Improved Agreeing-Gluing Algorithm

Abstract

Abstract. In this paper we study the asymptotical complexity of solving a system of sparse algebraic equations over finite fields. An equation is called sparse if it depends on a bounded number of variables. Finding efficiently solutions to the system of such equations is an underlying hard problem in the cryptanalysis of modern ciphers. New deterministic Improved Agreeing-Gluing Algorithm is introduced. The expected running time of the Algorithm on uniformly random instances of the problem is rigorously estimated. The estimate is at present the best theoretical bound on the complexity of solving average instances of the problem. In particular, this is a significant improvement over those in our earlier papers [20,21]. In sparse Boolean equations a gap between the present worst case and the average time complexity of the problem has significantly increased. Also we formulate Average Time Complexity Conjecture. If proved that will have far-reaching consequences in the field of cryptanalysis and in computing in general.

MRHS Equation Systems that can be Solved in Polynomial Time

“…Each MRHS equation corresponds to a system of multivariate polynomial equations. There are various methods proposed for solving general MRHS systems based on Gluing [3], [6], [7] or transformation to another type of problem [11], [13]. All of them have a worst-case exponential complexity.…”

A new method to solve MRHS equation systems and its connection to group factorization

“…By repeated applications the local reduction algorithms can be used to simplify the MRHS system and allow us, when it is computationally feasible, to find the solution set of the system (usually when there is exactly one or no solution). Local reduction algorithms can also be combined with gluing [16], or used with recursive guessing and backtracking to provide an algorithm for solving a system similar to the DPLL algorithm used in SAT solvers [1]. The set S contains all possible right-hand sides.…”

“…The main methods used to solve systems of MRHS equations are "gluing" and "agreeing" [13,14,16], and various versions of "local reduction" [1, 18,21]. Gluing relies on combining equations.…”

A Comparison of Local Reduction and Sat-Solver Based Algebraic Cryptanalysis of Jh And Keccak

“…An effective algorithm to compute this intersection is Gluing [17], [18]. Complexity estimates for an improved version of Gluing on random equation systems are presented in [19].…”

“…The theoretical complexity bounds (e.g., [19]) are usually based on random equation system models, not on a concrete ciphers or families of ciphers. On the other hand, the experimental results (mostly based on SAT solvers) are restricted to smaller instances, and are often hard to scale to larger systems.…”