The rise and resilience of multivariate cryptography: Advances, pitfalls, and promising pathways

Abstract

Multivariate Public Key Cryptography (MPKC) offers a robust framework for secure communications in the post-quantum era by harnessing the complexity of solving multivariate quadratic polynomial equations over finite fields. This inherent difficulty not only delivers strong quantum resistance but also supports high-security applications and additional functionalities. However, these advantages come with notable trade-offs, including larger key sizes and sophisticated security evaluations. In this paper, we present a comprehensive survey of MPKC, beginning with its mathematical foundations illustrated through accessible examples and an introduction to the essential terminology and core algorithms, such as Grobner basis methods, the Berlekamp algorithm, and extended-linearization methods, etc., that underpin effective implementations.

Our work critically examines state-of-the-art encryption and signature schemes, covering approaches inspired by Oil–Vinegar, Rainbow, and HFE-based constructions, as well as some essential designs like EFLASH, HFEv, Simple Matrix Encryption, and MAYO, etc. We review contemporary attack strategies including differential, rank, direct attacks, and physical attacks, and discuss how recent cryptanalytic breakthroughs (e.g., vulnerabilities revealed in Rainbow and UOV) underscore the need for more robust design choices. Furthermore, we highlight emerging research directions by exploring innovative techniques that integrate linear codes, neural network frameworks, employing other special polynomials, and novel algebraic constructions such as Sidon spaces and the Triple Unlocking Mechanism, alongside advanced signature variants like blind, ring, and proxy signatures. By synthesising theoretical insights with practical cryptanalysis, this survey not only identifies the current limitations, such as decryption failures, excessive key sizes, and susceptibilities to MinRank, reconciliation attacks, and other attacks, but also outlines future research challenges and requirements.