{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,9]],"date-time":"2026-04-09T22:34:11Z","timestamp":1775774051458,"version":"3.50.1"},"reference-count":91,"publisher":"International Association for Cryptologic Research","license":[{"start":{"date-parts":[[2024,1,7]],"date-time":"2024-01-07T00:00:00Z","timestamp":1704585600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IACR CiC"],"accepted":{"date-parts":[[2024,3,5]]},"abstract":"<jats:p>This paper reviews, from bottom to top, a polynomial-time algorithm to correct <mml:math xmlns:mml=\"http:\/\/www.w3.org\/1998\/Math\/MathML\">\n              <mml:mrow>\n                <mml:mi>t<\/mml:mi>\n              <\/mml:mrow>\n            <\/mml:math> errors in classical binary Goppa codes defined by squarefree degree-<mml:math xmlns:mml=\"http:\/\/www.w3.org\/1998\/Math\/MathML\">\n              <mml:mrow>\n                <mml:mi>t<\/mml:mi>\n              <\/mml:mrow>\n            <\/mml:math> polynomials. The proof is factored through a proof of a simple Reed\u2013Solomon decoder, and the algorithm is simpler than Patterson's algorithm. All algorithm layers are expressed as Sage scripts backed by test scripts. All theorems are formally verified. The paper also covers the use of decoding inside the Classic McEliece cryptosystem, including reliable recognition of valid inputs. <\/jats:p>","DOI":"10.62056\/angy4fe-3","type":"journal-article","created":{"date-parts":[[2024,4,9]],"date-time":"2024-04-09T19:27:10Z","timestamp":1712690830000},"update-policy":"https:\/\/doi.org\/10.62056\/adfjwm02dj","source":"Crossref","is-referenced-by-count":4,"title":["Understanding binary-Goppa decoding"],"prefix":"10.62056","author":[{"given":"Daniel","family":"Bernstein","sequence":"first","affiliation":[{"id":[{"id":"https:\/\/ror.org\/02mpq6x41","id-type":"ROR","asserted-by":"publisher"}],"name":"University of Illinois at Chicago","place":["USA"]},{"id":[{"id":"https:\/\/ror.org\/04tsk2644","id-type":"ROR","asserted-by":"publisher"}],"name":"Ruhr University Bochum","place":["Germany"]},{"id":[{"id":"https:\/\/ror.org\/05bxb3784","id-type":"ROR","asserted-by":"publisher"}],"name":"Academia Sinica","place":["Taiwan"]}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"48349","published-online":{"date-parts":[[2024,4,9]]},"reference":[{"key":"ref1:1993\/vantilborg","article-title":"Coding theory, a first course","volume-title":"Coding theory, a first course","author":"Henk C. A. van Tilborg","year":"1993"},{"key":"ref2:1992\/preneel","first-page":"119","article-title":"A software implementation of the McEliece public-key\n  cryptosystem","volume-title":"Proceedings of the 13th symposium on information theory in\n  the Benelux","author":"Bart Preneel","year":"1992"},{"key":"ref3:2014\/ghosh","doi-asserted-by":"publisher","first-page":"1124","DOI":"10.1109\/TC.2012.271","article-title":"BLAKE-512-based 128-bit CCA2 secure timing attack resistant\n  McEliece cryptoprocessor","volume":"63","author":"Santosh Ghosh","year":"2014","journal-title":"IEEE Transactions on Computers"},{"key":"ref4:2009\/overbeck","isbn-type":"print","doi-asserted-by":"publisher","first-page":"95","DOI":"10.1007\/978-3-540-88702-7_4","article-title":"Code-based cryptography","volume-title":"Post-quantum cryptography","author":"Raphael Overbeck","year":"2009","ISBN":"https:\/\/id.crossref.org\/isbn\/9783540887010"},{"key":"ref5:1975\/patterson","doi-asserted-by":"publisher","first-page":"203","DOI":"10.1109\/TIT.1975.1055350","article-title":"The algebraic decoding of Goppa codes","volume":"21","author":"Nicholas J. Patterson","year":"1975","journal-title":"IEEE Transactions on Information Theory"},{"key":"ref6:1978\/mceliece","first-page":"114","article-title":"A public-key cryptosystem based on algebraic coding\n  theory","author":"Robert J. McEliece","year":"1978"},{"key":"ref7:1997\/sudan","doi-asserted-by":"publisher","first-page":"180","DOI":"10.1006\/jcom.1997.0439","article-title":"Decoding of Reed Solomon codes beyond the error-correction\n  bound","volume":"13","author":"Madhu Sudan","year":"1997","journal-title":"Journal of Complexity","ISSN":"https:\/\/id.crossref.org\/issn\/0885-064X","issn-type":"electronic"},{"key":"ref8:1998\/guruswami","doi-asserted-by":"publisher","first-page":"28","DOI":"10.1109\/SFCS.1998","article-title":"Improved decoding of Reed-Solomon and algebraic-geometry\n  codes","volume-title":"39th annual symposium on foundations of computer science,\n  FOCS '98, November 8\u201311, 1998, Palo Alto, California, USA","author":"Venkatesan Guruswami","year":"1998"},{"key":"ref9:1970\/goppa","first-page":"24","article-title":"A new class of linear correcting codes","volume":"6","author":"Valerii D. Goppa","year":"1970","journal-title":"Problemy Peredachi Informatsii"},{"key":"ref10:2013\/bernstein-mcbits","isbn-type":"print","doi-asserted-by":"publisher","first-page":"250","DOI":"10.1007\/978-3-642-40349-1_15","article-title":"McBits: fast constant-time code-based cryptography","volume-title":"Cryptographic hardware and embedded systems\u2014CHES\n  2013\u201415th international workshop, Santa Barbara, CA, USA, August 20\u201323,\n  2013, proceedings","volume":"8086","author":"Daniel J. Bernstein","year":"2013","ISBN":"https:\/\/id.crossref.org\/isbn\/9783642403484"},{"key":"ref11:2018\/chou","doi-asserted-by":"publisher","first-page":"95","DOI":"10.1007\/s13389-018-0186-9","article-title":"McBits revisited: toward a fast constant-time code-based\n  KEM","volume":"8","author":"Tung Chou","year":"2018","journal-title":"Journal of Cryptographic Engineering"},{"key":"ref12:2021\/chen","doi-asserted-by":"publisher","first-page":"125","DOI":"10.46586\/tches.v2021.i3.125-148","article-title":"Classic McEliece on the ARM Cortex-M4","volume":"2021.3","author":"Ming-Shing Chen","year":"2021","journal-title":"IACR Transactions on Cryptographic Hardware and Embedded\n  Systems"},{"key":"ref13:1974\/knuth","doi-asserted-by":"publisher","first-page":"261","DOI":"10.1145\/356635.356640","article-title":"Structured programming with go to statements","volume":"6","author":"Donald E. Knuth","year":"1974","journal-title":"Computing Surveys"},{"key":"ref14:2010\/bernstein-wild","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"143","DOI":"10.1007\/978-3-642-19574-7_10","article-title":"Wild McEliece","volume-title":"Selected areas in cryptography\u201417th international\n  workshop, SAC 2010, Waterloo, Ontario, Canada, August 12\u201313, 2010, revised\n  selected papers","volume":"6544","author":"Daniel J. Bernstein","year":"2011"},{"key":"ref15:2020\/sage","article-title":"SageMath, the Sage Mathematics Software System (Version\n  9.2)","volume-title":"SageMath, the Sage Mathematics Software System (Version\n  9.2)","year":"2020"},{"key":"ref16:1779\/waring","doi-asserted-by":"publisher","first-page":"59","DOI":"10.1098\/rstl.1779.0008","article-title":"Problems concerning interpolations","volume":"69","author":"Edward Waring","year":"1779","journal-title":"Philosophical Transactions of the Royal Society"},{"key":"ref17:2008\/bernstein-multapps","series-title":"Mathematical Sciences Research Institute Publications","first-page":"325","article-title":"Fast multiplication and its applications","volume-title":"Surveys in algorithmic number theory","volume":"44","author":"Daniel J. Bernstein","year":"2008"},{"key":"ref18:2020\/bernstein-controlbits","article-title":"Verified fast formulas for control bits for permutation\n  networks","author":"Daniel J. Bernstein","year":"2020"},{"key":"ref19:2019\/bernstein-safegcd","doi-asserted-by":"publisher","first-page":"340","DOI":"10.46586\/tches.v2019.i3.340-398","article-title":"Fast constant-time gcd computation and modular inversion","volume":"2019.3","author":"Daniel J. Bernstein","year":"2019","journal-title":"IACR Transactions on Cryptographic Hardware and Embedded\n  Systems"},{"key":"ref20:euclid","article-title":"Elements","volume-title":"Elements","author":"Euclid"},{"key":"ref21:1997\/knuth-2","isbn-type":"print","article-title":"The art of computer programming, volume 2: seminumerical\n  algorithms","volume-title":"The art of computer programming, volume 2: seminumerical\n  algorithms","author":"Donald E. Knuth","year":"1997","ISBN":"https:\/\/id.crossref.org\/isbn\/0201896842"},{"key":"ref22:1585\/stevin","article-title":"L'arithm\u00e9tique","volume-title":"L'arithm\u00e9tique","author":"Simon Stevin","year":"1585"},{"key":"ref23:1981\/brezinski","series-title":"Lecture Notes in Mathematics","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/BFb0095574","article-title":"The long history of continued fractions and Pad\u00e9\n  approximants","volume-title":"Pad\u00e9 approximation and its applications, Amsterdam 1980,\n  proceedings of a conference held in Amsterdam, the Netherlands, October\n  29\u201331, 1980","volume":"888","author":"Claude Brezinski","year":"1981","ISSN":"https:\/\/id.crossref.org\/issn\/0075-8434","issn-type":"electronic"},{"key":"ref24:1776\/lagrange","article-title":"Sur l\u2019usage des fractions continues dans le calcul\n  int\u00e9gral","author":"Joseph-Louis Lagrange","year":"1776","journal-title":"Nouveaux M\u00e9moires de l\u2019Acad\u00e9mie royale des\n  Sciences et Belles-Lettres de Berlin"},{"key":"ref25:1881\/kronecker","article-title":"Zur Theorie der Elimination einer Variablen aus zwei\n  algebraischen Gleichungen","author":"Leopold Kronecker","year":"1881","journal-title":"Monatsberichte der K\u00f6niglich Preussischen Akademie der\n  Wissenschaften zu Berlin"},{"key":"ref26:1892\/pade","doi-asserted-by":"publisher","first-page":"3","DOI":"10.24033\/asens.378","article-title":"Sur la repr\u00e9sentation approch\u00e9e d'une fonction par\n  des fractions rationnelles","volume":"9","author":"Henri Pad\u00e9","year":"1892","journal-title":"Annales scientifiques de l'\u00c9cole normale\n  sup\u00e9rieure"},{"key":"ref27:1773\/lagrange","article-title":"Recherches d\u2019arithm\u00e9tique","author":"Joseph-Louis Lagrange","year":"1773","journal-title":"Nouveaux M\u00e9moires de l\u2019Acad\u00e9mie royale des\n  Sciences et Belles-Lettres de Berlin"},{"key":"ref28:1801\/gauss","doi-asserted-by":"crossref","DOI":"10.5479\/sil.324926.39088000932822","article-title":"Disquisitiones arithmeticae","volume-title":"Disquisitiones arithmeticae","author":"Carl Friedrich Gauss","year":"1801"},{"key":"ref29:2002\/boneh-crt","doi-asserted-by":"publisher","first-page":"768","DOI":"10.1006\/jcss.2002.1827","article-title":"Finding smooth integers in short intervals using CRT\n  decoding","volume":"64","author":"Dan Boneh","year":"2002","journal-title":"Journal of Computer and System Sciences","ISSN":"https:\/\/id.crossref.org\/issn\/0022-0000","issn-type":"electronic"},{"key":"ref30:2008\/bernstein-smallheight","series-title":"Mathematical Sciences Research Institute Publications","first-page":"421","article-title":"Reducing lattice bases to find small-height values of\n  univariate polynomials","volume-title":"Surveys in algorithmic number theory","volume":"44","author":"Daniel J. Bernstein","year":"2008"},{"key":"ref31:2015\/cohn","doi-asserted-by":"publisher","first-page":"311","DOI":"10.3934\/amc.2015.9.311","article-title":"Ideal forms of Coppersmith's theorem and Guruswami-Sudan\n  list decoding","volume":"9","author":"Henry Cohn","year":"2015","journal-title":"Advances in Mathematics of Communications"},{"key":"ref32:2011\/bernstein-goppalist","series-title":"Lecture Notes in Computer Science","isbn-type":"print","doi-asserted-by":"publisher","first-page":"62","DOI":"10.1007\/978-3-642-20901-7_4","article-title":"List decoding for binary Goppa codes","volume-title":"Coding and cryptology\u2014third international workshop, IWCC\n  2011, Qingdao, China, May 30\u2013June 3, 2011, proceedings","volume":"6639","author":"Daniel J. Bernstein","year":"2011","ISBN":"https:\/\/id.crossref.org\/isbn\/9783642209000"},{"key":"ref33:2011\/bernstein-simplelist","isbn-type":"print","doi-asserted-by":"publisher","first-page":"200","DOI":"10.1007\/978-3-642-25405-5_13","article-title":"Simplified high-speed high-distance list decoding for\n  alternant codes","volume-title":"Post-quantum cryptography\u20144th international workshop,\n  PQCrypto 2011, Taipei, Taiwan, November 29\u2013December 2, 2011, proceedings","volume":"7071","author":"Daniel J. Bernstein","year":"2011","ISBN":"https:\/\/id.crossref.org\/isbn\/9783642254048"},{"key":"ref34:1960\/reed","doi-asserted-by":"publisher","first-page":"300","DOI":"10.1137\/0108018","article-title":"Polynomial codes over certain finite fields","volume":"8","author":"Irving S. Reed","year":"1960","journal-title":"Journal of the Society for Industrial and Applied\n  Mathematics"},{"key":"ref35:1962\/prange","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.1962.1057777","article-title":"The use of information sets in decoding cyclic codes","volume":"IT-8","author":"Eugene Prange","year":"1962","journal-title":"IRE Transactions on Information Theory"},{"key":"ref36:1965\/forney-thesis","article-title":"Concatenated codes","author":"G. David Forney Jr.","year":"1965"},{"key":"ref37:1965\/forney","doi-asserted-by":"publisher","first-page":"549","DOI":"10.1109\/TIT.1965.1053825","article-title":"On decoding BCH codes","volume":"11","author":"G. David Forney Jr.","year":"1965","journal-title":"IEEE Transactions on Information Theory"},{"key":"ref38:1961\/gorenstein","doi-asserted-by":"publisher","first-page":"207","DOI":"10.1137\/0109020","article-title":"A class of error-correcting codes in $p^{m}$ symbols","volume":"9","author":"Daniel Gorenstein","year":"1961","journal-title":"Journal of the Society for Industrial and Applied\n  Mathematics"},{"key":"ref39:1960\/peterson","doi-asserted-by":"publisher","first-page":"459","DOI":"10.1109\/TIT.1960.1057586","article-title":"Encoding and error-correction procedures for the\n  Bose-Chaudhuri codes","volume":"6","author":"W. Wesley Peterson","year":"1960","journal-title":"Transactions of the Institute of Radio Engineers"},{"key":"ref40:1969\/strassen","doi-asserted-by":"publisher","first-page":"354","DOI":"10.1007\/BF02165411","article-title":"Gaussian elimination is not optimal","volume":"13","author":"Volker Strassen","year":"1969","journal-title":"Numerische Mathematik","ISSN":"https:\/\/id.crossref.org\/issn\/0029-599X","issn-type":"electronic"},{"key":"ref41:1968\/berlekamp","article-title":"Algebraic coding theory","volume-title":"Algebraic coding theory","author":"Elwyn R. Berlekamp","year":"1968"},{"key":"ref42:1969\/massey","doi-asserted-by":"publisher","first-page":"122","DOI":"10.1109\/TIT.1969.1054260","article-title":"Shift-register synthesis and BCH decoding","volume":"15","author":"James Massey","year":"1969","journal-title":"IEEE Transactions on Information Theory","ISSN":"https:\/\/id.crossref.org\/issn\/0018-9448","issn-type":"electronic"},{"key":"ref43:1975\/sugiyama","doi-asserted-by":"publisher","first-page":"87","DOI":"10.1016\/S0019-9958(75)90090-X","article-title":"A method for solving key equation for decoding Goppa\n  codes","volume":"27","author":"Yasuo Sugiyama","year":"1975","journal-title":"Information and Control"},{"key":"ref44:1976\/justesen","doi-asserted-by":"publisher","first-page":"237","DOI":"10.1109\/TIT.1976.1055516","article-title":"On the complexity of decoding Reed\u2013Solomon codes","volume":"22","author":"J\u00f8rn Justesen","year":"1976","journal-title":"IEEE Transactions on Information Theory"},{"key":"ref45:1977\/sarwate","doi-asserted-by":"publisher","first-page":"515","DOI":"10.1109\/TIT.1977.1055732","article-title":"On the complexity of decoding Goppa codes","volume":"23","author":"Dilip V. Sarwate","year":"1977","journal-title":"IEEE Transactions on Information Theory"},{"key":"ref46:1975\/mills","doi-asserted-by":"publisher","first-page":"173","DOI":"10.1090\/S0025-5718-1975-0369276-7","article-title":"Continued fractions and linear recurrences","volume":"29","author":"William H. Mills","year":"1975","journal-title":"Mathematics of Computation"},{"key":"ref47:1979\/welch","doi-asserted-by":"publisher","first-page":"19","DOI":"10.1109\/TIT.1979.1055987","article-title":"Continued fractions and Berlekamp's algorithm","volume":"25","author":"Lloyd R. Welch","year":"1979","journal-title":"IEEE Transactions on Information Theory"},{"key":"ref48:1987\/dornstetter","doi-asserted-by":"publisher","first-page":"428","DOI":"10.1109\/TIT.1987.1057299","article-title":"On the equivalence between Berlekamp's and Euclid's\n  algorithms","volume":"33","author":"Jean Louis Dornstetter","year":"1987","journal-title":"IEEE Transactions on Information Theory"},{"key":"ref49:1989\/shiozaki","doi-asserted-by":"publisher","first-page":"1351","DOI":"10.1109\/18.21269","article-title":"Decoding of redundant residue polynomial codes using\n  Euclid's algorithm","volume":"34","author":"Akira Shiozaki","year":"1989","journal-title":"IEEE Transactions on Information Theory"},{"key":"ref50:2003\/gao","doi-asserted-by":"publisher","first-page":"55","DOI":"10.1007\/978-1-4757-3789-9_5","article-title":"A new algorithm for decoding Reed-Solomon codes","volume-title":"Communications, information and network security. With a\n  foreword by Richard E. Blahut","author":"Shuhong Gao","year":"2003"},{"key":"ref51:2017\/classicmceliece","article-title":"Classic McEliece: conservative code-based cryptography","author":"Daniel J. Bernstein","year":"2017"},{"key":"ref52:2019\/classicmceliece","article-title":"Classic McEliece: conservative code-based cryptography","author":"Daniel J. Bernstein","year":"2019"},{"key":"ref53:2017\/ntskem","article-title":"NTS-KEM","author":"Martin Albrecht","year":"2017"},{"key":"ref54:2019\/paterson","article-title":"New version of NTS-KEM","author":"Kenneth G. Paterson","year":"2019"},{"key":"ref55:2020\/chou","isbn-type":"print","doi-asserted-by":"publisher","first-page":"165","DOI":"10.1007\/978-3-030-69255-1_11","article-title":"An IND-CCA2 attack against the 1st- and 2nd-round versions\n  of NTS-KEM","volume-title":"Innovative security solutions for information technology\n  and communications\u201413th international conference, SecITC 2020, Bucharest,\n  Romania, November 19\u201320, 2020, revised selected papers","volume":"12596","author":"Tung Chou","year":"2020","ISBN":"https:\/\/id.crossref.org\/isbn\/9783030692544"},{"key":"ref56:2019\/ntskem","article-title":"NTS-KEM: second round submission","author":"Martin Albrecht","year":"2019"},{"key":"ref57:1986\/niederreiter","first-page":"159","article-title":"Knapsack-type cryptosystems and algebraic coding theory","volume":"15","author":"Harald Niederreiter","year":"1986","journal-title":"Problems of Control and Information Theory"},{"key":"ref58:1995\/canteaut","article-title":"Improvements of the attacks on cryptosystems based on\n  error-correcting codes","author":"Anne Canteaut","year":"1995"},{"key":"ref59:1998\/canteaut-cryptanalysis","series-title":"Lecture Notes in Computer Science","isbn-type":"print","doi-asserted-by":"publisher","first-page":"187","DOI":"10.1007\/3-540-49649-1_16","article-title":"Cryptanalysis of the original McEliece cryptosystem","volume-title":"Advances in cryptology\u2014ASIACRYPT'98: proceedings of the\n  international conference on the theory and application of cryptology and\n  information security held in Beijing","volume":"1514","author":"Anne Canteaut","year":"1998","ISBN":"https:\/\/id.crossref.org\/isbn\/3540651098"},{"key":"ref60:2022\/andronick","isbn-type":"print","article-title":"13th international conference on interactive theorem\n  proving, ITP 2022, August 7\u201310, 2022, Haifa, Israel","volume-title":"13th international conference on interactive theorem\n  proving, ITP 2022, August 7\u201310, 2022, Haifa, Israel","volume":"237","year":"2022","ISBN":"https:\/\/id.crossref.org\/isbn\/9783959772525"},{"key":"ref61:2008\/buhler","series-title":"Mathematical Sciences Research Institute Publications","article-title":"Surveys in algorithmic number theory","volume-title":"Surveys in algorithmic number theory","volume":"44","year":"2008"},{"key":"ref62:2011\/chee","series-title":"Lecture Notes in Computer Science","isbn-type":"print","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-20901-7","article-title":"Coding and cryptology\u2014third international workshop, IWCC\n  2011, Qingdao, China, May 30\u2013June 3, 2011, proceedings","volume-title":"Coding and cryptology\u2014third international workshop, IWCC\n  2011, Qingdao, China, May 30\u2013June 3, 2011, proceedings","volume":"6639","year":"2011","ISBN":"https:\/\/id.crossref.org\/isbn\/9783642209000"},{"key":"ref63:2011\/yang","isbn-type":"print","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-25405-5","article-title":"Post-quantum cryptography\u20144th international workshop,\n  PQCrypto 2011, Taipei, Taiwan, November 29\u2013December 2, 2011, proceedings","volume-title":"Post-quantum cryptography\u20144th international workshop,\n  PQCrypto 2011, Taipei, Taiwan, November 29\u2013December 2, 2011, proceedings","volume":"7071","year":"2011","ISBN":"https:\/\/id.crossref.org\/isbn\/9783642254048"},{"key":"ref64:2013\/bertoni","isbn-type":"print","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40349-1","article-title":"Cryptographic hardware and embedded systems\u2014CHES\n  2013\u201415th international workshop, Santa Barbara, CA, USA, August 20\u201323,\n  2013, proceedings","volume-title":"Cryptographic hardware and embedded systems\u2014CHES\n  2013\u201415th international workshop, Santa Barbara, CA, USA, August 20\u201323,\n  2013, proceedings","volume":"8086","year":"2013","ISBN":"https:\/\/id.crossref.org\/isbn\/9783642403484"},{"key":"ref65:2011\/biryukov","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-19574-7","article-title":"Selected areas in cryptography\u201417th international\n  workshop, SAC 2010, Waterloo, Ontario, Canada, August 12\u201313, 2010, revised\n  selected papers","volume-title":"Selected areas in cryptography\u201417th international\n  workshop, SAC 2010, Waterloo, Ontario, Canada, August 12\u201313, 2010, revised\n  selected papers","volume":"6544","year":"2011"},{"key":"ref66:2000\/-stoc","isbn-type":"print","article-title":"Proceedings of the 32nd annual ACM symposium on theory of\n  computing","volume-title":"Proceedings of the 32nd annual ACM symposium on theory of\n  computing","year":"2000","ISBN":"https:\/\/id.crossref.org\/isbn\/1581131844"},{"key":"ref67:2000\/boneh-crt","isbn-type":"print","doi-asserted-by":"publisher","first-page":"265","DOI":"10.1145\/335305.335337","article-title":"Finding smooth integers in short intervals using CRT\n  decoding","volume-title":"Proceedings of the 32nd annual ACM symposium on theory of\n  computing","author":"Dan Boneh","year":"2000","ISBN":"https:\/\/id.crossref.org\/isbn\/1581131844"},{"key":"ref68:2023\/deneuville","isbn-type":"print","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-29689-5","article-title":"Code-based cryptography\u201410th international workshop,\n  CBCrypto 2022, Trondheim, Norway, May 29\u201330, 2022, revised selected\n  papers","volume-title":"Code-based cryptography\u201410th international workshop,\n  CBCrypto 2022, Trondheim, Norway, May 29\u201330, 2022, revised selected\n  papers","volume":"13839","year":"2023","ISBN":"https:\/\/id.crossref.org\/isbn\/9783031296888"},{"key":"ref69:1981\/debruin","series-title":"Lecture Notes in Mathematics","doi-asserted-by":"publisher","DOI":"10.1007\/BFb0095573","article-title":"Pad\u00e9 approximation and its applications, Amsterdam 1980,\n  proceedings of a conference held in Amsterdam, the Netherlands, October\n  29\u201331, 1980","volume-title":"Pad\u00e9 approximation and its applications, Amsterdam 1980,\n  proceedings of a conference held in Amsterdam, the Netherlands, October\n  29\u201331, 1980","volume":"888","year":"1981","ISSN":"https:\/\/id.crossref.org\/issn\/0075-8434","issn-type":"electronic"},{"key":"ref70:1998\/ohta-asiacrypt98","series-title":"Lecture Notes in Computer Science","isbn-type":"print","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-49649-1","article-title":"Advances in cryptology\u2014ASIACRYPT'98: proceedings of the\n  international conference on the theory and application of cryptology and\n  information security held in Beijing","volume-title":"Advances in cryptology\u2014ASIACRYPT'98: proceedings of the\n  international conference on the theory and application of cryptology and\n  information security held in Beijing","volume":"1514","year":"1998","ISBN":"https:\/\/id.crossref.org\/isbn\/3540651098"},{"key":"ref71:2017\/fischer","isbn-type":"print","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-66787-4","article-title":"Cryptographic hardware and embedded systems\u2014CHES\n  2017\u201419th international conference, Taipei, Taiwan, September 25\u201328, 2017,\n  proceedings","volume-title":"Cryptographic hardware and embedded systems\u2014CHES\n  2017\u201419th international conference, Taipei, Taiwan, September 25\u201328, 2017,\n  proceedings","volume":"10529","year":"2017","ISBN":"https:\/\/id.crossref.org\/isbn\/9783319667867"},{"key":"ref72:2017\/chou","isbn-type":"print","doi-asserted-by":"publisher","first-page":"213","DOI":"10.1007\/978-3-319-66787-4_11","article-title":"McBits revisited","volume-title":"Cryptographic hardware and embedded systems\u2014CHES\n  2017\u201419th international conference, Taipei, Taiwan, September 25\u201328, 2017,\n  proceedings","volume":"10529","author":"Tung Chou","year":"2017","ISBN":"https:\/\/id.crossref.org\/isbn\/9783319667867"},{"key":"ref73:2021\/maimut","isbn-type":"print","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-69255-1","article-title":"Innovative security solutions for information technology\n  and communications\u201413th international conference, SecITC 2020, Bucharest,\n  Romania, November 19\u201320, 2020, revised selected papers","volume-title":"Innovative security solutions for information technology\n  and communications\u201413th international conference, SecITC 2020, Bucharest,\n  Romania, November 19\u201320, 2020, revised selected papers","volume":"12596","year":"2021","ISBN":"https:\/\/id.crossref.org\/isbn\/9783030692544"},{"key":"ref74:2003\/bhargava","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4757-3789-9","article-title":"Communications, information and network security. With a\n  foreword by Richard E. Blahut","volume-title":"Communications, information and network security. With a\n  foreword by Richard E. Blahut","year":"2003"},{"key":"ref75:1998\/-focs","doi-asserted-by":"publisher","DOI":"10.1109\/SFCS.1998","article-title":"39th annual symposium on foundations of computer science,\n  FOCS '98, November 8\u201311, 1998, Palo Alto, California, USA","volume-title":"39th annual symposium on foundations of computer science,\n  FOCS '98, November 8\u201311, 1998, Palo Alto, California, USA","year":"1998"},{"key":"ref76:1999\/guruswami","doi-asserted-by":"publisher","first-page":"1757","DOI":"10.1109\/18.782097","article-title":"Improved decoding of Reed-Solomon and algebraic-geometry\n  codes","volume":"45","author":"Venkatesan Guruswami","year":"1999","journal-title":"IEEE Transactions on Information Theory","ISSN":"https:\/\/id.crossref.org\/issn\/0018-9448","issn-type":"electronic"},{"key":"ref77:1996\/srivas","series-title":"Lecture Notes in Computer Science","isbn-type":"print","doi-asserted-by":"publisher","DOI":"10.1007\/BFB0031795","article-title":"Formal methods in computer-aided design, first\n  international conference, FMCAD '96, Palo Alto, California, USA, November\n  6\u20138, 1996, proceedings","volume-title":"Formal methods in computer-aided design, first\n  international conference, FMCAD '96, Palo Alto, California, USA, November\n  6\u20138, 1996, proceedings","volume":"1166","year":"1996","ISBN":"https:\/\/id.crossref.org\/isbn\/3540619372"},{"key":"ref78:2020\/blanchette","isbn-type":"print","doi-asserted-by":"publisher","DOI":"10.1145\/3372885","article-title":"Proceedings of the 9th ACM SIGPLAN international\n  conference on certified programs and proofs, CPP 2020, New Orleans, LA,\n  USA, January 20\u201321, 2020","volume-title":"Proceedings of the 9th ACM SIGPLAN international\n  conference on certified programs and proofs, CPP 2020, New Orleans, LA,\n  USA, January 20\u201321, 2020","year":"2020","ISBN":"https:\/\/id.crossref.org\/isbn\/9781450370974"},{"key":"ref79:2021\/platzer","isbn-type":"print","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-79876-5","article-title":"Automated deduction\u2014CADE 28\u201428th international\n  conference on automated deduction, virtual event, July 12\u201315, 2021,\n  proceedings","volume-title":"Automated deduction\u2014CADE 28\u201428th international\n  conference on automated deduction, virtual event, July 12\u201315, 2021,\n  proceedings","volume":"12699","year":"2021","ISBN":"https:\/\/id.crossref.org\/isbn\/9783030798758"},{"key":"ref80:2009\/bernstein-pqcrypto","isbn-type":"print","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-88702-7","article-title":"Post-quantum cryptography","volume-title":"Post-quantum cryptography","year":"2009","ISBN":"https:\/\/id.crossref.org\/isbn\/9783540887010"},{"key":"ref81:1992\/heideman","article-title":"Proceedings of the 13th symposium on information theory in\n  the Benelux","volume-title":"Proceedings of the 13th symposium on information theory in\n  the Benelux","year":"1992"},{"key":"ref82:1963\/struik","doi-asserted-by":"publisher","first-page":"257","DOI":"10.5951\/MT.56.4.0257","article-title":"The origin of L\u2019H\u00f4pital's rule","volume":"56","author":"Dirk J. Struik","year":"1963","journal-title":"The Mathematics Teacher"},{"key":"ref83:2013\/vanemdeboas","article-title":"The correspondence between Donald E. Knuth and Peter van\n  Emde Boas on priority deques during the spring of 1977","author":"Peter van Emde Boas","year":"2013"},{"key":"ref84:2019\/ormandy","article-title":"Issue 1804: cryptoapi: SymCrypt modular inverse\n  algorithm","author":"Tavis Ormandy","year":"2019"},{"key":"ref85:2019\/winder","article-title":"Warning: Google researcher drops Windows 10 zero-day\n  security bomb","author":"Davey Winder","year":"2019"},{"key":"ref86:2001\/comer","article-title":"How to criticize computer scientists: or, avoiding\n  ineffective deprecation and making insults more pointed","author":"Douglas E. Comer","year":"2001"},{"key":"ref87:1996\/harrison","series-title":"Lecture Notes in Computer Science","isbn-type":"print","doi-asserted-by":"publisher","first-page":"265","DOI":"10.1007\/BFb0031814","article-title":"HOL Light: A tutorial introduction","volume-title":"Formal methods in computer-aided design, first\n  international conference, FMCAD '96, Palo Alto, California, USA, November\n  6\u20138, 1996, proceedings","volume":"1166","author":"John Harrison","year":"1996","ISBN":"https:\/\/id.crossref.org\/isbn\/3540619372"},{"key":"ref88:2021\/moura","isbn-type":"print","doi-asserted-by":"publisher","first-page":"625","DOI":"10.1007\/978-3-030-79876-5_37","article-title":"The Lean 4 theorem prover and programming language","volume-title":"Automated deduction\u2014CADE 28\u201428th international\n  conference on automated deduction, virtual event, July 12\u201315, 2021,\n  proceedings","volume":"12699","author":"Leonardo de Moura","year":"2021","ISBN":"https:\/\/id.crossref.org\/isbn\/9783030798758"},{"key":"ref89:2020\/mathlib","isbn-type":"print","doi-asserted-by":"publisher","first-page":"367","DOI":"10.1145\/3372885.3373824","article-title":"The Lean mathematical library","volume-title":"Proceedings of the 9th ACM SIGPLAN international\n  conference on certified programs and proofs, CPP 2020, New Orleans, LA,\n  USA, January 20\u201321, 2020","author":"The mathlib community","year":"2020","ISBN":"https:\/\/id.crossref.org\/isbn\/9781450370974"},{"key":"ref90:2022\/brain","isbn-type":"print","doi-asserted-by":"publisher","first-page":"21","DOI":"10.1007\/978-3-031-29689-5_2","article-title":"Verifying Classic McEliece: examining the role of formal\n  methods in post-quantum cryptography standardisation","volume-title":"Code-based cryptography\u201410th international workshop,\n  CBCrypto 2022, Trondheim, Norway, May 29\u201330, 2022, revised selected\n  papers","volume":"13839","author":"Martin Brain","year":"2022","ISBN":"https:\/\/id.crossref.org\/isbn\/9783031296888"},{"key":"ref91:2022\/abrahamsson","isbn-type":"print","doi-asserted-by":"publisher","DOI":"10.4230\/LIPICS.ITP.2022.3","article-title":"Candle: A verified implementation of HOL Light","volume-title":"13th international conference on interactive theorem\n  proving, ITP 2022, August 7\u201310, 2022, Haifa, Israel","volume":"237","author":"Oskar Abrahamsson","year":"2022","ISBN":"https:\/\/id.crossref.org\/isbn\/9783959772525"}],"container-title":["IACR Communications in Cryptology"],"original-title":[],"language":"en","deposited":{"date-parts":[[2024,12,10]],"date-time":"2024-12-10T21:25:29Z","timestamp":1733865929000},"score":1,"resource":{"primary":{"URL":"https:\/\/cic.iacr.org\/p\/1\/1\/14"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,4,9]]},"references-count":91,"URL":"https:\/\/doi.org\/10.62056\/angy4fe-3","archive":["Internet Archive","Internet Archive"],"relation":{},"ISSN":["3006-5496"],"issn-type":[{"value":"3006-5496","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,4,9]]},"assertion":[{"value":"2024-01-07","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-03-05","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"cc1-1-41"}}