Cryptanalysis of MinRank

  • Authors:
  • Jean-Charles Faugère;Françoise Levy-Dit-Vehel;Ludovic Perret

  • Affiliations:
  • SALSA Project INRIA, Centre Paris-Rocquencourt UPMC, Univ Paris 06, LIP6 CNRS, UMR 7606, LIP6, Paris, France 75016;ENSTA, Paris cedex 15, 75739;SALSA Project INRIA, Centre Paris-Rocquencourt UPMC, Univ Paris 06, LIP6 CNRS, UMR 7606, LIP6, Paris, France 75016

  • Venue:
  • CRYPTO 2008 Proceedings of the 28th Annual conference on Cryptology: Advances in Cryptology
  • Year:
  • 2008

Quantified Score

Hi-index 0.00

Visualization

Abstract

In this paper, we investigate the difficulty of one of the most relevant problems in multivariate cryptography --- namely MinRank --- about which no real progress has been reported since [9, 19]. Our starting point is the Kipnis-Shamir attack [19]. We first show new properties of the ideal generated by Kipnis-Shamir's equations. We then propose a new modeling of the problem. Concerning the practical resolution, we adopt a Gröbner basis approach that permitted us to actually solve challenges A and B proposed by Courtois in [8]. Using the multi-homogeneous structure of the algebraic system, we have been able to provide a theoretical complexity bound reflecting the practical behavior of our approach. Namely, when r茂戮驴the dimension of the matrices minus the rank of the target matrix in the MinRank problem is constant, then we have a polynomial time attack $\mathcal{O}\left( \ln\left( q\right) \,n^{3\,r^{\prime2}}\right) $. For the challenge C [8], we obtain a theoretical bound of 266.3operations.