Paper 2015/573

Last fall degree, HFE, and Weil descent attacks on ECDLP

Ming-Deh A. Huang, Michiel Kosters, and Sze Ling Yeo

Abstract

Weil descent methods have recently been applied to attack the Hidden Field Equation (HFE) public key systems and solve the elliptic curve discrete logarithm problem (ECDLP) in small characteristic. However the claims of quasi-polynomial time attacks on the HFE systems and the subexponential time algorithm for the ECDLP depend on various heuristic assumptions. In this paper we introduce the notion of the last fall degree of a polynomial system, which is independent of choice of a monomial order. We then develop complexity bounds on solving polynomial systems based on this last fall degree. We prove that HFE systems have a small last fall degree, by showing that one can do division with remainder after Weil descent. This allows us to solve HFE systems unconditionally in polynomial time if the degree of the defining polynomial and the cardinality of the base field are fixed. For the ECDLP over a finite field of characteristic 2, we provide computational evidence that raises doubt on the validity of the first fall degree assumption, which was widely adopted in earlier works and which promises sub-exponential algorithms for ECDLP. In addition, we construct a Weil descent system from a set of summation polynomials in which the first fall degree assumption is unlikely to hold. These examples suggest that greater care needs to be exercised when applying this heuristic assumption to arrive at complexity estimates. These results taken together underscore the importance of rigorously bounding last fall degrees of Weil descent systems, which remains an interesting but challenging open problem.

Metadata
Available format(s)
PDF
Publication info
Published by the IACR in CRYPTO 2015
Keywords
discrete logarithm problemelliptic curve cryptosystemcomplexity theory
Contact author(s)
kosters @ gmail com
History
2015-06-17: received
Short URL
https://ia.cr/2015/573
License
Creative Commons Attribution
CC BY

BibTeX

@misc{cryptoeprint:2015/573,
      author = {Ming-Deh A.  Huang and Michiel Kosters and Sze Ling Yeo},
      title = {Last fall degree, HFE, and Weil descent attacks on ECDLP},
      howpublished = {Cryptology ePrint Archive, Paper 2015/573},
      year = {2015},
      note = {\url{https://eprint.iacr.org/2015/573}},
      url = {https://eprint.iacr.org/2015/573}
}
Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.