Comparison Between XL and Gröbner Basis Algorithms

Ars, Gwenolé; Faugère, Jean-Charles; Imai, Hideki; Kawazoe, Mitsuru; Sugita, Makoto

doi:10.1007/978-3-540-30539-2_24

Cited by 82 publications

(62 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…According to (2), each element ofṼ can be written as a sum of {x k g } 1≤k, ≤n . Now let AṼ ∈ M n 2 ×n 2 (K) be a matrix associated to the linear transformation Vect {x k g } 1≤k, ≤n →Ṽ .…”

Section: Theorem 5 Let M (D) Be the Set Of Monomials Of Degree D ≥mentioning

confidence: 99%

Cryptanalysis of 2R− Schemes

Faugère

Perret

2006

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. In this paper, we study the security of 2R − schemes [17,18], which are the "minus variant" of two-round schemes. This variant consists in removing some of the n polynomials of the public key, and permits to thwart an attack described at Crypto'99 [25] against two-round schemes. Usually, the "minus variant" leads to a real strengthening of the considered schemes. We show here that this is actually not true for 2R − schemes. We indeed propose an efficient algorithm for decomposing 2R − schemes. For instance, we can remove up to n 2 equations and still be able to recover a decomposition in O(n 12 ). We provide experimental results illustrating the efficiency of our approach. In practice, we have been able to decompose 2R − schemes in less than a handful of hours for most of the challenges proposed by the designers [18]. We believe that this result makes the principle of two-round schemes, including 2R − schemes, useless.

show abstract

Section: Theorem 5 Let M (D) Be the Set Of Monomials Of Degree D ≥mentioning

confidence: 99%

Cryptanalysis of 2R− Schemes

Faugère

Perret

2006

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…Although not fully understood when first introduced, currently there seems to be a much better understanding of the behaviour of the XL algorithm, including its merits and limitations [1,2,3,4,12]. In particular it has been shown that some of the heuristics used in deriving the complexity of the XL algorithm [8] were too optimistic [12].…”

Section: Linearization Methodsmentioning

confidence: 99%

An Analysis of the XSL Algorithm

Cid

Leurent

2005

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. The XSL "algorithm" is a method for solving systems of multivariate polynomial equations based on the linearization method. It was proposed in 2002 as a dedicated method for exploiting the structure of some types of block ciphers, for example the AES and Serpent. Since its proposal, the potential for algebraic attacks against the AES has been the source of much speculation. Although it has attracted a lot of attention from the cryptographic community, currently very little is known about the effectiveness of the XSL algorithm. In this paper we present an analysis of the XSL algorithm, by giving a more concise description of the method and studying it from a more systematic point of view. We present strong evidence that, in its current form, the XSL algorithm does not provide an efficient method for solving the AES system of equations.

show abstract

“…[3] for an overview of the idea. Although it has been shown that techniques from the XL-family are strictly less efficient than from the F-family [40,39,5,17], XL does have its merits as it is easier to adapt to different settings. Hence we have used a specialized version of XL in our solver to improve its efficiency, cf.…”

Section: Related Workmentioning

confidence: 99%

Advanced Algebraic Attack on Trivium

Quedenfeld

Wolf

2016

Mathematical Aspects of Computer and Information Sciences

View full text Add to dashboard Cite

Abstract. This paper presents an algebraic attack against Trivium that breaks 625 rounds using only 4096 bits of output in an overall time complexity of 2 42.2 Trivium computations. While other attacks can do better in terms of rounds (799), this is a practical attack with a very low data usage (down from 2 40 output bits) and low computation time (down from 2 62 ). From another angle, our attack can be seen as a proof of concept: how far can algebraic attacks can be pushed when several known techniques are combined into one implementation? All attacks have been fully implemented and tested; our figures are therefore not the result of any potentially error-prone extrapolation, but results of practical experiments.

show abstract

Comparison Between XL and Gröbner Basis Algorithms

Cited by 82 publications

References 19 publications

Cryptanalysis of 2R− Schemes

Cryptanalysis of 2R− Schemes

An Analysis of the XSL Algorithm

Advanced Algebraic Attack on Trivium

Contact Info

Product

Resources

About