On algebraic cryptanalysis of ciphers with low multiplicative complexity

In this article we study the application of multiple righthand sides (MRHS) equations in algebraic attacks against ciphers with low multiplicative complexity. Each AND gate in the circuit description is converted to a corresponding MRHS equation. The resulting system is transformed into a syndrome decoding problem. The complexity of the decoding problem then depends on the number of AND gates, and on the relative number of known output bits with respect to the number of unknown key bits. This allows us to apply results from coding theory, and explicitly connect the complexity of algebraic cryptanalysis to the multiplicative complexity of the cipher.