The Syndrome Decoding problem is at the core of many code-based
cryptosystems. In this paper, we study ternary Syndrome Decoding in large
weight. This problem has been introduced in the Wave signature scheme but has
never been thoroughly studied. We perform an algorithmic study of this problem
which results in an update of the Wave parameters. On a more fundamental level,
we show that ternary Syndrome Decoding with large weight is a really harder
problem than the binary Syndrome Decoding problem, which could have several
applications for the design of code-based cryptosystems

A Becker

A May

AD Flaxman

C Peters

CT Gueye

D Wagner

E Berlekamp

E Prange

J Stern

JT Coffey

M Chaimovich

N Howgrave-Graham

N Sendrier

NT Courtois

S Hirose

T Johansson

Z Galil

English

arXiv

Bricout, Rémi

Chailloux, André

Debris-Alazard, Thomas

Lequesne, Matthieu

INRIA a CCSD electronic archive server

HAL Id: hal-02421017https://hal.inria.fr/hal-02421017Submitted on 20 Dec 2019HAL is a multi-disciplinary open accessarchive for the deposit and dissemination of sci-entific research documents, whether they are pub-lished or not. The documents may come fromteaching and research institutions in France orabroad, or from public or private research centers.L’archive ouverte pluridisciplinaire HAL, estdestinée au dépôt et à la diffusion de documentsscientifiques de niveau recherche, publiés ou non,émanant des établissements d’enseignement et derecherche français ou étrangers, des laboratoirespublics ou privés.Ternary Syndrome Decoding with Large WeightRémi Bricout, André Chailloux, Thomas Debris-Alazard, Matthieu LequesneTo cite this version:Rémi Bricout, André Chailloux, Thomas Debris-Alazard, Matthieu Lequesne. Ternary SyndromeDecoding with Large Weight. Munich Workshop on Coding and Cryptography (MWCC), Jul 2019,Munich, Germany. ￿hal-02421017￿Ternary Syndrome Decoding with Large WeightRémi Bricout 1,2 André Chailloux 2 Thomas Debris-Alazard1,2 Matthieu Lequesne 1,21 Sorbonne Université, UPMC Univ Paris 06 2 Inria, ParisThe Syndrome Decoding ProblemSyndrome Decoding - SD(q, R,W )Instance: H ∈ F(n−k)×nq of full rank,s ∈ Fn−kq (usually called the syndrome).Output: e ∈ Fnq such that |e| = w and eHᵀ = s,where k 4=dRne, w 4=dWne and |e| 4= |{i : ei 6= 0}|.Binary vs. Ternary caseDepending on R and W , the complexity of the SD problem cangreatly vary. Let us fix a value R, and letWGV denote the Gilbert-Varshamov bound. For W ∈[0, 12], there exist three regimes.1 W ≈ WGV. There is a small number of solutions. This is theregime where the problem is the hardest and where it is themost studied.2 W  WGV. There are exponentially many solutions and thismakes the problem simpler. When W reaches 1−R2 , the problemcan be solved in average polynomial time.3 W  WGV. In this regime, we have with high probability aunique solution. However, the search space, i.e. the set ofvectors e st. |e| = dWne is much smaller.Decoding in Large WeightSymetry. SD(2, R,W ) and SD(2, R, 1−W ) are equivalent.However, this argument is no longer valid for q ≥ 3.The problem has a quite different behavior in small and largeweights. The goal of this work is to study the com-plexity of the SD problem for q = 3 and W > 0.5.Figure 1: Asymptotic complexity of Prange’s ISD algorithm for R = 0.5.From SD to Subset SumMost algorithms designed to solve the SD problem follow the sameframework, which can be generalized for the non-binary case. Let(H, s) be the instance that we want to solve. Let us introduce `and p, two parameters of the system.1 Apply a random permutation π on the columns of H.2 Perform a partial Gaussian elimination on the rows ofHπ using the first n− k − ` columns. Let S ∈ F(n−k)×(n−k)q bethe matrix corresponding to this operation and introduce twomatrices H′ ∈ F(n−k−`)×(k+`)q and H′′ ∈ F`×(k+`)q such thatSHπ =(1n−k−` H′0 H′′).The problem can be rewritten as follows.Hπeᵀ = sᵀ ⇐⇒ SHπeᵀ = Ssᵀ⇐⇒(1n−k−` H′0 H′′)(e′ᵀe′′ᵀ)=(s′ᵀs′′ᵀ)⇐⇒{e′ᵀ + H′e′′ᵀ = s′ᵀH′′e′′ᵀ = s′′ᵀTo solve the problem, we will try to find a solution (e′, e′′) tothe above system such that |e′′| = p and |e′| = w − p.3 Compute a set S of solutions of H′′e′′ᵀ = s′′ᵀ such that|e′′| = p. This is an instance of the Subset Sum problem.4 Take a vector e′′ ∈ S and let e′ᵀ = s′ᵀ −H′e′′ᵀ. If|e′| = w − p, e = (e′, e′′) is a solution for inputs Hπ and s,which can be turned into a solution of the initial problem.Reduction LemmaIf we have an algorithm that solves SS(3, k + `, `, L, ∅) then wehave an algorithm that solves SSNZC(3, k+`, `, L, k+`) with thesame complexity.The Subset Sum ProblemSubset Sum problem - SS(q, n,m, L, p)Instance: n vectors xi ∈ Fmq for 1 ≤ i ≤ n, a target s ∈ Fmq .Output: L solutions (b(j)1 , . . . , b(j)n ) ∈ {0, 1}n for 1 ≤ j ≤ L,such that for all j, ∑ni=1 b(j)i xi = s and |b(j)| = p.We denote SSNZC(q, n,m, L, p) the problem when we lookfor solutions with b(j)i ∈ Fq. We denote SS(q, n,m, L, ∅) theproblem without any constraint on the weight.Wagner’s algorithmWagner’s algorithm [1] is an algorithm to solve SS(2, n, `, L, ∅).For some parameters, it finds L solution in time O(L). It caneasily be adapted to solve the SS problem in the ternary case.The algorithm works as follows:divide the vectors x1, . . . ,xn in 2a stacks of size n/2a ;for each stack, compute a list Lp of L random linearcombinations of the vectors in the stack ;merge the lists two by two: from Lp and Lp+1 create the list{yp + yp+1 : yi ∈ Li and the last `/a bits of yp + yp+1 are 0s.} ;repeat a− 1 times.Figure 2: Wagner’s algorithm with a = 2.Theorem. Fix k, ` ∈ N∗ and a ∈ N such that 3`/a ≤ 2(k+`)/2a.The associated SS(3, k + `, `, 3`/a, ∅) problem can be solved inaverage time and space O(3`/a).Smoothing Wagner’s AlgorithmWagner’s algorithm shows how to find L solutions in timeO(L) forL = 3`/a. The smaller L is, the better the algorithm performs. Sothe idea is to take the largest integer a such that 3`/a < 2(k+`)/2a.But this induces a discontinuity in the complexity. We propose arefinement of the theorem that reduces the discontinuity.Using RepresentationsWhen looking for vectors b, Wagner’s algorithm looks for b in theform b = b1 + b2, where the second half of b1 and the first half ofb2 are only zeros, as on Figure 3 (1). As in the BJMM algorithm[2], the idea of representations is to remove this constraint andreplace it by a less restrictive one. Here, we fix the number of0s, 1s and 2s in b1 and b2. This allows more possibilities towrite b as the sum of two vectors (2).Figure 3: Same vector (1) using left-right split and (2) using representations.Our best algorithm uses a tree on seven levels. It uses Wagner’sleft-right splits at the top and at the bottom of the tree and rep-resentations on the intermediate levels.Figure 4: Wagner tree for a = 7.Yellow lists correspond to representations and blue lists to left-right splits.Wave parametersFigure 5: Comparison of the exponent complexities for R = 0.676New Parameters for WaveWave [3] is a new code-based signature scheme. It uses a hash-and-sign approach and follows the GPV paradigm. Wave is thefirts cryptographic scheme relying on the ternary SD problem withlarge weight. Forging a signature in the Wave scheme amounts tosolving the ternary SD problem (more exactly the Decoding OneOut of Many version of the problem). We provide new parametersfor Wave so that the scheme resists attacks using our algorithms.Hardest InstancesWe now focus on the parameters where the problem isthe hardest. We compared the performance of 3 standard algo-rithms: Prange’s algorithm, Dumer’s algorithm and the BJMM al-gorithm on binary SD problem with our equivalents for the ternarySD problem. We performed a case study and showed that thehardest case is reached for R ≈ 0.36907 and W = 1.Algorithm q = 2 q = 3 and W > 0.5Prange 0.121 (R = 0.454) 0.369 (R = 0.369)Dumer/Wagner 0.116 (R = 0.447) 0.269 (R = 0.369)BJMM/our algorithm 0.102 (R = 0.427) 0.247 (R = 0.369)Table 1: Best exponents with associated rates.The ternary SD problem appears significantly harder than thebinary one. But the input matrices have elements in F3 and notF2, so matrices of the same dimension contain more information.To get rid of this bias, we define the following metric. Whatis the smallest input size for which the algorithmsneed at least 2128 operations to decode? The input matrixH ∈ Fn(1−R)×n3 is represented in systematic form.Algorithm q = 2 q = 3 and W > 0.5Prange 275 (R = 0.384) 44 (R = 0.369)Dumer/Wagner 295 (R = 0.369) 83 (R = 0.369)BJMM/our algorithm 374 (R = 0.326) 99 (R = 0.369)Table 2: Minimum input sizes (in Kbits) for a time complexity of 2128.ConclusionStrong difference between the cases q = 2 and q ≥ 3.Two algorithms to solve the Syndrome Decoding problem inthis new regime : a q-ary version of Wagner’s approach anda second algorithm making use of representations.Application: new parameters for the Wave signaturescheme.Study of ths hardest case: complexity of SD in large weightis higher than in small weight.This work opens many new perspectives. It seems thereare many cases in code-based cryptography, from encryptionschemes to signatures, where this problem could replacethe binary SD problem to get smaller key sizes.[1] David Wagner.A generalized birthday problem.In Moti Yung, editor, Advances in Cryptology - CRYPTO 2002, volume 2442 of LNCS,pages 288–303. Springer, 2002.[2] Anja Becker, Antoine Joux, Alexander May, and Alexander Meurer.Decoding random binary linear codes in 2n/20: How 1 + 1 = 0 improves information setdecoding.In Advances in Cryptology - EUROCRYPT 2012, LNCS. Springer, 2012.[3] Thomas Debris-Alazard, Nicolas Sendrier, and Jean-Pierre Tillich.Wave: A new code-based signature scheme.Cryptology ePrint Archive, Report 2018/996, October 2018.https://eprint.iacr.org/2018/996.

Ternary Syndrome Decoding with Large Weight

Archive Ouverte en Sciences de l'Information et de la Communication

Crossref

The Syndrome Decoding problem is at the core of many code-based
cryptosystems.  In this paper, we study ternary Syndrome Decoding in
large weight. This problem has been introduced in the Wave signature
scheme but has never been thoroughly studied. We perform an
algorithmic study of this problem which results in an update of the
Wave parameters. On a more fundamental level, we show that ternary
Syndrome Decoding with large weight is a really harder problem than
the binary Syndrome Decoding problem, which could have several
applications for the design of code-based cryptosystems

Rémi Bricout

André Chailloux

Thomas Debris-Alazard

Matthieu Lequesne

Cryptology ePrint Archive

International audienceThe Syndrome Decoding problem is at the core of many code-based cryptosys-tems. In this paper, we study ternary Syndrome Decoding in large weight. This problem has been introduced in the Wave signature scheme but has never been thoroughly studied. We perform an algorithmic study of this problem which results in an update of the Wave parameters. On a more fundamental level, we show that ternary Syndrome Decoding with large weight is a really harder problem than the binary Syndrome Decoding problem, which could have several applications for the design of code-based cryptosystems

Décodage par syndrome ternaire en gros poids

Ternary Syndrome Decoding with Large Weight

Abstract

Similar works

Full text

Available Versions

INRIA a CCSD electronic archive server

Archive Ouverte en Sciences de l'Information et de la Communication

Crossref

Cryptology ePrint Archive

INRIA a CCSD electronic archive server

Archive Ouverte en Sciences de l'Information et de la Communication