Paper 2022/128

Time-Memory tradeoffs for large-weight syndrome decoding in ternary codes

Pierre Karpman and Charlotte Lefevre


We propose new algorithms for solving a class of large-weight syndrome decoding problems in random ternary codes. This is the main generic problem underlying the security of the recent Wave signature scheme (Debris-Alazard et al., 2019), and it has so far received limited attention. At SAC 2019 Bricout et al. proposed a reduction to a binary subset sum problem requiring many solutions, and used it to obtain the fastest known algorithm. However ---as is often the case in the coding theory literature--- its memory cost is proportional to its time cost, which makes it unattractive in most applications. In this work we propose a range of memory-efficient algorithms for this problem, which describe a near-continuous time-memory tradeoff curve. Those are obtained by using the same reduction as Bricout et al. and carefully instantiating the derived subset sum problem with exhaustive-search algorithms from the literature, in particular dissection (Dinur et al., 2012) and dissection in tree (Dinur, 2019). We also spend significant effort adapting those algorithms to decrease their granularity, thereby allowing them to be smoothly used in a syndrome decoding context when not all the solutions to the subset sum problem are required. For a proposed parameter set for Wave, one of our best instantiations is estimated to cost $2^{177}$ bit operations and requiring $2^{88.5}$ bits of storage, while we estimate this to be $2^{152}$ and $2^{144}$ for the best algorithm from Bricout et al..

Available format(s)
Public-key cryptography
Publication info
A minor revision of an IACR publication in PKC 2022
time-memory tradeoffsubset sumsyndrome decoding problem
Contact author(s)
pierre karpman @ univ-grenoble-alpes fr
charlotte lefevre @ ru nl
2022-02-09: received
Short URL
Creative Commons Attribution


      author = {Pierre Karpman and Charlotte Lefevre},
      title = {Time-Memory tradeoffs for large-weight syndrome decoding in ternary codes},
      howpublished = {Cryptology ePrint Archive, Paper 2022/128},
      year = {2022},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.