^{\prime }(E).$$

(13)

However, we found that under the certain conditions, the obtained MMQ problem is not equivalent to the initial MPF problem, i.e., solutions $X^{\prime }$ and $Y^{\prime }$ of Equation (13) do not satisfy the initial Equation (1). This happens if an entry of base matrix Q, which is chosen from an ideal is raised to zeroth power. In this case not all entries of MPF value matrix E are in the ideal ${\mathit{J}}_{p,n}$. To demonstrate this we present an example:

Example 3.

Let us consider the multiplicative semigroup $\mathit{S}={\mathbf{\Gamma }}_{5,33}^{♯}$. Entries of power matrices X and Y have to be selected from ${\mathit{Z}}_5$. Define matrices Q, X and Y in a following way:

$$Q=\left(\begin{array}{ccc}4& 31& 25\\ 16& 4& 9\\ 31& 16& 25\end{array}\right),X=\left(\begin{array}{ccc}2& 3& 4\\ 1& 0& 1\\ 1& 2& 3\end{array}\right),Y=\left(\begin{array}{ccc}3& 1& 2\\ 4& 1& 1\\ 3& 2& 2\end{array}\right)$$

Then MPF value represented by matrix E is the following:

$$E=\left(\begin{array}{ccc}27& 9& 9\\ 4& 1& 25\\ 27& 3& 9\end{array}\right)$$

We can see, that entries of the second row are not contained in the ideal ${\mathit{J}}_{5,33}=\{3,9,12,15,27\}$ and therefore mapping ${\psi }^{\prime }$ is not one-to-one. Therefore the mapping ${\psi }^{\prime }$ cannot be used to reduce MPF problem to MMQ problem in general case and hence multiplicative semigroup ${\mathbf{\Gamma }}_{p,n}^{♯}$ provides efficient security against DLA attack.

6. Discussion

We presented enhanced Matrix Power Asymmetric Cipher (MPAC) protocol regarding previously published prototype suggested in [1].

We have proved that enhanced MPAC is resistant to Chosen Plaintext Attack and Chosen Ciphertext Attack.

The improved security measures were proposed for preventing DLA based on application of logarithm function directly to MPAC equations and consequently avoiding initial MPF equations transformation to MMQ system of equations. Despite the lack of proof that the complexity of randomly generated MMQ system is NP-complete as it is proved for randomly generated MQ system of equations over any field [15], we are making a conjecture that the complexity of MMQ problem is high.

So far we do not know the methods of the solution of systems defined by initial MPF equations, since they are not custom systems of algebraic equations. It is rather a system of power equations, where unknown variables are the powers of certain elements in the semigroup.

By preventing initial MPF transformation to MMQ problem and referencing to these considerations we are making a conjecture that the proposed MPAC is secure against DLA since discrete logarithm functions cannot be defined for algebraic structures introduced in this paper.

It is determined in [16] that MPAC has significant computation efficiency advantage over other algorithms considered in the paper. Since we improved our protocol in this paper, MPAC can be efficiently applied in the IoT.