# A Generalization of Cyclic Code and Applications to Public Key Cryptosystems

In this paper, we define and discuss ϕ-cyclic code, which may be regarded as a general form of the ordinary cyclic code. As applications, we explain how to extend two public key encryption schemes, one is McEliece and Niederriter's cryptosystem of which is based on error-correcting code theory. Another one is NTRU public key cryptosystem of which is based on polynomial ring theory. The main purpose of this paper is to give a more general construction of NTRU based on ideal matrices and q-ary lattice theory.

## Authors

• 3 publications
• 1 publication
• 120 publications
• 2 publications
12/25/2021

### Cyclic Lattices, Ideal Lattices and Bounds for the Smoothing Parameter

Cyclic lattices and ideal lattices were introduced by Micciancio in <cit...
06/03/2019

### Encryption Scheme Based on Expanded Reed-Solomon Codes

We present a code-based public-key cryptosystem, in which we use Reed-So...
07/04/2021

### Expanded Gabidulin Codes and Their Application to Cryptography

This paper presents a new family of linear codes, namely the expanded Ga...
09/24/2020

### Exponent of Cyclic Codes over 𝔽_q

In this article, we introduce and study the concept of the exponent of a...
12/12/2018

### McNie2-Gabidulin: An improvement of McNie public key encryption using Gabidulin code

McNie is a code-based public key encryption scheme submitted as a candid...
04/05/2022

### The Cyclic Flats of a q-Matroid

In this paper we develop the theory of cyclic flats of q-matroids. We sh...
08/30/2016

### Lopsided Approximation of Amoebas

The amoeba of a Laurent polynomial is the image of the corresponding hyp...
##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## 1 ϕ-Cyclic Code

Let be a finite field with elements and be a power of a prime number, be the polynomial ring of with variable . Let be the -dimensional linear space over , and

be a fixed vector in

with , the associated polynomial of given by

 ϕ(x)=ϕa(x)=xn−an−1xn−1−⋯−a1x−a0∈Fq[x],a0≠0. (1.1)

Let be the principal ideal generated by in . There is a one to one correspondence between and the quotient ring , given by

 c=(c0,c1,...,cn−1)∈Fnq⇄c(x)=c0+c1x+⋯+cn−1xn−1∈R. (1.2)

In fact, this correspondence is also an isomorphism of Abel groups. One may extend this correspondence to subsets of and by

 C⊂Fnq⇄C(x)={c(x)|c∈C}⊂R. (1.3)

If is a linear subspace of of dimension , then is called a linear code in coding theory and written by as usual. Each vector is called a codeword of length . Obviously, and are two trivial codes. Another one is called constant codes, of which is almost trivial given by

 C={(b,b,...,b)|b∈Fq},and C=[n,1].

According to the given polynomial

, we may define a linear transformation

in ,

 τϕ(c)=τϕ((c0,c1,...,cn−1))=(a0cn−1,c0+a1cn−1,c1+a2cn−1,...,cn−2+an−1cn−1). (1.4)

It is easily seen that is a linear transformation.

Definition 1.1 Let be a linear code. It is called a -cyclic code, if

 ∀c∈C⇒τϕ(c)∈C. (1.5)

In other words, a linear code is a -cyclic code, if and only if is closed under linear transformation . Clearly, if , and , then the -cyclic code is precisely the ordinary cyclic code (see Chapter 6 of [9]).

We first show that there is a one to one correspondence between -cyclic codes in and ideals in .

Theorem 1 Let be a subset, then is a -cyclic code, if and only if is an ideal of .

Proof: We use column notation for vector in , then linear transformation may be written as

 τϕ⎛⎜ ⎜ ⎜ ⎜⎝c0c1⋮cn−1⎞⎟ ⎟ ⎟ ⎟⎠=⎛⎜ ⎜ ⎜ ⎜⎝a0cn−1c0+a1cn−1⋮cn−2+an−1cn−1⎞⎟ ⎟ ⎟ ⎟⎠,∀c=⎛⎜ ⎜ ⎜ ⎜⎝c0c1⋮cn−1⎞⎟ ⎟ ⎟ ⎟⎠∈Fnq.

Let be a square matrix over ,

 Tϕ=⎛⎜ ⎜ ⎜ ⎜ ⎜⎝0⋯0a0a1In−1⋮an−1⎞⎟ ⎟ ⎟ ⎟ ⎟⎠∈Fn×nq. (1.6)

where is the unit matrix. The matrix expression of as follows

 τϕ⎛⎜ ⎜ ⎜ ⎜⎝c0c1⋮cn−1⎞⎟ ⎟ ⎟ ⎟⎠=Tϕ⎛⎜ ⎜ ⎜ ⎜⎝c0c1⋮cn−1⎞⎟ ⎟ ⎟ ⎟⎠=⎛⎜ ⎜ ⎜ ⎜⎝a0cn−1c0+a1cn−1⋮cn−2+an−1cn−1.⎞⎟ ⎟ ⎟ ⎟⎠. (1.7)

Suppose and is an ideal of , it is clear that is a linear code of . To prove is a -cyclic code, we note that for any polynomial , then if and only if , namely, if , then

 xc(x)∈C(x)⇔τϕ(c)∈C⇔Tϕc∈C. (1.8)

Therefore, if is an ideal of , then we have immediately that is a -cyclic code of .

Conversely, if is a -cyclic code, then for all , we have

 ∀c∈C⇒Tkϕc∈C,k⩾1.

It follows that

 ∀c(x)∈C(x)⇒xkc(x)∈C(x),0⩽k⩽n−1,

which implies is an ideal of . This is the proof of Theorem 1.

By Theorem 1, to find a -cyclic code, it is enough to find an ideal of . There are two trivial ideals and , the corresponding -cyclic codes are and respectively, which are called trivial -cyclic code. To find non-trivial -cyclic codes, we make use of homomorphic theorems, which is a standard technique in Algebra. Let be the natural homomorphism from to its quotient ring , ,

 <ϕ(x)>⊂N⊂Fq[x]π−−−−→R=Fq[x]/<ϕ(x)>, (1.9)

where is an ideal of , of which is containing . Since is a principal ideal domain, then is a principal ideal generated by a monic polynomial . It is easy to see that

 <ϕ(x)>⊂⇔g(x)|ϕ(x).

It follows that all ideals satisfing (1.9) are given by

 { | g(x)∈Fq[x]\ is monic and\ g(x)|ϕ(x)}.

We write by mod , the image of under , it is easy to check

 \ mod\ ϕ(x)={h(x)g(x) | h(x)∈Fq[x]\ and degh(x)+degg(x)

more precisely, which is a representative elements set of mod , by homomorphism theorem in ring theory, all ideals of given by

 {\ mod\ ϕ(x) | g(x)∈Fq[x]\ is monic and\ g(x)|ϕ(x)}. (1.11)

Let be the number of monic divisors of in , it follows immediately that

Corollary 1 The number of -cyclic code in is .

To compare the -cyclic code and ordinary cyclic code, we see a simple example.

Example 1 Constant code is always a cyclic code for , and its generated polynomial is just . But constant code in is not always a -cyclic code, it is a -cyclic code if and only if , an equivalent condition for is

 an−1=an−2=⋯=a1=b,\ and\ a0=1+b.

Definition 1.2 Let be a -cyclic code and mod . We call is the generated polynomial of , where is monic and .

Lemma 1.1 Let be the generated polynomial of a -cyclic code , where , and , then and a generated matrix for is the following block matrix

 G=⎛⎜ ⎜ ⎜ ⎜ ⎜ ⎜ ⎜ ⎜⎝gτϕ(g)τ2ϕ(g)⋮τk−1ϕ(g)⎞⎟ ⎟ ⎟ ⎟ ⎟ ⎟ ⎟ ⎟⎠k×n, (1.12)

where is the corresponding codeword of , and for .

Proof: By assumption, mod , then , we are to prove it is a basis of . First, these vectors are linearly independent. Otherwise, we have

 k−1∑i=0biτiϕ(g)=0,\ for some\ bi∈Fq, (1.13)

and the corresponding polynomial is zero, namely

 (k−1∑i=0bixi)g(x)=0.

It follows that

 k−1∑i=0bixi=0⇒bi=0\ for all\ i,0⩽i⩽k−1.

Next, if , and , by (1.10), there is a polynomial such that

 c(x)=b(x)g(x)=(k−1∑i=0bixi)g(x),\ where\ bk−1=1.

Thus we have the corresponding codeword of

 c=k−1∑i=0biτiϕ(g).

This shows that is a basis of , and a generated matrix for is

 G=⎛⎜ ⎜ ⎜ ⎜ ⎜ ⎜ ⎜ ⎜⎝gτϕ(g)τ2ϕ(g)⋮τk−1ϕ(g)⎞⎟ ⎟ ⎟ ⎟ ⎟ ⎟ ⎟ ⎟⎠k×n.

We have lemma 1.1 at once.

To describe a parity check matrix for a -cyclic code, for any , we write

 ¯¯c=(cn−1,cn−2,...,c1,c0)∈Fnq.

Lemma 1.2 Suppose is a -cyclic code with generated polynomial , where and . Let , where . Then a parity check matrix for is

 H=⎛⎜ ⎜ ⎜ ⎜ ⎜ ⎜⎝¯¯¯hτϕ(¯¯¯h)⋮τn−k−1ϕ(¯¯¯h)⎞⎟ ⎟ ⎟ ⎟ ⎟ ⎟⎠(n−k)×n. (1.14)

Proof: Since , it means that in , thus we have

 g0hi+g1hi−1+⋯+gn−khi−n+k=0,∀0⩽i⩽n−1.

It follows that , where is a generated matrix for given by (1.12). Therefore, is a parity check matrix for .

A separable polynomial in Algebra means that it has no multiple roots in its splitting field. The following lemma shows that there is an unit element in any non-zero ideal of , when is a separable polynomial.

Lemma 1.3 Suppose is a separable polynomial of , and mod is an ideal of with , then there exists an element such that

 c(x)d(x)=c(x),\ for all\ c(x)∈C(x).

Proof: Let . Since is a separable polynomial, then , and there are two polynomial and in such that

 a(x)g(x)+b(x)h(x)=1.

Let

 d(x)=a(x)g(x)=1−b(x)h(x)∈C(x).

If , by (1.10), we write , it follows that

 c(x)d(x)≡a(x)g(x)g(x)g1(x)≡(1−b(x)h(x))g(x)g1(x)
 ≡g(x)g1(x)≡c(x)(mod\ ϕ(x)).

Thus we have in .

Next, we discuss maximal -cyclic code. Let mod , and be an irreducible polynomial in , we call the corresponding -cyclic code a maximal -cyclic code, because is a maximal ideal in .

Lemma 1.4 Let be a maximal -cyclic code with generated polynomial , be a root of in some extensions of , then

 C(x)={a(x) | a(x)∈R\ and\ a(β)=0}. (1.15)

Proof: If , by (1.10) we have immediately. Conversely, if and , since is irreducible, thus we have , and (1.15) follows at once.

An important application of maximal -cyclic code is to constract an error-correcting code, so that we may obtain a modified McEliece-Niederriter’s cryptosystem. To do this, let , and be an extension field of of degree . Suppose , where is a primitive element of and is the simple extension containing and . Let be the minimum polynomial of , then is an irreducible polynomial of degree of . It is well-known that is a Galois extension of , so that all roots of are in . Let be all roots of , the Vandermonde matrix defined by

 H=V(β1,β2,...,βn)=⎛⎜ ⎜ ⎜ ⎜ ⎜⎝1β1β21⋯βn−111β2β22⋯βn−12⋮⋮⋮⋮1βmβ2m⋯βn−1m⎞⎟ ⎟ ⎟ ⎟ ⎟⎠m×n, (1.16)

where and each is a vector of . For arbitrary monic polynomial , , let and be a maximal -cyclic code generated by . It is easy to verify that

 c∈C⇔cH′=0.

Therefore, is a parity check matrix for . If we choose the primitive element , so that any columns in are linearly independent, then the minimum distance of is greater than , and is a t-error-correcting code, where .

The public key cryptosystems based on algebraic coding theory were created by R.J.McEliece [11] and H.Niederriter [14], a suitable t-error-correcting code plays a key role in their construction. The error-correcting code should satisfy the following requirements:

(i) should have a relatively large error-correcting capability so that a reasonable number of message vectors can be used;

(ii) should allow an efficient decoding algorithm so that the decryption can be carried out with a short time.

Our results supply a different way to choose an error-correcting code by selecting arbitrary irreducible polynomials of degree and roots of rather than an irreducible factor of and the roots of unit such as ordinary BCH code and Gappa code.

In fact, for any positive integer , there is at least an irreducible polynomial with degree . Let be the number of irreducible polynomials of degree in , then we have (see Theorem 3.25 of [8])

 Nq(m)=1m∑d|mu(md)qd=1m∑d|mu(d)qmd,

where is Mobis function.

Assuming one has selected two monic and irreducible polynomials and with and , let , then one may obtain -cyclic code generated by or , which is more convenient and more flexible than the ordinary methods.

## 2 A Generalization of NTRUEncrypt

The public key cryptosystem NTRU proposed in 1996 by Hoffstein, Pipher and Silverman, is the fastest known lattice based encryption scheme, although its description relies on arithmetic over polynomial quotient ring , it was easily observed that it could be expressed as a lattice based cryptosystem (see [7]). For the background materials, we refer to [3], [5], [6], [10], [12] and [13]. Our strategy in this section is to replace by more general polynomial ring and obtain a generalization of NTRUEncrypt, where is a monic polynomial of degree with integer coefficients.

In this section, we denote and by

 ϕ(x)=xn−an−1xn−1−⋯−a1x−a0∈Z[x],R=Z[x]/<ϕ(x)>,a0≠0. (2.1)

Let be a square matrix given by

 H=Hϕ=⎛⎜ ⎜ ⎜ ⎜ ⎜⎝0⋯0a0a1In−1⋮an−1⎞⎟ ⎟ ⎟ ⎟ ⎟⎠n×n, (2.2)

where is unit matrix. Obviously, is the characteristic polynomial of , and defines a linear transformation of by , where is real number field, is a column vector of . We may extend this transformation to and denote by

 σ(αβ)=(HαHβ),\ where\ (αβ)∈R2n. (2.3)

Of course, is again a linear transformation of .

According to [13], a -ary lattice is a lattice such that , where is a positive integer.

Definition 2.1 A -ary lattice is called convolutional modular lattice, if is in even dimension satisfying

 ∀(αβ)∈L⇒σ(αβ)=(HαHβ)∈L. (2.4)

In other words, a convolutional modular lattice is a -ary lattice in even dimension and is closed under the linear transformation .

Recalling the secret key of NTRU is a pair of polynomials of degree , we may regard and as column vectors in . To obtain a convolutional modular lattice containing , we need some help of ideal matrices. An ideal matrix generated by a vector is defined by

 H∗(f)=H∗ϕ(f)=[f,Hf,H2f,...,Hn−1f]n×n, (2.5)

which is a block matrix in terms of each column . It is easily seen that is a generalization of the classical circulant matrices (see [4]), in fact, let , and , the ideal matrix generated by is given by

 H∗(f)=H∗ϕ(f)=⎛⎜ ⎜ ⎜ ⎜⎝f0fn−1⋯f1f1f0⋯f2⋮⋮⋮fn−1fn−2⋯f0⎞⎟ ⎟ ⎟ ⎟⎠,ϕ(x)=xn−1,

which is known as a circulant matrix. On the other hand, ideal matrix and ideal lattice play an important role in Ajtai’s construction of a collision resistant Hash function, the related materials we refer to [1], [2], [10], [15], [16] and [17].

First, we have to establish some basic properties for an ideal matrix , most of them are known when is a circulant matrix.

Lemma 2.1 Suppose and are given by (2.2) and (2.5) respectively, then for any we have

 H⋅H∗(f)=H∗(f)⋅H,∀f∈Rn.

Proof: Since is the characteristic polynomial of , by Hamilton-Cayley theorem, we have

 Hn=a0In+a1H+⋯+an−1Hn−1. (2.6)

Let

 b=⎛⎜ ⎜ ⎜ ⎜⎝a1a2⋮an−1⎞⎟ ⎟ ⎟ ⎟⎠,\ and\ H=(0a0In−1b).

By (2.5) we have

 H∗(f)H=[f,Hf,...,Hn−1f](0a0In−1b)
 =[Hf,H2f,...,Hn−1f,a0f+a1Hf+⋯+an−1Hn−1f]
 =[Hf,H2f,...,Hn−1f,Hnf]
 =H[f,Hf,...,Hn−1f]=H⋅H∗(f).

the lemma follows.

Lemma 2.2 For any we have

 H∗(f)=f0In+f1H+⋯+fn−1Hn−1. (2.7)

Proof: We use induction on to show this conclusion. If , it is trivial. Suppose it is true for , we consider the case of . For this purpose, we write , the column vectors of unit in , namely

 e1=⎛⎜ ⎜ ⎜ ⎜⎝10⋮0⎞⎟ ⎟ ⎟ ⎟⎠,e2=⎛⎜ ⎜ ⎜ ⎜⎝01⋮0⎞⎟ ⎟ ⎟ ⎟⎠⋯en=⎛⎜ ⎜ ⎜ ⎜⎝00⋮1⎞⎟ ⎟ ⎟ ⎟⎠,

and

 Hn+1=(0A0e1Hn),

where is a row vector. For any , , it is easy to check that

Let , we denote by

 f′=⎛⎜ ⎜ ⎜ ⎜⎝f1f2⋮fn⎞⎟ ⎟ ⎟ ⎟⎠∈Rn,\ and\ f=(f0f′).

By the assumption of induction, we have

 H∗n(f′)=[f′,Hnf′,...,Hn−1nf′]=f1In+f2Hn+⋯+fnHn−1n.

It follows that

 H∗n+1(f)=[(f0f′),Hn+1(f0f′),⋯,Hnn+1(f0f′)]
 =f0In+f1Hn+1+⋯+fnHnn+1.

We complete the proof of lamma 2.2.

We always suppose that is a separable polynomial and are complex number roots of , of which are different from each other. The Vandermonde matrix generated by is

 Vϕ=⎛⎜ ⎜ ⎜ ⎜ ⎜⎝11⋯1w1w2⋯wn⋮⋮⋮wn−11wn−12⋯wn−1n⎞⎟ ⎟ ⎟ ⎟ ⎟⎠,\ and\ \ \ % det(Vϕ)≠0.

Lemma 2.3 Let , then we have

 H∗(f)=V−1ϕ\ diag\ {f(w1),f(w2),...,f(wn)}Vϕ, (2.8)

where diag is the diagonal matrix.

Proof: By Theorem 3.2.5 of [4], for , we have

 H=V−1ϕ\ diag\ {w1,w2,...,wn}Vϕ. (2.9)

By lemma 2.2, it follows that

 H∗(f)=V−1ϕ\ diag\ {f(w1),f(w2),...,f(wn)}Vϕ.

Now, we summarize some basic properties for ideal matrix as follows.

Theorem 2 Let , be two column vectors and be the ideal matrix generated by , then we have:

(i) .

(ii) .

(iii) det .

(iv)

is an invertible matrix if and only if

and are coprime, i.e. gcd .

Proof: (i) and (ii) follow from lemma 2.2 immediately, (iii) and (iv) follow from lemma 2.3. Here we only give an equivalent form of (ii). Let

 f∗g=H∗(f)g. (2.10)

then by (ii) we have

 H∗(f∗g)=H∗(f)H∗(g). (2.11)

To construct a convolutional modular lattice containing vector , let , be the transpose of , and

 A=[(H∗(f))′,(H∗(g))′]=⎛⎜ ⎜ ⎜ ⎜ ⎜ ⎜ ⎜⎝f′g′f′H′g′H′f′(H′)2g′(H′)2⋮⋮f′(H′)n−1g′(H′)n−1⎞⎟ ⎟ ⎟ ⎟ ⎟ ⎟ ⎟⎠n×2n, (2.12)
 A′=(H∗(f)H∗(g))=(fHf⋯Hn−1fgHg⋯Hn−1g)2n×n. (2.13)

We consider and as matrices over , i.e. , , a -ary lattice is defined by (see [13])

 ∧q(A)={y∈Z2n | there exists\ x∈Zn⇒y≡A′x(mod\ q)}. (2.14)

Under the above notations, we have

Theorem 3 For any column vectors and , then is a convolutional modular lattice, and .

Proof: It is known that is a -ary lattice, i.e.

 qZ2n⊂∧q(A)⊂Z2n.

We only prove that is fixed under the linear transformation given by (2.4). If , then for some