Multivariate cryptography

History

Tsutomu Matsumoto and Hideki Imai (1988) presented their so-called C* scheme at the Eurocrypt conference. Although C* has been broken by Jacques Patarin (1995), the general principle of Matsumoto and Imai has inspired a generation of improved proposals. In later work, the "Hidden Monomial Cryptosystems" was developed by (in French) Jacques Patarin. It is based on a ground and an extension field. "Hidden Field Equations" (HFE), developed by Patarin in 1996, remains a popular multivariate scheme today [P96]. The security of HFE has been thoroughly investigated, beginning with a direct Gröbner basis attack [FJ03, GJS06], key-recovery attacks (Kipnis & Shamir 1999) [BFP13], and more. The plain version of HFE is considered to be practically broken, in the sense that secure parameters lead to an impractical scheme. However, some simple variants of HFE, such as the minus variant and the vinegar variant allow one to strengthen the basic HFE against all known attacks.

In addition to HFE, Patarin developed other schemes. In 1997 he presented “Balanced Oil & Vinegar” and in 1999 “Unbalanced Oil and Vinegar”, in cooperation with Aviad Kipnis and Louis Goubin (Kipnis, Patarin & Goubin 1999). Four multivariate cryptography signature schemes (GeMMS, LUOV, Rainbow and MQDSS) made their way into the 2nd round of the NIST post-quantum competition: see slide 12 of the report. The Rainbow scheme advanced to round 3 until it was broken in 2022, and none of the others were left by round 4.