Alternant Codes Research Articles

On linear codes with random multiplier vectors and the maximum trace dimension property

Abstract Let C C be a linear code of length n n and dimension k k over the finite field F q m {{\mathbb{F}}}_{{q}^{m}} . The trace code Tr ( C ) {\rm{Tr}}\left(C) is a linear code of the same length n n over the subfield F q {{\mathbb{F}}}_{q} . The obvious upper bound for the dimension of the trace code over F q {{\mathbb{F}}}_{q} is m k mk . If equality holds, then we say that C C has maximum trace dimension. The problem of finding the true dimension of trace codes and their duals is relevant for the size of the public key of various code-based cryptographic protocols. Let C a {C}_{{\boldsymbol{a}}} denote the code obtained from C C and a multiplier vector a ∈ ( F q m ) n {\boldsymbol{a}}\in {\left({{\mathbb{F}}}_{{q}^{m}})}^{n} . In this study, we give a lower bound for the probability that a random multiplier vector produces a code C a {C}_{{\boldsymbol{a}}} of maximum trace dimension. We give an interpretation of the bound for the class of algebraic geometry codes in terms of the degree of the defining divisor. The bound explains the experimental fact that random alternant codes have minimal dimension. Our bound holds whenever n ≥ m ( k + h ) n\ge m\left(k+h) , where h ≥ 0 h\ge 0 is the Singleton defect of C C . For the extremal case n = m ( h + k ) n=m\left(h+k) , numerical experiments reveal a closed connection between the probability of having maximum trace dimension and the probability that a random matrix has full rank.

Построение квазициклических альтернативных кодов и их приложение в кодовых криптосистемах

The paper presents an overview of quasi-cyclic alternant codes and their structural analysis regarding the classification of automorphisms. We also have detailed methods for recovering the structure of a given code. The attractiveness of the family of considered codes lies in their cryptographic applications and, as in theory, in reducing the key length of post-quantum code-based schemes. In addition, this method of constructing codes is universal and can be used to obtain subfield subcodes of quasicyclic algebraic-geometric codes associated with an arbitrary curve with a known group of automorphisms. However, as a result of constructing quasi-cyclic alternant codes, it becomes possible to reduce the key security of the source code to a code with smaller parameters, which may not be resistant to a structural attack.

Reliable Constructions for the Key Generator of Code-based Post-quantum Cryptosystems on FPGA

Advances in quantum computing have urged the need for cryptographic algorithms that are low-power, low-energy, and secure against attacks that can be potentially enabled. For this post-quantum age, different solutions have been studied. Code-based cryptography is one feasible solution whose hardware architectures have become the focus of research in the NIST standardization process and has been advanced to the final round (to be concluded by 2022–2024). Nevertheless, although these constructions, e.g., McEliece and Niederreiter public key cryptography, have strong error correction properties, previous studies have proved the vulnerability of their hardware implementations against faults product of the environment and intentional faults, i.e., differential fault analysis. It is previously shown that depending on the codes used, i.e., classical or reduced (using either quasi-dyadic Goppa codes or quasi-cyclic alternant codes), flaws in error detection could be observed. In this work, efficient fault detection constructions are proposed for the first time to account for such shortcomings. Such schemes are based on regular parity, interleaved parity, and two different cyclic redundancy checks (CRC), i.e., CRC-2 and CRC-8. Without losing the generality, we experiment on the McEliece variant, noting that the presented schemes can be used for other code-based cryptosystems. We perform error detection capability assessments and implementations on field-programmable gate array Kintex-7 device xc7k70tfbv676-1 to verify the practicality of the presented approaches. To demonstrate the appropriateness for constrained embedded systems, the performance degradation and overheads of the presented schemes are assessed.

On the dimension and structure of the square of the dual of a Goppa code

The Goppa code distinguishing (GD) problem asks to distinguish efficiently a generator matrix of a Goppa code from a randomly drawn one. We revisit a distinguisher for alternant and Goppa codes through a new approach, namely by studying the dimension of square codes. We provide here a rigorous upper bound for the dimension of the square of the dual of an alternant or Goppa code, while the previous approach only provided algebraic explanations based on heuristics. Moreover, for Goppa codes, our proof extends to the non-binary case as well, thus providing an algebraic explanation for the distinguisher which was missing up to now. All the upper bounds are tight and match experimental evidence. Our work also introduces new algebraic results about products of trace codes in general and of dual of alternant and Goppa codes in particular, clarifying their square code structure. This might be of interest for cryptanalysis purposes.

Decoding of Interleaved Alternant Codes

Interleaved Reed–Solomon codes admit efficient decoding algorithms which correct burst errors far beyond half the minimum distance in the random errors regime, e.g., by computing a common solution to the Key Equation for each Reed–Solomon code, as described by Schmidt et al. If this decoder does not succeed, it may either <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">fail</i> to return a codeword or <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">miscorrect</i> to an incorrect codeword, and good upper bounds on the fraction of error matrices for which these events occur are known. The decoding algorithm immediately applies to interleaved alternant codes as well, i.e., the subfield subcodes of interleaved Reed–Solomon codes, but the fraction of decodable error matrices differs, since the error is now restricted to a subfield. In this paper, we present new general lower and upper bounds on the fraction of error matrices decodable by Schmidt et al.’s decoding algorithm, thereby making it the only decoding algorithm for interleaved alternant codes for which such bounds are known.

Universal and Dynamic Locally Repairable Codes With Maximal Recoverability via Sum-Rank Codes

Locally repairable codes (LRCs) are considered with equal or unequal localities, local distances, and local field sizes. An explicit two-layer architecture with a sum-rank outer code is obtained, having disjoint local groups and achieving maximal recoverability (MR) for all families of local linear codes (MDS or not) simultaneously, up to a specified maximum locality $r $ . Furthermore, the local linear codes (thus the localities, local distances, and local fields) can be efficiently and dynamically modified without global recoding or changes in architecture or outer code, while preserving the MR property, easily adapting to new configurations in storage or new hot and cold data. In addition, local groups and file components can be added, removed or updated without global recoding. The construction requires global fields of size roughly $g^{r} $ , for $g $ local groups and maximum or specified locality $r $ . For equal localities, these global fields are smaller than those of previous MR-LRCs when $r \leq h $ (global parities). For unequal localities, they provide an exponential field size reduction on all previous best known MR-LRCs. For bounded localities and a large number of local groups, the global erasure-correction complexity of the given construction is comparable to that of Tamo–Barg codes or Reed–Solomon codes with local replication, while local repair is as efficient as for the Cartesian product of the local codes. Reed–Solomon codes with local replication and Cartesian products are recovered from the given construction when $r=1 $ and $h = 0 $ , respectively. The given construction can also be adapted to provide hierarchical MR-LRCs for all types of hierarchies and parameters. Finally, subextension subcodes and sum-rank alternant codes are introduced to obtain further exponential field size reductions, at the expense of lower information rates.

On PGZ decoding of alternant codes

In this paper, we first review the classical Petterson–Gorenstein–Zierler decoding algorithm for the class of alternant codes, which includes Reed–Solomon, Bose–Chaudhuri–Hocquenghem and classical Goppa codes. Afterwards, we present an improvement of the method to find the number of errors and the error-locator polynomial. Finally, we illustrate the procedure with several examples. In two appendices, we sketch the main features of the computer algebra system designed and developed to support the computations.

Pade approximants and key lattices for decoding alternant codes

In this paper we present two methods for algebraic decoding of alternant codes. The paper recalls fundamental facts of these codes and the concept of key equation introduced by Berlekamp on which decoding is based. The first method is based on Pade approximants. The second method consist of translating the key equation into a lattice over the ring of polynomials, called key lattice which depends on the syndrome, and then seek a shortest vector in this key lattice, with degrees constraints. The key lattice approach, following the fruitfull formulation of H. W. Lenstra, is based on a result of Grigor'ev showing that computing a minimal vector in the mentioned lattice is polynomial. The computational complexity of the proposed methods are given in terms of the error-correction capability of the codes and results in tractable polynomial time algorithms. A fast parallel version of the key lattice method is deduced.

Polyadic Constacyclic Codes

For any given positive integer $m$ , a necessary and sufficient condition for the existence of Type-I $m$ -adic constacyclic codes is given. Furthermore, for any given integer $s$ , a necessary and sufficient condition for $s$ to be a multiplier of a Type-I polyadic constacyclic code is given. As an application, some optimal codes from Type-I polyadic constacyclic codes, including generalized Reed–Solomon codes and alternant maximum distance separable codes, are constructed.

Error-correcting pairs

McEliece cryptosystem is the first public-key cryptosystem based on linear error-correcting codes. Although a code with an efficient bounded distance decoding algorithm is chosen as the secret key in this cryptosystem, not knowing the secret code and its decoding algorithm faced the attacker with the problem of decoding a random-looking linear code. Moreover, it is well known that the known efficient bounded distance decoding algorithm of the families of codes proposed for code-based cryptography (like Reed-Solomon codes, Goppa codes, alternant codes or algebraic geometry codes) can be described using error correcting pairs (ECP). That means that, the McEliece cryptosystem is not based on the intractability of bounded distance decoding but on the problem of retrieving an error-correcting pair from a random linear code. The aim of this article is to propose the class of codes with a t-ECP whose error-correcting pair is not easily reconstructed from the single knowledge of a generator matrix.

Constructions of Asymmetric Quantum Alternant Codes

Asymmetric quantum error-correcting codes (AQCs) have been proposed to deal with the significant asymmetry in many quantum channels, which may have more flexbility than general quantum error-correcting codes (QECs). In this paper, we construct AQCs based on Alternant codes. Firstly, we propose a new subclass of Alternant codes and combine them with BCH codes to construct AQCs. Then we construct AQCs based on series of nested pairs of subclasses of Alternant codes such as nested Goppa codes. As an illustrative example, we get three [[55, 6, 19/4]], [[55, 10, 19/3]], [[55, 15, 19/2]] AQCs from the well known [55, 16, 19] binary Goppa code. At last, we get asymptotically good binary expansions of quantum GRS codes, which are quantum generalizations of Retter’s classical results.

Limitations of single coset states and quantum algorithms for code equivalence

Quantum computers can break the RSA, El Gamal, and elliptic curve public-key cryptosystems, as they can efficiently factor integers and extract discrete logarithms. The power of such quantum attacks lies in \emph{quantum Fourier sampling}, an algorithmic paradigm based on generating and measuring coset states. %This motivates the investigation of the power or limitations of quantum Fourier sampling, especially in attacking candidates for ``post-quantum'' cryptosystems -- classical cryptosystems that can be implemented with today's computers but will remain secure even in the presence of quantum attacks. In this article we extend previous negative results of quantum Fourier sampling for Graph Isomorphism, which corresponds to hidden subgroups of order two (over S_n, to several cases corresponding to larger hidden subgroups. For one case, we strengthen some results of Kempe, Pyber, and Shalev on the Hidden Subgroup Problem over the symmetric group. In another case, we show the failure of quantum Fourier sampling on the Hidden Subgroup Problem over the general linear group GL_2(\FF_q). The most important case corresponds to Code Equivalence, the problem of determining whether two given linear codes are equivalent to each other up to a permutation of the coordinates. Our results suggest that for many codes of interest---including generalized Reed Solomon codes, alternant codes, and Reed-Muller codes---solving these instances of Code Equivalence via Fourier sampling appears to be out of reach of current families of quantum algorithms.

Folding Alternant and Goppa Codes With Non-Trivial Automorphism Groups

The main practical limitation of the McEliece public-key encryption scheme is probably the size of its key. A famous trend to overcome this issue is to focus on subclasses of alternant/Goppa codes with a non-trivial automorphism group. Such codes display then symmetries allowing compact parity-check or generator matrices. For instance, a key-reduction is obtained by taking quasi-cyclic (QC) or quasi-dyadic (QD) alternant/Goppa codes. We show that the use of such symmetric alternant/Goppa codes in cryptography introduces a fundamental weakness. It is indeed possible to reduce the key-recovery on the original symmetric public-code to the key-recovery on a (much) smaller code that has no symmetry anymore. This result is obtained thanks to an operation on codes called folding that exploits the knowledge of the automorphism group. This operation consists in adding the coordinates of codewords which belong to the same orbit under the action of the automorphism group. The advantage is twofold. The reduction factor can be as large as the size of the orbits, and it preserves a fundamental property: folding the dual of an alternant (respectively, Goppa) code provides the dual of an alternant (respectively, Goppa) code. A key point is to show that all the existing constructions of alternant/Goppa codes with symmetries follow a common principal of taking codes whose support is globally invariant under the action of affine transformations (by building upon prior works of Berger and Dur). This enables not only to present a unified view but also to generalize the construction of QC, QD, and even quasi-monoidic Goppa codes. Finally, our results can be harnessed to boost up any key-recovery attack on McEliece systems based on symmetric alternant or Goppa codes, and in particular algebraic attacks.

APPLYING BUCHBERGER'S CRITERIA FOR COMPUTING GRÖBNER BASES OVER FINITE-CHAIN RINGS

Norton and Sălăgean [Strong Gröbner bases and cyclic codes over a finite-chain ring, in Proc. Workshop on Coding and Cryptography, Paris, Electronic Notes in Discrete Mathematics, Vol. 6 (Elsevier Science, 2001), pp. 391–401] have presented an algorithm for computing Gröbner bases over finite-chain rings. Byrne and Fitzpatrick [Gröbner bases over Galois rings with an application to decoding alternant codes, J. Symbolic Comput.31 (2001) 565–584] have simultaneously proposed a similar algorithm for computing Gröbner bases over Galois rings (a special kind of finite-chain rings). However, they have not incorporated Buchberger's criteria into their algorithms to avoid unnecessary reductions. In this paper, we propose the adapted version of these criteria for polynomials over finite-chain rings and we show how to apply them on Norton–Sălăgean algorithm. The described algorithm has been implemented in Maple and experimented with a number of examples for the Galois rings.

CYCLIC CODES THROUGH $B[X;\frac{a}{b}{\mathbb Z}_{0}]$, WITH $\frac{a}{b}\in {\mathbb Q}^{+}$ AND b = a+1, AND ENCODING

Let B[X; S] be a monoid ring with any fixed finite unitary commutative ring B and [Formula: see text] is the monoid S such that b = a + 1, where a is any positive integer. In this paper we constructed cyclic codes, BCH codes, alternant codes, Goppa codes, Srivastava codes through monoid ring [Formula: see text]. For a = 1, almost all the results contained in [16] stands as a very particular case of this study.

A Note on Linear Codes over Semigroup Rings

Abstract. In this paper, we introduced new construction techniques of BCH, alternant, Goppa, Srivastava codes through the semigroup ring B[X; 13Z0] instead of the polynomial ring B[X; Z0], where B is a finite commutative ring with identity, and for these constructions we improve the several results of [1]. After this, we present a decoding principle for BCH, alternant and Goppa codes which is based on modified Berlekamp-Massey algorithm. This algorithm corrects all errors up tothe Hamming weight t r/2, i.e., whose minimum Hamming distance is r + 1.

Encoding through generalized polynomial codes

This paper introduces novel constructions of cyclic codes using semigroup rings instead of polynomial rings. These constructions are applied to define and investigate the BCH, alternant, Goppa, and Srivastava codes. This makes it possible to improve several recent results due to Andrade and Palazzo [1].

One-time signature scheme from syndrome decoding over generic error-correcting codes

Abstract We describe a one-time signature scheme based on the hardness of the syndrome decoding problem, and prove it secure in the random oracle model. Our proposal can be instantiated on general linear error correcting codes, rather than restricted families like alternant codes for which a decoding trapdoor is known to exist.

A Simple Proof of Horiguchi's Error-Value Formula in Decoding of Alternant Codes and Its Applications

A direct short proof of Horiguchi's formula for error values in alternant codes is provided. Horiguchi's formula employs only output polynomials of Berlekamp-Massey algorithm, which has less computational complexity than extended Euclidean algorithm for decoding alternant codes. As an application of our proof, we provide an explicit formula for the generator and parity check matrices of alternant codes and their singly- and doubly-extended codes.

Improved List Decoding of Generalized Reed–Solomon and Alternant Codes Over Galois Rings

We present a two-stage list decoder comprising an errors-only Guruswami-Sudan (GS) decoder and an errors-and-erasures GS decoder as component decoders in the first and second stage, respectively. The two stages are coupled via a post-processor which selects a codeword from the output list of the first component decoder, from which erasure locations are obtained for the second stage. When applied to a generalized Reed-Solomon (RS) code over a Galois ring R that maps into a generalized RS code of the same length n and minimum (Hamming) distance d over the corresponding residue field, the proposed decoder exploits the presence of zero divisors in R to correct s errors where w=lceiln-radic(n(n-d))-1rceil<sleslceiln- radic((n-w)(n-d))-1rceil with a probability determined by s, w, and the ratio of the number of nontrivial zero divisors to the number of units in the code alphabet. Focusing primarily on alternant codes over Zopf(2l), an important class of subring subcodes of generalized RS codes over GR(2l,a), we demonstrate that the GS decoding radius w can be exceeded by a substantial margin with significant probability