let f(x) = t(s(x)^2), where s,t:L->L are linear, [L:K]=n, char(K)>2 then g(x,y) = f(x+y)-f(x-y) = 4 t(s(x) s(y)) is bilinear. if we fix x, then g(x,y) = 4 s(x) t(s(y)), and we can compute (t o s):L->L up to scaling by a constant do this for x_1,..,x_n, and we learn s(x_i) then from knowledge of s and t o s we can learn t alternatively, let (D_y f)(x) = f(x+y)-f(x) = t([s(x)+s(y)]^2 - s(x)^2) = t(s(y)^2 - 2s(x)s(y)); then this is affine in x if we fix y, and the above ideas work. higher-order diff. crypt.: if V is a vector space with basis v1,..,vn, define D_V f = D_v1 D_v2 ... D_vn f. fact: if f has degree d and dim V = d, then D_V f is a constant follows from the fact that deg (D_v f) <= deg f - 1. if f(x) = t(s(x)^3) over L with char(L)=2, then note that from v=u^3 we can get u*v = u^4, noting u^4 is linear in u, hence there is a polynomial p(x,y) so that p(x,f(x)) = 0 for all x and so that p is of degree 1 in x and in y separately (total degree 2), hence you can use Gaussian elimination to find p, and then given y you can find x s.t. p(x,y) = 0 by linear algebra. generalization: the "affine multiple" attack note that we had a multiple A(u,v) = uv - u^4 of f(u)-v = u^3 - v so that A is affine in u if we fix v. in general, such an A(u,v) is known as an "affine multiple" of f(u)-v. fact: given any polynomial f(x), there exists an "affine multiple" A(x,y) so that A(x,y) is a multiple of f(x) - y and moreover A(x,y) is linear in x when you fix y. note: A can be computed by looking at 1, x, x^q, .., x^{q^{n-1}} mod f(x), where q = |K|, and then finding a linear relation (over K) among these n+1 polynomials (such a relation must exist, since we have n+1 polynomials over L, and L is an extension of K of degree n) of course, finding the "affine multiple" might be hard in general, we can use Gaussian elimination if the degree of A in y is low (if deg_y A(x,y) <= k when x is fixed, then the multivariate polynomial A(x,y) is a sum of at most n^{k+1} monomials, hence with Gaussian elimination we can solve for the n^{k+1} unknown coefficients with O(n^{3k+3}) work) once you find an affine multiple, you can use it to break the scheme ---- how to solve over-determined systems of equations of low degree the quadratic case: linearization - given m^2/2 quadratic equations in m unknowns x_1,..,x_m, can solve by introducing m^2/2 new variables y_{ij} = x_i * x_j and then using Gaussian elimination - given em^2 quadratic equations in m unknowns, the solution space is a linear subspace of dimension (1/2 - e)m^2, and each solution can be expressed as a linear function of (1/2 - e)m^2 variables z_k relinearization - note that y_ij y_kl = y_ik y_jl = y_il y_jk = x_i*x_j*x_k*x_l, which gives two linearly independent equations for every 4-tuple of indices - there are m^4/4! 4-tuples, so we get m^4/12 equations in m^2/2 unknowns y_ij - using above idea, we can express this as m^4/12 equations in (1/2 - e)m^2 unknowns z_k - now we can solve this new system in any way. - e.g., by linearization: we get m^4/12 equations in (1/2 - e)^2 m^4/2 unknowns a_kl - solvable if m^4/12 >= (1/2 - e)^2 m^4/2, i.e., if (1/2 - e)^2 >= 1/6, i.e., if 1/2 - e >= 1/sqrt(6), i.e., if e <= 1/2 - sqrt(6) ~= 0.1 - or, by re-linearization again (just keep going recursively) - similarly, we can consider 2k-tuples and look at new equations generalizations: - higher-degree cases: same ideas apply - low-weight case: if we have p_i(x_1,..,x_m) = 0 for i=1,..,l, and each p_i is of low weight, then linearization needs fewer equations let S_i = set of monomials in p_i, let S = union_i S_i; if l = number of equations >= |S|, then linearization works