A Study of the Security of Unbalanced Oil and Vinegar Signature Schemes

  • An Braeken
  • Christopher Wolf
  • Bart Preneel
Part of the Lecture Notes in Computer Science book series (LNCS, volume 3376)


The Unbalanced Oil and Vinegar scheme (UOV) is a signature scheme based on multivariate quadratic equations. It uses m equations and n variables. A total of v of these are called “vinegar variables”. In this paper, we study its security from several points of view. First, we are able to demonstrate that the constant part of the affine transformation does not contribute to the security of UOV and should therefore be omitted. Second, we show that the case n ≥ 2m is particularly vulnerable to Gröbner basis attacks. This is a new result for UOV over fields of odd characteristic. In addition, we investigate a modification proposed by the authors of UOV, namely to chose coefficients from a small subfield. This leads to a smaller public key. But due to the smaller key-space, this modification is insecure and should therefore be avoided. Finally, we demonstrate a new attack which works well for the case of small v. It extends the affine approximation attack from Youssef and Gong against the Imai-Matsumoto Scheme B for odd characteristic and applies it against UOV. This way, we point out serious vulnerabilities in UOV which have to be taken into account when constructing signature schemes based on UOV.


Signature Scheme Basis Attack Birthday Paradox Hide Field Equation Multivariate Quadratic Equation 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Computational Algebra Group, University of Sydney. The MAGMA Computational Algebra System for Algebra, Number Theory and Geometry,
  2. 2.
    Courtois, N., Goubin, L., Meier, W., Tacier, J.-D.: Solving underdefined systems of multivariate quadratic equations. In: Naccache, D., Paillier, P. (eds.) PKC 2002. LNCS, vol. 2274, pp. 211–227. Springer, Heidelberg (2002)CrossRefGoogle Scholar
  3. 3.
    Courtois, N., Goubin, L., Patarin, J.: Quartz: Primitive specification (second revised version) v21- b. zip, 18 pages (October 2001),
  4. 4.
    Courtois, N., Goubin, L., Patarin, J.: SFlashv3, a fast asymmetric signature scheme – Revised Specificatoin of SFlash, version 3.0, 14 pages (October 17, 2003), ePrint Report 2003/211,
  5. 5.
    Courtois, N.T., Daum, M., Felke, P.: On the security of HFE, HFEv- and Quartz. In: Desmedt, Y.G. (ed.) PKC 2003. LNCS, vol. 2567, pp. 337–350. Springer, Heidelberg (2002), CrossRefGoogle Scholar
  6. 6.
    Faugère, J.-C.: A new efficient algorithm for computing Gröbner bases (F 4). Journal of Pure and Applied Algebra 139, 61–88 (1999)zbMATHCrossRefMathSciNetGoogle Scholar
  7. 7.
    Faugère, J.-C.: A new efficient algorithm for computing Gröbner bases without reduction to zero (F 5). In: International Symposium on Symbolic and Algebraic Computation – ISSAC 2002, July 2002, pp. 75–83. ACM Press, New York (2002)CrossRefGoogle Scholar
  8. 8.
    Faugère, J.-C., Joux, A.: Algebraic cryptanalysis of Hidden Field Equations (HFE) using gröbner bases. In: Boneh, D. (ed.) CRYPTO 2003. LNCS, vol. 2729, pp. 44–60. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  9. 9.
    Garay, M.R., Johnson, D.S.: Computers and Intractability – A Guide to the Theory of NP-Completeness. W.H. Freeman and Company, New York (1979) ISBN 0- 7167-1044-7 or 0-7167-1045-5Google Scholar
  10. 10.
    Goubin, L., Courtois, N.T.: Cryptanalysis of the TTM cryptosystem. In: Okamoto, T. (ed.) ASIACRYPT 2000. LNCS, vol. 1976, pp. 44–57. Springer, Heidelberg (2000)CrossRefGoogle Scholar
  11. 11.
    Kasahara, M., Sakai, R.: A construction of public key cryptosystem for realizing ciphtertext of size 100 bit and digital signature scheme. IEICE Trans. Fundamentals E87-A(1), 102–109 (2004) Electronic version,,1,102
  12. 12.
    Kipnis, A., Patarin, J., Goubin, L.: Unbalanced oil and vinegar signature schemes. In: Stern, J. (ed.) EUROCRYPT 1999. LNCS, vol. 1592, pp. 206–222. Springer, Heidelberg (1999)CrossRefGoogle Scholar
  13. 13.
    Kipnis, A., Patarin, J., Goubin, L.: Unbalanced oil and vinegar signature schemes – extended version, 17 pages (2003) based on [12], citeseer/231623.html (2003- 06-11)Google Scholar
  14. 14.
    Kipnis, A., Shamir, A.: Cryptanalysis of the oil & vinegar signature scheme. In: Krawczyk, H. (ed.) CRYPTO 1998. LNCS, vol. 1462, pp. 257–266. Springer, Heidelberg (1998)Google Scholar
  15. 15.
    Kipnis, A., Shamir, A.: Cryptanalysis of the HFE public key cryptosystem. In: Wiener, M. (ed.) CRYPTO 1999. LNCS, vol. 1666, pp. 19–30. Springer, Heidelberg (1999); or Google Scholar
  16. 16.
    Matsumoto, T., Imai, H.: Algebraic methods for constructing asymmetric cryptosystems. In: Calmet, J. (ed.) AAECC 1985. LNCS, vol. 229, pp. 108–119. Springer, Heidelberg (1986)Google Scholar
  17. 17.
    Matsumoto, T., Imai, H.: Public quadratic polynomial-tuples for efficient signature verification and message-encryption. In: Günther, C.G. (ed.) EUROCRYPT 1988. LNCS, vol. 330, pp. 419–453. Springer, Heidelberg (1988)Google Scholar
  18. 18.
    Menezes, A.J., van Oorschot, P.C., Vanstone, S.A.: Handbook of Applied Cryptography. CRC Press, Boca Raton (1996), ISBN 0-8493-8523-7, online-version,
  19. 19.
    Moh, T.: A public key system with signature and master key function. Communications in Algebra 27(5), 2207–2222 (1999), electronic version at http://citeseer/moh99public.htmlGoogle Scholar
  20. 20.
    Patarin, J.: Cryptanalysis of the matsumoto and imai public key scheme of eurocrypt 1988. In: Coppersmith, D. (ed.) CRYPTO 1995. LNCS, vol. 963, pp. 248–261. Springer, Heidelberg (1995)Google Scholar
  21. 21.
    Patarin, J.: Asymmetric cryptography with a hidden monomial. In: Koblitz, N. (ed.) CRYPTO 1996. LNCS, vol. 1109, pp. 45–60. Springer, Heidelberg (1996)Google Scholar
  22. 22.
    Patarin, J.: Hidden Field Equations (HFE) and Isomorphisms of Polynomials (IP): two new families of asymmetric algorithms. In: Maurer, U.M. (ed.) EUROCRYPT 1996. LNCS, vol. 1070, pp. 33–48. Springer, Heidelberg (1996), CrossRefGoogle Scholar
  23. 23.
    Patarin, J.: The oil and vinegar signature scheme. Presented at the Dagstuhl Workshop on Cryptography (September 1997) (transparencies)Google Scholar
  24. 24.
    Patarin, J., Goubin, L.: Trapdoor one-way permutations and multivariate polynomials. In: Han, Y., Quing, S. (eds.) ICICS 1997. LNCS, vol. 1334, pp. 356–368. Springer, Heidelberg (1997), CrossRefGoogle Scholar
  25. 25.
    Shor, P.W.: Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM Journal on Computing 26(5), 1484–1509 (1997)zbMATHCrossRefMathSciNetGoogle Scholar
  26. 26.
    Toli, I.: Cryptanalysis of HFE, arXiv preprint server, 7 pages (June 2003),
  27. 27.
    Wolf, C., Braeken, A., Preneel, B.: Efficient cryptanalysis of RSE(2)PKC and RSSE(2)PKC. In: Blundo, C., Cimato, S. (eds.) SCN 2004. LNCS, vol. 3352, p. 14. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  28. 28.
    Yang, B.-Y., Chen, J.-M.: Rank attacks and defence in Tame-like multivariate PKC’s. Cryptology ePrint Archive, Report 2004/061, 21 pages (March 23, 2004). Scholar
  29. 29.
    Youssef, A.M., Gong, G.: Cryptanalysis of Imai and Matsumoto scheme B asymmetric cryptosystem. In: Pandu Rangan, C., Ding, C. (eds.) INDOCRYPT 2001. LNCS, vol. 2247, pp. 214–222. Springer, Heidelberg (2001)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2005

Authors and Affiliations

  • An Braeken
    • 1
  • Christopher Wolf
    • 1
  • Bart Preneel
    • 1
  1. 1.K.U.Leuven, ESAT-COSICLeuven-HeverleeBelgium

Personalised recommendations