In this paper we introduce a multistep generalization of the guess-and-determine or hybrid strategy for solving a system of multivariate polynomial equations over a finite field. In particular, we propose performing the exhaustive evaluation of a subset of variables stepwise, that is, by incrementing the size of such subset each time that an evaluation leads to a polynomial system which is possibly unfeasible to solve. The decision about which evaluation to extend is based on a preprocessing consisting in computing an incomplete Grobner basis after the current evaluation, which possibly generates linear polynomials that are used to eliminate further variables. If the number of remaining variables in the system is deemed still too high, the evaluation is extended and the preprocessing is iterated. Otherwise, we solve the system by a Grobner basis computation. Having in mind cryptanalytic applications, we present an implementation of this strategy in an algorithm called MultiSolve which is designed for polynomial systems having at most one solution. We prove explicit formulas for its complexity which are based on probability distributions that can be easily estimated by performing the proposed preprocessing on a testset of evaluations for different subsets of variables. We prove that an optimal complexity of MultiSolve is achieved by using a full multistep strategy with a maximum number of steps and in turn the classical guess-and-determine strategy, which essentially is a strategy consisting of a single step, is the worst choice. Finally, we extensively study the behaviour of MultiSolve when performing an algebraic attack on the well-known stream cipher Trivium.

翻译：本文提出一种猜定与混合策略的多步推广方法，用于求解有限域上的多元多项式方程组。具体而言，我们建议逐步对变量子集进行穷举评估：即每次当评估结果导致可能无法求解的多项式方程组时，逐步增加该子集的大小。是否扩展评估取决于预处理过程——在当前评估后计算一个不完全的Grobner基，该过程可能生成用于进一步消元的线性多项式。若系统中剩余变量数量仍过高，则扩展评估并迭代预处理；否则通过Grobner基计算求解方程组。针对密码分析应用，我们设计了一种名为MultiSolve的算法实现该策略，该算法适用于至多含一个解的多项式系统。我们基于概率分布推导了其复杂度的显式公式，该分布可通过在不同变量子集的评估测试集上执行所提出的预处理过程轻松估计。证明MultiSolve的最优复杂度需采用最大步数的全多步策略，而经典猜定策略（本质上是单步策略）为最差选择。最后，我们深入研究了在对著名流密码Trivium实施代数攻击时MultiSolve的行为特性。