Improved Information Set Decoding for Code-Based Cryptosystems with Constrained Memory

A family of error-correcting codes is list-decodable from error fraction $p$ if, for every code in the family, the number of codewords in any Hamming ball of fractional radius $p$ is less than some integer $L$ that is independent of the code length. It is said to be list-recoverable for input $\ell$ if for every sufficiently large subset of codewords (of $L$ or more), there is a coordinate where the codewords take more than $\ell$ values. The parameter $L$ is said to be the list size in either case. The capacity, i.e., the largest possible rate for these notions as the $L \to \infty$, is known to be $1-h_q(p)$ for list-decoding, and $1-\log_q \ell$ for list-recovery, where $q$ is the alphabet of the code family. In this work, we study the of random linear codes for both list-decoding and list-recovery as the rate approaches capacity. We show the following claims hold with high probability over the choice of the code (below, $\epsilon > 0$ is the gap to capacity). (1) A random linear code of rate $1 - \log_q(\ell) - \epsilon$ requires $L \ge \ell^{\Omega(1/\epsilon)}$ for list-recovery from input $\ell$. This is surprisingly in contrast to completely random codes, where $L = O(\ell/\epsilon)$ suffices w.h.p. (2) A random linear code of rate $1 - h_q(p) - \epsilon$ requires $L \ge \lfloor h_q(p)/\epsilon+0.99 \rfloor$ for list-decoding from error fraction $p$, when $\epsilon$ is sufficiently small. (3) A random binary linear code of rate $1 - h_2(p) - \epsilon$ is list-decodable from average error fraction $p$ with with $L \leq \lfloor h_2(p)/\epsilon \rfloor + 2$. The second and third results together precisely pin down the sizes for binary random linear codes for both list-decoding and average-radius list-decoding to three possible values.

Decoding random linear codes is a well studied problem with many applications in complexity theory and cryptography. The security of almost all coding and LPN/LWE-based schemes relies on the assumption that it is hard to decode random linear codes. Recently, there has been progress in improving the running time of the best decoding algorithms for binary random codes. The ball collision technique of Bernstein, Lange and Peters lowered the complexity of Stern’s information set decoding algorithm to 20.0556n. Using representations this bound was improved to 20.0537n by May, Meurer and Thomae. We show how to further increase the number of representations and propose a new information set decoding algorithm with running time 20.0494n.KeywordsInformation Set DecodingRepresentation Technique

The problem of analyzing the finite-length scaling behavior of sparse random linear codes is considered. Random linear codes with random generator matrices whose entries are picked according to i.i.d. Bernoulli distribution with parameter q = o(1) are called sparse. The parameter q is referred to as the sparsity of the random linear code. We develop a methodology to show the optimality of the scaling exponent of uniform random linear codes, i.e., q = 1/2, with high probability. The results are then extended to sparse random linear codes with sparsity q = Θ(n−1/2), where n is the code block length. The encoding complexity of such sparse random linear codes is reduced from O(n2), in uniform random linear codes, to O(n 3/2). It is also conjectured that q = log n/n is the lowest sparsity of random linear codes with optimal scaling exponent. The connection of these results to an open problem regarding finding binary polar codes with optimal scaling exponent are also discussed. In particular, we point out that as the size of the polarization kernel increases it can be used as the generator matrix for a code with optimal scaling exponent, without the need to do further polarization.

The combination of non-orthogonal multiple access (NOMA) and transmit antenna selection (TAS) techniques has recently attracted significant attention due to the low cost, low complexity, and high diversity gains. Meanwhile, random linear coding (RLC) is considered to be a promising technique for achieving high reliability and low latency in multicast communications. In this paper, we consider a downlink system with a multi-antenna base station and two multicast groups of single-antenna users, where one group can afford to be served opportunistically, while the other group consists of comparatively low-power devices with limited processing capabilities that have strict quality of service (QoS) requirements. In order to boost reliability and satisfy the QoS requirements of the multicast groups, we propose a cross-layer framework, including NOMA-based TAS at the physical layer and RLC at the application layer. In particular, two low-complexity TAS protocols for NOMA are studied in order to exploit the diversity gain and meet the QoS requirements. In addition, RLC analysis aims to facilitate heterogeneous users, such that sliding window-based sparse RLC is employed for computational restricted users, and conventional RLC is considered for others. Theoretical expressions that characterize the performance of the proposed framework are derived and verified through simulation results.

We introduce <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">alphabet-permutation (AP) codes</i>, a new family of error-correcting codes defined by iteratively applying random coordinate-wise permutations to a fixed initial word. A special case recovers random additive codes and random binary linear codes, where each permutation corresponds to an additive shift over a finite field. We show that when these permutations are drawn from a suitably “mixing” distribution, the resulting code is almost surely list-recoverable with list size proportional to the inverse of the gap to capacity. Compared to any linear code, our construction achieves exponentially smaller list sizes at the same rate. Previously, only fully random codes were known to attain such parameters, requiring exponentially many random bits and offering no structure. In contrast, AP codes are structured and require only polynomially many random bits—providing the first such construction to match the list-recovery guarantees of random codes.

It is well known that a random q-ary code of rate Ω(e2) is list decodable up to radius (1 - 1/q - e) with list sizes on the order of 1/e2, with probability 1 - o(1). However, until recently, a similar statement about random linear codes has until remained elusive. In a recent paper, Cheraghchi, Guruswami, and Velingker show a connection between list decodability of random linear codes and the Restricted Isometry Property from compressed sensing, and use this connection to prove that a random linear code of rate Ω( e2 /log3(1/e)) achieves the list decoding properties above, with constant probability. We improve on their result to show that in fact we may take the rate to be Ω(e2), which is optimal, and further that the success probability is 1 - o(1), rather than constant. As an added benefit, our proof is relatively simple. Finally, we extend our methods to more general ensembles of linear codes. As an example, we show that randomly punctured Reed-Muller codes have the same list decoding properties as the original codes, even when the rate is improved to a constant.

A random linear code has good minimal distance with high probability. The conjectured intractability of decoding random linear codes has recently found many applications in cryptography. One disadvantage of random linear codes is that their encoding complexity grows quadratically with the message length. Motivated by this disadvantage, we present a randomized construction of linear error-correcting codes which can be encoded in linear time and yet enjoy several useful features of random linear codes. Our construction is based on a linear-time computable hash function due to Ishai, Kushilevitz, Ostrovsky and Sahai [25].

We propose a novel scheme based on compressive sensing and sparse recovery to boost the performance of cross-packet random linear coding (RLC) by incorporating the partial packets in the decoding algorithm. In conventional RLC schemes, to successfully decode the packets the receiver needs to collect a certain number of correct innovative encoded packets. During this process, there are usually a lot of partially correct packets that are discarded. Our objective is to recover the errors in the partial packets to decrease the total transmitted packets to improve the performance in terms of throughput and energy efficiency. Assuming a systematic RLC, we first formulate this problem in form of a standard sparse recovery problem where the channel errors are sparsely distributed within the packets. Then we show that to correct a certain number of errors at the receiver, the minimum required number of transmitted packets is lower-bounded by the number of partial packets. We show that by correcting and exploiting the partial packets, the required number of RLC transmit packets to successfully deliver a given generation is reduced by typically 57% in comparison with the conventional scheme.

ABSTRACTNetwork coding (NC) has showed to be beneficial to improve transmission performance in wireless mesh networks. Random linear coding is usually applied as the default coding schema. However, random linear coding causes significant decoding delay and jitter at receiver. Further, current NC does not support weight assignment to original packets, which is however indispensable for popular applications such as quality of service control and multipath media streaming in wireless mesh networks. Partial network coding (PNC) can largely reduce decoding delay and receiving fluctuation while keeping the benefit of NC. However, PNC does not support weight‐based data replacement and weight assignment to original packets. In this work, we propose weighted partial network coding (WPNC), which is a generalized coding schema of PNC. WPNC inherits all merits of PNC and part of NC. With WPNC, both decoding delay and receiving fluctuation will be reduced as observed in PNC. Also, WPNC is quite suitable for those applications that require weight assignment to original packets. After providing the whole framework of WPNC and thorough theoretical analysis to its performance, we have demonstrated how WPNC can be integrated with quality of service control and multipath routing supported media streaming in wireless mesh networks. Performance of WPNC is inter‐validated by both theoretical analysis and numeric evaluations. Copyright © 2011 John; Wiley &amp; Sons, Ltd.

In this paper we consider usage of sparse random linear codes (RLC) for data transmission in wireless sensor networks, which allow efficient data transmission without need for ARQ procedures or complicated coding schemes, characteristic for algebraic codes. RLC codes are asymptotically optimal and automatically adjust to the channel characteristic. We examine bounds on the sparsity of generator matrix and present results obtained via practical implementation of sparse RLC coding on Iris platform using TinyOS environment.

Linear network coding is a promising technology that can maximize the throughput capacity of communication network. Despite this salient feature, there are still many challenges to be addressed, and security is clearly one of the most important challenges. In this paper, we will address the design of secure linear network coding. Specifically, we will investigate the network coding design that can both satisfy the weakly secure requirements and maximize the transmission data rate of multiple unicast streams between the same source and destination pair, which has not been addressed in the literature. In our study, we first prove that the secure unicast routing problem is equivalent to a constrained link-disjoint path problem. We then develop efficient algorithm that can find the optimal unicast topology in a polynomial amount of time. Based on the topology, we design deterministic linear network code that is weakly secure and can be constructed at the source node. And finally, we investigate the potential of random linear code for weakly secure unicast and prove the low bound of the probability that a random linear code is weakly secure.

The goal of this paper is to establish links between computational complexity theory and the theory and practice of constrained block coding. In particular, the complexities of several fundamental problems in constrained block coding are precisely classified in terms of the existing complexity-theoretic structure. One type of problem studied is that of designing encoder and decoder circuits using minimum or approximately minimum hardware; for our purposes, an "input" to this problem is (i) a deterministic, irreducible finite-state transition diagram (DIF) defining a set of constrained binary sequences, and (ii) a desired rate p:q. Several of these minimum-encoder and minimum-decoder problems are shown to be NP-hard, and more interestingly some are shown to be complete in the second and third levels of the polynomial hierarchy. Another fundamental problem is that of computing the maximum rate of a block code; that is, given a DIF and a codeword length q, find the maximum p such that a rate p:q block code exists for the constraint defined by the DIF. This problem is shown to be NP/sup #P/-complete. Although it is not known whether NP/sup #P/ contains problems of super-polynomial complexity, it lies "higher" in the complexity-class structure than NP in the sense that it is possible, given current knowledge, that NP/sup #P/ contains problems of super-polynomial complexity even if P=NP. Another question studied is whether maximum rate block codes can always be implemented by encoders and decoders of polynomial size. The answer to this question is shown to be closely related to whether the class #P lies "lower" in the complexity-class structure than currently believed-a proof of either answer would have major implications in complexity theory.

The theory of computational complexity is based on the tradeoff between two computational resources, memory space and computer time. This paper investigates the physical counterparts of these resources. Memory space is the number of bits of information required by a computer over the course of a computation. Physically, information is intimately connected with entropy: entropy can be thought of as random bits of information. The physical analogue of the amount of memory space required for a computation, Ф- SPACE, is the difference between the maximum entropy Smax of the computing system and its actual entropy, S.Ф-SPACE = S - Smax is the thermodynamic depth of the computation. Ф-SPACE is the maximum number of bits of memory space available for a physical system to perform computation. In conventional computational complexity theory, computer time is identified as the number of elementary logical operations (AND, OR, NOT, COPY) required to perform the computation. The physical analogue of time computational complexity is simply the time required for the physical computing system to perform the computation. In order to obtain a number that measures the number of physical operations that can be performed by the system over time t, we define Ф-TIME to be proportional to the computation time multiplied by the energy E of the computing system over the course of the computation: Ф-TIME = 2Et/πħ. Here, the proportionality factor 2/πħ is chosen to match the time it takes a computing system with energy E to flip a bit in time t. Ф-TIME is thus the number of bit flips that can take place in an information processing system. In addition, we propose a novel measure of physical complexity that combines these measures. The free energy F = E - TS of a system is the amount of energy that is available to do useful work - as opposed to the energy bound up in the thermal fluctuations of heat. We define the free complexity to be the free energy × time product, 2Ft/πħ required by a physical system to perform a computation. Physical spatial and temporal complexity provide upper bounds on the amount of computation that can be performed by any physical system. We discuss the implications of physical complexity for the computational complexity hierarchy, in particular, we show that in the presence of errors in the computation, Ф-SPACE is proportional Ф-TIME. We apply the resulting theory of physical computational complexity to analyze the computational power of black holes: exactly half of the energy of a black hole is available for physical computation.

<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Streaming codes</i> take a string of source symbols as input and output a string of coded symbols in real time, which eliminate the queueing delay of traditional <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">block codes</i> and are thus especially appealing for delay sensitive applications. This work studies the asymptotics of random linear streaming codes (RLSCs) in the large finite-field-size regime under the i.i.d. symbol erasure channel models. Two important scenarios are analyzed: (i) tradeoff between decoding deadline Δ and probability of error <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">p_e</i> assuming infinite memory α = ∞; and (ii) tradeoff between α and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">p_e</i> assuming infinite Δ = ∞. For each scenario, this work derives the corresponding asymptotic constant ρ, power β and decay rate η that satisfy <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">p_e</i>(<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">x</i>) ∼ ρ<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">x</i><sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">β</sup><italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">e</i><sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">−η<i>x</i></sup>. The results of (i) and (ii) are then used to study an important code design problem: Under a given target deadline Δ, what is the memory length α needed for the error probability <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">p_e</i> to be within a factor of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">c</i> > 1 of the best possible <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">p</i>∗ <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><i>e</i></sub> over α. Further analysis also suggests that regardless the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">c</i> value being considered, the necessary memory length is approximately 3–7% of the target deadline Δ when Δ is large, the actual percentage depending on the channel model and the coding rate. Such a prediction is consistent with existing brute-force-based evaluations.

Streaming codes encode a string of source packets and output a string of coded packets in real time, which eliminate the queueing delay of block coding and are thus especially suitable for delay-sensitive applications. This work studies random linear streaming codes (RLSCs) and i.i.d. packet erasure channels. While existing works focused on the asymptotic error-exponent analyses, this work characterizes the error rate in the finite memory length regime and the contributions include: (i) A new information-debt-based description of the error event; (ii) A matrix-based characterization of the error rate; (iii) A closed-form approximation of the error rate that is provably tight for large memory lengths; and (iv) A new Markov-chainbased analysis framework, which can be of independent research interest. Numerical results show that the approximation, i.e. (iii), closely matches the exact error rate even for small memory length (≈ 20). The results can be viewed as a sequential- coding counterpart of the finite length analysis of block coding [Polyanskiy et al. 10] under the specialized setting of RLSCs.