<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-00776072</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-18T01:35:43+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Cryptanalysis of HFE, Multi-HFE and Variants for Odd and Even Characteristic</title>
            <author role="aut">
              <persName>
                <forename type="first">Luk</forename>
                <surname>Bettale</surname>
              </persName>
              <email type="md5">182c48302c7eef05db8b0651df0dfbdc</email>
              <email type="domain">oberthur.com</email>
              <idno type="idhal" notation="numeric">935334</idno>
              <idno type="halauthorid" notation="string">684396-935334</idno>
              <orgName ref="#struct-301575"/>
              <affiliation ref="#struct-211634"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Jean-Charles</forename>
                <surname>Faugère</surname>
              </persName>
              <email type="md5">424972c8b3e59f15dec87335bdbaf554</email>
              <email type="domain">inria.fr</email>
              <idno type="idhal" notation="string">faugere</idno>
              <idno type="idhal" notation="numeric">19366</idno>
              <idno type="halauthorid" notation="string">2141-19366</idno>
              <idno type="IDREF">https://www.idref.fr/090173449</idno>
              <idno type="RESEARCHERID">http://www.researcherid.com/rid/COI-0285-2022</idno>
              <affiliation ref="#struct-179805"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Ludovic</forename>
                <surname>Perret</surname>
              </persName>
              <email type="md5">d1e76a35cfabf006008b7e9391c5bc7d</email>
              <email type="domain">lip6.fr</email>
              <idno type="idhal" notation="numeric">935330</idno>
              <idno type="halauthorid" notation="string">143637-935330</idno>
              <idno type="RESEARCHERID">http://www.researcherid.com/rid/JPN-3539-2023</idno>
              <idno type="ISNI">http://isni.org/isni/0000000359243421</idno>
              <idno type="VIAF">https://viaf.org/viaf/217378925</idno>
              <idno type="IDREF">https://www.idref.fr/123278864</idno>
              <affiliation ref="#struct-179805"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Ludovic</forename>
                <surname>Perret</surname>
              </persName>
              <email type="md5">d1e76a35cfabf006008b7e9391c5bc7d</email>
              <email type="domain">lip6.fr</email>
            </editor>
            <funder ref="#projeurop-17585"/>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2013-01-15 00:12:37</date>
              <date type="whenModified">2025-02-26 15:24:03</date>
              <date type="whenReleased">2013-01-15 14:04:34</date>
              <date type="whenProduced">2013</date>
              <date type="whenEndEmbargoed">2013-01-15</date>
              <ref type="file" target="https://inria.hal.science/hal-00776072v1/document">
                <date notBefore="2013-01-15"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://inria.hal.science/hal-00776072v1/file/MAYA2-UPMCINRIA-v1-key_recovery_on_HFE_2.0.pdf" id="file-776072-710949">
                <date notBefore="2013-01-15"/>
              </ref>
              <ref type="externalLink" target="http://www-salsa.lip6.fr/%7Ejcf/Papers/DCC2012.pdf"/>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="179615">
                <persName>
                  <forename>Ludovic</forename>
                  <surname>Perret</surname>
                </persName>
                <email type="md5">d1e76a35cfabf006008b7e9391c5bc7d</email>
                <email type="domain">lip6.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-00776072</idno>
            <idno type="halUri">https://inria.hal.science/hal-00776072</idno>
            <idno type="halBibtex">bettale:hal-00776072</idno>
            <idno type="halRefHtml">&lt;i&gt;Designs, Codes and Cryptography&lt;/i&gt;, 2013, 69 (1), pp.1 - 52. &lt;a target="_blank" href="https://dx.doi.org/10.1007/s10623-012-9617-2"&gt;&amp;#x27E8;10.1007/s10623-012-9617-2&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">Designs, Codes and Cryptography, 2013, 69 (1), pp.1 - 52. &amp;#x27E8;10.1007/s10623-012-9617-2&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://about.hal.science/hal-authorisation-v1/">HAL Authorization<ref corresp="#file-776072-710949"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="UPMC" corresp="SORBONNE-UNIVERSITE">Université Pierre et Marie Curie</idno>
            <idno type="stamp" n="CNRS">CNRS - Centre national de la recherche scientifique</idno>
            <idno type="stamp" n="INRIA">INRIA - Institut National de Recherche en Informatique et en Automatique</idno>
            <idno type="stamp" n="INRIA-ROCQ">INRIA Paris - Rocquencourt</idno>
            <idno type="stamp" n="OPENAIRE">OpenAIRE</idno>
            <idno type="stamp" n="INRIA_TEST">INRIA - Institut National de Recherche en Informatique et en Automatique</idno>
            <idno type="stamp" n="TESTALAIN1">TESTALAIN1</idno>
            <idno type="stamp" n="LIP6" corresp="SORBONNE-UNIVERSITE">Laboratoire d'Informatique de Paris 6</idno>
            <idno type="stamp" n="INRIA2">INRIA 2</idno>
            <idno type="stamp" n="UPMC_POLE_1" corresp="UPMC">UPMC Pôle 1</idno>
            <idno type="stamp" n="SORBONNE-UNIVERSITE">Sorbonne Université</idno>
            <idno type="stamp" n="SU-SCIENCES" corresp="SORBONNE-UNIVERSITE">Faculté des Sciences de Sorbonne Université</idno>
            <idno type="stamp" n="SU-TI">Sorbonne Université - Texte Intégral</idno>
            <idno type="stamp" n="ALLIANCE-SU"> Alliance Sorbonne Université</idno>
          </seriesStmt>
          <notesStmt>
            <note type="audience" n="2">International</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Cryptanalysis of HFE, Multi-HFE and Variants for Odd and Even Characteristic</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Luk</forename>
                    <surname>Bettale</surname>
                  </persName>
                  <email type="md5">182c48302c7eef05db8b0651df0dfbdc</email>
                  <email type="domain">oberthur.com</email>
                  <idno type="idhal" notation="numeric">935334</idno>
                  <idno type="halauthorid" notation="string">684396-935334</idno>
                  <orgName ref="#struct-301575"/>
                  <affiliation ref="#struct-211634"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Jean-Charles</forename>
                    <surname>Faugère</surname>
                  </persName>
                  <email type="md5">424972c8b3e59f15dec87335bdbaf554</email>
                  <email type="domain">inria.fr</email>
                  <idno type="idhal" notation="string">faugere</idno>
                  <idno type="idhal" notation="numeric">19366</idno>
                  <idno type="halauthorid" notation="string">2141-19366</idno>
                  <idno type="IDREF">https://www.idref.fr/090173449</idno>
                  <idno type="RESEARCHERID">http://www.researcherid.com/rid/COI-0285-2022</idno>
                  <affiliation ref="#struct-179805"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Ludovic</forename>
                    <surname>Perret</surname>
                  </persName>
                  <email type="md5">d1e76a35cfabf006008b7e9391c5bc7d</email>
                  <email type="domain">lip6.fr</email>
                  <idno type="idhal" notation="numeric">935330</idno>
                  <idno type="halauthorid" notation="string">143637-935330</idno>
                  <idno type="RESEARCHERID">http://www.researcherid.com/rid/JPN-3539-2023</idno>
                  <idno type="ISNI">http://isni.org/isni/0000000359243421</idno>
                  <idno type="VIAF">https://viaf.org/viaf/217378925</idno>
                  <idno type="IDREF">https://www.idref.fr/123278864</idno>
                  <affiliation ref="#struct-179805"/>
                </author>
              </analytic>
              <monogr>
                <idno type="halJournalId" status="VALID">12540</idno>
                <idno type="issn">0925-1022</idno>
                <idno type="eissn">1573-7586</idno>
                <title level="j">Designs, Codes and Cryptography</title>
                <imprint>
                  <publisher>Springer Verlag</publisher>
                  <biblScope unit="volume">69</biblScope>
                  <biblScope unit="issue">1</biblScope>
                  <biblScope unit="pp">1 - 52</biblScope>
                  <date type="datePub">2013</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/s10623-012-9617-2</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="da">Gröbner bases</term>
                <term xml:lang="da">MinRank</term>
                <term xml:lang="da">Hidden field equations</term>
              </keywords>
              <classCode scheme="halDomain" n="info.info-cr">Computer Science [cs]/Cryptography and Security [cs.CR]</classCode>
              <classCode scheme="halTypology" n="ART">Journal articles</classCode>
              <classCode scheme="halOldTypology" n="ART">Journal articles</classCode>
              <classCode scheme="halTreeTypology" n="ART">Journal articles</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>We investigate in this paper the security of HFE and Multi-HFE schemes as well as their minus and em- bedding variants. Multi-HFE is a generalization of the well-known HFE schemes. The idea is to use a multivariate quadratic system - instead of a univariate polynomial in HFE - over an extension field as a private key. According to the authors, this should make the classical direct algebraic (message-recovery) attack proposed by Faugère and Joux on HFE no longer efficient against Multi-HFE. We consider here the hardness of the key-recovery in Multi-HFE and its variants, but also in HFE (both for odd and even characteristic). We first improve and generalize the basic key recovery proposed by Kipnis and Shamir on HFE. To do so, we express this attack as matrix/vector operations. In one hand, this permits to improve the basic Kipnis-Shamir (KS) attack on HFE. On the other hand, this allows to generalize the attack on Multi-HFE. Due to its structure, we prove that a Multi-HFE scheme has much more equivalent keys than a basic HFE. This induces a structural weakness which can be exploited to adapt the KS attack against classical modifiers of multivariate schemes such as minus and embedding. Along the way, we discovered that the KS attack as initially described cannot be applied against HFE in characteristic 2. We have then strongly revised KS in characteristic 2 to make it work. In all cases, the cost of our attacks is related to the complexity of solving MinRank. Thanks to recent complexity results on this problem, we prove that our attack is polynomial in the degree of the extension field for all possible practical settings used in HFE and Multi-HFE. This makes then Multi-HFE less secure than basic HFE for equally-sized keys. As a proof of concept, we have been able to practically break the most conservative proposed parameters of multi-HFE in few days (256 bits security broken in 9 days).</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="laboratory" xml:id="struct-211634" status="INCOMING">
          <orgName>Oberthur Technologies</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
          </desc>
        </org>
        <org type="researchteam" xml:id="struct-179805" status="OLD">
          <idno type="RNSR">201221011R</idno>
          <orgName>Polynomial Systems</orgName>
          <orgName type="acronym">PolSys</orgName>
          <date type="start">2012-01-01</date>
          <date type="end">2015-12-31</date>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.inria.fr/equipes/polsys</ref>
          </desc>
          <listRelation>
            <relation active="#struct-233" type="direct"/>
            <relation active="#struct-93591" type="indirect"/>
            <relation name="UMR7606" active="#struct-441569" type="indirect"/>
            <relation active="#struct-86790" type="direct"/>
            <relation active="#struct-300009" type="indirect"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-233" status="OLD">
          <idno type="RNSR">199712651U</idno>
          <idno type="ROR">https://ror.org/05krcen59</idno>
          <orgName>Laboratoire d'Informatique de Paris 6</orgName>
          <orgName type="acronym">LIP6</orgName>
          <date type="start">1997-01-01</date>
          <date type="end">2017-12-31</date>
          <desc>
            <address>
              <addrLine>4 Place JUSSIEU 75252 PARIS CEDEX 05</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.lip6.fr/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-93591" type="direct"/>
            <relation name="UMR7606" active="#struct-441569" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-93591" status="OLD">
          <idno type="ROR">https://ror.org/02en5vm52</idno>
          <orgName>Université Pierre et Marie Curie - Paris 6</orgName>
          <orgName type="acronym">UPMC</orgName>
          <date type="end">2017-12-31</date>
          <desc>
            <address>
              <addrLine>4 place Jussieu - 75005 Paris</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.upmc.fr/</ref>
          </desc>
        </org>
        <org type="regroupinstitution" xml:id="struct-441569" status="VALID">
          <idno type="IdRef">02636817X</idno>
          <idno type="ISNI">0000000122597504</idno>
          <idno type="ROR">https://ror.org/02feahw73</idno>
          <orgName>Centre National de la Recherche Scientifique</orgName>
          <orgName type="acronym">CNRS</orgName>
          <date type="start">1939-10-19</date>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.cnrs.fr/</ref>
          </desc>
        </org>
        <org type="laboratory" xml:id="struct-86790" status="OLD">
          <orgName>Inria Paris-Rocquencourt</orgName>
          <date type="end">2016-03-30</date>
          <desc>
            <address>
              <addrLine>INRIA Rocquencourt : Domaine de Voluceau, Rocquencourt B.P. 105 78153 le Chesnay Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.inria.fr/centre/paris-rocquencourt</ref>
          </desc>
          <listRelation>
            <relation active="#struct-300009" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-300009" status="VALID">
          <idno type="ROR">https://ror.org/02kvxyf05</idno>
          <orgName>Institut National de Recherche en Informatique et en Automatique</orgName>
          <orgName type="acronym">Inria</orgName>
          <desc>
            <address>
              <addrLine>Domaine de VoluceauRocquencourt - BP 10578153 Le Chesnay Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.inria.fr/en/</ref>
          </desc>
        </org>
      </listOrg>
      <listOrg type="projects">
        <org type="europeanProject" xml:id="projeurop-17585" status="VALID">
          <idno type="number">216676</idno>
          <idno type="program">FP7-ICT-2007-1</idno>
          <idno type="call">FP7-ICT-2007-1</idno>
          <orgName>ECRYPT II</orgName>
          <desc>European Network of Excellence in Cryptology - Phase II</desc>
          <date type="start">2008-01-08</date>
          <date type="end">2013-01-31</date>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>