Hidden Fields Equations (HFE), also known as HFE trapdoor function, is a public key cryptosystem which was introduced at Eurocrypt in 1996 and proposed by (in French) Jacques Patarin following the idea of the Matsumoto and Imai system. It is based on polynomials over finite fields F q {\displaystyle \mathbb {F} _{q}} of different size to disguise the relationship between the private key and public key. HFE is in fact a family which consists of basic HFE and combinatorial versions of HFE. The HFE family of cryptosystems is based on the hardness of the problem of finding solutions to a system of multivariate quadratic equations (the so-called MQ problem) since it uses private affine transformations to hide the extension field and the private polynomials. Hidden Field Equations also have been used to construct digital signature schemes, e.g. Quartz and Sflash.
Mathematical background One of the central notions to understand how Hidden Field Equations work is to see that for two extension fields F q n {\displaystyle \mathbb {F} _{q^{n}}} F q m {\displaystyle \mathbb {F} _{q^{m}}} over the same base field F q {\displaystyle \mathbb {F} _{q}} one can interpret a system of m {\displaystyle m} multivariate polynomials in n {\displaystyle n} variables over F q {\displaystyle \mathbb {F} _{q}} as a function F q n → F q m {\displaystyle \mathbb {F} _{q^{n}}\to \mathbb {F} _{q^{m}}} by using a suitable basis of F q n {\displaystyle \mathbb {F} _{q^{n}}} over F q {\displaystyle \mathbb {F} _{q}} . In almost all applications the polynomials are quadratic, i.e. they have degree 2. We start with the simplest kind of polynomials, namely monomials, and show how they lead to quadratic systems of equations. Consider a finite field F q {\displaystyle \mathbb {F} _{q}} , where q {\displaystyle q} is a power of 2, and an extension field K {\displaystyle K} of degree n. Let 0 < h < q n {\displaystyle 0<h<q^{n}} such that h = q θ + 1 {\displaystyle h=q^{\theta }+1} for some θ {\displaystyle \theta } and gcd ( h , q n − 1 ) = 1 {\displaystyle (h,q^{n}-1)=1} . The condition gcd ( h , q n − 1 ) = 1 {\displaystyle (h,q^{n}-1)=1} is equivalent to requiring that the map u → u h {\displaystyle u\to u^{h}} on K {\displaystyle K} is one to one and its inverse is the map u → u h ′ {\displaystyle u\to u^{h'}} where h ′ {\displaystyle h'} is the multiplicative inverse of h mod q n − 1 {\displaystyle h\ {\bmod {q}}^{n}-1} . Take a random element u ∈ F q n {\displaystyle u\in \mathbb {F} _{q^{n}}} . Define w ∈ F q n {\displaystyle w\in \mathbb {F} _{q^{n}}} by
w = u h = u q θ u ( 1 ) {\displaystyle w=u^{h}=u^{q^{\theta }}u\ \ \ \ (1)}
… excerpt ends here. Continue reading the full article.
