On the distribution of Low Hamming Weight products

Abstract

Jeffrey Hoffstein et al. (Discrete Appl. Math. 130:37–49, 2003) introduced the Low Hamming Weight products (LHWP) $X=x_{1}x_{2}x_{3}$ as random exponent of elements in a group or a ring to improve the operational efficiency, where each $x_{i}$ has Hamming Weight $\operatorname{Ham}(x_{i})$ in its binary representation. The random power or multiple be used in many cryptographic constructions, such as Diffie–Hellman key exchange, elliptic curve ElGamal variants, and NTRU public-key cryptosystem. But their randomness is just a conjecture, which lacks of the security proof. The main purpose of this paper is using the analytic method and the properties of the character sums to prove the distribution of the Hamming weight products, which is related to their pseudorandomness and unpredictability. It is important to research the application of LHWP in cryptographic constructions. Our theory shows that the LHWP are exponentially close to the uniform distribution, namely, an attack on algorithm (Hoffstein et al. in Discrete Appl. Math. 130:37–49, 2003) needs polynomial time to reach exponentially close probabilities of success.

1 Background

Jeffrey Hoffstein and Joseph H. Silverman [1] proposed a new algorithm of fast exponentiation via Low Hamming Weight Products (LHWP), which is universally applied in cryptography. For example, Diffie–Hellman key exchange needs to output a random power of $g^{k}$ in a finite field $\mathcal{F}$, if input an element g in $\mathcal{F}$. Divesh Aggarwal [2] introduced a new public-key cryptosystem whose security is based on the Mersenne Low Hamming Weight Ratio: there exist two Low Hamming Weight integers A and B such that $\frac{A}{B}$ is difficult to distinguish from a uniformly random string. NTRU algorithm [3–5] is suspected to be resistant to quantum attacks, their key generation requires a random polynomial product fg in the ring.

The products $X=x_{1}x_{2}x_{3}$ of integers in [1] acts as the exponent over $G=F_{2^{n}}$, where each $x_{i}$ is a low Hamming weight number in its binary representation. It is a rapid method and has significant advantage of reducing the computation of powers in a group such as the Galois field $\mathcal{F}_{2^{n}}$. These kinds of questions also appear in [2, 6–9], where the representation of LHWP is applied to attack the relevant cryptosystems, and the Hamming weight model can be concentrated on the Differential Power Analysis.

The efficiency of the algorithm [1] is based on an assumption that a random multiplier is a product of factors, which is called the Low Hamming Product Assumption (see Definition 2). The security of the algorithm [2] is based on the assumption of Low Hamming Weight Ratio. They are all believed to be easily and rapidly computed, however, their randomness or pseudorandomness just is a conjecture, which is widely used, but lacks the solid foundation.

The main purpose of this paper is by using the analytic method and the bounds of the character sums to prove that the LHWP are exponentially close to the uniform distribution, which can imply their pseudorandomness. Furthermore, the theorem shows the unpredictability of LHWP. In addition, an attack on algorithm [1] needs polynomial time to reach exponentially close probabilities of success. The following are the definitions of low Hamming weight and some fundamental concepts required:

Denote by

$$ \operatorname{Ham}(X) = \mbox{Hamming weight of } X $$

the number of 1s in the binary representation of X. In order to compute X faster, it is more advantageous to choose X such that $\operatorname{Ham}(X)$ is small. However, if $\operatorname{Ham}(X)$ is too small, then the algorithm can be exploited by an attacker who is trying to operate brutally.

Let $p>2^{n}$ be a prime, and let $\mathcal{Z}_{p}$ be the residue integer ring modulo p. All elements $c\in \mathcal{Z}_{p}$ have the unique binary representation

$$ c=\sum_{i=0}^{n-1}k_{i}\cdot 2^{i},\quad k_{i} \in \{0,1\}. $$

with a fixed specified binary Hamming weight $h=\sum k_{i}$. The Hamming weight number is equivalent to the Hamming distance from the all-zero string of the same length, which is widely used in several disciplines including information theory, coding theory, and cryptography. For example, the Hamming weight operation can be interpreted as a conversion from the unitary numeral system to binary numbers. Victor K Wei shows that a generalized Hamming weight is a natural generalization of the minimum distance. It is used to characterize the cryptographic performance of a linear code over the wire-tap channel (see [10]).

Definition 1

(Hamming weight inequalities; see [2], Lemma 2)

Let p be a prime. For nonzero $A, B\in \mathcal{Z}_{p}$, denoting by $\operatorname{Ham}(A)$ the Hamming weight of the unique binary representation of A, we have

• 1. $\operatorname{Ham}(A+B)\leq \operatorname{Ham}(A)+\operatorname{Ham}(B)$.

• 2. $\operatorname{Ham}(A\cdot B)\leq \operatorname{Ham}(A)\cdot \operatorname{Ham}(B)$.

• 3. If a binary string $A \neq 0^{n}$, then $\operatorname{Ham}(-A)=n- \operatorname{Ham}(A)$.

Definition 2

(Low Hamming product assumption)

Let h be an integer. Given n-bit strings A and B of low Hamming weight h are independent, it is difficult to distinguish between the product AB and a uniformly distributed random n-bit string.

The security proof in Sect. 3 also requires the regularity of the probability distributions. The variation distance of two distributions X and Y over a finite domain D is defined as

$$ \Delta (X,Y)={\frac{1}{2}}\sum_{\alpha \in D} \bigl\vert \Pr [X=\alpha ]- \Pr [Y=\alpha ] \bigr\vert . $$

Recall that the definition of a statistical distance (sometimes it is called statistical closeness (see [11]) is: Let $n\in \mathcal{N}$ be an integer, for every positive polynomial $p(\cdot )$, and all sufficient large n, we say that two probability ensembles $X_{n}$ and $Y_{n}$ are statistically close if $\Delta (X_{n},Y_{n})$ is a negligible function of $\frac{1}{p(n)}$.

Similarly, δ-statistical closeness to uniform distribution (see [12, 13]) can be concluded based on the definition of statistical distance:

Definition 3

(δ-statistical closeness)

For some constant $\delta >0$, a random variable X is δ-statistically close to a uniform random variable Y if

$$ \Delta (X)=\frac{1}{2}\cdot \sum_{\alpha \in \mathcal{Z}} \biggl\vert \operatorname{pr}[X= \alpha ]-\frac{1}{p-1} \biggr\vert \leq \delta , $$

where we taking uniform probabilities of Y to equal $\frac{1}{p-1}$. More precisely, δ-statistically close means that the statistical distance $\Delta (X)$ is exponentially small.

2 Main results

Motivated by the universal use of Hamming weight in cryptography, studying the uniform distribution properties of LHWP is an important and interesting problem because it reveals some quality guarantee of their pseudorandomness. It is crucial for the security of the algorithms. We start with the following problem:

Let $p>2^{n}$ be a prime and denote by $\mathcal{Z}_{p}$ the residue ring modulo p. Given $h\in \mathcal{Z}_{p}$, find $x_{1},x_{2},x_{3} \in \mathcal{Z}_{p}$ of Hamming weight h, where $x_{i}$ corresponds to an n-bit string of arbitrary Hamming weight, such that $X=x_{1}x_{2}x_{3}$ exists and is uniformly distributed in $\mathcal{Z}_{p}$. More specifically,

$$ x_{1}x_{2}x_{3}\bmod (p) $$

(1)

is uniformly distributed, where p is a prime.

Let $\mathcal{B}$ be the set of integers with Hamming weight less than h, that is, if $x_{i}\in \mathcal{B}$, and $\mathrm{{Ham}}(x_{i})\leq h$, where $i=1,2,3$, then the cardinality

$$ \mathcal{ \vert B \vert }=\sum_{0\leq j\leq h} \binom{n}{j}. $$

We consider the distribution of modular sums

$$\begin{aligned} X=x_{1}x_{2}x_{3} \pmod{p}, \quad x_{1}, x_{2}, x_{3}\in \mathcal{B}. \end{aligned}$$

To be more specific, given a fixed $c\in \mathcal{Z}_{p}$, denote by $N(\mathcal{B},c)$ the number of solutions of the congruence

$$ x_{1}x_{2}x_{3}\equiv c \pmod{p},\quad x_{1}, x_{2}, x_{3}\in \mathcal{B}. $$

(2)

For such integers $x_{1}, x_{2}, x_{3}\in \mathcal{B}$, denote the probability by $P(\mathcal{B},c)$, it is clearly

$$ P(\mathcal{B},c)=\frac{1}{ \vert \mathcal{B} \vert ^{3}}N(\mathcal{B},c). $$

In Sect. 4, we shall use the classical bounds of character sums to give a uniform distribution proof for (2), which is related to the security of the algorithm [1]. That is, we shall prove the following

Theorem

Let$2^{n}< p<2^{5n}$be a prime. For some constants$\delta >0$, $\epsilon >0$, the LHWP$x=x_{1}x_{2}x_{3}$isδ-statistically close to uniform distribution, namely

$$ \sum_{c\in \mathcal{Z}_{p}} \biggl\vert P(\mathcal{B},c)- \frac{1}{p-1} \biggr\vert < p^{-\epsilon }< {\delta }. $$

3 Some lemmas

Let $\boldsymbol{\chi} _{p}$ be the set of multiplicative characters of the multiplicative group $\mathcal{Z}_{p}^{*}$. Denote by $\boldsymbol{\chi}_{p}^{*}$ the subset of nontrivial characters.

In this section, we shall give several necessary lemmas, which appear in the proof of our theorem. First, we have the following

Lemma 1

For any$\epsilon >0$, letχbe a nontrivial multiplicative character modulo$2^{n}< p<2^{5n}$, while$\mathcal{B}$is the set of integers with Hamming weight less than$h\leq [\frac{n}{2}]+1$ (here$[\frac{n}{2}]$means the greatest integer$\leq \frac{n}{2}$). Then there exists$\gamma >0$such that

$$ \max_{\chi \in \boldsymbol{\chi}_{p}^{*}} \biggl\vert \sum_{X\in \mathcal{B}} \chi (X) \biggr\vert \leq \mathcal{ \vert B \vert }p^{-\gamma }, $$

where$p^{\frac{1}{5}+\epsilon }\leq \mathcal{|B|}\leq p$.

Proof

By [14, Theorem 3], we know that if x is a number the Hamming Weight of which equals a fixed small j, then the following inequality holds:

$$ \sum_{x}\chi \bigl(f(x)\bigr)\ll d^{\frac{1}{2}}{n \choose j}^{\frac{1}{2}}2^{ \frac{n}{4}}p^{\frac{1}{8}+o(1)}, $$

where $d=\deg f$.

It is clear that $\mathcal{|B|}=\sum_{0\leq j\leq h}{n\choose j}\leq 2^{n-1}$, then for any $\epsilon >0$, taking $f(x)=X$,

$$\begin{aligned} \sum_{x\in \mathcal{B}}\chi (X) \ll & \sum _{0\leq j\leq h}\binom{n }{j}^{\frac{1}{2}}2^{\frac{n}{4}}p^{\frac{1}{8}+o(1)} \\ \ll & \vert \mathcal{B} \vert \binom{n }{j}^{\frac{1}{2}}2^{-\frac{3n}{4}}p^{ \frac{1}{8}+o(1)} \\ \ll & \vert \mathcal{B} \vert 2^{-\frac{3n}{4}}p^{\frac{1}{8}+o(1)}. \end{aligned}$$

From $p<2^{5n}$, we obtain $\sum_{x\in \mathcal{B}}\chi (X)\ll |\mathcal{B}|p^{- \frac{1}{40}+o(1)}$, thus taking $\gamma =\frac{1}{40}>0$, the claim of Lemma 1 holds. □

Remark

The most well known bound of $\max_{\chi \in \boldsymbol{\chi}_{p}^{*}} \vert \sum_{X \in \mathcal{B}}\chi (X) \vert$ is Polya–Vinogradov inequality (see [15, Theorem 2.2], [14, Lemma 1]):

$$ \displaystyle \max_{\chi \in \boldsymbol{\chi}_{p}^{*}} \biggl\vert \sum _{X \in \mathcal{B}}\chi (X) \biggr\vert \leq p^{\frac{1}{2}}\ln p, $$

which is nontrivial for $\mathcal{B}\geq p^{\frac{1}{2}+\epsilon }$. However, this bound related to $\mathcal{B}$ is too large to be used for our proof. In such cases we apply Lemma 1.

Lemma 2

Let$X\in \mathcal{B}$be an integer, its binary representation being ann-bit string of Hamming weight less thanh, then$\mathcal{|B|}=\sum_{0\leq j\leq h} {n \choose j}$, therefore,

$$ \mathcal{ \vert B \vert }\leq 2^{nH(h/n)}< p^{H(h/n)}, $$

where the entropy function is

$$ H(\gamma )=-\gamma \log \gamma -(1-\gamma )\log (1-\gamma ). $$

Proof

See [16, Sect. 10.11]. □

4 Proof of the Theorem

Recall that (see [17, Chap. 5]) if G is a finite Abelian group (multiplicative) of order $|G|$, a character χ of G is a homomorphism from G into the multiplicative group U of complex numbers of absolute value 1, that is, a mapping from G into U with $\chi (g_{1}g_{2})=\chi (g_{1})\chi (g_{2})$ for all $g_{1}, g_{2}\in G$. Then supposing g and h are elements of a finite Abelian group G, the following is the well-known property of character sums:

$$ \frac{1}{ \vert G \vert }\sum_{\chi \in \boldsymbol{\chi}_{p}}\chi (g)\overline{ \chi (h)}=\textstyle\begin{cases} 0, &\mbox{for }g\neq h, \\ 1, &\mbox{for }g= h. \end{cases} $$

In this section, we shall complete the proof of our theorem. Note that

$$\begin{aligned} \sum_{c\in \mathcal{Z}_{p}} \biggl\vert P( \mathcal{B},c)- \frac{1}{p-1} \biggr\vert ^{2} =&\sum _{c\in \mathcal{Z}_{p}} \biggl\vert \frac{N (\mathcal{B},c)}{ \vert \mathcal{B} \vert ^{3}}- \frac{1}{p-1} \biggr\vert ^{2} \\ =&\frac{1}{\mathcal{ \vert B \vert }^{6}}\sum_{c\in \mathcal{Z}_{p}} \biggl\vert N( \mathcal{B},c)-\frac{ \vert \mathcal{B} \vert ^{3}}{p-1} \biggr\vert ^{2}. \end{aligned}$$

(3)

Clearly, $N(\mathcal{B},c)$ is the number of solutions of the congruence (2), thus we have

$$ N(\mathcal{B},c)=\frac{1}{p-1}\sum_{\chi \in \boldsymbol{\chi}_{p}} \sum_{x_{1}x_{2}x_{3}\in \mathcal{B}}\chi (x_{1}x_{2}x_{3}) \overline{ \chi (c)}. $$

If $\chi =\chi _{0}$ is the trivial character, then the corresponding term of $N(\mathcal{B},c)$ is $|\mathcal{B}|^{3}/(p-1)$,

We know that $\chi (c^{-1} )=\overline{\chi (c)}$, and $z\overline{z}=|z|^{2}$, where z̅ denotes the conjugate of a complex number z. Then $c^{-1}$ runs through $\mathcal{Z}_{p}$ together with c, therefore

$$\begin{aligned}& \sum_{c\in \mathcal{Z}_{p}} \biggl\vert N(\mathcal{B},c)- \frac{ \vert \mathcal{B} \vert ^{3}}{p-1} \biggr\vert ^{2} \\& \quad =\sum_{c\in \mathcal{Z}_{p}} \biggl(\frac{1}{p-1}\sum _{\chi \in \boldsymbol{\chi}_{p}^{*}}\overline{\chi (c)} \biggl\vert \sum _{x_{1}x_{2}x_{3} \in \mathcal{B}}\chi (x_{1}x_{2}x_{3}) \biggr\vert \biggr)^{2} \\& \quad =\frac{1}{(p-1)^{2}}\sum_{c\in \mathcal{Z}_{p}}\sum _{\chi _{1} \chi _{2}\in \boldsymbol{\chi}_{p}^{*}}{\chi _{1}(c)} {\chi _{2}(c)} \biggl\vert \biggl(\sum_{X\in \mathcal{B}} \chi _{1}(X) \biggr)^{3} \biggr\vert \biggl\vert \biggl(\sum_{X\in \mathcal{B}}\chi _{2}(X) \biggr)^{3} \biggr\vert \\& \quad =\frac{1}{(p-1)^{2}}\sum_{\chi _{1}\chi _{2}\in \boldsymbol{\chi}_{p}^{*}} \biggl\vert \biggl(\sum_{X\in \mathcal{B}}\chi _{1}(X) \biggr)^{3} \biggr\vert \biggl\vert \biggl(\sum _{X\in \mathcal{B}}\chi _{2}(X) \biggr)^{3} \biggr\vert \sum_{c\in \mathcal{Z}_{p}}{\chi _{1}(c)} {\chi _{2}(c).} \end{aligned}$$

Recalling the identity of characters (see [18, Theorem 5.4]), for any $c\in \mathcal{Z}_{p}$

$$ \sum_{\chi \in \boldsymbol{\chi}_{p}}\chi (c)= \textstyle\begin{cases} p-1, &\mbox{if }\chi =\chi _{0}, \\ 0, &\mbox{otherwise}, \end{cases} $$

where $\chi _{0}$ is the trivial character, the inner sum equals 0 unless

$$ \chi _{2}(c)=\chi _{1}(c)^{-1}=\chi _{1}\bigl(c^{-1}\bigr)=\overline{\chi _{1}(c)}, \quad c\in \mathcal{Z}_{p}, $$

Then,

$$\begin{aligned}& \sum_{c\in \mathcal{Z}_{p}} \biggl\vert N(\mathcal{B},c)- \frac{ \vert \mathcal{B} \vert ^{3}}{p-1} \biggr\vert ^{2} \\& \quad =\frac{1}{(p-1)}\sum_{\chi _{1}\chi _{2}\in \boldsymbol{\chi}_{p}^{*}} \biggl\vert \biggl(\sum_{X\in \mathcal{B}}\chi _{1}(X) \biggr)^{3} \biggr\vert \biggl\vert \biggl(\sum _{X\in \mathcal{B}}\chi _{2}(X) \biggr)^{3} \biggr\vert \\& \quad =\frac{1}{(p-1)}\sum_{\chi \in \boldsymbol{\chi}_{p}^{*}} \biggl\vert \sum_{X \in \mathcal{B}}\chi (X) \biggr\vert ^{6} \\& \quad < \frac{1}{(p-1)}\max_{\chi \in \boldsymbol{\chi}_{p}^{*}} \biggl\vert \sum _{X \in \mathcal{B}}\chi (X) \biggr\vert ^{4}\sum _{\chi \in \boldsymbol{\chi}_{p}} \biggl\vert \sum _{X\in \mathcal{B}}\chi \bigl(X^{-1}\bigr) \biggr\vert ^{2} \\& \quad =\frac{1}{(p-1)}\max_{\chi \in \boldsymbol{\chi}_{p}^{*}} \biggl\vert \sum _{X \in \mathcal{B}}\chi (X) \biggr\vert ^{4}\sum _{X\in \mathcal{B}}\sum_{ \chi \in \boldsymbol{\chi}_{p}}\chi (X_{1})\chi (X_{2}). \end{aligned}$$

Note that

$$ \frac{1}{(p-1)}\sum_{\chi \in \boldsymbol{\chi}_{p}} \biggl\vert \sum _{X\in \mathcal{B}}\chi (X_{1})\chi (X_{2}) \biggr\vert =\mathcal{ \vert B \vert }. $$

Therefore, from Lemma 1, we have

$$\begin{aligned}& \sum_{c\in \mathcal{Z}_{p}} \biggl\vert N(\mathcal{B},c)- \frac{ \vert \mathcal{B} \vert ^{3}}{p-1} \biggr\vert ^{2}=\mathcal{ \vert B \vert }^{5}p^{-4 \gamma }. \end{aligned}$$

Denote

$$ w(\mathcal{B},c)=\sum_{c\in \mathcal{Z}_{p}} \biggl\vert N( \mathcal{B},c)- \frac{ \vert \mathcal{B} \vert ^{3}}{p-1} \biggr\vert . $$

Using the Cauchy–Schwarz inequality, we obtain

$$ w^{2}(\mathcal{B},c)\leq p \sum_{c\in \mathcal{Z}_{p}} \biggl\vert N( \mathcal{B},c)-\frac{ \vert \mathcal{B} \vert ^{3}}{p-1} \biggr\vert ^{2}= \mathcal{ \vert B \vert }^{5}p^{1-4\gamma }. $$

(4)

Combining (3) and (4), we can easily get

$$\begin{aligned} \sum_{c\in \mathcal{Z}_{p}} \biggl\vert P(\mathcal{B},c)- \frac{1}{p-1} \biggr\vert =&\frac{1}{\mathcal{ \vert B \vert }^{3}}w( \mathcal{B},c) \\ < &\mathcal{ \vert B \vert }^{-\frac{1}{2}}p^{\frac{1}{2}-2\gamma }. \end{aligned}$$

(5)

Recalling that $p>2^{n}$, for $0\leq \gamma \leq 1$, $A>0$, from Lemmas 1 and 2, as well as (5), for some $\delta >0$, $\epsilon >0$, the following inequality holds:

$$\begin{aligned} \sum_{c\in \mathcal{Z}_{p}} \biggl\vert P(\mathcal{B},c)- \frac{1}{p-1} \biggr\vert < &\mathcal{ \vert B \vert }^{-{\frac{1}{2}}}p^{\frac{1}{2}-2\gamma }< p^{ \frac{1}{4}-2\gamma }< p^{-\epsilon }< \delta . \end{aligned}$$

That is, the statistical distance is exponentially small. We also can conclude that the LHWP are exponentially close to the uniform distribution, namely, and attack on algorithm [1] needs polynomial time to reach exponentially close probabilities of success. This proves the theorem.

5 Conclusion

Character sums are important and useful tools in the analytic number theory. In this paper we use character sums to prove the pseudorandomness of LHWP, which play a central role in cryptology, algorithms, and many other areas. It is important and meaningful to establish the uniform distribution of such products for giving the security assurance of cryptographic constructions. In addition, we need to emphasize that for our bounds to be nontrivial, the cardinality of the LHWP $\mathcal{B}$ should be sufficiently large, however, it also applies to sparse integers.

6 Notations

Throughout the paper the implied constants in symbols big “O” and “≪” depend on the small real parameter “$\gamma > 0$”. Notations $A\ll B$ and $A = O(B)$ are equivalent to $|A|\leq B$. The symbol small “o(1)” denotes the function tending to 0.