Syndrome Decoding Estimator

Esser, Andre; Bellini, Emanuele

doi:10.1007/978-3-030-97121-2_5

Cited by 22 publications

(21 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As a result, contrary to the existing asymptotic results, we confirmed that the MMT algorithm (asymptotic runtime: 2 0.112𝑛 ) is faster than BJMM (2 0.102𝑛 ) for several memory sizes, including those suitable for current midrange PC/Servers. Additionally, as confirmed in [10], we showed that the May-Ozerov (MO) algorithm (2 0.953𝑛 ) has a smaller runtime than Both-May (BM) (2 0.0885𝑛 ) for some memory sizes and instances.…”

Section: Contributionssupporting

confidence: 56%

“…In this paper, we analyze the actual time complexity of major ISD algorithms under the limitation of memory using a syndrome decoding estimator [10]. We also derive the optimal parameters of each ISD algorithm applicable to real SDP instances, containing a difficulty level of approximately 2 50 , which corresponds to the highest dimension of SDP actually solved up to now (August 2021).…”

Section: Contributionsmentioning

confidence: 99%

“…Then, 𝐿 1 and 𝐿 2 are merged using an NN algorithm. For the NN algorithm, we use the meet-in-the-middle (MITM) algorithm used in [6] and the locality sensitive hashing (LSH)-based algorithm proposed in [10]. The following theorem is known about the time complexity of these NN algorithms: Theorem 1.…”

Section: May-ozerovmentioning

confidence: 99%

“…In addition to ISD, several papers provided a computational analysis of more general decoding techniques [7,8,9]. There is also work on an estimator that analyzes the actual time complexity of ISDs for SDPs with practical problem sizes associated with real cryptosystems [10,11,12,13].…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Multiparallel MMT: Faster ISD Algorithm Solving High-Dimensional Syndrome Decoding Problem

Narisada

Fukushima

Kiyomoto

2023

IEICE Trans. Fundamentals

View full text Add to dashboard Cite

The hardness of the syndrome decoding problem (SDP) is the primary evidence for the security of code-based cryptosystems, which are one of the finalists in a project to standardize post-quantum cryptography conducted by the U.S. National Institute of Standards and Technology (NIST-PQC). Information set decoding (ISD) is a general term for algorithms that solve SDP efficiently. In this paper, we conducted a concrete analysis of the time complexity of the latest ISD algorithms under the limitation of memory using the syndrome decoding estimator proposed by Esser et al. As a result, we present that theoretically nonoptimal ISDs, such as May-Meurer-Thomae (MMT) and May-Ozerov, have lower time complexity than other ISDs in some actual SDP instances. Based on these facts, we further studied the possibility of multiple parallelization for these ISDs and proposed the first GPU algorithm for MMT, the multiparallel MMT algorithm. In the experiments, we show that the multiparallel MMT algorithm is faster than existing ISD algorithms. In addition, we report the first successful attempts to solve the 510-, 530-, 540-and 550-dimensional SDP instances in the Decoding Challenge contest using the multiparallel MMT.

show abstract

Section: Contributionssupporting

confidence: 56%

Section: Contributionsmentioning

confidence: 99%

Section: May-ozerovmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Multiparallel MMT: Faster ISD Algorithm Solving High-Dimensional Syndrome Decoding Problem

Narisada

Fukushima

Kiyomoto

2023

IEICE Trans. Fundamentals

View full text Add to dashboard Cite

show abstract

“…The decisional version of the SDP, also known as the coset weight problem, belongs to the class of NP-complete problems [1]. Hence, all the existing algorithms for solving SDP are exponential in the code parameters [34], [35], [36], [37], [14]. Algorithms for solving the SDP include [38], [39], [40], [41], [42], [43], [44], [10], [11], [12], [13].…”

Section: Definition 1 (Binary Syndrome Decoding Problem Sdp)mentioning

confidence: 99%

Profiled Side-Channel Attack on Cryptosystems Based on the Binary Syndrome Decoding Problem

Colombier

Drăgoi

Cayrel

et al. 2022

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

The NIST standardization process for post-quantum cryptography has been drawing the attention of researchers to the submitted candidates. One direction of research consists in implementing those candidates on embedded systems and that exposes them to physical attacks in return. The Classic McEliece cryptosystem, which is among the four finalists of round 3 in the Key Encapsulation Mechanism category, builds its security on the hardness of the syndrome decoding problem, which is a classic hard problem in code-based cryptography. This cryptosystem was recently targeted by a laser fault injection attack leading to message recovery. Regrettably, the attack setting is very restrictive and it does not tolerate any error in the faulty syndrome. Moreover, it depends on the very strong attacker model of laser fault injection, and does not apply to optimised implementations of the algorithm that make optimal usage of the machine words capacity. In this article, we propose a to change the angle and perform a message-recovery attack that relies on side-channel information only. We improve on the previously published work in several key aspects. First, we show that sidechannel information, obtained with power consumption analysis, is sufficient to obtain an integer syndrome, as required by the attack framework. This is done by leveraging classic machine learning techniques that recover the Hamming weight information very accurately. Second, we put forward a computationallyefficient method, based on a simple dot product and informationset decoding algorithms, to recover the message from the, possibly inaccurate, recovered integer syndrome. Finally, we present a masking countermeasure against the proposed attack.

show abstract