The Degree of Regularity of HFE Systems

Abstract

Abstract. HFE is a public key scheme introduced by Patarin in 1996. An HFE public key is a large system of polynomials in many variables over a small finite field. This system results from some secret composition, based on which the owner can solve it to any arbitrary vector. While the security of the cryptosystem relies on the difficulty of solving the public system without the trapdoor information, in 2002 Faugère found experimentally that Gröbner basis computations perform much better on certain HFE instances than on random systems. More specifically, Faugère observed that the regular behaviour of the Gröbner basis computation collapses at a much lower degree than expected for random systems, letting the computation finish much earlier. Accounting for this distinctive property, Faugère and Joux showed in 2003 that mapping HFE systems to some other multivariate ring exhibits the particular algebraic structure of these systems. Nevertheless, they did not offer the actual computation of the degree of regularity of HFE systems. Later, in 2006, Granboulan, Joux and Stern showed an asymptotic upper bound on the degree of regularity of HFE systems over GF (2) using independent results on overdetermined systems of equations. The case of larger ground fields has remained however completely unsolved. In this paper, we exhibit an additional property of HFE systems that is increasingly significant as the size of the ground field grows. Using this property with a standard combinatorial calculation yields an arguably tight numerical bound on the degree of regularity of HFE systems for any parameters.

Inverting square systems algebraically is exponential

“…We will present the definition of degree of regularity as defined in [12] and and the main results in [12] [8]. Let…”

“…Putting all the above together we get the following important theorem. [8], inspired the work by [12], for the first time, there is a rigorous proof for the following much expected important theorem: Theorem 3.3. Let P be a quadratic operator of degree D. If Q-Rank(P ) > 1, the degree of regularity of the associated system is bounded by…”

“…Their rational is that when q is large the field equations X q 1 − X 2 , ..., X q n − X 1 cannot be used effectively and this limits the efficiency of the Gröbner basis algorithms, because one actually tries to solve the equations over the algebraic closure of the finite field. A breakthrough in case of general q came in the recent work of Dubois and Gama [12]. They first refined and gave a rigorous mathematical foundation for the arguments in [15].…”

“…Inspired by the work of [12], and using a similar idea to that used in [15] -roughly that one can bound the degree of regularity of a system by finding a bound for certain simpler subsystems, in [8], a new closed formula was found for the degree regularities for all HFE systems for any field. However this bound is derived using a very different approach.…”

“…We will first introduce briefly HFE and Square cryptosystems in the section below. In Section 3, we review the definition and basic properties of the degree of regularity from [12] [8]. In Section 4, we will prove and main theorem that degree of regularity of Square systems is indeed q and derive that the complexity of the Gröbner basis attacks on Square systems is indeed exponential.…”