On the number of solutions to a random instance of the permuted kernel problem

TL;DR

This paper provides rigorous formulas for the expected number of solutions to random instances of the Permuted Kernel Problem, which is crucial for assessing the security of post-quantum cryptographic schemes based on this problem.

Contribution

It offers the first rigorous derivation of exact formulas for the expected solutions to the PKP and IPKP, improving upon previous heuristic estimates.

Findings

Exact formulas for the expected number of solutions to PKP and IPKP.

Validation of formulas under two natural random instance generation methods.

Implications for security analysis of post-quantum cryptographic schemes.

Abstract

The Permuted Kernel Problem (PKP) is a problem in linear algebra that was first introduced by Shamir in 1989. Roughly speaking, given an $\ell \times m$ matrix $\mathbf{A}$ and an $m \times 1$ vector $\mathbf{b}$ over a finite field of $q$ elements $\mathbb{F}_q$, the PKP asks to find an $m \times m$ permutation matrix $\mathbf{\pi}$ such that $\mathbf{\pi} \mathbf{b}$ belongs to the kernel of $\mathbf{A}$. In recent years, several post-quantum digital signature schemes whose security can be provably reduced to the hardness of solving random instances of the PKP have been proposed. In this regard, it is important to know the expected number of solutions to a random instance of the PKP in terms of the parameters $q,\ell,m$. Previous works have heuristically estimated the expected number of solutions to be $m! / q^\ell$. We provide, and rigorously prove, exact formulas for the expected number of solutions to a random instance of the PKP and the related Inhomogeneous Permuted Kernel Problem (IPKP), considering two natural ways of generating random instances.