This paper explores the security of block ciphers like Rijndael and Serpent, which are built with layers of small S-boxes interconnected by linear key-dependent layers. The authors propose that these ciphers can be described by overdefined systems of algebraic equations, which are true with probability 1. They show that this is true for both Rijndael and Serpent due to their specific algebraic properties. The paper introduces a new method called XSL, which leverages the sparsity and structure of these equations to solve them more efficiently than traditional methods like XL. The XSL attack uses only equations that are true with probability 1, meaning the security does not grow exponentially with the number of rounds. The complexity of the XSL attack is polynomial or subexponential in the number of rounds, with a constant that is double-exponential in the size of the S-box. The authors suggest that S-boxes in block ciphers should not be describable by a system of polynomial equations that is too small or too overdefined to ensure security. The paper concludes with a discussion on the implications for the design of block ciphers and the potential for breaking Rijndael and Serpent using the XSL attack.This paper explores the security of block ciphers like Rijndael and Serpent, which are built with layers of small S-boxes interconnected by linear key-dependent layers. The authors propose that these ciphers can be described by overdefined systems of algebraic equations, which are true with probability 1. They show that this is true for both Rijndael and Serpent due to their specific algebraic properties. The paper introduces a new method called XSL, which leverages the sparsity and structure of these equations to solve them more efficiently than traditional methods like XL. The XSL attack uses only equations that are true with probability 1, meaning the security does not grow exponentially with the number of rounds. The complexity of the XSL attack is polynomial or subexponential in the number of rounds, with a constant that is double-exponential in the size of the S-box. The authors suggest that S-boxes in block ciphers should not be describable by a system of polynomial equations that is too small or too overdefined to ensure security. The paper concludes with a discussion on the implications for the design of block ciphers and the potential for breaking Rijndael and Serpent using the XSL attack.