Decoding Failure Rate Research Articles

On Accuracy of Testing Decryption Failure Rate for Encryption Schemes under the LWE Assumption

Lattice-based encryption schemes are significant cryptographic primitives to defend information security against quantum menace, and the decryption failure rate is related to both theoretical and realistic security. We quantitatively analyze how the floating-point arithmetic and neglecting small probabilities impact the precision, and propose a new effective and efficient test of the failure probability. Therein explicit criteria are given to select the floating-point datatype and to decide which small probabilities should be abandoned. Furthermore, the outcome is theoretically ensured to meet a given precision. Moreover, by combining the heuristic estimate and the precise simulation, this test is more efficient than previously neglecting small probabilities in a practical way.

Fast computation of cyclic convolutions and their applications in code-based asymmetric encryption schemes

The development of fast algorithms for key generation, encryption and decryption not only increases the efficiency of related operations. Such fast algorithms, for example, for asymmetric cryptosystems on quasi-cyclic codes, make it possible to experimentally study the dependence of decoding failure rate on code parameters for small security levels and to extrapolate these results to large values of security levels. In this article, we explore efficient cyclic convolution algorithms, specifically designed, among other things, for use in encoding and decoding algorithms for quasi-cyclic LDPC and MDPC codes. Corresponding convolutions operate on binary vectors, which can be either sparse or dense. The proposed algorithms achieve high speed by compactly storing sparse vectors, using hardware-supported XOR instructions, and replacing modulo operations with specialized loop transformations. These fast algorithms have potential applications not only in cryptography, but also in other areas where convolutions are used.

Polar Codes for Module-LWE Public Key Encryption: The Case of Kyber

In modern society, the Internet is one of the most used means of communication. Thus, secure information transfer is inevitably of major importance. Computers nowadays use encryption methods based on arithmetic operations to turn messages into ciphertexts that are practically impossible for an attacker to reverse-engineer using a classical computer. Lately, it has been proven that this is possible in a post-quantum setting where quantum computers of considerable size are available to attackers. With the advance of technology of quantum computers, it is now more necessary than ever before to construct encryption schemes that cannot be broken either using a classical or a quantum computer. The National Institute of Technology and Standards (NIST) has orchestrated a competition, and numerous encryption schemes have been proposed. The NIST has identified one algorithm to be standardized for the post-quantum era. This algorithm is called CRYSTALS-Kyber and is based on module learning with errors (MLWE). This paper investigates how to apply error correcting codes in order to create some excess decryption failure rate (DFR) and to take advantage of that in order to re-tune Kyber’s parameters in the pursuit of higher security. By applying Polar Codes, Kyber’s security was managed to be increased by 54.4% under a new set of parameters, while keeping the decryption failure rate well below the upper acceptable bound set by the NIST.

Information- and Coding-Theoretic Analysis of the RLWE/MLWE Channel

Several cryptosystems based on the Ring Learning with Errors (RLWE) problem have been proposed within the NIST post-quantum cryptography standardization process, e.g., NewHope. Furthermore, there are systems like Kyber which are based on the closely related MLWE assumption. Both previously mentioned schemes result in a non-zero decryption failure rate (DFR). The combination of encryption and decryption for these kinds of algorithms can be interpreted as data transmission over a noisy channel. To the best of our knowledge this paper is the first work that analyzes the capacity of this channel. We show how to modify the encryption schemes such that the input alphabets of the corresponding channels are increased. In particular, we present lower bounds on their capacities which show that the transmission rate can be significantly increased compared to standard proposals in the literature. Furthermore, under the common assumption of stochastically independent coefficient failures, we give lower bounds on achievable rates based on both the Gilbert-Varshamov bound and concrete code constructions using BCH codes. By means of our constructions, we can either increase the total bitrate (by a factor of 1.84 for Kyber and by factor of 7 for NewHope) while guaranteeing the same DFR or for the same bitrate, we can significantly reduce the DFR for all schemes considered in this work (e.g., for NewHope from 2−216 to 2−12769).

Polar coding for Ring-LWE-based public key encryption

The ring learning with errors (RLWE) problem can be used to construct efficient post-quantum public key encryption schemes. An error distribution, normally a Gaussian-like distribution, is involved in the RLWE problem. In this work we focus on using polar codes to alleviate a natural trade-off present in RLWE public key encryption schemes; namely, we would like a wider error distribution to increase security, but a wider error distribution comes at the cost of an increased probability of decryption error. The motivation of this work is to improve the bit-security level by using wider error distribution while keeping the target decryption failure rate achievable. The approach we proposed in this work is twofold. Firstly, we formulate RLWE public key encryption as a channel model with some noise terms known by the decoder. This makes our approach distinguished from existing research of this kind in the literature which ignores these known terms. Secondly, we design polar codes for the derived channel model. Theoretically and numerically, we show the proposed modeling and polar coding scheme contributes to a considerable bit-security level improvement compared with NewHope, a submission to National Institute of Standards and Technology (NIST), with almost the same parameters. Moreover, polar encoding and decoding support isochronous implementations in the sense that the timings of associated operations are irrelevant to the sensitive information.

Improving reliability using phase distribution aware LDPC code for holographic data storage.

The iterative Fourier transform (IFT) algorithm is an effective solution for phase retrieval in phase-type holographic data storage systems, but introduces a higher phase error rate. As a result, data reliability becomes a significant issue. In this paper, to improve reliability and decrease decoding latency, we propose a phase distribution aware low-density parity-check (LDPC) code [called point data abstraction library (PDAL)] with outstanding error correcting capability. After experiencing IFT, we first investigate the phase distribution characteristics and find that the adjacent phase distribution is more likely to cross, resulting in higher phase shift percentages. Then, using phase distribution, PDAL optimizes LDPC codes with higher precision decoding information by dynamically applying the phase threshold based on the phase error rate. When the phase error rate is 0.04, the bit error rate, decoding iteration times, and decoding failure rate are all reduced by 51.5%, 26.9%, and 51.8% on average, respectively, compared with traditional LDPC code without exploiting phase distribution. PDAL, which is an efficient and practical error correction approach for phase-modulated holographic data storage, can improve data reliability by boosting error correction performance.

How to Construct Polar Codes for Ring-LWE-Based Public Key Encryption.

There exists a natural trade-off in public key encryption (PKE) schemes based on ring learning with errors (RLWE), namely: we would like a wider error distribution to increase the security, but it comes at the cost of an increased decryption failure rate (DFR). A straightforward solution to this problem is the error-correcting code, which is commonly used in communication systems and already appears in some RLWE-based proposals. However, applying error-correcting codes to those cryptographic schemes is far from simply installing an add-on. Firstly, the residue error term derived by decryption has correlated coefficients, whereas most prevalent error-correcting codes with remarkable error tolerance assume the channel noise to be independent and memoryless. This explains why only simple error-correcting methods are used in existing RLWE-based PKE schemes. Secondly, the residue error term has correlated coefficients leaving accurate DFR estimation challenging even for uncoded plaintext. It can be found in the literature that a tighter DFR estimation can effectively create a DFR margin. Thirdly, most error-correcting codes are not well designed for safety considerations, e.g., syndrome decoding has a nonconstant time nature. A code good at error correcting might be weak under a variety of attacks. In this work, we propose a polar coding scheme for RLWE-based PKE. A relaxed “independence” assumption is used to derive an uncorrelated residue noise term, and a wireless communication strategy, outage, is used to construct polar codes. Furthermore, some knowledge about the residue noise is exploited to improve the decoding performance. With the parameterization of NewHope Round 2, the proposed scheme creates a considerable DRF margin, which gives a competitive security improvement compared to state-of-the-art benchmarks. Specifically, the security is improved by , while a DFR of is achieved a for code rate pf 0.25, 12,289, and binomial parameter . Moreover, polar encoding and decoding have a quasilinear complexity and intrinsically support constant-time implementations.

CPA/CCA2-secure PKE with squared-exponential DFR from low-noise LPN

LPN (learning parity with noise) problem is a good candidate for post-quantum cryptography which enjoys simplicity and suitability for weak-power devices. Döttling et al. (ASIACRYPT 2012) initiated the first secure public key encryption (PKE) under the low-noise LPN assumption. Kiltz et al. (PKC 2014) proposed a simpler and more efficient scheme using double-trapdoor technique from the same assumption. Both schemes abide the decoding failure rate (DFR) 2−Θ(k) (k is the security parameter) and there exists CPA/CCA2-secure PKE with squared-exponential DFR 2−Θ(k2) from constant-noise LPN (Yu and Zhang, CRYPTO 2016). In this work, we give a positive answer with squared-exponential DFR in the low-noise setting.More precisely, we first introduce a variant (VxLPN) of the low-noise Exact LPN (xLPN, proposed by Jain et al. at ASIACRYPT 2012 and used as building block in commitments and zero-knowledge proofs), where the coefficient matrix A follows the uniform distribution over {0,1}q×n (n=Θ(k2),q=Θ(n)), the secret x is sampled from Bμn (Bμ is the Bernoulli distribution with noise rate μ=Θ(1q)), and the noise e follows a column vector distribution uniform over {z∈{0,1}q:|z|=qμ}. A series of reductions show that VxLPN is at least as hard as the standard LPN for the same noise rate μ. We then construct from the VxLPN CPA/CCA2 secure PKE schemes with squared-exponential DFR 2−Θ(k2) which share the common structure extrinsically with Kiltz et al. and Yu-Zhang schemes. The secret key(s) in our schemes are simply sampled from the Bernoulli distribution, and comparatively, the secret key(s) in Yu-Zhang schemes must be chosen from a tailored version of Bernoulli distribution (along with the coefficient matrix A that follows a distribution Dλn×n=Un×λ⋅Uλ×n induced by multiplying two random matrices in the public key, λ=Θ(log2⁡n)) in order to guarantee the correctness of their schemes. Consider the performance on 128-bit security level, our CCA2-secure scheme only holds 117.79 MB public keys, 67.31 MB secret keys and 10.15 KB ciphertexts, and thus is more efficient than the schemes of Döttling et al. and Kiltz et al. ((14.53 GB, 14.48 GB, 14.06 KB) and (161.78 MB, 92.45 MB, 13.60 KB) respectively).

On the applicability of the Fujisaki–Okamoto transformation to the BIKE KEM

The QC-MDPC code-based KEM BIKE is one of the Round-3 candidates of the NIST PQC standardization project. Its Round-2 specification document described variants claiming to have IND-CCA security. The security proof used the Fujisaki–Okamoto transformation and a decoder targeting a Decoding Failure Rate (DFR) of (for Level-1 security). However, several aspects needed to be amended in order for the IND-CCA proof to hold. The main issue is that using a decoder with DFR of does not necessarily imply that the underlying PKE is δ-correct with , as required. In this paper, we handle the necessary aspects to ensure the security claim is correct. In particular, we close the gap in the proof by defining the notion of message-agnostic PKE. We show that the PKEs underlying the BIKE versions are message-agnostic. This implies that BIKE with a decoder that has a sufficiently low DFR is also an IND-CCA KEM.

LIGA: a cryptosystem based on the hardness of rank-metric list and interleaved decoding

We propose the new rank-metric code-based cryptosystem LIGA which is based on the hardness of list decoding and interleaved decoding of Gabidulin codes. LIGA is an improved variant of the Faure–Loidreau (FL) system, which was broken in a structural attack by Gaborit, Otmani, and Talé Kalachi (GOT, 2018). We keep the FL encryption and decryption algorithms, but modify the insecure key generation algorithm. Our crucial observation is that the GOT attack is equivalent to decoding an interleaved Gabidulin code. The new key generation algorithm constructs public keys for which all polynomial-time interleaved decoders fail—hence LIGA resists the GOT attack. We also prove that the public-key encryption version of LIGA is IND-CPA secure in the standard model and the key encapsulation mechanisms version is IND-CCA2 secure in the random oracle model, both under hardness assumptions of formally defined problems related to list decoding and interleaved decoding of Gabidulin codes. We propose and analyze various exponential-time attacks on these problems, calculate their work factors, and compare the resulting parameters to NIST proposals. The strengths of LIGA are short ciphertext sizes and (relatively) small key sizes. Further, LIGA guarantees correct decryption and has no decryption failure rate. It is not based on hiding the structure of a code. Since there are efficient and constant-time algorithms for encoding and decoding Gabidulin codes, timing attacks on the encryption and decryption algorithms can be easily prevented.

Analysis of Error Dependencies on Newhope

Among many submissions to the NIST post-quantum cryptography (PQC) project, NewHope is a promising key encapsulation mechanism (KEM) based on the Ring-Learning with errors (Ring-LWE) problem. Since NewHope is an indistinguishability (IND)-chosen ciphertext attack secure KEM by applying the Fujisaki-Okamoto transform to an IND-chosen plaintext attack secure public key encryption, accurate calculation of decryption failure rate (DFR) is required to guarantee resilience against attacks that exploit decryption failures. However, the current upper bound of DFR on NewHope is rather loose because the compression noise, the effect of encoding/decoding of NewHope, and the approximation effect of centered binomial distribution are not fully considered. Furthermore, since NewHope is a Ring-LWE based cryptosystem, there is a problem of error dependency among error coefficients, which makes accurate DFR calculation difficult. In this paper, we derive much tighter upper bound on DFR than the current upper bound using constraint relaxation and union bound. Especially, the above-mentioned factors are all considered in derivation of new upper bound and the centered binomial distribution is not approximated to subgaussian distribution. In addition, since the error dependency is considered, the new upper bound is much closer to the real DFR than the previous upper bound. Furthermore, the new upper bound is parameterized by using Chernoff-Cramer bound in order to facilitate calculation of new upper bound for the parameters of NewHope. Since the new upper bound is much lower than the DFR requirement of PQC, this DFR margin is used to improve the security and bandwidth efficiency of NewHope. As a result, the security level of NewHope is improved by 7.2 % or bandwidth efficiency is improved by 5.9 %.

QC-LDPC construction free of small size elementary trapping sets based on multiplicative subgroups of a finite field

Trapping sets significantly influence the performance of low-density parity-check codes. An $ (a, b) $ elementary trapping set (ETS) causes high decoding failure rate and exert a strong influence on the error floor of the code, where $ a $ and $ b $ denote the size and the number of unsatisfied check-nodes in the ETS, respectively. The smallest size of an ETS in $ (3, n) $-regular LDPC codes with girth 6 is 4. In this paper, we provide sufficient conditions to construct fully connected $ (3, n) $-regular algebraic-based QC-LDPC codes with girth 6 whose Tanner graphs are free of $ (a, b) $ ETSs with $ a\leq5 $ and $ b\leq2 $. We apply these sufficient conditions to the exponent matrix of a new algebraic-based QC-LDPC code with girth at least 6. As a result, we obtain the maximum size of a submatrix of the exponent matrix which satisfies the sufficient conditions and yields a Tanner graph free of those ETSs with small size. Some algebraic-based QC-LDPC code constructions with girth 6 in the literature are special cases of our construction. Our experimental results show that removing ETSs with small size contribute to have better performance curves in the error floor region.

PolarRLCE: A New Code-Based Cryptosystem Using Polar Codes

Security challenges brought about by the upcoming 5G era should be taken seriously. Code-based cryptography leverages difficult problems in coding theory and is one of the main techniques enabling cryptographic primitives in the postquantum scenario. In this work, we propose the first efficient secure scheme based on polar codes (i.e., polarRLCE) which is inspired by the RLCE scheme, a candidate for the NIST postquantum cryptography standardization in the first round. In addition to avoiding some weaknesses of the RLCE scheme, we show that, with the proper choice of parameters, using polar codes, it is possible to design an encryption scheme to achieve the intended security level while retaining a reasonably small public key size. In addition, we also present a KEM version of the polarRLCE scheme that can attain a negligible decryption failure rate within the corresponding security parameters. It is shown that our proposal enjoys an apparent advantage to decrease the public key size, especially on the high-security level.

Customizing short-length LT codes with evolution strategies for video streaming protection

Designing short-length Luby Transform (SLLT) codes to best protect video streaming and multicasting over lossy communication remains largely an empirical exercise. In this paper, we present a systematic approach to customize the decoding performance of these codes so that the protected video bitstreams may have the best playback quality over a wide range of channel loss rates. Our approach begins with the proposal of a new SLLT decoding performance model based on three parameters: decoding overhead, symbol decoding failure rate and tail probability of symbol decoding failure rate. We then formulate the design of SLLT codes as a multi-objective optimization problem, specify the design objectives in terms of goal program, and search for the most suitable codes using an augmented weighted Tchebycheff method implemented with the Covariance Matrix Adaptation Evolution Strategy (CMA-ES). Two design examples are provided to illustrate the effectiveness of our approach: (1) an SLLT post-code of a short-length raptor code that provides erasure protection to H.264 AVC bitstreams, and (2) an SLLT post-code of a rateless UEP code that supports graceful degradation of H.264 SVC playback quality. Empirical results demonstrate that the proposed method is capable of producing SLLT codes with customized decoding performance, whereas, the customized codes enable the playback pictures to attain significantly higher PSNR values at different stages of the decoding process than the pictures recovered under the protection of conventionally optimized codes.

Overclocking NAND Flash Memory I/O Link in LDPC-Based SSDs

Due to the increasingly significant process variation and gradual Flash memory cell wear-out, the worst-case-oriented error correction code (ECC) in solid-state drives (SSDs) is mostly underutilized throughout the entire lifetime. Error-prone overclocking of Flash memory chip I/O links can trade such ECC underutilization for opportunistically improving SSD speed performance, and its effectiveness strongly depends on how well the ECC decoding can handle the overclocking-induced I/O link errors. As SSDs are quickly adopting low-density parity-check (LDPC) code, this brief concerns LPDC-based overclocked SSDs. Experiments with 20-nm NAND Flash memory chips reveal unique bit error characteristics of the overclocked I/O link, based upon which this brief develops solutions that can leverage the error characteristics to improve LDPC decoding performance. Results show that the developed techniques can reduce LDPC code decoding power consumption by 60% and reduce the decoding failure rate by over two orders of magnitude.

An End-to-End Virtual Path Construction System for Stable Live Video Streaming over Heterogeneous Wireless Networks

In this paper, we propose an effective end-to-end virtual path construction system, which exploits path diversity over heterogeneous wireless networks. The goal of the proposed system is to provide a high quality live video streaming service over heterogeneous wireless networks. First, we propose a packetization-aware fountain code to integrate multiple physical paths efficiently and increase the fountain decoding probability over wireless packet switching networks. Second, we present a simple but effective physical path selection algorithm to maximize the effective video encoding rate while satisfying delay and fountain decoding failure rate constraints. The proposed system is fully implemented in software and examined over real WLAN and HSDPA networks.

A novel approach of limited-randomness fountain codes in deep space communication

Digital fountain is applied into deep space communication for its rateless and non-feedback forward error correction. However, the long code length and encoding overhead are confined factors to guarantee a considerable recovery probability as power and buffer-limited equipment in deep space environment. At the same time, the typical fountain decoding is sub-optimum decoding algorithm. We propose a new approach, Dependent Sequences Compensation Algorithm (DSCA), to improve the encoding efficiency by restricting the randomness in fountain encoding. While decoding algorithm is also optimized by redundant information in stopping set. The results show that the optimized method can obtain a 10−4 decoding failure rate with overhead under 0.20 for code length 500, which indicates the usefulness of the proposed approach in deep space communication.

Error Floor Estimation of Long LDPC Codes on Magnetic Recording Channels

The presence of error floor in low density parity check (LDPC) codes is of great concern for potential applications of LDPC codes to data storage channels, which require the code to maintain the near capacity error correcting performance down to frame error rates of 10-12. In order to investigate the error floor of LDPC codes under magnetic recording channels used in data storage systems, we extended the trapping set based estimation method to predict the error floor under magnetic recording channels. The goal is to accurately estimate the error rates in the error floor region for certain types of LDPC codes under the partial response channel. First, we use field-programmable gate array (FPGA) hardware simulation to find the trapping sets that cause the decoding failure in the error floor region. For each trapping set, we extract the parameters that are key to the decoding failure caused by this trapping set. Then we use a much simpler in situ simulation with these parameters to obtain the conditional decoding failure rate. By considering all the trapping sets, we obtain the overall frame error rate in the error floor region. The estimation results under the magnetic recording channel are within 0.3 dB of the direct simulation results.

An RL-based scheduling algorithm for video traffic in high-rate wireless personal area networks

The emerging high-rate wireless personal area network (WPAN) technology is capable of supporting high-speed and high-quality real-time multimedia applications . In particular, video streams are deemed to be a dominant traffic type, and require quality of service (QoS) support. However, in the current IEEE 802.15.3 standard for MAC (media access control) of high-rate WPANs, the implementation details of some key issues such as scheduling and QoS provisioning have not been addressed. In this paper, we first propose a Markov decision process (MDP) model for optimal scheduling for video flows in high-rate WPANs. Using this model, we also propose a scheduler that incorporates compact state space representation , function approximation, and reinforcement learning (RL). Simulation results show that our proposed RL scheduler achieves nearly optimal performance and performs better than F-SRPT, EDD + SRPT, and PAP scheduling algorithms in terms of a lower decoding failure rate.

An efficient sphere decoding approach for PTS assisted PAPR reduction of OFDM signals

It is well known that one of the main drawbacks of orthogonal frequency division multiplexing (OFDM) is the potentially high peak-to-average power ratio (PAPR) of the (OFDM) signal. Partial transmit sequence (PTS) is a widely accepted method in reducing PAPR of OFDM signal. As traditional optimal PTS (OPTS) technique requires an exhaustive search over all the combinations of the allowed phase factors the search complexity increases exponentially with the number of sub-blocks. In this paper, a new precalculated radius sphere decoding (PRSD) is presented. It can achieve the same PAPR performance but at lower computational complexity compared with OPTS and existing sphere decoding (SD) approach at zero decoding failure rate.