Computational cryptography › Multivariate
Hardness assumption

Multivariate quadratic (MQ)

In plain words

Solve many quadratic equations with many unknowns at once. Hard in general.

The idea: Quadratic equations in many variables, such as x1·x3 + x2 + x4·x5 = 1, and dozens more like it, all at once. Checking a proposed solution is quick. Finding one is hard in general, for quantum computers too. Signatures use it by making the public key such a system: a valid signature is a solution for the message's hash, which only someone with a hidden shortcut can find.

Why it matters: The basis of some quantum-safe signatures.

The details

On the map: solve random quadratic systems

Solve a system of random quadratic equations over a finite field. NP-hard in general and believed hard for quantum computers too.

It gives signatures (UOV, MAYO)[1, 2] with very small signatures but large public keys. It isn't known to give key exchange, which is why the family sits outside the public-key box.

Rests on

If any of these breaks, this breaks too.

If it falls

If this breaks, these break with it.

Everything that falls with it (5 boxes)

References

  1. Aviad Kipnis, Jacques Patarin and Louis Goubin. Unbalanced Oil and Vinegar Signature Schemes. Advances in Cryptology — EUROCRYPT ’99, 1999. doi:10.1007/3-540-48910-x_15
  2. Ward Beullens. MAYO: Practical Post-quantum Signatures from Oil-and-Vinegar Maps. Selected Areas in Cryptography, 2022. doi:10.1007/978-3-030-99277-4_17