Cryptanalysis of HFE, multi-HFE and variants for odd and even characteristic

Abstract

We investigate in this paper the security of HFE and Multi-HFE schemes as well as their minus and embedding variants. Multi-HFE is a generalization of the well-known HFE schemes. The idea is to use a multivariate quadratic system-instead of a univariate polynomial in HFE-over an extension field as a private key. According to the authors, this should make the classical direct algebraic (message-recovery) attack proposed by Faugère and Joux on HFE no longer efficient against Multi-HFE. We consider here the hardness of the key-recovery in Multi-HFE and its variants, but also in HFE (both for odd and even characteristic). We first improve and generalize the basic key recovery proposed by Kipnis and Shamir on HFE. To do so, we express this attack as matrix/vector operations. In one hand, this permits to improve the basic Kipnis-Shamir (KS) attack on HFE. On the other hand, this allows to generalize the attack on Multi-HFE. Due to its structure, we prove that a Multi-HFE scheme has much more equivalent keys than a basic HFE. This induces a structural weakness which can be exploited to adapt the KS attack against classical modifiers of multivariate schemes such as minus and embedding. Along the way, we discovered that the KS attack as initially described cannot be applied against HFE in characteristic 2. We have then strongly revised KS in characteristic 2 to make it work. In all cases, the cost of our attacks is related to the complexity of solving MinRank. Thanks to recent complexity results on this problem, we prove that our attack is polynomial in the degree of the extension field for all possible practical settings used in HFE and Multi-HFE. This makes then Multi-HFE less secure than basic HFE for equally-sized keys. As a proof of concept, we have been able to practically break the most conservative proposed parameters of multi-HFE in few days (256 bits security broken in 9 days).

Recursion based parallelization of exact dense linear algebra routines for Gaussian elimination

“…The kernel routines run over small finite fields and are usually lifted over Z, Q or Z[X]. They are used in algebraic cryptanalysis [15,3], computational number theory [27], or integer linear programming [18] and they benefit from the experience in numerical linear algebra. In particular, a key point there is to embed the finite field elements in integers stored as floating point numbers, and then rely on the efficiency of the floating point matrix multiplication dgemm of the BLAS.…”

A Polynomial-Time Key-Recovery Attack on MQQ Cryptosystems

“…We have implemented our attack in practice and verified that this assumption is reasonable. We highlight that our theoretical results work in characteristic 2 which is known to be the most difficult case to address in theory [17,18,19] for MinRank attacks. Also, we emphasize that our attack works without any restriction on the number of polynomials removed from the public-key (the minus modifier).…”

“…In particular, one of the most important characteristic of MQ schemes that allows a successful key-recovery is connected to unexpected high rank defect on the matrices associated to the public-key. The attacks on TTM [12], STS [13,14], Rainbow [15], HFE and MultiHFE [16,17,18,19] are all in essence based on the problem of finding a low rank linear combination of matrices, known as MinRank in cryptography [20]. This problem is NP-hard [20] and was used to design a zero-knowledge authentication scheme [21].…”

New Candidates for Multivariate Trapdoor Functions

“…For characteristic 2, HFE is vulnerable to the direct algebraic attack [10]. Recently, some authors improved the KS attack and were able to break certain HFE systems, over both odd and even characteristic [2].…”

“…One of the latest, Multi-HFE [11], proposes to use as core map a system of multivariate polynomials over K, instead of a single HFE polynomial. This cryptosystem was broken by means of a generalization of the Kipnis-Shamir MinRank attack [2].…”