Quantum Information Set Decoding Algorithms

Abstract

The security of code-based cryptosystems such as the McEliece cryptosystem relies primarily on the difficulty of decoding random linear codes. The best decoding algorithms are all improvements of an old algorithm due to Prange: they are known under the name of information set decoding techniques. It is also important to assess the security of such cryptosystems against a quantum computer. This research thread started in [22] and the best algorithm to date has been Bernstein's quantising [5] of the simplest information set decoding algorithm, namely Prange's algorithm. It consists in applying Grover's quantum search to obtain a quadratic speed-up of Prange's algorithm. In this paper, we quantise other information set decoding algorithms by using quantum walk techniques which were devised for the subset-sum problem in [6]. This results in improving the worst-case complexity of 2 0.06035n of Bernstein's algorithm to 2 0.05869n with the best algorithm presented here (where n is the codelength).

The Decoding Failure Probability of MDPC Codes

“…This problem is considered very hard when t or w are large enough: after decades of active research [Pra62, LB88, Leo88, Ste88, Dum91, Bar97, FS09, BLP11, MMT11, BJMM12, MO15, DT17, BM17] the best algorithms solving this issue are still exponential in t (or w), their complexity is of the form e tα(R)(1+o(1)) N (replace t by w in the low-weight search problem) where N is the number of solutions of the problem and R is the rate of the code. This holds even for algorithms in the quantum computing model [Ber11,KT17]. Moreover, the relative exponent α(R) has decreased only very slowly after 50 years of active research on the topic.The proposal made in [MTSB13] exploits this.…”

LEDAkem: A Post-quantum Key Encapsulation Mechanism Based on QC-LDPC Codes

“…We chose to employ the results provided in [43] to evaluate the computational efforts of Stern's variant of the ISD as they provide exact formulas instead of asymptotic bounds. However, we note that a recent work [22] provides improved asymptotic bounds on the computational complexity of quantum ISD for increasing values of the codeword length n. Deriving from this approach exact values for given parameters set is worth investigating.…”

“…Instead, with classical computers the most efficient ISD algorithm turns out to be the BJMM algorithm in [9]. Therefore, the security levels against attackers provided with classical computers have been estimated by considering the work factor of BJMM in (22) and (23). We chose to employ the results provided in [43] to evaluate the computational efforts of Stern's variant of the ISD as they provide exact formulas instead of asymptotic bounds.…”

“…Once n 0 is fixed, we can find many pairs of values m and d v which satisfy this bound; among these, we have chosen the one having the lowest product md v , which is a metric affecting the error correcting capability of the private code. Then, we have found the value of t that allows satisfying (22) and checked whether t ′ = tm errors can be corrected by the private code through Q-decoding with a sufficiently low DFR. Otherwise, we have increased the value of p keeping all the other parameters fixed.…”

“…We call the new system LEDAkem and study its properties and security. We take into account the fact that Grover's algorithm running on a quantum computer may be exploited to speedup attacks based on information set decoding (ISD) [22,43], and we propose some sets of parameters for LEDAkem achieving different security levels against attacks exploiting both classical and quantum computers. We also describe an optimized software implementation of the proposed system and provide and discuss some performance figures.…”