Cryptanalysis of a multivariate CCZ scheme

2025-07-21

AI Summary

This work addresses the critical open question of whether CCZ equivalence enhances security in the Pesto multivariate cryptosystem. We propose an efficient algebraic reduction technique that equivalently transforms the public quartic polynomial system—induced by CCZ equivalence—back into a quadratic system. Our method combines structural identification with degree-reduction techniques, challenging the long-standing assumption that CCZ equivalence significantly strengthens multivariate public-key cryptography. Experimental results demonstrate that the reduced quadratic system is efficiently solvable by standard algebraic attacks (e.g., XL and Gröbner basis algorithms), revealing that Pesto’s practical security is substantially lower than claimed. To our knowledge, this is the first systematic analysis exposing a structural weakness inherent in CCZ-based public-key construction within a concrete scheme. The work provides novel theoretical tools and a refined security evaluation paradigm for multivariate cryptography design and analysis.

Technology Category

• Constraint Satisfaction and Optimization: Other Foundations of Constraint Satisfaction
• Cognitive Modeling & Cognitive Systems: Analogy
• Knowledge Representation and Reasoning: Computational Complexity of Reasoning

Application Category

• Security and Privacy: Applications of cryptography
• Responsible Web: Measurement, analysis, and circumvention of Web censorship
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

We consider the multivariate scheme Pesto, which was introduced by Calderini, Caminata, and Villa. In this scheme, the public polynomials are obtained by applying a CCZ transformation to a set of quadratic secret polynomials. As a consequence, the public key consists of polynomials of degree 4. In this work, we show that the public degree 4 polynomial system can be efficiently reduced to a system of quadratic polynomials. This seems to suggest that the CCZ transformation may not offer a significant increase in security, contrary to what was initially believed.

Problem

• Analyzing security of multivariate CCZ scheme Pesto
• Reducing public degree 4 polynomials to quadratic
• Assessing CCZ transformation's impact on security

Innovation

• CCZ transformation applied to quadratic polynomials
• Public key consists of degree 4 polynomials
• Reduction to quadratic polynomial system