Improving Support-Minors Rank Attacks: Applications to G$$\displaystyle e$$MSS and Rainbow

Abstract

The Support-Minors (SM) method has opened new routes to attack multivariate schemes with rank properties that were previously impossible to exploit, as shown by the recent attacks of [40] and [9] on the Round 3 NIST candidates GeMSS and Rainbow respectively. In this paper, we study this SM approach more in depth and we propose a greatly improved attack on GeMSS based on this Support-Minors method. Even though GeMSS was already affected by [40], our attack affects it even more and makes it completely unfeasible to repair the scheme by simply increasing the size of its parameters or even applying the recent projection technique from [36] whose purpose was to make GeMSS immune to [40]. For instance, our attack on the GeMSS128 parameter set has estimated time complexity 2 72 , and repairing the scheme by applying [36] would result in a signature with slower signing time by an impractical factor of 2 14 . Another contribution is to suggest optimizations that can reduce memory access costs for an XL strategy on a large SM system using the Block-Wiedemann algorithm as subroutine when these costs are a concern. In a memory cost model based on [7], we show that the rectangular MinRank attack from [9] may indeed reduce the security for all Round 3 Rainbow parameter sets below their targeted security strengths, contradicting the lower bound claimed by [41] using the same memory cost model.

Status report on the third round of the NIST Post-Quantum Cryptography Standardization process

“…In contrast, the attack of [109] is polynomial in the number of vinegar variables and is not affected greatly by the number of removed equations. This attack is further improved by the techniques in [264], where it is shown how to implement the much more efficient support minors MinRank approach [144] in the case that the solution is in an extension field.…”

“…The result undermines the basic design principles of HFEv-. Possible modifications to repair the scheme -such as abandoning the vinegar and minus modifiers and increasing the degree of the HFE polynomial to reach the target security level or adding a projection or plus modifier to thwart the new attacks, as suggested in [265] -would both represent too large a change to the original submission and render the performance of the resulting scheme unacceptable, as shown in [264]. Therefore, NIST decided not to advance GeMSS.…”

Status report on the third round of the NIST Post-Quantum Cryptography Standardization process

“…In contrast, the attack of [109] is polynomial in the number of vinegar variables and is not affected greatly by the number of removed equations. This attack is further improved by the techniques in [262], where it is shown how to implement the much more efficient support minors MinRank approach [144] in the case that the solution is in an extension field.…”

“…The result undermines the basic design principles of HFEv-. Possible modifications to repair the scheme -such as abandoning the vinegar and minus modifiers and increasing the degree of the HFE polynomial to reach the target security level or adding a projection or plus modifier to thwart the new attacks, as suggested in [263] -would both represent too large a change to the original submission and render the performance of the resulting scheme unacceptable, as shown in [262]. Therefore, NIST decided not to advance GeMSS.…”

“…Together with the support minors method of solving MinRank instances (see [144]), this new "rectangular MinRank attack" reduced the complexity of the best known attacks on the various Rainbow parameter sets by 20 to 55 bits of security in the gate metric, showing that all of the Rainbow parameter sets fall significantly below their security targets, when memory costs are ignored. Subsequently, an analysis incorporating the significant memory access cost of this attack [262] suggests that all of the Rainbow parameters fail to meet their purported security levels, even when memory costs are taken into account. Finally, a new attack [13] provides a new hybrid combinatorial/algebraic attack and an improvement of the rectangular MinRank attacks that further reduces the security of all parameter sets to the extent that an attack on Rainbow-I has become practical.…”