Inverting HFE Is Quasipolynomial.

Louis Granboulan, Antoine Joux, Jacques Stern

Browse the full CRYPTO paper archive.