ALGORITHMS BASED ON *-ALGEBRAS, AND THEIR APPLICATIONS TO ISOMORPHISM OF POLYNOMIALS WITH ONE SECRET, GROUP ISOMORPHISM, AND POLYNOMIAL IDENTITY TESTING

摘要

We consider two basic algorithmic problems concerning tuples of (skew-)symmetric matrices. The first problem asks us to decide, given two tuples of (skew-)symmetric matrices (B-1, . . . , B-m) and (C-1, . . . , C-m), whether there exists an invertible matrix A such that for every i is an element of{1, . . . , m}, A(t)B(i)A = C-i. We show that this problem can be solved in randomized polynomial time over finite fields of odd size, the reals, and the complex numbers. The second problem asks us to decide, given a tuple of square matrices (B-1, . . . , B-m), whether there exist invertible matrices A and D, such that for every i is an element of{1, . . . , m}, AB(i)D is (skew-)symmetric. We show that this problem can be solved in deterministic polynomial time over fields of characteristic not 2. For both problems we exploit the structure of the underlying *-algebras (algebras with an involutive antiautomorphism) and utilize results and methods from the module isomorphism problem. Applications of our results range from multivariate cryptography to group isomorphism and to polynomial identity testing. Specifically, these results imply efficient algorithms for the following problems. (1) Test isomorphism of quadratic forms with one secret over a finite field of odd size. This problem belongs to a family of problems that serves as the security basis of certain authentication schemes proposed by Patarin [J. Patarin, in Advances in Cryptology, EUROCRYPT '96, Springer, Berlin, 1996, pp. 33-48]. (2) Test isomorphism of p-groups of class 2 and exponent p (p odd) with order p(l) in time polynomial in the group order, when the commutator subgroup is of order pO((root l)). (3) Deterministically reveal two families of singularity witnesses caused by the skew-symmetric structure. This represents a natural next step for the polynomial identity testing problem, in the direction set up by the recent resolution of the noncommutative rank problem [A. Garg et al., in Proceedings of the 57th