Je Remercie

Jérôme Lacan

Pierre Loidreau D'

Remercie Également

Alain Couvreur

Caroline Fontaine

Philippe Gaborit

Sophie Laplante

Jean-Pierre Tillich

André

Gaëtan Pascale

María, Léo Nicolas Anthony

Magali

Augustin

Yann

Clémence, Pierre, Rémi, Étienne, Rodolfo Christina Xavier

Kevin

Julia Kaushik

Nicolas Daniel

Loïc, Aurélie, Sébastien Simona Thomas

Antonio

Antoine Paul

Vivien Lucien

Andrea Clara

André Yann

Sonia D'abord À Moran

Lolo

Céline, Benjamin Cyril

Cindy Vincent Puis Caro

Nico Et Quentin

Pauline Pascal

Je dois d'abord remercier mon directeur de thèse, Nicolas, de m'avoir proposé de travailler sur cet algorithme si simple à décrire, mais qui a conduit à tant de questionnements et qui m'a permis de découvrir un domaine si riche. Merci pour ta disponibilité, tes explications, tes conseils et ton humour.

Introduction

Most cryptosystems in use today rely on the hardness of number theory problems such as the factorization or the discrete logarithm problems, either in finite fields or in elliptic curves. These problems with the current parameters would not resist an adversary with a sufficiently powerful quantum computer [START_REF] Peter | Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer[END_REF][START_REF] Jozsa | Quantum factoring, discrete logarithms, and the hidden subgroup problem[END_REF]. In fact the security of these problems would scale poorly against such an adversary, see for example [START_REF] Daniel J Bernstein | Postquantum RSA[END_REF].

In anticipation of the development of a powerful quantum computer, alternatives to cryptosystems based on number theory are gaining momentum in research. The National Institute of Standards and Technology (NIST) launched in 2014 a process 1 to standardize the first post-quantum public key encryption (PKE), key encapsulation mechanisms (KEM) and signatures. Initially, 82 proposals were submitted. At the time of writing, we are in the 3rd round and there are 7 finalists in the running, most likely candidates for standardization in the short term, and 8 alternate candidates, who may need another round of evaluation. The breakdown by domain of the remaining proposals is presented in Table 1. We can see that the proposed cryptosystems are based on problems that cover a wide range of mathematical fields. Let us focus on code-based cryptography. The only code-based finalist in the NIST standardization process is based on [START_REF] Mceliece | A Public-Key System Based on Algebraic Coding Theory[END_REF], published in 1978 in which McEliece introduced the idea of using error-correcting codes in cryptography.

Error correcting codes are extensively used in telecommunications. To transmit a message, it is first transformed into a codeword, a process that adds redundancy. If the codeword is transmitted over a noisy channel, it will contain errors when it reaches its recipient. Redundancy implies that we are still able, as long as the number of errors is limited, to recover the original message from this noisy codeword. A good error-correcting code has a certain structure that makes it possible to have an efficient decoder, that is to say, an algorithm that removes many errors in a timely manner. On the other hand, a random code is hard to decode.

McEliece had the idea of hiding a message by taking the corresponding codeword and adding as many errors as it is possible to remove. He used Goppa codes. On the one hand, they have good decoders, which allows decryption. And on the other hand, once scrambled, these codes are hard to distinguish from random codes. So anyone who does not know how the code was scrambled will not have a good decoder. In other words, we have a public-key encryption system: if the scrambled code is made public, anyone can use it to encrypt, but only the person who knows how it was scrambled can decrypt.

It is remarkable that, so far, this system has not been affected by any major attack, classical or quantum, and that it is now being considered for standardization. However, the public key size is in the order of a few megabits. This can be a hindrance for some applications. In order to reduce the key size, one can therefore consider using codes other than Goppa codes. Many attempts have been made in this direction and most of them have resulted in broken cryptosystems.

The Quasi-Cyclic Moderate Density Parity Check (QC-MDPC) codes, proposed in [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from Moderate Density Parity-Check codes[END_REF], appear to be good candidate for replacing Goppa codes in a McEliece cryptosystem. They have small key sizes and have not suffered major attacks. However, unlike Goppa codes, the principle of their decoder does not depend on algebraic properties but on probabilistic properties. Consequently, decoding may fail.

It has been shown in [START_REF] Guo | A Key Recovery Attack on MDPC with CCA Security Using Decoding Errors[END_REF] that the decoder leaks information about the secret key in case of failures. In fact, when the same key is used, an adversary who encrypts a large number of messages and has the ability to determine which ones failed to decrypt, can retrieve the secret key from the set of these failure-triggering messages. Thus, to use keys that are not ephemeral but static, it is necessary to ensure that the decoding failure rate (DFR) is very low. This is also a necessary condition to be able to verify strong security constraints such as indistinguishability under chosen ciphertext attack (IND-CCA).

QC-MDPC decoders and their DFR are the primary focus of the works presented in this document. Our motivation is threefold: to improve decoding algorithms, to better understand their workings and to ensure that they fail with negligible probability. We will focus on [BIKE] a Key Encapsulation Mechanism that uses QC-MDPC codes. It is an alternate candidate to the NIST Post-Quantum Cryptography Standardization Process.

NIST has expressed concerns about its IND-CCA security and DFR analysis in [START_REF] Alagic | Status Report on the Second Round of the NIST Post-Quantum Cryptography Standardization Process[END_REF], but nonetheless considers it one of the most promising candidates. This document is a step toward addressing these concerns.

This document is divided in four parts.

The first part recalls the necessary background on coding theory, public key cryptography, security reductions, code-based cryptography and the specificities of the QC-MDPC based scheme BIKE.

The second part presents new decoding algorithms and reviews some aspects of their implementation. The performance and tuning of these algorithms will be discussed from an essentially empirical point of view.

The third part describes two theoretical probabilistic models for some MDPC decoders, the ultimate goal being to predict their DFR.

The fourth part introduces a new decoding assumption and the statistical framework it implies for extrapolating the DFR from simulation measurements. We then study specific parity check matrices or error patterns that, due to the structural properties of QC-MDPC codes, are great candidates to challenge this new assumption.

Notations

General.

• Vectors and polynomials are denoted in roman type (e.g. h) and matrices in bold (e.g. H).

• The support Supp(v) of a vector v is the set of indices of its nonzero entries.

[Def. 1.15 p. 11]

• The weight |v| of a vector v is always the Hamming weight.

[Def. 1.16 p. 11]

• The vector operator ⋆ is the Schur product, both for vectors and polynomials.

[Def. 1.24 p. 12]

• The notation 𝑥 $ ← 𝑆 means drawing uniformly at random an element from 𝑆 and assign it to 𝑥.

Coding theory.

• The following variables are restricted to the following usage unless stated otherwise:

-𝑛: the length of a code; -𝑘: the dimension of a code; -𝑟 = 𝑛 -𝑘: the dimension of the dual; the block size of a quasi-cyclic parity check matrix;

-𝑑: the column weight of a parity check matrix;

-𝑤: the row weight of a parity check matrix;

-𝑡: the weight of an error pattern.

• For all 𝑗 ∈ {0, … , 𝑛 -1}, 𝜎 𝑗 ∶= |h 𝑗 ⋆ s| .

[Def. 5.1 p. 31]

• For a matrix H, we denote its 𝑖-th row by h ⊺ 𝑖 , and its 𝑗-th column by h 𝑗 .

• We will represent information vectors m, error patterns e and codewords c as row vectors; and the syndrome s as a column vector:

G ∈ 𝔽 𝑘×𝑛

Coding theory

In this chapter we will recall the fundamental notions from coding theory that we will need to construct QC-MDPC codes.

Linear codes

Definition 1.1. Let 𝑘 and 𝑛 be two positive integers with 𝑘 ≤ 𝑛. An 𝔽 𝑞 -linear code 𝒞 of length 𝑛 and dimension 𝑘 is a linear subspace of dimension 𝑘 of the vector space 𝔽 𝑛 𝑞 . Such a code is designated as an [𝑛, 𝑘]-code.

Definition 1.2. The rate of a code 𝒞 of dimension 𝑘 and length 𝑛 is the ratio 𝑅 = 𝑘 𝑛 .

In the context of telecommunications, when using an [𝑛, 𝑘]-linear code to send information, for every 𝑘 symbols of useful information, (𝑛 -𝑘) redundant symbols are also sent. The code rate is therefore the proportion of useful information that is sent through a channel. The reduntant information is used for error-detection and correction.

Definition 1.3. A matrix G ∈ 𝔽 𝑘×𝑛 𝑞 is said to be a generator matrix of the linear code 𝒞 if its rows form a basis of 𝒞.

Definition 1.4. The dual code 𝒞 ⟂ ⊂ 𝔽 𝑛 𝑞 of a code 𝒞 is the orthogonal space

𝒞 ⟂ ∶= {v ∈ 𝔽 𝑛 𝑞 | ∀w ∈ 𝒞, v ⋅ w = 0}
where v ⋅ w is the scalar product ∑ 𝑛-1 𝑖=0 𝑣 𝑖 𝑤 𝑖 . A generator matrix for the dual code 𝒞 ⟂ is called a parity check matrix for 𝒞. We will call equations the rows of parity check matrix.

Definition 1.5. The generator matrix G (resp. the parity check matrix H) of a linear code 𝒞 (of dimension 𝑘 and length 𝑛) is said to be in systematic form if is written as

G = [I 𝑘 𝑃 ] resp. H = [I 𝑛-𝑘 𝑃 ] .
Remark 1.6. A code is fully defined by its dual, therefore if H ∈ 𝔽 Remark 1.20. Let 𝑞, 𝑛 and 𝑘 be integers. For an [𝑛, 𝑘]-code drawn uniformly at random, the expected number of possible solutions of weight below or equal to 𝑤 to a decoding problem is ∑ 𝑤 𝑖=0 ( 𝑛 𝑖 )(𝑞 -1) 𝑖 𝑞 𝑛-𝑘 .

So, on average, there is one solution to a decoding problem with weight 𝑑 𝐺𝑉 (𝑞, 𝑛, 𝑘).

Definition 1.21. The binary entropy function is:

H(𝑋) ∶= H(𝑝) = -𝑝 log 2 𝑝 -(1 -𝑝) log 2 (1 -𝑝) .

Regularity

Definition 1.22. Let 𝑙 and 𝑟 be two positive integers. An (𝑙, 𝑟)-regular code is a code such that, in its Tanner graph, every variable node has degree 𝑙 and every check node has degree 𝑟. The integers 𝑙 and 𝑟 are respectively the left and right degrees.

Equivalently if H is a parity check matrix, the code it defines is (𝑙, 𝑟)-regular if all its column have the same weight 𝑙 and all its rows have the same weight 𝑟.

Channel

In telecommunications, when it comes to error correction, the model of the channel used is often specified. In cryptography, error patterns are often drawn uniformly at random among all fixed weight patterns. If a pattern has a weight 𝑡 and a length 𝑛, it can be seen, as a first approximation, as coming from a binary symmetric channel with a crossover probability 𝑡/𝑛.

Schur product

Definition 1.24. The Schur product of two vectors v, w ∈ 𝔽 𝑛 𝑞 is the componentwise product v ⋆ w ∶= (𝑣 0 ⋅ 𝑤 0 , 𝑣 1 ⋅ 𝑤 1 , … , 𝑣 𝑛-1 ⋅ 𝑤 𝑛-1 ) .

We use the same notation for polynomials Corollary 1.27. Let 𝑘 be a positive integer and let v 1 , … , v 𝑘 be 𝑘 vectors of equal length, then

| 𝑘 ∑ 𝑖=1 v 𝑖 | = 𝑘 ∑ 𝑑=1 (-2) 𝑑-1 ∑ 1≤𝑖 1 <⋯<𝑖 𝑑 ≤𝑘 |v 𝑖 1 ⋆ ⋯ ⋆ v 𝑖 𝑑 | .
Proof. Proposition 1.26 shows the case where 𝑘 = 2. Now, let 𝑘 be any integer greater than 2,

| 𝑘 ∑ 𝑖=1 v 𝑖 | = |( 𝑘-1 ∑ 𝑖=1 v 𝑖 ) + 𝑣 𝑘 | = | 𝑘-1 ∑ 𝑖=1 v 𝑖 | + |𝑣 𝑘 | -2 | 𝑘-1 ∑ 𝑖=1 (v 𝑖 ⋆ v 𝑘 )| .
Then, by induction hypothesis, we have

| 𝑘 ∑ 𝑖=1 v 𝑖 | = 𝑘-1 ∑ 𝑑=1 (-2) 𝑑-1 ∑ 1≤𝑖 1 <⋯<𝑖 𝑑-1 ≤𝑘-1 |v 𝑖 1 ⋆ ⋯ ⋆ v 𝑖 𝑑-1 | + |𝑣 𝑘 | -2 𝑘-1 ∑ 𝑑=1 (-2) 𝑑-1 ∑ 1≤𝑖 1 <⋯<𝑖 𝑑-1 ≤𝑘-1 |v 𝑖 1 ⋆ ⋯ ⋆ v 𝑖 𝑑-1 ⋆ v 𝑘 | .

(QC-)MDPC codes and basic properties

Starting from this point in this document, we will only focus on binary codes (i.e. 𝔽 2 -linear code).

Definition 1.28 (Low Density Parity Check). An [𝑛, 𝑘] LDPC code is a linear code for which there exists a sparse parity check matrix, by which we mean that the Hamming weight of its rows is in O(1).

Definition 1.29 (Moderate Density Parity Check). An [𝑛, 𝑘] MDPC code is a linear code for which there exists a moderately sparse parity check matrix, by which we mean that the Hamming weight of its rows is in O( √ 𝑛).

The two definitions are very much alike. The former codes have great decoding performance but the existence of low weight codewords in their dual is detrimental for its security in a McEliece cryptosystem as was shown in [START_REF] Monico | Using low density parity check codes in the McEliece cryptosystem[END_REF]. The latter codes correct this shortcoming at the cost of lower decoding performance.

The Tanner graph is a useful tool to understand and analyze the LDPC decoders. These decoders usually belong to the category of algorithms called message-passing algorithms or the one called bit-flipping algorithms (an overview of these methods will be done in §6.1.1).

While relying on strong security reductions, MDPC-based cryptosystem would require large key sizes. Following a movement initiated by [NTRU] and which has influenced many code-or lattice-based cryptosystems, a great reduction of the key sizes is obtained using an 𝔽 2 [𝑥]/(𝑥 𝑛 -1) type ring. In coding theory, this means using quasi-cyclic codes that we define now. Definition 1.30. A circulant matrix is a matrix where each row is rotated one element to the right relative to the preceding row.

Let 𝑟 be a positive integer. Any 𝑟 × 𝑟 binary circulant matrix H can be written as

H = ⎛ ⎜ ⎜ ⎜ ⎜ ⎜ ⎜ ⎜ ⎝ ℎ 0 ℎ 𝑟-1 … ℎ 2 ℎ 1 ℎ 1 ℎ 0 ℎ 𝑟-1 ℎ 2 ⋮ ℎ 1 ℎ 0 ⋱ ⋮ ℎ 𝑟-2 ⋱ ⋱ ℎ 𝑟-1 ℎ 𝑟-1 ℎ 𝑟-2 … ℎ 1 ℎ 0 ⎞ ⎟ ⎟ ⎟ ⎟ ⎟ ⎟ ⎟ ⎠ where ℎ 0 , … , ℎ 𝑟-1 ∈ 𝔽 2 .
Proposition 1.31. The application

⎛ ⎜ ⎜ ⎜ ⎜ ⎜ ⎜ ⎜ ⎝ ℎ 0 ℎ 𝑟-1 … ℎ 2 ℎ 1 ℎ 1 ℎ 0 ℎ 𝑟-1 ℎ 2 ⋮ ℎ 1 ℎ 0 ⋱ ⋮ ℎ 𝑟-2 ⋱ ⋱ ℎ 𝑟-1 ℎ 𝑟-1 ℎ 𝑟-2 … ℎ 1 ℎ 0 ⎞ ⎟ ⎟ ⎟ ⎟ ⎟ ⎟ ⎟ ⎠ ↦ ℎ 0 + ℎ 1 𝑥 + ⋯ + ℎ 𝑟-2 𝑥 𝑟-2 + ℎ 𝑟-1 𝑥 𝑟-1
is an isomorphism between the ring of 𝑟 × 𝑟 circulant matrices with coefficients in 𝔽 2 and the quotient ring 𝔽 2 [𝑥]/(𝑥 𝑟 -1).

Definition 1.32. Let 𝑛 0 , 𝑟, and 𝑑 be three positive integers. A QC-MDPC code is a code whose parity check matrix H = (H 0 … H 𝑛 0 -1 ) consists of 𝑛 0 circulant blocks H 0 , … , H 𝑛 0 -1 of size 𝑟 × 𝑟 and row weight 𝑑 such that 𝑛 0 𝑑 = 𝑂( √ 𝑛 0 𝑟). The code is an [𝑛 0 𝑟, (𝑛 0 -1)𝑟] code, it has rate 1 -1/𝑛 0 .

We refer to 𝑟 as the block size.

Remark 1.33. We can equivalently consider the parity check matrix as a tuple of elements of 𝔽 2 [𝑥]/(𝑥 𝑟 -1): (h 0 , … , h 𝑛 0 -1 ).

Similarly to Proposition 1.31, any vector e ∈ 𝔽 𝑟 2 has an associated polynomial in 𝔽 2 [𝑥]/(𝑥 𝑟 -1) with the application

⎛ ⎜ ⎜ ⎜ ⎜ ⎜ ⎜ ⎜ ⎝ 𝑒 0 𝑒 1 ⋮ 𝑒 𝑟-2 𝑒 𝑟-1 ⎞ ⎟ ⎟ ⎟ ⎟ ⎟ ⎟ ⎟ ⎠ ↦ 𝑒 0 + 𝑒 1 𝑥 + ⋯ + 𝑒 𝑟-2 𝑥 𝑟-2 + 𝑒 𝑟-1 𝑥 𝑟-1 .
We write 𝑛 0 circulant matrices of size 𝑟 × 𝑟 as H 0 , … , H 𝑛 0 -1 , an error pattern as e ∈ 𝔽 𝑛 0 𝑟 2 , and the corresponding syndrome s ∈ 𝔽 𝑟 2 :

(H 0 … H 𝑛 0 -1 ) e = s .
If we write h 0 , … , h 𝑛 0 -1 , e, and s their respective associated polynomials in 𝔽 2 [𝑥]/(𝑥 𝑟 -1), then we have h 0 e + ⋯ + h 𝑛 0 -1 e = s .

Although it may offer a little flexibility in a tradeoff between key generation time, decoding time and bandwidth usage, in this document we will not maintain the genericity of the term 𝑛 0 . We will therefore only focus on double circulant matrices, which will give codes with a rate of 1/2 i.e. 𝑛 0 = 2. It is the setting of [BIKE], a key encapsulation mechanism 1 based on QC-MDPC codes.

Chapter 2

Security reduction Definition 2.1. A Public Key Encryption (PKE) scheme is a triple of probabilistic polynomial-time algorithms (KeyGen, Encrypt, Decrypt) of:

• a key generation method that outputs a key pair (pk, sk); KeyGen ∶ {0, 1} 𝜆 → 𝒦 pub × 𝒦 priv ;

• an encryption method that takes a public key and a plaintext 𝑚 as inputs and outputs the ciphertext 𝑐;

Encrypt ∶ 𝒦 pub × ℳ → 𝒞 ;

• a decryption method that takes a private key and a ciphertext 𝑐 as inputs and outputs the plaintext 𝑚 or a failure ⟂;

Decrypt ∶ 𝒦 priv × 𝒞 → ℳ ;

where 𝜆 is the security parameter, 𝒦 pub is the public key space, 𝒦 priv is the private key space, ℳ ∋⟂ is the message space and 𝒞 is the ciphertext space.

Many modern practical usages of cryptography use hybrid cryptosystems (see [SSH; TLS] for examples): they combine a public key cryptosystem with a symmetric key cryptosystem. The former is convenient since it allows establishing a secure channel without the need to pre-share keys and the latter is usually efficient and thus allows a high throughput.

A Key Encapsulation Mechanism provides a way for two parties to exchange a common session key, thus solving the first part, establishing a secure channel. Definition 2.2. A Key Encapsulation Mechanism (KEM) is a triple of probabilistic polynomial-time algorithms (KeyGen, Encaps, Decaps) of:

• a key generation method that outputs a key pair (pk, sk); KeyGen ∶ {0, 1} 𝜆 → 𝒦 pub × 𝒦 priv ;

• an encapsulation method that takes a public key as input and outputs a message (typically a session key) 𝑚 and its encapsulation 𝑐;

Encaps ∶ 𝒦 pub → ℳ × 𝒞 ;

• a decapsulation method that takes a private key and an encapsulated message 𝑐 as inputs and outputs the message 𝑚 or a failure ⟂;

Decaps ∶ 𝒦 priv × 𝒞 → ℳ ;

where 𝜆 is the security parameter, 𝒦 pub is the public key space, 𝒦 priv is the private key space, ℳ ∋⟂ is the message space and 𝒞 is the ciphertext space.

Security games

For a cryptosystem, a reduction of security is a demonstration that if it is broken then some hard problems are broken as well. An important desirable property for a scheme to guarantee the confidentiality of communications is the ciphertext indistinguishability.

Indistinguishability is a property that depends on a "game" where an adversary provides two plaintexts and is provided the two corresponding ciphertexts without knowing which is which. If the adversary is not able to match each ciphertext with the right plaintext better than simply choosing randomly then the cryptosystem has the indistinguishability property. Different flavors of this property exist such as the indistinguishability under chosen plaintext attack (IND-CPA) and indistinguishability under chosen ciphertext attack (IND-CCA).

In Figure 2.1, we give the definitions of the IND-CPA game and the IND-CCA game. In the IND-CPA game, the adversary 𝒜 = (𝒜 1 , 𝒜 2 ) first chooses two messages 𝑚 0 ≠ 𝑚 1 . One of the two messages is picked uniformly at random then encrypted and the adversary has to guess which one it was. In the IND-CCA game, the adversary has access to a decryption oracle that can be used for any ciphertext other than the challenge.

Definition 2.3. The advantage of an adversary 𝒜 to a game 𝐺 in a cryptosystem 𝐾 is a measure of the successfullness of the adversary to the game, it is the difference between its probability of winning the game and the probability of winning the game by taking random choices:

Adv 𝐺 𝐾 (𝒜) ∶= |Pr [𝒜 (𝐺) = 1] - 1 2 | .

Fujisaki-Okamoto transform

Fujisaki and Okamoto proposed, in [START_REF] Fujisaki | Secure Integration of Asymmetric and Symmetric Encryption Schemes[END_REF], a hybrid encryption scheme combining a one-way secure scheme and a symmetric encryption primitive that is IND-CCA secure. This was later restated in a more modern way by Dent in [START_REF] Dent | A Designer's Guide to KEMs[END_REF]. Finally, a "modular" analysis was presented in [START_REF] Hofheinz | A modular analysis of the Fujisaki-Okamoto transformation[END_REF], it provides tighter security reductions and takes into account decryption errors (through a notion called 𝛿-correctness). Security reductions are made using the classic game hopping technique in the Random Oracle Model1 (ROM).

Post-quantum cryptography community has shown interest in the transform as it is used in most lattice-and code-based submissions to the NIST standardization process.

We focus on the FO ̸ ⟂ transformation, a way to transform a PKE into a KEM with implicit rejection. If the original PKE is IND-CPA secure and 𝛿-correct, it is shown in [START_REF] Hofheinz | A modular analysis of the Fujisaki-Okamoto transformation[END_REF] that the resulting KEM is IND-CCA secure under certain conditions fairly easily obtained.

It requires two hash functions K and H. The former should have outputs in ℳ and is used to compute the session key. The latter is necessary for a process called Let PKE 0 = (KeyGen 0 , Encrypt 0 , Decrypt 0 ) be a probabilistic PKE. We write PKE 1 = (KeyGen 1 , Encrypt 1 , Decrypt 1 ) the derandomization of PKE 0 . It is defined as:

• KeyGen 1 (seed) ∶= KeyGen 0 (seed),

• Encrypt 1 (pk, 𝑚) ∶= Encrypt 0 (pk, 𝑚‖ H(𝑚)),

• Decrypt 1 (sk, 𝑐) ∶= { 𝑚‖ℎ ← Decrypt 0 (sk, 𝑐); if 𝑚‖ℎ ≠⟂ and ℎ = H(𝑚) then return 𝑚; otherwise return ⟂; }.

Finally, we obtain a KEM (KeyGen, Encaps, Decaps) with The following results can be deduced from [START_REF] Hofheinz | A modular analysis of the Fujisaki-Okamoto transformation[END_REF] and allows the construction of an IND-CCA secure KEM from an IND-CPA secure, 𝛿-correct PKE.

Theorem 2.5 (Theorem 3.2 & Theorem 3.4 in [START_REF] Hofheinz | A modular analysis of the Fujisaki-Okamoto transformation[END_REF]). If PKE 1 is 𝛿-correct, then for any IND-CCA adversary ℬ against KEM, issuing at most 𝑞 K and respectively 𝑞 H queries to the random oracle K and respectively H there exists an IND-CPA adversary 𝒜 against PKE 1 running in about the same time as ℬ such that

Adv IND-CCA KEM (ℬ) ≤ 𝑞 H ⋅ 𝛿 + 2𝑞 H + 𝑞 K + 1 |ℳ| + 3Adv IND-CPA PKE 1 (𝒜) .
Chapter 3

Code-based cryptography

As of today, there are two general approaches to implementing a PKE or a KEM using error correcting codes: (i) those based on Alekhnovich's cryptosystem [START_REF] Alekhnovich | More on average case vs approximation complexity[END_REF], (ii) those based on McEliece [START_REF] Mceliece | A Public-Key System Based on Algebraic Coding Theory[END_REF] or Niederreiter [START_REF] Niederreiter | Knapsack-type cryptosystems and algebraic coding theory[END_REF] cryptosystems.

The former approach has the advantage of not relying on any trapdoor in the code and its security reduces only to the syndrome decoding problem. An interesting quasi-cyclic variation of this system is [HQC].

In this document, we focus on variants of the latter. For this, the private code must be a code for which there is a trapdoor, namely the ability to decode it efficiently. The problematics (efficiency and security) implied by this requirement is a vast subject and constitutes the main interest of this document, in the specific case of MDPC codes. The primary subject of this document, [BIKE], is a Niederreiter variant.

McEliece cryptosystem framework

The basic framework of a McEliece cryptosystem is based on the possibility of building a public generator matrix for which encoding is easy but decoding is difficult, and a trapdoor that makes decoding up to a distance 𝑡 tractable. This is usually done by (i) generating a code for which a good decoder is known, (ii) scrambling it. The scrambled matrix is the public key, and the trapdoor is anything that allows us to come back to the setting of the original code.

Therefore, this framework requires

• a code generation method that outputs a pair (G, 𝑇 )

CodeGen ∶ {0, 1} 𝜆 → 𝔽 𝑘×𝑛 𝑞 × 𝒯 ;
• a decoder that takes the generator matrix G, the trapdoor 𝑇 and a noisy codeword y = c + e and outputs (with high probability) the codeword c if |e| is smaller than some constant 𝑡

Decode ∶ 𝔽 𝑘×𝑛 𝑞 × 𝒯 × 𝔽 𝑛 𝑞 → 𝔽 𝑛 𝑞 ;
where 𝒯 is the set of trapdoors. From this we can build a PKE by taking 1 :

1 We use the inverse Inv G of the isomorphism 𝔽 𝑘 𝑞 → 𝒞. It can be computed by selecting 𝑘 positions for which the corresponding columns in G are linearly indepedent, then extracting the corresponding coordinates (resp. columns) from c (resp. G). If we call the resulting vector c ′ and the corresponding matrix G ′ , this inverse is simply c ′ G ′-1 .

• KeyGen(seed)

∶= CodeGen(seed), • Encrypt(G, m)

∶= { e $ ← ℰ 𝑛,𝑡 ; return mG + e; },

• Decrypt((G, 𝑇 ), y) ∶= { c ← Decode(G, 𝑇 , y); return Inv G (c); }.

Here, we denote by ℰ 𝑛,𝑡 the set of vectors of 𝔽 𝑛 2 with Hamming weight 𝑡. Remark 3.1. The encryption relies on encoding the actual message m, another possibility is to encode the message as the error vector e and choose m ramdomly. The catch with this method is that the error vector must have a Hamming weight at most 𝑡. As explained in [START_REF] Schalkwijk | An algorithm for source coding[END_REF], in the binary case, there exists a simple bijection 𝜙 between

ℰ 𝑛,𝑡 ∶= {e ∈ 𝔽 𝑛 2 | |e| = 𝑡} and ⎧ { ⎨ { ⎩ 0, … , ( 𝑛 𝑡 ) -1 ⎫ } ⎬ } ⎭ .
Note that ( 𝑛 𝑡 ) ≈ 2 𝑛 H(𝑡/𝑛) . Let x ∈ ℰ 𝑛,𝑡 and let us write {𝑖 1 , … , 𝑖 𝑡 } its support with 𝑖 1 < 𝑖 2 < ⋯ < 𝑖 𝑡 . Define 𝜙(x) ∶= ∑ 𝑡 𝑗=1 ( 𝑖 𝑗 -1 𝑗 ). Its inverse 𝜙 -1 can be computed in polynomial time using an algorithm somewhat similar to a number base conversion algorithm.

Niederreiter cryptosystem framework

The Niederreiter cryptosystem [START_REF] Niederreiter | Knapsack-type cryptosystems and algebraic coding theory[END_REF] is dual to the McEliece one. Its framework requires • a code generation method that outputs a pair (H, 𝑇 )

CodeGen ⟂ ∶ {0, 1} 𝜆 → 𝔽 (𝑛-𝑘)×𝑛 𝑞 × 𝒯 ;
• a decoder that takes the parity check matrix H, the trapdoor 𝑇 and a syndrome y = He ⊺ and outputs the error vector e if |e| is smaller than some constant 𝑡

Decode ⟂ ∶ 𝔽 (𝑛-𝑘)×𝑛 𝑞 × 𝒯 × 𝔽 𝑛-𝑘 𝑞 → 𝔽 𝑛 𝑞 ;
where 𝒯 is the set of trapdoors. From this we can build a PKE by taking:

• KeyGen(seed) ∶= CodeGen ⟂ (seed), • Encrypt(H, m) ∶= { e ← 𝜙 -1 (m); return He ⊺ ; },
• Decrypt((H, 𝑇 ), y) ∶= { e ← Decode ⟂ (H, 𝑇 , y); return 𝜙(e); }.

In terms of security, the two systems are equivalent, this was proven in [START_REF] Yuan | On the equivalence of McEliece's and Niederreiter's public-key cryptosystems[END_REF]. The Niederreiter setting has a clear advantage in terms of communication bandwith as the ciphertexts have length (𝑛 -𝑘) rather than 𝑛. Besides that, the difference between the two frameworks will strongly depend on the code actually used to implement it.

Best known attacks on underlying hard problems

The security of code-based cryptosystem relates to the two following generic problems of decoding linear codes. They were proven to be NP-complete in [START_REF] Berlekamp | On the inherent intractability of certain coding problems[END_REF]. The best known algorithms for these two problems are variants of the Information Set Decoding (ISD) algorithm defined by Prange in 1962 [Pra62]. This algorithm repeatedly attemps to find an error-free information set. The framework for ISD algorithms is summarized in Figure 3.2.

In the (original) Prange's version, the full row reduction is performed and the idea is to repeat the process until the vector Us has a Hamming weight below some target weight 𝑤. When it is the case, we can define e ∶= ((Us) ⊺ 0 𝑘 ) 𝑃 ⊺ , then we have He ⊺ = s and |e| = |Us| ≤ 𝑤.

An improvement of this algorithm due to Lee and Brickell in [START_REF] Pil | An Observation on the Security of McEliece's Public-Key Cryptosystem[END_REF] is to introduce a search step to amortize the cost of the Gaussian elimination. This step consists, for a (small) positive integer 𝑝, in searching for a sum of 𝑝 columns of H ′ that is at a distance of Us below 𝑤 -𝑝. Since then, this basic technique has received a few improvements. The first idea was to only perform a partial Gaussian elimination to transform the searching step into the smaller problem of finding e ″ ∈ 𝔽 𝑘+ℓ 2 of weight 𝑝 such that H ″ e ″ ⊺ = U ″ s and then verify that H ′ e ″ ⊺ is at distance below 𝑤 -𝑝 of U ′ s. We can then complete the error pattern by choosing e ∶= ( (

H ′ e ″ ⊺ + U ′ s) ⊺ e ″ ) 𝑃 ⊺
The step of finding e ″ can be seen as a collision search on which an interesting gain is obtained thanks to the birthday paradox, see [START_REF] Stern | A method for finding codewords of small weight[END_REF][START_REF] Dumer | On minimum distance decoding of linear codes[END_REF]. Then the algorithm was improved by introducing the representation technique in [START_REF] May | Decoding random linear codes in 𝑂(2 0.054𝑛 )[END_REF][START_REF] Becker | Decoding Random Binary Linear Codes in 2 𝑛/20 : How 1 + 1 = 0 Improves Information Set Decoding[END_REF]. Another variant uses nearest neighbours [START_REF] May | On Computing Nearest Neighbors with Applications to Decoding of Binary Linear Codes[END_REF].

Remark 3.4. As presented here, the algorithm is used to do syndrome decoding, but it can be used to search for low weight codewords as well. To do so, simply consider s = 0 and 𝑝 > 0 in any variant that has a search step (i.e. not the original algorithm due to Prange).

Input: Parity check matrix H ∈ 𝔽 (𝑛-𝑘)×𝑛 2 , syndrome s ∈ 𝔽 (𝑛-𝑘) 2
. Output: An error vector e ∈ 𝔽 𝑛 2 such that He ⊺ = s .

• Consider the augmented matrix (H s) .

• Apply a random permutation P ∈ 𝔽 𝑛×𝑛 2 on the columns of H (HP s) .

• Perform a row reduction, multiplying by a matrix U ∈ 𝔽

(𝑛-𝑘)×(𝑛-𝑘) 2 (UHP Us) .
with a full row reduction:

(1 𝑛-𝑘 H ′ Us) .
with a partial row reduction, for ℓ < 𝑛 -𝑘:

(

1 𝑛-𝑘-ℓ H ′ U ′ s 0 ℓ×(𝑛-𝑘-ℓ) H ″ U ″ s
) .

where

U = ( U ′ U ″ ) and U ′ ∈ 𝔽 (𝑛-𝑘-ℓ)×(𝑛-𝑘) 2 , U ″ ∈ 𝔽 ℓ×(𝑛-𝑘) 2
.

Figure 3.2: One iteration of Information Set Decoding principle

Therefore, any of these algorithms can be used to solve either SD(𝑛, 𝑘, 𝑤) or CF(𝑛, 𝑘, 𝑤) for some parameters 𝑛, 𝑘, 𝑤. If we write one of these algorithms as 𝒜 then both problems have the same workfactor 𝒲ℱ 𝒜 (𝑛, 𝑘, 𝑤) .

Let us only consider the Prange algorithm to solve SD(𝑛, 𝑘, 𝑡) with 𝑡 = 𝑜(𝑛) for now. The dominating factor in the work factor for this algorithm is the average number of trials before finding an error-free information set. It is equal to

( 𝑛 𝑡 ) ( 𝑛-𝑘 𝑡 )
. We have

1 𝑡 log 2 ( ( 𝑛 𝑡 ) ( 𝑛-𝑘 𝑡 ) ) ∼ 1 𝑡 log 2 ( 𝑛 𝑡 (𝑛 -𝑘) 𝑡 ) = 𝑐 with 𝑐 = -log 2 (1 - 𝑘 𝑛 )
as 𝑛 goes to infinity, using Stirling's formula. So the work factor is 2 𝑐𝑡(1+𝑜(1)) . For the other variants known at the moment of writing this document, the following result from [START_REF] Canto | Analysis of Information Set Decoding for a Sub-linear Error Weight[END_REF] shows that asymptotically, when 𝑡 = 𝑜(𝑛), the work factor is the same. Proposition 3.5. [START_REF] Canto | Analysis of Information Set Decoding for a Sub-linear Error Weight[END_REF] Let 𝑘 and 𝑡 be two functions of 𝑛 such that lim 𝑛→∞ 𝑘/𝑛 = 𝑅, 0 < 𝑅 < 1, and lim 𝑛→∞ 𝑡/𝑛 = 0. For any algorithm 𝒜 among the variants of [Pra62; Ste88; Dum91; BJMM12; MMT11; MO15], we have

𝒲ℱ 𝒜 (𝑛, 𝑘, 𝑡) = 2 𝑐𝑡(1+𝑜(1)) , 𝑐 = -log 2 (1 -𝑅)
when 𝑛 tends to infinity.

The quasi-cyclic structure of a code means that any blockwise circular shift of a codeword is also a codeword and that, given an error pattern, any circular shift of its syndrome corresponds to a blockwise circular shift of the same error pattern. It has been shown in [START_REF] Sendrier | Decoding One Out of Many[END_REF] that one can exploit this structure and expect a polynomial gain in the work factor of an ISD algorithm. In practice the work factor for finding low weight codeword in the dual is divided by (𝑛 -𝑘) and the work factor for decoding is divided by √ 𝑛 -𝑘. So, the work factor to solve the quasi-cyclic SD(𝑛, 𝑘, 𝑡) problem is

𝒲ℱ QCSD (𝑛, 𝑘, 𝑡) ∶= 𝒲ℱ 𝒜 (𝑛, 𝑘, 𝑡) √ 𝑛 -𝑘 = 2 𝑐[1/2+𝑡(1+𝑜(1))]-log 2 (𝑛)/2
and to solve the quasi-cyclic CF(𝑛, 𝑘, 𝑤) problem is

𝒲ℱ QCCF (𝑛, 𝑘, 𝑤) ∶= 𝒲ℱ 𝒜 (𝑛, 𝑘, 𝑤) 𝑛 -𝑘 = 2 𝑐[1+𝑤(1+𝑜(1))]-log 2 (𝑛) .
Chapter 4 BIKE [BIKE] Let us fix the following parameters:

• 𝑟: the block size of a parity check matrix,

• 𝑛 = 2𝑟: the length of a code,

• 𝑑: the column weight of a parity check matrix,

• 𝑤 = 2𝑑: the row weight of a parity check matrix,

• 𝑡: the weight of an error pattern,

• ℓ: the message space size,

• 𝜆: the security parameter, in bits.

We define the following sets:

• ℛ 𝑟 ≃ 𝔽 2 [𝑥]/(𝑥 𝑟 -1): the set of 𝑟 × 𝑟 circulant matrices,

• ℛ 𝑟,𝑑 : the set of 𝑟 × 𝑟 circulant matrices of row weight 𝑑,

• ℰ 𝑛,𝑡 : the set of vectors of 𝔽 𝑛 2 with Hamming weight 𝑡. • KeyGen(seed) ∶= { (h 0 , h 1 )

$ ← ℛ 𝑟,𝑑 ; h ← h 1 h -1 0 ; 𝜎 $ ← {0, 1} ℓ ; return (h 0 , h 1 , 𝜎), h; }, • Encaps(h) ∶= { m $ ← {0, 1} ℓ ; (e 0 , e 1 ) ← H(𝑚); c ← (e 0 + e 1 h, m ⊕ L(e 0 , e 1 )); 𝐾 ← K(m, c); return 𝐾, c; }, • Decaps((h 0 , h 1 , 𝜎), c) ∶= { e ′ ← Decode ⟂ MDPC (c 0 h 0 , h 0 , h 1 ); m ′ ← c 1 ⊕ L(e ′ ); if e ′ ≠ H(m ′ ) then return K(𝜎, c); otherwise return K(m ′ , c); }.
Where H, K and L are three hash functions. H has outputs in ℰ 𝑛,𝑡 , K and L in {0, 1} ℓ .

BIKE is defined 2 in Table 4.2. This entire document is devoted to the decoder, so we will not detail its operation in this preliminary chapter. We will however explain the conversion used and what it implies for security, in particular the necessary conditions imposed on the decoder. We will also detail why the block size should be chosen carefully.

Security

Using notations from §3.2 we can build PKE 0 = (KeyGen 0 , Encrypt 0 , Decrypt 0 ), a Niederreiter cryptosystem using QC-MDPC codes by taking

• CodeGen ⟂ (seed) ∶= { H 0 $ ← ℛ 𝑟,𝑑 ; H 1 $ ← ℛ 𝑟,𝑑 ; H ← (1 𝑟 H -1 0 H 1 ); return (H, H 0 ); }, • Decode ⟂ (H, H 0 , s) ∶= { s ′ ← H 0 s; return Decode ⟂ MDPC ((H 0 H 0 H), s ′ ); }.
with 𝒦 pub = ℛ 2 𝑟 , 𝒦 priv = ℛ 𝑟,𝑑 , ℳ = ℰ 𝑛,𝑡 , 𝒞 = 𝔽 𝑟 2 . However, applying Niederreiter construction directly in this PKE is not secure. Indeed, the problem is to leave the complete control of the error pattern to the person who encrypts. In the hand of a malicious adversary, this could be used in a reaction attack such as [START_REF] Guo | A Key Recovery Attack on MDPC with CCA Security Using Decoding Errors[END_REF] where particular error patterns allow them to gather information about the private key.

Even outside practical concerns, this issue is already taken into account in the analysis of [START_REF] Hofheinz | A modular analysis of the Fujisaki-Okamoto transformation[END_REF]. Indeed, if we want to use the Theorem 2.5 to prove that the scheme is IND-CCA secure, we need to make sure that the PKE is 𝛿-correct with 𝛿 really small. Definition 2.4 of 𝛿-correctness concerns the maximum probability of failure on all possible 1 https://csrc.nist.gov/projects/post-quantum-cryptography 2 The notation $ ← means drawing uniformly at random from the right side and assign it to the left side using seed.

messages, and it is difficult to prove that no message will be decoded with less success than the average. It is in fact not true, the question of particular problematic error patterns will be discussed in Chapter 16 on the phenomenon known as the "error floor".

To circumvent this problem, BIKE adds randomization to the error pattern. Instead of choosing a random message m and using it directly as an error pattern to compute the syndrome, the message m is first hashed and the hash H(m) is used as the error pattern. The soundness of such a process is guaranteed by a commitment: m ⊕ L(H(m)).

Using the more compact polynomial representation, we obtain the specification in Table 4.2.

To apply Theorem 2.5, we have to study the IND-CPA security of the scheme first. It relies on the quasi-cyclic versions of the problems SD(𝑛, 𝑘, 𝑡) and CF(𝑛, 𝑘, 𝑤). We define the function:

• QCSD 𝑟,𝑡 ((e 0 , e 1 ) , h, s) for e 0 , e 1 , h, s ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1).

It returns 1 if |e 0 | + |e 1 | = 𝑡 and e 0 + e 1 h = s, and 0 otherwise.

For any probabilistic polynomial time algorithm 𝒜 taking for inputs h ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1) and s ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1), and producing as output an element of (𝔽 2 [𝑥]/(𝑥 𝑟 -1))

2 , we define its advantage concerning the one-wayness of the cipher as:

Adv OW QCSD 𝑟,𝑡 (𝒜) = Pr [ QCSD 𝑟,𝑡 (𝒜(h, e 0 + e 1 h), h, e 0 + e 1 h) | h ∈ ℛ 𝑟 , (e 0 , e 1 ) ∈ ℰ 𝑛,𝑡 ] .
For any probabilistic polynomial time algorithm 𝒟 taking as input h ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1) , and producing 0 or 1 as output, we define its advantage concerning the distinguishability of the parity check matrix as:

Adv IND QCCF 𝑟,𝑤 (𝒟) = |Pr [𝒟 (h 1 h -1 0 ) = 1 | h 0 , h 1 ∈ ℛ 𝑟,𝑤/2 ] -Pr [𝒟 (h) = 1 | h ∈ ℛ 𝑟 ]| .
(𝒜 ′ ) + 1 2 Adv IND QCCF 𝑟,𝑤 (𝒟) .
The number of bits of security of a problem is usually defined as the smallest 𝜆 such that for any adversaries 𝒜

Time(𝒜) Adv(𝒜) ≥ 2 𝜆
where Time(𝒜) is the running time of 𝒜. Note that if 𝒜 makes 𝑞 queries to any oracle then Time(𝒜) > 𝑞.

To summarize Theorem 2.5 & Theorem 4.1, in order to have 𝜆 bits of security against an IND-CCA adversary we want:

• 𝒲ℱ QCSD (2𝑟, 𝑟, 𝑡) > 2 𝜆 , • 𝒲ℱ QCCF (2𝑟, 𝑟, 𝑤) > 2 𝜆 , • 2 ℓ > 2 𝜆 , • 𝛿 < 2 -𝜆 i.e. DFR(decoder) < 2 -𝜆 .
Remember that we call DFR the decoding failure rate of a decoding algorithm. The best known algorithm to solve the underlying problems are variants of the ISD algorithms that we discussed in §3.3. So to satisfy the first two points we should have, in a first approximation:

2 1/2+𝑡(1+𝑜(1))-log 2 (𝑛)/2 > 2 𝜆 and 2 1+𝑤(1+𝑜(1))-log 2 (𝑛) > 2 𝜆
for some security parameter 𝜆. Parameters should nevertheless be determined by considering the actual work factors of ISD algorithms. If only the first three points are verified, the system is still IND-CPA secure. The last point is the main concern of this document and grants IND-CCA security if verified.

Table 4.1 gives the sets of parameters of [BIKE]. Two values for the block size 𝑟 are provided, 𝑟 CPA that verifies the first three conditions and 𝑟 CCA that was the value retained in [BIKE] to have a DFR low enough for IND-CCA security using the method that we detail in Chapter 14.

Block size

Squaring. If the block size 𝑟 is an even number, it has been shown in [START_REF] Löndahl | Squaring attacks on McEliece public-key cryptosystems using quasi-cyclic codes of even dimension[END_REF] that an attacker can decrease the cost of the ISD attacks using a squaring technique.

Remember that we are in the context of Proposition 1.31 and we are dealing with polynomials in 𝔽 2 [𝑥]/(𝑥 𝑟 -1). While, in [START_REF] Löndahl | Squaring attacks on McEliece public-key cryptosystems using quasi-cyclic codes of even dimension[END_REF], only a McEliece variant using QC-MDPC is mentioned, it can easily be translated for the Niederreiter variant and this is what we will do here.

As we are dealing with a field of characteristic 2, squaring a polynomial

𝑟-1 ∑ 𝑖=0 𝑎 𝑖 𝑥 𝑖 gives, if 𝑟 is even, 𝑟-1 ∑ 𝑖=0 𝑎 𝑖 𝑥 2𝑖 = 𝑟/2-1 ∑ 𝑖=0 (𝑎 𝑖 + 𝑎 𝑖+𝑟/2 )𝑥 2𝑖 mod (𝑥 𝑟 -1) . (4.1)
Attacks on the system can be roughly described, for a private key h ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1) and a syndrome s ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1), as follows.

Key recovery

Message recovery

Find h 0 , h 1 ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1) such that |h 0 | ≤ 𝑤 |h 1 | ≤ 𝑤 and h 0 h = h 1 Find e 0 , e 1 ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1) such that |e 0 | + |e 1 | ≤ 𝑡
and e 0 + e 1 h = s

If we now square all equations, we obtain the following. Note that a squared polynomial has no monomial of odd degree, hence the dimension of the problem is divided by 2.

Key recovery (squared)

Message recovery (squared)

Find h 2 0 , h 2 1 ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1) such that |h 2 0 | ≤ 𝑤 2 |h 2 1 | ≤ 𝑤 2 and h 2 0 h 2 = h 2 1 Find e 2 0 , e 2 1 ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1) such that |e 2 0 | + |e 2 1 | ≤ 𝑡 2 and e 2 0 + e 2 1 h 2 = s 2
Now the weights 𝑤 2 and 𝑡 2 are not specified. In (4.1), we say that there is a collision if there exists an 𝑖 such that 𝑎 𝑖 = 𝑎 𝑖+𝑟/2 = 1 .

Each collision decreases the weight of the squared polynomial by 2 compared to the original polynomial. So the squared versions of the problems are simpler (remember from §3.3 that the complexity of the problems depends mainly on 𝑡 and 𝑤).

Of course, the process can be repeated as many times as the dyadic valuation of 𝑟. And each time the process is applied, since the dimension is divided by two, the probability of having a collision increases and therefore the weights3 𝑤 2 𝑖 and 𝑡 2 𝑖 decrease as well.

Square roots. Once a solution to the squared problem is found, it remains to lift it to return to the original problem. Say a ′2 = ∑

𝑟/2-1 𝑖=0 𝑖 even 𝑎 ′
𝑖 𝑥 2𝑖 is a solution to a problem. For any position 𝑖 such that 𝑎 ′ 𝑖 = 1 then

𝑎 ′ 𝑖 = 𝑎 𝑖 + 𝑎 𝑖+𝑟/2 = 1 so either 𝑎 𝑖 = 1 or 𝑎 𝑖+𝑟/2 = 1.
A solution to the initial problem is found using an ISD algorithm with the additional leverage provided by this information. To be more precise, if we remember the general structure of such an algorihm explained in Figure 3.2, rather than applying a random permutation P to the matrix, we restrict ourselves to permutations that do not place the above-mentioned positions in the information set. In other words, these positions will always be permuted to the first 𝑛 -𝑘 (or 𝑛 -𝑘 -ℓ) positions.

Doing this is equivalent to removing 2 ⋅ 𝑤 2 symbols (puncturing the code) so this increases the code rate slightly. And from Proposition 3.5 we know that this will slightly increase the contribution of the factor 𝑐 in the exponent of the workfactor.

However, if many collisions occurred during the squaring process, the decrease in the weight 𝑤 (or 𝑡) makes this algorithm worthwhile from an attacker's point of view.

As with the squaring process, this process too can be repeated as many times as the dyadic valuation of 𝑟.

To summarize, an attacker would perform squarings, then look for solution to the reduced problem, and finally lift the solution by computing square roots. The dominating factor in the complexity of this attack is the first solution to the reduced problem. It is particularly interesting for weak keys: keys with numerous collisions once squared. It has been shown in [START_REF] Löndahl | Squaring attacks on McEliece public-key cryptosystems using quasi-cyclic codes of even dimension[END_REF], for some parameters such that 2 4 divides 𝑟, that the logarithm of the cost of the attack divided by the probability of having a weak key is at least 10 bits below the expected security level.

Generalization. The attack was further generalized in [START_REF] Canto | Speeding up decoding a code with a non-trivial automorphism group up to an exponential factor[END_REF]. This paper adopts a different point of view. It studies codes with a non-trivial automorphism group i.e. a group of isometries that leave the code globally invariant. The code is then folded: for a given codeword, we consider the sum of its images under the elements of the automorphism group. The result is the same as in the previous paragraphs, the decoding problem is reduced to a smaller dimension, a smaller error weight with the same code rate.

To do the connection with the previous paragraphs, for a quasi-cyclic code with an even block size, the permutation that, in each block, shifts the positions by 𝑟/2 coordinates is an isometry and along with the identity it forms an automorphism group.

This could be done for any non-trivial divisor 𝑟 ′ of 𝑟, not just 2. We would then consider shifts in multiples of 𝑟/𝑟 ′ , giving a group of automorphism of the order 𝑟 ′ . To avoid any such attack, 𝑟 must therefore be a prime number.

In fact, to avoid any other structural attack, in [BIKE], the block size 𝑟 is chosen so that the polynomial 𝑥 𝑟 -1 has only two irreducible factors:

𝑥 + 1 and 𝑥 𝑟-1 + 𝑥 𝑟-2 + ⋯ + 𝑥 + 1 .

Equivalently, it means that 2 is primitive modulo 𝑟 -1.

It also ensures that any polynomial of 𝔽 2 [𝑥]/(𝑥 𝑟 -1) with an odd Hamming weight is invertible, thus avoiding having to integrate any rejection process in the key generation4 .

Chapter 5

Syndrome weight and counters in a regular MDPC code

There is a quantity that plays a fundamental role in decoding, notably for bit-flipping which is the type of algorithms used for [BIKE] 1 . That quantity is the counter of a position, i.e. the number of unsatisfied parity check equations involving that position. In this chapter, we study it as a subject in its own right and explain the relation with the syndrome weight.

This chapter is a review of some results of [Cha17] that we will need and refer to regularly throughout this document.

Notation. For this chapter, we consider a (𝑑, 𝑤)-regular [2𝑟, 𝑟]-MDPC code with a (sparse) parity check matrix H and consider the problem of finding the error vector e of weight 𝑡 from the syndrome s = He ⊺ with the parameters • 𝑟: the block size of the parity check matrix;

• 𝑛 = 2𝑟: the length of the code,

• 𝑑: the column weight of the parity check matrix;

• 𝑤 = 2𝑑: the row weight of the parity check matrix,

• 𝑡: the weight of the error pattern.

We write

2 H = (h 0 h 1 ⋯ h 𝑛-1 ) = ⎛ ⎜ ⎜ ⎜ ⎜ ⎜ ⎝ h ⊺ 0 h ⊺ 1 ⋮ h ⊺ 𝑟-1 ⎞ ⎟ ⎟ ⎟ ⎟ ⎟ ⎠
where h 0 , … , h 𝑛-1 are the columns of H and h ⊺ 0 , … , h ⊺ 𝑟-1 are the rows of H. The quantities H, s and e are usually clear from the context. We will omit them and simply write 𝜎 𝑗 and 𝐸 ℓ .

Fundamental quantities

Proposition 5.3. The following identities are verified for all H, all e and s = He ⊺ :

∑ ℓ odd 𝐸 ℓ = |s| , ∑ 𝑗 𝜎 𝑗 = 𝑤 |s| , ∑ 𝑗∈e 𝜎 𝑗 = ∑ ℓ odd ℓ𝐸 ℓ .
Proof. For any 𝑖 ∈ {1, … , 𝑟}, 𝑠 𝑖 = 1 if and only if |h ⊺ 𝑖 ⋆ e| is odd, implying the first identity. We can prove the next one by using the definition of 𝜎 𝑗 . We will use the fact that for any 𝑖 and 𝑗, we have 𝑖 ∈ h 𝑗 ⟺ 𝑗 ∈ h ⊺ 𝑖 . Equivalently, using indicator functions, for any 𝑖, 𝑗,

1 h 𝑗 (𝑖) = 1 h ⊺ 𝑖 (𝑗). 𝑛-1 ∑ 𝑗=0 𝜎 𝑗 = 𝑛-1 ∑ 𝑗=0 |h 𝑗 ⋆ s| = 𝑛-1 ∑ 𝑗=0 𝑟-1 ∑ 𝑖=0 1 h 𝑗 ⋆s (𝑖) = 𝑛-1 ∑ 𝑗=0 𝑟-1 ∑ 𝑖=0 1 h 𝑗 (𝑖)1 s (𝑖) = 𝑛-1 ∑ 𝑗=0 𝑟-1 ∑ 𝑖=0 1 h ⊺ 𝑖 (𝑗)1 s (𝑖) = 𝑟-1 ∑ 𝑖=0 1 s (𝑖) ⎛ ⎜ ⎝ 𝑛-1 ∑ 𝑗=0 1 h ⊺ 𝑖 (𝑗) ⎞ ⎟ ⎠ .
We can then use the fact that each row of H has a fixed weight. Similarly, we can prove the last identity:

∑ 𝑗∈e 𝜎 𝑗 = ∑ 𝑗,𝑒 𝑗 =1 |h 𝑗 ⋆ s| = 𝑛-1 ∑ 𝑗=0 𝑟-1 ∑ 𝑖=0 1 h 𝑗 ⋆s (𝑖)1 𝑒 (𝑗) = 𝑛-1 ∑ 𝑗=0 𝑟-1 ∑ 𝑖=0 1 h 𝑗 (𝑖)1 s (𝑖)1 e (𝑗) = 𝑛-1 ∑ 𝑗=0 𝑟-1 ∑ 𝑖=0 1 h ⊺ 𝑖 ⋆e (𝑗)1 s (𝑖) = ∑ 𝑖,|h ⊺ 𝑖 ⋆e| odd 𝑛-1 ∑ 𝑗=0 1 h ⊺ 𝑖 ⋆e (𝑗) = min(𝑤,𝑡) ∑ ℓ=0 ℓ odd ℓ𝐸 ℓ .

Counters distributions

We can adopt a transposed point of view for a counter, compared to Definition 5.1. First let us see that

s = ⎛ ⎜ ⎜ ⎜ ⎜ ⎜ ⎜ ⎝ |h ⊺ 0 ⋆ e| mod 2 |h ⊺ 1 ⋆ e| mod 2 ⋮ |h ⊺ 𝑟-1 ⋆ e| mod 2 ⎞ ⎟ ⎟ ⎟ ⎟ ⎟ ⎟ ⎠ .
We have3 for any 𝑗 ∈ {0, … , 𝑛 -1},

𝜎 𝑗 = ∑ 𝑖∈h 𝑗 (|h ⊺ 𝑖 ⋆ e| mod 2) .
We now assume that the parity check matrix H and the error vector e are drawn uniformly at random (but still verifying the constraints on regularity and Hamming weight). This way the syndrome s is a binary random vector and the counters are random variables.

It is natural to assume, for a fixed 𝑗 ∈ {0, … , 𝑛 -1}, that the 𝑑 random variables defined by (|h ⊺ 𝑖 ⋆ e| mod 2) for 𝑖 in the support of h 𝑗 are independent. Let us write the following probabilities

𝜋 0 = Pr [(|h ⊺ 𝑖 ⋆ e| mod 2) = 1 | 𝑗 ∉ e, 𝑖 ∈ h 𝑗 ] , 𝜋 1 = Pr [(|h ⊺ 𝑖 ⋆ e| mod 2) = 1 | 𝑗 ∈ e, 𝑖 ∈ h 𝑗 ] .
Finally, still assuming independence of the random variables, the counters follow one of the following two binomial distributions, depending on whether they concern a position in the support of the error or not:

𝜎 𝑗 ∼ Bin(𝑑, 𝜋 0 ) if 𝑗 ∉ e, 𝜎 𝑗 ∼ Bin(𝑑, 𝜋 1 ) if 𝑗 ∈ e.

Average case

With no further assumption on H or e, we have

𝜋 0 = ∑ ℓ odd ( 𝑤-1 ℓ )( 𝑛-𝑤 𝑡-ℓ ) ( 𝑛-1 𝑡 )
, and

𝜋 1 = ∑ ℓ even ( 𝑤-1 ℓ )( 𝑛-𝑤 𝑡-1-ℓ ) ( 𝑛-1 𝑡-1 )
.

(5.1)

Proof. If 𝑗 ∈ e,

Conditioning the counter distributions with the syndrome weight

Suppose now that we are no longer in the average case with a uniformly drawn error pattern e but that we have a syndrome s = He ⊺ such that its weight |s| =∶ 𝑆 is fixed.

Definition 5.4. We write 𝑋 the quantity

𝑋 ∶= ⎛ ⎜ ⎝ ∑ 𝑗∈e 𝜎 𝑗 ⎞ ⎟ ⎠ -𝑆 = ∑ ℓ>0 2ℓ𝐸 2ℓ+1 .
Suppose also that we know the sum of the counters of erroneous positions:

∑ 𝑗∈e 𝜎 𝑗 = 𝑆 + 𝑋
where 𝑋 is a positive value. And using Proposition 5.3, we have:

∑ 𝑗∉e 𝜎 𝑗 = (𝑤 -1)𝑆 -𝑋 .
Then, using the fact that a random variable following a binomial distribution has values around its mean, we can write:

𝜋 0 = (𝑤 -1)𝑆 -𝑋 𝑑(𝑛 -𝑡) , 𝜋 1 = 𝑆 + 𝑋 𝑑𝑡 .
(5.2)

In practice, we often wish to obtain an accurate model for the counter distributions which only depends on 𝑆 and 𝑡. So we must somehow get rid of 𝑋. In practice 𝑋 = 2𝐸 3 +4𝐸 5 +⋯ is not dominant in the above formula (for relevant parameters) and we can replace it by its expected value.

Proposition 5.5. The expected value of 𝑋 = ∑ ℓ>0 2ℓ𝐸 2ℓ+1 is

𝑋 = 𝑟 ∑ ℓ 2ℓ𝜌 2ℓ+1 where 𝜌 ℓ = ( 𝑤 ℓ )( 𝑛-𝑤 𝑡-ℓ ) ( 𝑛 𝑡 )
.

To illustrate the situation, the number of occurrences expected for a counter value with BIKE parameters offering 128-bit security is shown in Figure 5.1.

In practice, the counter distributions with probabilities from (5.2) are really close to those observed from simulation. This gives counters distributions accurate enough to allow improvement of the bit-flipping algorithm with better thresholds as we will see in §6.1.3.1. However, as far as the probabilistic modeling of the algorithm is concerned, we will see in Chapter 11 that this is not good enough. We will show a more accurate model in §11.3.3 that takes into account the regularity of the code.

Introduction

Some decoders are more naturally described as syndrome decoders and others rather as decoders of a noisy codeword. Keeping the notations introduced in Sections 3.1 & 3.2, the algorithms of the first category will have a superscript ⟂ symbol in their name while the others will not.

In general, a bitflipping-based decoder is best understood in terms of its effects on a syndrome, and a message-passing algorithm carries out calculations related to the positions of a received word. These two categories of decoders will be detailed in this introductory chapter.

In this document, we deal with codes whose parity check matrix consists of two 𝑟 × 𝑟 invertible matrices. The conversions between the two types of decoders are thus explicitly described in the Algorithm 6.1. Algorithm 6.1: Conversions between decoders and syndrome decoders.

State of the art

Given the close link between an LDPC code and an MDPC code, it is relevant to investigate the decoding of the former. This is what we will do first, before turning our attention to decoders designed specifically for MDPC codes. Finally, we will present the work of [START_REF] Chaulet | Étude de cryptosystèmes à clé publique basés sur les codes MDPC quasi-cycliques[END_REF] on the choice of thresholds, a central component of bit-flipping algorithms.

LDPC codes

Many variants of decoders were proposed since the invention of LDPC codes. They can all be seen as improvements or specialization of one of the following algorithms:

• bit-flipping;

• belief propagation, also called sum-product algorithm.

The former is a hard-decision decoder: a bit is either set to 0 or 1 and there is no way to deal with uncertainty. The latter is a soft-decision decoder: its input and all the intermediate states represent a probability or a likelihood.

Soft-decision decoders usually outperform hard-decision ones, but they have a more complex logic and require more memory. Looking for trade-offs between the two types of algorithms is a line of research that has often been considered, and we will label the resulting algorithms as intermediate.

Hard-decision decoding

Bit-flipping. A very simple iterative decoding algorithm was proposed by Gallager in [START_REF] Robert | Low Density Parity Check Codes[END_REF], it is usually referred to as the bit-flipping algorithm. It is based on the following observation: if a position is involved in many unsatisfied equations, it is more likely to be erroneous. Thus, at each iteration of the algorithm, the syndrome is computed and then, for each position, the number of unsatisfied equations in which it is involved is counted and if this count exceeds a certain threshold, the value of the position is flipped. Hopefully, with each iteration, the number of errors is decreased until there are no more errors, the syndrome is then zero. Full descriptions are given in Algorithm 6.2 and Algorithm 6.3. In these descriptions, the threshold is treated as the result of a call to a black box function but, as it is a subject on its own, the actual implementation of such a function will be discussed later in this document. Common choices for the threshold are: a majority vote i.e. 𝑇 = (|h 𝑗 | + 1)/2 or the maximum value reached by the counters max 𝑗 |h 𝑗 ⋆ s|. Algorithm 6.2 is said to be parallel because at each iteration, the syndrome is recomputed only once after all positions have been checked. On the other hand, Algorithm 6.3 is called serial because the syndrome is updated after each flip. Algorithm 6.2: Parallel bit-flipping.

⋆ s ′ | ≥ 𝑇 then 𝑒 ′ 𝑗 ← 1 -𝑒 ′ 𝑗 ; s ′ ← s -He ′ ⊺ ; return e ′ ;
These algorithms have been studied by Sipser and Spielman in [START_REF] Sipser | Expander codes[END_REF]. They showed that it converges to the solution given that the Tanner graph has some expanding properties1 i.e. if a relatively small subset of vertices has many connections with the rest of the graph. The threshold they used corresponds to a majority vote i.e. 𝑇 = (|h 𝑗 | + 1) /2. Message-passing algorithms. An important class of LDPC decoders are the messagepassing algorithms. In these algorithms, the nodes of the Tanner graph of the code are assigned values that are initialized using the received word and then the edges are used to "pass messages" in order to update the node values. Algorithm 6.4 gives the template of such an algorithm that we will use by defining the functions init, check_to_var, var_to_check, a_posteriori for the different variants. It uses the function 𝒩 H that returns the set of immediate neighbours of a node in the Tanner graph defined by the parity check matrix H.

Gallager A/B. One algorithm and its variant, often mentioned in the litterature as Gallager A and B algorithms, can be seen as a message-passing version of the bit-flipping decoder. Its description is given it Table 6.1. In contrast to the bit-flipping algorithm, this decoder does not exchange extrinsic information between nodes. In the bit-flipping algorithm, a node sends the same information to all its neighbours (all variable nodes send their current value to all their neighboring check nodes and vice versa). The messagepassing algorithm explicitely excludes the information it received from a node from the information it sends to this very node.

The difference between Gallager A and Gallager B is in the way the thresholds 𝑇 are computed. In Gallager B, thresholds are carefully computed and may change between rounds or nodes. In Gallager A, the threshold is always 𝑇 = deg(𝑣) -1 for any variable node 𝑣.

Soft-decision decoding

Belief propagation. The messages that are passed in the previous algorithm correspond to binary votes depending on the state of the nodes. In the belief propagation algorithm, probabilities or likelihoods are passed. This algorithm was first defined by Gallager Algorithm 6.4: Message-passing algorithm. in [START_REF] Robert | Low Density Parity Check Codes[END_REF] to decode LDPC codes. In a more general context, the algorithm was redefined by Pearl in [START_REF] Pearl | Reverend Bayes on Inference Engines: A Distributed Hierarchical Approach[END_REF] and is used in the artificial intelligence field.

There are many equivalent ways to write the algorithm, one can consider probability, likelihood ratio or log-likelihood ratio. Here we will write it using the log-likelihood ratio. Definition 6.1. Let 𝑋 be a binary random variable and let 𝑌 be a random variable. The likelihood ratio is the ratio

𝐿(𝑋 | 𝑦) ∶= Pr[𝑋 = 0 | 𝑌 = 𝑦] Pr[𝑋 = 1 | 𝑌 = 𝑦] .
The log-likelihood ratio is then simply log (𝐿 (𝑋 | 𝑦)).

Suppose that we send a codeword x through a channel, we call y the received vector. Let us now assume that the Tanner graph is a tree, we can thus assume that variable nodes are mutually independent as well as the check nodes. Using Proposition 1.14, it can be shown (see [START_REF] Robert | Low Density Parity Check Codes[END_REF]) that ;

Pr [𝑥 𝑣 = 0 | 𝑦 𝑣 , 𝒪 𝑣 ] Pr [𝑥 𝑣 = 1 | 𝑦 𝑣 , 𝒪 𝑣 ] = Pr [𝑥 𝑣 = 0 | 𝑦 𝑣 ] Pr [𝑥 𝑣 = 1 | 𝑦 𝑣 ] ∏ 𝑐∈𝒩 H (𝑣) 1 + ∏ 𝑣 ′ ∈𝒩 H (𝑐) (1 -2 Pr [𝑥 𝑣 ′ = 1 | 𝑦 𝑣 ′ , 𝒪 𝑣 ′ ]) 1 -∏ 𝑣 ′ ∈𝒩 H (𝑐) (1 -2 Pr [𝑥 𝑣 ′ = 1 | 𝑦 𝑣 ′ , 𝒪 𝑣 ′ ]) (6.1)
where 𝒪 𝑣 is the event that the transmitted vector satisfies the parity check equations concerning 𝑣 for some variable node 𝑣.

We can then use the fact that

∀𝑝 ∈ [0, 1], 1 -2𝑝 = tanh ( 1 2 log 𝑝 1 -𝑝 )
and

∀𝑥 ∈ (-1, 1), tanh -1 (𝑥) = 1 2 log ( 1 + 𝑥 1 -𝑥 )
to rewrite the formula using log-likelihood ratios.

Recall that the Tanner graph is assumed to be a tree. Excluding extrinsic information in the conditional probabilities, one can then show that the message-passing algorithm defined by Table 6.2 computes the log-likelihood values for each variable node with conditioning increasing by one more level for each iteration. In (6.1) the expression in the product corresponds to the messages sent from the check nodes to the variable nodes and the whole formula is the converse. Still assuming the Tanner graph is a tree, after enough iterations, the algorithm computes the log-likelihood of each variable node conditioned on the received vector and the values of the nodes in the entire graph.

A quantization method for implementing this algorithm efficiently has been detailed in [START_REF] Chung | On the design of low-density parity-check codes within 0.0045 dB of the Shannon limit[END_REF]. It has been shown that, using this technique, a precision of less than 16 bits has no impact on the performance compared to more precise computations.

Assuming the Tanner graph has no loop of length less than or equal to the number of iterations, the convergence of this algorithm can be studied by a method know as density evolution that will be detailed in §10.1.1.1.

As with the bit-flipping algorithm, message-passing algorithms are characterized by the way they update information. Algorithm 6.4 uses a scheduling method known as flooding: messages from variables (resp. check) nodes are sent all at once, only when all of them have been computed. Other methods have been shown to improve convergence and lower memory requirements by sending messages earlier. One of such scheduling technique is said to be horizontal, it processes check nodes one by one, during each iteration a check node immediately sends messages to its (variable nodes) neighbours which in turn immediately send messages to their (check nodes) neighbours. This algorithm is known as layered belief propagation.

Intermediate

The belief propagation algorithm usually has better decoding performance while the bitflipping algorithm has lower computing complexity and memory requirements. Naturally, there has been a search for tradeoffs: a slight increase in complexity or memory for a better decoding performance than the bit-flipping. Two-bit bit-flipping. In the two-bit bit-flipping algorithm [START_REF] Viet | Two-Bit Bit Flipping Algorithms for LDPC Codes and Collective Error Correction[END_REF], the variables nodes are given a strength encoded as a 2-bit value rather than a single bit: 0 s , 0 w , 1 s , 1 w where w indicates a "weak" value and s a "strong" value. Transitions from one strength to another is determined by a table that depends on the counter value. The general structure is described in Algorithm 6.5.

We adopt the convention that the binary vectors are written in lower case and the vectors of {0 w , 0 s , 1 w , 1 s } in upper case. The functions 𝐶 ∶ {0, 1} → {0 w , 0 s , 1 w , 1 s } and 𝑐 ∶ {0 w , 0 s , 1 w , 1 s } → {0, 1} convert from one to the other. It is suggested that the lifting 𝐶 is chosen such that ∀𝑖 ∈ {0, 1}, 𝐶(𝑖) = 𝑖 s , or ∀𝑖 ∈ {0, 1}, 𝐶(𝑖) = 𝑖 w And the projection is the obvious choice ∀𝑡 ∈ {s, w}, 𝐶(𝑖 𝑡 ) = 𝑖. Algorithm 6.5: Two-bit bit-flipping.

function twobit_bitflip(H, y):

input : A sparse parity check matrix H ∈ 𝔽 (𝑛-𝑘)×𝑛 2 , a vector y ∈ 𝔽 𝑛 2 . output : A codeword c ∈ 𝔽 𝑛 2 such that y = c + e ∈ 𝔽 𝑛 2 . s (0) ← Hy (0) ⊺ ;

Y (0) ← (𝐶 (𝑦 𝑗 )) 𝑗∈{0,…,𝑛-1} ; ℓ ← 0; while s (ℓ) ≠ 0 do ℓ ← ℓ + 1; for 𝑗 ∈ {0, … , 𝑛 -1} do 𝑌 (ℓ) 𝑗 ← 𝑓 (𝑌 (ℓ-1) 𝑗 , 𝜒 (𝑆 (ℓ) , 𝑗)); y (ℓ) ← (𝑐 (𝑌 (ℓ) 𝑗 )) 𝑗∈{0,…,𝑛-1} ; s (ℓ) ← Hy (ℓ) ⊺ ; for 𝑖 ∈ {0, … , 𝑛 -𝑘 -1} do 𝑆 (ℓ) 𝑗 ← (𝜙 (𝑠 (ℓ-1) 𝑗 , 𝑠 (ℓ) 𝑗 )) 𝑗∈{0,…,𝑟-1} ; return y (ℓ) ;
The check nodes are given a 2-bit value depending on their previous state: 𝑖 p , or 𝑖 n for 𝑖 ∈ {0, 1} for respectively the previously or newly assigned values. The function 𝜙 ∶ {0, 1} 2 → {0 p , 0 n , 1 p , 1 n } handles the task of maintaining the 2-bit syndrome values:

∀𝑖 ∈ {0, 1}, 𝜙(𝑖, 𝑖) ∶= 𝑖 p and 𝜙(1 -𝑖, 𝑖) ∶= 𝑖 n .
The counters in this model are now tuples rather than integers, they are computed via the function 𝜒:

∀𝑗 ∈ {0, … , 𝑛 -1}, 𝜒 0 w (S, 𝑗) = |{𝑖 ∈ {0, … , 𝑟 -1} | 𝑆 𝑖 = 0 w , ℎ 𝑖,𝑗 = 1}| , 𝜒 0 s (S, 𝑗) = |{𝑖 ∈ {0, … , 𝑟 -1} | 𝑆 𝑖 = 0 s , ℎ 𝑖,𝑗 = 1}| , 𝜒 1 w (S, 𝑗) = |{𝑖 ∈ {0, … , 𝑟 -1} | 𝑆 𝑖 = 1 w , ℎ 𝑖,𝑗 = 1}| , 𝜒 1 s (S, 𝑗) = |{𝑖 ∈ {0, … , 𝑟 -1} | 𝑆 𝑖 = 1 s , ℎ 𝑖,𝑗 = 1}| .
The description given in [START_REF] Viet | Two-Bit Bit Flipping Algorithms for LDPC Codes and Collective Error Correction[END_REF] is really specific to particular codes: LDPC with column weight 3. Authors suggest two node updating functions 𝑓.

The first one 𝑓 1 does not use the additional information on the syndrome bits about whether they were previously or newly assigned. It relies on the usual counters. The function is described in the following table showing the output values vs. counter values

𝜒 1 s + 𝜒 1 w . 0 1 2 3 0 w 0 s 1 w 1 s 1 s 0 s 0 s 0 s 0 w 1 s 1 w 1 s 0 w 0 s 0 s 1 s 1 s 1 s 1 w 0 s
What is interesting with this method is that the normal working of the bit-flipping is kept when there is a high degree of confidence in a flip, but otherwise the decision is delayed.

The second suggested function additionally uses the reliability information from the syndrome.

𝑓 2 (𝑖 𝑣 , 𝜒) = ⎧ { { ⎨ { { ⎩ 𝑓 1 (𝑖 𝑣 , 𝜒 1 s + 𝜒 1 w ) if (𝜒 0 s , 𝜒 0 w , 𝜒 1 w ) ∉ {(2, 0, 0), (1, 1, 0)}, 𝑖 𝑣 if (𝜒 0 s , 𝜒 0 w , 𝜒 1 w ) = (2, 0, 0), 𝑖 w if (𝜒 0 s , 𝜒 0 w , 𝜒 1 w ) = (1, 1, 0).

MDPC codes

Bit-flipping

Several variants of Algorithm 6.2 were considered for MDPC decoding. They vary on the way to choose the threshold. The original publication [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from Moderate Density Parity-Check codes[END_REF] suggests using max 𝑗 (|h 𝑗 ⋆ s|) -𝛿 for some fixed value of 𝛿. A fixed threshold per iteration strategy was explored in [HMG13; MG14; Cho16]. In [HMG13; MG14] they are based on Gallager's analysis of LDPC codes. In [START_REF] Chou | QcBits: Constant-Time Small-Key Code-Based Cryptography[END_REF] they were chosen by iterative experiments. And in [START_REF] Chaulet | Worst case QC-MDPC decoder for McEliece cryptosystem[END_REF], a novel approach was shown to be relevant: the threshold is chosen as a function of the syndrome weight. Obtaining this function was mainly experimental and many simulation data were needed in this first work, but an analytic formula derived from a theoretical model was presented in the subsequent work [START_REF] Chaulet | Étude de cryptosystèmes à clé publique basés sur les codes MDPC quasi-cycliques[END_REF].

A technique called adaptive auxiliary variable node (AAVN) was proposed in [START_REF] Bocharova | Improved iterative decoding of QC-MDPC codes in the McEliece public key cryptosystem[END_REF]. It adds columns and rows to the parity check matrix in order to remove some cycles of length 4 in the Tanner graph as small cycles are known to be detrimental to decoders. In this work, the threshold is set to max 𝑗 (|h 𝑗 ⋆ s|) .

Message-passing algorithms

In [START_REF] Baldi | Soft McEliece: MDPC code-based McEliece cryptosystems with very compact keys through realvalued intentional errors[END_REF], a "soft" QC-MDPC based McEliece cryptosystem was proposed. In this system, rather than dealing with a vector in 𝔽 𝑛 2 and an error vector of fixed weight 𝑡, codewords are encoded using binary pulse amplitude modulation (2-PAM) and the error vector is an additive white Gaussian noise (AWGN). Authors suggest using a belief propagation algorithm in the log-likelihood domain to decode.

Using a soft-decision decoder for the original QC-MDPC scheme (with a binary fixed weight error vector) has been considered in [START_REF] Liva | Protograph-based Quasi-Cyclic MDPC Codes for McEliece Cryptosystems[END_REF]. They use a "scaled" sum-product algorithm: the messages sent from the check nodes to the variable nodes are multiplied by a factor 𝜔. For the 80 security bits parameters of [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from Moderate Density Parity-Check codes[END_REF], they achieve great decoding performance with 𝜔 = 0.5.

QC-MDPC decoding thresholds

In Chapter 5, we saw that, using the regularity of a quasi-cyclic code, we can determine a model for the counters distributions. In this model, they follow two binomial distributions: one for the counters concerning errors, and the other for the counters concerning correct positions:

𝜎 𝑗 ∼ Bin(𝑑, 𝜋 0 ) if 𝑗 ∉ e , 𝜎 𝑗 ∼ Bin(𝑑, 𝜋 1 ) if 𝑗 ∈ e .
The probabilities 𝜋 0 and 𝜋 1 are determined by one of the following formulas.

Average case: When no further assumption is made on H or e, we have

𝜋 0 = ∑ ℓ odd ( 𝑤-1 ℓ )( 𝑛-𝑤 |e|-ℓ ) ( 𝑛-1 |e| )
, and

𝜋 1 = ∑ ℓ even ( 𝑤-1 ℓ )( 𝑛-𝑤 |e|-1-ℓ ) ( 𝑛-1 |e|-1 ) . (6.2)
When the syndrome weight is known: Conditioning the probabilities for some fixed values of |s| = 𝑆 and 𝑋 = ∑ 𝑗∈e 𝜎 𝑗 -|s|, we have

𝜋 0 = (𝑤 -1)𝑆 -𝑋 𝑑(𝑛 -|e|) , and
𝜋 1 = 𝑆 + 𝑋 𝑑 |e| . (6.3)
The purpose of bit-flipping is, as much as possible, to reduce the error weight at each iteration. Therefore, when this is repeated enough times, the original noisy codeword has been decoded, all the errors have been removed.

To reduce the error weight, the algorithm must flip more errors than correct positions. So a good threshold 𝑇 is one where, of all the positions with a counter above it, a majority are errors:

∑ 𝑘≥𝑇 #{𝑗 ∈ e | 𝜎 𝑗 = 𝑘} ≥ ∑ 𝑘≥𝑇 #{𝑗 ∉ e | 𝜎 𝑗 = 𝑘} .
In practice, we will take the smallest such 𝑇. And since the cardinalities involved in the above inequality are almost impossible to know without having already decoded, we will rely on probabilities. Let us denote

𝑝 ∉e (𝑘) = Pr[𝜎 𝑗 = 𝑘 | 𝑗 ∉ e] = ( 𝑑 𝑘 )𝜋 𝑘 0 (1 -𝜋 0 ) 𝑑-𝑘 and 𝑝 ∈e (𝑘) = Pr[𝜎 𝑗 = 𝑘 | 𝑗 ∈ e] = ( 𝑑 𝑘 )𝜋 𝑘 1 (1 -𝜋 1 ) 𝑑-𝑘 .
Then the above inequality translates as:

|e| ∑ 𝑘≥𝑇 𝑝 ∈e (𝑘) ≥ (𝑛 -|e|) ∑ 𝑘≥𝑇 𝑝 ∉e (𝑘) .
The error weight |e| is not known apart from the first iteration where it is equal to 𝑡. For any subsequent iteration, it has to be guessed, for example using the syndrome weight. Since the counters distributions are usually unimodal, a way to choose the threshold 𝑇 that is more resilient to the imprecision on this guess is to choose the smallest 𝑇 such that:

|e| 𝑝 ∈e (𝑇 ) ≥ (𝑛 -|e|)𝑝 ∉e (𝑇 ) .
(6.4)

Adaptive threshold

Using the probabilities 𝜋 0 and 𝜋 1 from (6.3), the threshold equation (6.4) gives

𝑇 = ⎡ ⎢ ⎢ ⎢ 𝑑 log ( 1-𝜋 1 1-𝜋 0 ) + log ( |e| 𝑛-|e| ) log ( 1-𝜋 1 1-𝜋 0 ) + log ( 𝜋 0 𝜋 1 ) ⎤ ⎥ ⎥ ⎥ .
This was suggested in [START_REF] Chaulet | Étude de cryptosystèmes à clé publique basés sur les codes MDPC quasi-cycliques[END_REF] and it is very consistent with the thresholds that were empirically determined in [START_REF] Chaulet | Worst case QC-MDPC decoder for McEliece cryptosystem[END_REF] that were optimized for Algorithm 6.2. With a few exceptions, these are the thresholds we will use in this document. Moreover, a threshold lower than (𝑑 + 1)/2 is generally detrimental for decoding. Therefore, we will take a threshold that is the maximum between (𝑑 + 1)/2 and 𝑇 in the above formula.

An example of counters distributions are given, for BIKE parameters offering 128 bits of security, in Figure 6.1a in the average case and Figure 6.1b with the condition that 𝑆 = 5 000, 𝑋 = 912. Given the low proportion of errors, the chart is zoomed to show the intersection of the two curves. The curves giving the expected number of correct positions are thus clipped.

In the average case, using the threshold 𝑇 = 42 would be relevant as it is after the point of intersection of the two curves thus respecting (6.4).

The event 𝑆 = 5 000, 𝑋 = 912 happens with probability around 10 -5 . In this case, the previous, non-adaptive threshold would be too low and may cause the algorithm to flip many correct positions.

Contributions

By observing the iteration by iteration evolution of a decoder, we can see that one of the most detrimental things that can happen is the addition of many errors. When using a purely threshold-based decoder, such as the classic bit-flipping, the errors that are added are so because they had a high counter. Once they have been flipped, if they have a small counter, they will be harder to correct.

We have designed two new types of intermediate algorithms to prevent this from happening. They all take advantage, each in their own way, of the reliability information obtained from counter values, which would otherwise be lost in a typical bit-flipping algorithm.

• The Backflip decoder that encodes this information over time, limiting the duration of each flip the algorithm does.

• Gray decoders that add a level between flipping a bit and not flipping it, and use flip verification steps on this new level.

These new frameworks introduce new parameters that must be chosen for each set of parameters of the cryptosystem. Contrary to the thresholds, these parameters are not systematically associated, in the current state of knowledge, to a theoretical analysis and are chosen by optimization. We try, however, as much as possible, to give an intuition on the influence of each of these parameters.

We will also discuss the step-by-step decoder which is close to the sequential bit-flipping algorithm described in [START_REF] Sipser | Expander codes[END_REF]. In comparison, this decoder does not use a majority logic but an adaptive threshold and the positions are sampled more efficiently, with an induced bias that we can explain. The importance of this algorithm will be clarified in Chapter 12 where we build a probabilistic model on its evolution in order to estimate its failure rate.

In previous work, we have studied an adaptation to MDPC codes of the two-bit bit-flip of [START_REF] Viet | Two-Bit Bit Flipping Algorithms for LDPC Codes and Collective Error Correction[END_REF], generalized to an arbitrary precision. The additional cost in memory and computation, as well as the ad-hoc nature of its specifications, meant that this work was not pursued and will not be presented in this document. For more information we refer the reader to [START_REF] Vasseur | Cryptographie post-quantique : étude du décodage des codes QC-MDPC[END_REF]. In a way, there are similarities between this algorithm and Backflip that we present in Chapter 8. Indeed, one of the principles of Backflip is to keep the flips for a shorter period of time when we are less confident in them, this is also a feature of the two-bit bit-flip.

Benchmark. We will assess the performance of the different algorithms by plotting their DFR versus the block size 𝑟. As seen in §4.1, the IND-CPA security of a QC-MDPC system is essentially achieved by selecting the appropriate error weight 𝑡 and row weight 𝑤. IND-CCA security additionally requires that the decoder has a sufficiently low failure rate. Increasing the block size 𝑟 is one way to achieve this property and has little effect on the other IND-CCA security-related system properties.

We will use bit-flipping from Algorithm 6.2 and belief propagation from Algorithm 6.4 using Table 6.2 as benchmarks. The former has low complexity but rather poor decoding performance, and for the latter, the opposite applies.

We will refer to the former as "classic" bit-flipping. We use the adaptive thresholds from [START_REF] Chaulet | Étude de cryptosystèmes à clé publique basés sur les codes MDPC quasi-cycliques[END_REF] mentioned in §6.1.3.1. They are adaptive in the sense that they depend on the syndrome weight. The thresholds depend on the probabilities from (5.2), which in turn depend on the parameters 𝑑, 𝑤, 𝑟, 𝑛 and on certain values that are related to the specific instance we want to decode and the state of the decoder such as the syndrome weight |s|, the error weight |e| and the value 𝑋. The last two values are not information that a decoder can use normally. For this implementation, we replace 𝑋 by its expected value. And for the error weight, we take the actual value |e|. We know the exact value for our simulation since, contrary to the real world case, we constructed the initial error vector e and we can track any change that increases or decreases its weight. Doing this gives a theoretical curve that does not depend on the quality of the guess of the error weight. In a way, this gives the best possible threshold, it does so by "cheating".

Following [START_REF] Liva | Protograph-based Quasi-Cyclic MDPC Codes for McEliece Cryptosystems[END_REF] mentioned in §6.1.2.2, a scaling factor is applied to the messages sent from the check nodes. Here, with BIKE parameters offering 128 bits of security, a scaling factor of 𝜔 = 0.4 gave better performance in simulation, and it is therefore this factor that is used for the benchmark.

For the belief propagation curve, we have fewer data points because the computational cost is much higher and the decrease in DFR as block size increases is steeper.

In this document, we will always write algorithms using while loops which can potentially be infinite. In an actual implementation, the number of iterations must be limited and a decoding failure must be explicitly reported. Chapter 7

Step-by-step

The step-by-step algorithm was originally designed with analyzability in mind. In fact, it is a randomized version of Algorithm 6.3. In comparison, Algorithm 6.2 is parallel: all the counters are computed at once and then all the positions with a counter above the threshold are flipped at once, there is no update of the syndrome between those steps. The state of the decoder (for example in terms of the error weight or the syndrome weight) after one such iteration is hard to predict. In the step-by-step variant that we present here, one position is sampled, its counter is computed and if it is above a threshold it is flipped and the syndrome is updated immediately. One interesting characteristic of this algorithm is that the range of possible issues after one single flip is rather small: the error weight is adjusted by one unit (positively or negatively) and the syndrome weight by not more than 𝑑 units. We will see in Chapter 12 that to some extent, one can compute the probability associated to each one of these events. They are in fact the transition probabilities of a Markovian model of the algorithm. We will rely on this model to derive a probability of failure of the algorithm.

Beyond its analysis and although its decoding performance is poorer than, say, classic bit-flipping, it can still be wise to use this algorithm, especially if there are few errors to decode. In this chapter we focus on its design and implementation.

Definition

The description of the step-by-step decoder is given in Algorithm 7.1.

Sampling positions

Algorithm 7.1 calls a method to pick one position among the whole set of 𝑛 positions.

An interesting aspect of a sampling method is the way it affects the counter distributions. The general distributions of the 𝑛 counters are of course not changed, but as we progress through this section, we will see sampling methods that induce a bias each time greater towards higher counters. As a result, each provides different trade-offs between complexity and the probability of choosing an error.

We will write 𝑝 sample ∈e (𝜎) the probability that the sampled position is an error and has a counter of 𝜎. Similarly, 𝑝 sample ∉e (𝜎) will be the probability that the sampled position is not an error and has a counter of 𝜎.

We present here three different sampling methods.

Algorithm 7.1:

Step-by-step bit-flipping

function step_by_step_bitflip ⟂ (H, s): input : A sparse parity check matrix H ∈ 𝔽 (𝑛-𝑘)×𝑛 2 , a syndrome s = He ⊺ ∈ 𝔽 𝑛-𝑘 2 . output : An error pattern e ′ ∈ 𝔽 𝑛 2 such that He ′ ⊺ = s. e ′ ← 0; s ′ ← s; while s ′ ≠ 0 do 𝑇 ← threshold(context); 𝑗 $ ← sample(context); if |h 𝑗 ⋆ s ′ | ≥ 𝑇 then 𝑒 ′ 𝑗 ← 1 -𝑒 ′ 𝑗 ; s ′ ← s ′ + h 𝑗 ; return e ′ ;

Uniform sampling

The simplest possibility that comes to mind is to choose a position uniformly at random. In this case, the general distributions given in §5.2 are only affected by the proportion of errors among the positions:

𝑝 sample 0 ∈e (𝜎) = 𝑡 𝑛 ⋅ 𝑝 ∈e (𝜎) ; 𝑝 sample 0 ∉e (𝜎) = 𝑛 -𝑡 𝑛 ⋅ 𝑝 ∉e (𝜎) .
With this method, the probability of picking an error is 𝑝 sample 0 err = 𝑡 𝑛 .

Picking a position in one unsatisfied equation

This method takes advantage of the fact that an unsatisfied equation has at least one error among its positions. The sampling method is therefore 1. randomly pick an unsatisfied equation;

2. randomly pick a position in this equation.

Compared to the previous one, this method induces a bias towards high counters proportional to the counter value. Indeed, a counter is by definition the number of unsatisfied equations in which a position is involved. So the higher the counter is, the better chance it has of being chosen by this method. In terms of probabilities, this translates as:

𝑝 sample 1 ∈e (𝜎) = 𝜎𝑡 𝐷 1 ⋅ 𝑝 ∈e (𝜎) ; 𝑝 sample 1 ∉e (𝜎) = 𝜎(𝑛 -𝑡) 𝐷 1 ⋅ 𝑝 ∉e (𝜎)
where

𝐷 1 = 𝑑 ∑ 𝜎=0 𝜎 ⋅ (𝑝 ∈e (𝜎) + 𝑝 ∉e (𝜎)) = 𝑤𝑆 .
With this method, the probability of picking an error is:

𝑝 sample 1 err = 𝑑 ∑ 𝜎=0 𝑝 sample 1 ∈e (𝜎) = 𝑆 + 𝑋 𝑤𝑆 ≥ 1 𝑤 .

Picking a position in two unsatisfied equations

The same idea as the previous one can be generalized to an arbitrary number of equations.

In fact, if the sampling method picks a random position involved in exactly 𝑘 unsatisfied equations, the bias for a counter value 𝜎 will be 𝜎(𝜎 -1) ⋯ (𝜎 -𝑘 + 1). Such a sampling method with a large value of 𝑘 can potentially speed up the process of obtaining a position with a high counter (above the threshold) and thus reduce the number of iterations before a flip. But increasing 𝑘 may not always be relevant if one considers that it increases the cost of the sampling process. In this section, however, we focus on the case 𝑘 = 2, since its implementation has some interesting links with the spectrum of the parity check matrix discussed in Chapter 15.

To be clear, let us recap the method:

1. randomly pick two different unsatisfied equations;

2. randomly pick a position belonging to both these equations.

Here, the probabilities will be affected quadratically in the counter value.

𝑝 sample 2 ∈e (𝜎) = 𝜎(𝜎 -1) ⋅ 𝑡 𝐷 2 ⋅ 𝑝 ∈e (𝜎) ; 𝑝 sample 2 ∉e (𝜎) = 𝜎(𝜎 -1) ⋅ (𝑛 -𝑡) 𝐷 2 ⋅ 𝑝 ∉e (𝜎)
where

𝐷 2 = 𝑑 ∑ 𝜎=0 𝜎(𝜎 -1) ⋅ (𝑝 ∈e (𝜎) + 𝑝 ∉e (𝜎)) = 𝑑 ⋅ (𝑑 -1) ⋅ (𝑡𝜋 2 1 + (𝑛 -𝑡)𝜋 2 0 ) ,
using the formula for the factorial moments for a binomial distribution. With this method, the probability of picking an error is:

𝑝 sample 2 err = 𝑑 ∑ 𝜎=0 𝑝 sample 2 ∈e (𝜎) = 𝑡𝜋 2 1 𝑡𝜋 2 1 + (𝑛 -𝑡)𝜋 2 0 ≥ 1 1 + 𝑡 𝑛-𝑡 (𝑤 -1) 2 .
As long as 𝑝 sample 1 err > 𝑡 𝑛 , the probability of picking an error is greater with this method than the previous one 𝑝 .

Implementing this method for quasi-cyclic matrices. If the same parity check matrix is used more than once, this sampling method can benefit from a precomputation of the intersections between any two of its rows. In a circulant block of size 𝑟 × 𝑟, say the 𝑖 1 -th row and the 𝑖 2 -th row have intersections at positions 𝑗 1 , … , 𝑗 ℓ . Then if we shift simultaneously the two indices of the rows, the intersecting positions will also be shifted by the same offset: for any 𝛿, the (𝑖 1 + 𝛿 mod 𝑟)-th row and the (𝑖 2 + 𝛿 mod 𝑟)-th row have intersections at positions 𝑗 1 + 𝛿 mod 𝑟, … , 𝑗 ℓ + 𝛿 mod 𝑟.

Thus, by precomputing all intersecting positions between the first row and any other row, we avoid searching for intersections at each random sampling by using only a small amount of memory. Indeed, if we look at Algorithm 7.2, we can see that 𝑑(𝑑 -1) intersections have to be computed and stored.

for 𝑘 ∈ {0, 1} do foreach 𝑖, 𝑗 ∈ Supp(h 𝑘 ) such that 𝑖 < 𝑗 do 𝛿 = 𝑗 -𝑖; if 𝛿 ≤ ⌊𝑟/2⌋ then spectrum[𝛿] ← spectrum[𝛿] ∪ {(𝑘, (𝑟 -𝑖) mod 𝑟)}; 𝛿 = 𝑟 -𝛿; if 𝛿 ≤ ⌊𝑟/2⌋ then spectrum[𝛿] ← spectrum[𝛿] ∪ {(𝑘, (𝑟 -𝑗) mod 𝑟)};
return spectrum; function sample 2 (𝑟, 𝑛, (h 0 , h 1 ), s, spectrum): input : Block size 𝑟, a parity check matrix (h 0 , h 1 ) ∈ (𝔽 2 [𝑥]/(𝑥 𝑟 -1)) 2 , a syndrome s ∈ 𝔽 𝑟 2 , the precomputed array spectrum = precompute_spectrum(𝑟, (h 0 , h 1 )). output : A position involved in at least two unsatisfied equations. repeat Sample (𝑖, 𝑗) such that 𝑖 < 𝑗 and Overhead of this sampling method. Given the sparsity of the parity check matrix of an MDPC code, it is not guaranteed that any pair of equations will have a nonempty intersection. This incurs extra costs as the sampling method might have to restart several times before giving a position as we can see in the loop of Algoritm 7.2.

𝑠 𝑖 = 𝑠 𝑗 = 1; 𝛿 ← 𝑗 -𝑖; if 𝛿 ≤ ⌊𝑟/2⌋ then start ← 𝑖; else start ← 𝑗; 𝛿 ← 𝑟 -𝛿; until spectrum ≠ ∅; (𝑘, ℓ) $ ← spectrum[𝛿]; return 𝑘 ⋅ 𝑟 + (start + ℓ) mod 𝑟;
It is important to notice that, for any circulant matrix, there is a bijection between its row vectors and its column vectors which simply consists in reversing the vectors as can be seen in Definition 1.30. We can thus refer to Chapter 15 in which we study the influence of intersections between the columns of a quasi-cyclic matrix on the DFR. In particular, we can pick some combinatorial results from this chapter. For now, it is only important to know that, in a circulant block, two rows at distance 𝛿 from each other have a nonempty intersection if and only if 𝛿 is in the spectrum1 of the circulant block in question.

And using Corollary 15.19, we can say that for a circulant block of size 𝑟 × 𝑟 and column weight 𝑑, the probability that a distance is in the spectrum of that block is

1 - ( 𝑟-𝑑-1 𝑑-1 ) ( 𝑟-1 𝑑-1 )
.

So, now considering the full double circulant parity check matrix, the probability that two rows have at least one intersection is:

1 -( ( 𝑟-𝑑-1 𝑑-1 ) ( 𝑟-1 𝑑-1 ) ) 2 .
Table 7.1 shows that with BIKE parameters, the sampling method needs to be restarted, on average, less than once.

Performance

Performance of the step-by-step are reported in Figure 7.1. They relate to BIKE level 1 parameters (128 bits of security). As for the classic bit-flipping statistics in this document, it is implemented with the adaptive thresholds from [START_REF] Chaulet | Étude de cryptosystèmes à clé publique basés sur les codes MDPC quasi-cycliques[END_REF], threshold(context) = threshold(|s| , |e|) = 𝑇 where T is defined as in §6.1.3.1, and using the expected value for 𝑋. Here again, to avoid measuring the quality of the guess on the error weight and rather focus on the algorithm itself, the actual error weight |e| is used in the threshold formula.

Most of the algorithms we study in this paper are parallel: all the counters are computed at once and the syndrome is computed once for each iteration. On the other hand, the step-by-step algorithm is serial and thus an iteration does not represent the same amount of computation in a parallel and in a serial algorithm. In first approximation2 , if we only count the number of counters calculated, a parallel iteration is equivalent to 𝑛 serial iterations. To make a fair comparison, this is the metric used in figure 7.1. A point to note is that we are seeing gradual improvements as we increase the number of iterations. However, a plateau is quickly reached. Indeed, 100 iterations do only marginally better than 10 iterations.

Non-blocking variant

A notable feature of a serial algorithm such as the step-by-step algorithm with thresholds as in §6.1.3.1, compared to a parallel algorithm, is that the weight of the syndrome necessarily decreases with each iteration. Indeed, the chosen thresholds are always greater than (𝑑 + 1)/2. Thus, when we flip a position 𝑗 ∈ {0, … , 𝑛 -1} with a counter 𝜎 𝑗 ≥ (𝑑 + 1)/2, the weight of the syndrome goes from |s| to |s + h 𝑗 | = |s| + 𝑑 -2𝜎 < |s| -1, using Proposition 1.26. This behaviour is not necessarily found with a parallel algorithm since several columns are flipped at the same time, and therefore, depending on the intersections between these columns, it may happen that these parallel flips increase the weight of the syndrome.

The problem is that the algorithm is then less tolerant to bad flips, those that flip correct positions. If there have been too many bad flips, the error weight will have increased and the syndrome weight will have decreased. As a consequence, all the counters may end up below the threshold. The algorithm will therefore enter a loop where in each iteration it samples a position without ever flipping anything until it fails because the maximum number of iterations has been reached.

To avoid such a situation we propose a non-blocking variant of the aforementioned step-by-step algorithm. In this variant, presented in Algorithm 7.3, we regularly undo flips in the order they first were performed (flips are stored in a queue).

This cancellation of flips can have two consequences. The first one is that it cancels a good decision, in which case an error is added, and that decision will probably be quickly reversed. The second one, more interesting, is that it cancels a previous bad decision and thus removes an error that may not be removed with a threshold-based approach. The idea of using a queue to keep the list of flips is relevant since the flips of the former type will merely cost us a little time as we move forward in the queue to finally reach the flips of the latter type.

𝑒 ′ 𝑗 ← 1 -𝑒 ′ 𝑗 ; s ′ ← s ′ + h 𝑗 ; 𝑖 ← 0; else 𝑖 ← 𝑖 + 1; if 𝑖 ≥ max_iter(context) then 𝑗 ← dequeue(𝐹 ); 𝑒 ′ 𝑗 ← 1 -𝑒 ′ 𝑗 ; s ′ ← s ′ + h 𝑗 ; 𝑖 ← 0; return e ′ ;
The challenge now is to find the right amount of time to wait before triggering a flip cancellation. In Algorithm 7.3, this is handled by the method max_iter.

Constant max_iter(𝑖). We choose a number of iteration and max_iter(𝑖) returns true whenever 𝑖 is a multiple of this number.

Variable max_iter(𝑖, |s| , |𝐹|). We define this method from a hypothesis testing point of view. First, we write NoFlip 𝑖 the event

{(𝑗 0 , … , 𝑗 𝑖-1 ) ← sample(context) 𝑖 , 𝑇 ← threshold(context), ∀0 ≤ 𝑙 < 𝑖, |h 𝑗 𝑙 ⋆ s| < 𝑇} .
This corresponds to the case where the algorithm iterates 𝑖 times without flipping any position since all sampled positions have a counter below the threshold.

We always suppose that the following hypothesis is true:

ℋ 0 ∶ |e| = 𝑡 -|𝐹| .
In other words, ℋ 0 assumes that all active flips have removed an error. However, when 𝑖 iterations have passed without a single flip, we "reject" this hypothesis if the event NoFlip 𝑖 has a low probability 𝛼 (e.g. 𝛼 = 0.05). Rejecting the hypothesis ℋ 0 here signifies that there was at least one flip in the queue 𝐹 that added an error. In this case, we cancel the first flip in 𝐹, i.e. the one that was performed the earliest in the execution of the algorithm.

Actual implementation of this algorithm relies on the adaptive threshold 𝑇 computation explained in §6.1.3.1. In the formula, we can use the syndrome weight |s|, and, under hypothesis ℋ 0 , we assume |e| = 𝑡 -|𝐹| in the formula.

The probability of NoFlip 𝑖 is found assuming independence of the sampled counters, using the sampled counters distributions 𝑝 sample 𝑖 ∈e (𝜎) and 𝑝 sample 𝑖 ∉e (𝜎) for 𝜎 ∈ {0, … , 𝑑} detailed above for 𝑖 = 0, 1, 2. We thus choose the value of max_iter(context) to be the smallest integer 𝑖 such that

( 𝑇 -1 ∑ 𝜎=0 𝑝 sample 𝑖 ∈e (𝜎) + 𝑝 sample 𝑖 ∉e (𝜎)) 𝑖 < 𝛼 .
Here also, in the formula, we can use the syndrome weight |s|, and, under hypothesis ℋ 0 , we assume |e| = 𝑡 -|𝐹|.

Further refinement of this algorithm and its reinsertion into a parallel paradigm resulted in the more performant Backflip algorithm presented in Chapter 8.

Chapter 8

Backflip

In this chapter, we describe a novel way of including soft information in a bit-flipping algorithm. Counters provide information about the reliability of positions. Classic bitflipping sets a threshold and flips all positions above this threshold. Our algorithm, Backflip, adds a finer granularity by bringing a concept of flip duration. The more reliable a flip is, the longer it remains active.

Decoding is seriously hindered by correct positions which have a high counter. Once flipped, they become errors with a rather low counter. If this phenomenon occurs several times during the same decoding, the algorithm will have effectively produced an instance whose errors are difficult to detect so that any subsequent iteration will not be able to improve the situation. Backflip solves this problem by ensuring that each flip is temporary.

With classic bit-flipping, the only way to reverse a bad decision, and thus to deflip an initially correct position, is if the iterations posterior to these bad flips have sufficiently modified the syndrome. This way, the distributions of the counters have been sufficiently modified so that the counters of incorrectly flipped positions are once again above the threshold. With Backflip, we have a second mechanism that, when decoding starts to stall, progressively cancels the old unreliable flips.

Our algorithm, introduces a new concept for bit-flipping: the duration of a flip, which we call ttl for "time to live". The intuition is that the algorithm should be more prone to quickly undo a less reliable flip and conversely to keep a very reliable flip for a longer period of time. Since the higher a counter is, the more likely it is to indicate an error, the ttl should be an increasing function of the counter. It should also be at least equal to one when a counter is above the threshold. We will explore two strategies for the ttl and the thresholds, which, as we will see, are closely related.

As mentioned in §7.4, the idea of unconditionally canceling old flips originated from the non-blocking variant of the step-by-step decoder. In addition to the fact that this algorithm is parallel, it also differs in the fact that it actually uses reliability information.

Algorithm description

The full description of Backflip is given in Algorithm 8.1. It must keep track of active flips and associate to each one of them their time to live. At the beginning of each iteration, the times to live are decremented and flips that have expired are canceled.

The two functions threshold and ttl are specified generically and are discussed later in this chapter. The former may depend on any element of the context of the algorithm at runtime, we will see here examples using the current syndrome weight |s ′ | and the number of active flips |e ′ |. The latter uses a counter, which, remember, gives information about the reliability of the flip.

𝐷 𝑗 ← 𝐷 𝑗 -1 ; if 𝐷 𝑗 = 0 then 𝑒 ′ 𝑗 ← 0 ; s ′ ← s -He ′ ⊺ ; 𝑇 ← threshold(context); for 𝑗 ∈ {0, … , 𝑛 -1} do if |h 𝑗 ⋆ s ′ | ≥ 𝑇 then 𝑒 ′ 𝑗 ← 1 -𝑒 ′ 𝑗 ; 𝐷 𝑗 ← ttl(|h 𝑗 ⋆ s ′ |) s ′ ← s -He ′ ⊺ ; return e ′ ;
Overhead compared to classic bit-flipping. First, the algorithm needs additional memory to store the longevity of the flips. An obvious upper bound on the space taken is simply log 2 (max_ttl) ⋅ 𝑛 bits. For a constrained hardware implementation, this memory could be reduced by adopting a sparse representation of the array D.

Regarding time complexity, this algorithm needs two syndrome computations for each iteration: one after some flips have been canceled and one to check if the looping condition is verified.

Constant time considerations can be taken into account by setting an upper bound that is sufficiently high for the size of D. Indeed, a decoding for which the number of active flips is, say, a multiple of the original error weight 𝑡 fails anyway with a probability very close to 1.

Threshold and time-to-live

The threshold and the ttl functions are closely linked and their choice must be made jointly in order to achieve good decoding performance. Two strategies are presented here, the first was introduced in [SV20a] and used in [BIKE] 1 , and the second one takes a different approach that achieves better decoding performance.

Optimistic threshold strategy

We present here a heuristic for thresholds based on the rationale that being overly optimistic about the weight of errors, i.e. assuming that each flip has removed an error, slows down the algorithm when it makes bad decisions. It slows the algorithm down by making fewer new flips, but those that are actually performed are more reliable, and meanwhile, the algorithm will undo some old flips that were potentially bad decisions thus improving the overall situation. Indeed, an optimistic estimation of the error weight would bring it to the initial error weight 𝑡 subtracted by the number of active flips |e ′ |. We will see that using the adaptive threshold explained in §6.1.3.1 while underestimating the current error weight increases the threshold.

𝑇 = ⎡ ⎢ ⎢ ⎢ ⎢ ⎢ 𝑑 log ( 1-𝜋 1 1-𝜋 0 ) + log ( 𝑛-(𝑡-|e ′ |) 𝑛-|e| ) log ( 1-𝜋 1 1-𝜋 0 ) + log ( 𝜋 0 𝜋 1 ) ⎤ ⎥ ⎥ ⎥ ⎥ ⎥ . (8.1)
Since the current error weight is guessed optimistically, it can happen that 𝜋 1 > 1 in which case the previous equation would not make sense. In this case, we take the limit of (8.1) when 𝜋 1 tends to 1, that is 𝑑.

Optimistic estimation of 𝑡 gives a higher threshold. Remember from §6.1.3 that, with adaptive thresholds, we have

𝜋 0 = (𝑤 -1) |s ′ | -𝑋 𝑑(𝑛 -|e + e ′ |) , 𝜋 1 = |s ′ | + 𝑋 𝑑 |e + e ′ |
where 𝑋 = ∑ 𝑗∈e+e ′ 𝜎 𝑗 -|s ′ |.

Since 𝑋 ≪ (𝑤 -1) |s ′ | and 𝑡 ≪ 𝑛, underestimating |e + e ′ | will always give an estimate of 𝜋 0 close to the true value. However, 𝜋 1 will tend to be overestimated.

In this case, the estimated distribution of the correct position counters would be close to reality and the estimated distribution of the error counters would be shifted to the right. Since the threshold is chosen as the smallest value at which the former is below the latter, the underestimation of the error weight would choose a threshold above the optimal. Time-to-live. We want the ttl to be an increasing function of the counter, we also want it to be nonzero when a counter is above the threshold. We choose a heuristic that verify those properties and also has only a few parameters: an affine function of the difference between the counter and the threshold. We write this difference 𝛿 = 𝜎 -𝑇 , then ttl(𝜎) = max(1, ⌊𝑎 𝛿 + 𝑏⌋) .

To highlight the importance of setting the ttl function, we show in Figure 8.1 its effect on the DFR for different values of 𝑎 and 𝑏. The appropriate value range seems for 𝑎 to be around 0.5 and 𝑏 around 1. If we deviate too much from these values, it could be detrimental for the DFR to the point that we can see a plateau. Optimization. As this strategy is heuristic, its specification is based on an optimization from simulation in the absence of theoretical analysis. In practice, we proceed by using the algorithm under degraded conditions by reducing the block size and limiting the number of iterations so that a DFR can be effectively measured in a reasonable number of simulation.

The values for 𝑎 and 𝑏 are then determined by applying an optimization technique such as the Nelder-Mead method [START_REF] John | A Simplex Method for Function Minimization[END_REF] that minimizes the DFR under these degraded conditions. Values obtained for [BIKE] parameters are reported in Table 8.1. Performance. The performance of the algorithm for BIKE parameters for 128 bits of security with the ttl function described above, found by optimization, is displayed in Figure 8.2. A notable fact is that, unlike the other bit-flip-derived algorithms seen previously, with this algorithm a gain is observed each time the number of iterations is increased, it appears that we still did not reach a limit after 100 iterations. Another noteworthy point is that it does better in 100 iterations than scaled belief propagation ( [START_REF] Liva | Protograph-based Quasi-Cyclic MDPC Codes for McEliece Cryptosystems[END_REF] with 𝜔 = 0.4), which was our benchmark. However, we observe an inflection point on the DFR curves corresponding to a small number of iterations.

Multiple thresholds strategy

This strategy follows from the above remark that, when choosing a threshold, two probabilities 𝜋 0 and 𝜋 1 are estimated. If the current error weight is misestimated, then 𝜋 1 is also misestimated, but it has little influence on the estimate of 𝜋 0 . The rationale for this threshold selection strategy is therefore to rely only on 𝜋 0 .

Threshold selection rule. Indeed, rather than finding, as in the previous one, a balance between good and bad decisions that ultimately reduces the error weight, we choose a threshold that simply avoids making bad decisions. Still in the model explained in §5.2, the expected number of good positions with a counter value of 𝜎 is approximately

𝑛( 𝑑 𝜎 )𝜋 𝜎 0 (1 -𝜋 0 ) 𝑑-𝜎 .
We therefore choose threshold(context) = threshold(|s|) = 𝑇 where T is the smallest integer such that:

𝑛( 𝑑 𝑇 )𝜋 𝑇 0 (1 -𝜋 0 ) 𝑑-𝑇 < 𝛼
for some fixed value 𝛼.

Time-to-live. We apply the same idea, namely that we want to avoid making bad decisions. In fact, the less likely a flip is to add an error, the longer it stays active. To do this, we define several thresholds 𝑇 = 𝑇 1 , 𝑇 2 , … , 𝑇 ℓ such that for all 𝑖 ∈ {1, … , ℓ}, 𝑇 𝑖 is the

𝑇 𝑖 0 (1 -𝜋 0 ) 𝑑-𝑇 𝑖 < 𝛼 𝑖 for some constants 𝛼 = 𝛼 1 > 𝛼 2 > ⋯ > 𝛼 ℓ > 0.
Finally, we choose ttl(𝜎) as

ttl(𝜎) = max 𝑖 {𝑖 | 𝜎 ≥ 𝑇 𝑖 } .

Performance.

As an example, we provide in Figure 8.3 the DFR curve for BIKE parameters offering 128 bits of security when implementing this method with 𝛼 1 = 8, 𝛼 2 = 2, 𝛼 3 = 1/2, 𝛼 4 = 1/8, 𝛼 5 = 1/32, i.e. when it follows a geometric progression of common ratio 1/4. As with the other strategy, each additional iteration brings a noticeable gain in the performance. And here again, the algorithm does better than the benchmark. However, interestingly, we do not observe any inflection point in this case.

Chapter 9

Gray decoders

In this chapter we will discuss some bit-flipping variants following a similar framework: the gray decoders. They provide a way to introduce soft information in bit-flipping. Rather than going through all the positions and making the binary decision to flip or not, they add an intermediate level of decision. Positions with a high counter but still below the threshold are neither black nor white but gray. Gray decoders can make immediate decisions on black positions (the probable errors), but for gray positions they may perform reverifications.

Reverifications are a powerful mechanism of gray decoders. They consist in, after performing several flips, immediately recomputing the corresponding counters to verify that they actually remain below the threshold. It allows immediate correction of most bad decisions.

In a bit-flipping algorithm, the first iteration is probably the most important, and it is also the one for which we can extract the most reliable information. Indeed, for the first iteration, the weight of the error is fixed and known, it is the parameter that we called 𝑡, and since the error pattern is drawn uniformly at random, it does not suffer from any bias that can sometimes contradict the models on the counters.

Contrary to classic bit-flipping, in gray algorithms, this first information obtained from the counters is exploited a bit more by not reiterating immediately. The positions with a high counter but below the threshold are marked to receive a specific treatment later, before moving on to the next iteration. Thus, compared to classic bit-flipping, some additional operations are performed, they concern a smaller set of positions, with a higher concentration of errors. The high concentration of errors in this set together with the reverifications generally allows to adopt a very simple but very efficient threshold strategy.

Framework

We will detail different alternatives through the structure of Algorithm 9.1. We consider a classification that will be done by means of counters. Many alternatives can be considered for further processing after flipping the black positions, we will see that the verification method which will be explained here can be used as a building block for a particularly efficient decoding.

Reverifications

One key aspect of the gray decoders is the reverification steps.

After an iteration of parallel bit-flipping, we can observe two types of behaviour for the counters for flipped positions. The counters corresponding to good flips will be greatly

′ ⊺ = s. e ′ ← 0; s ′ ← s; it ← 1; while s ′ ≠ 0 do 𝐺, 𝐵 ← classify(H, s ′ ); for 𝑗 ∈ 𝐵 do 𝑒 ′ 𝑗 ← 1 -𝑒 ′ 𝑗 ; s ′ ← s -He ′ ⊺ ; process(𝐺, 𝐵, it); it ← it + 1; return e ′ ;
decreased while those corresponding to bad flips will not. This can be observed in Figure 9.1 for a fixed threshold.

We can thus improve the performance of the algorithm by filtering the flipped positions. After a bit-flipping iteration, we perform a verification step which consists in • recalculating the counters of the flipped positions,

• among those, flipping those with a counter above a threshold 𝑇 𝑣 .

In our experiments, it was not necessary to choose a threshold in a sophisticated way and taking 𝑇 𝑣 = (𝑑 + 1)/2 brought us good results. As we can see in the Figure 9.1 for example, most flipped errors should have a counter below this threshold, and the errors that were added would be above it with a high probability. Some good flips could be reverted and some bad flips could be kept, but overall the situation is better.

The same principle can be applied to the gray positions, i.e. those with a counter above some threshold 𝑇 𝑔 < 𝑇. The performance of such a method for different block sizes are compared in Figure 9.2. Two observations can be made from this data:

• the reverifications lead to a decrease of ≈ 30% in the error rate compared to the classic bit-flipping, for large block sizes,

• iterating the process more than once is only interesting for smaller block sizes.

Simple definition

Simply applying the reverification idea to the framework we obtain the algorithm specified in Algorithm 9.2 for some gray threshold function threshold 𝑔 and a number 𝐼 𝐺 of gray iterations. This algorithm appeared in one of our previous works [START_REF] Vasseur | Cryptographie post-quantique : étude du décodage des codes QC-MDPC[END_REF]. In this document we will focus on the variants presented in [START_REF] Drucker | QC-MDPC Decoders with Several Shades of Gray[END_REF], as they have shown interesting performance, have a constant-time implementation and are now included in the specification [BIKE].

Variants from Drucker, Gueron & Kostic

In [START_REF] Drucker | QC-MDPC Decoders with Several Shades of Gray[END_REF], four variants of gray decoders were defined, their definitions are synthesized in Algorithm 9.3. The authors suggest using 𝛿 = 3 as the fixed difference between the black threshold and the gray threshold: 𝑇 𝑔 ∶= 𝑇 -𝛿.

Comparison.

To compare the different variants, we consider one iteration at each update of the syndrome that forces the recalculation of the counters. This corresponds to the number of iterations of the while loop plus the number of calls to the iterate function.

Threshold. Authors of [START_REF] Drucker | QC-MDPC Decoders with Several Shades of Gray[END_REF] proposed to use the thresholds used for the One-Round decoder in [BIKE] for versions prior to 3.2. These thresholds were defined as the image of an affine function of the syndrome weight. Indeed, when we restrict the domain to a range of syndrome weight around its average value, the threshold formula approaches an affine function. The actual threshold function was determined using the method of least squares on that range. Functions thus obtained for BIKE parameters offering 128 bits of security but for different block sizes 𝑟 are presented in Table 9.1.

Furthemore, to avoid a potential problem identified through the study of error floors that we will see in Chapter 16, we set a lower bound on the threshold:

threshold(|s ′ |) = max ((𝑑 + 1)/2, ⌊𝑎 |s ′ | + 𝑏⌋) .
In Figure 9.4, we can see the effects that the choice of the threshold function has on the DFR curve. In particular, we can see that it has an influence on the point where the DFR starts to decrease sharply (the waterfall) and on the slope beyond this point. It appears that the larger the block size 𝑟 chosen to affinely approximate the threshold function, the later the waterfall. And with a small block size 𝑟 the slope will not be as steep.

Performance. The performance of the BGF algorithm for BIKE parameters for 128 bits of security is displayed in Figure 9.5. We can see that a plateau seems to be reached with

Sorting variant

Algorithm 9.4 also uses the principle of gray decoding but is not based on computing thresholds. The idea is first to sort the positions in descending order of their counters.

Then we define a gray area that contains the 𝑁 𝑔 positions that have the largest counters because they are the most likely to be errors. We then iterate on these positions always keeping the same order defined by the initial counters. For each position we compute the corresponding counter and immediatly flip it and update the syndrome if it is over the majority vote threshold (𝑑 + 1)/2.

As the first positions have the highest counters, they are all the more likely to be errors. This is why this algorithm will, in a first phase, eliminate many errors. The error weight will then be further reduced with reverifications.

As only a few errors are expected to remain after this process, a step-by-step decoder is used as a final step.

′ ⊺ = s. e ′ ← 0; s ′ ← s; Sort positions 𝑗 0 , 𝑗 1 , … , 𝑗 𝑛-1 so that ∀𝑖 < 𝑖 ′ , |h 𝑗 𝑖 ⋆ s| ≥ |h 𝑗 𝑖 ′ ⋆ s|; for ℓ = 1, … , 𝑁 do for 𝑖 = 0, … , 𝑁 𝑔 do if |h 𝑗 𝑖 ⋆ s ′ | ≥ (𝑑 + 1)/2 then 𝑒 ′ 𝑗 ← 1 -𝑒 ′ 𝑗 ; s ′ ← s ′ + h 𝑗 ; return e ′ + step_by_step_bitflip ⟂ (H, s ′ );
Figure 9.6 shows the performance of this algorithm with 𝑁 𝑔 = 𝑛/10 and 𝑁 = 10. It therefore requires the computation of 𝑛 counters in the first gray step and a few more that come from the step-by-step algorithm.

The additional cost of sorting positions must also be taken into account. Finding the 𝑁 𝑔 positions with the largest counters can be done with a max-heap in time in 𝑂(𝑛 log(𝑁 𝑔 )). Sorting is done in time 𝑂(𝑁 𝑔 log(𝑁 𝑔 )).

Some components of the sorted gray decoder were incorporated in the design of the One-Round algorithm that was chosen in [BIKE] from version 1 to version 3.2. (𝑑, 𝑡) = (71, 134). 99%-confidence intervals.

Part III

Analysis of bit-flipping decoders for QC-MDPC

To see what happen on the check nodes side, we refer to Proposition 1.14 in the preliminary chapter. Using this result, we can say that at iteration #𝑖, each check node involves an even number of errors with probability 1-(1-2𝑝 𝑖 ) 𝑤

2

. Using the threshold 𝑇 𝑖+1 , the probability that an error was received but corrected at iteration #(𝑖 + 1) is

𝜖 𝑑-1 ∑ 𝑠=𝑇 𝑖+1 ( 𝑑 -1 𝑠 ) ( 1 + (1 -2𝑝 𝑖 ) 𝑤 2 ) 𝑠 ( 1 -(1 -2𝑝 𝑖 ) 𝑤 2 )
𝑑-1-𝑠 , and on the contrary, the probability that a bit was correctly received but was mistakenly flipped is

(1 -𝜖) 𝑑-1 ∑ 𝑠=𝑇 𝑖+1 ( 𝑑 -1 𝑠 ) ( 1 -(1 -2𝑝 𝑖 ) 𝑤 2 ) 𝑠 ( 1 + (1 -2𝑝 𝑖 ) 𝑤 2 )
𝑑-1-𝑠 .

In the end the error rate at iteration #(𝑖 + 1) is simply

𝑝 𝑖+1 = 𝜖 -𝜖 𝑑-1 ∑ 𝑠=𝑇 𝑖+1 ( 𝑑 -1 𝑠 ) ( 1 + (1 -2𝑝 𝑖 ) 𝑤 2 ) 𝑠 ( 1 -(1 -2𝑝 𝑖 ) 𝑤 2 ) 𝑑-1-𝑠 + (1 -𝜖) 𝑑-1 ∑ 𝑠=𝑇 𝑖+1 ( 𝑑 -1 𝑠 ) ( 1 -(1 -2𝑝 𝑖 ) 𝑤 2 ) 𝑠 ( 1 + (1 -2𝑝 𝑖 ) 𝑤 2 )
𝑑-1-𝑠

.

One can then choose the thresholds 𝑇 𝑖 that minimize the probabilities 𝑝 𝑖 for all 𝑖. For a sufficiently large code length and a sufficiently small value of 𝜖, 𝑝 𝑖 converges to 0 as 𝑖 tends to infinity. Density Evolution. The method developed by Gallager has then been extended to various channels, for soft-decision algorithms and irregular codes, see for example [START_REF] Thomas | The capacity of low-density parity-check codes under message-passing decoding[END_REF][START_REF] Michael G Luby | Improved low-density parity-check codes using irregular graphs[END_REF]. It is usually referred to as the density evolution method.

Expander codes arguments

There is an important notion in graph theory called the expansion. In [START_REF] Sipser | Expander codes[END_REF], it has been shown that the bit-flipping algorithm (either sequential or parallel) succeeds as long as the Tanner graph of the code has sufficiently good expansion. The bit-flipping algorithms considered operate according to a majority vote rule, or in other words they use the fixed threshold (𝑑 + 1)/2.

The following proposition tells us that a random regular graph is a good expander.

Proposition 10.2. Let 𝐵 be a (𝑑, 𝑤) regular bipartite graph of 𝑛 𝑑-regular nodes on the left and (𝑑/𝑤) ⋅ 𝑛 𝑤-regular nodes on the right. Then with exponentially high probability, for any 𝛼 ∈ (0, 1), any set 𝑆 of size 𝛼 ⋅ 𝑛 has at least

𝑛 ⎛ ⎜ ⎝ 𝑑 𝑤 (1 -(1 -𝛼) 𝑤 ) -√ 2𝑑𝛼 H(𝛼) log 2 𝑒 ⎞ ⎟ ⎠ neighbors.
Then any reasonably good expander code can be decoded with a bit-flipping algorithm.

Theorem 10.3. [START_REF] Sipser | Expander codes[END_REF]Theorem 10 & 11] Let 𝐵 be a (𝑑, 𝑤) regular bipartite graph of 𝑛 𝑑-regular nodes on the left and (𝑑/𝑤) ⋅ 𝑛 𝑤-regular nodes on the right. If 𝐵 is a (𝛼, 3/4 + 𝜖) expander, for any 𝜖 > 0, then the sequential and the parallel bit-flipping algorithms correct up to 𝛼 ⋅ 𝑛/2 errors. The former does so in a linear number of flips and the latter in 𝑂(log 𝑛) iterations.

Analysis of regular LDPC codes with a bit-flipping algorithm

In [START_REF] Burshtein | On the Error Correction of Regular LDPC Codes Using the Flipping Algorithm[END_REF], Burshtein analyzed the parallel bit-flipping algorithm as defined by Sipser and Spielman in [START_REF] Sipser | Expander codes[END_REF]. The Tanner graph of an LDPC code is decomposed in several parts:

• the set of unsatisfied equations 𝒥,

• the set of satisfied equations 𝒦,

• the set of good positions 𝒢,

• the set of bad positions ℬ.

The sets 𝒢 and ℬ are then further decomposed depending on whether the counter values are above or below a threshold that corresponds to a majority vote. They enumerate all the possible configurations of these sets and get a bound on the number of problematic configurations using generating functions. They show that, asymptotically when 𝑛 goes to infinity, for all codes of length 𝑛, a large proportion can decode any error pattern of weight 𝛼𝑛 for any value 𝛼 < 𝛼 0 . The limit value 𝛼 0 is obtained by finding the value that maximizes a certain function.

In their proof, they start by describing all "possibly bad" configurations, i.e. the only configurations in which the algorithm would increase the error weight after an iteration. These configurations are described according to the number of vertices in the aforementioned subsets in the Tanner graph and the number of edges between them. They then determine the probability that a random regular code exists in one of these configurations. The probability of existence of a "bad" code is bounded by simply giving the same weight to any configuration. In the end, the result is very interesting because of its asymptotic significance but less so for practical use. For example, in the case of a regular LDPC code of length 1 000 000, column weight 5 and row weight 10; it can only show that at least 14% of the codes can correct any error configuration with a weight of 13 or less.

MDPC codes

The difference between LDPC codes and MDPC codes is in the degree of the nodes in their Tanner graph. While it is rather small (usually a few units) for the former, for the latter it is closer to one hundred for cryptographically relevant parameters (i.e. more than 128 bits of security). So, a typical MDPC code has many short cycles in his Tanner graph (and it cannot be considered to be a tree anymore) and on top of that we add a quasi-cyclic structure. Therefore we cannot completely rely on the same assumptions as Gallager's analysis.

Leveraging the syndrome weight for decoding

We have already presented the counters model from [START_REF] Chaulet | Étude de cryptosystèmes à clé publique basés sur les codes MDPC quasi-cycliques[END_REF] in Chapter 5. Determining the error after the first iteration of a parallel bit-flipping is akin to determining the distributions of the number of positions with a counter above the threshold on one side for the positions in error and on the other for the correct positions. With an assumption of mutual independence of all counters, these two distributions are binomial and one can then calculate the number of error remaining with a convolution. However, it is observed in [START_REF] Chaulet | Étude de cryptosystèmes à clé publique basés sur les codes MDPC quasi-cycliques[END_REF] that this model gives inaccurate predictions both in the case where the counters model uses the syndrome weight and in the case where it does not.

Asymptotic analysis

In [START_REF] Tillich | The decoding failure probability of MDPC codes[END_REF], the decoding of MDPC codes is studied for a code of arbitrarily large length 𝑛 with the additional restriction that the row weight 𝑤(𝑛) is in Θ( √ 𝑛). Two algorithms are considered. The first is deterministic, and it is shown that, for an MDPC code, with a sufficiently large code length 𝑛 and with some restriction on the intersections of the columns of the parity check matrix, a majority logic decoder can decode any error pattern of weight 𝑡(𝑛) where 𝑡(𝑛) = Θ (

√ 𝑛 log log 𝑛 log 𝑛
). The second algorithm is based on a probabilistic counter model for MDPC codes and uses asymptotic bounds.

Deterministic analysis. The central proposition for this analysis is the following, its proof uses Tanner graph arguments that remind the ones used in [START_REF] Sipser | Expander codes[END_REF].

Proposition 10.4. [Til18b, Proposition 1] Consider a code with a parity check matrix for which every column has weight at least 𝑑 and whose maximum column intersection is 𝐼. Performing majority-logic decoding based on this matrix (i.e. Algorithm 6.2 with 𝑇 = (𝑑 + 1)/2) corrects all errors of weight ≤ 𝑑/(2𝐼).

Proof. The original proof from the paper considers the Tanner graph and looks at the properties of certain subgraphs according to the degree of their nodes. We can reformulate it to adopt a more algebraic point of view.

Let us write H an 𝑟 × 𝑛 parity check matrix of column weight at least 𝑑 as

H = (h 0 h 1 ⋯ h 𝑛-1 )
where h 0 , … , h 𝑛-1 are the columns of H. We suppose that H has a maximum column intersection of 𝐼 i.e. • If 𝑖 ∈ Supp(e),

∀𝑖, 𝑗

𝜎 𝑖 = |h 𝑖 + ∑ 𝑗∈Supp(e)∖{𝑖} h 𝑖 ⋆ h 𝑗 | ≥ |h 𝑖 | -∑ 𝑗∈Supp(e)∖{𝑖} |h 𝑖 ⋆ h 𝑗 | ≥ 𝑑 -(|e| -1)𝐼 .
• If 𝑖 ∉ Supp(e),

𝜎 𝑖 = |∑ 𝑗∈Supp(e) h 𝑖 ⋆ h 𝑗 | ≤ ∑ 𝑗∈Supp(e) |h 𝑖 ⋆ h 𝑗 | ≤ |e| 𝐼 .
One then easily verifies that when 𝑇 = (𝑑 + 1)/2 and |e| ≤ 𝑑/(2𝐼), we have

∀𝑖 ∉ Supp(e), ∀𝑖 ′ ∈ Supp(e), 𝜎 𝑖 < 𝑇 ≤ 𝜎 𝑖 ′ .
This decoder is envisaged in combination with some key filtering. In fact, when 𝑛 grows, and the column weight is in 𝑂( √ 𝑛), it is shown that the maximum column intersections is in 𝑂 ( log 𝑛 log log 𝑛 ) with high probailty. Introducting some filtering in the key generation method would exclude the cases where it is above said bound. And together with the previous proposition, it proves that for some sufficiently large code length 𝑛, a majority logic bit-flipping algorithm decodes any error pattern of weight in 𝑂 (

√ 𝑛 log log 𝑛 log 𝑛
).

Asymptotic statistical model. The model assumes the following properties:

• the counters are mutually independent,

• the counters of erroneous positions follow a binomial distribution:

𝑗 ∈ e ⇒ 𝜎 𝑗 ∼ Bin(𝑑, 𝜋 1 )
for some "success" probability 𝜋 1 ,

• the counters of correct positions follow a binomial distribution:

𝑗 ∉ e ⇒ 𝜎 𝑗 ∼ Bin(𝑑, 𝜋 0 )

for some "success" probability 𝜋 0 .

In this model the "success" probabilities are determined assuming independence of the syndrome bits and in the context where both the row weight 𝑤(𝑛) and the error weight Synthesis. In the paper, three different types of decoding scenarios are finally envisaged.

𝑡(𝑛) are in 𝑂( √ 𝑛). It is shown that, in this context ∀𝑏 ∈ {0, 1}, 𝜋 𝑏 = 1 2 -(-1) 𝑏 𝜖 ⎛ ⎜ ⎝ 1 2 + 𝑂 ( 1 √ 𝑛 ) ⎞ ⎟ ⎠ with 𝜖 = 𝑒 -2𝑤𝑡 𝑛 .
• Do one iteration and choose parameter so that the deterministic bound guarantees a zero probability of failure.

• Do two iterations so that, using the probabilistic model, the error weight after the first iteration is below the deterministic bound.

• Do two iterations so that, using the probabilistic model, the error weight after the first iteration is below some arbitrary bound (1 -𝛼)𝑡(𝑛) for some constant 𝛼 < 1.

Numerical applications show that the parameters from [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from Moderate Density Parity-Check codes[END_REF] providing 80 bits of security should have their code length multiplied by ∼ 427 (row weight also has to be multiplied by ≃ 45) with the first method and ≃ 2 in the other scenarios.

LEDAcrypt

The authors of the QC-MDPC cryptosystem LEDAcrypt described a model for the decoder in their submission [LEDA], it follows a previous article [START_REF] Santini | Hard-decision iterative decoding of LDPC codes with bounded error rate[END_REF]. As in [START_REF] Tillich | The decoding failure probability of MDPC codes[END_REF], they adopt a probabilistic approach followed by a deterministic one, but in this case not in an asymptotic context. The probabilistic model is close to the analysis of Gallager discussed previously for LDPC codes.

Statistical models. Two different types of decoders are considered, the in-place decoder and the out-of-place decoder. The former is quite similar to the step-by-step decoder, in the sense that it is sequential, it updates the syndrome after each flip. However, with this one, during an iteration, each one of the 𝑛 positions is visited exactly once, but in a random order. The latter is a parallel bit-flipping.

In the document, they make the following assumptions:

• the parity check matrix H is random and regular, it has a column weight 𝑑 and row weight 𝑤,

• the error pattern e is drawn uniformly at random among the vectors of weight 𝑡 and length 𝑛,

• the syndrome bits are mutually independent.

The out-of-place decoder analysis assumes the independence of the counters values and uses it to find the error weight after one iteration. This is essentially similar to the work done in [START_REF] Chaulet | Étude de cryptosystèmes à clé publique basés sur les codes MDPC quasi-cycliques[END_REF], without the conditioning on the syndrome weight.

The analysis seems to some extent appropriate for a single iteration given the examples provided. However, in [LEDA], this analysis is not further iterated. This is undoubtedly due to the discrepancies (which increase with the number of iterations) between this model and the simulation already highlighted in [START_REF] Chaulet | Étude de cryptosystèmes à clé publique basés sur les codes MDPC quasi-cycliques[END_REF].

Based on assumptions reminiscent of what had been done previously in [SV19] that will be presented in Chapter 12, they model the decoder as a Markov chain. However, in [LEDA], they define a Markov chain that only tracks the error weight. Indeed, they assume that the error weight after an iteration depends only on what it was before. The error pattern is always considered to be taken uniformly at random among all the vector of fixed Hamming weight. In addition, they address the fact that, contrary to the step-by-step algorithm, the in-place decoder is not fully randomized, and they consider the worst order possible for visiting the positions.

Combinatorial bound. The reference documentation [LEDA] provides an intersecting improvement over the bound proven in [START_REF] Tillich | The decoding failure probability of MDPC codes[END_REF]. Given a simply calculated characteristic of the code, it is shown that one can decode any error pattern whose weight is bounded by some constant. Rather than relying on the maximum column intersection, they use a finer characterization of the matrix. Remember that in the proof of Proposition 10.4 we only used the triangle inequality to bound the counter values. We then upper bounded the following quantities by bounding each term of

∑ 𝑗∈Supp(e)∖{𝑖} |h 𝑖 ⋆ h 𝑗 | and ∑ 𝑗∈Supp(e) |h 𝑖 ⋆ h 𝑗 |
individually. This was a very rough upper bound because for any column, all the other columns do not necessarily intersect with it in exactly 𝐼 rows, the maximum. The finer bound used in [LEDA] is based on the calculation of the 𝑛 × 𝑛 matrix 𝚪 which keeps a record of the number of intersections between all the pairs of columns:

∀𝑖, 𝑗 ∈ {0, … , 𝑛 -1}, Γ 𝑖,𝑗 = |h 𝑖 ⋆ h 𝑗 | .
Upper bounding the above sums is then a matter of finding the |e| largest elements in the 𝑖-th row of 𝚪.

A rather interesting feature of the 𝚪 matrix is that it is symmetric and also quasi-cyclic if H is quasi-cyclic as well. This allows for a fast computation of 𝚪 that is used for filtering keys in [LEDA].

Synthesis. Similarly to one of the scenarios proposed in [START_REF] Tillich | The decoding failure probability of MDPC codes[END_REF], they propose a twoiterations decoder modeled, for the first iteration, with the above statistical model, followed by an iteration whose outcome is deterministic. This also implies some sort of key filtering. Some curves showing the predictions of the DFR in this model compared to simulation is presented in [LEDA]. However, they were done with the parameters offering 80 bits of security of [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from Moderate Density Parity-Check codes[END_REF] and not for actual LEDA parameters.

Contributions

One of the difficulties encountered in the analysis of a QC-MDPC decoder is the fact that many correlations appear and are difficult to take into account. It is often tempting to make independence hypotheses about certain variables involved in the analysis. However, there are at least two factors that can challenge these hypotheses.

• The codes of interest are quasi-cyclic and therefore regular, this regularity adds correlations between the parity check equations compared to a completely random code. Such correlations occur, for example, when dealing with variables related to the syndrome weight or the counters.

• The decoding algorithms are iterative and the operations performed during each iteration further divert the error pattern from a random pattern. For example, bit-flipping flips in priority positions involved in many unsatisfied equations, the resulting error vector will generally give a lower syndrome weight than what is expected for a uniformly random pattern: the error positions are therefore correlated in a way that depends on the parity check equations.

It is rather challenging to find a good model that captures most of the characteristics of the codes and the algorithm without increasing the complexity of the calculations to the point of making them unfeasible. We will see two models that seek, each in its own way, to address these issues.

The first one attempts to take into account the quasi-cyclicity of the code. We will see that it is fairly accurate to predict the outcome of one iteration of a parallel bit-flipping algorithm. It is then tempting to design a decoder that is suitable for this analysis and whose performance would therefore be evaluated within the framework of a very credible model. One disadvantage of this method is that the model assumes that the error pattern is uniformly random and can therefore only be used for the first iteration. The analysis of the subsequent iteration relies on weaker assumptions, which greatly increase the upper bound on the DFR that can be proven.

The second model assumes a Markovian behaviour. In an effort to capture the correlations arising from the iterative nature of the decoder, this model tracks the evolution of the syndrome weight and the error weight of a step-by-step decoder. An interesting result of this model is that it gives an idea of the shape of the DFR curve of a fully iterative decoder for code length that are unreachable with simulations.

Compared to previous works, these two models make it possible to evaluate algorithms with efficient adaptive thresholds that depend on the syndrome weight. When defining the first model, we re-examine the various independence assumptions made in previous work and propose a better approach. This completes [START_REF] Chaulet | Étude de cryptosystèmes à clé publique basés sur les codes MDPC quasi-cycliques[END_REF] in which a discrepancy was already noted.

Chapter 11

One iteration of the parallel decoder with variable thresholds

Our goal, in this chapter, is to analyze one iteration of the parallel bit-flipping decoder with a threshold rule that is a function of the syndrome weight (see Algorithm 11.1). Its for loop is perfectly parallel and the decision to flip does not depend on other decisions. We will show that when e 0 is drawn uniformly at random and the parity check matrix H is regular, we can find the joint distribution of 𝑆 0 and 𝑋 0 . The values 𝑆 0 and 𝑋 0 are really central to our model because they carry a lot of information about the counters distributions. We will then determine the counters distributions more accurately than in Chapter 5. We will see that this accuracy is needed to compute the distribution of 𝑡 1 . Finally, we propose a possible approach to determine 𝑆 1 .

It should be noted that 𝑆 0 is a piece of information that the algorithm can measure and use but 𝑋 0 is not, as it implies already knowing the support of the error pattern e 0 (which is the whole point of decoding). One strength of this model is that it lets us use an adaptive threshold for decoding. Our threshold choices are thus based on the syndrome weight 𝑆 0 but not on the value 𝑋 0 .

Compared to previous analyses reviewed in the state of the art, this model takes into account some correlations implied by the regularity of the quasi-cyclic code.

Convolutions. Numerical computations in this model require the calculation of many convolution powers of probability mass functions. Although the best algorithm to perform this operation is the fast Fourier transform, it is very sensitive to rounding errors if used with floating point arithmetic. This is particularly problematic when dealing with values such as probabilities that can range from 10 -40 to 1 and when the same magnitude is expected in the result.

In the one-dimensional case, the calculation by direct convolution of a vector of length 𝑚 with a vector of length 𝑛 has a complexity of 𝑂(𝑚𝑛). Now, the 𝑁-th convolution power of a vector of length 𝑛 can be realized using a fast exponentiation algorithm. In this case, a maximum of 2 log 2 (𝑁 ) convolutions are needed between vectors of length at most (respectively at each step): 𝑛, 3𝑛, … , (2 𝑖 -1)𝑛, … The total complexity of this method is thus 𝑂(𝑁 2 𝑛 2 ).

In this chapter, propositions are written using multidimensional random variables for brevity and convenience in writing proofs. The convolutions of these variables can be computed by reducing them to the one-dimensional case using, for example, the following property

Pr [∑ 𝑖 (𝑋 𝑖 , 𝑌 𝑖 ) = (𝑥, 𝑦)] = Pr [∑ 𝑖 𝑌 𝑖 = 𝑦 | ∑ 𝑖 𝑋 𝑖 = 𝑥] ⋅ Pr [∑ 𝑖 𝑋 𝑖 = 𝑥] .
The random variable ∑ 𝑖 𝑋 𝑖 will generally follow a binomial distribution. And the calculation of Pr [∑ 𝑖 𝑌 𝑖 = 𝑦 | ∑ 𝑖 𝑋 𝑖 = 𝑥] can be done with one-dimensional convolutions.

Notations

We adopt the following notations in this chapter.

General.

• The set ℰ 𝑛,𝑡 is set of all the error patterns of weight 𝑡 • The indicator function of a set 𝑆 is the function defined as

1 𝑆 (𝑥) ∶= { 1 if 𝑥 ∈ 𝑆, 0 if 𝑥 ∉ 𝑆.
Coding theory.

• We denote the syndrome weight corresponding to a certain error parttern 𝑆 = |s| s = He ⊺ , .

• For a position 𝑗 ∈ {0, … , 𝑛 -1}, we write its counter 𝜎 𝑗 ∶= |h 𝑗 ⋆ s| .

• We write 𝑋 = ∑ 𝑗∈e 𝜎 𝑗 -𝑆 .

• The definitions of 𝜎 𝑖 , E ℓ , 𝑆 and 𝑋 depend on a specific parity check matrix H and an error pattern e. These dependencies will always be evident from the context and are therefore not explicitly mentioned so as not to clutter the notations.

Probability.

• If 𝑝 𝑋 and 𝑝 𝑌 are respectively the probability mass functions of some independent random variables 𝑋 and 𝑌 then the probability mass function of their sum is the convolution

𝑝 𝑋+𝑌 (𝑧) = ∑ 𝑥+𝑦=𝑧 𝑝 𝑋 (𝑥) ⋅ 𝑝 𝑌 (𝑦) .
We denote it as 𝑝 𝑋 * 𝑝 𝑌 .

• The convolution operation is associative and we can thus consider the 𝑁-fold iteration of the convolution of a probabily mass function 𝑓 with itself. We denote it as • We will need to calculate conditional distributions from a joint distribution 𝑓. In this case, we will write 𝑁 𝑓 the associated normalization factor.

𝑓 * 𝑁 =

Mass equations in regular codes

Let H ∈ ℋ 𝑑,𝑤,𝑟×𝑛 ⊂ 𝔽 𝑟×𝑛 2 be a quasi-cyclic parity check matrix of column weight 𝑑 and row weight 𝑤 = 2𝑑. Let e ∈ ℰ 𝑛,𝑡 ⊂ 𝔽 𝑛 2 be an error pattern of Hamming weight 𝑡. We write the syndrome as s = He ⊺ .

To start our analysis, let us first apply two permutations P ∈ 𝔽 𝑟×𝑟 2 and Q ∈ 𝔽 𝑛×𝑛 2 to H, e and s:

H ′ = PHQ -1 e ′ = eQ ⊺ s ′ = Ps so that we have s ′ = H ′ e ′ ⊺ in the configuration illustrated in Figure 11.1. This transformation has no impact on the outcome of the parallel decoding process written in Algorithm 11.1 as the counters are unchanged and, since the algorithm is parallel, reordering the positions has no impact on its performance.

𝐴 𝐵

𝐶 𝐷 In the continuation of this chapter, we will define random variables describing each row (or column), then the consideration of these mass equations is essentially a matter of summing these random variables and conditioning the probabilities according to said sums.

H ′ 1 1 0 0 𝑆 𝑟 -𝑆 s ′⊤ 0 0 1 1 𝑛 -𝑡 𝑡 e ′
Remark 11.1. In previous works, following [START_REF] Chaulet | Étude de cryptosystèmes à clé publique basés sur les codes MDPC quasi-cycliques[END_REF], the value 𝑋 is usually defined as the sum 𝐸 3 + 𝐸 5 + ⋯ where 𝐸 ℓ is, for any positive integer ℓ, the number of equations affected by exactly ℓ errors. Here we take a slightly different point of view, 𝑋 = (∑ 𝑗∈e 𝜎 𝑗 ) -𝑆. The case 𝑋 = 0 is the one where there is exactly one error per unsatisfied equation. In this case, flipping one error will never decrease the counters of the other errors. In a way, 𝑋 measures the deviation from the case 𝑋 =0.

Remark 11.2. There is a notable link to be made between this work and Burshtein's work in [START_REF] Burshtein | On the Error Correction of Regular LDPC Codes Using the Flipping Algorithm[END_REF]. The translation between their notation and ours are

𝛼 = 𝑡 𝑛 , 𝜋 0 = 𝑆 𝑟 , 𝜔 0 = ∑ 𝑗∈e 𝜎 𝑗 𝑑𝑛 = 𝑆 + 𝑋 𝑑𝑛 .
In this chapter, we will show formulas to compute the number of good (resp. bad) positions flipped after one iteration. With Burshtein's notation, 𝛾 1,2 is the proportion of positions that are bad but not flipped after one iteration and 𝛿 1,2 is the proportion of positions that are good but flipped.

Modeling the error weight after the first iteration

In this section, we will derive a probabilistic model that allows, among other things, to determine the weight of the error after an iteration. All probabilities will be conditioned by the mass equations in §11.2 and we will see that this approach allows us to get really close to the statistics obtained with decoding simulation for quasi-cyclic codes. We will focus on proving every result by clearly stating the assumptions, and we will motivate the complexity of the model by comparing it to models that do not verify the mass equations.

Estimating the number of errors per equation

We first recall the following proposition, which is rather standard in coding theory.

Proposition 11.3. Let H be drawn uniformly at random in ℋ 𝑑,𝑤,𝑟×𝑛 and e drawn uniformly at random in ℰ 𝑛,𝑡 . For any 𝑖 ∈ {0, … , 𝑟 -1}, the number of errors involved in the 𝑖-th equation 𝜌 𝑖 ∶= |h ⊺ 𝑖 ⋆ e| follows the distribution below, conditioned on the syndrome bit value 𝑠 𝑖 ∈ {0, 1},

Pr[𝜌 𝑖 = ℓ | 𝑠 𝑖 ] = 𝑔 𝑠 𝑖 (ℓ) 𝑁 𝑔 𝑠 𝑖 for ℓ ∈ {0, … , min(𝑤, 𝑡)}, with 𝑔 𝑎 (ℓ) = ( 𝑤 ℓ )( 𝑛-𝑤 𝑡-ℓ ) ( 𝑛 𝑡 ) 1 𝑎+2ℤ (ℓ) , 𝑎 ∈ {0, 1}
and 𝑁 𝑔 0 and 𝑁 𝑔 1 are the normalization constants:

𝑁 𝑔 1 = ∑ ℓ is odd ( 𝑤 ℓ )( 𝑛-𝑤 𝑡-ℓ ) ( 𝑛 𝑡 ) , 𝑁 𝑔 0 = 1 -𝑁 𝑔 1 .
Proof. By definition of the matrix-vector product in 𝔽 2 , since s = He ⊺ , for any 𝑖 ∈ {0, … , 𝑟 -1}, 𝜌 𝑖 is the number of errors implied in h ⊺ 𝑖 . Since h ⊺ 𝑖 and e are drawn uniformly at random among vectors of weight respectively 𝑤 and 𝑡, said number follows a hypergeometric distribution. Conditioning the probabilities on the value modulo 2 of this sum is then only a question of separating the distributions according to the parity and then normalizing them.

In Table 11.1, we can see the decay of these probabilities as ℓ increases with [BIKE] parameters offering 128 bits of security.

Estimating the syndrome weight and the sum of the counters

In the following proposition we give the distribution of the syndrome weight and the sum of the counters when the error is uniformly distributed of weight 𝑡 and the matrix H is regular. where 𝜁 is defined on {0, 1} × {0, … , 𝑤} 2 with, for 𝑎 ∈ {0, … , min(𝑤, 𝑡)},

⎧ { ⎨ { ⎩ 𝜁(0, 0, 𝑎) = ( 𝑤 𝑎 )( 𝑛-𝑤 𝑡-𝑎 ) ( 𝑛 𝑡 ) if 𝑎 is even , 𝜁(1, 𝑎, 0) = ( 𝑤 𝑎 )( 𝑛-𝑤 𝑡-𝑎 ) ( 𝑛 𝑡 ) if 𝑎 is odd .
and 𝜁 is zero elsewhere;

𝑁 𝜁 = ∑ 𝑘,ℓ
𝜁 * 𝑟 (𝑘, 𝑘 + ℓ, 𝑑𝑡 -𝑘 -ℓ) .

Proof. For a parity check equation h ⊺ 𝑖 of H, we consider the three-dimensional random variable 𝑅 𝑖 = (𝑠 𝑖 , 𝑠 𝑖 ⋅ ℓ, (1 -𝑠 𝑖 ) ⋅ ℓ) where ℓ is the number of errors involved in this equation (i.e. ℓ = |h ⊺ 𝑖 ⋆ e|) and 𝑠 𝑖 is the 𝑖-th bit of the syndrome, so, by definition 𝑠 𝑖 = ℓ mod 2. The distribution of this random variable is given by 𝜁, we have already discussed in the proof of Proposition 11.3 that it follows a hypergeometric distribution.

The sum of 𝑟 independent random variables of this type follows the distribution given by 𝜁 * 𝑟 . In this sum, the first coordinate represents the number of unsatisfied equations, the second is the sum of the number of errors in the unsatisfied equations, and the third is the sum of the number of errors in the satisfied equations.

The proposition is obtained by conditioning the probabilities for the coordinates to verify (11.1).

Remark 11.5. However, the syndromes we consider all correspond to error patterns of the same weight 𝑡, and the parity check matrix is column-regular with column weight 𝑑. Under these conditions, the syndrome weight necessarily has the same parity as 𝑑 ⋅ 𝑡 (see Corollary 1.27). Taking this in consideration, we can refine (11.3):

1 𝑑⋅𝑡+2ℤ (𝑆) 𝑁 𝜁 ′ 𝜁 ′ * 𝑟 (𝑆, 𝑆 + 𝑋) (11.4)
with

𝑁 𝜁 ′ = ∑ 𝑘,ℓ 1 𝑑⋅𝑡+2ℤ (𝑘)𝜁 ′ * 𝑟 (𝑘, 𝑘 + ℓ) .
A comparison of these different models is given in Table 11.2. We can see that Proposition 11.4 gives a distribution very close to the one obtained by simulation, whereas (11.3) and (11.4) do not. Distribution tails are particularly poorly estimated for the latter two. This suggests that (11.1) does indeed capture most of the correlations between syndrome bits induced by the quasi-cyclicity of the matrix.

Counters distributions

Compared to the distributions obtained by simulation, the counters distributions of the model given in [START_REF] Chaulet | Étude de cryptosystèmes à clé publique basés sur les codes MDPC quasi-cycliques[END_REF] match very well. However, there remains some small bias that affects the model that we will describe later (the distribution of the number of positions above a threshold -the ones that are flipped).

To correct these discrepancies, we can again use the mass equations (11.1) that the regularity of the code implies.

In this subsection, we suppose that the syndrome weight 𝑆 and the value 𝑋 = (∑ 𝑗∈e 𝜎 𝑗 ) -𝑆 are no longer random variables and their values are known.

{ 𝜙 𝑎 (0, ℓ) = 𝑡-ℓ 𝑡 ⋅ 𝑔 𝑎 (ℓ) , 𝜙 𝑎 (1, ℓ) = ℓ 𝑡 ⋅ 𝑔 𝑎 (ℓ) , { 𝜓 𝑎 (0, 𝑤 -ℓ) = 𝑛-𝑡-𝑤+ℓ 𝑛-𝑡 ⋅ 𝑔 𝑎 (ℓ) , 𝜓 𝑎 (1, 𝑤 -ℓ) = 𝑤-ℓ 𝑛-𝑡 ⋅ 𝑔 𝑎 (ℓ) .
where 𝑔 𝑎 is defined in Proposition 11. Since we reordered the rows of H, we know that for all 𝑖 ∈ {0, … , 𝑆 -1}, there is an odd number of errors in the corresponding equations (𝑠 𝑖 = 1), and it is even for all the other rows (𝑠 𝑖 = 0). Assuming independence of the random variables 𝑅 𝑖 , we obtain the distributions of

𝑆-1 ∑ 𝑖=0 𝑅 𝑖 = (𝜎 1 , Σ 1 ) and 𝑟-1 ∑ 𝑖=𝑆 𝑅 𝑖 = (𝜎 0 , Σ 0 )
with convolutions (it corresponds respectively to 𝜙 * 𝑆 1 and 𝜙 * (𝑟-𝑆) 0

). The first sum involves the upper right corner of our representation of the parity check matrix in Figure 11.1 while the other one involves the lower right corner. We have mass equations for each one of these parts of the matrix. Here they translate as

Σ 1 = 𝑆 + 𝑋 , Σ 0 = 𝑑𝑡 -(𝑆 + 𝑋) .
We also know that the column weight 𝑑 is fixed so 𝜎 0 , 𝜎 1 ∈ {0, … , 𝑑} and 𝜎 0 = 𝑑 -𝜎 1 . The relevant conditional probabilities are obtained by setting the probabilities to zero when the conditions are not satisfied and then normalizing them through division by 𝑁 𝜙 .

The same arguments prove the formulas for 𝑗 ∉ e by doing the substitutions below.

∈ e ∉ e 𝑡 𝑛 -𝑡 ℓ 𝑤 -ℓ 𝑆 + 𝑋 (𝑤 -1)𝑆 -𝑋 𝜙 𝜓

Remark 11.7. The values obtained with Proposition 11.6 should be compared to the simpler binomial model given by (5.2) established in [START_REF] Chaulet | Étude de cryptosystèmes à clé publique basés sur les codes MDPC quasi-cycliques[END_REF]. Examples are given in Table 11.3. There is only a very slight bias between the binomial model and the distribution obtained with Proposition 11.6. The improvement achieved by the latter could therefore be considered minor and not worth the additional complexity, but the usefulness of this proposition will be more evident in the following subsection when comparing the number of flipped positions predicted by the model with the simulations.

Predicting flips

In this subsection, we still suppose that the syndrome weight 𝑆 and the value 𝑋 = (∑ 𝑗∈e 𝜎 𝑗 ) -𝑆 are no longer random variables and their values are known, we also suppose that the counters distributions for these values of 𝑆 and 𝑋 are known. We now choose a threshold 𝑇. In the model, it can depend on any fixed parameter of the cryptosystem 𝑟, 𝑛, 𝑑, 𝑤, 𝑡, but it can also depend on 𝑆 or 𝑋. However, it makes little sense to base it on the exact value of 𝑋, because such a quantity is not known to a real decoder.

In order to predict the number of errors remaining after one iteration, we want to know the number of positions that have a counter greater than or equal to the threshold 𝑇 while separating the case where the corresponding position is an error from the case where it is not (in the first case it decreases the error weight while in the other it increases it).

Let us recall the equations from (11.1) concerning the counters (i.e. the upper part of the matrix in Figure 11.1:

∑ 𝑗∈e 𝜎 𝑗 = 𝑆 + 𝑋 , ∑ 𝑗∉e 𝜎 𝑗 = (𝑤 -1)𝑆 -𝑋 .
This dependence between the counters can be taken into account using a technique similar to the previous propositions. (𝑘, 𝑑𝑡 -𝑆 -𝑋)

Proof. First let us suppose that 𝑗 ∈ e. We define a two-dimensional random variable C 𝑗 = (𝐶 𝑗,1 , 𝐶 𝑗,2 ), 𝐶 𝑗,2 is the counter 𝜎 𝑗 of position 𝑗 and 𝐶 𝑗,1 is such that

𝐶 𝑗,1 = { 0 if 𝐶 𝑗,2 < 𝑇, 1 if 𝐶 𝑗,2 ≥ 𝑇.
The probability mass function of C 𝑗 is given by 𝛾 1 . Summing 𝑡 times the independent random variables C 𝑗 for all error position 𝑗 ∈ e gives a random variable whose first coordinate is the number of counters above 𝑇 and the second coordinate is the sum of all the counters. Its probability mass function is 𝛾 * 𝑡 1 . The relevant conditional probabilities are finally obtained by keeping only the values of ∑ 𝑗∈e C 𝑗 such that the second coordinate is 𝑆 + 𝑋 and then normalizing the probabilities with a division by 𝑁 𝛾 1 .

The result is proven for 𝑗 ∉ e with the substitutions below. Remark 11.10. We should now come back to the previous comments made about the counters distributions in Remark 11.7. For this purpose, substitute, in Proposition 11.8, 𝛾 0 for 𝛾 ′ 0 and 𝛾 1 for 𝛾 ′ 1 with Comparison between these models is provided in Table 11.4. We can observe that compared to Remark 11.9, our model makes a better prediction of the variance. And compared to Remark 11.10, our model makes a better prediction of the mean. Simulation data are for 10 9 samples. 99%-confidence intervals.

∀𝑘 ∈ {0, … , 𝑑)}, { 𝛾 ′ 0 (1 ≥𝑇 (𝑘), 𝑘) = ( 𝑑 𝑘 )𝜋 𝑘 1 (1 -𝜋 1 ) 𝑑-𝑘 , 𝛾 ′ 1 (1 ≥𝑇 (𝑘), 𝑘) = ( 𝑑 𝑘 )𝜋 𝑘 0 (1 -𝜋 0 ) 𝑑-𝑘 , (

A two-iteration decoder with a DFR analysis

In the previous section, we assessed the accuracy of the model to predict the error weight after one iteration. Using the same idea as in [START_REF] Tillich | The decoding failure probability of MDPC codes[END_REF] or [LEDA], we designed a decoder whose first iteration is analyzed by the probabilistic model we have just established, followed by a deterministic property which guarantees the successful decoding of an error pattern with a weight below a certain bound. The deterministic property that we use is an intermediate between [START_REF] Tillich | The decoding failure probability of MDPC codes[END_REF] and [LEDA] and require some key filtering. The reason for this intermediate result is that we can estimate the additional cost of filtering by using results on the distance spectrum proven in Chapter 15.

In this section, we will explore three strategies (for some security parameter 𝜆):

• Do one iteration and choose parameters so that the probalistic model predicts a DFR below 2 -𝜆 .

• Do two iterations so that, using the probabilistic model, the error weight after the first iteration is below the deterministic bound with probability above (1 -2 -𝜆 ).

• Take a reciprocal point of view and discuss the number of errors that must be unconditionally corrected in the second iteration for a given block size to obtain a DFR below 2 -𝜆 .

One iteration

Decoding in one iteration means that the error weight 𝑡 1 after one iteration is zero. With this decoder, we have

DFR(𝑟) = ∑ 𝑡 1 >0 Pr reg [𝑡 1 ] .
However, with this algorithm, we lose the advantage of an iterative algorithm that has the possibility to make mistakes that are rectified later. The impact on the block size is quite significant since it would have to be multiplied by at least 40 to obtain a sufficiently low DFR. For example, the predicted DFR for (𝑑, 𝑡) = (71, 134) are shown in Figure 11.3. Obtaining a DFR below 2 -128 for the 128-bits of security parameters of [BIKE] (𝑑, 𝑡) = (71, 134) requires a block size 𝑟 > 540 000.

Two iterations

We can design an algorithm that first performs a parallel iteration of the bit-flip algorithm using a threshold depending on the syndrome weight, and then a second iteration with a fixed threshold. The first one is quite efficient, corrects many errors and has an accurate probabilistic model. The second one is sufficient to correct the residual errors, and its soundness is deterministic and does not require any assumptions about the error pattern or the syndrome.

Let us first recall the definition of the maximum column intersection and prove proposition that is a slight improvement (it can correct up to one more error) of [Til18b, Proposition 1] or a particular case of [START_REF] Baldi | LEDAcrypt. Revision 3.0 of the submission to the NIST postquantum cryptography call[END_REF]§3.4]. Definition 11.12. [Til18b, Definition 2] Let H be a binary parity check matrix. The number of intersections between two different columns 𝑗 and 𝑗 ′ is equal to the number of rows 𝑖 for which ℎ 𝑖,𝑗 = ℎ 𝑖,𝑗 ′ = 1. The maximum column intersection of H is the maximum for any pairs of columns:

max 𝑗,𝑗 ′ |h 𝑗 ⋆ h 𝑗 ′ | .
Remark 11.13. In a quasi-cyclic code with a parity check matrix represented as h = (h 0 , h 1 ) ∈ (𝔽 2 [𝑥]/(𝑥 𝑟 -1)) 2 , any column can be written as 𝑥 𝑘 h ℓ for some 𝑘 ∈ {0, … , 𝑟 -1} 50 000 1 ⋅ 10 5 1.5 ⋅ 10 5 2 ⋅ 10 5 2.5 ⋅ 10 5 3 ⋅ 10 5 3.5 ⋅ 10 5 4 ⋅ 10 5 4.5 ⋅ 10 5 5 ⋅ 10 5 and ℓ ∈ {0, 1}. Since shifting two columns by the same offset does not change their number of intersections, we can rewrite the maximum column intersection formula as

𝐼 ∶= max 𝑘,𝑘 ′ ∈{0,…,𝑟-1} ℓ,ℓ ′ ∈{0,1} |𝑥 𝑘 h ℓ ⋆ 𝑥 𝑘 ′ h ℓ ′ | = max(𝐼 0 , 𝐼 1 , 𝐼 01 ) .
where

𝐼 0 ∶= max 𝑘∈{0,…,𝑟-1} |h 0 ⋆ 𝑥 𝑘 h 0 | , 𝐼 1 ∶= max 𝑘∈{0,…,𝑟-1} |h 1 ⋆ 𝑥 𝑘 h 1 |
are the maximum column intersection inside each block and

𝐼 01 ∶= max 𝑘∈{0,…,𝑟-1} |h 0 ⋆ 𝑥 𝑘 h 1 |
concerns the intersections between the two blocks. The error pattern e can be corrected if there exists 𝑇 such that 𝐼𝑡 < 𝑇 ≤ 𝑑 -𝐼(𝑡 -1) .

The largest 𝑡 that verifies this inequality is ⌊ 𝑑+𝐼-1 2𝐼 ⌋ and we can verify that we can take 𝑇 = ⌊ 𝑑+𝐼+1 2 ⌋.

We will consider the two-iteration bit-flipping as described in Algorithm 11.2. With Proposition 11.14, we now have an upper bound on its DFR:

DFR(𝑟) ≤ ∑ 𝑡 1 >⌊(𝑑+𝐼-1)/2𝐼⌋ Pr reg [𝑡 1 ] .
For any maximum column intersection 𝐼, we write We can estimate the probability that the key generation function draws a bad key and the number of trials before finding a good key follows a geometric distribution. We can consider this number of trials as an overhead factor on the key generation. However, the additional costs only concern the entropy generation and this does not represent the major part of the cost in a Niederreiter scheme such as BIKE, where the most expensive operation is a polynomial (or matrix) inversion.

𝑟 𝐼,𝜆 ∶= min ⎧ { ⎨ { ⎩ 𝑟 | ∑ 𝑡 1 >⌊(𝑑+𝐼-1)/2𝐼⌋ Pr reg [𝑡 1 ] < 2 -𝜆 ⎫ } ⎬ }
Remember that in Remark 11.13 we have separated the maximum column intersection 𝐼 between its intrablocks parts 𝐼 0 , 𝐼 1 and its interblock part 𝐼 01 . Therefore, we have:

Pr[𝐼 ≤ 𝑚] = Pr[𝐼 0 ≤ 𝑚 and 𝐼 1 ≤ 𝑚 and 𝐼 01 ≤ 𝑚] .
The values 𝐼 0 and 𝐼 1 concern independent blocks and are therefore independent random variables, so we can write:

Pr[𝐼 ≤ 𝑚] = Pr[𝐼 0 ≤ 𝑚] ⋅ Pr[𝐼 1 ≤ 𝑚] ⋅ Pr[𝐼 01 ≤ 𝑚 | 𝐼 0 ≤ 𝑚, 𝐼 1 ≤ 𝑚] .
For ease of calculation, and only at the cost of a slight inaccuracy, we will also assume the independence with the interblock part

𝐼 01 : Pr[𝐼 01 ≤ 𝑚 | 𝐼 0 ≤ 𝑚, 𝐼 1 ≤ 𝑚] = Pr[𝐼 01 ≤ 𝑚].
We will use results from Chapter 15 and thus the proofs of the different assertions can be found there. In particular, it is shown in this chapter that there is a link between the column intersections inside a circulant block and its distance spectrum. The relevant combinatorial result from Corollary 15.17 is reported here without justification.

Proposition 11.15. For given integers 𝑚, 0 ≤ 𝑚 < 𝑑, and 𝛿, 1 ≤ 𝛿 ≤ ⌊𝑟/2⌋, define

𝒩 𝑚 ∶= 𝑟 𝑑 -𝑚 ( 𝑑 -1 𝑑 -𝑚 -1 )( 𝑟 -𝑑 -1 𝑑 -𝑚 -1 ) , 𝜋 𝑚 = 𝒩 𝑚 ( 𝑟 𝑑 ) = 𝑟 𝑑 -𝑚 ( 𝑑-1 𝑑-𝑚-1 )( 𝑟-𝑑-1 𝑑-𝑚-1 ) ( 𝑟 𝑑 ) , 𝜋 ′ 𝑚 = ( 𝑑 𝑚 )( 𝑟-𝑑 𝑑-𝑚 ) ( 𝑟 𝑑 )
.

Then

Pr[𝐼 0 ≤ 𝑚] = Pr[𝐼 1 ≤ 𝑚] = ( ∑ 𝑘≤𝑚 𝜋 𝑘 ) ⌊𝑟/2⌋ , Pr[𝐼 01 ≤ 𝑚] = ( ∑ 𝑘≤𝑚 𝜋 ′ 𝑘 ) 𝑟 .
In Algorithm 15.3, for a threshold 𝜏 ∈ {1, … , 𝑑}, the probability of accepting a key is Pr[𝐼 ≤ 𝑚]. Since all the key generations are independent, the number of trials before finding a suitable key follows a geometric distribution. In Table 11.6 we give the mean values for different parameter sets. Filtering keys to have a maximum column intersection of 3 appears to be an interesting tradeoff, and for any greater value it has a negligible influence on the key generation time.

Decoding performance requirements after the first iteration

With our model, we can estimate the greatest error weight after one iteration that happens with a non-negligible probability (i.e. larger than 2 -𝜆 ). Results are given in Figure 11.4. The figure shows that, for a block size of about 21 000, we need to successfully decode with a very high probability any error pattern whose weight does not exceed a few tens. Such a performance does not seem unattainable in view of our experimentations. For example, the error patterns responsible for the error floors discussed in Chapter 16 are the worst error patterns that we know of in terms of decoding, but they have a larger weight.

Noisy syndrome decoding

Ouroboros is a key exchange protocol that uses MDPC codes, see [START_REF] Deneuville | Ouroboros: A Simple, Secure and Efficient Key Exchange Protocol Based on Coding Theory[END_REF]. In comparison to the MDPC-McEliece scheme, Ouroboros relies only on one security assumption (Quasi-Cyclic Syndrome Decoding, QCSD) instead of two (QCSD and Quasi-Cyclic Codeword Finding), see BIKE-3 variants of [BIKE] for the versions earlier than 3.2. It also differs in the decoder: in Ouroboros one needs to decode a noisy syndrome i.e. s = He ⊺ + e ′ . This requires only a small modification of a bit-flipping algorithm to decode. It is a matter of stopping the algorithm when the syndrome has a small weight rather than a zero weight.

The analysis of an iteration also requires some adaptation of the model. Basically, contrary to the noiseless problem, a one in the syndrome does not mean that there is an odd number of errors in the corresponding equation (and conversely a zero in the syndrome does not mean an even number of errors). To give an idea of the impact of the added noise, with BIKE-3 (Ouroboros), |e ′ | = |e| /2.

In fact, the additional noise on the syndrome only affects the weight of the syndrome and the counters distributions, the other propositions of the previous section then apply without further adaptation. In this section we show how the noise on the syndrome is to be taken into account in the relevant propositions.

Since the number of equations affected is known and fixed in the parameters of the scheme, we know exactly how many syndrome bits will have their parity flipped. We still use the notation 𝑆 for the syndrome weight 𝑆 = |He ⊺ + e ′ |, we write the syndrome noise weight 𝑡 𝑂 ∶= |e ′ |. Now, we need an additional random variable to account for the number of unsatisfied equations affected by the noise on the syndrome 𝐼 = |e ′ ⋆ s|. The noiseless syndrome weight is then

|s + e ′ | = 𝑆 + 𝑡 0 -2𝐼 . 0 0 1 1 1 1 0 0 𝐼 𝑆 -𝐼 𝑡 𝑂 -𝐼 𝑟 -𝑆 -𝑡 𝑂 + 𝐼 He ⊺ 1 1 0 0 1 1 0 0 𝐼 𝑡 𝑂 -𝐼 e ′ 1 1 0 0 𝑆 𝑟 -𝑆 He ⊺ + e ′
Remark 11.16. We already know that if s is drawn uniformly at random in ℰ 𝑟,𝑆 and e ′ drawn uniformly at random in ℰ 𝑟,𝑡 𝑂 , the number of intersection between them follows a hypergeometric distribution, we write

𝑓(𝑆, 𝐼) = ( 𝑆+𝑡 𝑂 -2𝐼 𝑡 𝑂 -𝐼 )( 𝑟-𝑆-𝑡 𝑂 +2𝐼 𝐼 ) ( 𝑟 𝑡 𝑂
) the probability of the vector e ′ having 𝐼 intersections with s.

When e and s have 𝐼 intersections, there are exactly 𝐼 unsatisfied equations with an even number of errors, 𝑡 𝑂 -𝐼 satisfied equations with an odd number of errors, the other equations behave as expected.

Proposition 11.17. Let H be drawn uniformly at random in ℋ 𝑑,𝑤,𝑟×𝑛 , e drawn uniformly at random in ℰ 𝑛,𝑡 and e ′ drawn uniformly at random in ℰ 𝑟,𝑡 𝑂 . The syndrome weight 𝑆 = |e ′ + He ⊺ |, the value 𝑋 = (∑ 𝑗∈e 𝜎 𝑗 ) -𝑆, and the value 𝐼 = 𝑡 𝑂 -|e ′ ⋆ s| follow the joint distribution

Pr reg [(𝑆, 𝑋, 𝐼) = (𝑘, ℓ, 𝑜)] = 1 𝑁 𝜁,𝜁 𝑓(𝑘, 𝑜) (𝜁 * (𝑟-𝑡 𝑂 ) * 𝜁 * 𝑡 𝑂 ) (𝑘, 𝑘 + ℓ, 𝑑𝑡 -𝑘 -ℓ) with, for 𝑎 ∈ {0, … , min(𝑤, 𝑡)}, ⎧ { ⎨ { ⎩ 𝜁(1, 𝑎, 0) = ( 𝑤 𝑎 )( 𝑛-𝑤 𝑡-𝑎 ) ( 𝑛 𝑡 ) if 𝑎 is even , 𝜁(0, 0, 𝑎) = ( 𝑤 𝑎 )( 𝑛-𝑤 𝑡-𝑎 ) ( 𝑛 𝑡 ) if 𝑎 is odd , ⎧ { ⎨ { ⎩ 𝜁(0, 0, 𝑎) = ( 𝑤 𝑎 )( 𝑛-𝑤 𝑡-𝑎 ) ( 𝑛 𝑡 ) if 𝑎 is even , 𝜁(1, 𝑎, 0) = ( 𝑤 𝑎 )( 𝑛-𝑤 𝑡-𝑎 ) ( 𝑛 𝑡 )
if 𝑎 is odd .

(compared to 𝜁 the first component of 𝜁 is flipped) and

𝑁 𝜁,𝜁 = ∑ 𝑘,ℓ,𝑜 𝑓(𝑘, 𝑜) (𝜁 * (𝑟-𝑡 𝑂 ) * 𝜁 * 𝑡 𝑂 ) (𝑘, 𝑘 + ℓ, 𝑑𝑡 -𝑘 -ℓ) .
Proposition 11.18. Let H be drawn uniformly at random in ℋ 𝑑,𝑤,𝑟×𝑛 , e drawn uniformly at random in ℰ 𝑛,𝑡 and e ′ drawn uniformly at random in ℰ 𝑟,𝑡 𝑂 . We denote the syndrome weight 𝑆, the value 𝑋 = (∑ 𝑗∈e 𝜎 𝑗 ) -𝑆 and the value 𝐼 = 𝑡 𝑂 -|e ′ ⋆ s|, and suppose they ) (𝑑 -𝑘, 𝑑(𝑛 -𝑡) -(𝑤 -1)𝑆 + 𝑋) ,

(the functions 𝜙 𝑠 and 𝜓 𝑠 are defined as in Proposition 11.6) with

𝑁 ′ (𝜙) = 𝑑 ∑ 𝑘=0 (𝜙 * 𝐼 0 * 𝜙 * (𝑆-𝐼) 1 ) (𝑘, 𝑆 + 𝑋) ⋅ (𝜙 * (𝑡 𝑂 -𝐼) 1 * 𝜙 * (𝑟-𝑆-𝑡 𝑂 +𝐼) 0 ) (𝑑 -𝑘, 𝑑𝑡 -(𝑆 + 𝑋)) , 𝑁 ′ (𝜓) = 𝑑 ∑ 𝑘=0 (𝜓 * 𝐼 0 * 𝜓

Going further to predict the syndrome weight after the first iteration

Concerning the bounds used in the previous section for the two-iteration decoding, although they do not require additional assumptions about the error pattern, they do characterize worst-case scenarios. In particular, the worst possible error patterns produce syndromes with unusual weights. Obtaining the joint distribution of the error weight and the syndrome weight after an iteration would allow for a finer analysis of the DFR since outliers would be weighted by their extremely low probability. Knowledge of this distribution also appears necessary if we plan to consider algorithms performing more than two iterations.

In this section, we outline the possibility of predicting the syndrome weight after one iteration. The difficulty with the ensuing model is that it is more complex and requires too much computational time.

Similarly to the mass equations of Section 11.2, we can apply permutations to the parity check matrix and the vectors to have more precise equations. To evaluate the syndrome changes (a one that becomes a zero and vice versa), as before, we need to take into account some mass equations. We suppose that the number of correct positions to be flipped 𝑡 + and the number of errors to be removed 𝑡 -is known. We also suppose that the sum Σ + of the 𝑡 + counters of the correct positions to be flipped, and the sum Σ -of the 𝑡 - counters of errors to be removed are fixed.

Again, applying two permutations

P ′ ∈ 𝔽 𝑟×𝑟 2 and Q ′ ∈ 𝔽 𝑛×𝑛 2
to H, e and s:

H ″ = P ′ HQ ′-1
e ″ = eQ ′ ⊺ s ″ = P ′ s so that we have s ″ = e ″ H ″ ⊺ in the configuration illustrated in Figure 11.5.

𝐵 0 𝐵 1 𝐴 1 𝐴 0 𝐷 0 𝐷 1 𝐶 1 𝐶 0 H ″ 1 1 0 0 𝑆 𝑟 -𝑆 s ″0 ⊺ 1 1 0 1 0 0 𝑆 - 𝑆 + s ″1 ⊺ 0 0 1 1 0 0 𝑡 e ″0 0 0 1 1 0 0 1 1 𝑛 -𝑡 -𝑡 + 𝑡 -𝑡 - 𝑡 - 𝑡 + e ″1
𝐴 1 = Σ -, 𝐴 0 = Σ + , 𝐴 1 + 𝐵 1 = 𝑆 + 𝑋 , 𝐴 0 + 𝐵 0 = (𝑤 -1)𝑆 -𝑋 , 𝐴 0 + 𝐶 0 = 𝑑𝑡 + , 𝐴 1 + 𝐶 1 = 𝑑𝑡 -, 𝐴 0 + 𝐵 0 + 𝐶 0 + 𝐷 0 = 𝑑(𝑛 -𝑡) , 𝐴 1 + 𝐵 1 + 𝐶 1 + 𝐷 1 = 𝑑𝑡 .
With some independence assumptions, the distributions of Σ + and Σ -can be determined as well as the repartition of the ones for each row of the parity check matrix.

A derivation, albeit more complex, similar to the one presented here for the error weight after the first iteration can be established for the syndrome weight after the first iteration using these mass equations. The distributions thus calculated on a few particular starting values for 𝑆 0 and 𝑋 0 seemed to be in line with the simulations. However, the cost of these few calculations did not bode well for a complete model.

Algorithm supported by the model

Remember the definition of step-by-step bit-flipping, Algorithm 7.1 already discussed in Chapter 7.

One of its key features is that it is easy to track the error weight and the syndrome weight at each step if we know whether the flipped position is an error or not as well as the value of its counter. Indeed, by Proposition 1.26, when the position 𝑗 with the counter 𝜎 𝑗 is flipped the weight of the syndrome becomes |s| + |h 𝑗 | -2𝜎 𝑗 .

In the following section, we establish the assumptions that we make to estimate the probabilities associated with the different events that affect the outcome of the algorithm. We will see that it describes, in fact, a Markov chain. We then define some additional assumptions that are made mainly out of convenience as they greatly simplify the calculations in the model. In another section we detail the transition probabilities of the Markov chain. And finally we compare the predicted DFR in this model to the one obtained by simulations of Algorithm 7.1 for a great range of block size 𝑟.

Necessity of the randomization. The algorithm is fully randomized to allow us, firstly to use a slightly more efficient sampling method than going through all the positions, and secondly to avoid any bias when doing so.

Assumptions

Let H be drawn uniformly at random in ℋ 𝑑,𝑤,𝑟×𝑛 and e be a vector of weight 𝑡. We write the syndrome s ∶= He ⊺ . We write 𝑡 ∶= |e| and 𝑆 ∶= |s|.

First, we assume that the counters behave as written in [START_REF] Chaulet | Étude de cryptosystèmes à clé publique basés sur les codes MDPC quasi-cycliques[END_REF].

Assumption 1. The counters 𝜎 𝑗 = |h 𝑗 ⋆ s| are independent and follow binomial distributions depending on wether 𝑗 is in the support of the error pattern e or not:

𝜎 𝑗 ∼ Bin(𝑑, 𝜋 0 ) if 𝑗 ∉ e , 𝜎 𝑗 ∼ Bin(𝑑, 𝜋 1 ) if 𝑗 ∈ e .
with

𝜋 1 = 𝑆 + 𝑋 𝑑𝑡 , 𝜋 0 = (𝑤 -1)𝑆 -𝑋 𝑑(𝑛 -𝑡) and (see Proposition 12.2) 𝑋 = 𝜉 E[𝑋 | 𝑆, 𝑡]
for some constant 𝜉.

Remark 12.1. We have seen in the previous chapter that while the counter distributions above are extremely close to the observations that there remains a small bias (see §11.3.3). We write 𝑆 𝑖 and 𝑡 𝑖 the random variables accounting for respectively the syndrome weight and the error weight at the 𝑖-th iteration of the step-by-step algorithm. We also define the event 𝐿 𝑖 that the decoder is in a blocked state at the 𝑖-th iteration, this happens when there is no position with a counter greater than or equal to the threshold:

𝐿 𝑖 ∶= {∀𝑗, 𝜎 (𝑖) 𝑗 < 𝑇 } .
where 𝜎 (𝑖) 𝑗 is the counter associated to position 𝑗 at the 𝑖-th iteration. Assumption 2. The stochastic process in Algorithm 7.1 is a time-homogeneous Markov chain, i.e. the sequence (𝑆 𝑖 , 𝑡 𝑖 ) 𝑖 is such that for all 𝑖 ≥ 1

Pr [(𝑆 𝑖+1 , 𝑡 𝑖+1 ) = (𝑎 𝑖+1 , 𝑏 𝑖+1 ) | ¬𝐿 𝑖 , (𝑆 𝑖 , 𝑡 𝑖 ) = (𝑎 𝑖 , 𝑏 𝑖 ), … , ¬𝐿 0 , (𝑆 0 , 𝑡 0 ) = (𝑎 0 , 𝑏 0 )] = Pr [(𝑆 𝑖 , 𝑡 𝑖 ) = (𝑎 𝑖+1 , 𝑏 𝑖+1 ) | ¬𝐿 𝑖-1 , (𝑆 𝑖-1 , 𝑡 𝑖-1 ) = (𝑎 𝑖 , 𝑏 𝑖 )] .

Proposition 12.2. Assuming that the random variables that indicate the number of errors |h ⊺

𝑖 ⋆ e| for some equation indices 𝑖 are independent and if e ∈ ℰ 𝑛,𝑡 , the expectation of

𝑋 ∶= ∑ ℓ>0 2ℓ𝐸 2ℓ+1 knowing 𝑆 = |He ⊺ | is E[𝑋 | 𝑆, 𝑡] = 𝑆 ⋅ ∑ ℓ 2ℓ𝜌 2ℓ+1 ∑ ℓ 𝜌 2ℓ+1 where 𝜌 ℓ = ( 𝑤 ℓ )( 𝑛-𝑤 𝑡-ℓ ) ( 𝑛 𝑡 )
.

Proof. For any row 𝑖 ∈ {0, … , 𝑟 -1}, we define 𝑅 𝑖 the random variable defined as follows

𝑅 𝑖 = ⎧ { ⎨ { ⎩ 0 if 𝑠 𝑖 = 0, |h ⊺ 𝑖 ⋆ e| -1 otherwise.
If we know the error weight

𝑡, then E[𝑅 𝑖 | 𝑠 𝑖 = 1] = ∑ ℓ 2ℓ𝜌 2ℓ+1 ∑ ℓ 𝜌 2ℓ+1
. Assuming independence, the expected sum of 𝑆 of these random variables would be equal to 𝑆 multiplied by the expected value of a single one.

Remark 12.3. The model derived from these two assumptions gradually degenerates as the number of iterations grows, but remains relatively accurate in the first few iterations of Algorithm 7.1, that is even when e is not uniformly distributed.

Markov chain. These two assumptions allow us to model the step-by-step decoder as a finite state machine (FSM) with a state (𝑆, 𝑡) with 𝑆 the syndrome weight and 𝑡 the error weight. Assumption 2 compels us to separate the situation where the decoder is blocked from the one where it is not. Indeed, transitioning to a blocked state concerns the whole "population" of counters while the other transitions concern the sampling method. As a result, the transitions of the finite state machine follow the configuration shown in Figure 12.1.

An error pattern is successfully decoded in 𝑓 iterations if the FSM follows a path that leads to the state 𝑆 = 0, 𝑡 = 0:

(𝑆 0 , 𝑡 0 ) → (𝑆 1 , 𝑡 1 ) → ⋯ → (𝑆 𝑓-1 , 𝑡 𝑓-1 ) → (0, 0) .
To estimate the probability of success of the decoder (from which we easily deduce the DFR1 ) in the model defined by the two assumptions, we want to compute the probability of these events for any possible starting state (𝑆 0 , 𝑡 0 ). The possible starting states are constrained by the structure of the code and the weight of the initial error pattern.

Validity of the Markovian model.

In Assumption 1, we introduced a factor 𝜉 next to E[𝑋 | 𝑆, 𝑡]. This factor compensates for the fact that the process is not strictly Markovian. The problem lies in the term 𝑋. The decoder flips high counters in order to decrease the syndrome weight. If we focus on an unsatisfied equation that becomes satisfied in this process, if it contained more than one error, they also see their counters decreasing. The error pattern obtained during decoding is therefore not random and the distribution of the counters is biased. They are lower than what is expected for a given syndrome weight 𝑆 and error weight 𝑡. In order to take this bias into account, a factor 𝜉, close to 1 is added.

𝑆 𝑖 , 𝑡 𝑖 𝐿 𝑖 , 𝑆 𝑖 , 𝑡 𝑖 ¬𝐿 𝑖 , 𝑆 𝑖 , 𝑡 𝑖 � 𝑆 𝑖 + 𝑑 -2𝜎, 𝑡 𝑖 + 1 � � 𝑆 𝑖 + 𝑑 -2𝜎, 𝑡 𝑖 -1 � 𝑇 ≤ 𝜎 ≤ 𝑑 𝑝 𝐿 1 -𝑝 𝐿 1 𝑝 𝑝 + 𝜎 𝑝 - 𝜎 Figure 12
.1: Diagram of the transitions profile at the 𝑖-th iteration starting from a state where the syndrome weight is 𝑆 𝑖 and the error weight is 𝑡 𝑖 . The edges are assigned probabilities that we establish in section 12.5 (note that they depend on 𝑆 𝑖 and 𝑡 𝑖 ).

DFR estimation within the model

Additional assumptions. Although it is not strictly necessary for the calculation of the DFR in this model, for this work we specify the decoder so that 1. the threshold 𝑇 is always greater than or equal to (𝑑 + 1)/2, 2. the number of iterations is not limited.

The first assumption ensures that, in the algorithm, any flip reduces the weight of the syndrome by at least 1. Indeed, if a position 𝑗 with the counter 𝜎 𝑗 ≥ (𝑑 + 1)/2 is flipped at iteration #𝑖, the syndrome weight becomes

𝑆 𝑖+1 = 𝑆 𝑖 + 𝑑 -2𝜎 𝑗 ≤ 𝑆 𝑖 -1 .
Note that if the algorithm is implemented with a mechanism that exits the loop and outputs a decoding failure when none of the 𝑛 counters hits the threshold, the probability that it will never terminate is zero. In this sense, the second assumption is still legitimate for a concrete algorithm (albeit conflicting with any goal of guaranteeing a constant-time execution).

These two additional assumptions significantly reduce the time complexity of the model computations. They guarantee that there is no loop in the Markov chain. The former ensures that transitions from a state (𝑆, 𝑡) can only go in the direction that lowers its first component 𝑆. The latter allows another representation of the Markov chain without any self-loop (apart from those with a probability of 1). This is tantamount to considering an equivalent algorithm whose main loop would be • sample positions at random until you find one with a counter above the threshold,

• flip it.

We can thus calculate for each state (𝑆, 𝑡) the probability that it leads to a failure once and for all as long as we do it for 𝑆 in ascending order. In other words, if we plot, with on the x-axis the counter value and on the y-axis the expected number of positions that have this counter value, the two curves concerning respectively the errors and the correct positions, the threshold is the intersection of the two curves (see Figure 12.2).

With Assumption 1, we have

𝑇 ∶= max ⎛ ⎜ ⎜ ⎜ ⎝ 𝑑 + 1 2 , ⎡ ⎢ ⎢ ⎢ 𝑑 log ( 1-𝜋 1 1-𝜋 0 ) + log ( 𝑡 𝑛-𝑡 ) log ( 1-𝜋 1 1-𝜋 0 ) + log ( 𝜋 0 𝜋 1 ) ⎤ ⎥ ⎥ ⎥ ⎞ ⎟ ⎟ ⎟ ⎠ .
One edge case should be treated separately. If 𝜋 1 > 1, take 𝑇 = 𝑑. This can happen because the value of 𝑋 is only an estimation based on an expected value. With this theoretical model, the decoder needs to know the value of 𝑡, i.e. the actual number of remaining errors. A more realistic threshold value can be used, based, for example, on an estimate of the weight of the error as a function of the syndrome weight (see [START_REF] Chaulet | Worst case QC-MDPC decoder for McEliece cryptosystem[END_REF]).

Transition probabilities

Let us break down probabilities tied to the edges in the diagram of Figure 12.1. We consider one iteration of the loop in Algorithm 7.1. A threshold 𝑇 has been computed. 1. For any position 𝑗, the counter 𝜎 = |h 𝑗 ⋆ s| is below the threshold. The decoder is in a blocked state. This happens with probability 𝑝 𝐿 .

2. There exists at least one counter greater than or equal to the threshold, this happens with probability 1 -𝑝 𝐿 . Now suppose position 𝑗 has been sampled, the corresponding counter value is denoted 𝜎 = |h 𝑗 ⋆ s|. From this point, there are three different types of transition probabilities:

(a) if 𝜎 ≥ 𝑇 and 𝑗 ∈ e, then (𝑆, 𝑡) → (𝑆 + 𝑑 -2𝜎, 𝑡 -1), with probability 𝑝 - 𝜎 , (b) if 𝜎 ≥ 𝑇 and 𝑗 ∉ e, then (𝑆, 𝑡) → (𝑆 + 𝑑 -2𝜎, 𝑡 + 1), with probability 𝑝 + 𝜎 , (c) if 𝜎 < 𝑇, then (𝑆, 𝑡) → (𝑆, 𝑡), with probability 𝑝.

Counters probabilities notation.

For ease of reading and for the sake of genericity, we adopt the following mathematical notations for the probabilities of the counters, for all 𝜎 ∈ {0, … , 𝑑}

𝑓 1 𝑆,𝑡 (𝜎) ∶= Pr [ |h 𝑗 ⋆ s| = 𝜎 | |e| = 𝑡, |s| = 𝑆, 𝑗 ∈ e] , 𝑓 0 𝑆,𝑡 (𝜎) ∶= Pr [ |h 𝑗 ⋆ s| = 𝜎 | |e| = 𝑡, |s| = 𝑆, 𝑗 ∉ e] .
Under Assumption 1

𝑓 1 𝑆,𝑡 (𝜎) = ( 𝑑 𝜎 )𝜋 𝜎 1 (1 -𝜋 1 ) 𝑑-𝜎 , 𝑓 0 𝑆,𝑡 (𝜎) = ( 𝑑 𝜎 )𝜋 𝜎 0 (1 -𝜋 0 ) 𝑑-𝜎 .

Blocked state

Let us first treat the case where the entire "population" of positions has counters below the threshold. In this case, the algorithm would simply be caught in an infinite loop.

Proposition 12.4. Under Assumption 1, we have

𝑝 𝐿 ∶= Pr [(𝑆, 𝑡) → (𝐿, 𝑆, 𝑡)] = Pr [∀𝑗 ∈ {0, … , 𝑛 -1}, 𝜎 𝑗 < 𝑇 | 𝑆, 𝑡] = (∑ 𝜎<𝑇 𝑓 1 𝑆,𝑡 (𝜎)) 𝑡 ⋅ (∑ 𝜎<𝑇 𝑓 0 𝑆,𝑡 (𝜎)) 𝑛-𝑡 .

Transitions from a non-blocked state

The transition probabilities from a non-blocked state depend on the counters distribution as well as the sampling method. For all 𝜎 ∈ {𝑇 , … , 𝑑},

𝑝 - 𝜎 ∶= Pr [𝑗 ← sample(context), 𝑗 ∈ e, |h 𝑗 ⋆ s| = 𝜎] , 𝑝 + 𝜎 ∶= Pr [𝑗 ← sample(context), 𝑗 ∉ e, |h 𝑗 ⋆ s| = 𝜎] .
The probability of staying in the same state is then:

𝑝 = ∑ 𝜎<𝑇 (𝑝 - 𝜎 + 𝑝 + 𝜎 ) .
In Chapter 7, we have defined three sampling methods. In the order we treat them, each method induces a bias towards large counters that is stronger than the previous one.

Uniform sampling. The probabilities for the method of simply choosing a position 𝑗 ∈ {0, … , 𝑛 -1} uniformly at random are obtained by simply weighting the distributions of the counters by the error rate or its complement:

∀𝜎 ∈ {𝑇 , … , 𝑑} 𝑝 - 𝜎 = 𝑡 𝑛 𝑓 1 𝑆,𝑡 (𝜎) , 𝑝 + 𝜎 = (𝑛 -𝑡) 𝑛 𝑓 0 𝑆,𝑡 (𝜎) .
Picking a position in one unsatisfied equation. With the method consisting in choosing an unsatisfied equation uniformly at random then, still uniformly at random, one position involved in the equation, counters distributions are affected by a factor linear in 𝜎.

∀𝜎 ∈ {𝑇 , … , 𝑑} 𝑝 - 𝜎 = 𝜎𝑡 𝑤𝑆 ⋅ 𝑓 1 𝑆,𝑡 (𝜎) , 𝑝 + 𝜎 = 𝜎(𝑛 -𝑡) 𝑤𝑆 ⋅ 𝑓 0 𝑆,𝑡 (𝜎) .
Picking a position in two unsatisfied equations. When the same principle is applied with two unsatisfied equations, counters distributions are affected by a factor quadratic in 𝜎.

∀𝜎 ∈ {𝑇 , … , 𝑑} 𝑝

- 𝜎 = 𝜎(𝜎 -1)𝑡 𝐷 ⋅ 𝑓 1 𝑆,𝑡 (𝜎) , 𝑝 + 𝜎 = 𝜎(𝜎 -1)(𝑛 -𝑡) 𝐷 ⋅ 𝑓 0 𝑆,𝑡 (𝜎)
where 𝐷 = 𝑑(𝑑 -1)(𝑡𝜋 2 1 + (𝑛 -𝑡)𝜋 2 0 ).

Infinite number of iterations. As explained in §12.4, not setting a limit to the number of iterations has advantages in terms of computational complexity. In this case, we denote the probabilities with a prime symbol (𝑝 ′ 𝐿 , 𝑝 ′- 𝜎 , 𝑝 ′+ 𝜎 , 𝑝 ′ ). The probability of blocking is unchanged: 𝑝 ′ 𝐿 = 𝑝 𝐿 . One advantage of considering an infinite number of iterations is that it removes loops so 𝑝 ′ = 0. The other probabilities are multiplied by ∑ 𝑖≥0 𝑝 𝑖 = 1/(1 -𝑝):

𝑝 ′- 𝜎 = 𝑝 - 𝜎 1 -𝑝 , 𝑝 ′+ 𝜎 = 𝑝 + 𝜎 1 -𝑝 .

Results

First, we place ourselves in the context of the [BIKE] cryptosystem. We explore two different approaches to decoding that can make use of this model. The first one is to use exclusively the step-by-step decoder. The second one consists in performing a first pass with another algorithm, then decoding the residual errors with a step-by-step decoder.

In any case, it is desirable to know the starting states of the step-by-step decoder. That is to say, in the first case, it is necessary to know the joint distribution of the syndrome and the error weight of a uniformly random error pattern, and in the second case, it is necessary to know this distribution for the output of the first pass. Then, the DFR is calculated by weighting the probability that each starting state causes a failure by its occurrence frequency at the input of the step-by-step decoder.

For the first case, it was discussed in the previous chapter, but the second one is more complicated. The problem lies in the syndrome weight which is difficult to evaluate, for example for a parallel decoder as we saw in the previous chapter. We will therefore see the problem in a reciprocal way: we will determine the set of states in which it is necessary to arrive with the first pass to be certain (for example, with a probability of 1 -2 -128 ) that the step-by-step decoder will be successful. The issue is then shifted to finding a decoder that brings us to one of these states with a high probability. 9 000 9 500 10 000 10 500 11 000 11 500 12 000 12 500 13 000 13 500 14 000

State-of-the-art

Designing good LDPC code

Construction of LDPC codes usually relies on choosing a random parity check matrix of fixed degree then rejecting matrices with a certain structure. In [START_REF] David | Near Shannon limit performance of low density parity check codes[END_REF] a construction avoids more than one overlap between columns, another avoids short cycles in the Tanner graph. Irregular codes construction first optimizes the density evolution as a function of the degree distribution polynomials 𝜆 = ∑ 𝜆 𝑖 𝑥 𝑖-1 and 𝜌 = ∑ 𝜌 𝑖 𝑥 𝑖-1 where 𝜆 𝑖 and 𝜌 𝑖 are the fraction of edges incident to a variable (resp. check) node of degree 𝑖, see [START_REF] Thomas J Richardson | Design of capacity-approaching irregular low-density parity-check codes[END_REF]. A technique known as progressive edge growth guarantees a Tanner graph whose smallest short cycle (its length is called the girth of the graph) is greater than the method above [START_REF] Hu | Progressive edge-growth Tanner graphs[END_REF].

Error floors in LDPC codes

Estimation of the error floors for LDPC codes has been the focus of many research papers, most of them involve particularities of the channel, the structure of the code or a specific decoder. The usual suspects are subsets of the Tanner graph with nodes of unusual degrees: the trapping sets and the stopping sets. A (𝑢, 𝑣) trapping set consists in 𝑢 variable nodes inducing a graph where 𝑣 check nodes have an odd degree. A stopping set is a subset of the variable nodes inducing a graph where no check node has degree 1. One can define the decisional problem of determining if there is a stopping set of size less than 𝑡 for a given linear code. And similarly we can define the problem of determining if there exists a trapping set of size less than 𝑡 such that 𝑘 check nodes have degree 1 in the induced subgraph for a given 𝑘 and a linear code. A reduction of the former to the latter was established in [START_REF] Wang | Finding All Small Error-Prone Substructures in LDPC Codes[END_REF] and the former was proven to be NP-complete in [START_REF] Krishnan | On the Complexity of finding stopping set size in Tanner Graphs[END_REF]. The NP-completeness was proven for generic codes only, but it is pointed out in [START_REF] Wang | Finding All Small Error-Prone Substructures in LDPC Codes[END_REF] that it still holds if we add the constraint that the parity check matrix is sparse.

Error floors for LDPC codes over the binary erasure channel (BEC) were analysed in [START_REF] Di | Finite-length analysis of low-density parity-check codes on the binary erasure channel[END_REF][START_REF] Richardson | Error Floors of LDPC Codes[END_REF]. The analysis was extended to the additive white Gaussian noise channel (AWGN) and the binary symmetric channel (BSC) in [START_REF] Richardson | Error Floors of LDPC Codes[END_REF]. The method involves searching for candidate trapping sets in the Tanner graph then estimating their influence on the decoding failure rate.

DFR and spectrum of QC-MDPC codes

It was shown in [START_REF] Guo | A Key Recovery Attack on MDPC with CCA Security Using Decoding Errors[END_REF] that there is a correlation between the decoding failure probability and the resemblance between an error pattern and the secret parity check matrix.

Here the resemblance is defined via the distance spectrum. It is the set of all the distances between two ones in a vector, it is counted blockwise and circularly. For example, say 𝑟 = 11 and e = (e 0 , e 1 ) ∈ (𝔽 𝑟 2 )

2 with e 0 = (0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0) then the distance spectrum for this block is the set {2, 4, 5}.

The key observation of the paper is that the decoder's probability of failure depends on the number of common distances between the spectrum of the key and the spectrum of the error pattern. Authors observed that, when a distance is in the spectrums of both of them, the decoder is slightly less likely to fail. They thus set up a reaction attack in which an attacker sends many ciphertexts to an oracle that returns whether the decryption (decoding) was successfull. As the attacker knows the plaintext associated to a ciphertext, they can extract its distance spectrum. With enough samples, each distance can be classified, and one can tell with great certitude whether it belongs to the parity check matrix spectrum or not. Authors then showed that the sparse parity check matrix (the private key) can be recovered with an algorithm akin to a depth-first search.

They used Algorithm ℬ from [START_REF] Ingo Von Maurich | Implementing QC-MDPC McEliece Encryption[END_REF] i.e. a parallel bit-flipping algorithm with a precomputed table of thresholds 𝑏 𝑖 for each iteration. But similar behaviour can be observed with any other algorithm.

We will see that the distance spectrum is a powerful tool that shows up in other security related aspects such as the weak keys for QC-MDPC.

Weak keys in a QC-LDPC cryptosystem

The second round version of LEDACrypt [LEDA] is a cryptosystem that uses QC-LDPC codes. It shares some similarities with BIKE in the fact that it uses a QC-MDPC code, but it has the additional propriety that the parity check matrix H can be factored as H = H ′ Q where H ′ and Q are sparse, quasi-cyclic matrices of dimension respectively 𝑝 × (𝑝 ⋅ 𝑛 0 ) and (𝑝 ⋅ 𝑛 0 ) × (𝑝 ⋅ 𝑛 0 ) for some parameters 𝑛 0 and 𝑝. In [START_REF] Daniel Apon | Cryptanalysis of LEDAcrypt[END_REF], authors exhibited sets of weak keys. The product structure of the parity check matrix induces a strong bias in the bits positions of the low-weight codewords. This bias can be exploited to speed up the information set decoding algorithms1 (ISD). While the typical ISD algorithm chooses a random permutation on the columns for each iteration, they first consider an information set consisting of consecutive positions in each block. They have shown that a single iteration of the Prange algorithm can break a significant proportion of the (thus weak) keys. From this fundamental idea, they have achieved improvements by exploiting some isomorphisms provided by the structure of the product of quasi-cyclic matrices. In the end, they showed that the cost of the attack divided by the density of these weak keys is much lower than the alleged security of the system.

The latest specification of LEDACrypt corrects that flaw by removing the product structure and thus using indeed a QC-MDPC code.

Weak keys in QC-MDPC cryptosystems

Taking QC-MDPC codes, some weak keys were studied in [START_REF] Bardet | Weak Keys for the Quasi-Cyclic MDPC Public Key Encryption Scheme[END_REF], their particular algebraic properties allow retrieval of the secret key by solving a rational reconstruction problem. The rational reconstruction problem consists, for two polynomials f and g in 𝕂 [𝑥] where 𝕂 is a field and the polynomials are such that 0 < deg(f) < deg(g), in finding, for a positive integer 𝑟 ≤ deg(g), two polynomials 𝜙 and 𝜓 of 𝕂[𝑥] such that

⎧ { { { ⎨ { { { ⎩ deg(𝜓) < 𝑟 , deg(𝜙) < def(g) -𝑟 , gcd(𝜙, 𝜓) = 1 , 𝜓 𝜙 = f mod g .
A polynomial-time algorithm to solve this problem is the extended euclidean algorithm.

In [START_REF] Bardet | Weak Keys for the Quasi-Cyclic MDPC Public Key Encryption Scheme[END_REF], authors define a set of weak keys which are, for the case of BIKE, the subset of keys of the form h = (h 0 , h 1 ) where deg(h 0 ) + deg(h 1 ) < 𝑟. Considering the quasi-cyclic structure of the code, they further extend this set by using isomorphisms.

In the end, the density of those keys is small, of order 2 -𝜆 where 𝜆 the security parameters of the system (e.g. 𝜆 = 128), and do not represent a direct threat.

Contributions

Concerning the decoding, there are three qualities that are desirable for a QC-MDPC scheme: (i) a small block size, (ii) a low complexity and (iii) a low proven DFR. It is a rather challenging to have all three at the same time.

The main issue with proving a low DFR lies in the fact that the algorithms are iterative. The distributions of the relevant information to the algorithm can be computed for a uniformly random error pattern with a uniformly random parity check matrix. After one iteration the error pattern can no longer be considered uniformly random, some bits were flipped based on their counters which are information that are correlated to other bits. These correlations are hard to characterize and therefore the analysis for the first iteration cannot be iterated for the next ones.

In addition, the decoders that can be analysed often have rather poor performance, either because they are sequential or because they do not take advantage of the gain offered by being iterative.

The better performance achieved by the latest developments in decoding algorithms offers the promise of smaller parameter sizes, but they are even less amenable to analysis. Therefore, in this part we consider the use of simulation to estimate the DFR for these recent evolutions.

In the first chapter, we formulate an assumption, supported by the analytical results, that we use to extrapolate the DFR from simulations. Using values obtained by simulation requires great rigor with regard to margins of error. We thus cover the confidence intervals for the DFR obtained from the simulation data and for the extrapolated value. Now, let us rewrite the definition of the decoding failure rate in the context of a Niederreiter cryptosystem with a sparse parity check matrix set ℋ and the set of admissible error patterns ℰ. Let 𝒲 be any subset of ℋ and 𝒟 be a decoder. In the context of decoding failures, a set of weak keys is a set 𝒲 such that

|𝒲| |ℋ| DFR 𝒟,𝒲 > 2 -𝜆 .
If this inequality is satisfied, but there is an imbalance between the factors so that

|𝒲| |ℋ|
is rather small but DFR 𝒟,𝒲 is rather large, then the estimates based on simulations could be skewed. In Chapter 15 we define and evaluate the influence of some subsets of keys on the DFR. We show a new property that links the spectrum of a key with the number of intersections between two columns in the parity check matrix. The weak keys that we define have an unusual spectrum (or equivalently an unusual number of columns intersections), we give combinatorial formulas to count them and evaluate their influence on the DFR with simulations.

Similarly, we can focus on the other side of the product He ⊺ and look at specific error patterns e. In this case, the phenomenon that we want to avoid is known as the error floor in coding theory.

For all sparse parity check matrix H, we associate ℰ H a subset of ℰ. Let 𝒟 be a decoder. In Chapter 16, we will see that the quasi-cyclic structure together with the sparseness of the parity check matrix of a QC-MDPC imply the existence of several error patterns called "near-codewords". When used to decode a pattern close to one of these near-codewords (using the Hamming distance), a decoder is more likely to fail. Once again, similar to the weak keys situation, it is a matter of counting the problematic patterns and evaluating their influence on decoding by means of simulations.

DFR

Chapter 14

A DFR extrapolation framework

Several works and simulation show that, excluding a phenomenon such as the error floor discussed in Chapter 16, the function 𝑟 ↦ log DFR 𝒟 (𝑟) is always decreasing and, at worst, it is an affine function. Similar to how security reduction often relies on the complexity of the best known algorithm to solve a particular problem (e.g. information set decoding for most code-based cryptographic schemes), we make a decoding assumption that we can use to estimate the DFR of a particular decoding algorithm.

Notations

We adopt the following notations in this chapter.

• The decoding failure rate for a QC-MDPC, with a set of keys ℋ and a set of messages ℰ for a decoder 𝒟 is written as

DFR ℰ 𝒟,ℋ = Pr [𝒟(H, He ⊺ ) ≠ e | H ∈ ℋ, e ∈ ℰ] .
• For ease of reading, when omitted, the set ℰ is by default the whole set of admissible messages ℰ = ℰ 𝑛,𝑡 = {e ∈ {0, 1} 𝑛 | |e| = 𝑡} .

• When omitted, the set ℋ is by default the whole set of admissible keys

ℋ = ℋ 𝑑,𝑤,𝑟×𝑛 = {H ∈ 𝔽 𝑟×𝑛 2 | ∀𝑖 ∈ {0, … , 𝑟 -1}, |h ⊺ 𝑖 | = 𝑤, ∀𝑗 ∈ {0, … , 𝑛 -1}, |h 𝑗 | = 𝑑} ,
• The column weight 𝑑, the row weight 𝑤, and the error weight 𝑡 will be obvious from the context and we will write

DFR(𝑟) = DFR ℰ 2𝑟,𝑡
𝒟,ℋ 𝑑,2𝑑,𝑟×2𝑟 .

The decoder security assumption

We defined a Markovian model for a simple variant of bit-flipping, the step-by-step decoder 1 . This decoder corrects fewer errors than other bit-flipping variants, however it uses the same ingredients: computing counters and flipping the corresponding positions if they are above some threshold. We fix the values of the parameters 𝑑 and 𝑡, then a model can be generated and a DFR computed for arbitrary large values of the block size 𝑟. We observe that in the range of interest for 𝑟, the function 𝑟 ↦ log DFR(𝑟) is first strictly concave and eventually decreases linearly with 𝑟.

[Til18a] also explores the asymptotic behaviour of QC-MDPC decoding. The asymptotic formula it provides for the DFR cannot be used directly because the setting is different (𝑑 and 𝑡 vary with 𝑟), and also the conditions under which it can be proven are not relevant for decoders and parameters of practical interest. However, the indication provided by the formula is consistent with the previous remark, the dominant term in the expression decreases linearly with 𝑟.

Experimentally, when plotting the DFR (obtained by simulation) vs. the block size 𝑟 in a logarithmic scale, one observes a concave curve. This was observed for all the variants of bit-flipping decoding.

As there is enough evidence from the state of the art to back this claim, we suggest formulating a decoding assumption on which we will base our estimation of the DFR. We denote 𝒟 a decoder: it is a family of decoding algorithms that can be applied to any QC-MDPC codes with fixed (𝑑, 𝑡) and variable 𝑟.

Assumption 3. For a given decoder 𝒟, and a given security level 𝜆, the function

𝑟 ↦ log DFR 𝒟 (𝑟) is concave if DFR 𝒟 (𝑟) ≥ 2 -𝜆 .
Under this assumption, a conservative estimation on the DFR can be made from the measure of the DFR for two different block sizes 𝑟 1 and 𝑟 2 . Indeed, let 𝑟 1 < 𝑟 2 < 𝑟 3 , then by definition of the concavity of a function we have

log DFR 𝒟 (𝑟 2 ) ≥ 𝑟 3 -𝑟 2 𝑟 3 -𝑟 1 log DFR 𝒟 (𝑟 1 ) + 𝑟 2 -𝑟 1 𝑟 3 -𝑟 1 log DFR 𝒟 (𝑟 3 ) as 𝑟 3 -𝑟 2 𝑟 3 -𝑟 1 , 𝑟 2 -𝑟 1 𝑟 3 -𝑟 1 ∈ [0, 1] and 𝑟 3 -𝑟 2 𝑟 3 -𝑟 1 𝑟 1 + 𝑟 2 -𝑟 1 𝑟 3 -𝑟 1
𝑟 3 = 𝑟 2 . This inequality can be rewritten as in the following proposition. Proposition 14.1. Under Assumption 3, an upper bound of the DFR for a block size 𝑟 3 can be extrapolated from the DFR for block sizes 𝑟 1 and 𝑟 2 , with 𝑟 1 < 𝑟 2 < 𝑟 3 using the following inequality: log DFR 𝒟 (𝑟 3 ) ≤ log DFR 𝒟 (𝑟 1 ) + log DFR 𝒟 (𝑟 2 ) -log DFR 𝒟 (𝑟 1 ) 𝑟 2 -𝑟 1 (𝑟 3 -𝑟 1 ) .

Another way to say it is that the secant line crossing the graph of 𝑟 ↦ log DFR 𝒟 (𝑟) at 𝑟 1 and 𝑟 2 upper bounds log DFR 𝒟 (𝑟 3 ) for any 𝑟 3 > 𝑟 2 . It is an equality when 𝑟 ↦ log DFR 𝒟 (𝑟) is affine, and this was the observed asymptotic behaviour in the Markovian model. However, in the range of values for 𝑟 usually used in simulation, the function has a faster decrease and 𝑟 1 and 𝑟 2 should be as high as the simulation and the desired precision allow.

For instance in Figure 14.1, suppose the low curve (blue) is giving the log 2 (DFR) and we are able to make accurate simulation as long as the DFR is above 2 -25 (black dots). Taking the tangent at the last point gives us the red line from which we derive an upper bound 𝑟 ′ for a block size with a DFR below 2 -128 as well as an upper bound 2 -𝑠 for the DFR for a given block size 𝑟.

Security of the system with respect to the block size

The security of a QC-MDPC based cryptosystem relates to the generic problem of decoding linear codes. Remember, from §3.3, the result that is implied by Proposition 3.5 and [START_REF] Sendrier | Decoding One Out of Many[END_REF], stating that the security of the system depends on With BIKE parameters, 𝑛 does not exceed 2 16 and the code rate is always 𝑅 = 𝑘/𝑛 = 1/2 so 𝑐 = 1. Consequently, the methodology we develop in this chapter to decrease the DFR for an algorithm by increasing the code length has very little impact on this aspect of the security of the system.

Confidence interval

The failure rate DFR ℰ 𝒟,ℋ (𝑟) is the probability of the Bernoulli trial written in Algorithm 14.1 returning False. In this section we will denote this DFR as 𝑝 for conciseness. Repeating this procedure 𝑁 times and counting the number of failures 𝐹 consitutes a random variable following a binomial distribution Bin(𝑁 , 𝑝). The ratio 𝐹 /𝑁 gives an estimate of the actual probability 𝑝 and, using a normal approximation, the standard deviation of this estimate is proportional to

√𝐹 (𝑁 -𝐹 ) 𝑁 √ 𝑁 .
To be more precise, let us recall the definition of a confidence interval.

Definition 14.2. Let 𝛼 ∈ (0, 1). Suppose we have an observable vector x = (𝑥 1 , … , 𝑥 𝑛 ) from a distribution that depends on an unknown parameter 𝜃 ∈ Θ. A confidence interval with a confidence level (1 -𝛼) for 𝜃 is obtained from a function ℐ that satisfies:

∀𝜃 ∈ Θ, Pr [𝜃 ∈ ℐ(x, 𝛼) | 𝜃] ≥ 1 -𝛼 .
The actual value of the left-hand side of this inequality is called the coverage probability. So the confidence level is the infimum of the coverage probabilities for all 𝜃 ∈ Θ.

The aforementioned normal approximation is a common way to roughly estimate a confidence interval. Some more advanced techniques were designed so that the coverage probability is closer to the desired (1 -𝛼).

A first estimation

Here we will recall the Clopper-Pearson interval also known as the exact method as it gives a coverage probability that is always above (1 -𝛼). It is a conservative method for computing a confidence interval.

Clopper-Pearson interval

First, we need to set the framework for our problem. We repeat 𝑁 times a Bernoulli process with probability of failure 𝜃. The observed number of failures is a random variable that we denote 𝑋 ∈ {0, … , 𝑁 }. 𝑋 follows a binomial distribution Bin(𝑁 , 𝜃):

Pr[𝑋 = 𝑥] = { ( 𝑁 𝑥 )𝜃 𝑥 (1 -𝜃) 𝑁-𝑥 if 𝑥 ∈ {0, … , 𝑁 }; 0 otherwise.
The probability 𝜃 is the unknown parameter that we want to estimate. This method uses the cumulative probabilities of the binomial distribution Pr[𝑋 ≥ 𝑥] and Pr[𝑋 ≤ 𝑥] for some number of failures 𝑥 and some undeternmined probability 𝜃:

Pr[𝑋 ≥ 𝑥] = 𝑁 ∑ 𝑘=𝑥 ( 𝑁 𝑘 )𝜃 𝑘 (1 -𝜃) 𝑁-𝑘 Pr[𝑋 ≤ 𝑥] = 𝑥 ∑ 𝑘=0 ( 𝑁 𝑘 )𝜃 𝑘 (1 -𝜃) 𝑁-𝑘 .
The confidence interval is a range of values for 𝜃 such that for a number of failures 𝐹 observed among 𝑁 samples is not abnormal i.e. for any probability 𝜃 in the interval, the observation happens with probability at least (1 -𝛼).

Given the monotonicity of the cumulative probabilities with respect to 𝜃, the confidence interval can be written as (𝜃 -; 𝜃 + ) with

𝜃 -= inf 𝜃 {𝜃 | Pr[𝑋 ≥ 𝐹 ] > 𝛼 2 } , 𝜃 + = sup 𝜃 {𝜃 | Pr[𝑋 ≤ 𝐹 ] > 𝛼 2 } .
Another common way to write it is: Proposition 14.3 (Clopper-Pearson [START_REF] Charles | The use of confidence or fiducial limits illustrated in the case of the binomial[END_REF]). A (1 -𝛼)-confidence interval for a failure probability 𝑝 when 𝐹 failures have been observed out of 𝑁 experiments is (𝜃 -, 𝜃 + ) where

𝜃 -= 𝐵 -1 (𝛼/2, 𝐹 , 𝑁 -𝐹 + 1) 𝜃 + = 𝐵 -1 (1 -𝛼/2, 𝐹 + 1, 𝑁 -𝐹 ) .
With 𝐵 -1 the inverse of 𝑥 ↦ 𝐵(𝑥, 𝑎, 𝑏), the incomplete beta function:

𝐵(𝑥, 𝑎, 𝑏) = Γ(𝑎 + 𝑏) Γ(𝑎)Γ(𝑏) ∫ 𝑥 0 𝑡 𝑎-1 (1 -𝑡) 𝑏-1 𝑑𝑡 .

A first estimation of confidence intervals for extrapolations

Now let us come back to our extrapolation problem. First, say we know the true probabilities 𝑝 1 = DFR(𝑟 1 ) and 𝑝 2 = DFR(𝑟 2 ). If we suppose that 𝑟 ↦ log DFR 𝒟 (𝑟) is an affine function (the extreme case of Assumption 3) then the failure probability 𝑝 3 = DFR(𝑟 3 ) for a block size

𝑟 3 > 𝑟 2 > 𝑟 1 is 𝑝 3 = 𝑝
𝑓 𝑋 𝐴 (𝑥) = | 1 𝐴 | 𝑥 1/𝐴-1 𝑓 𝑋 (𝑥 1/𝐴 ) .
With no prior knowledge on the failure probability distributions we have the following proposition.

Proposition 14.7. For 𝑖 = 1, 2, taking the uniform prior 𝑓 Θ 𝑖 (𝜃 𝑖 ) = 1, under the observation 𝑋 𝑖 = 𝑥 𝑖 , Θ 𝑖 follows a beta distribution Β(𝑥 𝑖 + 1, 𝑁 𝑖 -𝑥 𝑖 + 1):

𝑓 Θ 𝑖 | 𝑋 𝑖 =𝑥 𝑖 (𝜃) = 1 𝐵(𝑥 𝑖 + 1, 𝑁 𝑖 -𝑥 𝑖 + 1) 𝜃 𝑥 𝑖 (1 -𝜃) 𝑁 𝑖 -𝑥 𝑖
where 𝐵(𝑎, 𝑏) = Γ(𝑎)Γ(𝑏) Γ(𝑎+𝑏) .

Proof. Bayes' theorem states that:

𝑓 Θ 𝑖 | 𝑋 𝑖 =𝑥 𝑖 (𝜃) = Pr(𝑋 𝑖 = 𝑥 𝑖 | Θ 𝑖 )𝑓 Θ 𝑖 (𝜃) ∫ 1 0 Pr(𝑋 𝑖 = 𝑥 𝑖 | Θ 𝑖 )𝑓 Θ 𝑖 (𝜃)𝑑𝜃 .
Applying Corollary 14.6, we can determine the distributions of Θ 𝐴 1 and Θ 1+𝐴 2 . Then, applying Proposition 14.4

𝑓 Θ 3 | 𝑋 1 =𝑥 1 ,𝑋 2 =𝑥 2 (𝑧) = 𝑧 1/(1+𝐴)-1 𝐴(1 + 𝐴) ∫ 1 0 𝑓 Θ 1 | 𝑋 1 =𝑥 1 (𝑥 1/𝐴 )𝑓 Θ 2 | 𝑋 2 =𝑥 2 ((𝑧𝑥) 1/(1+𝐴) ) 𝑥 1/𝐴+1/(1+𝐴)-1 𝑑𝑥 .
Finally, since the integrand is non-negligible only in a narrow range of values and since we are interested in the logarithm of the DFR, we can apply a change of variable and Proposition 14.5 to obtain the following proposition. Proposition 14.8. Let Θ 𝑖 ∈ [0, 1] be a real-valued random variable for i= 1, 2. Let 𝑋 𝑖 be random variables such that under the condition that Θ 𝑖 = 𝜃 𝑖 , 𝑋 𝑖 follows a binomial distribution for 𝑖 = 1, 2: 𝑋 𝑖 | Θ 𝑖 = 𝜃 𝑖 ∼ Bin(𝑁 𝑖 , 𝜃 𝑖 ) .

Let Θ 3 ∈ [0, 1] be the random variable defined as

Θ 3 = Θ -𝐴 1 Θ 1+𝐴 2 for some constant 𝐴 > 0. 𝑓 log(Θ 3 ) | 𝑋 1 =𝑥 1 ,𝑋 2 =𝑥 2 (𝑠) = 𝑒 𝑠(𝑥 2 +1)/(1+𝐴) 𝐾 ∫ 0 -∞ 𝑒 𝑡( 𝑥 1 +1 𝐴 + 𝑥 2 +1 1+𝐴 ) (1 -𝑒 𝑡 𝐴 ) 𝑁 1 -𝑥 1 (1 -𝑒 𝑠+𝑡 1+𝐴 ) 𝑁 2 -𝑥 2 𝑑𝑡 . with 𝐾 = 𝐴(1 + 𝐴)𝐵(𝑥 1 + 1, 𝑁 1 -𝑥 1 + 1)𝐵(𝑥 2 + 1, 𝑁 2 -𝑥 2 + 1) .
We can now define the (1 -𝛼) confidence interval (log 𝜃 - 3 ; log 𝜃 + 3 ) on the extrapolated value log 𝜃 3 where log 𝜃 - 3 is such that

∫ log 𝜃 - 3 -∞ 𝑓 log(𝜃 3 ) (𝑠) 𝑑𝑠 = 𝛼/2 and log 𝜃 + 3 is such that ∫ 0 log 𝜃 + 3 𝑓 log(𝜃 3 ) (𝑠) 𝑑𝑠 = 𝛼/2 .
Proposition 14.9. Let 𝑝 1 and 𝑝 2 be the failure probabilities of two independent Bernoulli trials. Suppose, for 𝑖 = 1, 2, that we observe 𝐹 𝑖 failures out of 𝑁 𝑖 samples of each Bernoulli trial, and suppose that

𝑝 3 = 𝑝 -𝐴 1 𝑝 1+𝐴 2 .
Then a (1 -𝛼)-confidence interval for 𝑝 3 is (exp(ℓ𝑝 - 3 ), exp(ℓ𝑝 + 3 )) where ℓ𝑝 - 3 is the greatest value such that

1 𝐾 ∫ ℓ𝑝 - 3 -∞ ∫ 0 -∞ 𝑒 𝑠( 𝐹 2 +1 1+𝐴 ) 𝑒 𝑡( 𝐹 1 +1 𝐴 + 𝐹 2 +1 1+𝐴 ) (1 -𝑒 𝑡 𝐴 ) 𝑁 1 -𝐹 1 (1 -𝑒 𝑠+𝑡 1+𝐴 ) 𝑁 2 -𝐹 2 𝑑𝑡 𝑑𝑠 < 𝛼 2
and ℓ𝑝 + 3 is the smallest value such that

1 𝐾 ∫ ∞ ℓ𝑝 + 3 ∫ 0 -∞ 𝑒 𝑠( 𝐹 2 +1 1+𝐴 ) 𝑒 𝑡( 𝐹 1 +1 𝐴 + 𝐹 2 +1 1+𝐴 ) (1 -𝑒 𝑡 𝐴 ) 𝑁 1 -𝐹 1 (1 -𝑒 𝑠+𝑡 1+𝐴 ) 𝑁 2 -𝐹 2 𝑑𝑡 𝑑𝑠 < 𝛼 2 where 𝐾 = 𝐴(1 + 𝐴)𝐵(𝐹 1 + 1, 𝑁 1 -𝐹 1 + 1)𝐵(𝐹 2 + 1, 𝑁 2 -𝐹 2 + 1) .
Example 14.10. In Table 14.1 we compare the confidence intervals (DFR -, DFR + ) for extrapolated DFR at 𝑟 3 = 12 323 for two simulations data:

• BGF (9 iterations): for 𝑟 1 = 10 037, 𝐹 1 = 66 391, 𝑁 1 = 3 747 161 784, 𝑟 2 = 10 253, 𝐹 2 = 5, 𝑁 2 = 1 445 221 866,

• Backflip 7 iterations : 𝑟 1 = 10 181, 𝐹 1 = 394, 𝑁 1 = 14 576 092 619, 𝑟 2 = 10 253, 𝐹 1 = 111, 𝑁 1 = 34 283 154 045.

We can see a difference of a few bits between confidence intervals from the simple method and Proposition 14.9.

Choosing parameters

As discussed in §4.1, the security of QC-MDPC system depends mainly on the column weight 𝑑 and the error weight 𝑡, achieving a low DFR is a matter of choosing the right block size 𝑟. To achieve IND-CPA security, the parameter 𝑡 and 𝑑 should be chosen to match a certain security level 𝜆. To have IND-CCA security, we also need to make sure the DFR is less than 2 -𝜆 . In order to find the smallest 𝑟 block size having this property, we will run decoding simulations.

Under Assumption 3, the DFR can be estimated from two sets of simulations. The only varying parameter between those two sets is the block size 𝑟. Another thing to consider is how we balance the computational effort between these two sets. We assume that the block size has a negligible influence on the effort necessary to run one simulation, and we cap the total number of simulations by a value 𝑁. In total, there are four parameters to be determined:

𝑟 1 , 𝑟 2 , 𝑁 1 , 𝑁 2 (𝑁 = 𝑁 1 + 𝑁 2 ).
We then run 𝑁 𝑖 simulations with block size 𝑟 𝑖 and count the number of decoding failures 𝐹 𝑖 for 𝑖 = 1, 2. Using Proposition 14.9 we can then choose the smallest 𝑟 such that an upper bound on the DFR for this 𝑟 is below 2 -𝜆 .

However, it is difficult to choose relevant values for 𝑟 1 , 𝑟 2 , 𝑁 1 , 𝑁 2 using an analytical formula. Such a formula would also require knowing 𝑟 ↦ DFR 𝒟 (𝑟) but we only assume that it is concave.

To overcome this issue, we can rely on a heuristic. First we can compute a rough estimate of 𝑟 ↦ DFR 𝒟 (𝑟) with a polynomial interpolation and use it in a nonlinear optimization to determine the values of 𝑟 1 , 𝑟 2 , 𝑁 1 and 𝑁 2 that minimize the upper bound given in Proposition 14.9. In practice, the nonlinear optimization method described in [START_REF] John | A Simplex Method for Function Minimization[END_REF] converges quickly.

The complete heuristic is detailed in Algorithm 14.2.

is an isomorphism and an isometry for the Hamming distance.

Remark 15.3. The inverse of 𝜙 𝛿 is 𝜙 𝛿 -1 .

Remark 15.4. Previous works on weak keys for QC-LDPC or QC-MDPC codes also mention this isometry: [APRS20, §4.3] & [BDLO16, §6]. Together with the circular shifts (multiplications by 𝑥 𝑖 for all 𝑖 ∈ {0, … , 𝑟 -1}), it allows a quadratic gain on the size of a set of keys while holding similar characteristics.

Decoding

To understand the rationale behind our constructions of weak keys, let us first adopt an intuitive point of view of the bit-flipping decoder. Remember Algorithm 6.2, the bit-flipping algorithm. The counter |h 𝑗 ⋆ s| of a position 𝑗 is the number of parity check equations (rows of H) involving that position and which are unsatisfied. If the number of unsatisfied parity check equations is high, the coordinate on that position is likely to be erroneous. Finding e from the syndrome s = He ⊺ and the sparse parity check matrix H such that |e| = 𝑡 is possible by exploiting the bias in the counters. Figure 5.1 gives the number of positions with given counter values, the smaller Gaussian shape curve on the right stands for the erroneous positions. The decoder knows the counters but not the errors' location (i.e. it knows only the sum of the two curves). So Algorithm 6.2 chooses a sensible threshold 𝑇 and flips all positions with a counter above it, the syndrome is recomputed, then the counters again. This process is repeated and the error weight usually decreases after each iteration until all errors have been removed and the syndrome is zero.

Remark 15.5. When the block size decreases or the error weight increases, this usually results in a decrease of the error counters. When this happens, the small Gaussian curve in Figure 5.1 will move to the left and error detection will become more difficult-even if the threshold is adjusted-because they will be overwhelmed by the sheer mass of correct positions. Any effect that moves the small curve to the left or the large curve to the right therefore has a negative effect on the decoder behaviour. As we will see later, this is precisely what happens with weak keys.

Notations

We adopt the following notations in this chapter.

• The decoding failure rate for a QC-MDPC, with a set of keys ℋ and a set of messages ℰ for a decoder 𝒟 is written as

DFR ℰ 𝒟,ℋ = Pr [𝒟(H, He ⊺ ) ≠ e | H ∈ ℋ, e ∈ ℰ] .
• For ease of reading, when omitted, the set ℰ is by default the whole set of admissible messages ℰ = ℰ 𝑛,𝑡 = {e ∈ {0, 1} 𝑛 | |e| = 𝑡} .

• When omitted, the set ℋ is by default the whole set of admissible keys

ℋ = ℋ 𝑑,𝑤,𝑟×𝑛 = {H ∈ 𝔽 𝑟×𝑛 2 | ∀𝑖 ∈ {0, … , 𝑟 -1}, |h ⊺ 𝑖 | = 𝑤, ∀𝑗 ∈ {0, … , 𝑛 -1}, |h 𝑗 | = 𝑑} ,
• The column weight 𝑑, the row weight 𝑤, and the error weight 𝑡 will be obvious from the context and we will write

DFR(𝑟) = DFR ℰ 2𝑟,𝑡
𝒟,ℋ 𝑑,2𝑑,𝑟×2𝑟 .

Distance Spectrum

In [START_REF] Guo | A Key Recovery Attack on MDPC with CCA Security Using Decoding Errors[END_REF] the notion of spectrum for a circulant matrix was introduced. We recall its definition and significance here and show its close relashionship with the intersections between two columns in the same circulant block.

Definition 15.6. We define the distance between two positions 𝑖, 𝑗 ∈ {0, … , 𝑟 -1} in a circulant block as d(𝑖, 𝑗) = min((𝑟 + 𝑗 -𝑖) mod 𝑟, (𝑟 + 𝑖 -𝑗) mod 𝑟) .

When calculating the distances between the positions of the support of h ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1), some distances may appear several times. The number of occurrences of a distance 𝛿 is called its multiplicity:

𝜇 (𝛿, h) = |{(𝑖, 𝑗) | 0 ≤ 𝑖 ≤ 𝑗 < 𝑟, ℎ 𝑖 = ℎ 𝑗 = 1 and d(𝑖, 𝑗) = 𝛿}| .
The spectrum of h is defined as the set of all distances with their multiplicity:

Sp(h) = {(𝛿, 𝜇 (𝛿, h)) | 𝛿 ∈ {0, 1, … , ⌊𝑟/2⌋}} .
The spectral polynomial of h is defined as:

s(h) = ⌊𝑟/2⌋ ∑ 𝛿=1 𝜇 (𝛿, h) 𝑥 𝛿 .
It is shown in [START_REF] Guo | A Key Recovery Attack on MDPC with CCA Security Using Decoding Errors[END_REF] that the knowledge, even partial, of the distance spectrum of a sparse polynomial allows its complete recovery. It is also shown that the statistical analysis of error patterns leading to failures of the QC-MDPC decoder provides information on the secret key spectrum and eventually allows a key recovery attack.

New properties of the distance spectrum

Proposition 15.7. Let h ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1). We write h ⊺ = 𝜙 -1 (h) = ∑ 𝑖∈Supp(h) 𝑥 -𝑖 for any h ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1), this operation corresponds to transposing the circulant block. We have

hh ⊺ = |h| + s(h) + s(h) ⊺
where the above product of polynomials is considered in ℤ[𝑥]/(𝑥 𝑟 -1).

Proof. By expanding the product then decomposing the sum, we obtain

hh ⊺ = ⎛ ⎜ ⎝ ∑ 𝑖∈Supp(h) 𝑥 𝑖⎞ ⎟ ⎠ ⎛ ⎜ ⎝ ∑ 𝑗∈Supp(h) 𝑥 -𝑗⎞ ⎟ ⎠ = ∑ 𝑖,𝑗∈Supp(h) 𝑖=𝑗 𝑥 𝑖-𝑗 + ∑ 𝑖,𝑗∈Supp(h) 𝑖>𝑗 𝑥 𝑖-𝑗 + ∑ 𝑖,𝑗∈Supp(h) 𝑖<𝑗 𝑥 𝑖-𝑗 = ∑ 𝑖,𝑗∈Supp(h) 𝑖=𝑗 𝑥 𝑖-𝑗 + ∑ 𝑖,𝑗∈Supp(h) 𝑖<𝑗 𝑥 min(𝑖-𝑗,𝑟+𝑖-𝑗) + ∑ 𝑖,𝑗∈Supp(h) 𝑖<𝑗 𝑥 max(𝑖-𝑗,𝑟+𝑖-𝑗) = |h| + s(h) + s(h) ⊺ .
There is a one-to-one correspondence between the spectrum of a polynomial h and the number of common bits between h and its 𝛿-shift 𝑥 𝛿 h. Corollary 15.8. For all h ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1) and all 𝛿 ∈ {0, 1, … , ⌊𝑟/2⌋}, we have

(i) 𝜇 (𝛿, h) = |h ⋆ 𝑥 𝛿 h|; (ii) if 𝛿 ≠ 0, 𝜇 (1, h) = 𝜇 (𝛿, 𝜙 𝛿 (h)).
Proof. Considering coefficients indices modulo 𝑟:

𝜇 (𝛿, h) = (hh ⊺ ) 𝛿 = 𝑟-1 ∑ 𝑖=0 ℎ 𝑖 ℎ 𝑖-𝛿 = |h ⋆ 𝑥 𝛿 h| .
The second identity easily derives from 𝜙 𝛿 (𝑥h) = 𝑥 𝛿 𝜙 𝛿 (h) and the fact that 𝜙 𝛿 is an isometry for the Hamming distance.

Remark 15.9. Sp(h) = Sp(𝑥 ℓ h) for all ℓ ∈ {0, … , 𝑟 -1}.

Proposition 15.10. The application

Sp(h) → Sp(𝜙 𝑎 (h)) (𝛿, 𝑚) ↦ (𝛿 ′ , 𝑚) with 𝛿 ′ = min(𝑎𝛿 mod 𝑟, 𝑟 -(𝑎𝛿 mod 𝑟)), is a bijection. Proof. 𝜙 𝛿 (hh ⊺ ) = 𝜙 𝛿 (h)𝜙 𝛿 (h) ⊺

Distance spectrum statistics

Definition 15.11. Let h ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1). Viewed as a binary vector, we assume h starts with 0 and ends with 1, using run-length encoding it can be uniquely described as a sequence of strictly positive integers (𝑧 1 , 𝑜 1 , 𝑧 2 , 𝑜 2 , … , 𝑧 𝑠 , 𝑜 𝑠 ): it starts with 𝑧 1 zeros followed by 𝑜 1 ones, followed by 𝑧 2 zeros, etc.

We will write h ∼ (𝑧 1 , 𝑜 1 , 𝑧 2 , 𝑜 2 , … , 𝑧 𝑠 , 𝑜 𝑠 ).

Proposition 15.12. If h ∼ (𝑧 1 , 𝑜 1 , 𝑧 2 , 𝑜 2 , … , 𝑧 𝑠 , 𝑜 𝑠 ), then

𝜇 (1, h) = 𝑠 ∑ 𝑖=1 (𝑜 𝑖 -1) .
Proof. Counting the multiplicity of 𝛿 = 1 in h is simply counting the number of times there are two consecutive ones. In a block of 𝑜 𝑖 consecutive ones, this happens (𝑜 𝑖 -1) times.

The following proposition reduces the problem of fixing a multiplicity in a vector to splitting |h| ones into 𝑠 nonempty segments interleaved with 𝑠 nonempty segments of zeros of total length (𝑟 -|h|).

Proposition 15.13. Let h ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1). Suppose h ∼ (𝑧 1 , 𝑜 1 , 𝑧 2 , 𝑜 2 , … , 𝑧 𝑠 , 𝑜 𝑠 ), then { 𝑜 1 + 𝑜 2 + ⋯ + 𝑜 𝑠 = |h| ; 𝑧 1 + 𝑧 2 + ⋯ + 𝑧 𝑠 = 𝑟 -|h| and 𝜇 (1, h) = 𝑚 if and only if 𝑠 = |h| -𝑚 .
Corollary 15.14. There are exactly ( 𝑑-1 𝑑-𝑚-1 )( 𝑟-𝑑-1 𝑑-𝑚-1 ) polynomials h ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1) of weight 𝑑 starting with a zero and ending with a one such that 𝜇 (1, h) = 𝑚.

Proof. The equivalence of the previous proposition gives 𝑠 = 𝑑 -𝑚, and patterns following the two other conditions are counted using the "stars and bars" principle.

To count the number of general patterns h such that 𝜇 (1, h) = 𝑚, circular shifts of patterns starting with a zero and ending with a one have to be considered. However not all shifts are possible as we need to avoid counting several times the same configuration. For example shifting h ∼ (𝑧 1 , 𝑜 1 , 𝑧 2 , 𝑜 2 , … , 𝑧 𝑠 , 𝑜 𝑠 ) by (𝑧 1 + 𝑜 1 ) positions would give 𝑥 -(𝑧 1 +𝑜 1 ) h ∼ (𝑧 2 , 𝑜 2 , … , 𝑧 𝑠 , 𝑜 𝑠 , 𝑧 1 , 𝑜 1 ).

For the sake of clarity, let us generalize our ∼ notation for any pattern h.

h ∼ (𝑧 1 , 𝑜 1 , … , 𝑧 𝑠 , 𝑜 𝑠 ) ℓ with ⎧ { { ⎨ { { ⎩ 𝑠 = 𝑑 -𝑚 ; 𝑜 1 + ⋯ + 𝑜 𝑠 = 𝑑 ; 𝑧 1 + ⋯ + 𝑧 𝑠 = 𝑟 -𝑑 ; ℓ ∈ {0, … , 𝑧 1 + 𝑜 1 -1} .
Corollary 15.17. For given integers 𝑚, 0 ≤ 𝑚 < 𝑑, and 𝛿, 1 ≤ 𝛿 ≤ ⌊𝑟/2⌋, there are

𝒩 𝑚 ∶= 𝑟 𝑑 -𝑚 ( 𝑑 -1 𝑑 -𝑚 -1 )( 𝑟 -𝑑 -1 𝑑 -𝑚 -1 ) polynomials h ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1) of weight 𝑑 such that 𝜇 (𝛿, h) = 𝑚.
Proof. When 𝛿 = 1 the result derives from Proposition 15.16.

• First, if 𝑚 < 𝑑 -1, all values 𝑧 1 , … , 𝑧 𝑠 and 𝑜 1 , … , 𝑜 𝑠 are at least 1, so 𝑧 1 ∈ {1, … , 𝑟 -𝑑 -(𝑠 -1)} and 𝑜 1 ∈ {1, … , 𝑑 -(𝑠 -1)}. If 𝑧 1 and 𝑜 1 are fixed, Corollary 15.14 tells us that there are ( 𝑑-𝑜 1 -1 𝑑-𝑚-2 )( 𝑟-𝑑-𝑧 1 -1 𝑑-𝑚-2 ) ways to choose the values of 𝑧 2 , … , 𝑧 𝑠 and 𝑜 2 , … , 𝑜 𝑠 . Accounting for the different (𝑧 1 + 𝑜 1 ) possible values of ℓ, we obtain

𝑟-2𝑑+𝑚+1 ∑ 𝑧 1 =1 𝑚+1 ∑ 𝑜 1 =1 (𝑧 1 + 𝑜 1 )( 𝑑 -𝑜 1 -1 𝑑 -𝑚 -2 )( 𝑟 -𝑑 -𝑧 1 -1 𝑑 -𝑚 -2 ) = 𝑟 𝑑 -𝑚 ( 𝑑 -1 𝑑 -𝑚 -1 )( 𝑟 -𝑑 -1 𝑑 -𝑚 -1
) .

• Now if 𝑚 = 𝑑 -1, then the only relevant patterns are the 𝑟 shifts of the pattern consisting of 𝑧 1 consecutive zeros followed by 𝑜 1 ones.

The generalization to any value of 𝛿 derives from the identity 𝜇 (1, h) = 𝜇 (𝛿, 𝜙 𝛿 (h)) of Corollary 15.8. 1.03 ⋅ 10 -9 1.01 ⋅ 10 -9 12 4.05 ⋅ 10 -15 2.49 ⋅ 10 -11 2.44 ⋅ 10 -11 13 8.74 ⋅ 10 -17 5.39 ⋅ 10 -13 5.28 ⋅ 10 -13 14 1.69 ⋅ 10 -18 1.04 ⋅ 10 -14 1.02 ⋅ 10 -14 can be written as the conjunctive normal form (CNF)

ℎ 0 ℎ 𝛿 ∧ ℎ 1 ℎ 𝛿+1 ∧ ⋯ ∧ ℎ 𝑟-1 ℎ 𝛿-1 ≡ (ℎ 0 ∨ ℎ 𝛿 ) ∧ (ℎ 1 ∨ ℎ 𝛿+1 ) ∧ ⋯ ∧ (ℎ 𝑟-1 ∨ ℎ 𝛿-1 ) .
To further simplify the system, one can use the fact that at least one multiplicity is nonzero and a lot of variables can be removed. This comes from the fact that the equation system has at least 2𝑟 solutions: if one vector is a solution then so are its circular shifts and the transpositions of its circular shifts. Therefore, if we know that 𝜇 (𝛿 ′ , h) > 0 then we can fix ℎ 0 = ℎ 𝛿 ′ = 1 and the above CNF gives ℎ 𝛿 = ℎ 𝑟-𝛿 = ℎ 𝛿+𝛿 ′ = ℎ 𝛿 ′ -𝛿 = 0. So each zero multiplicity in the spectrum can fix the value of at most four variables.

Reconstructing a block with 𝑟 = 12 323 and 𝑑 = 71 from this simplified system takes less than a second using the SMT solver z3. In comparison, the algorithm proposed in [START_REF] Guo | A Key Recovery Attack on MDPC with CCA Security Using Decoding Errors[END_REF] is a depth-first search and does not use the information provided by the multiplicities.

Also, this modelisation tells us that if h is irreducible, the key reconstruction from the spectrum only has two solutions: h and h ⊺ .

Weak keys: Constructions and properties

IND-CCA security and weak keys for KEMs

Remember from Definition 2.4 that a KEM (KeyGen, Encaps, Decaps) is said to be 𝛿-correct if Pr [Decaps(sk, 𝑐) ≠ 𝐾 | (pk, sk) ← KeyGen({0, 1} 𝜆 ); (𝐾, 𝑐) ← Encaps(pk)] ≤ 𝛿 .

And remember that for [BIKE], since the encapsulation includes a randomization, 𝛿 is the average DFR for a specific decoder, for any key and any error vector.

We can summarize Theorem 2.5 in the case of where 𝜖 encompasses the advantage related to the underlying difficult problems and therefore does not depend at all on the decoder used for the system. This 𝜖 is dealt with in the usual manner: proper semantically secure transform and system parameters selection according to the computational assumptions.

If one wants to challenge the fact that the decoder actually offers the required security, i.e. its failure rate is less than 2 -𝜆 , one could present a set of weak keys 𝒲 ⊂ ℋ. The average DFR for these keys DFR 𝒟,𝒲 would have to be higher than DFR 𝒟,ℋ but its density would also have to be high enough to contribute significantly to the average DFR, i.e. the set 𝒲 has to be such that

|𝒲| |ℋ| DFR 𝒟,𝒲 > 2 -𝜆 .
In the following sections we will construct three categories of weak keys and evaluate the left-hand side of the above inequality.

Type I

In [START_REF] Drucker | On constant-time QC-MDPC decoding with negligible failure rate[END_REF], weak keys are specified as (h 0 , h 1 ) with

h 0 = (1 + 𝑥 + … + 𝑥 𝑓-1 ) + h ′ 0 such that |h ′ 0 | = 𝑑 -𝑓 and |(1 + 𝑥 + … + 𝑥 𝑓-1 ) ⋆ h ′ 0 | = 0
for 𝑓 in a range from 0 to 40. Authors observe that the correcting capability deteriorates as 𝑓 grows. Values as high as 40 always lead to a decoding failure in simulation.

The reason for this degradation comes from the fact that, compared to a typical key, a weak key admits column pairs with a larger intersection in its private parity check matrix. This can be seen by computing the spectral polynomial of h 0 :

s(h 0 ) = h 0 h 0 ⊺ = (1 + 𝑥 + … + 𝑥 𝑓-1 )(1 + 𝑥 -1 + … + 𝑥 -(𝑓-1) ) + s ′ = 𝑓 + (𝑓 -1)𝑥 + … + 𝑥 𝑓-1 + s ′
where s ′ has nonnegative coefficients. So any column 𝑥 𝑗 h 0 has at least (𝑓 -1) intersections with its two neighbours 𝑥 𝑗±1 h 0 , at least (𝑓 -2) intersections with 𝑥 𝑗±2 h 0 , etc. The typical maximum column intersection of BIKE keys is small: for (𝑟, 𝑑) = (12 323, 71) about a quarter of the keys have a maximal column intersection greater than 5 (see Table 15.1). More intersections between columns mean higher correlations between their counters. In Figure 15.1 we measure the difference between the weak keys defined above with parameter 𝑓 = 20 and random keys. With a weak key, an erroneous position tends to have lower counter when its immediate neighbour is erroneous. Conversely, still with a weak key, a non-erroneous position tends to have higher counter when its neighbour is erroneous.

Intuitively, this means that (i) neighbours that are both erroneous tend to hide each other and (ii) an erroneous position will contaminate its correct neighbours. Both effects negatively impact the (threshold-based) decoder (see Remark 15.5). Indeed, a higher counter on average for correct positions implies that more of them are above the threshold and are thus being flipped, adding errors. A lower counter for errors implies that more of them are below the threshold and are thus left unchanged, not decreasing the error weight.

As the decoding degradation is explained by the abnormal distribution of multiplicities in the spectrum of a block, we can generalize the construction of the weak keys. Using Remark 15.9 and Proposition 15.10, from one key defined as in [START_REF] Drucker | On constant-time QC-MDPC decoding with negligible failure rate[END_REF] we derive many more with the same multiplicity distribution (up to a permutation of the distance values in the spectrum). In Definition 15.21, the constructed keys are such that 𝜇 (𝛿, h 𝑖 ) ≥ 𝑓-1, 𝜇 (2𝛿, h 𝑖 ) ≥ 𝑓-2, … , 𝜇 ((𝑓 -1)𝛿, h 𝑖 ) ≥ 1.

Type II

Instead of having several high multiplicities at the same time, Type II weak keys only increase the multiplicity of a single distance. We will see that they have a lower impact on DFR for a given multiplicity, but a higher density. Type III keys are slightly denser, but their count is very close to the count for Type II.

Type III

Weak keys of Type I and II have properties that concern only one block of the parity check matrix. We can also define weak keys that have many intersections between two columns of two different blocks.

Definition 15.26. We call weak key of Type III and parameter 𝑚, a key h = (h 0 , h 1 ) such that |h 0 ⋆ 𝑥 ℓ h 1 | = 𝑚 for some ℓ ∈ {0, … , 𝑟 -1}. .

We shift the Type I curve (𝑚 = 𝑓 -1) to align the multiplicities. As we will observe in §15.5, the Type I keys have a worse effect on decoding for a given multiplicity. We observe also that for large multiplicity (roughly above 𝑓 = 21 for Type I, and above 𝑚 = 27 for Type II and III) the density is small enough to make those keys harmless (assuming a target of 128 bits of security), regardless of their impact on decoding.

DFR estimations

To estimate the DFR for weak keys, we will rely on the framework developed in Chapter 14 based on Assumption 3. To be more precise, we assume in this section that for any subset of keys 𝒲 ⊂ ℋ, the function 𝑟 ↦ DFR 𝒟,𝒲 (𝑟) is concave. In other words, the high distance multiplicity will not have a stronger effect when the block size gets larger, but will affect the decoder similarely for any block size.

In Figure 15.3 & 15.4 & 15.5, we give simulation results for all the types of weak keys previously defined with several values for 𝑓 or 𝑚 using BGF with 7 iterations. We can see that no set of weak keys seems to be any threat as the product of their density by their average DFR is always below 2 -𝜆 , 𝜆 = 128.

We can observe that Type I keys with 𝑓 ≥ 10 and Type II and III with 𝑚 ≥ 14 have a negligible influence on the average DFR since their densities multiplied by their DFR are well below 2 -𝜆 . For the other weak keys, with lower mutiplicity, the estimated DFR for weak keys is within the confidence interval of the average DFR obtained with random keys. This means that for 𝑓 < 10 and 𝑚 < 14 we did not observe in our experiment a measurable difference in the decoder's DFR between weak keys and random keys. While all types of weak keys that we established have at least a pair of columns with (𝑓 -1) (for Type I) or 𝑚 (for Type II or III) intersections, some differences explain the different DFR. In a weak key of Type I and parameter 𝑓, a column 𝑥 𝑗 h 𝑖 has at least (𝑓 -1) intersections with its two neighbours 𝑥 𝑗±𝛿 h 𝑖 , at least (𝑓 -2) intersections with 𝑥 𝑗±2𝛿 h 𝑖 , etc. In a weak key of Type II and parameter 𝑚, a column 𝑥 𝑗 h 𝑖 has exactly 𝑚 intersections with its two neighbours 𝑥 𝑗±𝛿 h 𝑖 . And in a weak key of Type III and parameter 𝑚, a column 𝑥 𝑗 h 0 has exactly 𝑚 intersections with a single column 𝑥 𝑗 ′ h 1 . Chapter 16

Error floors: Subsets of error patterns LDPC codes and Turbo codes are known to suffer from a phenomenon called error floor (see [START_REF] Garello | On error floor and free distance of turbo codes[END_REF][START_REF] Richardson | Error Floors of LDPC Codes[END_REF]). When the signal-to-noise ratio increases, the decoding performance of these codes first undergoes a sharp decrease in a region called the waterfall region, then there is a sudden change in slope and the performance flattens out (see Figure 16.1) This latter phenomenon is called the error floor. Just like LDPC codes, QC-MDPC codes are not spared from error floor phenomena. However, the techniques used to estimate the error floor of LDPC codes usually rely on enumerating subgraphs of the Tanner graph of the code. The Tanner graph is denser for an MDPC code and these methods are usually not practical. To initiate the discussion of the techniques used in this chapter, let us first consider the case of a minimum distance decoder.

Waterfall

Minimum distance decoding.

We assume that we decode an error pattern of weight 𝑡 in a QC-MDPC code with 𝒟 a minimum distance decoder (i.e. it outputs the smallest possible error pattern e which, when added to the input, gives a codeword).

Recall that we have defined the DFR as the probability that the decoder outputs an error vector that is different from the one that was used to compute the syndrome: So, taking each row of G, we see that there are 𝑟 codewords of weight 𝑤, they are all obtained by circularly shifting the first row. As 𝑤 is well below the Gilbert-Varshamov bound, it is safe to assume that there are no smaller codewords in the general case. Moreover, most of the parameters used to instantiate a QC-MDPC system will take into account the slight asymmetry in the cost of the key and message attacks respectively (because of [START_REF] Sendrier | Decoding One Out of Many[END_REF]) by having 𝑤 > 𝑡. Therefore, in (16.2), since the sum is zero when 𝑤 > 2𝑡, the sum of two codewords with weight 𝑤 will probably not trigger a decoding failure because they have a weight slightly less than 2𝑤. In the end we are only concerned by the 𝑟 codewords of weight 𝑤.

Given the previous remark and the fast decay in the summand when 𝑖 grows in (16.2), we can approximate the probability of having a bad error pattern with Numerical application of this formula are given in Table 16.1. We can see that it is always negligible compared to 2 -𝜆 where 𝜆 is the security parameter. In this chapter we will see that in practice, as the decoder is not minimum distance and is typically a bit-flipping decoder, we can slightly relax the construction of e ′ in (16.1). Indeed, we will see that c need not necessarily be a codeword (it can be a near-codeword) and that we can choose |e ′ | > 𝑡. Although these new conditions do not necessarily trigger a decoding failure, they do have a negative impact on decoding performance to an extent that we will quantify using simulations.

In a QC-MDPC code, the quasi-cyclicity of the code endows it with a polynomial structure. Together with the fact that by definition it has a sparse parity check matrix, and it is defined in a field of characteristic 2, we shall see that many near-codewords can be found. We will build subsets of error patterns that are spheres around codewords or near-codewords for a certain radius. We will see that, using a bit-flipping decoder, they have a higher DFR. The density of these subsets multiplied by their DFR is a lower bound of the average DFR. Since the slope is rather flat when 𝑟 increases, we refer to the curve of this lower bound as the error floor.

Notations

We adopt the following notations in this chapter.

• The decoding failure rate for a QC-MDPC, with a set of keys ℋ and a set of messages ℰ for a decoder 𝒟 is written as • For ease of reading, when omitted, the set ℰ is by default the whole set of admissible messages ℰ = ℰ 𝑛,𝑡 = {e ∈ {0, 1} 𝑛 | |e| = 𝑡} .

• When omitted, the set ℋ is by default the whole set of admissible keys

Structured patterns in QC-MDPC codes 16.2.1 Low weight codewords

There is an isometry between codewords of a QC-MDPC code of rate 1/2 and those of its dual. The following definition describes the set of codewords of weight 𝑤 for a QC-MDPC. For a set 𝒮 that is either 𝒞, 𝒩 or 2𝒩, we define the set of error patterns e that are near 𝒮. We set the distance to these sets via the constant ℓ = |e ⋆ c|. ( 𝑡-ℓ 𝑘 )( 𝑛-𝑤-𝑡+ℓ 𝑡-ℓ-𝑘 ) ( 𝑛-𝑤 𝑡-ℓ )

.

Multiplying the right-hand side by |𝑆| 2 ( 𝑤 ℓ ) 2 gives a really rough upper bound on the proportion of duplicates in Proposition 16.5. This is negligible for ℓ < 45 with (𝑟, 𝑑, 𝑡) = (12 323, 71, 134) and 𝑆 ∈ {𝒞, 𝒩, 2𝒩}. In this case, the upper bound 𝒟 𝑡,𝑤+𝑡-2ℓ (𝑆) is really close to the actual density. In Figure 16.2 we give the density of all the sets of error patterns described in the previous section for (𝑟, 𝑑, 𝑡) = (12 323, 71, 134). We can see, for each set, the range of distance of interest for our analysis i.e. those that have a density greater that 2 -128 . We now suppose that c is one of those. In Table 16.2, we give statistics for different sets 𝒮 and different values of ℓ, namely the syndrome weight and the distribution of the counters classified according to whether they concern a position belonging to e ⟂ , h ⟂ , p or none of these. Remember that for a bit-flipping iteration to be efficient, the counters of positions in the support of e have to be higher than the others. What we can observe from the table is that as ℓ increases, the counters of positions in the support of e ⟂ or c ⟂ increase, while those of p and the others decrease. In other words, the algorithm is more likely to mistakenly add errors by flipping positions in the support of c ⟂ and miss the errors in p ⊂ e. It is also interesting to point out that this influence on the counters as well as on the syndrome weight can even be observed for small values of ℓ.

Influence

Note that as all the sets 𝒞, 𝒩 or 2𝒩 are stable by blockwise circular shifts, any error pattern has at least one intersection with one of them, and is highly likely to have two. Therefore, depending on the set 𝒮, the set 𝒜 𝑡,ℓ (𝑆) might be empty for lower values of ℓ.

Lower bound on the DFR with simulations

Using Algorithm 16.1, we can evaluate the DFR on the sets 𝒜 𝑡,ℓ (𝑆) for any decoding algorithm, any ℓ, and 𝑆 ∈ {𝒞, 𝒩, 2𝒩}. Figure 16.3 & 16.4 & 16.5 gives DFR estimates for various decoders. We can observe that the product of the density of the sets 𝒜 𝑡,ℓ (𝒞), 𝒜 𝑡,ℓ (𝒩), 𝒜 𝑡,ℓ (2𝒩) multiplied by the obtained DFR is increasing. But we eventually reach the limits of what can be obtained with simulation. It would not be surprising if as the distance increases, the DFR converges to its average value (which is expected to be below 2 -𝜆 ).

We can also see in those figures that the near-codewords in 𝒩 seem to have the most influence on the decoder in comparison to the other sets 𝒞 or 2𝒩.

Comments

Not that the DFR obtained are not the results of extrapolations and this construction gives directly a lower bound on the DFR. The (small) imprecision on these values comes from the fact that we only compute a bound on the density of the considered sets and the fact that the DFR is estimated with simulation. As discussed in the previous section, the former is really tight and, for the latter, estimations are given with their 99% confidence interval.

While decoders are slowed down by the closeness of problematic patterns, we observe that failures would not be avoided by simply increasing the number of iterations. Error patterns are either decoded in a few iterations or they are never decoded.

The technique described here for generating error patterns close to 𝒩 provides a good way to test decoders' borderline cases. For example, although the threshold selection rules for BlackGray decoders are not explicitly described in [START_REF] Drucker | QC-MDPC Decoders with Several Shades of Gray[END_REF], the additional implementation of [BIKE] (for versions prior to and including 3.2) implemented a BlackGray decoder and used a simple affine function of the syndrome weight. Our early work on error floors showed that this resulted in the existence of a subset of error patterns whose average DFR multiplied by the density was well above 2 -𝜆, thus threatening the IND-CCA security of the system. In this case, the solution was to set a minimum value for the threshold at (𝑑 + 1)/2.

Conclusion

We first studied a sequential bit-flipping algorithm that updates the syndrome and recalculates its threshold after each flip. It was designed primarily to be stochastic and suitable for a probabilistic analysis. However, it has led us to design algorithms based on a novel idea which consists in regularly cancelling old flips. This idea has been concretized in a more efficient way with Backflip. Backflip is particularly efficient, especially when it performs a large number of iterations. Interestingly, it performs better than the soft-decision decoding algorithm to which we compared it. This work was published in [SV20a] and Backflip was suggested in [BIKE] for the second round of the NIST strandardization process. Finally, we discussed the efficiency of gray decoders.

We then studied two probabilistic models of decoders. For the first one, we managed to incorporate a feature that has not been fully taken into account so far in the analyses of decoding algorithms, namely the quasi-cyclicity of the code and the regularity that it implies. Our model accurately predicts the behaviour of an iteration of parallel bit-flipping, and gives us the distribution of the error weight after one iteration. The second model concerns the step-by-step decoder mentioned above. This model is able to handle the complete algorithm execution not just one iteration. Compared to the previous model, it is less accurate in this case. An interesting application for this algorithm and its analysis is to use it at the end of decoding when there is not many errors left to decode. This is what can be done with an iteration of a gray decoder for example. This work on the Markovian model has been published in [SV19].

Finally, we presented a DFR extrapolation framework. It is based on an assumption that followed the conclusions obtained from the DFR models. We have rigorously determined the confidence intervals associated with these extrapolations. We then constructed some sets of weak keys that were justified by structural properties of quasi-cyclic codes. This work is the object of a preprint [START_REF] Sendrier | On the existence of weak keys for QCMDPC decoding[END_REF]. Then we shed light on the existence of near codewords due to this structure, and assessed their influence on decoding. This provides a lower bound on the DFR and ensures that extrapolations are not wrong. These extrapolation techniques and checks against weak keys and error floors were used extensively for the selection of [BIKE]'s IND-CCA parameters.

Perspectives. We have presented efficient algorithms, but many aspects of their implementations are based on simulations and optimizations. It would be interesting to have a better understanding and justification of ttl functions or the thresholds used to define the gray positions.

The proximity to near codewords emerges as crucial in understanding the decoding instances that fail. In particular, it has an influence on the syndrome weight and counters distributions. Models could greatly benefit from conditioning these distributions to the distance to a near codeword.

Errors appear in model predictions when we try to iterate it beyond one iteration because of the correlations that appear when decoding. It would be interesting to see to what extent these correlations can be related to the near codewords we found, i.e. how much the algorithm tends to increase the number of bits in common with a row of the parity check matrix.

Concerning weak keys, with those of Type I, each column has a large intersection with several columns, and with those of Type II and III, each column has a large intersection with only one (or two) other columns. There is a range of possibilities between these two extremes that it would be interesting to investigate. For example, we could consider keys that have two distances with a high multiplicity, or three, etc.

  𝑞,H ∈ 𝔽(𝑛-𝑘)×𝑛 𝑞 , c = mG , s = He ⊺ .

(𝑣

  𝑛-𝑘)×𝑛 𝑞 is a parity check matrix for an [𝑛, 𝑘]-code 𝒞 then 𝒞 = {c ∈ 𝔽 𝑛 𝑞 | Hc ⊺ = 0} . 10 Chapter 1. Coding theory Remark 1.7. If G ∈ 𝔽 𝑘×𝑛 𝑞 and H ∈ 𝔽 (𝑛-𝑘)×𝑛 𝑞 are respectively a generator and a parity check matrices of a code 𝒞 then we have 1.3 Minimum distance & Gilbert-Varshamov distance Definition 1.15. The support of a vector v ∈ 𝔽 𝑛 𝑞 is the set of indices of its nonzero entries: Supp(v) ∶= {𝑖 ∈ {0, … , 𝑛 -1} | 𝑣 𝑖 ≠ 0} . We use the same notation for polynomials Supp ( 𝑖 𝑥 𝑖 ) ∶= {𝑖 ∈ {0, … , 𝑛 -1} | 𝑣 𝑖 ≠ 0} . Definition 1.16. The Hamming weight |v| of a vector (or a polynomial) v is the number of its nonzero entries |v| ∶= |Supp(v)| . The Hamming distance 𝑑(a, b) between two vectors a and b is the Hamming weight of the difference between a and b: 𝑑(a, b) ∶= |a -b| .Definition 1.17. The minimum distance of a code 𝒞 is the minimum distance between two distinct codewords: minc 0 ,c 1 ∈𝒞 c 0 ≠c 1 𝑑(c 0 , c 1 ) .Remark 1.18. For a linear code, we have minc 0 ,c 1 ∈𝒞 c 0 ≠c 1 𝑑(c 0 , c 1 ) = min c∈𝒞 c≠0|c| .Definition 1.19. Let 𝑞, 𝑛 and 𝑘 be integers. The Gilbert-Varshamov distance 𝑑 𝐺𝑉 (𝑞, 𝑛, 𝑘) is the smallest integer 𝑑 such that -1) 𝑖 ≥ 𝑞 𝑛-𝑘 .

Definition 1. 23 .

 23 Let 𝑥 be the binary random variable transmitted over a binary symmetric channel of crossover probability 𝜖, let us write the received binary random variable 𝑦. Then we havePr [𝑥 = 0 | 𝑦 = 0] = Pr [𝑥 = 1 | 𝑦 = 1] = 1 -𝜖 , Pr [𝑥 = 0 | 𝑦 = 1] = Pr [𝑥 = 1 | 𝑦 = 0] = 𝜖 .

((

  𝑣 𝑖 ⋅ 𝑤 𝑖 )𝑥 𝑖 .Proposition 1.25. The Schur product is distributive over the addition:u ⋆ (v + w) = u ⋆ v + u ⋆ w .Proposition 1.26. For any integer 𝑛 > 0, let 𝑣, 𝑤 ∈ 𝔽 𝑛 2 , then |v + w| = |v| + |w| -2 |v ⋆ w| . Proof. v + v ⋆ w and w + v ⋆ w have disjoint support and weight respectively |v| -|v ⋆ w| and |w| -|v ⋆ w|, |v + w| = |(v + v ⋆ w) + (w + v ⋆ w)| .

Figure 2 . 1 :

 21 Figure 2.1: Security games

  Conditioned by |s| = 5 000 and 𝑋 = ∑ 𝑗∈e 𝜎 𝑗 -|s| = 912 .

Figure 5 . 1 :

 51 Figure 5.1: Counters distributions and threshold for (𝑟, 𝑑, 𝑡) = (12 323, 71, 137) .

Figure 6 . 1 :Figure 6 . 2 :

 6162 Figure 6.1: Counters distributions and threshold for (𝑟, 𝑑, 𝑡) = (12 323, 71, 137)

Algorithm 7. 2 :

 2 Sampling a position in two unsatisfied equations. function precompute_spectrum(𝑟, (h 0 , h 1 )): input : Block size 𝑟, a parity check matrix (h 0 , h 1 ) ∈ (𝔽 2 [𝑥]/(𝑥 𝑟 -1)) 2 . output : The array of lists spectrum: (𝑘, ℓ) ∈ spectrum[𝛿] if and only if the rows at indices 0 and 𝛿 of the circulant matrix defined by h 𝑘 intersect in position ℓ. spectrum ← {∅ | 𝑖 ∈ {0, … , ⌊𝑟/2⌋}};

  Figure 7.1: DFR vs. block size with step-by-step. (𝑑, 𝑡) = (71, 134). 99%-confidence intervals.

Algorithm 7. 3 :

 3 Non-blocking step-by-step bit-flipping.

  Algorithm 8.1: Backflip. function backflip ⟂ (H, s): input : A sparse parity check matrix H ∈ 𝔽 (𝑛-𝑘)×𝑛 2 , a syndrome s = He ⊺ ∈ 𝔽 𝑛-𝑘 2 . output : An error pattern e ′ ∈ 𝔽 𝑛 2 such that He ′ ⊺ = s. e ′ ← 0; s ′ ← s -He ′ ⊺ ; /* Time-to-live of flips. */ D ← 0; while s ′ ≠ 0 do /* Undo flips reaching their time-of-death. */ for 𝑗 ∈ {0, … , 𝑛 -1} do

  Threshold selection rule. Here we have threshold(context) = threshold(|s| , 𝑡 -|e ′ |) = 𝑇 where T is defined as in §6.1.3.1 with 𝜋 0 and 𝜋 1 calculated by substituting 𝑡 for 𝑡 -|e ′ | and 𝑆 for |s ′ |:

Figure 8 . 1 :

 81 Figure 8.1: DFR vs. block size with Backflip (9 iterations) for different affine ttl functions ttl(𝜎) = max(1, ⌊𝑎 𝛿 + 𝑏⌋)). (𝑑, 𝑡) = (71, 134). 99%-confidence intervals.

Figure 8 . 2 :

 82 Figure 8.2: DFR vs. block size with Backflip. ttl(𝛿) = max(1, ⌊0.45 𝛿 + 1.1⌋) (𝑑, 𝑡) = (71, 134). 99%-confidence intervals.

Algorithm 9. 1 :

 1 Gray bit-flipping. function gray_bitflip ⟂ (H, s): input : A sparse parity check matrix H ∈ 𝔽 (𝑛-𝑘)×𝑛 2 , a syndrome s = He ⊺ ∈ 𝔽 𝑛-𝑘 2 . output : An error pattern e ′ ∈ 𝔽 𝑛 2 such that He

Figure 9 . 1 :Figure 9 . 2 :Figure 9 . 3 :Figure 9 . 4 :

 91929394 Figure 9.1: Evolution of the counters between the first two iterations (fixed threshold 𝑇 = 42). (𝑟, 𝑑, 𝑡) = (12 323, 71, 134) -10 8 samples.(White when no data, otherwise the darker the shade the lower the probability.)

Figure 9 . 5 :

 95 Figure 9.5: DFR vs. block size with BGF. threshold (|s ′ |) = max ((𝑑 + 1)/2, ⌊0.0069722 |s ′ | + 13.53⌋). (𝑑, 𝑡) = (71, 134). 99%-confidence intervals.

Figure 9 . 6 :

 96 Figure 9.6: DFR vs. block size with sorting variant of the gray decoder. (𝑑, 𝑡) = (71, 134). 99%-confidence intervals.

  Classic bit-flipping -100 it.Belief propagation -100 it.Backflip (multi-thresh.) -100 it.

Figure 9 . 7 :

 97 Figure 9.7: DFR vs. block size with various decoders (summary).(𝑑, 𝑡) = (71, 134). 99%-confidence intervals.

Definition 10. 1 .

 1 Consider a bipartite graph of 𝑛 𝑑-regular nodes on the left and (𝑑/𝑤) ⋅ 𝑛 𝑤-regular nodes on the right. It has expansion (𝛼, 𝛽) if for any subset 𝑆 of nodes on the left such that |𝑆| ≤ 𝛼𝑛 then the set of its neighbors 𝒩(𝑆) satisfies |𝒩(𝑆)| ≥ 𝛽 ⋅ 𝑑 ⋅ |𝑆| .

  ∈ {0, … , 𝑛 -1}, 𝑖 ≠ 𝑗 ⇒ |h 𝑖 ⋆ h 𝑗 | ≤ 𝐼 . We now consider an error pattern e, it gives the syndrome s = ∑ 𝑗∈Supp(e) h 𝑗 . Now let us write the counter 𝜎 𝑖 ∶= |h 𝑖 ⋆ ∑ 𝑗∈Supp(e) h 𝑗 | = |∑ 𝑗∈Supp(e) h 𝑖 ⋆ h 𝑗 | for position 𝑖 and separate the cases where 𝑖 belongs to the support of e from the case where it does not.

  The bit-flipping decoder can decode an error pattern of weight 𝑡(𝑛) = 𝑂( √ 𝑛) with a failure probability upper bounded by 𝑒 -Ω(𝑛 log log 𝑛 log 𝑛 ) .

Algorithm 11. 1 :

 1 One iteration of parallel bit-flipping. function one_parallel_iteration ⟂ (H, s 0 ): input : A sparse parity check matrix H ∈ 𝔽 (𝑛-𝑘)×𝑛 2 , a syndrome s 0 = H(e 0 ) ⊺ ∈ 𝔽 𝑛-𝑘 2 . output : The error pattern difference after one iteration e ′ ∈ 𝔽 𝑛 2 . e ′ ← 0; s 1 ← s 0 ; 𝑇 ← threshold (|s 0 |); for 𝑗 ∈ {0, … , 𝑛 -1} do if |h 𝑗 ⋆ s 0 | ≥ 𝑇 then 𝑒 ′ 𝑗 ← 1 -𝑒 ′ 𝑗 ; s 1 ← s 0 -He ′ ⊺ ; return e ′ In our configuration, we have |e 0 | = 𝑡 0 = 𝑡 and s 0 = H(e 0 ) ⊺ . After one iteration, we will have e 1 = e 0 + e ′ and s 1 = H(e 1 ) ⊺ . We also define for 𝑖 = 0, 1, 𝑡 𝑖 ∶= |e 𝑖 | , 𝑆 𝑖 ∶= |s 𝑖 | and 𝑋 𝑖 ∶= ⎛ ⎜ ⎝ ∑ 𝑗∈e 𝑖 |h 𝑗 ⋆ s 𝑖 | ⎞ ⎟ ⎠ -𝑆 𝑖 .

ℰ

  𝑛,𝑡 = {e ∈ {0, 1} 𝑛 | |e| = 𝑡} , • ℋ 𝑑,𝑤,𝑟×𝑛 is the set of regular 𝑟 × 𝑛 parity check matrices of column weight 𝑑 and row weight 𝑤 ℋ 𝑑,𝑤,𝑟×𝑛 = {H ∈ 𝔽 𝑟×𝑛 2 | ∀𝑖 ∈ {0, … , 𝑟 -1}, |h ⊺ 𝑖 | = 𝑤, ∀𝑗 ∈ {0, … , 𝑛 -1}, |h 𝑗 | = 𝑑} .

•

  𝑓 * 𝑓 * 𝑓 * ⋯ * 𝑓 * 𝑓 ⏟⏟⏟⏟⏟⏟⏟⏟⏟ 𝑁 . We indicate the probability of an event 𝐸 conditioned on (11.1), the equations implied by the regularity of the code, by Pr reg [𝐸] .

Figure 11 . 1 :

 111 Figure 11.1: Illustration of the reordering of the parity check matrix.

  Proposition 11.4. 1 Let H be drawn uniformly at random in ℋ 𝑑,𝑤,𝑟×𝑛 and e drawn uniformly at random in ℰ 𝑛,𝑡 . The syndrome weight 𝑆 = |He ⊺ | and the value 𝑋 = (∑ 𝑗∈e 𝜎 𝑗 ) -𝑆 follow the joint distribution for 𝑘 ∈ {0, … , 𝑟} and ℓ ∈ {0, … , 𝑑𝑡} Pr reg [(𝑆, 𝑋) = (𝑘, ℓ)] = 1 𝑁 𝜁 𝜁 * 𝑟 (𝑘, 𝑘 + ℓ, 𝑑𝑡 -𝑘 -ℓ) (11.2)

  Proposition 11.6.2 Let H be drawn uniformly at random in ℋ 𝑑,𝑤,𝑟×𝑛 and e drawn uniformly at random in ℰ 𝑛,𝑡 . We denote the syndrome weight 𝑆 and the value 𝑋 = (∑ 𝑗∈e 𝜎 𝑗 ) -𝑆, and suppose that they are known constants. The counters 𝜎 𝑗 = |h 𝑗 ⋆ s| follow the distributions for 𝑘 ∈ {0, … , 𝑑} Pr reg [𝜎 𝑗 = 𝑘 | 𝑗 ∈ e, 𝑆, 𝑋] = 1 𝑁 𝜙 𝜙 * 𝑆 1 (𝑘, 𝑆 + 𝑋) ⋅ 𝜙 * (𝑟-𝑆) 0 (𝑑 -𝑘, 𝑑𝑡 -(𝑆 + 𝑋)) , Pr reg [𝜎 𝑗 = 𝑘 | 𝑗 ∉ e, 𝑆, 𝑋] = 1 𝑁 𝜓 𝜓 * 𝑆 1 (𝑘, (𝑤 -1)𝑆 -𝑋) ⋅ 𝜓 * (𝑟-𝑆) 0 (𝑑 -𝑘, 𝑑(𝑛 -𝑡) -(𝑤 -1)𝑆 + 𝑋)) , probabilities are zero when 𝑘 ∉ {0, … , 𝑑}, and we have, for ℓ ∈ {0, … , min(𝑤, 𝑡)} and 𝑎 ∈ {0, 1},

  1 (𝑘, 𝑆 + 𝑋) ⋅ 𝜙 * (𝑟-𝑆) 0 (𝑑 -𝑘, 𝑑𝑡 -(𝑆 + 𝑋)) , 𝑁 𝜓 = 𝑑 ∑ 𝑘=0 𝜓 * 𝑆 1 (𝑘, (𝑤 -1)𝑆 -𝑋) ⋅ 𝜓 * (𝑟-𝑆) 0 (𝑑 -𝑘, 𝑑(𝑛 -𝑡) -(𝑤 -1)𝑆 + 𝑋)) . Proof. First let us suppose that 𝑗 ∈ e. For each row 𝑖 of the parity check matrix H, we consider the 2-dimensional random variables 𝑅 ′ 𝑖 = (ℎ 𝑖,𝑗 , ℓ) where ℓ is the number of errors implied in the equation at row 𝑖: ℓ = |h ⊺ 𝑖 ⋆ e|. We thus have, for all ℓ ∈ {0, … , min(𝑡, 𝑤)} Pr[𝑅 ′ 𝑖 = (0, ℓ)] = 𝑡 -ℓ 𝑡 ⋅ 𝑔 𝑠 𝑖 (ℓ) , Pr[𝑅 ′ 𝑖 = (1, ℓ)] = ℓ 𝑡 ⋅ 𝑔 𝑠 𝑖 (ℓ) .

  Remark 11.9. Here again, one could question the necessity of considering the mass equations (11.1). Without it |{𝑗 ∈ e | 𝜎 𝑗 ≥ 𝑇 | }| and |{𝑗 ∉ e | 𝜎 𝑗 ≥ 𝑇 | }| are two random variables following binomial distributions: |{𝑗 ∈ e | 𝜎 𝑗 ≥ 𝑇 | }| ∼ Bin(𝑡, 𝑝 1 ) , |{𝑗 ∉ e | 𝜎 𝑗 ≥ 𝑇 | }| ∼ Bin(𝑛 -𝑡, 𝑝 0 ) (11.5) where 𝑝 1 = Pr reg [𝜎 𝑗 ≥ 𝑇 | 𝑗 ∈ e] , 𝑝 0 = Pr reg [𝜎 𝑗 ≥ 𝑇 | 𝑗 ∉ e] .

SimulationSimulation

  is the number of removed errors, and the error weight after one iteration is 𝑡 = 𝑡 + 𝑡 + -𝑡 -. Kullback-Leibler divergence is computed between the simulation data 𝒮 and the distribution ℳ obtained on the model specified in the first column. The probabilities Pr reg [(𝑆, 𝑋)] are computed according to Proposition 11.4.Pr reg [(𝑆, 𝑋)] = 1.001 ⋅ 10 -5Pr reg [(𝑆, 𝑋)] = 1.836 ⋅ 10 -5

Figure 11 . 3 :

 113 Figure 11.3: Predicted DFR for a one-iteration decoder, for (𝑑, 𝑡) = (71, 134)

Figure 11 . 4 :

 114 Figure 11.4: Number of errors that needs to be decoded after one iteration to have a DFR below 2 -𝜆 , for (𝑑, 𝑡) = (71, 134)

  are known constants. The counters 𝜎 𝑗 = |h 𝑗 ⋆ s| follows the distributions for 𝑘 ∈ {0, … , 𝑑} Pr reg [𝜎 𝑗 = 𝑘 | 𝑗 ∈ e, 𝑆, 𝑋, 𝐼] = 1 𝑁 ′ (𝜙) (𝜙 * 𝐼 0 * 𝜙 * (𝑆-𝐼) 1 ) (𝑘, 𝑆 + 𝑋) ⋅ (𝜙 * (𝑡 𝑂 -𝐼) 1 * 𝜙 * (𝑟-𝑆-𝑡 𝑂 +𝐼) 0 ) (𝑑 -𝑘, 𝑑𝑡 -(𝑆 + 𝑋)) , Pr reg [𝜎 𝑗 = 𝑘 | 𝑗 ∉ e, 𝑆, 𝑋, 𝐼] = 1 𝑁 ′ (𝜓) (𝜓 * 𝐼 0 * 𝜓 * (𝑆-𝐼) 1 ) (𝑘, (𝑤 -1)𝑆 -𝑋) ⋅ (𝜓 * (𝑡 𝑂 -𝐼) 1 * 𝜓 * (𝑟-𝑆-𝑡 𝑂 +𝐼) 0

Figure 11 . 5 :

 115 Figure 11.5: New reordering of the parity check matrix.

Figure 12 . 2 :

 122 Figure 12.2: Example of a threshold choice for (𝑟, 𝑑, 𝑡) = (12 323, 71, 137) and 𝑆 = 4 868 (𝑋 = 908.87)

Figure 12 . 3 :

 123 Figure 12.3: DFR vs. block size.

DFR

  𝒟 = Pr [𝒟(H, He ⊺ ) ≠ e | H ∈ ℋ, e ∈ ℰ] = |𝒲| |ℋ| DFR 𝒟,𝒲 + (1 -|𝒲| |ℋ| ) DFR 𝒟,ℋ∖𝒲 with DFR 𝒟,𝒲 = Pr [𝒟(H, He ⊺ ) ≠ e | H ∈ 𝒲, e ∈ ℰ] and DFR 𝒟,ℋ∖𝒲 = Pr [𝒟(H, He ⊺ ) ≠ e | H ∈ ℋ ∖ 𝒲, e ∈ ℰ] .

𝒲ℱ𝑟Figure 14 . 1 :

 141 Figure 14.1: DFR tangent extrapolation

Algorithm 14. 1 :

 1 Bernoulli trial for decoding failure. input : Block size 𝑟, message space ℰ, key space ℋ, decoder 𝒟. s ← He ⊺ ; e ′ ← 𝒟(H, H, s); return [e ′ = e];

Figure 15 . 1 :

 151 Figure 15.1: Counter values of the neighbours of an error for typical keys (horizontal lines) and weak keys with 𝑓 = 20 (filled). (𝑟, 𝑑, 𝑡) = (12 323, 71, 134).

log 2 Figure 15 . 2 :

 2152 Figure 15.2: Density of weak keys versus multiplicity (log scale) for (𝑟, 𝑑) = (12 323, 71).Type III keys are slightly denser, but their count is very close to the count for Type II.

Proposition 15. 27 .

 27 We denote 𝒲 III (𝑚) the set of weak keys of Type III of parameter 𝑚 with blocks of weight 𝑑 and length 𝑟. |𝒲 III (𝑚)| ≤ 𝑟( In Figure 15.2 we give the density of all types of weak keys for (𝑟, 𝑑) = (12 323, 71). We denote for all 𝑚 > 0 and for type ∈ {I, II, III} 𝜏 type (𝑚) = |𝒲 type (𝑚)| ( 𝑟 𝑑 )

Figure 15 . 3 :

 153 Figure 15.3: Extrapolated (for 𝑟 = 12 323) DFR vs. number of consecutive ones 𝑓 with Type I weak keys and BGF (7 iterations). (𝑑, 𝑡) = (71, 134). 99%-confidence intervals.

Figure 15 . 4 :Figure 15 . 5 :

 154155 Figure 15.4: Extrapolated (for 𝑟 = 12 323) DFR vs. multiplicity 𝑚 with Type II weak keys and BGF (7 iterations). (𝑑, 𝑡) = (71, 134). 99%-confidence intervals.

Figure 16 . 1 :

 161 Figure 16.1: Typical DFR curve.

  DFR ℰ 𝒟,ℋ = Pr [𝒟(H, He ⊺ ) ≠ e | H ∈ ℋ, e ∈ ℰ] . With a minimum distance decoder, we have a decoding failure 𝒟(H, He ⊺ ) ≠ e when e = c + e ′ or equivalently e ′ = c + e (16.1) with c a codeword and |e ′ | ≤ 𝑡. We know that |e ′ | = |c| + |e| -2 |e ⋆ c| , which means that |c| 2 ≤ |e ⋆ c| .If e, e ′ and c are taken uniformly at random, the probability for this inequality to be satisfied ismin(|c|,𝑡) ∑ 𝑖=⌈|c|/2⌉ ( |c| 𝑖 )( 𝑛-|c| 𝑡-𝑖 ) ( 𝑛 𝑡 ) . (16.2)If we write the parity check matrix H ∈ ℋ of a QC-MDPC asH = (H 0 H 1 )then we have a generator matrix G ∈ ℋ

  put into perspective the rarity of such a configuration, let us give an asymptotic formula for (16.3) when 𝑟 → ∞: 2 𝐴-𝐵 log 2 (𝑟)

  DFR ℰ 𝒟,ℋ = Pr [𝒟(H, He ⊺ ) ≠ e | H ∈ ℋ, e ∈ ℰ] .

ℋ

  = ℋ 𝑑,𝑤,𝑟×𝑛 = {H ∈ 𝔽 𝑟×𝑛 2 | ∀𝑖 ∈ {0, … , 𝑟 -1}, |h ⊺ 𝑖 | = 𝑤, ∀𝑗 ∈ {0, … , 𝑛 -1}, |h 𝑗 | = 𝑑} ,• The column weight 𝑑, the row weight 𝑤, and the error weight 𝑡 will be obvious from the context and we will writeDFR(𝑟) = DFR ℰ 2𝑟,𝑡𝒟,ℋ 𝑑,2𝑑,𝑟×2𝑟 .

  We keep the same construction as before and choose an error pattern e ′ as e = c + e ′ with c in 𝒞, 𝒩 or 2𝒩 and |e| = 𝑡, but this time we relax the condition on the weight of e ′ . We have |e ′ | = |c| + |e| -2 |e ⋆ c| .

Definition 16. 4 .←

 4 Let 𝑆 ⊂ (𝔽 2 [𝑥]/(𝑥 𝑟 -1)) 2 , we write 𝒜 𝑡,ℓ (𝑆) = ⋃ 𝑣∈𝑆 {𝑢 ∈ (𝔽 2 [𝑥]/(𝑥 𝑟 -1)) 2 | |𝑢| = 𝑡, |𝑢 ⋆ 𝑣| = ℓ} . Algorithm 16.1 provides a way to construct these sets. Algorithm 16.1: Weak error patterns generation.function weak_error(𝑟, 𝑡, ℓ, (h 0 , h 1 ), 𝑆):input : Block size 𝑟, error weight 𝑡, an integer ℓ, a key (h 0 , h 1 ) ∈ (𝔽 2 [𝑥]/(𝑥 𝑟 -1)) 2 , a set 𝑆 ∈ {𝒞, 𝒩, 2𝒩}. output : A vector c that has ℓ intersections with an element of 𝑆. c ← sample 𝑆 (h 0 , h 1 );𝑠 $ ← {0, … , 𝑟 -1}; (𝑝 0 , … , 𝑝 ℓ-1 ) $ Sample ℓ values from Supp(c); (𝑝 ℓ , … , 𝑝 𝑡-1 ) $ ← Sample (𝑡 -ℓ) values from {0, … , 𝑟 -1} ∖ Supp(c); c ← 0; for 𝑘 ∈ {0, … , 𝑡 -1} do 𝑐 𝑠+𝑝 𝑘 ← 1; return c; function sample 𝒞 (h 0 , h 1 ): return (h 1 , h 0 ); function sample 𝒩 (h 0 , h 1 ): (c 0 , c 1 ) ← (0, 0); 𝑖 $ ← {0, 1}; c 𝑖 ← h 𝑖 ; return (c 0 , c 1 ); function sample 2𝒩 (h 0 , h 1 ): 𝑠 $ ← {0, … , 𝑟 -1}; return sample 𝒩 (h 0 , h 1 ) + 𝑥 𝑠 sample 𝒩 (h 0 , h 1 );These sets can also be seen as unions of spheres of radius 𝑤 + 𝑡 -2ℓ and centers in 𝑆.Proposition 16.5. Suppose that there exists a weight 𝑤 such that ∀𝑢 ∈ 𝑆, |𝑢| = 𝑤, then ∀𝑣 ∈ 𝒜 𝑡,ℓ (𝑆), |𝑣 -𝑢| = 𝑤 + 𝑡 -2ℓ and|𝒜 𝑡,ℓ (𝑆)| ≤ |𝑆| ( 𝑤 ℓ )( 𝑛 -𝑤 𝑡 -ℓ ) .In this case, we write𝒟 𝑡,𝑤+𝑡-2ℓ (𝑆) = |𝑆| ( 𝑤 ℓ )( 𝑛-𝑤 𝑡-ℓ ) ( 𝑛 𝑡 ), an upper bound on the density of the set 𝒜 𝑡,ℓ (𝑆).Remark 16.6. For any ℓ and 𝑆, we can rewrite 𝒜 𝑡,ℓ (𝑆) as𝒜 𝑡,ℓ (𝑆) = ⋃ 𝑠∈𝑆 ⋃ 𝑐⊂𝑠 |𝑐|=ℓ {𝑐} + {𝑣 | |𝑣| = 𝑡 -ℓ, |𝑐 ⋆ 𝑣| = 0} .It is a union of spheres, and they might intersect. However, this is highly unlikely with the parameters usually considered for QC-MDPC schemes. Indeed, suppose that for some 𝑐, 𝑐 ′ ∈ 𝑆 there exists a 𝑢 such that 𝑢 = 𝑐 + 𝑣 = 𝑐 ′ + 𝑣 ′ where |𝑐| = |𝑐 ′ | = ℓ and |𝑣| = |𝑣 ′ | = 𝑡 -ℓ. Let us rewrite it as 𝑐 + 𝑐 ′ = 𝑣 + 𝑣 ′ . We always have |𝑐 + 𝑐 ′ | ≤ 2ℓ, and Pr[|𝑣 + 𝑣 ′ | ≤ 2ℓ] ≤

  on decoding. Let 𝒮 be 𝒞, 𝒩 or 2𝒩. The proximity of an error pattern to an element of 𝒮 has an influence on the counters. Let us write one of these elements c ∈ 𝒮 ∈ (𝔽 2 [𝑥]/(𝑥 𝑟 -1)) 2 and an error pattern e ∈ (𝔽 2 [𝑥]/(𝑥 𝑟 -1)) 2 . Let us separate the positions in c and e depending on whether they are mutual or not. We can write p = e ⋆ c , e ⟂ = e -p , c ⟂ = c -p , then e = e ⟂ + p , c = c ⟂ + p .Since the distance between e and c is given by the formula|e| + |c| -2 |p| ,and assuming the elements of 𝒮 all have the same weight, a closest element of 𝒮 to e is one that maximizes ℓ = |p|.

log 2 Figure 16 . 2 :

 2162 Figure 16.2: Upper bound on the probability that an error pattern of weight 𝑡 is at a certain distance 𝛿 from 𝒩, 2𝒩 or 𝒞. For ℓ = |e ⋆ c|, the distance is 𝛿 = |c| + 𝑡 -2ℓ where |c| is 𝑑, 𝑤 or 𝑤 respectively for 𝒩, 2𝒩 or 𝒞. (𝑟, 𝑑, 𝑡) = (12 323, 71, 134).

Figure 16 . 3 :

 163 Figure 16.3: DFR vs. distance to 𝒩 with various gray decoders (7 iterations for BGF, 8 for B and 9 for the others) and Backflip with multiple thresholds (7 iterations). (𝑟, 𝑑, 𝑡) = (12 323, 71, 134). 99%-confidence intervals.

Figure 16 . 4 :Figure 16 . 5 :

 164165 Figure16.4: DFR vs. distance to 2𝒩 with various gray decoders (7 iterations for BGF, 8 for B and 9 for the others) and Backflip with multiple thresholds (7 iterations). (𝑟, 𝑑, 𝑡) = (12 323, 71, 134). 99%-confidence intervals.

Table 1 :

 1 NIST Post-Quantum Cryptography Standardization Process -Round 3

	PKE/KEM Signature
	Finalists
	Code	1	0
	Lattice	3	2
	Multivariate	0	1
	Alternate candidates
	Code	2	0
	Lattice	2	0
	Hash	0	1
	Isogeny	1	0
	Multivariate	0	1
	Zero-knoweldge	0	1

  , 𝑚 1 , state) ← 𝒜 1 (pk); 𝑐 ← Encrypt(pk, 𝑚 𝑏 );

		IND-CPA game for a PKE		IND-CCA game for a KEM
	(pk, sk) ← KeyGen(rand);	(pk, sk) ← KeyGen(rand);
	𝑏	$ ← {0, 1};	𝑏	$ ← {0, 1};
	(𝑚 0 , 𝑚 1 , state) ← 𝒜 1 (pk);	(𝑚, 𝑐 0 ) ← Encaps(pk);
	𝑐 ← Encrypt(pk, 𝑚 𝑏 ); 𝑏 ′ ← 𝒜 2 (pk, 𝑐, state); return [𝑏 ′ = 𝑏];	𝑐 1 𝑏 ′ ← 𝒜 𝒪 sk,𝑐 $ ← 𝒞; dec (𝑚, 𝑐 𝑏 ); return [𝑏 ′ = 𝑏];
		IND-CCA game for a PKE		𝒪 sk,𝑐 dec (𝑐 ′ )
	(pk, sk) ← KeyGen(rand);	if 𝑐 ′ = 𝑐 then
	𝑏 return [𝑏 ′ = 𝑏]; $ ← {0, 1}; 𝒪 sk,𝑐 dec 2 (pk, 𝑐, state); (𝑚 0 𝑏 ′ ← 𝒜	return ⟂; else return Decrypt(sk, 𝑐 ′ );

  Problem 1. Syndrome Decoding -SD(𝑛, 𝑘, 𝑡) Instance: A parity check matrix H ∈ 𝔽 There exists e ∈ 𝔽 𝑛 2 such that |e| = 𝑡 and He ⊺ = s . There exists e ∈ 𝔽 𝑛 2 such that |e| = 𝑤 and He ⊺ = 0 . For any fixed values of 𝑛, 𝑘 and 𝑡, we denote 𝒲ℱ 𝒜 (𝑛, 𝑘, 𝑡) the work factor, i.e. the average cost in binary operations, of algorithm 𝒜 to produce a solution to the computational syndrome decoding problem SD(𝑛, 𝑘, 𝑡).

	(𝑛-𝑘)×𝑛 2	, a syndrome s ∈ 𝔽 𝑛-𝑘 2	, a target
	weight 𝑡 > 0 .
	Property: Problem 2. Codeword Finding -CF(𝑛, 𝑘, 𝑤)
	Instance: A parity check matrix H ∈ 𝔽 2 (𝑛-𝑘)×𝑛	, a target weight 𝑤 > 0 .
	Property: Figure 3.1: Hard problems in code-based cryptography.
	Definition 3.2.

Definition 3.3. For a linear code of length 𝑛 and dimension 𝑘, an information set is a set 𝒥 of 𝑘 coordinates such that for any vector (𝑏 𝑗 ) 𝑗∈𝒥 there exists a unique codeword c such that 𝑐 𝑗 = 𝑏 𝑗 for 𝑗 ∈ 𝒥.

Table 4

 4

	𝜆	𝑤	𝑡	𝑟 CPA	𝑟 CCA	ℓ
	128 142 134 10 163 12 323 256
	192 206 199 19 853 24 659 256
	256 274 264 32 749 40 973 256

.1: BIKE parameters.

Table 4 .

 4

2: BIKE specification.

  𝑚 𝑐 𝑖 →𝑣 𝑗 is a message from check node 𝑐 𝑖 to variable node 𝑣 𝑗 , 𝑚 𝑣 𝑗 →𝑐 𝑖 is a message from variable node 𝑣 𝑗 to check node 𝑐 𝑖 . */ for 𝑗 ∈ {0, … , 𝑛 -1} do 𝑚 𝑣 𝑗 ← init(𝑦 𝑗 ); for 𝑐 ∈ 𝒩 H (𝑣 𝑗 ) do 𝑚 𝑣 𝑗 →𝑐 ← 𝑚 𝑣 𝑗 𝑚 𝑐 𝑖 →𝑣 ← check_to_var ({𝑚 𝑣 ′ →𝑐 𝑖 | 𝑣 ′ ∈ 𝒩 H (𝑐 𝑖 ) ∖ {𝑣}}); 𝑚 𝑣 𝑗 →𝑐 ← var_to_check (𝑚 𝑣 𝑗 , {𝑚 𝑐 ′ →𝑣 𝑗 | 𝑐 ′ ∈ 𝒩 H (𝑣 𝑗 ) ∖ {𝑐}}); 𝑦 𝑗 ← a_posteriori (𝑚 𝑣 𝑗 , {𝑚 𝑐 ′ →𝑣 𝑗 | 𝑐 ′ ∈ 𝒩 H (𝑣 𝑗 )});

	function message_passing(H, y):
	input : The biadjacency matrix of a bipartite graph H ∈ 𝔽 2 (𝑛-𝑘)×𝑛 a vector y ∈ 𝔽 𝑛 2 .	,
	/* For 𝑖 ∈ {0, … , 𝑛 -𝑘 -1} and 𝑗 ∈ {0, … , 𝑛 -1},
	𝑚 𝑣 𝑗 is a message from the channel,
	/* Loop while the current vector is not a codeword.	*/
	while Hy ⊺ ≠ 0 do
	for 𝑖 ∈ {0, … , 𝑛 -𝑘 -1} do
	for 𝑣 ∈ 𝒩 H (𝑐 𝑖 ) do
	/* Check node to variable nodes.	*/
	for 𝑗 ∈ {0, … , 𝑛 -1} do
	for 𝑐 ∈ 𝒩 H (𝑣 𝑗 ) do
	/* Variable node to check nodes.	*/
	return y;

Table 6

 6 ∶= 𝑦 + ∑ 𝑚 𝑐 ′ →𝑣 ∈ℳ 𝑚 𝑐 ′ →𝑣 ; 𝑚 𝑐 ′ →𝑣 ∈ℳ 𝑚 𝑐 ′ →𝑣 ;

	.1: Gallager A/B.

Table 7 . 1 :

 71 Probability 𝑝 that a random pair of equations has an empty intersection for[BIKE] parameters and average number of trials 1/𝑝 before finding one.

	Security (bits)	𝑑	Security	𝑟	𝑝	1/𝑝
	128	71	IND-CPA 10 163 0.63 IND-CCA 12 323 0.56	1.60 1.80
	192	103	IND-CPA 19 853 0.65 IND-CCA 24 659 0.58	1.53 1.74
	256	137	IND-CPA 32 749 0.68 IND-CCA 40 973 0.60	1.47 1.67

  An error pattern e ′ ∈ 𝔽 𝑛 2 such that He ′ ⊺ = s. /* 𝐹 is a queue containing the flipped position in order.

	function nonblocking_step_by_step_bitflip ⟂ (H, s):
	input : A sparse parity check matrix H ∈ 𝔽 2 (𝑛-𝑘)×𝑛 a syndrome s = He ⊺ ∈ 𝔽 𝑛-𝑘 2 .	,
	output : */
	𝐹 ← {};
	/* 𝑖 is the number of iterations spent without flipping any
	position.	*/
	𝑖 ← 0;
	e ′ ← 0;
	s

′ ← s; while s ′ ≠ 0 do 𝑇 ← threshold(context); 𝑗 ← sample(context); if |h 𝑗 ⋆ s ′ | ≥ 𝑇 then if 𝑗 ∉ 𝐹 then enqueue(𝐹 , 𝑗); else remove(𝐹 , 𝑗);

Table 8 .

 8

	Security (bits)	𝑎	𝑏
	128	0.45	1.1
	192	0.36 1.41
	256	0.45	1

1: ttl parameters obtained by optimization for BIKE parameters.

Table 9 . 1 :

 91 Affine threshold functions for (𝑑, 𝑡) = (71, 134). An error pattern e ′ ∈ 𝔽 𝑛 2 such that He

	𝑟	𝑑	𝑎	𝑏
	9 800 71 0.00726021 13.5491
	9 900 71 0.00717314 13.5541
	10 000 71 0.00709255 13.5445
	10 100 71 0.00701653 13.5273
	10 163 71	0.0069722	13.53
	10 200 71	0.006946 13.4979
	10 300 71 0.00687955 13.4617
	10 400 71 0.00681805	13.414
	10 500 71 0.00675966 13.3623
	Algorithm 9.4: Sorted bit-flipping.
	function sorted_gray_bitflip ⟂ (H, s):
	input : A sparse parity check matrix H ∈ 𝔽 2 (𝑛-𝑘)×𝑛 a syndrome s = He ⊺ ∈ 𝔽 𝑛-𝑘 2 .	,
	output :

Table 11 . 1 :

 111 Numerical applications of Proposition 11.3 for (𝑟, 𝑑, 𝑡) = (12 323, 71, 134). ℓ log 2 Pr[𝜌 𝑖 = ℓ | 𝑠 𝑖 = 0] ℓ log 2 Pr[𝜌 𝑖 = ℓ | 𝑠 𝑖 = 1]

	0	-0.39	1	-0.14
	2	-2.13	3	-3.50
	4	-6.53	5	-8.68
	6	-12.35	7	-15.03
	8	-19.15	9	-22.23
	10	-26.72	11	-30.14
	12	-34.94	13	-38.65
	14	-43.71	15	-47.67
	16	-52.98	17	-57.16
	18	-62.68	19	-67.08
	20	-72.80	21	-77.39
	22	-83.30	23	-88.07
	24	-94.15	25	-99.09
	26	-105.34	27	-110.45
	28	-116.85	29	-122.11
	30	-128.67	31	-134.08

Table 11 . 2 :

 112 To emphasize the importance of the extra condition in the probabilities, let us look at what happens when we remove it. The probability (11.2) becomes Comparison of the distribution of 𝑆 and 𝑋 between simulation (10 9 samples with quasi-cyclic matrices) and models for (𝑟, 𝑑, 𝑡) = (12 323, 71, 134). Kullback-Leibler divergence is computed between the simulation data 𝒮 and the distribution ℳ obtained with the model specified for each row.

	𝜁 ′ * 𝑟 (𝑆, 𝑆 + 𝑋)	(11.3)
	where 𝜁 ′ is defined on {0, 1} × {0, … , 𝑤} with, for 𝑎 ∈ {0, … , min(𝑤, 𝑡)},
	𝜁 ′ (𝑎 mod 2, 𝑎) =	( 𝑤 𝑎 )( 𝑛-𝑤 𝑡-𝑎 ) ( 𝑛 𝑡 )

Table 11 . 3 :

 113 𝑛,𝑡 . We denote the syndrome weight 𝑆 and the value 𝑋 = (∑ 𝑗∈e 𝜎 𝑗 ) -𝑆, and suppose they are known constants. We suppose that the counters distributions Pr reg [𝜎 𝑗 | 𝑗 ∈ e, 𝑆, 𝑋] and Pr reg [𝜎 𝑗 | 𝑗 ∉ e, 𝑆, 𝑋] are known (see Proposition 11.6). The number of positions whose counter is greater than or equal to a threshold 𝑇 follows the distributions, for 𝑘 ∈ {0, … , 𝑡} and 𝑙 ∈ {0, … , 𝑛 -𝑡} Comparison of the counters distributions between simulation (10 5 samples) and models for (𝑟, 𝑑, 𝑡) = (12 323, 71, 134). Kullback-Leibler divergence is computed between the simulation data 𝒮 and the distribution ℳ obtained on the model specified in the first column. The probabilities Pr reg [(𝑆, 𝑋)] are computed according to Proposition 11.4.

	Pr reg	[|{𝑗 ∈ e | 𝜎 𝑗 ≥ 𝑇 | }| = 𝑘 | 𝑆, 𝑋] =	1 𝑁 𝛾 1	𝛾 * 𝑡 1 (𝑘, 𝑆 + 𝑋)
	Pr reg	[|{𝑗 ∉ e | 𝜎 𝑗 ≥ 𝑇 | }| = 𝑙 | 𝑆, 𝑋] =	1 𝑁 𝛾 0	𝛾 0 * (𝑛-𝑡)	(𝑙, (𝑤 -1)𝑆 -𝑋)
	where 𝛾 0 and 𝛾 1 are defined on {0, 1} × {0, … , 𝑑} with
			∀𝑘 ∈ {0, … , 𝑑)}, {	𝛾 0 (1

Proposition 11.8. Let H be drawn uniformly at random in ℋ 𝑑,𝑤,𝑟×𝑛 and e drawn uniformly at random in ℰ ≥𝑇 (𝑘), 𝑘) = Pr reg [𝜎 𝑗 = 𝑘 | 𝑗 ∉ e] , 𝛾 1 (1 ≥𝑇 (𝑘), 𝑘) = Pr reg [𝜎 𝑗 = 𝑘 | 𝑗 ∈ e] ,

Table 11 . 4 :

 114 Comparison between simulation (10 5 samples) and models for (𝑟, 𝑑, 𝑡) = (12 323, 71, 134). 𝑡 + is the number of added errors, 𝑡 -

  Two iterations of the parallel bit-flipping algorithm. One can use the Algorithm 15.3 in §15.6 to filter out keys whose maximum column intersection is too high.

	function two_parallel_iterations ⟂ (H, s, 𝐼):
	input : A sparse parity check matrix H ∈ 𝔽 2 (𝑛-𝑘)×𝑛 a syndrome s = He ⊺ ∈ 𝔽 𝑛-𝑘 2 ,	,
	the maximum number of intersections 𝐼 between columns of H.
	output : The error pattern difference after two iterations e ′ ∈ 𝔽 𝑛 2 . e ′ ← 0;
	s ′ ← s;
	𝑇 ← threshold(|s|);
	for 𝑗 ∈ {0, … , 𝑛 -1} do
	if |h 𝑗 ⋆ s| ≥ 𝑇 then
	𝑒 ′ 𝑗 ← 1 -𝑒 ′ 𝑗 ;
	s ′ ← s -He ′ ⊺ ;
	for 𝑗 ∈ {0, … , 𝑛 -1} do
	if |h 𝑗 ⋆ s ′ | ≥ ⌊(𝑑 + 𝐼 + 1)/2⌋ then
	𝑒 ′ 𝑗 ← 1 -𝑒 ′ 𝑗 ;
	return e 𝐼	⌊(𝑑 + 𝐼 -1)/2𝐼⌋ 𝑟 𝐼,128
	1	35	19 778
	2	18	24 490
	3	12	28 577
	4	9	32 408
	5	7	36 649
	6	6	39 778
	7	5	44 104
	8-10	4	50 430
	11-14	3	60 654
	15-23	2	80 728
	24-70	1 134 408
	71	0 539 795
	Key filtering and overhead.

⎭ , the minimum block size that one should use to have a DFR below 2 -𝜆 with Algorithm 11.2. Examples of values are given in Table 11.5 for [BIKE] parameters. Algorithm 11.2: ′ ; Table 11.5: Example values for 𝑟 𝐼,𝜆 with (𝑑, 𝑡) = (71, 134) and 𝜆 = 128.

Table 11 . 6 :

 116 Overhead due to key filtering for a maximum column intersection value 𝐼 and block size 𝑟 with (𝑑, 𝑡) = (71, 134).

	𝐼	𝑟	Avg. keygen overhead
	2 24 490	+1.5 ⋅ 10 +26 %
	3 28 577	+429.26%
	4 32 408	+3.24%
	5 36 649	+0.04%

Table 11 . 7 :

 117 Comparison of the distribution of 𝑆, 𝑋 and 𝐼 between simulation (10 9 samples with quasi-cyclic matrices) and the model for (𝑟, 𝑑, 𝑡, 𝑡 𝑂 ) = (12 269, 67, 154, 77). The Kullback-Leibler divergence between the simulation data 𝒮 and the distribution obtained from Proposition 11.17 is 9.015 ⋅ 10 -4 . Comparison of the counters distributions between simulation (10 5 samples) and models for (𝑟, 𝑑, 𝑡, 𝑡 𝑂 ) = (12 269, 67, 154, 77). Kullback-Leibler divergence is computed between the simulation data 𝒮 and the distribution ℳ obtained on the model specified in the first column. The probabilities Pr reg [(𝑆, 𝑋, 𝐼)] are computed according to Proposition 11.17.

			𝑆		𝑋		𝐼
		Mean	Var.	Mean		Var.	Mean	Var.
	Simulation	5 030.068 2 618.891	1 080.049 1 643.046	45.520 18.596
	Proposition 11.17 5 030.225 2 618.815	1 079.920 1 642.820	45.519 18.596
	Table 11.8: 𝑗 ∈ e			𝑗 ∉ e
		Mean	Var.	D KL (𝒮‖ℳ)	Mean	Var.	D KL (𝒮‖ℳ)
	𝑆 = 5 031	𝑋 = 1 080	𝐼 = 46	Pr reg [(𝑆, 𝑋, 𝐼)] = 2.842 ⋅ 10 -5
	Simulation	27.397 16.107	-	39.682 15.979	-
	Proposition 11.18 27.398 16.107 3.75 ⋅ 10 -7	39.681 15.982	4.31 ⋅ 10 -7

Chapter 13 Introduction LDPC

  codes share many properties with MDPC codes and have received a lot of attention in the last decades in the context of telecommunication. However, applications of coding theory to cryptography and to telecommunication have different requirements. The latter usually focuses on finding one good code that fits some channel and hardware constraints. For example IEEE 802.11 standard defines several common parity check matrices for its different standardized rates [802.11, §20.3.8]. With a code-based public key encryption scheme such as BIKE, each key generation involves choosing a new random code. The IND-CCA security of such a scheme requires that the family of the generated codes has a low average decoding failure rate (DFR).

  Pr [𝒟(H, He ⊺ ) ≠ e | e ∈ ℰ ∖ ℰ H ] . If for any sparse parity check matrix H we can find a set of error patterns ℰ H that hinder the decoding performance, it is problematic if

		𝒟 =	1 |ℋ|	∑ H∈ℋ	⎛ ⎜ ⎝	|ℰ H | |ℰ|	DFR ℰ H 𝒟,H + (1 -	|ℰ H | |ℰ|	) DFR ℰ∖ℰ H 𝒟,H	⎞ ⎟ ⎠
	with		DFR ℰ H 𝒟,H = Pr [𝒟(H, He ⊺ ) ≠ e | e ∈ ℰ H ]
	and	DFR 𝒟,H = 1 ℰ∖ℰ H |ℋ| ∑ H∈ℋ |ℰ H | |ℰ| DFR	ℰ H 𝒟,H = E H∈ℋ [	|ℰ H | |ℰ|	DFR	ℰ H 𝒟,H ] > 2 -𝜆 .

  Let 𝑋 and 𝑌 be two independent positive random variables whose probability density functions are respectively 𝑓 𝑋 and 𝑓 𝑌 then the ratio 𝑍 = 𝑋/𝑌 is a random variable with the following probability density function: Let 𝑋 be a real valued random variable and let 𝑔 ∶ ℝ → ℝ be an invertible monotonic differentiable measurable function whose inverse is ℎ. Let 𝑌 be the random variable defined by 𝑌 = 𝑔(𝑋). We write 𝑓 𝑋 and 𝑓 𝑌 the probability density functions of respectively 𝑋 and 𝑌. Then 𝑓 𝑌 (𝑦) = |ℎ ′ (𝑦)|𝑓 𝑋 (ℎ(𝑦)) .

	Proposition 14.4. 𝑓 𝑋/𝑌 (𝑧) = ∫	∞	𝑓 𝑌 (𝑦)𝑓 𝑋 (𝑧𝑦)𝑦 𝑑𝑦 .
	0
	Proposition 14.5. Corollary 14.6. For any random variable 𝑋 and any real number 𝐴 ≠ 0
			-𝐴 1 𝑝 1+𝐴 2	(14.1)

Table 14 . 1 :

 141 Confidence intervals for some decoding simulation data.

	Algorithm	Simple method log(DFR) log(DFR -) log(DFR + ) log(DFR -) log(DFR + ) Proposition 14.9
	BGF 9 iterations	-146.20	-172.30	-129.11	-164.21	-130.31
	Backflip 7 iterations	-116.22	-134.13	-99.00	-128.13	-104.57

  Definition 15.15. Let h ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1) and let ℓ be the smallest integer such that 𝑥 -ℓ h starts with a 0 and ends with a 1. We writeh ∼ (𝑧 1 , 𝑜 1 , … , 𝑧 𝑠 , 𝑜 𝑠 ) ℓ if and only if 𝑥 -ℓ h ∼ (𝑧 1 , 𝑜 1 , … , 𝑧 𝑠 , 𝑜 𝑠 ) .

	Proposition

15.16. For any pattern h ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1) of weight 𝑑 such that 𝜇 (1, h) = 𝑚, there is a unique representation

Table 15 . 1 :

 151 Numerical application of the multiplicity probabilities given in Corollary 15.20 for (𝑟, 𝑑) = (12 323, 71).

	𝑚	𝜋 𝑚	𝑝 ≥𝑚	𝑝 =𝑚
	0	0.667	1.0	0.0
	1	0.272	1.0	0.0
	2	0.0539	1.0	0.0
	3	0.00692	1.0	0.0186
	4	0.000647	0.981	0.73
	5	4.69 ⋅ 10 -5	0.251	0.234
	6	2.75 ⋅ 10 -6	0.0168	0.016
	7	1.34 ⋅ 10 -7	0.000827	0.000793
	8	5.55 ⋅ 10 -9	3.42 ⋅ 10 -5	3.3 ⋅ 10 -5
	9 1.98 ⋅ 10 -10	1.22 ⋅ 10 -6	1.18 ⋅ 10 -6
	10 6.13 ⋅ 10 -12	3.78 ⋅ 10 -8	3.68 ⋅ 10 -8
	11 1.67 ⋅ 10 -13

  BIKE, for any IND-CCA adversary ℬ against BIKE issuing at most 𝑞 queries to any random oracle with a decoder 𝒟 for a set of keys ℋ, with Adv IND-CCA

BIKE

(ℬ) ≤ 𝑞 ⋅ DFR 𝒟,ℋ +𝜖

Table 16 . 1 :

 161 Numerical application for (16.4) with BIKE parmeters.

	𝜆	𝑤	𝑡	𝐴	𝐵	𝑟	𝐴 -𝐵 log 2 (𝑟)
	128 142 134	535.496	70 12 323	-415.738
	192 206 199	838.289 102 24 659	-649.874
	256 274 264 1 171.659 136 40 597	-910.376

  ). 99%-confidence intervals.

	24.860 16.135	21.504 14.963	15.804 12.251	5.865 5.355
	35.423 16.945	39.391 16.222	46.614 14.061	60.756 6.885
	35.726 16.941	31.815 16.259	24.740 14.157	10.924 7.260
	46.267 16.105	49.668 14.901	55.436 12.109	65.497 5.057
		3 589.383 1 718.329	642.406 058.521	983.970 184.843
		90		130

Using the Random Oracle Model means here that the hash functions are to be treated as black boxes which, for any input request, produce a uniformly randomly chosen element of its codomain. They are mathematical functions, so any repetition of an input will always produce the same output.

Repeated squaring gives the same equations as above, we simply need to change each exponent by 2 by 2 𝑖 and the weights 𝑤 2 and 𝑡 2 by 𝑤 2 𝑖 and 𝑡 2 𝑖 respectively, for the 𝑖-th iteration of the process.

Remember that in the Niederreiter setting, the first block h 0 has to be inverted to compute the systematic form h = h 1 h -1 0 .

After all BIKE stands for Bit-Flipping Key Encapsulation.

Note that for a quasi-cyclic code, in the polynomial formalism, if the parity check matrix is represented as (h 0 , h 1 ) with h 0 , h 1 ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1) for some block size 𝑟, then we have, for 𝑖 = 0, 1 ∀𝑗 ∈ {0, … , 𝑟 -1}, h 𝑖⋅𝑟+𝑗 = 𝑥 𝑗 h 𝑖 .

Remember that we equate a vector with its support.

This is explained in more detail in §10.1.2

The formal definition of the spectrum is recalled in Definition 15.6 page 143.

In particular, this approximation does not take into account the fact that, on a platform offering vectorized instructions, computing all the counters at the same time may be faster than computing them all individually.

Backflip decoder was suggested in version 3 of the specification.

The noisy syndrome case (Ouroboros) is covered in Proposition 11.17 of §11.5.

The noisy syndrome case (Ouroboros) is covered in Proposition 11.18 of §11.5.

In fact, to ensure sufficient accuracy with floating point operations, an actual implementation of the model would rather calculate the complement of the probability of success: the probability of reaching a blocked state.

See §3.3.

The algorithm and the analysis are discussed in Chapters 7 & 12.

144.716 2 105.496

Remerciements

Summary of contributions

We design three new decoding algorithms for MDPC codes:

• one that is randomized and sequential: step-by-step,

• one that implements a novel idea consisting in adding a lifetime to each decision taken: Backflip,

• and one that considers an intermediate level of decision: gray decoder.

The first one has a theoretical interest that we will develop in Part III. The other two are at an intermediate level between the hard-and soft-decision algorithms and have great performance with a low complexity. Backflip shows remarkable performance that scales well as the number of iterations increases.

Summary of contributions

We design two new probabilistic models for the bit-flipping decoder:

• one that accurately predicts the distribution of error weights after a single iteration of the algorithm for a regular code,

• one that considers the full decoding process for the (sequential) step-by-step introduced in the Part II.

In contrast to the other models, when compared to the simulation data, we find that they can predict the DFR with very good accuracy. In addition, they are the first ones to integrate the use of an efficient adaptive threshold rule.

The exploitation of these models required ad-hoc optimized implementations in C language. Results for the first model required a particularly important computational effort, since the calculation time, depending on the set of parameters chosen, ranges from half an hour to several hours.

LDPC codes

We present three different analyses of the LDPC decoding failure rate. The first one is based on a statistical model developed by Gallager. Many works have been derived from it to adapt it to other channels or algorithms, but the bases of the model are essentially the same (independence of all random variables and assumption that the Tanner graph is a tree). The second analysis by Sipser and Spielman is done on the more general context of expander codes. They show that the simple bit-flipping algorithm with a majority logic will always decode given that the code has a Tanner graph with certain expansion properties. The result is deterministic and relies solely on properties of the graph and not on any statistical model. A link with LDPC codes can be established by observing that a random LDPC code has, with a high probability, a good expansion property. The third analysis by Burshtein enumerates all bad configurations in a regular LDPC code and derives a rough upper bound on the probability that a given code has poor decoding performance under bit-flipping on any of those configurations.

Gallager's analysis

In his thesis [START_REF] Robert | Low Density Parity Check Codes[END_REF], Gallager analyzes his hard-decision decoding algorithm for regular LDPC codes on the binary symmetric channel. In contrast to a bit-flipping algorithm, this algorithm explicitely excludes extrinsic information between nodes. It is thus closer to a message-passing algorithm.

The analysis relies on the following assumptions:

• the Tanner graph is a tree,

• the values of variable nodes are mutually independent,

• the values of check nodes are mutually independent,

• thresholds depend only on the iteration index.

Let us explain briefly the technique on a regular LDPC code. We keep the convention of this document and write 𝑑 the variable nodes degree and 𝑤 the check nodes degree. Suppose that we have a binary symmetric channel with crossover probabilty 𝜖. We track the error rate 𝑝 𝑖 among the variable nodes at iteration #𝑖. At iteration #0, the error rate is exactly the crossover probability 𝑝 0 = 𝜖 .

Error weight after one iteration

The two random variables that count the number of flipped positions, separated according to whether they are erroneous or not, can be considered independent. The error weight after an iteration is then simply determined by a convolution of their respective distributions.

Unconditional probability of the error weight after the first iteration

We can now summarize all the propositions of this section in a single distribution that we will compare to the simulation, namely the error weight after an iteration 𝑡 1 .

Here are the outlines of the nested conditioning on the probabilities that we are going to achieve.

• First we determine, using Proposition 11.4, the joint distribution of 𝑆 0 and 𝑋 0 :

• Using Proposition 11.6 & 11.8, for every values of 𝑆 0 and 𝑋 0 such that Pr reg [(𝑆 0 , 𝑋 0 )] is not negligible, and depending on a threshold function, we determine the distribution of the number of added (𝑡 + 1 ) or removed (𝑡 - 1 ) errors:

In the end, we can find the distribution we are looking for Pr reg

A comparison between the distribution of 𝑡 1 obtained from this model and the one obtained with the simulations is provided in Figure 11.2. Due to the rapid decay of probabilities in the tails, it is presented on a binary logarithmic scale. We can observe that the model is really accurate and that it succeeds in predicting the probabilities with a precision up to a fraction of a decimal digit in binary logarithm. We note that the same accuracy is obtained with any other block size or threshold function.

Chapter 12

Markovian model of the step-by-step algorithm

In this chapter, unlike the previous one, we make coarser assumptions about the decoder's behaviour. However, these assumptions are reasonable and allow us to model a complete iterative decoder. We will still rely on some results of the previous chapter.

Notations

We adopt the following notations in this chapter.

General.

• The set ℰ 𝑛,𝑡 is set of all the error patterns of weight 𝑡 ℰ 𝑛,𝑡 = {e ∈ {0, 1} 𝑛 | |e| = 𝑡} ,

• ℋ 𝑑,𝑤,𝑟×𝑛 is the set of regular 𝑟 × 𝑛 parity check matrices of column weight 𝑑 and row weight 𝑤

Coding theory.

• We denote the syndrome weight corresponding to a certain error parttern

• For a position 𝑗 ∈ {0, … , 𝑛 -1}, we write its counter 𝜎 𝑗 ∶= |h 𝑗 ⋆ s| .

• We write 𝑋 = ∑ 𝑗∈e 𝜎 𝑗 -𝑆 .

• The definitions of 𝜎 𝑖 , E ℓ , 𝑆 and 𝑋 depend on a specific parity check matrix H and an error pattern e. These dependencies will always be evident from the context and are therefore not explicitly mentioned so as not to clutter the notations.

Using the step-by-step decoder only

Starting distribution. We wish to have the joint distribution of (𝑆 0 , 𝑡 0 ). As we are in the context of the [BIKE] cryptosystem, the initial error weight is set to 𝑡 0 = 𝑡.

Since the error pattern is the result of a pseudorandom expansion of a seed, it can be seen as drawn uniformly at random in ℰ 𝑛,𝑡 (in the random oracle model). Therefore, Proposition 11.4 covers the joint distribution of (𝑆 0 , 𝑡 0 ). It accurately takes into account the fact that the parity check matrix is quasi-cyclic 2 as shown in the previous chapter.

Computation Results. In Figure 12.3 we show the DFR predicted by the model for three different values of 𝜉 so that we have a lower and an upper bound of the simulation curve. The values of 𝜉 are close as they are within 0.02 of each other.

Using the step-by-step decoder for residual error correction

In Figure 12.4, we give an example of the DFR predicted by this Markov model. All parameters are fixed (𝑟, 𝑑) = (12 323, 71) but a wide range of values for the syndrome weight and the error weight is considered. What is represented are the contours of the DFR: for each Iso-𝜆 line, the states inside the curve lead to a failure with a predicted probability less than 2 -𝜆 . As an indication, the syndrome weight for a uniformly random error model is also represented as an overlay with the mean value and the range of expected values with a probability greater than 2 -128 for a given 𝑡. However, the output of a real decoder is not uniformly random at all, and the same data would usually be lower.

2 Strictly speaking, it takes into account the mass equations that stem from the regularity of the code

Summary of contributions

Based on the knowledge of the decoding acquired from models and simulations, we establish an assumption about the behaviour of the DFR curve.

• We apply it to establish a framework for extrapolating DFR from simulation data. It is necessary to use the inferred results rigorously, which we do by means of confidence intervals for which we derive formulas.

• We then make sure that the assumption is not violated by particular structures in the code. We measure the effect of parity check matrices with many column intersections on the decoder and compute precisely, proving new combinatorial properties of the spectrum, their density.

• Finally, we exhibit near-codewords, which are found in any QC-MDPC code. We see how they negatively influence decoding and estimate their impact on the average DFR.

(1 -𝛼) with

In reality, for a block size 𝑟 𝑖 , we only know that 𝐹 𝑖 failures were observed out of 𝑁 𝑖 samples with 𝑖 = 1, 2. If 𝑝 1 has a (1 -𝛼)-confidence interval (𝑝 - 1 ; 𝑝 + 1 ) and 𝑝 2 has a (1 -𝛽)-confidence interval (𝑝 - 2 ; 𝑝 + 2 ), then 𝑝 3 has a confidence interval (𝑝 - 3 ; 𝑝 + 3 )

with a coverage probability at least (1 -𝛼)(1 -𝛽). This is illustrated in Figure 14.2.

In practice, for a given confidence level, one can find a narrower confidence interval than this one.

Using posterior probability

In this section we detail how to compute narrower confidence interval using posterior probabilities.

We see the failure probability of a Bernoulli trial as a random variable Θ 𝑖 ∈ [0, 1] for i= 1, 2. Under the condition that Θ 𝑖 = 𝜃 𝑖 , 𝑋 𝑖 follows a binomial distribution for 𝑖 = 1, 2:

We define the random variable Θ 3 ∈ [0, 1] as

for some constant 𝐴 > 0.

Our goal is, with no prior knowledge on Θ 3 , to find its distribution if we observe 𝑋 𝑖 = 𝐹 𝑖 for 𝑖 = 1, 2.

Let us first recall two properties about random variables (see [START_REF] Dale | The Algebra of random variables[END_REF] and [START_REF] Bertsekas | Introduction to probability[END_REF] for proofs). In this section, we write 𝑓 𝑋 the probability density functions of any random variable 𝑋.

Weak keys: Subsets of parity check matrices

Short cycles in the Tanner graph and high number of intersections between columns in the parity check matrix are detrimental for the decoding capabilities of the decoder.

In this chapter, we start from the definition of the distance spectrum due to [START_REF] Guo | A Key Recovery Attack on MDPC with CCA Security Using Decoding Errors[END_REF]. We show new properties of this spectrum that can be used to enumerate them. We make an observation on the counters distribution for parity check matrices with unusual spectrum and see how that can be detrimental to the decoding performance. Then, we construct three sets of weak keys for a QC-MDPC system, these keys have an unusual spectrum and thus a DFR higher than average. We eventually assess their impact on the security of the system by estimating their DFR with simulation and using upper bounds on their cardinality.

QC-MDPC Codes

Definition and polynomial representation

Let H = (H 0 , H 1 ) be the parity check matrix of a QC-MDPC code. Equivalently, the parity check matrix can be written as a tuple of polynomials (h 0 , h 1 ) ∈ (𝔽 2 [𝑥]/(𝑥 𝑟 -1))

2 , using the following isomorphism.

Proposition 15.1 (Recall). The application

is an isomorphism between the ring of circulant 𝑟 × 𝑟 matrices with coefficients in 𝔽 2 and the quotient ring 𝔽 2 [𝑥]/(𝑥 𝑟 -1).

If we denote h 𝑖 the polynomial corresponding to first column of the block H 𝑖 for 𝑖 = 0, 1, and if we write the row vector (e 0 , e 1 ) as polynomials then the product (H 0 , H 1 )(e 0 , e 1 ) ⊺ is the column vector represented by the polynomial e 0 h 0 + e 1 h 1 .

The following isomorphism is important in our analysis as it allows us to reduce properties on any distance 𝛿 to the case 𝛿 = 1.

.

Thus, in a quasi-cyclic matrix, for 𝑚 > ⌊ 𝑑 2 𝑟 ⌋, a column is less likely to have exactly 𝑚 of intersections with another column in its own circulating block than with a column from other blocks. In fact, with BIKE parameters, ⌊ 𝑑 2 𝑟 ⌋ = 0.

Corollary 15.19. Let 𝑟 and 𝑑 be positive integers and let h ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1) be a pattern of weight 𝑑. For any integer 𝛿 such that 1 ≤ 𝛿 ≤ ⌊𝑟/2⌋, the probability that 𝛿 has a nonzero mutiplicity in the spectrum of h is

.

Corollary 15.20. We assume the independence of the multiplicities of the spectrum. Let 𝑚 be an integer such that 0 ≤ 𝑚 < 𝑑, 𝛿 be such that 1 ≤ 𝛿 ≤ ⌊𝑟/2⌋ and h ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1),

Example. We give in Table 15.1, for (𝑟, 𝑑) = (12 323, 71), the probabilities of having a certain multiplicy in the spectrum of a circulant block. We observe it is typically low. Note that the independence of the multiplicities for all distances is not true in general. However, this approximation is really close to the values observed in simulation.

Reconstructing the secret key from the spectrum

Proposition 15.7 brings a new approach to the problem of reconstructing a key from its spectrum used in [START_REF] Guo | A Key Recovery Attack on MDPC with CCA Security Using Decoding Errors[END_REF]. Knowing Sp(h), one can write the following system of equations in 𝑟 boolean variables ℎ 0 , … , ℎ 𝑟-1 ∈ {0, 1}.

Such a system is said to be pseudo-boolean as it involves linear operations in ℤ of boolean values. Most satisfiability modulo theories (SMT) solvers implement a way to solve them. Nevertheless, the resolution of this system can greatly benefit from simplification.

Indeed, say, for some 𝛿, 𝜇 (𝛿, h) = 0. Then

Definition 15.23. We call weak key of Type II and parameter 𝑚, a key h = (h 0 , h 1 ) such that 𝜇 (𝛿, h 𝑖 ) = 𝑚 for some 𝑖 ∈ {0, 1} and some distance 𝛿 ∈ {1, … , ⌊𝑟/2⌋}.

Thanks to Corollary 15.17 of §15.3.2 we may obtain an upper bound for the number of Type II weak keys.

Proposition 15.24. Let 𝑚 be an integer such that 0 ≤ 𝑚 < 𝑑. We denote 𝒲 II (𝑚) the set of patterns h of weight 𝑑 and length 𝑟 for which one distance at least of its spectrum has multiplicity 𝑚. Then

) .

We only have an upper bound because, for a given 𝑚, the sets {h ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1) | 𝜇 (𝛿, h) = 𝑚} are not disjoint when 𝛿 varies. But in practice, when 𝑚 is above the typical values (4 or 5), the intersections are very small and the bound is very tight. Algorithm 15.2 derives from the combinatorial analysis of §15. Remark 15.25. With BIKE, the suggested decoders are parallel: the syndrome is only computed once for each iteration and flips are chosen independently of the order in which positions are considered in an iteration. Therefore, the decoders are such that 𝒟((𝜙 𝛿 (h 0 ), 𝜙 𝛿 (h 1 )), 𝜙 𝛿 (s)) = 𝜙 𝛿 (𝒟((h 0 , h 1 ), s)) . This means that the set of patterns for which a distance 𝛿 has a multiplicity 𝑚 has the same DFR as the set of patterns for which a distance 𝛿 ′ ≠ 𝛿 has a multiplicity 𝑚. Put another way, for a given multiplicity 𝑚, for all distances 𝛿 ∈ {1, … , ⌊𝑟/2⌋} the constructed sets have exactly the same contribution to the average DFR.

Filtering weak keys

Algorithm 15.3 provides a way of filtering weak keys defined in this paper. It filters Type II weak keys (which include Type I) by computing the spectrum of each block and rejecting when a multiplicity is too high (over a threshold). Type III weak keys are filtered by computing the intersection between every column from the first block with every column from the second block. From the statistics of §15.4 by setting a threshold to, say, 10, this algorithm rejects less than one key out of several million. Algorithm 15.3: Rejection algorithm for weak keys.

input : Block size 𝑟, column weight 𝑑, a threshold 𝜏, a key h 0 = 𝑥 𝑗 0,1 + 𝑥 𝑗 0,2 + ⋯ + 𝑥 𝑗 0,𝑑 , h 1 = 𝑥 𝑗 1,1 + 𝑥 𝑗 2 be the parity check matrix of a QC-MDPC code of row weight 𝑤. We write 𝒞 the set of codewords of weight 𝑤:

The sum of any two codewords of weight 𝑤 gives the set of codewords 2𝒞. And any 𝑐 ∈ 2𝒞 has weight 2𝑤 -𝜖 0 -𝜖 1 where the distribution of 𝜖 𝑖 is given by 𝜋 𝑚 in Corollary 15.20 for 𝑚 = 𝜖 𝑖 and 𝑖 = 0, 1. These codewords have too great a weight to be relevant here. Indeed, we will construct error patterns of weight 𝑡 that are close to codewords. With the usual BIKE parameters, we already have 𝑤 > 𝑡, doubling the size of the codewords can only increase the distance to the error patterns of fixed weight 𝑡.

Near-codewords

Definition 16.2. Let H be the parity check matrix of a linear code. A (𝑢, 𝑣) near-codeword is an error pattern e of weight 𝑢 such that |He ⊺ | = 𝑣.

We say that the variable nodes corresponding to the support of such an error pattern constitute a (𝑢, 𝑣) trapping set as defined in [START_REF] Richardson | Error Floors of LDPC Codes[END_REF].

Let us write a circulant block in its polynomial representation h = ∑ 𝑖∈Supp(h) 𝑥 𝑖 ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1). Applying the Frobenius endomorphism we obtain: In the following definition, we describe all the (𝑑, 𝑑) near-codewords based on this template, i.e. those of each circulant block and all their circular shifts. Definition 16.3. Let h = (h 0 h 1 ) ∈ 𝔽 2 [𝑥]/(𝑥 𝑟 -1) 2 be the parity check matrix of a QC-MDPC code of row weight 𝑤.

We write 𝒩 the following set of (𝑑, 𝑑) near-codewords e = (e 0 , e 1 ) 𝒩 = {(𝑥 𝑠 h 0 , 0) | 𝑠 ∈ {0, … , 𝑟 -1}} ∪ {(0, 𝑥 𝑠 h 1 ) | 𝑠 ∈ {0, … , 𝑟 -1}} .

There are 2𝑟 such (𝑑, 𝑑) near-codewords.

We will also consider the set 2𝒩 of the sums of two (𝑑, 𝑑) near-codewords as they are (2𝑑 -𝜖 0 , 2𝑑 -𝜖 1 ) near-codewords (for some small values 𝜖 0 and 𝜖 1 ) and we usually have 2𝑑 = 𝑤 ≈ 𝑡

Error patterns impeding decoding

We have already covered the case where one uses a minimum distance decoder in a QC-MDPC scheme. But such a decoder is too challenging to efficiently implement, and we use a bit-flipping or a belief propagation algorithm. We will here focus on variants of the former.

In any bit-flipping variant, the syndrome is used to compute the counters that are then used to decide whether to flip a bit or not. In this section we will use those two data as a benchmark to assess the influence of low weight codewords and near-codewords on the decoder.