Some (almost) optimally extendable linear codes

Abstract

Side-channel attacks and fault injection attacks are nowadays important cryptanalysis methods on the implementations of block ciphers, which represent huge threats. Direct sum masking (DSM) has been proposed to protect the sensitive data stored in registers against both SCA and FIA. It uses two linear codes ${\mathcal {C}}$ and ${\mathcal {D}}$ whose sum is direct and equals ${\mathbb {F}}_q^n$. The resulting security parameter is the pair $(d({\mathcal {C}})-1,d({{\mathcal {D}}}^\perp )-1)$. For being able to protect not only the sensitive input data stored in registers against SCA and FIA but the whole algorithm (which is required at least in software applications), it is useful to change $\mathcal C$ and ${\mathcal {D}}$ into ${\mathcal {C}}^\prime$, which has the same minimum distance as ${\mathcal {C}}$, and ${\mathcal {D}}^\prime$, which may have smaller dual distance than ${\mathcal {D}}$. Precisely, $\mathcal D^\prime$ is the linear code obtained by appending on the right of its generator matrix the identity matrix with the same number of rows. It is then highly desired to construct linear codes ${\mathcal {D}}$ such that $d({{\mathcal {D}}^\prime }^\perp )$ is very close to $d({{\mathcal {D}}}^\perp )$. In such case, we say that ${\mathcal {D}}$ is almost optimally extendable (and is optimally extendable if $d({{\mathcal {D}}^\prime }^\perp )= d({\mathcal {D}}^\perp )$). In general, it is notoriously difficult to determine the minimum distances of the codes ${\mathcal {D}}^\perp$ and ${{\mathcal {D}}^\prime }^\perp$ simultaneously. In this paper, we mainly investigate constructions of (almost) optimally extendable linear codes from irreducible cyclic codes and from the first-order Reed–Muller codes. The minimum distances of the codes ${\mathcal {D}}, {\mathcal {D}}^\prime , \mathcal D^\perp$, and ${{\mathcal {D}}^\prime }^\perp$ are determined explicitly and their weight enumerators are also given. Furthermore, several families of optimally extendable codes are found (for the second time) among such linear codes.