Designing Against the 'Overdefined System of Equations' Attack

Recently, Courtois and Pieprzyk proposed an attack on symmetric ciphers that takes advantage of a previously-unexploited property of substitution boxes, or s-boxes, in the round function. This paper gives a brief overview of this “overdefined system of equations” attack and shows how the attack may be avoided through the use of round functions that contain a variety of protection mechanisms, including combinations of operators from different algebraic groups, a circular rotation step, and substitution boxes (s-boxes) of large dimension.