K.<x>
=
GF(
2
^
64
, name
=
'x'
,modulus
=
1
+
x^
1
+
x^
2
+
x^
4
+
x^
5
+
x^
7
+
x^
10
+
x^
11
+
x^
12
+
x^
13
+
x^
18
+
x^
20
+
x^
21
+
x^
22
+
x^
23
+
x^
24
+
x^
25
+
x^
26
+
x^
30
+
x^
33
+
x^
64
)
P0
=
var(
'P0'
)
P1
=
var(
'P1'
)
M0
=
var(
'M0'
)
M1
=
var(
'M1'
)
y
=
var(
'y'
)
z
=
var(
'z'
)
c0
=
var(
'c0'
)
c1
=
var(
'c1'
)
c2
=
var(
'c2'
)
c3
=
var(
'c3'
)
c4
=
var(
'c4'
)
R.<P0,P1,y,z,c0,c1,c2,c3,c4,M0,M1>
=
GF(
2
)[]
v17
=
P0
v18
=
P1
v8
=
v18
+
y
+
c0
v10
=
v8
*
v8
*
v8
v14
=
v17
+
v10
v17
=
v18
v18
=
v14
eq_forward_1
=
v18
v8
=
v18
+
z
+
c1
v10
=
v8
*
v8
*
v8
v14
=
v17
+
v10
v17
=
v18
v18
=
v14
eq_forward_2
=
v18
v8
=
v18
+
y
+
c2
v10
=
v8
*
v8
*
v8
v14
=
v17
+
v10
v17
=
v18
v18
=
v14
eq_forward_3
=
v18
v17
=
M1
v18
=
M0
v8
=
v18
+
y
+
c4
v10
=
v8
*
v8
*
v8
v14
=
v17
+
v10
v17
=
v18
v18
=
v14
eq_backward_1
=
v18
v8
=
v18
+
z
+
c3
v10
=
v8
*
v8
*
v8
v14
=
v17
+
v10
v17
=
v18
v18
=
v14
eq_backward_2
=
v18
v8
=
v18
+
y
+
c2
v10
=
v8
*
v8
*
v8
v14
=
v17
+
v10
v17
=
v18
v18
=
v14
eq_backward_3
=
v18
ct0
=
0x55250D8CEEDFFB35
ct1
=
0xDBAFC899D2AAD5EC
ct2
=
0xD30CE81D5CFD183E
ct3
=
0x3C205341A484C650
pt0
=
0x73C51960EF361B30
pt1
=
0xFBD5C824382C435D
pt2
=
0x79EEBA9CCF47A451
pt3
=
0x55B4D0E1061D12D0
cnt0
=
0x20F4641148FA59A5
cnt1
=
0x96950F0D368EB90D
cnt2
=
0x7467551A8419E0B5
cnt3
=
0x01A61218FE968D86
cnt4
=
0x192DB7EB78969270
y,z
=
K[
'y,z'
].gens()
eq1
=
\
eq_forward_1(P0
=
K.fetch_int(pt0),P1
=
K.fetch_int(pt1),c0
=
K.fetch_int(cnt0),\
c1
=
K.fetch_int(cnt1),c2
=
K.fetch_int(cnt2),c3
=
K.fetch_int(cnt3),c4
=
K.fetch_int(cnt4))\
-
eq_backward_3(M0
=
K.fetch_int(ct0),M1
=
K.fetch_int(ct1),c0
=
K.fetch_int(cnt0),\
c1
=
K.fetch_int(cnt1),c2
=
K.fetch_int(cnt2),c3
=
K.fetch_int(cnt3),c4
=
K.fetch_int(cnt4))
eq2
=
\
eq_forward_2(P0
=
K.fetch_int(pt0),P1
=
K.fetch_int(pt1),c0
=
K.fetch_int(cnt0),\
c1
=
K.fetch_int(cnt1),c2
=
K.fetch_int(cnt2),c3
=
K.fetch_int(cnt3),c4
=
K.fetch_int(cnt4))\
-
eq_backward_2(M0
=
K.fetch_int(ct0),M1
=
K.fetch_int(ct1),c0
=
K.fetch_int(cnt0),\
c1
=
K.fetch_int(cnt1),c2
=
K.fetch_int(cnt2),c3
=
K.fetch_int(cnt3),c4
=
K.fetch_int(cnt4))
eq3
=
\
eq_forward_3(P0
=
K.fetch_int(pt0),P1
=
K.fetch_int(pt1),c0
=
K.fetch_int(cnt0),\
c1
=
K.fetch_int(cnt1),c2
=
K.fetch_int(cnt2),c3
=
K.fetch_int(cnt3),c4
=
K.fetch_int(cnt4))\
-
eq_backward_1(M0
=
K.fetch_int(ct0),M1
=
K.fetch_int(ct1),c0
=
K.fetch_int(cnt0),\
c1
=
K.fetch_int(cnt1),c2
=
K.fetch_int(cnt2),c3
=
K.fetch_int(cnt3),c4
=
K.fetch_int(cnt4))
eq4
=
\
eq_forward_1(P0
=
K.fetch_int(pt2),P1
=
K.fetch_int(pt3),c0
=
K.fetch_int(cnt0),\
c1
=
K.fetch_int(cnt1),c2
=
K.fetch_int(cnt2),c3
=
K.fetch_int(cnt3),c4
=
K.fetch_int(cnt4))\
-
eq_backward_3(M0
=
K.fetch_int(ct2),M1
=
K.fetch_int(ct3),c0
=
K.fetch_int(cnt0),\
c1
=
K.fetch_int(cnt1),c2
=
K.fetch_int(cnt2),c3
=
K.fetch_int(cnt3),c4
=
K.fetch_int(cnt4))
eq5
=
\
eq_forward_2(P0
=
K.fetch_int(pt2),P1
=
K.fetch_int(pt3),c0
=
K.fetch_int(cnt0),\
c1
=
K.fetch_int(cnt1),c2
=
K.fetch_int(cnt2),c3
=
K.fetch_int(cnt3),c4
=
K.fetch_int(cnt4))\
-
eq_backward_2(M0
=
K.fetch_int(ct2),M1
=
K.fetch_int(ct3),c0
=
K.fetch_int(cnt0),\
c1
=
K.fetch_int(cnt1),c2
=
K.fetch_int(cnt2),c3
=
K.fetch_int(cnt3),c4
=
K.fetch_int(cnt4))
eq6
=
\
eq_forward_3(P0
=
K.fetch_int(pt2),P1
=
K.fetch_int(pt3),c0
=
K.fetch_int(cnt0),\
c1
=
K.fetch_int(cnt1),c2
=
K.fetch_int(cnt2),c3
=
K.fetch_int(cnt3),c4
=
K.fetch_int(cnt4))\
-
eq_backward_1(M0
=
K.fetch_int(ct2),M1
=
K.fetch_int(ct3),c0
=
K.fetch_int(cnt0),\
c1
=
K.fetch_int(cnt1),c2
=
K.fetch_int(cnt2),c3
=
K.fetch_int(cnt3),c4
=
K.fetch_int(cnt4))
I
=
ideal(eq1,eq2,eq3,eq4,eq5,eq6)
B
=
I.groebner_basis()
key0
=
hex
(B[
0
].coefficients()[
1
].integer_representation())
key1
=
hex
(B[
1
].coefficients()[
1
].integer_representation())
print
(key0,key1)