Properties of the Discrete Differential with Cryptographic Applications

Recently, the C∗− signature scheme has been completely broken by Dubois et al. [2, 3]. As a consequence, the security of SFLASH and other multivariate public key systems have been impaired. The attacks presented in [2, 3] rely on a symmetry of the differential of the encryption mapping. In [1], Ding et al. experimentally justify the use projection as a method of avoiding the new attack. In this paper, we derive some properties of the discrete differential, give a theoretical justification for the reparation in [1], and establish the exact context in which this attack is applicable.