Decoding Linear Codes with High Error Rate and its Impact for LPN - PowerPoint PPT Presentation

Decoding Linear Codes with High Error Rate and its Impact for LPN Security PQCrypto 2018 , 09.-11.04.2018 Leif Both , Alexander May Horst Görtz Institute for IT-Security Ruhr-University Bochum, Germany Faculty of Mathematics

Our work ◮ Improved running times for decoding of random linear codes. State of the art Our algorithm 2 0 . 0953 n 2 0 . 0885 n Full Distance (FD) 2 0 . 0473 n 2 0 . 0465 n Half Distance (HD) ◮ Based on the BJMM algorithm (Becker, Joux, May, Meurer EC2012) and Nearest Neighbors (May, Ozerov EC2015). ◮ Works best for high error rates. ◮ Application: Hybrid algorithm for LPN (Esser, Kübler, May Crypto2017). Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 2/24

On Linear Codes Definition (Linear Code) A linear code C is a k -dimensional subspace of F n 2 . ◮ Alternative definition via Parity Check matrix P 2 | P c = 0 } , where P ∈ F ( n − k ) × n C = { c ∈ F n . 2 Definition (Distance) For a linear code C the distance is defined as c � = c ′ ∈ C { ∆( c , c ′ ) } . d = min Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 3/24

The Decoding Problem Definition (Decoding Problem) Given: P , ω, x = c + e with c ∈ C , ∆( e ) = ω Find: e ( ⇒ c = x + e ) . ◮ Unique decoding of x if ω ≤ d − 1 2 . ◮ HD Decoding : ω = d − 1 2 . ◮ FD Decoding : ω = d . Definition (Syndrome) The Syndrome s of a vector x is defined as s := P x . ◮ s = P x = P c + P e ⇔ s = P e . Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 4/24

Compare Decoding Algorithms ◮ Running Time T ( n , k , d ). ◮ Use the Gilbert-Varshamov bound ⇒ d = f ( n , k ) ⇒ T ( n , k , d ) = T ( n , k ) . ◮ Worst case running time: T ( n ) = max k { T ( n , k ) } . ◮ Assumption: Exponential complexity of HD/FD decoding ⇒ T ( n ) = 2 c T n . Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 5/24

Prange: Basic Idea for Decoding (1962) Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 6/24

Prange: Basic Idea for Decoding (1962) Algorithm (Idea) 1. Bring P into systematic form. 2. Permute columns. 3. Enumerate all e 1 . 4. Check if ∆( H e 1 + ¯ s ) = ω − p . Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 6/24

Advanced Ideas ◮ Exact matching on some coordinates (Stern 1989). ◮ Meet in the middle (Stern 1989). ◮ Representations techniques (BJMM EC2012). ◮ Binary search tree (BJMM EC2012). ◮ Nearest Neighbors (May, Ozerov EC2015). Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 7/24

Advanced Ideas (Our work) ◮ No exact matching (Bernstein et al. Crypto2011). ◮ Meet in the middle (Stern 1989). ◮ Representations techniques (BJMM EC2012). ◮ Binary search tree (BJMM EC2012). ◮ Nearest Neighbors (May, Ozerov EC2015). Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 8/24

Advanced Ideas (Our work) ◮ No exact matching (Bernstein et al. Crypto2011). ◮ Meet in the middle (Stern 1989). ◮ Representations techniques (BJMM EC2012). ◮ Binary search tree (BJMM EC2012). ◮ Nearest Neighbors (May, Ozerov EC2015). ◮ Division into blocks of different weight (Our work). Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 9/24

Advanced Ideas (Our work) ◮ No exact matching (Bernstein et al. Crypto2011). ◮ Meet in the middle (Stern 1989). ◮ Representations techniques (BJMM EC2012). ◮ Binary search tree (BJMM EC2012). ◮ Nearest Neighbors (May, Ozerov EC2015). ◮ Division into blocks of different weight (Our work). Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 10/24

Representations Techniques ◮ Split the error vector again. Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 11/24

Representations Techniques ◮ Split the error vector again. ◮ Many possible combinations create more solutions. Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 11/24

Division into Blocks ◮ Solve equation blockwise. Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 12/24

Division into Blocks ◮ Solve equation blockwise. Main Equations ”∆( H e 1 + H e 2 + ¯ s ) = ω 1 ” on the first block ”∆( H e 1 + H e 2 + ¯ s ) = ω 2 ” on the second block Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 12/24

Our Algorithm Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 13/24

Our Algorithm Algorithm (Idea) 1. Enumerate all vectors of length k / 2 and weight p 1 / 2. Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 16/24

Our Algorithm Algorithm (Idea) 1. Enumerate all vectors of length k / 2 and weight p 1 / 2. 2. Nearest Neighbor search for weight ω 3 . Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 16/24

Our Algorithm Algorithm (Idea) 1. Enumerate all vectors of length k / 2 and weight p 1 / 2. 2. Nearest Neighbor search for weight ω 3 . 3. Nearest Neighbor search for weight ω 1 . Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 16/24

Our Algorithm Algorithm (Idea) 1. Enumerate all vectors of length k / 2 and weight p 1 / 2. 2. Nearest Neighbor search for weight ω 3 . 3. Nearest Neighbor search for weight ω 1 . 4. Filter for weight p , ω 2 . Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 16/24

Our Algorithm ◮ Can be generalized for an arbitrary number of levels. ◮ Uses May Ozerov Nearest Neighbor search whenever possible. ◮ Comparison to BJMM: NNS on every level, no exact matching. Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 17/24

Results ◮ Comparison: Running time exponent c T for different code rates. Prange BJMM D3 BJMM+NN D3 Our D3 Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 18/24

Results ◮ Comparison: Running time exponent c T and memory exponent c M for different numbers of layers. BJMM-NN Our algorithm Layers c T c M c T c M 2 0.1003 0.0781 0.0982 0.0717 3 0.0967 0.0879 0.0926 0.0647 (FD) 4 0.0953 0.0915 0.0885 0.0736 2 0.0491 0.0309 0.0488 0.0290 3 0.0473 0.0363 0.0478 0.0290 (HD) 4 0.0473 0.0351 0.0465 0.0294 Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 19/24

Results ◮ Comparison: Running time exponent c T and memory exponent c M for different numbers of layers. BJMM-NN Our algorithm Layers c T c M c T c M 2 0.1003 0.0781 0.0982 0.0717 3 0.0967 0.0879 0.0926 0.0647 (FD) 4 0.0953 0.0915 0.0885 0.0736 2 0.0491 0.0309 0.0488 0.0290 3 0.0473 0.0363 0.0478 0.0290 (HD) 4 0.0473 0.0351 0.0465 0.0294 Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 20/24

Application: Hybrid Algorithm for LPN Definition (LPN k ,τ ) Given: Samples of the form ( a i , b i ) := ( a i , � a i , s � + e i ) , for i = 1 , 2 , . . . where a i ∈ R F k 2 and e i ∈ { 0 , 1 } with Pr[ e i = 1] = τ ∈ [0 , 1 2 ). Find: s ∈ F k 2 . ◮ Alternative form: Write n samples as ( A , b ) ∈ F n × k × F n satisfying b = A s + e . 2 2 ◮ Connection to Decoding: b is noisy codeword. Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 21/24

Application: Hybrid Algorithm for LPN ◮ Step 1: Use BKW algorithm to reduce dimension. ◮ Comes at cost of an increased error rate. LPN 512 , 1 4 → LPN 117 , 255 512 ◮ Step 2: Solve instance via decoding. ◮ Comparison: Running time exponents for a typical instance log( T ) log( M ) LPN 117 , 255 512 Prange 117 - BJMM-NN 117 64 Our algorithm 75 47 Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 22/24

Decoding Linear Codes with High Error Rate and its Impact for LPN - PowerPoint PPT Presentation

Decoding Linear Codes with High Error Rate and its Impact for LPN Security PQCrypto 2018 , 09.-11.04.2018 Leif Both , Alexander May Horst Grtz Institute for IT-Security Ruhr-University Bochum, Germany Faculty of Mathematics Our work

6.02 Fall 2012 Lecture #5 Error correction for linear block codes - Syndrome decoding

Improved bounds on the word error probability of RA(2) codes with linear programming based

List Decoding of Algebraic Codes Peter Beelen, Kristian Brander and Johan S.R. Nielsen DTU

Algorithms in the Real World Error Correcting Codes I Overview Hamming Codes Linear

Error Codes Correcting Gary Lecture 11 toolkit CMU Preliminaries Setting Error of

Linear-Time Erasure List-Decoding of Expander Codes Noga Ron-Zewi (University of Haifa) Mary

List decoding of RM(1,m) codes and Multi-linear Power Analysis attacks (MLPA) Ilya Dumer , Rafael

Local Optimality Certificates for LP Decoding of Tanner Codes Nissim Halabi Guy Even 1 1 th

Decoding Reed-Muller codes over product sets John Kim, Swastik Kopparty Rutgers University May

Decoding F q -linear codes over erasure channels Sara D. Cardell Universidad de Alicante

Error Detection Codes Error Detection Two types Nave scheme Error Detection Codes

Decoding error-correcting codes with Grbner bases Stanislav Bulygin Ruud Pellikaan WIC, May

Recent Advances in Decoding Random Binary Linear Codes and Their Implications to Crypto

Some rece cent results on high rate local codes Shubhangi Saraf Rutgers Joint works with

Decoding error-correcting codes with Grbner bases Ruud Pellikaan joint work with Stanislav

G ENERALIZED R EED -S OLOMON CODES (GRS CODES ) A CHARACTERIZATION OF MDS CODES THAT HAVE AN ERROR

Linear-Programming Decoding of Tanner Codes with Local-Optimality Certificates Nissim Halabi Guy

Decoding of Linear Codes Arman Fazeli Alexander Vardy Hanwen Yao afazelic@ucsd.edu

Information Theory Lecture 8 BCH codes BCH codes: R8.45 (R5.6) Decoding BCH (and

Closed formulas for the error locator polynomials of cyclic codes Dedicated to Tom Hholdt in

Simplified high-speed high-distance list decoding for alternant codes cr.yp.to/papers.html

Error Detection Two types Error Detection Codes (e.g. CRC, Parity, Checksums) Error

Turning error-reducing quantum turbo codes into error-correcting codes Mamdouh Abbara (MEc),

Syndrome-Coupled Rate-Compatible Error-Correcting Codes for Flash Memories Pengfei Huang 1 , Yi