Polynomial-Time Algorithms for Quadratic Isomorphism of Polynomials
Résumé
Let \(\mathbb{K}\) be a field, $\f=(f_1,\ldots,f_m)$ and $\g=(g_1,\ldots,g_m)$ be two sets of $m\geqslant 1$ non-linear polynomials over $\mathbb{K}[x_1,\ldots,x_n]$. We consider the computational problem of finding -- if any -- an invertible transformation on the variables mapping $\f$ to $\g$. The corresponding equivalence problem is known as {\it Isomorphism of Polynomials with one Secret} ({\tt IP1S}) and is a fundamental problem in multivariate cryptography; the problem is also called {\tt PolyProj} when \(m=1\). Agrawal and Saxena show that Graph Isomorphism ({\tt GI}) reduces to equivalence of cubic polynomials with respect to an invertible linear change of variables. This strongly suggests that solving equivalence problems efficiently, {\it i.e.} in polynomial-time, is a very challenging algorithmic task. Then, following Kayal at SODA'11, we search for large families of polynomials equivalence which can be solved efficiently. The main result is a randomized polynomial-time algorithm for solving {\tt IP1S} for quadratic instances, a particular case of importance in cryptography and somewhat justifying {\it a posteriori} the fact that {\tt GI} reduces to only cubic instances of {\tt IP1S}. To this end, we show that {\tt IP1S} for quadratic polynomials can be reduced to a variant of the classical module isomorphism problem in representation theory, which involves to test the orthogonal simultaneous conjugacy of symmetric matrices. We show that we can essentially {\it linearize} the problem by reducing quadratic-{\tt IP1S} to test the orthogonal simultaneous similarity of symmetric matrices; this latter problem was shown by Chistov, Ivanyos and Karpinski to be equivalent of finding an invertible matrix in the linear space $\mathbb{K}^{n \times n}$ of $n \times n$ matrices over $\K$ and to compute the square root in a matrix algebra. While computing square roots of matrices can be be done efficiently using numerical methods, it seems difficult to control the bit complexity of such methods. However, we present exact and polynomial-time algorithms for computing the square root in $\mathbb{K}^{n \times n}$ for various fields (including finite fields). We then consider \#{\tt IP1S}, the counting version of {\tt IP1S} for quadratic instances. In particular, we provide a (complete) characterization of the automorphism group of homogeneous quadratic polynomials. Finally, we also consider the more general {\it Isomorphism of Polynomials} ({\tt IP}) problem where we allow an invertible linear transformation on the variables \emph{and} on the set of polynomials. A randomized polynomial-time algorithm for solving {\tt IP} when \(\f=(x_1^d,\ldots,x_n^d)\) is presented. From an algorithmic point of view, the problem boils down to factoring the determinant of a linear matrix (\emph{i.e.}\ a matrix whose components are linear polynomials). This extends to {\tt IP} a result of Kayal obtained for {\tt PolyProj}.
Origine | Fichiers produits par l'(les) auteur(s) |
---|