Advances in Cryptology – EUROCRYPT 2005

Volume 3494 of the series Lecture Notes in Computer Science pp 341-353

Differential Cryptanalysis for Multivariate Schemes

  • Pierre-Alain FouqueAffiliated withDépartement d’Informatique, École normale supérieure
  • , Louis GranboulanAffiliated withDépartement d’Informatique, École normale supérieure
  • , Jacques SternAffiliated withDépartement d’Informatique, École normale supérieure


In this paper we propose a novel cryptanalytic method against multivariate schemes, which adapts differential cryptanalysis to this setting. In multivariate quadratic systems, the differential of the public key is a linear map and has invariants such as the dimension of the kernel. Using linear algebra, the study of this invariant can be used to gain information on the secret key. We successfully apply this new method to break the original Matsumoto-Imai cryptosystem using properties of the differential, thus providing an alternative attack against this scheme besides the attack devised by Patarin. Next, we present an attack against a randomised variant of the Matsumoto-Imai cryptosystem, called PMI. This scheme has recently been proposed by Ding, and according to the author, it resists all previously known attacks. We believe that differential cryptanalysis is a general and powerful method that can give additional insight on most multivariate schemes proposed so far.