Formal Power Series on Algebraic Cryptanalysis
Shuhei Nakamura
TL;DR
This paper develops formal power-series-based upper bounds for the first fall degree of polynomial systems arising in algebraic cryptanalysis, focusing on large fields where the order enables precise equalities between the first fall degree and Koszul-syzygy bounds. It proves that for non-semi-regular systems the first fall degree is bounded above by the degree of regularity, and extends these ideas to multi-graded systems by introducing the bound $D_{\mathbb{Z}_{\ge 0}^s}$ (and its ordered variant ${\bf D}_{\mathbb{Z}_{\ge 0}^s,\prec}$), tying them to multivariate Hilbert-series. The work develops a theoretical framework for the multi-graded XL algorithm with kernel search and provides the necessary assumptions to estimate solving degrees in this setting. Applications to Rainbow and GMSS show how these bounds translate into practical attack-cost estimates for key-recovery and MinRank-type KS attacks, highlighting potential reductions in solving degrees and informing parameter choices in post-quantum cryptography. Overall, the results supply a rigorous, scalable method to bound attack complexity via multi-degree Hilbert-series analysis, improving cryptanalytic planning for multivariate schemes.
Abstract
In the complexity estimation for an attack that reduces a cryptosystem to solving a system of polynomial equations, the degree of regularity and an upper bound of the first fall degree are often used in cryptanalysis. While the degree of regularity can be easily computed using a univariate formal power series under the semi-regularity assumption, determining an upper bound of the first fall degree requires investigating the concrete syzygies of an input system. In this paper, we investigate an upper bound of the first fall degree for a polynomial system over a sufficiently large field. In this case, we prove that the first fall degree of a non-semi-regular system is bounded above by the degree of regularity, and that the first fall degree of a multi-graded polynomial system is bounded above by a certain value determined from a multivariate formal power series. Moreover, we provide a theoretical assumption for computing the first fall degree of a polynomial system over a sufficiently large field.