A New Efficient Algorithm for Computing All Low Degree Annihilators of Sparse Polynomials with a High Number of Variables

Abstract

Algebraic attacks have proved to be an effective threat to block and stream cipher systems. In the realm of algebraic attacks, there is one major concern that, for a given Boolean polynomial f, if f or f + 1 has low degree annihilators. Existing methods for computing all annihilators within degree d of f in n variables, such as Gauss elimination and interpolation, have a complexity based on the parameter $k_{n, d} = \sum_{i=0}^{d}{{{n}\choose{i}}}$, which increases dramatically with n. As a result, these methods are impractical when dealing with sparse polynomials with a large n, which widely appear in modern cipher systems.

In this paper, we present a new tool for computing annihilators, the characters w.r.t. a Boolean polynomial. We prove that the existence of annihilators of f and f + 1 resp. relies on the zero characters and the critical characters w.r.t. f. Then we present a new algorithm for computing annihilators whose complexity relies on k′ _f,d , the number of zero or critical characters within degree d w.r.t.f. Since k′ _f,d  ≪ k _{n, d} when f is sparse, this algorithm is very efficient for sparse polynomials with a large n. In our experiments, all low degree annihilators of a random balanced sparse polynomial in 256 variables can be found in a few minutes.

This work is partly supported by the National Natural Science Foundation of China under Grant No. 60970152, the Grand Project of Institute of Software: YOCX285056, and National 863 Project of China(No. 2007AA01Z447).