Vlad-Florin Drăgoi, Brice Colombier, Pierre-Louis Cayrel, Vincent Grosso
{"title":"存在噪声时的整数综合征解码","authors":"Vlad-Florin Drăgoi, Brice Colombier, Pierre-Louis Cayrel, Vincent Grosso","doi":"10.1007/s12095-024-00712-3","DOIUrl":null,"url":null,"abstract":"<p>Code-based cryptography received attention after the NIST started the post-quantum cryptography standardization process in 2016. A central NP-hard problem is the binary syndrome decoding problem, on which the security of many code-based cryptosystems lies. The best known methods to solve this problem all stem from the information-set decoding strategy, first introduced by Prange in 1962. A recent line of work considers augmented versions of this strategy, with hints typically provided by side-channel information. In this work, we consider the integer syndrome decoding problem, where the integer syndrome is available but might be noisy. We study how the performance of the decoder is affected by the noise. First we identify the noise model as being close to a centered in zero binomial distribution. Second we model the probability of success of the ISD-score decoder in presence of a binomial noise. Third, we demonstrate that with high probability our algorithm finds the solution as long as the noise parameter <i>d</i> is linear in <i>t</i> (the Hamming weight of the solution) and <i>t</i> is sub-linear in the code-length. We provide experimental results on cryptographic parameters for the BIKE and <i>Classic McEliece</i> cryptosystems, which are both candidates for the fourth round of the NIST standardization process.</p>","PeriodicalId":10788,"journal":{"name":"Cryptography and Communications","volume":"191 1","pages":""},"PeriodicalIF":0.0000,"publicationDate":"2024-05-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":"{\"title\":\"Integer syndrome decoding in the presence of noise\",\"authors\":\"Vlad-Florin Drăgoi, Brice Colombier, Pierre-Louis Cayrel, Vincent Grosso\",\"doi\":\"10.1007/s12095-024-00712-3\",\"DOIUrl\":null,\"url\":null,\"abstract\":\"<p>Code-based cryptography received attention after the NIST started the post-quantum cryptography standardization process in 2016. A central NP-hard problem is the binary syndrome decoding problem, on which the security of many code-based cryptosystems lies. The best known methods to solve this problem all stem from the information-set decoding strategy, first introduced by Prange in 1962. A recent line of work considers augmented versions of this strategy, with hints typically provided by side-channel information. In this work, we consider the integer syndrome decoding problem, where the integer syndrome is available but might be noisy. We study how the performance of the decoder is affected by the noise. First we identify the noise model as being close to a centered in zero binomial distribution. Second we model the probability of success of the ISD-score decoder in presence of a binomial noise. Third, we demonstrate that with high probability our algorithm finds the solution as long as the noise parameter <i>d</i> is linear in <i>t</i> (the Hamming weight of the solution) and <i>t</i> is sub-linear in the code-length. We provide experimental results on cryptographic parameters for the BIKE and <i>Classic McEliece</i> cryptosystems, which are both candidates for the fourth round of the NIST standardization process.</p>\",\"PeriodicalId\":10788,\"journal\":{\"name\":\"Cryptography and Communications\",\"volume\":\"191 1\",\"pages\":\"\"},\"PeriodicalIF\":0.0000,\"publicationDate\":\"2024-05-10\",\"publicationTypes\":\"Journal Article\",\"fieldsOfStudy\":null,\"isOpenAccess\":false,\"openAccessPdf\":\"\",\"citationCount\":\"0\",\"resultStr\":null,\"platform\":\"Semanticscholar\",\"paperid\":null,\"PeriodicalName\":\"Cryptography and Communications\",\"FirstCategoryId\":\"1085\",\"ListUrlMain\":\"https://doi.org/10.1007/s12095-024-00712-3\",\"RegionNum\":0,\"RegionCategory\":null,\"ArticlePicture\":[],\"TitleCN\":null,\"AbstractTextCN\":null,\"PMCID\":null,\"EPubDate\":\"\",\"PubModel\":\"\",\"JCR\":\"\",\"JCRName\":\"\",\"Score\":null,\"Total\":0}","platform":"Semanticscholar","paperid":null,"PeriodicalName":"Cryptography and Communications","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1007/s12095-024-00712-3","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}
引用次数: 0
摘要
美国国家标准与技术研究院(NIST)于 2016 年启动后量子密码学标准化进程后,基于密码的密码学受到了关注。一个核心的 NP 难问题是二进制综合征解码问题,许多基于密码的密码系统的安全性都取决于此。解决这一问题的最著名方法都源于信息集解码策略,该策略由 Prange 于 1962 年首次提出。最近的一项研究考虑了这一策略的增强版本,通常由侧信道信息提供提示。在这项工作中,我们考虑的是整数综合征解码问题,其中整数综合征是可用的,但可能是有噪声的。我们研究了解码器的性能如何受到噪声的影响。首先,我们确定噪声模型接近于以零为中心的二项分布。其次,我们对二项分布噪声下 ISD 评分解码器的成功概率进行建模。第三,我们证明,只要噪声参数 d 与 t(解的汉明权重)成线性关系,且 t 与码长成亚线性关系,我们的算法就能高概率地找到解。我们提供了 BIKE 和经典 McEliece 密码系统密码参数的实验结果,这两个系统都是第四轮 NIST 标准化进程的候选系统。
Integer syndrome decoding in the presence of noise
Code-based cryptography received attention after the NIST started the post-quantum cryptography standardization process in 2016. A central NP-hard problem is the binary syndrome decoding problem, on which the security of many code-based cryptosystems lies. The best known methods to solve this problem all stem from the information-set decoding strategy, first introduced by Prange in 1962. A recent line of work considers augmented versions of this strategy, with hints typically provided by side-channel information. In this work, we consider the integer syndrome decoding problem, where the integer syndrome is available but might be noisy. We study how the performance of the decoder is affected by the noise. First we identify the noise model as being close to a centered in zero binomial distribution. Second we model the probability of success of the ISD-score decoder in presence of a binomial noise. Third, we demonstrate that with high probability our algorithm finds the solution as long as the noise parameter d is linear in t (the Hamming weight of the solution) and t is sub-linear in the code-length. We provide experimental results on cryptographic parameters for the BIKE and Classic McEliece cryptosystems, which are both candidates for the fourth round of the NIST standardization process.