Inverting HFE Is Quasipolynomial

Abstract

Abstract. In the last ten years, multivariate cryptography has emerged as a possible alternative to public key cryptosystems based on hard computational problems from number theory. Notably, the HFE scheme [17] appears to combine efficiency and resistance to attacks, as expected from any public key scheme. However, its security is not yet completely understood. On one hand, since the security is related to the hardness of solving quadratic systems of multivariate binary equations, an NP complete problem, there were hopes that the system could be immune to subexponential attacks. On the other hand, several lines of attacks have been explored, based on so-called relinearization techniques [12,5], or on the use of Gröbner basis algorithms [7]. The latter approach was used to break the first HFE Challenge 1 in 96 hours on a 833 MHz Alpha workstation with 4 Gbytes of memory. At a more abstract level, Faugère and Joux discovered an algebraic invariant that explains why the computation finishes earlier than expected. In the present paper, we pursue this line and study the asymptotic behavior of these Gröbner basis based attacks. More precisely, we consider the complexity of the decryption attack which uses Gröbner bases to recover the plaintext and the complexity of a related distinguisher. We show that the decryption attack has a quasipolynomial complexity, where quasipolynomial denotes an subexponential expression much smaller than the classical subexponential expressions encountered in factoring or discrete logarithm computations. The same analysis shows that the related distinguisher has provable quasipolynomial complexity.

SSE Implementation of Multivariate PKCs on Modern x86 CPUs

“…Solving HFE directly is considered to be sub-exponential [22], and a "standard" HFE implementation for 2 80 security works over F 2 103 with degree d = 129. We know of no timings below 100 million cycles on a modern processor like a Core 2.…”

Practical Cryptanalysis of a Public-Key Encryption Scheme Based on New Multivariate Quadratic Assumptions

“…This line of research dates back to the mid eighties with the design of C * [35], later followed by many other proposals, e.g., [44,30,14,41,28,49,50]. While this family of designs is commonly considered to be an interesting alternative to constructions based on number-theoretic problems (in the post-quantum setting), it suffers from a lack of clear security reductions to well-understood problems, leading to a series of attacks, e.g., [29,13,18,24,20,17,19,15].…”

Inverting square systems algebraically is exponential

“…The notions of degree of regularity and semi-regularity in [2] can be generalized to the case when q is odd. However, the asymptotic analysis on which the results of [15] depend, has not yet been generalized to this situation. The work in [11] seemed to suggest that HFE systems over a field of odd characteristic could resist the attack of Gröbner basis algorithms even when D is small.…”

“…A breakthrough in case of general q came in the recent work of Dubois and Gama [12]. They first refined and gave a rigorous mathematical foundation for the arguments in [15]. They then derived a new method to compute the degree of regularity over any field similar to that in [2].…”