Trace Zero Cryptography

In coding theory, a polynomial code is a type of linear code whose set of valid code words consists of those polynomials (usually of some fixed length) that are divisible by a given fixed polynomial (of shorter length, called the generator polynomial).

Definition

Fix a finite field $GF(q)$, whose elements we call symbols. For the purposes of constructing polynomial codes, we identify a string of $n$ symbols $a_{n-1}\dots a_0$ with the polynomial

$a_{n-1}{x}^{n-1}+\cdots +a_{1}x+a_0.$

Fix integers $m\le n$ and let $g(x)$ be some fixed polynomial of degree $m$, called the generator polynomial. The polynomial code generated by $g(x)$ is the code whose code words are precisely the polynomials of degree less than $n$ that are divisible (without remainder) by $g(x)$.

Example

Consider the polynomial code over $GF(2)=\{0,1\}$ with $n=5$, $m=2$, and generator polynomial $g(x)=x^2+x+1$. This code consists of the following code words:

$0\cdot g(x),1\cdot g(x),x\cdot g(x),(x+1)\cdot g(x),$

$x^2\cdot g(x),(x^2+1)\cdot g(x),(x^2+x)\cdot g(x),(x^2+x+1)\cdot g(x).$

Or written explicitly:

$0,x^2+x+1,x^3+x^2+x,x^3+1,$

$x^4+x^3+x^2,x^4+x^3+x+1,x^4+x,x^4+x^2+1.$

Equivalently, expressed as strings of binary digits, the codewords are:

$00000,00111,01110,01001,$

$11100,11011,10010,10101.$

Note that this, as every polynomial code, is indeed a linear code, i.e., linear combinations of code words are again code words. In a case like this where the field is GF(2), linear combinations are found by taking the XOR of the codewords expressed in binary form (e.g. 00111 XOR 10010 = 10101).

Encoding

In a polynomial code over $GF(q)$ with code length $n$ and generator polynomial $g(x)$ of degree $m$, there will be exactly $q^{n-m}$ code words. Indeed, by definition, $p(x)$ is a code word if and only if it is of the form $p(x)=g(x)\cdot q(x)$, where $q(x)$ (the quotient) is of degree less than $n-m$. Since there are $q^{n-m}$ such quotients available, there is the same number of possible code words. Plain (unencoded) data words should therefore be of length $n-m$

Some authors, such as (Lidl & Pilz, 1999), only discuss the mapping $q(x)\mapsto g(x)\cdot q(x)$ as the assignment from data words to code words. However, this has the disadvantage that the data word does not appear as part of the code word.

Instead, the following method is often used to create a systematic code: given a data word $d(x)$ of length $n-m$, first multiply $d(x)$ by $x^m$, which has the effect of shifting $d(x)$ by $m$ places to the left. In general, $x^{m}d(x)$ will not be divisible by $g(x)$, i.e., it will not be a valid code word. However, there is a unique code word that can be obtained by adjusting the rightmost $m$ symbols of $x^{m}d(x)$. To calculate it, compute the remainder of dividing $x^{m}d(x)$ by $g(x)$:

$x^{m}d(x)=g(x)\cdot q(x)+r(x),$

where $r(x)$ is of degree less than $m$. The code word corresponding to the data word $d(x)$ is then defined to be

$p(x):=x^{m}d(x)-r(x),$

Note the following properties:

1. $p(x)=g(x)\cdot q(x)$, which is divisible by $g(x)$. In particular, $p(x)$ is a valid code word.
2. Since $r(x)$ is of degree less than $m$, the leftmost $n-m$ symbols of $p(x)$ agree with the corresponding symbols of $x^{m}d(x)$. In other words, the first $n-m$ symbols of the code word are the same as the original data word. The remaining $m$ symbols are called checksum digits or check bits.

Example

For the above code with $n=5$, $m=2$, and generator polynomial $g(x)=x^2+x+1$, we obtain the following assignment from data words to codewords:

• 000 Template:Mapsto 00000
• 001 Template:Mapsto 00111
• 010 Template:Mapsto 01001
• 011 Template:Mapsto 01110
• 100 Template:Mapsto 10010
• 101 Template:Mapsto 10101
• 110 Template:Mapsto 11011
• 111 Template:Mapsto 11100

Decoding

An erroneous message can be detected in a straightforward way through polynomial division by the generator polynomial resulting in a non-zero remainder.

Assuming that the code word is free of errors, a systematic code can be decoded simply by stripping away the $m$ checksum digits.

If there are errors, then error correction should be performed before decoding. Efficient decoding algorithms exist for specific polynomial codes, such as BCH codes.

Properties of polynomial codes

As for all digital codes, the error detection and correction abilities of polynomial codes are determined by the minimum Hamming distance of the code. Since polynomial codes are linear codes, the minimum Hamming distance is equal to the minimum weight of any non-zero codeword. In the example above, the minimum Hamming distance is 2, since 01001 is a codeword, and there is no nonzero codeword with only one bit set.

More specific properties of a polynomial code often depend on particular algebraic properties of its generator polynomial. Here are some examples of such properties:

• A polynomial code is cyclic if and only if the generator polynomial divides $x^n-1$.
• If the generator polynomial is primitive, then the resulting code has Hamming distance at least 3, provided that $n\le 2^m-1$.
• In BCH codes, the generator polynomial is chosen to have specific roots in an extension field, in a way that achieves high Hamming distance.

The algebraic nature of polynomial codes, with cleverly chosen generator polynomials, can also often be exploited to find efficient error correction algorithms. This is the case for BCH codes.

Specific families of polynomial codes

• Cyclic codes – every cyclic code is also a polynomial code; a popular example is the CRC code.
• BCH codes – a family of cyclic codes with high Hamming distance and efficient algebraic error correction algorithms.
• Reed–Solomon codes – an important subset of BCH codes with particularly efficient structure.

References

• W.J. Gilbert and W.K. Nicholson: Modern Algebra with Applications, 2nd edition, Wiley, 2004.
• R. Lidl and G. Pilz. Applied Abstract Algebra, 2nd edition. Wiley, 1999.

43 year old Petroleum Engineer Harry from Deep River, usually spends time with hobbies and interests like renting movies, property developers in singapore new condominium and vehicle racing. Constantly enjoys going to destinations like Camino Real de Tierra Adentro.