On the last fall degree of zero-dimensional Weil descent systems. (July 2018)

• Record Type: Journal Article
• Authors: Huang, Ming-Deh A.; Kosters, Michiel; Yang, Yun; Yeo, Sze Ling
• Is Part Of: Journal of symbolic computation. Volume 87(2018)
• Page Start: 207
• Page End: 226
• Publication Date: 2018-07
• Subjects: 13P10 -- 13P15; Polynomial system -- Gröbner basis -- Last fall degree -- Zero-dimensional -- First fall degree -- Weil descent -- HFE -- ECDLP; Mathematics -- Data processing -- Periodicals; Numerical analysis -- Data processing -- Periodicals; Automatic programming (Computer science) -- Periodicals; Mathématiques -- Informatique -- Périodiques; Analyse numérique -- Informatique -- Périodiques; Programmation automatique -- Périodiques; Automatic programming (Computer science); Mathematics -- Data processing; Numerical analysis -- Data processing; Periodicals; Electronic journals; 510.285
• DOI: 10.1016/j.jsc.2017.08.002
• Languages: English
• ISSNs: 0747-7171

Abstract

Abstract: In this article we will discuss a mostly theoretical framework for solving zero-dimensional polynomial systems. Complexity bounds are obtained for solving such systems using a new parameter, called the last fall degree, which does not depend on the choice of a monomial order. The method is similar to certain MutantXL algorithms, but our abstract formulation has advantages. For example, we can prove that the cryptographic systems multi-HFE and HFE are insecure. More generally, let k be a finite field of cardinality q n and let k ′ be the subfield of cardinality q . Let F ⊂ k [ X 0, …, X m − 1 ] be a finite subset generating a zero-dimensional ideal. We give an upper bound of the last fall degree of the Weil descent system of F from k to k ′, which depends on q, m, the last fall degree of F, the degree of F and the number of solutions of F, but not on n . This shows that such Weil descent systems can be solved efficiently if n grows and the other parameters are fixed. In particular, one can apply these results to show a weakness in the cryptographic protocols HFE and multi-HFE.