Attacks on the Birational Permutation Signature Schemes

  • Don Coppersmith
  • Jacques Stern
  • Serge Vaudenay
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 773)


Shamir presents in [3] a family of cryptographic signature schemes based on birational permutations of the integers modulo a large integer N of unknown factorization. These schemes are attractive because of the low computational requirements, both for signature generation and signature verification. However, the two schemes presented in Shamir’s paper are weak. We show here how to break the first scheme, by first reducing it algebraically to the earlier Ong-Schnorr-Shamir signature scheme, and then applying the Pollard solution to that scheme. We then show some attacks on the second scheme. These attacks give ideas which can be applied to schemes in this general family.


Quadratic Form Quadratic Equation Signature Scheme Galois Theory Legitimate User 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


  1. 1.
    H. Ong, C. P. Schnorr, and A. Shamir: A fast signature scheme based on quadratic equations. Proc. 16th ACM Symp. Theory of Computing, pp.208–216; 1984.Google Scholar
  2. 2.
    J. M. Pollard and C. P. Schnorr: An efficient solution of the congruence x 2 + ky 2 = m(mod n). IEEE Trans. Inform. Theory vol IT-33 no 5, pp.702–709; Sept., 1987.CrossRefMathSciNetGoogle Scholar
  3. 3.
    A. Shamir: Efficient signature schemes based on birational permutations. Manuscript March 1993. To appear, Crypto 93.Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 1994

Authors and Affiliations

  • Don Coppersmith
    • 1
  • Jacques Stern
    • 2
  • Serge Vaudenay
    • 2
  1. 1.IBM ResearchT. J. Watson Research CenterYorktown Heights
  2. 2.Laboratoire d’InformatiqueEcole Normale SupérieureParisFrance

Personalised recommendations