Pith. sign in

REVIEW 3 major objections 5 minor 45 references

The complexity of the SupportMinors Modeling for the MinRank Problem

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper proves that, for generic MinRank instances, the SupportMinors modeling's degree-1 and degree-2 equation counts equal the original heuristic estimates.

desk verdict The b=2 complexity estimate is false as stated, but the paper's algebraic core has value and is worth repairing. read the letter →

arxiv 2506.06547 v1 pith:YU2WRCVK submitted 2025-06-06 cs.CR math.AC

Daniel Cabarcas , Giulia Gaggero , Elisa Gorla This is my paper · ORCID
classification cs.CRmath.AC MSC 13D0213P2594A60
keywords MinRankproblemSupportMinorsmodelingsyzygymodulesMacaulaymatrixlinearizationcomplexityestimatesdeterminantalidealsmultivariatecryptography
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The MinRank problem asks for a nonzero linear combination of $K$ given matrices whose rank is at most $r$, and it is the hard problem behind several post-quantum signature and encryption designs. The SupportMinors modeling solves MinRank by writing the condition as a polynomial system and applying linearization through a Macaulay matrix, but its complexity has until now rested on heuristics. This paper proves that, for a generic choice of the input matrices, the number of independent equations generated at degrees $b=1$ and $b=2$ is exactly what the original SupportMinors article predicted. In the special case $r=n-1$ it gives the complete syzygy count in every degree. If the proof is correct, heuristic attack-cost estimates in these regimes become proven upper bounds, which matters for setting security parameters of rank-metric and multivariate schemes.

What carries the argument

The load-bearing object is the syzygy module $U$ of the $(r+1)$-minors of the matrix $D=(Y;C)$, where $Y$ is an $m\times n$ matrix of distinct variables and $C$ is an $r\times n$ matrix of distinct variables; a syzygy is a linear relation among the minors. The paper refines a known generating set for the first syzygies of determinantal ideals to a set $S'$ that generates the degree-$(r+2)$ part of $U$, namely the syzygies involving only the $Y$-variables. The homomorphism $\rho$ specializes $Y$ to the linear-form matrix $M_x=\sum_{\ell=1}^K x_\ell M_\ell$, and the critical step is proving that $\rho(S')$ generates the corresponding syzygy space after specialization. These syzygies are exactly the linear dependencies among the rows of the SupportMinors Macaulay matrix, so counting them controls the rank of that matrix and hence the cost of the linearization.

What would settle it

For $m=3$, $n=5$, $r=2$, $K=9$, Theorem 11 predicts that a generic SupportMinors instance has $240$ linearly independent rows in the degree-$b=2$ Macaulay matrix; computing the actual rank for random matrices over a large finite field would settle the formula. Equivalently, for the same parameters one can compute the grade of the specialized ideal and compare it with the grade of the ideal of $3$-minors of a $5\times 5$ matrix, which is $9$; a smaller specialized grade would show that the specialization step in Theorem 5 fails.

Watch

Extended reading notes

Core claim

The central claim is Theorem 5: for $K \ge m(n-r)$ and a generic choice of $M_1,\ldots,M_K$, the degree-$(r+2)$ syzygies of the specialized SupportMinors system that involve only the $x$-variables are exactly the specializations of the linear syzygies of the generic system that involve only the $y$-variables. As a consequence, Theorem 11 states that the number of linearly independent equations available for linearization is $\min\{m\binom{n}{r+1}, K\binom{n}{r}\}$ for $b=1$, and, when $m\binom{n}{r+1} \le K\binom{n}{r}$, it is $\min\{Km\binom{n}{r+1} - \binom{m+1}{2}\binom{n}{r+2}, \binom{K+1}{2}\binom{n}{r}\}$ for $b=2$. The paper's claim is that these formulas are proven rather than heuristic for generic inputs, and that the submaximal case $r=n-1$ admits a complete syzygy count in every degree.

Load-bearing premise

The argument assumes without proof that, for $K\ge(m-1)(n-r-1)$ and a generic choice of the input matrices, the specialized ideal $\rho(F)$ has the same grade as the original ideal $(F)$; this equality is needed to transfer the syzygy computation through the specialization, and if it fails for some parameter range of cryptographic interest, Theorem 5 and the degree-2 formula in Theorem 11 are not established.

Editorial extensions

If this is right

  • For generic instances, the degree-$b=1$ SupportMinors system has exactly $\min\{m\binom{n}{r+1}, K\binom{n}{r}\}$ independent equations, settling the first-stage complexity whenever this number is below the number of variables.
  • When $m\binom{n}{r+1} \le K\binom{n}{r}$, the degree-$b=2$ independent equation count is $\min\{Km\binom{n}{r+1}-\binom{m+1}{2}\binom{n}{r+2}, \binom{K+1}{2}\binom{n}{r}\}$, making the second-stage complexity estimate provable.
  • Corollary 12 provides explicit parameter inequalities under which the SupportMinors algorithm provably produces a solution in degree $b=1$ or $b=2$, so in those regimes the attack's running time is a proven upper bound rather than a heuristic.
  • For $r=n-1$, the dimension of the syzygy space of the relevant maximal minors is computed in every degree as an alternating sum of binomial products, completing the complexity picture for that case.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension the paper does not pursue is degree $b\ge 3$: the same specialization argument would need control of the higher syzygies of the specialized ideal, and direct rank computations of degree-3 Macaulay matrices for random instances could test whether the original heuristic continues to hold there.
  • The unproved grade equality is checkable for the concrete parameter sets used in rank-metric and multivariate schemes; if it holds there, the $b=2$ formula becomes a certified complexity bound for those specific attacks.
  • If the genericity condition admits enough rational points over the finite fields used in cryptography, the theorem converts the SupportMinors heuristic into a proven upper bound for those fields, which can only lower the estimated attack cost relative to the heuristic and therefore affects security margins.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The manuscript aims to make rigorous the heuristic complexity estimates of the SupportMinors Modeling for the MinRank problem, focusing on the number of linearly independent equations available in degrees b = 1 and b = 2, and on a separate submaximal-minors case. The main technical work studies syzygies of (r+1)-minors of a generic matrix, proves a generation statement for the specialized linear syzygies (Theorem 5), and then uses this to derive the b = 2 dimension formula (Theorem 11). The paper is clearly organized and makes use of substantial commutative algebra, including results of Kurano, Andrade-Simis, and Bruns-Vetter.

Significance. If the main theorems were correct, the paper would make an important contribution by turning heuristic estimates for the SupportMinors attack on MinRank into provable upper bounds in several parameter regimes. The paper is well written and the overall strategy is natural. It also explicitly identifies the algebraic objects that govern the number of independent equations, which is valuable. However, as stated, the central b = 2 estimate is false, and the proof of the theorem on which it relies contains an unproved grade-preservation claim. These issues are load-bearing, so the paper cannot be accepted in its present form. Credit is due for the clear use of external theorems and for the transparent separation of the algebraic and cryptographic steps, but a substantive revision is required.

major comments (3)
  1. [§5 (Theorem 11, b = 2)] The b = 2 formula in Theorem 11 is false as stated. Take m = 1, r = 2, n = 5, K = 1. Then m*C(n, r+1) = 10 and K*C(n, r) = 10, so the stated hypothesis m*C(n, r+1) ≤ K*C(n, r) holds. Let M_x = (a_1 x, ..., a_5 x) with generic a ∈ K^5 and let C be a 2×5 matrix of independent variables. Each ρ(g_J) is equal to x·L_J, where L_J is the corresponding 3-minor of the matrix [a; C] on columns J. The ten rows x·ρ(g_J) span a space of dimension 6: the L_J are the coordinates of the linear map Λ^2 K^5 → Λ^3 K^5, u∧v ↦ a∧u∧v, whose rank is 6. The formula in Theorem 11 gives min{1·1·10 − C(5,4), C(5,2)} = min{5, 10} = 5. Thus the theorem is contradicted by a concrete instance. The proof invokes Theorem 5, which requires K ≥ m(n−r) = 3, but the hypothesis of Theorem 11 only implies K ≥ m(n−r)/(r+1). The missing condition is therefore not a harmless strengthening of the stated hypothesis; it is necessary for the statement to be true.
  2. [§4.1 (Theorem 5)] The proof of Theorem 5 is not complete. The statement of the theorem requires K ≥ m(n−r), but the proof begins with the different condition K ≥ (m−1)(n−r−1) and then asserts, without proof or citation, that grade(ρ(F)) = grade((F)). This grade equality is exactly what is needed to apply [18, Theorem 3.5] to specialize a minimal free resolution of (F) to one of ρ(F), yielding Syz(ρ(F)) = ρ(Syz(F)). Since the rest of the proof, and consequently the b = 2 estimate in Theorem 11, depends on this equality, the authors must either prove the grade-preservation claim under the stated hypotheses or state and prove the theorem under the weaker condition actually used. As it stands, Theorem 5 is not established.
  3. [§5 (proof of Theorem 11)] The step in the proof of Theorem 11 asserting dim(Syz(ρ(G)) ∩ K[x_1,...,x_K]_{r+2}) = C(m+1,2)·C(n,r+2) does not follow from Theorem 5. Theorem 5 only states that ρ(S′) generates this space; it does not assert that the elements of ρ(S′) are linearly independent. In the counterexample of the first major comment, S′ has five elements but the syzygy space has dimension four, so the equality is false in that case. Even after adding a hypothesis such as K ≥ m(n−r), the proof must justify the linear independence or otherwise compute the dimension of the generated space rather than the cardinality of a generating set.
minor comments (5)
  1. [§1] The notation is inconsistent: the problem statements use k for the number of matrices, while the rest of the paper uses K. Please unify the notation.
  2. [§4.2 (Theorem 9)] The hypothesis of Theorem 9, K ≥ m + 1 − (n − 1)n, appears to be a typo: for n ≥ 2 it is almost always vacuous, whereas Corollary 8 requires K ≥ m. Please clarify the intended condition and check whether Theorem 9 should inherit K ≥ m.
  3. [§2] In the paragraph defining Syz(G), the sentence 'Syz(G) denotes the syzygies of F' should say 'of G'. The current wording is confusing.
  4. [Notation 10] The word 'Zarisky-dense' should be 'Zariski-dense'.
  5. [§4.1 (Theorem 5)] The first line of the proof of Theorem 5 uses the condition K ≥ (m−1)(n−r−1), but the theorem statement uses K ≥ m(n−r). This mismatch should be resolved, since a reader cannot tell which condition is actually needed for the subsequent argument.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: Theorem 11's estimates are derived from external commutative algebra results and do not reduce to the heuristics they confirm.

full rationale

The paper's central derivation is not circular. Theorem 11's b=1 count is a direct cardinality count of the SupportMinors equations and Plücker coordinates, not an imported prediction. The b=2 estimate is obtained by counting the dimension of T(2,1) as C(K+1,2)C(n,r) and subtracting the dimension of the x-linear syzygy space, which the paper computes as C(m+1,2)C(n,r+2) via Theorem 5. Theorem 5 itself is proved from Kurano's generator theorem for Syz(F) [35], a Bruns-Vetter specialization argument [18, Theorem 3.5], and Theorem 4's cancellation analysis; none of these assumes the complexity estimate being proved. The generating set S' in Theorem 2 is exactly the syzygy family identified in the prior heuristic paper [11], but the proof of generation is carried out independently from Kurano's external theorem, and linear independence follows from the distinct multidegrees discussed in Section 3. The self-citation to [11] is comparative ('as predicted in [11]') and supplies the algorithm definition and the heuristic being benchmarked; it is not load-bearing evidence for the algebraic claims. The paper contains a genuine support gap that is not circular: the proof of Theorem 5 asserts without proof or citation that grade(ρ(F)) = grade((F)) for K ≥ (m−1)(n−r−1), and the stated hypotheses of Theorem 11 do not include the stronger hypothesis K ≥ m(n−r) that Theorem 5's proof appears to require. A concrete counterexample to Theorem 11 as stated (K=1, m=1, r=2, n=5) has been noted by the reviewer; this indicates a correctness failure or missing hypothesis, not a circular reduction, because the claimed formula is not being inserted as an assumption into its own proof. No fitted parameters are renamed as predictions, and no uniqueness or ansatz is imported from the authors' prior work to force the result.

Assumptions & free parameters 0 free parameters · 6 assumptions · 0 invented entities

The paper does not introduce new free parameters or entities. Its main inputs are standard theorems in commutative algebra plus an unproved grade preservation claim and a genericity assumption on the input matrices.

assumptions (6)
  • standard math Kurano's theorem: the syzygies of the (r+1)-minors of a generic (m+r) x n matrix are generated by the Type I and Type II relations described in [35, Theorem 5.1].
    Used to define the generating set S for Syz(F) in Section 3; this is an external published theorem.
  • standard math Andrade-Simis resolution: the ideal of maximal minors involving a fixed set of n-1 columns of an n x ℓ matrix has a free resolution given by a modification of the Buchsbaum-Rim complex, under grade conditions.
    Theorem 6 is cited and used in Section 4.2 to compute syzygy dimensions in the submaximal case.
  • standard math Bruns-Vetter specialization theorem: under grade preservation, a minimal free resolution of (F) over R specializes to a minimal free resolution of ρ(F) over P.
    Cited as [18, Theorem 3.5] in the proof of Theorem 5.
  • ad hoc to paper Grade preservation under specialization: for K ≥ (m-1)(n-r-1) and generic M1,...,MK, grade(ρ(F)) = grade((F)).
    Stated without proof or citation in the proof of Theorem 5; this is the load-bearing unresolved assumption.
  • domain assumption Genericity of M1,...,MK: the coefficient matrices belong to a Zariski-dense open set in K^{K*m*n} making the grade conditions and the generation statements hold.
    The results are proven for generic instances, not for all instances; cryptographic instances are assumed to fall in this open set.
  • domain assumption Plücker coordinates can be treated as independent variables for the linearization because the equations have degree at most one in them.
    Section 5, paragraph before Notation 10; used to count the ambient dimension T_{(b,1)}.

how reviews work

0 comments
Cite this review

Pith. "Pith review of The complexity of the SupportMinors Modeling for the MinRank Problem." pith.science (2026). https://pith.science/paper/YU2WRCVK

@misc{pith2026250606547,
  author       = {Pith},
  title        = {Pith review of: The complexity of the SupportMinors Modeling for the MinRank Problem},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YU2WRCVK}},
  note         = {Machine review of arXiv:2506.06547}
}
read the original abstract

In this note, we provide proven estimates for the complexity of the SupportMinors Modeling, mostly confirming the heuristic complexity estimates contained in the original article.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 45 canonical work pages

  1. [1]

    G. Adj, L. Rivera-Zamarripa, J. Verbel, E. Bellini, S. Barbero, A. Esser, C. Sanna, and F. Zweydinger. MiRitH (MinRank in the Head). 2023

    work page 2023

  2. [2]

    Andrade and A

    J. Andrade and A. Simis. A complex that resolves the ideal of minors having n-1 columns in common. Proceedings of the American Mathematical Society, 81(2):217–219, 1981

    work page 1981

  3. [3]

    Aragon, M

    N. Aragon, M. Bardet, L. Bidoux, J.-J. Chi-Dom ´ ınguez, V. Dyseryn, T. Feneuil, P. Ga- borit, A. Joux, M. Rivain, J.-P. Tillich, and A. Vin¸ cotte. RYDE specifications. 2023

    work page 2023

  4. [4]

    Aragon, L

    N. Aragon, L. Bidoux, J.-J. Chi-Dom ´ ınguez, T. Feneuil, P. Gaborit, R. Neveu, and M. Rivain. MIRA: a digital signature scheme based on the MinRank problem and the mpc-in-the-head paradigm. arXiv preprint: arXiv: 2307. 08575, 2023

    work page 2023

  5. [5]

    Aragon, O

    N. Aragon, O. Blazy, J.-C. Deneuville, P. Gaborit, A. Hauteville, O. Ruatta, J.-P. Tillich, and G. Z´ emor. LAKE-Low rAnk parity check codes Key Exchange. 2017

    work page 2017

  6. [6]

    Aragon, O

    N. Aragon, O. Blazy, J.-C. Deneuville, P. Gaborit, A. Hauteville, O. Ruatta, J.-P. Tillich, and G. Z´ emor. LOCKER-LOw rank parity ChecK codes EncRyption. 2017

    work page 2017

  7. [7]

    Aragon, O

    N. Aragon, O. Blazy, P. Gaborit, A. Hauteville, and G. Z´ emor. Durandal: a rank metric based signature scheme. In Advances in Cryptology - EUROCRYPT 2019 , pages 728–

    work page 2019

  8. [8]

    Baena, P

    J. Baena, P. Briaud, D. Cabarcas, R. Perlner, D. Smith-Tone, and J. Verbel. Improving support-minors rank attacks: applications to GeMSS and Rainbow. In Advances in Cryptology - CRYPTO 2022 , pages 376–405. Springer, 2022

    work page 2022

Show all 45 references
  1. [9]

    Bardet and M

    M. Bardet and M. Bertin. Improvement of algebraic attacks for solving superdeter- mined MinRank instances. In J. H. Cheon and T. Johansson, editors, Post-Quantum Cryptography, pages 107–123, Cham, 2022. Springer International Publishing

    2022

  2. [10]

    Bardet, P

    M. Bardet, P. Briaud, M. Bros, P. Gaborit, V. Neiger, O. Ruatta, and J.-P. Tillich. An algebraic attack on rank metric code-based cryptosystems. In Annual International Conference on the Theory and Applications of Cryptographic Techniques , pages 64–93. Springer, 2020

    2020

  3. [11]

    Bardet, M

    M. Bardet, M. Bros, D. Cabarcas, P. Gaborit, R. Perlner, D. Smith-Tone, J.-P. Tillich, and J. Verbel. Improvements of algebraic attacks for solving the rank decoding and MinRank problems. In Advances in Cryptology - ASIACRYPT 2020 , pages 507–536. Springer, 2020

    2020

  4. [12]

    Bellini, A

    E. Bellini, A. Esser, C. Sanna, and J. Verbel. MR-DSS – Smaller MinRank-based (Ring-)Signatures. In International Conference on Post-Quantum Cryptography , pages 144–169. Springer, 2022

    2022

  5. [13]

    Berger and P

    T. Berger and P. Loidreau. Designing an efficient and secure public-key cryptosystem based on reducible rank codes. In Progress in Cryptology - INDOCRYPT 2004 , pages 218–229. Springer, 2005

    2004

  6. [14]

    Bettale, J.-C

    L. Bettale, J.-C. Faugere, and L. Perret. Cryptanalysis of HFE, multi-HFE and variants for odd and even characteristic. Designs, Codes and Cryptography , 69:1–52, 2013

    2013

  7. [15]

    Beullens

    W. Beullens. Improved cryptanalysis of UOV and Rainbow. In Advances in Cryptology - EUROCRYPT 2021 , pages 348–373. Springer, 2021

    2021

  8. [16]

    Beullens

    W. Beullens. Breaking Rainbow takes a weekend on a laptop. In Advances in Cryptog- raphy - CRYPTO 2022 , pages 464–479. Springer, 2022

    2022

  9. [17]

    Briaud, J.-P

    P. Briaud, J.-P. Tillich, and J. Verbel. A polynomial time key-recovery attack on the Sidon cryptosystem. In Selected Areas in Cryptography - 28th International Conference SAC 2021, pages 419–438. Springer, 2021

    2021

  10. [18]

    Bruns and U

    W. Bruns and U. Vetter. Determinantal rings , volume 1327 of Lecture Notes in Math- ematics. Springer, 1988

    1988

  11. [19]

    J. F. Buss, G. S. Frandsen, and J. O. Shallit. The computational complexity of some problems of linear algebra. In BRICS Report Series RS-96-33 , pages 1–39. 1996

    1996

  12. [20]

    Cabarcas, D

    D. Cabarcas, D. Smith-Tone, and J. A. Verbel. Key recovery attack for ZHFE. In Post-Quantum Cryptography, pages 289–308. Springer, 2017

    2017

  13. [21]

    Caminata and E

    A. Caminata and E. Gorla. The complexity of MinRank. In Women in Numbers Europe III: Research Directions in Number Theory , pages 163–169. Springer, 2021

    2021

  14. [22]

    T. Chou, R. Niederhagen, E. Persichetti, T. H. Randrianarisoa, K. Reijnders, S. Samardjiska, and M. Trimoska. Take your MEDS: digital signatures from matrix code equivalence. In International Conference on Cryptology in Africa , pages 28–52. Springer, 2023

    2023

  15. [23]

    N. T. Courtois. Efficient zero-knowledge authentication based on a linear algebra prob- lem MinRank. In International Conference on the Theory and Application of Cryptology and Information Security , pages 402–421. Springer, 2001

    2001

  16. [24]

    J. Ding, R. Perlner, A. Petzoldt, and D. Smith-Tone. Improved cryptanalysis of HFEv− via projection. In Post-Quantum Cryptography, pages 375–395. Springer, 2018. 13

    2018

  17. [25]

    Faugere, M

    J.-C. Faugere, M. S. El Din, and P.-J. Spaenlehauer. Computing loci of rank defects of linear matrices using Gr¨ obner bases and applications to cryptology. In Proceedings of the 2010 International Symposium on Symbolic and Algebraic Computation , pages 257–264, 2010

    2010

  18. [26]

    Faug` ere, M

    J.-C. Faug` ere, M. S. El Din, and P.-J. Spaenlehauer. On the complexity of the gener- alized MinRank problem. Journal of Symbolic Computation , 55:30–58, 2013

    2013

  19. [27]

    Faugere, F

    J.-C. Faugere, F. Levy-dit Vehel, and L. Perret. Cryptanalysis of MinRank. In Pro- ceedings of the 28th Annual conference on Cryptology: Advances in Cryptology , pages 280–296. Springer, 2008

    2008

  20. [28]

    Faure and P

    C. Faure and P. Loidreau. A new public-key cryptosystem based on the problem of reconstructing p-polynomials. In International workshop on coding and cryptography , pages 304–315. Springer, 2005

    2005

  21. [29]

    Fiat and A

    A. Fiat and A. Shamir. How to prove yourself: Practical solutions to identification and signature problems. In Advances in Cryptography - CRYPTO’86 , pages 186–194. Springer, 1986

    1986

  22. [30]

    E. M. Gabidulin, A. Paramonov, and O. Tretjakov. Ideals over a non-commutative ring and their application in cryptology. In Advances in Cryptology—EUROCRYPT’91 , pages 482–489. Springer, 1991

    1991

  23. [31]

    Gaborit, O

    P. Gaborit, O. Ruatta, J. Schrek, and G. Z´ emor. RankSign: an efficient signature algorithm based on the rank metric. In PQCrypto 2014 , pages 88–107. Springer, 2014

    2014

  24. [32]

    Goubin and N

    L. Goubin and N. T. Courtois. Cryptanalysis of the TTM cryptosystem. In Advances in Cryptology - ASIACRYPT 2000 , pages 44–57. Springer, 2000

    2000

  25. [33]

    Kipnis and A

    A. Kipnis and A. Shamir. Cryptanalysis of the HFE public key cryptosystem by re- linearization. In Annual International Cryptology Conference , pages 19–30. Springer, 1999

    1999

  26. [34]

    Kreuzer and L

    M. Kreuzer and L. Robbiano. Computational commutative algebra, volume 1. Springer, 2000

    2000

  27. [35]

    K. Kurano. The first syzygies of determinantal ideals. Journal of Algebra , 124(2):414– 436, 1989

    1989

  28. [36]

    Loidreau

    P. Loidreau. Designing a rank metric based McEliece cryptosystem. In PQCrypto 2010, pages 142–152. Springer, 2010

    2010

  29. [37]

    C. A. Melchor, N. Aragon, M. Bardet, S. Bettaieb, L. Bidoux, O. Blazy, and J.-C. Deneuville. ROLLO-Rank-Ouroboros, LAKE & LOCKER. 2019

    2019

  30. [38]

    C. A. Melchor, N. Aragon, S. Bettaieb, L. Bidoux, O. Blazy, J.-C. Deneuville, P. Ga- borit, A. Hauteville, G. Z´ emor, and I. Bourges. Ouroboros-R. NIST Submission, 2017

    2017

  31. [39]

    C. A. Melchor, N. Aragon, S. Bettaieb, L. Bidoux, O. Blazy, J.-C. Deneuville, P. Ga- borit, and G. Z´ emor. Rank quasi-cyclic (RQC). 2017

    2017

  32. [40]

    Moody, R

    D. Moody, R. Perlner, and D. Smith-Tone. An asymptotically optimal structural attack on the ABC multivariate encryption scheme. In Post-Quantum Cryptography, pages 180–196. Springer, 2014

    2014

  33. [41]

    Moody, R

    D. Moody, R. Perlner, and D. Smith-Tone. Improved attacks for characteristic-2 pa- rameters of the cubic ABC simple matrix encryption scheme. In Post-Quantum Cryp- tography, pages 255–271. Springer, 2017

    2017

  34. [42]

    Overbeck

    R. Overbeck. Structural attacks for public key cryptosystems based on Gabidulin codes. Journal of cryptology , 21(2):280–301, 2008. 14

    2008

  35. [43]

    Raviv, B

    N. Raviv, B. Langton, and I. Tamo. Multivariate public key cryptosystem from sidon spaces. In Public-Key Cryptography - PKC 2021 , pages 242–265. Springer, 2021

    2021

  36. [44]

    C. Tao, A. Petzoldt, and J. Ding. Efficient key recovery for all HFE signature variants. In Advances in Cryptology - CRYPTO 2021 , pages 70–93. Springer, 2021

    2021

  37. [45]

    Vates and D

    J. Vates and D. Smith-Tone. Key recovery attack for all parameters of HFE −. In Post-quantum cryptography, pages 272–288. Springer, 2017. 15

    2017

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.