QUARTZ, 128-Bit Long Digital Signatures
  • Jacques Patarin
  • Nicolas Courtois
  • Louis Goubin
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 2020)


For some applications of digital signatures the traditional schemes as RSA, DSA or Elliptic Curve schemes, give signature size that are not short enough (with security 280, the minimal length of these signatures is always ≥ 320 bits, and even ≥ 1024 bits for RSA). In this paper we present a first well defined algorithm and signature scheme, with concrete parameter choice, that gives 128-bit signatures while the best known attack to forge a signature is in 280. It is based on the basic HFE scheme proposed on Eurocrypt 1996 along with several modifications, such that each of them gives a scheme that is (quite clearly) strictly more secure. The basic HFE has been attacked recently by Shamir and Kipnis (cf [3]) and independently by Courtois (cf this RSA conference) and both these authors give subexponential algorithms that will be impractical for our parameter choices. Moreover our scheme is a modification of HFE for which there is no known attack other that inversion methods close to exhaustive search in practice. Similarly there is no method known, even in theory to distinguish the public key from a random quadratic multivariate function.

QUARTZ is so far the only candidate for a practical signature scheme with length of 128-bits.

QUARTZ has been accepted as a submission to NESSIE (New European Schemes for Signatures, Integrity, and Encryption), a project within the Information Societies Technology (IST) Programme of the European Commission.


Digital Signature Signature Scheme Knapsack Problem Short Signature Information Society Technology 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    N. Courtois, A. Shamir, J. Patarin, A. Klimov, Eficient Algorithms for solving Overdefined Systems of Multivariate Polynomial Equations, in Advances in Cryptology, Proceedings of EUROCRYPT’2000, LNCS no 1807, Springer, 2000, pp. 392–407. 1 On a Pentium III 500 MHz. This part can be improved: the given software was not optimized. 2 This part can be improved: the given software was not optimized.Google Scholar
  2. 2.
    E. Kaltofen, V. Shoup, Fast polynomial factorization over high algebraic extensions of finite fields, in Proceedings of the 1997 International Symposium on Symbolic and Algebraic Computation, 1997.Google Scholar
  3. 3.
    A. Kipnis, A. Shamir, Cryptanalysis of the HFE public key cryptosystem, in Advances in Cryptology, Proceedings of Crypto’99, LNCS n˚ 1666, Springer, 1999, pp. 19–30.Google Scholar
  4. 4.
    J. Patarin, Hidden Fields Equations (HFE) and Isomorphisms of Polynomials (IP): two new families of asymmetric algorithms, in Advances in Cryptology, Proceedings of EUROCRYPT’96, LNCS no 1070, Springer Verlag, 1996, pp. 33–48.Google Scholar
  5. 5.
    A. Kipnis, J. Patarin and L. Goubin, Unbalanced Oil and Vinegar Signature Schemes, in Advances in Cryptology, Proceedings of EUROCRYPT’99, LNCS no 1592, Springer, 1999, pp. 206–222.Google Scholar
  6. 6.
    The HFE cryptosystem web page:

Copyright information

© Springer-Verlag Berlin Heidelberg 2001

Authors and Affiliations

  • Jacques Patarin
    • 1
  • Nicolas Courtois
    • 1
  • Louis Goubin
    • 1
  1. 1.Bull CP8LouveciennesFrance

Personalised recommendations