Why do we use just one affine transformation in Oil and Vinegar (UOV) scheme to hide the structure of the map? Doesn't it cause any security problems, and isn't it better to use two transformations?


1 Answer 1


The public key in Oil-Vinegar was proposed as $F\circ L$, where $L:\Bbb F^n \to \Bbb F^n$ ($n = o + v$) is an invertible linear transformation and $F:\Bbb F^n \to \Bbb F^o$ is an Oil-Vinegar map.

I think you are suggesting that another transformation $T:\Bbb F^o \to \Bbb F^o$ is used at the end of the composition so that the public key becomes $P = T\circ F \circ L$. This is natural (and necessary!) in other similar schemes like Hidden Field Equations (HFE). However, this is not necessary in Oil-Vinegar since $F$ is uniformly random among all Oil-Vinegar maps and the composition of an Oil-Vinegar map with a linear transformation (on the left) yields another Oil-Vinegar map.

To be more precise, if you let your public key be $P = T\circ F \circ L$, then by definining $F' = T\circ F$ your scheme will have the shape $F'\circ L$ where $F'$ is an Oil-Vinegar map, so we can assume without loss of generality (or, without losing security strength) that the transformation $T$ does not exist.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.