Decoding Linear Codes with High Error Rate and its Impact for LPN - PowerPoint PPT Presentation

Decoding Linear Codes with High Error Rate and its Impact for LPN Security PQCrypto 2018 , 09.-11.04.2018 Leif Both , Alexander May Horst Görtz Institute for IT-Security Ruhr-University Bochum, Germany Faculty of Mathematics

Our work ◮ Improved running times for decoding of random linear codes. State of the art Our algorithm 2 0 . 0953 n 2 0 . 0885 n Full Distance (FD) 2 0 . 0473 n 2 0 . 0465 n Half Distance (HD) ◮ Based on the BJMM algorithm (Becker, Joux, May, Meurer EC2012) and Nearest Neighbors (May, Ozerov EC2015). ◮ Works best for high error rates. ◮ Application: Hybrid algorithm for LPN (Esser, Kübler, May Crypto2017). Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 2/24

On Linear Codes Definition (Linear Code) A linear code C is a k -dimensional subspace of F n 2 . ◮ Alternative definition via Parity Check matrix P 2 | P c = 0 } , where P ∈ F ( n − k ) × n C = { c ∈ F n . 2 Definition (Distance) For a linear code C the distance is defined as c � = c ′ ∈ C { ∆( c , c ′ ) } . d = min Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 3/24

The Decoding Problem Definition (Decoding Problem) Given: P , ω, x = c + e with c ∈ C , ∆( e ) = ω Find: e ( ⇒ c = x + e ) . ◮ Unique decoding of x if ω ≤ d − 1 2 . ◮ HD Decoding : ω = d − 1 2 . ◮ FD Decoding : ω = d . Definition (Syndrome) The Syndrome s of a vector x is defined as s := P x . ◮ s = P x = P c + P e ⇔ s = P e . Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 4/24

Compare Decoding Algorithms ◮ Running Time T ( n , k , d ). ◮ Use the Gilbert-Varshamov bound ⇒ d = f ( n , k ) ⇒ T ( n , k , d ) = T ( n , k ) . ◮ Worst case running time: T ( n ) = max k { T ( n , k ) } . ◮ Assumption: Exponential complexity of HD/FD decoding ⇒ T ( n ) = 2 c T n . Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 5/24

Prange: Basic Idea for Decoding (1962) Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 6/24

Prange: Basic Idea for Decoding (1962) Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 6/24

Prange: Basic Idea for Decoding (1962) Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 6/24

Prange: Basic Idea for Decoding (1962) Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 6/24

Prange: Basic Idea for Decoding (1962) Algorithm (Idea) 1. Bring P into systematic form. 2. Permute columns. 3. Enumerate all e 1 . 4. Check if ∆( H e 1 + ¯ s ) = ω − p . Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 6/24

Advanced Ideas ◮ Exact matching on some coordinates (Stern 1989). ◮ Meet in the middle (Stern 1989). ◮ Representations techniques (BJMM EC2012). ◮ Binary search tree (BJMM EC2012). ◮ Nearest Neighbors (May, Ozerov EC2015). Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 7/24

Advanced Ideas (Our work) ◮ No exact matching (Bernstein et al. Crypto2011). ◮ Meet in the middle (Stern 1989). ◮ Representations techniques (BJMM EC2012). ◮ Binary search tree (BJMM EC2012). ◮ Nearest Neighbors (May, Ozerov EC2015). Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 8/24

Advanced Ideas (Our work) ◮ No exact matching (Bernstein et al. Crypto2011). ◮ Meet in the middle (Stern 1989). ◮ Representations techniques (BJMM EC2012). ◮ Binary search tree (BJMM EC2012). ◮ Nearest Neighbors (May, Ozerov EC2015). ◮ Division into blocks of different weight (Our work). Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 9/24

Advanced Ideas (Our work) ◮ No exact matching (Bernstein et al. Crypto2011). ◮ Meet in the middle (Stern 1989). ◮ Representations techniques (BJMM EC2012). ◮ Binary search tree (BJMM EC2012). ◮ Nearest Neighbors (May, Ozerov EC2015). ◮ Division into blocks of different weight (Our work). Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 10/24

Representations Techniques ◮ Split the error vector again. Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 11/24

Representations Techniques ◮ Split the error vector again. ◮ Many possible combinations create more solutions. Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 11/24

Division into Blocks ◮ Solve equation blockwise. Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 12/24

Division into Blocks ◮ Solve equation blockwise. Main Equations ”∆( H e 1 + H e 2 + ¯ s ) = ω 1 ” on the first block ”∆( H e 1 + H e 2 + ¯ s ) = ω 2 ” on the second block Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 12/24

Our Algorithm Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 13/24

Our Algorithm Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 14/24

Our Algorithm Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 15/24

Our Algorithm Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 16/24

Our Algorithm Algorithm (Idea) 1. Enumerate all vectors of length k / 2 and weight p 1 / 2. Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 16/24

Our Algorithm Algorithm (Idea) 1. Enumerate all vectors of length k / 2 and weight p 1 / 2. 2. Nearest Neighbor search for weight ω 3 . Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 16/24

Our Algorithm Algorithm (Idea) 1. Enumerate all vectors of length k / 2 and weight p 1 / 2. 2. Nearest Neighbor search for weight ω 3 . 3. Nearest Neighbor search for weight ω 1 . Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 16/24

Our Algorithm Algorithm (Idea) 1. Enumerate all vectors of length k / 2 and weight p 1 / 2. 2. Nearest Neighbor search for weight ω 3 . 3. Nearest Neighbor search for weight ω 1 . 4. Filter for weight p , ω 2 . Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 16/24

Our Algorithm ◮ Can be generalized for an arbitrary number of levels. ◮ Uses May Ozerov Nearest Neighbor search whenever possible. ◮ Comparison to BJMM: NNS on every level, no exact matching. Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 17/24

Results ◮ Comparison: Running time exponent c T for different code rates. Prange BJMM D3 BJMM+NN D3 Our D3 Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 18/24

Results ◮ Comparison: Running time exponent c T and memory exponent c M for different numbers of layers. BJMM-NN Our algorithm Layers c T c M c T c M 2 0.1003 0.0781 0.0982 0.0717 3 0.0967 0.0879 0.0926 0.0647 (FD) 4 0.0953 0.0915 0.0885 0.0736 2 0.0491 0.0309 0.0488 0.0290 3 0.0473 0.0363 0.0478 0.0290 (HD) 4 0.0473 0.0351 0.0465 0.0294 Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 19/24

Results ◮ Comparison: Running time exponent c T and memory exponent c M for different numbers of layers. BJMM-NN Our algorithm Layers c T c M c T c M 2 0.1003 0.0781 0.0982 0.0717 3 0.0967 0.0879 0.0926 0.0647 (FD) 4 0.0953 0.0915 0.0885 0.0736 2 0.0491 0.0309 0.0488 0.0290 3 0.0473 0.0363 0.0478 0.0290 (HD) 4 0.0473 0.0351 0.0465 0.0294 Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 20/24

Application: Hybrid Algorithm for LPN Definition (LPN k ,τ ) Given: Samples of the form ( a i , b i ) := ( a i , � a i , s � + e i ) , for i = 1 , 2 , . . . where a i ∈ R F k 2 and e i ∈ { 0 , 1 } with Pr[ e i = 1] = τ ∈ [0 , 1 2 ). Find: s ∈ F k 2 . ◮ Alternative form: Write n samples as ( A , b ) ∈ F n × k × F n satisfying b = A s + e . 2 2 ◮ Connection to Decoding: b is noisy codeword. Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 21/24

Application: Hybrid Algorithm for LPN ◮ Step 1: Use BKW algorithm to reduce dimension. ◮ Comes at cost of an increased error rate. LPN 512 , 1 4 → LPN 117 , 255 512 ◮ Step 2: Solve instance via decoding. ◮ Comparison: Running time exponents for a typical instance log( T ) log( M ) LPN 117 , 255 512 Prange 117 - BJMM-NN 117 64 Our algorithm 75 47 Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 22/24