Academia.eduAcademia.edu

Rank-Metric Codes and Their Applications

Profile image of Hedongliang LiuHedongliang Liu

2022, ArXiv

visibility

…

description

122 pages

link

1 file

Abstract

The rank metric measures the distance between two matrices by the rank of their difference. Codes designed for the rank metric have attracted considerable attention in recent years, reinforced by network coding and further motivated by a variety of applications. In code-based cryptography, the hardness of the corresponding generic decoding problem can lead to systems with reduced public-key size. In distributed data storage, codes in the rank metric have been used repeatedly to construct codes with locality, and in coded caching, they have been employed for the placement of coded symbols. This survey gives a general introduction to rank-metric codes, explains their most important applications, and highlights their relevance to these areas of research.

Figures (29)

For an upper bound on Ag+;, we only consider the highest term, i.e., 7 = s, and obtain To obtain a lower bound, we consider the difference between the two highest terms:
For an upper bound on Ag+;, we only consider the highest term, i.e., 7 = s, and obtain To obtain a lower bound, we consider the difference between the two highest terms:
The following expression provides a rough estimate of the weight distribution:
The following expression provides a rough estimate of the weight distribution:
Figure 2.2: List size of codes in the rank metric, depending on normalized Bounded Minimum Distance (BMD) decoding radius Ttgurp/n = (d—1)/2n and normalized Johnson radius 7/n and on the normalized minimum distance 6 = d/n. Figures 2.2a and 2.2b illustrates the different decoding regions of rank-metric and Gabidulin codes. general algorithm cannot exist.
Figure 2.2: List size of codes in the rank metric, depending on normalized Bounded Minimum Distance (BMD) decoding radius Ttgurp/n = (d—1)/2n and normalized Johnson radius 7/n and on the normalized minimum distance 6 = d/n. Figures 2.2a and 2.2b illustrates the different decoding regions of rank-metric and Gabidulin codes. general algorithm cannot exist.
Figure 2.3: Illustration of evaluation polynomials of twisted Gabidulin codes. Boxes correspond to possibly non-zero coefficients. Arcs connect the corresponding hook and twist (gray background) coefficients (cf. Definition 2.13.1). (a) shows the evaluation polynomials of a Gabidulin code (Delsarte, 1978; Gabidulin 1985; Roth, 1991): fo,...,f%-1 can be chosen arbitrarily, and all higher-degree coefficients are zero. (b) shows the evaluation polynomials of Sheekey’s (Sheekey, 2016) twisted Gabidulin codes, where the k-th coefficient is a multiple of the zeroth coefficient. (c) shows the evaluation polynomials of the generalization of twisted Gabidulin codes in Definition 2.13.1: there are several non-zero coefficients of degree > k, and each depends on one of the coefficients fo,..., fe—1. Kadir et al., 2021; Kadir and Li, 2020). The general decoding principle of (Randrianarisoa and Rosenthal, 2017; Randrianarisoa, 2017) is to solve a linear system of equations with one fewer equation than usual (cf. Section 2.8). The solutions of these equations form a one- dimensional space. In addition, we have one non-linear equation that arises from the special structure of the evaluation polynomials. It is shown in (Randrianarisoa and Rosenthal, 2017; Randrianarisoa, 2017) that we can efficiently find the unique solution of the decoder by solving this additional non-linear equation. So far, there is no polynomial-time decoder for twisted Gabidulin codes with multiple twists, or one twist ty > 1.
Figure 2.3: Illustration of evaluation polynomials of twisted Gabidulin codes. Boxes correspond to possibly non-zero coefficients. Arcs connect the corresponding hook and twist (gray background) coefficients (cf. Definition 2.13.1). (a) shows the evaluation polynomials of a Gabidulin code (Delsarte, 1978; Gabidulin 1985; Roth, 1991): fo,...,f%-1 can be chosen arbitrarily, and all higher-degree coefficients are zero. (b) shows the evaluation polynomials of Sheekey’s (Sheekey, 2016) twisted Gabidulin codes, where the k-th coefficient is a multiple of the zeroth coefficient. (c) shows the evaluation polynomials of the generalization of twisted Gabidulin codes in Definition 2.13.1: there are several non-zero coefficients of degree > k, and each depends on one of the coefficients fo,..., fe—1. Kadir et al., 2021; Kadir and Li, 2020). The general decoding principle of (Randrianarisoa and Rosenthal, 2017; Randrianarisoa, 2017) is to solve a linear system of equations with one fewer equation than usual (cf. Section 2.8). The solutions of these equations form a one- dimensional space. In addition, we have one non-linear equation that arises from the special structure of the evaluation polynomials. It is shown in (Randrianarisoa and Rosenthal, 2017; Randrianarisoa, 2017) that we can efficiently find the unique solution of the decoder by solving this additional non-linear equation. So far, there is no polynomial-time decoder for twisted Gabidulin codes with multiple twists, or one twist ty > 1.
Table 3.1: Overview of problems in the rank metric and the corresponding cryptosystems. The following table provides an overview of the previously considered problems and the
Table 3.1: Overview of problems in the rank metric and the corresponding cryptosystems. The following table provides an overview of the previously considered problems and the
Table 3.2: Parameters of the GPT variants. 3.2.2. McEliece-type Rank-Metric Cryptosystems based on Gabidulin Codes
Table 3.2: Parameters of the GPT variants. 3.2.2. McEliece-type Rank-Metric Cryptosystems based on Gabidulin Codes
*Ms,q (a) € For,” the s x n Moore matrix for a vector a = (a1, d2,...,@n) € Fym.
*Ms,q (a) € For,” the s x n Moore matrix for a vector a = (a1, d2,...,@n) € Fym.
Figure 3.1: Overview of the history of GPT variants and attacks.
Figure 3.1: Overview of the history of GPT variants and attacks.
In order to prevent the attack by Gibson (1995), Gabidulin (1993) presented a modified variant of the GPT cryptosystem which uses a more general distortion matrix X. The modified key generation is described in Algorithm 5. Modified GPT Variant by Gabidulin
In order to prevent the attack by Gibson (1995), Gabidulin (1993) presented a modified variant of the GPT cryptosystem which uses a more general distortion matrix X. The modified key generation is described in Algorithm 5. Modified GPT Variant by Gabidulin
The series of Overbeck’s attacks broke all GPT variants for most practical parameters. n order to prevent Overbeck’s attack, GPT variants with column scrambling matrices over Fm were proposed. The first GPT variant using a column scrambler over Fgm was proposed by Gabidulin (2008). The GPT variants by Gabidulin et al. (2009) and Rashwan et al. (2010) are also based on this general idea. In (Otmani et al., 2017) it was shown that (Gabidulin et al., 2009; Rashwan et al., 2010) are special cases of (Gabidulin, 2008). Hence, we only describe the general system from (Gabidulin, 2008) in Algorithm 9 — 11.
The series of Overbeck’s attacks broke all GPT variants for most practical parameters. n order to prevent Overbeck’s attack, GPT variants with column scrambling matrices over Fm were proposed. The first GPT variant using a column scrambler over Fgm was proposed by Gabidulin (2008). The GPT variants by Gabidulin et al. (2009) and Rashwan et al. (2010) are also based on this general idea. In (Otmani et al., 2017) it was shown that (Gabidulin et al., 2009; Rashwan et al., 2010) are special cases of (Gabidulin, 2008). Hence, we only describe the general system from (Gabidulin, 2008) in Algorithm 9 — 11.
Different GPT variants that are resistant against Overbeck’s attacks were proposed by Loidrea (2010) and Rashwan et al. (2010). Rather than relying on a column scrambling matrix over F gm, the variants use particular distortion matrices to prevent Overbeck’s structural at- tacks. The variants can be described in Algorithm 12 — 14. If the right kernel of pk has dimension one, a decoder can be obtained from pk in polynomial time. This occurs with high probability if X is chosen uniformly at random. This implies the design criterion that X has to be chosen such that rk,(X) < ix—t for some > 1 which implies tx > (n — k) (see (Loidreau, 2010, Corollary 1)). However, this restriction increases the key size.
Different GPT variants that are resistant against Overbeck’s attacks were proposed by Loidrea (2010) and Rashwan et al. (2010). Rather than relying on a column scrambling matrix over F gm, the variants use particular distortion matrices to prevent Overbeck’s structural at- tacks. The variants can be described in Algorithm 12 — 14. If the right kernel of pk has dimension one, a decoder can be obtained from pk in polynomial time. This occurs with high probability if X is chosen uniformly at random. This implies the design criterion that X has to be chosen such that rk,(X) < ix—t for some > 1 which implies tx > (n — k) (see (Loidreau, 2010, Corollary 1)). However, this restriction increases the key size.
The GPT variants (Loidreau, 2016; Loidreau, 2017) use particular column scrambling ma trices over Fgm, called rank amplifiers. The variants are described in Algorithm 15-17. In particular, the coefficients of the inverse of the right scrambler are taken from some fixed dimensional F,-linear subspace of Fgm. This idea is motivated by LRPC codes (Gaborit et al., 2013) and the analogue cryptosystem in the Hamming metric proposed by Baldi et al. (2016).
The GPT variants (Loidreau, 2016; Loidreau, 2017) use particular column scrambling ma trices over Fgm, called rank amplifiers. The variants are described in Algorithm 15-17. In particular, the coefficients of the inverse of the right scrambler are taken from some fixed dimensional F,-linear subspace of Fgm. This idea is motivated by LRPC codes (Gaborit et al., 2013) and the analogue cryptosystem in the Hamming metric proposed by Baldi et al. (2016).
Attack for GPT with Rank Amplifiers (\ = 2)
Attack for GPT with Rank Amplifiers (\ = 2)
recovered. The detailed description of the cryptosystem is provided in Algorithms 21-23. 3.2.4 Attack on the QC-LRPC GPT Variant An attack on the QC-LRPC cryptosystem that exploits the block-circulant structure of the parity-check matrix was presented in (Hauteville and Tillich, 2015). As a possible repair,
recovered. The detailed description of the cryptosystem is provided in Algorithms 21-23. 3.2.4 Attack on the QC-LRPC GPT Variant An attack on the QC-LRPC cryptosystem that exploits the block-circulant structure of the parity-check matrix was presented in (Hauteville and Tillich, 2015). As a possible repair,
Algorithm 24: KeyGen (-) (Faure and Loidreau, 2005)
Algorithm 24: KeyGen (-) (Faure and Loidreau, 2005)
Table 3.4: Comparison of memory costs of sk, pk and the ciphertext ct in Byte of IND-CCA- secure Loidreau (Shehhi et al., 2019) and the NIST proposals RQC (Aguilar Melchor et al., 2019b), ROLLO (Aguilar Melchor et al., 2019a), BIKE (Aragon et al., 2019a) and Classic McEliece (Bernstein et al., 2019). The entry ‘yes’ in the column DFR indicates that a scheme has a decryption failure rate larger than 0.
Table 3.4: Comparison of memory costs of sk, pk and the ciphertext ct in Byte of IND-CCA- secure Loidreau (Shehhi et al., 2019) and the NIST proposals RQC (Aguilar Melchor et al., 2019b), ROLLO (Aguilar Melchor et al., 2019a), BIKE (Aragon et al., 2019a) and Classic McEliece (Bernstein et al., 2019). The entry ‘yes’ in the column DFR indicates that a scheme has a decryption failure rate larger than 0.
Figure 4.1: Illustration of a Cache-Aided Broadcast System. delivery phase. When the placement applies coding, in addition to the principle above, the coding coefficients should be chosen such that a set of full rank conditions are satisfied, which guarantees that all the file segments that are part of the linear combinations of the cached symbols can be decoded after receiving sufficient coded symbols in the delivery phase (Tian and Chen, 2018, Section IV.A). However, specifying the coding coefficients for generic parameters turns out to be difficult. Tian and Chen (2018) resolved the issue by a combination of rank metric codes (used in placement phase) and MDS codes (used in delivery phase), which provides an explicit solution apart from an existence proof by Ho et al. (2006).
Figure 4.1: Illustration of a Cache-Aided Broadcast System. delivery phase. When the placement applies coding, in addition to the principle above, the coding coefficients should be chosen such that a set of full rank conditions are satisfied, which guarantees that all the file segments that are part of the linear combinations of the cached symbols can be decoded after receiving sufficient coded symbols in the delivery phase (Tian and Chen, 2018, Section IV.A). However, specifying the coding coefficients for generic parameters turns out to be difficult. Tian and Chen (2018) resolved the issue by a combination of rank metric codes (used in placement phase) and MDS codes (used in delivery phase), which provides an explicit solution apart from an existence proof by Ho et al. (2006).
Figure 5.1: Illustration of (e, 2) — Nieedpe networks An (¢,£)-Nhrat+e generalized combination network is a class of multicast networks, illus- trated in Figure 5.1 (see also (Etzion and Wachter-Zeh, 2018)). The network has three
Figure 5.1: Illustration of (e, 2) — Nieedpe networks An (¢,£)-Nhrat+e generalized combination network is a class of multicast networks, illus- trated in Figure 5.1 (see also (Etzion and Wachter-Zeh, 2018)). The network has three
Figure 5.2: Error propagation in RLNC. A single link error can corrupt the entire transmission.
Figure 5.2: Error propagation in RLNC. A single link error can corrupt the entire transmission.
Figure 5.4: Illustration of the relation between the input and output of the operator channel (5.8). The transmitted space is V (blue and green) and the received space is U = (VNU) @ E (green and red). The green intersection space is returned by §n,—s5(V) and the red error space is €. The subspace distance between the input subspace VY and the output subspace U/ is Figure 5.3: The operator channel (Kétter and Kschischang, 2008a).
Figure 5.4: Illustration of the relation between the input and output of the operator channel (5.8). The transmitted space is V (blue and green) and the received space is U = (VNU) @ E (green and red). The green intersection space is returned by §n,—s5(V) and the red error space is €. The subspace distance between the input subspace VY and the output subspace U/ is Figure 5.3: The operator channel (Kétter and Kschischang, 2008a).
Figure 5.5: Normalized distance 7 over the code rate R for q = 2,m = 6 and m = 6 and interleaving orders / folding parameters L = h = 1,3,10 with the corresponding normalized weight X.
Figure 5.5: Normalized distance 7 over the code rate R for q = 2,m = 6 and m = 6 and interleaving orders / folding parameters L = h = 1,3,10 with the corresponding normalized weight X.

Related papers

Relative Generalized Rank Weight of Linear Codes and Its Applications to Network Coding
T. Uyematsu

IEEE Transactions on Information Theory, 2015

By extending the notion of minimum rank distance, this paper introduces two new relative code parameters of a linear code C 1 of length n over a field extension F q m and its subcode C 2 C 1 . One is called the relative dimension/intersection profile (RDIP), and the other is called the relative generalized rank weight (RGRW). We clarify their basic properties and the relation between the RGRW and the minimum rank distance. As applications of the RDIP and the RGRW, the security performance and the error correction capability of secure network coding, guaranteed independently of the underlying network code, are analyzed and clarified. We propose a construction of secure network coding scheme, and analyze its security performance and error correction capability as an example of applications of the RDIP and the RGRW. Silva and Kschischang showed the existence of a secure network coding in which no part of the secret message is revealed to the adversary even if any dim C 1 -1 links are wiretapped, which is guaranteed over any underlying network code. However, the explicit construction of such a scheme remained an open problem. Our new construction is just one instance of secure network coding that solves this open problem.

View PDFchevron_right
Universal Secure Network Coding via Rank-Metric Codes
danilo silva

Computing Research Repository, 2008

The problem of securing a network coding communication system against an eavesdropper adversary is considered. The network implements linear network coding to deliver n packets from source to each receiver, and the adversary can eavesdrop on \mu arbitrarily chosen links. The objective is to provide reliable communication to all receivers, while guaranteeing that the source information remains information-theoretically secure from the adversary. A coding scheme is proposed that can achieve the maximum possible rate of n-\mu packets. The scheme, which is based on rank-metric codes, has the distinctive property of being universal: it can be applied on top of any communication network without requiring knowledge of or any modifications on the underlying network code. The only requirement of the scheme is that the packet length be at least n, which is shown to be strictly necessary for universal communication at the maximum rate. A further scenario is considered where the adversary is allowed not only to eavesdrop but also to inject up to t erroneous packets into the network, and the network may suffer from a rank deficiency of at most \rho. In this case, the proposed scheme can be extended to achieve the rate of n-\rho-2t-\mu packets. This rate is shown to be optimal under the assumption of zero-error communication.

View PDFchevron_right
A New Technique in Rank Metric Code-Based Encryption
Terry Lau

Cryptography, 2018

We propose a rank metric codes based encryption based on the hard problem of rank syndrome decoding problem. We propose a new encryption with a public key matrix by considering the adding of a random distortion matrix over F q m of full column rank n. We show that IND-CPA security is achievable for our encryption under assumption of the Decisional Rank Syndrome Decoding problem. Furthermore, we also prove some bounds for the number of matrices of a fixed rank with entries over a finite field. Our proposal allows the choice of the error terms with rank up to r 2 , where r is the error-correcting capability of a code. Our encryption based on Gabidulin codes has public key size of 13 . 68 KB, which is 82 times smaller than the public key size of McEliece Cryptosystem based on Goppa codes. For similar post-quantum security level of 2 140 bits, our encryption scheme has a smaller public key size than the key size suggested by LOI17 Encryption.

View PDFchevron_right
Rank Distance Bicodes and Their Generalization
Florentin Smarandache

2010

View PDFchevron_right
Reducible rank codes and their applications to cryptography
Ernst Gabidulin

IEEE Transactions on Information Theory, 2003

We present a new family of so-called reducible rank codes which are a generalization of rank product codes [2]. This family includes maximal rank distance (MRD) codes for lengths in the field . We give methods for encoding and decoding reducible rank codes.

View PDFchevron_right
Rank-metric codes and applications
Ernst Gabidulin

The State of Art for rank codes is represented. The theory and applications are considered.

View PDFchevron_right
A New Rank Metric Codes based Identification Scheme
Peter KIDOUDOU

International Journal of Computer Applications

In this paper, we propose a version of the identification rank metric code-based schemes. This protocol is an improvement of rankbased Véron protocol.It provide smaller public and private key sizes.With the same complexity as the Véron scheme, we make the scheme more secure by hiding the structure of the code used.

View PDFchevron_right
New rank codes based encryption scheme using partial circulant matrices
Terry Lau

Designs, Codes and Cryptography, 2019

We propose a new rank metric code based encryption based on the hard problem of rank syndrome decoding problem. We consider a generator matrix for Gabidulin codes in the form of k-partial circulant matrix. We distort the matrix G by adding it with another random k-partial circulant matrix and multiplying the product with a random circulant matrix. We also convert our encryption into an IND-CCA2 secured encryption scheme under assumption of Rank Syndrome Decoding problem. Our encryption has the smallest key size (of 4.306 KB) at 256-bit security level as compared to all the other rank code based encryption schemes with zero decryption failure and hidden structure for the decodable codes.

View PDFchevron_right
A Rank-Metric Approach to Error Control in Random Network Coding
danilo silva

IEEE Transactions on Information Theory, 2008

The problem of error control in random linear network coding is addressed from a matrix perspective that is closely related to the subspace perspective of Rotter and Kschischang. A large class of constant-dimension subspace codes is investigated. It is shown that codes in this class can be easily constructed from rank-metric codes, while preserving their distance properties. Moreover, it is shown that minimum distance decoding of such subspace codes can be reformulated as a generalized decoding problem for rank-metric codes where partial information about the error is available. This partial information may be in the form of erasures (knowledge of an error location but not its value) and deviations (knowledge of an error value but not its location). Taking erasures and deviations into account (when they occur) strictly increases the error correction capability of a code: if mu erasures and delta deviations occur, then errors of rank t can always be corrected provided that 2t les d - 1 + mu + delta, where d is the minimum rank distance of the code. For Gabidulin codes, an important family of maximum rank distance codes, an efficient decoding algorithm is proposed that can properly exploit erasures and deviations. In a network coding application, where n packets of length M over F(q) are transmitted, the complexity of the decoding algorithm is given by O(dM) operations in an extension field F(qn).

View PDFchevron_right

Related topics

MathematicsComputer Science