Cryptanalysis of the extension field cancellation cryptosystem

Abstract

In this article, we present algebraic attacks against the Extension Field Cancellation ($\texttt {EFC}$) scheme, a multivariate public-key encryption scheme which was published at PQCRYPTO’2016. First, we present a successful Gröbner basis message-recovery attack on the first and second proposed parameters of the scheme. For the first challenge parameter, a Gröbner-based hybrid attack has a $2^{65}$ bit complexity which beats the claimed 80 bit security level. We further show that the algebraic system arising from an $\texttt {EFC}$ public-key is much easier to solve than a random system of the same size. Briefly, this is due to the apparition of many lower degree equations during the Gröbner basis computation. We present a polynomial-time method to recover such lower-degree relations and also show their usefulness in improving the Gröbner basis attack complexity on $\texttt {EFC}$. Thus, we show that there is an algebraic structural weakness in the system of equations coming from $\texttt {EFC}$ and hence makes the scheme not suitable for encryption.

Appendices

Appendix A: Toy example to compute the matrix $\alpha _m({\mathbf {x}})$

Let us consider the case of ${\mathbb {F}}_2$, with $n=3$. Let us represent a polynomial ring over ${\mathbb {F}}_2$ as ${\mathbb {F}}_2[x_1,x_2,x_3]$ over the variables ${\mathbf {x}}=(x_1,x_2,x_3)$. So the extension field is defined by ${\mathbb {F}}_{2^3}$. Let $\omega$ be algebraic over ${\mathbb {F}}_2$. Thus we can define $\kappa = z^3 + z+1$ as the irreducible polynomial of $\omega$ over ${\mathbb {F}}_2$. Now consider that the matrix $A{\mathbf {x}}$ gives a column vector of three polynomials, say $g_1,g_2,g_3 \in {\mathbb {F}}_2[{\mathbf {x}}]$. Hence

$$\begin{aligned} \varphi (A{\mathbf {x}}) = g_1 + \omega \cdot g_2 + \omega ^2 \cdot g_3 \in {\mathbb {F}}_{2^3}[{\mathbf {x}}] \end{aligned}$$

We now show the way to compute $\alpha _m({\mathbf {x}}) \in$. We compute

$$\begin{aligned} \omega \cdot \varphi (A{\mathbf {x}})= & {} g_3 + \omega \cdot (g_1+g_3) + \omega ^2 \cdot g_2\\ \omega ^2 \cdot \varphi (A{\mathbf {x}})= & {} g_2 + \omega \cdot (g_2+g_3) + \omega ^2 \cdot (g_1+g_3) \end{aligned}$$

Hence the matrix that represents multiplication by $\varphi (A{\mathbf {x}})$ with ${\mathbf {x}}$ is given by

$$\begin{aligned} \alpha _m({\mathbf {x}})= \begin{bmatrix} g_1 &{} g_2 &{} g_3 \\ g3 &{} (g_1 + g_3) &{} g_2 \\ g_2 &{} (g_2+g_3) &{} (g_1+g_3) \\ \end{bmatrix} \end{aligned}$$

Table 16 Experimental Degree of regularity observed in Magma $\mathsf {F4}$

Appendix B: List of experimental degree of regularities

In the following table, we provide a table of the degree of regularities that were observed in experiments for varying parameter values of n and a for $\texttt {EFC}_2^-(a)$. The list is partially empty because of many computations were not completed because of lack of memory. We have left those cells blank.