On the complexity of solving quadratic Boolean systems

  • Authors:
  • Magali Bardet;Jean-Charles FaugèRe;Bruno Salvy;Pierre-Jean Spaenlehauer

  • Affiliations:
  • íquipe Combinatoire et Algorithmes-Université de Rouen/LITIS, France;INRIA, Paris-Rocquencourt Center, POLSYS Project, France and CNRS, UMR 7606, LIP6, France and UPMC, Univ. Paris 06, LIP6 UFR Ingénierie 919, Case 169, 4, Place Jussieu, F-75252 Paris, France;INRIA, Paris-Rocquencourt Center, Algorithms Project, France;INRIA, Paris-Rocquencourt Center, POLSYS Project, France and CNRS, UMR 7606, LIP6, France and UPMC, Univ. Paris 06, LIP6 UFR Ingénierie 919, Case 169, 4, Place Jussieu, F-75252 Paris, France

  • Venue:
  • Journal of Complexity
  • Year:
  • 2013

Quantified Score

Hi-index 0.00

Visualization

Abstract

A fundamental problem in computer science is that of finding all the common zeros of m quadratic polynomials in n unknowns over F"2. The cryptanalysis of several modern ciphers reduces to this problem. Up to now, the best complexity bound was reached by an exhaustive search in 4log"2n2^n operations. We give an algorithm that reduces the problem to a combination of exhaustive search and sparse linear algebra. This algorithm has several variants depending on the method used for the linear algebra step. We show that, under precise algebraic assumptions on the input system, the deterministic variant of our algorithm has complexity bounded by O(2^0^.^8^4^1^n) when m=n, while a probabilistic variant of the Las Vegas type has expected complexity O(2^0^.^7^9^2^n). Experiments on random systems show that the algebraic assumptions are satisfied with probability very close to 1. We also give a rough estimate for the actual threshold between our method and exhaustive search, which is as low as 200, and thus very relevant for cryptographic applications.