New recombination algorithms for bivariate polynomial factorization based on Hensel lifting

Lecerf, Grégoire

doi:10.1007/s00200-010-0121-5

Cited by 20 publications

(41 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The representation of multivariate polynomials is an important issue, which has been discussed from the early ages of computer algebra [Czapor et al 1992;Davenport et al 1987;van der Hoeven and Lecerf 2010;Johnson 1974;Monagan and Pearce 2007, 2010Stoutemyer 1984;Yan 1998]. …”

Section: Remarkmentioning

confidence: 99%

History of finite fields

2013

Handbook of Finite Fields

View full text Add to dashboard Cite

Section: Remarkmentioning

confidence: 99%

History of finite fields

2013

Handbook of Finite Fields

View full text Add to dashboard Cite

“…Since deg y (f ) > deg y (s 1 − s 0 ), the factor of Q with the highest degree in y is the one corresponding to I 1 . To factor efficiently the bivariate polynomial Q, we can use for instance the algorithm in [14].…”

Section: Remarkmentioning

confidence: 99%

Algebraic Cryptanalysis of the PKC’2009 Algebraic Surface Cryptosystem

Faugère

Spaenlehauer

2010

Public Key Cryptography – PKC 2010

View full text Add to dashboard Cite

Abstract. In this paper, we fully break the Algebraic Surface Cryptosystem (ASC for short) proposed at PKC'2009 [3]. This system is based on an unusual problem in multivariate cryptography: the Section Finding Problem. Given an algebraic surface X(x, y, t) ∈ Fp[x, y, t] such that deg xy X(x, y, t) = w, the question is to find a pair of polynomials of degree d, ux(t) and uy(t), such that X(ux(t), uy(t), t) = 0. In ASC, the public key is the surface, and the secret key is the section. This asymmetric encryption scheme enjoys reasonable sizes of the keys: for recommended parameters, the size of the secret key is only 102 bits and the size of the public key is 500 bits. In this paper, we propose a message recovery attack whose complexity is quasi-linear in the size of the secret key. The main idea of this algebraic attack is to decompose ideals deduced from the ciphertext in order to avoid to solve the section finding problem. Experimental results show that we can break the cipher for recommended parameters (the security level is 2 102 ) in 0.05 seconds. Furthermore, the attack still applies even when the secret key is very large (more than 10000 bits). The complexity of the attack is O(w 7 d log(p)) which is polynomial with respect to all security parameters. In particular, it is quasi-linear in the size of the secret key which is (2d + 2) log(p). This result is rather surprising since the algebraic attack is often more efficient than the legal decryption algorithm.

show abstract

“…The average time analysis of one such algorithm is provided by Gao and Lauder [7]: it is almost linear in the input size, which is O(N 2 ) if f has total degree N. Moreover, for fields F with at least 2mn + m + n + 1 elements, Lecerf [16] recently proposed a deterministic algorithm whose complexity in the worst case is of the order of (mn) (ω+1)/2 , ignoring logarithmic terms, plus the complexity of factoring a univariate polynomial with degree at most m + n, where (m, n) is the bidegree of f and ω ∈ (2, 3] is an appropriate constant. He also devised a probabilistic algorithm that, if F has at least 10mn elements, is expected to achieve the above complexity with ω = 2, ignoring the cost of random subset generation.…”

Section: Introductionmentioning

confidence: 99%

“…See also Chèze and Lecerf [5] for a detailed complexity analysis of this method. Moreover, Lecerf [16] presented deterministic and probabilistic algorithms to compute the factorization of bivariate polynomials over fields with arbitrary characteristic, but whose cardinality is larger than some precise lower bound.…”

Section: Introductionmentioning

confidence: 99%

A note on Gao’s algorithm for polynomial factorization

Hoppen

Rodrigues

Trevisan

2011

Theoretical Computer Science

View full text Add to dashboard Cite

a b s t r a c tShuhong Gao (2003) [6] has proposed an efficient algorithm to factor a bivariate polynomial f over a field F. This algorithm is based on a simple partial differential equation and depends on a crucial fact: the dimension of the polynomial solution space G associated with this differential equation is equal to the number r of absolutely irreducible factors of f . However, this holds only when the characteristic of F is either zero or sufficiently large in terms of the degree of f . In this paper we characterize a vector subspace of G for which the dimension is r, regardless of the characteristic of F, and the properties of Gao's construction hold. Moreover, we identify a second vector subspace of G that leads to an analogous theory for the rational factorization of f .

show abstract

New recombination algorithms for bivariate polynomial factorization based on Hensel lifting

Cited by 20 publications

References 32 publications

History of finite fields

History of finite fields

Algebraic Cryptanalysis of the PKC’2009 Algebraic Surface Cryptosystem

A note on Gao’s algorithm for polynomial factorization

Contact Info

Product

Resources

About