arXiv subjects

Roberto La Scala

Publications and source records attributed to Roberto La Scala.

17 recordsLinked to original sources

arXiv2026

Hamming Ideals and Grobner Bases for ISD-like Syndrome Decoding

We investigate an algebraic approach to the Syndrome Decoding Problem, based on a reformulation of the Hamming weight constraint and its integration with the Information Set Decoding paradigm. We begin with a systematic analysis of the Hamming variety, deriving its defining equations in terms of elementary symmetric functions. Since these equations may have high degree, we exploit convolution identities for elementary symmetric functions, together with factorizations based on Lucas' identity, to derive an equivalent formulation with auxiliary variables and equations of bounded degree. Building on this modeling, we generalize the ISD paradigm through an ISD-like decoding strategy, implemented by the GBDecode algorithm, in which only a subset of an information set is fixed. This approach reduces the size of the combinatorial search space at the cost of solving the associated multivariate nonlinear systems. To handle this algebraic component, we employ the MultiSolve algorithm, which replaces a single Grobner basis computation with a collection of computations on simpler systems, obtained by exhaustively assigning a varying number of indeterminates over the finite field. This provides a tunable balance between combinatorial search and algebraic solving. We evaluate the resulting approach experimentally on instances of the Syndrome Decoding Problem for random binary linear codes, using parameters corresponding to the NIST Security Category 1 parameter set of the Classic McEliece cryptosystem. The experiments assess the feasibility of this combinatorial-algebraic approach and provide insights into the practical behavior of Grobner basis techniques within an ISD-like decoding framework.

cs.CR↗

arXiv2026

Oracle-Based Multistep Strategy for Solving Polynomial Systems Over Finite Fields and Algebraic Cryptanalysis of the Aradi Cipher

The multistep solving strategy consists in a divide-and-conquer approach: when a multivariate polynomial system is computationally infeasible to solve directly, one variable is assigned over the elements of the base finite field, and the procedure is recursively applied to the resulting simplified systems. In a previous work by the same authors (among others), this approach proved effective in the algebraic cryptanalysis of the Trivium cipher. In this paper, we present a new formulation of the corresponding algorithm based on a Depth-First Search strategy, along with a novel complexity analysis leveraging tree structures. We also introduce the notion of an ``oracle function'', which is intended to determine whether evaluating a new variable is required to simplify the current polynomial system. This notion allows us to unify all previously proposed variants of the multistep strategy, including the classical hybrid approach, by appropriately selecting the oracle function. Finally, we employ the multistep solving strategy in the cryptanalysis of the NSA's recently introduced low-latency block cipher Aradi, achieving a first full-round algebraic attack that exposes structural features in its symbolic model.

cs.CR↗

arXiv2024

A multistep strategy for polynomial system solving over finite fields and a new algebraic attack on the stream cipher Trivium

In this paper we introduce a multistep generalization of the guess-and-determine or hybrid strategy for solving a system of multivariate polynomial equations over a finite field. In particular, we propose performing the exhaustive evaluation of a subset of variables stepwise, that is, by incrementing the size of such subset each time that an evaluation leads to a polynomial system which is possibly unfeasible to solve. The decision about which evaluation to extend is based on a preprocessing consisting in computing an incomplete Grobner basis after the current evaluation, which possibly generates linear polynomials that are used to eliminate further variables. If the number of remaining variables in the system is deemed still too high, the evaluation is extended and the preprocessing is iterated. Otherwise, we solve the system by a complete Grobner basis computation. Having in mind cryptanalytic applications, we present an implementation of this strategy in an algorithm called MultiSolve which is designed for polynomial systems having at most one solution. We prove explicit formulas for its complexity which are based on probability distributions that can be easily estimated by performing the proposed preprocessing on a testset of evaluations for different subsets of variables. We prove that an optimal complexity of MultiSolve is achieved by using a full multistep strategy with a maximum number of steps and in turn the standard guess-and-determine strategy, which essentially is a strategy consisting of a single step, is the worst choice. Finally, we extensively study the behaviour of MultiSolve when performing an algebraic attack on the well-known stream cipher Trivium.

cs.SC↗

arXiv2022

An algebraic attack to the Bluetooth stream cipher E0

In this paper we study the security of the Bluetooth stream cipher E0 from the viewpoint it is a "difference stream cipher", that is, it is defined by a system of explicit difference equations over the finite field GF(2). This approach highlights some issues of the Bluetooth encryption such as the invertibility of its state transition map, a special set of 14 bits of its 132-bit state which when guessed implies linear equations among the other bits and finally a small number of spurious keys, with 83 guessed bits, which are compatible with a keystream of about 60 bits. Exploiting these issues, we implement an algebraic attack using Gröbner bases, SAT solvers and Binary Decision Diagrams. Testing activities suggest that the version based on Gröbner bases is the best one and it is able to attack E0 in about 2^79 seconds on an Intel i9 CPU. To the best of our knowledge, this work improves any previous attack based on a short keystream, hence fitting with Bluetooth specifications.

cs.CR↗

arXiv2021

Stream/block ciphers, difference equations and algebraic attacks

In this paper we model a class of stream and block ciphers as systems of (ordinary) explicit difference equations over a finite field. We call this class "difference ciphers" and we show that ciphers of application interest, as for example systems of LFSRs with a combiner, Trivium and Keeloq, belong to the class. By using Difference Algebra, that is, the formal theory of difference equations, we can properly define and study important properties of these ciphers, such as their invertibility and periodicity. We describe then general cryptanalytic methods for difference ciphers that follow from these properties and are useful to assess the security. We illustrate such algebraic attacks in practice by means of the ciphers Bivium and Keeloq.

cs.CR↗

arXiv2020

Context-free languages and associative algebras with algebraic Hilbert series

In this paper, homological methods together with the theory of formal languages of theoretical computer science are proved to be effective tools to determine the growth and the Hilbert series of an associative algebra. Namely, we construct a class of finitely presented associative algebras related to a family of context-free languages. This allows us to connect the Hilbert series of these algebras with the generating functions of such languages. In particular, we obtain a class of finitely presented graded algebras with non-rational algebraic Hilbert series.

math.RA↗

arXiv2019

Noncommutative algebras, context-free grammars and algebraic Hilbert series

In this paper we introduce a class of noncommutative (finitely generated) monomial algebras whose Hilbert series are algebraic functions. We use the concept of graded homology and the theory of unambiguous context-free grammars for this purpose. We also provide examples of finitely presented graded algebras whose corresponding leading monomial algebras belong to the proposed class and hence possess algebraic Hilbert series.

math.RA↗

arXiv2018

Multigraded Hilbert Series of noncommutative modules

In this paper, we propose methods for computing the Hilbert series of multigraded right modules over the free associative algebra. In particular, we compute such series for noncommutative multigraded algebras. Using results from the theory of regular languages, we provide conditions when the methods are effective and hence the sum of the Hilbert series is a rational function. Moreover, a characterization of finite-dimensional algebras is obtained in terms of the nilpotency of a key matrix involved in the computations. Using this result, efficient variants of the methods are also developed for the computation of Hilbert series of truncated infinite-dimensional algebras whose (non-truncated) Hilbert series may not be rational functions. We consider some applications of the computation of multigraded Hilbert series to algebras that are invariant under the action of the general linear group. In fact, in this case such series are symmetric functions which can be decomposed in terms of Schur functions. Finally, we present an efficient and complete implementation of (standard) graded and multigraded Hilbert series that has been developed in the kernel of the computer algebra system Singular. A large set of tests provides a comprehensive experimentation for the proposed algorithms and their implementations.

math.RA↗

arXiv2017

Computing minimal free resolutions of right modules over noncommutative algebras

In this paper we propose a general method for computing a minimal free right resolution of a finitely presented graded right module over a finitely presented graded noncommutative algebra. In particular, if such module is the base field of the algebra then one obtains its graded homology. The approach is based on the possibility to obtain the resolution via the computation of syzygies for modules over commutative algebras. The method behaves algorithmically if one bounds the degree of the required elements in the resolution. Of course, this implies a complete computation when the resolution is a finite one. Finally, for a monomial right module over a monomial algebra we provide a bound for the degrees of the non-zero Betti numbers of any single homological degree in terms of the maximal degree of the monomial relations of the module and the algebra.

math.RA↗

arXiv2016

Monomial right ideals and the Hilbert series of noncommutative modules

In this paper we present a procedure for computing the rational sum of the Hilbert series of a finitely generated monomial right module $N$ over the free associative algebra $K\langle x_1,\ldots,x_n \rangle$. We show that such procedure terminates, that is, the rational sum exists, when all the cyclic submodules decomposing $N$ are annihilated by monomial right ideals whose monomials define regular formal languages. The method is based on the iterative application of the colon right ideal operation to monomial ideals which are given by an eventual infinite basis. By using automata theory, we prove that the number of these iterations is a minimal one. In fact, we have experimented efficient computations with an implementation of the procedure in Maple which is the first general one for noncommutative Hilbert series.

math.RA↗

arXiv2014

Extended letterplace correspondence for nongraded noncommutative ideals and related algorithms

Let $K\ < x_i\ >$ be the free associative algebra generated by a finite or countable number of variables $x_i$. The notion of "letterplace correspondence" introduced in [1,2] for the graded (two-sided) ideals of $K\ < x_i\ >$ is extended in this paper also to the nongraded case. This amounts to the possibility of modelizing nongraded noncommutative presented algebras by means of a class of graded commutative algebras that are invariant under the action of the monoid $\mathbb N$ of natural numbers. For such purpose we develop the notion of saturation for the graded ideals of $K\ < x_i,t\ >$, where $t$ is an extra variable and for their letterplace analogues in the commutative polynomial algebra $K[x_{ij},t_j]$, where $j$ ranges in $\mathbb N$. In particular, one obtains an alternative algorithm for computing inhomogeneous noncommutative Gröbner bases using just homogeneous commutative polynomials. The feasibility of the proposed methods is shown by an experimental implementation developed in the computer algebra system Maple and by using standard routines for the Buchberger algorithm contained in Singular. References [1] La Scala, R.; Levandovskyy, V., Letterplace ideals and non-commutative Gröbner bases. J. Symbolic Comput., 44 (2009), 1374--1393. [2] La Scala, R.; Levandovskyy, V., Skew polynomial rings, Gröbner bases and the letterplace embedding of the free associative algebra. J. Symbolic Comput., 48 (2013), 110--131

math.RA↗

arXiv2014

Noetherian quotients of the algebra of partial difference polynomials and Grobner bases of symmetric ideals

In this paper we develop a Grobner bases theory for ideals of partial difference polynomials with constant or non-constant coefficients. In particular, we introduce a criterion providing the finiteness of such bases when a difference ideal contains elements with suitable linear leading monomials. This can be explained in terms of Noetherianity of the corresponding quotient algebra. Among these Noetherian quotients we find finitely generated polynomial algebras where the action of suitable finite dimensional commutative algebras and in particular finite abelian groups is defined. We obtain therefore a consistent Grobner bases theory for ideals that possess such symmetries.

math.AC↗

arXiv2013

Groebner bases and gradings for partial difference ideals

In this paper we introduce a working generalization of the theory of Gröbner bases for algebras of partial difference polynomials with constant coefficients. One obtains symbolic (formal) computation for systems of linear or non-linear partial difference equations arising, for instance, as discrete models or by the discretization of systems of differential equations. From an algebraic viewpoint, the algebras of partial difference polynomials are free objects in the category of commutative algebras endowed with the action by endomorphisms of a monoid isomorphic to $\N^r$. Then, the investigation of Gröbner bases in this context contributes also to the current research trend consisting in studying polynomial rings under the action of suitable symmetries that are compatible with effective methods. Since the algebras of difference polynomials are not Noetherian ones, we propose in this paper a theory for grading them that provides a Noetherian subalgebras filtration. This implies that the variants of the Buchberger's algorithm we developed for difference ideals terminate in the finitely generated graded case when truncated up to some degree. Moreover, even in the non-graded case, we provide criterions for certifying completeness of eventually finite Gröbner bases when they are computed within sufficiently large bounded degrees. We generalize also the concepts of homogenization and saturation, and related algorithms, to the context of difference ideals. The feasibily of the proposed methods is shown by an implementation in Maple that is the first to provide computations for systems of non-linear partial difference equations. We make use of a test set based on the discretization of concrete systems of non-linear partial differential equations.

math.RA↗

arXiv2012

Skew polynomial rings, Groebner bases and the letterplace embedding of the free associative algebra

In this paper we introduce an algebra embedding $ι:K< X >\to S$ from the free associative algebra $K< X >$ generated by a finite or countable set $X$ into the skew monoid ring $S = P * Σ$ defined by the commutative polynomial ring $P = K[X\times N^*]$ and by the monoid $Σ= < σ>$ generated by a suitable endomorphism $σ:P\to P$. If $P = K[X]$ is any ring of polynomials in a countable set of commuting variables, we present also a general Gröbner bases theory for graded two-sided ideals of the graded algebra $S = \bigoplus_i S_i$ with $S_i = P σ^i$ and $σ:P \to P$ an abstract endomorphism satisfying compatibility conditions with ordering and divisibility of the monomials of $P$. Moreover, using a suitable grading for the algebra $P$ compatible with the action of $Σ$, we obtain a bijective correspondence, preserving Gröbner bases, between graded $Σ$-invariant ideals of $P$ and a class of graded two-sided ideals of $S$. By means of the embedding $ι$ this results in the unification, in the graded case, of the Gröbner bases theories for commutative and non-commutative polynomial rings. Finally, since the ring of ordinary difference polynomials $P = K[X\times N]$ fits the proposed theory one obtains that, with respect to a suitable grading, the Gröbner bases of finitely generated graded ordinary difference ideals can be computed also in the operators ring $S$ and in a finite number of steps up to some fixed degree.

math.RA↗

arXiv2007

Defining Relations of Low Degree of Invariants of Two $4 \times 4$ Matrices

Over a field K of characteristic 0, we study the algebra of invariants of the general linear group GL(4,K) acting by simultaneous conjugation on two matrices of order 4. It coincides with the trace algebra generated by all traces of products of two generic matrices of order 4. It is known that the minimal degree of the defining relations of any homogeneous minimal generating set of this algebra is equal to 12. Starting with the generating set given recently by Drensky and Sadikova, we have determined all relations of degree < 15. For this purpose we have developed further algorithms based on representation theory of the general linear group and easy computer calculations with standard functions of Maple.

math.RA↗

arXiv2006

Groebner bases of ideals invariant under endomorphisms

We introduce the notion of Groebner S-basis of an ideal of the free associative algebra K over a field K invariant under the action of a semigroup S of endomorphisms of the algebra. We calculate the Groebner S-bases of the ideal corresponding to the universal enveloping algebra of the free nilpotent of class 2 Lie algebra and of the T-ideal generated by the polynomial identity [x,y,z]=0, with respect to suitable semigroups S. In the latter case, if |X|>2, the ordinary Groebner basis is infinite and our Groebner S-basis is finite. We obtain also explicit minimal Groebner bases of these ideals.

math.RA↗

arXiv2002

The Knuth-Robinson-Schensted correspondence and the Weak Polynomial Identities of $M_{1,1}(E)$

In this paper it is proved that the ideal $I_w$ of the weak polynomial identities of the superalgebra $M_{1,1}(E)$ is generated by the proper polynomials $[x_1,x_2,x_3]$ and $[x_2,x_1][x_3,x_1][x_4,x_1]$. This is proved for any infinite field $F$ of characteristic different from 2. Precisely, if $B$ is the subalgebra of the proper polynomials of $F< X>$, we determine a basis and the dimension of any multihomogeneous component of the quotient algebra $B / B \cap I_w$. We compute also the Hilbert series of this algebra. One of the main tools of the paper is a variant we found of the Knuth-Robinson-Schensted correspondence defined for single semistandard tableaux of double shape.

math.RA↗