286 D. Lin et al. / Finite Fields and Their Applications 18 (2012) 283–302
the number of “equivalent” secret keys in a multivariate scheme and the total number of different
multivariate cryptographic schemes respectively.
To this end, we will extensively use tools of finite geometry [18–22]. Geometries over finite fields
study in particular the standard form of quadratic form over finite fields under some linear transfor-
mation, which is related to the IP problem.
Organization of the paper. In Section 2, we recall the definition of IP and introduce the con-
nection between IP and the matrices congruence problem. This is the key point of the paper. In
Section 3, we study the enumeration problem of polynomial isomorphism classes in two different
cases: char
(F
q
) = 2 and char(F
q
) = 2. In each case, we provide a lower bound on the total number
of (linearly) equivalence classes. Finally, in Section 4 we will give some basic results for this enu-
meration problem and consider their application to some specific multivariate cryptographic system
(C
∗
and HFE). In particular, we provide a partial answer how many different cryptographic schemes
can be derived from a monomial central function, and how many pairs of secret keys we can choose
for a fixed scheme/central function, which is the real scale of its private key space.
2. Preliminary
In this section, we recall the definition of IP problem introduced in [13] and a useful theorem
given by Kipnis and Shamir in [23] (restated by Ding, Gower and Schmidt in their book [24]) which
is about the relation between polynomials system and univariate polynomial over extension field. We
also introduce a new notation called friendly mapping. Both the theorem and friendly mapping provide
the key ingredient to connect our new tool to IP problem.
2.1. Isomorphism of polynomials
Let
F
q
be a finite field with q elements and F
q
[x
1
,...,x
n
] be the ring of polynomials in n 1
indeterminates over
F
q
.
Definition 3. We denote by P the set of all the transformations F : (x
1
,...,x
n
) → ( f
1
,..., f
n
) from F
n
q
to F
n
q
, where f
i
=
n
s
=1
s
t
=1
c
i,st
x
s
x
t
∈ F
q
[x
1
,...,x
n
]. We say that F
1
∈ P and F
2
∈ P are equivalent
if there exist two invertible linear transformations
(T , L) ∈ GL
n
(F
q
) × GL
n
(F
q
) such that F
2
= T ◦ F
1
◦ L.
Clearly, the above relation is an equivalence relation on the elements of P.Thus,P can be written
as a disjoint union of different equivalence classes. The problem of recovering the transformations T
and L is known as IP with two secrets. A restricted problem called IP with one secret (IP1S) (see [13])
involves only one transformation on the variables, namely to find L
∈ GL
n
(F
q
) such that F
2
= F
1
◦ L.
Generally, this simplification will induce more equivalence classes. Indeed, linear transformation T
mixes some classes together.
Remark 1 . Note that, in the case of q
= 2, it holds that x
2
k
= x
k
. As a consequence, the f
i
’s in Defini-
tion 3 are not always homogeneous. They are, in fact, quadratic polynomials without constant terms.
For simplicity and by abuse of language, we still refer to such polynomials as homogeneous in this
paper.
IP (as well as IP1S) can also be interpreted as a group action. Let
G = GL
n
(F
q
) × GL
n
(F
q
) be the
direct product of GL
n
(F
q
) and GL
n
(F
q
),thenG forms a group under the operation: (T
1
, L
1
) · (T
2
, L
2
) =
(
T
1
◦ T
2
, L
2
◦ L
1
). Considering G acting on the set P, we can define the invariant group of F ∈ P as
follows:
H =
(T , L): T ◦ F ◦ L = F
.
Then T
1
◦ F ◦ L
1
= T
2
◦ F ◦ L
2
iff (T
−1
1
◦ T
2
) ◦ F ◦ (L
2
◦ L
−1
1
) = F ,hence(T
−1
1
◦ T
2
, L
2
◦ L
−1
1
) ∈ H.This
means that in order to study equivalent keys, it suffices to study the invariant group H of F . H is a