Skip to main content
Log in

Solving non-linear Boolean equation systems by variable elimination

  • Original Paper
  • Published:
Applicable Algebra in Engineering, Communication and Computing Aims and scope

Abstract

In this paper we study Boolean equation systems, and how to eliminate variables from them while bounding the degree of polynomials produced. A procedure for variable elimination is introduced, and we relate the techniques to Gröbner bases and XL methods. We prove that by increasing the degree of the polynomials in the system by one for each variable eliminated, we preserve the solution space, provided that the system satisfies a particular condition. We then estimate how many variables we need to eliminate in order to solve the resulting system by re-linearization, and show that we get complexities lower than the trivial brute-force \(\mathcal {O}(2^n)\) when the system is overdetermined.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6

Similar content being viewed by others

References

  1. Zajac, P.: Upper bounds on the complexity of algebraic cryptanalysis of ciphers with a low multiplicative complexity. Des. Codes Cryptogr. 82(1–2), 43–56 (2017)

    Article  MathSciNet  Google Scholar 

  2. Shamir, A., Patarin, J., Courtois, N., Klimov, A.: Efficient Algorithms for Solving Overdefined Systems of Multivariate Polynomial Equations. In: Eurocrypt’2000, LNCS 1807, pp. 392–407, Springer (2000)

  3. Courtois, N.T., Pieprzyk, J.: Cryptanalysis of block ciphers with overdefined systems of equations. In: Advances in Cryptology—ASIACRYPT 2002. ASIACRYPT 2002. Lecture Notes in Computer Science, vol. 2501, pp. 267 – 287. Springer, Berlin (2002)

  4. Faugere, J.-C.: A new efficient algorithm for computing Gröbner bases (F4). Effective methods in algebraic geometry (Saint-Malo, 1998). J. Pure Appl. Algebra 139, 61–88 (1999)

    Article  MathSciNet  Google Scholar 

  5. Kandri-Rody, A., Kapur, D., Narendran, P., An ideal-theoretic approach to word problems and unification problems over finitely presented commutative algebras. In: Jouannaud J.P. (eds.), Rewriting Techniques and Applications. RTA. Lecture Notes in Computer Science, vol 202. Springer, Berlin (1985)

  6. Sakai, K., Sato, Y.: Boolean Gröbner bases, ICOT Technical Momorandum 488 (1988). http://www.jipdec.or.jp/archives/icot/ARCHIVE/Museum/TRTM/tm0488.htm. Accessed 15 Sept 2017

  7. Decker, W., Greuel, G.-M., Pfister, G., Schönemann, H.: Singular 3-1-2—a computer algebra system for polynomial computations (2010). http://www.singular.uni-kl.de/. Accessed 4 Oct 2017

  8. Brickenstein, M., Dreyer, A.: A framework for Gröbner-basis computations with Boolean polynomials. J. Symbol. Comput. 44(9), 1326–1345 (2009)

    Article  Google Scholar 

  9. Horácek, J., Kreuzer, M., Ekossono, A.S.M.: Computing Boolean border bases. In: 2016 18th international symposium on symbolic and numeric algorithms for scientific computing (SYNASC), pp. 465–472. IEEE (2016)

  10. Lokshtanov, D., Paturi, R., Tamaki, S., Williams, R., Yu, H.: Beating brute force for systems of polynomial equations over finite fields. In: The 27th ACM-SIAM Symposium on Discrete Algorithms (SODA) (2017)

  11. Smolensky, R.: Algebraic methods in the theory of lower bounds for Boolean circuit complexity. In: Proceedings of the 19th Annual ACM Symposium on Theory of Computing (STOC), pp. 77–82 (1987)

  12. Chan, T.M., Williams, R.: Deterministic APSP, orthogonal vectors, and more: quickly derandomizing Razborov–Smolensky. In: Proceedings of the 27th Annual ACM-SIAM Symposium on Discrete Algorithms (SODA), pp. 1246–1255 (2016)

  13. Lazard, D.: Gaussian elimination and resolution of systems of algebraic equations. In: Proceedings of EUROCAL 1983, volume 162 of LNCS, pp. 146-157 (1983)

  14. Giusti, M.: Some effectivity problems in polynomial ideal theory. In: Proceedings of International Symposium on Symbolic and Algebraic Computation EUROSAM 84, Cambridge (England), volume 174 of LNCS, pp. 159–171. Springer (1994)

  15. Bardet, M., Faugere, J.-C., Salvy, B.: Complexity of Gröbner basis computation for semiregular overdetermined sequences over \(\mathbb{F}_2\) with solutions in \(\mathbb{F}_2\), rapport de recherche 5049. Institut National de Recherche en Informatique et en Automatique, Lorraine (2003)

  16. Bardet, M., Faugere, J.-C., Salvy, B., Yang, B.-Y.: Asymptotic behaviour of the degree of regularity of semi-regular polynomial systems. Presented at MEGA’05, Eighth International Symposium on Effective Methods in Algebraic Geometry (2005)

  17. Bouillaguet, C., Chen, H.-C., Cheng, C.-M., Chou, T., Niederhagen, R., Shamir, A., Yang, B.-Y.: Fast exhaustive search for polynomial systems in \(\mathbb{F}_2\). In: Cryptographic Hardware and Embedded Systems—CHES 2010. 12th International Workshop, Santa Barbara, USA, August 17–20, 2010. Proceedings, pp. 203–218. Springer, Berlin (2010)

  18. Bardet, M., Faugere, J.-C., Salvy, B., Spaenlehauer, P.-J.: On the complexity of solving quadratic Boolean systems. J. Compl. 29(1), 53–75 (2013)

    Article  MathSciNet  Google Scholar 

  19. Joux, A., Vitse, V.: A crossbred algorithm for solving Boolean polynomial systems, Cryptology ePrint Archive, Report 2017/372 (2017). https://eprint.iacr.org/2017/372. Accessed 23 Mar 2019

  20. Rosen, K.H.: Handbook of Discrete and Combinatorial Mathematics. The Series Discrete Mathematics and Its Applications. Taylor & Francis, London (1999)

    Book  Google Scholar 

  21. Cox, D., Little, J., O’Shea, D.: Ideals, Varieties and Algorithms, 3rd edn. Springer, Berlin (2007)

    Book  Google Scholar 

  22. Cox, D., Little, J., O’Shea, D.: Using Algebraic Geometry GTM 185. Springer, Berlin (2005)

    MATH  Google Scholar 

  23. Sala, M., Mora, T., Perret, L., Sakata, S., Traverso, C.: Gröbner Bases, Coding and Cryptography. Springer, New York (2009)

    Book  Google Scholar 

  24. Faugere, J-C.: A new efficient algorithm for computing Gröbner bases without reduction to zero (F5). In: Proceedings of the 2002 International Symposium on Symbolic and Algebraic Computation, pp. 75–83. ACM, New York (2002)

  25. Stegers, T.: Faugere’s F5 Algorithm Revisited, Thesis For The Degree Of Diplom-Mathematiker, Department of Mathematics, Technische Universität Darmstadt, 2005. http://sciencedocbox.com/Physics/68613748-Faugere-s-f5-algorithm-revisited.html

  26. Rosen, Kenneth H.: Handbook of Discrete and Combinatorial Mathematics, 2nd edn. CRC Press, Boca Raton (2017)

    Google Scholar 

  27. Raddum, H., Rønjom, S.: On the Number of Linearly Independent Equations Generated by XL, Sequences and Their Applications (SETA) 2008, LNCS 5203. Springer, pp. 239–251 (2008)

  28. Yang, B.-Y., Chen, J.-M.: Theoretical analysis of XL over small fields. In: Australasian Conference on Information Security and Privacy (ACISP) 2004, LNCS 3108. Springer, pp. 277–288 (2004)

Download references

Acknowledgements

We would like to thank the anonymous reviewers for helpful comments.

Author information

Authors and Affiliations

Authors

Corresponding author

Correspondence to Håvard Raddum.

Additional information

Publisher's Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Appendix: syzygies between polynomials of degrees \(\ge 2\)

Appendix: syzygies between polynomials of degrees \(\ge 2\)

When the degree of some \(a_i\)’s are greater than 1, there may be other syzygies that are not generated by the Koszul and Boolean syzygies. Let \(a^1_1, \ldots a^1_{\ell _1}\) be polynomials of degree \(\le 1\). By suitable Gaussian elimination we may assume the initial terms are such that:

$$\begin{aligned} {\text {in}}(a^1_1)> {\text {in}}(a^1_2)> \cdots > {\text {in}}(a^1_{\ell _1}). \end{aligned}$$
(13)

Let \(a^d_1, \ldots , a^d_{\ell _d}\) be polynomials of degree \(\le d\). We perform reduction operations as follows: If a term of \(a^d_i\) is of the form \(t \cdot {\text {in}}(a^1_j)\) where t is a monomial of degree \(\le d-1\), we replace \(a^d_i\) by \(a^d_i - t \cdot a^1_j\). We then eventually get:

$$\begin{aligned} \text {No term of}\ a^d_i\ \text {is}\ t \cdot {\text {in}}(a^1_j)\ \text {where} \ t\ \text {is a monomial of degree}\ \le d-1. \end{aligned}$$
(14)

Secondly we may perform Gaussian elimination on the \(a^d_i\) such that:

$$\begin{aligned} {\text {in}}(a^d_1)> {\text {in}}(a^d_2)> \cdots > {\text {in}}(a^d_{\ell _d}). \end{aligned}$$
(15)

Suppose we have given \(a^d_i\) as above for each \(1 \le d \le D\) and \(i = 1, \ldots , \ell _d\). Let

$$\begin{aligned} \mathbb {B}^L = \mathbb {B}^{\ell _1} \oplus \cdots \oplus \mathbb {B}^{\ell _D} \end{aligned}$$

where \(\mathbb {B}^{\ell _d} = \mathbb {B}\epsilon ^d_1 \oplus \cdots \oplus \mathbb {B}\epsilon ^d_{\ell _d}\) and we set \(\epsilon ^d_j\) to have degree d. There is a map

$$\begin{aligned} \mathbb {B}^L \rightarrow \mathbb {B}, \quad \epsilon ^d_i \mapsto a^d_i \end{aligned}$$

and the syzygy module \(S \subseteq \mathbb {B}^L\) is the kernel of this map.

Suppose now we have a total order on the terms of \(\mathbb {B}\). We make a term order on \(\mathbb {B}^L\) by letting terms \(s \epsilon ^e_j < t \epsilon ^d_i\) if:

  • \(e < d\), or

  • \(e = d\) and \(j < i\), or

  • \(e = d, j = i\) and \(s < t\)

Theorem 26

Given polynomials \(a^d_i\) of degree \(\le d\), for each \(1 \le d \le D\) and suppose for each d they fulfill Condition (15) above. The following syzygies may exist:

  1. 1.

    Koszul syzygies \(a^d_j \epsilon ^e_k + a^e_k \epsilon ^d_j\) where \(e < d\) or \(e = d\) and \(k < j\). For given sum \(d+e\) denote by \(K^{d+e}\) the linear space these syzygies generate.

  2. 2.

    Boolean syzygies \((a^d_j + 1) \epsilon ^d_j\). For given d denote by \(B^{2d}\) the linear space these syzygies generate.

  3. 3.

    For each \(\delta \ge 2\) syzygies

    $$\begin{aligned} \mathbf {r}= \underset{\begin{matrix} d = 1, \ldots , \delta \\ i = 1, \ldots , \ell _d \end{matrix}}{\sum } r^{\delta -d}_i \epsilon ^d_i \end{aligned}$$

    where \(r^{\delta -d}_i\) has degree \(\le \delta -d\) and no term of \(\mathbf {r}\) is \(\tau \cdot t\) where t is the initial term of a syzygy in \(K^e\) or \(B^e\) and \(\deg (\tau ) + e \le \delta \).

For a given \(\delta \) in 3., denote by \(R^{\le \delta }\) the linear space of such syzygies.

  1. a.

    Then for \(\delta \ge 2\) we have:

    $$\begin{aligned} S^{\le \delta } = \sum _{d = 2}^{\delta } S^{\le \delta -d} K^d +\sum _{d = 2}^{\delta } S^{\le \delta -d}B^d + R^{\le \delta }. \end{aligned}$$
    (16)
  2. b.

    Suppose in addition the \(a^d_i\) fulfill the Condition (14) above. Then we may let \(R^{\le \delta }\) be the space of all syzygies of type 3. where the coefficient \(r^{\delta -1}_i\) of the \(a^1_i\) vanish, and we still have the above identity (16).

Proof

Given a syzygy of degree \(\le \delta \)

$$\begin{aligned} \mathbf {s}= \underset{\begin{matrix} d = 1, \ldots , \delta \\ i = 1,\ldots , \ell _d \end{matrix}}{\sum } s^{\delta -d}_i\epsilon ^d_i. \end{aligned}$$

If a term in \(\mathbf {s}\) is a product \(n \cdot t\) where t is the initial term of a syzygy \(\mathbf {s}^{\prime }\) in \(K^p\) or \(B^p\) with \(\deg (\tau ) + p \le \delta \), we replace \(\mathbf {s}\) by \(\mathbf {s}- \tau \cdot \mathbf {s}^{\prime }\). In this way we continue and in the end we get syzygy as in 3. This proves the identity (16) above.

Suppose now the Condition (14) is also fulfilled. Let the following relation be of Type 3.:

$$\begin{aligned} \sum _{i = 1}^{\ell _1} r^{\delta -1}_i a^1_i + \underset{\begin{matrix} d = 2,\ldots , \delta \\ i = 1, \ldots , \ell _d \end{matrix}}{\sum } r^{\delta -d}_i \epsilon ^d_i. \end{aligned}$$

Let \(x_1 = {\text {in}}(a^1_1)\). Then no term of any other \(a^d_i\) contains \(x_1\) and also no \(r^{\delta -d}_i\) contains \(x_1\). But then the relation above is only possible if \(r^1_1 = 0\). In this way we may continue and get all \(r^1_i = 0\) except possibly if \({\text {in}}(a^1_j)\) is the constant 1 (in which case we must have i the last index \(\ell _1\)). But then by the reduction process using \(a^1_{\ell _1}\), none of the \(a^d_i\) for \(d \ge 2\) contains a term of degree \(<d\) and similarly no term of the \(r^{\delta -d}_j\) contains a term of degree \(<\delta -d\). But then in the relation

$$\begin{aligned} r^{\delta -1}_{\ell _1} \cdot 1 + \underset{\begin{matrix} d=2, \ldots , \delta \\ i = 1, \ldots , \ell _d \end{matrix}}{\sum } r^{\delta -d}_i a^d_i, \end{aligned}$$

the left side has degree \(\le \delta -1\) while the right side has all terms of degree \(\delta \). Hence \(r^{\delta -1}_{\ell _1} = 0\). \(\square \)

We now present the algorithm to compute \(R^{\le \delta }\) under the assumption of Conditions (15) and (14).

ALGORITHM TO COMPUTE \(R^{\le \delta }\)

  1. 1.

    Set \(KB_{in}^{\le 1}, R_{in}^{\le 1}\) equal to 0. Let \(\delta := 2\).

  2. 2.

    Let \(KB_{in}^{\delta }\) consist of all pairs \((t,\delta )\) where t is the initial term of a Koszul syzygy in \(K^{\delta }\) or a Boolean syzygy in \(B^{\delta }\).

  3. 3.

    \(KB_{in}^{\le \delta } = KB_{in}^{\le \delta -1} \cup KB_{in}^{\delta }\).

  4. 4.

    If \(\delta = 2\) let \(R^2 = 0\). If \(\delta \ge 3\) then \(R^{\delta }\) consist of all syzygies

    $$\begin{aligned} \mathbf {r}= \underset{\begin{matrix} d=2, \ldots , \delta \\ i = 1, \ldots , \ell _d \end{matrix}}{\sum } r^{\delta -d}_i\epsilon ^d_i \end{aligned}$$

    where \(r^{\delta -d}_i\) has degree \(\le \delta -d\) and no term of \(\mathbf {r}\) is a product of monomials \(\tau \cdot t\) where:

    • \((t,p) \in R_{in}^{\le \delta -1} \cup KB_{in}^{\le \delta -1}\) and \(\tau \) is a monomial such that \(\deg (\tau ) + p \le \delta \).

    • \(\tau = 1\) and \((t,\delta ) \in KB_{in}^{\delta }\)

  5. 5.

    Perform Gaussian elimination on \(R^{\delta }\) and let \(R_{in}^{\delta }\) consists of all pairs \((t,\delta )\) where t is the initial term of a syzygy in \(R^{\delta }\).

  6. 6.

    \(R_{in}^{\le \delta } = R_{in}^{\le \delta -1} \cup R_{in}^{\delta }\).

  7. 7.

    If \(\delta \) is less than the stop bound then \(\delta :=\delta +1\) and go to 2.

As for the actual computation of the syzygies in Step 4, this can be done by taking the \(r^{\delta -d}_i\) to be linear combinations of the allowed terms (with unknown coefficients), and then solving a system of linear equations.

Proposition 27

With the algorithm above, then

$$\begin{aligned} R^{\le \delta } = \sum _{d \ge 3} S^{\le \delta -d}R^d. \end{aligned}$$

Proof

This is clear by construction. \(\square \)

Our applications of Theorem 26 are typically for \(\delta = 1\) or 2 (This occurs for sets \(F^ 2, \ldots , F^d\) where \(d = 3\) or 4.). We are then interested in the syzygies \(S^{\le 2}\) and \(S^{\le 3}\). These are given as follows:

$$\begin{aligned} S^{\le 2}= & {} K_2 + B_2 \\ {S^{\le 3} }= & {} \langle L^1\rangle K_2 + K_3 +\langle L^1\rangle B_2 + R^3. \end{aligned}$$

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Greve, B., Ytrehus, Ø., Raddum, H. et al. Solving non-linear Boolean equation systems by variable elimination. AAECC 32, 3–47 (2021). https://doi.org/10.1007/s00200-019-00399-7

Download citation

  • Received:

  • Revised:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s00200-019-00399-7

Keywords

Navigation