Information Set Decoding in the Lee Metric with Applications to   Cryptography

Anna-Lena Horlemann-Trautmann; Violetta Weger

arXiv:1903.07692·cs.CR·April 28, 2020

Information Set Decoding in the Lee Metric with Applications to Cryptography

Anna-Lena Horlemann-Trautmann, Violetta Weger

PDF

TL;DR

This paper adapts an information set decoding algorithm to the Lee metric over the ring Z/4Z, demonstrating its potential to significantly reduce key sizes in cryptographic systems like McEliece and Niederreiter.

Contribution

It introduces a novel ISD algorithm in the Lee metric and establishes a framework for cryptosystems over Z/4Z, highlighting advantages over traditional Hamming metric codes.

Findings

01

Lee metric codes can drastically reduce key sizes.

02

The framework applies to McEliece and Niederreiter cryptosystems.

03

Results can be extended to other Galois rings.

Abstract

We convert Stern's information set decoding (ISD) algorithm to the ring $Z /4 Z$ equipped with the Lee metric. Moreover, we set up the general framework for a McEliece and a Niederreiter cryptosystem over this ring. The complexity of the ISD algorithm determines the minimum key size in these cryptosystems for a given security level. We show that using Lee metric codes can drastically decrease the key size, compared to Hamming metric codes. In the end we explain how our results can be generalized to other Galois rings $Z / p^{s} Z$ .

Tables1

Table 1. Table 1. Key sizes and security levels (both in bits) for GV-codes over ℤ 4 subscript ℤ 4 \mathbb{Z}_{4} with n = 150 𝑛 150 n=150 and d = 81 𝑑 81 d=81 .

$k_{1}$	1	2	3	4	…	18	19	…	24	25
best $ℓ$	1	1	1	1	…	1	1	…	1	2
best $v$	4	4	4	4	…	3	3	…	3	3
key size	5198	5296	5390	5480	…	6110	6160	…	6440	6446
security level	31	31	31	30	…	27	27	…	28	28

Equations165

wt_{L} (x) = min {x, m - x},

wt_{L} (x) = min {x, m - x},

wt_{L} (x) = i = 1 \sum n wt_{L} (x_{i}) .

wt_{L} (x) = i = 1 \sum n wt_{L} (x_{i}) .

d_{L} (x, y) = wt_{L} (x - y) .

d_{L} (x, y) = wt_{L} (x - y) .

ϕ : (Z_{4}, wt_{L})

ϕ : (Z_{4}, wt_{L})

0

1

2

3

\overline{ϕ} : (Z_{4}^{n}, wt_{L}) \to (F_{2}^{2 n}, wt_{H}) .

\overline{ϕ} : (Z_{4}^{n}, wt_{L}) \to (F_{2}^{2 n}, wt_{H}) .

G = (Id_{k_{1}} 0 A 2 Id_{k_{2}} B 2 C),

G = (Id_{k_{1}} 0 A 2 Id_{k_{2}} B 2 C),

H = (- B^{⊤} - C^{⊤} A^{⊤} 2 A^{⊤} C^{⊤} 2 Id_{k_{2}} Id_{n - k_{1} - k_{2}} 0) =: (D 2 F E 2 Id_{k_{2}} Id_{n - k_{1} - k_{2}} 0),

H = (- B^{⊤} - C^{⊤} A^{⊤} 2 A^{⊤} C^{⊤} 2 Id_{k_{2}} Id_{n - k_{1} - k_{2}} 0) =: (D 2 F E 2 Id_{k_{2}} Id_{n - k_{1} - k_{2}} 0),

(m_{1}, m_{2}) (Id_{k_{1}} 0 A 2 Id_{k_{2}} B 2 C) = m_{1}^{⊤} (m_{1} A + 2 m_{2})^{⊤} (m_{1} B + 2 m_{2} C)^{⊤} = c_{1}^{⊤} c_{2}^{⊤} c_{3}^{⊤} .

(m_{1}, m_{2}) (Id_{k_{1}} 0 A 2 Id_{k_{2}} B 2 C) = m_{1}^{⊤} (m_{1} A + 2 m_{2})^{⊤} (m_{1} B + 2 m_{2} C)^{⊤} = c_{1}^{⊤} c_{2}^{⊤} c_{3}^{⊤} .

(D 2 F E 2 Id_{k_{2}} Id_{n - k_{1} - k_{2}} 0) c_{1}^{⊤} c_{2}^{⊤} c_{3}^{⊤} = (D c_{1}^{⊤} + E c_{2}^{⊤} + c_{3}^{⊤} 2 F c_{1}^{⊤} + 2 c_{2}^{⊤}) = (s_{1}^{⊤} 2 s_{2}^{⊤}) .

(D 2 F E 2 Id_{k_{2}} Id_{n - k_{1} - k_{2}} 0) c_{1}^{⊤} c_{2}^{⊤} c_{3}^{⊤} = (D c_{1}^{⊤} + E c_{2}^{⊤} + c_{3}^{⊤} 2 F c_{1}^{⊤} + 2 c_{2}^{⊤}) = (s_{1}^{⊤} 2 s_{2}^{⊤}) .

c (n, w) := i = 0 \sum ⌊ w /2 ⌋ (i n) (w - 2 i n - i) 2^{w - 2 i} .

c (n, w) := i = 0 \sum ⌊ w /2 ⌋ (i n) (w - 2 i n - i) 2^{w - 2 i} .

c (n, w) = i = 0 \sum ⌊ w /2 ⌋ (i n) (w - 2 i n - i) 2^{w - 2 i} = (w 2 n) .

c (n, w) = i = 0 \sum ⌊ w /2 ⌋ (i n) (w - 2 i n - i) 2^{w - 2 i} = (w 2 n) .

∣ C ∣\geq \frac{2 ^{n}}{\sum _{j = 0}^{d - 1} ( j n )} .

∣ C ∣\geq \frac{2 ^{n}}{\sum _{j = 0}^{d - 1} ( j n )} .

∣ C ∣\geq \frac{4 ^{n}}{( \sum _{j = 0}^{d - 1} ( j 2 n ) - 1 ) 3 + 1} .

∣ C ∣\geq \frac{4 ^{n}}{( \sum _{j = 0}^{d - 1} ( j 2 n ) - 1 ) 3 + 1} .

(w k) (t n)^{- 1} .

(w k) (t n)^{- 1} .

U H e^{⊤} = (A Id_{n - k}) (e_{1}^{⊤} e_{2}^{⊤}) = s^{'⊤} = U s^{⊤},

U H e^{⊤} = (A Id_{n - k}) (e_{1}^{⊤} e_{2}^{⊤}) = s^{'⊤} = U s^{⊤},

e_{1} A^{⊤} + e_{2} = s^{'} .

e_{1} A^{⊤} + e_{2} = s^{'} .

((w k) (t - w n - k))^{- 1} (t n) \cdot [(n - k)^{2} (n + 1) + (w k) (w + 1) (n - k)] .

((w k) (t - w n - k))^{- 1} (t n) \cdot [(n - k)^{2} (n + 1) + (w k) (w + 1) (n - k)] .

(w k) (t - w n - k) (t n)^{- 1} .

(w k) (t - w n - k) (t n)^{- 1} .

L (n, w) := i = 1 \sum w (i n) .

L (n, w) := i = 1 \sum w (i n) .

∣ S ∣ \cdot ∣ T ∣ \cdot 2^{- n} .

∣ S ∣ \cdot ∣ T ∣ \cdot 2^{- n} .

U H e^{⊤} = (A_{1} A_{2} Id_{ℓ} 0 0 Id_{n - k - ℓ}) e_{1}^{⊤} 0 e_{2}^{⊤} = (s_{1}^{⊤} s_{2}^{⊤}) = U s^{⊤},

U H e^{⊤} = (A_{1} A_{2} Id_{ℓ} 0 0 Id_{n - k - ℓ}) e_{1}^{⊤} 0 e_{2}^{⊤} = (s_{1}^{⊤} s_{2}^{⊤}) = U s^{⊤},

e_{1} A_{1}^{⊤}

e_{1} A_{1}^{⊤}

e_{1} A_{2}^{⊤} + e_{2}

U H e^{⊤} = (A_{1} A_{2} Id_{ℓ} 0 0 Id_{n - k - ℓ}) π_{I} (e_{X} + e_{Y})^{⊤} 0 A_{2} π_{I} (e_{X} + e_{Y})^{⊤} + s_{2}^{⊤}

U H e^{⊤} = (A_{1} A_{2} Id_{ℓ} 0 0 Id_{n - k - ℓ}) π_{I} (e_{X} + e_{Y})^{⊤} 0 A_{2} π_{I} (e_{X} + e_{Y})^{⊤} + s_{2}^{⊤}

= (A_{1} π_{I} (e_{X} + e_{Y})^{⊤} A_{2} π_{I} (e_{X} + e_{Y})^{⊤} + A_{2} π_{I} (e_{X} + e_{Y})^{⊤} + s_{2}^{⊤}) = (s_{1}^{⊤} s_{2}^{⊤}) = U s^{⊤},

((v m _{1}) (v m _{2}) (t - 2 v n - k - ℓ))^{- 1} (t n) \cdot [(n - k)^{2} (n + 1) + ℓ (L (m_{1}, v) - m_{1})

((v m _{1}) (v m _{2}) (t - 2 v n - k - ℓ))^{- 1} (t n) \cdot [(n - k)^{2} (n + 1) + ℓ (L (m_{1}, v) - m_{1})

+ ℓ (L (m_{2}, v) - m_{2} + (v m _{2})) + (v m _{1}) (v m _{2}) 2^{- ℓ + 1} (t - 2 v + 1) (2 v + 1)] .

ℓ (L (m_{1}, v) - m_{1}) .

ℓ (L (m_{1}, v) - m_{1}) .

ℓ (L (m_{2}, v) - m_{2} + (v m _{2})),

ℓ (L (m_{2}, v) - m_{2} + (v m _{2})),

\frac{( v m _{1} ) ( v m _{2} )}{2 ^{ℓ}}

Peer Reviews

No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.

Videos

No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.

Full text

Information Set Decoding in the Lee Metric with Applications to Cryptography

Anna-Lena Horlemann-Trautmann

Faculty of Mathematics and Statistics

University of St. Gallen

Bodanstr. 6

St. Gallen, Switzerland

[email protected]

and

Violetta Weger

Institute of Mathematics

University of Zurich

Winterthurerstrasse 190

8057 Zurich, Switzerland

[email protected]

Abstract.

We convert Stern’s information set decoding (ISD) algorithm to the ring $\mathbb{Z}/4\mathbb{Z}$ equipped with the Lee metric. Moreover, we set up the general framework for a McEliece and a Niederreiter cryptosystem over this ring. The complexity of the ISD algorithm determines the minimum key size in these cryptosystems for a given security level. We show that using Lee metric codes can substantially decrease the key size, compared to Hamming metric codes. In the end we explain how our results can be generalized to other Galois rings $\mathbb{Z}/p^{s}\mathbb{Z}$ .

Key words and phrases:

Coding Theory; Cryptography; McEliece System; ring-linear Codes; Lee Metric.

2010 Mathematics Subject Classification:

1. Introduction

The hardness of decoding random linear codes is at the heart of any code-based public key cryptosystem. Information set decoding (ISD) algorithms are the main method for decoding random linear codes in the Hamming metric, whenever the problem has only a few solutions. An ISD algorithm is given a corrupted codeword and recovers the message or equivalently finds the error vector. Such algorithms are often formulated via the parity check matrix, since it is enough to find a vector of a certain weight which has the same syndrome as the corrupted codeword – this problem is also referred to as the syndrome decoding problem. ISD algorithms over the binary are based on a decoding algorithm proposed by Prange [37] in 1962 and the main structure of the variants do not change much from the original: as a first step one chooses an information set, then Gaussian elimination brings the parity check matrix into a standard form and, assuming that the errors are outside of the information set, these row operations on the syndrome will recover the error vector, if the weight does not exceed the given error correction capacity.

ISD algorithms are of immense importance when proposing a code-based cryptosystem. The idea of using linear codes in public key cryptography was first formulated by Robert McEliece [31], in 1978. In the McEliece cryptosystem the private key is the generator matrix of a linear code with an efficient decoding algorithm. The public key is a scrambled and disguised version of the generator matrix, such that the private key (and hence the decoding algorithm) is not reconstructable from the public key. The message is encrypted by encoding it with the generator matrix and adding a random error of prescribed Hamming weight. The owner of the private key can recover the message by inverting the disguising function and using the efficient decoding algorithm. On the other hand, if the secret code is hidden well enough, an adversary who wants to break the system encounters the decoding problem of a random linear code, since the public code looks random to him. The best the adversary can do is hence to use the best generic decoding algorithm for random linear codes, which currently are ISD algorithms. ISD algorithms hence do not break a code-based cryptosystem but they determine the choice of secure parameters.

One of the main drawbacks of classical code-based cryptosystems are the public key sizes. To reduce these key sizes, over the last years, many variants of code-based cryptosystems have been proposed that use codes in the rank-metric, instead of the Hamming metric. This raises the question if other metrics can be useful, as well. This is why we study codes in the Lee metric for code-based cryptography in this paper, and show that, for theoretical code parameters111By theoretical parameters we mean codes attaining the Gilbert-Varshamov bound., the Lee metric can also lead to a substantial reduction of the public key size.

We will focus on codes that are defined over integer residue rings $\mathbb{Z}_{m}:=\mathbb{Z}/m\mathbb{Z}$ , for some integer $m>1$ , equipped with the Lee metric. In particular, we are going to use ring-linear codes, which are defined to be $\mathbb{Z}_{m}$ -submodules of $\mathbb{Z}_{m}^{n}$ . We especially focus on quaternary codes, which are defined over $\mathbb{Z}_{4}$ , since this case has been studied the most in the coding theory literature. In general, ring-linear codes were first mentioned by Assmus and Mattson in [1], for important results see [8, 9, 21, 33, 39, 40, 41], for a more general overview see [20]. The idea of using ring-linear codes for cryptography (in a quite different setting) first came up in [44].

We note that, although $\mathbb{Z}_{4}$ -linear Lee codes can be represented over $\mathbb{F}_{2}$ , there exists no representation that preserves both the weight and the linearity of the $\mathbb{Z}_{4}$ -code over $\mathbb{F}_{2}$ . Thus the known results over $\mathbb{F}_{2}$ cannot be used for the Lee metric. This is why this paper presents the adaption of ISD algorithms over the binary [42] to $\mathbb{Z}_{4}$ and a general form of the McEliece and Niederreiter cryptosystems over $\mathbb{Z}_{4}$ . The complexity of the ISD algorithm then determines a minimum public key size for a given security level of these cryptosystems. The paper is structured as follows: in Section 2 we introduce the theory of ring-linear codes, especially Lee codes, two ISD algorithms over the binary [42] and the notations and concepts involved in the algorithms. In Section 3 we present the adaption of the ISD algorithms over the binary to $\mathbb{Z}_{4}$ , including a complexity analysis. In Section 4 we cover the applications of the ISD algorithm over $\mathbb{Z}_{4}$ to code-based cryptography by stating the general McEliece and Niederreiter cryptosystems using quaternary codes. In this context we will also investigate the key size of such a cryptosystem using theoretical values for the secret quaternary code regarding 128 bit security against our ISD algorithms over $\mathbb{Z}_{4}$ , from Section 3. In Section 5 we explain briefly how one can generalize the ISD algorithm as well as the McEliece system to other Galois rings $\mathbb{Z}_{p^{s}}$ . We will then conclude this paper in Section 6 and add some open questions and problems.

2. Preliminaries

In this section we present the main theory and tools of ring-linear codes, especially Lee codes, as well as some known binary ISD algorithms and the concepts and notations involved.

2.1. Ring-linear coding theory

In traditional finite field coding theory an $[n,k]$ linear code $\mathcal{C}$ over $\mathbb{F}_{q}$ is a linear subspace of $\mathbb{F}_{q}^{n}$ of dimension $k$ . One can generalize this by taking a finite ring $R$ instead of $\mathbb{F}_{q}$ .

Let us assume for simplicity that $R$ is commutative, but observe that the following stays true in the noncommutative case.

Definition 1.

Let $k$ and $n$ be positive integers and let $R$ be a finite ring. $\mathcal{C}$ is called an $R$ -linear code of length $n$ of type $h$ , if $\mathcal{C}$ is a submodule of $R^{n}$ , with $\mid\mathcal{C}\mid=h$ .

We will restrict to the most preferred case of $\mathbb{Z}_{m}:=\mathbb{Z}/m\mathbb{Z}$ , for some $m\in\mathbb{N}$ . In particular, we will formulate most of our results for $m=4$ , since this case has been studied the most.

Definition 2.

We say that $\mathcal{C}$ is a quaternary linear code of length $n$ , if $\mathcal{C}$ is an additive subgroup of $\mathbb{Z}_{4}^{n}$ .

In traditional finite field coding theory we endow $\mathbb{F}_{q}^{n}$ with the Hamming metric to define the weight of a codeword $\text{wt}_{H}$ and the distance of codewords $d_{H}$ . In ring-linear coding theory over $\mathbb{Z}_{m}$ we could use the Hamming metric, the Lee metric, the homogeneous metric, the Euclidean metric and so on, for an overview see [19]. If we use the Lee metric the corresponding codes are referred to as Lee codes.

Definition 3.

For $x\in\mathbb{Z}_{m}$ we define the Lee weight to be

[TABLE]

similarly for $x\in\mathbb{Z}_{m}^{n}$ we define the Lee weight to be the sum of the Lee weights of its coordinates:

[TABLE]

For $x,y\in\mathbb{Z}_{m}^{n}$ , the Lee distance is defined to be

[TABLE]

There is a connection between traditional finite field coding theory and $\mathbb{Z}_{4}$ -linear coding theory via the Gray map:

Definition 4.

The Gray map is an isometry between $(\mathbb{Z}_{4},\text{wt}_{L})$ and $(\mathbb{F}_{2}^{2},\text{wt}_{H})$ and is defined as follows:

[TABLE]

The Gray map can be extended componentwise to

[TABLE]

Note however, that the Gray map does not preserve linearity, i.e., the image of a quaternary linear code is generally not linear over $\mathbb{F}_{2}$ .

We introduce the following notation: For a vector $v$ of length $n$ , a matrix $A$ with $n$ columns, a code $\mathcal{C}$ of length $n$ and a set $I\subset\{1,\ldots,n\}$ we denote by $v_{I}$ the projection of $v$ to its coordinates indexed by $I$ , and by $A_{I}$ the columns of $A$ indexed by $I$ . Analogously we define $\mathcal{C}_{I}:=\{v_{I}\mid v\in\mathcal{C}\}$ .

We will use the following definition of information set, since it fits perfectly in the context of ring-linear codes:

Definition 5.

For a code $\mathcal{C}$ over $\mathbb{F}_{q}$ of length $n$ and dimension $k$ , we call a set $I\subseteq\{1,\ldots,n\}$ of size $k$ an information set if $\mid\mathcal{C}_{I}\mid=\mid\mathcal{C}\mid$ .

Similarly, we define quaternary information sets for quaternary codes as follows:

Definition 6.

For a code $\mathcal{C}$ over $\mathbb{Z}_{4}$ of length $n$ and type $4^{k_{1}}2^{k_{2}}$ , we call a set $I\subseteq\{1,\ldots,n\}$ of size $k_{1}+k_{2}$ a (quaternary) information set if $\mid\mathcal{C}_{I}\mid=\mid\mathcal{C}\mid$ .

The following proposition defines the quaternary systematic form of the generator matrix and the parity check matrix of a quaternary code.

Proposition 7 ([21]).

Let $\mathcal{C}$ be a quaternary linear code of length $n$ and type $4^{k_{1}}2^{k_{2}}$ . Then $\mathcal{C}$ is permutation equivalent to a code having the $(k_{1}+k_{2})\times n$ generator matrix

[TABLE]

where $A\in\mathbb{Z}_{2}^{k_{1}\times k_{2}}$ , $B\in\mathbb{Z}_{4}^{k_{1}\times(n-k_{1}-k_{2})}$ , $C\in\mathbb{Z}_{2}^{k_{2}\times(n-k_{1}-k_{2})}$ , for some $k_{1},k_{2}\in\mathbb{N}_{0}$ .

A parity check matrix of $\mathcal{C}$ is the corresponding permutation of the $(n-k_{1})\times n$ matrix

[TABLE]

where $D\in\mathbb{Z}_{4}^{(n-k_{1}-k_{2})\times k_{1}},E\in\mathbb{Z}_{2}^{(n-k_{1}-k_{2})\times k_{2}},F\in\mathbb{Z}_{2}^{k_{2}\times k_{1}}$ .

If we have a generator matrix of the form (2.1), to get a unique encoding, the messages need to be of the form $m=(m_{1},m_{2})$ , where $m_{1}\in\mathbb{Z}_{4}^{k_{1}}$ and $m_{2}\in\mathbb{Z}_{2}^{k_{2}}$ . Encoding is done as follows:

[TABLE]

Hence the codewords are of the form $c=(c_{1},c_{2},c_{3})$ , where $c_{1}\in\mathbb{Z}_{4}^{k_{1}},c_{2}\in\mathbb{Z}_{4}^{k_{2}}$ and $c_{3}\in\mathbb{Z}_{4}^{n-k_{1}-k_{2}}$ .

For the syndrome of a codeword $c=(c_{1},c_{2},c_{3})$ we get

[TABLE]

The syndromes $s=(s_{1},2s_{2})$ are such that $s_{1}\in\mathbb{Z}_{4}^{n-k_{1}-k_{2}}$ and $s_{2}\in\mathbb{Z}_{2}^{k_{2}}$ .

To compute the number of vectors in $\mathbb{Z}_{4}^{n}$ having Lee weight $w$ , we have to sum over all choices of $i$ entries having Lee weight 2, of course only until $\lfloor w/2\rfloor$ . For the rest of the $n-i$ entries we are missing a Lee weight of $w-2i$ . We will achieve this with entries of Lee weight 1, where for each of the $w-2i$ entries, there are two choices: either 1 or 3. We will introduce the following notation for the amount of these vectors:

[TABLE]

With the Gray isometry we have that the number of vectors in $\mathbb{Z}_{4}^{n}$ having Lee weight $w$ is the same as the number of vectors in $\mathbb{F}_{2}^{2n}$ having Hamming weight $w$ , which is simply given by $\binom{2n}{w}.$ Note that one can also check that

[TABLE]

With this we can easily derive an analogue of the binary Gilbert-Varshamov bound for quaternary codes.

Proposition 8 (Theorem 13.73, [3]).

Let $n$ and $d$ be positive integers. There exists a linear binary code $\mathcal{C}$ of length $n$ and minimum Hamming distance $d$ , such that

[TABLE]

Furthermore there exists a linear quaternary code $\mathcal{C}$ of length $n$ and minimum Lee distance $d$ , such that

[TABLE]

2.2. Information set decoding algorithms

Many ISD algorithms and improvements have been suggested to Prange’s simplest form of ISD (see for example [11, 13, 14, 16, 26, 45]); in historical order the proposed ISD algorithms are by Prange [37], Leon [28], Lee-Brickell [27], Stern [42], Canteaut and Chabaud [12], Finiasz and Sendrier [18], Bernstein, Lange and Peters [6], May, Meurer and Thomae [29], Becker, Joux, May and Meurer [2] and the latest improvement is by May and Ozerov [30].

All of the above mentioned ISD algorithms were proposed over the binary field. However, with new variants of the McEliece cryptosystem proposed over general finite fields, some of the mentioned ISD algorithms have been generalized to $\mathbb{F}_{q}$ : Coffey and Goodman [15] generalized Prange’s algorithm to $\mathbb{F}_{q}$ , in [35] Peters generalized the algorithms by Lee-Brickell and Stern. Niebuhr, Persichetti, Cayrel, Bulygin and Buchmann [34] generalized the algorithm of Finiasz-Sendrier with efficiency improvements by using partial knowledge of attackers to a general finite field. In [24] Interlando, Khathuria, Rohrer, Rosenthal and Weger generalized the ball-collision algorithm by Bernstein, Lange and Peters to $\mathbb{F}_{q}$ . In [23] Hirose generalized the May-Ozerov algorithm to $\mathbb{F}_{q}$ . And Meurer generalized the algorithm of Becker, Joux, May and Meurer in [32].

The general idea of ISD algorithms is to guess an information set $I\subset\{1,\ldots n\}$ of size $k$ and the right distribution of the error vector corresponding to this information set, such that we can recover the message from this information set. In the algorithms we consider the information set $I$ will be chosen randomly in each outer loop of the algorithm. Nevertheless we want to note that there is a slightly smarter way to do so, see [12], by reusing some elements of $I$ in the next iteration and only adding missing elements. For simplicity, we will just use a random choice.

Once we have chosen an information set $I$ , we need to guess the error vector having the assumed weight distribution. In the binary case this means we just have to guess the locations of the errors. In Lee-Brickell’s algorithm [27], the distribution of the error vector is assumed to be $w$ in the information set and $t-w$ outside the information set. In Stern’s algorithm the error vector has weight $2v$ in the information set coordinates; moreover, these $2v$ errors are assumed to be located in two disjoint coordinate sets, both having weight $v$ . In addition, we assume that there is a zero-window of size $\ell$ , where no errors are allowed. The remaining error weight of $t-2v$ is found in the remaining $n-k-\ell$ coordinates.

The average complexity of ISD algorithms is given by the cost of one iteration times the average number of iterations needed, which is given by the inverted success probability. Note that the success criterion is to choose the correct weight distribution of the error vector. The success probability of having correctly chosen $w$ errors in $k$ coordinates over all vectors having length $n$ and Hamming weight $t$ is given by

[TABLE]

While on classical computers ISD attacks with a high cost of one iteration but a low number of iterations outperform ISD attacks with a low cost of one iteration and a high number of iterations, this is not the case for quantum computers. In fact: in [4] it was observed that using Grover’s algorithm within ISD attacks reduces the number of iterations needed, thus when using a quantum computer ISD attacks with a low cost of one iteration, such as Lee-Brickell’s algorithm, might outperform ISD attacks a low number of iterations, such as Stern’s algorithm. This is why we will adapt both, Lee-Brickell’s algorithm and Stern’s algorithm, to the Lee metric.

We will start with explaining the ISD algorithm of Lee-Brickell [27] over the binary field with respect to the Hamming distance. For this we are going to use the following notation. For $S\subset\{1,\ldots,n\}$ of size $\ell$ , we denote by $\mathbb{F}_{2}^{n}(S)$ the vectors living in $\mathbb{F}_{2}^{n}$ having support in $S$ . The projection of $x\in\mathbb{F}_{2}^{n}(S)$ to $\mathbb{F}_{2}^{\ell}$ is denoted by $\pi_{S}(x)$ . On the other hand we denote by $\sigma_{S}(x)$ the canonical embedding of $x\in\mathbb{F}_{2}^{\ell}$ to $\mathbb{F}_{2}^{n}(S)$ . We are given the parity check matrix $H\in\mathbb{F}_{2}^{(n-k)\times n}$ , the amount $t$ of errors we can correct and the syndrome $s\in\mathbb{F}_{2}^{n-k}$ . We want to find a vector $e\in\mathbb{F}_{2}^{n}$ , such that $\text{wt}_{H}(e)=t$ and $He^{\top}=s$ . The algorithm is formulated in Algorithm 1.

To illustrate the algorithm, assume that the information set is $I=\{1,\ldots,k\}$ . We get

[TABLE]

where $A\in\mathbb{F}_{2}^{(n-k)\times k}$ and $e_{1}\in\mathbb{F}_{2}^{k},e_{2}\in\mathbb{F}_{2}^{n-k}$ . From this we get the condition

[TABLE]

The part $e_{1}$ is chosen to have weight $w$ , and the part $e_{2}$ is chosen such that its support is disjoint from $e_{1}$ , it has the remaining weight $t-w$ , and $e_{2}=s^{\prime}+e_{1}A^{\top}$ .

*Remark 9**.*

In all the following complexity analyses we will use schoolbook long multiplication with a computational complexity of $n^{2}$ operations for inputs of length $n$ . We remark that faster multiplication algorithms are known and can be used in our ISD algorithms; however, we refrain from using them since they would not make a substantial difference in our analyses, but on the other hand make the formulas more complicated.

Theorem 10.

The average number of bit operations Algorithm 1 needs is approximately

[TABLE]

Proof.

As a first step we need to find the systematic form of the permuted parity check matrix, and the corresponding syndrome form. As a broad estimate we use the complexity of computing $U[H\mid s^{\top}]$ , which takes approximately $(n-k)^{2}(n+1)$ bit operations.

For all $e_{1}\in\mathbb{F}_{2}^{n}(I)$ having $wt_{H}(e_{1})=w$ , which are $\binom{k}{w}$ many, we have to check, if the weight of $e_{2}=s^{\prime}+\pi_{I}(e_{1})A^{\top}$ is $t-w$ , hence this step costs $(w+1)(n-k)$ bit operations.

The success probability is given by having chosen the correct weight distribution of the error vector, i.e., in the information set the weight $w$ and in $J$ the missing weight $t-w$ :

[TABLE]

Hence, the overall cost of this algorithm is as claimed. ∎

In the following we explain Stern’s algorithm over the binary field with respect to the Hamming distance. We will use a formulation of the algorithm, which matches the ball-collision formulation in [6]. The two algorithms differ in the zero-window of size $\ell$ : in Stern’s algorithm no error is allowed in the zero-window, whereas in the ball-collision algorithm, this window is split into $Y_{1},Y_{2}$ and $q_{1},q_{2}$ errors are allowed respectively. Even though the asymptotic complexity of the ball-collision algorithm is smaller, for concrete parameters it turns out that, in most of the cases, $q_{1}=q_{2}=0$ is the most efficient choice, therefore we will generalize Stern’s algorithm to $\mathbb{Z}_{4}$ in this paper. Nevertheless, using the (ball-)collision formulation allows us to use improvements and speed ups, some of which will be explained in the following, together with their complexities:

(1)

The concept of intermediate sums presented in [6] is important whenever one wants to do a computation for all vectors in a certain space. Consider, for example, the setting where we are given a binary $k\times n$ matrix $A$ and want to compute $Ax^{\top}$ for all $x\in\mathbb{F}_{2}^{n}$ , of weight $w$ . This would usually cost $k(w-1)$ additions and $w$ multiplications, for each $x\in\mathbb{F}_{2}^{n}$ . But if we first compute $Ax^{\top}$ , where $x$ has weight one, this only outputs the corresponding column of $A$ and has no costs. From there we can compute the sums of two columns of $A$ , there are $\binom{n}{2}$ many of these sums and each one costs $k$ additions. From there we can compute all sums of three columns of $A$ , which are $\binom{n}{3}$ many. Using the sums of two columns, we only need to add one more column costing $k$ additions. Proceeding in this way, until one reaches the weight $w$ , computing $Ax^{\top}$ for all $x\in\mathbb{F}_{2}^{n}$ of weight $w$ , costs $k(L(n,w)-n)$ bit operations, where

[TABLE]

Note that the we need to take away the cost of the weight one vectors, since they are for free. 2. (2)

The next concept, called early abort (also presented in [6]), is important whenever a computation is done while checking the weight of the result. For example one wants to compute $x+y$ , where $x,y\in\mathbb{F}_{2}^{n}$ , which usually costs $n$ additions, but we only proceed in the algorithm if $wt_{H}(x+y)=t$ . Hence we compute and check the weight simultaneously, and if the weight of the partial solution exceeds $t$ , we do not need to continue. For the Hamming weight one expects a randomly chosen bit to have weight 1 with probability $\frac{1}{2}$ , hence after $2t$ we should reach the wanted weight $t$ , and after $2(t+1)$ we should exceed the weight $t$ . Hence on average we expect to compute only $2(t+1)$ many bits of the solution, before we can abort. 3. (3)

The third concept is the idea of using collisions. Instead of going through all possible error vectors of weight $2v$ , fulfilling certain properties, we can split this process. For this we consider vectors of weight $v$ in one set $S$ , and vectors with disjoint weight $v$ in another set $T$ , such that two vectors in the intersection of $S$ and $T$ determine the final error vector. The exact definition of the two sets and the properties the vectors need to fulfill will become clearer when we describe the actual algorithm, but we can assume that we need to find $x,y$ from some $S\subseteq\mathbb{F}_{2}^{n}$ and $T\subseteq\mathbb{F}_{2}^{n}$ , respectively, such that $Ax^{\top}=By^{\top}+s^{\top}$ for some prescribed $A,B\in\mathbb{F}_{2}^{k\times n}$ and $s\in\mathbb{F}_{2}^{k}$ . Assuming that $x,y$ are uniformly distributed, the average amount of collisions is given by

[TABLE]

The assumption of a uniform distribution is commonly used, and justified e.g. in [6] and references therein.

The setting for the algorithm is as follows: We are given the parity check matrix $H\in\mathbb{F}_{2}^{(n-k)\times n}$ , the amount $t$ of errors we can correct and the syndrome $s\in\mathbb{F}_{2}^{n-k}$ . We want to find a vector $e\in\mathbb{F}_{2}^{n}$ , such that $\text{wt}_{H}(e)=t$ and $He^{\top}=s^{\top}$ . We are going to use all the ideas mentioned above. Stern’s algorithm over the binary in the collision formulation is given in Algorithm 2. Note that, without formulating it in detail, the concept of intermediate sums is used in lines 6 and 7, and the concept of early abort is used in line 10. The collision is used in lines 8 and 9, since it is the same $a$ in both cases.

Let us illustrate the algorithm in the easiest situation, where the information set is $I=\{1,\ldots,k\}$ and the zero window is $\{k+1,\ldots,k+\ell\}$ . We get

[TABLE]

where $A_{1}\in\mathbb{F}_{2}^{\ell\times k}$ , $A_{2}\in\mathbb{F}_{2}^{(n-k-\ell)\times k}$ and $e_{1}\in\mathbb{F}_{2}^{k},e_{2}\in\mathbb{F}_{2}^{n-k-\ell},s_{1}\in\mathbb{F}_{2}^{\ell},s_{2}\in\mathbb{F}_{2}^{n-k-\ell}$ . From this we get the conditions

[TABLE]

The part $e_{1}$ is chosen to be $\pi_{I}(e_{X}+e_{Y})$ such that it has weight $2v$ , and with the collision we ensure that the first condition is satisfied. The part $e_{2}$ is chosen such that its support is disjoint from $e_{1}$ , it has the remaining weight $t-2v$ , and the second condition is satisfied, i.e., $e_{2}=\pi_{I}(e_{X}+e_{Y})A_{2}^{\top}+s_{2}$ . Therefore

[TABLE]

i.e., $e=(e_{1},0,e_{2})$ fulfills $He^{\top}=s^{\top}$ and $wt_{H}(e)=t$ .

Theorem 11.

The average number of bit operations Algorithm 2 needs, is

[TABLE]

Proof.

(1)

As a first step we need to find the systematic form of the permuted parity check matrix, and the corresponding syndrome form. As a broad estimate we use the complexity of computing $U[H\mid s^{\top}]$ , which takes approximately $(n-k)^{2}(n+1)$ bit operations. 2. (2)

To build the set $S$ one has to compute $\pi_{I}(e_{X})A_{1}^{\top}$ for all $e_{X}\in\mathbb{F}_{2}^{n}(X)$ of weight $v$ . Using intermediate sums this costs

[TABLE] 3. (3)

The set $T$ is built similarly, since one has to compute $\pi_{I}(e_{Y})A_{1}^{\top}+s_{1}$ for all $e_{Y}\in\mathbb{F}_{2}^{n}(Y)$ of weight $v$ . Using intermediate sums this costs

[TABLE]

where $\ell\binom{m_{2}}{v}$ is the complexity of adding $s_{1}$ to $\pi_{I}(e_{Y})A_{1}^{\top}$ for each $e_{Y}\in\mathbb{F}_{2}^{n}(Y)$ of weight $v$ . 4. (4)

In the next step we want to check for collisions between the set $S$ and $T$ . The set $S$ consists of all $e_{X}$ , where $e_{X}\in\mathbb{F}_{2}^{n}(X)$ has weight $v$ . Hence $S$ is of size $\binom{m_{1}}{v}$ and similarly the set $T$ is of size $\binom{m_{2}}{v}$ . The collision lives in $\mathbb{F}_{2}^{\ell}$ , hence if we assume an uniform distribution we have to check on average

[TABLE]

many collisions. For each collision we have to compute $\pi_{I}(e_{X}+e_{Y})A_{2}^{\top}+s_{2}$ and we only proceed if the weight of this is $t-2v$ . With the method of early abort we only have to compute on average $2(t-2v+1)$ many entries. Each entry of the solution costs $2v+1$ bit operations. 5. (5)

This sums up to the cost of one iteration being

[TABLE]

The success probability is given by having chosen the correct weight distribution of the error vector, i.e. in $X$ the weight $v$ , in $Y$ the weight $v$ , and in $J$ the missing weight $t-2v$ :

[TABLE]

Hence the overall cost of this algorithm is given as in the claim by

[TABLE]

∎

3. Information set decoding over $\mathbb{Z}_{4}$

In this section we adapt our previous formulation of Lee-Brickell’s and Stern’s algorithm (in the collision formulation) for $\mathbb{Z}_{4}$ -linear codes. For both algorithms, we first formulate the algorithm and illustrate how and why they work, before we determine their complexities.

Before explaining the algorithms, we determine the complexity of computing $Ax^{\top}$ , for $x\in\mathbb{Z}_{4}^{n}$ having Lee weight $w$ and a given matrix $A\in\mathbb{Z}_{4}^{k\times n}$ , since this will be used in both algorithms.

Lemma 12.

Let $A\in\mathbb{Z}_{4}^{k\times n}$ and $x\in\mathbb{Z}_{4}^{n}$ with $wt_{L}(x)=w$ . Then computing $Ax^{\top}$ needs at most $2(w-1)k$ bit operations.

Proof.

Whenever an entry of $x$ is a $1$ , we need to add a column, and whenever it is a $3$ we need to subtract a column. Both, a column addition or subtraction, cost at most $2k$ bit operations. If the entry of $x$ is $2$ , we have to add a column twice; but the entry also has Lee weight $2$ , i.e., per Lee weight one we still get $2k$ operations. Thus, the overall complexity is $2(w-1)k$ . ∎

3.1. Lee-Brickell’s algorithm over $\mathbb{Z}_{4}$

Recall that the systematic form of the parity check matrix is permutation equivalent to (2.2). For our purpose however, it is enough to consider the systematic form as

[TABLE]

where $A\in\mathbb{Z}_{4}^{(n-k_{1}-k_{2})\times(k_{1}+k_{2})}$ and $C\in\mathbb{Z}_{2}^{k_{2}\times(k_{1}+k_{2})}$ . The algorithm is given in Algorithm 3.

To illustrate the algorithm, let us again assume that the chosen information set is $\{1,\ldots,k\}$ . Then there exists an invertible $U\in\mathbb{Z}_{4}^{(n-k_{1})\times(n-k_{1})}$ , such that

[TABLE]

where $s_{1}\in\mathbb{Z}_{4}^{n-k_{1}-k_{2}},s_{2}\in\mathbb{Z}_{2}^{k_{2}}$ and $e_{1}\in\mathbb{Z}_{4}^{k_{1}+k_{2}},e_{2}\in\mathbb{Z}_{4}^{n-k_{1}-k_{2}}$ . From this we get the conditions

[TABLE]

We will choose $e_{1}$ having Lee weight $w$ and such that the second condition is satisfied. The first condition will then be satisfied by the choice of $e_{2}$ and we check that $e_{2}$ has the remaining Lee weight $t-w$ .

3.2. Complexity analysis of Lee-Brickell’s algorithm over $\mathbb{Z}_{4}$

We now estimate the complexity of Lee-Brickell’s algorithm over $\mathbb{Z}_{4}$ . We assume that one addition or one multiplication over $\mathbb{Z}_{4}$ costs $2$ binary operations each. We remark here that if a lookup table for the multiplication and addition is used, the cost of one multiplication as well as the cost of one addition over $\mathbb{Z}_{4}$ will be only one bit. All the following costs, however, will be given without using a lookup table. Moreover, as in the binary case, we use school-book long multiplication instead of faster multiplication algorithms.

Theorem 13.

The average number of bit operations Algorithm 3 needs, is

[TABLE]

Proof.

As a first step we need to find the (permuted) quaternary systematic form of the parity check matrix, and the corresponding syndrome form. As a broad estimate we use the complexity of computing $U[H\mid s^{\top}]$ , which takes approximately $(n-k_{1})^{2}(n+1)$ quaternary operations, i.e., $2(n-k_{1})^{2}(n+1)$ bit operations.

As a next step, we compute $2\pi_{I}(e_{1})C^{\top}$ for all $e_{1}\in\mathbb{Z}_{4}^{n}(I)$ having $wt_{L}(e_{1})=w$ . With Lemma 12 this costs $2(w-1)k_{2}$ bit operations for one choice of $e_{1}$ . Analogously, we get that computing $\pi_{I}(e_{1})A^{\top}$ costs $2(w-1)(n-k_{1}-k_{2})$ bit operations. Thus, computing $s_{1}-\pi_{I}(e_{1})A^{\top}$ costs $2w(n-k_{1}-k_{2})$ bit operations. Since there are $\binom{2(k_{1}+k_{2})}{w}$ many such $e_{1}$ we get an overall cost of

[TABLE]

The success probability is given by having chosen the correct weight distribution of the error vector, i.e., weight $t$ in the information set, and the missing weight $t-w$ in $J$ :

[TABLE]

It follows that the overall cost of the algorithm is as claimed. ∎

3.3. Collision ISD (Stern’s algorithm) over $\mathbb{Z}_{4}$

As in Lee-Brickell’s algorithm, we first bring the parity check matrix into systematic form, according to the chosen information set. Because of the zero window of length $\ell$ we now split the matrix into three block rows, instead of two. If we assume that the information set is $I=\{1,\dots,k_{1}+k_{2}\}$ and the zero window is $\{k_{1}+k_{2}+1,\ldots,k_{1}+k_{2}+\ell\}$ , we get the following situation:

[TABLE]

where $s_{1}\in\mathbb{Z}_{4}^{\ell},s_{2}\in\mathbb{Z}_{4}^{n-k_{1}-k_{2}-\ell},s_{3}\in\mathbb{Z}_{2}^{k_{2}}$ and $A\in\mathbb{Z}_{4}^{\ell\times(k_{1}+k_{2})}$ ,

$B\in\mathbb{Z}_{4}^{(n-k_{1}-k_{2}-\ell)\times(k_{1}+k_{2})}$ , $C\in\mathbb{Z}_{2}^{k_{2}\times(k_{1}+k_{2})}$ and $e_{1}\in\mathbb{Z}_{4}^{k_{1}+k_{2}},e_{2}\in\mathbb{Z}_{4}^{n-k_{1}-k_{2}-\ell}$ . From this we get the conditions

[TABLE]

We will choose $e_{1}$ and $e_{2}$ having disjoint Lee weight $2v$ and $t-2v$ , respectively. In order to satisfy the first and the third condition, which only depend on $e_{1}$ , we will check for a collision in the algorithm. The second condition will be satisfied by the choice of $e_{2}$ . Thus, compared to the binary version we only get the extra conditions $2e_{1}C^{\top}=2s_{3}$ on $e_{1}$ . The rest is analogous. In fact we choose $e_{1}=\pi_{I}(e_{X}+e_{Y})$ and $e_{2}=s_{2}-e_{1}B^{\top}=s_{2}-\pi_{I}(e_{X}+e_{Y})B^{\top}$ , where $I$ is the quaternary information set, and $X$ and $Y$ are partitions of $I$ . Therefore we get

[TABLE]

The final collision algorithm is formulated in Algorithm 4. As in the binary case, we implicitly assume that we use intermediate sums in lines 6 and 7, early abort in line 10 and the speed up by using collisions in lines 8 and 9.

3.4. Complexity analysis of collision ISD over $\mathbb{Z}_{4}$

First we determine the complexities of the separate speed up concepts used in the main part of the algorithm.

(1)

Intermediate sums: The concept is the same over $\mathbb{Z}_{4}$ as over $\mathbb{F}_{2}$ . With

[TABLE]

and Lemma 12 we get that the cost of computing $Ax^{\top}$ , for all $x\in\mathbb{Z}_{4}^{n}$ of Lee weight $w$ , is $2k(\bar{L}(n,w)-2n)$ bit operations. 2. (2)

Early abort: This concept changes slightly when using the Lee weight over $\mathbb{Z}_{4}$ . On average we can expect $1/2$ of the entries to have weight 1, $1/4$ of the entries to have weight $2$ and $1/4$ of the entries to have weight 0. Hence, on average, we should reach Lee weight $t$ after $(\frac{1}{2}+2\frac{1}{4})^{-1}t=t$ additions and therefore calculate $t+1$ entries, before we can abort the computation. 3. (3)

Collisions: The average amount of collisions one needs to check between elements living in $\mathbb{Z}_{4}^{n}$ of a set $S$ and a set $T$ , under the assumption of a uniform distribution (analogously to the binary case), is given by

[TABLE]

Theorem 14.

The average number of bit operations Algorithm 4 needs, is

[TABLE]

assuming that $v\geq 1$ .

Proof.

(1)

As a first step we need to find the (permuted) quaternary systematic form of the parity check matrix, and the corresponding syndrome form. As a broad estimate we use the complexity of computing $U[H\mid s^{\top}]$ , which takes approximately $(n-k_{1})^{2}(n+1)$ quaternary operations, i.e., $2(n-k_{1})^{2}(n+1)$ bit operations. 2. (2)

To build the set $S$ one has to compute $\pi_{I}(e_{X})A^{\top}$ and $2\pi_{I}(e_{X})C^{\top}$ for all

$e_{X}\in\mathbb{Z}_{4}^{n}(X)$ of Lee weight $v$ . Using intermediate sums the former costs $2\ell(\bar{L}(m_{1},v)-2m_{1})$ and the latter costs $k_{2}(L(m_{1},v)-m_{1}+1)$ , since $C$ lives in $\mathbb{Z}_{2}^{k_{2}\times(k_{1}+k_{2})}$ and $2\pi_{I}(e_{X})$ lives in $2\mathbb{Z}_{2}^{k_{1}+k_{2}}$ . Hence, computing $S$ costs in total

[TABLE]

binary operations. 3. (3)

The set $T$ is built similarly, since one has to compute $s_{1}-\pi_{I}(e_{Y})A^{\top}$ and $2s_{3}-2\pi_{I}(e_{Y})C^{\top}$ for all $e_{Y}\in\mathbb{Z}_{4}^{n}(Y)$ of weight $v$ . Using intermediate sums we get a complexity of

[TABLE]

binary operations. 4. (4)

In the next step we want to check for the two collisions between the set $S$ and $T$ . The set $S$ consists of all $e_{X}$ , where $e_{X}\in\mathbb{Z}_{4}^{n}(X)$ has weight $v$ . Hence $S$ is of size $\binom{2m_{1}}{v}$ and similarly the set $T$ is of size $\binom{2m_{2}}{v}$ . The first collision lives in $\mathbb{Z}_{4}^{\ell}$ , whereas the second collision lives in $2\mathbb{Z}_{2}^{k_{2}}$ . We assume an uniform distribution and hence have to check on average

[TABLE]

many collisions. For each collision we have to compute $s_{2}-\pi_{I}(e_{X}+e_{Y})B^{\top}$ . With the method of early abort we only have to compute on average $t-2v+1$ entries. By Lemma 12, each entry of the solution costs $4v-2$ binary operations (assuming that $v\geq 1$ ). 5. (5)

This sums up to the cost of one iteration being

[TABLE]

The success probability is given by having chosen the correct weight distribution of the error vector, i.e. in $X$ the weight $v$ , in $Y$ the weight $v$ , and in $J$ the missing weight $t-2v$ :

[TABLE]

Hence the overall cost of this algorithm is as in the claim given by

[TABLE]

∎

4. Applications: code-based cryptosystems over $\mathbb{Z}_{4}$

In this section we state a quaternary version of the McEliece and the Niederreiter cryptosystem. For the key generation one chooses a quaternary code $\mathcal{C}$ of length $n$ and type $h=4^{k_{1}}2^{k_{2}}$ , which has an efficient decoding algorithm and is able to correct up to $t$ errors. We do not propose the use of a specific code, but we note that the secret code needs to come from a family of codes that is large enough and have a large enough error correction capacity $t$ , such that brute force attacks on these aspects are not feasible.

*Remark 15**.*

We assume without loss of generality that the message $x$ lives in $\mathbb{Z}_{4}^{k_{1}}\times\mathbb{Z}_{2}^{k_{2}}$ . Indeed, we can transform any binary string $\bar{x}\in\mathbb{F}_{2}^{2k_{1}+k_{2}}$ into this form by an invertible map before the encryption, and use the inverse map after the decryption.

4.1. Quaternary McEliece

Let $G$ be a $(k_{1}+k_{2})\times n$ generator matrix of $\mathcal{C}$ and choose an $n\times n$ permutation matrix $P$ , this matrix has no further conditions, since the change of columns does not affect the $\mathbb{Z}_{2}$ -part of the message, whereas for the $(k_{1}+k_{2})\times(k_{1}+k_{2})$ invertible matrix $S$ , we need further conditions: in the classical case over finite fields, $S$ is just a change of basis, but in the $\mathbb{Z}_{4}$ case, changing the rows of the generator matrix affects the position of $\mathbb{Z}_{2}$ -part of the message. Since such a change hinders the constructor of the cryptosystem to tell where the $\mathbb{Z}_{2}$ -part of the message should be taken, we will restrict the choice of invertible matrices to the following form: let $S_{1}$ and $S_{2}$ be $k_{1}\times k_{1}$ , respectively $k_{2}\times k_{2}$ invertible matrices over $\mathbb{Z}_{4}$ , then $S$ is given by

[TABLE]

Compute $G^{\prime}=SGP$ and publish $(k_{1},k_{2},G^{\prime},t)$ .

For the encryption, let $x=(x_{1},x_{2})$ , with $x_{1}\in\mathbb{Z}_{4}^{k_{1}}$ and $x_{2}\in\mathbb{Z}_{2}^{k_{2}}$ be the message and choose an error vector $e\in\mathbb{Z}_{4}^{n}$ of Lee weight $\text{wt}_{L}(e)\leq t$ . The cipher is computed as

[TABLE]

For the decryption one computes

[TABLE]

Since $\text{wt}_{L}(eP^{-1})\leq t$ and $SG$ generates the same code as $G$ we can use the decoding algorithm of the code to recover $xS$ and hence the message $x$ .

*Remark 16**.*

To outgo a chosen ciphertext attack (CCA) one can multiply a new permutation matrix to the public generator matrix at each new instantiation of the system, analogously to the classical McEliece system [5].

4.2. Quaternary Niederreiter

The quaternary version of the Niederreiter cryptosystem is done in a similar way by using the parity check matrix $H$ and by computing its syndromes for encryption. Since there is no restriction on the message space in the Niederreiter version, there will be no conditions needed on the permutation matrix and on the invertible matrix.

Again, one chooses a quaternary code $\mathcal{C}$ of length $n$ and type $h=4^{k_{1}}2^{k_{2}}$ , which has an efficient decoding algorithm and is able to correct up to $t$ errors.

Let $H$ be a $(n-k_{1})\times n$ parity matrix of $\mathcal{C}$ , choose an invertible $(n-k_{1})\times(n-k_{1})$ matrix $S$ , i.e. $\det(S)\in\mathbb{Z}_{4}^{\times}$ and an $n\times n$ permutation matrix $P$ .222Also here we can choose a new $P$ every time to prevent a CCA. Compute $H^{\prime}=S^{-1}HP$ and publish $(k_{1},k_{2},H^{\prime},t)$ .

For the encryption, let $x\in\mathbb{Z}_{4}^{n}$ be the message of Lee weight $\text{wt}_{L}(x)\leq t$ . The cipher is computed as

[TABLE]

For the decryption one computes

[TABLE]

Since $\text{wt}_{L}(Px^{\top})\leq t$ we can use the decoding algorithm of the code to recover $Px^{\top}$ and hence the message $x$ .

4.3. Key size

To determine the key size we need to count the number of non-prescribed entries of the public generator matrix. For this we assume that the generator matrix is published in quaternary systematic form as in (2.1).

This allows us to compute the size of the generator matrix in the form (2.1), or equivalently the size of the parity check matrix in the form (2.2).

Theorem 17.

The size of the public key, given by the non-prescribed parts of either the generator matrix (2.1) or the parity check matrix (2.2), is

[TABLE]

bits.

In the following we study the key sizes of the proposed cryptographic scheme in Section 4 with respect to a given security level against Algorithm 4 provided in Section 2.2.

Two of the most studied families of $\mathbb{Z}_{4}$ -linear codes are Kerdock and Preparata codes [21]. Because of their small minimum distance Preparata codes are not useful for our cryptosystems. Even though Kerdock codes over $\mathbb{Z}_{4}$ satisfy all the conditions needed for the quaternary version of the McEliece cryptosystem, they seem to be a bad choice for key size reasons: while the key size of the cryptosystems doubles going from code length $n=2^{m}$ to $2^{m+1}$ , the security level only increases by 3 bits.

For now we leave it as an open problem to find suitable codes for the use in a Lee-metric public key cryptosystem, but we remark that many constructions of Lee codes are known, e.g., [7, 10, 17, 21, 22, 25, 36, 38, 43, 47]. For the remainder of this paper we will use only theoretical parameters, to illustrate how using the Lee metric could potentially decrease the key sizes in a McEliece or Niederreiter type cryptosystem. We consider quaternary codes achieving the Gilbert-Varshamov bound in the Lee metric, i.e., codes of length $n$ and Lee weight $d$ whose cardinality is at least

[TABLE]

*Example 18**.*

As a first example we examine codes of length $n=150$ and minimum Lee distance $d=81$ , i.e., we can set $t=40$ . The Gilbert-Varshamov bound tells us that such codes with $\mathbb{Z}_{4}$ -dimension $26=k_{1}+k_{2}/2$ exist. We now vary $k_{1}$ from $1$ to $25$ , with $k_{2}=2(26-k_{1})$ . Furthermore, we set $m_{1}=\lceil(k_{1}+k_{2})/2\rceil,m_{2}=\lfloor(k_{1}+k_{2})/2\rfloor$ and we optimize on the size $\ell$ of the zero-window and the number $2v$ of errors in the information set. With these parameters we get the following key sizes and security levels in bits, see Table 1.

Note that the above security levels were computed using Algorithm 4, which always outperforms Algorithm 3 on a classical computer. For comparison, a binary code of length $2n=300$ , dimension $k=26$ and minimum Hamming distance $d=81$ gives a key size of $7124$ and a security level of $27$ bits with the binary version of Stern’s algorithm. Hence, depending on $k_{1}$ we get at least the same security level with a key size improvement of around $10-28\%$ , when using Lee codes over $\mathbb{Z}_{4}$ .333 For further comparison, binary codes achieving the Gilbert-Varshamov bound of length $2n=300$ and dimension $k=26$ have minimum distance $d=102$ and achieve a security level of $28$ bits with a key size of $7124$ bits.

In the next example we find codes that theoretically achieve a security level of $128$ bits, against the adaptation of the collision ISD algorithm.

*Example 19**.*

Given the relative distance $d/n=0.2$ , using an optimization on the size of $v$ and $\ell$ we search for a minimal code length $n$ , such that a $k_{1}$ exists with which the security level of 128 bits is reached. We get $n=425,k=229,k_{1}=33,k_{2}=392,t=42,v=21,\ell=0$ and key size of 12936 bits.

*Remark 20**.*

The previously obtained theoretical values give much smaller public keys than the classical McEliece system with binary Goppa codes achieves. For this note that for the security level of 128 bits, the proposed parameters for the McEliece system using Goppa codes by Bernstein et al. in [5] are $n=2960,k=2288$ , which gives a key size of $1537536$ bits. In fact the theoretical key sizes presented here are within the range of quasi-cyclic MDPC codes, which were submitted to NIST for post-quantum code-based cryptosystem (from 10 to 37 kilobits, see https://csrc.nist.gov/projects/post-quantum-cryptography/round-2-submissions).

5. Generalization from $\mathbb{Z}_{4}$ to $\mathbb{Z}_{p^{s}}$

In this section we give the general idea of how to generalize the ISD algorithm and the two code-based cryptosystems to any Galois ring $\mathbb{Z}_{p^{s}}$ for any prime $p$ and $s\in\mathbb{N}$ . Recall that the Lee weight of $x\in\mathbb{Z}_{p^{s}}^{n}$ is given by

[TABLE]

The main modification is in the systematic form of the generator and parity check matrix of the code. In general, a linear code over $\mathbb{Z}_{p^{s}}$ has a (column permuted) generator matrix of the form

[TABLE]

and a (column permuted) parity check matrix of the form

[TABLE]

where $K=\sum_{i=1}^{s}k_{i}$ and the matrices live in

[TABLE]

We say that such a code has type $(p^{s})^{k_{1}}(p^{s-1})^{k_{2}}\dots p^{k_{s}}$ . This is also the cardinality of the code, and the uniquely encodable messages are of the form $(m_{1},m_{2},\dots,m_{s})\in\mathbb{Z}_{p^{s}}^{k_{1}}\times\mathbb{Z}_{p^{s-1}}^{k_{2}}\times\dots\times\mathbb{Z}_{p}^{k_{s}}$ . If our code has length $n$ , an information set is a set $I\subseteq\{1,\dots,n\}$ of size $K$ such that $|\mathcal{C}_{I}|=|\mathcal{C}|$ .

5.1. Information set decoding over $\mathbb{Z}_{p^{s}}$

One can set up an ISD algorithm analogously to Algorithm 4. Instead of three conditions on $e_{1}$ and $e_{2}$ we then get $s+1$ conditions on $e_{i}$ for $i\in\{1,\ldots s\}$ , where $e_{s}$ is only part of one condition. For $e_{i}$ with $i\in\{1,\ldots s-1\}$ to satisfy the $s$ conditions, that are not involving $e_{s}$ , one needs to compute similar sets $S_{i}$ for $i\in\{1,\ldots,s-1\}$ consisting of $s$ tuples, find the collisions between them, and lastly choose $e_{s}$ satisfying the remaining condition. In the appendix we exemplify the described algorithm over $\mathbb{Z}_{8}$ . Note that this ISD algorithm is different to the Lee metric ISD algorithm proposed in [46]444[46] appeared as a follow-up of this work., as there the systematic form is considered to be

[TABLE]

with $A\in\mathbb{Z}_{p^{s}}^{(n-K)\times K}$ and $B\in\mathbb{Z}_{p^{s-1}}^{(K-k_{1})\times K}.$ This choice of systematic form clearly makes the ISD algorithm easier to understand, but does not take into account the particular form of the parity check matrix. We leave it as an open problem to compare the benefits of the two different algorithms.

5.2. Code-based cryptosystems over $\mathbb{Z}_{p^{s}}$

The Niederreiter system does not need a modification of 4.2 to be used over any $\mathbb{Z}_{p^{s}}$ . In the McEliece cryptosystem 4.1 one just needs to make sure that the invertible matrix $S$ has the correct block diagonal structure to prevent mixing the subcodes that live in different subrings. The rest stays the same.

For the size of the public key note that you can either publish the generator or the parity check matrix. However, it turns out that both ways give you the same key size. The key size in bits related to the generator matrix $G$ as in (5.1) (or equivalently related to the parity check matrix $H$ as in (5.2)) is

[TABLE]

6. Conclusion

The change from the Hamming metric to the rank metric has recently received a lot of attention in the code-based cryptography community, since the key sizes are very promising. Following this idea, we propose the change to the Lee metric and the ring-linear codes related to this metric. In this paper we built the framework for the use of quaternary codes in code-based cryptography by generalizing Lee-Brickell’s and Stern’s ISD algorithm to $\mathbb{Z}_{4}$ . This paper also gives the general form of the quaternary version of the McEliece and the Niederreiter cryptosystem.

Here we provide some questions, which might lead to interesting applications and further understanding of ring-linear codes and the Lee metric from a cryptographic point of view. Even though we restricted the focus in this paper to the case $\mathbb{Z}_{4}$ , and explained shortly how to generalize this to $\mathbb{Z}_{p^{s}}$ , it is possible and it might be interesting to generalize this to $\mathbb{Z}_{m}$ , for any $m$ . It is possible that some of the ISD algorithms have a structure that correlates better to the Lee metric, hence there might be other ISD algorithms which should be generalized to $\mathbb{Z}_{4}$ . And the most important question in order to have an application in cryptography is: which codes might be used for the quaternary version of the McEliece cryptosystem, such that the conditions for the cryptosystem are satisfied and the key size is reasonable?

Acknowledgments

We would like to thank Karan Khathuria for fruitful discussions and technical support.

Appendix

Here we describe the ISD algorithm from Section 5 over $\mathbb{Z}_{8}$ . We consider a code $\mathcal{C}\subseteq\mathbb{Z}_{8}^{n}$ of type $\mid\mathcal{C}\mid=8^{k_{1}}4^{k_{2}}2^{k_{3}}$ , and define $K:=k_{1}+k_{2}+k_{3}$ . For simplicity let us assume that the information set is $I=\{1,\dots,K\}$ with $I_{1}=\{1,\ldots,k_{1}+k_{2}\}$ , $I_{2}=\{k_{1}+k_{2}+1,\ldots,K\}$ and the zero window is $\{K+1,\ldots,K+\ell\}$ . We first bring the parity check matrix into systematic form, according to the chosen information set, and get:

[TABLE]

where $s_{1}\in\mathbb{Z}_{8}^{\ell},s_{2}\in\mathbb{Z}_{8}^{n-K-\ell},s_{3}\in\mathbb{Z}_{4}^{k_{3}},s_{4}\in\mathbb{Z}_{2}^{k_{2}}$ and $A\in\mathbb{Z}_{8}^{\ell\times(k_{1}+k_{2})}$ , $B\in\mathbb{Z}_{8}^{\ell\times k_{3}}$ , $C\in\mathbb{Z}_{8}^{(n-K-\ell)\times(k_{1}+k_{2})},D\in\mathbb{Z}_{8}^{(n-K-\ell)\times k_{3}},E\in\mathbb{Z}_{4}^{k_{3}\times(k_{1}+k_{2})},F\in\mathbb{Z}_{2}^{k_{2}\times(k_{1}+k_{2})}$ and $e_{1}\in\mathbb{Z}_{8}^{k_{1}+k_{2}},e_{2}\in\mathbb{Z}_{8}^{k_{3}},e_{3}\in\mathbb{Z}_{8}^{n-K-\ell}$ . From this we get the conditions

[TABLE]

We will choose $e_{1}$ and $e_{2}$ disjoint both having Lee weight $v$ and $e_{3}$ having Lee weight $t-2v$ . In order to satisfy the first, the third and the fourth condition, which only depend on $e_{1}$ and $e_{2}$ , we will check for a collision within the algorithm. The second condition will be satisfied by choosing $e_{3}=s_{2}-e_{1}C^{\top}-e_{2}D^{\top}$ . The algorithm is provided in Algorithm 5.

Bibliography47

The reference list from the paper itself. Each links out to its DOI / PubMed record.

1[1] Edward F. Assmus and Harold F. Mattson. Error-correcting codes: an axiomatic approach. Information and Control , 6(4):315–330, 1963.
2[2] Anja Becker, Antoine Joux, Alexander May, and Alexander Meurer. Decoding random binary linear codes in 2 n / 20 superscript 2 𝑛 20 2^{n/20} : How 1+ 1= 0 improves information set decoding. In Annual International Conference on the Theory and Applications of Cryptographic Techniques , pages 520–536. Springer, 2012.
3[3] Elwyn Berlekamp. Algebraic coding theory . World Scientific, 1968.
4[4] Daniel J Bernstein. Grover vs. Mc Eliece. In International Workshop on Post-Quantum Cryptography , pages 73–80. Springer, 2010.
5[5] Daniel J Bernstein, Tanja Lange, and Christiane Peters. Attacking and defending the Mc Eliece cryptosystem. In International Workshop on Post-Quantum Cryptography , pages 31–46. Springer, 2008.
6[6] Daniel J. Bernstein, Tanja Lange, and Christiane Peters. Smaller decoding exponents: ball-collision decoding. In Annual Cryptology Conference , pages 743–760. Springer, 2011.
7[7] Thomas Blackford. Cyclic codes over ℤ 4 subscript ℤ 4 \mathbb{Z}_{4} of oddly even length. Discrete Applied Mathematics , 128(1):27–46, 2003.
8[8] Ian F. Blake. Codes over certain rings. Information and Control , 20(4):396–404, 1972.

TL;DR

Contribution

Findings

Abstract

Peer Reviews

Videos

Information Set Decoding in the Lee Metric with Applications to Cryptography

Abstract.

Key words and phrases:

2010 Mathematics Subject Classification:

1. Introduction

2. Preliminaries

2.1. Ring-linear coding theory

Definition 1**.**

Definition 2**.**

Definition 3**.**

Definition 4**.**

Definition 5**.**

Definition 6**.**

Proposition 7** ([21]).**

Proposition 8** (Theorem 13.73, [3]).**

2.2. Information set decoding algorithms

Remark 9*.*

Theorem 10**.**

Proof.

Theorem 11**.**

Proof.

3. Information set decoding over Z4\mathbb{Z}_{4}Z4​

Lemma 12**.**

Proof.

3.1. Lee-Brickell’s algorithm over Z4\mathbb{Z}_{4}Z4​

3.2. Complexity analysis of Lee-Brickell’s algorithm over Z4\mathbb{Z}_{4}Z4​

Theorem 13**.**

Proof.

3.3. Collision ISD (Stern’s algorithm) over Z4\mathbb{Z}_{4}Z4​

3.4. Complexity analysis of collision ISD over Z4\mathbb{Z}_{4}Z4​

Theorem 14**.**

Proof.

4. Applications: code-based cryptosystems over Z4\mathbb{Z}_{4}Z4​

Remark 15*.*

4.1. Quaternary McEliece

Remark 16*.*

4.2. Quaternary Niederreiter

4.3. Key size

Theorem 17**.**

Example 18*.*

Example 19*.*

Remark 20*.*

5. Generalization from Z4\mathbb{Z}_{4}Z4​ to Zps\mathbb{Z}_{p^{s}}Zps​

5.1. Information set decoding over Zps\mathbb{Z}_{p^{s}}Zps​

5.2. Code-based cryptosystems over Zps\mathbb{Z}_{p^{s}}Zps​

6. Conclusion

Acknowledgments

Appendix

Definition 1.

Definition 2.

Definition 3.

Definition 4.

Definition 5.

Definition 6.

Proposition 7 ([21]).

Proposition 8 (Theorem 13.73, [3]).

*Remark 9**.*

Theorem 10.

Theorem 11.

3. Information set decoding over $\mathbb{Z}_{4}$

Lemma 12.

3.1. Lee-Brickell’s algorithm over $\mathbb{Z}_{4}$

3.2. Complexity analysis of Lee-Brickell’s algorithm over $\mathbb{Z}_{4}$

Theorem 13.

3.3. Collision ISD (Stern’s algorithm) over $\mathbb{Z}_{4}$

3.4. Complexity analysis of collision ISD over $\mathbb{Z}_{4}$

Theorem 14.

4. Applications: code-based cryptosystems over $\mathbb{Z}_{4}$

*Remark 15**.*

*Remark 16**.*

Theorem 17.

*Example 18**.*

*Example 19**.*

*Remark 20**.*

5. Generalization from $\mathbb{Z}_{4}$ to $\mathbb{Z}_{p^{s}}$

5.1. Information set decoding over $\mathbb{Z}_{p^{s}}$

5.2. Code-based cryptosystems over $\mathbb{Z}_{p^{s}}$