On the first fall degree of summation polynomials

1 Introduction

Finding solutions to algebraic equations is a fundamental task. A common approach is a Gröbner basis computation via an algorithm such as Faugère’s F⁢4 and F⁢5 (see [4, 5]). In recent applications, Gröbner basis techniques have become relevant to the solution of the Elliptic Curve Discrete Logarithm Problem (ECDLP). Here one seeks solutions to polynomial equations arising from a Weil descent along Semaev’s summation polynomials [13] which represents a crucial step in an index calculus method for the ECDLP; see, e.g., [12, 14]. The efficiency of Gröbner basis algorithms is governed by a so-called degree of regularity, that is, the highest degree occurring along the subsequent computation of algebraic relations. It is widely believed that this often intractable complexity parameter is closely approximated by the degree of the first non-trivial algebraic relation, the first fall degree. In particular, the algorithms for the ECDLP of Petit and Quisquater [12] are sub-exponential under the assumption that this approximation is in o⁢(1).

In the present paper, we will improve Petit’s and Quisquater’s [12] first fall degree bound m2+1 for the system arising from the Weil descent along Semaev’s (m+1)-th summation polynomial. That is, we prove that a degree fall occurs at degree m2-m+1 by exhibiting the highest degree homogeneous part of that polynomial system. In fact, this degree is m2-m, so that we expect the bound to be sharp except for the somewhat pathological case m=2 that has been discussed by Kosters and Yeo [10]. This allows us to sharpen the asymptotic run time of the index calculus algorithm for the ECDLP as exhibited in the complexity analysis of Petit and Quisquater [12].

2 The first fall degree

The notion of the first fall has been described by Faugère and Joux [6, Section 5.1], Granboulan, Joux and Stern [7, Section 3], Dubois and Gama [3, Section 2.2] and Ding and Hodges [2, Section 3]. Although the concept of the first fall degree has been called minimal degree [6] and degree of regularity [2, 3, 7], we actually adopt the terminology and definition of Hodges, Petit and Schlather [8]. For readability reasons we include a brief and tailored account of the first fall degree and refer the reader to [8, Section 2] for details and greater generality.

Our considerations take place over a degree n extension 𝔽2n of the binary field 𝔽2. Consider the decomposition of the graded ring

into its homogeneous components

Each Sj is the 𝔽2n-vector space generated by the monomials of degree j. Let I be an ideal in S generated by homogeneous polynomials h1,…,hr∈Sd all of the same degree d. Then we have a surjective map

Without loss of generality we furthermore assume

Let ei denote the canonical i-th basis element of the free S-module Sr. The S-module U generated by the elements

is a subset of ker⁡(ϕ). If we restrict ϕ to the 𝔽2n-subvector space Sj-dr⊂Sr, we obtain a surjective map

whose kernel contains the 𝔽2n-subvector space Uj-d=U∩Sj-dr and hence factors through

Following [8], we now consider the ring of functions

as a finite-dimensional filtered algebra whose filtration components [A𝔽2n]d, d∈ℕ, are given by the polynomials up to degree d. The associated graded ring of A𝔽2n is

whose graded components

are given by the homogeneous polynomials of degree d. Any linear subspace V⊂[A𝔽2n]d induces a homogeneous linear subspace V¯⊂[Gr⁢(A𝔽2n)]d via the canonical projection πd:[A𝔽2n]d→[Gr⁢(A𝔽2n)]d.

3 Weil descent along summation polynomials

We prove that the first fall degree of the polynomial system that arises from a Weil descent along Semaev’s summation polynomial Sm+1 is bounded from above by m2-m+1. This is an improvement over m2+1 that results from [8, Theorem 5.2] and [12, Section 4]. Let us briefly introduce the summation polynomials and describe the Weil descent.

Semaev [13] introduced the m-th summation polynomial Sm⁢(x1,…,xm)∈𝕂⁢[x1,…,xm] on an elliptic curve E:y2=x3+a4⁢x+a6 over a finite field 𝕂 with char⁢(𝕂)≠2,3 by the following defining property: for elements x1,…,xm in the algebraic closure 𝕂¯ one has Sm⁢(x1,…,xm)=0 if and only if there exist y1,…,ym∈𝕂¯ such that (x1,y1),…,(xm,ym)∈E⁢(K¯) and (x1,y1)+⋯+(xm,ym)=0 on E. Semaev gave a recursive formula based on resultants to compute those polynomials and described some properties [13, Theorem 1]. The summation polynomials can also be given in characteristic 2. We consider 𝕂=𝔽2n, an ordinary, i.e. non-singular, elliptic curve E:y2+x⁢y=x3+a2⁢x2+a6, and the projection to the x-coordinate x⁢(Pi)=x⁢(xi,yi)=xi of Pi∈E. Then still

and from Diem’s general description [1, Lemma 3.4, Lemma 3.5] one can deduce

and the degree of Sm+1 in each variable xi is 2m-1. Note that these formulas have also been outlined by Petit and Quisquater [12, Section 5] who also refer to Diem [1].

To describe the Weil descent along those summation polynomials (see, e.g., [12, Section 4]) we fix a basis 1,z,…,zn-1 of 𝔽2n over 𝔽2 and let W be a subvector space in 𝔽2n of dimension n′ and basis ν1,…,νn′ over 𝔽2. We introduce m⁢n′ variables yi⁢j that model the linear constraints

set xm+1 to an arbitrary element c∈𝔽2n, and obtain the equation system

The first fall degree of interest is that of the reduced polynomial system

Note that s0,…,sn-1∈𝔽2⁢[y11,…,ym⁢n′]/(y112-y11,…,ym⁢n′2-ym⁢n′).

By the definition of the first fall degree, we are interested in the highest degree homogeneous part of s0,…,sn-1 whose degree can be determined as follows.

We are ready to prove the main result.

4 Experiments and conclusion

In the light of the first fall degree bound given in Theorem 3.2, we computed a Gröbner basis for the ideal resulting from the Weil descent along the summation polynomial Sm+1⁢(x1,…,xm,xm+1) for m=2,3,4 on an AMD Opteron CPU with Magma’s GroebnerBasis() function. Again, we set the verbose level to 1 and extracted the empirical first fall degree Df⁢f as the step degree of the first step where new lower degree (i.e. less than step degree) polynomials are added. The empirical degree of regularity Dreg is the highest step degree that appears during the Gröbner basis computation. In each experiment we chose a random non-singular elliptic curve over 𝔽2n, a random subvector space of dimension n′=⌈n/m⌉ as the factor basis, and set xm+1 to the x-coordinate of a random point on the curve. The experimental results that extend the ones present in the literature by Petit and Quisquater [12] and Kosters and Yeo [10] are displayed in Table 1.

Like Kosters and Yeo [10, Section 5], we observed a raise in the regularity degree for m=2 in our experiments and were able to verify their observation that with the low degree polynomials W=span⁡{1,z,…,zn′} chosen as the factor basis (cf. [14, Section 4.5]) the raise in the regularity degree was produced for slightly greater n=45. It would be very interesting to observe a raise in the degree of regularity for higher Semaev polynomials, but time and memory amounts become a serious issue for m≥3. However, such observations might neither falsify [12, Assumption 2] that Dreg=Df⁢f+o⁢(1) nor lead to further evidence that the gap between the degree of regularity and the first fall degree depends on n as discussed in [9, Section 5.2].

However, we believe our first fall degree bound m2-m+1 for Semaev polynomials to be sharp for m≥3, and rephrase [12, Assumption 2] as the following question:

Note that our upper bound on the first fall degree of summation polynomials is a first step towards answering this question. The first fall degree generically bounds the degree of regularity from below. Hence, any further lower bound on the degree of regularity associated to the specific case of a Weil descent along summation polynomials can potentially answer (4.1).

Assuming an affirmative answer to (4.1), we can furthermore sharpen the asymptotic complexity of the index calculus algorithm for the ECDLP as presented by Petit and Quisquater [12, Section 5]. In the paragraph A new complexity analysis of [12, Section 5] it is argued that the complexity of the index calculus approach via summation polynomials is dominated by the Gröbner basis computation. Under the assumption that the degree of regularity is approximated closely by the first fall degree [12, Assumption 2], Petit and Quisquater derive [12, Proposition 4], i.e. that the discrete logarithm can asymptotically be solved in sub-exponential time

where c=2⁢ω3, ω is the linear algebra constant (ω=log⁡(7)/log⁡(2) is used in the following estimates), and n2/3+1 is an upper bound for the first fall degree of the m-th summation polynomial when m=n1/3 [12, Proposition 1]. They state that, by following this analysis, the index calculus approach beats generic algorithms with run time 𝒪⁢(2n/2) for any n≥N where N is an integer approximately equal to 2 000. Now, based on Theorem 3.2, we assume Dreg≈m2-m+1=n2/3-n1/3+1 and sharpen (4.2) to