Solving Multivariate Polynomial Systems and an Invariant from Commutative Algebra

Abstract

The complexity of computing the solutions of a system of multivariate polynomial equations by means of Gröbner bases computations is upper bounded by a function of the solving degree. In this paper, we discuss how to rigorously estimate the solving degree of a system, focusing on systems arising within public-key cryptography. In particular, we show that it is upper bounded by, and often equal to, the Castelnuovo-Mumford regularity of the ideal generated by the homogenization of the equations of the system, or by the equations themselves in case they are homogeneous. We discuss the underlying commutative algebra and clarify under which assumptions the commonly used results hold. In particular, we discuss the assumption of being in generic coordinates (often required for bounds obtained following this type of approach) and prove that systems that contain the field equations or their fake Weil descent are in generic coordinates. We also compare the notion of solving degree with that of degree of regularity, which is commonly used in the literature. We complement the paper with some examples of bounds obtained following the strategy that we describe.

The complexity of solving Weil restriction systems

“…In § 2.1, we briefly recall the definitions of solving degree and degree of regularity. We limit ourselves to the basic notions necessary to define these two invariants and we refer to [CG21] for a more detailed exposition. In § 2.2, we recall the construction of Weil restriction and we present an algebraic proof of Weil's Theorem in the affine case.…”

“…Notice that the solving degree is still an upper bound on the degree in which the algorithms adopting this variation terminate. See also [CG21,Remark 6] for a more detailed discussion.…”

“…In this paper, we use results from [CG21] to produce upper bounds for the solving degree. Some of these results require the assumption that the system is in generic coordinates according to [BS87, Definition 1.5].…”

Solving degree, last fall degree, and related invariants

“…This motivated the introduction of several algebraic invariants related to the solving degree. The main ones are the first [9,8] and last fall degrees [15], the degree of regularity [2,1], and the Castelnuovo-Mumford regularity [4]. These invariants are routinely used within the cryptographic community in order to estimate the solving degree.…”

“…Several connections between these invariants, both heuristic and proven, are known. In [4] we have shown that, under suitable assumptions, the Castelnuovo-Mumford regularity of the homogenization of a system is an upper bound for its solving degree. In [14] the authors outlined an algorithm to compute the solution of a polynomial system and provided an upper bound on its complexity in terms of its last fall degree.…”