Cryptanalysis of the tractable rational map cryptosystem

Abstract

In this paper, we present the cryptanalysis of a public key scheme based on a system of multivariate polynomial equations, the "tractable rational map" cryptosystem. We show combinatorial weaknesses of the cryptosystem, and introduce a variant of the XL resolution algorithm, the Linear Method, which is able to leverage these weaknesses to invert in short time the trapdoor one-way function defined by the cipher using only the public key, and even rebuild a private key. We also interpret the behavior of the Linear Method on random instances of the scheme, and show that various generalizations of the cipher, as well as an increase of the security parameter, cannot lead to a secure scheme. © International Association for Cryptologic Research 2005.