\section{Introduction}

Cryptographic schemes are mainly classified into public key cryptography and symmetric key cryptography.
In symmetric key encryption schemes, both the sender and the receiver of a message use a common key, therefore they have to share the common key in advance.
Public key cryptographic schemes used for this purpose are called key exchange protocols.
The famous key exchange protocols include RSA-based one \cite{RSA1} and Diffie--Hellman key exchange \cite{Diffie}.

For the widely used public key cryptosystems at the present such as RSA cryptosystem \cite{RSA2} and elliptic curve cryptosystems \cite{elliptic,elliptic2}, it has been known that Shor's quantum algorithm \cite{Shor} can break these schemes in polynomial time.
This means that those cryptosystems will be vulnerable once a large-scale quantum computer is developed in future.
As a countermeasure, post-quantum cryptography (PQC) has been studied intensively, which is the class of (public key) cryptographic schemes secure even against quantum algorithms.
NIST has started the standardization process for PQC since 2017, and a lot of candidates have been submitted.
Among them, one of the main candidates for PQC is multivariate cryptography, which is based on the hardness of solving a system of multivariate non-linear equations.

In 2019, Akiyama et al.~\cite{Akiyama} proposed a key exchange protocol which is based on the hardness of solving a system of multivariate non-linear equations but yet has a design strategy different from ordinary multivariate cryptography.
Namely, ordinary multivariate cryptography intends to conceal the internal structure by using compositions of maps, while Akiyama et al.'s scheme uses both composition and addition of maps to conceal the central map $\mvec{\psi}$.
Although their construction improved a previous protocol \cite{Yosh} in reducing the ciphertext size, the original version of their protocol has a drawback that $\mvec{\psi}$ has to be an injective polynomial map, which decreases the number of candidates for $\mvec{\psi}$ and hence weakens the security.
They also proposed a countermeasure that enables to use non-injective $\mvec{\psi}$ for strengthening the security, but this increases the failure probability of establishing a common key.
This trade-off should be resolved in order to make the scheme practically useful.

\subsection{Our Contributions}

In this paper, we give an improvement of the key exchange protocol by Akiyama et al.~\cite{Akiyama} in reducing the failure probability while keeping the security level.
Roughly speaking, in the improved version of Akiyama et al.'s protocol, one of the two parties solves a certain system of polynomial equations defined over a prime field $\mathbb{F}_q$ in order to determine the common key.
The main reason of the larger failure probability is that the system of equations frequently has two or more solutions in $\mathbb{F}_q^n$ and therefore the correct common key is not uniquely determined.
Our main idea is to restrict the range of the correct common key (i.e., the correct solution of the system of equations) into $\mathbb{Z}_p^n \subseteq \mathbb{F}_q^n$ for smaller $p < q$ instead of the whole of $\mathbb{F}_q^n$.
(This idea is inspired by the construction of \cite{Akiyama2}.)
Even if the system of equations has multiple solutions in $\mathbb{F}_q^n$, the solution in $\mathbb{Z}_p^n$ will be unique with high probability, which enables the party to successfully determine the correct common key.
Our proposed protocol with sizes of parameters $q$ and $n$ similar to those of \cite{Akiyama} indeed reduces the failure probability significantly.
Moreover, we propose a parameter set for our proposed protocol that might achieve both failure probability $2^{-120}$ and $128$-bit security level.
We theoretically estimate an upper bound for the failure probability in order to confirm the former property, and discuss the security level against some typical kinds of attacks (Gr\"{o}bner basis computation, linear algebraic attack, etc.) in order to confirm the latter property.

\subsection{Organization of This Paper}

Section \ref{sec:preliminaries} summarizes some notations and basic properties such as properties of Gr\"{o}bner basis.
In Section \ref{sec:previous_scheme}, we recall the construction of the previous protocol in \cite{Akiyama} and summarize advantages and disadvantages of the previous protocol.
In Section \ref{sec:proposed_protocol}, we describe our proposed protocol and give a theoretical estimate of an upper bound for failure probability of the protocol.
Section \ref{sec:experimental_results} summarizes the results of our computer experiments about our proposed protocol.
Section \ref{sec:comparison} summarizes the results of comparison between our proposed protocol and the previous protocol in \cite{Akiyama}.
Finally, in Section \ref{sec:security_evaluation}, we evaluate the security of our proposed protocol.

\section{Preliminaries}
\label{sec:preliminaries}

In this section, we recall algebraic definitions needed to understand the algorithms, and introduce PME problem, which is the base of the security of the existing method.

\subsection{Notation}

Let $\mathbb{F}_q$ denote the finite field of $q$ elements and $\mvec{x} := (x_1, \dots, x_n)$ for $n$ variables $x_1,\dots,x_n$.
Then, $f(\mvec{x})$ expresses a polynomial map of $n$ variables.
We refer to $\mathbb{F}_q[\mvec{x}]$ as the polynomial ring of $n$ variables on coefficient ring $\mathbb{F}_q$, and express $(\psi_1(\mvec{x}),\dots,\psi_m(\mvec{x}))$ as $\mvec{\psi}(\mvec{x})$ for polynomial maps of $n$ variables $\psi_1(\mvec{x}),\dots,\psi_m(\mvec{x})$.
Then we define the degree of $\mvec{\psi}$ by $\deg \mvec{\psi} := \max\{\deg \psi_1,\dots,\deg \psi_n\}$.
In particular, polynomial maps of degree one are called affine maps.

For polynomial maps $\mvec{\psi}=(\psi_1,\dots,\psi_m)$ of $n$ variables and $\mvec{\phi}=(\phi_1,\dots,\phi_n)$, we define the composed map $\mvec{\psi}\circ \mvec{\phi}$ by $\mvec{\psi}\circ \mvec{\phi} = (\psi_1(\phi_1,\dots,\phi_n),\dots,\psi_m(\phi_1,\dots,\phi_n))$.
In this paper, we use the following classes of polynomials:
\[
\begin{split}
\Lambda_{n,d} &:= \{f \in \mathbb{F}_q[x_1, \dots, x_n] \mid \deg f = d\} \enspace,\\
\Lambda_{n,d}^m &:= \{\mvec{f} \in \mathbb{F}_q[x_1, \dots, x_n]^m \mid \deg \mvec{f} = d\} \enspace,\\
(\Lambda_{n,d}^n)^* &:= \{\mvec{\psi} \in \Lambda_{n,d}^n \mid \mvec{\psi} \mbox{ is injective}\} \enspace.
\end{split}
\]
Moreover, $\xleftarrow{r}S$ represents that we choose randomly from the set $S$.

\subsection{PME Problem}
\label{subsec:PME_problem}

PME problem was introduced by Akiyama et al.~\cite{Akiyama}, which is the base of the security of their previous method.
The definition is as follows.

\begin{definition}
[PME problem]
For $(f(\mvec{x}), c_1(\mvec{x}), \dots, c_n(\mvec{x})) \in \mathbb{F}_q[\mvec{x}]^{n+1}$ and $(u_1, \dots, u_n) \in \mathbb{F}_q^n$,
PME (Polynomial Map Equation) problem is a problem of finding a solution to the system of multivariate polynomial equations
\begin{eqnarray*}
  \begin{cases}
    f(x_1, \cdots, x_n) = 0 \\
    c_1(x_1, \cdots, x_n) = u_1\\
    \qquad\vdots\\
    c_n(x_1, \cdots, x_n) =u_n \enspace.\\
  \end{cases}
\end{eqnarray*}
\end{definition}

\subsection{Gr\"{o}bner Basis}

Here we summarize some basics for Gr\"{o}bner basis.
See e.g., \cite{text} for the details.

First, we define the monomial term set $\mathcal{M}_n$ of polynomial ring $K[\mvec{x}]$ on coefficient field $K$:
\begin{eqnarray*}
    \mathcal{M}_n:=\{x_1^{\alpha_1}\cdots x_n^{\alpha_n}\mid(\alpha_1, \cdots, \alpha_n) \in (\mathbb{Z}_{\geq 0})^n\} \enspace.
\end{eqnarray*}

\begin{definition}
[monomial order]
For a strict partial order $\succ$ on $\mathcal{M}_n$, $\succ$ is called monomial order when it satisfies the following three conditions.
\begin{enumerate}
\item
$\succ$ is a total order.
\item
Any subset $S \neq \emptyset$ of $\mathcal{M}_n$ has the minimum element about $\succ$.
\item
If $s,t \in \mathcal{M}_n$ and $s \succ t$, then for any element $u$ of $\mathcal{M}_n$, we have $su \succ tu$.
\end{enumerate}
\end{definition}

\begin{example}
[lexicographical order]
We define the lexicographical order $\succ_{lex}$ on $\mathcal{M}_n$ by
\[
x_1^{\alpha_1} \cdots x_n^{\alpha_n} \succ_{lex} x_1^{\beta_1} \cdots x_n^{\beta_n} \Leftrightarrow 1 \leq \exists i \leq n \mbox{ s.t.\ } \alpha_j = \beta_j \mbox{ ($1 \leq j \leq i-1$) and } \alpha_i > \beta_i \enspace.
\]
Then it is known that $\succ_{lex}$ is a monomial order.
\end{example}

\begin{definition}
[leading term]
Let $f \in K[\mvec{x}]$.
The leading term of $f$ is the maximum monomial (with coefficient) in $f$ with respect to a given monomial order $\succ$, and it is expressed as $LT_{\succ}(f)$.
\end{definition}

Then the following holds about division of multivariate polynomials.

\begin{proposition}
Let $\mathcal{G}=\{g_1,\dots,g_s\}$ be a finite subset of $K[\mvec{x}]\setminus \{0\}$.
For each $f \in K[\mvec{x}]$, there exist $h_1,\dots,h_s,r \in K[\mvec{x}]$ satisfying the following:
\begin{itemize}
\item
$f = h_1 g_1 + \cdots h_s g_s + r$.
\item
Each monomial appearing in $r$ is not divisible by $LT_{\succ}(g_i)$ for any $1 \leq i \leq s$.
\end{itemize}
\end{proposition}

In the above situation, we write the term $r$ as $\overline{f}^{\succ, \mathcal{G}}$ and call it remainder of $f$ about $\succ$ divided by $\mathcal{G}$.
Now Gr\"{o}bner basis is defined as follows.

\begin{definition}
[Gr\"{o}bner basis]
A finite subset $\mathcal{G}=\{g_1,\dots,g_s\}$ of $K[\mvec{x}] \setminus \{0\}$ is a Gr\"{o}bner basis of an ideal $\mathcal{I} \subseteq K[\mvec{x}]$ about $\succ$ when it satisfies the following condition: For any $f \in \mathcal{I} \setminus \{0\}$, $LT_{\succ}(g_i)$ divides $LT_{\succ}(f)$ for some $1 \leq i \leq s$.
\end{definition}

We note that this definition is equivalent to saying that for any $f \in \mathcal{I} \setminus \{0\}$, the remainder always satisfies that $\overline{f}^{\succ, \mathcal{G}} = 0$.

Hereinafter, we consider solving a system of multivariate non-linear polynomial equations using Gr\"{o}bner basis.
First, we formulate the problem as follows.

\begin{problem}
Given $s$ polynomials $f_1,\dots,f_s \in K[\mvec{x}]$ in $n$ variables $\mvec{x}$, find $(a_1,\dots,a_n) \in K^n$ such that $f_1(a_1,\dots,a_n)= \cdots =f_s(a_1,\dots,a_n)=0$.
\end{problem}

We reformulate this problem in a way that we can apply Gr\"{o}bner basis to the problem.

\begin{problem}
\label{prob:zero_set}
Let $\mathcal{I} \subseteq K[\mvec{x}]$ be the ideal generated by $f_1,\dots,f_s \in K[\mvec{x}]$.
Then find the zero set $V(\mathcal{I}) := \{(a_1,\cdots,a_n)\in K^n \colon f(a_1,\dots,a_n)=0 \mbox{ for any } f \in \mathcal{I}\}$.
\end{problem}

For Gr\"{o}bner basis about lexicographical order, the following property is useful.

\begin{theorem}
For lexicographical order $\succ_{lex}$ with $x_1 \succ x_2 \succ \cdots \succ x_n$, let $\mathcal{G}$ be a Gr\"{o}bner basis of an ideal $\mathcal{I} \subseteq K[\mvec{x}]$ about $\succ_{lex}$.
Then, for any $1 \leq \ell \leq n$, $\mathcal{G} \cap K[x_{\ell}, \dots,x_n]$ is a Gr\"{o}bner basis of the ideal $\mathcal{I} \cap K[x_{\ell}, \dots,x_n]$ of $K[x_{\ell}, \dots,x_n]$.
\end{theorem}

This theorem enables us to reduce Problem \ref{prob:zero_set} to solving problems in less variables.
Moreover, when the ideal $\mathcal{I}$ is a zero-dimensional ideal (in the sense explained below), we can reduce the problem to a further easier one.

\begin{definition}
[zero-dimensional ideal]
An ideal $\mathcal{I} \subseteq K[\mvec{x}]$ is a zero-dimensional ideal when the quotient space $K[\mvec{x}] / \mathcal{I}$ is a finite-dimensional linear space over $K$.
\end{definition}

A Gr\"{o}bner basis $\mathcal{G}= \{g_1,\cdots,g_s\}$ of a zero-dimensional ideal $\mathcal{I}$ about lexicographical order satisfies (with a certain ordering for the elements of $\mathcal{G}$) that for each $1 \leq i \leq n$, $g_i$ is a polynomial in $x_1,\dots,x_i$.
This fact makes it possible to solve the original system of equations by solving univariate non-linear equations finitely many times.

Buchberger's algorithm, $F_4$ algorithm \cite{F4}, and $F_5$ algorithm \cite{F5} are frequently used to calculate Gr\"{o}bner basis.
When the ideal in the problem is a zero-dimensional ideal, we can estimate the computational complexity of $F_5$, which is the best algorithm among them, by using the notion of degree of regularity explained below.

\begin{definition}
[degree of regularity]
We define the degree of regularity of a zero-dimensional ideal $\mathcal{I}=\langle f_1,\dots,f_s\rangle$ by
\begin{eqnarray*}
d_{reg} := \min\left\{ d\geq 0\mid \dim \{ f \in I \colon f \mbox{ is homogeneous of degree } d \} = \binom{n+d-1}{d} \right\} \enspace.
\end{eqnarray*}
\end{definition}

\begin{definition}
[$d$-regular]
For an overdetermined system of polynomial equations $f_1 = \cdots = f_s = 0$ ($s \geq n$) whose polynomials generate a zero-dimensional ideal, this equation system is $d$-regular when the following holds for any $1 \leq i \leq s$ and $g \in K[\mvec{x}]$:
\begin{center}
If $\deg(g) < d-\deg(f_i)$ and $gf_i \in \langle f_1,\dots,f_{i-1}\rangle$, then $g \in \langle f_1,\dots,f_{i-1}\rangle$.
\end{center}
\end{definition}

\begin{definition}
[semi-regular]
A system of polynomial equations is semi-regular when it is $d_{reg}$-regular.
\end{definition}

The following result is shown in \cite{Grobner}.

\begin{theorem}
\label{thm:complexity_of_F5}
For a semi-regular system of polynomial equations, the complexity of $F_5$ algorithm is estimated as
\begin{eqnarray*}
O\left({\binom{n+d_{reg}}{n}}^{\omega}\right)
\end{eqnarray*}
where $\omega<2.39$ denotes the linear algebra constant.
\end{theorem}

\section{The Previous Protocol}
\label{sec:previous_scheme}

In this section, we summarize the previous protocol proposed by Akiyama et al.~\cite{Akiyama}.

\subsection{The Original Protocol}

Here we describe the original version of the previous protocol given in Section 4 of \cite{Akiyama}.
In the protocol, Alice and Bob are going to agree on a common key using a public channel.
We use the following parameters:
\begin{align*}
q \colon& \mbox{prime number which is the number of elements of the coefficient field}\\
n \colon& \mbox{number of variables}\\
m \colon& \mbox{degree of polynomials generated by Bob}\\
d \colon& \mbox{degree of polynomal generated by Alice}
\end{align*}
The protocol is as follows (see also Figure \ref{fig:previous_protocol}).
\begin{enumerate}
\item \label{previous_algorithm__Alice}
Alice sends a multivariate equation $f(\mvec{x})=0$ to Bob and keeps its solution $\mvec{\sigma} \in \mathbb{F}_q^n$ secret.
The detail is as follows:
\begin{enumerate}
\item
Generate a polynomial $f(\mvec{x}) \in \mathbb{F}_q[\mvec{x}]$ of degree $d$ uniformly at random.
\item
Generate a solution $\mvec{\sigma} \in \mathbb{F}_q^n$ of $f(\mvec{x})=0$ as follows.
First, generate $\sigma_1, \dots, \sigma_{n-1} \in \mathbb{F}_q$ uniformly at random.
Then, solve a univariate equation $f(\sigma_1, \dots, \sigma_{n-1}, x_n)=0$ in $x_n$ and keep a solution $\sigma_n$; if it cannot be solved, then modify the constant term and restart generating $\sigma_1, \dots, \sigma_{n-1}$.
\item
Keep the solution $\mvec{\sigma} = (\sigma_1, \dots, \sigma_{n-1}, \sigma_n) \in \mathbb{F}_q^n$.
\item
Send $f(\mvec{x})$ to Bob.
\end{enumerate}
\item
Bob sends multivariate polynomials $\mvec{g}(\mvec{x})$ and $\mvec{c}(\mvec{x})$ to Alice.
The detail is as follows:
\begin{enumerate}
\item
Generate a bijective affine map $\mvec{g}(\mvec{x}) = (g_1(\mvec{x}), \dots, g_n(\mvec{x})) \in \mathbb{F}_q[\mvec{x}]^n$ uniformly at random.
\item
Generate an injective polynomial map $\mvec{\psi}(\mvec{x}) = (\psi_1(\mvec{x}), \dots, \psi_n(\mvec{x})) \in \mathbb{F}_q[\mvec{x}]^n$ of degree $\deg \psi_j = m$ ($1 \leq j \leq n$) randomly.
\item
Compute $\mvec{\psi}(\mvec{g}(\mvec{x}))$.
\item
Generate a polynomial map $\mvec{r}(\mvec{x}) = (r_1(\mvec{x}), \dots, r_n(\mvec{x})) \in \mathbb{F}_q[\mvec{x}]^n$ of degree $\deg r_j = m-d$ ($1 \leq j \leq n$) uniformly at random.
\item
Compute a polynomial map $\mvec{c}(\mvec{x}) = \mvec{\psi}(\mvec{g}(\mvec{x})) + f(\mvec{x})\mvec{r}(\mvec{x})$.
\item
Send $\mvec{g}(\mvec{x})$ and $\mvec{c}(\mvec{x})$ to Alice.
\end{enumerate}
\item
Alice computes a common key $\mvec{s} \in \mathbb{F}_q^n$, and sends $\mvec{u} \in \mathbb{F}_q^n$ to Bob.
The detail is as follows:
\begin{enumerate}
\item
Compute $\mvec{g}(\mvec{\sigma}) = \mvec{s}$, and keeps $\mvec{s}$ as a common key.
\item
Compute $\mvec{c}(\mvec{\sigma}) = \mvec{u}$, and send $\mvec{u}$ to Bob.
\end{enumerate}
\item \label{previous_algorithm__Bob}
Bob computes a common key $\mvec{s}$ as follows.
Since $f(\mvec{\sigma})= 0$ implies $\mvec{c}(\mvec{\sigma}) = \mvec{\psi}(\mvec{g}(\mvec{\sigma})) = \mvec{u}$, Bob can compute the common key $\mvec{s}$ by applying $\mvec{\psi}^{-1}$ to $\mvec{u}$:
\begin{eqnarray*}
\mvec{\psi}^{-1}(\mvec{u}) = \mvec{g}(\mvec{\sigma}) =\mvec{s} \enspace.
\end{eqnarray*}
\end{enumerate}
\begin{figure}[t!]
\centering
\begin{tabular}{|lll|}
\hline
Alice      &         & Bob        \\ \hline
$\mvec{\sigma} \stackrel{r}{\leftarrow} \mathbb{F}_q^n$&         &            \\
$f \stackrel{r}{\leftarrow} \Lambda_{n,d}$&         &\\
$f(\mvec{\sigma}) = 0$ & $\xrightarrow{f}$& $\mvec{g} \stackrel{r}{\leftarrow} \Lambda_{n,1}^n$ \\
           &         & $\mvec{\psi} \stackrel{r}{\leftarrow} (\Lambda_{n,m}^n)^*$\\
           &         & $\mvec{r} \stackrel{r}{\leftarrow} \Lambda_{n,m-d}^n$\\
           &$\xleftarrow{\left(\mvec{g}, \mvec{c}\right)}$& $\mvec{c}:=\mvec{\psi}\circ\mvec{g}+f\mvec{r}$\\
$\mvec{s}:=\mvec{g}(\mvec{\sigma})$   &  & \\
$\mvec{u}:=\mvec{c}(\mvec{\sigma})$  &$\xrightarrow{\mvec{u}}$&  $\mvec{s}=\mvec{\psi}^{-1}(\mvec{u})$\\\hline
\end{tabular}
\caption{The previous protocol}
\label{fig:previous_protocol}
\end{figure}

\subsection{An Improved Version in the Original Paper}
\label{subsec:previous_improvement}

In this section, we explain the improvement of the protocol above given in the original paper to increase the possibilities of multivariate polynomial map $\mvec{\psi}$.
In the original protocol, we restricted the polynomial map $\mvec{\psi}$ to be injective in order Bob to obtain the common key uniquely.
In contrast, here we use a general polynomial map $\mvec{\psi}$, and from the candidate set $\mvec{\psi}^{-1}(\mvec{u})$ of common keys, we exclude ones which do not satisfy the necessary condition $f = 0$.
Precisely, we change Step \ref{previous_algorithm__Bob} of the algorithm in the following manner:
\begin{itemize}
\item[(a)]
Compute the set $\mvec{\psi}^{-1}(\mvec{u})$.
\item[(b)]
If $\#\mvec{\psi}^{-1}(\mvec{u}) = 1$, then keep the $\mvec{s} \in \mvec{\psi}^{-1}(\mvec{u})$ as the common key and halt.
\item[(c)]
If $\#\mvec{\psi}^{-1}(\mvec{u}) \neq 1$, then compute all elements of $S := \{ \mvec{s} \in \mvec{\psi}^{-1}(\mvec{u})\mid f( \mvec{g}^{-1}(\mvec{s}) ) = 0\}$.
In other words, for each element $\mvec{s}$ of $\mvec{\psi}^{-1}(\mvec{u})$, check whether it satisfies that $f( \mvec{g}^{-1}(\mvec{s}) ) = 0$, and if not, exclude the $\mvec{s}$ from the set $S$.
\item[(d)]
If finally $\#S = 1$, then keep the element of $S$ as the common key; otherwise, restart from Step \ref{previous_algorithm__Alice}.
\end{itemize}

\subsection{Advantage of the Previous Protocol}

The protocol constructs a ciphertext in a way different from the usual multivariate cryptography (using a central map and composing it with two affine maps), and consequently, there is a possibility to reduce the parameter size and the ciphertext size by avoiding known attacks to multivariate cryptosystems.
Also, the protocol was an improvement of Yosh's protocol \cite{Yosh} and succeeded in decreasing the degree of polynomials from exponential order to polynomial order, which improves the efficiency.

\subsection{Disadvantage of the Previous Protocol}
\label{sec:previous_protocol__disadvantage}

The improvement in Section \ref{subsec:previous_improvement} aimed at enhancing the security by enlarging the possibility of the map $\mvec{\psi}$.
However, even though an additional check using the condition $f(\mvec{\sigma})=0$ is introduced, there may be risk of failure of the protocol due to non-injectivity of $\mvec{\psi}$.
In fact, for the experiments of the protocol performed in the original paper \cite{Akiyama}, the highest average success rate with their proposed parameters was only $89.9\%$.
In contrast, practically desirable values of failure rates are of the order of $2^{-64}$ or even smaller.
Therefore, the success rate of the previous protocol has to be much improved.

\section{Our Proposed Protocol}
\label{sec:proposed_protocol}

\subsection{Protocol Description}

Similarly to \cite{Akiyama}, Alice and Bob are going to agree on a common key using a public channel.
In addition to the originally used parameters, we introduce parameters $p$ related to the range of the common key and $\ell$ determining the number of equations in $f$.
From now, we regard $\mathbb{Z}_p := \{0,1,\dots,p-1\} \subseteq \mathbb{F}_q$.
\begin{align*}
q \colon& \mbox{prime number which is the number of elements of the coefficient field}\\
p \colon& \mbox{integer related to the range of the common key}\\
n \colon& \mbox{number of variables}\\
m \colon& \mbox{degree of polynomials generated by Bob}\\
d \colon& \mbox{degree of polynomial generated by Alice}\\
\ell \colon& \mbox{number of polynomials generated by Alice}
\end{align*}
Our proposed protocol is as follows (see also Figure \ref{fig:proposed_protocol}):
\begin{enumerate}
\item \label{item:proposed_protocol_Alice}
Alice sends a system of multivariate polynomial equations $\mvec{f}(\mvec{x})=0$ to Bob, and keeps its solution $\underline{s}$ belonging to $\mathbb{Z}_p^n \subseteq \mathbb{F}_q^n$ as the common key.
The detail is as follows:
\begin{enumerate}
\item
Generate a uniformly random $\mvec{s} \in \mathbb{Z}_p^n$, which will be the common key.
\item
Generate a system of degree-$d$ polynomials $\tilde{f}(\mvec{x}) = (\tilde{f}_1(\mvec{x}),\dots,\tilde{f}_{\ell}(\mvec{x})) \in \mathbb{F}_q[\mvec{x}]^{\ell}$ uniformly at random.
\item
Compute $\mvec{f}(\mvec{x}) := (f_1(\mvec{x}),\dots,f_{\ell}(\mvec{x})) = \tilde{f}(\mvec{x})-\tilde{f}(\mvec{s})$.
\item
Send $\mvec{f}(\mvec{x})$ to Bob.
\end{enumerate}
\item
Bob sends a polynomial map $\mvec{c}(\mvec{x})$ to Alice.
The detail is as follows:
\begin{enumerate}
\item
Randomly generate a polynomial map $\mvec{\psi}(\mvec{x}) = (\psi_1(\mvec{x}), \dots, \psi_n(\mvec{x})) \in \mathbb{F}_q[\mvec{x}]^n$ of degree $\deg \psi_j = m$ ($1 \leq j \leq n$).
\item
Generate a polynomial map $\mvec{r}(\mvec{x}) = (r_1(\mvec{x}), \dots, r_n(\mvec{x})) \in \mathbb{F}_q[\mvec{x}]^n$ of degree $\deg r_j = m-d$ ($1 \leq j \leq n$) uniformly at random.
\item
Choose $(t_1,\dots,t_n) \in \{1,\dots,\ell\}^n$ uniformly at random.
\item
Compute $c_i(\mvec{x}) = \psi_i(\mvec{x}) + f_{t_i}(\mvec{x})r_i(\mvec{x})$ for each $1 \leq i \leq n$.
\item
Send $\mvec{c}(\mvec{x})$ to Alice.
\end{enumerate}
\item
Alice computes $\mvec{c}(\mvec{s}) = \mvec{u}$ and sends $\mvec{u}$ to Bob.
\item
Bob computes the common key $\mvec{s}$.
The detail is as follows:
\begin{enumerate}
\item
Compute the set $\mvec{\psi}^{-1}(\mvec{u}) \cap \mathbb{Z}_p^n$.
\item
If $\#\mvec{\psi}^{-1}(\mvec{u}) \cap \mathbb{Z}_p^n = 1$, then keep the $\mvec{s} \in \mvec{\psi}^{-1}(\mvec{u}) \cap \mathbb{Z}_p^n$ as the common key and halt.
\item
If $\#\mvec{\psi}^{-1}(\mvec{u}) \cap \mathbb{Z}_p^n \neq 1$, then compute all elements of $S = \{ \mvec{s} \in \mvec{\psi}^{-1}(\mvec{u}) \cap \mathbb{Z}_p^n \mid \mvec{f}(\mvec{s}) = 0 \}$.
\item
If $\#S = 1$, then keep the element of $S$ as the common key; otherwise, restart from Step \ref{item:proposed_protocol_Alice}.
\end{enumerate}
\end{enumerate}
\begin{figure}[t!]
  \centering
  \begin{tabular}{|lll|}
  \hline
  Alice      &         & Bob        \\ \hline
  $\mvec{s} \stackrel{r}{\leftarrow} \mathbb{Z}_p^n$&         &            \\
  $\mvec{f} \stackrel{r}{\leftarrow} \Lambda_{n,d}^{\ell}$&         &\\
  $\mvec{f}(\mvec{s}) = 0$ & $\xrightarrow{\mvec{f}}$&  $\mvec{\psi} \stackrel{r}{\leftarrow} \Lambda_{n,m}^n$\\
             &         & $\mvec{r} \stackrel{r}{\leftarrow} \Lambda_{n,m-d}^n$\\
             &         & $t_i \stackrel{r}{\leftarrow} \{1,\dots,\ell\}$\\
             &$\xleftarrow{\mvec{c}}$& $c_i:=\psi_i+f_{t_i}r_i$\\
  $\mvec{u}:=\mvec{c}(\mvec{s})$  &         &\\
  &$\xrightarrow{\mvec{u}}$&  $\mvec{s}\in \mvec{\psi}^{-1}(\mvec{u}) \cap \mathbb{Z}_p^n$\\
  &         & s.t.\ $\mvec{f}(\mvec{s})=0$\\\hline
\end{tabular}
\caption{Our proposed protocol}
\label{fig:proposed_protocol}
\end{figure}

\subsection{Construction of Easy-to-Invert Polynomials}

In our proposed protocol, the total efficiency depends highly on the efficiency of generating the polynomial map $\mvec{\psi}$ and computing the inverse $\mvec{\psi}^{-1}$.
Therefore, it is important to use polynomial maps $\mvec{\psi}$ that can be efficiently generated and whose preimage can be efficiently computed.
Here we adopt polynomial systems where the number of variables in each polynomial is gradually incremented, such as in Gr\"{o}bner basis of a zero-dimensional ideal about lexicographical order (see an example below).
For such a polynomial system, its preimage can be recursively computed by solving univariate polynomial equations and then substituting the solutions to the remaining polynomials.
In our proposed protocol, we only need solutions belonging to $\mathbb{Z}_p^n$, therefore we have to only keep the solutions of the univariate equations belonging to $\mathbb{Z}_p$, and we can prune some branches when a solution in $\mathbb{Z}_p$ does not exist.
This reduces the computational cost drastically, in contrast to the original protocol where we needed to solve univariate equations $d^n$ times.

\begin{example}
Here we give a toy example of our polynomial systems in the case of degree two with three variables over coefficient field $\mathbb{F}_5$:
\begin{eqnarray*}
  \left\{
    \begin{array}{l}
  \psi_1(\underline{x}) = 3{x_1}^2 + x_1 +  4 \\
  \psi_2(\underline{x}) = {x_2}^2 + 2{x_1}{x_2} + 4 x_1 + x_2 + 3  \\
  \psi_3(\underline{x}) = 4{x_1}^2 + 2{x_3}^2 + {x_1}{x_3} + 3{x_2}{x_3} + 1
\end{array}
\right.
\end{eqnarray*}
\end{example}

\subsection{Theoretical Estimate of Failure Probability}
\label{subsec:error_bound_analysis}

Here, for parameters $(q,p,n,m,d,\ell)$, we estimate the failure probability of our proposed protocol.
Here the \lq\lq failure\rq\rq{} means the case where two or more candidates remain after the computation by Bob to determine the common key (i.e., the protocol is restarted at the final step).
In order to estimate the failure probability, we analyze the expected number of candidates for the common key computed by Bob.
Recall that Bob's computation at the step consists of the following two steps:
\begin{enumerate}
\item \label{error_analysis_step1}
Computing the preimage of $\mvec{\psi}$ in $\mathbb{Z}_p^n$.
\item \label{error_analysis_step2}
From the candidates obtained at Step \ref{error_analysis_step1}, excluding ones that do not satisfy the condition $\mvec{f} = 0$.
\end{enumerate}
We divide the argument into the two steps above.
From now, we focus on the case $m = 2$ and $d = 1$ which are our proposed parameters.

\paragraph{For Step \ref{error_analysis_step1}.}

Recall that now $\psi_1$ is a quadratic polynomial in $x_1$, $\psi_2$ is a quadratic polynomial in $x_1,x_2$, and so on, and $\psi_n$ is a quadratic polynomial in $x_1,\dots,x_n$.
Consequently, we can solve the system of equations by recursively solving univariate quadratic equations.
We represent this process by using a rooted tree structure from $0$-th level (root) to $n$-th level, where a node at $k$-th level corresponds to a partial solution $(s_1,\dots,s_k)$ obtained from the first $k$ polynomials $\psi_1,\dots,\psi_k$.
Hence the nodes at $n$-th level represent the candidates for the common key computed by Bob.
Now for each node $(s_1,\dots,s_k)$ at $k$-th level ($0 \leq k \leq n - 1$), there are the following three possibilities;
\begin{itemize}
\item
the node has no child nodes (that is, the quadratic equation $\psi_{k+1}(s_1,\dots,s_k,x_{k+1})$ has no solution $x_{k+1} \in \mathbb{Z}_p$);
\item
the node has only one child node (that is, the quadratic equation $\psi_{k+1}(s_1,\dots,s_k,x_{k+1})$ has a unique solution $x_{k+1} \in \mathbb{Z}_p$);
\item
the node has two child nodes (that is, the quadratic equation $\psi_{k+1}(s_1,\dots,s_k,x_{k+1})$ has two different solutions $x_{k+1} \in \mathbb{Z}_p$).
\end{itemize}

Here we note that there is always at least one path from the root to a node at $n$-th level, which corresponds to the \lq\lq correct\rq\rq{} solution chosen by Alice.
We call it the correct path.
From now, we evaluate (by using some heuristic assumptions) an upper bound for the expected number of \lq\lq incorrect\rq\rq{} solutions, that is, paths from the root to a node at $n$-th level different from the correct path.

First we consider the case that the correct path has another branch at $k$-th level ($0 \leq k \leq n - 1$).
We note that the current equation $\psi_{k+1}(s_1,\dots,s_k,x_{k+1})$ has at least one solution in $\mathbb{F}_q$ (which is the correct solution), therefore it has two solutions in $\mathbb{F}_q$.
By heuristically assuming that the other solution is uniformly random over $\mathbb{F}_q$, the probability of branching, i.e., the probability that the other solution is in $\mathbb{Z}_p$ and is different from the correct solution, is at most $p/q$.

Secondly, in a situation where a node, say $v$, at $k$-th level ($1 \leq k \leq n - 1$) that is not on the correct path exists, we evaluate the expected number of child nodes of $v$.
To simplify the argument, here we heuristically assume that the behavior of child nodes of $v$ is independent of the behaviors at the previous levels.
Now it seems not easy for evaluating the probability that the current univariate quadratic equation has a solution in $\mathbb{F}_q$ (note that if it has a solution in $\mathbb{F}_q$, then it has two solutions in $\mathbb{F}_q$ possibly with multiplicity); to derive an upper bound, here we just bound the probability from above by $1$.
We also heuristically assume that now the two solutions distribute independently and uniformly at random over $\mathbb{F}_q$.
Under the assumption, the probability that the node $v$ has a first child node (that is, at least one of the two solutions belongs to $\mathbb{Z}_p$) is given by $1 - (1 - p/q)^2 = 2p / q - (p/q)^2 \leq 2p / q$; and the probability that the node $v$ has the second child node (that is, both of the two solutions belong to $\mathbb{Z}_p$ and these are different) is given by $(p/q) \cdot (p-1)/q \leq (p/q)^2$.
Hence, the expected number of child nodes of $v$ is upper bounded by $\alpha := 2p / q + (p/q)^2$.

By heuristically assuming that the behavior of each level is independent of each other, the expected number of nodes at $n$-th level appearing after branching from the correct path at $k$-th level (now the node $v$ above is at $(k+1)$-th level) is upper bounded by $\alpha^{n-(k+1)}$.
Therefore, the expected number of incorrect solutions is upper bounded by
\[
\sum_{k=0}^{n-1} \frac{ p }{ q } \cdot \alpha^{n-(k+1)}
= \frac{ p }{ q } \cdot \frac{ 1 - \alpha^n }{ 1 - \alpha}
= \frac{ p }{ q } \cdot \frac{ 1 - (2p / q + (p/q)^2)^n }{ 1 - (2p / q + (p/q)^2) } \enspace.
\]

\paragraph{For Step \ref{error_analysis_step2}.}

To simplify the argument, we heuristically assume that the values of $f_i(\mvec{s}')$ ($1 \leq i \leq \ell$) for an incorrect solution $\mvec{s}'$ are uniformly random over $\mathbb{F}_q$ and independent of each other.
Under the assumption, the probability that an incorrect solution $\mvec{s}'$ satisfies that $\mvec{f}(\mvec{s}') = 0$ is $1/q^{\ell}$.

\paragraph{}
Summarizing, by writing the number of incorrect candidates for the common key computed by Bob as $X$, we have
\[
\mathbb{E}[X]
\leq \frac{ p }{ q } \cdot \frac{ 1 - (2p / q + (p/q)^2)^n }{ 1 - (2p / q + (p/q)^2) } \cdot \frac{ 1 }{ q^{\ell} } \enspace.
\]
Our proposed protocol fails if and only if $X \geq 1$, and by Markov's Inequality, its probability is bounded by
\begin{equation}
\label{eq:theoretical_upper_bound}
Pr[X \geq 1]
\leq \mathbb{E}[X]
\leq \frac{ p }{ q } \cdot \frac{ 1 - ( 2p/q + (p/q)^2 )^n }{ 1 - ( 2p/q + (p/q)^2 ) } \cdot \frac{ 1 }{ q^{\ell} } \enspace.
\end{equation}
By substituting our choice of parameters
\[
(q,p,n,m,d,\ell) = (46116646144580573897,19,32,2,1,1)
\]
into the formula above, we obtain an estimated upper bound $8.93 \times 10^{-39} \approx 1.52 \times 2^{-127}$ for the failure probability.

\section{Experimental Results}
\label{sec:experimental_results}

In this section, we explain our experimental results on our proposed protocol.
We used a PC with 8 GB memory and 2 GHz Intel Core i5, and used Magma for implementation.

\subsection{Confirmation of the Theoretical Upper Bound}

In order to confirm that our theoretical upper bound in Eq.\eqref{eq:theoretical_upper_bound} under several heuristic assumptions is not too optimistic, we executed our proposed protocol many times and observed whether a failure occurs or not.
Here we used another parameter set $(q,p,n,m,d,\ell)=(130337,19,32,2,1,1)$, as the original parameter yields too small estimated failure probability and therefore it is not feasible to confirm it experimentally.
For our parameter here, the theoretical upper bound in Eq.\eqref{eq:theoretical_upper_bound} becomes $1.12 \times 10^{-9}$.
On the other hand, we performed $100000$ trials with the parameter and no failure occurred during the experiment.
At least this experimental result does not contradict the theoretical estimate.

\subsection{Experiments with Parameters Similar to the Previous Protocol}
\label{sec:experimental_results__similar_parameter}

For the sake of comparison, as a parameter set similar to $(q,n,m,d)=(4,25,2,1)$ used in the previous protocol \cite{Akiyama}, we performed experiments using parameter $(q,p,n,m,d,\ell)=(7,2,32,2,1,1)$.
We executed our protocol $300$ times, and the protocol succeeded $287$ times, therefore the success ratio was about $95.6\%$.
This improves the success ratio $89.9\%$ of the previous protocol mentioned in Section \ref{sec:previous_protocol__disadvantage}.
We note that the theoretical upper bound in Eq.\eqref{eq:theoretical_upper_bound} of the failure probability with this parameter becomes $0.118$, which indeed bounds the experimental failure ratio $0.044$.

We also performed experiments using another parameter $(q,p,n,m,d,\ell) = (7,4,32,2,1,1)$; in this case, the protocol succeeded only $20$ times among $300$ trials.
The significantly lower success ratio would be caused by the property that now the ratio $p / q$ of the range of the correct solution among the whole coefficient field becomes too large.
In fact, now the theoretical upper bound in Eq.\eqref{eq:theoretical_upper_bound} of the failure probability becomes $3.88 \times 10^5$ which is a meaningless value.

\subsection{Computational Time for Our Protocol}

Table \ref{tab:execution_time} shows the computational times of our protocol with parameter
\[
(q,n,m,d,\ell) = (46116646144580573897,32,2,1,1)
\]
and various choices of $p = 19$, $19^2$, $19^3$.
The execution time increased when $p$ becomes larger, but the change of execution times among these choices of $p$ is not significantly large.
The reason would be that now the ratio $p/q$ is too small (e.g., $p/q = 1.49 \times 10^{-16}$ when $p = 19^3$) to affect the number of nodes in the tree (that is, the total number of equations to be solved).
\begin{table}[t!]
  \centering
  \caption{Computational times for our proposed protocol with $p = 19$, $19^2$, and $19^3$}
  \label{tab:execution_time}
  \begin{tabular}{|c|c|c|} \hline
      $p$& total time for $1000$ executions (s) & average time (s) \\ \hline
      $19$ & $71.460$ & $7.15 \times 10^{-2}$\\
      $19^2$ & $72.800$ & $7.28 \times 10^{-2}$\\
      $19^3$ & $239.370$ & $2.39 \times 10^{-1}$\\ \hline
  \end{tabular}
\end{table}

\subsection{Relation between Failure Ratios and Parameter $\ell$}

One of the main difference of our proposed protocol from the previous protocol is that now we may use $\ell \geq 1$ conditions $\mvec{f} = 0$, not only a single condition, to exclude the incorrect common keys.
Table \ref{tab:probability_with_various_l} shows the numbers of success (among $1000$ trials) in our experiments with two parameter sets $(q,p,n,m,d) = (5,2,32,2,1)$ and $(3,2,32,2,1)$ and various choices of $\ell = 1,\dots,5$.
The result shows that the failure ratio decreases when $\ell$ increases, which is consistent with the theoretical estimate given in Section \ref{subsec:error_bound_analysis}.
\begin{table}[t!]
\centering
\caption{Numbers of success with various choices of $\ell$ ($1000$ trials for each parameter)}
\label{tab:probability_with_various_l}
  \begin{tabular}{|c|c|c|} \hline
    $(q,p,n,m,d)$ & $(5,2,32,2,1)$ & $(3,2,32,2,1)$\\ \hline
    $\ell = 1$ & $806$ &  $26$\\
    $\ell = 2$ & $950$ & $186$\\
    $\ell = 3$ & $993$ & $552$\\
    $\ell = 4$ & $996$ & $802$\\
    $\ell = 5$ & $999$ & $945$\\ \hline
  \end{tabular}
\end{table}

\subsection{Degree of Regularity}
\label{sec:experimental_result__degree_of_regularity}

Here we explain our experiments about the degree of regularity used in Section \ref{sec:security_evaluation__Grobner_basis}.
If we consider to solve the system of equations $\mvec{f}(\mvec{x}) = 0$ and $\mvec{c}(\mvec{x}) = \mvec{u}$ in $\mathbb{F}_q^n$ instead of $\mathbb{Z}_p^n$, the corresponding ideal is generated by $\mvec{f}(\mvec{x})$, $c_1(\mvec{x}) - u_1, \dots, c_n(\mvec{x}) - u_n$.
In order to add the constraint that the solution has to be found in $\mathbb{Z}_p^n$, we introduce the following polynomial system $\mvec{h}$:
\begin{eqnarray*}
h_i(\mvec{x}) = \prod_{\gamma = 0}^{p-1} (x_i - \gamma) \mbox{ ($1 \leq i \leq n$)} \enspace.
\end{eqnarray*}
Now the set of solutions in $\mathbb{Z}_p^n$ corresponds to the ideal $\mathcal{I}$ generated by $\mvec{f}(\mvec{x})$, $c_1(\mvec{x}) - u_1, \dots, c_n(\mvec{x}) - u_n$, and $\mvec{h}(\mvec{x})$.
We fix parameters $(q,m,d,\ell) = (46116646144580573897,2,1,1)$, and calculated the degree of regularity for the cases $2 \leq n \leq 10$ and $p \in \{2,3,4,19\}$.
The result was that the degree of regularity of the ideal $\mathcal{I}$ is always $d_{reg} = n + 1$.
Due to the result, we can expect that the degree of regularity of any ideal of this type would be $d_{reg} = n + 1$ regardless of whether $p$ is larger than $n$ or smaller than $n$; this observation will be applied in Section \ref{sec:security_evaluation__Grobner_basis} to the case $p = 19$ and $n = 32$.

\section{Comparison with Previous Protocol}
\label{sec:comparison}

\subsection{Failure Probabilities of Protocols}

As shown in Section \ref{subsec:error_bound_analysis}, the failure probability of our proposed protocol with the proposed parameter set is of the order of $10^{-39}$, which is significantly lower than the experimentally derived failure ratio $10.1\%$ of the previous protocol.
We emphasize that this improvement is not just due to different choices of parameters; the argument in Section \ref{sec:experimental_results__similar_parameter} showed that our proposed protocol also improves the previous protocol even with the choice of similar parameters.

We also note that, while the previous paper \cite{Akiyama} did not give any theoretical analysis for failure probabilities with various parameters, we give a theoretical estimate in Eq.\eqref{eq:theoretical_upper_bound} for failure probabilities of our proposed protocol, which suggests that the failure probability will be reduced when $q$ becomes larger and $p/q$ becomes smaller.

\subsection{Necessary Numbers of Communication Rounds}
\label{sec:comparison__rounds}

Here we suppose that the \lq\lq practical failure probability\rq\rq{} of key exchange protocols is $2^{-120} \approx 7.52 \times 10^{-37}$, taken from the failure probability with a parameter set LightSaber-KEM of SABER \cite{SABER} which is one of the Round 3 Finalists of NIST PQC standardization.
The failure probability of one execution of the previous protocol is $0.101$, therefore $37$ trials are needed to achieve the overall failure probability $2^{-120}$.
One protocol execution uses two communication rounds between Alice and Bob, therefore the total number of communication rounds is $2 \times 37 = 74$.
In contrast, our proposed protocol with the proposed parameter set already achieves failure probability $1.52 \times 2^{-127} < 2^{-120}$, therefore the required number of communication rounds is just two.

\subsection{Communication Complexity}

We compare the amount of communication bits between Alice and Bob, for our proposed protocol and the previous protocol.
Here we express a polynomial as a vector of its coefficients; a polynomial of degree $d$ with $n$ variables is represented by a vector of dimension $\sum_{k=0}^{d} \binom{k+n-1}{k}$.
Also, we suppose that an element of $\mathbb{F}_q$ is represented by $\log_{2}q$ bits.

In the previous protocol, the communicated objects are $f = \mvec{f}$, $\mvec{g}$, $\mvec{c}$, and $\mvec{u}$.
Here $f$ is a single degree-$d$ polynomial with $n$ variables over $\mathbb{F}_q$; $\mvec{g}$ consists of $n$ degree-$1$ polynomials with $n$ variables (each having $n + 1$ coefficients) over $\mathbb{F}_q$; $\mvec{c}$ consists of $n$ degree-$m$ polynomials with $n$ variables over $\mathbb{F}_q$; and $\mvec{u}$ is an $n$-dimensional vector over $\mathbb{F}_q$.
Therefore, the numbers of communicated elements of $\mathbb{F}_q$ are as in the left column of Table \ref{tab:communication_complexity}.
\begin{table}[t!]
\centering
\caption{Comparison of communication complexity}
\label{tab:communication_complexity}
  \begin{tabular}{|c|c|c|} \hline
     & previous protocol ($\times \log_2 q$ bits) & our protocol ($\times \log_2 q$ bits) \\ \hline
    $\mvec{f}$ & $\sum_{k=0}^{d} \binom{k+n-1}{k}$ & $\ell \cdot \sum_{k=0}^{d} \binom{k+n-1}{k}$ \\
    $\mvec{g}$ & $n^2+n$ & --- \\
    $\mvec{c}$ & $n \cdot \sum_{k=0}^{m} \binom{k+n-1}{k}$ & $n \cdot \sum_{k=0}^{m} \binom{k+n-1}{k}$ \\
    $\mvec{u}$ & $n$ & $n$\\
    total & $\sum_{k=0}^{d} \binom{k+n-1}{k} + n \cdot \sum_{k=0}^{m} \binom{k+n-1}{k} + n^2 + 2n$ & $\ell \cdot \sum_{k=0}^{d} \binom{k+n-1}{k} + n \cdot \sum_{k=0}^{m} \binom{k+n-1}{k} + n$ \\ \hline
  \end{tabular}
\end{table}

In our proposed protocol, the changes from the previous protocol are the following two points; the number of polynomials in $\mvec{f}$ becomes $\ell$ instead of one; and $\mvec{g}$ is not communicated.
Therefore, the numbers of communicated elements of $\mathbb{F}_q$ are as in the right column of Table \ref{tab:communication_complexity}.

For a parameter set $(q,n,m,d) = (9,50,2,1)$ used in the previous paper \cite{Akiyama}, the communication complexity of one execution of the previous protocol is $2.19 \times 10^5$ bits.
As the previous protocol needs $37$ trials to achieve the practical failure probability (see Section \ref{sec:comparison__rounds}), the total communication complexity becomes $8.10 \times 10^6$ bits.
In contrast, our proposed protocol with the proposed parameter
\[
(q,p,n,m,d,\ell) = (46116646144580573897,19,32,2,1,1)
\]
achieves the practical failure probability by only one execution, and the communication complexity is $1.18 \times 10^6$ bits.
Hence our proposed protocol improves the communication complexity compared to the previous protocol.

\section{Security Evaluation}
\label{sec:security_evaluation}

In this section, we analyze the security of our proposed protocol.

\subsection{Constrained PME Problem}
\label{subsec:constrained_PME_problem}

Here we define a computational problem named constrained PME problem, which is a modification of PME problem described in Section \ref{subsec:PME_problem} and is a base of the security of our proposed protocol.

\begin{problem}
[constrained PME problem]
For $(f_1(\mvec{x}), \dots, f_{\ell}(\mvec{x}), c_1(\mvec{x}), \dots, c_n(\mvec{x})) \in \mathbb{F}_q[\mvec{x}]^{n + \ell}$ and $(u_1, \dots, u_n) \in \mathbb{F}_q^n$, constrained PME problem is a problem of finding a solution to the system of multivariate polynomial equations that belongs to $\mathbb{Z}_p^n$:
\begin{eqnarray*}
  \begin{cases}
    f_1(x_1, \dots, x_n) = 0 \\
    \qquad\vdots\\
    f_{\ell}(x_1, \dots, x_n) = 0 \\
    c_1(x_1, \dots, x_n) = u_1\\
    \qquad\vdots\\
    c_n(x_1, \dots, x_n) =u_n \enspace.
  \end{cases}
\end{eqnarray*}
\end{problem}

\subsection{Security against Key Recovery Attacks}

As well as the previous paper \cite{Akiyama}, in this paper, we consider the security against the Key Recovery Attack by Honest Passive Observer (KRA-HPO).
In the scenario, an attacker is supposed to not interfere with the communication between Alice and Bob.
Then we prove that our proposed protocol is secure in this sense by assuming the hardness of constrained PME problem defined above.

To formulate the security, let $\Sigma$ denote our proposed key exchange protocol, as described in Figure \ref{fig:our_protocol_for_security_definition}.
Let $\mathcal{A}$ denote an adversary's attack algorithm.
Then we define the security experiment for KRA-HPO adversary as in Figure \ref{fig:KRA-HPO_experiment}, where $\mathsf{Gen}$ denotes an algorithm to generate the parameters of our proposed protocol.
Now we define the security as follows:
\begin{figure}[t!]
\centering
\begin{tabular}{|l|}
\hline
$\Sigma(q,p,n,m,d,\ell)$              \\ \hline
$\mvec{f}$ $\stackrel{r}{\leftarrow}$ $\mathbb{F}_q[\mvec{x}]^{\ell};$\\
$f(\mvec{s})$ $=$ $0, \mvec{s} \stackrel{r}{\leftarrow} \mathbb{Z}_p^n;$\\
$\mvec{r}$ $\stackrel{r}{\leftarrow}$ $\Lambda_{n, m-d}^{n};$\\
$\mvec{\psi}$ $\stackrel{r}{\leftarrow}$ $\Lambda_{n,m}^n;$\\
$t_i$ $\stackrel{r}{\leftarrow}$ $\{1,\dots,\ell\};$\\
$c_i$ $\leftarrow$ $\psi_i + f_{t_i}\cdot r_i;$\\
$\mvec{u}$ $\leftarrow$ $\mvec{c}(\mvec{s});$\\
Output $(\mvec{s},\mvec{f},\mvec{c},\mvec{u})$\\
\hline
\end{tabular}
\caption{Our proposed key exchange protocol $\Sigma$}
\label{fig:our_protocol_for_security_definition}
\end{figure}
\begin{figure}[t!]
\centering
\begin{tabular}{|l|}
\hline
$\mathsf{Exp}_{\Sigma, \mathcal{A}}^{\mathrm{KRA-HPO}}(\kappa)$        \\ \hline
$(q,p,n,m,d,\ell)\stackrel{r}{\leftarrow} \mathsf{Gen}(1^{\kappa});$\\
$(\mvec{s},\mvec{f},\mvec{c},\mvec{u})\stackrel{r}{\leftarrow}\Sigma(q,p,n,m,d,\ell);$\\
$\mvec{s}{}' \leftarrow\mathcal{A}(\mvec{f},\mvec{c},\mvec{u});$\\
Output $( \mvec{s}, \mvec{s}{}' )$\\
\hline
\end{tabular}
\caption{Security experiment for KRA-HPO adversary $\mathcal{A}$ against protocol $\Sigma$}
\label{fig:KRA-HPO_experiment}
\end{figure}

\begin{definition}
We say that the key exchange protocol $\Sigma$ is KRA-HPO secure when for any probabilistic polynomial-time (PPT) adversary $\mathcal{A}$, its advantage defined below is negligible in the security parameter $\kappa$:
\begin{eqnarray*}
\mathsf{Adv}_{\Sigma, \mathcal{A}}^{\mathrm{KRA-HPO}}(\kappa) := \Pr[\mvec{s} = \mvec{s}{}' \mid (\mvec{s}, \mvec{s}{}' ) \leftarrow \mathsf{Exp}_{\Sigma, \mathcal{A}}^{\mathrm{KRA-HPO}}(\kappa)] \enspace.
\end{eqnarray*}
\end{definition}

We also put the following assumption on the hardness of constrained PME problem:

\begin{assumption}
[hardness of constrained PME problem]
Suppose that $\mvec{f}$, $\mvec{c}$, and $\mvec{u}$ are chosen as in our proposed protocol.
We assume that for any PPT algorithm $\mathcal{B} = \mathcal{B}(1^{\kappa},\mvec{f},\mvec{c},\mvec{u})$, the probability that its output $\mvec{s}{}'$ satisfies that $\mvec{f}(\mvec{s}{}') = 0$ and $\mvec{c}(\mvec{s}{}') = \mvec{u}$ is negligible in $\kappa$.
\end{assumption}

Then we have the following theorem:

\begin{theorem}
Under the assumption on the hardness of constrained PME problem explained above, our proposed protocol $\Sigma$ is KRA-HPO secure.
In more detail, if a PPT adversary $\mathcal{A}$ breaks the security of $\Sigma$ with advantage $\mathsf{Adv}_{\Sigma, \mathcal{A}}^{\mathrm{KRA-HPO}}(\kappa)$, then there exists a PPT algorithm $\mathcal{B}$ solving the constrained PME problem with probability at least $\mathsf{Adv}_{\Sigma, \mathcal{A}}^{\mathrm{KRA-HPO}}(\kappa)$.
\end{theorem}
\begin{proof}
Given an adversary $\mathcal{A}$ as in the statement, we define an algorithm $\mathcal{B}(1^{\kappa},\mvec{f},\mvec{c},\mvec{u})$ as follows: it runs $\mathcal{A}(\mvec{f},\mvec{c},\mvec{u})$ to obtain $\mvec{s}{}'$, and outputs the $\mvec{s}{}'$.
This $\mathcal{B}$ is PPT as well as $\mathcal{A}$.
Now the condition $\mvec{s}{}' = \mvec{s}$ holds in the experiment $\mathsf{Exp}_{\Sigma, \mathcal{A}}^{\mathrm{KRA-HPO}}(\kappa)$ with probability $\mathsf{Adv}_{\Sigma, \mathcal{A}}^{\mathrm{KRA-HPO}}(\kappa)$, and if it happens, then the output of $\mathcal{B}$ also satisfies that $\mvec{s}{}' = \mvec{s}$ and (as $\mvec{f}(\mvec{s}) = 0$ and $\mvec{c}(\mvec{s}) = \mvec{u}$ by the definition) hence $\mvec{f}(\mvec{s}{}') = 0$ and $\mvec{c}(\mvec{s}{}') = \mvec{u}$, i.e., $\mathcal{B}$ solves the constrained PME problem.
Hence the claim holds.
\end{proof}

\subsection{On Solving the Problem Using Gr\"{o}bner Basis}
\label{sec:security_evaluation__Grobner_basis}

In order to confirm our security assumption described above, here we consider to solve the constrained PME problem by computing Gr\"{o}bner basis of the ideal $\mathcal{I}$ generated by $\mvec{f}(\mvec{x})$, $c_1(\mvec{x}) - u_1,\dots,c_n(\mvec{x}) - u_n$, and $\mvec{h}(\mvec{x})$, where the polynomials $\mvec{h}$ are as defined in Section \ref{sec:experimental_result__degree_of_regularity}.
The experimental result described in Section \ref{sec:experimental_result__degree_of_regularity} suggests that the ideal $\mathcal{I}$ is semi-regular; if it is true, then we have the degree of regularity $d_{reg} = 33$ for $\mathcal{I}$.
Now when we want to compute a Gr\"{o}bner basis of $\mathcal{I}$ by using $F_5$ algorithm, the computational complexity is estimated (as in Theorem \ref{thm:complexity_of_F5}) as the order of $\binom{n + d_{reg}}{n}^{\omega}$.
By substituting $n = 32$, $d_{reg}= 33$, and by using an estimate $\omega = 2.3$ as in \cite{omega}, the value becomes
\[
\binom{n + d_{reg}}{n}^{\omega}
\approx 4.8 \times 10^{42} \enspace.
\]
This value is significantly larger than $2^{128} \approx 3.4 \times 10^{38}$.
Hence it is expected that our proposed protocol would be secure in the sense of $128$-bit security against this kind of attacks.

\subsection{On Attacks Using Linear Algebra}

Here we consider a kind of attacks to recover the polynomial map $\mvec{\psi}$; if it were possible, then the adversary could compute the set $\mvec{\psi}^{-1}(\mvec{u}) \cap \mathbb{Z}_p^n$ which contains the common key $\mvec{s}$.

For the choice of parameter $\ell = 1$ mainly used in this paper, we note that by the construction of the protocol, the following relation holds:
\begin{eqnarray*}
\psi_i(\underline{x}) + f(\underline{x})r_i(\underline{x}) = c_i(\underline{x}) \mbox{ for } i=1, \dots, n \enspace.
\end{eqnarray*}
Here, for each $i$, the coefficients of $f$ and $c_i$ are known and the coefficients of $\psi_i$ and $r_i$ are not known.
This situation can be regarded as a system of linear equations.
Now the number of equations and the number of unknown coefficients in $\psi_i$ are equal, therefore the dimension of the solution space is equal to the number, say $N$, of unknown coefficients in $r_i$.
As $\deg r_i = m-d$, we have
\[
N = \sum_{k=0}^{m-d} \binom{k+n-1}{k} \enspace.
\]
With our proposed parameters
\[
(q,p,n,m,d,\ell) = (46116646144580573897,19,32,2,1,1) \enspace,
\]
we have $N = n + 1 = 33$ and $q^N = 8.08 \times 10^{648}$.
Therefore the number of candidates for the solution is significantly larger than $2^{128}$ and hence our proposed protocol is secure in the sense of $128$-bit security against this kind of attacks.

\subsection{On the Exhaustive Search with the Help of $\mvec{f}$}

Considering the exhaustive search for the common key $\mvec{s}$ over the range $\mathbb{Z}_p^n$, when we use parameters $\ell = 1$ and $d = 1$ as above, the number of candidates for $\mvec{s}$ can be reduced by a factor of $1/p$.
Indeed, when the coefficient of $x_i$ in $f$ is non-zero, for each value of $s_1,\dots,s_{i-1},s_{i+1},\dots,s_n$, the condition $f(\mvec{s}) = 0$ yields at most one possible value of $s_i \in \mathbb{Z}_p$.
Due to the observation, when we want to keep $128$-bit security, we have to compare $2^{128}$ with $p^{n-1}$ instead of $p^n$.
With our proposed parameters as above, we have $p^{n-1} = 19^{31} = 4.38 \times 10^{39} > 2^{128} = 3.40 \times 10^{38}$.
Therefore our proposed protocol is secure in the sense of $128$-bit security against this kind of attacks.

When the parameter $\ell$ is increased, there is an advantage that the upper bound of the failure probability decreases as shown in Eq.\eqref{eq:theoretical_upper_bound}.
However, there is also a disadvantage that the larger number of conditions in $\mvec{f}$ restricts the range of the common key further, which may make the exhaustive search easier.

\subsection*{Acknowledgements.}

The authors thank Tsuyoshi Takagi, Momonari Kudo, Hiroki Furue, and Yacheng Wang for their precious advice for this research.
This research was supported by the Ministry of Internal Affairs and Communications SCOPE Grant Number 182103105.


\section{Introduction} \label{section_introduction}
It is well-known that Saturn, Jupiter, Uranus and Neptune have ring systems. For Mars, no rings have been detected yet, but it was suggested by \citet{soter1971dust} that Mars should possess a ring system, which consists of dust grains originating from Phobos and Deimos. A number of studies contributed to the dynamical modeling of the suspected Martian dust rings, which are reviewed in several papers \citep{hamilton1996asymmetric, krivov1997martian, krivov2006search, zakharov2014dust}. Attempts to detect the rings are described by \citet{showalter2006deep}, \citet{zakharov2014dust}, \citet{showalter2017dust}. The Japan Aerospace Exploration Agency (JAXA) will launch the Martian Moons Exploration mission in 2024 with the Circum-Martian Dust Monitor \citep{kobayashi2018situ}, an instrument that will conduct in-situ dust measurements.

Recent studies of particle dynamics in the Martian dust rings were presented by \citet{makuch2005long} and \citet{krivov2006search}. In addition to solar radiation pressure and the Martian oblateness $J_2$, \citet{makuch2005long} included in their model the Poynting-Robertson (P-R) drag which is important for grains with long lifetime. They integrated the orbit-averaged equations of motion for dust grains to obtain the spatial structure of the Deimos torus. Furthermore, the Martian eccentricity ($e_\mathrm{Mars}$) combined with the three aforementioned perturbation forces was considered by \citet{krivov2006search}, who also integrated the orbit-averaged equations of motion. From their numerical simulations the configurations of the Phobos and Deimos dust rings were obtained and the ring optical depths were estimated. The effect of $e_\mathrm{Mars}$ on the dust dynamics was also discussed by \citet{showalter2006deep}.

In this paper we study the full dynamics of dust particles ejected from Phobos and Deimos in terms of direct numerical integrations of the equations of motion. Particle lifetimes and spatial configurations of number density are obtained for 12 different grain sizes ranging from $0.5\mu\mathrm{m}$ to $100\mu\mathrm{m}$. The steady state size distributions, dominant grain sizes, cumulative grain densities and geometric optical depths for the rings are derived by averaging over the initial mass distribution of ejecta. The major asymmetries of the rings are evaluated in a sun-fixed reference frame, allowing for quantitative predictions for future in-situ measurements by forthcoming missions.

The paper is organized as follows. In Section \ref{section_production}, the mass production rates of dust from both source moons are estimated. The equations of motion and the numerical integrations are described in Section \ref{section_simulations}. The resulting lifetimes of various grain sizes are presented in Section \ref{section_lifetime}, and the effect of the planetary odd zonal harmonic coefficient $J_3$ is analyzed in Section \ref{section_J3}. In Section \ref{section_configuration}, we present the resulting spatial configuration of the Phobos and Deimos rings. A discussion of the model results and uncertainties, along with our conclusions, is given in Section \ref{section_comparison_uncertainties}.

\section{Dust production rates} \label{section_production}
The mass production rate of dust ejected from the surface of Phobos and Deimos by impacts of the hypervelocity interplanetary particles can be written as \citep{krivov2003impact}
\begin{equation} \label{eq:M+}
M^+= \alpha_\mathrm{G}\, F_\mathrm{imp}^{\infty}\, Y\,S \,,
\end{equation}
where $F_\mathrm{imp}^{\infty}$ is the mass flux of the interplanetary projectiles, $\alpha_\mathrm{G}$ accounts for the enhancement of the flux due to gravitational focusing by Mars, $Y$ is the yield (which denotes the ratio of the total mass of the ejected particles to the mass of the projectiles), and $S$ is the cross section of the source moon. The value of $\alpha_\mathrm{G}$ is calculated from Eq.~(14) in \citet{2006P&SS...54.1024S}. For Phobos we obtain $\alpha_\mathrm{G} \! \approx \! 1.003$, and a focused impact velocity $v_\mathrm{imp} \! = \! 15.30 \, \mathrm{km\,s^{-1}}$; for Deimos we have $\alpha_\mathrm{G} \! \approx \! 1.010$ and $v_\mathrm{imp} \! = \! 15.12 \, \mathrm{km\,s^{-1}}$. The gravitational focusing effect at Phobos and Deimos is low because of the small mass of Mars. The yield $Y$ is calculated with the empirical formula by \citet{2001Icar..154..391K}. For $F_\mathrm{imp}^{\infty}$ at Mars we adopt the same value as \citet{krivov2006search}, i.e.~$1 \times 10^{-15} \, \mathrm{kg\,m^{-2}\,s^{-1}}$, obtained from interplanetary dust models \citep{1985Icar...62..244G, divine1993five}, which is consistent by order of magnitude with the number from the Interplanetary Meteoroid Engineering Model (version 1.1) \citep{2011Mints, 2005AdSpR..35.1282D}. For a pure silicate surface of the moons, we obtain mass production rates $M^+$ of about $1.1 \times 10^{-1} \, \mathrm{g/s}$ for ejecta from Phobos and about $3.4 \times 10^{-2} \, \mathrm{g/s}$ for ejecta from Deimos. We note that there are large uncertainties in the estimate of the mass production rate (see Section \ref{section_comparison_uncertainties}).

\section{Numerical simulations} \label{section_simulations}
A well-tested numerical code \citep[see][]{liu2016dynamics, liu2018dust, liu2018comparison} is used to integrate the evolution of dust grains. Grains of sizes ranging from submicron to 100 microns are simulated: $0.5 \,\mathrm{\mu m}$, $1 \, \mathrm{\mu m}$, $2 \, \mathrm{\mu m}$, $5 \, \mathrm{\mu m}$, $10 \, \mathrm{\mu m}$, $15 \, \mathrm{\mu m}$, $20 \, \mathrm{\mu m}$, $25 \, \mathrm{\mu m}$, $30 \, \mathrm{\mu m}$, $40 \, \mathrm{\mu m}$, $60 \, \mathrm{\mu m}$, and $100 \, \mathrm{\mu m}$, including the effects of Martian gravity, gravitational perturbations from the Sun, Phobos, and Deimos, solar radiation pressure, as well as P-R drag.

The shapes of Jupiter and Saturn are both nearly hemispherically and axially symmetric, which is not the case for Mars. Thus, in our model the Martian gravity field up to 5th degree and 5th order is considered. We use silicate as the material for dust and adopt a bulk density of 2.37 $\mathrm {g \, cm^{-3}}$ \citep{makuch2005long, krivov2006search}.

The equations of motion for dust particles in the Martian system read
\begin{equation} \label{equ_dynamic_model}
\begin{split}
\ddot{\vec r} = &GM_\mathrm M\nabla  \Bigg[ \frac{1}{r}+\frac{1}{r}\sum_{l=1}^{l_\mathrm{max}}\sum_{m=0}^{l}\left(\frac{R_\mathrm M}{r}\right)^l \times \\
& P_{lm}(\sin\phi) (C_{lm}\cos m\lambda + S_{lm}\sin m\lambda) \Bigg] \\
& + GM_{\mathrm P}\left(\frac{\vec r_{\mathrm {dP}}}{r_{\mathrm {dP}}^3}-\frac{\vec r_{\mathrm P}}{r_{\mathrm P}^3}\right) + GM_{\mathrm D}\left(\frac{\vec r_{\mathrm {dD}}}{r_{\mathrm {dD}}^3}-\frac{\vec r_{\mathrm D}}{r_{\mathrm D}^3}\right) \\
& + GM_\mathrm{S}\left(\frac{\vec r_\mathrm{dS}}{r_\mathrm{dS}^3}-\frac{\vec r_\mathrm S}{r_\mathrm S^3}\right) \\
& + \frac{3Q_\mathrm SQ_\mathrm {pr}\mathrm{AU}^2}{4r_\mathrm {Sd}^2\rho_\mathrm gr_\mathrm gc}\left\{\left[1-\frac{\dot r_\mathrm {Sd}}{c}\right]\hat{\vec r}_\mathrm {Sd} - \frac{\dot{\vec r}_\mathrm {Sd}}{c}\right\} \,.
\end{split}
\end{equation}
Here $G$ is the gravitational constant, $M_\mathrm M$ the mass of Mars, and $R_\mathrm M$ the Martian reference radius. We denote with $P_{lm}$ the associated Legendre functions of degree $l$ and order $m$, where $l_\mathrm{max}=5$ in this work and $C_{lm}$ and $S_{lm}$ are the spherical harmonics of the Martian gravity field. Further, $\phi$ and $\lambda$ are the latitude and longitude in the Martian body-fixed frame, respectively, $M_{\mathrm P}$ ($M_{\mathrm D}$) is the mass of Phobos (Deimos), $\vec r_{\mathrm {dP}}$ ($\vec r_{\mathrm {dD}}$) is the vector from the dust particle to Phobos (Deimos), and $\vec r_{\mathrm P}$ ($\vec r_{\mathrm D}$) is the vector of the Phobos (Deimos) position. Similarly, $M_{\mathrm S}$ is the mass of the Sun, $\vec r_{\mathrm {dS}}$ is the vector from the dust particle to the Sun, and $\vec r_{\mathrm S}$ is the radius vector of the Sun. The symbol AU denotes the astronomical unit, $Q_\mathrm S$ is the solar radiation energy flux at one AU, $Q_\mathrm{pr}$ is the solar radiation pressure efficiency, $\vec r_{\mathrm {Sd}} = -\vec r_{\mathrm {dS}}$, $\rho_\mathrm g$ is the bulk density of the grain, $r_\mathrm g$ is the grain radius, and $c$ is the light speed.

The values of the gravity spherical harmonics are taken from the Mars gravity model MRO120D \citep{konopliv2016improved}. The formulas for solar radiation pressure and the P-R drag are taken from \citet{burns1979radiation}. The size-dependent values of the solar radiation pressure efficiency $Q_\mathrm{pr}$ are computed from Mie theory \citep{mishchenko1999bidirectional,mishchenko2002scattering} for spherical grains (see Fig.~3 in \citet{liu2018dust}), using the optical constants for silicate grains from \citet{mukai1989cometary}. Due to the small size of Phobos ($R_\mathrm{P} \! \approx \!$ 11 km) and Deimos ($R_\mathrm{D} \! \approx \!$ 6 km), the dust ejection velocity is higher than the escape velocity but much lower than the orbital velocity of the moons \citep{horanyi1990toward, horanyi1991dynamics}. Therefore, it is a very good approximation to start grains directly from the orbits of Phobos and Deimos. It is known that the dynamical behavior of dust particles strongly depends on the solar longitude (Martian season) at the launch time \citep{hamilton1996asymmetric, krivov1997martian, makuch2005long, krivov2006search}. Thus, in our simulations 100 particles per grain size are launched with uniformly distributed initial mean anomalies of the Martian orbit around the Sun \citep{krivov1997martian, showalter2006deep}.

The motions of dust grains are simulated until they hit Phobos, Deimos, Mars, they escape from the Martian system, or for a maximum of 100,000 years. In order to save computation cost, we also stop the simulation when the fraction of grains remaining in orbit for certain sizes are less than 5\% (the integrations for the 100 particles per grain size run in parallel on a computer cluster provided by the Finnish CSC -- IT Center for Science). When we check for collisions of the dust particles with a given target (Phobos, Deimos, and Mars), at each time step of the integration we calculate the distance between the particle and the center of the target. If this distance is smaller than the target's radius, an impact occurs. When the grain is close to the target, in order to avoid overlooking the impact due to discrete time steps of the numerical integrators, a cubic Hermite interpolation is adopted to calculate the minimum distance between the particle and the target's center approximately (see \citet{chambers1999hybrid} and \citet{liu2016dynamics}). In our simulations, we store the slowly changing orbital elements including semi-major axis, eccentricity, inclination, argument of pericenter, longitude of ascending node, and true anomaly. Generally, we store 10 sets of orbital elements for one orbital period. The orbital segment between two consecutively stored sets of osculating elements is approximately considered as Keplerian. For denser output, each of these segments is further divided into intervals that are equidistant in time. Since dust particles are produced and absorbed continually (by hitting sinks or escape from the system), each discrete point corresponds to one particle in the steady-state ring configuration (see details in Sections 3.4 and 4 in \citet{liu2016dynamics} as well as Section 4 in \citet{liu2018dust}).

\section{Particle Lifetimes} \label{section_lifetime}
The lifetimes for dust from Phobos and Deimos derived from our simulations are shown in Figure ~\ref{fig:Lifetime}. Overall, we confirm the picture drawn from previous work (see table 1 in \citet{krivov2006search} and references given there): Grains larger than about $5\mu\mathrm{m}$ to $10\mu\mathrm{m}$ have lifetimes on the order of 10,000 years if they come from Deimos and a few tens of years if they are ejected from Phobos. For grain sizes smaller than 5 $\mathrm{\mu m}$ the lifetimes drop to a value of months.

To explain this jump in lifetime, a conserved ``Hamiltonian" for the orbit-averaged system is used, which reads \citep{1996Icar..123..503H}
\begin{equation}
\begin{split}
\label{eq:Hamiltonian}
\mathcal H (e, \phi_\odot) = & \sqrt{1-e^2} + Ce\cos\phi_\odot + \frac{1}{2}Ae^2\left[1+5\cos(2\phi_\odot)\right] \\
                             & + \frac{W}{3(1-e^2)^{3/2}} \ .
\end{split}
\end{equation}
Here $e$ is the eccentricity, $\phi_\odot$ is the solar angle, denoting the angle between the Sun and the grain's pericenter as seen from the planet, and $C$, $A$, and $W$ are parameters labeling the relative strengths of solar radiation pressure, solar tidal force, and the Martian $J_2$, respectively (see \citet{1996Icar..123..503H} for details). For this analysis, the perturbations from solar radiation pressure, the solar tidal force and $J_2$ are included, but other perturbations are ignored. Besides, the inclinations and eccentricities of Mars and source moons are neglected, and the grains have zero inclination.

Due to the low grain ejection velocity, which is negligible compared to the orbital velocity of the moons, the particles start their evolution with $e_0 \! \approx \! 0$.
Since the Hamiltonian $\mathcal H$ is conserved, the orbital evolution of dust particles follows in the phase plane of the Hamiltonian a curve with the value at the starting point $\mathcal H (e=0, \phi_\odot)$. Typical phase portraits, obtained as a contour plot from Eq.~\ref{eq:Hamiltonian}, are shown in Figs.~\ref{fig:phase_phobos_impact} and \ref{fig:phase_deimos_bifu_impact}.

\begin{figure}
\centering
\noindent\includegraphics[width=0.45\textwidth]{lifetime.pdf}
\caption{Lifetimes for particles of various sizes originating from the Martian moons Phobos and Deimos.}
\label{fig:Lifetime}
\end{figure}

\begin{figure}
\centering
\noindent\includegraphics[width=0.4\textwidth]{phase_phobos_impact.pdf}
\caption{Phase portrait for 10.7 $\mathrm{\mu m}$ particles from Phobos. The blue dashed circle denotes $e_\mathrm{impact}$ = 0.638 for Phobos grains.}
\label{fig:phase_phobos_impact}
\end{figure}

\begin{figure}
\centering
\noindent\includegraphics[width=0.3\textwidth,angle=-90]{phase_deimos_impact.pdf}
	\caption{Phase portrait for 6.0 $\mathrm{\mu m}$ particles from Deimos. The blue dashed circle denotes $e_\mathrm{impact}$ = 0.855 for Deimos grains.}
\label{fig:phase_deimos_bifu_impact}
\end{figure}

The value of eccentricity for which the grains' pericenter distance is equal to the Martian radius reads
\begin{equation}\label{eq:e_impact}
e_\mathrm{impact} = 1-\frac{R_\mathrm{M}}{a_\mathrm{moon}} \,,
\end{equation}
where $a_\mathrm{moon}$ is the semi-major axis of the source moon. The value of $e_\mathrm{impact}$ is of 0.638 for Phobos grains and of 0.855 for Deimos grains \citep{hamilton1996asymmetric}. With $r_\mathrm{g}^\mathrm{impact}$ we denote the grain size for which the maximum eccentricity $e_\mathrm{max}$, attained in the course of the orbital evolution, reaches $e_\mathrm{impact}$ \citep{hamilton1996asymmetric}. Particles smaller than $r_\mathrm{g}^\mathrm{impact}$ will develop a lager $e_\mathrm{max}$, and thus will hit Mars shortly after ejection, while grains larger than $r_\mathrm{g}^\mathrm{impact}$ will stay in the circum-Martian space for a much longer time. Based on Eq.~\ref{eq:Hamiltonian}, $r_\mathrm{g}^\mathrm{impact}$ = 10.7 $\mathrm{\mu m}$ for grains from Phobos (Fig.~\ref{fig:phase_phobos_impact}). Our analytical value of $r_\mathrm{g}^\mathrm{impact}$ is different from the one given by \citet{hamilton1996asymmetric} because we use size-dependent values of $Q_\mathrm{pr}$ for silicate grains (see Section \ref{section_simulations}). From the full numerical simulations, the value of $r_\mathrm{g}^\mathrm{impact}$ is close to but a bit smaller than 10.7 $\mathrm{\mu m}$, explaining the jump in the lifetime between 5 and 10 $\mathrm{\mu m}$ for Phobos grains (Fig.~\ref{fig:Lifetime}). From Fig.~\ref{fig:phase_phobos_impact} it is also evident that in principle we expect in the Phobos ring mostly particles with a solar angle in the range $90^\circ < \phi_\odot < 270^\circ $. For grains lifted from Deimos the phase portrait is shown in Fig.~\ref{fig:phase_deimos_bifu_impact}. For Deimos grains $r_\mathrm{g}^\mathrm{impact}$ = 6.0 $\mathrm{\mu m}$.

Particles larger than $r_\mathrm{g}^\mathrm{impact}$ are safe from rapid collision with Mars. Their lifetime is limited mainly by collisions with their source moon and by the slow reduction of their semi-major axis, which, ultimately, increases again their chance to hit Mars.

\section{The effect of $J_3$} \label{section_J3}
The effect of $J_2$ ($\approx \! 1.96 \times 10^{-3}$) on the dynamics of Martian dust was well studied in previous papers \citep[e.g.~][]{hamilton1996asymmetric, krivov1995dynamics}. In this section, the effect of a higher degree term, i.e.~the $J_3$ gravitational coefficient is analyzed. The $J_3$ term reflects an asymmetry in the mass distributions between the northern and southern hemispheres of the planet, which causes variations of inclination and eccentricity \citep{roy1965astrodynamics,paskowitz2006design}
\begin{equation} \label{equ_dot_i_J3}
\left\langle \frac{\mathrm{d}i}{\mathrm{d}t} \right\rangle_{J_3} = \frac{3nJ_3R_\mathrm{M}^3}{2a^3(1-e^2)^3} e \cos i \left(1-\frac{5}{4}\sin^2i \right) \cos\omega
\end{equation}
\begin{equation} \label{equ_dot_e_J3}
\left\langle \frac{\mathrm{d}e}{\mathrm{d}t} \right\rangle_{J_3} = -\frac{3nJ_3R_\mathrm{M}^3}{2a^3(1-e^2)^3} \sin i \left(1-\frac{5}{4}\sin^2i \right) \cos\omega \ .
\end{equation}
Here $i$ is the inclination, $n$ the mean motion, $a$ the semi-major axis, and $\omega$ the argument of pericenter.

For Jupiter and Saturn, because of their nearly hemispherically and axially symmetric shapes, the values of $J_3$ are almost zero ($J_3\approx -4.2 \times 10^{-8}$ for Jupiter \citep{iess2018measurement}, and $J_3 \! \approx \! 5.9 \times 10^{-8}$ for Saturn \citep{iess2019measurement}), and thus $J_3$ has negligible effect on the dynamics of particles in the Jovian and Saturnian rings. In contrast, Mars has a much larger value of $J_3$ ($\approx \! 3.15 \times 10^{-5}$), exceeding the value of $J_3$ for the Earth ($\approx -2.5 \times 10^{-6}$ \citep{pavlis2012development}), so that we might expect a noticeable effect on the dynamics of circum-Martian dust. From Eq.~\ref{equ_dot_i_J3}, $J_3$ could be important for the evolution of the inclination for eccentric orbits.
In Fig.~\ref{fig:dot_i_J3_phobos} we show the evolution of a 20 $\mu \mathrm{m}$ particle from Phobos with and without the action of $J_3$. The maximal effect of $J_3$ on the inclination amounts to 10\%, roughly. The variations in inclination due to $J_3$, in turn, alter the effects of solar radiation and Martian $J_2$ on the evolution of semi-major axis and eccentricity. For a specific grain, the mildly altered dynamics can have a drastic effect on the lifetime (Fig.~\ref{fig:dot_i_J3_phobos}), while the overall, averaged effect on the lifetimes seems to remain small (see comparison to previous work in Section \ref{section_lifetime}).

Because of the factor $\sin i$ in Eq.~\ref{equ_dot_e_J3}, which is small due to the generally low orbital inclination, the direct effect of $J_3$ on eccentricity remains negligible compared to that of solar radiation pressure.

The $J_3$ effect decreases rapidly with increasing semi-major axis (Eqs.~\ref{equ_dot_i_J3} and \ref{equ_dot_e_J3}). Thus, it is more important for grains from Phobos than for those from Deimos. The $J_5$ gravitational coefficient has a similar, albeit much weaker effect on inclination. For particles from Phobos the strength of the perturbation induced by $J_5$ is roughly $J_5/J_3 \times \left(R_\mathrm{M}/a_\mathrm{Phobos}\right)^2 \! \approx \! 2\% $ of the perturbation induced by $J_3$.
\begin{figure}
\centering
\noindent\includegraphics[width=0.45\textwidth]{i_J3_phobos.pdf}
\caption{Evolution of inclination for a 20 $\mu \mathrm{m}$ particle from Phobos. The black line denotes the inclination evolution with all perturbation forces (see Section \ref{section_simulations}). The red line corresponds to the case with all perturbation forces except $J_3$. Without $J_3$ the particle re-impacts on the source moon at an earlier time.}
\label{fig:dot_i_J3_phobos}
\end{figure}

\section{Particle size distribution and configuration of the rings} \label{section_configuration}
The differential mass distribution of the ejected particles is assumed to follow a power law
\begin{equation} \label{equ_mass_distri}
p(m) \propto m^{-(1+\alpha)} \,.
\end{equation}
For the slope $\alpha$ we adopt a value of $0.9$, derived from the in-situ measurements in the impact-generated lunar dust cloud \citep{Horanyi:2015faa} performed by the Lunar Dust Experiment onboard NASA's Lunar Atmosphere and Dust Environment Explorer mission. The mass distribution we normalize with the mass production rates given by Eq.~(\ref{eq:M+}). Averaging the results from the long-term simulations over the initial mass distribution (\ref{equ_mass_distri}) we obtain an estimate for the steady-state differential size distribution of grains in the Phobos and Deimos rings (Fig.~\ref{fig:size_distri}). Physically, this distribution arises from a folding of the steep size dependence of the initial grain production with the size dependent lifetime (Fig.~\ref{fig:Lifetime}).

Since the lifetimes of larger grains from Phobos are not substantially longer than those of the small grains, we find that the Phobos ring is dominated by grains $\leq$ 2 $\mathrm{\mu m}$. A small, secondary peak around $10\mu\mathrm{m}$ is visible best in logarithmic scale (Fig.~\ref{fig:size_distri}). For the small grains that dominate the Phobos ring, solar radiation pressure is the most important perturbation force, which pushes nearly instantly the solar angle to $90^\circ$ \citep{hamilton1996asymmetric, 1996Icar..123..503H}. The subsequent rotation of the solar angle is induced by $J_2$ and by the orbital motion of Mars (see discussion around equation 5 of \citet{hamilton1996asymmetric}). Because of the small semi-major axis of Phobos, and thus of the grains lifted from its surface, the effect of $J_2$ dominates and the rotation is in anti-clockwise direction, assuming in principle values in the range $90^\circ < \phi_\odot < 270^\circ $ (see Fig.~\ref{fig:phase_phobos_impact}). But the rotation of the solar angle takes place on timescales that are longer than the lifetime of the grains. As a result, all grains develop their eccentricities with a sun-angle that remains close to $90^\circ$ and the Phobos ring appears shifted towards the negative $y$-axis (Fig.~\ref{fig:normal_rotating_density}).
\begin{figure}
\centering
\noindent\includegraphics[width=0.45\textwidth]{size_distri.pdf}
	\caption{\textbf{(a)} Steady-state differential size distribution (logarithmic scale) for the Phobos and Deimos rings obtained from numerical simulations (Section \ref{section_simulations}) combined with initial mass distribution of ejecta Eq.~(\ref{equ_mass_distri}). A power law with slope $q$ = 2.7 is also shown for reference. \textbf{(b)} Same as \textbf{(a)}, but in linear scale for $r_\mathrm{g}<25\mu\mathrm{m}$.}
\label{fig:size_distri}
\end{figure}

\begin{figure}
\centering
\noindent\includegraphics[width=0.4\textwidth]{normal_rotating_density.pdf}
\caption{\textbf{(a)} Grain number density in the Phobos ring projected onto the Martian equatorial plane, vertically averaged over $[-0.3, 0.3] \, R_\mathrm{M}$ in a frame that keeps a fixed orientation with respect to the Sun. The plot is obtained by averaging simulation results of particles of 12 grain sizes ranging from $0.5 \,\mathrm{\mu m}$ to $100 \,\mathrm{\mu m}$ (Section \ref{section_simulations}) over an initial mass distribution of ejecta with the differential slope $\alpha \! = \! 0.9$ (Eq.~\ref{equ_mass_distri}). See Fig.~\ref{fig:size_distri} for the steady-state differential size distribution for these ring particles. The positive $x_\mathrm{rot}$-axis points to the direction of the Sun. The blue line denotes the Martian radius, and the red dashed lines denote the orbits of Phobos (inner) and Deimos (outer). \textbf{(b)} Same as \textbf{(a)}, but for the Deimos ring, vertically averaged over $[-2.0, 2.0] \, R_\mathrm{M}$.}
\label{fig:normal_rotating_density}
\end{figure}

\begin{figure}
\centering
\noindent\includegraphics[width=0.4\textwidth]{edge_yz_inertial.pdf}
\caption{\textbf{(a)} Geometrical optical depth of the Phobos ring, when viewed from the opposite direction of the Martian vernal equinox point. The plot is obtained by averaging simulation results of particles of 12 grain sizes ranging from $0.5 \,\mathrm{\mu m}$ to $100 \,\mathrm{\mu m}$ (Section \ref{section_simulations}) over an initial mass distribution of ejecta with the differential slope $\alpha \! = \! 0.9$ (Eq.~\ref{equ_mass_distri}). The $z$-axis is along the Martian spin axis. The $x$-axis (not shown in this plot) points to the Martian vernal equinox point, and the $y$-axis is perpendicular to the $x$-axis in the Martian equatorial plane. The blue line denotes the Martian radius, and the red dashed lines denote the orbital distances of Phobos (inner) and Deimos (outer). \textbf{(b)} Same as \textbf{(a)}, but for the Deimos ring.}
\label{fig:edge_yz_inertial}
\end{figure}

The Deimos ring, in contrast, is dominated by larger grains (Fig.~\ref{fig:size_distri}) in the size range of about 5-20 $\mathrm{\mu m}$, owing to the very large lifetimes of these particles (Fig.~\ref{fig:Lifetime}). This lifetime is longer than the period of the cycle in the evolution of the solar angle and the eccentricity (Fig.~\ref{fig:phase_deimos_bifu_impact}). For Deimos grains the rotation of the solar angle induced by the orbital motion of Mars dominates over the effect of $J_2$, so that the solar angle rotates clockwise \citep{hamilton1996asymmetric}. The maximum eccentricity is attained at $\phi_\odot \! = \! 0^\circ$. Averaging over many grains, lifted from Deimos uniformly over one Martian year, the Deimos ring appears shifted away from the Sun (Fig.~\ref{fig:normal_rotating_density}).

We find a peak number density (Fig.~\ref{fig:normal_rotating_density}) for grains $\geq$ 0.5 $\mu \mathrm{m}$ for the Phobos ring of about $4.7\times 10^{-5} \, \mathrm{m}^{-3}$ if vertically averaged over $[-0.3, 0.3] \, R_\mathrm{M}$ (corresponding roughly to the thickness of the ring, Fig.~\ref{fig:edge_yz_inertial}), and for the Deimos ring of about $9.2\times 10^{-6} \, \mathrm{m}^{-3}$ if vertically averaged over $[-2.0, 2.0] \, R_\mathrm{M}$. This allows us to estimate the number of dust impacts detected by an in-situ instrument on a spacecraft that traverses the rings. For a vertical crossing of the rings with a 1 $\mathrm{m}^2$ detector (as the sensitive area of the detector onboard JAXA's Martian Moons Exploration mission) one expects to record about 96 particles ($\geq$ 0.5 $\mu \mathrm{m}$) from the Phobos ring and about 125 particles from the Deimos ring.

The non-detection of the Martian rings in observations with the Hubble Space Telescope in 2001 \citep{showalter2006deep} placed upper limits on their edge-on brightness. For a geometric albedo of $0.07$, this translates into upper limits for the edge-on optical depth of $\sim2\times 10^{-6}$ for the Phobos ring and $\sim10^{-6}$ for the Deimos ring \citep{krivov2006search}. The edge-on geometric optical depths from our simulations are shown in Fig.~\ref{fig:edge_yz_inertial}. Here, the viewing direction is from the Martian vernal equinox point in the plane of the sky, i.e.\ the ascending node of the Martian orbital plane in the Martian equatorial plane. For this configuration we use a slope of $\alpha=0.9$ for the initial mass distribution (\ref{equ_mass_distri}) and we obtain an average edge-on geometric optical depth for the Phobos ring of about $3.5\times 10^{-8}$, and about $3.1\times 10^{-7}$ for the Deimos ring. If, alternatively, we use a value of $\alpha \! = \! 0.8$ \citep{krivov2003impact}, which is consistent with measurements of the dust cloud around the Galilean satellites by the Galileo Dust Detection System \citep{2000P&SS...48.1457K}, we get slightly larger values of about $3.7\times 10^{-8}$ for the Phobos ring and about $3.7\times 10^{-7}$ for the Deimos ring. In either case ($\alpha \! = \! 0.9$ or $\alpha \! = \! 0.8$) the average edge-on optical depth is lower than the upper limits inferred from the Hubble observations.

\section{Summary and Discussion} \label{section_comparison_uncertainties}
In this work we present a comprehensive numerical model for the evolution of dust particles ejected from the Martian moons Phobos and Deimos, with the goal to construct a steady state model for the configuration of the putative Martian dust rings. The new model ingredients are: (i) We perform direct numerical integrations of the equations of motion for a large number of particles, instead of integrating the orbit averaged evolution equations for the orbital elements. (ii) We use an array of 12 grain sizes, from submicron to 100 microns, to better resolve than previous studies the size dependent lifetimes. We present results as averages over an initial ejecta mass distribution. (iii) We include the Martian gravity field up to 5th degree and 5th order and account for the gravitational perturbations of Phobos and Deimos. (iv) We check for impacts of grains on the source moons and with Mars directly at (and between) the time steps of the integration, which allows for a more accurate evaluation of grain lifetimes than the probabilistic approach used in previous studies.

Our results are: \\
(1) We evaluate the lifetimes of grains with radii between $0.5\mu\mathrm{m}$ and $100\mu\mathrm{m}$, confirming results obtained in the literature. For grains from both source moons a jump in lifetime occurs between $5$ and $10$ microns. Smaller grains have lifetimes of months up to one (Earth) year. Larger grains from Phobos have lifetimes of tens of years while grains from Deimos remain in orbit for 10,000 years or more.\\
(2) The gravity perturbation induced by the Martian north-south asymmetry has in our simulations a small but noticeable effect on the orbital evolution of the grains from Phobos, in particular on the evolution of the inclination. For Deimos the effect is much smaller.\\
(3) Taking into account the initial mass distribution of ejecta, we derive the steady-state size distribution of dust particles in both ring components. The Phobos ring is dominated by grains smaller than a few microns. The Deimos ring is dominated by grains around $10$ microns in size. This is consistent with (but refines) previous results.\\
(4) Averaging over the initial mass distribution of ejecta and a large number of grains produced on the surfaces of the moons uniformly over one Martian year, we obtain a model for the steady state configuration of the rings. For the Deimos ring we confirm results from previous studies, in that the ring extends in the anti-sun direction, owing to an interplay of solar radiation pressure and the effect of Martian $J_2$ and the orbital motion of Mars. The ring has a thickness of about 4 Martian radii. For the Phobos ring we obtain the new result that the steady state ring should have a solar angle of $90^\circ$. This configuration arises from the dominance of small grains in this ring component and the correspondingly small lifetimes. The grains do not have time to perform a full cycle of the evolution of the eccentricity, and the solar angle stays close to its initial value of $90^\circ$. \\
(5) For a vertical traversal with a spacecraft, we estimate that a dust detector of $1\mathrm{m}^2$ area should record about 100 grains larger than $0.5\mu\mathrm{m}$ from either ring.\\
(6) We derive the edge-on geometric optical depth from our model, giving for the Phobos ring an estimate of $\tau\sim3.5\times 10^{-8}$ and about $\tau\sim3.1\times 10^{-7}$ for the Deimos ring, which is below the upper limits for the edge-on photometric optical depth inferred from observations of $\sim2\times 10^{-6}$ for the Phobos ring and $\sim10^{-6}$ for the Deimos ring.

Our model results are subject to fairly large uncertainties, as is the case for the models presented previously in the literature. The most uncertain parameter is the mass production rate of dust particles. On the one hand, the interplanetary projectile flux is still poorly constrained. On the other hand, not much is known about the surfaces properties of the source moons, which induces uncertainties in the ejecta yield, the bulk density of ejected grains, and in their dynamical response on solar radiation pressure and Poynting-Robertson drag. The values of the interplanetary flux and the ejecta yield affect the results linearly. The shape of the initial mass distribution, the bulk density of the particles, and their material have a size dependent effect, and their variation will affect the steady state size distribution, the number densities, and the optical depth of the rings in a non-linear manner. The precise error limits of the model results induced by the uncertainties in the parameters is difficult to assess, but it might easily amount to an uncertainty of an order of magnitude, or even more. For the initial distribution of ejecta masses we use a differential power-law with a slope of $\alpha=0.9$, as it was inferred by in-situ measurements in the lunar dust cloud. We also checked models with a slope of $\alpha=0.8$ (a value used in previous modelling of dust rings) and found that our main conclusions on the grain size distribution in the rings, the number densities, as well as their spatial configuration and the optical depths are robust. An additional complication might arise from the intermittency of the interplanetary flux \citep{Horanyi:2015faa}. For the small lifetimes of the grains that dominate the Phobos ring, this might result in a significant variability of the ring over months. Finally, we note that \citet{krivov2006search} pointed out the potential importance of grain-grain collisions as a sink, which we have not included in our modelling. Collisions might play a role especially for the Deimos ring, owing to the long particle lifetimes, leading to a depletion of the number density and optical depth.

Although the Martian rings escaped detection so far, there is little or no doubt that the dust tori of Phobos and Deimos exist. The mechanism of quasi-continuous dust production in impacts of interplanetary meteoroids has been confirmed by measurements \citep{1999Natur.399..558K,Horanyi:2015faa}, as well as the formation of dust rings by this mechanism \citep{1999Sci...284.1146B,2004jpsm.book..241B,Hedman:2009kt}. The best chance to detect the rings might be in-situ measurements with a dust detector onboard a spacecraft, or, high-phase angle imaging from an orbiter when the spacecraft is in the shadow of Mars.

\section*{Acknowledgements}
This work was supported by the European Space Agency under the project Jovian Meteoroid Environment Model at the University of Oulu and by the Academy of Finland. We acknowledge CSC -- IT Center for Science for the allocation of computational resources.

\section*{Data availability}
The data underlying this article will be shared on reasonable request to the corresponding author.

\bibliographystyle{mnras}