Paper 2004/103

Cryptanalysis of SFlash v3

Jintai Ding and Dieter Schmidt


Sflash is a fast multivariate signature scheme. Though the first version Sflash-v1 was flawed, a second version, Sflash-v2 was selected by the Nessie Consortium and was recommended for implementation of low-end smart cards. Very recently, due to the security concern, the designer of Sflash recommended that Sflash-v2 should not be used, instead a new version Sflash-v3 is proposed, which essentially only increases the length of the signature. The Sflash family of signature schemes is a variant of the Matsumoto and Imai public key cryptosystem. The modification is through the Minus method, namely given a set of polynomial equations, one takes out a few of them to make them much more difficult to solve. In this paper, we attack the Sflash-v3 scheme by combining an idea from the relinearization method by Kipnis and Shamir, which was used to attack the Hidden Field Equation schemes, and the linearization method by Patarin. We show that the attack complexity is less than 2^80, the security standard required by the Nessie Consortium.

Available format(s)
Public-key cryptography
Publication info
Published elsewhere. Unknown where it was published
smart cards
Contact author(s)
jintai ding @ uc edu
2004-05-07: received
Short URL
Creative Commons Attribution


      author = {Jintai Ding and Dieter Schmidt},
      title = {Cryptanalysis of SFlash v3},
      howpublished = {Cryptology ePrint Archive, Paper 2004/103},
      year = {2004},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.