First fall degree and Weil descent

Abstract

Polynomial systems arising from a Weil descent have many applications in cryptography, including the HFE cryptosystem and the elliptic curve discrete logarithm problem over small characteristic fields. Understanding the exact complexity of solving these systems is essential for the applications. A first step in that direction is to study the first fall degree of the systems. In this paper, we establish a rigorous general bound on the first fall degree of polynomial systems arising from a Weil descent. We also provide experimental data to study the tightness of our bound in general and its plausible consequences on the complexity of polynomial systems arising from a Weil descent.