.

.

.

Par la suite on a réussi à faire une cryptanalyse complète du schéma de McEliece à base des codes Polaires. Ce résultat a été une application directe des propriétés découvertes sur les codes Polaires et il a été publié dans une conférence internationale en cryptographie post-quantique [BCD + 16].

the number of weak keys. We published our results in an international conference in cryptography [START_REF] Bardet | Weak keys for the quasi-cyclic MDPC public key encryption scheme[END_REF].

Next we studied the Polar codes and their application to public key cryptography. Since they were discovered by Arikan [START_REF] Arıkan | Channel polarization: a method for constructing capacityachieving codes for symmetric binary-input memoryless channels[END_REF], Polar codes are part of the most studied from an information theory point of view, family of codes. In terms of performance they are really efficient since they are capacity achieving over the Binary Discrete Memoryless Channels and they allow extremely fast encoding and decoding algorithms. Nonetheless, few facts are known about their structure. In this context, we have introduced an algebraic formalism which allowed us to reveal a big part of the structure of Polar codes. Indeed, we have managed to answer fundamental questions regarding Polar codes such as the dual, the minimum distance, the permutation group and the number of minimum weight codewords of a Polar code. Our results were published in an international conference in information theory [START_REF] Bardet | Algebraic properties of polar codes from a new polynomial formalism[END_REF].

We also managed to completely cryptanalyze the McEliece variant using Polar codes. The attack was a direct application of the aforementioned results on the structural properties of Polar codes and it was published in an international conference in postquantum cryptography [BCD + 16].

First of all, I am most grateful to my supervisors Ayoub Otmani and Magali Bardet. I would like to thank them for giving me the opportunity to make part of the crypto team at the University of Rouen Normandy. The words are not enough to express my gratitude for their patience and support as well as their suggestions on the relevant papers that I read and studied during the thesis. I would also like to thank them for all the efforts that were done in order for me to built a real project around my thesis and by that I mean the opportunity to assist to many conferences and workshops and also to meet many researchers in the field.

I express my gratitude to the jury members: Daniel Augot, Thierry Berger, Philippe Gaborit, Nicolas Sendrier and Jean-Pierre Tillich. They took the time to read my manuscript and also to have interesting discussion on other potential perspectives of my results. I would like to thank Jean-Pierre Tillich for the valuable comments and his guidance and support.

The collaboration with my co-authors Ayoub Otmani, Magali Bardet, Jean-Gabriel Luque, Jean-Pierre Tillich, Pierre-Louis Cayrel, Julia Chaulet, Tania Richmond and Brice Colombier was very fruitful, for that I thank them.

I also want to thank Hervé Talé Khalachi for our collaboration and the projects that we are working on. He is one of the colleagues that supported me in the hard moments and I appreciate his friendship. I want to express my gratitude to Ali Chouria and Clément Miklarz, maybe the best two colleagues that I could ever imagine. Also I bog thanks to Amazigh Amrane which makes the live much more easier in our office. A big thank you to Mohamed Saheed Taha for the valuable discussions during the coffee breaks.

My thesis was conducted within the computer science department of the University of Rouen Normandy, more exactly in the Combinatorics and Algorithms team which is part of the LITIS Laboratory. Therefore I wand to that all the members of the team for their support and comments. I have a special thought for all the good advice about life in general that Pascal Caron gave me during these years.

I would like to thank all the members from the research group on cryptography and coding theory from INRIA which I meet in our monthly meetings and especially the organizer of this collaboration group, Jean-Pierre Tillich.

Finally, I would like to thank my wife Alina. She had the patience and the courage to iii follow me into this adventure. Many of my valuable ideas came to me when I was next to her and maybe the arrival of our son Vladimir was one of the most beautiful thing that ever happened during these years. I also like to thank my parents and my sister Alexandra even though far from Rouen they always encouraged and supported me.

Motivations

Public-key cryptography is one of the newest subfield in cryptology and maybe one of the most challenging one. Essentially based on the evolution of the Internet of things and the highly increasing number of connected devices, the public key cryptography became one of the most spread solution for Internet security issues. It emerged in the late seventies motivated by a practical issue: how to securely exchange keys over a non reliable communication channel. The first key exchange protocol based on the idea of using a public key/private key pair was proposed by Diffie-Hellman [START_REF] Diffie | New directions in cryptography[END_REF], followed two years after by the public-key encryption scheme of Rivest, Shamir and Adleman [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF]. Miller [START_REF] Victor | Use of elliptic curves in cryptography[END_REF] proposed for the first time in 1985 to use elliptic curve in public key cryptography, field that is widely used nowadays. Three of the main technologies on which information technologies and Internet are based, namely TLS, PGP and SSH, they all implement Elliptic Curve Cryptography.

Meanwhile the scientific community begin to study the mathematical problems on which public-key schemes base their security. There are two number theory problems for the aforementioned protocols, the integer factorization and the discrete logarithm. If at the beginning, the general belief was that these two problems are hard enough for a cryptographic purpose, nowadays the future of number theory based cryptosystems is rather uncertain. There are two reasons for that:

• The latest classic algorithms for discrete logarithm in small characteristic finite fields are quasi-polynomial in the size of the group [START_REF] Barbulescu | A heuristic quasi-polynomial algorithm for discrete logarithm in finite fields of small characteristic[END_REF] and therefore they became a real threat from a theoretical point of view as well as a practical point of view.

• The quantum algorithms for factoring integers over Z and for computing logarithms in the multiplicative group F p * have a theoretical polynomial time complexity [START_REF] Shor | Algorithms for quantum computation: Discrete logarithms and factoring[END_REF]. Even though in practice we are still far from factoring a 2048-bit RSA module, the danger coming from the quantum computers has been raised.

The question weather it is a classical algorithm or a quantum algorithm that will break for the first time a 2048-RSA public key in practice in a reasonable time, is a challenging debate. Lately another question is making a lot of noise, that is the problem of finding a proper quantum resistant encryption scheme. National security agencies (NSA) as well as xi 1.1. MOTIVATIONS institutions that establish standards in information technologies (NIST in the USA, ETSI in Europe) and international projects (PQCrypto EU) related to Quantum Resistant Cryptography seem to accelerate the process. From the private sector there are many signals that seem to enforce the necessity of a Quantum Resistant Cryptography (see Intel, Microsoft etc.).

There are two fields on which the scientific community focus their attention: quantum cryptography based on quantum theory and post-quantum cryptography based on classic theory. They are both suppose to deal with quantum computer threats and thereby might replace the actual number theory based cryptography. We deal here with the classical vision and study one of the solutions proposed by the post-quantum cryptography.

There are several hard problems on which the post-quantum cryptography base their security and we recall here one of them. Let n and k be two integers such that 1 k n-1 and H be a random (n -k) × n matrix over a field F. Then we have the following problem Instance: A (n -k) × n matrix H over F, a vector s ∈ F n-k and a small integer ω > 0. Question: Is there a vector x ∈ F n of weight ω, such that Hx T = s?

We emphasize that without the weight condition this problem is easy to solve using linear algebra. It is exactly the condition on the weight that makes the later problem difficult and there are three different well-known distances which are used for cryptographic purpose:

• when F is a finite field, F = F q we can consider the Hamming distance. Then the problem is known as the Syndrome Decoding Problem and it was proved NPcomplete by Berlekamp, McEliece and van Tilborg in [START_REF] Berlekamp | On the inherent intractability of certain coding problems[END_REF]. Based on this problem McEliece proposed a public key encryption scheme [START_REF] Mceliece | A Public-Key System Based on Algebraic Coding Theory[END_REF]. This subfield is known under the name of code-based cryptography field.

• when F is a finite field such that F = F p m we can consider the Rank distance.

Then the problem is known as the Rank Syndrome Decoding Problem and it was proved NP-complete by Gaborit and Zémor in [START_REF] Gaborit | On the hardness of the decoding and the minimum distance problems for rank codes[END_REF]. This subfield is known as the rank-based cryptography, from which we recall the LRPC encryption scheme [START_REF] Gaborit | Low rank parity check codes and their application to cryptography[END_REF].

• when F is the residue integer ring F = Z q we consider the Euclidean distance and the problem is known as the decisional Closest Vector Problem. Aijtaj begun the study of this type of problems and initiated based on the hardness of the CVP the lattice based cryptography [START_REF] Ajtai | Generating hard instances of lattice problems (extended abstract)[END_REF][START_REF] Ajtai | A public-key cryptosystem with worstcase/average-case equivalence[END_REF], which is one of the most promising post-quantum solutions. We recall some well known encryption schemes coming from this area, namely the Ring-LWE [START_REF] Lyubashevsky | On ideal lattices and learning with errors over rings[END_REF], the GGH scheme [START_REF] Goldreich | Public-key cryptosystems from lattice reduction problems[END_REF] or the NTRU scheme [START_REF] Hoffstein | NTRU: A ring-based public key cryptosystem[END_REF].

The resemblance between these three fields is not only in the problem on which their security stands on, it is also in the choice of the encryption schemes. The most promising encryption protocols, and here we refer to efficiency, key size and security arguments, are the QC-MDPC McEliece, the QC-LRPC and the NTRU-cryptosystem. They all have a similar description, since the private key can be defined as a pair of polynomials (h 1 (x), h 2 (x)) ∈ (F[x]/(x n -1)) 2 with weight h 1 + h 2 ω and the public key is the polynomial f (x) = h 1 (x)h 2 (x) -1 (mod x n -1).

Our contribution 1.2.1 Decreasing Monomial Codes

The first contribution is to introduce a class of algebraic error correcting codes, that we call Decreasing Monomial Codes. As their name indicates this family of codes possess an algebraic structure since it is defined as evaluation of multivariate monomials. In addition the monomials forming a basis for a Decreasing Monomial code are selected with respect to an ordering, the " " (see Definition 3.3.1).

The initial motivation was rather a cryptographic one, since we first propose the use of such a code family when we cryptanalyzed the McEliece variant using Polar codes. The intriguing part is that Polar codes were introduces as part of the probabilistic codes and the scientific community was searching for an algebraic formalism related to Polar codes. Indeed in the initial article [START_REF] Arıkan | Channel polarization: a method for constructing capacityachieving codes for symmetric binary-input memoryless channels[END_REF], introducing Polar codes, Arikan pointed out that constructing Polar codes is a challenging task that maybe requires more knowledge on the underlying structure of the Polar codes. He also pointed out the strong relation between Polar codes and Reed-Muller codes, fact that gives the first intuition on the algebraic structure of Polar codes. Nevertheless Arikan's article was a major contribution in the field of coding theory since he proved for the first time that Polar codes achieve the capacity of many communication channels. We recall that many interesting properties were known about Polar codes but there is no complete study or knowledge about several issues like: dual of Polar codes, permutation group or minimum weight codewords of a Polar code. Therefore the study of Polar codes from a coding perspective is a highly motivating task and understanding the structure of this codes is necessary.

In the first place we prove that Polar codes designed for the Binary Discrete Memoryless Channels are Decreasing Monomial codes (see Theorem 3.3.31). We also prove that Reed-Muller codes are part of this big family of linear codes (see Proposition 3.3.12). Based on this fact we analyze the structure of the Polar codes, seen as a Decreasing Monomial code.

The main results are the following

• The dual of a Decreasing Monomial code is a Decreasing Monomial code (see Proposition 3.4.12).

• The permutation group of a Decreasing Monomial code contains the Lower Triangular Group, LTA(m, 2) (see Definition 3.6.2), which is a subgroup of the General Afiine group (see Theorem 3.6.6).

• The structure of minimum weight codewords of a Decreasing Monomial code is given by the orbits of the maximum degree monomials (see Proposition 3.7.12).

• We give a counting method for the number of minimum weight codewords of a Decreasing Monomial code based on the Young diagrams associated to the maximum degree monomials (see Theorem 3.7.14).

xiii 1.2. OUR CONTRIBUTION

Cryptanalysis of the McEliece scheme based on Polar codes

A major impact for the code-based community is that Polar codes can not be used in a McEliece type scheme, at least not in the original version of the cryptosystem. Our second major contribution related to Decreasing Monomial codes is that we propose a full cryptanalysis of the McEliece variant based on Polar codes. The attack is based on the fact that we are able to determine exactly the structure of the minimum weight codewords of a Polar code. Therefore we manage to distinguish between the maximum degree monomials for the code and thus solve the Code Equivalence Problem in this case.

Weak keys for the QC-MDPC McEliece

The McEliece variant using QC-MDPC codes [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from moderate density parity-check codes[END_REF] is one of the most promising candidates for a post-quantum cryptosystem using the theory of error correcting codes. There are several reason for that like for example the "random-like" structure of the codes, the efficiency, the key size and many others.

Weak keys approach -differences and advantages from generic model The best attacks against the QC-MDPC scheme are variants of the Information Set Decoding, with exponential complexity in the weight of the error vector [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from moderate density parity-check codes[END_REF]. Our initial motivation was to attack the QC-MDPC's security from another point of view. We investigate particular configurations which are vulnerable against polynomial time attacks. For that we redefine the Key Recovery Problem for the QC-MDPC scheme as a modified version of the well-known Rational Recovery Problem. Hence we use the Extended Euclidean Algorithm, which is one of the possible solutions to the later problem, to recover a private key from the public data.

We emphasize the difference between our method and generic ones. In the general model one considers the work factor of the best algorithm that is able to recover the private key from the public key for any random public key. Hence in this model any private key can be attacked with an exponential algorithm and thus there is no distinction whatsoever between the different private keys. On the other hand in the weak keys model, only a proportion of keys, that has to be determined, might be vulnerable to polynomial time attacks. But since the attack is very efficient, the designers of the scheme must carefully choose the parameters in such manner to avoid weak keys.

Weak keys for the QC-MDPC scheme -results and consequences Our first contribution is to estimate the proportion of weak keys of a (2p, p, ω) QC-MDPC scheme. The asymptotic analysis shows that the proportion of weak keys for the smooth (2p, p, ω) QC-MDPC schemes, is equivalent when p goes to infinity, to ω 1/2 2 -H(α)ω where H(x) is the binary entropy function. We also prove that the proportion of weak keys for all the (2p, p, ω) QC-MDPC schemes is equivalent to ω2 -H(α)ω .

The first observation is that the proportion of weak keys is really close to the security level given by the work factor of the best ISD variants. We also stress out that no structural property of the QC-MDPC code was considered in the counting process and thus the aforementioned probabilities might considerably be increased with the use of some specific properties. For this we consider equivalent QC-MDPC codes, fact that we xiv CHAPTER 1. INTRODUCTION define in terms of group actions, namely we consider the additive group (F p , +) and the multiplicative group (F p * , •). With the use of the additive group we increase the proportion of weak keys by a factor equal to ω 2 . As for the multiplicative group the proportion of weak keys can be increased in the best case by a factor equal to p -1. In the worst case the factor equals (p -1)/ω/2.

We compute the values of the probabilities for all the proposed parameters of the QC-MDPC scheme from [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from moderate density parity-check codes[END_REF] and discover that for several parameters the probability of weak keys is considerably bigger than the announced security level of the scheme. Thus we propose a secured version of the Key Generation algorithm and analyze its time complexity. We also analyze the complexity of the attack and implement a practical attack in MAGMA Software, for which we give the execution timings. We point out that the secured version has two advantages: firstly it eliminated the possible weak keys and secondly it can be implemented in an efficient manner.

xv

Code-based Cryptography

Introduction

Code-based cryptography appeared for the first time in 1978, when McEliece proposed the first public key encryption scheme which is not based on number theory primitives [START_REF] Mceliece | A Public-Key System Based on Algebraic Coding Theory[END_REF]. Instead he built a scheme for which the security relies on two problems:

• the hardness of the Syndrome Decoding Problem [START_REF] Berlekamp | On the inherent intractability of certain coding problems[END_REF].

• the difficulty to distinguish between a binary Goppa code and a random linear code [FGO + 10].

McEliece's scheme is composed of three algorithms: key generation, encryption and decryption. The key generation algorithm picks a random k × n generator matrix G of a binary linear code C which is itself randomly picked in a family of codes for which t errors can be efficiently corrected. The secret key is the decoding algorithm (or the private parameters of the decoding algorithm) associated to C and the public key is G.

To encrypt m ∈ F k 2 , the sender chooses a random vector e in F n 2 of Hamming weight less than or equal to t and computes the ciphertext c = mG + e. The receiver then recovers the plaintext by applying a decoding algorithm on c.

The scheme disposes of various advantages like for example

• the complexity of the encryption and decryption algorithms are equivalent to those of symmetric schemes and thus are very efficient compared to other public key schemes. [START_REF] Overbeck | Code-based cryptography[END_REF] • the best attacks for solving the Syndrome Decoding Problem are exponential in the code length, which makes code-based schemes of high potential. [START_REF] Canto | Analysis of information set decoding for a sub-linear error weight[END_REF] However code-based cryptography came with a big disadvantage: the size of the public keys was about five hundred thousands bits, for a 2 60 security level, which was unacceptable at that time. Nevertheless the scientific community made a huge progress in reducing the key size of the McEliece PKC by proposing different structures like quasi-cyclic or quasi-dyadic codes. Nowadays the key size is no longer an issue and several practical implementations of the McEliece prove the efficiency and potential of the scheme [BS08, Str10b, CHP12, BCS13, HvMG13, MOG15].

Coding theory is a fundamental field in communication and was introduce in 1948 by Claude E. Shannon in [START_REF] Shannon | A mathematical theory of communication[END_REF]. The main purpose of coding theory is to propose schemes that can be used to efficiently and reliably transmit information over a noisy channel. From a practical point of view the main challenge is to design coding schemes that could approach channel capacity, also known as "the Shannon limit". Shannon's objective required extraordinary efforts and finally proved to be possible with the help of probabilistic codes. Channel coding can be defined as the process of adding enough redundancy to a message that has to be sent over a communication channel in order to recover the message after errors have been added by the channel.

Channel coding

Definition 2.2.1 (Discrete channel). Let k and m be two strictly positive integers. Then a discrete channel W is defined by

• A finite input alphabet X = {x 1 , . . . , x k }.

CHAPTER 2. CODE-BASED CRYPTOGRAPHY

• A finite output alphabet Y = {y 1 , . . . , y m }.

• The transition probability k × m matrix P = (p i,j ) 1 i k , 1 j m with p i,j = W (y j |x i ) is the probability that y i is received knowing that x i was sent over the channel.

The communication process can now be defined using a probability model for the source, the channel and the receiver.

• The source is defined through an input probability space given by (X , prob X ), where prob X is a discrete probability distribution over X . We denote the input probability vector by p X = (prob X (x 1 ), . . . , prob X (x k )) .

• The channel is defined through P = (W (y|x)) (x,y)∈X ×Y .

• The receiver is defined through the output probability space given by (Y, prob Y ) where the output probability vector p Y = (prob Y (y 1 ), . . . , prob Y (y m )) is defined by the relation p Y = p X P .

We extend the conditional probability from symbols (letters) to finite length words in a natural manner: we define the transition probability W (y|x) as the probability of receiving the word y = y (1) . . . y (n) ∈ Y n knowing that x = x (1) . . . x (n) ∈ X n was sent over the channel. For "memoryless" channels we have

W (y|x) = n i=1 W (y (i) |x (i) )
Figure 2.2 shows two well known memoryless channels, the Binary Symmetric (BSC) and Binary Erasure (BEC) channels.

• The BSC(p) is defined for 0 p 1/2 by X = Y = {0, 1} and W (y

j |x i ) = 1 -p if y j = x i p if y j = x i
• The BEC(p) is defined for 0 p 1 by X = {0, 1}, Y = X ∪ {?} and W (y

j |x i ) =      1 -p if y j = x i p if y j =? 0 elsewhere
The "memoryless" property comes from the fact that both channels take a bit as input and flip (BSC) or erase (BEC) the bit independently of the past or the future. They are symmetric since the probabilities are the same regardless the value of the input. They are part of the big family of Binary Discrete Memoryless Channels (B-DMC). The parameter p is the crossover probability and represents the probability that a bit is not sent correctly, in particular it can be deleted in the case of a BEC or flipped in the case of a BSC.

Furthermore we define the notion of concatenated channel and degraded channel.

CODING THEORY

0 0 0 0 ? 1 1 1 1 1 -p p p 1 -p 1 -p p p 1 -p Figure 2.2 -(
Y → Z such that W = W " • W , that is W (z|x) = y∈Y W "(z|y)W (y|x).
We write

W d W to denote that W is degraded with respect to W . Lemma 2.2.4. d is a transitive relation W d W W d W " ⇒ W d W ". (2.1) Proof. Let W : X → Z , W : X → Y and W : X → U. By definition of a degraded channel we have that W = W 1 •W with W 1 : Y → Z and W = W 2 •W with W 2 : U → Y. Then W = W 3 • W with W 3 : U → Z is such that W 3 = W 1 • W 2 , which ends the proof.
An example of degradation from [START_REF] Richardson | Modern Coding Theory[END_REF] is the family of binary erasure channels {BEC(p)} 0 p 1 . For any pair of parameters (ε, δ) with 0 ε < δ 1 we have that BEC(δ) d BEC(ε) (see Figure 2.3).

Linear Codes

The main facts that we remind in this part are well known results coming from classical books like [START_REF] Macwilliams | The Theory of Error-Correcting Codes[END_REF] or [START_REF] Roth | Introduction to Coding Theory[END_REF].

CHAPTER 2. CODE-BASED CRYPTOGRAPHY 0 0 0 ? ? 1 1 1 1 -ε ε ε 1 -ε 1 -δ-ε 1-ε δ-ε 1-ε δ-ε 1-ε 1 -δ-ε 1-ε 1 Figure 2.3 -BEC(δ) seen as a degradation of BEC(ε) for 0 ε < δ < 1.
Preliminaries. All the objects that we recall in this part are defined over F 2 since we concentrate our study on binary linear codes.

Definition 2.2.5 (Binary linear code). An [n, k] linear code C over F 2 is a linear subspace of dimension k of the vector space

F n 2 .
Any element in C is called a codeword. The redundancy of C is the difference n -k and the rate of a code is denoted by r = k/n.

Generator and Parity check matrix.

A generator matrix for a [n, k] linear code is a k × n binary matrix (often denoted by G) whose rows form a basis for the code, as a vector space. A generator matrix is in systematic form, if G = (I k | R) where I k is the identity matrix and R is a k × (n -k) binary matrix. Definition 2.2.6 (Information set). Any subset I ⊂ {0, 1, . . . , n} of the positions of a [n, k] linear code is called an information set if for any generator matrix G the restriction of G to I, denoted G I , is invertible.

A binary (n -k) × n matrix H, is called a parity-check matrix of a linear code C = [n, k], if we have c ∈ C ⇔ Hc T = 0 n-k .
Since this equation is equivalent to HG T = 0 (n-k)×k and H has rank (n -k), we can compute the parity-check matrix of a code given the generator matrix by finding a basis for the kernel of G. This can be done easily when G is into systematic form since in this case we have

H = -R T | I n-k .
The dual of a linear code, denoted by C ⊥ is the binary linear code which consists of all vectors u ∈ F n 2 such that ∀ c ∈ C , u • c T = 0. The generator matrix of the dual code is the parity-check matrix of the code and we have

C ⊥ ⊥ = C .
Minimum distance of a linear code. The Hamming distance d H between two codewords is the number of coordinates on which they differ. The Hamming distance endows the set of binary n length vectors with a metric and the pair (F n 2 , d H ) forms a metric space called the Hamming space of dimension n.

The Hamming weight of a codeword is the number of its coordinates different from zero. The support of a codeword supp(c) is the set of its coordinates different from zero.

CODING THEORY

Definition 2.2.7 (Minimum distance). The minimum distance of a linear code is: There are code families for which the minimum distance is known, most of them are algebraic codes. In the general case estimating the minimum distance of a linear code is a hard problem.

d min (C ) = min (c,c * )∈C ×C c =c * d H (c, c * ) Since C is

Remark 2.2.11 (Decisional minimum distance problem). The minimum distance decision problem is NP-complete [Var97] and can be formalized as follow

Instance: A binary (n -k) × n matrix H and an integer ω > 0.

D : Y n → C .
The probability that a codeword c is decoded erroneously, given that c was transmitted over the channel W is

P err (c) def = y∈Y n D(y) =c W (y | c).
The error probability of D is

P err = max c∈C P err (c).
The error probability is a measure of the efficiency of a decoder and the goal is to have decoders with P err as small as possible. A particular decoding strategy is the maximum-likelihood decoder. Take for example the case of a BSC(p) with crossover probability 0 < p < 1/2. Then we have

W (y | c) = n i=1 W (y i | c i ) = p d H (y,c) (1 -p) n-d H (y,c) = (1 -p) n p 1 -p d H (y,c) . Since p/(1 -p) < 1 when p < 1/

Find:

a word e ∈ F n 2 of minimum Hamming weight such that s = He T , where s is the syndrome of y with respect to H. Remark 2.2.18. The decision problem it is known in the literature as the Syndrome Decoding Problem (SDP) and it is NP-complete [START_REF] Berlekamp | On the inherent intractability of certain coding problems[END_REF]. The SDP can be formalized as follow

Instance: A binary (n -k) × n matrix H, a vector s ∈ F n-k 2
and an integer ω > 0. Question: Is there a vector x ∈ F n 2 of weight ω, such that Hx T = s?

Operations on codes

• Basic constructions

The intersection between a code C and its dual is called the Hull of C

H(C ) = C ∩ C ⊥ . A code C with dimension k n/2 is called weakly self-dual if H(C ) = C ⊂ C ⊥ and self-dual if H(C ) = C = C ⊥ (in this case k = n/2).

• Shortened and Punctured codes

For a given code C and a subset J ⊆ {0, . . . , n -1} the punctured code P J (C ) and shortened code S J (C ) are defined as:

P J (C ) = (c i ) i / ∈J | c ∈ C ; S J (C ) = (c i ) i / ∈J | ∃c = (c i ) i ∈ C such that ∀i ∈ J , c i = 0 .
Instead of writing P {j} (C ) and S {j} (C ) when J = {j} we rather use the notation P j (C ) and S j (C ). 1 0 1 1 0 0 0 1 0 1 0 1 0 0 0 0 1 0    and I = {1, 2} be a set of positions. Then we have

-S I (C ) is a [4, 1
, 1] binary linear code with generator matrix 0 0 1 0

-P I (C ) is a [4, 3, 1] binary linear code with generator matrix    1 0 0 1 0 1 0 1 0 0 1 0   
We also have that C ⊥ is a [6, 3, 2] binary linear code with generator matrix

   1 0 0 1 0 1 0 1 0 0 0 1 0 0 1 1 0 1    .
Then we obtain

-S I C ⊥ is a [4, 1, 3
] binary linear code with generator matrix 1 1 0 1

-P I C ⊥ is a [4, 3, 1] binary linear code with generator matrix    1 0 0 0 0 1 0 0 0 0 0 1   
+ k 2 , min (2d 1 , d 2 )] denoted C C def = {(c 1 |c 1 + c 2 ) | c i ∈ C i i ∈ {1, 2}} .
If C i has generator matrix G i and parity check-matrix H i for i ∈ {1, 2} then a generator matrix and a parity check matrix for C are the two following block matrices

G 1 G 1 0 G 2 and H 1 0 -H 2 H 2 .
• Star product of codes.

Using the component-wise product of binary vectors in F n 2 (see Definition 2.2.8) we define the star product of two codes Definition 2.2.22 (Star product code). For i ∈ {1, 2} let C i be a [n, k i , d i ] binary linear code. Then the star product code of C 1 and C 2 is the binary linear code denoted C 1 C 2 defined as

C 1 C 2 def = Span F 2 {c 1 c 2 | c 1 ∈ C 1 and c 2 ∈ C 2 } . Proposition 2.2.23. Let C 1 be a [n, k 1 , d 1 ] binary linear code and C 2 be a [n, k 2 , d 2 ]
binary linear code. Then we have

d min (C 1 C 2 ) min{d 1 , d 2 }. 2.2. CODING THEORY dim (C 1 C 2 ) min n, k 1 k 2 - dim (C 1 ∩ C 2 ) 2 .
When the two codes are equal we will rather denote

   1 1 0 0 1 0 0 0 0 1 1 0 0 0 0 0 1 0    .
We remark that here the

dimension of C 2 equals 2+1 2 = 3.

Automorphism group of binary linear codes

Definition 2.2.25. Any mapping τ : F n 2 → F n 2 that preserves the Hamming distance is called an isometry. An automorphism of a linear code C is an isometry which maps C onto itself.

There are two types of isometries known in the literature, for linear codes, namely linear and semi-linear isometries [START_REF] Huffman | Codes and groups. Handbook of coding theory[END_REF]. In the case of binary fields we have the following result: the group of linear isometries of the Hamming space of dimension n over F 2 is isomorphic to the symmetric group S n [START_REF] Sendrier | The hardness of code equivalence over and its application to code-based cryptography[END_REF]. So we can define the permutation group of a binary linear code as the group of permutations of positions in the support of the code, that leave the code globally invariant: Definition 2.2.26 (Permutation group of a code). Let C be a [n, k, d] binary linear code and π ∈ S n .We denote by x π = (x π -1 (i) ) 1 i n the vector x permuted by π. C π = {c π | c ∈ C } denotes the permuted code of C . Then the permutation group of a code is

Perm (C ) def = {π ∈ S n | C π = C } When Perm (C )
is reduced to only one element then we speak of "trivial" group. Despite the fact that we know the permutation group of some code families, in general it is not an easy task to compute it. In Appendix A we give some relations between the permutation group of a code and its dual or its Hull.

Code families

We propose here to recall and give the main properties of some of the code families that are used in public key cryptography. We emphasize that during the thesis other code families were studied but we prefer to detail each one at adequate moment.

Reed-Muller codes. The Reed-Muller codes were introduced by David Muller [START_REF] Muller | Application of boolean algebra to switching circuit design and to error detection[END_REF] and rediscovered shortly after with an efficient decoding algorithm by Irving Reed [START_REF] Reed | A class of multiple-error-correcting codes and the decoding scheme[END_REF]. 1

CHAPTER 2. CODE-BASED CRYPTOGRAPHY

The scientific community was highly interested in this family of codes and therefore discovered many structural properties of Reed-Muller codes citeMS86. Definition 2.2.27 (Reed-Muller codes). Let m and r be two integers such that 1 r m and let n def = 2 m .Then the r th order Reed-Muller code R(r, m) is the binary linear code defined as the set of all vectors

(g(v 1 , . . . , v m )) (v 1 ,...,vm)∈F m 2 ∈ F n
2 , where g ∈ F 2 [x 1 , . . . , x m ] ranges over the set of polynomials over F 2 in m variables with degree at most r.

R(r, m) def = (g(v 1 , . . . , v m )) (v 1 ,...,vm)∈F m 2 | deg g r .
Properties 2.2.28 (Chapter 13, [START_REF] Macwilliams | The Theory of Error-Correcting Codes[END_REF]). The R(r, m) code has the following properties:

1. The R(r, m) code is a n, r i=0 m r , 2 m-r binary linear code. 2. The dual of a Reed-Muller code is a Reed-Muller code, namely R(r, m) ⊥ = R(m -r -1, m).

The number of minimum weight codewords equals [KT70]

W min = 2 r m r 2 , where m r 2 def = m-r-1 i=0 2 m-i -1 2 m-r-i -
Perm (R(r, m)) = GA(m).
Generalized Reed-Solomon and Goppa codes. Generalized Reed-Solomon codes, or shortly GRS codes, were introduced by Reed and Solomon in [START_REF] Solomon | Polynomial codes over certain finite fields[END_REF] and represent a powerful family of codes with many applications. Ten years after, a new class of codes, binary Goppa codes, was introduced by Valery Goppa [START_REF] Valerii | A new class of linear correcting codes[END_REF]. The main reason we detail Goppa codes in the same paragraph with GRS codes is because Goppa codes can be defined as subfield subcodes of GRS codes. Definition 2.2.31 (Generalized Reed-Solomon codes). Let k and n be two integers such that 1 k < n q where q = p m is a power of a prime number p. Let (x, y) ∈ F n q × F n q be a pair such that x is an n-tuple of distinct elements of F q and the elements y i are nonzero elements in F q . Then the Generalized Reed-Solomon code is

GRS k (x, y) def = {(y 1 f (x 1 ), . . . , y n f (x n ) | f ∈ F q [x] , deg(f ) < k} .

THE MCELIECE PUBLIC KEY ENCRYPTION SCHEME

The vector x is called the support of the code and y the multiplier vector. GRS codes are MDS since the minimum distance is d = n -k -1.

Generalized Reed-Solomon codes can be defined using the generator matrix, more exactly

G GRS k (x,y) =          1 1 . . . 1 x 1 x 2 . . . x n x 2 1 x 2 2 . . . x 2 n . . . . . . . . . . . . x k-1 1 x k-1 2 . . . x k-1 n                y 1 y 2 0 0 . . . y n       . Proposition 2.2.32. GRS k (x, y) ⊥ = GRS n-k (x, z),
where z is a non zero codeword of a [n, 1, n] GRS code with the same code locators and column multipliers as GRS k (x, y), i.e. H GRS n-1 (x,y) z T = 0.

We notice that the vector z with ∀ 1 i n , z i = 0 exists since any non zero codeword of a [n, 1, n] GRS code has a Hamming weight equal to n. Definition 2.2.33 (Alternant codes). Let C ⊂ F n p m be a linear code over F p m . Then an alternant code is a linear code over F n p of length n dimension k n -mr and minimum distance d r + 1 is defined by

Alt r (x, y) def = GRS r (x, y) ⊥ ∩ F n p .
Using Proposition 2.2.32 we obtain that Alt r (x, y) consists of all vectors c over F p such that H GRS n-r (x,y) c T = 0.

Definition 2.2.34 (Binary Goppa codes). Let x ∈ F n

2 m be a n -tuple of distinct elements and g ∈ F 2 m [x] be a polynomial of degree t such that ∀ i, g(x i ) = 0. Let y def = (1/g(x i ), . . . , 1/g(x n )) then the binary Goppa code is defined by

Γ(x, g) def = Alt t (x, y).

The McEliece Public Key Encryption Scheme

Textbook McEliece

The McEliece public key encryption scheme [START_REF] Mceliece | A Public-Key System Based on Algebraic Coding Theory[END_REF] is composed of three algorithms: key generation (KeyGen), encryption (Encrypt) and decryption (Decrypt).

The first step is the key generation algorithm that takes as input the integers n, k, t such that k < n and t < n and outputs the public key/private key pair (pk, sk). In order to encrypt a message m ∈ F k 2 one applies the Encrypt(, ) function. The last step is the decryption function that takes as input a ciphertext z and the private key sk and outputs the corresponding message m.

CHAPTER 2. CODE-BASED CRYPTOGRAPHY

1. Pick a generator matrix G of a [n, k] binary Goppa code Γ(x, g) that can corrects t errors.

2. Pick at random a k × k invertible matrix S and a n × n permutation matrix P . Here Decode(., .) is an efficient decoding algorithm for Γ(x, g). Notice that multiplying the error vector by a permutation does not change the weight of the vector. One can easily verify the correctness of the scheme by checking Decrypt(Encrypt(m, pk), sk) = m.

Security of the scheme

In the last part of his article McEliece brought up a discussion on the security of the scheme. The author proposed two types of attacks: firstly a key recovery attack in which he imagine an adversary that might recover the private generator matrix of the Goppa code and then use the Paterson algorithm to decode. Secondly he proposed a message recovery attack in which the codeword is retrieved from the ciphertext without the knowledge of the private key. In a sense McEliece established the major security threats the one has to consider when designing a code based cryptosystem, namely the Message Recovery Attack (MRA) and the Key Recovery Attack (KRA). He proposed as parameters for the scheme n = 2 10 and t = 50 as for the dimension of the code he picked k = 524. Nowadays, these parameters correspond to a 60 bits security level.

• Message Recovery Attack

The message recovery attack aims to retrieve the message that was sent using only the ciphertext and the public key. In this case an adversary has to solve the Syndrome Decoding Problem (see 2.2.18).

THE MCELIECE PUBLIC KEY ENCRYPTION SCHEME

The most efficient algorithm to solve the Syndrome Decoding Problem, for the moment, is the Information Set Decoding (ISD). The ISD algorithm searches for an information set such that the error positions are all out of the information set. Details about the different variants of ISD are given in [START_REF] Canto | Analysis of information set decoding for a sub-linear error weight[END_REF]. Almost all McEliece variants base their security on the assumption that the public code is indistinguishable from a random linear code. Therefore the security level against the MRA attacks is based on the complexity of the ISD, namely O(e -ω log(1-R)(1+o(1)) ) when ω = o(n) [START_REF] Canto | Analysis of information set decoding for a sub-linear error weight[END_REF].

• Key Recovery Attack

The key recovery adversary aims to retrieve the private key of a McEliece type cryptosystem given the public key. If the attacker manages to efficiently recover the private key, then he can also decode and find all the messages that have been encrypted with that key. Therefore it is considered as the most powerful possible attack. In the KRA scenario the adversary can be reduced to solve the code equivalence problem.

Code Equivalence Problem. Since we consider only binary linear codes we will define the Permutation Equivalence problem (see [START_REF] Sendrier | The hardness of code equivalence over and its application to code-based cryptography[END_REF]).

Distinguisher Attack

The distinguisher problem is a recent issue that had a major impact on the code-based cryptography. The question that we raise here is: Can a linear code be distinguished from a random linear code using an efficient deterministic algorithm ?

The article [FGO + 10] was a breakthrough in this field since it proposed a deterministic polynomial-time distinguisher for high rate Alternant codes, that is the dimension of the square code 2 . It allowed to distinguish many algebraic codes from random codes, like CHAPTER 2. CODE-BASED CRYPTOGRAPHY Reed-Solomon codes, Goppa codes, Reed-Muller codes etc. Ever since the original article on the distinguisher was published, many successful cryptanalysis used the star product, attacks that we recall them in Section 2.3.3.

McEliece PKC variants

Binary irreducible Goppa codes were proposed in the original paper of McEliece [START_REF] Mceliece | A Public-Key System Based on Algebraic Coding Theory[END_REF]. Even though the original parameters were broken by Bernstein, Lange and Peters in [START_REF] Daniel | Attacking and defending the McEliece cryptosystem[END_REF], they proposed a new set of parameters (see Figure 2.7). Despite their well known structure for the moment there are no efficient key recovery or decoding attacks against binary irreducible Goppa codes. A distinguisher exists in the case of high rate Goppa codes [FGO + 10]. But despite of this potential vulnerability there is no efficient algorithm for the moment exploiting the knowledge and the properties of the distinguisher.

The existence of weak keys for Goppa codes was raised by Sendrier and Loidreau in [START_REF] Loidreau | Weak keys in the McEliece public-key cryptosystem[END_REF]. They managed to distinguish the Goppa codes generated by binary irreducible polynomials. The number of such codes is exponentially smaller than the number of all Goppa codes, more exactly the probability of choosing a weak key is approximately 2 We also mention the existence of a compact variant of the McEliece scheme based on quasi-dyadic Goppa codes due to Misoczki and Barreto [START_REF] Misoczki | Compact McEliece keys from Goppa codes[END_REF], variant that is not yet broken in the binary case.

Generalized Reed-Solomon codes were proposed for the first time by Niederreiter in [START_REF] Niederreiter | Knapsack-type cryptosystems and algebraic coding theory[END_REF] but turned out to be an insecure solution. Indeed, six years after the article was published, Sidelnikov and Shestakov proposed a polynomial time attack against this variant [START_REF] Michilovich | On the insecurity of cryptosystems based on generalized Reed-Solomon codes[END_REF]. Nevertheless the idea of using GRS codes was reconsidered more than ten years after by Berger and Loidreau when they proposed to consider subcodes of GRS codes [START_REF] Thierry | How to mask the structure of codes for a cryptographic use[END_REF]. Unfortunately this technique was also attacked in two steps by Wieschebrink [START_REF] Wieschebrink | An attack on a modified Niederreiter encryption scheme[END_REF][START_REF] Wieschebrink | Cryptanalysis of the Niederreiter public key scheme based on GRS subcodes[END_REF], using the square code structure.

Other attempts to repair the Niederreiter variant were proposed by Wieschebrink [START_REF] Wieschebrink | Two NP-complete problems in coding theory with an application in code based cryptography[END_REF] who's idea was to add random column to the generator matrix. Baldi, Bianchi, Chiaralice, Rosenthal and Schipani [BBC + 16] proposed to use Wieschebrink's idea but in addition they suggest to change the permutation matrix. But many of these variants turned out to be extremely unsecured against square code type attacks or filtration type attacks [CGG + 14].

Reed-Muller codes were proposed by Sidelnikov's in [START_REF] Michilovich | A public-key cryptosytem based on Reed-Muller codes[END_REF]. This variant was firstly attacked by Minder and Shokrollahi [START_REF] Minder | Cryptanalysis of the Sidelnikov cryptosystem[END_REF]. In the case of Reed-Muller codes the Key

THE MCELIECE PUBLIC KEY ENCRYPTION SCHEME

Recovery Attack is reduced to solving the code equivalence problem since there is only one R(r, m). Minder and Shokrollahi managed to solve this problem using a filtration type attack based on the structure properties of the minimum weight codewords. The complexity of their algorithm was dominated by the minimum weight codewords searching algorithm.

Chizhov and Borodin proposed another attack. Their algorithm could solve the code equivalence problem, for some of the parameters of the Reed-Muller codes, in polynomial time [START_REF] Vladimirovich | The failure of mceliece pkc based on reed-muller codes[END_REF][START_REF] Chizhov | Effective attack on the McEliece cryptosystem based on Reed-Muller codes[END_REF].

A modified version [START_REF] Thiecoumba | Secure cryptographic scheme based on modified Reed Muller codes[END_REF] using the masking technique introduced by Wieschebrink was recently broken by Otmani and Kalachi using a square code type attack [START_REF] Otmani | Square code attack on a modified sidelnikov cryptosystem[END_REF].

Algebraic-geometry codes was suggested by Janwa and Moreno in 1996 [START_REF] Janwa | McEliece public key cryptosystems using algebraic-geometric codes[END_REF]. Several articles discussed the potential vulnerabilities of this variant and proposed algorithms that could be deployed to attack in some particular cases [START_REF] Faure | Cryptanalysis of the McEliece cryptosystem over hyperelliptic curves[END_REF][START_REF] Michilovich | On the insecurity of cryptosystems based on generalized Reed-Solomon codes[END_REF]. Nevertheless they can not be generalized and suffer in terms of efficiency. In [START_REF] Couvreur | A polynomial time attack against algebraic geometry code based public key cryptosystems[END_REF] Couvreur, Marquez-Corbella and Pellikaan proposed a polynomial type algorithm that works on codes from curves of arbitrary genus. They managed to recover an error-correcting pair from the square code using a filtration type attack and the structure of the square code.

Concatenated codes were the first family of probabilistic codes analyzed from a cryptographic point of view. Sendrier detailed in [START_REF] Sendrier | On the structure of a randomly permuted concatenated code[END_REF][START_REF] Sendrier | On the concatenated structure of a linear code[END_REF] the main vulnerabilities of ordinary concatenated codes.

LDPC codes presented a disputed class of codes in cryptography. In the book of Baldi [START_REF] Baldi | QC-LDPC Code-Based Cryptography[END_REF] all the details about the thrilling combats defeating and attacking the LDPC codes are given. Monico, Rosenthal and Shokrollahi were the first ones to propose and analyze a McEliece variant using low density parity check codes in [START_REF] Monico | Using low density parity check codes in the McEliece cryptosystem[END_REF]. Partially inspired by the idea of Gaborit to consider quasi-cyclic codes [START_REF] Gaborit | Shorter keys for code based cryptography[END_REF] 3 the new QC-LDPC cryptosystem was presented by Baldi and Chiaraluce in [START_REF] Baldi | Cryptanalysis of a new instance of McEliece cryptosystem based on QC-LDPC codes[END_REF]. Both BCH codes and LDPC codes with the quasi-cyclic structure were successfully cryptanalyzed by Otmani, Tillich and Dallot [START_REF] Otmani | Cryptanalysis of McEliece cryptosystem based on quasi-cyclic LDPC codes[END_REF]. In order to prevent the scheme to the last attack a modification that aims to increase the weight of the codewords in the dual of the LDPC code was proposed in [START_REF] Baldi | A new analysis of the TMcEliece cryptosystem based on QC-LDPC codes[END_REF]. This modification seems to be working for the moment since no other structural attacks were discovered.

Wild Goppa codes was a natural extension from binary Goppa codes to non binary fields. It was proposed by Bernstein, Lange and Peters in [START_REF] Daniel | Wild McEliece[END_REF] and [START_REF] Daniel | Wild McEliece Incognito[END_REF]. Many of the proposed parameters, namely those for which the extension degree was equal to 2, were broken by Couvreur, Otmani and Tillich using filtration type techniques [START_REF] Couvreur | New identities relating wild Goppa codes[END_REF][START_REF] Couvreur | Polynomial time attack on wild McEliece over quadratic extensions[END_REF].

Srivastava codes were proposed in [START_REF] Persichetti | Compact McEliece keys based on quasi-dyadic Srivastava codes[END_REF]. The author is using Quasi-Dyadic Srivastava codes and gives another application of these types of codes, namely for signature schemes. Even though the parameters for the signature were broken in [FOP + 14], the parameters for the encryption scheme are still valid.

CHAPTER 2. CODE-BASED CRYPTOGRAPHY

Convolutional codes represented among the shortest term solutions since between the proposal article by Londahl and Johansson [START_REF] Löndahl | A new version of McEliece PKC based on convolutional codes[END_REF] and an efficient attack by Landais and Tillich [START_REF] Landais | An efficient attack of a McEliece cryptosystem variant based on convolutional codes[END_REF] only one year passed.

Conclusion

Many of the McEliece variants were successfully cryptanalyzed, mainly because of their algebraic structure. Therefore probabilistic codes were proposed as possible substitutions for algebraic codes. We propose to analyze the security of two of the latest variants, namely the MDPC and Polar code variants.

Polar codes were firstly proposed by Shrestha and Kim [START_REF] Sujan | New McEliece cryptosystem based on polar codes as a candidate for post-quantum cryptography[END_REF]. A second proposal, using subcodes of Polar codes was given in [START_REF] Hooshmand | Reducing the key length of McEliece cryptosystem using polar codes[END_REF]. In Chapter 4 we analyze the security of the first variant and propose an attack based on the structure of the minimum weight codewords.

MDPC codes are probably the most suitable codes for the moment in a McEliece type scheme [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from moderate density parity-check codes[END_REF]. Many cryptographic arguments are in favor of using this family of codes like efficiency, small key size when used with a quasi-cyclic structure and the most important to our opinion the lack of algebraic structure. We analyze the security of the QC-MDPC McEliece in Chapter 5.

Decreasing Monomial Codes

Introduction

Decreasing Monomial codes are a family of algebraic codes that contains two well known class of codes: Polar and Reed-Muller codes. We introduced for the first time this family of codes during the cryptanalysis of a public key encryption scheme à la McEliece using Polar codes [START_REF] Sujan | New McEliece cryptosystem based on polar codes as a candidate for post-quantum cryptography[END_REF][START_REF] Hooshmand | Reducing the key length of McEliece cryptosystem using polar codes[END_REF]. At that moment few things were known about the structure of Polar codes, even though they were studied since 2007, when they were introduced by Arıkan [START_REF] Arıkan | Channel polarization: a method for constructing capacityachieving codes for symmetric binary-input memoryless channels[END_REF]. The main results concerning Polar codes were about the performance, construction and decoding capacity.

Contributions

Our first major contribution is to propose a partial order , on the set of monomials in the polynomial ring F 2 [x 0 , x 1 , . . . , x m-1 ]/(x 2 0 -x 0 , . . . , x 2 m-1 -x m-1 ), which is used to redefine Polar codes as vector spaces spanned by the evaluation of monomials that belong to a decreasing monomial subset I.

We define three families of codes ordered by inclusion and analyze the structure of these codes: Decreasing Monomial codes ( ) are included in the class of Weakly Decreasing Monomial codes ( w ), which are included in the class of Monomial codes. We focus our interest on the class of Decreasing Monomial codes and try to answer several fundamental questions like: the minimum distance, the permutation group, the duality properties and many more.

Our first major contribution is to prove that Reed-Muller codes and Polar codes are Decreasing Monomial codes. This result represent a new step into classifying "universal" Polar codes for the Binary Discrete Memoryless Channels, which was one of the most challenging problems proposed in [START_REF] Arıkan | Channel polarization: a method for constructing capacityachieving codes for symmetric binary-input memoryless channels[END_REF].

Among the most relevant properties of Decreasing Monomial codes that we reveal in this chapter we enumerate: the dual of a Decreasing Monomial code is still a Decreasing Monomial code, the permutation group of Decreasing Monomial codes contains the Lower Triangular Affine Group, which is a subgroup of the General Affine group. We also raise another non-trivial question regarding Decreasing Monomial codes, that is the number of minimum weight codewords. For that we give a counting technique for the number of minimum weight codewords based on Young diagrams and hence propose a closed formula. Several opened questions remain about Decreasing Monomial codes, fact that we point

MONOMIAL CODES

out at the end of the chapter. Some of the results in this Chapter were published in [START_REF] Bardet | Algebraic properties of polar codes from a new polynomial formalism[END_REF].

Monomial Codes

Definitions and Properties

Throughout this chapter we will use the following conventions and notations Notation 3.2.1.

• The ambient space is the polynomial ring

R m = F 2 [x 0 , x 1 , . . . , x m-1 ]/(x 2 0 -x 0 , . . . , x 2 m-1 -x m-1 ).
• We set n = 2 m .

• Any binary vector u ∈ F m 2 is denoted by u = (u 0 , . . . , u m-1 ), where u m-1 is the most significant bit. Furthermore we will define an order on the elements of F m 2 . A natural order is to associate to any element u ∈ F m 2 the integer u ∈ Z defined by u = m-1 i=0 u i 2 i , and then to use the natural order on the integers. Notice that that value u is computed regardless of the fact that

u i ∈ F 2 .
This order it is known in the literature as the index order and it is already used by Arıkan in [START_REF] Arıkan | Channel polarization: a method for constructing capacityachieving codes for symmetric binary-input memoryless channels[END_REF]. We remark that the index order is equivalent to the lexicographic order induced by 0 < 1, over the sequences u m-1 . . . u 0 . In other words, given u and v we say that u is smaller than or equal to v if u m-1 . . . u 0 lex v m-1 . . . v 0 . The following example illustrates our proposal Example 3.2.2. Let v = (0, 1, 0, 1) and u = (1, 0, 0, 1). We have that u lex v since 1001 lex 1010.

On the other hand v = 2 + 8 = 10 and u = 1 + 8 = 9 and by the index order we obtain u < v.

We choose here to write the elements in F m 2 in decreasing index order, which means that we begin with the greatest element (1, . . . , 1) and end up with the smallest element (0, . . . , 0). Example 3.2.3. For m = 2 we have

F 2 2 = [(1, 1
), (0, 1), (1, 0), (0, 0)].

Next we will define the evaluation function that associate to a polynomial g ∈ R m the binary vector denoted by ev(g) in F n 2 . Definition 3.2.4. Let g ∈ R m and order the elements in F m 2 with respect to the decreasing index order. Define the evaluation function

R m → F n 2 g → ev(g) = g(u)
u∈F m 2 CHAPTER 3. DECREASING MONOMIAL CODES Lemma 3.2.5. [START_REF] Carlet | Boolean functions for cryptography and error correcting codes. Boolean models and methods in mathematics[END_REF] The function ev is a bijection.

Corollary 3.2.6. The function ev defines a vector space isomorphism between the vector space (R m , +, •) and (F n 2 , +, •). Example 3.2.7. For m = 3 and g = x 0 x 1 + x 0 we have 111 011 101 001 110 010 100 000 ev(x

0 x 1 ) = 1 0 0 0 1 0 0 0 ev(x 0 ) = 1 0 1 0 1 0 1 0 ev(g) = 0 0 1 0 0 0 1 0 Remark 3.2.8.
The polynomials in R m are also known in the literature as a particular representation of Boolean function, that is the Algebraic Normal Form, or shortly ANF (see [START_REF] Carlet | Boolean functions for cryptography and error correcting codes. Boolean models and methods in mathematics[END_REF][START_REF] Carlet | Vectorial boolean functions for cryptography. Boolean models and methods in mathematics[END_REF]). In [Car10a, Section 2.1] several properties are given, including those regarding the ev function. Since ev is bijective, an efficient algorithm to compute its inverse is given. This algorithm is called the Fast Mobius Transform and it is running in m2 m bit operations.

An important part in the formalism will be played by the monomials.

Notation 3.2.9. We denote by x i the monomial

x i 0 0 • • • x i m-1 m-1 , where i ∈ F m 2 .
We also denote the set of monomials

M m def = x i | i = (i 0 , . . . , i m-1 ) ∈ F m 2 .
For any monomial g ∈ M m of degree 1 s m we use the notation g = x l 1 . . . x ls where 0

l 1 < l 2 • • • < l s m -1.
We also denote the support of a monomial by ind(g) = {l 1 . . . , l s }. Proof. This comes first of all from the linear independence of the monomials in R m and second of all from the fact that ev is bijective (see Lemma 3.2.5).

Remark 3.2.12. R(r, m) is a monomial code with dimension k = r i=0 m i . In order to demonstrate this fact we recall the definition of R(r, m) from 2.2.27, more exactly R(r, m)

def = ev(g) | g ∈ R m , deg g r .
The later remark stress out the importance of the degree of polynomials involved in a Reed-Muller code. We will see in Section 3.5 that the notion of degree it is also used to determine the minimum distance of a Monomial code. Therefore we introduce the following notation Notation 3.2.13. Let I ⊆ M m . We denote the subset of monomials of degree r in I by

I r = {g ∈ I | deg(g) = r}.

Construction of Monomial codes

In order to construct monomial codes we use Arikan's definition [START_REF] Arıkan | A performance comparison of polar codes and reed-muller codes[END_REF]. It is mainly based on the recursive Plotkin construction. Therefore we use this last construction to define the generator matrix of a monomial code. We will call this matrix the monomial evaluation basis. Let's begin by recalling the Kronecker product of two matrices.

A ⊗ B def =     a 1,1 B • • • a 1,ca B . . . b i,j B . . . a ra,1 B • • • a ra,ca B     .
Using the Kronecker product we define the following matrix with coefficients in F 2

G m def = 1 0 1 1 ⊗ • • • ⊗ 1 0 1 1 m times . Example 3.2.15. When m = 2 we have G 2 =      1 0 0 0 1 1 0 0 1 0 1 0 1 1 1 1      .
Remark 3.2.16. We notice that G m is a basis for the vector space (F n 2 , +, ×). Indeed, G m is a matrix with full rank, more exactly rank(G m ) = 2 m .

In the next paragraph we will prove that each row of G m is the evaluation of a monomial in M m on all the elements u of F m 2 , in decreasing index order. Since any monomial is defined as x i with i ∈ F m 2 we choose the same order on the exponents i as for the evaluation elements u. For example when m = 2 we evaluate the monomials in the in the following order:

[x 0 x 1 , x 1 , x 0 , 1].
Example 3.2.17. For m = 2 we have 11 01 10 00 11 ev(x 0 x 1 ) 1 0 0 0 01 ev(x 1 ) 1 1 0 0 10 ev(x 0 ) 1 0 1 0 00 ev(1) 1 1 1 1 Remark 3.2.18. The function ev defines a one-to-one mapping between the rows of the monomial evaluation matrix (in the previous example G 2 , which is a generating matrix for the vector space (F 4 2 , +, ×)) and the monomials in M m (in the example M 2 = {1, x 0 , x 1 , x 1 x 0 } which is a generating basis for (R 2 , +, ×)). CHAPTER 3. DECREASING MONOMIAL CODES Lemma 3.2.19. G m is the monomial evaluation basis for the vector space F n 2 and

G m [i] = ev(x i 0 0 . . . x i m-1 m-1 ).
Proof. We use induction on m. For m = 1 we have that

ev(x 0 ) =(1, 0) ev(1) =(1, 1)
which equals G 1 . We suppose that our statement is true up to an integer m and prove it for m + 1. By

definition we have G m+1 = G m 0 2 m G m G m .
From the order on the evaluation points we have that the first half of the columns is represented by the 2 m elements having their last position equal to 1, namely (u 0 , . . . , u m-1 , 1), and the second half by the elements (u 0 , . . . , u m-1 , 0) where

u i ∈ F 2 .
Using the same argument we have that the lower half of the rows is represented by the monomials involving only the first m variables, more exactly x 0 . . . x m-1 , . . . , x 0 , 1 m . As for the upper half, the monomials here admit x m as variable, namely the set of monomials is {x 0 . . . x m , . . . , x 0 x m , x m }. Therefore the evaluation of the first rows block on the first columns block equals G m since x m equals one on this block. In the same sense on the second column block x m equals zero so we obtain 0 2 m . As for the lower part the variable x m is not involved in the evaluation, thus we obtain that the two blocks are equal to G m .

In conclusion G m+1 is the evaluation of all the monomials in m + 1 variables over all the elements (u 0 , . . . , u m ) ∈ F m+1 2 .

Straightforward we can define Monomial codes in an equivalent manner: Proposition 3.2.20. Let G m be the generator matrix for the vector space F n 2 . Then any row sub-matrix of G m defines a linear code C ⊆ F n 2 , that we call monomial code.

Notation 3.2.21. Any row sub-matrix of G m indexed by the monomials in the set I will be furthermore denoted by G I .

Polar codes are Monomial codes

In order to prove that Polar codes are monomial codes we could just recall the definition given by Arıkan in [START_REF] Arıkan | Channel polarization: a method for constructing capacityachieving codes for symmetric binary-input memoryless channels[END_REF]. He pointed out that the generator matrices of both Reed-Muller and Polar codes are obtained by a suitable choice of the rows of G m . Nevertheless, in order to have a better understanding on how the selecting rule works for Polar codes, we recall the construction technique that was originally used for this family of codes.

Polar codes

The Polar codes construction is based on the channel combining (Figure 3.1) and splitting technique (Figure 3.3). Arıkan used this two techniques in [START_REF] Arıkan | Channel polarization: a method for constructing capacityachieving codes for symmetric binary-input memoryless channels[END_REF], in order to construct

MONOMIAL CODES

the circuit that we illustrate in Figure 3.2. This circuit will be used both for encoding and decoding of Polar codes over a specific channel. For this purpose we denote by W the memoryless channel for which the polar code is devised. Its input alphabet is binary and its output alphabet is denoted by Y and it is also assumed to be discrete. We assume that the channel is symmetric meaning that there exists a permutation π of Y which is also an involution (π -1 = π) and W (y|1) = W (π(y)|0) for all y ∈ Y.

u 2 W y 2 u 1 W y 1 Figure 3.1 -The channel combining for m = 1
Duplicating the construction m times results in a complex circuit, denoted W m , that we plot in Figure 3.2. The index order is used for the row numbers (Arıkan's notation)

The resulting channel W m can be defined as a vector channel, for example W 1 is defined by

W (y 1 , y 2 | u 1 , u 2 ) = W (y 1 | u 1 )W (y 2 | u 1 ⊕ u 2 ).
Using the second technique the circuit will be split into 2 m synthetic channels. We define the Arıkan channel transforms W + and W -of W which are both binary-input memoryless symmetric channel with transitions probabilities specified by Definition 3.2.22 (Synthetic channels).

W -(y 1 , y 2 |u 2 ) def = 1 2 u 1 ∈F 2 W (y 1 |u 1 )W (y 2 |u 1 ⊕ u 2 ) W + (y 1 , y 2 , u 2 |u 1 ) def = 1 2 W (y 1 |u 1 )W (y 2 |u 1 ⊕ u 2 )
Here the output alphabet of

W -is Y × Y whereas the output alphabet of W + is Y × Y × F 2 .
CHAPTER 3. DECREASING MONOMIAL CODES Remark 3.2.23. Notice that the formula for W + (y 1 , y 2 , u 2 | u 1 ) can be deduced directly from the definition on W 1 using Bayes formula. Indeed,

W + (y 1 , y 2 , u 2 | u 1 ) = W (y 1 , y 2 | u 1 , u 2 )prob(u 2 | u 1 ) which implies W + (y 1 , y 2 , u 2 | u 1 ) = 1 2 W (y 1 , y 2 | u 1 , u 2 ).
As for the second synthetic channel we have

W -(y 1 , y 2 |u 2 ) = u 1 ∈F 2 W (y 1 , y 2 , u 1 | u 2 ) = u 1 ∈F 2 W (y 1 , y 2 | u 1 , u 2 )prob(u 1 | u 2 ) = 1 2 u 1 ∈F 2 W (y 1 |u 1 )W (y 2 |u 1 ⊕ u 2 ). u 2 W y 2 u 2 W y 2 u 1 W y 1 u 1 W y 1 Figure 3.3 -The two synthetic channels (left) W -: F 2 → Y × Y , (right) W + : F 2 → Y × Y × F 2
In order to have a better understanding of the synthetic channels we detail in Appendix B how the successive cancellation decoder works. Notice that encoding (u 2 , u 1 ) into (u 2 ⊕ u 1 , u 1 ) can also be described as vector matrix multiplication

(u 2 , u 1 ) × G 1 = (u 2 + u 1 , u 1 ).
Therefore we can identify the channel W -to W x 0 and W + = W 1 . Straightforward we define the synthetic channel corresponding to a monomial Definition 3.2.24. Let g ∈ M m . Then the synthetic channel corresponding to g is

W g = W v m-1 •••v 0 , where v i = -if x i |g and v i = + otherwise.
Example 3.2.25. For instance when m = 5 we have W x 0 x 1 x 3 = W +-+--. Figure 3.4 plots the synthetic channels corresponding to each monomial for m = 3.

We also need to define the Bhattacharyya parameter B (W ) of a binary-input symmetric channel W Definition 3.2.26. Let W be a B-DMC with output alphabet Y. Then the Bhattacharyya parameter of the channel W is

B (W ) = y∈Y W (y|0)W (y|1) (3.1)

MONOMIAL CODES

7: 111 : x 0 x 1 x 2 : W --- W 6: 011 : x 1 x 2 : W --+ W 5: 101 : x 0 x 2 : W -+- W 4: 001 : x 2 : W -++ W 3: 110 : x 0 x 1 : W +-- W 2: 010 : x 1 : W +-+ W 1: 100 : x 0 : W ++- W 0: 000 : 1 : W +++ W x 0 x 1 x 2 Figure 3
.4 -The combined circuit for m = 3 with the monomial representation and the corresponding synthetic channels. The rows are in decreasing index order.

Example 3.2.27. In the case of the Binary Erasure Channels and Binary Symmetric Channels we have

• B (BEC(p)) = p. • B (BSC(p)) = 2 p(1 -p).
Remark 3.2.28. Let W be a BEC(p) then we have that B (W -) = 2p -p 2 and B (W + ) = p 2 . This fact can be proved directly either from the model of the synthetic channels in the case of the BEC family (see Exemple B.0.3) or by computing the Bhattacharyya parameter on W -and W + using Defintion 3.2.26 and 3.2.22.

With these definitions we can construct a polar code of length n = 2 m and dimension k devised for a binary-input symmetric channel W . Definition 3.2.29. The polar code of length n = 2 m and dimension k devised for the channel W is the monomial code C (I) where I is the set of k monomials in M m which take the k smallest values B (W g ) among all g in M m .

Note that the output alphabet size of the channels W g is exponential in m which makes this ranking rather delicate. However there are various methods for computing these k "best" channels. The first method was proposed by Arıkan and uses the Monte Carlo simulation in order to estimate the Bhattacharyya parameters [START_REF] Arikan | Channel polarization: A method for constructing capacity-achieving codes[END_REF]. No more that one year after, he proposed to ignore the actual channel type that is used and compute the best channels in the case of a BEC [START_REF] Arıkan | Channel polarization: a method for constructing capacityachieving codes for symmetric binary-input memoryless channels[END_REF]. Another technique based of the factor graph is used by Mori and Tanaka in [START_REF] Mori | Performance of polar codes with the construction using density evolution[END_REF]. Tal and Vardy proposed in [START_REF] Tal | How to construct polar codes[END_REF] a sandwich method where each channels is caught between a degraded and an upgraded channel that are apparently very tight in terms of capacity.

Decreasing and Weakly Decreasing Monomial Codes

Definitions and Properties

Polar codes and Reed-Muller codes are both monomial codes. But the family of monomial codes is too large to explain the intriguing algebraic properties of polar codes (for instance their very large automorphism group). Therefore we will introduce a partial order over the set of monomials Definition 3.3.1. Let f and g be two monomials in M m .

• The w order between f and g is defined as

f w g iff f |g.
• The order between f and g is defined as

-when deg(f ) = deg(g) = s and f = x i 1 . . . x is , g = x j 1 . . . x js we have f g iff ∀ 1 s i j .
when deg(f ) < deg(g) we have

f g iff ∃g * ∈ M m s.t. f g * w g. Remark 3.3.2.
• The two relations w and are well defined partial orders since they are reflexive, antisymmetric, and transitive.

• The order of divisibility was already used in the case of Polar codes but in a completely different context by Mori and Tanaka in [MT09b, Section VI]. In their case the purpose was to tighten the bounds of the error block probability of a Polar code designed for the BEC family.

• The order w is weaker than in the sense that any pair of monomials f, g that satisfy the relation f w g, also satisfy the relation f g, by definition. The inverse is not always true, take for example f = x 0 x 2 and g = x 1 x 2 . By definition f g but f w g.

• The constant polynomial 1 is the smallest element for both and w . We also have that for the variables are totally ordered

x 0 x 1 • • • x m-1 .

DECREASING AND WEAKLY DECREASING MONOMIAL CODES

Weakly Decreasing Monomial Codes

Definition 3.3.3. Let f and g be two monomials in M m such that f w g and I ⊂ M m .

• We define the closed interval [f, g] w with respect to the partial order w as the set of monomials h ∈ M m such that f w h w g.

• The set I is called a weakly decreasing set if and only if (f ∈ I and g w f ) implies g ∈ I.

• Let I weakly decreasing set. We define the subset of maximum monomials of I

I max w = {f ∈ I | ∃g ∈ I, g = f s.t. f w g}.
We notice that an interval [f, g] w is composed of at least two elements f and g.

Remark 3.3.4. Any weakly decreasing set is uniquely defined as a union of weakly decreasing intervals :

I = g∈Imax w [1, g] w .
We stress out that in general for a weakly monomial set I the set of maximum monomials with respect to w order is different from the set of maximum degree monomials. Nevertheless the two sets might be equal and this is the case when ∀g ∈ I max w , deg(g) = r, where 0 r m.

R(r, m) = C   deg(g)=r [1, g] w   .
If I represents the set of monomial defining the R(r, m) code, then we have equality between the subset of maximum degree monomials and the subset of maximum monomials for the order w :

I max w = I r .
Proof. The result is a direct consequence of the definition of Reed-Muller codes 2.2.27 and the Definition 3.3.1 of w .

Decreasing Monomial Codes

Definition 3.3.7. Let f and g be two monomials in M m such that f g and I ⊂ M m .

• We define the closed interval [f, g] with respect to the partial order as the set of monomials h ∈ M m such that f h g.

• The set I is called a decreasing set if and only if (f ∈ I and g f ) implies g ∈ I.

CHAPTER 3. DECREASING MONOMIAL CODES

x 0 x 1 x 2 x 3 x 1 x 2 x 3 x 0 x 2 x 3 x 0 x 1 x 3 x 0 x 1 x 2 x 2 x 3 x 1 x 3 x 1 x 2 x 0 x 3 x 0 x 2 x 0 x 1 x 3 x 2 x 1 x 0 1 Figure 3
.5 -The Hasse diagram for the weakly decreasing monomial order when m = 4

• Let I decreasing set. We define the subset of maximum monomials of I

I max = {f ∈ I | ∃g ∈ I, g = f s.t. f g}.
Remark 3.3.8. Let I ⊆ M m be a decreasing set.

• Then I is also a weakly decreasing set and we have the following equalities

I = g∈Imax [1, g] . and I = f ∈Imax w [1, f ] w . • In general the intervals are different since [1, f ] w ⊆ [1, f ] .
And this is a direct implication of the fact that I max ⊆ I max w .

Nonetheless there are particular cases when the two intervals are equal, namely for any f = x 0 . . . x t with 0 t m -1.

• We also stress out that as for the weakly decreasing sets, the set of maximum degree monomials is, in general, different from the set of maximum monomials with respect to the order.

But there is a particular case when the two sets are equals, for example when the set of maximum monomials is reduced to one element I max = {x 0 . . . x t }. Then we have I max = I max w = I t .

• We notice that that for any monomial set I the subset of maximum degree monomials I t is independent to any order property that I might satisfy. For this reason in general I t is different from the subset of maximum monomials with respect to w or .

Definition 3.3.9 (Decreasing monomial code). Let I ⊂ M m be a decreasing set. Then the linear code C (I) is called decreasing monomial code.

DECREASING AND WEAKLY DECREASING MONOMIAL CODES

Proposition 3.3.10. Let f , g in M m such that f g and let us set f * , g * as the monomials in M m such that f = f * gcd(f, g) and g = g * gcd(f, g), then we have:

f * g * .
Furthermore, for any h in M m such that gcd(g, h) = 1, we have:

f h gh. Proof. If gcd(f, g) = 1 we directly deduce the relation f * g * . So suppose that gcd(f, g) = 1.
Firstly consider the case deg(f

) = deg(g) = s. Let ind(f ) = {i 1 , . . . , i s } and ind(g) = {j 1 , . . . , j s } where 1 s m. Now let ind(gcd(f, g)) = {i l 1 , . . . , i lr } = {j k 1 , . . . , j kr } = ind(f ) ∩ ind(g) with 1 r s.
By definition of the support of a monomial and of the order we have that i l 1 = j k 1 with k 1 l 1 , and . . . , and i lr = j kr with k r l r . Now consider any element in ind(gcd(f, g)), for example i l 1 . Then we have i

l 1 = j k 1 with k 1 j 1 . Since i k 1 < j m 1 +1 and . . . i l 1 -1 < j l 1 we obtain f /x i l 1 g/x jm 1 . Continue down to f /(x i l 1 . . . x i lr ) g/(x k 1 . . . x kr ). Secondly consider that deg(f ) < deg(g).
Then by definition of the order we have g = g 1 g 2 with deg(g 1 ) = deg(f ) and f g 1 . This implies that we can write f = f * gcd(f, g 1 ) gcd(f, g 2 ) and g = g * 1 gcd(f, g 1 )g * 2 gcd(f, g 2 ) with g i = g * i gcd(f, g i ) for 1 i 2. By the first step of our proof we deduce f * gcd(f, g 2 ) g * 1 , which implies f * gcd(f, g 2 ) g * 1 g * 2 gcd(f, g 2 ). We directly deduce that f * g * 1 g * 2 = g * .

Remark 3.3.11. The condition on h to be prime with f and g is essential. Indeed, for instance

x 0 x 1 but x 0 x 1 x 2 1 since x 2 1 = x 1 in R m .
Proposition 3.3.12. Reed-Muller codes are Decreasing Monomial codes given by

R(r, m) = C ([1, x m-r • • • x m-1 ] ) . (3.2)
Proof. Let I be the set of monomials in R m of degree at most r. We have R(r, m) = C (I). Note now that x m-r . . . x m-1 belongs to I and that all monomials f of degree at most r are smaller than or equal to this monomial

f x m-r • • • x m-1 . This implies I ⊆ [1, x m-r • • • x m-1 ] .
Moreover no monomial of degree greater than r can be smaller than x m-r . . . x m-1 . Therefore we have • Let m = 4 and I be a monomial set defined by

I = [1, x m-r • • • x m-1 ] . CHAPTER 3. DECREASING MONOMIAL CODES x 0 x 1 x 2 x 1 x 2 x 0 x 2 x 0 x 1 x 2 x 1 x 0 1 x 0 x 1 x 2 x 3 x 1 x 2 x 3 x 0 x 2 x 3 x 0 x 1 x 3 x 2 x 3 x 0 x 1 x 2 x 1 x 3 x 1 x 2 x 0 x 3 x 0 x 2 x 3 x 0 x 1 x 2 x 1 x 0 1 Figure 3.
I = {1, x 0 , x 1 , x 2 , x 3 , x 0 x 1 , x 0 x 2 , x 0 x 3 , x 1 x 2 }.

Then we have that I is a decreasing set with

I = [1, x 0 x 3 ] ∪ [1, x 1 x 2 ] . We also have I max = {x 0 x 3 , x 1 x 2 } and I 2 = {x 0 x 1 , x 0 x 2 , x 0 x 3 , x 1 x 2 }.

On the other hand I is a weakly decreasing set

I = [1, x 0 x 1 ] w ∪ [1, x 0 x 2 ] w ∪ [1, x 1 x 2 ] w ∪ [1, x 0 x 3 ] w .
Here we have that I max w = I 2 .

• Let = 4 and J be a monomial set defined by

J = {1, x 0 , x 1 , x 2 , x 3 , x 0 x 3 , x 1 x 2 }.
Then we have that J is a weakly decreasing monomial set, more exactly

J = [1, x 0 x 3 ] w ∪ [1, x 1 x 2 ] w . We also have that J max w = J 2 = {x 0 x 3 , x 1 x 2 }.
But J is not a decreasing monomial set since x 0 x 2 ∈ J.

DECREASING AND WEAKLY DECREASING MONOMIAL CODES

Polar codes are Decreasing Monomial codes

In this part we will focus on proving that Polar codes are Decreasing Monomial codes. We will begin by considering the Binary Erasure Channel and then the general case of Binary Discrete Memoryless Channels. We point out that an equivalent demonstration of the fact that Polar codes over the B-DMC are Decreasing Monomial codes was given in parallel by Christian Schürch in [START_REF] Schürch | A partial order for the synthesized channels of a polar code[END_REF].

Polar codes over the BEC

The Binary Erasure Channel was a deeply studied case and also the first channel for which we proved that Polar codes satisfy the decreasing property.

Proposition 3.3.15. The Bhattacharyya parameter for the synthetic channels in the case of a BEC(p) is:

B W x u (p) = f u 0 • • • • • f u m-1 (p),
where

f 0 : [0, 1] → [0, 1] p → p 2 and f 1 : [0, 1] → [0, 1] p → 1 -(1 -p) 2 .
This fact comes directly from the Definition 3.2.26 of the Bhattacharyya parameter and Example B.0.3 on the BEC(p).

Remark 3.3.16. We remark that the two functions f 0 , f 1 are increasing functions and thus B W x u is an increasing function over [0, 1] as the composition of increasing functions. Proposition 3.3.17 (Bhattacharyya function of a monomial over the BEC).

Let g = x g 1 . . . x gs with 0 g 1 < • • • < g s m -1. Then the Bhattacharyya function for the BEC(p) associated to g is

B (W g )(p) = f g 1 0 • f 1 • f g 2 -g 1 -1 0 • f 1 • • • • f gs-g s-1 -1 0 • f 1 • f m-gs-1 0 (p).
Example 3.3.18. For m = 2 we have

B (W x 0 x 1 ) = B W --= f 1 • f 1 = p(2 -p) (2 -p(2 -p)) B (W x 1 ) = B W -+ = f 0 • f 1 = p 2 (2 -p) 2 B (W x 0 ) = B W +-= f 1 • f 0 = p 2 (2 -p 2 ) B W 1 = B W ++ = f 0 • f 0 = p 4 .
We notice that for a given binary erasure channel BEC(p) the order induced by the Bhattacharyya parameter on the synthetic channels is a total order. We raise here a more general question, that is what happens when the crossover probability of the channel it's unknown to the designer? In this case we define the Bhattacharyya order over the family of {BEC(p)} 0 p 1 . Definition 3.3.19 (Bhattacharyya order over the family of BEC). Let W and W be two synthetic channels. Then we say that B (W ) B (W ) if and only if for any erasure probability p ∈ [0, 1] we have that

B (W )(p) B (W )(p).

CHAPTER 3. DECREASING MONOMIAL CODES

We say that two channels W and W are incomparable, with respect to the Bhattacharyya order, if there exist a pair of erasure probabilities (p, p )

∈ [0, 1] × [0, 1] such that B (W )(p) < B (W )(p) and B (W )(p ) > B (W )(p ).
In Figure 3.7 and 3.8 we plot the Bhattacharyya order over the family of BEC as a function of the channel probability for all the synthetic channels. We show that up to m = 4 the Bhattacharyya order is total. Starting from m = 5 the Bhattacharyya order over the family of BEC becomes a partial order. In this particular case the monomials that are no longer comparable are x 4 and x 1 x 0 . Moreover they generate, with respect to the divisibility order, two other non comparable pair of monomials x 4 x 3 with x 3 x 1 x 0 and x 4 x 2 with x 2 x 1 x 0 . But this partial order it is stronger that the " " and thus for this family of channels Polar codes might admit a better ordering than the , fact that opens new perspectives in this topic.

Figure 3.7 -The Bhattacharyya parameter for all the synthetic channels when m = 4

In the next paragraph we will detail some necessary properties for proving that Polar codes are Decreasing Monomial codes over the BEC.

Lemma 3.3.20. For i ∈ {1, . . . , s}, let l i , l * i be increasing functions from [0, 1] → [0, 1] such that ∀x ∈ [0, 1], l * i (x) l i (x). Let Z = l 1 • • • • • l s and Z * = l * 1 • • • • • l * s , then ∀x ∈ [0, 1], Z * (x) Z(x).
Proof. The proof is by induction on s. For s = 1, the result comes from the assumption. For s 2, let

Z s-1 = l 2 • • • • • l s and Z * s-1 = l * 2 • • • • • l * s , then for any x ∈ [0, 1] by induction we have Z * s-1 (x) Z s-1 (x)
, hence using the fact that l * 1 is increasing and that l *

1 l 1 we get Z * (x) = l * 1 (Z * s-1 (x)) l * 1 (Z s-1 (x)) l 1 (Z s-1 (x)) = Z(x). Lemma 3.3.21 (The bit position). Let g = x g 1 . . . x g s-1 x gs with 0 g 1 < • • • < g s m-1 and g ( * i) = x g 1 . . . x g i x g * i+1 x g i+2 . . . x gs with g i g * i+1 g i+1 . Then g ( * i) g and B W g * B (W g ).

DECREASING AND WEAKLY DECREASING MONOMIAL CODES

Figure 3.8 -The Bhattacharyya parameter for all the synthetic channels when m = 5

Proof. From the definition of the Bhattacharyya parameter we have

B (W g ) = l 1 • f g i+1 -g * i+1 0 • f 1 • l 3 and B W g * = l 1 • f 1 • f g i+1 -g * i+1 0 • l 3 where l 1 = f g 1 0 • f 1 • • • • • f g i -g i-1 -1 0 • f 1 • f g * i+1 -g i -1 0 and l 3 = f g i+2 -g i+1 -1 0 • f 1 • • • • • f m-gs-1 0 . Let l * 2 = f 1 • f g i+1 -g * i+1 0 and l 2 = f g i+1 -g * i+1 0
• f 1 . In order to use the previous lemma, it remains to prove that

, ∀y ∈ [0, 1] l * 2 (y) l 2 (y). Since l * 2 (y) = y 2 g i+1 -g * i+1 (2 -y 2 g i+1 -g * i+1 ) and l 2 (y) = (y(2 -y)) 2 g i+1 -g * i+1 we obtain l 2 (y) -l * 2 (y) = y 2 g i+1 -g * i+1 ((2 -y) 2 g i+1 -g * i+1 -2 + y 2 g i+1 -g * i+1 ). (3.3) Let L k be the function defined by L k (y) = (2 -y) k -2 + y k for y ∈ [0, 1] and k ∈ N * . As L k+1 (y) -L k (y) = (1 -y)((2 -y) k -y k ) (1 -y)(2 -y -y) = 2(1 -y) 2 0 for y ∈ [0, 1], then L k+1 (y) L k (y) L 0 (y) = 0 by induction. Hence, l 2 (y) -l * 2 (y) = y 2 g i+1 -g * i+1 L 2 g i+1 -g * i+1 (y) 0. Proposition 3.3.22. Let g = x g 1 . . . x g s-1 x gs and h = x h 1 . . . x h s-1 x hs be two monomials such that g h. Then B (W g ) B W h . Proof. For i = 0, . . . , s let g ( * i) = x g 1 . . . x g i x h i+1 . . . x hs .
We have g ( * 0) = h, g ( * s) = g, and g ( * (i+1)) g ( * i) verify the hypotheses of the previous lemma. Applying the previous lemma s times, we get

B (W g ) B W h . Proposition 3.3.23. Let 0 t s m -1 and g = x g 1 . . . x g t-1 x gt and h = x h 1 . . . x h s-1 x hs be two monomials such that g h. Then B (W g ) B W h .
Proof. From the definition of the order , we have g x h s-t+1 . . . x hs and B (W g ) B (W x h s-t+1 ...x hs ). But we can write We prove that I is decreasing, i.e. for any monomial g ∈ I, for any monomial h ∈ M m , if h g then h ∈ I. This will be the case if the Bhattacharyya parameter of g and h verify B (W g ) B W h ,which is the case from Proposition 3.3.23.

B (W x h s-t+1 ...x hs ) = f h s-t+1 0 • l 2 , CHAPTER 3. DECREASING MONOMIAL CODES with l 2 = f 1 f h s-t+2 -h s-t+1 0 • • • • • f m-1-hs 0 and B W h = l 1 • l 2 where l 1 is the composition of h s-t+1 functions f 0 or f 1 . As f 0 f 1 ,

Polar codes over the B-DMC

In this part we will prove a more general statement that is Polar codes are Decreasing Monomial codes. We will start by proving a weaker statement whose ingredients and lemmas used in the proof will be essential for the proof of Theorem 3.3.31. But first we begin by recalling some useful facts about concatenated and degraded channel.

Lemma 3.3.25 ([RU08, p207]). Let W be a binary input channel. If W d W then B (W ) B (W ).

Lemma 3.3.26 ([Kob09, Lemma 4.7],[TV13, Lemma 5]). Let W be a binary input channel and let W be a degradation of this channel (W d W ). Then

W - d W - W + d W + .
From this lemma we obtain that Corollary 3.3.27. Let W be a binary input channel and let W be a degradation of this channel:

W d W . For any monomial f in M m we have W f m d W f m .
Lemma 3.3.28. For any binary-input symmetric channel W : {0, 1} → Y we have

W - d W d W + .
Proof. First of all let us recall why we have W d W + . Consider the output (y 1 , y 2 , u 2 ) of the W + channel when a bit u 1 has been sent through it. By definition y 1 is the result of sending u 1 through the W -channel. Therefore if we define W as the channel W : Y × Y × {0, 1} → Y which takes (y 1 , y 2 , u 1 ), erases y 2 and u 1 to send just y 1 , we clearly have that

W = W • W + . Let us prove now that W - d W by constructing a channel W such that W • W = W -.
The channel W is defined as follows. It takes as input y 1 . At that point a bit u 1 is drawn uniformly at random and sent through channel W to get some value y 2 . Then W outputs the pair (y 1 , y 2 ) when u 1 = 0 and (π(y 1 ), y 2 ) when u 1 = 1. Here π is the involution acting on Y such that W (y|1) = W (π(y)|0). Now sending b through channel W • W and receiving y 1 y 2 happens in two cases

DECREASING AND WEAKLY DECREASING MONOMIAL CODES

• when u 1 = 0, this happens when y 1 has been received after sending u 2 through W and y 1 , y 2 has been received after sending y 1 through W . This means that for W , y 2 has been received with the second use of W when u 1 has been sent through it;

• when u 1 = 1, this happens when π(y 1 ) has been received after sending u 2 through W (so that W changes π(y 1 ) into π(π(y 1 )) = y 1 ) and y 2 has been received with the second use of W when u 1 has been sent through it.

This implies that

(W • W )(y 1 , y 2 |u 2 ) = prob(x = 0)prob(receiving (y 1 , y 2 )|u 2 was sent, u 1 = 0) + prob(u 1 = 1)prob(receiving (y 1 , y 2 )|u 2 was sent, u 1 = 1) = prob(u 1 = 0)W (y 1 |u 2 )W (y 2 |u 1 = 0) + prob(u 1 = 1)W (π(y 1 )|u 2 )W (y 2 |u 1 = 1) = 1 2 {W (y 1 |u 2 )W (y 2 |u 1 = 0) + W (π(y 1 )|u 2 )W (y 2 |u 1 = 1)} = 1 2 {W (y 1 |u 2 )W (y 2 |u 1 = 0) + W (y 1 |1 ⊕ u 2 )W (y 2 |u 1 = 1)} = 1 2 u∈F 2 W (y 1 |u)W (y 2 |u ⊕ u 2 ) = W -(y 1 , y 2 |u 2 )
This computation shows that W • W is precisely the channel W -.

Proposition 3.3.29. Let W be a binary input symmetric channel. Let f and g be two monomials of M m . If f w g then

W g m d W f m .
Proof. This follows by induction on m. When m = 1 we just have to prove that

W x 0 1 d W 1 1 . (3.4)
Recall that

W x 0 1 = W - W 1 1 = W +
The inequality (3.4) follows directly from Lemma 3.3.28. Assume now that Proposition 3.3.29 holds for some positive integer m and let f and g be in M m+1 such that f w g.

Let us define the following monomials:

f 0...(m-1) = gcd f, m-1 i=0 x i g 0...(m-1) = gcd g, m-1 i=0 x i CHAPTER 3. DECREASING MONOMIAL CODES f m = x 0 if x m divides f, 1 otherwise. g m = x 0 if x m divides g, 1 otherwise.
Note now that

W f m+1 = W fm 1 f 0...m-1 m W g m+1 = (W gm 1 ) g 0...m-1 m
Since f 0...m-1 divides g 0...m-1 we have by the induction hypothesis

W fm 1 g 0...m-1 m d W fm 1 f 0...m-1 m (3.5) Since f m w g m we have W gm 1 d W fm 1 . From Corollary 3.3.27 we deduce that (W gm 1 ) g 0...m-1 m d W fm 1 g 0...m-1 m (3.6)
From (3.5) and (3.6) we deduce that

(W gm 1 ) g 0...m-1 m d W fm 1 f 0...m
B W f m B (W g m ).
This implies that f also belongs to I. In order to prove Therorem 3.3.31 we will need to have a finer understanding of the W f m 's and for that we give the following lemma:

DECREASING AND WEAKLY DECREASING MONOMIAL CODES

Lemma 3.3.32. Let x ∈ F 2 be the input of a synthetic channel W f m . Then the channel W f m can be described as follows:

1. choose binary word a = (a g ) g∈Mm of length 2 m indexed by the monomials of M m using the decreasing index order from Section 3.2.

2. let a = (a g ) g∈Mm be the binary word of length 2 m such that for all g ∈ M m a g = a g with the exception of a f where a f = x.

compute b

def = a G m .
4. send the bits of b through channel W to obtain a vector y ∈ Y 2 m .

the output of the channel

W f m is then y, (a g ) g:g>f .
Proof. This lemma is a direct consequence of the Definition 3.2.24 of W f m and Definition 3.2.22 of the synthetic channels. Theorem 3.3.31 heavily relies on Proposition 3.3.29 on one hand and the following lemma on the other hand. Lemma 3.3.33. Let W be a B-DMC. In such a case for any positive integer m we have

W x 1 x 2 ...x m-2 x m-1 m d W x 0 x 1 ...x m-2 m .
Proof. We use Lemma 3.3.32 and consider W x 0 x 1 ...x m-2 m . As explained in this lemma, the channel takes as input a bit c and outputs y and (a g ) g:g>x 0 x 1 ...x m-2 , where y = (y g ) g∈Mm ∈ Y 2 m is the result of sending a G m through the channel W.

Let τ : M m -→ M m be a permutation on the set of monomials in M m defined by

τ (x i 1 • • • x it ) = x (i 1 -1) (mod m) • • • x (it-1) (mod m) .
Let W be a B-DMC which consists in reordering y as y τ def = (y τ (g) ) g∈M and deleting all the entries of (a g ) g:g>x 0 x 1 ...x m-2 with the exception of a x 0 ...x m-1 . To finish the proof we check that

W x 0 x 1 ...x m-2 m • W = W x 1 x 2 ...x m-2 x m-1 m .
Before giving a slightly more general statement, let us introduce some notation which will be very helpful.

Notation 3.3.34. Let f = x i 1 . . . x is be a monomial in M m . We denote by f [a..b] the monomial Π i j :a i j b x i j and by f -t , with t i 1 the monomial x i 1 -t . . . x is-t . Example 3.3.35. Let m = 7 and f = x 0 x 2 x 3 x 4 x 6 . Then f [1..3] = x 2 x 3 and f -2 [2..4] = x 0 x 1 x 2 .
Lemma 3.3.36. Let f and g be two monomials of M m of the same degree such that (i) f g,

(ii) f [0..i-1] = g [0..i-1] , CHAPTER 3. DECREASING MONOMIAL CODES (iii) f [i+t+1..m-1] = g [i+t+1..m-1] , (iv) f [i..i+t] = x i x i+1 . . . x i+t-1 , (v) g [i..i+t] = x i+1 x i+2 . . . x i+t . Then W g m d W f m
More generally in the case of two monomials f and g satisfying (ii) and (iii) and

W g -i [i..i+t] t+1 d W f -i [i..i+t] t+1 (3.7) then W g m d W f m .
Proof. We can write in the first case

W f m = W f [i+t+1..m-1] m-i-t-1 x 0 x 1 ...x t-1 t+1 f [0..i-1] i W g m = W f [i+t+1..m-1] m-i-t-1 x 1 x 2 ...xt t+1 f [0..i-1] i .
We can apply Lemma 3.3.33 to W

f [i+t+1..m-1] m-i-t-1 to deduce that W f [i+t+1..m-1] m-i-t-1 x 1 x 2 ...xt t+1 d W f [i+t+1..m-1] m-i-t-1 x 0 x 1 ...x t-1 t+1
.

By applying Corollary 3.3.27 we obtain

W f [i+t+1..m-1] m-i-t-1 x 1 x 2 ...xt t+1 f [0..i-1] i d W f [i+t+1..m-1] m-i-t-1 x 0 x 1 ...x t-1 t+1 f [0..i-1] i .
The second statement follows by a similar reasoning but uses now (3.7) directly instead of using Lemma 3.3.33.

This lemma can now be used to prove by induction on m that Lemma 3.3.37. Let W be a symmetric binary input channel. Let m be a positive integer and let f and g be two monomials of M m that are of same degree and such that f g.

Then W g m d W f m .
Proof. When m = 1 the two monomials are necessarily equal and we are done. Assume now that the property we want to prove holds for all positive integers up to some positive integer m. Consider now two monomials f and g of M m+1 with the same degree t and such that f g. We can write

f = x i 1 . . . x it g = x j 1 . . . x jt

DECREASING AND WEAKLY DECREASING MONOMIAL CODES

with i 1 < i 2 < • • • < i t and j 1 < j 2 < . . . j t . Let i l be the smallest index among {i 1 , . . . , i t } such that i l < j l . If such an index does not exist we have f = g and therefore

W g m+1 d W f m+1
which is what we want to prove. Let i s be the largest index greater than or equal to i l such that

i j = i l + (j -l)
for all j in {l, l + 1, . . . , s}. In other words in such a case

x i l . . . x is = x i l x i l +1 . . . x i l +(s-l) .
Observe that we can write f as

f = f [0..i l -1] x i l x i l +1 . . . x i l +(s-l) f [i l +(s-l)+2..m] .
We can apply the previous lemma and obtain

W f [0..i l -1] x i l +1 x i l +2 ...x i l +(s-l)+1 f [i l +(s-l)+2..m] m+1 d W f m+1 . (3.8)
Observe now that g is such that

x i l +1 x i l +2 . . . x i l +(s-l)+1 f [i l +(s-l)+2..m] g [i l ..m] .
This comes from the fact that all the j u 's for u ∈ {l, l + 1, . . . , s} necessarily satisfy j u i u + 1, since this is true for u = l and can be shown for values that are larger by noting that j u j l + (l -u) i l + 1 + (l -u) = i u + 1. We can apply the induction hypothesis to the pair g -i l

[i l ..m] and x 1 . . .

x (s-l)+1 f -i l [i l +(s-l)+2..m] since x 1 . . . x (s-l)+1 f -i l [i l +(s-l)+2..m] g -i l [i l ..m]
and therefore

W g -i l [i l ..m] m-i l +1 d W x 1 ...x (s-l)+1 f -i l [i l +(s-l)+2..m] m-i l +1
.

By applying Corollary 3.3.27 we deduce that

W g m+1 d W g [0..i l -1] x i l +1 ...x i l +(s-l)+1 f [i l +(s-l)+2..m] m+1
.

(3.9)

Using the fact that by definition g [0..i l -1] = f [0..i l -1] and putting (3.8) and (3.9) together by using the transitivity of d we get

W g m+1 d W f m+1 .
We are ready now for the proof of Theorem 3.3.31.

Proof of Theorem 3.3.31. Let C (I) be a polar code generated by the set of monomials I devised for a channel W . Let f and g be two monomials such that g is in I and f g. Assume first that f and g have the same degree. In such a case we can apply Lemma 3.3.37 and deduce that

W g m d W f m .
When f and g are not of the same degree, we know that there exists a divisor g * of g such that g * and f have the same degree and f g * . By applying Lemma 3.3.37 to the pair (f, g * ) we deduce that

W g * m d W f m . Since g * divides g we know from Proposition 3.3.30 that W g m d W g * m .
By transitivity of d we deduce again that

W g m d W f m .
Therefore in all cases we can apply Lemma 3.3.25 and obtain that

B W f m B (W g m ).
This implies that f also belongs to I.

Duality properties

We begin here by studying the problem of duality in the case of monomial codes. We will see that the dual of a monomial code is a polynomial code, but not necessarily a monomial code. We will prove that up to a permutation of the support of the code, the dual of a monomial code is still a monomial code, fact that is already known from Vardy and Mahdavifar [START_REF] Mahdavifar | Explicit capacity achieving codes for defective memories[END_REF]. Moreover the dual of a weakly decreasing monomial code turns out to be a weakly decreasing monomial code.

Dual of Monomial Codes

Definition 3.4.1. The multiplicative complement of a monomial g ∈ M m is defined as:

ǧ def = i∈{0,...,m-1}\ind(g) x i = x 0 . . . x m-1 g .

By extension for any subset

I ⊆ M m , the set Ǐ ⊆ M m denotes Ǐ = { f : f ∈ I}.
Definition 3.4.2. Let m be a positive integer and s < m. We define the application ψ that associates to any monomial

g in M m the polynomial ψ(g) in R m ψ : M m -→ R m g = x i 1 . . . x is -→ ψ(g) = (x i 1 + 1) . . . (x is + 1).
Lemma 3.4.3. Let π be the permutation that swaps the positions i with 2 m -i + 1 for all 0 i 2 m -1.

π def = 0 . . . i . . . 2 m -1 2 m -1 . . . 2 m -i . . . 0 .
Then ev(ψ(g)) π = ev(g).

DUALITY PROPERTIES

Proof. Since for any element u = (u 0 , . . . , u m-1 ) ∈ F m 2 we have that π(u) = (u 0 + 1, . . . , u m-1 + 1) it is straightforward to remark that for any monomial g ∈ M m the evaluation of ψ(g) on π(u) equals the evaluation of g on u.

Example 3.4.4. Let m = 2 then we have 11 01 10 00 ev(x 0 x 1 ) 1 0 0 0 ev(x 1 ) 1 1 0 0 ev(x 0 ) 1 0 1 0 ev(1)

1 1 1 1 = G 2 .
If we apply ψ to all the monomials we obtain 11 01 10 00 ev((x 0 + 1)(x 1 + 1)) 0 0 0 1 ev(x 1 + 1) 0 0 1 1 ev(x 0 + 1) 0 1 0 1 ev(1)

1 1 1 1 = G π 2 .
Lemma 3.4.5. Let C (I) be a monomial code. Then , where π is the permutation that swaps the positions i with 2 m -i + 1 for all 0 i 2 m -1. Hence rank(G I ) = rank(G * ψ(I) ). Proposition 3.4.6. Let C (I) be a monomial code, then its dual is a polynomial code given by

dim(C (I)) = dim(C (ψ(I))).
C (I) ⊥ = C ψ(M m \ Ǐ) .
Proof. First of all we apply Lemma 3.4.5 to obtain dim(C (ψ

(M m \ Ǐ))) = n -|I| = dim(C (I) ⊥ ), since M m \ Ǐ is a monomial set and | Ǐ| = |I|.
Hence we have to prove only one inclusion. Let (f, g) ∈ I, ψ(M m \ Ǐ) be a pair of elements such that deg(f g) m -1. Since for any polynomial P ∈ R m with deg(P ) m -1 we have wt(ev(P )) = 0 mod 2, then we have that ev(f ) • ev(g) = 0. In other words the vectors corresponding to the evaluation of f and g are orthogonal.

Now suppose that deg(f g) = m, which means that

f g = x 0 . . . x m-1 + h(x) where h ∈ R m with deg(h) < m. Since g ∈ ψ(M m \ Ǐ) we have by definition that g = (x i 1 + 1) . . . (x is + 1) with x i 1 . . . x is ∈ M m \ Ǐ and s < m. This implies that f • (x i 1 + 1) . . . (x is + 1) = x 0 . . . x m-1 + h(x), which means that f |x i 1 . . . x is .
There are two possible cases:

1. if f = x i 1 . . . x is it's impossible since f ∈ Ǐ and x i 1 . . . x is ∈ M m \ Ǐ. 2. if f |x i 1 . . .
x is and deg( f ) < s we have that it exists at least one variable x i l with l ∈ {1..s} so that gcd(x i l , f ) = 1. But this implies that x i l |f and furthermore

f • (x i 1 + 1) . . . (x is + 1) = 0 fact that is impossible since deg(h) < m.

Dual of Weakly Decreasing Monomial Codes

Proposition 3.4.7. Let I be a weakly decreasing monomial set, with respect to w . Then

C (I) = C (ψ(I)) .
Proof. Since for any g ∈ M m we have ψ(g) = i∈ind(g)

(x i + 1) = f |g f ∈Mm f, we deduce that C ([1, g] w ) = C (ψ([1, g] w )
). Now using Definition 3.3.3 and 3.3.5 we have that

C (I) = C ( g i ∈Imax w [1, g i ] w
) and since ψ and ∪ commute, namely

g i ∈Imax w ψ([1, g i ] w = ψ( g i ∈Imax [1, g i ] w
) we obtain the wanted result. Lemma 3.4.8. For all f and g in M m , f w g if and only if ǧ w f . Proof. Let f w g. Then we have g = f gcd(f, g) and by definition

ǧ = x 0 . . . x m-1 f gcd(f, g) = f gcd(f, g) w f .
For the second implication use the first result applied to f and ǧ and the fact that f = f for any monomial f. Example 3.4.9. Take m = 5 and f = x 0 x 1 and g = x 0 x 1 x 4 . Then we have f w g and

ǧ = x 2 x 3 w f = x 2 x 3 x 4 .
Corollary 3.4.10. Let I ⊆ M m be a weakly decreasing set. Then M m \ Ǐ is a weakly decreasing set.

Proof. Let h be a monomial that belongs to M m \ Ǐ, and let g ∈ M m be a monomial such that g w h. Assume by contradiction that g / ∈ M m \ Ǐ, i.e. g ∈ Ǐ. Then there exists f ∈ I such that g = f w h, which implies that ȟ w f by Lemma 3.4.8. Since I is a weakly decreasing set, ȟ ∈ I, that is to say, ȟ = h ∈ Ǐ which contradicts the assumption. Therefore M m \ Ǐ is a weakly decreasing set Proposition 3.4.11. Let C (I) be a weakly decreasing monomial code. Then its dual is a weakly decreasing monomial code given by

C (I) ⊥ = C (M m \ Ǐ).

DUALITY PROPERTIES

Proof. As | Ǐ| = |I|, we have dim C (M m \ Ǐ) = |M m \ Ǐ| = N -dim C (I) = dim C (I) ⊥ ,
so we need to prove only one inclusion.

Let f ∈ M m \ Ǐ and consider g ∈ I. If deg(f g) < m we have that wt(ev(f g)) ≡ 0 mod 2, therefore the vectors ev(f ) and ev(g) are orthogonal. Now assume that f g = x 0 • • • x m-1 . This means there exists h ∈ M m such that f = hǧ, or equivalently ǧ w f , that is to say f ∈ Ǐ because I is a weakly decreasing set (and thanks to Lemma 3.4.8). Hence the inclusion C (M m \ Ǐ) ⊆ C (I) ⊥ is proved.

Dual of Decreasing Monomial Code

The later results on the dual of a weakly decreasing monomial code are also valid for any decreasing monomial code. Proposition 3.4.12. Let C (I) be a decreasing monomial code. Then its dual is a decreasing monomial code given by

C (I) ⊥ = C (M m \ Ǐ).
Proof. Since the class of Decreasing Monomial codes inherits the properties of Weakly Decreasing Monomial codes (see Remark 3.3.13) we obtain the wanted result.

Corollary 3.4.13. Using the result on the dual of Decreasing Monomial codes we deduce a well known fact on the dual of Reed-Muller codes

R(r, m) ⊥ = C (M m \ [x 0 . . . x m-r-1 ; x 0 . . . x m-1 ] ) = C ([1; x r+1 . . . x m-1 ] ) = R(m -r -1, m),
A straightforward consequence of Proposition 3.4.12 is that under some conditions, any decreasing monomial code is weakly self-dual. There are Decreasing Monomial codes for which the later condition in not satisfied.

Consider for example

I = [1, x 0 • • • x m-3 ] ∪ [1, x m-2 x m-1 ] . The dimension of the code C (I) is dim(C (I)) = 1 + m(m + 1)/2 + 2 m-2 .
Then for the values of m that satisfy the inequality 1 + m(m + 1)/2 + 2 m-2 2 m-1 we have that C (I) is a decreasing monomial code with rate smaller that 0.5, which is not weakly self-dual. This comes from the fact that x m-2 x m-1 and x 0 • • • x m-3 belong to the set I but they do not satisfy the condition in Corollary 3.4.14.

I = {1, x 0 , x 1 , x 0 x 2 } , J = {1, x 0 , x 2 , x 0 x 2 } , L = {1, x 0 , x 1 , x 0 x 1 }.
We have that I is a monomial set, J is a weakly decreasing monomial set and L is a decreasing monomial set. We compute the multiplicative complement of the three sets and obtain

Ǐ = {x 0 x 1 x 2 , x 1 x 2 , x 0 x 2 , x 1 } J = {x 0 x 1 x 2 , x 1 x 2 , x 0 x 1 , x 1 } Ľ = {x 0 x 1 x 2 , x 1 x 2 , x 0 x 2 , x 2 } CHAPTER 3. DECREASING MONOMIAL CODES from which we obtain M m \ Ǐ = {1, x 0 , x 2 , x 0 x 1 } M m \ J = {1, x 0 , x 2 , x 0 x 2 } M m \ Ľ = {1, x 0 , x 1 , x 0 x 1 }
We obtain that C (J) ⊥ = C (J) and C (L) ⊥ = C (L). As for the monomial code we have

C (I) ⊥ = C ({1, x 0 , x 2 , x 0 x 1 + x 1 }) .

Minimum Distance

The minimum distance of Polar codes was already studied in the literature by Korada [START_REF] Babu | Polar Codes for Channel and Source Coding[END_REF]. The estimation of the minimum distance of a monomial code is quite similar and needs the following notion. Definition 3.5.1. Let C (I) be a monomial code over m variables. We let

r -(C (I)) def = max r | R(r, m) ⊆ C (I) r + (C (I)) def = min r | C (I) ⊆ R(r, m)
We notice that another way of defining these quantities is that r -is the largest r for which the monomial x m-r • • • x m-1 is in I. On the other hand r + is the largest integer r for which x 0 • • • x r-1 is in I. These quantities are related to the minimum distance of a decreasing monomial code and its dual through the following result Proposition 3.5.2. Let C (I) be a weakly decreasing monomial code over m variables. We have the following properties:

1. The minimum distance of C (I) is equal to 2 m-r + (C (I)) .
2. r -(C (I) ⊥ ) and r + (C (I) ⊥ ) satisfy the equalities:

r -(C (I) ⊥ ) = m -1 -r + (C (I)) (3.11) r + (C (I) ⊥ ) = m -1 -r -(C (I)) (3.12) 3. The minimum distance of C (I) ⊥ is equal to 2 r -(C (I))+1
Proof.

1. We notice that r + is the largest degree of a monomial in I. If we consider the evaluation of any monomial in I r + we obtain a codeword of weight 2 m-r + (C (I)) . This implies that the minimum distance of C (I) is smaller than or equal to this quantity. On the other hand, the minimum distance of C (I) is larger than or equal to the minimum distance of R(r + , m) which is equal to 2 m-r + (C (I)) , which implies our claim.

PERMUTATION GROUP

3. Using the two previous points we have

d min (C (I) ⊥ ) = 2 m-r + (C (I) ⊥ ) = 2 m-(m-1-r -(C (I))) = 2 1+r -(C (I))
Corollary 3.5.3. The same properties hold for any Decreasing Monomial codes.

Proof. Since the class of Decreasing Monomial codes inherits the properties of Weakly Decreasing Monomial codes (see Remark 3.3.13) we obtain the wanted result.

Permutation Group

Definitions and Properties

Applying an affine permutation to a monomial code yields a polynomial code but not necessarily a monomial code. Furthermore, polynomial codes and monomial codes may have a trivial permutation group. However by considering the subclass of Decreasing Monomial codes we obtain codes with a very large permutation group which is the lower triangular affine group. Before giving its precise definition, we introduce some notation.

Notation 3.6.1. Binary square matrices with m rows (and m columns) are denoted by

F m×m 2 .
Let us recall that a bijective affine transformation over F m 2 can be represented by a pair (A, b) where A lies in the general linear group GL(m, 2) and b in F m 2 . The action of (A, b) on a monomial g is denoted by (A, b) • g. It basically consists in replacing each monomial x i by a "new" monomial y i defined by:

y i = m-1 j=0 a ij x j + b i .
In the case of Decreasing Monomial codes, we are interested in a subclass of these transformations that are lower triangular. We recall that a matrix A = (a i,j ) is lower triangular if a i,j = 0 whenever j > i. Definition 3.6.2. Let A ∈ F m×m 2 be a lower triangular binary matrix with a i,i = 1 and b ∈ F m 2 . Define the following affine transformation

M m -→ R m x -→ Ax + b.
We denote the set of such transformations LTA(m, 2).

Proposition 3.6.3. The set LTA(m, 2) forms a group that we call lower triangular affine group.

CHAPTER 3. DECREASING MONOMIAL CODES

Proof. LTA(m, 2) can be decomposed into the semi-direct product of two groups and therefore it forms a group. The two groups are

• The group of translations T(m, 2) Proof. Let I be a weakly decreasing set of monomials in m variables and g = x i 1 . . . x is be a monomial that belongs to I. Then consider en element b ∈ T(m, 2) which acts on g

F m 2 -→ F m 2 x -→ x + b, where b ∈ F m 2 . • The subgroup of GL(m,
x i 1 . . . x is → (x i 1 + b i 1 ) . . . (x is + b is ) = g * .
Consider a subset of ind(g) that we denote S b,g , for which ∀j ∈ S b,g , b j = 0. This set might be empty and in that case

g * = i∈ind(g) (x i + 1) = f wg f.
But since I is a weakly decreasing set all the monomials in the sum belong to I. Hence if S b,g = ∅ we have ev(g * ) ∈ C (I).

If S b,g is non empty then we have

g * = i∈S b,g x i j∈ind(g)\S b,g (x j + 1) = i∈S b,g x i f wgb f,
where

g b = i∈ind(g)\S b,g
x i . Therefore g * equals the sum of all monomials h w g such that g/g b w h. Hence ev(g * ) ∈ C (I). Remark 3.6.5.

• Since the order of the group T(m, 2) equals 2 m we have that for any weakly decreasing monomial code |Perm (C (I))| /2 m ∈ N * .

• For the Reed-Muller codes we have

|Perm (R(r, m)) | = |GA(m)| = 2 m m-1 i=0 (2 m -2 i ).
• Nevertheless, the structure of the hole group of permutations for weakly decreasing monomial codes remains an opened question.

Permutation group of Decreasing Monomial codes

Theorem 3.6.6. The permutation group of a decreasing monomial code in m variables contains LTA(m, 2).

Proof. Let C (I) be a decreasing monomial code and let (A, b) be in LTA(m, 2). The action of (A, b) where A = (a i,j ) ∈ F m×m 2 and b ∈ F m 2 can be viewed as a change of variables where x i is replaced by the variable y i defined by

y i = x i + i-1 j=0 a ij x j + b i . Hence if x i 1 • • • x is belongs to I with 0 i 1 < • • • < i s m -1 then y i 1 • • • y is is
a linear combination involving only monomials of the form i∈J x i where J describes the powerset of {i 1 , . . . , i s }. In particular, i∈J x i is in I since I is decreasing and therefore ev(y i 1 • • • y is ) belongs to C (I), which terminates the proof.

Remark 3.6.7.

• The order of LTA(m, 2) equals 2 m+( m 2 ) . Therefore for any Decreasing Monomial code

C (I) we have |Perm (C (I))| /2 m+( m 2 ) ∈ N * .
• For the Reed-Muller codes we have

|Perm (R(r, m)) | = |GA(m)| = |LTA(m, 2)| m i=1
(2 i -1).

• The problem of finding the hole permutation group remains open for Decreasing Monomial codes.

In a recent work Soro, Lacan, Roca, Savin and Cunche [SLR + 16] used a similar permutation in order to propose a recursive algorithm for decoding Reed-Muller over the Binary Erasure Channel. The algorithm exploits the Plotkin construction of Reed-Muller codes and the permutation group, in order to improve the generic decoder. Their idea might also be used in the case of any Decreasing Monomial code but it is not exploited for the moment. Nevertheless we exploit the permutation group of Decreasing Monomial codes to answer another fundamental question: what is the structure of minimum weight codewords of a Decreasing Monomial Code?

Minimum weight codewords

Orbits under the action of LTA(m, 2)

A natural object when dealing with group actions is the orbit of an element. We denote by LTA(m, 2)

• g = {(A, b) • g| (A, b) ∈ LTA(m, 2)} for g ∈ M m CHAPTER 3. DECREASING MONOMIAL CODES
the orbit of a monomial g under the action of LTA(m, 2).When g is equal to the monomial x i then its orbits is of the form

x i + i-1 j=0 a j x j + b | a j and b ∈ F 2 .
A consequence is that the cardinality of the orbit of x i equals 2 i+1 . When the degree of g is greater than 1 counting the number of elements in the orbit is less obvious. The reason why the task is more complicated comes from the fact that the stabilizer subgroup of LTA(m, 2) with respect to g is not trivial. The following example illustrates this fact.

Example 3.7.1. Let g = x 0 x 1 then by definition LTA(m, 2).g = {(x 0 + b 0 )(x 1 + a 1,0 x 0 + b 1 )|b 0 , a 1,0 , b 1 ∈ F 2 }.
We remark that there are two group elements in LTA(m, 2) that leave g invariant:

(x 0 + b 0 )(x 1 + a 1,0 x 0 + b 1 ) = x 0 x 1 if
and only if b 0 = 0 and a 1,0 = b 1 , in other words x 0 x 1 = x 0 (x 1 + x 0 + 1). Hence there are 4 distinct polynomials in the orbit of x 0 x 1 which are x 0 x 1 , x 0 (x 1 + 1), (x 0 + 1)x 1 and (x 0 + 1)(x 1 + 1). Definition 3.7.2. For any g from M m we define LTA(m, 2) g as the subgroup of (A, b) ∈ LTA(m, 2) such that:

b i = 0 and a ij = 0 if i ∈ ind(g) or j ∈ ind(g).
Proposition 3.7.3. For any monomial g in M m the orbit of g under the action of LTA(m, 2) is equal to the orbit of g under the action of LTA(m, 2) g :

LTA(m, 2) • g = LTA(m, 2) g • g.
(3.13)

Proof. The inclusion LTA(m, 2) g ⊆ LTA(m, 2) is clear. We prove the converse inclusion by induction on deg g. Let deg g = 1. We have that g = x i and by definition of LTA(m, 2)

LTA(m, 2) • x i = {x i + j<i α j x j + b i with α j , b i ∈ F 2 }.
By definition of LTA(m, 2) g we have that

A =         0 . . . . . . . . . . . . 0 a i0 . . . a i(i-1) 1 . . . 0 0 . . . . . . . . . . . . 0         and b = (0, . . . , 0, b i , 0, . . . , 0) t . Therefore Ax + b = b i + a i0 x 0 + . . . a i(i-1) x i-1 + x i .
Let us assume that is true for any monomial of degree d where d 1. Let g be a monomial in M m of degree d + 1. Let us consider (A, b) in LTA(m, 2) and for any i in ind(g) we define y i as:

y i = x i + i-1 t=0 a it x t + b i Hence we have (A, b) • g = j∈ind(g) y j
. Now let i be the maximum element of ind(g). We then have:

y i = x i + t∈ind(g),t =i a it x t + i-1 t=0,t / ∈ind(g) a it x t + b i

MINIMUM WEIGHT CODEWORDS

Using the fact that f 2 = f for any f in R m , we also have:

j∈ind(g) y j = y i t∈ind(g),t =i y t =   x i + t∈ind(g),t =i a it (x t + 1 + y t ) + i-1 t=0,t / ∈ind(g) a it x t + b i   t∈ind(g),t =i y t
Since t∈ind(g),t =i y t is of degree d then by induction assumption, there exists (A * , b * ) ∈ LTA(m, 2) g such that for any t ∈ ind(g) and t = i, it holds:

y t = x t + t-1 s=0,s / ∈ind(g) a * ts x s + b * t .
This implies in particular that we can write:

t∈ind(g),t =i a it (x t + 1 + y t ) = t∈ind(g) t =i t-1 s=0 s / ∈ind(g) a it (a * ts x s + b * t + 1)
This last equation only involves variables x s with 0 s < i and s / ∈ ind(g). Hence we can find a binary vector (a i0 , . . . , a i(i-1) ) with a it = 0 if t ∈ ind(g), and b i ∈ F 2 such that:

t∈ind(g) y t = t∈ind(g)   x t + t-1 s=0,s / ∈ind(g) a ts x s + b t   .
This last equality proves LTA(m, 2) • g ⊆ LTA(m, 2) g • g and concludes the proof.

Proposition 3.7.4. For any g ∈ M m we have

|LTA(m, 2) • g| = |LTA(m, 2) g | . Proof. From Proposition 3.7.3 we have that |LTA(m, 2) • g| |LTA(m, 2) g |. Let g ∈ M m and let us consider (A, b) and (A , b ) in LTA(m, 2) g . We prove that if (A, b) • g = (A , b ) • g in R m then A = A and b = b .
This comes from the fact that in the polynomial (A, b)

• g ∈ R m , the coefficient of x j k∈ind(g),k =i
x k when i ∈ ind(g) and j / ∈ ind(g) is exactly a ij and the coefficient of

k∈ind(g),k =i x k is b i . This proves that (A, b) = (A , b ).
Therefore there is a bijection between the two sets and counting the number of elements in the orbit of g is equivalent to counting the number of pairs A, b ∈ LTA(m, 2) g .

Computing the cardinality of orbits

In order to give the cardinality of an orbit we use a well-known combinatorial object called the Ferrers diagram (or Young diagram). In the literature the usual convention is to have 1 λ i m -d. But here we prefer to write the zero elements since we consider partitions inside a fixed grid.

Example 3.7.7. For the diagrams in Figure3.9 the partitions, using our convention, are:

(0, 0), (1, 0), (1, 1), (2, 0), (2, 1), (2, 2), (3, 0), (3, 1), (3, 2), (3, 3).

Bijection between monomials and Young diagrams

We construct a bijection between Young diagrams in grids of size d×(m-d) and monomials of degree d in m variables. First of all we associate to a monomial g the corresponding matrix A ∈ LTA(m, 2) g . Then we will use a well known bijection between the Young diagrams and the matrices in row echelon form [START_REF] Donald | Subspaces, subsets, and partitions[END_REF].

The bijection works as follows: if (A, b) ∈ LTA(m, 2) g , then by definition of A the rows i / ∈ ind(g) and the columns j ∈ ind(g) contains only a 1 on the diagonal (and 0 elsewhere). If we remove from A the rows i / ∈ ind(g) and the columns j ∈ ind(g), we get a d × (m -d) matrix with possible non-zero coefficients exactly inside the boxes of the associated Ferrers diagram.

MINIMUM WEIGHT CODEWORDS

Proof. If g = x i 0 • • • x i d-1 ∈ M m is a monomial of degree d, then the partition associated to g is λ g = (i d-1 -(d -1), i d-2 -(d -2), . . . , i 0 -0) inside the d × (m -d) grid. It is a partition since i k -k i k-1 -(k -1). If λ = (λ d-1 , . . . , λ 0 ) is a partition inside the d × (m -d) grid with λ d-1 λ d-2 • • • λ 0 0, then the monomial g associated to it is g = x i 1 • • • x i d where i k = λ k + k > λ k-1 + k -1 = i k-1 .
Example 3.7.9. We consider in this example that m = 5 and the monomial g has deg(g) = 2.

• Let λ g be the empty partition λ g = ε inside the 2 × 3 grid. With our convention λ g = (0, 0) and we have g = x 0 x 1 .

.

• Now let g = x 1 x 4 then the partition associated to g is λ g = (4 -1, 1 -0) = (3, 1) and it's Young diagram in the 2 × 3 grid is * * * * .
We also illustrate the bijection between A and λ g .

A =         1 0 0 0 0 a 10 1 0 0 0 0 0 1 0 0 0 0 0 1 0 a 40 0 a 42 a 43 1         .
After deleting the rows corresponding to x 0 , x 2 , x 3 and the columns corresponds to Using the same technique we obtain that the monomials associated to the Young diagrams from Figure 3.9 are (in the same order as in the fugure): Characterizing the minimum weight codewords is often quite difficult and there are few families of codes for which the structure of the minimum weight codewords is well known. In the case of Decreasing Monomial codes the subgroup LTA(m, 2) gives enough information to understand the structure of the minimum weight codewords.

x 0 x 1 , x 0 x 2 , x 1 x 2 , x 0 x 3 , x 1 x 3 , x 2 x 3 , x 0 x 4 , x 1 x 4 , x

Definitions and Properties

We suppose that C (I) is a decreasing monomial code. From Proposition 3.5.2, the set of minimum weight codewords is

W min = {c ∈ C (I) | |c| = 2 m-r + },
where r + = r + (C (I)).

Proposition 3.7.12.

W min = ev(P ) | ∃f ∈ I r + , P ∈ LTA(m, 2) • f .
Proof. The ⊇ inclusion comes from the fact that LTA(m, 2) acts on C (I) as a permutation, and thus for any f ∈ I r + , ev(f ) has weight 2 m-r + . As for the ⊆ inclusion, consider an arbitrary element ev(P ) ∈ W min . From [KTA76] we know that an element of weight 2 m-r + is the evaluation of a product of r + independent affine linear forms P = r + j=1 j . Each linear form can be written as

j = x i j + 0 k<i j a jk x k + ε j .
If all the maximal variables x i j in the r + linear forms are pairwise distinct then P ∈ LTA(m, 2) • (x i 1 . . . x ir + ). Now suppose that this assumption is not true and consider two linear forms 1 , 2 sharing the same maximum variable and such that 1 2 = 0. In other words

1 = x i 2 + k<i 2 a 1k x k +ε 1 3.7. MINIMUM WEIGHT CODEWORDS and 2 = x i 2 + k<i 2 a 2k x k + ε 2 . Let * 1 = x i 2 + 1 and * 2 = x i 2 + 2 .
It is clear that * 1 + * 2 = 0 because of the independence condition. We also have that * 1 + * 2 = 1 because if not we would obtain 1 2 = 0. Using the relation f 2 = f for any f ∈ R m we can rewrite

1 2 = ( 1 + 2 + 1) 2 = ( * 1 + * 2 + 1) 2 = 1 2
where the maximum variable of 1 is strictly smaller than x i 2 and the two forms are independent.

By induction on the number of linear forms, we can prove that any product of r + linear forms can be rewritten in a product of r + linear independant forms with distincts maximal variable.

Furthermore we prove that for any two distinct monomials the intersection of their orbits is the empty set and conclude with the formula counting the number of minimum weight codewords of a decreasing monomial code.

Lemma 3.7.13. Let f and g be two different monomials in M m . Then the intersection of their orbits is equal to the empty set.

LTA(m, 2) • f ∩ LTA(m, 2) • g = ∅.
Proof. If the two monomial can be compared with respect to our order then we can consider without loss of generality that f g. Using the definition of LTA(m, 2) we have that any polynomial in the orbit of g contains the monomial g and any polynomial in the orbit of f does not contain the monomial g. So it is impossible to find a polynomial belonging to both orbits.

If the two monomials are incomparable the proof works in the same way. Let f and g be two monomials such that f = gcd(f, g)f * and g = gcd(f, g)g * . Since f and g are incomparable we know that there exists a maximum variable x i such that x i |f and x i |g and ∀j ∈ ind(g) , i > j. Therefore any polynomial in the orbit of f contains the monomial x i gcd(f, g). On the other hand since the variable x i is bigger than all the variables in g * the monomial x i gcd(f, g) in not contaned in any of the polynomials in the orbit of g.

Computing the number of minimum weight codewords

Theorem 3.7.14. Let C (I) be a decreasing monomial code, then the number of minimum weight codewords in C (I) equals

|W min | = 2 r + g∈Ir + 2 |λg| .
Proof. Use Proposition 3.7.12 and Lemma 3.7.13 Corollary 3.7.15. The number of minimum weight codewords in R(r, m) equals

|W min (R(r, m))| = 2 r m r 2 where m r 2 = (2 m -1) . . . (2 m -2 r-1 ) (2 r -1) . . . (2 r -2 r-1 )
is the Gaussian binomial coefficient.

Decreasing Monomial

Weakly Decreasing Monomial Monomial

C (I) ⊥ C (M m \ Ǐ) C (M m \ Ǐ) C ψ(M m \ Ǐ) d min (C (I)) 2 m-r+ 2 m-r+ 2 m-r+ Perm (C (I)) LTA(m, 2) ⊆ Perm (C (I)) T(m, 2) ⊆ Perm (C (I)) |W min | 2 r+ g∈Ir + 2 |λg|

Perspectives

There are many questions related to this topic and we do not pretend to select here the most important ones. We just enumerate some of the subjects on which we tend to focus in the near future.

1 x 3 x 2 x 1 x 0 x 3 x 2 x 1 x 3 x 2 x 0 x 3 x 1 x 0 x 3 x 2 x 2 x 1 x 0 x 3 x 1 x 2 x 1 x 3 x 0 x 2 x 0 x 3 x 1 x 0 x 2 x 1 x 0 1 Figure 3
.11 -The decreasing order over the Young diagrams corresponding to the monomials when m = 4

1. The first topic is a combinatorial question concerning the number of Decreasing Monomial codes of fixed dimension, let's say k. If the answer if obvious for the class of Monomial codes, that is n k , in the case of Weakly Decreasing Monomial codes and Decreasing Monomial codes the question doesn't have a trivial answer. The main direction that we that we tend to follow is a detail study of ideals of posets.

Experiments show that the order of the full permutation group for Decreasing

Monomial codes is way bigger that the order of the lower triangular group. In many cases it is close up to a constant to the general affine group. Therefore to reveal the full permutation group for the Decreasing Monomial codes is still an opened question that could unlock other important results.

3. Since both Reed-Muller codes and Polar codes achieve the capacity of the Binary Erasure Channel, a natural question is whether any Decreasing Monomial code achieve the capacity of the BEC. For that we believe that the previous question, regarding the permutation group might be extremely useful. Also the results that we obtained on the structure of the minimum weight codewords could be potentially one of the ideas to be used in this sense.

4

Cryptanalysis of the McEliece scheme based on Polar Codes

Introduction

Since Polar codes benefit of various interesting properties like fast encoding and decoding algorithms and high decoding capacity they seem fitted in cryptographic applications. They were proposed in a public key encryption scheme à la McEliece by [START_REF] Sujan | New McEliece cryptosystem based on polar codes as a candidate for post-quantum cryptography[END_REF] and [START_REF] Hooshmand | Reducing the key length of McEliece cryptosystem using polar codes[END_REF]. as well as for a secret key cryptosystem in [START_REF] Hooshmand | Secret key cryptosystem based on polar codes over binary erasure channel[END_REF]. Due to their high decoding capacity they might also be suitable for signature schemes [START_REF] Otmani | On the Design of Code-Based Signatures[END_REF]. Based on the results that we proved in Chapter 3 we explain that generic algorithms, like the SSA [START_REF] Sendrier | Finding the permutation between equivalent linear codes: The support splitting algorithm[END_REF], for solving this problem are not feasible due to the structural properties of Polar codes. Our main contribution is to propose a Key Recovery Attack against the McEliece scheme based on Polar codes. The advantage of our algorithm is that it can be applied on any Decreasing Monomial code that admits a specific discriminant that we detail in Section 4.4.2. The signature that we propose for our attack is based on the number of minimum weight codewords in the dual of a shortened Polar code. With this tool we manage to discriminate between several monomials that define the Polar code fact that allows us to solve the code equivalence problem. We detail our algorithm on a toy example, over a small extension of F 2 , and also give some details about a practical implementation applicable for cryptographic parameters. The results in this Section were published in [BCD + 16].

Contribution

The McEliece PKC variant using Polar codes

Introduction

Shrestha and Kim proposed a public key encryption scheme à la McEliece based on Polar codes [START_REF] Sujan | New McEliece cryptosystem based on polar codes as a candidate for post-quantum cryptography[END_REF]. The idea is the same as in the original scheme, it only replaces

THE MCELIECE PKC VARIANT USING POLAR CODES

the binary Goppa code with a Polar code designed for a BSC(p). Therefore during the KeyGeneration algorithm, one has to compute the Bhattacharya parameter for all the 2 m synthetic channels and choose the best k channels in order to output the generator matrix G of the Polar code. The masking technique is the usual one, using a permutation and an invertible matrix. Moreover the encryption and decryption algorithms work exactly in the same way as in the original version (see Section 2.3 for details).

Parameters for the scheme

The authors in [START_REF] Sujan | New McEliece cryptosystem based on polar codes as a candidate for post-quantum cryptography[END_REF] proposed as practical parameters, codes of length 2048 and rate close to 1/3, more exactly a [2048, 614] Polar code. The Shannon limit for the noise on a binary symmetric channel of crossover probability p that a code of rate 614 2048 is able to sustain is about p = 0.19. So in order to built the generator matrix of the Polar code we have to choose the best 614 rows of G 11 which give the best performance for the successive cancellation decoder. Regarding the performance of the SC decoder we illustrate in Figure 4.1 the decoding error probability in function of the weight of the error vector in the case of a [2048, 614] Polar code designed for a BSC(0.19).

wt(e)

143 164 184 205 225 246 266 P err (e) 2.10 -6 3, 2.10 -5 2, 56.10 -4 1, 02.10 -3 3, 37.10 -3 1, 49.10 -2 4, 76.10 -2 If we suppose that the scheme has to be deployed in a practical environment where a reasonable error probability would be lower than or equal to 10 -3 , then we choose to consider error vectors with Hamming weight less than 200.

Security arguments

Shrestha and Kim proposed a security analysis based on two aspects: firstly they analyze the complexity of the brute force attack and secondly they give some arguments against the eventual use of the attack against the Sidelnikov cryptosystem [START_REF] Michilovich | A public-key cryptosytem based on Reed-Muller codes[END_REF]. But there is no reference to any generic attack, therefore we give in Figure 4.2 the security level against the MRA, for a [2048, 614] Polar code in function of the error vector weight, with respect to the complexity of the ISD algorithm. We notice that in this case we could get a 100-bit security if we choose error vectors with a Hamming weight at least 184. In this case the error probability equals 2.56 • 10 -4 which is reasonable for a practical purpose.

CHAPTER 4. CRYPTANALYSIS OF THE MCELIECE SCHEME BASED ON POLAR CODES

For the Key Recovery Attack, we face in the case of Polar codes the Code Equivalence Problem. There is in essence a single Polar code of a given dimension and length. So breaking the scheme amounts to find for a permuted version of the Polar code a permutation that gives the original Polar code. What makes this problem difficult for Polar codes is that the standard algorithm for solving it, namely the Support Splitting Algorithm [START_REF] Sendrier | Finding the permutation between equivalent linear codes: The support splitting algorithm[END_REF] is too complex to be used in this context due to the very large size of the hull of the Polar code (see Section 3.4). What makes the problem even more intricate is the fact that a Polar code have a very large permutation group (see Section 3.6) which complicates the task significantly.

So it seems that this variant is not threatened by any known key recovery attack, at least not an obvious one. Moreover a proper choice of parameters seems to be possible, parameters that give the security of the scheme with respect to the MRA attack. Despite all these arguments for the use of Polar codes, we will reveal the existence of a flawless in this case, which is represented by the set of minimum weight codewords. In the case of a [2048, 614] Polar code the minimum distance equals 32, which is way lower than the minimum error weight that has to be considered for a proper security level. On top of that we have just seen in the previous section that the structure of the minimum weight codewords is given by the action of the lower triangular affine group. Therefore there might be a distinguisher on the maximum degree monomials using this group action, which is exactly the idea that we will use against this McEliece variant.

Solving the code equivalence problem for Polar codes

In order to solve the code equivalence problem for Polar codes we will need to define the notion of signature for a linear code.

Definitions

Definition 4.3.1 (Signature). Let C be a code of length n. Let G be a subgroup of permutations of C and W be a subset of C globally invariant under G. We say that a function Σ(c, C ) where c belongs to C is a signature for the action of G on W if and only if:

1. Σ(c, C ) = Σ(c π , C π ) for π from S n (i.e. Σ is invariant by permutation), 2. Σ(c, C ) = Σ(c , C ) if c

and c both belong to W but are not in the same orbit under G (i.e. Σ takes distinct values for each orbit).

Notice here that a signature always takes the same value on an orbit under G since if we take c in W and γ is an element of G, then Σ(c, C ) = Σ(c γ , C γ ) = Σ(c γ , C ) since γ belongs to the permutation group of the code.

The main idea of our attack is that we are able to find an efficient signature for the Polar codes C (I). This signature will allow us to determine the orbit of a particular monomial f ∈ I under the action of the LTA(m, 2). Furthermore we will proceed by induction, more exactly we will determine the monomials f i which divide f and solve the code equivalence problem for the shortened code on the support of f i .

SOLVING THE CODE EQUIVALENCE PROBLEM FOR POLAR CODES

Preliminaries

Before we detail the attack we recall some of the properties of Polar codes that are going to be used. We will suppose that the Polar code of length n = 2 m and dimension k is defined by the set of monomials I and that the maximum degree of monomials in I equals r + . We will denote as before the set of monomials of degree r + by I r + ⊂ I. Next we recall the necessary ingredients for a successful cryptanalysis of Polar codes:

• From Theorem 3.6.6 we know that the permutation group of a decreasing monomial code in m variables contains LTA(m, 2).

• The minimum weight codewords of a Polar code C (I) are given by the evaluation of the polynomials in the orbits LTA(m, 2) • f for any maximum degree monomial f ∈ I r + .

• Since any Polar code is a decreasing monomial code and I r + = ∅ we have that x 0 . . . x r + -1 ∈ I r + . We denote the corresponding codeword by c min def

= ev(x 0 • • • x r + -1 ) Notation 4.3.2. Let c min def = ev(x 0 • • • x r + -1
), than we denote by I be the support of c min , and J be the complementary set (that is the set of position for which c min takes the value 0).

Let c i = ev(x 0 . . . , x i-1 ) with c 0 being ev(1), that is the all-one codeword and c min = c r + . We denote by I i the support of c i and J i be the complementary set. We remark that we have I r + = I and J r + = J .

Attack algorithm.

The algorithm for performing the attack can now be summarized as follows:

Step 1. (Minimum weight codewords searching) Search the non-zero minimum weight vectors of C (I) and C (I) π , that we denote by W min and W min π respectively. We know from Properties 4.3.2 that c min belongs to W min .

Step 2. (Signature of orbits in W min ) Compute the orbits of W min under the action of LTA(m, 2) and find a signature for these orbits. This signature is based on shortening the dual C (I) ⊥ on the support of c (where c belongs to W min ) and computing the dimension of this code and the number of codewords of minimum weight in it.

Step 3. (Computation of orbits in W min π ) Use this signature to decompose W min π into distinct orbits under the group π -1 LTA(m, 2)π and use it to find the orbit of c π min .

Step 4. (Identification of affine spaces) Without loss of generality, we may take any codeword in the orbit of c π min and declare that it is equal to c π min . The structure of the orbit of c min is such that the supports of all the codewords in this orbit are affine spaces of the form x 0 = ε 0 , x 1 = ε 1 , . . . , x r + -1 = ε r + -1 , where the ε i 's are arbitrary elements in F 2 . Denote this affine space by A(ε 0 , . . . , ε r + -1 ) and let c min (ε 0 , . . . , ε r + -1 ) be the corresponding codeword. Up to a permutation of C π , we identify all the elements c min (ε 0 , . . . , ε r + -1 ) π . This gives all the affine spaces permuted by π, that is A(ε 0 , . . . , ε r + -1 ) π def = {π -1 (i) | i ∈ A(ε 0 , . . . , ε r + -1 )}.

Step 5. (Equivalence problem for a short code) We compute the codes D def = P J (C ) and D π def = P J π (C π ) and solve the code equivalence problem for D and D π where π is the restriction of the permutation π to the affine space I. Notice that this problem is solved for much shorter codes than the original system.

Step 6. (Induction step) We compute the punctured code D i = P J i (C ). Then solve for i = r + -1, . . . , 0 the code equivalence problem for the pair (D i , (D i ) π i ) by using the solution to the code equivalence problem (D i+1 , (D i+1 ) π i+1 ) where π i is the restriction of π to the set of positions of D i .

The last code equivalence problem we solve here (namely for i = 0) is just a solution to the original code equivalence problem.

Cryptanalyze of the McEliece variant based on

Polar codes

Step 1 -Minimum weight codewords searching.

Finding the minimum weight codewords of C (I) π can be performed by applying any variants of the ISD algorithm.On the other hand, all the minimum codewords of C (I) are easily obtained by using Theorem 3.7.14: W min decomposes into orbits under the action of LTA(m, 2) where each orbit contains one of the monomials of I of degree r + .

Example 4.4.1. The example that we give here will be considered through all the cryptanalysis. We will consider the [256, 79] Polar code. It is defined by the set

I = [1, x 6 x 7 ] ∪ [1, x 1 x 4 x 7 ] ∪ [1, x 0 x 5 x 6 ] ∪ [1, x 2 x 4 x 6 ] ∪ [1, x 3 x 4 x 5 ] ∪ [1, x 0 x 1 x 2 x 5 ] ∪ [1, x 0 x 1 x 3 x 4 ] .
The Polar code is such that R(2, 8) ⊂ C (I) ⊂ R(4, 8).Therefore we have that the minimum weight equals 2 8-4 = 16 and the set of maximum degree monomials is:

I 4 = {x 0 x 1 x 2 x 3 , x 0 x 1 x 2 x 4 , x 0 x 1 x 2 x 5 , x 0 x 1 x 3 x 4 }.
Using the minimum weight counting method we have that there are 16 words in the orbit of x 0 x 1 x 2 x 3 , 32 in the orbit of x 0 x 1 x 2 x 4 and 64 in the orbit of x 0 x 1 x 2 x 5 and x 0 x 1 x 3 x 4 , which makes a total of 176 minimum weight codewords.

Step 2 -Signature of orbits in W min

To distinguish between the codewords of W min we have first chosen a monomial in each of the orbits under LTA(m, 2) that decompose W min . For each of such monomials g we have computed the dual of the shortened code D def = S J (C (I)) ⊥ with respect to the support J of ev(g). It has turned out that, for the Polar codes we have considered, the pair (number of codewords of weight 2 r -in D, dimension of D) was discriminant enough to yield a signature of the orbit. This critical quantity 2 r -occurs because we have Theorem 4.4.2. Let g = x i 1 . . . x ir + be a monomial of degree r + in I. Denote by supp(g) the support of ev(g), then the minimum distance of S supp(g) (C (I))

⊥ is equal to 2 r -if and only if there exists a monomial h in M m \ Ǐ such that:

CRYPTANALYZE OF THE MCELIECE VARIANT BASED ON POLAR CODES

deg(gcd(h, g))

= r + -1 2. deg(gcd(h, ǧ)) = m -r --r +
We will first begin this demonstration by proving a general result about the dual of shortened monomial codes.

Lemma 4.4.3. Let C (I) be a decreasing monomial code and g ∈ I. Let supp(g) be the support of ev(g). We denote by E S supp(g) (C (I))

⊥ the dual of the shortened code in supp(g) that we have extended by zeros in the positions in which we have shortened the code. Then E S supp(g) (C (I))

⊥ = ev((1 + g)f ) : f ∈ M m \ Ǐ
Proof. Recall that we have

S supp(g) (C (I)) ⊥ = P supp(g) C (I) ⊥
We know that C (I) ⊥ = C (M m \ Ǐ). The lemma follows from this and the fact the ev(1+g) takes value 1 on the complementary of supp(g) and 0 on supp(g).

We will also need the following result that is only a slight generalization of [Min07, Prop. 6, p.69] (and our proof will follow closely the proof of this proposition). Lemma 4.4.4. Let g be some monomial of degree s 1. Denote by supp(g) the support of ev(g), then the minimum distance of S supp(g) (C (I))

⊥ is greater than or equal to 2 r -.

If the minimum distance is equal to 2 r -then there exists a monomial h in M m \ Ǐ such that

1. deg(gcd(h, g)) = s -1 2. deg(gcd(h, ǧ)) = m -r --s Proof.
Let us take a nonzero codeword of C (I) ⊥ , say that is the evaluation of some polynomial f , which is in this case of degree at most m -1 -r -. Write f = j m j as a sum of monomials. Then f def = j:g m j m j is defined as the polynomial where we have removed from the monomial expression of f all monomials that are divisible by g. Since (S supp(g) (C (I))) ⊥ = P supp(g) C (I) ⊥ , we want to prove that the evaluation of f on {0, 1} m \ supp(g) is either zero or of weight 2 r -. Notice that the evaluation on {0, 1} m \ supp(g) coincides with the evaluation of f .

Let us assume that g = x 0 . . . x s-1 . With this choice, let us pick a monomial of f that has maximum degree in x s , . . . , x m-1 . Let d be this degree (in x s , . . . , x m-1 ). f can be written as f = mu(x 0 , . . . , x s-1 ) + v(x 0 , . . . , x m-1 ),

where m is a monomial of degree d in x s , . . . , x m-1 . We take here in the monomials whose sum is equal to f all monomials that are divisible by m and u is just the sum of these monomials divided by m. Let d be the degree of u which is necessarily smaller than s since f does not contain any monomial divisible by g.

CHAPTER 4. CRYPTANALYSIS OF THE MCELIECE SCHEME BASED ON POLAR CODES

Notice that u(x 0 . . . x s-1 ) is non zero in at least 2 s-d -1 entries if we do not count the (1, . . . , 1) entry, since its evaluation is a codeword of R(d , s).

Call a "block" the set of points (x 0 , . . . , x m-1 ) which take a prescribed value on x 0 , . . . , x s-1 . The support supp(g) of g corresponds to the block x 0 = 1, . . . , x s-1 = 1. Notice that the weight of ev( f ) restricted to a block (with the exception of the block x 0 = 1, . . . , x s-1 = 1) is at least 2 m-s-d , since this restriction is a codeword of R(d, m -s). In other words the weight of ev( f (1 + g)) is lower-bounded by

|ev( f )(1 + g)| 2 m-s-d (2 s-d -1) 2 m-s-d 2 s-d 1 2 = 2 m-d-d -1 .
Notice that we have d + d m -r --1 and therefore we finally obtain

|ev( f )| 2 m-(m-r --1)-1 = 2 r -.
This proves the statement about the minimum distance in this case. A quick inspection of this proof shows that the only fact we used on g was that is is different from 1 (the particular form of g was only here to simplify notation), and therefore it also holds for all monomials g different from 1. Assume now that the minimum distance of S supp(g) (C (I))

⊥ is equal to 2 r -. By a quick inspection of this proof this means that deg u = s -1 and deg m = m -r --1 -(s -1) = m -r --s. Write u as a set of monomials u = j m j and choose m as any monomial in this sum that is of degree s -1. Obviously h def = mm is a monomial of degree s -1 + m -r --s = m -r --1 that appears as a monomial in the sum f = j m j . Therefore h is in M m \ Ǐ. Such an h has the aforementioned form.

We will now use this to prove Theorem 4.4.2.

Proof. First of all let us notice that the minimum distance of E S supp(g) (C (I)) ⊥ is the same as the minimum distance of S supp(g) (C (I)) ⊥ . From Lemma 4.4.3 we know that any codeword in the first code can be written as ev((1 + g)f )) where f is polynomial which is a linear combination of monomials in M m \ Ǐ. Consider now that there is a monomial h satisfying the conditions above. Let us prove that the weight of ev((1 + g)h) is equal to 2 r -. Let i 0 be the only index that is in ind(g) but not in ind(g ∧ h). Observe now that

(1 + g)h = (1 + x i 1 . . . x ir + ) i∈ind(gcd(g,h))
x i i∈ind(gcd(ǧ,h))

x i = (1 + x i 0 ) i∈ind(gcd(g,h))
x i i∈ind(gcd(ǧ,h))

x i = (1 + x i 0 )h. Thus |ev((1 + g)h))| = |(ev((1 + x j 0 )h)| = 2 m-(m-r --1+1) = 2 r -.
By using the lower-bound on the minimum distance coming from Lemma 4.4.4 we obtain that the minimum distance of S supp(g) (C (I))

⊥ is equal to 2 r -.

Assume now that the minimum distance of S supp(g) (C (I))

⊥ is equal to 2 r -, then we can use Lemma 4.4.4 and obtain the aforementioned claim.

CRYPTANALYZE OF THE MCELIECE VARIANT BASED ON POLAR CODES

Example 4.4.5. If we consider the dual of the Polar code we have that R(3, 8) ⊂ C (I) ⊥ ⊂ R(5, 8). The maximum degree monomials in the dual code are {g ∈ M m , g x 0 x 1 x 2 x 5 x 7 , or g x 0 x 1 x 3 x 5 x 6 , or g x 0 x 2 x 3 x 4 x 7 , or g x 1 x 2 x 3 x 4 x 6 }.

Recall that the minimum weight codewords of the Polar code are given by the monomials in I 4 = {x 0 x 1 x 2 x 3 , x 0 x 1 x 2 x 4 , x 0 x 1 x 2 x 5 , x 0 x 1 x 3 x 4 }. So we obtain that the minimum distance of the dual of the shortened code is

• 2 4+2 for x 0 x 1 x 2 x 3 since (1 + x 0 x 1 x 2 x 3 )x 0 x 1 x 2 x 5 x 7 = x 0 x 1 x 2 (1 + x 3 )x 5 x 7 . • 2 4+2 for x 0 x 1 x 2 x 4 since (1 + x 0 x 1 x 2 x 4 )x 0 x 1 x 2 x 5 x 7 = x 0 x 1 x 2 (1 + x 4 )x 5 x 7 . • 2 4+2 for x 0 x 1 x 2 x 5 since (1 + x 0 x 1 x 2 x 5 )x 0 x 1 x 2 x 4 x 7 = x 0 x 1 x 2 (1 + x 5 )x 4 x 7 . • 2 4+2 for x 0 x 1 x 3 x 4 since (1 + x 0 x 1 x 3 x 4 )x 0 x 1 x 2 x 4 x 7 = x 0 x 1 x 4 (1 + x 3 )x 2 x 7 .
If we apply the minimum weight counting method from Section 3.7 to the four monomials we obtain that in the dual of the shortened code there are 372 minimum weight codewords when we consider the monomial x 0 x 1 x 2 x 3 , 340 codewords for x 0 x 1 x 2 x 4 , 308 codewords for x 0 x 1 x 2 x 5 and 148 codewords for x 0 x 1 x 3 x 4 .

Therefore, here the number of minimum weight codewords in the dual of the shortened code can be considered as signature for the monomials.

Step 3 -Computation of orbits in W min π The signature Σ that has been found in the previous step is now applied to W min π . It gives the orbits of W min π with respect to the conjugate group π -1 Gπ. Indeed, it can be verified that Proposition 4.4.6. W min π is invariant by the action of π -1 LTA(m, 2)π and if Σ is a signature for W min under the action of LTA(m, 2), then it is also a signature for the action of π -1 LTA(m, 2)π on W min π .

We use this signature for finding the orbit of c min .

Proposition 4.4.7. The orbit of c min under LTA(m, 2) consists of 2 r + codewords that are of the form c min (ε 0 , . . . , ε r + -1 ) where the ε i 's are arbitrary elements of F 2 . The orbit of c π min under π -1 LTA(m, 2)π is given by 2 r + codewords of weight 2 m-r + that have disjoint supports which are the permuted versions A(ε 0 , . . . , ε r + -1 ) π of the affine spaces A(ε 0 , . . . , ε r + -1 ).

In other words, finding this orbit in W min π and looking at the support of the codewords that we have found in this way allows us to find the support of the permuted versions A(ε 0 , . . . , ε r + -1 ) π of the affine spaces A(ε 0 , . . . , ε r + -1 ).

Step 4 -Identification of affine spaces

There are several ways to identify the permuted versions of the affine spaces we are interested in. One of the simplest way is by computing the dimensions of certain spaces. First we take any codeword in the orbit of c min . Such codeword is of the form c γπ min where γ is a permutation leaving C (I) invariant. In other words, up to applying the permutation group, we can safely declare that this codeword is c π min . Let I 0 be the support of c min = c(1, . . . , 1). We choose I 0 be the support of the codeword c( 1, . . . , 1 (r + -1) times , 0). Notice that I def = I 0 ∪I 0 is the support of the codeword ev(x 0 . . . x r + -2 ). We compute the dimension of the code P I (C (I)). Now, we let J 0 , . . . , J 2 r + -1 be the supports of the codewords that are in the orbit of c π min , with J 0 being the support of the codeword c γπ min that has been chosen. We compute the dimensions of the codes P J 0 ∪J i (C (I) π ) for i = 1, . . . , 2 r + -1. It turns out that there is generally a single space J i such that dim (P J 0 ∪J i (C (I) π )) = dim (P I (C (I))). We pair these two spaces J 0 and J i together. This process can be used to pair together all the spaces A(ε 0 , . . . , ε r + -2 , 0) γπ and A(ε 0 , . . . , ε r + -2 , 1) γπ by pairing together J i and J j when J j is the only space for a given i such that dim

P J i ∪J j (C (I) π ) = dim (P I (C (I))) .
In such a case, J i and J j necessarily correspond to A(ε 0 , . . . , ε r + -2 , 0) γπ and A(ε 0 , . . . , ε r + -2 , 1) γπ for a certain (ε 0 , . . . , ε r + -2 ) ∈ F r + -1 2

. In other words, we know after this process all the spaces A(ε 0 , . . . , ε r + -2 ) γπ = A(ε 0 , . . . , ε r + -2 , 0) γπ ∪ A(ε 0 , . . . , ε r + -2 , 1) γπ . We can carry on this process with the codeword c = ev(x 0 . . . x r + -1 ) instead of c min and recover all the permuted affines spaces A(1) γπ , A(1, 1) γπ , . . . , A(1, 1, . . . , 1 r + times ) γπ for some permutation γ leaving C (I) invariant.

Example 4.4.8. If we consider the Polar code and we puncture the code on the support of the vector ev(x 0 x 1 x 2 ) = ev(x 0 x 1 x 2 x 3 + x 0 x 1 x 2 (1 + x 3 )) we obtain a code of dimension 75. If we puncture now on the other 2 4 -1 possible supports we obtain each time a dimension strictly greater than 75. Which means that there is only one minimum weight codeword, namely ev(x 0 x 1 x 2 (x 3 + 1)), that can be paired with ev(x 0 x 1 x 2 x 3 ).

We continue and consider the vector ev(x 0 x 1 ) and remark that this is the only codeword for which the dimension of the punctured code equals 68. It means that there is only one vector, namely ev(x 0 x 1 (x 2 + 1)), than can be paired with ev(x 0 x 1 x 2 ).

In the last step we find the support of the permuted of the codeword ev(x 0 ).

Step 5 -Equivalence problem for a short decreasing monomial code

We now have to solve the code equivalence problem for D which is a code of length 2 m-r + which is much shorter than the original code. It is also straightforward to check that it is a decreasing monomial code.

IMPLEMENTATION

Step 6 -Induction step

The idea here is to reconstruct the permutation π given that we already know its action on the support of c min . More precisely, the code equivalence problem that we solve here is:

Problem 4.4.9 (Code equivalence search problem with side information). Given (C , C π ) and t pairs of code positions (i 0 , j 0 ), (i 1 , j 1 ), . . . , (i t-1 , j t-1 ), find π such that C π = C π and π(i s ) = j s for all s ∈ {0, 1, . . . , t -1}

We use the following algorithm for solving this problem (we let here I def = {i 0 , . . . , i t-1 } and J def = {j 0 , . . . , j t-1 })

1. we pick a certain number of codewords c(0), . . . , c( -1) of C .

2. Let C (j) the set of codewords of C which coincide with c(j) on the positions belonging to J . We also define C (i) π as the set of codewords of C π that coincide with c(i) π on I.

3. We compute for all i in 0, 1, . . . , -1 and all positions j which are not in J , the number Σ(i, j) which is the number of codewords of minimum weight in P j (C (i)), and similarly for all all positions j that are not in I, the number Σ π (i, j) which is the number of codewords of minimum weight in P j (C (i) π ).

4. We declare for u which is not in I that π(u) = v if there exists a unique v which does not belong to J such that Σ(i, v) = Σ π (i, u) for all i in {0, 1, . . . , -1}.

It is straightforward to verify that this algorithm outputs the unique π solving the problem in this case. We have also encountered cases, where even with the knowledge we have on π, we have different solutions. In such a case, we were able to compute how many solutions we had and add to the set of pairs (i s , j s ) an additional pair (or additional pairs) which gives a unique solution.

Implementation

We implemented the attack on the [2048, 614]-Polar code.Such a code is able to correct more than 200 errors with a small error probability-this should be compared to the 130 errors that a Goppa code of the same rate is able to tolerate. In the case of a Goppa code we have about 70 bits of security against message attacks based on generic linear codes decoding algorithms, whereas we have more than 105 bits of security for the Polar code.

We first checked that this code C and its dual C ⊥ are both Decreasing Monomial codes and computed all the minimum weight codewords by using Proposition 3.7.12. We have also checked that the code was weakly self-dual C ⊂ C ⊥ . The minimum distance of C turned out to be equal to 32 and there were 42176 codewords of this weight, whereas the minimum distance of C ⊥ was 8 and there were 6912 codewords of this weight in the dual, numbers that were computed using Theorem 3.7.14. The same number of codewords were found by Dumer's algorithm in C π and in (C π ) ⊥ . It tooks 27 seconds to find these codewords in C π and 3 seconds to find these codewords in (C π ) ⊥ on a 8-core XEON E3-1240 running at 3.40 GHz.

But the most time consuming part was

Step 6 of the attack when we have to compute the various Σ(i, j)'s that are needed. This is done again by using Dumer's algorithm. The difference with obtaining codewords of minimum weight of the Polar code is that in the polar case we know beforehand the number of minimum weight codewords by using a counting procedure based on Theorem 3.7.14 and we can stop the search procedure once we have the right amount of different codewords. However when we compute Σ(i, j) we do not know beforehand the number of minimum weight codewords in P j (C (i)) and we use a probabilistic procedure based on the coupon collector problem : once we have found n different minimal codewords, where on average we have found each codeword α ln n times we stop the procedure for a certain value of α greater than 1. Here we have taken α to be equal to 3. In this case, to speed up the computation we chose the c(i)'s to be minimum weight codewords of C . More than 80% of the total computation is actually taken for the last step of induction where we recover a permutation for the whole [2048, 614] code from the partial permutation acting on half its positions. This takes about 227 hours and the total computation time is about 280 hours. This part of the attack is very likely to be improved significantly if need be.

Perspectives

Even though we managed to totally break the McEliece scheme based on Polar codes there is another variant using Polar codes which is not vulnerable to our attack. In [START_REF] Hooshmand | Reducing the key length of McEliece cryptosystem using polar codes[END_REF] the authors propose to choose a subcode of the Polar code instead of the whole code, which is equivalent to choosing a Monomial code from a subset of monomials in M m . Therefore our attack can not be directly implemented on this code and different techniques have to be investigated. We notice that this variant is similar to [START_REF] Rina | A new post-quantum cryptosystem based on newly discovered decoding algorithm of reed-muller codes[END_REF], in which the authors propose to choose a subcode of a Reed-Muller code. Remark that choosing subcodes of Decreasing Monomial codes rises a bigger difficulty in finding the structure of the code since in general the subcodes lose all the decreasing properties and more important properties related to the permutation group. Another fundamental difference is that there is no more only one private code but an exponential number of codes since there are

k D k S
where k D is the dimension of the decreasing code and k S is the dimension of the subcode. Therefore the code equivalence problem becomes even more complicated to solve in this case. So if one manges to solve the code equivalence problem for Monomial codes or even Weakly Decreasing Monomial codes it might make a step towards the complete elimination of this family of codes from public key cryptography.

The second aspect we want to reveal is the efficiency of the attack. Since the main step in our algorithm is to search for the minimum weight codewords one might suggest to propose parameters for which the minimum distance is big enough in order to make the attack unfeasible in practice. But this is not always a good solution since the minimum distance of the dual code might decrease and thus we can apply our attack on the dual code, since it is a Decreasing Monomial code. Nonetheless, there is another type of attack, much more efficient, that worked on the family of Reed-Muller codes [START_REF] Vladimirovich | The failure of mceliece pkc based on reed-muller codes[END_REF]. The idea is to use the square code and the dual code in order to decrease the dimension of the initial Reed-Muller code down to the first order Reed-Muller code. The only issue is that for this family of codes the square code has the same permutation group as the initial code, which 4.6. PERSPECTIVES is not the case for a Decreasing Monomial code in general. In the case of Polar codes, we tried this attack but we did not managed to find the whole structure of the code. By that we mean that only a part of the generating monomials of the Polar code were found.

5

Weak keys in the QC-MDPC McEliece

Introduction

Moderate Density Parity-Check codes, or shortly MDPC codes, were introduces in 2009 [START_REF] Ouzan | Moderate-density parity-check codes[END_REF] and became famous for their application in cryptography, in a McEliece type scheme [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from moderate density parity-check codes[END_REF].

The security assessment for the QC-MDPC is based on a reduction towards the syndrome decoding problem for quasi-cyclic codes. The main ingredient for the reduction is the assumption that a QC-MDPC code can not be distinguish from a random QC linear code. More details on this issue can be found in the original paper [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from moderate density parity-check codes[END_REF] and in [START_REF] Sendrier | On the use of structured codes in code based cryptography[END_REF].

The scientific community presented a real interest in this variant and thus several efficient implementations were proposed [START_REF] Heyse | Smaller keys for codebased cryptography: QC-MDPC McEliece implementations on embedded devices[END_REF][START_REF] Ingo Von | Lightweight code-based cryptography: QC-MDPC McEliece encryption on reconfigurable devices[END_REF][START_REF] Ingo | Implementing QC-MDPC McEliece encryption[END_REF][START_REF] Chou | Qcbits: constant-time small-key code-based cryptography[END_REF] as well as a structural attack against the cyclosymmetric MDPC codes [START_REF] Perlner | Optimizing information set decoding algorithms to attack cyclosymmetric MDPC codes[END_REF], side-channel attacks [START_REF] Ingo Von | Towards side-channel resistant implementations of QC-MDPC mceliece encryption on constrained devices[END_REF][START_REF] Guo | A key recovery attack on mdpc with cca security using decoding errors[END_REF] and improved decoders for the scheme [START_REF] Chaulet | Worst case QC-MDPC decoder for McEliece cryptosystem[END_REF]. But this variant using QC-MDPC codes, made a big step towards a global recognition at The Seventh International Conference on Post-Quantum Cryptography PQCrypto2016, where the scientific community seemed to agree on the fact that this variant could be among the finalists in the POST-QUANTUM CRYPTO Project, initiated by the NIST.

Our contribution. We propose here to analyze the security of the MDPC-McEliece cryptosystem from another point of view, more exactly to identify a subset of private keys, that we will call weak keys, which can be efficiently retrieved from the corresponding public keys. For that we describe the Key Generation step using an algebraic formalism for quasi-cyclic codes and show that the Key Recovery Attack is just a particular instance of the Rational Reconstruction Problem. Hence we propose to use a modified version of the Extended Euclidean Algorithm, or shortly EEA as a Key Recovery Attack against the QC-MDPC scheme. The main advantage of this approach is the low complexity of the algorithm that we use, since the EEA runs in O(n 2 ) bit operations, where n is the length of the code.

The most challenging part of our study was to estimate the proportion of weak and search for different techniques that might increase the proportion of weak keys. So the first step was to determine the exact proportion of private keys that can be recovered 5.1. INTRODUCTION using the EEA. In our study we have considered the case of a 2-quasi-cyclic MDPC scheme with parameters (2p, p, ω), where ω is the Hamming weight of the two blocks and p is the length of each block. We have proved that the proportion of weak keys is asymptotically dominated by 2 -cω where 0 < c 1 is a constant. Thus the chances of finding a weak key are very close to the security level for the scheme, which is given by the cost of the best variant of Information Set Decoding.

In our study we also investigate different methods to improve our initial results. A successful approach is to consider the problem of equivalence of quasi-cyclic codes and use it in order to increase the proportion of weak keys. For that we use two group actions that preserve the 2-quasi-cyclic structure of the (2p, p, ω) QC-MDPC code, namely the additive group F p and the multiplicative group F p * . We prove that using the additive group we increase the proportion of weak keys by a factor equal to ω 2 . As for the multiplicative group F p * , we extend the proportion of vulnerable keys with a linear factor in p. We confront our result with the proposed parameters for the QC-MDPC scheme and remark that we obtain probability values that are bigger than the announced security level. Hence we estimate that some of the parameters must be reviewed in order to at least decrease this probability below the security level. In order to do so one must increase the weight of the MDPC, which comes with a degradation of the decoding error probability. Therefore we propose another step in the Key Generation which completely eliminates weak keys from the possible set of keys. The results that we detail in this Chapter were published in [START_REF] Bardet | Weak keys for the quasi-cyclic MDPC public key encryption scheme[END_REF].

CHAPTER 5. WEAK KEYS IN THE QC-MDPC MCELIECE

Preliminaries on QC-MDPC Codes

Cyclic and Quasi-Cyclic codes

Cyclic codes were studied for the first time by Prange [START_REF] Prange | Cyclic error-correcting codes in two symbols[END_REF] and benefit of simple encoding and decoding techniques. Part of this family of codes are Bose-Chaudhuri-Hocquenghem [Hoc59, BRC60] and Reed-Solomon codes [START_REF] Solomon | Polynomial codes over certain finite fields[END_REF]. Since here we are rather interested in the quasi-cyclic structure we prefer to recall only a small part of the properties of cyclic codes. For a detailed presentation of cyclic codes we address the reader to the well-known [START_REF] Macwilliams | The Theory of Error-Correcting Codes[END_REF]. As for the structural results on quasi-cyclic codes many of the result we recall here come from the work of San Lin and Patrick Solé, more precisely from the third part [START_REF] Ling | On the algebraic structure of quasi-cyclic codes III: generator theory[END_REF] of a four series of articles entitled On the algebraic structure of quasi-cyclic codes, as well as the phd thesis of Christophe Chabot [START_REF] Chabot | Reconnaissance de codes, structure des codes quasicycliques[END_REF].

Preliminaries

In order to define cyclic codes we need to introduce the notion of cyclic shift of a n length vector. We will use the usual convention, that is we consider the shifts to the right, and as in the previous chapter, the most significant bit of a vector (c 0 , . . . , c n-1 ) is the rightmost bit, here c n-1 . Definition 5.2.1 (Cyclic Shift). We define the cyclic shift of a binary n-length vector c = (c 0 , . . . , c n-1 ) by T (c), where

T : F n 2 → F n 2 (c 0 , c 1 , . . . , c n-1 ) → (c n-1 , c 0 , . . . , c n-2 )
For any 0 i n-1 the i th cyclic shift of a vector c is T i (c) = (c n-i , . . . , c 0 , . . . , c n-i-1 ).

Definition 5.2.2 (Cyclic and Quasi-Cyclic codes). Let n be a strictly positive integer and C be a [n, k] binary linear code.

• We say that C is a cyclic code if for any codeword c ∈ C we have T (c) ∈ C .

• We say that C is a n 0 -quasi-cyclic code if ∃ 0 < n 0 < n with n 0 |n, such that for any codeword c ∈ C we have

T n 0 (c) ∈ C .
Let's recall the main properties regarding cyclic and quasi-cyclic codes: Proposition 5.2.3.

• ([MS86]

) Let C be a [n, k] binary cyclic code, then for any codeword c ∈ C all the cyclic shifts T i (c), for 1 i n -1 are codewords of C .

• ([MS86]

) Any [n, k] binary cyclic code admits as parity-check matrix a n×n circulant matrix, that we denote H, such that rank(H) = n -k, where a circulant matrix is a n × n matrix obtained by cyclically right shifting its first row h = (h 0 , h 1 , . . . , h n-1 )

H =       h 0 h 1 • • • h n-1 h n-1 h 0 • • • h n-2 . . . . . . . . . . . . h 1 h 2 • • • h 0       .
(5.1)

PRELIMINARIES ON QC-MDPC CODES

• ( [START_REF] Baldi | QC-LDPC Code-Based Cryptography[END_REF]) Any binary n 0 -quasi-cyclic code of length n 0 p and rate k 0 /n 0 admits a parity-check matrix H such that

H =     H 1,1 H 1,2 • • • H 1,n 0 . . . . . . . . . . . . H n 0 -k 0 ,1 H n 0 -k 0 ,2 • • • H n 0 -k 0 ,n 0     ,
where for each 1 i n 0 -k 0 and 1 j n 0 the matrix H i,j is p × p circulant.

An interesting case that is used for the QC-LDPC and QC-MDPC codes is when k 0 = n 0 -1. In this case we have a n 0 -quasi-cyclic code of length n 0 p and rate (n 0 -1)/n 0 that admits a parity check matrix

H = H 1 H 2 • • • H n 0 .

Algebraic formalism

It is already known that cyclic codes can be defined using an algebraic formalism [START_REF] Macwilliams | The Theory of Error-Correcting Codes[END_REF].

For that we associate to any binary n length vector c = (c 0 , . . . , c n-1 ) the polynomial over

F 2 [x], that is c(x) = n-1 i=0 c i x i
. Now we can define a cyclic code in an equivalent manner Proposition 5.2.4. [START_REF] Macwilliams | The Theory of Error-Correcting Codes[END_REF] A binary cyclic code of length n is an ideal of the polynomial algebra F 2 [x]/(x n -1).

Since both cyclic and quasi-cyclic codes are strongly related to the algebra of circulant matrices we recall some well-known facts concerning this algebra.

Theorem 5.2.5. [START_REF] Davis | Circulant matrices. Pure and applied mathematics[END_REF] The algebra of n × n binary circulant matrices denoted by C n (F 2 ), +, × is isomorphic to the polynomial algebra F 2 [x]/(x n -1), +, • through the mapping Φ :

C n (F 2 ) -→ F 2 [x]/(x n -1) M -→ m(x) = n-1 i=0 m i x i (mod x n -1).
where m = (m 0 , . . . , m n-1 ) is the first row defining M .

Proposition 5.2.6. Let M ∈ C n (F 2 ) be a circulant matrix and m(x) ∈ F 2 [x]/(x n -1) the corresponding polynomial. Then M is invertible if and only if m(x) and x n -1 are coprime. Furthermore the inverse of M is given by the polynomial m -1 (x) ∈ F 2 [x]/(x n -1). An efficient algorithm to compute m -1 (x) is the Extended Euclidean Algorithm.

Corollary 5.2.7 ([Bal14]

). Let M ∈ C n (F 2 ) be a circulant matrix and m the first row vector defining M . If m has an even Hamming weight then M is rank deficient, in other words M is not invertible. Remark 5.2.8. From now on we will consider the case n = p a prime number, choice that is also considered in [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from moderate density parity-check codes[END_REF]. Our choice has several motivations that we will point out at adequate moment, see for example Section 5.3.2.

QC-MDPC MCELIECE

The bit flipping algorithm takes for input a vector y ∈ F n 2 and the parity-check matrix H of the MDPC code, as well as a threshold b. At each iteration it computes the syndrome of y with respect to H and for each bit i of the vector y it computes the number of parity equations unsatisfied by i. If the number of unsatisfied equations is greater than or equal to the threshold b then the corresponding bit is flipped and the procedure restarts with the new vector and syndrome. The algorithm stops when the syndrome is equal to zero or the number of iterations has reached a fixed upper bound. A full description of the algorithm is given in [START_REF] Gallager | Low Density Parity Check Codes[END_REF] and in [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from moderate density parity-check codes[END_REF][START_REF] Chaulet | Worst case QC-MDPC decoder for McEliece cryptosystem[END_REF] for the latest variants.

Remark 5.2.13. Since the performance and the correctness of the bit flipping algorithm depends on the density of the parity-check matrix H, any equivalent parity-check matrix that respects the density condition enables a correct decoding algorithm. In other words

given a LDPC/MDPC code C and a vector y, then any equivalent LDPC/MDPC code of C can decode the vector y with the same decoding algorithm, namely the bit flipping algorithm.

QC-MDPC McEliece

Description

We begin by describing the Key Generation of the QC-MDPC McEliece as defined in [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from moderate density parity-check codes[END_REF]. The private key of an (n 0 p, p, ω) QC-MDPC code is a parity check matrix

H = H 1 H 2 • • • H n 0 , (5.3)
where H i are p × p circulant matrices for 1 i n 0 . This private key is obtained by taking at random the first row of H until H n 0 is invertible. The public key is the block parity-check matrix

F def = H -1 n 0 H, or equivalently F = H -1 n 0 H 1 • • • H -1 n 0 H n 0 -1 I p def = F 1 • • • F n 0 -1 I p .
(5.4)

Hence, the main steps in the QC-MDPC scheme can be summarized as follows

Key-Generation

• Private key. Pick at random a valid parity check matrix matrix H of a (n 0 p, p, ω) QC-MDPC code.

• Public key. The parity check matrix F (or equivalently the generator matrix G, where GF T = 0).

Encryption of a plaintext

m ∈ F (n 0 -1)p 2 into z ∈ F n 0 p 2 :
• choose a random error vector e ∈ F n 0 p 2 with weight e t, where t is the decoding capacity of the code.

• compute the ciphertext z = mG + e 3. Decryption of the ciphertext z using the private key and the bit-flipping decoder:

CHAPTER 5. WEAK KEYS IN THE QC-MDPC MCELIECE

• compute mG using the bit-flipping algorithm applied to z with the knowledge of H.

• extract the first (n 0 -1)p positions of mG in order to obtain m.

Remark 5.3.1. Using the isomorphism defined in Proposition 5.2.5, the private and public keys are fully described by the sequences h 1 , . . . , h n 0 and f 1 , . . . , f n 0 -1 of polynomials in F 2 [x]/(x p -1) such that for all i ∈ {1, . . . , n 0 -1},

f i = h i h n 0 (mod x p -1), (5.5)
where the private polynomials are taken so that

n 0 i=1 h i = ω.

The choice of parameters for the scheme

There are several factors to be considered in the choice of the parameters for the QC-MDPC McEliece scheme.

• The parameter p has to be prime in order to avoid attacks using the decomposition of x p -1 into irreducible [START_REF] Loidreau | Codes derived from binary Goppa codes[END_REF][START_REF] Fouque | Cryptanalysis of a hash function based on quasi-cyclic codes[END_REF] or squaring type attack [LJS + 16].

• Against Folding type attacks [Gen01, FOP + 14] we need to choose values for p such that the number of irreducible factors of x p -1 in F 2 [x] different from x -1, denoted d, is as small as possible, for example d = O(1). In Figure 5.1 we detail the values for d for all the proposed parameters in [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from moderate density parity-check codes[END_REF].

• During the Key Generation step one must randomly choose the polynomials h i until at least one of them is invertible. So we might expect, for security reasons, that the designers selected those parameters for which the set of invertible polynomials in the polynomial algebra F 2 [x]/(x p -1) is the largest possible. Using a ring isomorphism we give the number of invertible polynomials and thus show which are the proper parameters to be selected.

Proposition 5.3.2. Let p be a prime number and assume (x -1)

d i=1 g i (x) is the decom- position of x p -1 into irreducible polynomials over F 2 [x]
for some d 1. Then

• an invertible polynomial has necessarily an odd Hamming weight.

• the number of invertible polynomials in

F 2 [x]/(x p -1) equals 2 p-1 d -1 d .
.

Hence, if we take into consideration that d = O(1) when p tends to infinity, we obtain that the number of invertible polynomials in F 2 [x]/(x p -1) tends to 2 p-1 when p tends to infinity, which is exactly the number of polynomials with an odd Hamming weight. So Figure 5.1 -Suggested parameters for the QC-MDPC scheme in [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from moderate density parity-check codes[END_REF] the probability of choosing an invertible polynomial from the set of polynomials with an odd Hamming weight is 1 -

WEAK KEYS FOR THE QC-MDPC SCHEME

2 -p-1 d d
, which tends to 1 when d = O(1). We notice from Figure 5.1 that the designers of the scheme considered in most of the cases d = 1 or d = 2. Therefore they maximized the cardinality of the set of invertible polynomials.

Remark 5.3.3. Furthermore we restrict the study to the case of a two blocks (2p, p, ω) QC-MDPC scheme that is to say n 0 = 2 with p a prime number such that d = 1 or possibly d = 2. We consider that for 1 i 2 we have h i = ω i with ω i an odd integer and ω 1 + ω 2 = ω. Thus we maximize our chances that h i is invertible.

In [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from moderate density parity-check codes[END_REF] it is also recommended to choose the polynomials h i with 1 i 2, using a smooth distribution of their Hamming weight, by that we understand that ω 1 = ω 2 = ω/2. We analyze in detail in the next section the consequence of a smooth distribution as well as non-smooth distribution.

Weak keys for the QC-MDPC scheme

The key recovery attack

We are interested in a key-recovery under a chosen plaintext attack when applied on a (2p, p, ω) QC-MDPC scheme. Definition 5.4.1 (QC-MDPC Key Recovery Problem). Given the public key f ∈ F 2 [x]/(x p -1), of a (2p, p, ω) QC-MDPC scheme, find a pair of polynomials (h 1 , h 2 ), with

h i ∈ F 2 [x]/(x p -1) satisfying f = h 1 h 2 (mod x p -1) and h 1 + h 2 ω. (5.6)
This problem can be tackled by applying classical techniques based on exponential algorithms seeking low-weight codewords, which is the idea used in [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from moderate density parity-check codes[END_REF] in order to set up the security level of the scheme. It can also be recast as the problem of solving the rational reconstruction problem that is described in full details in Sec. 5.4.2. The extended Euclidean algorithm solves (5.6) when there exists an integer t > 0 such that deg(h 1 ) < t p and deg(h 2 ) p -t.

The Rational Reconstruction Problem

Definition 5.4.2 (Rational reconstruction). Let g and f be polynomials in K[x] where K is a field such that 0 < deg(f ) < deg(g). For a given integer r satisfying 1 r deg(g), the rational reconstruction of f modulo g consists in finding ϕ and ψ in K[x] such that gcd(ϕ, g) = 1, deg(ψ) < r and deg(ϕ) deg(g) -r and satisfying

ψ ϕ = f (mod g). (RR)
Remark 5.4.3. When g = x p then we rather speak of Padé approximation.

Note that if (RR) has a solution (ϕ, ψ) then ψ ϕ is unique. Furthermore if (ϕ, ψ) ∈ K[x] 2
is a solution of the problem (RR), then it is also a solution to the following problem. Clearly, any solution to (SRR) is solution to (RR) if and only if gcd(ϕ, g) = 1. Moreover, (SRR) always has a non-trivial solution since recovering ϕ and ψ can be done by solving a linear system of p equations with r + (p -r + 1) = p + 1 unknowns representing the coefficients of ϕ and ψ.

A very efficient way to solve (RR) is to apply the Extended Euclidean Algorithm (EEA) to (f, g). Recall that if we denote by (ϕ i , δ i , ψ i ), with i 0, the polynomials obtained at the i-th step of EEA(f, g) then we have ψ 0 def = g, ψ 1 def = f and for all i 0:

     ψ i = Q i+1 ψ i+1 + ψ i+2 with 0 deg(ψ i+2 ) < deg(ψ i+1 ), ψ i = ϕ i f + δ i g
with (ϕ 0 , ϕ 1 ) def = (0, 1) and (δ 0 , δ 1 ) def = (1, 0).

We also have the relations

ϕ i+2 = -Q i+1 ϕ i+1 + ϕ i and δ i+2 = -Q i+1 δ i+1 + δ i . Input: Two polynomials f, g ∈ K[x] Output: The polynomial ψ ∈ K[x] s.t. ψ = gcd(f, g) together with ϕ, δ ∈ K[x] s.t. ψ = ϕf + δg 1 ψ 0 = g, ϕ 0 = 0, δ 0 = 1; 2 ψ 1 = f, ϕ 0 = 1, δ 0 = 0; 3 i = 0; 4 while ψ i+2 = 0 do 5 Q i+1 = ψ i quo ψ i+1 ; 6 ψ i+2 = -Q i+1 ψ i+1 + ψ i ; 7 ϕ i+2 = -Q i+1 ϕ i+1 + ϕ i ; 8 δ i+2 = -Q i+1 δ i+1 + δ i 9 end 10 return (ψ i , ϕ i , δ i )
Algorithm 1: The Extended Euclidean Algorithm

WEAK KEYS FOR THE QC-MDPC SCHEME

We are now able to prove that this approach provides a non-trivial solution. Let's denote by j the smallest index such that deg(ψ j ) < r deg(ψ j-1 ). We require the following proposition. (5.7)

The following proposition characterizes a solution to (RR) when it exists.

Proposition 5.4.6 ([Pan12]). Let (ϕ i , δ i , ψ i ), with i 0, be the polynomials obtained at the i-th step of EEA(f, g). Let j be the smallest integer such that deg(ψ j ) < r then (ϕ j , ψ j ) is a non-trivial solution to (SRR). Furthermore, if (ϕ, ψ) is a solution to (RR) then there exists λ in K\{0} such that ϕ = λϕ j and ψ = λψ j .

Weak keys

This section is devoted to the identification of private keys (h 1 , h 2 ) that can be recovered from the public key f by means of the Extended Euclidean Algorithm.

Main idea of the attack. Since

f = h 1 h 2 (mod x p -1
), the idea of our attack is to find a rational reconstruction of f 1 modulo x p -1. At each step t of algorithm EEA(f, x p -1), the attacker checks if the ongoing computed polynomials denoted by (ψ t , ϕ t ) where ψ t = f ϕ t , satisfy the inequality ϕ t + f 1 ϕ t ω.

(5.8)

If such a solution is found then by Proposition 5.4.6 we have found (equivalent) secret polynomials. With these polynomials we built an equivalent parity-check matrix for the QC-MDPC code and thus we are able to decrypt any ciphertext (see Remark 5.2.13). The main question we want to answer is to estimate precisely the number of keys that can be recovered with this technique.

Definition 5.4.7. Let p be a prime number and ω an even integer with 1 < ω < p. Let (ω 1 , ω 2 ) ∈ N 2 be odd integers such that ω 1 + ω 2 = ω. We define the set of private pairs with fixed weights by

P ω 1 ,ω 2 = (h 1 , h 2 ) ∈ (F 2 [x]/(x p -1)) 2 | h i = ω i and ω i odd ,
and the set of all private pairs of a (2p, p, ω) QC-MDPC scheme by

P ω = ω 1 +ω 2 =ω P ω 1 ,ω 2 .
Private pairs that can be recovered using the Extended Euclidiean Algorithm are declared weak pairs. Definition 5.4.8. A pair (h 1 , h 2 ) ∈ P ω is called a weak pair if

deg(h 1 ) + deg(h 2 ) < p.
(5.9)

The set of weak pairs is denoted by

W ω = {(h 1 , h 2 ) ∈ P ω | deg(h 1 ) + deg(h 2 ) < p}. Similarly, W ω 1 ,ω 2 is defined as W ω ∩ P ω 1 ,ω 2 .
Remark 5.4.9.

• The exact collection of private keys of a general (2p, p, ω) QC-MDPC scheme is actually the set P ω * = ω 1 +ω 2 =ω P * ω 1 ,ω 2 where

P * ω 1 ,ω 2 = (h 1 , h 2 ) ∈ P ω 1 ,ω 2 | gcd(h 2 , x p -1) = 1 .
• Since we consider parameters for which d = 1 and d = 2, where d comes from the factorization of x p -1, we have

-when d = 1 P ω 1 ,ω 2 = P * ω 1 ,ω 2 and P ω = P ω * .
when d = 2 (see Proposition 5.4.14)

lim p→∞ p ω=2 ω even |W ω * | = lim p→∞ 2p ω=2 ω even |W ω |.
Proposition 5.4.10. Let p be a prime number and ω an even integer with 1 < ω < p.

Let (ω 1 , ω 2 ) ∈ N 2 be odd integers such that ω 1 + ω 2 = ω. Then we have |W ω 1 ,ω 2 | = p+1 ω 1 +ω 2 and |W ω | = ω 2 p + 1 ω .
(5.10)

|P ω 1 ,ω 2 | = p ω 1 p ω 2 and |P ω | = 1 2 2p ω -(-1) ω 2 p ω 2 .
(5.11)

Proof. Let (h 1 , h 2 ) ∈ P ω 1 ,ω 2 . Then h i has ω i non-zero coefficients, and a degree less than

p, hence |P ω 1 ,ω 2 | = p ω 1 p ω 2 . For (h 1 , h 2 ) ∈ W ω 1 ,ω 2 we have deg(h 1 ) + deg(h 2 ) < p. If k = deg(h 1 )
, then h 1 has a leading coefficient x k and ω 1 -1 non-zero coefficients between x 0 and x k-1 . The number of such polynomials is k ω 1 -1 . Furthermore the number of polynomials h 2 with ω 2 non-zero coefficients and deg(h 2 ) < p -k equals p-k ω 2 . Using the Gould's formulae [START_REF] Gould | Combinatorial identities: a standardized set of tables listing 500 binomial coefficient summations[END_REF], we get

|W ω 1 ,ω 2 | = p-1 k=0 k ω 1 -1 p -k ω -ω 1 = p + 1 ω ,
and

|P ω | = ω 1 +ω 2 =ω ω i odd p ω 1 p ω 2 = 1 2 2p ω -(-1) ω 2 p ω 2 .
As for W ω we obtain:

|W ω | = ω 1 +ω 2 =ω ω i odd p + 1 ω = p + 1 ω ω 1 +ω 2 =ω ω i odd 1 = ω 2 p + 1 ω .

WEAK KEYS FOR THE QC-MDPC SCHEME

Corollary 5.4.11. Let p be a prime number and ω an even integer with 1 < ω < p and H(α) = -α log 2 α -(1 -α) log 2 (1 -α) be the binary entropy function for any 0 α 1. Let (ω 1 , ω 2 ) ∈ N 2 be odd integers such that ω 1 + ω 2 = ω and ω = o(p). Then we have

|W ω 1 ,ω 2 | |P ω 1 ,ω 2 | = 2πα(1 -α)ω 1 2 2 -ωH(α) ×      e -2 √ c 1 c 2 1 + O( 1 √ p ) if ω 2 i 2p = c i + O( 1 √ p ) p -2 √ c 1 c 2 1 + O( log 3 p p ) if ω 2 i 2p = c i log p + O( log p p ) with α = 1 1 + c 2 c 1 . |W ω | |P ω | = ω2 -ω ×      e -c 2 1 + O( 1 √ p ) if ω 2 2p = c + O( 1 √ p ), p -c 2 1 + O( log 3 p p ) if ω 2 2p = c log p + O( log p p ).
For all the asymptotic expansion that we derive in this Chapter we mainly use the Stirling formula. In Appendix D we detail the asymptotic expansion of the binomial coefficient and deduce all the asymptotic expansions that we state here.

Corollary 5.4.12. In particular for a smooth (2p, p, ω) QC-MDPC, we have

W ω/2,ω/2 P ω/2,ω/2 = p+1 ω p ω/2 2 ,
with asymptotic equivalence

W ω/2,ω/2 P ω/2,ω/2 ∼            √ πp 1 4 e -2 2 1 4 -2 √ 2p if ω = 2 √ 2p, √ πp 1 4 -2 log 1 4 p2 1 4 -2 √ 2p log p if ω = 2 √ 2p log p.
Remark 5.4.13. We notice from Proposition 5.4.10 that the probability of a weak key with fixed weight is asymptotically dominated by 2 -ωH(α) . Therefore the most secure choice for the parameters is when α equals 1, which is equivalent to ω 1 = ω 2 = ω/2, in other words the smooth distribution. Nevertheless the impact of a non smooth distribution is not measured in [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from moderate density parity-check codes[END_REF] but now it can be determined by the means of Proposition 5.4.10 (see Figure 5.

for numerical values).

In the next proposition we demonstrate that the cardinality of the set of all weak pairs for all the possible values of ω tends to the cardinality of the set of all weak keys when d = 2. Hence our choice of counting weak pairs, when the length goes to infinity, is a justified solution, for d = 1 and d = 2. Proposition 5.4.14. Let x p -1 = (x -1)g 1 (x)g 2 (x) be the decomposition of x p -1 into irreducible factors over F 2 [x]. Then we have:

lim p→∞ p ω=2 ω even |W ω * | = lim p→∞ p ω=2 ω even |W ω | CHAPTER 5. WEAK KEYS IN THE QC-MDPC MCELIECE Proof.
Since the set of weak keys equals the set of weak pairs minus the set of non invertible pairs of odd weight polynomials (h 1 , h 2 ) we have:

W ω \ (P ω \ P ω * ) = W ω * ⊆ W ω p ω=2 ω even W ω \ (P ω \ P ω * ) = p ω=2 ω even W ω * ⊆ p ω=2 ω even W ω p ω=2 ω even |W ω | -|P ω \ P ω * | p ω=2 ω even |W ω * | p ω=2 ω even |W ω |
We compute the cardinal of pairs of non invertible polynomials with odd Hamming weight (h 1 , h 2 ):

p ω=2 ω even |P ω \ P ω * | = 2 p-1 -(2 p-1 2 -1) 2 2 = (2 p+1 2 -1) 2 .
From Proposition 5.4.10 we deduce p ω=2 ω even

|W ω | = p ω=2 ω even ω 2 p + 1 ω = p ω=2 ω even p + 1 2 p ω -1 = p + 1 2 2 p-1
So when d = 2 we have that:

lim p→∞ p ω=2 ω even |P ω \ P ω * | p ω=2 ω even |W ω | lim p→∞ 8 p + 1 = 0.
Numerical results. In Figure 5.2 we plot the numerical results for the suggested parameters in [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from moderate density parity-check codes[END_REF] and [START_REF] Baldi | QC-LDPC Code-Based Cryptography[END_REF]. We notice that the values we obtain for the proportion of weak keys are lower than the security level, which is a good security argument in favor of the parameters that were chosen for the scheme. The values were computed in PARI/GP as well as in MAPLE software. In Figure 5.3 we compute the proportion of weak keys for the 80 bit security parameters, namely the (9602, 4801, 90) QC-MDPC. In this case we consider all the possible values for (ω 1 , ω 2 ) such that ω 1 + ω 2 = 90 with 21 ω 1 45. We notice that a non smooth distribution of the Hamming weight has a negative impact on the security of the scheme, reason for which we suggest to choose ω 1 = ω 2 = ω/2.

Since the proportion of weak keys is lower that the security level for a smooth (2p, p, ω) QC-MDPC, we focus our interest in finding additional techniques that allow us to increase this proportion. For that we naturally begin by considering the equivalence problem for quasi-cyclic codes.

EQUIVALENCE OF CODES

Equivalence of codes

Equivalence of cyclic codes

The equivalence of cyclic codes is presented in [START_REF] Macwilliams | The Theory of Error-Correcting Codes[END_REF]Chapter8]. There are two group actions that preserves a cyclic code C , group actions that we redefine here using the algebraic formalism for cyclic codes.

Preliminaries

c π (x) = p-1 i=0 c π -1 (i) x i .
Next we define the first group that acts as a permutation and leaves a cyclic code invariant. It comes directly from the definition of cyclic codes and consists of the cyclic shifts: Definition 5.5.2. The additive group (F p , +) acts on the set of polynomials F 2 [x]/(x p -1) as:

σ + : F p × F 2 [x]/(x p -1) → F 2 [x]/(x p -1) (α , c(x)) → σ + α (c(x)) = x α c(x).
We denote by F p . c the orbit of c(x) under the action of F p . Remark 5.5.3.

• We notice that σ + is a group action since we have

σ + 0 (c(x)) = c(x) for any c(x) ∈ F 2 [x]/(x p -1) and σ + α (σ + β (c(x))) = σ + α+β (c(x)) for any c(x) ∈ F 2 [x]/(x p -1
) and α and β ∈ (F p , +).

• We also have that σ + α induces a permutation on the coefficients of any polynomial in F 2 [x]/(x p -1) and thus doesn't modify the weight of the polynomial

σ + α (c(x)) = p-1 i=0 c i-α (mod p) x i .
(5.12) Proposition 5.5.4. Let C be a [p, k] binary cyclic code. Then for any α ∈ (F p , +) we have

σ + α (C ) = C .
Proof. Let c(x) be a polynomial in F 2 [x]/(x p -1) and C be the ideal c(x) . By definition of the group action we have that σ + α (c(x)) is an element of the ideal c(x) . Conversely we have that c(x) is an element of the ideal generated by < σ + α (c(x)) > . Indeed, since x α and x p -1 are coprime then x α admits an inverse modulo x p -1 and thus we can write

c(x) = (x α ) -1 (x α c(x)).
The second group action that plays an important role in the equivalence of cyclic codes is: Definition 5.5.5. The action of the multiplicative group (F p * , •) over F 2 [x]/(x p -1) can be defined as follow:

σ * : F p * × F 2 [x]/(x p -1) → F 2 [x]/(x p -1) (α , c(x)) → σ * α (c(x))
,

where σ * α p-1 i=0 c i x i = p-1 i=0 c i x αi (mod x p -1).
We denote by F p * . c the orbit of c(x) under the action of F p * .

Remark 5.5.6.

• σ * is well defined as a group action on the set of polynomials in F 2 [x]/(x p -1) since σ * 1 (x i ) = x i , ∀i and for any pair α and β elements of the group (F p * , •) we have

σ * α (σ * β (x i )) = x αβi (mod x p -1) = σ * αβ (x i ), ∀0 i p -1.
• We also have that σ * α induce a permutation on the coefficients of any polynomial in F 2 [x]/(x p -1) and thus doesn't modify the weight of the polynomial

σ * α (c(x)) = p-1 i=0 c iα -1 (mod p) x i , (5.13)
It is known from the literature that if two cyclic codes C 1 and C 2 are such that ∃α ∈ F p * satisfying C 1 = σ * α (C 2 ), then we say that C 1 and C 2 are multiplier equivalent.

EQUIVALENCE OF CODES

Proposition 5.5.7. Let C be a [p, k] cyclic code. Then for any α in the multiplicative subgroup 2 ⊆ F p * we have

σ * α (C ) = C .
Proof. Let c(x) be a polynomial in F 2 [x]/(x p -1) and C be the ideal c(x) . By definition of the group action and using the field characteristic we have that

σ * 2 (c(x)) = c(x) 2 . Hence σ * 2 (c(x)
) is an element of the ideal c(x) . Conversely we have to prove that c(x) ∈ σ * 2 (c(x)) . First notice that for any power of two we have c(x)

2 i ∈ σ * 2 (c(x)) . Since c(x) = c(x) 2 ord(2)
, where ord(2) is the multiplicative order of 2, we have that C ∈ σ * 2 (C ) . When the two group actions are combined we use the following notation for the orbits Notation 5.5.8. We denote the orbit of a polynomial c(x) under the action of F p and F p * by

F p * . (F p . c) = ∪ f (x)∈Fp.c {σ * α (f (x)) | α ∈ F p * } respectively F p . (F p * . c) = ∪ f (x)∈Fp * .c {σ + α (f (x)) | α ∈ F p }.

Equivalence of quasi-cyclic codes.

Since we deal with (2p, p, ω) QC-MDPC codes we detail in this section only the case of 2-quasi-cyclic codes. Hence we consider a pair of polynomials (h

1 (x), h 2 (x)) ∈ (F 2 [x]/(x p -1)
) 2 and study the group actions that act as a permutation and preserve the quasi-cyclic structure, notion that we define as follows:

Definition 5.5.9. Let p be a prime number. We say that a permutation π ∈ S 2p preserves the 2-quasi-cyclic structure if for any 2-quasi-cyclic code C , C π is a 2-quasi-cyclic code.

The action of F p and F p * can be extended in a natural manner to (F 2 [x]/(x p -1)) 2 , by considering the action on each component. Definition 5.5.10. For any pair (α 1 , α 2 ) ∈ F 2 p and any pair of polynomials (h

1 (x), h 2 (x)) ∈ (F 2 [x]/(x p -1)) 2 we define σ + (α 1 ,α 2 ) (h 1 (x), h 2 (x)) = σ + α 1 (h 1 (x)), σ + α 2 (h 2 (x)) .
Proposition 5.5.11. For any pair (α 1 , α 2 ) ∈ F 2 p the permutation induced by σ + (α 1 ,α 2 ) is an element of the symmetric group S 2p that preserves the 2-quasi-cyclic structure.

Moreover for any α ∈ F p and any 2-quasi-cyclic code C we have

σ + (α,α) (C ) = C .
As for the second group action we have Definition 5.5.12. For any pair (α 1 , α 2 ) ∈ (F p * ) 2 and any pair of polynomials

(h 1 , h 2 ) ∈ (F 2 [x]/(x p -1)) 2 we define σ * (α 1 ,α 2 ) (h 1 , h 2 ) = σ * α 1 (h 1 ), σ * α 2 (h 2 ) .
Proposition 5.5.13. For any α ∈ F p * the permutation induced by σ * (α,α) is an element of the symmetric group S 2p that preserves the 2-quasi-cyclic structure.

Since the later Proposition states that only σ * α,β with α = β preserves the 2-quasi-cyclic structure, we simplify the notations and rather say that F p * acts on the set of polynomials (F 2 [x]/(x p -1)) 2 . Proposition 5.5.14. For any π ∈ S 2 , (β 1 , β 2 ) ∈ F 2 p and α ∈ F p * we have that π

• σ + β 1 ,β 2 • σ * α,α preserves the 2-quasi-cyclic structure.
Moreover for a given 2-quasi-cyclic code C there are at most 2p 2 (p -1) equivalent 2-quasi-cyclic codes.

For the orbits we use the usual notations Notation 5.5.15.

(F p ) 2 . (h 1 , h 2 ) = {σ + (α 1 ,α 2 ) (h 1 (x), h 2 (x)) | (α 1 , α 2 ) ∈ (F p ) 2 } and F p * . (h 1 , h 2 ) = {σ * (α,α) (h 1 (x), h 2 (x)) | α ∈ F p * }.

Attacking equivalent public keys

Considering the equivalence of quasi-cyclic codes for the QC-MDPC scheme can be used to extend the initial key recovery attack. In this part we explain how to deploy the Extended Euclidean Algorithm on the equivalent public keys.

The modified EEA for the attack

Equivalence under the action of (F p ) 2 . Let f ∈ F 2 [x]/(x p -1) be a public key of a (2p, p, ω) QC-MDPC scheme, and (h 1 , h 2 ) ∈ F 2 [x]/(x p -1) × F 2 [x]/(x p -1) the corresponding private key. So we have that f = h 1 h 2 mod (x p -1). Now assume that h 1 and h 2 can not be recovered only by applying EEA(x p -1, f ) but instead there exists (α 1 , α 2 ) ∈ F 2 p such that (x α 1 h 1 , x α 2 h 2 ) is a weak key. Then the public key x α 1 -α 2 f = x α 1 h 1

x α 2 h 2 can be attacked by EEA, which is equivalent to say that

∃α 1 , α 2 ∈ F 2 p such that deg(x α 1 h 1 ) + deg(x α 2 h 2 ) < p. (5.14)
Using this idea if our attack does not work on f we repeat it on all p -1 cyclic shifts of f , namely xf, x 2 f, . . . , x p-1 f. If there is a shift such that the outgoing polynomials satisfy the weight conditions in (5.8) then we have successfully recovered (equivalent) secret polynomials by Proposition 5.4.6. In other words we extend our technique to equivalent private keys, more exactly equivalent under the action of the additive group (F p , +) 2 . We call these solutions weak orbits and formally define them:

Definition 5.6.1 (Weak orbit). The set (F p ) 2 . (h 1 , h 2 ) defined by a private key (h 1 , h 2 ) ∈ F 2 [x]/(x p -1) 2 of a (2p, p, ω) QC-MDPC
is called a weak orbit if it contains at least one weak key, i.e. satisfies (5.14).

We denote

W ω 1 ,ω 2 = {(h 1 , h 2 ) ∈ P ω 1 ,ω 2 | (h 1 , h 2
) satisfy (5.14)} the set of private keys that define weak orbits.

In the case of all (2p, p, ω) QC-MDPC codes we denote

W ω = ω 1 +ω 2 =ω ω 1 odd W ω 1 ,ω 2 .
We deduce immediately that

W ω 1 ,ω 2 ⊆ W ω 1 ,ω 2 and |W ω 1 ,ω 2 | W ω 1 ,ω 2 p 2 |W ω | .
(5.15)

ATTACKING EQUIVALENT PUBLIC KEYS

Equivalence under the action of F p * . Let f ∈ F 2 [x]/(x p -1) be the public key of a (2p, p, ω) QC-MDPC scheme, and (h 1 , h 2 ) ∈ F 2 [x]/(x p -1) × F 2 [x]/(x p -1) the corresponding private key. Now suppose that (α 1 , α 2 ) ∈ F 2 p such that (x α 1 h 1 , x α 2 h 2 ) is a weak key, in other words (h 1 , h 2 ) can not be recovered by means of EEA applied to f or any of the cyclic shifts of f.

The idea to increase our chances of finding the private key or an equivalent one is to use the second group action, namely (F p * , •). Therefore we start our attack by fixing α ∈ F p * and try to find a rational reconstruction of σ * α (f ) modulo x p -1. If the algorithm finds a solution (ψ t , ϕ t ) where ψ t = α • f ϕ t satisfy the inequality

ϕ t + ψ t ω.
(5.16) then we have found as before (equivalent) secret polynomials.

Otherwise, the attacker performs the same attack to all shifts of f , namely α • x j f . If the attack fails, another α is chosen and the procedure is repeated until the good combination of α and shifts are founded. We call these solutions extended weak orbits and define them Definition 5.6.2 (Extended weak orbits). Let (h 1 , h 2 ) ∈ (F 2 [x]/(x p -1)) 2 be a private key of a (2p, p, ω) QC-MDPC. We say that the set

F p * . (F p ) 2 . (h 1 , h 2 )

is an extended weak orbit if and only if it contains at least one weak orbit.

We denote

W ω 1 ,ω 2 = {(h 1 , h 2 ) ∈ P ω 1 ,ω 2 | ∃α ∈ F p * s.t. σ * α,α (h 1 , h 2 ) satisfy (5.14
)} the set of private keys that define extended weak orbits.

In the case of all (2p, p, ω) QC-MDPC codes we denote

W ω = ω 1 +ω 2 =ω ω 1 odd W ω 1 ,ω 2 .
We deduce immediately that

W ω 1 ,ω 2 ⊆ W ω 1 ,ω 2 ⊆ W ω 1 ,ω 2 and W ω 1 ,ω 2 W ω 1 ,ω 2 (p -1) W ω 1 ,ω 2 .
(5.17)

We are left to determine how these two group actions increase the proportion of equivalent private keys that can be recovered using the Extended Euclidean Algorithm.

Orbits of the QC-MDPC private keys

So far we have seen that applying the Extended Euclidean Algorithm on the public key f of a (2p, p, ω) QC-MDPC scheme reveals a proportion of weak keys that is lower than the security level given by the designers in [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from moderate density parity-check codes[END_REF]. Thus we have defined two group actions that could potentially increase the proportion of weak keys. In order to achieve our goal, namely to determine how these group actions might increase the proportion of weak keys we proceed in two steps 1. we determine the cardinality of the orbits of (h 1 (x), h 2 (x)) ∈ P ω 1 ,ω 2 under the action of (F p ) 2 and F p * .

CHAPTER 5. WEAK KEYS IN THE QC-MDPC MCELIECE

2. we compute the cardinality of the orbits of (h 1 (x), h 2 (x)) ∈ W ω 1 ,ω 2 under the action of (F p ) 2 and F p * .

Before we detail how to compute the cardinality of the orbits we give an upper bound on the proportion of weak keys that might be obtained using these two group actions. Using Equation (5.15) and (5.17) we have

W ω 1 ,ω 2 |P ω 1 ,ω 2 | p 2 (p -1) |W ω 1 ,ω 2 | |P ω 1 ,ω 2 | .
(5.18)

In order to better illustrate the potential effect of the group action that we propose here, we plot in Figure 5.4 the numerical values for proportion of weak keys and the upper bound from (5.18) for the proportion of extended weak orbits for the (2p, p, ω) QC-MDPC scheme. The results in Figure 5.4 are a strong motivation for computing the exact value of the proportion of weak keys under the action of the two groups, (F p ) 2 and F p * . Therefore the remaining part of this section as well as Section 5.7, Section 5.8 and Section 5.9 are dedicated to solving the aforementioned problem. In the rest of this section we give some general properties regarding the orbits of polynomials in F 2 [x]/(x p -1).

Proposition 5.6.3.

Let (h 1 , h 2 ) ∈ (F 2 [x]/(x p -1)) 2 . Then we have F p * . (F p ) 2 . (h 1 , h 2 ) = (F p ) 2 . (F p * . (h 1 , h 2 )) . Proof. Let c(x) = p-1 i=0 c i x i be a polynomial in F 2 [x]/(x p -1).
Then by definition we have

σ * α (σ + β (c(x))) = σ * α   x β p-1 i=0 c i x i   = p-1 i=0 c i x (i+β)α = x αβ p-1 i=0 c i x iα = σ + αβ (σ * α (c(x))).

WEAK ORBITS AND EXTENDED WEAK ORBITS

Use the later result in the case of (h 1 , h 2 ) ∈ (F 2 [x]/(x p -1)) 2 . By definition of the two group actions we have

σ * (α,α) (σ + (β 1 ,β 2 ) (h 1 , h 2 )) = (σ * α (σ β 1 (h 1 )), σ * α (σ β 2 (h 2 ))) = σ + αβ 1 (σ * α (h 1 )), σ + αβ 2 (σ α (h 2 )) = σ + (αβ 1 ,αβ 2 ) (σ * (α,α) (h 1 , h 2 ))
Since the later Proposition states that we obtain the same orbit regardless of the order in which we decided to act on the set of polynomials, we will begin by considering the action of the additive group. Hence in the next section we estimate the proportion of weak keys under the action of (F p ) 2 .

Weak orbits and Extended weak orbits

Orbits under the action of (F p ) 2

Proposition 5.7.1. Let c(x) be a polynomial in F 2 [x]/(x p -1), then if 0 < c < p -1 the cardinality of the orbit of h under the action of the additive group (F p , +) equals

|F p . c| = p.
Proof. First of all recall that for a prime number p the only subgroups of the additive group (F p , +) are the trivial group ({0}, +) or the whole group. Therefore if for a polynomial c the stabilizer subgroup of (F p , +) with respect to c is reduced to the trivial group we obtain |F p . c| = p. Now notice that the only polynomials c for which the stabilizer subgroup is the hole group are either c(x) = 0 or c(x) = x p-1 + x p-2 • • • + x + 1, which ends our proof.

Straightforward we obtain

Corollary 5.7.2. Let (h 1 , h 2 ) be a pair of polynomials in

F 2 [x]/(x p -1) 2 , then if 0 < h i < p -1 we have (F p ) 2 . (h 1 , h 2 ) = p 2 .
In particular

P ω 1 ,ω 2 / (F p ) 2 = 1/p 2 |P ω 1 ,ω 2 | = 1/p 2 p ω 1 p ω 2 and W ω 1 ,ω 2 / (F p ) 2 P ω 1 ,ω 2 / (F p ) 2 = W ω 1 ,ω 2 |P ω 1 ,ω 2 | and W ω 1 ,ω 2 / (F p ) 2 /F p * P ω 1 ,ω 2 / (F p ) 2 F p * = W ω 1 ,ω 2 |P ω 1 ,ω 2 | .

Proportion of weak orbits

Computing the cardinality of W ω 1 ,ω 2 / (F p ) 2 turns out to be a challenging task. The technique that we use to achieve our goal requires a background in Combinatorics of Words, facts that we details in Section 5.8. We rather give here the results and show how the cyclic shifts increased the proportion of weak keys on practical parameters.

Theorem 5.7.3. Let p, omega and ω 1 , ω 2 be the parameters of a (2p, p, ω) QC-MDPC scheme with ω 2 i /2p = c i log p + O( log p p ), where c 1 and c 2 are constant such that c 1 c 2 . Then we have:

W ω 1 ,ω 2 / (F p ) 2 P ω 1 ,ω 2 / (F p ) 2 ∼ p-1 ω-2 1/p 2 p ω 1 p ω 2 when p → ∞, (5.19)
with asymptotic equivalence

W ω 1 ,ω 2 / (F p ) 2 P ω 1 ,ω 2 / (F p ) 2 ∼ ω 2 2πα(1 -α)p -2 √ c 1 c 2 ω 1 2 2 -ωH(α) where α = 1 1 + c 2 c 1 .
The proof of this Theorem is given in details in Section 5.8. Corollary 5.7.4. Let p ω and ω 1 , ω 2 be the parameters of a (2p, p, ω) QC-MDPC scheme with ω 2 i /2p = c i log p + O( log p p ), where c 1 and c 2 are constant such that c 1 c 2 . Then using the action of (F p ) 2 we have increased the proportion of weak keys by a factor equivalent to ω 2 when p goes to infinity, more exactly we have

W ω 1 ,ω 2 / (F p ) 2 ∼ ω 2 W ω 1 ,ω 2 / (F p ) 2
Numerical values. In Figure 5.5 we plot the numerical values obtained for the proportion of weak keys and weak orbits for a (2p, p, ω) QC-MDPC scheme. We notice that for all the proposed parameters the improvement coming from the group action of (F p ) 2 has overpassed the announced security level. In other words we managed to increase the chances of finding a private key above the security level. The action of the multiplicative group F p * is studied in detail in Section 5.9. Here we synthesize the main results concerning the orbits under the action of F p * . The first difficulty is to determine the cardinality of an orbit F p * . (F p ) 2 . (h 1 , h 2 ) where (h 1 , h 2 ) ∈ P ω 1 ,ω 2 . As for the multiplicative group we begin by studying the action of F p * on a polynomial c ∈ F 2 [x]/(x p -1) and obtain: Proposition (5.9.3). Let c ∈ F 2 [x]/(x p -1) and Γ c be the subgroup of (F p * , •) which stabilizes F p . c. Then the cardinality of the orbit

F p * . (F p . c) is |F p * . (F p . c)| = (p -1) |Γ c | .
(5.20)

Since the polynomials we consider here satisfy a Hamming weight condition we prove that: Proposition (5.9.9). Let α ∈ F p * and c ∈ F 2 [x]/(x p -1) so that 1 < c < p and σ * α (F p . c) = F p . c. Then the order of α in the multiplicative group F p * divides either c or c -1.

From Proposition 5.9.3 and 5.9.9 we deduce that: Corollary (5.9.12). Let (h 1 , h 2 ) ∈ P ω 1 ,ω 2 with h i = ω i and denote by Γ (h 1 ,h 2 ) the subgroup of F p * that stabilizes (F p ) 2 . (h 1 , h 2 ). Then we have

• any α ∈ Γ (h 1 ,h 2 ) is such that ord(α)| gcd(p -1, gcd(l 1 , l 2 ))
, where l i runs through {ω i , ω i -1}, for 1 i 2.

• The cardinality of an orbit equals

F p * . (F p ) 2 . (h 1 , h 2 ) = (p -1) |Γ (h 1 ,h 2 ) | .
(5.21)

• When (h 1 , h 2 ) is a private key of a (2p, p, ω) QC-MDPC code with ω i = O( √ p log p) we have O p log p F p * . (F p ) 2 . (h 1 , h 2 ) p -1.
(5.22)

Proportion of extended weak orbits

Estimating the cardinality of the set W ω 1 ,ω 2 highly depends on the subgroups of the multiplicative group F p * . Hence it seems difficult to obtain a general theorem that characterize the cardinality of the set of extended weak orbits for any prime number p. Nonetheless we obtain some results regarding this problem that we state bellow. Proposition (5.9.13). Let (h 1 , h 2 ) be a private key of a (2p, p, ω) QC-MDPC code. If

(h 1 , h 2 ) ∈ W ω 1 ,ω 2 then σ * -1 (F p ) 2 . (h 1 , h 2 ) is a weak orbit. Moreover if -1 ∈ Γ (h 1 ,h 2 ) then |F p * . ((F p ) 2 . (h 1 , h 2 ))| p-1 2 .

CHAPTER 5. WEAK KEYS IN THE QC-MDPC MCELIECE

In general for a smooth QC-MDPC code we obtain Corollary (5.9.14). Let p and ω be the parameters of a smooth (2p, p, ω) QC-MDPC code. Then we have

p -1 ω/2 W ω 1 ,ω 2 |P ω 1 ,ω 2 | W ω 1 ,ω 2 |P ω 1 ,ω 2 | (p -1) W ω 1 ,ω 2 |P ω 1 ,ω 2 | .(5.51)
Numerical values. We plot in Figure 5.6 the numerical values obtained for the proportion of weak keys, weak orbits and extended weak orbits for a (2p, p, ω) QC-MDPC scheme. We notice that the proportion of extended weak orbits are big enough to raise the question whether the designer of this scheme can assume this risk. Therefore we propose a solution to avoid this type of vulnerabilities, solution that we detail in Section 5.11.4 and that consists in a secure Key Generation algorithm (see Figure 2).

Computing the proportion of weak orbits

Redefining the problem

The problem we want to solve here, is to estimate the cardinality of W ω 1 ,ω 2 = {(h 1 , h 2 ) ∈ P ω 1 ,ω 2 | (h 1 , h 2 ) satisfy (5.14)} , where Equation (5.14) states

∃α 1 , α 2 ∈ F 2 p such that deg(x α 1 h 1 ) + deg(x α 2 h 2 ) < p.
In order to achieve our goal we will introduce the concept of longest run and redefine the problem in an equivalent manner.

Lemma 5.8.1. Let h i = min(F p . h i ) be the minimum polynomial for the lexicographical order of h i ∈ F 2 [x]/(x p -1). Then the set (F p ) 2 . (h 1 , h 2 ) is a weak orbit if and only if (h 1 ) + deg(h 2 ) < p.

Proof. By definition we have that h i = min(F p . h i ) implies that deg(h i ) < x α h i for any 1 α < p. Since a weak orbit has to satisfy equation (5.14) we obtain the wanted result.

Definition 5.8.2. We define the longest run of zeros of a polynomial c in F 2 [x]/(x p -1) by the longest sequence of consecutive zero coefficients of c.

COMPUTING THE PROPORTION OF WEAK ORBITS

Remark 5.8.3. We remark that there is a relation connecting the degree of the minimum polynomial and the longest run of zeros. If k i denotes the longest run of zeros of h i ∈ F 2 [x]/(x p -1) we have that deg(h i ) = p -k i -1.

Example 5.8.4. Let p = 7 and consider the polynomial c(x) = 1 + x + x 5 . Then the orbit equals in this case F p . c = {1+x+x 5 , x+x 2 +x 6 , 1+x 2 +x 3 , x+x 3 +x 4 , x 2 +x 4 +x 5 , x 3 +x 5 +x 6 , 1+x 4 +x 6 }.

The smallest polynomial in lexicographic order is c = 1 + x 2 + x 3 . We also notice that the longest run of zeros equals k = 3 and deg(c) = p -k -1 = 3.

Since we have the relation between the degree and the longest run of zeros for the minimal polynomial in the equivalence class we can redefine a weak orbit in terms of longest run: Proposition 5.8.5. The set (F p ) 2 . (h 1 , h 2 ) defined by a private key (h 1 , h 2 ) ∈ P ω 1 ,ω 2 of a (2p, p, ω) QC-MDPC code is a weak orbit if and only if it satisfies the equation:

k 1 + k 2 p -1.
(5.23)

Proof. Use Lemma 5.8.1 and Remark 5.8.3.

At this point we have reduced our key recovery attack to another problem. To count all pairs (h 1 , h 2 ) with the restriction mentioned above, we have to answer the following question:What is the distribution of the longest run of zeros for the equivalence class of all cyclic shifts of a F p 2 vector with fixed Hamming weight? We will answer this question using the concept of Lyndon words, that we explain in the next paragraph.

Lyndon words

Before we define the notion of Lyndon words we recall some basic definitions from the field of Combinatorics of Words. Definition 5.8.6.

• A finite alphabet A k = {a 0 , a 1 , . . . , a k } is a finite set of symbols that we call letters.

• Any finite sequence of letters belonging to the same alphabet is called a finite word.

• The free monoid generated by the alphabet A k ,usually denoted by A * k , is defined as the monoid whose elements are all the finite sequences of zero or more elements from A k , with string concatenation as the monoid operation. We will denote the empty word by ε. This statement can be written in terms of formal series as There are two types of necklaces, namely periodic and aperiodic (or primitive). Take for example the word w = 0101 which is periodic since w = (01) 2 and w = 001 which is aperiodic.

w∈A k w = 1 1 - k i=0 a i . ( 5
Definition 5.8.9. [START_REF] Lothaire | Algebraic combinatorics on words. Encyclopedia of mathematics and its applications[END_REF]A Lyndon word l is a word satisfying the conditions:

• l is a primitive word (i.e. it cannot be written l = uv, where u and v commute and u, v = ε)

• l is the lexicographically smallest word in its conjugacy class Example 5.8.10.

1. Let F p . 00011 = {00011, 00110, 01100, 11000, 10001} . The Lyndon word here is 00011 since it is the strictly smallest than all the cyclic shifts. and it is primitive.

2. Let F p . 0101 = {0101, 1010, 0101, 1010}. There is no Lyndon word here, since the smallest element in the conjugacy class is 0101 but it is not primitive since 0101 = (01) 2 .

Lyndon words are named after the mathematician Roger Lyndon, who introduced them in 1954 under the name of standard lexicographic sequences. Since a Lyndon word is the only word which is lexicographically smaller than all its the cyclic shifts it implies that a Lyndon word is different from all of its non-trivial shifts, and is therefore primitive. So we have an equivalent way of defining a Lyndon word, that is Remark 5.8.11. We notice that the existence of a Lyndon word is closely related to the size of the conjugacy class. Indeed if the set of all cyclic shifts of p-length word w, has exactly p different elements, in other words the size of the orbit equals p, then we have the existence of a Lyndon word.

When p is prime we obtain the result in Proposition 5.7.1, namely for any word w with Hamming weight different from zero or p the number of elements in the conjugacy class of w equals p.

Lyndon words have many applications in algebra and combinatorics. For instance in number theory we know that the set of monic irreducible polynomials of degree n over a field of characteristic p is in bijection with the set of Lyndon words of length n over an alphabet of size p (see [START_REF] Lothaire | Algebraic combinatorics on words. Encyclopedia of mathematics and its applications[END_REF] for more details). We also have an application of Lyndon words in cryptography [START_REF] Perret | A chosen ciphertext attack on a public key cryptosystem based on lyndon words[END_REF].

Since our goal here is to use the Lyndon words to count weak orbits for the QC-MDPC scheme, we will explain the basic enumeration methods related to Lyndon words and recall the existing results in this area.

Longest run of Lyndon words with fixed weight

The longest run problem was previously studied from a probabilistic point of view by Feller [START_REF] Feller | An introduction to probability theory and its applications[END_REF] and Schilling, Gordon and Waterman [START_REF] Gordon | An extreme value theory for long head runs[END_REF]. The problem studied here is slightly different from our in the sense that the authors give the distribution of the longest run of binary words with fixed weight and not binary words under the cyclic shift action. Their approach is to consider an p trial of Bernoulli variables and search for the probability of the maximum longest run of "heads" or "coins". Results are given for a fixed length p as well as in the asymptotic case. Same results for the latter case were obtained using analytical combinatorics by Flajolet [START_REF] Flajolet | Analytic combinatorics[END_REF] and Wilson and Permantle [START_REF] Pemantle | Twenty combinatorial examples of asymptotics derived from multivariate generating functions[END_REF]. Now if we inspect the case of Lyondon words, many results are known about the number of Lyndon words with different restrictions. We recall the results on the number of Lyndon words over a q-ary alphabet with length p given by Witt [START_REF] Witt | Collected papers/Gesammelte Abhandlungen[END_REF] or the number of Lyndon words over the q-ary alphabet with fixed weight given by Gilbert in [START_REF] Gilbert | Symmetry types of periodic sequences[END_REF]. The first article analyzing the longest run of Lyndon word is by Bassino, Clément and Nicaudin [START_REF] Bassino | The standard factorization of lyndon words: an average point of view[END_REF]. Nonetheless the authors do not take into consideration the longest run of Lyndon words with fixed weight. In a sense our problem is the both an extension of Gilbert's result and Bassino, Clément and Nicaudin's result.

Counting techniques related to Lyndon words. In order to achieve our goal we need to recall the main properties and techniques used for enumerating problems related to Lyndon words. For that we will recall the result in [START_REF] Witt | Collected papers/Gesammelte Abhandlungen[END_REF] with a full proof. For that we begin by a well known theorem on the factorization of words into product of Lyndon words Theorem 5.8.12. [START_REF] Lyndon | Free differential calculus, iv. the quotient groups of the lower central series[END_REF][START_REF] Lothaire | Algebraic combinatorics on words. Encyclopedia of mathematics and its applications[END_REF] Any word w ∈ A * k may be uniquely written as a unique non-increasing product of Lyndon words, i.e., w = l 1 l 2 . . . l n where the l i are Lyndon words such that l n l n-1 • • • l 1 .

Example 5.8.13. Let w = 01101001, then the factorization into product of Lyndon words is w = (011)(01)(001).

There is an efficient algorithm that computes the factorization into Lyndon words due to Duval [START_REF] Pierre | Factorizing words over an ordered alphabet[END_REF], algorithm that has a linear complexity in the length of the word to be factorized.

Corollary 5.8.14. Let L(A k ) denote the set of Lyndon words over the alphabet A k . Then we have

w∈A * k w = l∈L(A k ) 1 1 -l , (5.25)
where the denotes the fact that the elements l ∈ L(A k ) are considered in decreasing lexicographical order.

Example 5.8.15. Let B = {0, 1} be the binary alphabet totally ordered by 0 < 1. We will generate all the binary words in B * of length at most 3, denoted by B 3 , ordered by length B 3 = {ε, 0, 1, 00, 01, 10, 11, 000, 001, 010, 011, 100, 101, 110, 111}. The number of Lyndon words over the binary alphabet is a well known sequence, that can be found in The On-Line Encyclopedia of Integer Sequences 1, 2, 1, 2, 3, 6, 9, 18, 30, 56, 99, 186, 335, . . . ( sequence A001037 in the Oeis)

The last technique needed in enumeration problems are the generating functions. We do not recall the definitions regarding the concepts that are involved in this area, we will only explain how to apply these techniques. For a detailed reference in this field we direct the reader to the book of Flajolet and Sedgewick [START_REF] Flajolet | Analytic combinatorics[END_REF], which turned out to be highly useful.

The procedure that we follow to obtain the generating function is composed of three steps:

• the first step is to formally represent each letter of the alphabet A k by a formal variable z that represents the length of the letter ∀0 i k, a i → z

• since any finite word is a finite sequence of letters we associate to any word w in A * k the formal variable z |w| , representing the length of the word w. Here |w| denotes the length of the word w.

• the univariate generating function where µ is the Möbius function, defined by µ(j) = 0 if j has a squared prime factor, µ(j) = 1 if j is square-free with an even number of prime factors and µ(j) = -1 otherwise.

Φ(z) = w∈A * k z |w| is so that the coefficient of [z n ] Φ(z)

COMPUTING THE PROPORTION OF WEAK ORBITS

Proof. From Equation (5.24) the generating function for the words in

A * k equals Φ(z) = 1 1 - k i=0 z = 1 1 -(k + 1)z .
Based on Equation (5.25) and the cyclotomic identity from [START_REF] Witt | Collected papers/Gesammelte Abhandlungen[END_REF] we have that the same generating function equals

Φ(z) = ∞ i=1 1 1 -z i |L(A k ,i)| So we deduce 1 1 -(k + 1)z = i 1 1 1 -z i |L(A k ,i)|
Taking the logarithm we obtain log(1

-(k + 1)z) = ∞ i 1 |L(A k , i)| log(1 -z i )
We develop the later equation using the Taylor-Young formula n 1

((k + 1)z) n n = ∞ i 1 |L(A k , i)| d 1 z id d .
We extract the coefficient of z n on both sides of the equation and obtain

(k + 1) n n = d|n L(A k , n d ) d .
The last step is to use the Möbius inversion formula [START_REF] Möbius | Über eine besondere art von umkehrung der reihen[END_REF][START_REF] Landau | Handbuch der Lehre von der Verteilung der Primzahlen[END_REF] and obtain the wanted result.

Remark 5.8.17. A particular case of this formula is for the binary alphabet B, case for which we obtain |L(B, n

)| = 1 n d|n µ(d)2 n d .
Remember that in our case we have n = p is a prime number, case for which we have |L(B, p)| = 1 p (2 p -2) (which is a positive integer, fact that can be proved using the binomial theorem).

Based on the later technique we will prove the following theorem: Theorem 5.8.18. Let p, k, ω be integers, such that 1 ω p and k p -ω. The number of binary Lyndon words with length p, longest run less than or equal to k and weight equal to ω is:

L k (B, p, ω) = 1 ω j∈N * , j|gcd(p,ω) µ (j) ω j p j -ω j k

,

(5.27)

where j i k
is known as the standard multinomial coefficient and is defined as the coefficient

of x i in 1 + x + • • • + x k j .

CHAPTER 5. WEAK KEYS IN THE QC-MDPC MCELIECE

Proof. In the first place we define a well known morphism between A * k and B * . The monoids A * k and B * are endowed with the lexicographic orders satisfying 0 < 1 and

a k < • • • < a 0 . The morphism ϕ : A * k → (0 * 1) * ⊂ B * a i → 0 i 1
is an order preserving isomorphism (see [START_REF] Richomme | Lyndon morphisms[END_REF] for details). We deduce that w ∈ A * k is a Lyndon word if and only if ϕ(w) is a Lyndon word. The purpose of the application ϕ is that it allows us to compute the cardinality of the Lyndon words over the binary alphabet by handling only the set of Lyndon words over the alphabet A k , which is much easier to compute.

The next step is to deduce the generating function, which in our case is a bivariate function.

• Each word in A * k can be written as follows:

w = a l 0 a l 2 . . . a l j-1 where ∀m ∈ {0, 1, . . . j -1} a lm ∈ A k and j 0

• Each letter of the alphabet A k is formally represented by the translation rule:

a lm → zx lm+1
where the formal variable z represents the length of the letter and the formal variable x represents the sum 1 + l m .

• We have the following translation rule for any word generated by the specified alphabet:

w → z |w| x ψ(w) where ψ(w) = |w| + |w|-1 m=0 l m • The bivariate generating function Φ(z, x) = w∈A * z |w| x ψ(w)
is so that the coefficient of z ω x p in Φ(z, x) represents the number of words of length ω and ψ-parameter equal to p.

We notice that the we have for any finite word

w ∈ A * k ψ(w) = |ϕ(w)|.
In other words ψ(w) is the equivalent measure for the length of the binary word ϕ(w) and |w| is the equivalent measure for the Hamming weight of the binary word ϕ(w).

If we set L ψ (A k , ω, p) = l ∈ L(A k ) |l| = ω and ψ(l) = p then ϕ (L ψ (A k , ω, p)) = L k (B, p, ω).

COMPUTING THE PROPORTION OF WEAK ORBITS

Hence, it suffices to compute |L ψ (A k , ω, p)| , which can be done using the same technique as in Proposition 5.8.16.

Using Equation (5.25) and (5.24) we obtain the equality

Φ(z, x) = 1 1 -z k+1 i=1 x i = ∞ 1 j i 1 1 -x i z j |Lψ(Ak,j,i)| .
(5.28)

We apply the logarithm in each side of the equality above and develop using the Taylor expansion. In the resulting formula we compare the coefficient of z ω x p in the left hand side and the right hand side and obtain

j|ω ω j |p j L ψ (A k , j, p ω j) = ω p -ω k , (5.29)
where

ω p k = l 1 +2l 2 +...kl k =p l 0 +l 1 +...l k =ω ω! l 0 !l 1 ! . . . l k ! denotes the coefficient of x p in (1+x+x 2 +• • •+x k ) ω .
We rewrite the last equation as

j|ω j|p ω j L ψ (A k , ω j , p j ) = ω p -ω k , ( 5.30)
and finally apply the Möbius Inversion

Since from now on we deal only with binary words we will simplify the notations and drop the name of the alphabet from the L(B, p). So starting from this point we denote the set of Lyndon words over the binary alphabet of length p by L(p).

Corollary 5.8.19. The number of Lyndon words of length p and Hamming weight equal to ω over the binary alphabet (result already found in [START_REF] Gilbert | Symmetry types of periodic sequences[END_REF] by Gilbert and Riordan) is:

|L(p, ω)| = 1 p j| gcd(p,ω) µ(j) p j ω j
.

(5.31)

Proof. We notice that the for fixed p and ω the longest run satisfies k p -ω. Hence L p-ω (p, ω) = L(p, ω) and using the later theorem we have

|L(p, ω)| = 1 ω j∈N * , j| gcd(p,ω) µ (j) ω j p j -ω j p-ω (5.32)
From [START_REF] Belbachir | Connection between ordinary multinomials, Fibonacci numbers, Bell polynomials and discrete uniform distribution[END_REF] we have that

∀k p, ω p k = p + ω -1 p (5.33)
Combining the last two equations we obtain the wanted result.

COMPUTING THE PROPORTION OF WEAK ORBITS

the corresponding Lyndon word in L(p, c ) we obtain

W ω 1 ,ω 2 / (F p ) 2 P ω 1 ,ω 2 / (F p ) 2 = k 1 +k 2 p-1 L k 1 (p, ω 1 )L k 2 (p, ω 2 ) |L(p, ω 1 )L(p, ω 2 )| .
In order to simplify the proofs, in the next part we define a discrete random variable that represents the longest run of Lyndon words. Definition 5.8.22. Let L(p, ω) be the probability space for our model and consider that each Lyndon word in L(p, ω) has the same probability to be chosen, namely p/ p ω . Now, let X p,ω be a discrete random variable that represents the longest run of zeros of Lyndon words with length p and weight ω, which takes values in the set { p-1 ω , . . . , p -ω}. We define the cumulative distribution and mass function for X p,ω , for any

p-1 ω k p-ω F Xp,ω (k) = L k (p, ω) |L(p, ω)| and f Xp,ω (k) = L k (p, ω) |L(p, ω)| .
In other words for our probability model we write the set of binary Lyndon words of length p and weight ω as L(p, ω) = p-ω k= p-1 ω L k (p, ω). Since for the QC-MDPC code we study pairs of Lyndon words with a certain condition (see Equation (5.23)), we define Definition 5.8.23. Let Y p,ω 1 ,ω 2 def = X p,ω 1 + X p,ω 2 be a discrete random variable that represents the sum of two independent random variables X p,ω 1 and X p,ω 2 . Remark 5.8.24. The initial problem, that is estimating the proportion of weak orbits, becomes now a probability problem, namely

W ω 1 ,ω 2 / (F p ) 2 P ω 1 ,ω 2 / (F p ) 2 = P (Y p,ω 1 ,ω 2 p -1) = k 1 +k 2 p-1 f Xp,ω 1 (k 1 )f Xp,ω 2 (k 2 ).
As p is prime, using Corollary 5.8.20 and Definition 5.8.22 we get the exact value:

P (Y p,ω 1 ,ω 2 p -1) = k 1 +k 2 p-1 ω 1 p-ω 1 k 1 -ω 1 p-ω 1 k 1 -1 p-1 ω 1 -1 ω 2 p-ω 2 k 2 -ω 2 p-ω 2 k 2 -1 p-1 ω 2 -1 (5.36)
The first case that seems interesting is when each variable has a longest run greater than or equal to half of the wanted quantity p-1 2 . Proposition 5.8.25. Let ω 1 and ω 2 2, then we have:

P X p,ω 1 p -1 2 P X p,ω 2 p -1 2 = ω 1 ω 2 × p-1 2 ω 1 -1 p-1 2 ω 2 -1 p-1 ω 1 -1 p-1 ω 2 -1 ,
(5.37)

with asymptotic equivalence

ω 1 ω 2 2 -ω ×                  p -c 2 2 if ω 2 2 p = c 2 log p + O( log p p ) and ω 1 = O(1), e -c 1 +c 2 2 if ω 2 i p = c i + O( 1 √ p ), e -c 1 2 p -c 2 2 if ω 2 1 p = c 1 + O( 1 √ p ) and ω 2 2 p = c 2 log p + O( log p p ), p -c 1 +c 2 2 if ω 2 i p = c i log p + O( log p p ).

CHAPTER 5. WEAK KEYS IN THE QC-MDPC MCELIECE

Proof. Apply the formula for the standard multinomial coefficient from [START_REF] Lothaire | Algebraic combinatorics on words. Encyclopedia of mathematics and its applications[END_REF][START_REF] Belbachir | Connection between ordinary multinomials, Fibonacci numbers, Bell polynomials and discrete uniform distribution[END_REF]:

ω p -ω k = p-ω k+1 j=0 (-1) j ω j p -j(k + 1) -1 ω -1 .
For asymptotic expansion as before use the Stirling approximation for factorials.

Remark 5.8.26. Using the results from Proposition 5.8.25 and 5.4.10 when ω 1 = ω 2 = ω 2 we have that

P X p,ω 1 p -1 2 P X p,ω 2 p -1 2 ∼ ω 3 2 |W ω 1 ,ω 2 | |P ω 1 ,ω 2 | .
We step forward and analyze the probability for a weak orbit in the general case.

Remark 5.8.27. We notice that if ω 1 or ω 2 equals 1, or ω 1 = ω 2 = 2 then the probability of a weak orbit equals

P (Y p,ω 1 ,ω 2 p -1) = 1.
But the interesting analysis for the QC-MDPC scheme, is when ω 1 and ω 2 are relatively close and ω = O √ p log p .

P (Y p,ω 1 ,ω 2 p -1) ∼ ω 1 ω 2 p-1 ω-2 p-1 ω 1 -1 p-1 ω 2 -1 when p → ∞,
(5.38)

Moreover for

ω 2 i 2p = c i log p + O( log p p ), we have P (Y p,ω 1 ,ω 2 p -1) ∼ ω 2 2πα(1 -α)p -2 √ c 1 c 2 ω 1 2 2 -ωH(α) where α = 1 1 + c 2 c 1 .
Proof. By definition we have:

P (Y p,ω 1 ,ω 2 p -1) = ω 2 -1 k p-ω 1 f Xp,ω 1 (k) 1 -F Xp,ω 2 (p -k -1 -1) .
In order to estimate the probability P (Y p,ω 1 ,ω 2 p -1) we begin by some properties on the distribution function of the random variable X p,ω . Lemma 5.8.29. Let ω 2 and p prime. Then for k > p-ω 2 we have

f Xp,ω (k) = ω p-k-2 ω-2 p-1 ω-1 , F Xp,ω (k -1) = 1 - ω p-k-1 ω-1 p-1 ω-1 .
(5.39)

COMPUTING THE PROPORTION OF WEAK ORBITS

For k p-ω 2 the bounds are

ω p-k-2 ω-2 -ω 2 p-2k-1 ω-1 -p-2k-3 ω-1 p-1 ω-1 f Xp,ω (k) ω p-k-2 ω-2 p-1 ω-1 , (5.40) ω p-k-1 ω-1 -ω 2 p-2k-1 ω-1 p-1 ω-1 1 -F Xp,ω (k -1) ω p-k-1 ω-1 p-1 ω-1 .
(5.41)

For the upper bound, this gives

P (Y p,ω 1 ,ω 2 p -1) p-ω 1 k=ω 2 -1 ω 1 p-k-2 ω 1 -2 p-1 ω 1 -1 ω 2 k ω 2 -1 p-1 ω 2 -1 = ω 1 ω 2 p-1 ω 1 +ω 2 -2 p-1 ω 1 -1 p-1 ω 2 -1 .
(5.42)

For the lower bound, we separate our sum into three different sums, for k

p-ω 1 2 , p-ω 1 2 < k < p -1 -p-ω 2 2 = p+ω 2 2 -1 and p+ω 2 2 -1 k p
-ω 1 and use relations (5.39), (5.40) and (5.41):

P (Y p,ω 1 ,ω 2 p -1) p-ω 1 k=ω 2 -1 ω 1 p-k-2 ω 1 -2 p-1 ω 1 -1 ω 2 k ω 2 -1 p-1 ω 2 -1 - p-ω 1 2 k=ω 2 -1 ω 1 2 p-2k-1 ω 1 -1 -p-2k-3 ω 1 -1 p-1 ω 1 -1 ω 2 k ω 2 -1 p-1 ω 2 -1 - p-ω 1 k= p+ω 2 2 -1 ω 2 2 p-k-2 ω 1 -2 p-1 ω 1 -1 ω 1 2k-p+1 ω 2 -1 p-1 ω 2 -1
We use the relations p-2k-1

ω 1 -1 -p-2k-3 ω 1 -1 = p-2k-2 ω 1 -2 + p-2k-3 ω 1 -2 2 p-2k-2 ω 1 -2 (as ω 1 2), ω 1 ω 2 p-1 ω 1 -1 p-1 ω 2 -1 = p 2 p ω 1 p ω 2 and a change of variable k → p -k -2 in the last sum to get p ω 1 p ω 2 p 2 P (Y p,ω 1 ,ω 2 p -1) p -1 ω -2 -ω 1 p-ω 1 2 k=ω 2 -1 p -2k -2 ω 1 -2 k ω 2 -1 - 1 2 ω 2 p-ω 2 2 -1 k=ω 1 -2 p -2k -3 ω 2 -1 k ω 1 -2 Now we use the following bound on the product p-2k-2 ω 1 -2 k ω 2 -1 p-k-2 ω-3 and the relation from [Gou72] s k=r a-k b = a-r+1 b+1 -a-s b+1 a-r+1 b+1 to get p ω 1 p ω 2 p 2 P (Y p,ω 1 ,ω 2 p -1) p -1 ω -2 -ω 1 p -ω 2 ω -2 - 1 2 ω 2 p -ω 1 ω -2 p -1 ω -2 - 3 2 ω 1 p -ω 2 ω -2 .

CHAPTER 5. WEAK KEYS IN THE QC-MDPC MCELIECE

if ω 1 = max(ω 1 , ω 2 ). We finally get the bounds

1 - 3ω 1 2 p-ω 2 ω-2 p-1 ω-2 P (Y p,ω 1 ,ω 2 p -1) p 2 ( p-1 ω-2 ) ( p ω 1 )( p ω 2 )
1.

(5.43)

We check that the lower bound tends to 1 when

ω i = O( √ p log p).
The proof of Theorem 5.7.3 comes directly from the later proposition and the fact that

W ω 1 ,ω 2 / (F p ) 2 P ω 1 ,ω 2 / (F p ) 2 = P (Y p,ω 1 ,ω 2 p -1) .
Corollary 5.8.30. For a smooth (2p, p, ω) QC-MDPC scheme we have

P (Y p,ω/2,ω/2 p -1) ∼ ω 2 p-1 ω 2 -1 2 p -1 ω -2
when p → ∞ and ω = O( p log p).

(5.44)

If we recall the results obtained with the first method in Proposition 5.4.10 and Corollary 5.4.12 we conclude that we can attack ω 2 times more private keys

P (Y p,ω 1 ,ω 2 p -1) ∼ ω 2 × |W ω 1 ,ω 2 | |P ω 1 ,ω 2 | .
Our result might be extended to the set of all (2p, p, ω) QC-MDPC codes.

Proposition 5.8.31. Let p be a prime number and ω an even integer such that ω = O( √ p log p). Then we have

ω 2 p-1 ω 2 -1 2 p -1 ω -2 W ω |P ω | ωp 2 p-1 ω-2 2p ω + (-1) ω 2 +1 p ω 2 .
(5.45)

Remark 5.8.32. If we recall the result in Proposition 5.4.10 we obtain a gain factor that is close to ω 2 when we consider the cyclic shifts.

5.9 Extended weak orbits 5.9.1 General Properties Proposition 5.9.1. Let α ∈ F p * \ {1} and c ∈ F 2 [x]/(x p -1). The following equivalence holds:

σ * α (F p . c) = F p . c ⇔ ∃! β ∈ F p , σ * α (σ + β (c)) = σ + β (c).
(5.46)

For α = 1 we have ∀c * ∈ F p . c, σ * α (c * ) = c * .
Proof. For α = 1 the relation comes directly from the definition of the group action. Now assume that α = 1. The (⇐) implication comes from the definition of the orbits.

For the (⇒) implication let c be such that σ * α (F p . c) = F p . c. This implies that there exits j < p so that σ * α (c) = x j c = σ + j (c). Recall from Proposition 5.6.3 that

∀(α, β) ∈ F p * × F p σ * α (σ + β (c)) = σ + αβ (σ * α (c)).
In particular for β = -j(α -1) -1 the later equality also holds, fact that implies

σ * α (σ + -j(α-1) -1 (c)) = σ + α(-j)(α-1) -1 (σ * α (c)) = σ + α(-j)(α-1) -1 (σ + j (c)) = σ + α(-j)(α-1) -1 +j (c) = σ + (-j)(α-1) -1 (α+(-1)(α-1)) (c) = σ + -j(α-1) -1 (
c). Let's now suppose that β is not unique, in other words there are two polynomials in the orbit (5.47)

F p . c such that σ * α (σ + i (c)) = σ + i (c) and σ * α (σ + l (c)) = σ + l (c), with 0 i < l p -1. But this implies σ * α (σ + l (c)) = σ * α σ + l-i (σ + i (c)) = σ + α(l-i) σ * α (σ + i (c)) = σ + α(l-i) σ + i (c) = σ + α(l-i)+i (c). Since σ * α (σ + l (c)) = σ + l (c), we deduce σ + l (c) = σ + α(l-i)+i (c), fact that implies (α -1)(l -i) = 0. So unless α = 1 or l = i

EXTENDED WEAK ORBITS

• for α = 3 and α = 5, R 3

7 = R 5 7 = {c 0 + c 1 (x + x 2 + x 3 + x 4 + x 5 + x 6 ) , c 0 , c 1 ∈ F 2 }. • for α = 6, R 6 7 = {c 0 , c 1 (x + x 6 ) + c 2 (x 2 + x 5 ) + c 3 (x 3 + x 4 ) , c 0 , c 1 , c 2 , c 3 ∈ F 2 }.
Remark 5.9.8. We notice that

• for a fixed i ∈ F p * , for any element j ∈ C α i we have R i p = R j p . Fact that can be expressed in an equivalent manner

for i ⊂ F p * , ∀j ∈ i we have R i p = R j p .
• the classes defined by the element -1 are

C p-1 0 = {0} and C p-1 i = {i, p -i} for all 1 i < p-1 2 .
• when p is odd F p * admits at least three subgroups: the trivial group, the whole group F p * and -1 , which is a group of order two.

Proposition 5.9.9. Let α ∈ F p * and c ∈ F 2 [x]/(x p -1) so that 1 < c < p and σ * α (c) = c. Then the order of α divides either c or c -1.

Proof. From Proposition 5.9.6 we know that any polynomial c ∈ R α p is fully described

c = i∈I α p c i j i ∈C α i (x j i ).
But for a fixed α the cardinality of any equivalence class C α i equals the order of the element |C α i | = ord(α), from which we deduce two possible cases:

• either c 0 = 0 and we obtain that ord(α)| c .

• or c 0 = 1 and then we obtain ord(α)| c -1.

So only group elements that respect the property given above can fix elements in the set of polynomials with weight restrictions. Since the order of any element α ∈ F p * also satisfies the condition ord(α)|(p -1) we deduce that only α ∈ F p * satisfying ord(α)| gcd( c , p -1) or ord(α)| gcd( c -1, p -1) can stabilize c. Thus a natural consequence is that we can use the Burnside lemma for counting the number of orbits in this case.

Theorem 5.9.10. Let p be a prime number and 1 ω p -1. Then we have

|L(p, ω)/F p * | = 1 p -1 1 ω p -1 ω -1 + α∈Fp * \{1} ord(α)| gcd(p-1,ω) p-1 ord(α) ω ord(α) + α∈Fp * \{1} ord(α)| gcd(p-1,ω-1) p-1 ord(α) ω-1 ord(α)
Example 5.9.11.

For p = 7 and ω = 3 we have: L(7, 3) = {0000111, 0001011, 0010011, 0001101, 0010101}

We also have |F * 7 | = 6 and |L(7, 3)| = 5. We count the number of fixed points for all the elements α ∈ F * 7 .

NUMERICAL RESULTS

Corollary 5.9.14. Let p and ω be the parameters of a smooth (2p, p, ω) QC-MDPC code.

-1 ω/2 ω 2 p-1 ω 2 -1 2 p -1 ω -2 W ω |P ω | ωp 3 2 p-1 ω-2 2p ω + (-1) ω 2 +1 p ω 2 .
(5.52)

Numerical Results

The parameters chosen for the experimental part are those suggested by the designers of the scheme [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from moderate density parity-check codes[END_REF]. The security levels correspond to the best known attacks given in [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from moderate density parity-check codes[END_REF] and the probabilities displayed in Figure 5.8 and 5.9 are computed directly from the formulas given in Corollary 5.4.12, Proposition 5.8.25, Corollary 5.8.30 and Proposition 5.4.10. In Figure 5.8 we compute the exact values directly from Corollary 5.4.12 and Proposition 5.8.25 for the first and the second probability. In the last column we give the asymptotic value of the probability of a weak orbit from Corollary 5.8.30. The asymptotic value approaches very precisely the exact value, at least when the exact computation is possible. We used the following procedure to obtain our results:

• We generate the list L := ω 2 p-ω 2 k - ω 2 p-ω 2 k-1 k∈{(p-1)/ ω 2 ,...,p-ω 2 }
.

• We compute the probability from Equation 5.36

P (Y p,ω 1 ,ω 2 p -1) = k 1 +k 2 p-1 k 1 ,k 2 ∈{(p-1)/ ω 2 ,...,p-ω 2 } L[k 1 ]L[k 2 ].
In Figure 5.9, we display the probability values for all ω 1 + ω 2 = ω. In the first column we compute the exact value of the probability from Proposition 5.4.10. Whereas in the next column we compute the asymptotic value of lower bound and the upper bound. In the last column we give only the asymptotic value for the upper bound. One might think that the upper bound is not very tight and that the exact value of the probability is way lower than the value of the upper bound. Even though we share this concern we want to insist on the fact that for achieving sharp bounds we need to deal with complex summations involving the generalized Pascal-DeMoivre triangles.

In order to cope with that, we experimented for several values of the parameters, which show that the probability is quite close to the upper bound. As p goes to infinity and ω = O √ p log p the difference between the two values tends to zero. We compute the probabilities for the first cryptographic parameters p = 4801 and ω = 90. The exact value for the probability equals 2 -71.26 whereas the upper bound equals 2 -71.12 .

Complexity and Experimental Timings

Preliminaries

In general for the Key Recovery Attack the model is quite different in the sense that for any given public key there is an algorithm able to recover the corresponding private key. So the complexity of the KRA is given by the Working Factor (WF) of the best generic attack, which in the case of QC-MDPC is exponential in the parameters of the scheme.

In our case the attack algorithm recovers a private key from the public key only if it's applied on a weak key, weak orbit or extended weak orbit. Therefore in this model the WF of the attack is given by the complexity of the algorithm that solves the Rational Reconstruction Problem.

Extended Euclidean Algorithm complexity. The main brick in our algorithm is the Rational Reconstruction, that can be performed using the Extended Euclidean Algorithm. The original version of the EEA has a time complexity which is quadratic in the length of the input, here O(p 2 ). The first optimizations were proposed by Lehmer [Leh38] in 1938, when the constant factor was improved but the complexity was still quadratic. We remark that here we employ a slightly modified EEA. Indeed, in our version the algorithm stops when the weight of the two outgoing polynomials satisfies the relation in (5.6). This means that the number of iterations might possibly be less than the maximum number of steps in EEA. But this advantage is balanced by the fact that we check the weight of the polynomials. The complexity of checking the weight of the polynomials equals ω + ε bit operations, where ε can vary in the set {1, . . . , p -1 -ω}. This fact comes from the degree condition of the outgoing polynomials in the EEA, that is deg(h 1 ) + deg(h 2 ) < p. Now if (h 1 , h 2 ) is a weak key we might have to check p -1 coefficients and if not, in the best case only ω plus a constant number of coefficients.

Complexity analysis

Worst case.

The worst case scenario is when the attack is performed on a key that is not weak, with respect to our definition. It is also the case when the attacker manages to find a weak key at the last operation, more exactly when all the p -1 actions of the multiplicative group were shot and all the p actions of the additive group were tried. In this case we perform p -1 actions of F p * times p actions of the F p times the EEA. So in the worst case the work factor equals p(p -1) • WF EEA . We stress out the fact that due to the values of the weak keys, weak orbits and extended weak orbits, for the cryptographic purpose in [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from moderate density parity-check codes[END_REF] the worst case scenario work factor complexity is also valid in the case of a random key. Now let's suppose that the private key of a QC-MDPC is a weak key or a weak orbit or an extended weak orbit. We will study the work factor of the attack for each configuration in the best case and in average.

Best case.

The best case for an adversary is when the private key is a weak key and in this case we have a work factor WF EEA . Slightly different but still at a constant close work factor from the best case is when a small number of cyclic shifts is needed to reach a weak key.

Average case.

We consider here two scenarios

• Average case for a weak orbit. Let (h 1 , h 2 ) be the private key if a QC-MDPC scheme such that it is not weak, meanwhile the orbit under the additive group F p is a weak one. In other words k 1 + k 2 p -1, where k i represents as before, the longest run of h i . We first notice that the private key cannot be recovered by applying directly the modified EEA on the public key. So we need to test a several number of cyclic shifts in order to find the weak pair.

CHAPTER 5. WEAK KEYS IN THE QC-MDPC MCELIECE

In order to estimate the average number of shifts needed to retrieve a weak pair we set k 1 + k 2 = p -1 + ε, where 0 ε p + 1 -ω. Then we have Proposition 5.11.1.

Let (h 1 , h 2 ) ∈ F 2 [x]/(x p -1) with h 1 + h 2 = ω and k 1 + k 2 = p -1 + ε, where 0 ε p + 1 -ω. Let f ∈ F 2 [x]/(x p -1) be such that f = h 2 h -1 1 (mod x p -1).
Then there are 2ε+1 shifts of f such that the outgoing polynomials of EEA(x p -1, x i f ) are weak pairs.

Proof. The first weak key given (h 1 , h 2 ) with k 1 + k 2 = p -1 + ε is the minimum pair (h 1 , h 2 ). Then for all 1 i ε we have that (x i h 1 , h 2 ) and (h 1 , x i h 2 ) are also weak pairs. Therefore we have 2ε + 1 different shifts which give weak pairs.

Thus in order to estimate the average number of shifts we put a simple probability problem.

Proposition 5.11.2. Consider a set of p balls (representing the total number of shifts), composed of two type of balls, 2ε + 1 white balls and the rest are black balls.

Then the probability of picking the first white ball at the i th step equals for all i ∈ {1, . . . , p -2ε -1}.

p-i 2ε p 2ε+1

So in average the first white ball is picked at the p + 1 2(ε + 1) th step.

Proof. The problem is a classic urn process without replacement. In fact is the analogue of the geometric distribution, law that describes the first arrival probability in a urn process with replacement. To simplify the computations we denote the number of white balls by d = 2ε + 1. So the probability of choosing the first white ball at the i th step is the ratio between the total number of white balls at the i th step in the urn, which equals d and the number of balls in the urn, which equals p -i + 1, multiplied by the probability of choosing only black balls in the previous (i -1) steps, which equals

p-d p × • • • × p-d-i+2 p-i+2 .
From this we deduce that the probability of the choosing the first white ball at the i th step equals

∀1 i p -d + 1, p-i d-1 p d .
We also need to verify that our distribution is well defined

p-d-1 i=1 p-i d-1 p d = 1 p d p-d j=0 j + d -1 d -1 = p d -d-1 d p d = 1.

COMPLEXITY AND EXPERIMENTAL TIMINGS

We used here the following formula from [START_REF] Gould | Combinatorial identities: a standardized set of tables listing 500 binomial coefficient summations[END_REF] p i=0 i+k r = p+k+1 r+1 -k r+1 . To compute the average we have

p-d-1 i=1 i p-i d-1 p d = p-d j=0 (n -d + 1 -j) j+d-1 d-1 p d = n -d + 1 p d p-d j=0 j + d -1 d -1 - 1 p d p-d j=0 j j + d -1 d -1 = n -d + 1 - 1 p d p-d j=0 d j + d -1 d = n -d + 1 -d p d+1 p d = n -d + 1 -d n -d d + 1 = n + 1 d + 1 .
When ε = 0 in other words only one shift works, we obtain the discrete uniform distribution and obtain an average number of shifts equal to p + 1 2 (the working factor equals p+1 2 WF EEA ). Whereas for ε = p + 1 2c -1, where c a positive constant, the average number of shifts is constant and equals c ( the working factor equals cWF EEA ).

• The average case for an extended weak orbit. The last part of the analysis is estimating the average number of extension (actions of F p * ) needed to retrieve a weak pair. Since the relation between the action of this group and the longest run seems more complicated we just give a lower bound for the searched quantity. We suppose that there is at least one shift on f ≡ h 1 h 2 mod (x p -1) such that two shifted h 1 and h 2 can be obtained using the EEA. By Proposition 5.9.13 that σ * -1 (f ) can also be attacked with the same algorithm, so for each weak key there are at least two good extensions for our attack, which makes an average quantity upper bounded by p 3 .

Numerical results

The first set of parameters that we used were not in the scale of the cryptographic values. More precisely we considered p = 101 and ω 1 = ω 2 = 9. The purpose was to confront the theoretical values for the probabilities of a weak keys and the experimental results. In this sense using MAGMA's random generator we computed 10 5 pair of polynomials for the QC-MDPC scheme and executed the attack on the shifted keys. In theory the Input: Two odd integers ω 1 and ω 2 s.t. ω 1 + ω 2 = ω Output: A secure private pair (h 1 (x), h 2 (x)) for the QC-MDPC scheme 1 S ← {0, . . . , p -1} ; 2 L 1 ← RandomSubset(S, ω 1 ), L 2 ← RandomSubset(S, ω 2 );

1 i ω j -1 (L α j [i + 1] -L α j [i]), p -1 -L α j [ω j ] + L α j [1]
), for 1 j 2; x i Algorithm 2: Secure Key Generation of a QC-MDPC McEliece scheme that takes ω 2 i operations plus ω additions which corresponds to the computation of the longest run of the two lists L α 1 and L α 2 . The result has to be multiplied by the number of failures, N f which ends the proof.

7 if k L α 1 + k L α 2 p -

Perspectives

Our technique might also be useful for other public key encryption schemes like for example the NTRU scheme [START_REF] Hoffstein | NTRU: A ring-based public key cryptosystem[END_REF]. Here the description is similar to the QC-MDPC case. The Key Generation algorithm takes as input the parameters (p, q, l) and outputs the private key sk = (h 1 (x), h 2 (x)) and the public key pk = f (x) where

• h 1 (x), h 2 (x) ∈ Z q [x]/(x p -1) are such that 1. h 1 and h 2 are sparse polynomials with respect to the norm L ∞ . In general the polynomials have coefficients in {-1, 0, +1}.

2. h 1 and h 2 are moderately sparse polynomials with respect to the Hamming distance. For example when p = 251 the weight equals h 1 = h 2 = 72.

3. h 1 admits an inverse modulo p and modulo q.

• f (x) ∈ Z q [x]/(x p -1) is such that h 1 (x)f (x) = ph 2 (x) (mod q).

(5.53) So if we apply the weak keys technique we must take into consideration Lyndon words of length p over the alphabet {-1, 0, 1}. Secondly it is rather unclear how the restriction on the Hamming weight is considered. Nevertheless the problem seems quite similar to the QC-MDPC and the probabilities might be computed in this case. But it appears at least for the (251, 128, 3)-NTRU that the probabilities are significantly smaller than in the first two security level of the DC-MDPC. Our statement is based on a simple argument, since the Hamming weight of the two polynomials equals 72, a rough estimation gives a probability close to 3 -2×72 = 3 -144 .

Conclusion

Motivated by the up-growing weight that code-based cryptography has lately developed in the public key cryptography, we proposed to study during the thesis the security of the latest McEliece variants.

We started with the QC-MDPC McEliece, which is among the favorite candidates for quantum resistant encryption solutions. We proposed a key recovery attack based on an algorithm that solves the Rational Reconstruction Problem. The main advantage of our approach is the complexity of the attack, which is quadratic in the code length. Since only particular configurations of private keys can be retrieved with our algorithm we analyzed the proportion of such configurations, that we call weak keys. We continued our analysis and investigated different techniques for extending the proportion of weak keys. We developed two methods based on the equivalence of quasi-cyclic codes that allowed us to multiply the proportion of weak keys by a factor equal to the length of the code times the square of the Hamming weight of the private key. We finished this part by proposing an efficient and secure Key Generation algorithm for the QC-MDPC McEliece scheme.

Secondly we analyzed the security of the McEliece variant based on Polar codes. The idea of using Polar codes in cryptography came in a natural manner since Polar codes posses interesting properties like: they are capacity achieving codes for the class of Binary Discrete Memoryless channels, they admit efficient encoding and decoding procedures etc. Even though Polar codes are closely related to Reed-Muller codes the techniques used for the cryptanalysis of Reed-Muller codes do not work on Polar codes. Therefore we started to study in detail the structure of Polar codes. If at the beginning our purpose was purely cryptographic we finally answered to several non-trivial coding theory questions as well as to our initial problem. The first contribution was to propose an algebraic framework for both Polar and Reed-Muller codes. It is based on a partial order that we defined, order that allowed us to determine many of the hidden structural properties of Polar codes. Using some of the these properties, we proposed a successful cryptanalysis against the McEliece scheme based on Polar codes.

Perspectives in code-based cryptography

Since most of the McEliece variants were successfully cryptanalyzed, several questions regarding this scheme were raised, among which a general security question of indistinguishability of the public code from a random code. And even though some variants remain secured against existing attacks there is no theoretical guaranty of their security. By that we mean there is no security proof for the aforementioned variants. For instance there is no formal proof of the indistinguishability of the public code from a random one. Following McEliece's idea a possible solution for this problem would be to find a new masking technique for which there is a formal proof of the indistinguishability of the public code from a random one. In [START_REF] Wang | Quantum resistant random linear code based public key encryption scheme RLCE[END_REF] the author propose a masking technique for which he proves that the public code is equivalent to a random code and thus reintroduce in the context all the structural codes that have been broken. He mention that the attack we propose against Polar codes do not work any more in this new context. Another solution was already proposed by Alekhnovich who proposed an innovative approach based on the difficulty of decoding purely random codes [START_REF] Alekhnovich | More on average case vs approximation complexity[END_REF]. In order to prove Equation (A.5) we choose an element π ∈ Perm C ⊥ and obtain

C ⊥ = C ⊥ π (A.1) = (C π ) ⊥ ⇒ C = (C π ) .
Hence we have that π ∈ Perm (C ) . This implies that each of the vectors in the later inequality is mapped by π into itself and we use the same argument as before to prove that C = C 2 . In the next paragraph we give an example of a binary linear code for which the permutation group of the code is different from both the permutation group of Hull and permutation group of the square code. We also have that C ⊥ is a [6, 3, 2] binary linear code defined by the generator matrix    1 0 0 1 1 1 0 1 0 0 1 1 0 0 1 1 0 0    and has the same permutation group as C .

The H(C ) is the [6, 0] binary linear code. Indeed the only codeword that belong to C and C ⊥ is the 0 0 0 0 0 0 vector. Therefore the permutation group is the symmetric group Perm (H(C )) = S 6 .

The square code C 2 is the [6, 5, 1] binary linear code defined by the generator matrix

       
1 0 0 0 0 0 0 1 0 0 0 0 0 0 1 1 0 0 0 0 0 0 1 0 0 0 0 0 0 1

       
. The permutation group Perm (C 2 ) is a group of order 48 generated by {(1, 2); (2, 5); (5, 6); (3, 4)}.

B Decoding Polar codes

Successive cancellation decoder. We consider the simplest case, namely m = 1. Suppose that a pair of bits (u 2 , u 1 ) is encoded into a pair of bits (z 2 , z 1 ) using W 1 , in other words (u 2 , u 1 ) → (z 2 , z 1 ) = (u 1 ⊕ u 2 , u 1 ). Then each element is sent over a channel W to obtain a pair of symbols (y 1 , y 2 ). Now given (y 1 , y 2 ) we want to be able to decode, more exactly to recover (u 1 , u 2 ). The first step consists in computing p 1 def = prob(z 1 = 1 | y 1 ) and p 2 def = prob(z 2 = 1 | y 2 ), given (y 1 , y 2 ) and the channel W. Remark that computing p 1 and 2 can be done by inverting the probability matrix corresponding to the channel W.

Secondly we detail for each synthetic channel the probability of recovering the initial bit 1. The first case (the channel W -):

Given p 1 and p 2 find q 2 = prob(u 2 = 1 | y 1 , y 2 ). Lemma B.0.1.

q 2 = 1 -(1 -2p 1 )(1 -2p 2 ) 2 . (B.1)
Proof. Since u 2 = z 1 ⊕ z 2 we obtain prob(z 1 ⊕ z 2 = 1) = prob(z 1 = 1) + prob(z 1 = 1) -2prob(z 1 = 1, z 2 = 1).

As we know, the variables z 1 and z 2 are independent, therefore we obtain with θ a primitive p th root of unity and s i = 0 runs through a set of coset representatives mod p.

The polynomials g i in the factorization of x p -1 are known as the minimal polynomials of θ s i . The degree of each minimal polynomial g i equals the order ord(2) in the multiplicative group F p * . In general if we search for the factors of x p -1 over F q [x] with q coprime with p the minimal polynomials are given by the q-cyclotomic cosets C q s i , that is g i (x) = j∈C α s i (x -θ j ).

Corollary C.0.3. Let p be a prime number such that 2 is a primitive element of the multiplicative group F p * . Then the factorization of x p -1 over F 2 [x] is

x p -1 = (x -1)(x p-1 + • • • + x + 1).

D Binomial Coefficient -Asymptotics

We begin by recalling the Stirling formula for factorials:

p! = √ 2πp p e p 1 + 1 12p + 1 288p 2 + O( 1 p 3 ) .
and the main asymptotic expansion derived from it: Proposition D.0.1. When k = αp with α constant we have:

p k = 1 2πα(1 -α)p α α (1 -α) 1-α -p 1 - 1 12p 1 α + 1 1 -α -1 + O 1 p 2 .
or using the Entropy function:

log p k = - 1 2 log 2πα(1 -α)p + pH(α) - 1 12p 1 α + 1 1 -α -1 + O 1 p 2 .
Proof. where

f (p, k) = 1 + 1 12p + 1 288p 2 + O( 1 p 3 ) 1 + 1 12(p-k) + 1 288(p-k) 2 + O( 1 (p-k) 3 ) 1 + 1 12k + 1 288k 2 + O( 1 k 3 ) = 1 - 1 12p 1 α + 1 1 -α -1 + O 1 p 2 So p k = 1 2πα(1 -α)p α α (1 -α) 1-α -p 1 - 1 12p 1 α + 1 1 -α -1 + O 1 p 2 .
or using the Entropy function:

log p k = - 1 2 log 2πα(1 -α)p + pH(α) - 1 12p 1 α + 1 1 -α -1 + O 1 p 2 .
Corollary D.0.2. When α = 1 2 we obtain the famous formula for the central coefficient:

p p 2 = 2 πp 2 p 1 - 1 4p + O 1 p 2 .
In the second part we assume that k = o(p) and we develop the formula for the binomial coefficient and replace the factorials using the Stirling formula: Proposition D.0.3. When k = o(p) we have: For the exponential factor we have:

p k =                  p k k! 1 + O( 1 p ) if k = O(1) p k k! e -c 1 + O( 1 √ p ) if k 2 2p = c + O( 1 √ p ) p k k! p -c 1 + O(
p k = p k k! e O( 1 p ) 1 + O 1 p = p k k! 1 + O 1 p .
If k = 2cp + O( √ p) where c > 0 is a constant, we have: The first consequence of this analysis is the quotient of two binomial coefficients:

p k = p k k! e -(c+O( 1 √ p ))(1+O( 1 √ p )) 1 + O 1 √ p = p k k! e -c e O 1 √ p 1 + O 1 √ p = p k k! e -c 1 + O 1 √ p .
Corollary D.0.4.

p k 2p k =            2 -k 1 + O( 1 p ) if k = O(1) 2 -k e -c 2 1 + O( 1 √ p ) if k 2 2p = c + O( 1 √ p ) 2 -k p -c
√ p 2cp 1 + O 1 √ p   ω 2 2p = c + c 1 + O 1 √ p + 2 √ cc 1 1 + O 1 √ p ω 2 2p = c + c 1 + 2 √ c 1 c + O 1 √ p p ω p ω 1 p ω-ω 1 = 1 ω ω 1 e -2 √ cc 1 1 + O 1 √ p .
Second case is when (ω-ω 1 ) 2 With these results at hand we can prove all the asymptotic facts related to the binomial coefficient. We begin with Corollary 5.4.11 that states the following

List of Figures

  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi 1.2 Our contribution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii 1 Introduction

  CHAPTER 1. INTRODUCTION In this particular challenging context we focus on the first candidate, the code-based cryptography and study the security of the latest encryption schemes, namely the QC-MDPC McEliece and the Polar codes based McEliece.

  Figure 2.1 -Channel coding

  a binary linear code we have that d H (c, c * ) = wt(cc * ). So d min (C ) = min c∈C ,c =0 wt(c) which is also equal to d min (C ) = min c∈C ,c =0 |supp(c)|. In order to estimate wt(xy) for any pair of vectors (x, y) in the Hamming space we have to define the intersection of x and y Definition 2.2.8 (Component-wise product

CHAPTER 2 .

 2 CODE-BASED CRYPTOGRAPHY Definition 2.2.13 (Maximum-Likelihood Decoder). Given a [n, k, d] linear code C over F 2 and a channel W = (F 2 , Y, P ) a maximum-likelihood decoder (MLD) for C with respect to W is the function D MLD : Y n → C defined as: for every y ∈ Y n , D(y) def = argmax c∈C W (y | c).

  pk = (G pub , t) and sk = (S, P ).

Figure 2 . 4 -

 24 Figure 2.4 -The Key Generation function of the original McEliece scheme -KeyGen(n, k, t) = (pk, sk)

Figure 2 . 6 -

 26 Figure 2.6 -The Decryption function of the original McEliece scheme -Decrypt(z, sk) = m

  Definition 3.2.10 (Polynomial and Monomial code). Let I ⊆ R m be a finite set of polynomials in m variables. The linear code defined by I is the vector subspace C (I) ⊆ F n 2 generated by {ev(f ) | f ∈ I}. • When I ⊆ R m we say that C (I) is a polynomial code. • When I ⊆ M m we say that C (I) is a monomial code. Proposition 3.2.11. For all I ⊆ M m the dimension of the monomial code C (I) is equal to |I|.

  Definition 3.2.14 (Kronecker product). Let A = (a ij ) 1 i ra 1 j ca and B = (b i,j ) 1 i r b 1 j c b be two matrices defined over the same field. Then the Kronecker product of A and B is the r a r b × c a c b matrix defined by:

Figure 3

 3 Figure 3.2 -The combined circuit for m = 3 and the binary expansion of each row.The index order is used for the row numbers (Arıkan's notation)

  Definition 3.3.5. Let I ⊂ M m be a weakly decreasing set. Then the linear code C (I) is called weakly decreasing monomial code. Proposition 3.3.6. Reed-Muller codes are weakly decreasing monomial codes

  Figure 3.6 -The Hasse diagram for the decreasing monomial order (left) m = 3 and (right) m = 4

  applying Lemma 3.3.20 we get the result. Finally we can state our result, that is Theorem 3.3.24. Polar codes designed for the Binary Erasure Channel are Decreasing Monomial codes. Proof. Let C (I) be a Polar code of length N = 2 m over the BEC family and I ⊂ M m .

  Theorem 3.3.31. Polar codes are Decreasing Monomial codes.

Proof.

  We denote as usual G the generator matrix of C (I) and G * the generator matrix of C (ψ(I)). First we recall that for any permutation π ∈ S n and any row submatrix G I of G m , indexed by a subset of monomials we have rank(G I ) = rank(G π I ) = |I|. (3.10) Then we use Lemma 3.4.3, more exactly the fact that G * ψ(I) = G π I

  Corollary 3.4.14. Let C (I) be a decreasing monomial code with |I| n/2. Then C (I) ⊆ C (I) ⊥ if and only if for any f ∈ I, f ∈ I, or in other words I ⊆ M m \ Ǐ.

  Example 3.4.15. Let m = 3 and

  2. Equation (3.11) and (3.12) follow immediately from Proposition 3.4.11: C (I) ⊥ = C (M m \ Ǐ) and the alternative definitions of r -(C (I) ⊥ ) and of r + (C (I) ⊥ ) which are respectively the largest degree r such that all monomials of degree r are monomials in M m \ Ǐ and the largest degree of a monomial that belongs to M m \ Ǐ.

  2) defined by the set of all lower triangular matrices A ∈ F m×m 2 with a i,i = 1. Then (LTA(m, 2), •) is defined by: (A, b), (A , b ) ∈ LTA(m, 2) we have (A, b) • (A , b ) = (AA , Ab + b) 3.6.2 Permutation group of Weakly Decreasing Monomial codes. Proposition 3.6.4. The permutation group of a weakly decreasing monomial code contains the group of translations T(m, 2).

  Figure 3.9 -Young diagrams inside a 2 × 3 grid

  Proposition 3.7.8. For any integers m, d with 1 d m, there is a bijection between monomials in M m of degree d and Young diagrams inside the d × (m -d) grid.

x 1

 1 Figure 3.9.

  2 x 4 and x 3 x 4 . We denote by λ g the Ferrers diagram corresponding to g and |λ g | the size of a diagram, that is to say the number of * in the diagram. Thanks to Proposition 3.7.4 we can state the following. Proposition 3.7.10. The cardinality of the orbit of g under the action of LTA(m, 2) is |LTA(m, 2) • g| = 2 deg(g)+|λg| Example 3.7.11. Let m = 5 and g = x 1 x 4 then the partition associated to g is λ g = (4 -1, 1 -0) = (3, 1) and it's Young diagram in the 2 × 3 grid is * * * * . Using Proposition 3.7.10 we have that the cardinality of the orbit of x 1 x 4 equals 2 2+4 = 2 6 . We can also use the matrix representation, which is in this case a 10 0 0 a 40 a 42 a 43 We deduce that there are 2 4 different matrices A in LTA(m, 2) g , and 2 2 different vectors b which gives a cardinality equal to 2 6 3.7.3 The minimum weight codewords of a decreasing monomial code.

CHAPTER 3 .

 3 DECREASING MONOMIAL CODES Proof. Recall that m r 2 represents the number of r-dimensional subspaces of F m 2 . The problem of counting the number of r-dimensional subspaces of F m 2 is equivalent to counting the number of r × m matrices of rank r in reduced echelon form. Each matrix gives rise to a Young diagram inside the r × (m -r) grid and each diagram λ can be obtained from 2 |λ| matrices [Knu71a]. So we have the following combinatorial identity: that R(r, m) = C ([1, x m-r . . . x m-1 ]) , which implies that the Young diagrams corresponding to all the maximum degree monomials of a Reed-Muller Code are all the possible diagrams in the r × (m -r) grid. Thus we have |W min (R(r, m))| = 2 r λ⊂r×(m-r) 2 |λ| = 2 r m r 2 Remark 3.7.16. We notice that the number of minimum weight codewords of the Reed-Muller codes represent an upper bound on the number of minimum weight codewords of any Decreasing Monomial code C (I) |W min (C (I))| |W min (R(r + , m))|.

Figure 3 .

 3 Figure 3.10 -Main properties of Monomial, Weakly Decreasing Monomial and Decreasing Monomial codes

3. 8 .

 8 PERSPECTIVES * * * * * * * * * * * * * * * * * * * * * * * *

  We propose in this Chapter to analyze the security of the McEliece variant based on Polar codes. More exactly we focus on the Key Recovery Problem and show that in the case of Polar codes it can be reduced to the Code Equivalence Problem.

Figure 4 . 1 -

 41 Figure 4.1 -Error probability for a [2048, 614] Polar code in function of the error weight

Figure 4 . 2 -

 42 Figure 4.2 -Security level against the MRA of the [2048, 614] Polar code in function of the error weight

Definition 5.4. 4 .

 4 Let g and f be polynomials in K[x] where K is a field such that 0 < deg(f ) < deg(g) = p. For a given integer r satisfying 1 r p, the SRR problem consists in finding ϕ and ψ in K[x] such that (ϕ, ψ) = (0, 0) and deg(ψ) < r and deg(ϕ) p -r and satisfying ϕf = ψ (mod g) (SRR)

  Proposition 5.4.5 ([Pan12, Chapter 2]). At each step i 0 of EEA(f, g) it holds that deg(ϕ i+1 ) = p -deg(ψ i ).

Figure 5 . 3 -

 53 Figure 5.3 -Proportion of weak keys for the (9602, 4801, 90) QC-MDPC for ω 1 = 90 -ω 2 with 21 ω 1 45.

Definition 5.5. 1 .

 1 Let C be a [p, k] binary cyclic code and π ∈ Perm (C ) . Then for all c ∈ C the permutation π acts on the polynomial c(x) as in Definition 2.2.26

Figure 5 . 4 -

 54 Figure 5.4 -Proportion of weak key and upper bound for the proportion of weak keys under the action of (F p ) 2 and F p * for the (2p, p, ω) QC-MDPC when ω 1 = ω 2 = ω 2 .

Figure 5 . 5 -

 55 Figure 5.5 -Proportion of weak key and weak orbits for the smooth (2p, p, ω) QC-MDPC

Figure 5 . 6 -

 56 Figure 5.6 -Proportion of weak key, weak orbits and extended weak orbits for the smooth (2p, p, ω) QC-MDPC

CHAPTER 5 .

 5 WEAK KEYS IN THE QC-MDPC MCELIECE Now let us consider the set of Lyndon words of length less than or equal to 3, in decreasing lexicographical order L(B, 3) = {1, 011, 01, 001, 0} and compute the product in Equation 5.25 l∈L(B, 3) 1 1 -l = (ε + 1 + 11 + 111)(ε + 011)(ε + 01)(ε + 001)(ε + 0 + 00 + 000) = ε + 0 + 00 + 000 + 001 + 01 + 010 + 011 + 111 + 11 + 110 + 1 + 10 + 100 + 101 + . . . Now if we extract from the result of this product only the elements with a length less that or equal to 3 we obtain the set B 3 .

Proposition 5.8. 28 .ω 2 2 p

 282 Let ω 1 ω 2 satisfy the relation lim p→+∞ e -log ω 1 = +∞. Then we have:

Figure 5 . 8 -

 58 Figure 5.8 -Probability of a weak key (orbit) for the QC-MDPC when ω 1 = ω 2 = ω 2 .

Figure 5 . 9 -

 59 Figure5.9 -Probability of a weak key, extended weak pairs and improvements on extended weak pairs for the QC-MDPC for all ω 1 + ω 2 = ω.

3// 5 L α 1 =

 51 RandomSubset(E, ω) randomly chooses a subset of E of cardinality ω;4 for α ∈ F p * do Sort([αi (mod p) : i ∈ L 1 ]) and L α 2 = Sort([αi (mod p) : i ∈ L 2 ]); 6 k L α j = max( max

  Several authors were inspired by his work [DMN12, DV13, KMP14, ABD + 16]. This two approaches open a new perspective for code-based cryptography. Let y ∈ (C 2 ) π , then we have that y = (i,j) α i,j c i c j π with c i and c j codewords in C and α i,j ∈ F 2 . Using the previous property of the component-wise product we have that y = (i,j)α i,j c π i c π j ∈ (C π ) 2 .For the second inclusion we use the dimension argument and obtain the wanted result.Corollary A.0.2. Let C be a binary linear code [n, k, d] and Perm (C ) be its permutation group. Then we have thatPerm (C ) = Perm C ⊥ .(A.5)Perm (C ) ⊆ Perm (H(C )) . (A.6) Perm (C ) ⊆ Perm C 2 . (A.7)Proof. The proof for all the three ⊆ inclusions works exactly the same. Let π ∈ Perm (C ) be an element of the permutation group of C . Then we have by Proposition A.0.1 thatC ⊥ π = (C π ) ⊥ = (C ) ⊥ ⇒ π ∈ Perm C ⊥ (H(C )) π = H (C π )= H (C ) ⇒ π ∈ Perm (H(C )) C 2 π = (C π ) 2 = (C ) 2 ⇒ π ∈ Perm C 2

•

  If C is weakly self-dual then we have that Perm (C ) = Perm (H(C )) since H(C ) = C . • There are code families for which Perm (C ) = Perm (H(C )) = Perm (C 2 ), for example the Reed-Muller codes R(r, m) with r (m -2)/2 . (see 2.2.27) Proposition A.0.4. Any binary linear code C of dimension 1 or 2 has Perm (C ) = Perm (C 2 ) . Proof. For a binary linear code C of dimension 1 we have that C = C 2 . For a binary linear code C of dimension 2 we set C = {0 n , c, b, c + b}, with b = c. So the square code of C is C 2 = {0 n , c, b, c + b, c b, c b + b, c b + c, c b + c + b}. We notice that Now, based on this equation we obtain wt(b + c) = 2wt(c) -wt(c b) wt(c b + b) = wt(c) wt(c b + c) = wt(c) -wt(c b) wt(c b + b + c) = 2wt(c) If wt(c b) ∈ {0, wt(c)} then we deduce as before that either c b = 0 n or c b = c and by A.0.5 we have π ∈ Perm (C ) . So we consider that 0 < wt(c b) < wt(c). Since the maximum weight is given by c + b + c b and it is strictly bigger than all the other vector weight (because 0 < wt(c b) < wt(c)) we have that c b + c + b = (c b + c + b) π = (c b + b) π + c π = (c b + b) π + c b + b But this implies that c = (c b + b) π . So for the moment we have determined how π acts on c, c b + b and c b + b + c. We continue and see what happens for the rest of the vectors and we distinguish three different possibilities 1. If 0 < wt(c b) < wt(c)/2 we obtain wt(c b) < wt(c b + c) < wt(b) < wt(c + b). This implies that each of the vectors in the later inequality is mapped by π into itself. Therefore we have c + b = (c + b) π = c π + b π = b + b + c b = c b. Which is impossible unless c = b = 0 n , from which we obtain that C = C 2 . 2. If wt(c)/2 < wt(c b) < wt(c) we obtain wt(c b + c) < wt(c b) < wt(c + b) < wt(b).

3.

  If wt(c b) = wt(c)/2 we obtain that (c b + b) π = c b + b. We also have that b + c can be mapped by π into itself or into b. We have seen before that if (c + b) π = c + b and b π = b then we have that C 2 = C . So we can consider the remaining case, for which we have b + c = (b + c) π = b π + c π = c + b + b + c b = c + c b Fact that implies b = c b which is impossible by the Hamming weight condition.

Example A.0. 6 .

 6 Let C be a [6, 3, 2] binary linear code defined by the generator matrix Then we have that Perm (C ) = {id; (3, 4); (5, 6); (3, 4)(5, 6)}.

prob(u 2 CFactorization of x p - 1

 21 = 1 | y 1 , y 2 ) = prob(z 1 ⊕ z 2 = 1 | y 1 , y 2 ) = prob(z 1 = 1 | y 1 , y 2 ) + prob(z 2 = 1 | y 1 , y 2 ) -2prob(z 1 = 1, z 2 = 1 | y 1 , y 2 ) = prob(z 1 = 1 | y 1 ) + prob(z 2 = 1 | y 2 ) -2prob(z 1 = 1 | y 1 )prob(z 2 = 1 | y 2 ) = p 1 + p 2 -2p 1 p 2 = 1 -(1 -2p 1 )(1 -2p 2 ) 2 .Notation C.0.1. We denote for any 1 α p -1 the α-cyclotomic coset of the integer i mod p by C α i = {i, iα, . . . , iα ord(α)-1 }, where ord(α) is the order of α in the multiplicative group F * p .Theorem C.0.2 ([MS86, Chapter 7]). Let p>2 be a prime number. The decomposition of x p -1 over F 2 isx p -1 = (x -1) d i=1 g i (x),where g i (x) are irreducible polynomials over F 2 [x], with deg g i = p-1 d for all i ∈ {1, . . . , d} and g i (x) = j∈C 2 s i (x -θ j ),

  -α)p p p α αp p αp ((1 -α)) (1-α)p p (1-α)p f (p, k) = 1 2πα(1 -α)p α α (1 -α) 1-α -p f (p, α)

  k = O(1) we have:

  If k = 2cp log p + O( √ p log p)where c > 0 is a constant, we have:

2 1 +

 1 Figure D.1 -Difference between the real value of p k / 2p k and the asymptotic approximation for k = √ 2p and k = √ 2p log p when p ranges in the set {100, 500, 1000, 5000, 10000}.

2p= c log p + O log p p and ω 2 1 2p = c 1

 11 log p + O log p p . ω = ω -ω 1 + ω 1 = 2cp log p + O( p log p) + 2c 1 p log p + O( p log p) ω 2 2p = (c + c 1 ) log p + O log p

  Figure D.3 -Difference between the real value of p ω / p ω/2

2. 1

 1 Channel coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 (left) BSC(p) and (right) BEC(p) . . . . . . . . . . . . . . . . . . . . . . 2.3 BEC(δ) seen as a degradation of BEC(ε) for 0 ε < δ < 1. . . . . . . . . 2.4 Key Generation of the original McEliece scheme -KeyGen(n, k, t) = (pk, sk) 2.5 The Encryption function of the original McEliece scheme -Encrypt(m, pk) = z 2.6 The Decryption function of the original McEliece scheme -Decrypt(z, sk) = m 2.7 Parameters for McEliece with Goppa codes from [BLP08] . . . . . . . . . 3.1 The channel combining for m = 1 . . . . . . . . . . . . . . . . . . . . . . 3.2 The combined circuit for m = 3 and the binary expansion of each row. The index order is used for the row numbers (Arıkan's notation) . . . . . . . 3.3 The two synthetic channels (left) W -: F 2 → Y × Y , (right) W + : F 2 → Y × Y × F 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4 The combined circuit for m = 3 with the monomial representation and the corresponding synthetic channels. The rows are in decreasing index order. 3.5 The Hasse diagram for the weakly decreasing monomial order when m = 4 3.6 The Hasse diagram for the decreasing monomial order (left) m = 3 and (right) m = 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.7 The Bhattacharyya parameter for all the synthetic channels when m = 4 3.8 The Bhattacharyya parameter for all the synthetic channels when m = 5 3.9 Young diagrams inside a 2 × 3 grid . . . . . . . . . . . . . . . . . . . . . . 3.10 Main properties of Monomial, Weakly Decreasing Monomial and Decreasing Monomial codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.11 The decreasing order over the Young diagrams corresponding to the monomials when m = 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.1 Error probability for a [2048, 614] Polar code in function of the error weight 4.2 Security level against the MRA of the [2048, 614] Polar code in function of the error weight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.1 Suggested parameters for the QC-MDPC scheme in [MTSB13] . . . . . .

  ). Let x and y ∈ F n

	2 , then the component-wise
	product of y and x is
	x y

def = (x 1 y 1 , . . . , x n y n ) ∈ F n 2 . Proposition 2.2.9. Let x and y ∈ F n 2 , then we have wt(x + y) = wt(x) + wt(y) -2wt(x y). (2.2) Notation 2.2.10. Furthermore for a linear code of length n, dimension k and minimum distance d we use the [n, k, d] notation.

  2 we have that D MLD (y) is the codeword c which minimize the Hamming distance d In this case the nearest codeword problem can be reformulated as: Let C be a [n, k, d] linear code over F 2 and H be a (n -k) × n parity-check matrix for C . Then the syndrome of a word y ∈ F n 2 with respect to H is the the vector s ∈ F n-k we can reformulate the nearest codeword decoder in an equivalent manner, more exactly Given: a [n, k, d] linear code over F 2 with a (n -k) × n parity-check matrix H and a received word y ∈ F n

	2.2. CODING THEORY
	Definition 2.2.17. 2	defined as:
		s
		2
	Definition 2.2.16 (Nearest Codeword Problem for BSC).

H (y, c

). In other words c is the closest codeword of C to y.

Definition 2.2.14 (Nearest Codeword Decoder). The nearest codeword decoder for a

[n, k, d] linear code C over F 2 is the function D : F n 2 → C defined as: ∀y ∈ F n 2 , D(y) def = argmin c∈C d H (y, c).

Remark 2.2.15. We notice that the closest codeword to y might not be unique. Indeed, the unicity property can be guaranteed when d H (y, c)

(d -1)/2 .

Proof. In order to prove this fact suppose that C is a [n, k, d] binary linear code and that c is the transmitted codeword and y the received vector with d H (y, c) (d -1)/2. Suppose that D(y) = c = c. By the definition of the decoder we have d H (y, c ) d H (y, c) and hence by the triangular inequality we obtain d d H (c, c ) d H (y, c) + d H (y, c ) d -1. Error correction. We consider here the BSC(p) with crossover probability 0 < p < 1/2. Given a [n, k, d] linear code C over F 2 , let c ∈ C be the transmitted codeword and y ∈ F n 2 the received word. During the communication process the channel modified the codeword which means that some bits of c were flipped. The error vector e ∈ F n 2 is such that c = ye. Given: [n, k, d] linear code C over F 2 and a word y ∈ F n 2 . Find: e ∈ F n 2 of minimum Hamming weight such that ye ∈ C .

There are several methods for the nearest codeword decoder but we remind here only one, namely the syndrome decoding. First we define the syndrome of a vector with respect to a parity-check matrix def = Hy T . Since for every vector c ∈ F n 2 we have that c ∈ C ⇔ Hc T = 0 n-k

  C C by C 2 and call it the square code of C . If C is a [n, k, d] binary linear code then C 2 is a binary linear code of length n, minimum distance d min (C 2 ) d and dimension dim(C 2 ) min n, k+1

			2	.
	Example 2.2.24. Let C be a [6, 2, 2] binary linear code defined by the generator
	matrix	1 1 0 0 1 0 0 0 0 1 1 0	. Then the square code C 2 is a [6, 3, 1] binary linear
	code defined by the generator matrix

Proposition 2.2.30. The

1 is the 2-analog of the Binomial coefficient also known as the Gaussian coefficient. Definition 2.2.29. The set of affine transformations over F m 2 of the form x → Ax + b where A ∈ F m×m 2 is an invertible binary matrix and b ∈ F m 2 forms a group called the general affine group GA(m). permutation group of binary Reed-Muller codes for 1 r m -2 is the general affine group

  The set of all cyclic shifts of a word is called its conjugacy class. The conjugacy class of a word can be represented by a necklace, also known as circular word.

	Example 5.8.7. Let B = {0, 1} denote the binary alphabet. Then the free monoid on B
	is
	B * = ε + 0 + 1 + 00 + 01 + 10 + 11 + 000 + . . . .
	The same set can be generated by means of equation (5.24)
	B * = (0 + 1) 0 + (0 + 1) 1 + (0 + 1) 2 + (0 + 1) 3 + . . .
	= ε + 0 + 1 + 00 + 01 + 10 + 11 + 000 + . . .
	Definition 5.8.8.
	.24)

  represents the number of works of length n over the alphabet A k .

	Proposition 5.8.16. Let L(A k , n) denote the set of Lyndon words of length n over A k .
	Then we have	|L(A k , n)| =	1 n d|n	µ(d)(k + 1)	n d ,	(5.26)

  the equation is not satisfied, which ends the proof Let's recall a well-known result about the sugbroups of a finite cyclic group, theorem that will be applied to F p * ,

	Theorem 5.9.2 ([BC68, Theorem 4.9]). Let G = g be a finite cyclic group, with size m.
	Then any subgroup of G has the form g d , where d is a positive divisor of m. Different
	values of d give subgroups with different sizes, so there is just one subgroup of G having a
	given size.
	With this theorem at hand we directly deduce

Proposition 5.9.3. Let c ∈ F 2 [x]/(x p -1) and Γ c be the subgroup of (F p * , •) which stabilizes F p . c. Then the cardinality of the orbit F p * . (F p . c) is |F p * . (F p . c)| = (p -1) |Γ c | .

  The Least-Significant-Bit version of the Knuth-Schönhage algorithm is due to Stehlé and Zimmermann in 2004[START_REF] Stehlé | A Binary Recursive Gcd Algorithm[END_REF]. Even though the time complexity of this algorithm is not improved the description and the proof of their algorithm is significantly simpler in this case. The average behavior of the EEA was studied in [LV08, CCD + 09].

The first sub-quadratic algorithm was proposed in 1970 by Knuth

[START_REF] Knuth | The analysis of algorithms[END_REF]

with complexity O(p(log p) 5 log log p) and shortly after revisited by Schönhage in 1971

[START_REF] Schönhage | Fast calculation of expansions of continued fractions[END_REF]

who obtained 5.11. COMPLEXITY AND EXPERIMENTAL TIMINGS a better complexity O(p(log p) 2 log log p).

  1 then

	8	go back to Step 2;
	9 end
	10 h 1 (x) ←	x i and h 2 (x) ←
		i∈L 1	i∈L 2

  We study each element apart and give the asymptotic expansion for several cases:

				f (p, k) =	1 + 1 12p + o( 1 p ) 1 + 1 12(p-k) + o( 1 (p-k) )
					= 1 +	1 12p	+ o(	1 p	) 1 -	1 12(p -k)	+ o(	1 p	)
					= 1 -	1 12	k p 2 + o(	1 p	)
					= 1 + o		1 p
	Since
									p p -k	= 1 +	k 2p	+ o	k p
	we obtain:
				p p -k	f (p, k) = 1 +	k 2p	+ o	k p	+ o	1 p	= 1 + O	k p
										log 3 p p )	if k 2 2p = c log p + O( log p p )
	Proof.
	p k	=	p! k!(p -k)!
		=	1 k!	2πp 2π(p -k)	p e	p	e p -k	p-k	1 + 1 12p + 1 288p 2 + O( 1 p 3 ) 1 + 1 12(p-k) + 1 288(p-k) 2 + O( 1 (p-k) 3 )
		=	p k k!	p (p -k)	1 +	p -k k	p-k

e -k f (p, k)

Although it seems that these codes were firstly discovered by Mitani in 1951[START_REF] Mitani | On the transmission of numbers in a sequential computer[END_REF], they became popular only after the article of Muller and Reed.

For the square code we refer here to the square star product, for more details see Definition 2.2.22

In[START_REF] Gaborit | Shorter keys for code based cryptography[END_REF] the author proposes BCH codes with the quasi-cyclic structure. The idea of adding the quasi cyclic structure became one of the main techniques for reducing the key size in the McEliece scheme.

3.8. PERSPECTIVES

Acknowledgments

CHAPTER 5. WEAK KEYS IN THE QC-MDPC MCELIECE

Proposition 5.2.9. [START_REF] Ling | On the algebraic structure of quasi-cyclic codes III: generator theory[END_REF] The mapping Φ defined in Theorem 5.2.5 can be extended to quasi circulant matrices in a natural manner (C p (F 2 )) n 0 -→ (F 2 [x]/(x p -1)) n 0 (M 0 , . . . , M n 0 -1 ) -→ (m 0 (x), . . . , m n 0 -1 (x)) .

Then application Φ induces a one-to-one correspondence between binary quasi-cyclic codes of length n 0 p and linear codes over F 2 [x]/(x p -1) of length n 0 .

Since we deal with polynomials in the algebra F 2 [x]/(x p -1), +, • we recall in Appendix C the main facts about the factorization of x p -1 over F 2 [x].

QC-MDPC codes

Gallager discovered the low density parity check (LDPC) codes during his phd thesis [START_REF] Gallager | Low Density Parity Check Codes[END_REF]. He was motivated by the problem of finding "random-like" codes that could be decoded near the capacity with quasi-optimal performance and feasible complexity. Since LDPC were too complex for the technology at that time, they were forgotten for more than 30 years, and rediscovered by MacKay [START_REF] David | Good error-correcting codes based on very sparse matrices[END_REF] and Sipser and Spielman [START_REF] Sipser | Expander codes[END_REF]. These codes were extended in a natural way to moderate density parity check (MDPC) codes in [START_REF] Ouzan | Moderate-density parity-check codes[END_REF]. Definition 5.2.10. A (n, r, ω)-code is a linear code defined by a r × n parity-check matrix (r < n) where each row has weight ω.

• a LDPC code is a (n, r, ω) with ω = O(1) when n → ∞

• a MDPC code is a (n, r, ω) with ω = O( √ n log n) when n → ∞ Definition 5.2.11. A (n 0 p, p, ω) Quasi-Cyclic MDPC (QC-MDPC) code is a MDPC code defined by a block parity-check matrix

where each block H i is a p × p circulant matrix.

Remark 5.2.12. Using the isomorphism defined in Proposition 5.2.5 we can define a (n 0 p, p, w) QC-MDPC code in an equivalent manner. Indeed, we can consider

where h denotes the Hamming weight of h(x), that is the number of non zero coefficients of h(x).

Bit flipping decoding algorithm. The decoding techniques for MDPC codes are slightly modified version of the original bit flipping algorithm, due to Gallager [START_REF] Gallager | Low Density Parity Check Codes[END_REF]. This technique is known to provide an error-correction capability that increase linearly with the length of the code, but decreases with the weight of the parity-checks. Therefore MDPC codes come with a degradation of the performances for decoding, compared to a LDPC code.

CHAPTER 5. WEAK KEYS IN THE QC-MDPC MCELIECE

Corollary 5.8.20. When p is prime,

Probability of weak orbits

Recall that our initial problem was to determine the proportion

Since we have associated to any polynomial c in F 2 [x]/(x p -1) with fixed hamming weight

CHAPTER 5. WEAK KEYS IN THE QC-MDPC MCELIECE

But in our case we have to consider polynomials with a given Hamming weight, fact that seems to complicate the computations. We demonstrate that orbits of polynomials with a given weight are in fact easier to compute. For that we need to introduce some notations. Notation 5.9.4. We denote the set of polynomial in F 2 [x]/(x p -1) that are fixed by an Example 5.9.5. Let p = 7. Then we have

• for α = 1 we have C 1 i = {i} for any 0 i 6.

• for α = 2 and α = 4 we have ord(2) = ord(4) = 3, hence we obtain

• for α = 3 and α = 5 we have ord(3) = ord(5) = 6 and C 3 0 = {0} and C 3 1 = F * 7 .

• for α = 6 we have ord(6) = 2. We obtain C 6 0 = {0} and C 6 i = {i, 7 -i} for any 1 i 3. Proposition 5.9.6. The set of polynomials in F 2 [x]/(x p -1) that are fixed by an element α ∈ F p * equals

Proof. By the definition we have that

(5.48)

So if we choose one element i ∈ I α p then αi mod p ∈ C α i has to satisfy the later equation. But this means that α(αi) ∈ C α i is also an index that has to satisfy the same equation. In other words all the indices in C α i must satisfy the same equation and thus ∀j ∈ C α i we have c i = c j .

Example 5.9.7. Let p = 7. Then we have

So using Theorem 5.9.10 we obtain

Verification:

Proportion of extended weak orbits

The case of a 2-quasi-cyclic MDPC code is a direct generalization of the results obtained in Proposition 5.9.3 and 5.9.9.

Corollary 5.9.12. Let (h 1 , h 2 ) ∈ P ω 1 ,ω 2 with h i = ω i and denote by

Then we have

, where l i runs through {ω i , ω i -1}, for 1 i 2.

• The cardinality of an orbit equals

(5.49)

(5.50) Proposition 5.9.13.

In general for a smooth QC-MDPC code we obtain CHAPTER 5. WEAK KEYS IN THE QC-MDPC MCELIECE probability of finding a weak orbit equals 0.0032. Meanwhile in practice we obtained a probability equal to 0.00317 and the time needed to test all the orbits was approximately 6000 seconds.

In the second part we used the first parameters for the 2 80 security level which are p = 4801 and ω = 90 and consider the most frequent case max i∈{1,2} ω i = 47. In the first case we applied the EEA on a weak key. In the second part we generated a weak key that we shifted. Therefore we randomly choose an integer i ∈ F p and applied the EEA on the i th shift. We repeated the procedure until a weak key was found. In the worst case we had to compute all the p shifts, whereas in average we only needed a small number of trials until the weak key was discovered. The last column corresponds to the following experience. We generated a weak key, then we applied the action of F * p and the we shifted. In this case the procedure is the same: we randomly pick an element of the group F * p and consider the key under the action of this element. Then we apply the Shifted(EEA) until the proper pair of shift and extension in founded. In the worst case we compute all the possible combinations of shifts and extensions.

On a 4-core Intel(R) Xeon(R) CPU ES-2690 @ 2.90 GHz, using MAGMA V2.19-9 we applied two variants of the EEA : the recursive original variant with complexity O(p 2 ) and the MAGMA implementation using the Knuth-Schönhage version.

EEA

Secure QC-MDPC

In order to prevent the scheme from such weakness we have to check whether we can retrieve an equivalent private pair from the public key. The first solution is to apply our attack on all the elements in the orbit F p * . F p . f (x). But we can do much better using the longest run property from (5.23). Indeed we only need to check if the sum of the longest runs of h 1 (x) and h 2 (x) is bigger than p -1. Based on this remark our algorithm generates two private polynomials for the QC-MDPC code and then checks for each equivalent pair σ * (α,α) (h 1 , h 2 ) for all α ∈ F p * , if the longest run condition is satisfied. If the answer is positive then we restart from the beginning. Figure 2 illustrates the new Key Generation algorithm for the QC-MDPC scheme.

• Proof of Equation (A.1).

First of all we remark that the scalar product is invariant by permutation of the vectors positions, namely

Now we can prove the first identity

, fact that ends the proof.

• Proof of Equation (A.2).

We begin by recalling that for any n length binary linear codes C 1 and C 2 we have

Now we can use the previous result and obtain

• Proof of Equation (A.3).

For the square code we use the fact that the component-wise product is invariant by permutation, (c

Remark A.0.5. If one of the following conditions is satisfied

So let π ∈ Perm (C 2 ) , then we have the following possible cases:

• c π ∈ C , fact that implies that π ∈ Perm (C ) .

• 2. The second case (the channel W + ):

Given p 1 , p 2 and u 2 find q 1 = prob(u 1 = 1 | y 1 , y 2 , u 2 ).

Lemma B.0.2.

Since we search for the probability that u 1 = 1 we have

The second case u 2 = 1 works the same. We have that z 1 = u 1 and z 2 = u 1 + 1, in other words z 1 = z 2 + 1 = u 1 . Therefore the total number of possibilities is: either z 1 = u 1 = 0, z 2 = 1 or z 1 = u 1 = 1, z 2 = 0. Among them there is one good configuration for the probability prob(u 1 = 1 | y 1 , y 2 ), namely when

when u 2 = 1.

.1 -The decoding algorithm over the two synthetic channels (left)

We notice that for W + the value of u 2 is necessary, therefore the two synthetic channels are not independent. Hence the decoder works as follows:

1. Compute the probability q 2 corresponding to the channel W -.

2. If q 2 1/2 then decode u 2 = 1 else decode u 2 = 0.

3. Use the value of u 2 to compute q 1 and decode u 1 .

Example B.0.3.

• Let W = BEC(p). Then W -can be viewed as binary erasure channel. The SC decoder fails to decode u 2 only when at least one of the symbols z 1 or z 2 were erased. This fact arrives with probability 1 -(1 -p) 2 . Thus the decoder recovers u 2 with probability (1 -p) 2 .

W + can also be viewed as a binary erasure channel. In this case the value of u 2 is provided to the decoder and therefore, the decoder fails to recover the value of u 1 when both of the symbols z 1 or z 2 were erased. This arrives with a probability p 2 and thus the decoder recovers u 1 with probability 1 -p 2 .

APPENDIX B. DECODING POLAR CODES

• Let W = BSC(p). W -corresponds to u 2 → (y 1 , y 2 ) and if we denote the errors by (e 1 , e 2 ) we have that (y 1 , y 2 ) = (z 1 ⊕ e 1 , z 2 ⊕ e 2 ). Since z 1 ⊕ z 2 = u 2 we state that W -can be viewed as a BSC with u 2 → u 2 ⊕ e 1 ⊕ e 2 . Therefore we obtain

where the value of u 2 is provided by the decoder of W -. This implies that (y 1 , y 2 ⊕ u 2 ) = (u 1 ⊕ e 1 , y 2 + u 2 ). But since we know the value of u 2 and that y 2 = u 1 ⊕ u 2 ⊕ e 2 we say that the channel W + outputs (u 1 ⊕ e 1 , u 1 ⊕ e 2 ), which is a BSC of diversity 2. Here the probabilities are:

and ω 1 = O(1)

Corollary. 5.4.11 Let p be a prime number and ω an even integer with 1 < ω < p and H(α) = -α log 2 α -(1 -α) log 2 (1 -α) be the binary entropy function for any 0 α 1. Let (ω 1 , ω 2 ) ∈ N 2 be odd integers such that ω 1 + ω 2 = ω and ω = o(p). Then we have

Proof. In the first case The next analysis on our list is Corollary 5.4.12. Here we have to prove that

Proof. This is a particular case of Proposition D.0.6 when c = c 1 . So when ω = 2 √ 2p we have:

and when ω = 2 √ 2p log p we have: