Computing Loci of Rank Defects of Linear Matrices using ... · PDF file 2/13 PJ Spaenlehauer....

Click here to load reader

  • date post

    14-Jul-2020
  • Category

    Documents

  • view

    0
  • download

    0

Embed Size (px)

Transcript of Computing Loci of Rank Defects of Linear Matrices using ... · PDF file 2/13 PJ Spaenlehauer....

  • Computing Loci of Rank Defects of Linear Matrices

    using Gröbner Bases and Applications to Cryptology

    Jean�Charles Faugère Mohab Safey El Din Pierre�Jean Spaenlehauer

    UPMC � CNRS � INRIA Paris - Rocquencourt LIP6 � SALSA team

    ISSAC 2010 July 28, 2010

    1/13 PJ Spaenlehauer

  • The MinRank problem

    r ∈ N. M0, . . . ,Mk : k + 1 matrices of size m ×m.

    MinRank

    �nd λ1, . . . , λk such that

    Rank

    ( M0 −

    k∑ i=1

    λiMi

    ) ≤ r .

    Multivariate generalization of the EigenValue problem.

    Applications in cryptology, coding theory, geometry, ... Kipnis/Shamir Crypto'99 Faugère/Levy-dit-Vehel/Perret Crypto'08,...

    Fundamental NP-hard problem of linear algebra.

    Buss, Frandsen, Shallit. J. of Computer and System Sciences. 1999. The computational complexity of some problems of linear algebra.

    2/13 PJ Spaenlehauer

  • Two algebraic modelings

    M = M0 − ∑k

    i=1 λiMi .

    The minors modeling

    Rank(M) ≤ r m

    all minors of size (r + 1) of M vanish.

    ` m

    r+1

    ´2 equations of degree r + 1.

    k variables.

    Few variables, lots of equations, high

    degree !!

    The Kipnis-Shamir modeling

    Rank(M) ≤ r ⇔ ∃x(1), . . . , x(m−r) ∈ Ker(M).

    M ·

    [email protected]

    Im−r

    x (1) 1 . . . x

    (m−r) 1

    ... ...

    ...

    x (1) r . . . x

    (m−r) r

    1CCCCCCCA = 0.

    m(m − r) bilinear equations. k + r(m − r) variables.

    Complexity of solving MinRank using Gröbner bases techniques ?

    Comparison of the two modelings ?

    Number of solutions ?

    3/13 PJ Spaenlehauer

  • Two algebraic modelings

    M = M0 − ∑k

    i=1 λiMi .

    The minors modeling

    Rank(M) ≤ r m

    all minors of size (r + 1) of M vanish.

    ` m

    r+1

    ´2 equations of degree r + 1.

    k variables.

    Few variables, lots of equations, high

    degree !!

    The Kipnis-Shamir modeling

    Rank(M) ≤ r ⇔ ∃x(1), . . . , x(m−r) ∈ Ker(M).

    M ·

    [email protected]

    Im−r

    x (1) 1 . . . x

    (m−r) 1

    ... ...

    ...

    x (1) r . . . x

    (m−r) r

    1CCCCCCCA = 0.

    m(m − r) bilinear equations. k + r(m − r) variables.

    Complexity of solving MinRank using Gröbner bases techniques ?

    Comparison of the two modelings ?

    Number of solutions ?

    3/13 PJ Spaenlehauer

  • Two algebraic modelings

    M = M0 − ∑k

    i=1 λiMi .

    The minors modeling

    Rank(M) ≤ r m

    all minors of size (r + 1) of M vanish.

    ` m

    r+1

    ´2 equations of degree r + 1.

    k variables.

    Few variables, lots of equations, high

    degree !!

    The Kipnis-Shamir modeling

    Rank(M) ≤ r ⇔ ∃x(1), . . . , x(m−r) ∈ Ker(M).

    M ·

    [email protected]

    Im−r

    x (1) 1 . . . x

    (m−r) 1

    ... ...

    ...

    x (1) r . . . x

    (m−r) r

    1CCCCCCCA = 0.

    m(m − r) bilinear equations. k + r(m − r) variables.

    Complexity of solving MinRank using Gröbner bases techniques ?

    Comparison of the two modelings ?

    Number of solutions ?

    3/13 PJ Spaenlehauer

  • Two algebraic modelings

    M = M0 − ∑k

    i=1 λiMi .

    The minors modeling

    Rank(M) ≤ r m

    all minors of size (r + 1) of M vanish.

    ` m

    r+1

    ´2 equations of degree r + 1.

    k variables.

    Few variables, lots of equations, high

    degree !!

    The Kipnis-Shamir modeling

    Rank(M) ≤ r ⇔ ∃x(1), . . . , x(m−r) ∈ Ker(M).

    M ·

    [email protected]

    Im−r

    x (1) 1 . . . x

    (m−r) 1

    ... ...

    ...

    x (1) r . . . x

    (m−r) r

    1CCCCCCCA = 0.

    m(m − r) bilinear equations. k + r(m − r) variables.

    Complexity of solving MinRank using Gröbner bases techniques ?

    Comparison of the two modelings ?

    Number of solutions ?

    3/13 PJ Spaenlehauer

  • Main results

    System −→ grevlex GB −→ Change of ordering

    lex GB.

    Complexity O

    „“n + dreg dreg

    ”ω« O (n ·#Solω)

    m: size of the matrices, k: number of matrices, r: target rank. k = (m− r)2.

    Minors Kipnis-Shamir Degree of regularity

    when k = (m − r)2

    New

    r(m− r) + 1 New

    old

    dreg ≤ m(m − r) + 1

    # Sol

    New

    old

    <

    m

    r

    !m−r Complexity

    O(mωk) O(mω(k+1))

    Both modelings → polynomial complexity when k = (m− r)2 is �xed. New Crypto challenge broken: 10 generic matrices of size 11× 11

    target rank 8, K = GF(65521).

    4/13 PJ Spaenlehauer

  • Main results

    System −→ grevlex GB −→ Change of ordering

    lex GB.

    Complexity O

    „“n + dreg dreg

    ”ω« O (n ·#Solω)

    m: size of the matrices, k: number of matrices, r: target rank. k = (m− r)2.

    Minors Kipnis-Shamir Degree of regularity

    when k = (m − r)2

    New

    r(m− r) + 1 New

    old

    dreg ≤ m(m − r) + 1

    # Sol

    New

    old

    <

    m

    r

    !m−r Complexity

    O(mωk) O(mω(k+1))

    Both modelings → polynomial complexity when k = (m− r)2 is �xed. New Crypto challenge broken: 10 generic matrices of size 11× 11

    target rank 8, K = GF(65521).

    4/13 PJ Spaenlehauer

  • Main results

    System −→ grevlex GB −→ Change of ordering

    lex GB.

    Complexity O

    „“n + dreg dreg

    ”ω« O (n ·#Solω)

    m: size of the matrices, k: number of matrices, r: target rank. k = (m− r)2.

    Minors Kipnis-Shamir Degree of regularity

    when k = (m − r)2 New

    r(m− r) + 1 New old

    dreg ≤(m− r)2 + 1�m(m − r) + 1

    # Sol

    New old m−r−1Y i=0

    i!(m + i)!

    (m− 1− i)!(m− r + i)!<

    m

    r

    !m−r Complexity

    O(mωk) O(mω(k+1))

    Both modelings → polynomial complexity when k = (m− r)2 is �xed. New Crypto challenge broken: 10 generic matrices of size 11× 11

    target rank 8, K = GF(65521).

    4/13 PJ Spaenlehauer

  • Main results

    System −→ grevlex GB −→ Change of ordering

    lex GB.

    Complexity O

    „“n + dreg dreg

    ”ω« O (n ·#Solω)

    m: size of the matrices, k: number of matrices, r: target rank. k = (m− r)2.

    Minors Kipnis-Shamir Degree of regularity

    when k = (m − r)2 New

    r(m− r) + 1 New old

    dreg ≤(m− r)2 + 1�m(m − r) + 1

    # Sol

    New old m−r−1Y i=0

    i!(m + i)!

    (m− 1− i)!(m− r + i)!<

    m

    r

    !m−r Complexity O(mωk) O(mω(k+1))

    Both modelings → polynomial complexity when k = (m− r)2 is �xed. New Crypto challenge broken: 10 generic matrices of size 11× 11

    target rank 8, K = GF(65521).

    4/13 PJ Spaenlehauer

  • Main results

    System −→ grevlex GB −→ Change of ordering

    lex GB.

    Complexity O

    „“n + dreg dreg

    ”ω« O (n ·#Solω)

    m: size of the matrices, k: number of matrices, r: target rank. k = (m− r)2.

    Minors Kipnis-Shamir Degree of regularity

    when k = (m − r)2 New

    r(m− r) + 1 New old

    dreg ≤(m− r)2 + 1�m(m − r) + 1

    # Sol

    New old m−r−1Y i=0

    i!(m + i)!

    (m− 1− i)!(m− r + i)!<

    m

    r

    !m−r Complexity O(mωk) O(mω(k+1))

    Both modelings → polynomial complexity when k = (m− r)2 is �xed. New Crypto challenge broken: 10 generic matrices of size 11× 11

    target rank 8, K = GF(65521).

    4/13 PJ Spaenlehauer

  • Gröbner bases of bilinear systems

    Faugère/Safey/S. Gröbner bases of bihomogeneous ideals generated by polynomials of bidegree (1,1): Algorithms and Complexity. arXiv:1001.4004

    Theorem

    For a generic a�ne 0-dimensional bilinear system over K[x1, . . . , xnx , y1, . . . , yny ],

    dreg ≤ min(nx , ny ) + 1.

    Sharp bound in practice !

    Asymptotic complexity

    Assumption: KS systems behave like generic a�ne bilinear systems. When k = (m − r)2 is �xed, the complexity of the Gröbner basis computation of the Kipnis-Shamir modeling is

    O

    (( 2k + m(m − r) + 1

    (m − r)2 + 1

    )ω) =

    m→∞ O

    ( m

    ω(k+1) ) .

    5/13 PJ Spaenlehauer

  • Gröbner bases of bilinear systems

    Faugère/Safey/S. Gröbner bases of bihomogeneous ideals generated by polynomials of bidegree (1,1): Algorithms and Complexity. arXiv:1001.4004

    Theorem

    For a generic a�ne 0-dimensional bilinear system over K[x1, . . . , xnx , y1, . . . , yny ],

    dreg ≤ min(nx , ny ) + 1.

    Sharp bound in practice !

    Asymptotic complexity

    Assumption: KS systems behave like generic a�ne bilinear systems. When k = (m − r)2 is �xed, the complexity of the Gröbner basis computation of the Kipnis-Shamir modeling is

    O

    (( 2k + m(m − r) + 1

    (m − r)2 + 1

    )ω) =

    m→∞ O

    ( m

    ω(