Bounded Distance Decoding Research Articles

Concatenated Permutation Codes under Chebyshev Distance

Permutation codes are error-correcting codes over symmetric groups. We focus on permutation codes under Chebyshev (ℓ∞) distance. A permutation code invented by Kløve et al. is of length n, size 2n-d and, minimum distance d. We denote the code by φn,d. This code is the largest known code of length n and minimum Chebyshev distance d > n/2 so far, to the best of the authors knowledge. They also devised efficient encoding and hard-decision decoding (HDD) algorithms that outperform the bounded distance decoding. In this paper, we derive a tight upper bound of decoding error probability of HDD. By factor graph formalization, we derive an efficient maximum a-posterior probability decoding algorithm for φn,d. We explore concatenating permutation codes of φn,d=0 with binary outer codes for more robust error correction. A naturally induced pseudo distance over binary outer codes successfully characterizes Chebyshev distance of concatenated permutation codes. Using this distance, we upper-bound the minimum Chebyshev distance of concatenated codes. We discover how to concatenate binary linear codes to achieve the upper bound. We derive the distance distribution of concatenated permutation codes with random outer codes. We demonstrate that the sum-product decoding performance of concatenated codes with outer low-density parity-check codes outperforms conventional schemes.

A New Code Based Signature Scheme for Blockchain Technology

Blockchain is a method of recording information that makes it not feasible for the system to be replaced, attacked, or manipulated. A blockchain is equipped with a notebook that copies and processes the various procedures across the network of computers participating in the blockchain. Digital signature algorithm is one of the cryptographic protocols used by the blockchain. In this work, we introduce a new digital signature scheme based on error correcting codes. In the scheme constructed on a [n, k, d]− code over 𝔽q, which is d ≥ 2t + 1, and the size of the signature length is n − k. The signature verification is based on the bounded distance decoding of the code. Since the verification space is 𝔽qn, the proposed scheme has an improved performance in terms of working in a wider space.

Application of Discrete Pruned Enumeration in Solving BDD

The bounded distance decoding (BDD) is a fundamental problem in lattice-based cryptography which is derived from the closest vector problem (CVP). In this paper, we adapt the lattice enumeration with discrete pruning, a burgeoning method for the shortest lattice vector problem (SVP), to solve BDD in various cryptanalysis scenarios using direct method. We first transfer the basic definition involved in discrete pruning technique from SVP to CVP, prove corresponding properties and give the specific procedures of the algorithm. Additionally, we use the discrete pruning technique to interpret the classical CVP algorithms, including Babai’s nearest plane and Lindner–Peikert nearest planes, which can be regarded as discrete pruned enumeration on some special pruning sets. We propose three probability models in the runtime analysis to accurately estimate the cost of our algorithm in different application scenarios. We study the application of discrete pruned enumeration for BDD mainly on LWE-based cryptosystem and DSA with partially known nonces. The experimental results show that our new algorithm has higher efficiency than the previous algorithms which directly solve BDD, including the nearest plane(s) algorithms and the lattice enumeration with classical pruning strategies, and we are able to recover the DSA secret with less leaked information than the previous works.

Enhanced Anchor Decoder for Staircase Codes With Hard Reliability Scores

In this letter, we propose an enhanced anchor decoding (AD) algorithm for staircase codes with hard reliability scores (HRSs). We use the following two observations on the decoding results of the iterative bounded distance decoding (BDD) to assign the HRSs. Firstly, the miscorrection probability increases with the number of erroneous bits detected by the BDD. Secondly, the miscorrection probability of an anchor is low when the affected codewords due to error corrections of this anchor are also anchors. Most miscorrections can be reliably detected and prevented by using HRSs. The simulation results show that, for a staircase code based on the two-error-correcting Bose-Chaudhuri-Hocquenghem (BCH) code, the enhanced AD algorithm performs 0.11 dB better than the AD algorithm at a bit error rate of 10−7.

Improved Soft-Aided Decoding of Product Codes With Dynamic Reliability Scores

Products codes (PCs) are conventionally decoded with efficient iterative bounded-distance decoding (iBDD) based on hard-decision channel outputs which entails a performance loss compared to a soft-decision decoder. Recently, several hybrid algorithms have been proposed aimed to improve the performance of iBDD decoders via the aid of a certain amount of soft information while keeping the decoding complexity similarly low as in iBDD. We propose a novel hybrid low-complexity decoder for PCs based on error-and-erasure (EaE) decoding and dynamic reliability scores (DRSs). This decoder is based on a novel EaE component code decoder, which is able to decode beyond the designed distance of the component code but suffers from an increased miscorrection probability. The DRSs, reflecting the reliability of a codeword bit, are used to detect and avoid miscorrections. Simulation results show that this policy can reduce the miscorrection rate significantly and improves the decoding performance. The decoder requires only ternary message passing and a slight increase of computational complexity compared to iBDD, which makes it suitable for high-speed communication systems. Coding gains of up to 1.2 dB compared to the conventional iBDD decoder are observed.

Sub-Block Rearranged Staircase Codes

We propose a new family of spatially coupled product codes, called sub-block rearranged staircase (SR-staircase) codes. Each code block of SR-staircase codes is obtained by encoding rearranged preceding code blocks and new information blocks, where the rearrangement involves sub-blocks decomposition and transposition. The proposed codes can be constructed to have each code block size of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$1/q$ </tex-math></inline-formula> to that of the conventional staircase codes while having the same rate and component codes, for any positive integer <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$q$ </tex-math></inline-formula> . In this regard, we can use strong algebraic component codes to construct SR-staircase codes with a similar or the same code block size and rate as staircase codes with weak component codes. We characterize the decoding threshold of the proposed codes under iterative bounded distance decoding (iBDD) by using density evolution. We also derive the conditions under which they achieve a better decoding threshold than that of staircase codes. Further, we investigate the error floor performance by analyzing the contributing error patterns and their multiplicities. Both theoretical and simulation results show that the designed SR-staircase codes outperform staircase codes in terms of waterfall and error floor while the performance can be further improved by using a large coupling width.

Public-Key Cryptosystems and Bounded Distance Decoding of Linear Codes.

Error-correcting codes form an important topic in information theory. They are used to correct errors that occur during transmission on a noisy channel. An important method for correcting errors is bounded distance decoding. The public-key cryptosystem is a cryptographic protocol that has two different keys. One of them is a public-key that can be known by everyone, and the other is the private-key only known to the user of the system. The data encrypted with the public-key of a given user can only be decrypted by this user with his or her private-key. In this paper, we propose a public-key cryptosystem based on the error-correcting codes. The decryption is performed by using the bounded distance decoding of the code. For a given code length, dimension, and error-correcting capacity, the new system allows dealing with larger plaintext than other code based public-key cryptosystems.

Guessing Bits: Improved Lattice Attacks on (EC)DSA with Nonce Leakage

The lattice reduction attack on (EC)DSA (and other Schnorr-like signature schemes) with partially known nonces, originally due to Howgrave-Graham and Smart, has been at the core of many concrete cryptanalytic works, side-channel based or otherwise, in the past 20 years. The attack itself has seen limited development, however: improved analyses have been carried out, and the use of stronger lattice reduction algorithms has pushed the range of practically vulnerable parameters further, but the lattice construction based on the signatures and known nonce bits remain the same.In this paper, we propose a new idea to improve the attack based on the same data in exchange for additional computation: carry out an exhaustive search on some bits of the secret key. This turns the problem from a single bounded distance decoding (BDD) instance in a certain lattice to multiple BDD instances in a fixed lattice of larger volume but with the same bound (making the BDD problem substantially easier). Furthermore, the fact that the lattice is fixed lets us use batch/preprocessing variants of BDD solvers that are far more efficient than repeated lattice reductions on non-preprocessed lattices of the same size. As a result, our analysis suggests that our technique is competitive or outperforms the state of the art for parameter ranges corresponding to the limit of what is achievable using lattice attacks so far (around 2-bit leakage on 160-bit groups, or 3-bit leakage on 256-bit groups).We also show that variants of this idea can also be applied to bits of the nonces (leading to a similar improvement) or to filtering signature data (leading to a data-time trade-off for the lattice attack). Finally, we use our technique to obtain an improved exploitation of the TPM–FAIL dataset similar to what was achieved in the Minerva attack.

Approximating Closest Vector Problem in ℓ∞-Norm Revisited

Abstract The security of most lattice-based cryptography schemes are based on two computational hard problems which are the short integer solution (SIS) and learning with errors (LWE) problems. The computational complexity of SIS and LWE problems are related to approximating shortest vector problem and bounded distance decoding (BDD) problem. Approximating BDD is a special case of approximating closest vector problem (CVP). In this paper, we revisit the study for approximating CVP. We give a proof that approximating the CVP over $\ell _\infty $-norm (CVP$_\infty $) within any constant factor is NP-hard. The result is obtained by the gap-preserving reduction from Min Total Label Cover problem in $\ell _1$-norm to to CVP$_\infty $. This proof is simpler than known proofs [ 10].

Novel High-Throughput Decoding Algorithms for Product and Staircase Codes Based on Error-and-Erasure Decoding

Product codes (PCs) and staircase codes (SCCs) are conventionally decoded based on bounded distance decoding (BDD) of the component codes and iterating between row and column decoders. The performance of iterative BDD (iBDD) can be improved using soft-aided (hybrid) algorithms. Among these, iBDD with combined reliability (iBDD-CR) has been recently proposed for PCs, yielding sizeable performance gains at the expense of a minor increase in complexity compared to iBDD. In this paper, we first extend iBDD-CR to SCCs. We then propose two novel decoding algorithms for PCs and SCCs which improve upon iBDD-CR. The new algorithms use an extra decoding attempt based on error and erasure decoding of the component codes. The proposed algorithms require only the exchange of hard messages between component decoders, making them an attractive solution for ultra high-throughput fiber-optic systems. Simulation results show that our algorithms based on two decoding attempts achieve gains of up to $0.88$ dB for both PCs and SCCs. This corresponds to a $33\%$ optical reach enhancement over iBDD with bit-interleaved coded modulation using $256$ quadrature amplitude modulation.

Refined Reliability Combining for Binary Message Passing Decoding of Product Codes

We propose a novel soft-aided iterative decoding algorithm for product codes (PCs). The proposed algorithm, named iterative bounded distance decoding with combined reliability (iBDD-CR), enhances the conventional iterative bounded distance decoding (iBDD) of PCs by exploiting some level of soft information. In particular, iBDD-CR can be seen as a modification of iBDD where the hard decisions of the row and column decoders are made based on a reliability estimate of the BDD outputs. The reliability estimates are derived using extrinsic message passing for generalized low-density-parity check (GLDPC) ensembles, which encompass PCs. We perform a density evolution analysis of iBDD-CR for transmission over the additive white Gaussian noise channel for the GLDPC ensemble. We consider both binary transmission and bit-interleaved coded modulation with quadrature amplitude modulation.We show that iBDD-CR achieves performance gains up to $0.51$ dB compared to iBDD with the same internal decoder data flow. This makes the algorithm an attractive solution for very high-throughput applications such as fiber-optic communications.

Toward Non-interactive Zero-Knowledge Proofs for NP from LWE

Non-interactive zero-knowledge ( $$\mathsf {NIZK}$$ ) is a fundamental primitive that is widely used in the construction of cryptographic schemes and protocols. Our main result is a reduction from constructing $$\mathsf {NIZK}$$ proof systems for all of $$\mathbf {NP}$$ based on $$\mathsf {LWE}$$ , to constructing a $$\mathsf {NIZK}$$ proof system for a particular computational problem on lattices, namely a decisional variant of the bounded distance decoding ( $$\mathsf {BDD}$$ ) problem. That is, we show that assuming $$\mathsf {LWE}$$ , every language $$L \in \mathbf {NP}$$ has a $$\mathsf {NIZK}$$ proof system if (and only if) the decisional $$\mathsf {BDD}$$ problem has a $$\mathsf {NIZK}$$ proof system. This (almost) confirms a conjecture of Peikert and Vaikuntanathan (CRYPTO, 2008). To construct our $$\mathsf {NIZK}$$ proof system, we introduce a new notion that we call prover-assisted oblivious ciphertext sampling ( $$\mathsf {POCS}$$ ), which we believe to be of independent interest. This notion extends the idea of oblivious ciphertext sampling, which allows one to sample ciphertexts without knowing the underlying plaintext. Specifically, we augment the oblivious ciphertext sampler with access to an (untrusted) prover to help it accomplish this task. We show that the existence of encryption schemes with a $$\mathsf {POCS}$$ procedure, as well as some additional natural requirements, suffices for obtaining $$\mathsf {NIZK}$$ proofs for $$\mathbf {NP}$$ . We further show that such encryption schemes can be instantiated based on $$\mathsf {LWE}$$ , assuming the existence of a $$\mathsf {NIZK}$$ proof system for the decisional $$\mathsf {BDD}$$ problem.

Vulnerable Public Keys in NTRU Cryptosystem

In this paper the authors give an efficient bounded distance decoding (BDD for short) algorithm for NTRU lattices under some conditions about the modulus number q and the public key h. They then use this algorithm to give plain-text recovery attack to NTRU Encrypt and forgery attack on NTRU Sign. In particular the authors figure out a weak domain of public keys such that the recent transcript secure version of NTRU signature scheme NTRUMLS with public keys in this domain can be forged.

On the hardnesses of several quantum decoding problems

We classify the time complexities of three decoding problems for quantum stabilizer codes: quantum bounded distance decoding (QBDD), quantum maximum likelihood decoding (QMLD), and quantum minimum error probability decoding (QMEPD). For QBDD, we show that it is NP-hard based on Fujita’s result, and cover the gap of full row rank of check matrices, like what Berlekamp, McEliece, and Tilborg suggested in 1978. Then, we give some insight into the quantum decoding problems to clarify that the degeneracy property is implicitly embedded in any decoding algorithm, independent of the typical definition of degenerate codes. Then, over the depolarizing channel model, we show that QMLD and QMEPD are NP-hard. The NP-hardnesses of these decoding problems indicate that decoding general stabilizer codes is extremely difficult, strengthening the foundation of quantum code-based cryptography.

Improving BDD Enumeration for LWE Problem Using GPU

In this paper, we present a GPU-based parallel algorithm for the Learning With Errors (LWE) problem using a lattice-based Bounded Distance Decoding (BDD) approach. To the best of our knowledge, this is the first GPU-based implementation for the LWE problem. Compared to the sequential BDD implementation of Lindner-Peikert and pruned-enumeration strategies by Kirshanova [1], our GPU-based implementation is almost faster by a factor 6 and 9 respectively. The used GPU is NVIDIA GeForce GTX 1060 6G. We also provided a parallel implementation using two GPUs. The results showed that our algorithm is scalable and faster than the sequential version (Lindner-Peikert and pruned-enumeration) by a factor of almost 13 and 16 respectively. Moreover, the results showed that our parallel implementation using two GPUs is more efficient than Kirshanova et al.'s parallel implementation using 20 CPU-cores.

Binary Message Passing Decoding of Product-Like Codes

We propose a novel binary message passing decoding algorithm for product-like codes based on bounded distance decoding (BDD) of the component codes. The algorithm, dubbed iterative BDD with scaled reliability (iBDD-SR), exploits the channel reliabilities and is therefore soft in nature. However, the messages exchanged by the component decoders are binary (hard) messages, which significantly reduces the decoder data flow. The exchanged binary messages are obtained by combining the channel reliability with the BDD decoder output reliabilities, properly conveyed by a scaling factor applied to the BDD decisions. We perform a density evolution analysis for generalized low-density parity-check (GLDPC) code ensembles and spatially coupled GLDPC code ensembles, from which the scaling factors of the iBDD-SR for product and staircase codes, respectively, can be obtained. For the white additive Gaussian noise channel, we show performance gains up to 0.29 dB and 0.31 dB for product and staircase codes compared to conventional iterative BDD (iBDD) with the same decoder data flow. Furthermore, we show that iBDD-SR approaches the performance of ideal iBDD that prevents miscorrections.

Lattice Gaussian Sampling by Markov Chain Monte Carlo: Bounded Distance Decoding and Trapdoor Sampling

Sampling from the lattice Gaussian distribution plays an important role in various research fields. In this paper, the Markov chain Monte Carlo (MCMC)-based sampling technique is advanced in several fronts. Firstly, the spectral gap for the independent Metropolis-Hastings-Klein (MHK) algorithm is derived, which is then extended to Peikert's algorithm and rejection sampling; we show that independent MHK exhibits faster convergence. Then, the performance of bounded distance decoding using MCMC is analyzed, revealing a flexible trade-off between the decoding radius and complexity. MCMC is further applied to trapdoor sampling, again offering a trade-off between security and complexity. Finally, the independent multiple-try Metropolis-Klein (MTMK) algorithm is proposed to enhance the convergence rate. The proposed algorithms allow parallel implementation, which is beneficial for practical applications.

Improved analysis of the reduction from BDD to uSVP

In ICALP 2016, Bai, Stehlé and Wen showed that for polynomially bounded parameter γ, the Bounded Distance Decoding (BDD) problem with parameter 1/(2γ) can be probabilistically reduced to the unique Shortest Vector Problem (uSVP) with parameter γ. Their reduction is based on the lattice sparsification and embedding techniques. In this paper, we improve their analysis for specific values of the parameter and prove that BDD1/(2γ) can be reduced to uSVPγ1 with a slightly larger gap. The improvement follows from a careful study of the radius of a sphere which contains at most polynomial number of vectors, then a proper choice of the parameter in the embedding lattice is used to obtain a unique lattice with a larger gap. Our result shows that the equivalence between BDD1/(2γ) and uSVPγ does not hold under the assumption that uSVPγ does not reduce to uSVPγ′ for any two constants γ<γ′.

Improved Decoding of Staircase Codes: The Soft-Aided Bit-Marking (SABM) Algorithm

Staircase codes (SCCs) are typically decoded using iterative bounded-distance decoding (BDD) and hard decisions. In this paper, a novel decoding algorithm is proposed, which partially uses soft information from the channel. The proposed algorithm is based on marking certain number of highly reliable and highly unreliable bits. These marked bits are used to improve the miscorrection-detection capability of the SCC decoder and the error-correcting capability of BDD. For SCCs with $2$-error-correcting Bose-Chaudhuri-Hocquenghem component codes, our algorithm improves upon standard SCC decoding by up to $0.30$~dB at a bit-error rate (BER) of $10^{-7}$. The proposed algorithm is shown to achieve almost half of the gain achievable by an idealized decoder with this structure. A complexity analysis based on the number of additional calls to the component BDD decoder shows that the relative complexity increase is only around $4\%$ at a BER of $10^{-4}$. This additional complexity is shown to decrease as the channel quality improves. Our algorithm is also extended (with minor modifications) to product codes. The simulation results show that in this case, the algorithm offers gains of up to $0.44$~dB at a BER of $10^{-8}$.

Polynomial time bounded distance decoding near Minkowski’s bound in discrete logarithm lattices

We propose a concrete family of dense lattices of arbitrary dimension n in which the lattice bounded distance decoding (BDD) problem can be solved in deterministic polynomial time. This construction is directly adapted from the Chor–Rivest cryptosystem (IEEE-TIT 1988). The lattice construction needs discrete logarithm computations that can be made in deterministic polynomial time for well-chosen parameters. Each lattice comes with a deterministic polynomial time decoding algorithm able to decode up to large radius. Namely, we reach decoding radius within $$O(\log n)$$ Minkowski’s bound, for both $$\ell _1$$ and $$\ell _2$$ norms.