On the number of solutions to a random instance of the permuted kernel problem

Abstract

The Permuted Kernel Problem (PKP) is a problem in linear algebra that was first introduced by Shamir in 1989. Roughly speaking, given an $\ell \times m$ matrix $\mathbf{A}$ and an $m \times 1$ vector $\mathbf{b}$ over a finite field of $q$ elements $\mathbb{F}_q$, the PKP asks to find an $m \times m$ permutation matrix $\mathbf{\pi}$ such that $\mathbf{\pi} \mathbf{b}$ belongs to the kernel of $\mathbf{A}$. In recent years, several post-quantum digital signature schemes whose security can be provably reduced to the hardness of solving random instances of the PKP have been proposed. In this regard, it is important to know the expected number of solutions to a random instance of the PKP in terms of the parameters $q,\ell,m$. Previous works have heuristically estimated the expected number of solutions to be $m! / q^\ell$. We provide, and rigorously prove, exact formulas for the expected number of solutions to a random instance of the PKP and the related Inhomogeneous Permuted Kernel Problem (IPKP), considering two natural ways of generating random instances.