Improved Information Set Decoding - Decoding Random Linear ...

Improved Information Set Decoding - 

Decoding Random Linear Codes in O(2 0.054n ) 

Alexander May, Alexander Meurer, Enrico Thomae 

ASIACRYPT 2011, Seoul 

HORST GÖRTZ INSTITUTE FOR IT-SECURITY 

FACULTY OF MATHEMATICS Department for IT-Security and Cryptology

Recap Binary Linear Codes 

A binary linear code C is a k-dimensional subspace of F 2 

n 

0 / 1 

k 

● Generator matrix G = C = { x t·G k 

: x 2 F 2 

} 

n 

n-k 

● Parity check matrix H = 0 / 1 

n 

C = { H·c = 0 : c 2 F 2 

} 

n 

IMPROVED INFORMATION SET DECODING ASIACRYPT 2011 | December 2011, Seoul


A binary linear code C is a k-dimensional subspace of F 2 

n 

k 

● Generator matrix G = C = { x t·G k 

: x 2 F 2 

} 

n 

0 / 1 

n-k 

● Parity check matrix H = 0 / 1 

n 

C = { H·c = 0 : c 2 F 2 

} 

n 

Minimum distance d = min x≠y2C 

{ wt(x+y) } 

C is called binary [n,k,d] code. 

· 

d 

x 

· · 

y 



n 

A binary linear code C is a k-dimensional subspace of F 

● 

Running time of decoding algorithms: T(n,k,d) 

2 

● 

In 

● Generator this talk: Analysis 

matrix for random 

G k 

= 

0 binary / 1 linear 

C = { x t·G k 

: x 2 F 2 

} 

codes with constant rate R=k/n 

● 

For n→∞, k and d are related via Gilbert- 

n 

n-k 

n 

● Parity Varshamov check matrix bound, thus 

H = 0 / 1 C = { H·c = 0 : c 2 F 2 

} 

T(n,k,d) = T(n,k) 

● 

We compare algorithms by their complexity 

· 

y 

d 

Minimum coeffcient distance F(k), d i.e. = min c2C 

{ wt(c) } 

x 

· · 

Such C is called binary T(n,k) [n,k,d] = O(2 code. 

F(k)n ) 

n 


Scenario (Bounded Distance Decoding) 

Obtain x = c + e with c 2 C and w := wt(e) = 

Goal: Find e and thus c = x + e 

Consider syndrome s := s(x) = H·x = H·(c+e) = H·e 

→ Find linear combination of w columns of H matching s 

weight w 

n 

4 5 

d-1 

2 

· 

x· 

4 5 

d-1 

2 

c 

· · 

· 

n-k 

H 

= + + = s 







weight w 

n 

4 5 

d-1 

2 

n-k 

H 

= + + = 

T(n,k,d) 

s 

= 

n 

· 

x· 

4 5 

d-1 

2 

c 

· · 

Brute-Force complexity 

w 

· 





4 5 

d-1 

2 



· 

x· 

4 5 

d-1 

2 

c 

· · 

· 

weight w 

n 

Complexity 

n-k 

H 

= + + = s 

F(k) ≤ 0.38677 


Some very basic observations 

Allowed (linear algebra) transformations 

● 

Permuting the columns of H does not change the problem 




● 


weight w 

n 

n-k 

H 

= s 




● 


weight w 

n 

n-k 

H 

= s 




● 

● 


Elementary row operations on H do not change the problem 




● 

● 



weight w 

n 

n-k 

H 

= 

s 




● 

● 



weight w 

n 

U G 

n-k 

H 

U G 

= s 

Invertible (n-k)x(n-k) matrix 


Randomized systematic form 

From now on, we work on a randomly column-permuted version 

of H in systematic form 

(n-k) x k matrix 

U G * 

H * 

= 

Q 

I n-k 

U P 

(n-k)-dimensional 

idendity matrix 


Basic Information Set Decoding 

''Reducing the brute-force search 

space by linear algebra.'' 



Fundamental principle: 

● 

Randomization: transform H into column-permuted 

systematic form 

H 

→ 

Q 

I n-k 

● Search phase: Try to fnd solution e = weight w , i.e. 

weight w 

Q 

I n-k 

= 

s 

● 

If no solution found: Rerandomize and try again! 



Fundamental principle: 

● 

Randomization: transform H into column-permuted 

systematic form 

H → Q 

T(n,k,d) = Pr[“good” randomization] -1 x C[Search] 

● Search phase: Try to fnd solution e = weight w , i.e. 

I n-k 

weight w 

Q 

I n-k 

= 

s 

● 

If no solution found: Rerandomize and try again! 


Classical ISD variants 

Lee-Brickel (1988) 

p 

k 

w - p 

n-k 

Q 

I n-k 

= s 

● Brute force on Q, i.e. search e'= p with wt(Qe'+s) = w-p 

● If so, fll up e''= w - p with remaining (w-p) 1's 




p 

w - p 

e' 

k 

n-k 

k 

Q 

I n-k 

= s 

⇔ 

Q 

+ s = e'' 

wt(Qe'+s) = w-p 

● Brute force on Q, i.e. search e'= p with wt(Qe'+s) = w-p 

● If so, fll up e''= w - p with remaining (w-p) 1's 




p 

k 

w - p 

n-k 

e' 

k 

Q 

I n-k 

= s 

⇔ 

Q 

+ s = e'' 


● Brute T(n,k,d) force = on Q, Pr[“good” i.e. search randomization] e'= p 

-1 x with C[Brute wt(Qe'+s) force] 

= w-p 

k p n−k 

w 

n 

w− p 

● If so, fll up e''= w - p 

= with remaining w-p x 

1's 

−1 

k p 




p 

k 

w - p 

n-k 

e' 

k 

Q 

I n-k 

= s 

⇔ 

Q 

+ s = e'' 


Complexity 

● Brute force (bounded on Q, i.e. search distance e'= decoding) 

p 

with wt(Qe'+s) = w-p 

F(k) ≤ 0.05751 

● If so, fll up e''= w - p with remaining w-p 1's 



Stern (1989) 

● 

Meet-in-the-middle on Q 

p/2 p/2 0 w - p 

k/2 k/2 l n-k-l 

q 1 

, … , q k 

Q' 

I n-k 

= s 



Stern (1989) 

● 


p/2 p/2 0 w - p 

k/2 k/2 l n-k-l 

q 1 

, … , q k 

Q' 

I n-k 

= s 

Find e'= p/2 p/2 

with 

Qe'=s' on frst l coordinates, i.e. 

p/2 p/2 

q 1 

, … , q k 

Q' 

via standard sort & match 

= 

s' 

* 

: 

* 

∑ q i 

i∈I 1 

match 

∑ q i s ' 

i∈I 2 

I 1 ⊂[1, , k 2 ] I 2⊂[ k 2 1,, k ] 



Stern (1989) 

● 


p/2 p/2 0 w - p 

k/2 k/2 l n-k-l 

q 1 

, … , q k 

Q' 

I n-k 

= s 

⇔ 

p/2 p/2 

q 1 

, … , q k 

Q' 

+ 

s 

= 

0 

I n-k 

w - p 



Stern (1989) 

● 


p/2 p/2 0 w - p 

k/2 k/2 l n-k-l 

q 1 

, … , q k 

Q' 

I n-k 

= s 

⇔ 

s' 

* 

: 

* 

+ 

s 

= 

0 

I n-k 

w - p 



Stern (1989) 

● 


p/2 p/2 0 w - p 

k/2 k/2 l n-k-l 

q 1 

, … , q k 

Q' 

I n-k 

= s 

⇔ 

s' 

* 

: 

* 

+ 

s 

= 

0 

I n-k 

w - p 

0 

⇔ * 

: 

* 

= 

e'' 



Stern (1989) 

● 


p/2 p/2 0 w - p 

k/2 k/2 l n-k-l 

q 1 

, … , q k 

Q' 

I n-k 

= s 

⇔ 

s' 

* 

: 

* 

+ 

s 

= 

0 

I n-k 

w - p 

T(n,k,d) = Pr[“good” randomization] -1 x 0C[MitM] 

⋅ 

n−k −l 

 

= e'' 

= x k : 

p/2 

IMPROVED INFORMATION SET DECODING ASIACRYPT 2011 | December 2011, Seoul 

[ 

 

k / 

⇔ 

2 

p/ 

* 

22 

w− p 

n w 

]−1 

*


Stern (1989) 

● 


p/2 p/2 0 w - p 

k/2 k/2 l n-k-l 

q 1 

, … , q k 

Q' 

I n-k 

= s 

⇔ 

s' 

* 

: 

* 

+ 

s 

= 

0 

I n-k 

w - p 

Complexity (bounded distance decoding) 

0 

⇔ * 

: 

* 

F(k) ≤ 0.05563 

= 

e'' 


Wrapping up so far 

● 

Different methods search for different error-distributions 

● Lee-Brickel (1988) 

p/2 p/2 0 w-p 

● Stern (1989) 

p w-p 



● 

● 



p w-p 

● Stern (1989) 

p/2 p/2 0 w-p 

Recently: Ball-collision decoding (CRYPTO11) by Bernstein et al. 

● Improving Pr[good rand.] by allowing q extra 1's within the 

length l zero-window 

p/2 p/2 q/2 q/2 w-p-q 

● F(k) ≤ 0.05558 



● 



p 

w-p 

● Stern (1989) 

p/2 p/2 0 w-p 

● 

Recently: Ball-collision decoding (CRYPTO11) by Bernstein et al. 

● 

Improving Pr[good rand.] by allowing q extra 1's within the 

length l zero-window 

● F(k) ≤ 0.05558 

p/2 p/2 q/2 q/2 w-p-q 

● 

Both Stern and BallColl improve runtime at the cost of increased 

space consumption (→ see paper for details) 



Asymptotic complexity (Bounded Distance Decoding) 

Lee-Brickel F(k) = 0.05751 

Stern F(k) = 0.05563 

BallColl F(k) = 0.05558 


Our New Algorithm 


Generalized ISD framework 

● 

Starting point: Generalized ISD framework of Finiasz and 

Sendrier (ASIACRYPT 2009) 

● 

Observation: Since frst l columns of I n-k 

can not be used in 

Stern's algorithm, we can simply „shift“ them to the Q-part 

of H 



● 



● 




of H 

k 

n-k 

H = 

Q 

I n-k 



● 



● 




of H 

H = 

k+l 

Q 

n-k-l 

0 

I n-k-l 

l rows 



● 

Major subproblem: Finding exactly p columns amongst 

q 1 

, ..., q k+l 

matching s on it's frst l coordinates s' 

k+l 

q 1 

, ..., q k+l 

n-k-l 

0 

l rows 

H = 

Q' 

I n-k-l 



● 

Major subproblem: Finding exactly p columns amongst 

q 1 

, ..., q k+l 

matching s on it's frst l coordinates s' 

● 

Stern divides the q i 

into disjoint sets, i.e. searches index sets 

I 1 ⊂[1, , kl and 

2 ] I 2⊂[ k l 1,,k l] 

2 

with 

∑ q ∑ i q i =s ' 

i∈I 1 i∈ I 2 

k+l 

q 1 

, ..., q k+l 

n-k-l 

0 

l rows 

H = 

Q' 

I n-k-l 


Our New Algorithm 

● 

Main contribution: More effcient non-disjoint matching 

inspired by representation technique of Howgrave-Graham 

and Joux (in the context of subset sum algorithms), i.e. pick 

I 1, I 2 ⊂[1,, kl ] 

with ∣I j ∣= p 2 

and 

∑ q ∑ i 

q i 

=s ' 

i∈I 1 i∈ I 2 

k+l 

n-k-l 

q 1 

, ..., q k+l 

0 

l rows 

H = 

Q' 

I n-k-l 


The representation trick in detail 

k+l 

● Aim: Find weight p such that 

p 

k+l 

q 1 

, ..., q k+l 

= 

s 1 

' 

: 

s l 

' 

 

p 

p/2 

● There are ways of decomposing p , e.g. 

p/2 

p/2 

, , ... 

p/2 

p/2 

→ It suffces to fnd one of them! 


How can we proft from representations? 

p 

k+l 

q 1 

, ..., q k+l 

w-p 

n-k-l 

0 

Q' 

I n-k-l 

● Advantage: Every solution expands into 

p 

p/2 equivalent solutions 

● Disadvantage: Search space grows from kl/2 

to kl 

p/2 p/2 

● Goal: Find one solution via Divide & Conquer strategy 

kl 

p/2 

● Rule of thumb: We get better if 


 

p 

p/2 kl/2 

p/2


p 

k+l 

q 1 

, ..., q k+l 

w-p 

n-k-l 

0 

Q' 

I n-k-l 


p 

Complexity 

p/2 equivalent 0 solutions 

● Disadvantage: Search space ⇔ grows from kl/2 

to * 

p/2 

= 

kl 

p/2 e'' 

T(n,k,d) = Pr[“good” randomization] -1 x C[RepTrick] 

: 

● Goal: Find one solution via Generalized Birthday * attack (Wagner) 

kl 

p/2 

kl 

p 

= ⋅ n−k −l 

x 

p/2 

w− p ● Rule of thumb: We get better if 

[ kl 

n w 


]−1 

 

p 

p/2 kl/2 

p/2 

 

p 

p/2


p 

k+l 

q 1 

, ..., q k+l 

w-p 

n-k-l 

0 

Q' 

I n-k-l 


p 

p/2 equivalent 0 solutions 

● Disadvantage: Complexity Search (bounded space ⇔ grows distance from decoding) 

kl/2 

to * 

p/2 

= 

kl 

p/2 e'' 

: 

● Goal: Find one solution via Generalized Birthday * attack (Wagner) 

F(k) ≤ 0.05364 

kl 

p/2 

● Rule of thumb: We get better if 


 

p 

p/2 kl/2 

p/2

Complexity comparison 

Asymptotic complexitiy (Bounded Distance Decoding) 

Lee-Brickel F(k) = 0.05751 

BallColl F(k) = 0.05558 

MMT F(k) = 0.05364 


Summary 

● 

● 

● 

Asymptotically fastest generic decoding algorithm 

Not a mere time-memory trade-off (→ see paper) 

First application of HGJ representation trick to a different 

scenario 

Open questions 

● 

● 

● 

Precise analysis w.r.t. polynomial factors (e.g. linear algebra) 

Transfer Bernstein's speed-up tricks for Stern's algorithm 

What is the real break even point compared to other methods? 


Summary 

● 

● 

● 

Asymptotically fastest generic decoding algorithm 

Not a mere time-memory trade-off (→ see paper) 

First application of HGJ representation trick to a different 

scenario 

Thank you! 

Open questions 

● 

● 

● 

Precise analysis w.r.t. polynomial factors (e.g. linear algebra) 

Transfer Bernstein's speed-up tricks for Stern's algorithm 

What is the real break even point compared to other methods?

Improved Information Set Decoding - Decoding Random Linear ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?