Abstract:For Arithmetization-Oriented ciphers and hash functions Gröbner basis attacks are generally considered as the most competitive attack vector. Unfortunately, the complexity of Gröbner basis algorithms is only understood for special cases, and it is needless to say that these cases do not apply to most cryptographic polynomial systems. Therefore, cryptographers have to resort to experiments, extrapolations and hypotheses to assess the security of their designs. One established measure to quantify the complexity of linear algebra-based Gröbner basis algorithms is the so-called solving degree. Caminata \& Gorla revealed that under a certain genericity condition on a polynomial system the solving degree is always upper bounded by the Castelnuovo-Mumford regularity and henceforth by the Macaulay bound, which only takes the degrees and number of variables of the input polynomials into account. In this paper we extend their framework to iterated polynomial systems, the standard polynomial model for symmetric ciphers and hash functions. In particular, we prove solving degree bounds for various attacks on MiMC, Feistel-MiMC, Feistel-MiMC-Hash, Hades and GMiMC. Our bounds fall in line with the hypothesized complexity of Gröbner basis attacks on these designs, and to the best of our knowledge this is the first time that a mathematical proof for these complexities is provided. Moreover, by studying polynomials with degree falls we can prove lower bounds on the Castelnuovo-Mumford regularity for attacks on MiMC, Feistel-MiMC and Feistel-MiMC-Hash provided that only a few solutions of the corresponding iterated polynomial system originate from the base field. Hence, regularity-based solving degree estimations can never surpass a certain threshold, a desirable property for cryptographic polynomial systems.

Inoculating multivariate schemes against differential attacks

Complexity estimates for the F4 attack on the perturbed Matsumoto-Imai cryptosystem

A New Variant of the Matsumoto-Imai Cryptosystem through Perturbation

The Matsumoto-Imai Cryptosystem

Analysis of Multivariate Encryption Schemes: Application to Dob and

Breaking the Symmetry: a Way to Resist the New Differential Attack.

Cryptanalysis of Rational Multivariate Public Key Cryptosystems

Embedded Surface Attack on Multivariate Public Key Cryptosystems from Diophantine Equations.

Dimension of the linearization equations of the matsumoto-imai cryptosystems

High Order Linearization Equation (Hole) Attack On Multivariate Public Key Cryptosystems

Simple Matrix - A Multivariate Public Key Cryptosystem (mpkc) for Encryption

Method Of Attacking A New Diffie-Hellman Like Public-Key Scheme

Multivariable Public Key Cryptosystems

Multivariate Public Key Cryptography

Overview of Cryptanalysis Techniques in Multivariate Public Key Cryptography

On the Equivalent Keys in Multivariate Cryptosystems

Improved Impossible Differential Attacks on Reduced-Round MISTY1.

Solving Degree Bounds For Iterated Polynomial Systems

New Differential-Algebraic Attacks and Reparametrization of Rainbow

Differential Fault Attacks on Privacy Protocols Friendly Symmetric-Key Primitives: RAIN and HERA

Simple Matrix Scheme For Encryption