The New Implementation Schemes of the TTM Cryptosystem Are Not Secure

Abstract

We show that the new TTM implementation schemes have a defect. There exist linearization equations

$$\sum\limits_{i = 1,j = 1}^{n,m} {{a_{ij}}{x_i}{y_j}({x_1}, \ldots ,{x_n}) + \sum\limits_{i = 1}^n {{b_i}{x_i} + \sum\limits_{j = 1}^m {{c_j}{y_j}({x_1}, \ldots ,{x_n}) + d = 0,} } }$$

which are satisfied by the components y3 (x1 … xn) of the ciphers of the TTM schemes. The inventor of TTM used two versions of the paper [2] to refute a claim in [3]. When we do a linear substitution with the linear equations derived from the linearization equations for a given ciphertext,we can find the plaintext by an iteration of the procedure of first search for linear equations by linear combinations and then linear substitution. The computational complexity of the attack on these two schemes is less than 2³⁵ over a finite field of size 2⁸.