Abstract
In this paper we study Boolean equation systems, and how to eliminate variables from them while bounding the degree of polynomials produced. A procedure for variable elimination is introduced, and we relate the techniques to Gröbner bases and XL methods. We prove that by increasing the degree of the polynomials in the system by one for each variable eliminated, we preserve the solution space, provided that the system satisfies a particular condition. We then estimate how many variables we need to eliminate in order to solve the resulting system by re-linearization, and show that we get complexities lower than the trivial brute-force \(\mathcal {O}(2^n)\) when the system is overdetermined.






Similar content being viewed by others
Explore related subjects
Discover the latest articles, news and stories from top researchers in related subjects.References
Zajac, P.: Upper bounds on the complexity of algebraic cryptanalysis of ciphers with a low multiplicative complexity. Des. Codes Cryptogr. 82(1–2), 43–56 (2017)
Shamir, A., Patarin, J., Courtois, N., Klimov, A.: Efficient Algorithms for Solving Overdefined Systems of Multivariate Polynomial Equations. In: Eurocrypt’2000, LNCS 1807, pp. 392–407, Springer (2000)
Courtois, N.T., Pieprzyk, J.: Cryptanalysis of block ciphers with overdefined systems of equations. In: Advances in Cryptology—ASIACRYPT 2002. ASIACRYPT 2002. Lecture Notes in Computer Science, vol. 2501, pp. 267 – 287. Springer, Berlin (2002)
Faugere, J.-C.: A new efficient algorithm for computing Gröbner bases (F4). Effective methods in algebraic geometry (Saint-Malo, 1998). J. Pure Appl. Algebra 139, 61–88 (1999)
Kandri-Rody, A., Kapur, D., Narendran, P., An ideal-theoretic approach to word problems and unification problems over finitely presented commutative algebras. In: Jouannaud J.P. (eds.), Rewriting Techniques and Applications. RTA. Lecture Notes in Computer Science, vol 202. Springer, Berlin (1985)
Sakai, K., Sato, Y.: Boolean Gröbner bases, ICOT Technical Momorandum 488 (1988). http://www.jipdec.or.jp/archives/icot/ARCHIVE/Museum/TRTM/tm0488.htm. Accessed 15 Sept 2017
Decker, W., Greuel, G.-M., Pfister, G., Schönemann, H.: Singular 3-1-2—a computer algebra system for polynomial computations (2010). http://www.singular.uni-kl.de/. Accessed 4 Oct 2017
Brickenstein, M., Dreyer, A.: A framework for Gröbner-basis computations with Boolean polynomials. J. Symbol. Comput. 44(9), 1326–1345 (2009)
Horácek, J., Kreuzer, M., Ekossono, A.S.M.: Computing Boolean border bases. In: 2016 18th international symposium on symbolic and numeric algorithms for scientific computing (SYNASC), pp. 465–472. IEEE (2016)
Lokshtanov, D., Paturi, R., Tamaki, S., Williams, R., Yu, H.: Beating brute force for systems of polynomial equations over finite fields. In: The 27th ACM-SIAM Symposium on Discrete Algorithms (SODA) (2017)
Smolensky, R.: Algebraic methods in the theory of lower bounds for Boolean circuit complexity. In: Proceedings of the 19th Annual ACM Symposium on Theory of Computing (STOC), pp. 77–82 (1987)
Chan, T.M., Williams, R.: Deterministic APSP, orthogonal vectors, and more: quickly derandomizing Razborov–Smolensky. In: Proceedings of the 27th Annual ACM-SIAM Symposium on Discrete Algorithms (SODA), pp. 1246–1255 (2016)
Lazard, D.: Gaussian elimination and resolution of systems of algebraic equations. In: Proceedings of EUROCAL 1983, volume 162 of LNCS, pp. 146-157 (1983)
Giusti, M.: Some effectivity problems in polynomial ideal theory. In: Proceedings of International Symposium on Symbolic and Algebraic Computation EUROSAM 84, Cambridge (England), volume 174 of LNCS, pp. 159–171. Springer (1994)
Bardet, M., Faugere, J.-C., Salvy, B.: Complexity of Gröbner basis computation for semiregular overdetermined sequences over \(\mathbb{F}_2\) with solutions in \(\mathbb{F}_2\), rapport de recherche 5049. Institut National de Recherche en Informatique et en Automatique, Lorraine (2003)
Bardet, M., Faugere, J.-C., Salvy, B., Yang, B.-Y.: Asymptotic behaviour of the degree of regularity of semi-regular polynomial systems. Presented at MEGA’05, Eighth International Symposium on Effective Methods in Algebraic Geometry (2005)
Bouillaguet, C., Chen, H.-C., Cheng, C.-M., Chou, T., Niederhagen, R., Shamir, A., Yang, B.-Y.: Fast exhaustive search for polynomial systems in \(\mathbb{F}_2\). In: Cryptographic Hardware and Embedded Systems—CHES 2010. 12th International Workshop, Santa Barbara, USA, August 17–20, 2010. Proceedings, pp. 203–218. Springer, Berlin (2010)
Bardet, M., Faugere, J.-C., Salvy, B., Spaenlehauer, P.-J.: On the complexity of solving quadratic Boolean systems. J. Compl. 29(1), 53–75 (2013)
Joux, A., Vitse, V.: A crossbred algorithm for solving Boolean polynomial systems, Cryptology ePrint Archive, Report 2017/372 (2017). https://eprint.iacr.org/2017/372. Accessed 23 Mar 2019
Rosen, K.H.: Handbook of Discrete and Combinatorial Mathematics. The Series Discrete Mathematics and Its Applications. Taylor & Francis, London (1999)
Cox, D., Little, J., O’Shea, D.: Ideals, Varieties and Algorithms, 3rd edn. Springer, Berlin (2007)
Cox, D., Little, J., O’Shea, D.: Using Algebraic Geometry GTM 185. Springer, Berlin (2005)
Sala, M., Mora, T., Perret, L., Sakata, S., Traverso, C.: Gröbner Bases, Coding and Cryptography. Springer, New York (2009)
Faugere, J-C.: A new efficient algorithm for computing Gröbner bases without reduction to zero (F5). In: Proceedings of the 2002 International Symposium on Symbolic and Algebraic Computation, pp. 75–83. ACM, New York (2002)
Stegers, T.: Faugere’s F5 Algorithm Revisited, Thesis For The Degree Of Diplom-Mathematiker, Department of Mathematics, Technische Universität Darmstadt, 2005. http://sciencedocbox.com/Physics/68613748-Faugere-s-f5-algorithm-revisited.html
Rosen, Kenneth H.: Handbook of Discrete and Combinatorial Mathematics, 2nd edn. CRC Press, Boca Raton (2017)
Raddum, H., Rønjom, S.: On the Number of Linearly Independent Equations Generated by XL, Sequences and Their Applications (SETA) 2008, LNCS 5203. Springer, pp. 239–251 (2008)
Yang, B.-Y., Chen, J.-M.: Theoretical analysis of XL over small fields. In: Australasian Conference on Information Security and Privacy (ACISP) 2004, LNCS 3108. Springer, pp. 277–288 (2004)
Acknowledgements
We would like to thank the anonymous reviewers for helpful comments.
Author information
Authors and Affiliations
Corresponding author
Additional information
Publisher's Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Appendix: syzygies between polynomials of degrees \(\ge 2\)
Appendix: syzygies between polynomials of degrees \(\ge 2\)
When the degree of some \(a_i\)’s are greater than 1, there may be other syzygies that are not generated by the Koszul and Boolean syzygies. Let \(a^1_1, \ldots a^1_{\ell _1}\) be polynomials of degree \(\le 1\). By suitable Gaussian elimination we may assume the initial terms are such that:
Let \(a^d_1, \ldots , a^d_{\ell _d}\) be polynomials of degree \(\le d\). We perform reduction operations as follows: If a term of \(a^d_i\) is of the form \(t \cdot {\text {in}}(a^1_j)\) where t is a monomial of degree \(\le d-1\), we replace \(a^d_i\) by \(a^d_i - t \cdot a^1_j\). We then eventually get:
Secondly we may perform Gaussian elimination on the \(a^d_i\) such that:
Suppose we have given \(a^d_i\) as above for each \(1 \le d \le D\) and \(i = 1, \ldots , \ell _d\). Let
where \(\mathbb {B}^{\ell _d} = \mathbb {B}\epsilon ^d_1 \oplus \cdots \oplus \mathbb {B}\epsilon ^d_{\ell _d}\) and we set \(\epsilon ^d_j\) to have degree d. There is a map
and the syzygy module \(S \subseteq \mathbb {B}^L\) is the kernel of this map.
Suppose now we have a total order on the terms of \(\mathbb {B}\). We make a term order on \(\mathbb {B}^L\) by letting terms \(s \epsilon ^e_j < t \epsilon ^d_i\) if:
-
\(e < d\), or
-
\(e = d\) and \(j < i\), or
-
\(e = d, j = i\) and \(s < t\)
Theorem 26
Given polynomials \(a^d_i\) of degree \(\le d\), for each \(1 \le d \le D\) and suppose for each d they fulfill Condition (15) above. The following syzygies may exist:
-
1.
Koszul syzygies \(a^d_j \epsilon ^e_k + a^e_k \epsilon ^d_j\) where \(e < d\) or \(e = d\) and \(k < j\). For given sum \(d+e\) denote by \(K^{d+e}\) the linear space these syzygies generate.
-
2.
Boolean syzygies \((a^d_j + 1) \epsilon ^d_j\). For given d denote by \(B^{2d}\) the linear space these syzygies generate.
-
3.
For each \(\delta \ge 2\) syzygies
$$\begin{aligned} \mathbf {r}= \underset{\begin{matrix} d = 1, \ldots , \delta \\ i = 1, \ldots , \ell _d \end{matrix}}{\sum } r^{\delta -d}_i \epsilon ^d_i \end{aligned}$$where \(r^{\delta -d}_i\) has degree \(\le \delta -d\) and no term of \(\mathbf {r}\) is \(\tau \cdot t\) where t is the initial term of a syzygy in \(K^e\) or \(B^e\) and \(\deg (\tau ) + e \le \delta \).
For a given \(\delta \) in 3., denote by \(R^{\le \delta }\) the linear space of such syzygies.
-
a.
Then for \(\delta \ge 2\) we have:
$$\begin{aligned} S^{\le \delta } = \sum _{d = 2}^{\delta } S^{\le \delta -d} K^d +\sum _{d = 2}^{\delta } S^{\le \delta -d}B^d + R^{\le \delta }. \end{aligned}$$(16) -
b.
Suppose in addition the \(a^d_i\) fulfill the Condition (14) above. Then we may let \(R^{\le \delta }\) be the space of all syzygies of type 3. where the coefficient \(r^{\delta -1}_i\) of the \(a^1_i\) vanish, and we still have the above identity (16).
Proof
Given a syzygy of degree \(\le \delta \)
If a term in \(\mathbf {s}\) is a product \(n \cdot t\) where t is the initial term of a syzygy \(\mathbf {s}^{\prime }\) in \(K^p\) or \(B^p\) with \(\deg (\tau ) + p \le \delta \), we replace \(\mathbf {s}\) by \(\mathbf {s}- \tau \cdot \mathbf {s}^{\prime }\). In this way we continue and in the end we get syzygy as in 3. This proves the identity (16) above.
Suppose now the Condition (14) is also fulfilled. Let the following relation be of Type 3.:
Let \(x_1 = {\text {in}}(a^1_1)\). Then no term of any other \(a^d_i\) contains \(x_1\) and also no \(r^{\delta -d}_i\) contains \(x_1\). But then the relation above is only possible if \(r^1_1 = 0\). In this way we may continue and get all \(r^1_i = 0\) except possibly if \({\text {in}}(a^1_j)\) is the constant 1 (in which case we must have i the last index \(\ell _1\)). But then by the reduction process using \(a^1_{\ell _1}\), none of the \(a^d_i\) for \(d \ge 2\) contains a term of degree \(<d\) and similarly no term of the \(r^{\delta -d}_j\) contains a term of degree \(<\delta -d\). But then in the relation
the left side has degree \(\le \delta -1\) while the right side has all terms of degree \(\delta \). Hence \(r^{\delta -1}_{\ell _1} = 0\). \(\square \)
We now present the algorithm to compute \(R^{\le \delta }\) under the assumption of Conditions (15) and (14).
ALGORITHM TO COMPUTE \(R^{\le \delta }\)
-
1.
Set \(KB_{in}^{\le 1}, R_{in}^{\le 1}\) equal to 0. Let \(\delta := 2\).
-
2.
Let \(KB_{in}^{\delta }\) consist of all pairs \((t,\delta )\) where t is the initial term of a Koszul syzygy in \(K^{\delta }\) or a Boolean syzygy in \(B^{\delta }\).
-
3.
\(KB_{in}^{\le \delta } = KB_{in}^{\le \delta -1} \cup KB_{in}^{\delta }\).
-
4.
If \(\delta = 2\) let \(R^2 = 0\). If \(\delta \ge 3\) then \(R^{\delta }\) consist of all syzygies
$$\begin{aligned} \mathbf {r}= \underset{\begin{matrix} d=2, \ldots , \delta \\ i = 1, \ldots , \ell _d \end{matrix}}{\sum } r^{\delta -d}_i\epsilon ^d_i \end{aligned}$$where \(r^{\delta -d}_i\) has degree \(\le \delta -d\) and no term of \(\mathbf {r}\) is a product of monomials \(\tau \cdot t\) where:
-
\((t,p) \in R_{in}^{\le \delta -1} \cup KB_{in}^{\le \delta -1}\) and \(\tau \) is a monomial such that \(\deg (\tau ) + p \le \delta \).
-
\(\tau = 1\) and \((t,\delta ) \in KB_{in}^{\delta }\)
-
-
5.
Perform Gaussian elimination on \(R^{\delta }\) and let \(R_{in}^{\delta }\) consists of all pairs \((t,\delta )\) where t is the initial term of a syzygy in \(R^{\delta }\).
-
6.
\(R_{in}^{\le \delta } = R_{in}^{\le \delta -1} \cup R_{in}^{\delta }\).
-
7.
If \(\delta \) is less than the stop bound then \(\delta :=\delta +1\) and go to 2.
As for the actual computation of the syzygies in Step 4, this can be done by taking the \(r^{\delta -d}_i\) to be linear combinations of the allowed terms (with unknown coefficients), and then solving a system of linear equations.
Proposition 27
With the algorithm above, then
Proof
This is clear by construction. \(\square \)
Our applications of Theorem 26 are typically for \(\delta = 1\) or 2 (This occurs for sets \(F^ 2, \ldots , F^d\) where \(d = 3\) or 4.). We are then interested in the syzygies \(S^{\le 2}\) and \(S^{\le 3}\). These are given as follows:
Rights and permissions
About this article
Cite this article
Greve, B., Ytrehus, Ø., Raddum, H. et al. Solving non-linear Boolean equation systems by variable elimination. AAECC 32, 3–47 (2021). https://doi.org/10.1007/s00200-019-00399-7
Received:
Revised:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s00200-019-00399-7