Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

A Combinatorial Approach to Avoiding Weak Keys in the BIKE Cryptosystem

Gretchen L Matthews, Emily McMillon

TL;DR

This work establishes a concrete link between decoding weaknesses in BIKE and the presence of $4$-cycles in the Tanner graph representations of QC-MDPC codes. It develops a precise counting framework for $4$-cycles, separating contributions from individual circulants and cross-block interactions, and introduces a practical filter that uses cycle-structure features to prune weak keys. The authors extend the analysis to general QC-MDPC codes, identify cycle-types that most strongly influence decoder failure, and provide experimental evidence that short cycles within a single circulant are more detrimental than cross-circulant ones. They further show that complete avoidance of $4$-cycles is theoretically unlikely for BIKE parameters, underscoring the relevance of cycle-aware key filtering in practice, and provide data for reproducibility. The findings have implications for secure parameter selection and key generation in code-based post-quantum cryptosystems.

Abstract

Bit Flipping Key Encapsulation (BIKE) is a code-based cryptosystem that was considered in Round 4 of the NIST Post-Quantum Cryptography Standardization process. It is based on quasi-cyclic moderate-density parity-check (QC-MDPC) codes paired with an iterative decoder. While (low-density) parity-check codes have been shown to perform well in practice, their capabilities are governed by the code's graphical representation and the choice of decoder rather than the traditional code parameters, making it difficult to determine the decoder failure rate (DFR). Moreover, decoding failures have been demonstrated to lead to attacks that recover the BIKE private key. In this paper, we demonstrate a strong correlation between weak keys and $4$-cycles in their associated Tanner graphs. We give concrete ways to enumerate the number of 4-cycles in a BIKE key and use these results to present a filtering algorithm that will filter BIKE keys with large numbers of 4-cycles. These results also apply to more general parity check codes.

A Combinatorial Approach to Avoiding Weak Keys in the BIKE Cryptosystem

TL;DR

This work establishes a concrete link between decoding weaknesses in BIKE and the presence of -cycles in the Tanner graph representations of QC-MDPC codes. It develops a precise counting framework for -cycles, separating contributions from individual circulants and cross-block interactions, and introduces a practical filter that uses cycle-structure features to prune weak keys. The authors extend the analysis to general QC-MDPC codes, identify cycle-types that most strongly influence decoder failure, and provide experimental evidence that short cycles within a single circulant are more detrimental than cross-circulant ones. They further show that complete avoidance of -cycles is theoretically unlikely for BIKE parameters, underscoring the relevance of cycle-aware key filtering in practice, and provide data for reproducibility. The findings have implications for secure parameter selection and key generation in code-based post-quantum cryptosystems.

Abstract

Bit Flipping Key Encapsulation (BIKE) is a code-based cryptosystem that was considered in Round 4 of the NIST Post-Quantum Cryptography Standardization process. It is based on quasi-cyclic moderate-density parity-check (QC-MDPC) codes paired with an iterative decoder. While (low-density) parity-check codes have been shown to perform well in practice, their capabilities are governed by the code's graphical representation and the choice of decoder rather than the traditional code parameters, making it difficult to determine the decoder failure rate (DFR). Moreover, decoding failures have been demonstrated to lead to attacks that recover the BIKE private key. In this paper, we demonstrate a strong correlation between weak keys and -cycles in their associated Tanner graphs. We give concrete ways to enumerate the number of 4-cycles in a BIKE key and use these results to present a filtering algorithm that will filter BIKE keys with large numbers of 4-cycles. These results also apply to more general parity check codes.

Paper Structure

This paper contains 12 sections, 9 theorems, 38 equations, 2 figures, 6 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Preliminaries
  3. Parity-check codes
  4. BIKE
  5. Weak Keys in BIKE
  6. Cycles and weak keys
  7. BIKE
  8. General QC-MDPC Codes
  9. Filtering Based on Cycle Structure
  10. Complete Avoidance of $4$-Cycles
  11. Experimental results
  12. Conclusion

Key Result

Proposition 3.3

Let $h \in \mathbb{F}_2[x]/ \langle x^r - 1 \rangle$ and $H \in \mathbb{F}_2^{r \times r}$ be the circulant parity-check matrix corresponding to $h$. Then, for $i,j \in [r]_0$, In particular,

Figures (2)

  • Figure 1: A parity check matrix $H$ (left) for a linear code and its corresponding Tanner graph $T(H)$ (right). Here and throughout, variable nodes are represented with circles and check nodes are represented with squares.
  • Figure 2: This figure illustrates the types of $4$-cycles, marked $A$, $B$, $C$, and $D$, in a quasi-cyclic parity-check matrix $H$ with circulant blocks pictured as the small squares.

Theorems & Definitions (27)

  • Definition 2.1
  • Definition 2.2
  • Definition 2.3
  • Definition 2.4
  • Example 2.5
  • Definition 3.1
  • Remark 3.2
  • Proposition 3.3
  • proof
  • Lemma 3.4
  • ...and 17 more