A correct justification for the CHMT algorithm for solving underdetermined multivariate systems

Abstract

Cheng et al. (2014) [6] introduced a substantial improvement to the Miura-Hashimoto-Takagi algorithm for solving sufficiently underdetermined systems of multivariate polynomial equations. This improvement claimed to make the algorithm polynomial time for instances satisfying $n\ge \left(\begin{array}{c}m+1\\ 2\end{array}\right)$, where m is the number of equations and n is the number of variables. While experimentally, the algorithm seems to work, we have uncovered a subtle error in the proof of time complexity for the algorithm. Due to the fact that there have been multiple proposals for algorithms based on this and related algorithms, as well as the recent submission to NIST's call for additional post-quantum digital signatures of a more modern “provably secure” version of the famous UOV digital signature algorithm based on the foundational structure of this algorithm, our observation may highlight a concerning theoretical deficiency in this area of research.

In this work, we provide a tight justification for the polynomial time complexity of the algorithm (with a very minor tweak), thereby justifying the complexity of enhancements based upon it as well. At the heart of this justification is a precise calculation of the probability of recovering a maximal depth path in polynomially many steps within a possibly exponentially large search tree. While this algorithmic problem is generic, we find that the parameters relevant for the application to the above algorithm are extremal and poorly studied. Thus, our analysis serves to clarify the boundary behavior of such search algorithms with respect to complexity classes.