Algorithms for Testing Monomials in Multivariate Polynomials

Article Interpolation of depth-3 arithmetic circuits with two multiplication gates Author: Amir Shpilka Technion, Haifa, Israel Technion, Haifa, IsraelView Profile Authors Info & Claims STOC '07: Proceedings of the thirty-ninth annual ACM symposium on Theory of computingJune 2007Pages 284–293https://doi.org/10.1145/1250790.1250833Published:11 June 2007Publication History 12citation214DownloadsMetricsTotal Citations12Total Downloads214Last 12 Months4Last 6 weeks2 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access

Given any fixed integer q ≥ 2, a q-monomial is of the format [Formula: see text] such that 1 ≤ sj ≤ q - 1, 1 ≤ j ≤ t. q-monomials are natural generalizations of multilinear monomials. Recent research on testing multilinear monomials and q-monomials for prime q in multivariate polynomials relies on the property that Zq is a field when q ≥ 2 is prime. When q > 2 is not prime, it remains open whether the problem of testing q-monomials can be solved in some compatible complexity. In this paper, we present a randomized O*(7.15k) algorithm for testing q-monomials of degree k that are found in a multivariate polynomial that is represented by a tree-like circuit with a polynomial size, thus giving a positive, affirming answer to the above question. Our algorithm works regardless of the primality of q and improves upon the time complexity of the previously known algorithm for testing q-monomials for prime q > 7.

Identification schemes based on multivariate polynomials have been receiving attraction in different areas due to the quantum secure property. Identification is one of the most important elements for the IoT to achieve communication between objects, gather and share information with each other. Thus, identification schemes which are post-quantum secure are significant for Internet-of-Things (IoT) devices. Various polar forms of multivariate quadratic and cubic polynomial systems have been proposed for these identification schemes. There is a need to define polar form for multivariate dth degree polynomials, where . In this paper, we propose a solution to this need by defining constructions for multivariate polynomials of degree . We give a generic framework to construct the identification scheme for IoT and RFID applications. In addition, we compare identification schemes and curve-based cryptoGPS which is currently used in RFID applications.

Sequential Galois field (F 2k ) arithmetic circuits take k-bit inputs and produce a k-bit result, after k-clock cycles of operation. Formal verification of sequential arithmetic circuits with large datapath size is beyond the capabilities of contemporary verification techniques. To address this problem, this paper describes a verification method based on algebraic geometry that: i) implicitly unrolls the sequential arithmetic circuit over multiple (k) clock-cycles; and ii) represents the function computed by the state-registers of the circuit, canonically, as a multi-variate word-level polynomial over F 2k . Our approach employs the Grobner basis theory over a specific elimination ideal. Moreover, an efficient implementation is described to identify the k-cycle computation performed by the circuit at word-level. We can verify up to 100-bit sequential Galois field multipliers, whereas conventional techniques fail beyond 23-bit circuits.

We study the problem of testing if the polynomial computed by an arithmetic circuit is identically zero (ACIT). We give a deterministic polynomial time algorithm for this problem when the inputs are read-twice formulas. This algorithm also computes the MLIN predicate, testing if the input circuit computes a multilinear polynomial.We further study two related computational problems on arithmetic circuits. Given an arithmetic circuit C, 1) ZMC: test if a given monomial in C has zero coefficient or not, and 2) MonCount: compute the number of monomials in C. These problems were introduced by Fournier, Malod and Mengel [STACS 2012], and shown to characterize various levels of the counting hierarchy (CH).We address the above problems on read-restricted arithmetic circuits and branching programs. We prove several complexity characterizations for the above problems on these restricted classes of arithmetic circuits.

We present a simple algorithm based on the inclusion-exclusion principle for computing the sum of the coefficients of all multilinear monomials in a polynomial computed by an arithmetic circuit over any field F . This problem is formally denoted as (k,n) -MLC and is defined as follows: — Given an arithmetic circuit computing a homogeneous polynomial \(f \in \mathbb {F}[x_1,\ldots ,x_n]\) of degree k , where \(\mathbb {F}\) is any field, compute the sum of the coefficients of all multilinear monomials in f . We provide a deterministic algorithm for the ( k,n )-MLC problem with a running time of \(O(n^{k/2} \cdot 2^{O(k)} \cdot s^{O(1)})\) , where s is the size of the circuit. Our algorithm is also polynomial space-bounded. The ( k,n )-MLC problem was first studied by Koutis and Williams [ 15 , 16 , 17 , 22 ] and later studied by Arvind et al., [ 3 ], where they obtain a deterministic algorithm with a running time of \(O^*({n\atopwithdelims (){\downarrow k/2}}\cdot s^{O(\log k)})\) 1 \(^,\) 2 using Hadamard product of polynomials. Pratt [ 18 ] proposed a deterministic algorithm that runs in \(O^*(n^{k/2})\) time, but this approach relies on a non-trivial Waring decomposition of symmetric polynomials over the rationals, which does not extend to small finite fields. Our method is notable for its simplicity and general applicability to all fields. In contrast to existing works, we introduce the complement of the ( k,n )-MLC problem, which we call the ( k,n )-NMLC problem. This approach looks at finding the sum of the coefficients of all non-multilinear monomials, which gives us a new way to think about the ( k,n )-MLC problem. This new method results in a simple algorithm and helps explain where the leading exponent \(k/2\) comes from. We develop a deterministic algorithm for the ( k,n )-NMLC problem that runs in \(O(n^{k/2} \cdot 2^{O(k)} \cdot s)\) time and uses polynomial space. The algorithm for the ( k,n )-MLC problem is straightforward: it subtracts the sum of the coefficients of all non-multilinear monomials (the result from the ( k,n )-NMLC problem) from the total sum of all monomial coefficients in the polynomial, which includes both multilinear and non-multilinear monomials. We apply these results to obtain a deterministic algorithm for the exact counting version of the r -simple k -path problem, as introduced in References [ 1 , 13 ], and also to a generalization of the ( k,n )-MLC problem, which we call the \((r,k,n)\) -MLC problem. This involves computing the sum of the coefficients of all monomials in the polynomial produced by the given arithmetic circuit, where the degree of each variable is at most r .

The complexity of two problems on arithmetic circuits

We present a robust secure methodology for computing functions that are represented as multivariate polynomials where parties hold different variables as private inputs. Our generic efficient protocols are fully black-box and employ threshold additive homomorphic encryption; they do not assume honest majority, yet are robust in detecting any misbehavior. We achieve solutions that take advantage of the algebraic structure of the polynomials, and are polynomial-time in all parameters (security parameter, polynomial size, polynomial degree, number of parties). We further exploit a “round table” communication paradigm to reduce the complexity in the number of parties.A large collection of problems are naturally and efficiently represented as multivariate polynomials over a field or a ring: problems from linear algebra, statistics, logic, as well as operations on sets represented as polynomials. In particular, we present a new efficient solution to the multi-party set intersection problem, and a solution to a multi-party variant of the polynomial reconstruction problem.Keywordssecure multiparty computationmultivariate polynomial evaluationadditive homomorphic encryptionthreshold cryptosystemssecret sharingmultiparty set intersection

Using recent absolute irreducibility testing algorithms, we derive new irreducibility forms. These are integer polynomials in variables which are the generic coefficients of a multivariate polynomial of a given degree. A (multivariate) polynomial over a specific field is said to be absolutely irreducible if it is irreducible over the algebraic closure of its coefficient field. A specific polynomial of a certain degree is absolutely irreducible, if and only if all the corresponding irreducibility forms vanish when evaluated at the coefficients of the specific polynomial. Our forms have much smaller degrees and coefficients than the forms derived originally by Emmy Noether. We can also apply our estimates to derive more effective versions of irreducibility theorems by Ostrowski and Deuring and of the Hilbert irreducibility theorem. We also give an effective estimate on the diameter of the neighborhood of an absolutely irreducible polynomial with respect to the coefficient space in which absolute irreducibility is preserved. Furthermore, we can apply the effective estimates to derive several factorization results in parallel computational complexity theory: we show how to compute arbitrary high precision approximations of the complex factors of a multivariate integral polynomial and how to count the number of absolutely irreducible factors of a multivariate polynomial with coefficients in a rational function field, both in the complexity class NC. The factorization results also extend to the case where the coefficient field is a function field.

Polynomial and spline quasi-interpolants (QIs) are practical and effective approximation operators. Among their remarkable properties, let us cite for example: good shape properties, easy computation and evaluation (no linear system to solve), uniform boundedness independently of the degree (polynomials) or of the partition (splines), good approximation order. We shall emphasize new results on various types of univariate and multivariate polynomial or spline QIs, depending on the nature of coefficient functionals, which can be differential, discrete or integral. We shall also present some applications of QIs to numerical methods.

We propose a new quantum-safe digital signature algorithm called Multivariate Polynomial Public Key Digital Signature (MPPK/DS). The core of the algorithm is based on the modular arithmetic property that for a given element g, greater than equal to two, in a prime Galois field GF(p) and two multivariate polynomials P and Q, if P is equal to Q modulo p-1, then g to the power of P is equal to g to the power of Q modulo p. MPPK/DS is designed to withstand the key-only, chosen-message, and known-message attacks. Most importantly, making secret the element g disfavors quantum computers’ capability to solve the discrete logarithm problem. The security of the MPPK/DS algorithm stems from choosing a prime p associated with the field GF(p), such that p is a sum of a product of an odd prime number q multiplied with a power x of two and one. Given such a choice of a prime, choosing even coefficients of the publicly available polynomials makes it hard to find any private information modulo p-1. Moreover, it makes it exponentially hard to lift the solutions found modulo q to the ring of integers modulo p-1 by properly arranging x and q. However, finding private information modulo the components q and power x of two is an NP-hard problem since it involves solving multivariate equations over the chosen finite field. The time complexity of searching a private key from a public key or signatures is exponential over GF(p). The time complexity of perpetrating a spoofing attack is also exponential for a field GF(p). MPPK/DS can achieve all three NIST security levels with optimized choices of multivariate polynomials and the generalized safe prime p.

Previous chapter Next chapter Full AccessProceedings Proceedings of the 2011 Annual ACM-SIAM Symposium on Discrete Algorithms (SODA)Efficient algorithms for some special cases of the polynomial equivalence problemNeeraj KayalNeeraj Kayalpp.1409 - 1421Chapter DOI:https://doi.org/10.1137/1.9781611973082.108PDFBibTexSections ToolsAdd to favoritesExport CitationTrack CitationsEmail SectionsAboutAbstract We consider the following computational problem. Let F be a field. Given two n-variate polynomials f(x1, …, xn) and g(x1, …, xn) over the field F, is there an invertible linear transformation of the variables which sends f to g? In other words, can we substitute a linear combination of the xi's for each xj appearing in f and obtain the polynomial g? This problem is known to be at least as difficult as the graph isomorphism problem even for homogeneous degree three polynomials. There is even a cryptographic authentication scheme (Patarin, 1996) based on the presumed average-case hardness of this problem. Here we show that at least in certain (interesting) special cases there is a polynomial-time randomized algorithm for determining this equivalence, if it exists. Somewhat surprisingly, the algorithms that we present are efficient even if the input polynomials are given as arithmetic circuits. As an application, we show that if in the key generation phase of Patarin's authentication scheme, a random multilinear polynomial is used to generate the secret, then the scheme can be broken and the secret recovered in randomized polynomial-time. Previous chapter Next chapter RelatedDetails Published:2011ISBN:978-0-89871-993-2eISBN:978-1-61197-308-2 https://doi.org/10.1137/1.9781611973082Book Series Name:ProceedingsBook Code:PR138Book Pages:xviii-1788

We study the polynomial reconstruction problem for low-degree multivariate polynomials over finite field $\mathbb{F}[2]$. In this problem, we are given a set of points $\mathbf{x}\in\{0,1\}^n$ and target values $f(\mathbf{x})\in\{0,1\}$ for each of these points, with the promise that there is a polynomial over $\mathbb{F}[2]$ of degree at most d that agrees with f at $1-\varepsilon$ fraction of the points. Our goal is to find a degree d polynomial that has good agreement with f. We show that it is NP-hard to find a polynomial that agrees with f on more than $1-2^{-d}+\delta$ fraction of the points for any $\epsilon,\delta>0$. This holds even with the stronger promise that the polynomial that fits the data is in fact linear, whereas the algorithm is allowed to find a polynomial of degree d. Previously the only known hardness of approximation (or even NP-completeness) was for the case when $d =1$, which follows from a celebrated result of Håstad [J. ACM, 48 (2001), pp. 798–859]. In the setting of Computational Learning, our result shows the hardness of nonproper agnostic learning of parities, where the learner is allowed a low-degree polynomial over $\mathbb{F}[2]$ as a hypothesis. This is the first nonproper hardness result for this central problem in computational learning. Our results can be extended to multivariate polynomial reconstruction over any finite field.

Carry-save-adder (CSA) is one of the most widely used components for fast arithmetic in industry. This paper provides a solution to the problem of finding an optimal-timing allocation of CSAs in arithmetic circuits. Namely, we present a polynomial time algorithm which finds an optimal-timing CSA allocation for a given arithmetic expression. We then extend our result for CSA allocation to the problem of optimizing arithmetic expressions across the boundary of design hierarchy by introducing a new concept, called auxiliary ports. Our algorithm can be used to carry out the CSA allocation step optimally and automatically and this can be done within the context of a standard RTL synthesis environment.

In this paper we consider the problem of determining whether an unknown arithmetic circuit, for which we have oracle access, computes the identically zero polynomial. This problem is known as the black-box polynomial identity testing (PIT) problem. Our focus is on polynomials that can be written in the form $f(\bar x) = \sum\nolimits_{i = 1}^k {h_i (\bar x) \cdot g_i (\bar x)} $, where each h i is a polynomial that depends on only ρ linear functions, and each g i is a product of linear functions (when h i = 1, for each i, then we get the class of depth-3 circuits with k multiplication gates, also known as ΣΠΣ(k) circuits, but the general case is much richer). When maxi (deg(h i · g i )) = d we say that f is computable by a ΣΠΣ(k; d;ρ) circuit. We obtain the following results. A deterministic black-box identity testing algorithm for ΣΠΣ(k; d;ρ) circuits that runs in quasi-polynomial time (for ρ=polylog(n+d)). In particular this gives the first black-box quasi-polynomial time PIT algorithm for depth-3 circuits with k multiplication gates. A deterministic black-box identity testing algorithm for read-k ΣΠΣ circuits (depth-3 circuits where each variable appears at most k times) that runs in time $n^{2^{O(k^2 )} } $. In particular this gives a polynomial time algorithm for k=O(1). Our results give the first sub-exponential black-box PIT algorithm for circuits of depth higher than 2. Another way of stating our results is in terms of test sets for the underlying circuit model. A test set is a set of points such that if two circuits get the same values on every point of the set then they compute the same polynomial. Thus, our first result gives an explicit test set, of quasi-polynomial size, for ΣΠΣ(k; d;ρ) circuits (when ρ=polylog(n+d)). Our second result gives an explicit polynomial size test set for read-k depth-3 circuits. The proof technique involves a construction of a family of affine subspaces that have a rank-preserving property that is inspired by the construction of linear seeded extractors for affine sources of Gabizon and Raz [9], and a generalization of a theorem of [8] regarding the structure of identically zero depth-3 circuits with bounded top fan-in.