Solving Systems of Algebraic Equations Over Finite Commutative Rings and Applications

Several problems in algebraic geometry and coding theory over finite rings are modeled by systems of algebraic equations. Among these problems, we have the rank decoding problem, which is used in the construction of public-key cryptography. In 2004, Nechaev and Mikhailov proposed two methods for solving systems of polynomial equations over finite chain rings. These methods used solutions over the residual field to construct all solutions step by step. However, for some types of algebraic equations, one simply needs partial solutions. In this paper, we combine two existing approaches to show how Gr\"obner bases over finite chain rings can be used to solve systems of algebraic equations over finite commutative rings. Then, we use skew polynomials and Pl\"ucker coordinates to show that some algebraic approaches used to solve the rank decoding problem and the MinRank problem over finite fields can be extended to finite principal ideal rings.


Introduction
Solving systems of algebraic equations has always been of high interest in algorithmic algebra.Indeed, many algebraic problems have their solution sets contained in those of systems of algebraic equations.A tangible example is the rank decoding problem [20], which has attracted a lot of attention this last decade in view of its application in cryptography.This problem is generally defined over finite fields and therefore, leads to the problem of solving systems of algebraic equations over finite fields when modeled appropriately.But it should be remembered that this latest problem has been studied for a long time and has a wide variety of algorithms that can be used to solve it and also estimate the solving complexities [21,15,16,13,10].
Most recently, the rank decoding problem has been extended to finite principal ideal rings in [24] where the authors, after having justified the interest of studying this problem over finite rings, show that it is at least as hard as the rank decoding problem over finite fields, and also provide a combinatorial type algorithm for solving this new problem.The translation of the rank decoding problem over finite rings as a system of algebraic equations naturally induces the problem of solving systems of algebraic equations over finite rings.
Contrary to the problem of solving systems of algebraic equations over finite fields, the previous problem over finite rings has not experienced much development.The most advanced and recent work is the paper of Mikhailov and Nechaev [32], who proposed two approaches for solving systems of polynomial equations over finite chain rings.One of these approaches uses canonical generating systems, which are not Gröbner bases in general.An algebraic modeling of the rank decoding problem over finite chain rings that we will use is a system of algebraic equations with some parameters, and we just need a partial solution.Note that Gröbner bases over fields are generally used to solve these kinds of systems.A natural question is therefore to know whether Gröbner bases can be used to solve systems of algebraic equations over finite chain rings in general, as in the case of finite fields.
Independently, Gröbner bases over finite chain rings have been much studied and implemented in some mathematical software systems like Magma [11], SageMath [42], etc.Indeed, similar to Buchberger's algorithm over fields [8], Norton and Salagean [36] gave an algorithm for computing Gröbner bases over finite chain rings.This algorithm has been improved in [23] by adding the product criterion and the chain criterion.In the Magma handbook [11], it was specified that the F 4 algorithm [15] was extended over Euclidean rings 1 , taking into account the elimination criteria given in [33].Moreover, the elimination theorem, which is the main property used to solve systems of algebraic equations, can be extended over finite chain rings.However, the elimination theorem does not hold in general on other types of finite rings.But we must not forget that Low Rank Parity Check codes which are potential linear codes for rank-based cryptography have been extended to finite commutative rings [40,25].Thus, it also becomes necessary to tackle the resolution of systems of algebraic equations over finite commutative rings.
According to the structure theorem for finite commutative rings [31], every finite commutative ring is isomorphic to a product of finite commutative local rings.Thus, solving systems of algebraic equations over finite commutative rings is reduced to finite local rings.In [9], Bulyovszky and Horváth gave a good method for solving systems of linear equations over finite local rings.Indeed, they transformed systems of linear equations from local rings to Galois rings and used the Hermite normal form to solve it.In this work we show that this transformation can be applied to systems of algebraic equations, and we then use Gröbner bases to solve the resulting equation since Galois rings are specific cases of finite chain rings.
Before one can use Gröbner bases over finite chain rings to solve the rank decoding problem, it is first necessary to give an algebraic modeling.As specified in [24], some properties of the rank of a matrix over fields cannot be extended to rings in general due to zero divisors.Therefore, the algebraic modeling of the rank decoding problem given in [5] using the MaxMinors cannot be directly applied to rings.However, in [20] other algebraic modeling using linearized polynomials has been given and some main properties of linearized polynomials have been extended in [26] over finite principal ideal rings.We will use these results to prove that the algebraic modeling done in [20] using linearized polynomials can be generalized over finite principal ideal rings.Furthermore, as the rank decoding problem reduces to the MinRank problem [18], we also study possible algebraic modelings of the MinRank problem over finite rings.
The MinRank problem have several algebraic modeling over fields.For example, the MaxMinors modeling [17], the Kipmis-Shamir modeling [28], or the Support-Minors modeling [5].Over finite chain rings, the rank of a matrix is not generally equal to the order of the highest order non-vanishing minor.Thus, the MaxMinors modeling cannot directly extend over rings.However, we will use the rank decomposition and the Plücker coordinates to show that the Kipmis-Shamir modeling and the Support-Minors modeling can be extended to finite principal ideal rings.
The rest of the paper is organized as follows.In Section 2, we give some properties of Gröbner bases over finite chain rings, followed by the use of Gröbner bases for solving systems of algebraic equations over finite chain rings in Section 3. In Section 4 we show how to solve systems of algebraic equations over finite commutative local rings by decomposing them as a direct sum of cyclic modules over Galois rings.Section 5 uses the fact that the row span of a matrix is contained in a free module of the same rank to prove that the Kipmis-Shamir Modeling and the Support Minors Modeling of the MinRank problem can be extended to finite principal ideal rings.In Section 6, skew polynomials are used to give an algebraic modeling of the rank decoding problem over finite principal ideal rings, and to finish, we conclude the paper and give some perspectives in Section 7.
2 Gröbner Bases Over Finite Chain Rings

Finite Chain Rings
A chain ring is a ring whose ideals are linearly ordered by inclusion, and a local ring is a ring with exactly one maximal ideal.By [31], a finite ring is a chain ring if and only if it is a local principal ideal ring, that is to say a finite ring that admits exactly one maximal ideal and every ideal is generated by one element.A basic example of finite chain rings is the ring Z p k = Z/p k Z of integers modulo a power of a prime number p. Its maximal ideal is pZ p k .Other examples of finite chain rings that we will use to give a representation of finite commutative local rings in Section 4 are Galois rings.A Galois ring of characteristic p k and rank r, denoted by GR p k , r , is the ring Z p n [X] / (f ), where f ∈ Z p k [X] is a monic polynomial of degree r, irreducible modulo p, and (f ) being the ideal of Z p k [X] generated by f .Thus, GR p k , r is a degree r Galois extension of Z p k and is a finite chain ring with maximal ideal generated by p and residue field F p r = GR (p n , r) /pGR (p n , r) [31].
In this section, we assume that R is a finite commutative chain ring with maximal ideal m and residue field F q = R/m.We denote by π a generator of m, and ν the nilpotency index of π, i.e., the smallest positive integer such that π ν = 0.An important property of finite chain rings is the structure of their ideals.Every ideal of R is of the form π i R, for i = 0, . . ., ν.A direct consequence is the following two decompositions of any element from R. Let Γ be a complete set of representatives of the equivalence classes of R under the congruence modulo π.As in [32], we have for example Γ = {a ∈ R : a q = a}.

Example 2.2
The ring Z 8 is a finite chain ring where the maximal ideal is generated by 2, with nilpotency index 3.The residual field of Z 8 is F 2 = Z 8 /2Z 8 and a complete set of representatives of the equivalence classes of Z 8 under the congruence modulo 2 is Γ = {0, 1}.We have 6 = 3 × 2 1 and 3 is invertible in Z 8 , thus val (6) = 1, moreover the maximal ideal is also generated by 6.The 2−adic decomposition of The decomposition (1) using the valuation will be used in the next subsection to compute Gröbner bases and the π−adic decomposition (2) will be used is Section 3 to solve algebraic equations.

Gröbner Bases
The ring of polynomials with k indeterminates x 1 , . . ., x k and coefficients in R is denoted where the d i 's are non-negative integers and α = (d 1 , . . ., d k ).If ">" is an admissible order on the set of monomials, then any element f in R [x 1 , . . ., x k ] \ {0} can be written uniquely as f = s i=1 c i x α i where each x α i is a monomial, c i ∈ R, and (a) G is called a Gröbner basis for I if lt(G) = lt(I).
(b) G is called a strong Gröbner basis for I if for all f ∈ I there exists g ∈ G such that lt(g) divides lt (f ), that is to say lt (f ) = cx α lt(g) where c ∈ R and x α is a monomial.
In [37,Proposition 3.9] a connection between Gröbner bases and strong Gröbner bases was given over finite chain rings.Proposition 2.4 A subset of R [x 1 , . . ., x k ] is a Gröbner basis if and only if it is a strong Gröbner basis.
Over finite chain rings, the reduction is also equivalent to the strong reduction [36,Proposition 3.2].So, we will simply recall the definition of strong reduction given in [37,Definition 3.1 ].
(i) We say that f strongly reduces to h with respect to F in one step and denote it by f ։ F h, if there exists i ∈ {1, . . ., n} such that h = f − cx α f i , where c ∈ R, α ∈ N k , and lt (f ) = cx α lt (f i ).
(ii) The reflexive and transitive closure of the relation ։ F is denoted ։ * F and we set 0 ։ * F 0 by convention.
The reduction process and S−polynomials are used over fields to give a characterization of Gröbner bases.But over a finite chain ring which is not a field, we have zero divisors.Consequently, to give a characterization of Gröbner bases, we also need A−polynomials that we define below, together with S−polynomials.
(ii) Let g ∈ R [x 1 , . . ., x k ] \ {0}.An A-polynomial of g, denoted Apoly(g), is any polynomial of the form ag where a generates the ideal Ann (lc (g Remark 2.7 Since R is a finite chain ring, it is easy to find the constants c 1 , c 2 , and a of Definition 2.6.Indeed: (a) For i ∈ {1, 2}, set lc (g i ) = b i π l i where l i = val (lc (g i )).Then, a least common multiple of lc (g 1 ) and lc (g 2 ) is lcm (lc (g 1 ) , lc (g 2 )) = π l where l = max {l 1 , l 2 }.Thus, we can choose Since ν is the nilpotency index of π, then we can choose a = π ν−val(lc(g)) .
Theorem 2.8 Let I be an ideal in R [x 1 , . . ., x k ], I = {0}, and G a finite subset of I. Then G is a Gröbner basis for I if and only if the following two conditions are satisfied: Similar to Buchberger's algorithm over fields, Theorem 2.8 is used in [36, Algorithme 3.9] to compute Gröbner bases.

Solving System of Algebraic Equations Over Finite Chain Rings
In this section, we assume as in Section 2 that R is a finite commutative chain ring with maximal ideal m generated by π, residue field F q = R/m, and that ν is the nilpotency index of π.

Solving With Lifting Approach
The lifting approach consists of using solutions in the residue field R/m to construct solutions in the ring R. One such method was given in [32, Algorithm 1].Let us recall the main property that justifies this algorithm.Consider a system of polynomial equations of the form where is the partial derivative of f i (x) with respect to x s .Let f (x) be the canonical projection of f (x) onto the residue field F q .As specified in Proposition 2.1, every element c in R k , has the π−adic decomposition c = ν−1 j=0 π j γ j (c) where γ j (c) ∈ Γ k .By [32] we have the following: and for j ∈ {1, . . ., ν − 1} the vector γ j (c) is a solution in Γ k of the system of linear equations (mod π) .
By Proposition 3.1, solving systems of multivariate polynomial equations over the finite chain ring R is reduced to the finite field R/m.However, the projection of certain systems of equations on R/m has several solutions and among these solutions, only one can be lifted.For example, consider the following system over Z 25 : The residual field of Z 25 is F 5 .The projection of (4) onto F 5 is the equation x 5 − x = 0 and all elements in F 5 are solutions.When we use Proposition 3.1, we observe that only one solution can be lifted.Thus, the solution of (4) in Z 25 is x = 18.We can directly obtain this solution if we use the method based on the canonical generating system [32, Algorithm 2].Thus, to solve systems of algebraic equations in one variable in the next subsection, we will use the canonical generating system.For the case of several variables, the methods which use solutions in the residual field R/m to construct solutions in the ring R are not appropriate in practice for some systems of polynomial equations, specifically for parametric systems.As an illustration, consider the following system over Z 8 : Equation ( 5) has 16 solutions.When we use the lifting approach to solve (5) we compute each solution step by step.We will see in the next subsection that we can easily obtain all these solutions using Gröbner bases.

Solving With Gröbner Bases
In this subsection, we show how Gröbner bases can be used to solve systems of multivariate polynomial equations over finite chain rings, as in the case of finite fields.The direct consequence of Proposition 2.4 is the elimination theorem given in [44,Theorem 244].
Proposition 3.2 Let G be a Gröbner basis for an ideal The elimination theorem makes it possible to iteratively solve algebraic systems by eliminating variables.Indeed, by Proposition 3.2, if we compute a Gröbner basis G of the ideal I = (f 1 , . . ., f d ) associated to (3) with the lexicographic order Thus, solving systems of multivariate polynomial equations is generally reduced to solving systems of univariate polynomial equations.We will now show how to use Gröbner bases over finite chain rings to solve systems of univariate polynomial equations.Recall that a Gröbner basis G is called minimal if no proper subset of G is a Gröbner basis for the ideal generated by G.In [36, Theorem 4.2], a characterization of minimal Gröbner bases in one variable over finite chain rings has been given.
As specified in [32], a minimal Gröbner basis in one variable over finite chain rings is a canonical generating system.Therefore, according to Proposition 3.3, we can use [32,Algorithm 2] to solve systems of univariate polynomial equations over finite chain rings using Gröbner bases.Specifically, consider the system of univariate polynomial equations of the form where Assume that a minimal Gröbner basis of the ideal generated by {f 1 (x) , . . ., f r (x)} is G = {u 0 π a 0 g 0 , . . ., u s π as g s } like in Proposition 3.3.As specified in [32, page 64] we can assume that a 0 = 0. Set h j = g i , for 0 ≤ i ≤ s and a i ≤ j < a i+1 , where a s+1 = ν.Then, Equation ( 6) is equivalent to the following system of polynomial equations: As in [32,Theorem 8] and [32, Equation (54)], we will use the derivation Dh j (x) of h j (x) to solve Equation (7).Recall that any element c in R admits a unique π−adic decomposition c = ν−1 j=0 γ j (c) π j , where γ j (c) ∈ Γ.
According to Propositions 3.2 and 3.4, to solve a system of multivariate polynomial equations over finite chain rings, we can compute a Gröbner basis of the associated system with the lexicographic order and successively solve systems of univariate polynomial equations.We will see in Sections 5 and 6 that this approach is appropriate for some systems of algebraic equations when we just need a partial solution.

Solving Systems of Algebraic Equations Over Finite Commutative Local Rings
In the preview section, we have used Gröbner bases to show how one can solve systems of algebraic equations over finite chain rings.We will now show that solving systems of algebraic equations over finite commutative rings can be reduced to finite chain rings.According to [31, Theorem VI.2], if R is a finite commutative ring, then R can be decomposed as a direct sum of local rings, that is to say where for j = 1, . . ., ρ, R (j) is a finite commutative local ring.Thus, the problem of solving systems of algebraic equations over R can be reduced to solving systems of algebraic equations over the various R (j) .However, Gröbner basis are not generally equal to strong Gröbner bases over local rings.Therefore, we will use Galois rings, which are specific classes of finite chain rings to represent finite local rings.As specified in [1,6], finite rings have several representations (the table representation, the basis representation, and the polynomial representation).Galois rings can be used to give the basis representation and the polynomial representation of finite commutative local rings [31, Theorems XVI.2 and XVII.1].In [9], Bulyovszky and Horváth used the basis representation to give a good method for solving systems of linear equations over finite local rings.We are going to extend this method to systems of multivariate polynomial equations.
In this section, we assume that R is a finite commutative local ring with maximal ideal m and residue field F q = R/m.Set q = p µ where p is a prime number.Then the characteristic of R is p ς where ς is a non-negative integer and by [31,Theorem XVII.1] there is a subring R 0 of R such that R 0 is isomorphic to the Galois ring of characteristic p ς and cardinality p µς .Considering R as a R 0 −module, there exist θ 1 , . . ., θ γ in R such that Let j in {1, . . ., γ}.Since every ideal in R 0 is generated by a power of p, then there is ς j in {1, . . ., ς} such that p ς j R 0 = Ann (θ j ) = {a ∈ R 0 : aθ j = 0} .
Lemma 4.1 and the basis decomposition ( 9) can be used to transform a system of multivariate polynomial equations over finite local rings to Galois rings.Specifically, we have the following: Theorem 4.2 Consider a system of polynomial equations of the form where f r are multivariate polynomial functions with coefficients in R and (x i ) 1≤i≤k ∈ R k .Set x i,j θ j , i = 1, . . ., k where x i,j ∈ R 0 and where f r,s are multivariate polynomial functions with coefficients in R 0 .Then Equation ( 10) is equivalent to p ς−ςs f r,s (x i,j ) 1≤i≤k,1≤j≤γ = 0, r = 1, . . ., d, s = 1, . . ., γ.
Since Galois rings are specific cases of finite chain rings, we can use the methods described in Section 3 to solve (11).
Example 4.3 In this example we consider a local ring of size 16 which in not a finite chain ring.As specified in [30], we can choose R = Z 8 [X] /I where I is the ideal generated by X 2 + 4 and 2X.Then R is a local ring with maximal ideal generated by 2 + I and X + I. Set θ = X + I, then a maximal Galois subring of R is R 0 = Z 8 and we have R = θ 1 R 0 ⊕ θ 2 R 0 where θ 1 = 1 and θ 2 = θ.Moreover, Ann (θ 1 ) = {0} = 2 3 R 0 and Ann (θ 2 ) = 2R 0 .We would like to find the roots of the polynomial function defined over R by The residual field of R is F 2 and the projection over F 2 of P (x) is P (x) = x 3 which is not square-free.Therefore, we are not able to find the roots of P using methods based on the Hensel's lemma [31,Theorem XIII.4] or the Newton-Hensel's lemma [19, Proposition 2.1.9].Thus, an alternative method is to use Theorem 4.2.Set x = x 1 + x 2 θ where x 1 and x 2 are in R 0 .Then, Therefore, the equation is equivalent to the system Thanks to Example 3.5, we deduce that the solutions of ( 12) are (x 1 , x 2 ) in {(2, t) , (6, t) , t ∈ Z 8 }.As 2θ = 0 and x = x 1 + x 2 θ, then x 2 is unique modulo 2. We can therefore choose x 2 in {0, 1}.Thus, the roots of P are 2, 6, 2 + θ, and 6 + θ.

MinRank Problem Over Finite Principal Ideal Rings
In this section, we extend some algebraic modeling of the MinRank problem over finite principal ideal rings.In what follow, we assume that R is a finite commutative principal ideal ring.The set of all m × n matrices with entries in a ring R will be denoted by R m×n .Let A ∈ R m×n , we denote by row (A) the R−submodule generated by the row vectors of A. The transpose of A is denoted by A ⊤ and the k × k identity matrix is denoted by I k .As specified in [26,Proposition 3.4], the Smith normal form can be used to compute the rank of a matrix.Moreover, as in the case of fields, the map R m×n × R m×n → N, given by (A, B) → row (A − B) is a metric.However, some properties of the rank of a matrix over fields generally do not extend to rings due to zero divisors.and det(A) = 0. Thus, rk (A) = rk (6A) and rk (A) is not equal to the order of the highest order non-vanishing minor.

MinRank Problem
Definition 5.3 Let M 0 , M 1 , . .., M k in R m×n and r in N * .The MinRank problem is to find x 1 , . . ., x k in R such that rk(M 0 + k i=1 x i M i ) ≤ r.The homogeneous MinRank problem corresponds to the case where M 0 = 0. Let x ∈ R n , and D x be the n × n diagonal matrix with the entries of x on the diagonal.Then, according to [26,Proposition 3.4], the Hamming weight of x is equal to the rank of D x and thus, using the work of [43], one can easily prove as in [12] that the MinRank problem over finite principal ideal rings is NP-complete.Therefore, this problem is potential for cryptography and, the study of its algebraic resolution deserves attention.In [24, Proposition 4.3], it was shown that solving the rank decoding problem over finite principal ideal rings reduces to finite chain rings.This result does apply also to the MinRank problem.
In general, an instance of the MinRank problem has several solutions.But if r is not greater than the error correction capability of the R−linear code generated by M 1 , . . ., M k (assuming M 1 , . . ., M k are R−linearly independent), then the problem has a unique solution (x 1 , . . ., x k ).In the homogeneous case, for any solution (x 1 , . . ., x k ) and for any α ∈ R, (αx 1 , . . ., αx k ) is also a solution.Thus, if R is a field, one of the components of a nonzero solution of the homogeneous MinRank problem can always be assumed to be 1.However, if R is not a field, this assumption is not true in some cases (see Example 5.10).
From a modelling perspective, the MinRank problem over finite fields can be transformed into a system of algebraic equations using the maximum minors while over finite principal ideal rings, the rank of a matrix is usually not equal to the order of the highest order non-vanishing minor.As a consequence, the MaxMinor modelling does not apply in general when dealing with rings.In the following subsections, we will prove that the Kipmis-Shamir Modelling and the Support Minors Modelling can be extended over finite principal ideal rings.

Kipmis-Shamir Modeling
We start with some lemmas which will be used to give the Kipmis-Shamir modeling over finite principal ideal rings.According to [26, Proposition 3.2], we have the following: Lemma 5.4 Let E ∈ R m×n such that rk (E) ≤ r.Then, there exists a rank r free submodule F of R n such that row (E) ⊂ F .
Remark 5.5 Let E and F as in Lemma 5.4.If row (E) is a free module and rk (E) = r then F is unique and row (E) = F .But if row (E) is not a free module, then F is generally not unique.
By [14, Proposition 2.9], we have the following: Lemma 5.7 For any rank r free submodule F of R n , there exists Z ∈ R n×(n−r) with linearly independent column vectors and satisfying If a and b are two elements of a finite chain ring, then a divides b or b divides a.This property was used in [35,Proposition 3.2] to prove the existence of the generator matrices in standard form over finite chain rings.So, we have the following: Lemma 5.8 Assume that R is a finite chain ring.Let Z ∈ R n×(n−r) with column vectors that are linearly independent.Then there exists a size n permutation matrix P, an invertible matrix Q ∈ R (n−r)×(n−r) , and a matrix Z ′ ∈ R r×(n−r) such that The above Lemma 5.8 is not generally true when R is not a finite chain ring.Indeed, consider the matrix over Z 6 .The column vector of Z is Z 6 −linearly independent.But Z cannot be decomposed as in Lemma 5.8.Lemmas 5.4, 5.7 and 5.8 allow to extend the Kipmis-Shamir Modeling to finite principal ideal rings.
(ii) There exists Z ∈ R n×(n−r) , with column vectors that are linearly independent and such that Moreover, if R is a finite chain ring then, up to a permutation of columns of M x , we can assume that Z is into the form Proof.The proof is similar to the case of fields.Indeed, assume that rk(M x ) ≤ r.Then, by Lemma 5.4, there exists a free submodule F of R n of rank r such that row (M x ) ⊂ F .Thus, by Lemma 5.7, there is Z ∈ R n×(n−r) , with column vectors that are linearly independent and such that (13) holds.Conversely, assume that (ii) holds.Then, by Lemma 5.7, all row vectors of M x are in a free module of rank r.Therefore, by [26,Proposition 3.2], rk(M x ) ≤ r.
As specified in Remark 5.5, the free submodule F is generally not unique.Therefore, Z ′ is generally not unique.
In the simulations, we observe that in some cases to simplify the resolution of ( 13) it is necessary to add some equations as specified in Remark 3.6.
Example 5.11 Consider the following MinRank problem: find where According to Theorem 5.9, ( 16) is equivalent to When we choose Z in the form then we do not get the solution.Thus, it is necessary to choose the switchable permutation.
(ii) There exists a Plücker coordinates {z j 1 ,...,jr : 1 for all i = 1, . . ., n and all sequence of r + 1 positive integers where M x [i, j α ] is the entry at the i th row and j th α column of M x .
Proof.Assume that rk(M x ) ≤ r.Then, by Lemma 5.4, there exists a free submodule F of R n of rank r such that row (M x ) ⊂ F .Let {z j 1 ,...,jr : 1 ≤ j 1 < • • • < j r ≤ n} be a Plücker coordinates of F .Then, by Lemma 5.12 and ( 19), we get (20).Conversely, assume that (ii) holds.Then, by Lemma 5.12, all row vectors of M x are in a free module of rank r.Therefore, by [26,Proposition 3.2], rk(M x ) ≤ r.
As stated in Remark 5.5, the free submodule F is generally not unique.Consequently, there are usually several Plücker coordinates associated to different free submodules, and which all satisfy Equation (20).Equation ( 20) is a system of polynomial equations with unknowns x l and z j 1 ,...,jr .Thus, as specified in the previous sections, we can use Gröbner bases to solve (20).But in some cases, it is possible to use linear algebra as in [3].
In the case of fields, some conditions have been given in [3] to solve (20) using linear algebra.It will be interesting to study if these conditions can be extended to rings.
It is important to note that, according to [26,Proposition 3.4], the rank of a matrix and its transpose are equal.Therefore, the MinRank problem defined with M 0 , M 1 , . .., M k shares the same solution set with the one defined with M ⊤ 0 , M ⊤ 1 , . .., M ⊤ k .Thus, in order to reduce the number of variables in the algebraic modeling, one can transpose the matrices before solving the MinRank problem, as stated for example in [2].

Rank Decoding Problems Over Finite Principal Ideal Rings
In this section, we will study the algebraic approach for solving the rank decoding problem over finite principal ideal rings.Over fields, the rank decoding problem has several algebraic modeling.As specified in [24, Section 4], the Ourivski-Johansson modeling [39] and the MaxMinors modeling [5] cannot extend directly to rings due to zero divisors.We will show that the Support-Minors modeling [4] and the modeling using linearized polynomials [20] can be extended to finite principal ideal rings.

Rank Decoding Problem
To define the rank decoding problem, we must first recall the construction of a Galois extension of a finite principal ideal ring R. As we specified in Section 4, R can be decomposed into a direct sum of local rings.Thus, in the following, we assume that where each R (j) is a finite chain ring with maximal ideal m (j) and residue field F q (j) , for j = 1, . . ., ρ.
Let m be a non-zero positive integer and h (j) ∈ R (j) [X] a monic polynomial of degree m such that its projection onto F q (j) [X] is irreducible.Set S (j) = R (j) [X] / h (j) , then by [31] S (j) is a Galois extension of R (j) of degree m with Galois group that is cyclic of order m.Moreover, S (j) is also a finite chain ring with maximal ideal M (j) = m (j) S (j) and residue field F q m (j) .Let us denote by σ (j) a generator of the Galois group of S (j) , σ = σ (j) 1≤j≤ρ and S = S (1) × • • • × S (ρ) .Then, as specified in [26], S is a Galois extension of R of degree m with Galois group generated by σ.Moreover, there exists h ∈ R [X] such that S ∼ = R [X] / (h).An example of construction of a Galois extension of Z 40 of degree 4 was given in [24, Example 2.2].The following example shows how one can construct a generator of the Galois group in practice using the Hensel lifting of a primitive polynomial.Example 6.1 Let us construct a degree 3 Galois extension of R = Z 8 , and its Galois group.The residue field of R is F q = F 2 and the polynomial g = X 3 +X+1 is a primitive polynomial in F q [X].Using the Hensel's lemma, we can construct the polynomial h = X 3 +6X 2 +5X +7 ∈ R [X], such that h = g and h divides X q m −1 − 1.Therefore, S = R [X] / (h) = R [α] is a Galois extension of R of degree m = 3, where α = X + (h).Moreover, α q m −1 = 1 and α i = 1, for 0 < i < q m − 1.Thus, the Galois group is generated by the map σ : S → S given by α → α q , that is to say, for all x = m−1 i=0 x i α i , where a) The support of u, denoted by supp(u), is the R−submodule of S generated by {u 1 , . . ., u n }.
b) The rank of u, denoted by rk R (u) , or simply by rk (u) is the smallest number of elements in supp(u) which generate supp(u) as a R−module.
Since S is a free R−module, computing the rank of a vector u ∈ S n can be done by using its matrix representation in a R−basis of S as in the case of finite fields (for more details see [26,Proposition 3.13]).Definition 6.3 Let C be a S−submodule of S n , y an element of S n and r ∈ N * .The rank decoding problem is to find e in S n and c in C such that y = c + e with rk(e) ≤ r.
Using the representation of elements in S n as elements of R m×n , the rank decoding problem can be reduced to the MinRank problem, as in the case of finite fields [18].

Support-Minors Modeling
According to [26, Proposition 3.14] we have the following: Lemma 6.5 For any u ∈ S n with rk (u) ≤ r, there exists b ∈ S r and A ∈ R r×n such that row (A) is a free module of rank r and u = bA.
The following result is a generalization of the Support-Minors modeling for the rank decoding problem giving in [4].Theorem 6.6 Let C be a S−submodule of S n with a generator matrix G = (g i,j ) 1≤i≤k,1≤j≤n , y = (y i ) 1≤i≤n ∈ S n and r ∈ N. The following statements are equivalent.
(i) There exists c ∈ C such that rk (y − c) ≤ r.

Algebraic Modeling With Skew Polynomials
Skew polynomials [38] generalize linearized polynomials, and some properties of linearized polynomials have been extended to skew polynomials in [26].Definition 6.8 The skew polynomial ring over S with automorphism σ, denoted by S[X, σ], is the ring of all polynomials in S[X] such that • the addition is defined to be the usual addition of polynomials;

Solving by Linearization
In this subsection, we will show that in some cases, the unknowns x in (28) can be recovered using linear algebra.Equation ( 28) is equivalent to where In the same way as the row echelon form over fields, the matrix A can be decomposed as A = PT where P is an invertible matrix and T = (t i,j ) is an upper triangular matrix, that is to say t i,j = 0 if i > j [27,Theorem 3.5].The matrix T is usually called the Hermite normal form of A. One can compute the Hermite normal using the same methods as the Gaussian elimination algorithm, see for example [27,41,9].As z r = 1, the following proposition shows that if T has a specific form, then x can be recovered.Proposition 6.15With the above notations, assume that (28) has a solution and that T is of the form where T 1 is an r(k + 1) × r(k + 1) upper triangular matrix, T 2 being a r(k + 1) × (k + 1) matrix and T 3 = I k b where b is a k × 1 matrix, then Note that ( 29) is a homogeneous system of n linear equations with (k +1)(r +1) unknowns.So, a necessary condition for T to have the form (30) is n ≥ (k + 1)(r + 1) − 1.The same condition was given in [20,Theorem 12] in the case of finite fields.With this condition, we observed in our simulations that, when C is a random free submodule, x can be recovered in many cases.It will be therefore interesting to study the probability of this observation.with rk (e) = r = 1.So, the skew polynomial P ∈ S[X, σ], such that is of the form P = z 0 + z 1 X where z 0 , z 1 ∈ S with z 1 = 1.By setting g = (g 1, g 2 , g 3 ) and y = (y 1, y 2 , y 3 ), (31) and (32) imply z 0 (xg j − y j ) + z 1 σ (xg j − y j ) = 0, j = 1, ..., 3.

Conclusion
In this work, we have shown that solving systems of algebraic equations over finite commutative rings reduces to the same problem over Galois rings.Then, using the elimination theorem and some properties of canonical generating systems, we have also shown how Gröbner bases can be used to solve systems of algebraic equations over finite chain rings.As applications, these results have been used to give some algebraic approaches for solving the MinRank problem and the rank decoding problem over finite principal ideal rings.The above work clearly open the door to an important complexity question, namely the real coast of Gröbner bases computation over finite chain rings, or at least the coast when dealing with the MinRank and rank decoding problems over finite chain rings.
Another metric used in coding theory and cryptography is the Lee metric [29].This metric is usually defined over integer residue rings, which are specific cases of finite principal ideal rings.Another interesting perspective will be to study the possibility of using algebraic techniques for solving the decoding problem in the Lee metric.

Proposition 2 . 1
Let c in R, then (a) there exist a unique l in {0, . . ., ν} and a unit u in R such that c = π l u (1) (b) the element c has a unique representation in the form c = ν−1 j=0 c j π j . The leading monomial, the leading coefficient, and the leading term of f are respectively defined by lm (f) := x α 1 , lc (f ) := c 1 , lt (f ) := c 1 x α 1 .For W ⊂ R [x 1 , . . ., x k ],we denote by lt (W ) the ideal generated by {lt (w) | w ∈ W }. According to [37, Definition 3.8], we have the following: Definition 2.3 Let I be an ideal in R [x 1 , . . ., x k ] and G a subset of I.

Definition 5 . 1
Let A ∈ R m×n .The rank of A, denoted by rk R (A) or simply by rk (A) is the smallest number of elements in row(A) which generate row(A) as a R−module.