Information Set Decoding in the Lee Metric Violetta Weger joint - PowerPoint PPT Presentation

Information Set Decoding in the Lee Metric Violetta Weger joint work with Franco Chiaraluce, Marco Baldi, Massimo Battaglioni, Anna-Lena Horlemann-Trautmann, Edoardo Persichetti and Paolo Santini University of Zurich CBCrypto 2020 9 May 2020 Violetta Weger Information Set Decoding in the Lee Metric

Motivation Changing the Metric The original McEliece cryptosystem using Goppa codes remains unbroken but sufgers from large key sizes. Many attempts of fjxing this issue by exchanging the family of codes. Example: Niederreiter proposed to use GRS codes, which have the highest error correction capacity, hence promise low key sizes, but are vulnerable to algebraic attacks. Within the 7 code-based cryptosystems in the NIST round 2, the ones that are achieving the lowest key sizes are based on the rank metric. Violetta Weger Information Set Decoding in the Lee Metric

Motivation Rank Metric Defjnition (Rank Metric) q we defjne the rank weight to be with the rank metric. Violetta Weger Information Set Decoding in the Lee Metric For A , B ∈ F m × n wt R ( A ) = rk ( A ) and the rank distance between A and B to be d R ( A , b ) = wt R ( A − B ) . Defjnition ( F q -linear Rank Metric Code) C is a F q -linear rank metric code of length n and dimension k, if C is a k -dimensional linear subspace of Mat m × n ( F q ) equipped

Motivation Rank Metric Defjnition (Rank Metric) rank metric. metric codes. Violetta Weger Information Set Decoding in the Lee Metric For x , y ∈ F n q m we defjne the rank weight to be wt R ( x ) = dim ( ⟨ x 1 , . . . , x n ⟩ F q ) and the distance between x and y to be d R ( x , y ) = wt R ( x − y ) . Defjnition ( F q m -linear Rank Metric Code) C is a F q m -linear rank metric code of length n and dimension k, if C is a k -dimensional linear subspace of F n q m equipped with the Note: all F q m -linear rank metric codes are also F q -linear rank

Motivation Bruteforce cost Violetta Weger t Difgerence between Rank and Hamming Metric t Information Set Decoding in the Lee Metric Rank q m . Hamming Let x ∈ F n Supp ( x ) { 1 ≤ i ≤ n | x i ̸ = 0 } ⟨ x 1 , . . . , x n ⟩ F q wt ( x ) | Supp ( x ) | dim ( Supp ( x )) t − 1 ( q m − 1 ) t q t − q i ∼ q ( m − t ) t q m − q i ( n ) [ m ] q = ∏ i = 0

Motivation Difgerence between Rank and Hamming Metric Hamming Rank NP-complete SDP more costly Advantages studied thoroughly low key sizes large key sizes not studied thoroughly Disadvantages only randomized reduction Violetta Weger Information Set Decoding in the Lee Metric

Lee Metric Properties Defjnition (Lee Weight) Violetta Weger Information Set Decoding in the Lee Metric Let x ∈ Z / m Z , then wt L ( x ) = min { x , | m − x |} . Example ( Z / 8 Z ) wt L ( 0 ) = 0 wt L ( 1 ) = wt L ( 7 ) = 1 wt L ( 2 ) = wt L ( 6 ) = 2 wt L ( 3 ) = wt L ( 5 ) = 3 wt L ( 4 ) = 4

Lee Metric Properties Defjnition (Lee Weight) Violetta Weger Information Set Decoding in the Lee Metric Let x ∈ Z / m Z , then wt L ( x ) = min { x , | m − x |} .

Lee Metric Properties Defjnition (Lee Weight) Violetta Weger Information Set Decoding in the Lee Metric Let x ∈ Z / m Z , then wt L ( x ) = min { x , | m − x |} .

Lee Metric Properties Defjnition (Lee Metric) n Defjnition (Lee Metric Code) Violetta Weger Information Set Decoding in the Lee Metric Let x , y ∈ ( Z / m Z ) n , then the Lee weight is defjned as ∑ wt L ( x ) = wt L ( x i ) and the Lee distance between x and y is i = 1 d L ( x , y ) = wt L ( x − y ) . Clearly: For all x ∈ ( Z / m Z ) n : wt H ( x ) ≤ wt L ( x ) . C is a linear Lee metric code of length n and type | C | , if C is an additive subgroup of ( Z / m Z ) n equipped with the Lee metric.

Lee Metric Quaternary Codes Defjnition (Quaternary Code) Defjnition (Gray Isometry) Violetta Weger Information Set Decoding in the Lee Metric C is a quaternary code of length n and type 4 k 1 2 k 2 , if C is an additive subgroup of ( Z / 4 Z ) n equipped with the Lee metric. ϕ : ( Z / 4 Z , wt L ) → ( F 2 2 , wt H ) 0 �→ ( 0 , 0 ) 1 �→ ( 0 , 1 ) 2 �→ ( 1 , 1 ) 3 �→ ( 1 , 0 ) We can extend ϕ n : ( Z / 4 Z ) n → F 2 n 2 .

Lee Metric Quaternary Codes Defjnition (Quaternary Code) Defjnition (Gray Isometry) Violetta Weger Information Set Decoding in the Lee Metric C is a quaternary code of length n and type 4 k 1 2 k 2 , if C is an additive subgroup of ( Z / 4 Z ) n equipped with the Lee metric. ϕ : ( Z / 4 Z , wt L ) → ( F 2 2 , wt H ) 0 �→ ( 0 , 0 ) 1 �→ ( 0 , 1 ) 2 �→ ( 1 , 1 ) 3 �→ ( 1 , 0 ) We can extend ϕ n : ( Z / 4 Z ) n → F 2 n 2 .

Lee Metric 4 Violetta Weger . 2 4 4 0 2Id k 2 2 F E The systematic form of the parity check matrix is given by Difgerences 2 . Information Set Decoding in the Lee Metric 2 C the systematic form of the generator matrix is given by A 2 0 2Id k 2 B Let C be a quaternary code of length n and type 4 k 1 2 k 2 , then ( Id k 1 ) G = , , B ∈ Z k 1 × ( n − k 1 − k 2 ) , C ∈ Z k 2 × ( n − k 1 − k 2 ) where A ∈ Z k 1 × k 2 ( D ) Id n − k 1 − k 2 H = , where D ∈ Z ( n − k 1 − k 2 ) × k 1 , E ∈ Z ( n − k 1 − k 2 ) × k 2 , F ∈ Z k 2 × k 1

ISD in the Lee Metric Main idea: Assume no error happen in the information set. Violetta Weger A ISD over the Hamming Metric Information Set Decoding in the Lee Metric q q Prange’s algorithm: Given: H ∈ F ( n − k ) × n , s ∈ F n − k , t ∈ N . q , such that He ⊤ = s ⊤ and wt H ( e ) = t . Find: e ∈ F n ) ( 0 ) UHe ⊤ = ( = Us ⊤ . Id n − k e ′⊤ Thus we get the condition e ′⊤ = Us ⊤ .

ISD in the Lee Metric Structure of ISD Algorithms 1. Choose an information set. 2. Bring the parity check matrix into systematic form and perform the same row operations on the syndrome. 3. By assuming a certain weight distribution of the error vector we get conditions on the error vector. 4. Go through all possible vectors and check if conditions are satisfjed, if they are output the error vector. 5. If not, start over with a new information set. Violetta Weger Information Set Decoding in the Lee Metric

ISD in the Lee Metric Cost of ISD Algorithms The cost of an ISD algorithm is given by number of iterations = reciprocal of the success probability of one iteration. Example: Prange in the Hamming metric has a success probability of t t Violetta Weger Information Set Decoding in the Lee Metric number of iterations · cost of one iteration . ) − 1 ( n − k )( n .

ISD in the Lee Metric 2 C Violetta Weger t t New success probability: 2 1 Quaternary Prange 0 Information Set Decoding in the Lee Metric 4 4 Given: H ∈ Z ( n − k 1 ) × n , s ∈ Z n − k 1 , t ∈ N . 4 with He ⊤ = s ⊤ and wt L ( e ) = t . Find: e ∈ Z n ( A ) ( 0 ) ( s ⊤ ) UHe ⊤ = Id n − k 1 − k 2 = . e ′⊤ 2 s ⊤ From this we get the conditions e ′ = s 1 and s 2 = 0. ) − 1 ( 2 ( n − k 1 − k 2 ) )( 2 n .

Performance j Violetta Weger j 4 n and minimum Lee distance d, such that GV - Bounds Information Set Decoding in the Lee Metric Let n and d be positive integers. There exists a linear binary 2 n Proposition (Gilbert-Varshamov Bound) code C of length n and minimum Hamming distance d, such that | C |≥ ) . ∑ d − 1 ( n j = 0 Furthermore there exists a linear quaternary code C of length n | C |≥ . ( ∑ d − 1 ( 2 n ) − 1 ) 3 + 1 j = 0

Performance 256.33 cost Prange t H d H k n In the Hamming metric: 1887620 215 903 431 3 970 1943 14534 256.03 42 Key Size 451 334 708122 Violetta Weger 3730692 256.68 214 429 1931 3863 128.03 103 94 189 841 1683 203852 80.53 51 85 20 Performance for theoretical Parameters 101 463 1050 83.42 12 25 90 5 Key Size 3 cost Prange t L d L k 2 k 1 n In the Lee metric: 230 105 375 3106 372380 128.82 96 193 3 430 863 129.96 52 20 41 154 9 173 107180 80.29 Information Set Decoding in the Lee Metric

Performance Disclaimer These are only theoretical parameters, since we are not actually proposing a code to be used within the quaternary McEliece cryptosystem! Violetta Weger Information Set Decoding in the Lee Metric

Information Set Decoding in the Lee Metric . . . . 0 0 Diffjculties of Generalizing p Id k s 0 . . . . . . ... . . . . . . 0 0 Violetta Weger . and the systematic form of the parity check matrix is . ... . . . . . . matrix is Id k 1 0 p Id k 2 Lee Metric over Z p s Let C be a linear Lee metric code over Z p s of length n and type ( p s ) k 1 ( p s − 1 ) k 2 . . . p k s . Then the systematic form of the generator   . . . A 1 , s + 1 A 1 , 2 A 1 , s . . .  pA 2 , s + 1  G = pA 2 , s  ,      p s − 1 Id k s p s − 1 A s , s + 1 . . .   . . . Id n − K B 1 , 1 B 1 , 2 B 1 , s . . .   H = pB 2 , 1 pB 2 , 2  ,      p s − 1 B s , 1 p s − 1 Id k 2 . . . where K = ∑ s i = 1 k i .

Information Set Decoding in the Lee Metric Simplifjcation for ISD For the purpose of ISD algorithms we can choose the following form Violetta Weger considering k 1 . A 0 pB This way we are putting all the zero-divisors together, only . and p s p s pD 0 Lee Metric over Z p s ( Id k 1 ) ( C ) Id n − K G = , H = , with A ∈ Z k 1 × ( n − k 1 ) , B ∈ Z ( K − k 1 ) × ( n − k 1 ) , C ∈ Z ( n − K ) × K p s − 1 D ∈ Z ( K − k 1 ) × K p s − 1