Cryptanalysis of the matsumoto and imai public key scheme of eurocrypt’88

Abstract

In [1] Matsumoto and Imai have developed a new public key scheme for enciphering or signing. (This scheme is completely different and should not be mistaken with another scheme of Matsumoto and Imai developed in 1983 and broken at Eurocrypt’84). No attacks have been published as yet for this scheme. However we will see in this paper that for almost all the keys almost each cleartext can be found from his ciphertext after only about m 2 n 4 log n computations where m is the degree of the field K chosen, and where mn is the number of bits of the text. Moreover for absolutely all the keys that give a practical size for the messages it will be possible to find almost all the cleartexts from the corresponding ciphertexts after a feasible computation. So the algorithm of [1] is insecure.