Results 1  10
of
208
Noncommutative Elimination in Ore Algebras Proves Multivariate Identities
 J. SYMBOLIC COMPUT
, 1996
"... ... In this article, we develop a theory of @finite sequences and functions which provides a unified framework to express algorithms proving and discovering multivariate identities. This approach is vindicated by an implementation. ..."
Abstract

Cited by 109 (13 self)
 Add to MetaCart
... In this article, we develop a theory of @finite sequences and functions which provides a unified framework to express algorithms proving and discovering multivariate identities. This approach is vindicated by an implementation.
A Gröbner free alternative for polynomial system solving
 Journal of Complexity
, 2001
"... Given a system of polynomial equations and inequations with coefficients in the field of rational numbers, we show how to compute a geometric resolution of the set of common roots of the system over the field of complex numbers. A geometric resolution consists of a primitive element of the algebraic ..."
Abstract

Cited by 109 (19 self)
 Add to MetaCart
(Show Context)
Given a system of polynomial equations and inequations with coefficients in the field of rational numbers, we show how to compute a geometric resolution of the set of common roots of the system over the field of complex numbers. A geometric resolution consists of a primitive element of the algebraic extension defined by the set of roots, its minimal polynomial and the parametrizations of the coordinates. Such a representation of the solutions has a long history which goes back to Leopold Kronecker and has been revisited many times in computer algebra. We introduce a new generation of probabilistic algorithms where all the computations use only univariate or bivariate polynomials. We give a new codification of the set of solutions of a positive dimensional algebraic variety relying on a new global version of Newton’s iterator. Roughly speaking the complexity of our algorithm is polynomial in some kind of degree of the system, in its height, and linear in the complexity of evaluation
A reordered Schur factorization method for zerodimensional polynomial systems with multiple roots
 In Proc. ACM Intern. Symp. on Symbolic and Algebraic Computation
, 1997
"... We discuss the use of a single generic linear combination of multiplication matrices, and its reordered Schur factorization, to find the roots of a system of multivariate polynomial equations. The principal contribution of the paper is to show how to reduce the multivariate problem to a univariate p ..."
Abstract

Cited by 46 (3 self)
 Add to MetaCart
(Show Context)
We discuss the use of a single generic linear combination of multiplication matrices, and its reordered Schur factorization, to find the roots of a system of multivariate polynomial equations. The principal contribution of the paper is to show how to reduce the multivariate problem to a univariate problem, even in the case of multiple roots, in a numerically stable way. 1 Introduction The technique of solving systems of multivariate polynomial equations via eigenproblems has become a topic of active research (with applications in computeraided design and control theory, for example) at least since the papers [2, 6, 9]. One may approach the problem via various resultant formulations or by Grobner bases. As more understanding is gained, it is becoming clearer that eigenvalue problems are the "weakly nonlinear nucleus to which the original, strongly nonlinear task may be reduced"[13]. Early works concentrated on the case of simple roots. An example of such was the paper [5], which use...
Algebraic Cryptanalysis of McEliece Variants with Compact Keys
 In Proceedings of Eurocrypt 2010
"... Abstract. In this paper we propose a new approach to investigate the security of the McEliece cryptosystem. We recall that this cryptosystem relies on the use of errorcorrecting codes. Since its invention thirty years ago, no efficient attack had been devised that managed to recover the private key ..."
Abstract

Cited by 45 (11 self)
 Add to MetaCart
Abstract. In this paper we propose a new approach to investigate the security of the McEliece cryptosystem. We recall that this cryptosystem relies on the use of errorcorrecting codes. Since its invention thirty years ago, no efficient attack had been devised that managed to recover the private key. We prove that the private key of the cryptosystem satisfies a system of bihomogeneous polynomial equations. This property is due to the particular class of codes considered which are alternant codes. We have used these highly structured algebraic equations to mount an efficient keyrecovery attack against two recent variants of the McEliece cryptosystems that aim at reducing public key sizes. These two compact variants of McEliece managed to propose keys with less than 20,000 bits. To do so, they proposed to use quasicyclic or dyadic structures. An implementation of our algebraic attack in the computer algebra system MAGMA allows to find the secretkey in a negligible time (less than one second) for almost all the proposed challenges. For instance, a private key designed for a 256bit security has been found in 0.06 seconds with about 2 17.8 operations. 1
Converting bases with the Gröbner walk
 Journal of Symbolic Computation
, 1997
"... We present an algorithm which converts a given Gröbner basis of a polynomial ideal I to a Gröbner basis of I with respect to another term order. The conversion is done in several steps following a path in the Gröbner fan of I. Each conversion step is based on the computation of a Gröbner basis of a ..."
Abstract

Cited by 44 (1 self)
 Add to MetaCart
We present an algorithm which converts a given Gröbner basis of a polynomial ideal I to a Gröbner basis of I with respect to another term order. The conversion is done in several steps following a path in the Gröbner fan of I. Each conversion step is based on the computation of a Gröbner basis of a toric degeneration of I. c ○ 1997 Academic Press Limited 1.
"One sugar cube, please" or Selection strategies in the Buchberger algorithm
 Proceedings of the ISSAC'91, ACM Press
, 1991
"... In this paper we describe some experimental findings on selection strategies for Gröbner basis computation with the Buchberger algorithm. In particular, the results suggest that the "sugar flavor" of the "normal selection", implemented first in CoCoA, then in AlPI, and now in SCR ..."
Abstract

Cited by 37 (2 self)
 Add to MetaCart
In this paper we describe some experimental findings on selection strategies for Gröbner basis computation with the Buchberger algorithm. In particular, the results suggest that the "sugar flavor" of the "normal selection", implemented first in CoCoA, then in AlPI, and now in SCRATCHPADII, is the best choice for a selection strategy. It has to be combined with the "straightforward" simplification strategy and with a special form of the GebauerMöller criteria to obtain the best results. The idea of the "sugar flavor" is the following: the Buchberger algorithm for homogeneous ideals, with degreecompatible term ordering and normal selection strategy, usually works fine. Homogenizing the basis of the ideal is good for the strategy, but bad for the basis to be computed. The sugar flavor computes, for every polynomial in the course of the algorithm, "the degree that it would have if computed with the homogeneous algorithm", and uses this phantom degree (the sugar) only for the selection strategy. We have tested several examples with different selection strategies, and the sugar flavor has proved to be always the best choice or very near to it. The comparison between the different variants of the sugar flavor has been made, but the results are up to now inconclusive. We include a complete deterministic description of the Buchberger algorithm as it was used in our experiments.
Hybrid approach for solving multivariate systems over finite fields
 JOURNAL OF MATHEMATICAL CRYPTOLOGY
, 2009
"... In this paper, we present an improved approach to solve multivariate systems over finite fields. Our approach is a tradeoff between exhaustive search and Gröbner bases techniques. We give theoretical evidences that our method brings a significant improvement in a very large context and we clearly d ..."
Abstract

Cited by 37 (9 self)
 Add to MetaCart
(Show Context)
In this paper, we present an improved approach to solve multivariate systems over finite fields. Our approach is a tradeoff between exhaustive search and Gröbner bases techniques. We give theoretical evidences that our method brings a significant improvement in a very large context and we clearly define its limitations. The efficiency depends on the choice of the tradeoff. Our analysis gives an explicit way to choose the best tradeoff as well as an approximation. From our analysis, we present a new general algorithm to solve multivariate polynomial systems. Our theoretical results are experimentally supported by successful cryptanalysis of several multivariate schemes (TRMS, UOV,...). As a proof of concept, we were able to break the proposed parameters assumed to be secure until now. Parameters that resists to our method are also explicitly given. Our work permits to refine the parameters to be chosen for multivariate schemes.
Gröbner Bases of Lattices, Corner Polyhedra, and Integer Programming
, 1995
"... There are very close connections between the arithmetic of integer lattices, algebraic properties of the associated ideals, and the geometry and the combinatorics of corresponding polyhedra. In this paper we investigate the generating sets ("Gröbner bases") of integer lattices that corresp ..."
Abstract

Cited by 37 (6 self)
 Add to MetaCart
(Show Context)
There are very close connections between the arithmetic of integer lattices, algebraic properties of the associated ideals, and the geometry and the combinatorics of corresponding polyhedra. In this paper we investigate the generating sets ("Gröbner bases") of integer lattices that correspond to the Gröbner bases of the associated binomial ideals. Extending results by Sturmfels & Thomas, we obtain a geometric characterization of the universal Gröbner basis in terms of the vertices and edges of the associated corner polyhedra. In the special case where the lattice has finite index, the corner polyhedra were studied by Gomory, and there is a close connection to the "group problem in integer programming." We present exponential lower and upper bounds for the maximal size of a reduced Gröbner basis. The initial complex of (the ideal of) a lattice is shown to be dual to the boundary of a certain simple polyhedron.
Comparison between XL and Gröbner Basis Algorithms
 ASIACRYPT 2004, LECTURE
, 2004
"... This paper compares the XL algorithm with known Gröbner basis algorithms. We show that to solve a system of algebraic equations via the XL algorithm is equivalent to calculate the reduced Gröbner basis of the ideal associated with the system. Moreover we show that the XL algorithm is also a Gröbner ..."
Abstract

Cited by 30 (10 self)
 Add to MetaCart
(Show Context)
This paper compares the XL algorithm with known Gröbner basis algorithms. We show that to solve a system of algebraic equations via the XL algorithm is equivalent to calculate the reduced Gröbner basis of the ideal associated with the system. Moreover we show that the XL algorithm is also a Gröbner basis algorithm which can be represented as a redundant variant of a Gröbner basis algorithm F4. Then we compare these algorithms on semiregular sequences, which correspond, in conjecture, to almost all polynomial systems in two cases: over the fields F2 and Fq with q ≫ n. We show that the size of the matrix constructed by XL is large compared to the ones of the F5 algorithm. Finally, we give an experimental study between XL and the Buchberger algorithm on the cryptosystem HFE and find that the Buchberger algorithm has a better behavior.
Computing Parametric Geometric Resolutions
, 2001
"... Given a polynomial system of n equations in n unknowns that depends on some parameters, we de ne the notion of parametric geometric resolution as a means to represent some generic solutions in terms of the parameters. The coefficients of this resolution are rational functions of the parameters; we f ..."
Abstract

Cited by 29 (8 self)
 Add to MetaCart
(Show Context)
Given a polynomial system of n equations in n unknowns that depends on some parameters, we de ne the notion of parametric geometric resolution as a means to represent some generic solutions in terms of the parameters. The coefficients of this resolution are rational functions of the parameters; we first show that their degree is bounded by the Bézout number d n , where d is a bound on the degrees of the input system. We then present a probabilistic algorithm to compute such a resolution; in short, its complexity is polynomial in the size of the output and the probability of success is controlled by a quantity polynomial in the Bézout number. We present several applications of this process, to computations in the Jacobian of hyperelliptic curves and to questions of real geometry.