Efficient Algorithms for Solving Overdefined Systems of Multivariate Polynomial Equations

  • Nicolas Courtois
  • Alexander Klimov
  • Jacques Patarin
  • Adi Shamir
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 1807)


The security of many recently proposed cryptosystems is based on the difficulty of solving large systems of quadratic multivariate polynomial equations. This problem is NP-hard over any field. When the number of equations m is the same as the number of unknowns n the best known algorithms are exhaustive search for small fields, and a Gröbner base algorithm for large fields. Gröbner base algorithms have large exponential complexity and cannot solve in practice systems with n ≥ 15. Kipnis and Shamir [9] have recently introduced a new algorithm called “relinearization”. The exact complexity of this algorithm is not known, but for sufficiently overdefined systems it was expected to run in polynomial time.

In this paper we analyze the theoretical and practical aspects of relinearization. We ran a large number of experiments for various values of n and m, and analysed which systems of equations were actually solvable. We show that many of the equations generated by relinearization are linearly dependent, and thus relinearization is less efficient that one could expect. We then develop an improved algorithm called XL which is both simpler and more powerful than relinearization. For all 0 < ε ≤ 1/2, and mεn 2, XL and relinearization are expected to run in polynomial time of approximately \( n^{\mathcal{O}(1/\sqrt \varepsilon )} \). Moreover, we provide strong evidence that relinearization and XL can solve randomly generated systems of polynomial equations in subexponential time when m exceeds n by a number that increases slowly with n.


Quadratic Equation Exhaustive Search Asymptotic Complexity Exact Complexity Multivariate Equation 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


  1. 1.
    Iyad A. Ajwa, Zhuojun Liu, and Paul S. Wang: “Grobner Bases Algorithm”, ICM Technical Reports, February 1995. See
  2. 2.
    Don Coppersmith: “Finding a small root of a univariate modular equation”; Proceedings of Eurocrypt’96, Springer-Verlag, pp.155–165.Google Scholar
  3. 3.
    Nicolas Courtois “The security of HFE”, to be published.Google Scholar
  4. 4.
    Nicolas Courtois: The HFE cryptosystem web page. See
  5. 5.
    Jean-Charles Faugère: “A new efficient algorithm for computing Gröbner bases (F4).” Journal of Pure and Applied Algebra 139 (1999) pp. 61–88. See zbMATHCrossRefMathSciNetGoogle Scholar
  6. 6.
    Jean-Charles Faugère: “Computing Gröbner basis without reduction to 0”, technical report LIP6, in preparation, source: private communication.Google Scholar
  7. 7.
    Rudolf Lidl, Harald Niederreiter: “Finite Fields”; Encyclopedia of Mathematics and its applications, Volume 20, Cambridge University Press.Google Scholar
  8. 8.
    Aviad Kipnis, Jacques Patarin, Louis Goubin: “Unbalanced Oil and Vinegar Signature Schemes”; Eurocrypt 1999, Springer-Verlag, pp. 216–222.Google Scholar
  9. 9.
    Aviad Kipnis, Adi Shamir: “Cryptanalysis of the HFE Public Key Cryptosystem”; Proceedings of Crypto’99, Springer-Verlag.Google Scholar
  10. 10.
    Neal Koblitz: “Algebraic aspects of cryptography”; Springer-Verlag, ACM3, 1998, Chapter 4 “Hidden Monomial Cryptosystems”, pp. 80–102.Google Scholar
  11. 11.
    Jacques Patarin: “Hidden Field Equations (HFE) and Isomorphisms of Polynomials (IP): two new families of Asymmetric Algorithms”; Eurocrypt’96, Springer Verlag, pp. 33–48. An extended up-to-date version can be found at

Copyright information

© Springer-Verlag Berlin Heidelberg 2000

Authors and Affiliations

  • Nicolas Courtois
    • 1
    • 3
  • Alexander Klimov
    • 2
  • Jacques Patarin
    • 3
  • Adi Shamir
    • 4
  1. 1.MS/LIToulon UniversityLa Garde CedexFrance
  2. 2.Dept. of Appl. Math. & CyberneticsMoscow State UniversityMoscowRussia
  3. 3.Bull CP8Louveciennes CedexFrance
  4. 4.Dept. of Applied Math.The Weizmann Institute of ScienceRehovotIsrael

Personalised recommendations