Computational cryptography › Public-key encryption and key exchange › Post-quantum public-key › Codes and noisy equations
Hardness assumptionKE: gives key exchange

Syndrome decoding

In plain words

Given a garbled message with a few errors, find the errors, when the code has no visible structure to help you. Very hard, even for quantum computers.

The idea: Error-correcting codes add redundancy so that a few flipped bits can be fixed. For a random code with no structure, fixing those errors is extremely hard: you'd essentially have to guess which bits are wrong, and the number of possibilities explodes. Code-based encryption uses exactly that: add errors on purpose to hide the message, and make sure only the recipient has a code they can decode quickly.

Why it matters: The basis of code-based quantum-safe encryption.

The details

On the map: decode a random linear code best attack: information-set decoding

Decode a random linear error-correcting code: given a noisy codeword, find the small error pattern. The general problem is NP-hard[1], it has been studied since McEliece's 1978 scheme[2], the best attacks (information-set decoding)[3] take exponential time, and quantum computers only give a modest speedup.

It is the basis of code-based cryptography such as Classic McEliece and HQC (KE).

Rests on

If any of these breaks, this breaks too.

If it falls

If this breaks, these break with it.

About the tags

KE
This assumption gives key exchange on its own, so it needs more than one-way functions and falls if public-key encryption is impossible.

References

  1. E. Berlekamp, R. McEliece and H. van Tilborg. On the inherent intractability of certain coding problems (Corresp.). IEEE Transactions on Information Theory, 1978. doi:10.1109/tit.1978.1055873
  2. Robert J. McEliece. A Public-Key Cryptosystem Based On Algebraic Coding Theory. DSN Progress Report 42-44, Jet Propulsion Laboratory, 1978. ipnpr.jpl.nasa.gov/progress_report2/42-44/44N.PDF
  3. E. Prange. The use of information sets in decoding cyclic codes. IEEE Transactions on Information Theory, 1962. doi:10.1109/tit.1962.1057777