Solving Underdefined Systems of Multivariate Quadratic Equations

The security of several recent digital signature schemes is based on the difficulty of solving large systems of quadratic multivariate polynomial equations over a finite field F. This problem, sometimes called MQ, is known to be NP-hard. When the number m of equations is equal to the number n of variables, and if n < 15, Grobner base algorithms have been applied to solve MQ. In the overdefined case n ? m, the techniques of relinearization and XL, due to A. Shamir et. al., have shown to be successful for solving MQ. In signature schemes, we usually have n ? m. For example signature schemes Flash and Sflash submitted to Nessie call for primitives or the UOV scheme published at Eurocrypt 1999. Little is known about the security of such underdefined systems.In this paper, three new and different methods are presented for solving underdefined multivariate systems of quadratic equations. As already shown at Eurocrypt 1999, the problem MQ becomes polynomial when n ? m(m+1) for fields F of characteristic 2. We show that for any field, for about n ? 2m/7(m + 1), exponential but quite small in practice, the problem becomes polynomial in n.When n ? m the complexity of all our 3 algorithms tends to qm. However for practical instances of cryptosystems with n ? O(m), we show how to achieve complexities significantly lower than exhaustive search. For example we are able break Unbalanced Oil and Vinegar signature schemes for some "bad" choices of the parameters (but not for the parameters proposed in [4]).