A Rank Attack Against Extension Field Cancellation

Abstract

Extension Field Cancellation (EFC) is a multivariate-based primitive for encryption proposed by Szepieniec, Ding and Preneel in 2016. They claim to provide 80 bits of security for all the proposed variants and parameters. In this paper, we develop a rigorous security analysis and show that none of the proposed variants archive the claimed security levels. While the Joux-Vitse algorithm can perform message recovery on the variants EFC (Formula Presented) and EFC in less than (Formula Presented) bit operations, we offer a new key recovery technique based on MinRank that can break the last proposed variant EFC (Formula Presented) with complexity 273. We also introduce a new technique based on a spectral decomposition with respect to a subfield to recover the first half of the isomorphism of polynomials in EFC (Formula Presented), when (Formula Presented). This technique is of independent interest.