Recently, there are many researches [5] [3] [7] [4] that, under the first fall degree assumption, the complexity of ECDLP over Fpn where p is small prime and the extension degree n is input size, is subexponential. However, from the recent research, the first fall degree assumption seems to be doubtful. Koster [2] shows that the problem for deciding whether the value of Semaev’s formula Sm(x1, ..., xm) is 0 or not, is NPcomplete. This result directly does not means ECDLP being NP-complete, but, it suggests ECDLP being NP-complete. Further, in [7], Semaev shows that the equations system using m − 2 number of S3(x1, x2, x3), which is equivalent to decide whether the value of Semaev’s formula Sm(x1, ..., xm) is 0 or not, has constant(not depend on m and n) first fall degree. So, under the first fall degree assumption, its complexity is poly in n (O(n)). And so, suppose P 6= NP , which almost all researcher assume this, it has a contradiction and we see that first fall degree assumption is not true. Koster shows the NP-completeness from the group belonging problem, which is NPcomplete, reduces to the problem for deciding whether the value of Semaev’s formula Sm(x1, ..., xm) is 0 or not, in polynomial time. In this paper, from another point of view, we discuss this situation. Here, we construct some equations system defined over arbitrary field K and its first fall degree is small, from any 3SAT problem. The cost for solving this equations system is polynomial times under the first fall degree assumption. So, 3SAT problem, which is NP-complete, reduced to the problem in P under the first fall degree assumption. Almost all researcher assume P 6= NP , and so, it concludes that the first fall degree assumption is not true. However, we can take K = R(not finite field!!!). It means that 3SAT reduces to solving multivariable equations system defined over R and there are many method for solving this by numerical computation. So, I must point out the very small possibility that NP complete problem is reduces to solving cubic equations equations system over R which can be solved in polynomial time.
[1]
Stephen A. Cook,et al.
The complexity of theorem-proving procedures
,
1971,
STOC.
[2]
Koh-ichi Nagao.
Equations System coming from Weil descent and subexponential attack for algebraic curve cryptosystem
,
2013,
IACR Cryptol. ePrint Arch..
[3]
Igor A. Semaev.
Summation polynomials and the discrete logarithm problem on elliptic curves
,
2004,
IACR Cryptol. ePrint Arch..
[4]
Jean-Jacques Quisquater,et al.
On Polynomial Systems Arising from a Weil Descent
,
2012,
ASIACRYPT.
[5]
Igor A. Semaev,et al.
New algorithm for the discrete logarithm problem on elliptic curves
,
2015,
IACR Cryptol. ePrint Arch..
[6]
Koh-ichi Nagao.
Complexity of ECDLP under the First Fall Degree Assumption
,
2015,
IACR Cryptol. ePrint Arch..