Decoding Linear Codes with High Error Rate and its Impact for LPN - - PowerPoint PPT Presentation

▶

Jun 28, 2023 198 likes •557 views

Decoding Linear Codes with High Error Rate and its Impact for LPN Security PQCrypto 2018 , 09.-11.04.2018 Leif Both , Alexander May Horst Grtz Institute for IT-Security Ruhr-University Bochum, Germany Faculty of Mathematics Our work

SLIDE 1

Decoding Linear Codes with High Error Rate and its Impact for LPN Security

PQCrypto 2018, 09.-11.04.2018 Leif Both, Alexander May Horst Görtz Institute for IT-Security Ruhr-University Bochum, Germany Faculty of Mathematics

SLIDE 2

Our work

◮ Improved running times for decoding of random linear codes. State of the art Our algorithm Full Distance (FD) 20.0953n 20.0885n Half Distance (HD) 20.0473n 20.0465n ◮ Based on the BJMM algorithm (Becker, Joux, May, Meurer EC2012) and Nearest Neighbors (May, Ozerov EC2015). ◮ Works best for high error rates. ◮ Application: Hybrid algorithm for LPN (Esser, Kübler, May Crypto2017).

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 2/24

SLIDE 3

On Linear Codes Definition (Linear Code)

A linear code C is a k-dimensional subspace of Fn

2.

◮ Alternative definition via Parity Check matrix P C = {c ∈ Fn

2 | Pc = 0}, where P ∈ F(n−k)×n 2

.

Definition (Distance)

For a linear code C the distance is defined as d = min

c=c′∈C{∆(c, c′)}.

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 3/24

SLIDE 4

The Decoding Problem Definition (Decoding Problem)

Given: P, ω, x = c + e with c ∈ C, ∆(e) = ω Find: e (⇒ c = x + e). ◮ Unique decoding of x if ω ≤ d−1

2 .

◮ HD Decoding: ω = d−1

2 .

◮ FD Decoding: ω = d.

Definition (Syndrome)

The Syndrome s of a vector x is defined as s := Px. ◮ s = Px = Pc + Pe ⇔ s = Pe.

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 4/24

SLIDE 5

Compare Decoding Algorithms

◮ Running Time T(n, k, d). ◮ Use the Gilbert-Varshamov bound ⇒ d = f (n, k) ⇒ T(n, k, d) = T(n, k). ◮ Worst case running time: T(n) = maxk{T(n, k)}. ◮ Assumption: Exponential complexity of HD/FD decoding ⇒ T(n) = 2cT n.

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 5/24

SLIDE 6

Prange: Basic Idea for Decoding (1962)

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 6/24

SLIDE 7

Prange: Basic Idea for Decoding (1962)

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 6/24

SLIDE 8

Prange: Basic Idea for Decoding (1962)

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 6/24

SLIDE 9

Prange: Basic Idea for Decoding (1962)

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 6/24

SLIDE 10

Prange: Basic Idea for Decoding (1962) Algorithm (Idea)

1. Bring P into systematic form.
2. Permute columns.
3. Enumerate all e1.
4. Check if ∆(He1 + ¯

s) = ω − p.

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 6/24

SLIDE 11

Advanced Ideas

◮ Exact matching on some coordinates (Stern 1989). ◮ Meet in the middle (Stern 1989). ◮ Representations techniques (BJMM EC2012). ◮ Binary search tree (BJMM EC2012). ◮ Nearest Neighbors (May, Ozerov EC2015).

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 7/24

SLIDE 12

Advanced Ideas (Our work)

◮ No exact matching (Bernstein et al. Crypto2011). ◮ Meet in the middle (Stern 1989). ◮ Representations techniques (BJMM EC2012). ◮ Binary search tree (BJMM EC2012). ◮ Nearest Neighbors (May, Ozerov EC2015).

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 8/24

SLIDE 13

Advanced Ideas (Our work)

◮ No exact matching (Bernstein et al. Crypto2011). ◮ Meet in the middle (Stern 1989). ◮ Representations techniques (BJMM EC2012). ◮ Binary search tree (BJMM EC2012). ◮ Nearest Neighbors (May, Ozerov EC2015). ◮ Division into blocks of different weight (Our work).

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 9/24

SLIDE 14

Advanced Ideas (Our work)

◮ No exact matching (Bernstein et al. Crypto2011). ◮ Meet in the middle (Stern 1989). ◮ Representations techniques (BJMM EC2012). ◮ Binary search tree (BJMM EC2012). ◮ Nearest Neighbors (May, Ozerov EC2015). ◮ Division into blocks of different weight (Our work).

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 10/24

SLIDE 15

Representations Techniques

◮ Split the error vector again.

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 11/24

SLIDE 16

Representations Techniques

◮ Split the error vector again. ◮ Many possible combinations create more solutions.

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 11/24

SLIDE 17

Division into Blocks

◮ Solve equation blockwise.

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 12/24

SLIDE 18

Division into Blocks

◮ Solve equation blockwise.

Main Equations

”∆(He1 + He2 + ¯ s) = ω1” on the first block ”∆(He1 + He2 + ¯ s) = ω2” on the second block

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 12/24

SLIDE 19

Our Algorithm

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 13/24

SLIDE 20

Our Algorithm

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 14/24

SLIDE 21

Our Algorithm

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 15/24

SLIDE 22

Our Algorithm

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 16/24

SLIDE 23

Our Algorithm Algorithm (Idea)

1. Enumerate all vectors of length k/2 and weight p1/2.

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 16/24

SLIDE 24

Our Algorithm Algorithm (Idea)

1. Enumerate all vectors of length k/2 and weight p1/2.
2. Nearest Neighbor search for weight ω3.

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 16/24

SLIDE 25

Our Algorithm Algorithm (Idea)

1. Enumerate all vectors of length k/2 and weight p1/2.
2. Nearest Neighbor search for weight ω3.
3. Nearest Neighbor search for weight ω1.

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 16/24

SLIDE 26

Our Algorithm Algorithm (Idea)

1. Enumerate all vectors of length k/2 and weight p1/2.
2. Nearest Neighbor search for weight ω3.
3. Nearest Neighbor search for weight ω1.
4. Filter for weight p, ω2.

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 16/24

SLIDE 27

Our Algorithm

◮ Can be generalized for an arbitrary number of levels. ◮ Uses May Ozerov Nearest Neighbor search whenever possible. ◮ Comparison to BJMM: NNS on every level, no exact matching.

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 17/24

SLIDE 28

Results

◮ Comparison: Running time exponent cT for different code rates.

Prange BJMM D3 BJMM+NN D3 Our D3

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 18/24

SLIDE 29

Results

◮ Comparison: Running time exponent cT and memory exponent cM for different numbers of layers. BJMM-NN Our algorithm Layers cT cM cT cM 2 0.1003 0.0781 0.0982 0.0717 3 0.0967 0.0879 0.0926 0.0647 (FD) 4 0.0953 0.0915 0.0885 0.0736 2 0.0491 0.0309 0.0488 0.0290 3 0.0473 0.0363 0.0478 0.0290 (HD) 4 0.0473 0.0351 0.0465 0.0294

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 19/24

SLIDE 30

Results

◮ Comparison: Running time exponent cT and memory exponent cM for different numbers of layers. BJMM-NN Our algorithm Layers cT cM cT cM 2 0.1003 0.0781 0.0982 0.0717 3 0.0967 0.0879 0.0926 0.0647 (FD) 4 0.0953 0.0915 0.0885 0.0736 2 0.0491 0.0309 0.0488 0.0290 3 0.0473 0.0363 0.0478 0.0290 (HD) 4 0.0473 0.0351 0.0465 0.0294

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 20/24

SLIDE 31

Application: Hybrid Algorithm for LPN Definition (LPNk,τ)

Given: Samples of the form (ai, bi) := (ai, ai, s + ei), for i = 1, 2, . . . where ai ∈R Fk

2 and ei ∈ {0, 1} with Pr[ei = 1] = τ ∈ [0, 1 2).

Find: s ∈ Fk

2.

◮ Alternative form: Write n samples as (A, b) ∈ Fn×k

2

× Fn

2

satisfying b = As + e. ◮ Connection to Decoding: b is noisy codeword.

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 21/24

SLIDE 32

Application: Hybrid Algorithm for LPN

◮ Step 1: Use BKW algorithm to reduce dimension. ◮ Comes at cost of an increased error rate. LPN512, 1

4 → LPN117, 255 512

◮ Step 2: Solve instance via decoding. ◮ Comparison: Running time exponents for a typical instance LPN117, 255

512

log(T) log(M) Prange 117

BJMM-NN

117 64 Our algorithm 75 47

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 22/24

SLIDE 33

Application: Hybrid Algorithm for LPN

◮ Comparison: Running time exponent for different error rates.

Prange BJMM+NN D3 Our D3

Decoding Linear Codes with High Error Rate and its Impact for LPN Security|PQCrypto 2018|09.-11.04.2018 23/24

SLIDE 34

Summary

◮ Improved running times for decoding of random linear codes. ◮ Reason: Heavy use of Nearest Neighbor techniques. ◮ Superior algorithm in the hybrid framework for LPN. ◮ Open Problem: Reduce number of parameters. Many thanks for your attention!