CC BY
17
Вестник СПбГУ. Прикладная математика. Информатика... 2022. Т. 18. Вып. 2 UDC 512.552.18+003.26 MSC 16Р10
Structure of a 4-dimensional algebra and generating parameters of the hidden discrete logarithm problem
N. A. Moldovyan, A. A. Moldovyan
St Petersburg Federal Research Center of the Russian Academy of Sciences, 39, 14-ya liniya V. O., St Petersburg, 199178, Russian Federation
For citation: Moldovyan N. A., Moldovyan A. A. Structure of a 4-dimensional algebra and generating parameters of the hidden discrete logarithm problem. Vestnik of Saint Petersburg University. Applied Mathematics. Computer Science. Control Processes, 2022, vol. 18, iss. 2, pp. 209-217. https://doi.org/10.21638/11701/spbul0.2022.202
Structure of a 4-dimensional algebra and generating parameters of the hidden discrete logarithm problem the field GF (p) is studied in connection with using it as algebraic support of the hidden discrete logarithm problem that is an attractive primitive of post-quantum signature schemes. It is shown that each invertible 4-dimensional vector that is not a scalar vector is included in a unique commutative group representing a subset of algebraic elements. Three types of commutative groups are contained in the algebra and formulas for computing the order and the number of groups are derived for each type. The obtained results are used to develop algorithms for generating parameters of digital signature schemes based on computational difficulty of the hidden logarithm problem.
Keywords: digital signature, post-quantum cryptoscheme, hidden logarithm problem, finite non-commutative algebra, associative algebra, cyclic group.
1. Introduction. Currently the development of the public-key digital signature algorithms and protocols that are resistant to attacks with using computations on a quantum computer (quantum attacks) attracts si gnificant attention of the cryptographic community |1|-
Usually the research activity in the area of the post-quantum public-key cryptography-is focused on the development of the public-key cryptoschemes based on the computationally complex problems different from the factoring problem (FP) and the discrete logarithm problem (DLP), since both the FP and the DLP can be solved in polynomial time on a quantum computer [2-4].
Recently it was shown that the hidden discrete logarithm problem (HDLP) defined in finite non-commutative associative algebras (FN A As) set over a ground field GF (p) represents an attactive primitive for designing practical post-quantum signature algorithms [5]. The design criteria of post-quantum resistance for development of the HDLP-based signature schemes are presented in [6]. Different FN A As had been used to set different forms of the HDLP and to develop different types of post-quantum cryptoschemes based on computational difficulty of the HDLP: public key-agreement protocols [7], commutative encryption algorithms [8], and digital signature schemes [5, 9].
However, the rationale for using FNAAs as carriers of HDLP is intuitive and empirical. Namely, it is intuitively assumed that the used algebra contains a sufficiently large number of isomorphic finite commutative groups whose order is equal to the divisor of p2 — 1 or to the divisor of p(p — 1). A limited experimental verification of these assumptions is
© St Petersburg State University, 2022
performed. Thus, the problem of theoretical justification of these assumptions for some fixed FNAÀ chosen as algebraic carrier of the HDLP-based cryptoschemes is open.
In this paper the structure of the 4-dimensional FNAA proposed in [10] for reducing the hardware implementation cost of the HDLP-based signature scheme is studied and formulas for computing the number of different types of commutative groups contained in the algebra and for computing the order of the groups are obtained.
2. The studied 4-dimensional FNAA. Suppose in a finite m-dimensional vector space set over the field GF(p) the vector multiplication of arbitrary two vectors is defined additionally. If the vector multiplication is distributive at the right and at the left rela-
m
A can be represented in two forms: A = (a0, a1,..., am—1) and A = m—1 aiei, where ao,ai,... ,am—1 G GF(p) are called coordinates; e0, e^ ..., em—1 are basis vectors. The vector multiplication operation (o) of two m-dimensional vectors A Mid B is defined with the following formula:
m—1m— 1
A o B = ^^ ^^ aibj(ei o ej),
i=0 j=0
ei o ej
Aet (here A G GF(p) is called structural coefficient) given in the cell at intersection of the i-th row and j-th column of specially composed basis vector multiplication table (BVMT). If the BVMT sets non-commutative vector multiplication possessing property of associativity, then we have a FNAA.
Table from [10] sets a 4-dimensional FNAA proposed as algebraic carrier of the HDLP-based signature scheme suitable for efficient hardware implementation (due to comparatively low computational complexity of the vector multiplication). That FNAA contains the global two-sided unit E = {^—1,A—1,0,0). Vectors A satisfying the condition a0a1 = a2a3 are invertible. Vectors N = (n0,n1,n2,n3) satisfying the condition n0n1 = n2n3 are non-invertible. A non-invertible vector N such that n1 = 0 and ^n0 = — An1 is locally invertible relatively a local two sided unit E"N for which the following formula is derived in [10]:
-,„ i n0 n1 n2 n3
En —
N y yU.no + Ani' yU.no + Ani' yU.no + Ani' /xno + Ani
The vector E"N is unit of some cyclic multiplicative group rN which is generated by the vector N and represents a subset of the set of non-invertible vectors. Supposedly, the considered FNAA contains sufficiently large number of the cyclic groups isomorphic to rN and the latter is used as a hidden group in one of the HDLP-based signature schemes described in [10]. One can easily show that the number of non-invertible vectors contained in the algebra is equal to p3 + p2 — p and the order Q of the non-commutative multiplicative group of the algebra is described by the formula
Q= p(p — 1) (p2 — 1) = p(p — 1)2(p + 1).
3. Commutative subalgebras. A fixed 4-dimensional vector Q = (qo,qi,q2,q3) defines a set of pairwise permutable algebraic elements X such that Q o X = X o Q. Using Table, one can represent the latter vector equation as the following system of four linear equations with unknown coordinates of the vector X = (x0, x\,x2,x3):
Hx0q0 + Ax3q2 - nx0q0 - \x2q3 = 0, \x1q1 + ^X2q3 - Axiqi - ¡ixx^q^ = 0, Axiq2 + \ix,2qo - Ax2qi - \1x0q2 = 0, ¡ixoqz + Ax3qi - iJ,x3qo - Axiq3 = 0.
Consider the case (q2,q3) = (0,0) for which the system (1) reduces to the system of two linear equations:
x2 (mqo - Aqi) = 0, x3 (^qo - Aqi) = 0.
From (1) one can easily see that for the vectors Q satisfying the condition ¡iq0 = Aqi every 4-dimensional vector satisfies this system. Evidently, the said vectors Q compose the set of scalar vectors S = (s^-1, sA-i, 0,0), where s = 0,1,...,p - 1. For the vectors Q = (q0,qi, 0,0) satisfying the condition ¡iq0 = Aqi the solution space of the system (1) is the set $ of p2 vectors X = (i, j, 0,0), where i,j = 0,1,...,p - 1. The latter set contains 2p - 1 non-invertible vectors and (p - 1)2 invertible ones (for invertible vectors i =0 j =0
$ are contained in $, therefore $ represents associative subalgebra that is comutative (see Table). Multiplicative group ^ of this algebra has order Q = (p - 1)2. A minimum generator system of the group ^ includes two vectors of the order w = p - 1, for example (w, 0,0,0^d (0, z, 0,0) where w and z are primitive dements modulo p.
Table. The BVMT defining the considered FNAA (A / 0, p / 0)
о ео ei ег ез
ео /лео 0 0 /лез
ei 0 Aei Лег 0
ei Мег 0 0 /iei
ео 0 Ле3 Ле0 0
Consider the case (q2,q3) = (0,0). In the system (1) the first and second equations coincide. In addition, in the solution space of the first and second equations, the third and fourth equations also coincide. Thus, the solution space of the system (1) coincide with the solution space of the next system of two linear equations:
Ажз q2 — X2q3 = 0, \x\q2 + ¡ЛХ2 qo — Ax2qi — I^x0q2 = 0.
If q2 = 0, then x3 = q3q-1x2 and the solution space of the system (2) is described by the following formula:
Y , \ (■ W2»+ (Agi - ngo) j . q3 Л X = {x0,xi,x2,x3) = \i,---—j , (3)
V Aq2 q2 J
where i,j =0,1, ...,p — 1. If q3 = 0, then x2 = q2q-1x3 and the solution space of the system (2) is described by the formula
X = (i„ X1 x2 х3)=(г №»+(Agi-Wo)j ® . Л (4)
{JsQj Jslj JsJ, JsJJ 16, , J, J J • \-±J
V Aq3 q3 J
Note that for the case q2 =^d q3 = 0 the formulas (3) and (4) define the same set of vectors X that ^e permutable with the vector Q. For certainty, consider the formula (3).
Proposition 1. Arbitrary two vectors X^d X2 from the set (3) are permutable, i. e. Xi o X2 = X2 o X\.
Proof. Suppose Xi = (ii, (vq2ii + (Xq) — nqo) ji) X-1 q-i,ji, q3q-1 ji) and X2 = (i2, {pq2i2 + (Xqi — fj,q0) j2) X-i q-i,j2, q3q-ij2)- Using Table and perfoming direct computation of the values Vi = Xi o X2 and V2 = X2 o Xi we will obtain Vi = V2. □
Suppose E denotes the set of scalar vectors S = sE (s = 0,1,...,p — 1) and $q denotes the set of mutually permutable vectors defined by the formula (3). Arbitrary vector V from the set $q\E defines the set $v including p2 different vectors every of which is permutable with V. Since, due to the Proposition 1, the set $q contains p2
VV
Proposition 2. Arbitrary vector V e $q\E defines the set $v of vectors permutable with V, which coincides with $q, i. e. $v = $q.
V
set of paiwise permutable vectors.
Arbitrary fixed set $ represents a commutative associative subalgebra of the considered 4-dimensional FNAA. Evidently, every scalar S
of pairwise permutable vectors. Other p4 — p non-zero vectors are distributed among n® different sets $ each of which contains p2 — p unique non-scalar vectors, therefore, we have the following formula for the number of the $ subalgebras:
4
P-P 2 , ,
m = -=P +P + 1- (5)
p2 — p
In general case different subalgebras contain finite multiplicative groups of different orders Qr$ and types.
4. Three types of commutative groups. Consider a fixed $q subalgebra for some vector Q that satisfies the non-equalities q2 = 0 and q3 = 0. The order of its multiplicative group is equal to p2 minus the number nN of non-invertible vectors contained in the subalgebra. From the non-invertibility condition x0xi = x2x3 and the formula (3) we have the equation
Xq3j2 — (Xqi — fiqo) ij — nq2i2 = 0. (6)
The number of different pairs (i, j) satisfying the equation (6) gives the value of nN- For
i =0 j =0 i =0 value j, we get
The value of A defines three types of multiplicative group of the commutative subalgebras $: i) A is a quadratic non-residue modulo p; ii) A is a quadratic residue modulo p; iii) A = 0.
Case i): subalgebra $q contains one non-invertible vector (0,0,0,0) and nN = 1-Therefore, all non-zero vectors are ivertible and $q represents the finite field of the order p2. The group r$ ^s cyclic as multiplicative group of a field and Qr<¡> = p2 — 1. A group of such type is denoted as ri.
Case ii): \f~K = i / 0. For every value i = 1,2, ...,p — 1 we have two unique
solutions of the equation (3): j = ^(Aqi - ^qo) (2Aq3)-i ± sj i. Thus, taking into account
zero vector, we have nN = 2p - 1 Mid Qr$ = p2 - (2p - 1) = (p - 1)2. A vector V = (a, b, 0,0) G E defines a subalgebra $v multiplicative group of which has order equal to (p - 1)2 and contains a minimum generator system including two vectors Gi and G2 of the same order equal to p - 1. Suppose the vector W is a generator of a cyclic group r$ of the order p2 - 1. Then the formula F(X) = W— o X o W1 defines p2 - 1 different (in general case) isomorphic maps of the group r$v to different groups Evidently, every
p - 1
Thus, if A is a quadratic residue in GF (p), then the formula (3) defines a $q algebra that contains a multiplicative group generated by a minimum generators system including two p - 1
by a minimum generator system including k elements of the same order is called a group with £;-dimensional cyclicity). A group of the second type is denoted as r2.
Case Hi): \f~K = 0. For every value of i = 0,1, 2,... ,p — 1 we have one unique solutions of the equation (6): j = (Aqi - ¡iq0)(2Aq3)-1 i. Thus, we have nN = p and Qr$ = p2 - p = p(p - 1). For a primitive element a G GF(p) the order of scalar vector S = aE is equal to p - 1. Definitely, the group r$ contains a vector V of the order p. The vector W = V o S is contained in r$ and has order equal to p(p - 1), since the values p and p - 1 are mutually prime. The vectors W1 (i = 1,2,..., p(p - 1)) are pairwise different and each of them is contained in r$, therefore, one can conclude the group is cyclic. A group of the third type is denoted as
5. On the number of groups of the same type. Due to the Proposition 3 one can write the equation
(fin — (#E — 1)) d +(fir2 — (#s — 1)) t + (^Гз — (#E — 1)) u = = p(p — 1) (p2 — 1) — (#E — 1),
where unknown integer values d, ^d u denote number of the groups ri5 r2, and r3, respectively, contained in the considered 4-dimensional FNAA. Substituting the values Qri = p2 - 1, Qr2 = (p - 1)^ Qr3 = p(p - i^d = p in equation (9) one can get
pd +(p - 2)t + (p - 1)u = p3 - p - 1. (10)
The value of the sum d + t + u is the number of different $ subalgebras contained in the FNAA, therefore, due to equality (5) one can write
d + t + u = p2 + p +1. (11)
From (10) and (11) it is easy to obtain the following equalities:
2t + u = (p +1)2, 2d + u = p2 + 1. (12)
uQ defines the $q algebras containing the groups of the r3 type. For a non-invertible vector Q the equality q0qi = q2q3 holds true and the formulas (7) and (8) can be represented in the form
. _ Xqi- l^qo ± (Xqi + Mgo) ■ . _ (Agi + nqof 2A qs l' 4A ■
The case A = 0 corresponds to fulfillment of the condition Xq1 = —iq0.H q0 = q1 = 0, then the system (3) take on the following form:
\x3q2 — Xx2q3 =0,
\ n ^ J
^xoq3 — \xiqs = 0.
Since additional condition (q2,q3) = (0,0) leads to trivial case Q = (0,0,0,0), at least, we have q3 = 0 or q2 = 0 For certainty, consider the case q3 = 0 (the value of q2 is arbitrary). The solution space of the system (13) that sets the $q subalgebra is described by the formula
X = (x0,x1,x2,x3) = (i, y«, ~j,j V A q3
where i,j = 0,1,. ..,p- 1. The non-invertible vectors contained in $q satisfy the condition
2 = Aq2 ,2
M<73
If the value Xq2 (iq3)-1 is a quadratic non-residue, then $q includes only one non-invertible vector, namely, (0,0,0,0) and multiplicative group of the IVtype. If the value
M2 (iq3)-1 is a quadratic residue and i = ±jJXq2 (iq3)-1, then $q includes 2p — 1
non-invertible vectors and multiplicative group of the r2-type. If q3 = 0 and q2 = 0, then includes p non-invertible vectors having the form (0,0,0,j) and multiplicative group of the r3-type (evidently, every of the vectors (0,0,0,j) sets subalgebra $(0,0,0,j) = Similarly, for the case q2 = ^d qs = 0, each of the vectors Q = (0,0,q2,0) defines a fixed $ algebra that includes p non-invertible vectors having the form (0,0,j, 0) and a multiplicative group of the r3-type.
Thus, the case q0 = q1 = 0 gives two different subalgebras each of which contains a group of the r3 type. For the values q0 = 0 and q1 = 0 we have p — 1 different variants of fulfillment of the condition Xq1 = —iq0. Every of ^^e said variants for each value qs G {1, 2,...,p — 1} defines a unique non-invertible vector Q setting a unique $q subalgebra containing a group of the r3-type.
In the case q0 = 0 or q1 = we have (p — 1)2 vectors defining the $q subalgebras containing a group of the r3-type. For the case q0 = 0 and q1 = 0, we have 2(p — 1) additional vectors of the said type. Totally, in the considered FN A A we have (p — 1)2 + 2(p — 1) non-invertible vectors defining the $q subalgebras each of which contains p — 1 vectors of the considered type. Therefore, we have
(p-lf+2(p-l)
u =---=p+ 1. (14)
p — 1
Substituting the value of u in (12) we obtain:
2 ' 2 v ;
6. Discussion. The post-quantum signature schemes with a hidden group can be divided into the following two types: i) algorithms based on the computational difficulty of the HDLP; ii) algorithms based on computational difficulty of solving systems of many quadratic equations with many unknowns [12]. Post-quantum security of second type algorithms is related to the fact that the quantum computer is ineffective to solve systems
of many quadratic equations [13, 14]. Usually the FN A As used as carriers of the algebraic signature algorithms with a hidden group are set over a ground field GF(p) with characteristic p of sufficiently large size z (z = 256 to 512 bits). Besides, the value of p is to be selected so that one can select a hidden cyclic group of sufficiently large prime order. To implement a masking mechanism one should use an algebraic carrier containing sufficiently-large number of cyclic groups of the same order. The larger this number, the more resistant the masking mechanism appears. The derived formulas (14) and (15) clearly show that the number of the commutative groups of every of the types ri5 r2, and r3 is sufficiently-large, therefore the hidden group can be potentially selected in a set of groups of every of these types. However, it seems preferable to select a hidden group from one of the ri and r2 sets, since the number of the r3-type groups is significant!y lower: d/u « t/u « p.
For designing a signature scheme with a cyclic hidden group one can generate a prime p = 2q + 1, where q is also a prime, and compute a vector H of order q as generator of the hidden cyclic group. The vector H can be selected from groups of r^ or r2-types. An alternative possibility of using a cyclic hidden group relate to generating a prime p = 2q -1 with prime q. In the latter rase the generator H of hidden group of order q is to be chosen only from set of the retype groups. Algorithm for generating a vector H of order q is as follows:
• select at random an invertible vector R = E;
p2-i
• compute the vector H = R " ;
• if H = E, then output the vector H. Otherwise go to step 1.
For designing a signature scheme with commutative hidden group possessing 2-di-
mensional cyclicity (see, for example, [6, 12]) the considered 4-dimensional FNAA is to be
set over GF (p) with characteristic p = 2q + 1, where q is a prime. To set a hidden group q2
Hi and H2 of the order q, which generate two different cyclic groups contained in the
same group of the r2-type. Algorithm for generating vectors H^d H2 that represent
q2
• select at random an invertible vector Q = (q0, qi, q2,q3) such that {q2 = 0; q3 = 0}
A
•A
i=1
•j
• using the formula (3), compute the vector X = (x0,xi,x2,x3);
• if x0xi = x2x3, then set the variable i ^ i + 1 and go to step 3. Otherwise compute
p-i
the vector Hi = X " ;
• if Hi = E, then set the variable i ^ i +1 and go to step 3. Otherwise generate a primitive element a G GF(p) and compute the scalar vector S = aE = aA-i, 0,0);
p-i ,
• generate a random integer k < q and compute the vector H2 = S " o H*. Then
Hi H2
Using a r3-type group to set a hidden cyclic group of order p is of potential interest to insure a higher perfomance of the computational procedures of the HDLP-based signature
schemes, since for the values p having the structure p = 2z + c, where value of c is small, the p
Hp
a) select arbitrary three values 0 < q0,qi,q3 < p - 1 and compute the value q2 = - (Aqi - Mq0)2 (4A^q3)-i for which we have A = 0 (see (8));
b) compute the vector H = (q0,q1, q2,q3)p-1;
c) if H = E, then go to step 1. Else output the vector H as a generator of a hidden cyclic group.
7. Conclusion. The results obtained show the studied 4-dimensional FNAA defined by a sparse BVMT over a ground field GF (p) can be represented as a set of commutative subalgebras intersecting in a set of scalar vectors. Three types of subalgebras can be
p2 — 1
(p — 1)2 p( p — 1)
for generating the invertible vectors of the required order, wich are contained in a group of given type, are presented.
References
1. Post-quantum cryptography. 10th International Conference, PQCrypto 2019, Chongqing, China, May 8-10, 2019, Proceedings. Lecture Notes in Computer Science series. Cham, Springer Publ., 2019, vol. 11505, pp. 1-269.
2. Shor P. W. Polynomial-time algorithms for prime factorization and discrete logarithms on quantum computer. SI AM Journal of Computing, 1997, vol. 26, pp. 1484-1509.
3. Jozsa R. Quantum algorithms and the fourier transform. Proc. Roy. Soc. London. Series A, 1998, vol. 454, pp. 323-337.
4. Yan S. Y. Quantum attacks on public-key cryptosystems. Boston, Springer Publ., 2013, 207 p.
5. Moldovyan D. N. New form of the hidden logarithm problem and its algebraic support. Bulletin of Academy of Sciences of Moldova. Mathematics, 2020, no. 2(93), pp. 3-10.
6. Moldovyan N. A., Moldovyan A. A. Candidate for practical post-quantum signature scheme. Vest-nik of Saint Petersburg University. Applied Mathematics. Computer Science. Control Processes, 2020, vol. 16, iss. 4, pp. 455-461. https://doi.org/10.21638/11701/spbul0.2020.410
7. Moldovyan D. N. Post-quantum public key-agreement scheme based on a new form of the hidden logarithm problem. Computer Science Journal of Moldova, 2019, vol. 27, no. 1(79), pp. 56-72.
8. Moldovyan A. A., Moldovyan D. N., Moldovyan N. A. Post-quantum commutative encryption algorithm. Computer Science Journal of Moldova, 2019, vol. 27, no. 3(81), pp. 299-317.
9. Moldovyan D. N. A unified method for setting finite non-commutative associative algebras and their properties. Quasigroups and Related Systems, 2019, vol. 27, no. 2, pp. 293-308.
10. Moldovyan D. N., Moldovyan A. A., Moldovyan N. A. Post-quantum signature schemes for efficient hardware implementation. Microprocessors and Microsystems, 2021, vol. 80, pp. 103487. https://doi.Org/10.1016/j.micpro.2020.103487
11. Moldovyan N. A., Moldovyanu P. A. New primitives for digital signature algorithms. Quasigroups and Related Systems, 2009, vol. 17, no. 2, pp. 271-282.
12. Moldovyan D. N., Moldovyan A. A., Moldovyan N. A. A new concept for designing post-quantum digital signature algorithms on non-commutative algebras. Voprosy kiberbezopasnosti [Cibersecurity questions], 2022, no. 1(47), pp. 18-25. https://doi.org/10.21681/2311-3456-2022-l-18-25
13. Shuaiting Q., Wenbao H., Yifa Li, Luyao J. Construction of extended multivariate public key cryptosystems. international Journal of Network Security, 2016, vol. 18, no. 1, pp. 60-67.
14. Jintai D., Dieter S. Multivariate public key cryptosystems. 2004. https://eprint.iacr.org/2004/350.pdf (accessed: February 24, 2022).
Received: December 22, 2021.
Accepted: May 05, 2022.
Authors' information:
Nikolay A. Moldovyan — Dr. Sci. in Engineering, Professor, Chief Researcher; nmold@mail.ru
Alexandr A. Moldovyan — Dr. Sci. in Engineering, Professor, Chief Researcher; maal305@yandex.ru
Структура одной четырехмерной алгебры и генерация параметров скрытой задачи дискретного логарифмирования
Н. А. Молдовян, А. А. Молдовян
Санкт-Петербургский федеральный исследовательский центр Российской академии наук, Российская Федерация, 199178, Санкт-Петербург, В. О., 14-я линия, 39
Для цитирования: Moldovyan N. A., Moldovyan A. A. Structure of a 4-dïmensïonal algebra and generating parameters of the hidden discrete logarithm problem // Вестник Санкт-Петербургского университета. Прикладная математика. Информатика. Процессы управления. 2022. Т. 18. Вып. 2. С. 209-217. https://doi.org/10.21638/11701/spbul0.2022.202
Строение одной четырехмерной конечной некоммутативной ассоциативной алгебры, заданной над полем GF (p), изучено в плане ее использования в качестве алгебраического носителя скрытой задачи дискретного логарифмирования. Показано, что каждый обратимый вектор, не относящийся к скалярным, включается в единственную коммутативную группу, которая является подмножеством алгебраических элементов. Три типа коммутативных групп содержатся в алгебре, и выведены формулы для вычисления порядка и числа групп каждого типа. Полученные результаты использованы для разработки алгоритмов генерации параметров схем цифровой подписи, основанных на вычислительной трудности скрытой задачи логарифмирования.
Ключевые слова: цифровая подпись, постквантовая криптосхема, скрытая задача логарифмирования, конечная некоммутативная алгебра, ассоциативная алгебра, циклическая группа.
Контактная информация:
Молдовян Николай Андреевич — д-р техн. наук, проф., гл. науч. сотр.; nmold@mail.ru Молдовян Александр Андреевич — д-р техн. наук, проф., гл. науч. сотр.; maal305@yandex.ru
