This page by Nicolas T. Courtois mentions Geometric Generalised T' Method. It is described as

an advanced geometric algorithm, never published, for finding extra linearly independent equations at a given degree, which would normally be found by Gröbner bases techniques, but at a higher degree(!) with much higher memory and with much higher complexity. So in practice, this algorithm has no competitors in producing such equations on current computers.

The other page of the same site mentions T' method (not geometric and not generalized) as one of the steps of the AES attack and it even says that it is described in several papers (but sadly without any link):

In general, it is likely that in the future, the best attack on AES will be of the following form:
1. Use the equations over GF(256).
2. Apply one of the versions of XSL.
3. Apply a final step. The so called T' method, described in several papers, may or may not be sufficient.

So, my questions are: What is the T' method? Where it is described? What could be its geometric generalization?

Will be grateful for any reference or clue.


T' method was introduced in the paper Cryptanalysis of Block Ciphers with Overdefined Systems of Equations by Nicolas Courtois and Josef Pieprzyk (see section 6.1 and Appendix E).

It is a part of XSL attack on block ciphers (such as Rijndael and Serpent).

During XSL attack cipher is represented as a system of multivariate quadratic polynomials and the goal of T' method is to derive more linearly independent equations form it.

Don Coppersmith criticized this attack but noted that

The method has some merit, and is worth investigating, but it does not break Rijndael as it stands.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.