here - Sites personnels de TELECOM ParisTech - Télécom ParisTech

2.3. The case ɛ = +1 292.3 The case ɛ = +1We are now interested in the original conjecture proposed by Tu and Deng [264] which can bereformulated as follows.Conjecture 1.2.2. For k ≥ 2 and t ∈ Z/(2 k − 1)Z, let S t,k be the following set 3 :S t,k = { a ∈ Z/(2 k − 1)Z | r(a, t) > w H (t) } ,and P t,k the fraction 4 of modular integers in S t,k :ThenP t,k = #S t,k /2 k .P t,k ≤ 1 2 .Tu and Deng verified computationally the validity of this assumption for k ≤ 29 in aboutfifteen days on a quite recent computer [264]. We also implemented their algorithm and wereable to check the conjecture for k = 39 in about twelve hours and fifteen minutes on a pool ofabout four hundred quite recent cores, and k = 40 on a subset of these computers. The algorithmof Tu and Deng [264, Appendix] as well as our implementation are described in Section 2.9.This conjecture is not only interesting in a cryptographic context, but also for purely arithmeticalreasons. For a fixed modular integer t ∈ Z/(2 k − 1)Z, it is indeed natural to expect thenumber of carries occurring when adding a random modular integer a ∈ Z/(2 k − 1)Z to t to beroughly the Hamming weight of t. Following this idea, it is of interest to study the distribution ofthe number of carries around this value. Quite unexpectedly, the conjecture seems to indicate akind of regularity.2.3.1 NotationWe now define the sets we are interested in.Definition 2.3.1. Let k ≥ 2 and t ∈ Z/(2 k − 1)Z. Define:• C t,k ={(a, b) ∈ ( Z/(2 k − 1)Z ) }2| a + b = t , the modular integers whose sum is t;• C t,k,i = {(a, b) ∈ C t,k | w H (a) + w H (b) = k + i}, the modular integers whose sum is t andwhose sum of weights is k + i for i ∈ Z;• S t,k , the modular integers whose sum is t and whose sum of weights is strictly less than k,i.e. S t,k = ⊔ i0 C t,k,i;• E t , the modular integers whose sum is t and whose sum of weights equals k; i.e. E t = C t,k,0 .The following lemma is obvious.Lemma 2.3.2. For k ≥ 2 and t ∈ Z/(2 k − 1)Z,C t,k = S t,k ⊔ E t ⊔ T t,k .3 It is easy to see that this formulation is equivalent to the original one. A formal proof will be given inCorollary 2.3.8.4 We are fully aware that there are only 2 k − 1 elements in Z/(2 k − 1)Z, but we will often use the abuse ofterminology we make here and speak of fraction, probability or proportion for P t,k .