English

Schwartz-Zippel for multilinear polynomials mod N

Discrete Mathematics 2022-05-06 v2 Cryptography and Security Data Structures and Algorithms

Abstract

We derive a tight upper bound on the probability over x=(x1,,xμ)Zμ\mathbf{x}=(x_1,\dots,x_\mu) \in \mathbb{Z}^\mu uniformly distributed in [0,m)μ [0,m)^\mu that f(x)=0modNf(\mathbf{x}) = 0 \bmod N for any μ\mu-linear polynomial fZ[X1,,Xμ]f \in \mathbb{Z}[X_1,\dots,X_\mu] co-prime to NN. We show that for N=p1r1,...,prN=p_1^{r_1},...,p_\ell^{r_\ell} this probability is bounded by μm+i=1I1pi(ri,μ)\frac{\mu}{m} + \prod_{i=1}^\ell I_{\frac{1}{p_i}}(r_i,\mu) where II is the regularized beta function. Furthermore, we provide an inverse result that for any target parameter λ\lambda bounds the minimum size of NN for which the probability that f(x)0modNf(\mathbf{x}) \equiv 0 \bmod N is at most 2λ+μm2^{-\lambda} + \frac{\mu}{m}. For μ=1\mu =1 this is simply N2λN \geq 2^\lambda. For μ2\mu \geq 2, log2(N)8μ2+log2(2μ)λ\log_2(N) \geq 8 \mu^{2}+ \log_2(2 \mu)\cdot \lambda the probability that f(x)0modNf(\mathbf{x}) \equiv 0 \bmod N is bounded by 2λ+μm2^{-\lambda} +\frac{\mu}{m}. We also present a computational method that derives tighter bounds for specific values of μ\mu and λ\lambda. For example, our analysis shows that for μ=20\mu=20, λ=120\lambda = 120 (values typical in cryptography applications), and log2(N)416\log_2(N)\geq 416 the probability is bounded by 2120+20m 2^{-120}+\frac{20}{m}. We provide a table of computational bounds for a large set of μ\mu and λ\lambda values.

Cite

@article{arxiv.2204.05037,
  title  = {Schwartz-Zippel for multilinear polynomials mod N},
  author = {Benedikt Bünz and Ben Fisch},
  journal= {arXiv preprint arXiv:2204.05037},
  year   = {2022}
}
R2 v1 2026-06-24T10:44:22.337Z