Paper 2026/040

Polynomial Evaluation on Many Inputs with Bounded Hamming Weight over GF(2)

Abstract

We propose a new polynomial evaluation algorithm to evaluate a degree-$d$ Boolean polynomial $f(x_n,\ldots,x_1)$ on all elements in some structured sets $S\subseteq \mathbb F_2^n$. This problem has been well-studied for $S=\mathbb F_2^n$ and there are efficient polynomial evaluation algorithms like standard Mobius transform, memory-efficient Mobius transform (EUROCRYPT 2021, TOMS 2024) and fast exhaustive search (CHES 2010, PQCrypt 2023) for the case $S=\mathbb F_2^n$. In addition, the standard Mobius transform can also be used to evaluate a polynomial over the set $S=P_{n}^w$ of all $(x_n,\ldots,x_1)\in\mathbb F_2^n$ whose Hamming weight is upper bounded by $w$, and its memory complexity is the same as the size of $S$. In Dinur's algorithm for polynomial method proposed at EUROCRYPT 2021, there is a critical step to efficiently evaluate $f$ over a more general input set $P_{n-n_1}^{w}\times P_{n_1}^{n_1}\subseteq \mathbb F_2^n$. To our knowledge, in the literature, no memory-efficient polynomial evaluation algorithms are designed for such a special input set. Dinur proposed a tweaked fast exhaustive search algorithm for this problem, but it has not been proved nor implemented. This leaves us with a natural question: can we design an efficient polynomial evaluation algorithm tailored for a more general input set $P_{n_s,\ldots,n_1}^{w_s,\ldots,w_1}=P_{n_s}^{w_s}\times \cdots \times P_{n_1}^{w_1}\subseteq \mathbb F_2^n$ where $\sum_{i=1}^{s}n_i=n$ and $w_i\leq n_i$? We answer this question by proposing a new polynomial evaluation algorithm named \textbf{FESG}, i.e., \textbf{F}ast \textbf{E}xhaustive \textbf{S}earch over a more \textbf{G}eneral input set, to handle the input set $P_{n_s,\ldots,n_1}^{w_s,\ldots,w_1}$. This algorithm is based on the derivative-based polynomial evaluation framework proposed at CHES 2010. In addition to extending the application of derivative-based framework to a more general input set, we also successfully address a major issue in existing derivative-based algorithms over $\mathbb F_2$ proposed at CHES 2010 and PQCrypt 2023, reducing the time complexity of the initialization phase from $\mathcal O\big(\binom{n}{\leq d}^2\big)$ to $\mathcal O\big(\binom{n}{\leq d}\big)$. As a result, FESG is also efficient for large $d$. Our algorithm is almost optimal, whose theoretic time and memory complexity are $\binom{n}{\leq d}+d\cdot |P_{n_s,\ldots,w_1}^{w_s,\ldots,w_1}|$ bit operations and $2\cdot \binom{n}{\leq d}$ bits, respectively. Here, $|P_{n_s,\ldots,w_1}^{w_s,\ldots,w_1}|$ is the size of the set $P_{n_s,\ldots,w_1}^{w_s,\ldots,w_1}$. An efficient implementation of the FESG algorithm for any $(d,n_s,\ldots,n_1,w_s,\ldots,w_1)$ is also given in this work. In particular, the FESG algorithm also provides a proven method for a critical step in Dinur's algorithm for polynomial method without affecting its overall complexity.

Note: Major revision of the paper. Update the implementation of the algorithm so that it can work for any degree.