Asymptotic Analysis of ISD algorithms for the q-ary case

39 Pages·2017·1.02 MB·English

by  Rodolfo Canto Torres

Introduction
GenericDecodingAlgorithms
AsymptoticAnalysisoverthefieldsize
Results
Asymptotic Analysis of ISD algorithms for
the q-ary case
Rodolfo Canto Torres
27 April 2017
1/37
Generic problem is believed to be hard on average.
Central for security of code-based cryptography.
For the binary case, the first important algorithm (ISD) was
proposed by Prange in 1962 and the last one by May and
Ozerov in 2015.
For the q-ary case, the first generalisation was done by Peters
in 2010 and the last one by Gueye, Klamti and Hirose in 2017.
(ISD = Information Set Decoding)
Introduction
GenericDecodingAlgorithms
AsymptoticAnalysisoverthefieldsize
Results
Computational Syndrome Decoding
CSD(H,s,w)
Let H ∈ F(n−k)×n, s ∈ Fn−k, w ≥ 0.
q q
Find e ∈ Fn, wt(e) ≤ w, He = s.
q
2/37
For the q-ary case, the first generalisation was done by Peters
in 2010 and the last one by Gueye, Klamti and Hirose in 2017.
(ISD = Information Set Decoding)
Introduction
GenericDecodingAlgorithms
AsymptoticAnalysisoverthefieldsize
Results
Computational Syndrome Decoding
CSD(H,s,w)
Let H ∈ F(n−k)×n, s ∈ Fn−k, w ≥ 0.
q q
Find e ∈ Fn, wt(e) ≤ w, He = s.
q
Generic problem is believed to be hard on average.
Central for security of code-based cryptography.
For the binary case, the first important algorithm (ISD) was
proposed by Prange in 1962 and the last one by May and
Ozerov in 2015.
2/37
Introduction
GenericDecodingAlgorithms
AsymptoticAnalysisoverthefieldsize
Results
Computational Syndrome Decoding
CSD(H,s,w)
Let H ∈ F(n−k)×n, s ∈ Fn−k, w ≥ 0.
q q
Find e ∈ Fn, wt(e) ≤ w, He = s.
q
Generic problem is believed to be hard on average.
Central for security of code-based cryptography.
For the binary case, the first important algorithm (ISD) was
proposed by Prange in 1962 and the last one by May and
Ozerov in 2015.
For the q-ary case, the first generalisation was done by Peters
in 2010 and the last one by Gueye, Klamti and Hirose in 2017.
(ISD = Information Set Decoding)
2/37
Introduction
GenericDecodingAlgorithms
AsymptoticAnalysisoverthefieldsize
Results
Conventional Complexity of known algorithms
Asymptotic analysis
Let R = k/n (code rate), τ = w/n (error rate) such that
0 ≤ τ ≤ h−1(1−R). So, for an algorithm A we can express its
q
work factor of solving CSD(n,Rn,τn) as
WF (n,Rn,τn,q) = 2c(cid:48)n(1+o(1))
A
where c is a constant which depends on R, τ, A and q.
3/37
Introduction
GenericDecodingAlgorithms
AsymptoticAnalysisoverthefieldsize
Results
In this Work
Main Aim
For many variants A of ISD, if R and τ are constants then
lim WF (n,Rn,τn,q) = WF (n,Rn,τn).
A Prange
q→∞
4/37
Introduction
GenericDecodingAlgorithms
AsymptoticAnalysisoverthefieldsize
Results
1 Introduction
2 Generic Decoding Algorithms
Decoding by Birthday Paradox
Prange’s Algorithm
Information Set Decoding Algorithms
Stern-Dumer’s Algorithm
Mae, May and Thomae’s Algorithm
3 Asymptotic Analysis over the field size
4 Results
5/37
DecodingbyBirthdayParadox
Introduction
Prange’sAlgorithm
GenericDecodingAlgorithms
InformationSetDecodingAlgorithms
AsymptoticAnalysisoverthefieldsize
Stern-Dumer’sAlgorithm
Results
Mae,MayandThomae’sAlgorithm
Decoding by Force Brute
We produce one indexed list
L = {(He,e),e ∈ Fn,wt(e) = w}
q
We look for (s,e) ∈ L
The cost is
(cid:18) (cid:19)
n
(q−1)w
w
6/37
DecodingbyBirthdayParadox
Introduction
Prange’sAlgorithm
GenericDecodingAlgorithms
InformationSetDecodingAlgorithms
AsymptoticAnalysisoverthefieldsize
Stern-Dumer’sAlgorithm
Results
Mae,MayandThomae’sAlgorithm
Description
We divide the problem in half :
H = [H |H ], H ,H ∈ F(n−k)×n2
1 2 1 2 q
n
e = [e |e ], e ,e ∈ F2
1 2 1 2 q
We produce two list:
n n
L = {(H e ,e ),e ∈ F2}, L = {(s −H e ,e ),e ∈ F2}
1 1 1 1 1 q 2 2 2 2 2 q
We have: He = s =⇒ H e = s −H e .
1 s 2 2
Produce L =⇒ Produce L ,L ,L (cid:111)(cid:110) L
1 2 1 2
7/37
DecodingbyBirthdayParadox
Introduction
Prange’sAlgorithm
GenericDecodingAlgorithms
InformationSetDecodingAlgorithms
AsymptoticAnalysisoverthefieldsize
Stern-Dumer’sAlgorithm
Results
Mae,MayandThomae’sAlgorithm
Scheme
n/2 n/2
(cid:122) (cid:125)(cid:124) (cid:123)(cid:122) (cid:125)(cid:124) (cid:123)
H H
1 2
= s
·
t
0 e1 0 0 e2 0
(cid:124) (cid:123)(cid:122) (cid:125) (cid:124) (cid:123)(cid:122) (cid:125)
w/2 w/2
H e = s −H e ?
1 1 2 2
8/37