Abstract. The XL (eXtended Linearization) equation-solving algorithm belongs to the same extended family as the advanced Gröbner Bases methods F4/F5. XL and its relatives may be used as direct attacks against multivariate Public-Key Cryptosystems and as final stages for many "algebraic cryptanalysis" used today. We analyze the applicability and performance of XL and its relatives, particularly for generic systems of equations over medium-sized finite fields.In examining the extended family of Gröbner Bases and XL from theoretical, empirical and practical viewpoints, we add to the general understanding of equation-solving. Moreover, we give rigorous conditions for the successful termination of XL, Gröbner Bases methods and relatives. Thus we have a better grasp of how such algebraic attacks should be applied. We also compute revised security estimates for multivariate cryptosystems. For example, the schemes SFLASH v2 and HFE Challenge 2 are shown to be unbroken by XL variants.

T. Moh invented the cryptosystem, Tame Transformation Method, abbreviated as TTM. Its encryption and decryption are very fast due to the general properties of tame automorphisms and small finite fields. The success of the system relies on the construction of the Q 8 -module. We give a systematic way to construct a Q m -module where m ¼ 2 k . This not only enhances the complexity and the security of TTM, but also makes TTM more accessible. Further discussion and generalization of this method are also given.