Jurnal Ilmiah (Prosiding) - Universitas Diponegoro

(1)

LEMBAR

HASIL PENILAIAN SEJAWAT SEBIDANG ATAU PEER REVIEW KARYA ILMIAH : PROSIDING

Judul Jurnal Ilmiah (Prosiding)

: Calculation of Lung Cancer Volume of Target Based on Thorax Computed Tomography Images using Active Contour Segmentation Method for Treatment Planning System Nama/ Jumlah Penulis : Fiet Patra Yosandha, Kusworo Adi, dan Catur Edi Widodo/ 3 orang

Status Pengusul : Penulis ke- 2

Identitas Prosiding : a. Nama Jurnal : Journal of Physics: Conf. Series b. Nomor ISSN : 1742-6588 (print); 1742-6596 (web) c. Vol, No., Bln Thn : 855, 2017

d. Penerbit : IOP Publishing

e. DOI artikel (jika ada) : https://doi.org/10.1088/1742-6596/855/1/012063 f. Alamat web jurnal : https://iopscience.iop.org/article/10.1088/1742-

6596/855/1/012063

Alamat Artikel : https://iopscience.iop.org/article/10.1088/1742- 6596/855/1/012063/pdf

g. Terindex : Scopus, Q3 SJR: 0.221 (2018)

https://www.scimagojr.com/journalsearch.php?q=13005 3&tip=sid&clean=0

Kategori Publikasi Jurnal Ilmiah : √ Prosiding forum Ilmiah Internasional (beri pada kategori yang tepat) Prosiding forum Ilmiah Nasional Hasil Penilaian Peer Review :

Komponen Yang Dinilai Nilai Reviewer

Nilai Rata-rata Reviewer 1 Reviewer 2

a. Kelengkapan unsur isi prosiding (10%) 2,90 3,00 2,95

b. Ruang lingkup dan kedalaman pembahasan (30%)

8,70 8,80 8,75

c. Kecukupan dan kemutahiran

data/informasi dan metodologi (30%)

8,70 8,70 8,70

d. Kelengkapan unsur dan kualitas terbitan/prosiding(30%)

8,50 9,00 8,75

Total = (100%) 28,80 29,50 29,15

Semarang, 8 Mei 2020 Reviewer 1

Prof. Dr. Muhammad Nur, DEA NIP. 195711261990011001

Unit Kerja : Departemen Fisika - FSM UNDIP

Reviewer 2

Prof. Dr. Heri Sutanto, SSi, MSi NIP. 197502151998021001

(2)

LEMBAR

6596/855/1/012063

Kategori Publikasi Jurnal Ilmiah : √ Prosiding forum Ilmiah Internasional (beri pada kategori yang tepat) Prosiding forum Ilmiah Nasional Hasil Penilaian Peer Review :

Komponen Yang Dinilai

Nilai Maksimal Prosiding Nilai Akhir Yang Diperoleh Internasional

Nasional

a. Kelengkapan unsur isi prosiding (10%) 3,00 2,90

b. Ruang lingkup dan kedalaman pembahasan (30%)

9,00 8,70

c. Kecukupan dan kemutahiran data/informasi dan metodologi (30%)

9,00 8,70

d. Kelengkapan unsur dan kualitas terbitan /prosiding (30%)

9,00 8,50

Total = (100%) 30,00 28,80

Nilai Pengusul =

Catatan Penilaian artikel oleh Reviewer : 1. Kelengkapan unsur isi prosiding:

Artikel telah ditulis seuai dengan format IOP Science. Unsur-unsur artikel lengkap Latar belakang sangat sangat singkat dan kebaruan tidak dikemukakan secara explisit..

2. Ruang lingkup dan kedalaman pembahasan:

Ruang lingkup tidak begitu luas. Pembahasan sudah baik lengkap, juga ditemukan dengan jelas terdapat diskusi/pembahasan sebagai pembandingan dengan hasil penelitian dalam referensi yang digunakan

3. Kecukupan dan kemutakhiran data/informasi dan metodologi:

Referensi tidak ditemukan mutahkir. Metoda standard dan dapat direflikasi oleh peneliti lain. Data mutakhir 4. Kelengkapan unsur dan kualitas terbitan:

Kualitas penerbitan cukup baik. Penataan masih ada yang terlewatkan. Paper berasal dari konferensi dimuat di IOP Science, terindeks Scopus, Q3 SJR: 0.221 (2018). Nili maximum 30.

Prof. Dr. Muhammad Nur, DEA NIP. 195711261990011001

√

(3)

LEMBAR

6596/855/1/012063

Kategori Publikasi Jurnal Ilmiah : √ Prosiding forum Ilmiah Internasional (beri pada kategori yang tepat) Prosiding forum Ilmiah Nasional

Hasil Penilaian Peer Review : Komponen Yang Dinilai

Nilai Maksimal Prosiding Nilai Akhir Yang Diperoleh Internasional

Nasional

e. Kelengkapan unsur isi prosiding (10%) 3,00 3,00

f. Ruang lingkup dan kedalaman pembahasan (30%)

9,00 8,80

g. Kecukupan dan kemutahiran data/informasi dan metodologi (30%)

9,00 8,70

h. Kelengkapan unsur dan kualitas terbitan /prosiding (30%)

9,00 9,00

Total = (100%) 30,00 29,50

Nilai Pengusul =

Catatan Penilaian artikel oleh Reviewer : 1. Kelengkapan unsur isi prosiding:

Artikel telah ditulis secara lengkap mulai dari judul, abstrak, pendahuluan hingga referensi dan sesuai template Journal of Physics: Conf. Series.

2. Ruang lingkup dan kedalaman pembahasan:

Ruang lingkup kedalaman pembahasan sudah diuraikan dengan baik sesuai data yang diperoleh terutama dalam proses perhitungan volume tumor dengan image processing. Pembahasan belum mengkaitkan dengan hasil peneliti lain.

3. Kecukupan dan kemutakhiran data/informasi dan metodologi:

Data penelitian yang diperoleh cukup memadai (ada 1 gambar) yang setiap tahapan image processing ditampilkan..

Hasil penelitian sudah sesuai dengan metodologi riset yang dilakukan. Artikel disusun berdasarkan total 11 referensi dan 5 referensi tidak mutakhir.

4. Kelengkapan unsur dan kualitas terbitan:

Secara umum kelengkapan unsur artikel lengkap. Kualitas penerbit IOP baik dan sudah berpengalaman mempublikasi hasil-hasil seminar internasional. Prosiding terindeks Scopus dengan SJR 0.221 (2018).

Prof. Dr. Heri Sutanto, SSi, MSi NIP. 197502151998021001

√

(4)

Journal of Physics: Conference Series

PAPER • OPEN ACCESS

International Conference on Mathematics:

Education, Theory and Application

To cite this article: 2017 J. Phys.: Conf. Ser. 855 011001

View the article online for updates and enhancements.

Preface

The 1

^st

International Conference on Mathematics: Education, Theory, and Application (ICMETA) was held on December 6-7, 2016 at Universitas Sebelas Maret (UNS), Solo, Indonesia. The ICMETA is a conference that was first accomplished by Department of Mathematics, Universitas Sebelas Maret and planned to be held biennially.

The main objective of the conference is to gather world-class researchers, engineers, and educators engaged in the fields of mathematics and its applications to meet and present their latest activities. It provides a platform to disseminate research findings, and hopefully, it also sparks innovative ideas, foster research relations or partnership between the various institutions. As a scientific meeting event we invited experts from six different countries including Australia, the Netherlands, Indonesia, Japan,

Malaysia, and France as keynote speakers.

We are grateful to all speakers for their presentations and all delegates who contributed

for the success of this conference.

(6)

Peer review statement

To cite this article: 2017 J. Phys.: Conf. Ser. 855 011002

Peer review statement

All papers published in this volume of Journal of Physics: Conference Series have been peer reviewed through processes administered by the proceedings Editors. Reviews were conducted by expert referees to the professional and scientific standards expected of a proceedings journal published by IOP Publishing.

(8)

Author details

1 of 1

◅ Return to search results

Adi, K.

Author ID: 57200265615

Aﬃliation(s):

, Semarang, Indonesia



http://orcid.org/0000-0002-7702-6554



Universitas Diponegoro View more 

View potential author matches

Other name formats: Adi, K. Adi, Kusworo

Subject area: Computer Science Engineering Physics and Astronomy Environmental Science Social Sciences Energy Mathematics Medicine Earth and Planetary Sciences Decision Sciences

Health Professions ^{View all}

Documents by author

35

Analyze author output

Total citations

66^by⁵¹^documents

View citation overview

h-index:

4

❓

View h-graph

Document and citation trends:

Years

Documents Citations Documents

Citations

2006 2020

0 8

0 21

Proﬁle actions

 Edit author proﬁle Connect to ORCID❓

^Alerts

Set citation alert Set document alert

❓ Learn more about Scopus Proﬁles ↗

KA

Universitas Diponegoro 35 Documents

K. Adi ⬈

Is this you?

Sort on:

Document title Authors Year Source Cited by

, ,

, (...), ,

2019

185(1), pp. 42-49

0

Open Access

, , 2019

125,22006

0

35 Documents Cited by 51 documents 48 co-authors Topics

▻

View in search results format View 394 references ▻ Date (newest) 

Export all Add all to list Set document alert Set document feed

A SIMPLIFIED METHOD for the WATER-EQUIVALENT DIAMETER CALCULATION to ESTIMATE PATIENT DOSE in CT EXAMINATIONS

Anam, C. Arif, I. Haryanto, F. Adi, K. Dougherty, G.

Radiation Protection Dosimetry



View abstract View at Publisher Related documents

System of Performance Evaluation of Rice Paddy Production with Data Envelopment Analysis

Hidayah, Q.H. Mustaﬁd Adi, K.

E3S Web of Conferences



Brought to you by Universitas Diponegoro

Search Sources Lists SciVal ↗ Create account Sign in

(9)

Open Access

, ,

, (...), ,

2019

25(3), pp. 179-187

0

, ,

, (...), ,

2019

39(3), pp. 783-793

Open Access

, 2019

1217(1),12033

0

Open Access

,

, , ,

2019

1217(1),12032

0

Open Access

, ,

, (...), ,

2019

1217(1),12036

0

, , 2019 Proceeding - 2019 International Conference of Artiﬁcial Intelligence and Information Technology, ICAIIT 2019

8834622, pp. 255-259

0

Open Access

, , 2018

73,13004

0

, , 2018 2018 International Seminar on Research of Information Technology and Intelligent Systems, ISRITI 2018

8864330, pp. 459-464

0

, ,

,

2018

1977,020007

0

Open Access

, ,

2018

1025(1),012025 Automated MTF measurement in CT images with a simple wire

phantom

Anam, C. Fujibuchi, T.

Haryanto, F. Muhlisin, Z. Dougherty, G.

Polish Journal of Medical Physics and Engineering



Assessment of patient dose and noise level of clinical CT images:

Automated measurements

Anam, C. Budi, W.S. Adi, K. Fujibuchi, T.

Dougherty, G.

Journal of Radiological Protection 4



Finger edge contour perimeter as a biometric based identiﬁcation system

Widodo, C.E. Adi, K. Journal of Physics: Conference Series



Richardson number model for turbulence motion analysis around airport runway

Gernowo, R. Saputro, H.D. Setiawan, A. Adi, K.

Widodo, A.P.



Detecting driver drowsiness using total pixel algorithm Adi, K. Widodo, A.P.

Widodo, C.E. Naqiyah, S. Aristia, H.N.



Determining the Threshold Value for Identiﬁcation of the Goblet Cells in Chicken Small Intestine

Sepriana, D. Adi, K.

Widodo, C.E.



Information System Prediction with Weighted Moving Average (WMA) Method and Optimization Distribution Using Vehicles Routing Problem (VRP) Model for Batik Product

Nugrahani, T.A. Adi, K.

Suseno, J.E.



Logic scoring of preference method for determining landﬁll with geographic information system

Pirmanto, D. Suseno, J.E.

Adi, K.



Design of crack detection system for concrete built infrastructure based on ﬁber optic sensors

Hidayah, F.N. Budi, W.S.

Adi, K. Supardjo

AIP Conference Proceedings



Automatic vehicle counting using background subtraction method on gray scale images and morphology operation

Adi, K. Widodo, A.P.

Widodo, C.E. Pamungkas, A. Putranto, A.B.

Journal of Physics: Conference Series 1



(10)

Open Access

, ,

2018

1025(1),012023

Open Access

, , 2018

31,11007

Open Access

, , 2018

31,10006

0

, ,

, (...), ,

2018

11(2), pp. 8-12

, , 2017

23(7), pp. 6593-6597

, ,

,

2017

23(7), pp. 6618-6622

0

Open Access

, , 2017

855(1),012063

0

, , 2017 Proceedings - 2016 3rd International Conference on Information Technology, Computer, and Electrical Engineering, ICITACEE 2016 7892450, pp. 253-259

Hazard mitigation with cloud model based rainfall and convective data

Gernowo, R. Adi, K.

Yulianto, T. Seniyatis, S.

Yatunnisa, A.A.

Journal of Physics: Conference Series 1



Application Mail Tracking Using RSA Algorithm As Security Data and HOT-Fit a Model for Evaluation System

Permadi, G.S. Adi, K.

Gernowo, R.

E3S Web of Conferences 3



The Decision Support System (DSS) Application to Determination of Diabetes Mellitus Patient Menu Using a Genetic Algorithm Method

Zuliyana, N. Suseno, J.E.

Adi, K.



Detection lung cancer using Gray Level Co-Occurrence Matrix (GLCM) and back propagation neural network classiﬁcation

Adi, K. Widodo, C.E.

Widodo, A.P.

Pamungkas, A. Syifa, R.A.

Journal of Engineering Science and Technology Review

3



View abstract Related documents

Convective cloud model for analyzing of heavy rainfall of weather extreme at Semarang Indonesia

Gernowo, R. Adi, K.

Yulianto, T.

Advanced Science Letters 2



Beef marbling identiﬁcation using color analysis and decision tree classiﬁcation

Adi, K. Pujiyanto, S.

Nurhayati, O.D.

Pamungkas, A.

Advanced Science Letters



Calculation of Lung Cancer Volume of Target Based on Thorax Computed Tomography Images using Active Contour Segmentation Method for Treatment Planning System

Yosandha, F.P. Adi, K.

Widodo, C.E.



Detection of the beef quality: Using mobile-based K-mean clustering method

Nurhayati, O.D. Adi, K.

Pujiyanto, S.

2



Display: 20  results per page 1 2  Top of page

The data displayed above is compiled exclusively from documents indexed in the Scopus database. To request corrections to any inaccuracies or provide any further feedback, please use the Author Feedback Wizard .

About Scopus

What is Scopus Content coverage Scopus blog Scopus API

Language

⽇本語に切り替える切换到简体中文切換到繁體中文 Русский язык

Customer Service

Help Contact us

(11)

Document details

19 of 35

Calculation of Lung Cancer Volume of Target Based on Thorax Computed Tomography Images using Active Contour Segmentation Method for Treatment Planning System (Conference Paper) (Open Access)

, ,

Physics Department, Diponegoro University, Indonesia

Abstract

In this research, calculation process of the lung cancer volume of target based on computed tomography (CT) thorax images was done. Volume of the target calculation was done in purpose to treatment planning system in radiotherapy.

The calculation of the target volume consists of gross tumor volume (GTV), clinical target volume (CTV), planning target volume (PTV) and organs at risk (OAR). The calculation of the target volume was done by adding the target area on each slices and then multiply the result with the slice thickness. Calculations of area using of digital image processing techniques with active contour segmentation method. This segmentation for contouring to obtain the target volume. The calculation of volume produced on each of the targets is 577.2 cm for GTV, 769.9 cm for CTV, 877.8 cm for PTV, 618.7 cm for OAR 1, 1,162 cm for OAR 2 right, and 1,597 cm for OAR 2 left. These values indicate that the image processing techniques developed can be implemented to calculate the lung cancer target volume based on CT thorax images. This research expected to help doctors and medical physicists in determining and contouring the target volume quickly and precisely. © Published under licence by IOP Publishing Ltd.

SciVal Topic Prominence

Topic:

Prominence percentile: 97.808

Indexed keywords

Engineering controlled terms:

Biological organs Calculations Diseases Image processing Image segmentation Tomography

Engineering uncontrolled terms

Active contour segmentation Calculation process Clinical target volumes Computed tomography images Digital image processing technique

Image processing technique Planning target volumes Treatment planning systems

Engineering main heading:

Computerized tomography

◅ Back to results ◅ Previous Next ▻

^Export ^Download ^Print ^E-mail  Save to PDF ⋆ Add to List ^More...▻

View at Publisher

Volume 855, Issue 1, 12 June 2017, Article number 012063

1st International Conference on Mathematics: Education, Theory, and Application, ICMETA 2016;

Universitas Sebelas Maret (UNS)Surakarta; Indonesia; 6 December 2016 through 7 December 2016; Code 128467

Yosandha, F.P.  Adi, K. Widodo, C.E. 

 View references (11)

3 3

3 3 3 3



Biological organs | Computerized tomography | Lung segmentation



PlumX Metrics

Usage, Captures, Mentions, Social Media and Citations beyond Scopus.

Metrics

Cited by 0 documents

Inform me when this document is cited in Scopus:

Error-correcting pairs for a public-key cryptosystem

To cite this article: Ruud Pellikaan and Irene Márquez-Corbella 2017 J. Phys.: Conf. Ser. 855 012032

Error-correcting pairs for a public-key cryptosystem

Ruud Pellikaan

Dept. of Mathematics and Computing Science, Eindhoven University of Technology P.O. Box 513, 5600 MB Eindhoven, The Netherlands

E-mail: [email protected]

Irene M´arquez-Corbella

Dept. of Mathematics, Statistics and O. Research, University of La Laguna, Spain E-mail: [email protected]

Abstract. Code-based Cryptography (CBC) is a powerful and promising alternative for quantum resistant cryptography. Indeed, together with lattice-based cryptography, multivariate cryptography and hash-based cryptography are the principal available techniques for post- quantum cryptography. CBC was first introduced by McEliece where he designed one of the most efficient Public-Key encryption schemes with exceptionally strong security guarantees and other desirable properties that still resist to attacks based on Quantum Fourier Transform and Amplitude Amplification.

The original proposal, which remains unbroken, was based on binary Goppa codes. Later, several families of codes have been proposed in order to reduce the key size. Some of these alternatives have already been broken.

One of the main requirements of a code-based cryptosystem is having high performance t-bounded decoding algorithms which is achieved in the case the code has at-error-correcting pair (ECP). Indeed, those McEliece schemes that use GRS codes, BCH, Goppa and algebraic geometry codes are in fact using an error-correcting pair as a secret key. That is, the security of these Public-Key Cryptosystems is not only based on the inherent intractability of bounded distance decoding but also on the assumption that it is difficult to retrieve efficiently an error- correcting pair.

In this paper, the class of codes with at-ECP is proposed for the McEliece cryptosystem.

Moreover, we study the hardness of distinguishing arbitrary codes from those having at-error correcting pair.

1. Introduction

In 1978 [17] McEliece presented the first PKC system based on the theory of error-correcting codes. In 1986 Niederreiter [19] presented a dual version of McEliece cryptosystem which is equivalent in terms of security. Their main advantages are its fast encryption and decryption schemes. It is an interesting candidate for post-quantum cryptography.

2. Code-based cryptography

A linear codeC is a subspace ofFⁿq. Theweightofx∈Fⁿq is the number of nonzero entries ofx and is denoted by wt(x). The(Hamming) distancebetween x, y∈Fq is the number of entries where x and y differ and is denoted by d(x,y). The minimum distance of C is the minimal

(16)

2

1234567890

value of d(x,y) wherex, y∈C andx6=y. SinceC is linear it is equal to the minimum weight of C, that is the minimal value of wt(x) wherex∈C and x6=0.

Theparametersof the code are denoted by [n, k, d], wherenis itslength,kitsdimensionand dits minimum distance. The (information) rateof C is defined by R=k/n.

Let C be an Fq-linear code of length n and dimension k. A generator matrix G of C is a k×n matrix with entries inFq such that its rows are a basis ofC. A parity check matrix H is (n−k)×nmatrix with entries inFq such that cH^T =0 if and only ifc∈C.

The problem of minimum distance decoding has as input (G,y), where G is a generator matrix of a code C overFq of parameters [n, k, d] andy∈Fⁿq is a received word. The output is a codeword c∈C of minimal distance toy. One can phrase the problem equivalently in terms of a parity check matrix H of the code. Then the input is (H,s), where s∈F^n−kq . The output is ane∈Fⁿq of minimal weight such thateH^T =s. The relation of the two versions is given by s=yH^T thesyndromeand e=y−cthe error vector of the received word y.

The security of code-based cryptosystems is based on the hardness of decoding up to half the minimum distance. The minimum distance decoding problem was shown by Berlekamp- McEliece-Van Tilborg [2] to be NP-hard. The status of the hardness of decoding up to half the minimum distance is an open problem. McEliece proposed to use binary Goppa codes for his PKC system.

In the McEliece PKC system a collectionK of generator k×n matrices is chosen for which an efficient decoding algorithm is available that corrects all patterns ofterrors. Theencryption map

EG: P → C

for a given key G∈ K is defined byEG(m,e) =mG+e. Anadversary A is a map from C × K toP. This adversary is successful for (x, G)∈Ω ifA(E_G(x), G) =x.

Let C be a class of codes such that every code C in C has an efficient decoding algorithm correcting all patterns of terrors. Let G∈F^k×nq be a generator matrix ofC. In order to mask the origin ofG, take ak×kinvertible matrixS overFq and ann×npermutation or monomial matrix Π. Then for the McEliece PKC the matricesG,Sand Π are kept secret whileG⁰ =SGΠ is made public. Furthermore the (trapdoor) one-way function of this cryptosystem is usually presented as follows:

x= (m,e)7→y=mG⁰+e,

where m ∈ F^k_q is the plaintext and e∈ Fⁿ_q is a random error vector with Hamming weight at mostt.

3. Error-correcting pairs

From now on the dimension of a linear codeCwill be denoted byk(C) and its minimum distance by d(C). Given two elements a and b in Fⁿq, the star product is defined by coordinatewise multiplication, that isa∗b= (a₁b₁, . . . , a_nb_n) while thestandard inner multiplication is defined by a·b=Pn

i=1aibi.

LetA,B and C be subspaces of Fⁿq. Then A∗B is the subspace generated by{a∗b|a ∈ A and b∈B}. AndC^⊥ ={x|x·c= 0 for allc∈C}is thedualcode of C. FurthermoreA⊥B meansa·b= 0 for all a∈A and b∈B.

Definition 3.1. LetC be a linear code inFⁿq. The pair (A, B) of linear codes overFq^mof length n is called at-error-correcting pair (ECP) over Fq^m forC if the following properties hold:

E.1 (A∗B)⊥C, E.2 k(A)> t, E.3 d(B^⊥)> t,

(17)

3

1234567890

E.4 d(A) +d(C)> n.

Remark 3.2. In the above definition A and B are Fq^m-linear codes and C is an Fq-linear code. So by k(A) the dimension ofA overFq^m is meant. Andd(B^⊥), d(A) and d(C) mean the minimum distances ofB^⊥ andA overFq^m and of C overFq.

Remark 3.3. The notion of an error-correcting pair for a linear code was introduced in 1988 by Pellikaan [22] and independently by K¨otter in [11, 12] in 1992. It is shown that a linear code inFⁿq with a t-error-correcting pair has a decoding algorithm which corrects up to terrors with complexityO(n³).

Remark 3.4. Note that if (A, B) is a pair of codes that satisfies Conditions E.1, E.2, E.3 and the following two conditions:

E.5 d(A^⊥)>1, that means A is a non-degenerate code, E.6 d(A) + 2t > n,

then d(C)≥2t+ 1 and (A, B) is a t-ECP forC by [23, Corollary 3.4].

In the following we consider eight collections of pairs.

Example 3.5. Leta be ann-tuple of mutually distinct elements of Fq and b be ann-tuple of nonzero elements of Fq. Then thegeneralized Reed-Solomon code GRSk(a,b) is defined by

GRS_k(a,b) ={(f(a₁)b₁, . . . , f(a_n)b_n)|f(X)∈Fq[X] and deg(f(X))< k}.

If k≤n≤q, then GRS_k(a,b) is an [n, k, n−k+ 1] code. Furthermore the dual of a GRS code is again a GRS code, in particular GRSk(a,b)^⊥= GRSn−k(a,b^⊥) for someb^⊥ that is explicitly known.

LetA= GRSt+1(a,u), B = GRSt(a,v) and C = GRS2t(a,u∗v)^⊥. Then (A, B) is at-ECP forC. Conversely letC = GRS_k(a,b), thenA= GRS_t+1(a,b^⊥) andB= GRS_t(a,1) is at-ECP forC wheret=_n−k

2

.

So GRS codes are the prime examples of codes that have at-error-correcting pair. GRS codes are not suited for a coded-based PKC by the attack of Sidelnikov-Shestakov [26].

Example 3.6. Let C be a subcode of a code D that has (A, B) as a t-ECP. Then condition (E.1) holds for (A, B) with respect to D. So a∗b·d = 0 for all d in D. Hence a∗b·c = 0 for all c inC, sinceC ⊆D. Conditions (E.2), (E.3) and (E.4) hold. Therefore (A, B) is also a t-ECP forC.

In particular, letC be a subcode of the code GRSn−2t(a,b). This GRS code has a t-error- correcting pair by Example 3.5 which is also a t-ECP forC.

The class of subcodes of GRS codes was proposed by Berger and Loidreau in [1] for code-based PKC to resist precisely the Sidelnikov-Shestakov attack. But for certain parameter choices this proposal is also not secure as shown by M´arquez et al. [14].

Example 3.7. The Goppa code Γ(L, g(X)) associated to a Goppa polynomial g(X) of degreer and an n-tupleLof points inFq^m can be viewed as an alternant code, that is a subfield subcode of a GRS code of codimension r. Therefore such a code has an br/2c-error-correcting pair. If the Goppa polynomial is square free of degree r in an extension of F2, then the binary Goppa code has an r-ECP, since Γ(L, g(X)) = Γ(L, g(X)²).

Goppa codes were proposed by McEliece [17] for his PKC system. Sidelnikov-Shestakov made a claim [26] that their method for GRS codes could be extended to attack Goppa codes as well, but this had never been substantiated by a paper in the public domain. A binary Goppa code using elements in the extension F2^m and with a square free Goppa polynomial of degree t over F2^m has parameters [n, k, d] with n≤2^m, k≥n−mt and d≥2t+ 1. For these codes efficient decoding algorithms are known that decode all patterns witht errors.

(18)

4

1234567890

A binary Goppa code with parameters [1024,524,101] as proposed by McEliece is no longer secure with nowadays computing power due to recent improvements in the decoding algorithms.

Example 3.8. Algebraic geometry (AG) codes were introduced in 1977 by V.D. Goppa. Recall that GRS codes can be seen as the class of AG codes on the projective line, that is the algebraic curve of genus zero. We refer the interested reader to [24, 25].

Let X be an algebraic curve defined over Fq with genus g. By an algebraic curve we mean a curve that is absolutely irreducible, nonsingular and projective. Let P be an n-tuple of Fq- rational points on X and let E be a divisor of X with disjoint support from P of degree e.

Then the algebraic geometry code CL(X,P, E) is the image of the Riemann-Roch space L(E) of rational functions with prescribed behavior of zeros and poles at E under the evaluation map evP. If e < n, then the dimension of the code CL(X,P, E) is at least e+ 1−g and its minimum distance is at least n−e. If e > 2g−2, then its dimension is e+ 1−g. The dual code CL(X,P, E)^⊥ is again AG. If e >2g−2, then the dimension of the codeCL(X,P, E)^⊥ is at least n−e−1 +g and its minimum distance is at least d^∗ =e−2g+ 2. If e < n, then its dimension is n−e−1 +g.

If A = CL(X,P, E) and B = CL(X,P, F), then A∗B ⊆ CL(X,P, E +F). So there are abundant ways to construct error-correcting pairs of an AG code. An AG code on a curve of genus g with designed minimum distanced^∗ has at-ECP overFq with t=b(d^∗−1−g)/2c by [21, Theorem 1] and [22, Theorem 3.3]. Ifm is sufficiently large, then there exists at-ECP over Fq^m witht=b(d^∗−1)/2c by [23, Proposition 4.2].

Algebraic geometry codes were proposed by Niederreiter [19] and Janwa-Moreno [10] for code- based PKC systems. This system was broken for low genus zero [26], one and two [9, 18]. For arbitrary genus it was shown by M´arquez et al. [13, 15] that these codes are not secure for rates R in the intervals [γ,¹₂−γ], [¹₂+γ,1−γ], [¹₂−γ,1−3γ] and [3γ,¹₂ +γ], where R=k/n is the information rate andγ =g/nthe relative genus. Recently Couvreur et al. [6] showed that it is not necessary to retrieve the triple (X,P, E) and the Riemann-Roch space L(E) but that one can stay in the realm ofFⁿ_q and its subspaces in order to find an error-correcting pair.

Example 3.9. Geometric Goppa codes are subfield subcodes of algebraic geometry codes generalizing the classical Goppa codes that are subfield subcodes of GRS codes. Geometric Goppa codes were proposed by Janwa-Moreno [10]. Couvreur et al. [5] showed that certain geometric Goppa codes are not secure for a PKC system.

Example 3.10. Let (A, B) be a pair of codes with parameters [n, t+ 1, n−t] and [n, t, n−t+ 1], respectively, and C= (A∗B)^⊥, then the minimum distance ofC is at least 2t+ 1 and (A, B) is at-error-correcting pair for Cby [23, Corollary 3.4]. The dimension ofA∗B is at mostt(t+ 1).

So the dimension of C is at least n−t(t+ 1). In Appendix A it is shown that this is almost always equal to n−t(t+ 1) for random choices of Aand B.

Ifqis considerably larger thann, then a random linear code is MDS with very high probability.

So taking random codes AandB of lengthnand dimensionst+ 1 andt, respectively, this gives a very large class of codes for the McEliece PKC. However with large field the key size becomes larger and recall that the main obstacle for coded-based cryptosystems was the key size.

4. The ECP one-way function

Let P(n, t, q) be the collection of pairs (A, B) such that there exist a positive integer m and a pair (A, B) of Fq^m-linear codes of length n, that satisfy Conditions E.2, E.3, E.5 and E.6. Let C be the Fq-linear code of lengthn that is the subfield subcode that has all elements ofA∗B as parity checks. So

C =Fⁿq ∩(A∗B)^⊥.

Then the minimum distance of C is at least 2t+ 1 and (A, B) is at-ECP forC as was noted in Remark 3.4. LetF(n, t, q) be the collection ofFq-linear codes of lengthnand minimum distance

(19)

5

1234567890

d≥2t+ 1. Consider the following map

ϕ_(n,t,q): P(n, t, q) −→ F(n, t, q) (A, B) 7−→ C.

The question is whether this map is a one-way function.

Let U and V be generator matrices of the codes A and B, with rows denoted by ui and v_i, respectively. Let U ∗V be the matrix with the rowsu_i∗v_j ordered lexicographically. Let (U∗V)(q^l) be the matrix with entries theq^l-power of the entries ofU∗V. LetW be the reduced row echelon form (with the zero rows deleted) of the matrix with rows all the rows of (U∗V)(q^l) forl= 0,1. . . , m−1. Then W has entries inFq and is a parity check matrix of C. In this way

(U, V)7−→ W is an implementation of the mapϕ_(n,t,q).

If the mapϕ_(n,t,q) is indeed difficult to invert, then we will call it the ECP one-way function and the codeCwith parity check matrixW might be used as a public-key in a coding based PKC.

Otherwise it would mean that the PKC based on codes that can be decoded by error-correcting pairs is not secure.

Remark 4.1. Note that uΠ∗vΠ = (u∗v)Π for every permutation or monomial matrix Π.

Thus, if (A, B) is a t-ECP forC, then (AΠ, BΠ) is at-ECP forCΠ.

Furthermore, ifS and T are invertible matrices of the correct sizes to be multiplied on the left of the matricesU and V, respectively, then U∗V generates the same code as (SU)∗(T V) since (SU)∗v=S(U∗v) andu∗(T V) =T(u∗V) for all vectorsuand v. Therefore the usual maskingSHP of a parity check matrixHby means of an invertible matrixS and a permutation matrix P is already incorporated in the choice of the pair of generator matrices (U, V).

5. Distinguishing a code with an ECP

LetK be a collection of generator matrices of codes that have at-error-correcting pair and that is used for a coded-based PKC system. In this section we address assumption A.2 whether we can distinguish arbitrary codes from those coming from K.

LetC be ak dimensional subspace of Fⁿq with basis g1, . . . ,gk which represents the rows of the generator matrix G ∈ F^k×nq . We denote by S²(C) the second symmetric power of C, or equivalently the symmetrized tensor product of C with itself. If x_i = g_i, then S²(C) has basis {x_ixj |1≤i≤j≤n} and dimension ^k+1₂

. Furthermore we denote C∗C by C⁽²⁾ the square of C, that is the linear subspace in Fⁿq generated by {a∗b|a,b∈C}. See [3, §4 Definition 6]

and [4, 14]. Now, following the same scheme as in [13], we consider the linear map σ : S²(C) −→ C⁽²⁾,

where the elementx_ix_j is mapped tog_i∗g_j. The kernel of this map will be denoted byK²(C).

Then K²(C) is the solution space of the following set of equations:

X

1≤i≤i⁰≤k

gijg_i⁰_jX_ii⁰ = 0, 1≤j ≤n.

There is no loss of generality in assuming G to be systematic at the first k position, making a suitable permutation of columns and applying Gaussian elimination, if necessary. Then G = Ik P

where I_k is the k×k identity matrix and P is an k×(n−k) matrix formed by the last n−k columns of G. Now H = P^T −I_n−k

is a parity check matrix of C, or equivalently H is a generator matrix of the [n, n−k] code D=C^⊥.

(20)

6

1234567890

In [8, III] and [20, Ch. 10] a system L_P associated to the matrix P of k linear equations involving the ^n−k₂

variables Z_jl, withk+ 1≤j < l ≤n, is defined as L_P =







n−1

X

j=k+1 n

X

j⁰>j

p_ijp_ij⁰Z_jj⁰ = 0|1≤i≤k.







This system differs from the system of equations obtained for the kernel K²(C) in interchanging indices i and j and the strict inequality j < j⁰ in the summation, instead of i≤i⁰. Denote the kernel ofL_P, that is the space of all solutions of L_P, by K(L_P).

Proposition 5.1.

dimK(L_P) = dimK²(D) Proof. Let M be the ^k+1₂

×n matrix with entries g_ijg_i⁰_j

1≤i≤i⁰≤k 1≤j≤n

. Then a basis of K²(C) can be read of directly as the kernel of M. Note also that the dimension ofC⁽²⁾ is equal to the rank of M. Furthermore, sinceC⁽²⁾ is the image of the linear map σ, by the first isomorphism theorem we get:

dimK²(C) + dimC⁽²⁾= dimS²(C) =

k+ 1 2

.

Let hi be the i-th row of the parity check matrix H,ei be the i-th vector in the canonical basis of F^n−kq and q_i be thei-th row of the matrix P^T. Then q_ij =p_j,i+k and h_i = (q_i| −e_i).

Therefore

hj∗h_j⁰ =

qj∗qj ej

ifj=j⁰, qj∗qj⁰ 0

ifj < j⁰. LetM₁ be the k× ^n−k₂

matrix with entries p_ijp_ij⁰

1≤i≤k k<j<j⁰≤n

, then dimK(L_P) =

n−k 2

−rank(M₁) Now letM₂ be the ^n−k+1₂

×nmatrix with entries h_ijh_i⁰_j

1≤i≤i⁰≤n−k 1≤j≤n

. Then dimD⁽²⁾= rank(M₂) =n−k+ rank(M₁)

Therefore

dimK(L_P) =

n−k 2

−rank(M1)

=

n−k 2

+n−k−dimD⁽²⁾

= dimK²(D)

The dual statement of Proposition 5.1 gives: dimK(L_PT) = dimK²(C).

For every [n, k] code C overFq the following inequality holds:

dimC⁽²⁾≤min{n, ^k+1₂ }.

However if the entries of the matrixP are taken independently and identically distributed, then the inequality holds with equality with high probability what is actually proved in the next proposition.