Error Locator Polynomial Research Articles

Efficient ASIC Architecture for Low Latency Classic McEliece Decoding

Post-quantum cryptography addresses the increasing threat that quantum computing poses to modern communication systems. Among the available “quantum-resistant” systems, the Classic McEliece key encapsulation mechanism (KEM) is positioned as a conservative choice with strong security guarantees. Building upon the code-based Niederreiter cryptosystem, this KEM enables high performance encapsulation and decapsulation and is thus ideally suited for applications such as the acceleration of server workloads. However, until now, no ASIC architecture is available for low latency computation of Classic McEliece operations. Therefore, the present work targets the design, implementation and optimization of a tailored ASIC architecture for low latency Classic McEliece decoding. An efficient ASIC design is proposed, which was implemented and manufactured in a 22 nm FDSOI CMOS technology node. We also introduce a novel inversionless architecture for the computation of error-locator polynomials as well as a systolic array for combined syndrome computation and polynomial evaluation. With these approaches, the associated optimized architecture improves the latency of computing error-locator polynomials by 47% and the overall decoding latency by 27% compared to a state-of-the-art reference, while requiring only 25% of the area.

Low-Latency Nested Decoding for Short Generalized Integrated Interleaved BCH Codes

Generalized integrated interleaved (GII) codes nest short BCH sub-codewords to form more powerful BCH codewords. They can potentially achieve hyper-speed decoding with excellent error-correction capability. In particular, short GII-BCH codes are among the best candidates for the new fast storage class memories (SCMs). Miscorrections severely degrade the performance of short GII-BCH codes. Although they were effectively mitigated in previous designs, the involved repeated Chien search and higher-order syndrome computation cause long latency. This brief proposes efficient and low-latency nested decoding schemes for short GII-BCH codes. A strategy is developed to select sub-words for further nested decoding to mitigate miscorrections by keeping track of the error locator polynomials, instead of waiting for the lengthy Chien search. Formulas are also derived to estimate the effects on the error-correcting performance. Besides, a low-complexity linear feedback shift register (LFSR) architecture is developed to accelerate the higher-order nested syndrome computation. For an example GII-BCH code targeting at SCMs, the proposed design reduces the worst-case nested decoding latency by 26% with 8.5% area overhead and negligible performance loss compared to prior methods.

Step-by-Step Decoding of Binary Quasi-Reversible BCH Codes

Binary quasi-reversible BCH codes whose defining set contains consecutive elements from negative to positive integers have received considerable attention in recent years due to their efficient decoding suitable for a wide range of applications. This paper combines the concept of the weight and quasi-reversible structures to introduce two subclasses of BCH codes: odd-like/even-like quasi-reversible BCH codes. The step-by-step decoding of these codes is developed as follows: First, the weight evaluation of a received polynomial is able to judge whether the number of errors is odd or even, which helps to simplify the decoding processes. Second, based on Chiò’s pivotal condensation process which can be easily implemented in a parallel computing architecture, the determinant calculation of the band matrix instead of Peterson’s matrix in column-echelon form is faster. Third, a newly proposed non-monic error-locator polynomial is sparser than the conventional ones. As a consequence, the theoretical analysis and experimental results validate potential benefits in requiring fewer finite field additions and multiplications used in the decoding of binary odd-like/even-like quasi-reversible BCH codes up to half the minimum distance when compared with the narrow-sense BCH codes with small error-correcting capability.

A Key-Recovery Side-Channel Attack on Classic McEliece Implementations

In this paper, we propose the first key-recovery side-channel attack on Classic McEliece, a KEM finalist in the NIST Post-quantum Cryptography Standardization Project. Our novel idea is to design an attack algorithm where we submit special ciphertexts to the decryption oracle that correspond to cases of single errors. Decoding of such ciphertexts involves only a single entry in a large secret permutation, which is part of the secret key. Through an identified leakage in the additive FFT step used to evaluate the error locator polynomial, a single entry of the secret permutation can be determined. Iterating this for other entries leads to full secret key recovery. The attack is described using power analysis both on the FPGA reference implementation and a software implementation running on an ARM Cortex-M4. We use a machine-learning-based classification algorithm to determine the error locator polynomial from a single trace. The attack is fully implemented and evaluated in the Chipwhisperer framework and is successful in practice. For the smallest parameter set, it is using about 300 traces for partial key recovery and less than 800 traces for full key recovery, in the FPGA case. A similar number of traces are required for a successful attack on the ARM software implementation.

On Decoding Binary Quasi-Reversible BCH Codes

For the recently developed quasi-reversible BCH codes with long lengths and high error-correcting capability, this paper is aimed at proposing a new and faster decoding procedure. It consists of four steps: 1) compute the consecutive syndromes; 2) calculate the syndrome functions by the forward and backward recursions; 3) solve a linear subsystem together with one matrix multiplication in order to find an error-locator polynomial; 4) determine the errors from the obtained polynomial by using the root-finding algorithm. This procedure, especially in Steps 2 and 3, differs greatly from the conventional procedures, which determine an error-locator polynomial directly from solving a linear system with the aid of the consecutive syndromes. The key idea behind this decoding technique is that the computational complexity of such a small subsystem instead of an originally large linear system can be significantly reduced, although there are additional forward and backward syndrome calculations with low complexity increasing. Finally, the illustrative examples and numerical simulations can be helpful to demonstrate the accuracy and efficacy of the presented decoding technique at different error-correcting capabilities.

Design, optimization and Real Time implementation of a new Embedded Chien Search Block for Reed-Solomon (RS) and Bose-Chaudhuri-Hocquenghem (BCH) codes on FPGA Board

The development of error correcting codes has been a major concern for communications systems. Therefore, RS and BCH (Reed-Solomon and Bose, Ray-Chaudhuri and Hocquenghem) are effective methods to improve the quality of digital transmission. In this paper a new algorithm of Chien Search block for embedded systems is proposed. This algorithm is based on a factorization of error locator polynomial. i.e, we can minimize an important number of logic gates and hardware resources using the FPGA card. Consequently, it reduces the power consumption with a percentage which can reach 40 % compared to the basic RS and BCH decoder. The proposed system is designed, simulated using the hardware description language (HDL) and Quartus development software. Also, the performance of the designed embedded Chien search block for decoder RS\BCH (255, 239) has been successfully verified by implementation on FPGA board.

Miscorrection Mitigation for Generalized Integrated Interleaved BCH Codes

The generalized integrated interleaved (GII) codes nest BCH sub-codewords to form codewords of more powerful BCH codes. They can achieve hyper-throughput decoding with excellent error-correcting performance and are among the most suitable codes for next-generation memories. However, the new storage class memories require high code rate and short codeword length. In this case, the sub-codewords have small correction capability. The miscorrections of the sub-codewords lead to much more severe degradation on the GII error-correcting performance compared to the miscorrections of classic BCH codes. This letter investigates the miscorrections in GII decoding. Three low-complexity methods are developed to identify and mitigate the miscorrections by utilizing the nested syndromes, adding one single parity to each sub-codeword, and keeping track of the error locator polynomial degree. Besides, formulas for estimating the miscorrection rates are given. Using the proposed mitigation methods, the actual GII decoding performance becomes very close to that of the case without any miscorrections.

Design, optimization and Real Time implementation of a new Embedded Chien Search Block for Reed-Solomon (RS) and Bose-Chaudhuri-Hocquenghem (BCH) codes on FPGA Board.

The development of error correcting codes has been a major concern for communications systems. Therefore, RS and BCH (Reed-Solomon and Bose, Ray-Chaudhuri and Hocquenghem) are effective methods to improve the quality of digital transmission. In this paper a new algorithm of Chien Search block for embedded systems is proposed. This algorithm is based on a factorization of error locator polynomial. i.e, we can minimize an important number of logic gates and hardware resources using the FPGA card. Consequently, it reduces the power consumption with a percentage which can reach 40 % compared to the basic RS and BCH decoder. The proposed system is designed, simulated using the hardware description language (HDL) and Quartus development software. Also, the performance of the designed embedded Chien search block for decoder RS\BCH (255, 239) has been successfully verified by implementation on FPGA board.

Algebraic Decoding of Quasi-Reversible BCH Codes Using Band Matrices

A Bose-Chaudhuri-Hocquenghem (BCH) is called quasi-reversible if there are consecutive elements a <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sub> ,⋯,a <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sub> in the defining set, where a <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sub> is a negative integer and a <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sub> is a positive integer. A matrix in band form presented in this article involves the use of the Newton identities and symmetric polynomial identities. This matrix is the coefficient matrix of a linear system. The solution to such a linear system is the coefficients of an error-locator polynomial for quasi-reversible BCH codes. Its computational complexity is significantly lower than BCH decoding using the linear system with coefficient matrix in column echelon form. This article also proposes a new partial syndrome matrix with radical locators and a lot of zeros. Such a matrix is still in band form. The expansion of its matrix determinant is exactly a radical-locator polynomial. Compared to the former radical-locator polynomials in the literature, the newly discovered radical-locator polynomial not only requires less storage memory but also results in computational benefits. Surprisingly, the resulting polynomials are much sparser than those for the narrow-sense BCH codes. Finally, a complete algebraic decoding algorithm for quasi-reversible BCH codes is provided. The error-locator and radical-locator polynomials of degree less than or equal to 5 are listed.

BCH CODES DECODER BASED ON EUCLID ALGORITHM

In the process of algebraic decoding of BCH codes over the field GF(q) with the word length n = qm-1, correcting t errors, both in the time and frequency domains, it is necessary to find the error locator polynomial ?(x) as the least polynomial for which the key equation. Berlekamp proposed a simple iterative scheme, which was called the Berlekamp-Messi algorithm, and is currently used in most practical applications. Comparative statistical tests of the proposed decoder and decoder using the Berlikamp-Messi algorithm showed that they differ slightly in decoding speed. The proposed algorithm is implemented in the environment in Turbo Pascal and can be used for the entire family of BCH codes by replacing the primitive Galois polynomial.

Efficient Algorithm for Finding Roots of Error-Locator Polynomials

A novel method for finding roots of polynomials over finite fields has been proposed. This method is based on the cyclotomic discrete Fourier transform algorithm. The improvement is achieved by using the normalized cyclic convolutions, which have a small complexity and allow matrix decomposition, as well as methods of adapting the truncated normalized cyclic convolutions calculation. For small values of degree of the error-locator polynomial the novel method has not only the smallest multiplicative complexity, but the full computational complexity of this method is also less than with other methods. Thus, the multiplicative complexity of the novel method in comparison to the method of affine decomposition (the Fedorenko-Trifonov method) is up to ten times less, although the additive complexity is approximately 10-15% more. The novel method has matrix representation convenient for implementation.

Variable-Rate VLSI Architecture for 400-Gb/s Hard-Decision Product Decoder

Variable-rate transceivers, which adapt to the conditions, will be central to energy-efficient communication. However, fiber-optic communication systems with high bit-rate requirements make design of flexible transceivers challenging, since additional circuits needed to orchestrate the flexibility will increase area and degrade speed. We propose a variable-rate VLSI architecture of a forward error correction (FEC) decoder based on hard-decision product codes. Variable shortening of component codes provides a mechanism by which code rate can be varied, the number of iterations offers a knob to control the coding gain, while a key-equation solver module that can swap between error-locator polynomial coefficients provides a means to change error correction capability. Our evaluations based on 28-nm netlists show that a variable-rate decoder implementation can offer a net coding gain (NCG) range of 9.96-10.38dB at a post-FEC bit-error rate of 10 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">-15</sup> . The decoder achieves throughputs in excess of 400Gb/s, latencies below 53ns, and energy efficiencies of 1.14pJ/bit or less. While the area of the variable-rate decoder is 31% larger than a decoder with a fixed rate, the power dissipation is a mere 5% higher. The variable error correction capability feature increases the NCG range further, to above 10.5dB, but at a significant area cost.

MODIFIED ALGORITHM FOR SEARCHING THE ROOTS OF THE ERROR LOCATORS POLYNOMINAL WHILE DECODING BCH CODES

Context. In telecommunications and information systems with an increased noise component the noise-resistant cyclic BCH and Reed-Solomon codes are used. The adjustment and correcting errors in a message require some effective decoding methods. One of the stages in the procedure of decoding RS and BCH codes to determine the position of distortions is the search for the roots of the error locator polynomial. The calculation of polynomial roots, especially for codes with significant correction capacity is a laborious task requiring high computational complexity. That is why the improvement of BCH and RS codes decoding methods providing to reduce the computational complexity is an urgent task.Objective. The investigation and synthesis of the accelerated roots search algorithm of the error locator polynomial presented as an affine polynomial with coefficients in the finite fields, which allows accelerating the process of BCH and RS code decoding.Method. The classical roots search method based on the Chan’s algorithm is performed using the arithmetic of the Galois finite fields and the laborious calculation, in this case depends on the number of addition and multiplication operations. For linearized polynomials, the roots search procedure based on binary arithmetic is performed taking into account the values obtained at the previous stages of the calculation, which provides the minimum number of arithmetic operations.Results. An accelerated algorithm for calculating the values of the error locator polynomial at all points of the GF(2m) finite field for linearized polynomials based on the Berlekamp-Massey method has been developed. The algorithm contains a minimum number of addition operations, due to the use at each stage of the calculations the values obtained at the previous step, as well as the addition in the finite field GF(2). A modified roots search method for affine polynomials over the finite fields has been proposed to determine error positions in the code word while decoding the cyclic BCH and RS codes.Conclusions. The scientific newness of the work is to improve the algorithm of calculating the roots of the error locator polynomial, which coefficients belong to the elements of the finite field. At the same time it simplifies the procedure for cyclic BCH and RS codes decoding, due to reducing the computational complexity of one of the decoding stages, especially finding the error positions using the modified Berlekamp-Massey algorithm. These facts are confirmed by the simulation program results of the roots search of the error locator polynomial algorithm. It is shown, that the application of the accelerated method permits to reach a gain on speed of 1.5 times.

HELP: a sparse error locator polynomial for BCH codes

In 1990 Cooper suggested to use Groebner bases’ computations to decode cyclic codes and his idea gave rise to many research papers. In particular, as proved by Sala-Orsini, once defined the polynomial ring whose variables are the syndromes, the locations and the error values and considered the syndrome ideal, only one polynomial of a lexicographical Groebner basis for such ideal is necessary to decode (the general error locator polynomial, a.k.a. GELP). The decoding procedure only consists in evaluating this polynomial in the syndromes and computing its roots: the roots are indeed the error locations. A possible bottleneck in this procedure may be the evaluation part, since a priori the GELP may be dense. In this paper, focusing on binary cyclic codes with length $$n=2^m-1$$, correcting up to two errors, we give a Groebner-free, sparse analog of the GELP, the half error locator polynomial (HELP). In particular, we show that it is not necessary to compute the whole Groebner basis for getting such kind of locator polynomial and we construct the HELP, studying the quotient algebra of the polynomial ring modulo the syndrome ideal by a combinatorial point of view. The HELP turns out to be computable with quadratic complexity and it has linear growth in the length n of the code: $${\mathcal {O}}\left( \frac{n+1}{2}\right)$$.

On PGZ decoding of alternant codes

In this paper, we first review the classical Petterson–Gorenstein–Zierler decoding algorithm for the class of alternant codes, which includes Reed–Solomon, Bose–Chaudhuri–Hocquenghem and classical Goppa codes. Afterwards, we present an improvement of the method to find the number of errors and the error-locator polynomial. Finally, we illustrate the procedure with several examples. In two appendices, we sketch the main features of the computer algebra system designed and developed to support the computations.

Simultaneous Partial Inverses and Decoding Interleaved Reed–Solomon Codes

This paper introduces the simultaneous partial-inverse problem (SPI) for polynomials and develops its application to decoding interleaved Reed–Solomon codes beyond half the minimum distance. While closely related both to standard key equations and to well-known Pade approximation problems, the SPI problem stands out in several respects. First, the SPI problem has a unique solution (up to a scale factor), which satisfies a natural degree bound. Second, the SPI problem can be transformed (monomialized) into an equivalent SPI problem where all moduli are monomials. Third, the SPI problem can be solved by an efficient algorithm of the Berlekamp–Massey type. Fourth, decoding interleaved Reed–Solomon codes (or subfield-evaluation codes) beyond half the minimum distance can be analyzed in terms of a partial-inverse condition for the error pattern: if that condition is satisfied, then the (true) error locator polynomial is the unique solution of a standard key equation and can be computed in many different ways, including the well-known multi-sequence Berlekamp–Massey algorithm and the SPI algorithm of this paper. Two of the best performance bounds from the literature (the Schmidt–Sidorenko–Bossert bound and the Roth–Vontobel bound) are generalized to hold for the partial-inverse condition and thus to apply to several different decoding algorithms.

The Use of Multivariate Weak-Locator Polynomials to Decode Cyclic Codes up to Actual Minimum Distance

A class of cyclic codes has recently been decoded by using the weak-locator polynomials instead of the conventional error-locator polynomials. In this paper, a generalization of weak-locator polynomials to the multivariate cases, called the multivariate weak-locator polynomials, is defined, and a new matrix whose determinant can be expressed as a multivariate weak-locator polynomial is developed for cyclic codes. Moreover, a modified matrix along with Gaussian elimination found herein enables one to determine error positions precisely. The presented matrices result in a reduction of the number of syndromes when compared with the previously known matrices. The simulation shows that, for example, with the capability of correcting more errors, a considerably sophistical scheme of decoding the (97, 49, 15) binary cyclic code based on the proposed matrices is around 115 times faster than other existing decoders. Therefore, in general, it is developed to facilitate faster decoding of a large class of cyclic codes and is naturally suitable for the software implementation.

Fast Low-Complexity Triple-Error-Correcting BCH Decoding Architecture

An efficient decoding architecture for triple-error-correcting BCH codes is proposed by utilizing a lookup table (LUT) that stores the roots of the error locator polynomial instead of using the Chien search. Two roots of the polynomial equation are precomputed and stored in the LUT in order to relax the hardware complexity. To relax the complexity further, a new method to compress the LUT is additionally proposed. While a large portion of the LUT is filled with unnecessary information in the previous designs, this brief eliminates the redundant information by investigating an algebraic property of the equation. For BCH codes over GF(210), the LUT size is reduced to 18% of the previous work. As a result, the proposed decoding architecture reduces the decoding latency by 38% and the equivalent gate count by up to 40% compared to the previous work, achieving a fast low-complexity triple-error-correcting BCH decoder.

Efficient Coding Architectures for Reed–Solomon and Low-Density Parity-Check Decoders for Magnetic and Other Data Storage Systems

High-performance error correction codes are used in high-density data storage devices to overcome noise and channel impairments. In this paper, we develop novel and efficient decoding architectures for Reed-Solomon (RS) and low-density parity-check (LDPC) codes that are used in almost all data storage devices. First, we present a high-speed low-latency hard-decision-based pipelined RS decoder architecture that computes the error locator polynomial in exactly 2t clock cycles without parallelism. The RS decoder is a two-stage pipelined engine operating at the least latency possible, thereby, significantly reducing the size of the delay buffer. The RS decoder is implemented using Cadence tools and Kintex-7 field programmable gate array (FPGA). The technology-scaled normalized throughput of the pipelined RS decoder is almost two times compared with the existing decoders. The overall processing latency is reduced by almost 80% compared with the existing designs. Second, we design a high-throughput LDPC decoder using layered and non-layered min-sum algorithm based on non-uniform quantization (NUQ) on an FPGA kit. Unlike the standard state-of-the-art uniform quantization used in virtually all decoder circuits, our NUQ technique: 1) achieves a slight performance improvement of similar to 0.1 dB in the signal-to-noise ratio using equal number of bits and 2) yields 20% area savings (using 1 bit less) for the block RAMs used for storing intermediate check node and variable node messages.

On the Shape of the General Error Locator Polynomial for Cyclic Codes

General error locator polynomials were introduced in 2005 as an alternative decoding for cyclic codes. We now present a conjecture on their sparsity, which would imply polynomial-time decoding for all cyclic codes. A general result on the explicit form of the general error locator polynomial for all cyclic codes is given, along with several results for specific code families, providing evidence to our conjecture. From these, a theoretical justification of the sparsity of general error locator polynomials is obtained for all binary cyclic codes with $t\leq 2$ and $n , as well as for $t=3$ and $n , except for some cases where the conjectured sparsity is proved by a computer check. Moreover, we summarize all related results, previously published, and we show how they provide further evidence to our conjecture. Finally, we discuss the link between our conjecture and the complexity of bounded-distance decoding of the cyclic codes.