1. NATO ARW, 6-9 October, 2008, Veliko Tarnovo, Bulgaria Error Correcting Cryptcodes Based on Quasigroups SMILE MARKOVSKI “Ss Cyril and Methodius” University Skopje, Republic of Macedonia Joint research with D. Gligoroski and Lj. Kocarev

2. Error Correcting Cryptcodes Based on Quasigroups Gligoroski, D., Markovski, S., Kocarev, Lj., Error-Correcting Codes Based on Quasigroups, Proceedings of 16th International Conference on Computer Communications and Networks (ICCCN 2007), 13-16 Aug. 2007. pp. 165 – 172 http://ieeexplore.ieee.org/Xplore/login.jsp?url=/iel5/4317769/ 4317770/04317814.pdf?tp=&isnumber=&arnumber=4317814 http://ieeexplore.ieee.org/Xplore/login.jsp?url=/iel5/4317769/ 4317770/04317814.pdf?tp=&isnumber=&arnumber=4317814 D Gligoroski, D., Markovski, S., Kocarev, Lj., Totally Asynchronous Stream Ciphers + Redundancy = Cryptcoding, S. Aissi, H.R. Arabnia (Eds.): Proceedings of the 2007 International Conference on Security and menagement, SAM 2007, Las Vegas, June 25- 28,2007. CSREA Press, pp. 446 – 451 http://www.informatik.uni-trier.de/~ley/db/conf/ csreaSAM/csreaSAM2007.html#GligoroskiMK07

3. STREAM CIPHERS A synchronous stream cipher - one bit error of the transmitted ciphertext propagate to one bit error during the decryption An asynchronous stream cipher - one bit error of the transmitted ciphertext propagate to several consecutive bit errors during the decryption A totally asynchronous stream cipher (TASC) - one bit error of the transmitted ciphertext propagate to all consecutive bit errors during the decryption

4. STREAM CIPHERS plaintext: m 1 m 2 m 3 m 4 m 6 m 7 m 8 m 9 m 10 … ciphertext: c 1 c 2 c 3 c 4 c 6 c 7 c 8 c 9 c 10 … chanel: ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ciphertext: c 1 c 2 c 3 c 4 c 6 c 7 c 8 c 9 c 10 … plaintext: m 1 m 2 m 3 m 4 m 6 m 7 m 8 m 9 m 10 … ----------------------------------------------------------------------------------------------------------------- plaintext: m 1 m 2 m 3 m 4 m 6 m 7 m 8 m 9 m 10 … ciphertext: c 1 c 2 c 3 c 4 c 6 c 7 c 8 c 9 c 10 … chanel: ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ciphertext: c 1 c 2 c 3 c 4 c 6 c 7 c 8 c 9 c 10 … plaintext: m 1 m 2 m 3 m 4 m 6 m 7 m 8 m 9 m 10 … ----------------------------------------------------------------------------------------------------------------- plaintext: m 1 m 2 m 3 m 4 m 6 m 7 m 8 m 9 m 10 … ciphertext: c 1 c 2 c 3 c 4 c 6 c 7 c 8 c 9 c 10 … chanel: ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ciphertext: c 1 c 2 c 3 c 4 c 6 c 7 c 8 c 9 c 10 … plaintext: m 1 m 2 m 3 m 4 m 6 m 7 m 8 m 9 m 10 …

5. CRYPTCODING Given: - TASC - message M = B 1 ||B 2 ||B 3 ||… as concatenation of n-bit blocks B i - redundant message R = R 1 ||R 2 ||R 3 ||… as concatenation of k-bit blocks R i Coding: C = TASC(B 1 ||R 1 ||B 2 ||R 2 ||B 3 ||R 3 ||…) = C 1 ||C 2 ||C 3 ||…, where |C i | = | B i ||R i | (as stream code) C i = TASC(B i ||R i ) (as block code) Decoding of C’=C 1 ’||C 2 ’||C 3 ’||… : - use TASC -1 (C’) and the redundant information R (as stream code) - use TASC -1 (C i ’) and the redundant information R i (as block code) cryptcoding of rate n/(n+k)

6. DECODING TASC has to be suitably defined!!! - bijective function - randomized function Our TASC is based on quasigroup transformations of strings: - bijective functions - have good randomization properties We are using quasigroups of order 16 and their elements are nibles (4-bit words)

7. QUASIGROUP

8. LEFT PARASTROPHE (Q,*) – quasigroup Definition of “\”: x \ y = z y = x * z (Q,\) is a quasigroup too, left parastrophe of (Q,*) Identities: x * (x \ y) = y, x \ (x * y) = y

10. Quasigroup string transformations e-transformation Take a fixed a € Q. d-transformation

12. Quasigroup string transformations Theorem 1: The distribution of s-tuples in the string e a k (a 1 a 2 …a n ) is uniform, for each s = 1,2,…,k Theorem 2: There are quasigroups such that periodicity of e a k (a 1 a 2 …a n ) is 2 k times the periodicity of a 1 a 2 …a n Theorem 3: The e-transformations and the d-transformations are bijections

13. QUASIGROUP TASC

14. OUR DECODING Decoding process consists of four steps: (i) procedure for generating the sets with predefined Hamming distance (ii) inverse coding algorithm (iii) procedure for generating decoding candidate sets (iv) decoding rule

15. SETS WITH PREDEFINED HAMMING DISTANCE Probability that < t-1 bits in C’ i (where |C’ i | = s), are not correct is Let B max be an integer such that 1 - P(p,B max ) < q-1. Thenthe bit-error probability of the block C’ i (= D i ) is at most q. Define sets with predefined Hamming distnce B max by The cardinality of H i is

16. INVERSE CODING ALGORITHM (ICA)

17. GENERATING DECODING CANDIDATE SETS The decoding candidate sets S 0, S 1, …, S r are defined iteratively. S 0 = {(k 1 …k t, )}, where is the empty sequence and k (0) = k 1 …k t is the initial (secret) key. S i is the set of all pairs ( ,w 1 w 2 …w is ) obtained by using the sets S i-1 and H i as follows: For each ( , w 1 w 2 …w (i-1)s ) € S i-1 and each element  € H i, apply the ICA with input ( ,  ), and let ICA( ,  )=( ,  ). If  and R i have the redundant information in the same positions, then the pair ( ,w 1 w 2 …w is c 1 c 2 … c s ) = ( ,w 1 w 2 …w is ) is an element of S i.

18. DECODING RULE If the set S r contains only one element (d 1 d 2 …d n,w 1 w 2 …w rs ), then C = w 1 w 2 …w rs

19. EXAMPLE OF A STREAM CRYPTCODE Message: M = m 1 m 2 m 3 m 4 m 5 m 6 … Message expansion with redundancy: R(M) = m 1 000 m 2 000 m 3 000 0000 m 4 000 m 5 000 m 6 000 0000..., => code rate 3/16 Initial key: 01234 (digits represented by nibles) Chanel: Bounded BSC with at most 5 bit erors on every 16 received bits => B max = 5, B checks = 6885

20. M = 3 8 a 8 e 9 8 7 3 7 7 c 8 3 c d f d 3 a 6 e 1 0 … R(M)=3 0 0 0 8 0 0 0 a 0 0 0 0 0 0 0 8 0 0 0 e 0 0 0 9 0 0 0 0 0 0 0 8 0 0 0 7 0 0 0 3 0 0 0 0 0 0 0 7 0 0 0 7 0 0 0 c 0 0 0 0 0 0 0 8 0 0 0 3 0 0 0 c 0 0 0 0 0 0 0 d 0 0 0 f 0 0 0 d 0 0 0 0 0 0 0 3 0 0 0 a 0 0 0 6 0 0 0 0 0 0 0 e 0 0 0 1 0 0 0 0 0 0 0 C = TASC(R(M)) = 9 4 a 0 f 0 7 d a c a 5 d 8 5 8 c 7 5 b 8 a d 0 8 5 a 9 2 1 3 b 0 5 d 6 2 7 2 d b 4 c d 9 1 4 4 2 7 d 1 5 4 8 5 0 8 4 8 8 2 3 5 2 6 8 9 b 2 a 1 8 d 6 c b 1 9 c 5 9 e e 4 f 4 4 7 3 e 6 5 d 5 7 2 c 5 2 5 8 0 a b 3 6 e 2 8 1 c 8 1 2 1 4 1 3 8 d b c 2 c b 6 7 e 5 … Eror sequence: 5 4 4 5 5 4 5 4 5 5 2 5 4 5 4 4 5 3 5 4 5 5 5 3 5 5 5 5 5 5 5 5 5 5 4 … C’ = 9 2 e 3 6 8 7 9 a 8 f d 7 0 c 8 d e c b 2 2 d 2 4 4 8 1 a 3 1 a 1 7 f 5 b f 3 c b 4 c 7 9 0 1 e 8 7 f 3 4 c 0 9 8 0 1 8 6 a 3 5 4 e d 9 b 2 f 9 4 d c 8 a 1 d 0 5 d b b e a 4 0 7 b 4 3 4 d d f 1 b 5 2 c 8 8 9 a 3 9 e 6 1 0 4 0 1 4 7 1 b 3 a 4 e c 0 9 b 3 6 4 5 9 e 5 7 e 7 f c f d 6 3 1 8 0....

21. TRELIS OF DECODING PROCESS M = 3 8 a 8 e 9 8 7 3 7 7 c 8 3 c d f d 3 a 6 e 1 0 …

27. After 36 decrypted/decoded blocks we have two decoding candidates: a)3 8 a 8 e 9 8 7 3 7 7 c 8 3 c d f d 3 a 6 e 1 0 2 d c, b) 3 8 a 8 e 9 8 7 3 7 7 c 8 3 c d f d 3 a 6 e 1 0 2 d 1. The first candidate is the correct one.

28. INSTEAD OF CONCLUSION For comparison, 3/16 Reed-Muller code of length 32 that can recover up to 7 errors in 32 bits is not able to decode successfully the message with so many errors. This example shows that the stream codes, in some cases, can be much better than the block codes.

29. Thanks for your attention!