Polynomial XL: A Variant of the XL Algorithm Using Macaulay Matrices over Polynomial Rings

TL;DR

This work tackles solving multivariate quadratic systems (the MQ problem) by introducing Polynomial XL (PXL), a variant of the XL/Hybrid XL framework. PXL fixes $k$ variables and builds a Macaulay matrix over the polynomial ring in those $k$ variables for the remaining $n-k$ main variables, then performs partial eliminations before guessing the fixed variables to reduce per-guess cost. Under practical assumptions (e.g., affine semi-regularity), the authors provide complexity analyses that suggest PXL can outperform existing approaches (h-XL, h-WXL, Crossbred) in the regime where $n \approx m$, with concrete bounds and a representative example showing $2^{220}$ operations for PXL versus higher costs for the alternatives in a system over $\mathbb{F}_{2^8}$ with $n=m=80$. The results indicate a favorable time–memory trade-off for PXL in certain parameter regimes, supported by theoretical comparisons and experimental insights. The paper outlines the algorithm, analyzes complexity, and reports unoptimized implementation results to illustrate practical viability and potential cryptanalytic impact.

Abstract

Solving a system of $m$ multivariate quadratic equations in $n$ variables over finite fields (the MQ problem) is one of the important problems in the theory of computer science. The XL algorithm (XL for short) is a major approach for solving the MQ problem with linearization over a coefficient field. Furthermore, the hybrid approach with XL (h-XL) is a variant of XL guessing some variables beforehand. In this paper, we present a variant of h-XL, which we call the \textit{polynomial XL (PXL)}. In PXL, the whole $n$ variables are divided into $k$ variables to be fixed and the remaining $n-k$ variables as ``main variables'', and we generate a Macaulay matrix with respect to the $n-k$ main variables over a polynomial ring of the $k$ (sub-)variables. By eliminating some columns of the Macaulay matrix over the polynomial ring before guessing $k$ variables, the amount of operations required for each guessed value can be reduced compared with h-XL. Our complexity analysis of PXL (under some practical assumptions and heuristics) gives a new theoretical bound, and it indicates that PXL could be more efficient than other algorithms in theory on the random system with $n=m$, which is the case of general multivariate signatures. For example, on systems over the finite field with ${2^8}$ elements with $n=m=80$, the numbers of operations deduced from the theoretical bounds of the hybrid approaches with XL and Wiedemann XL, Crossbred, and PXL with optimal $k$ are estimated as $2^{252}$, $2^{234}$, $2^{237}$, and $2^{220}$, respectively.