50
v1v2 (latest)

Schwartz-Zippel for multilinear polynomials mod N

IACR Cryptology ePrint Archive (IACR ePrint), 2022
Abstract

We derive a tight upper bound on the probability over x=(x1,,xμ)Zμ\mathbf{x}=(x_1,\dots,x_\mu) \in \mathbb{Z}^\mu uniformly distributed in $ [0,m)^\mu$ that f(x)=0modNf(\mathbf{x}) = 0 \bmod N for any μ\mu-linear polynomial fZ[X1,,Xμ]f \in \mathbb{Z}[X_1,\dots,X_\mu] co-prime to NN. We show that for N=p1r1,...,prN=p_1^{r_1},...,p_\ell^{r_\ell} this probability is bounded by μm+i=1I1pi(ri,μ)\frac{\mu}{m} + \prod_{i=1}^\ell I_{\frac{1}{p_i}}(r_i,\mu) where II is the regularized beta function. Furthermore, we provide an inverse result that for any target parameter λ\lambda bounds the minimum size of NN for which the probability that f(x)0modNf(\mathbf{x}) \equiv 0 \bmod N is at most 2λ+μm2^{-\lambda} + \frac{\mu}{m}. For μ=1\mu =1 this is simply N2λN \geq 2^\lambda. For μ2\mu \geq 2, log2(N)8μ2+log2(2μ)λ\log_2(N) \geq 8 \mu^{2}+ \log_2(2 \mu)\cdot \lambda the probability that f(x)0modNf(\mathbf{x}) \equiv 0 \bmod N is bounded by 2λ+μm2^{-\lambda} +\frac{\mu}{m}. We also present a computational method that derives tighter bounds for specific values of μ\mu and λ\lambda. For example, our analysis shows that for μ=20\mu=20, λ=120\lambda = 120 (values typical in cryptography applications), and log2(N)416\log_2(N)\geq 416 the probability is bounded by $ 2^{-120}+\frac{20}{m}$. We provide a table of computational bounds for a large set of μ\mu and λ\lambda values.

View on arXiv
Comments on this paper