Skip to main content
2 of 3
edited tags
LeechLattice
  • 9.5k
  • 2
  • 23
  • 57

Hardness of solving $0=\sum_{i=1}^k \mathrm{linear}_i(x_1,..,x_n)^D$ over the rationals

This is related to cryptography and this question and another question.

In short, we are asking about decomposing multivariate polynomial as sum of perfect powers of linear polynomials.

Working over $\mathbb{Q}[x_1,...,x_n]$

Let $l_i(x_i)$ be $k$ linear polynomials such that the linear system $l_1=l_2=...l_k=0$ has solution $S_0$.

Let $D$ be positive integer and define $F=\sum_{i=1}^k l_i^D$.

$F$ is given as sum of monomials and $F(S_0)=0$.

$l_i$ are kept secret as trapdoor.

Q1 Are the there choices of $n,k,D,l_i$ such that finding solution of $F=0$ is infeasible?

Q2 Same as Q1, but in addition we are given one solution $S_1$ such that $F(S_1)=0$.

Q3 Same as Q1, but in addition we are given many solutions $S_i$ such that $F(S_i)=0$.

joro
  • 25.4k
  • 10
  • 66
  • 121