Constant-time Algorithm Research Articles

Adaptive histogram equalization in constant time

Adaptive Histogram Equalization (AHE) and its contrast-limited variant CLAHE are well-known and effective methods for improving the local contrast in an image. However, the fastest available implementations scale linearly with the filter mask size, which results in high execution times. This presents an obstacle in real-world applications, where large filter mask sizes are desired while maintaining low execution times. In this work, we propose an efficient algorithm for AHE that reduces the per-pixel computational complexity to O(1)\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\mathcal {O}(1)$$\\end{document}. To the best of our knowledge, this is the first time that a constant-time algorithm is proposed for AHE and CLAHE. In contrast to commonly used fast implementations, our method computes the exact result for each pixel without interpolation artifacts. We benchmark and compare our method to existing algorithms. Our experiments show that our method exhibits superior execution times independent of the filter mask size, which makes AHE and CLAHE fast enough to be usable in real-world applications.

Tiling and PCA Strategy for Clustering-Based High-Dimensional Gaussian Filtering

Edge-preserving filtering is an essential tool for image processing applications and has various types of filtering. High-dimensional Gaussian filtering (HDGF) supports a wide range of edge-preserving filtering. This paper approximates HDGF by clustering with Nyström approximation, tiling, and principal component analysis (PCA) to accelerate HDGF. Also, we compare it with the conventional HDGF approximations and clarify its effective range. We accelerate HDGF by clustering-based constant-time algorithm, which has O(K) order for convolution, where K is the number of clusters. First, we perform PCA for dimensionality reduction and then cluster signals with k-means++. HDGF is decomposed to Gaussian filtering by approximate eigenvalue decomposition of Nyström approximation using the clusters. The Gaussian filtering is performed in a constant-time algorithm. The process is further accelerated by the tiling strategy cooperating with PCA. In our experimental results, we compared three approximated HDGFs: clustering-based HDGF, permutohedral lattice, and Gaussian KD-tree. Also, we evaluated six types of high dimensional signals: RGB, RGB-IR, RGB-D, flash/no-flash, hyperspectral image, and non-local means. The proposed clustering-based HDGF was effective for low/middle-dimensional cases: RGB, RGB-IR, RGB-D, flash/no-flash, and hyperspectral images. Also, tiling with PCA strategy is effective for the conventional permutohedral lattice and Gaussian KD-tree. In the approximation of HDGF, the clustering-based HDGF is the better solution for low/middle-dimensional signals. For the higher-dimensional case of non-local means filtering, the conventional HDGF of the permutohedral lattice with the proposed PCA tiling is effective. Our code and dataset are available at https://norishigefukushima.github.io/TilingPCA4CHDGF/.

On the Parallel Parameterized Complexity of MaxSAT Variants

In the maximum satisfiability problem (max-sat) we are given a propositional formula in conjunctive normal form and have to find an assignment that satisfies as many clauses as possible. We study the parallel parameterized complexity of various versions of max-sat and provide the first constant-time algorithms parameterized either by the solution size or by the allowed excess relative to some guarantee. For the dual parameterized version where the parameter is the number of clauses we are allowed to leave unsatisfied, we present the first parallel algorithm for max-2sat (known as almost-2sat). The difficulty in solving almost-2sat in parallel comes from the fact that the iterative compression method, originally developed to prove that the problem is fixed-parameter tractable at all, is inherently sequential. We observe that a graph flow whose value is a parameter can be computed in parallel and develop a parallel algorithm for the vertex cover problem parameterized above the size of a given matching. Finally, we study the parallel complexity of max-sat parameterized by the vertex cover number, the treedepth, the feedback vertex set number, and the treewidth of the input’s incidence graph. While max-sat is fixedparameter tractable for all of these parameters, we show that they allow different degrees of possible parallelization. For all four we develop dedicated parallel algorithms that are constructive, meaning that they output an optimal assignment – in contrast to results that can be obtained by parallel meta-theorems, which often only solve the decision version.

Efficient Hardware Implementation of Elliptic-Curve Diffie–Hellman Ephemeral on Curve25519

Hardware architecture optimized for implementing the elliptic-curve Diffie–Hellman ephemeral (ECDHE) on 256-bit Montgomery elliptic curves presents unique challenges, particularly for resource-constrained IoT and mobile devices. This work aims to provide an efficient hardware implementation of ECDHE on Curve25519, including a dedicated finite state machine (FSM) designed to handle point multiplication and ECDHE operations, utilizing constant-time algorithms and a unified memory block for resource management. Additionally, we introduce an optimized modular computation unit that covers modular addition, subtraction, multiplication, and inversion. Our proposed hardware architecture enhances the efficiency of ECDHE operations while maintaining low resource utilization, considerably reduced latency, and low power consumption. Synthesized on the Xilinx Artix-7 platform, our design boasts 64,000 Slices and a clock speed of 102 MHz, and it computes an ECDHE scalar multiplication operation in 1.1 ms, consuming 117 mW. The proposed hardware design can be applied to various platforms, including mobile devices and IoT systems.

Loopless algorithms to generate maximum length gray cycles wrt. k-character substitutions

Given a binary word relation τ onto A⁎ and a finite language X⊆A⁎, a τ-Gray cycle over X consists in a permutation (w[i])0≤i≤|X|−1 of X such that each word w[i] is an image under τ of the previous word w[i−1]. We define the complexity measure λA,τ(n), equal to the largest cardinality of a language X having words of length at most n, and st. some τ-Gray cycle over X exists. The present paper is concerned with τ=σk, the so-called k-character substitution, st. (u,v)∈σk holds if, and only if, the Hamming distance of u and v is k. We present loopless (resp., constant amortized time) algorithms for computing specific maximum length σk-Gray cycles.

Exploiting the microarchitectural leakage of prefetching activities for side-channel attacks

Microarchitectural optimizations are designed to maximize CPU usage from all aspects of instruction execution. While they effectively shorten the overall timing of execution by executing instructions or load data speculatively, observable traces, which can be used to infer sensitive information about programs on the fly, are left behind. The Instruction Pointer (IP) based stride prefetcher is implemented by Intel since Sandy Bridge, which uses sequential load history to determine whether to fetch additional lines in advance. Shin et al. (2018) discovered that lines near the lookup table are prefetched by the IP-based stride prefetcher, and they conducted side-channel attack on ECDH in face of constant-time algorithm. Their exploitation of prefetching leakage leverage secret bits which directly relate to prefetching themselves, hence such attacks cannot be applied to algorithms without bit-dependent control/data flow, e.g., AES. @We believe the potential of prefetching leakage is not fully explored as many details of prefetcher implementation are unrevealed. Understanding how the prefetching works will help us to construct more powerful attacks. Motivated by this, we reverse-engineer three prefetching rules of IP-based stride prefetcher. A novel side-channel attack to recover the secret key of AES-128 is proposed to exemplify the exploitation, in which 3 or 4 consecutive bytes of the secret key are inferred according to observed prefetching activities combined with our concluded rules. Other unknown bytes can be complemented one at a time iteratively with our complement method. Besides, we verify that little interference is introduced by delaying the probing phase. In that case, it is rather reasonable and practical to schedule probing after the entire encryption is completed, instead of the first round where attackers need to interrupt the execution of encryption. Based on the inference, our side-channel attack successfully recovered all bytes of the secret key of AES-128. The microarchitectural leakage of prefetching activities is proved to contribute in terms of direct sensitive information recovery when detailed prefetching mechanisms are offered.

Calculating the Segmented Helix Formed by Repetitions of Identical Subunits thereby Generating a Zoo of Platonic Helices

Eric Lord has observed: “In nature, helical structures arise when identical structural subunits combine sequentially, the orientational and translational relation between each unit and its predecessor remaining constant.” This paper proves Lord’s observation. Constant-time algorithms are given for the segmented helix generated from the intrinsic properties of a stacked object and its conjoining rule. Standard results from screw theory and previous work are combined with corollaries of Lord’s observation to allow calculations of segmented helices from either transformation matrices or four known consecutive points. The construction of these from the intrinsic properties of the rule for conjoining repeated subunits of arbitrary shape is provided, allowing the complete parameters describing the unique segmented helix generated by arbitrary stackings to be easily calculated. Free/Libre open-source interactive software and a website which performs this computation for arbitrary prisms along with interactive 3D visualization is provided. We prove that any subunit can produce a toroid-like helix or a maximally-extended helix, forming a continuous spectrum based on joint-face normal twist. This software, website and paper, taken together, compute, render, and catalog an exhaustive “zoo” of 28 uniquely-shaped platonic helices, such as the Boerdijk–Coxeter tetrahelix and various species of helices formed from dodecahedra.

A constant-time sampling algorithm for binary Gaussian distribution over the integers

Discrete Gaussian sampling over the integers is one of fundamental operations in lattice-based cryptography. The binary Gaussian distribution DZ+,σ2 is a special discrete Gaussian distribution with σ2=1/(2ln⁡2) and μ=0 over the set of non-negative integers Z+, and a sampling algorithm for DZ+,σ2 can be used as the base sampler in a generic algorithm based on rejection sampling for any discrete Gaussian distribution over the integers. We present a constant-time algorithm for sampling from the binary Gaussian distribution DZ+,σ2. It requires no precomputation storage and mainly relies on bitwise operations, which could be more hardware-friendly. Its computational complexity is lower than that of the algorithm based on the full-tree Knuth-Yao method, and its entropy consumption is smaller than that of the full-table access algorithm based on a cumulative distribution table. The Rényi-divergence based security analysis of our constant-time algorithm can also be simplified.

How separable median filters can get better results than full 2D versions

The well-known method of median filtering is used both in a wide range of application frameworks and as a standalone filter. Small-window median filters can highly reduce the power of salt and pepper or additive Gaussian noise and minimize edge blurring. Large-window filters are also used, for example to estimate the background of images. Currently, the window size should not be an issue as a constant time algorithm and several implementations, including GPU-based codes, have been proposed in recent years. Unfortunately, none of these constant time implementations manage to fully exploit the capabilities of modern GPUs, and thus the throughputs of large-window median filters remain far below the peak throughputs allowed by recent GPU models. This paper aims at showing that a separable approximation of a 2D median filtering is often stronger than its full 2D implementation. Statistical and theoretical analysis are conducted to show and explain this fact which had so far remained unobserved. It is confirmed by experimentations on a dataset composed of 10,000 images, corrupted by different levels of salt and pepper noise. Separable and full 2D median filter algorithms are compared with several metrics, notably PSNR and MSSIM. In addition, a GPU implementation of 2D separable median filters is also proposed. This implementation is able to output up to 125 billion pixels per second on a recent Volta V100, which significantly outperforms existing implementations like Nvidia’s NPP library or Green’s code, resulting in the fastest median filtering solution to date.

Faster multiplication over $${\mathbb {F}}_2[X]$$ using AVX512 instruction set and VPCLMULQDQ instruction

Code-based cryptography is one of the main propositions for the post-quantum cryptographic context, and several protocols of this kind have been submitted on the NIST platform. Among them, BIKE and HQC are part of the five alternate candidates selected in the third round of the NIST standardization process in the KEM category. These two schemes make use of multiplication of large polynomials over binary rings, and due to the polynomial size (from 10,000 to 60,000 bits), this operation is one of the costliest during key generation, encapsulation, or decapsulation mechanisms. In BIKE-2, there is also a polynomial inversion which is time-consuming and this problem has been addressed in Drucker (Fast polynomial inversion for post quantum QC-MDPC cryptography, 2020). In this work, we revisit the different existing constant-time algorithms for arbitrary polynomial multiplication. We explore the different Karatsuba and Toom–Cook constructions in order to determine the best combinations for each polynomial degree range, in the context of AVX2 and AVX512 instruction sets. This leads to different kernels and constructions in each case. In particular, in the context of AVX512, we use the VPCLMULQDQ instruction, which is a vectorized binary polynomial multiplication instruction. This instruction deals with up to four polynomial (of degree up to 63) multiplications, that is four operand pairs of 64-bit words with 128-bit word storing each result, the four results being stored in one single 512-bit word. This allows to divide by roughly 3 the retired instruction number of the operation in comparison with the AVX2 instruction set implementations, while the speedup is up to 39% in terms of processor clock cycles. These results are different than the ones estimated in Drucker (Fast multiplication of binary polynomials with the forthcoming vectorized vpclmulqdq instruction, 2018). To illustrate the benefit of the new VPCLMULQDQ instruction, we used the HQC code to evaluate our approaches. When implemented in the HQC protocol, for the security levels 128, 192, and 256, our approaches provide up to 12% speedup, for key pair generation.

Edges in Fibonacci Cubes, Lucas Cubes and Complements

The Fibonacci cube of dimension n, denoted as \(\Gamma _n\), is the subgraph of the hypercube induced by vertices with no consecutive 1s. The Lucas cube \(\Lambda _n\) is the cyclic version of \(\Gamma _n\). The irregularity of a graph G is the sum of \(|d(x)-d(y)|\) over all edges \(\{x,y\}\) of G. In two recent papers based on the recursive structure of \(\Gamma _n\), it is proved that the irregularity of \(\Gamma _n\) and \(\Lambda _n\) is two times the number of edges of \(\Gamma _{n-1}\) and 2n times the number of vertices of \(\Gamma _{n-4}\), respectively. Using an interpretation of the irregularity in terms of couples of incident edges of a special kind, we give a bijective proof of both results. For these two graphs, we deduce also a constant time algorithm for computing the imbalance of an edge. In the last section using the same approach, we determine the number of edges and the sequence of degrees of the cube complement of \(\Gamma _n\).

LIGA: a cryptosystem based on the hardness of rank-metric list and interleaved decoding

We propose the new rank-metric code-based cryptosystem LIGA which is based on the hardness of list decoding and interleaved decoding of Gabidulin codes. LIGA is an improved variant of the Faure–Loidreau (FL) system, which was broken in a structural attack by Gaborit, Otmani, and Talé Kalachi (GOT, 2018). We keep the FL encryption and decryption algorithms, but modify the insecure key generation algorithm. Our crucial observation is that the GOT attack is equivalent to decoding an interleaved Gabidulin code. The new key generation algorithm constructs public keys for which all polynomial-time interleaved decoders fail—hence LIGA resists the GOT attack. We also prove that the public-key encryption version of LIGA is IND-CPA secure in the standard model and the key encapsulation mechanisms version is IND-CCA2 secure in the random oracle model, both under hardness assumptions of formally defined problems related to list decoding and interleaved decoding of Gabidulin codes. We propose and analyze various exponential-time attacks on these problems, calculate their work factors, and compare the resulting parameters to NIST proposals. The strengths of LIGA are short ciphertext sizes and (relatively) small key sizes. Further, LIGA guarantees correct decryption and has no decryption failure rate. It is not based on hiding the structure of a code. Since there are efficient and constant-time algorithms for encoding and decoding Gabidulin codes, timing attacks on the encryption and decryption algorithms can be easily prevented.

A practicable timing attack against HQC and its countermeasure

<p style='text-indent:20px;'>In this paper, we present a practicable chosen ciphertext timing attack retrieving the secret key of HQC. The attack exploits a correlation between the weight of the error to be decoded and the running time of the decoding algorithm of BCH codes. For the 128-bit security parameters of HQC, the attack runs in less than a minute on a desktop computer using roughly 6000 decoding requests and has a success probability of approximately 93 percent. To prevent this attack, we provide an implementation of a constant time algorithm for the decoding of BCH codes. Our implementation of the countermeasure achieves a constant time execution of the decoding process without a significant performance penalty.</p>

A Constant-Time Algorithm of CSIDH Keeping Two Points

A Constant-Time Algorithm of CSIDH Keeping Two Points

Comparison of Three CPU-Core Families for IoT Applications in Terms of Security and Performance of AES-GCM

This article describes the implementation of the AES-GCM for IoT-oriented low-end 8/16/32-bit general-purpose processors. Although various aspects of implementations of the AES-GCM for high-end processors and hardware were examined in detail, the low-end processors to a lesser extent. This article estimates the speed and memory demand for various approaches to ensuring resistance to attacks, such as timing analysis and simple power analysis by ensuring the constant algorithm execution time. A particular attention is paid to the low-level multiplication implementation in GF (2128) for each architecture as a key galois/counter mode operation, because low-end processors do not have ready-made instructions for carry-less multiplication. For each AVR/MSP430/ARM Cortex-M3 processor core, a constant time implementation of carry-less multiplication is proposed, the performance of which approaches the Not Constant Time algorithm.

A Constant-Time Algorithm for Middle Levels Gray Codes

For any integer $$n\ge 1$$, a middle levels Gray code is a cyclic listing of all n-element and $$(n+1)$$-element subsets of $$\{1,2,\ldots ,2n+1\}$$ such that any two consecutive sets differ in adding or removing a single element. The question whether such a Gray code exists for any $$n\ge 1$$ has been the subject of intensive research during the last 30 years, and has been answered affirmatively only recently [T. Mutze. Proof of the middle levels conjecture. Proc. London Math. Soc., 112(4):677–713, 2016]. In a follow-up paper [T. Mutze and J. Nummenpalo. An efficient algorithm for computing a middle levels Gray code. ACM Trans. Algorithms, 14(2):29 pp., 2018] this existence proof was turned into an algorithm that computes each new set in the Gray code in time $${{\mathcal {O}}}(n)$$ on average. In this work we present an algorithm for computing a middle levels Gray code in optimal time and space: each new set is generated in time $${{\mathcal {O}}}(1)$$ on average, and the required space is $${{\mathcal {O}}}(n)$$.

What Graph Properties Are Constant-Time Testable?

In this paper, we survey what graph properties have been found to be constant-time testable at present. How to handle big data is a very important issue in computer science. Developing efficient algorithms for problems on big data is an urgent task. For this purpose, constant-time algorithms are powerful tools, since they run by reading only a constant-sized part of each input. In other words, the running time is invariant regardless of the size of the input. The idea of constant-time algorithms appeared in the 1990s and spread quickly especially in this century. Research on graph algorithms is one of the best studied areas in theoretical computer science. When we study constant-time algorithms on graphs, we have three models that differ in the way that the graphs are represented: the dense-graph model, the bounded-degree model, and the general model. The first one is used to treat properties on dense graphs, and the other two are used to treat properties on sparse graphs. In this paper, we survey one by one what properties have been found to be constant-time testable in each of the three models.

Adaptive Large Neighborhood Search with a Constant-Time Feasibility Test for the Dial-a-Ride Problem

In the dial-a-ride problem, user-specified transport requests from origin to destination points have to be served by a fleet of homogeneous vehicles. The problem variant we consider aims at finding a set of minimum-cost routes satisfying constraints on vehicle capacity, time windows, maximum route duration, and maximum user ride times. We propose an adaptive large neighborhood search (ALNS) for its solution. The key novelty of the approach is an exact amortized constant-time algorithm for evaluating the feasibility of request insertions in the repair steps of the ALNS. In addition, we use two optional improvement techniques: a local-search-based intraroute improvement of routes of promising solutions using the Balas–Simonetti neighborhood and the solution of a set covering model over a subset of all routes generated during the search. With these techniques, the proposed algorithm outperforms the state-of-the-art methods in terms of solution quality. New best solutions are found for several benchmark instances. The online appendix is available at https://doi.org/10.1287/trsc.2018.0837 .

A new constant-time parallel algorithm for merging

Merging is the process of constructing a sorted array C from two sorted arrays A and B of lengths $$n_A$$ and $$n_B,$$ respectively, such that array C contains the elements of arrays A and B. The problem is a fundamental subroutine in many applications such as tree reconstruction, database design, and sorting. In this paper, we present a constant-time integer merging algorithm on a shared memory model with a concurrent read operation. No constant-time algorithm for integer merging on this model was designed previously. The algorithm, which is based on cross-rank and address strategy, works when the elements of the inputs belong to the integer domain. The presented algorithm has the following advantages:- (1) running in constant time; (2) stable; (3) simple; (4) optimal when the domain of integers is less than or equal to the size of the inputs and the number of processors is equal to size of the inputs; and (5) deterministic.

Fast flow volume estimation

The increasing popularity of jumbo frames means growing variance in the size of packets transmitted in modern networks. Consequently, network monitoring tools must maintain explicit traffic volume statistics rather than settle for packet counting as before. We present constant time algorithms for volume estimations in streams and sliding windows, which are faster than previous work. Our solutions are formally analyzed and are extensively evaluated over multiple real-world packet traces as well as synthetic ones. For streams, we demonstrate a run-time improvement of up to 2.4X compared to the state of the art. On sliding windows, we exhibit a memory reduction of over 100X on all traces and an asymptotic runtime improvement to a constant. Finally, we apply our approach to hierarchical heavy hitters and achieve an empirical 2.4-7X speedup.