%!TEX root = paper.tex

\section{Discussion on Countermeasures}

The most obvious countermeasure against this timing attack
is to use constant-time
BCH decoders~\cite{cryptoeprint:2019:155,cryptoeprint:2019:909}.
However, these decoders were proposed recently and they are not well studied yet.
As such, their security against other types of side-channel attacks needs further investigation.

Walters and Sinha Roy~\cite{cryptoeprint:2019:155} studied constant-time BCH decoders in the
context of LAC~\cite{lac2018}. Their decoder yields overheads between 10\% and 40\%
when used in LAC.
The optimized decoder proposed by Wafo-Tapa et al.~\cite{cryptoeprint:2019:909} can yield reasonable
overheads, between 3\% and 11\%, for the different security levels provided by the HQC instances.
Hopefully, with further study on constant-time BCH decoders, lower overheads can be achieved.

If the slowdown factor is a problem, one could try to add a number of errors to the
partially decoded vector right before the BCH decoding procedure. Next, we explain
the rationale behind this idea.
Consider the vector $\vec{c}' = \vec{m} \mat{G} + \vec{x}~\cdot~\vec{r}_2 + \vec{r}_1 \cdot \vec{y} + \vec{e}$.
When applying the repetition code decoder to each block
of $n_2$ elements of $\vec{c}'$, we can estimate the probability of a repetition decoding error from
the number of ones (or zeros) in the block. For example, if the number of 1's and 0's in a block are similar (both close to
$n_2/2$), then the
probability of a decoding error to occur is high. This might make it possible to estimate, within some statistical margin,
the number of errors that the repetition code decoder has left for the BCH decoder. Then, one can add
intentional errors to the partially decoded vector $\vec{c}'' = \Psi_2(\vec{c}')$,
for it to have a weight $W$, where $W$ is a constant error weight which the BCH decoder can correct.
Further study and a careful probabilistic analysis is needed to understand if a decoder using this idea
is secure.
