Systems of Boolean equations of low degree arise in a natural way when
analyzing block ciphers. The cipher's round functions relate the secret key to
auxiliary variables that are introduced by each successive round. In algebraic
cryptanalysis, the attacker attempts to solve the resulting equation system in
order to extract the secret key. In this paper we study algorithms for
eliminating the auxiliary variables from these systems of Boolean equations. It
is known that elimination of variables in general increases the degree of the
equations involved. In order to contain computational complexity and storage
complexity, we present two new algorithms for performing elimination while
bounding the degree at 3, which is the lowest possible for elimination.
Further we show that the new algorithms are related to the well known \emph{XL}
algorithm. We apply the algorithms to a downscaled version of the LowMC cipher
and to a toy cipher based on the Prince cipher, and report on experimental
results pertaining to these examples.Comment: 21 pages, 3 figures, Journal pape
