Solving efficiently structured polynomial systems and Applications in Cryptology
Résumé
Solving polynomial equations is a fundamental problem; an important subproblem is to solve polynomial systems having some additional structures: symmetries (for instance when the associated algebraic variety is invariant under the action of some finite group) or multihomogeneous algebraic systems (each equation is homogeneous wrt a block of variables). One of the most efficient method to solve polynomial systems in finite fields is to compute Gröbner bases. Little is known about the theoretical and practical complexity of computing Gröbner bases of structured systems; in this talk we review several recent advances in this area.Surprisingly such structured systems occur frequently in Algebraic Cryptanalysis: for instance the MinRank problem which is at the heart of the security of many multivariate public key cryptosystems such as HFE or the McEliece cryptosystem whose security is based on the hardness of decoding general linear codes are strongly related to multihomogeneous polynomial systems.To illustrate this talk, I will consider the algorithm introduced by Gaudry during ECC 2004 to solve the DLP for elliptic curves defined over a non prime finite field $F_q^n$ whose main step is related to polynomial system solving.More specifically, I will apply this algorithm to the case of Edwards curves, the well known family of elliptic curves that allow faster arithmetic as shown by Bernstein and Lange. We show how to take advantage of some symmetries of twisted Edwards curves to gain an exponential factor $2^{3(n-1)}$ when solving the underling polynomial systems. As a result, the Boolean complexity of solving the ECDLP for twisted Edwards curves defined over $F_q^5$ , with $q \approx 2^{64}$ , is supposed to be $2^{177}$ operations using generic algorithms compared to a complexity of $2^{127}$ operations using Gröbner bases and symmetries.