Preliminary Cryptanalysis of the Biscuit Signature Scheme
Résumé
Biscuit is a recent multivariate signature scheme based on the MPC-inthe-Head paradigm. It has been submitted to the NIST competition for additional signature schemes. Signatures are derived from a zero-knowledge proof of knowledge of the solution of a structured polynomial system. This extra structure enables efficient proofs and compact signatures. This short note demonstrates that it also makes these polynomial systems easier to solve than random ones. As a consequence, the original parameters of Biscuit failed to meet the required security levels and had to be upgraded.
Origine | Fichiers produits par l'(les) auteur(s) |
---|