Polar codes form a very powerful family of codes with a low complexity decoding algorithm that attains many information theoretic limits in error correction and source coding. These codes are closely related to Reed-Muller codes because both can be described with the same algebraic formalism, namely they are generated by evaluations of monomials. However, finding the right set of generating monomials for a polar code which optimises the decoding performances is a nontrivial task and is channel dependent. The purpose of this paper is to reveal some universal properties of these monomials. We will namely prove that there is a way to define a nontrivial (partial) order on monomials so that the monomials generating a polar code devised for a binary-input symmetric channel always form a decreasing set. We call such codes decreasing monomial codes. The fact that polar codes are decreasing monomial codes turns out to have rather deep consequences on their structure. Indeed, we show that decreasing monomial codes have a very large permutation group by proving that it contains a group called lower triangular affine group. Furthermore, the codewords of minimum weight correspond exactly to the orbits of the minimum weight codewords that are obtained from evaluations of monomials of the generating set. In particular, it gives an efficient way of counting the number of minimum weight codewords of a decreasing monomial code and henceforth of a polar code. Index TermsPolar codes, Reed-Muller codes, capacity-achieving codes, decreasing monomial codes, lower triangular affine group, post-quantum cryptography.I. INTRODUCTION Polar codes and Reed Muller codes viewed as monomial codes. Polar codes were discovered by Arıkan [1] and form a very powerful family of codes that gave a nice constructive way of attaining many information theoretic limits in error correction and source coding. In particular, they allow to attain the capacity of any symmetric memoryless channel with a low complexity decoding algorithm (namely the successive cancellation decoder of Arıkan). These codes are closely related to Reed-Muller codes in the sense that they can both be described with the same algebraic formalism, namely as monomial codes. Monomial codes are evaluation codes where a specific set of monomials provides a generator matrix. A Reed-Muller code R(r, m) is generated by the evaluation over F m 2 of all monomials degree at most r in m variables. A polar code of length 2 m is also generated by evaluation of monomials, but not necessarily by the same monomials as a Reed-Muller code: if we want a polar code of a certain dimension for a certain channel, we are going to take a very specific set of monomials which is in general significantly different from the Reed-Muller choice. This choice will give good performances for the Arıkan successive cancellation decoder. It turns out that this decoder is very closely related to Dumer's recursive algorithm for decoding Reed-Muller codes [2] based on the (u|u + v) decomposition. Basically Dumer's de...

No abstract

a b s t r a c tA fundamental problem in computer science is that of finding all the common zeros of m quadratic polynomials in n unknowns over F 2 . The cryptanalysis of several modern ciphers reduces to this problem. Up to now, the best complexity bound was reached by an exhaustive search in 4 log 2 n2 n operations. We give an algorithm that reduces the problem to a combination of exhaustive search and sparse linear algebra. This algorithm has several variants depending on the method used for the linear algebra step. We show that, under precise algebraic assumptions on the input system, the deterministic variant of our algorithm has complexity bounded by O(2 0.841n ) when m = n, while a probabilistic variant of the Las Vegas type has expected complexity O(2 0.792n ). Experiments on random systems show that the algebraic assumptions are satisfied with probability very close to 1. We also give a rough estimate for the actual threshold between our method and exhaustive search, which is as low as 200, and thus very relevant for cryptographic applications.

No abstract

We study the complexity of Gröbner bases computation, in particular in the generic situation where the variables are in simultaneous Noether position with respect to the system.We give a bound on the number of polynomials of degree d in a Gröbner basis computed by Faugère's F 5 algorithm ([Fau02]) in this generic case for the grevlex ordering (which is also a bound on the number of polynomials for a reduced Gröbner basis, independently of the algorithm used). Next, we analyse more precisely the structure of the polynomials in the Gröbner bases with signatures that F 5 computes and use it to bound the complexity of the algorithm.Our estimates show that the version of F 5 we analyse, which uses only standard Gaussian elimination techniques, outperforms row reduction of the Macaulay matrix with the best known algorithms for moderate degrees, and even for degrees up to the thousands if Strassen's multiplication is used. The degree being fixed, the factor of improvement grows exponentially with the number of variables.

Polar codes discovered by Arikan form a very powerful family of codes attaining many information theoretic limits in the fields of error correction and source coding. They have in particular much better decoding capabilities than Goppa codes which places them as a serious alternative in the design of both a public-key encryption schemeà la McEliece and a very efficient signature scheme. Shrestha and Kim proposed in 2014 to use them in order to come up with a new code-based public key cryptosystem. We present a key-recovery attack that makes it possible to recover a description of the permuted polar code providing all the information required for decrypting any message.

We study the isochronicity of centers at $O\in \mathbb{R}^2$ for systems $$\dot x=-y+A(x,y),\;\dot y=x+B(x,y),$$ where $A,\;B\in \mathbb{R}[x,y]$, which can be reduced to the Li\'enard type equation. When $deg(A)\leq 4$ and $deg(B) \leq 4$, using the so-called C-algorithm we found $36$ new families of isochronous centers. When the Urabe function $h=0$ we provide an explicit general formula for linearization. This paper is a direct continuation of \cite{BoussaadaChouikhaStrelcyn2010} but can be read independantly

Rank-metric code-based cryptography relies on the hardness of decoding a random linear code in the rank metric. The Rank Support Learning problem (RSL) is a variant where an attacker has access to N decoding instances whose errors have the same support and wants to solve one of them. This problem is for instance used in the Durandal signature scheme [5]. In this paper, we propose an algebraic attack on RSL which clearly outperforms the previous attacks to solve this problem. We build upon [8], where similar techniques are used to solve MinRank and RD. However, our analysis is simpler and overall our attack relies on very elementary assumptions compared to standard Gröbner bases attacks. In particular, our results show that key recovery attacks on Durandal are more efficient than was previously thought.keywords Post-quantum cryptography -rank metric code-based cryptographyalgebraic attack.