Cryptology ePrint Archive: Report 2017/593

Solving Multivariate Polynomial Systems and an Invariant from Commutative Algebra

Alessio Caminata and Elisa Gorla

Abstract: The security of several post-quantum cryptosystems is based on the assumption that solving a system of multivariate (quadratic) polynomial equations $p_1=\dots=p_m=0$ over a finite field is hard. Such a system can be solved by computing a lexicographic Groebner basis of the ideal $(p_1,\dots,p_m)$. The most efficient algorithms for computing Groebner bases, such as $F_4$ and $F_5$, transform the problem into several instances of Gaussian elimination. The computational complexity of these algorithms is not completely understood, especially when the polynomials $p_1,\dots,p_m$ are non-homogeneous. In this paper, we prove that this complexity is bounded by a function of the Castelnuovo-Mumford regularity of the ideal $(p_1^h,\dots,p_m^h)$ obtained by homogenizing the input polynomials. This allows us to bound the complexity of solving a system of polynomial equations when the associated ideal is zero-dimensional, a common situation in cryptography. More precisely, we show that the degree of the polynomials involved in the computation a Groebner basis of a zero-dimensional ideal grows at most linearly in the number of variables. In combination with some theorems in commutative algebra, our results also allow us to bound the complexity of some instances of the MinRank Problem.

Category / Keywords: public-key cryptography / post-quantum cryptography; multivariate cryptography; Groebner basis; solving degree; degree of regularity; Castelnuovo-Mumford regularity; shape lemma;

Date: received 20 Jun 2017, last revised 22 Jun 2017

Contact author: alessiocaminata87 at gmail com

Available format(s): PDF | BibTeX Citation

Note: Section 5 as been expanded and some references has been added.

Version: 20170622:152744 (All versions of this report)

Short URL:

Discussion forum: Show discussion | Start new discussion

[ Cryptology ePrint archive ]