# A structural attack to the DME-$(3,2,q)$ cryptosystem.

Martin Avendaño, Miguel Marco

###### Abstract

We present a structural attack on the DME cryptosystem with paramenters
$(3,2,q)$. The attack recovers $10$ of the $12$ coefficients of the first
linear map. We also show that, if those $12$ coefficients were known, the rest
of the private key can be efficiently obtained by solving systems of quadratic
equations with just two variables.

##  1 Introduction

DME stands for “double matrix exponentiation”. It is a family of multivariate
encryption primitives over finite fields, parametrized by two integers and a
field size (in bits). It was developed by Luengo, and the version with
parameters $(3,2,2^{48})$ was presented to the NIST call for quantum-resistant
public-key cryptographic algorithms [1].

The encryption map consists on a composition of three secret linear maps and
two public matrix exponentiations, defining a polynomial map with very high
degree, and moderated number of monomials. This map which can be inverted
provided we know the secret linear maps.

During the revision process at NIST, Weullens claimed to have found an attack
against DME-$(3,2,2^{48})$ consisting on using Weil descent to convert the map
in a quartic one over $\mathbb{F}_{2}$ (with a much larger set of variables),
and then decompose it in two quadratic ones. However, his claims about the
complexity and/or feasibility of such an attack could not be proved (see [2]).

Later, Weullens proposed another attack ([3], [4]) against the submitted
implementation that took advantage of the lack of a proper padding. This
attack used $2^{24}$ decryption queries, and analyzed the cases where the
decryption resulted in an error. It was practical, but did not essentially
break the underlying mathematical problem, so it could be prevented by using a
secure padding.

Here we present a structural attack against DME-$(3,2,q)$ that reduces the
difficulty of recovering the private key from the public one from the claimed
$256$ bits to just $log_{2}(q^{2})$. It is completely passive in the sense
that it does not require any interaction, just the knowledge of the public
key. The attack does not rely on any implementation details, since it
considers only the underlying mathematical problem.

##  2 Description of the system

We first describe the DME cryptosystem. We focus only on the mathematical
description, ignoring all the implementation details (such as how bits are
transformed into elements of $F_{q}$, padding, etc).

###  2.1 Setup

The system requires a common setup for all users, consisting on the following:

  * 1.

Two positive integers $m\geq n$.

  * 2.

A finite field $\mathbb{F}_{q}$ of characteristic $p$.

  * 3.

An explicit isomorphism of $\mathbb{F}_{q}$-vector spaces
$\mathbb{F}_{q}^{n}\cong\mathbb{F}_{q^{n}}$.

  * 4.

An explicit isomorphism of $\mathbb{F}_{q}$-vector spaces
$\mathbb{F}_{q}^{m}\cong\mathbb{F}_{q^{m}}$.

  * 5.

A $m\times m$ matrix $E$, whose nonzero entries are powers of $p$, that is
invertible modulo $q^{n}-1$, and whose rows have only two nonzero. entries.

  * 6.

A $n\times n$ matrix $F$, whose nonzero entries are powers of $p$, that is
invertible modulo $q^{m}-1$, and whose rows have only two nonzero entries.

  * 7.

A permutation map $M:\mathbb{F}_{q}^{nm}\to\mathbb{F}_{q}^{nm}$ such that

$M((\mathbb{F}_{q}^{n}\setminus\\{0\\})^{m})\subseteq(\mathbb{F}_{q}^{m}\setminus\\{0\\})^{n}.$

For the implementation submitted to the NIST call the following choices were
made:

  * 1.

$m=3$, $n=2$.

  * 2.

The field $\mathbb{F}_{q}$ is the field of $2^{48}$ elements, represented as
polynomials in $\mathbb{F}_{2}[x]$ modulo the polynomial
$x^{48}+x^{28}+x^{27}+x+1$.

  * 3.

The identification is done by considering $\mathbb{F}_{q^{2}}$ as the
polynomials in $\mathbb{F}_{q}[T]$ modulo $T^{2}+a\cdot T+b$, with

    * $a=x^{43}+x^{38}+x^{36}+x^{34}+x^{29}+x^{26}+x^{25}+x^{24}+x^{23}+x^{22}+x^{21}+x^{20}+x^{19}+x^{13}+x^{9}+x^{8}+x^{4}+x^{3}+x+1$

    * $b=x^{47}+x^{46}+x^{45}+x^{43}+x^{40}+x^{39}+x^{38}+x^{37}+x^{35}+x^{31}+x^{30}+x^{27}+x^{26}+x^{24}+x^{23}+x^{22}+x^{21}+x^{18}+x^{17}+x^{16}+x^{14}+x^{9}+x^{8}+x^{7}+x^{3}+x^{2}+1$

and taking coordinates in the basis $(1,T)$.

  * 4.

The identification is done by considering $\mathbb{F}_{q^{3}}$ as the
polynomials in $\mathbb{F}_{q}[S]$ modulo $S^{3}+c\cdot S^{2}+d\cdot S+e$ with

    * $c=x^{43}+x^{42}+x^{41}+x^{40}+x^{38}+x^{37}+x^{36}+x^{34}+x^{33}+x^{29}+x^{26}+x^{24}+x^{22}+x^{20}+x^{19}+x^{17}+x^{15}+x^{14}+x^{13}+x^{12}+x^{11}+x^{8}+x^{5}+x^{3}+x^{2}+x$.

    * $d=x^{46}+x^{45}+x^{44}+x^{41}+x^{38}+x^{37}+x^{33}+x^{32}+x^{31}+x^{30}+x^{25}+x^{21}+x^{20}+x^{17}+x^{16}+x^{15}+x^{14}+x^{12}+x^{10}+x^{9}+x^{8}+x^{7}+x^{4}+x^{3}+x^{2}+x+1$

    * $e=x^{47}+x^{46}+x^{42}+x^{39}+x^{38}+x^{35}+x^{32}+x^{26}+x^{25}+x^{24}+x^{23}+x^{20}+x^{19}+x^{17}+x^{15}+x^{14}+x^{13}+x^{12}+x^{11}+x^{9}+x^{8}+x^{6}+x^{5}+x^{2}+x$

and taking coordinates in the basis $(1,S,S^{2})$.

  * 5.

The matrix $E=\left(\begin{array}[]{ccc}2^{24}&2^{59}&0\\\ 2^{21}&0&2^{28}\\\
0&2^{29}&2^{65}\end{array}\right)$

  * 6.

The matrix $F=\left(\begin{array}[]{cc}2^{50}&2^{24}\\\
2^{7}&2^{88}\end{array}\right)$

  * 7.

$M$ is the identity.

###  2.2 Matrix exponentiations

The scheme makes use of a special kind of maps called matrix exponentiations.
Consider a vector
$\bar{x}=(x_{1}\ldots,x_{m})\in(\mathbb{F}_{q^{n}}^{*})^{m}$, and the matrix
$E$ defined above. We define the vector $\bar{x}^{E}:=(x_{1}^{E_{11}}\cdot
x_{2}^{E_{12}}\cdots x_{m}^{E_{1m}},\ldots,x_{1}^{E_{m1}}\cdot
x_{2}^{E_{m2}}\cdots x_{m}^{E_{mm}})$.

Analogously, we define a map
$(\mathbb{F}_{q^{m}}^{*})^{n}\to(\mathbb{F}_{q^{m}}^{*})^{n}$ by using the
matrix $F$.

It is easy to check that these are polynomial maps, even considered as maps
from $\mathbb{F}_{q}^{nm}$ to $\mathbb{F}_{q}^{nm}$ (by composing with the
isomorphisms fixed in the setup). It is also easy to check that the inverse
matrices (mod $q^{n}-1$ and $q^{m}-1$ respectively) determine inverse maps.

By abuse of notation, we use the same letter to represent both the matrix and
the corresponding map.

###  2.3 Keys and encryption/decryption maps

With this setup, the private key is a triple of invertible $nm\times nm$
matrices over $\mathbb{F}_{q}$, $(L_{1},L_{2},L_{3})$ such that $L_{1}$ is a
diagonal sum of $m$ square blocks $L_{11},\ldots,L_{1m}$ of size $n\times n$;
$L_{2}$ and $L_{3}$ are diagonal sums of $n$ blocks ($L_{21},\ldots,L_{2n}$
and $L_{31},\ldots,L_{3n}$ respectively) of size $m\times m$. They can be
regarded as linear maps $\mathbb{F}_{q}^{nm}\to\mathbb{F}_{q}^{nm}$.

Once chosen these matrices, we can consider the following composition of maps

${\mathbb{F}_{q}^{nm}}$${\mathbb{F}_{q}^{nm}}$${\mathbb{F}_{q}^{nm}}$${\mathbb{F}_{q}^{nm}}$${\mathbb{F}_{q}^{nm}}$${\mathbb{F}_{q}^{nm}}$${\mathbb{F}_{q^{n}}^{m}}$${\mathbb{F}_{q^{n}}^{m}}$${\mathbb{F}_{q^{m}}^{n}}$${\mathbb{F}_{q^{m}}^{n}}$$\scriptstyle{L_{1}}$$\scriptstyle{\cong}$$\scriptstyle{{E}}$$\scriptstyle{\cong}$$\scriptstyle{L_{2}\circ
M}$$\scriptstyle{\cong}$$\scriptstyle{{F}}$$\scriptstyle{\cong}$$\scriptstyle{L_{3}}$

The result is a multivariate polynomial map from $\mathbb{F}_{q}^{nm}$ to
itself. In the expanded expression of this map, the exponents that appear at
the end depend only on the entries of $E$ and $F$, hence are public. The
public key will be the coefficients that appear in that expression. The
structure of the system has been carefully designed to ensure that the number
of monomials in this expansion is not too large.

Note that each step in the composition is invertible (assuming we stay always
inside $(\mathbb{F}_{q^{n}}^{*})^{m}$ and $(\mathbb{F}_{q^{m}}^{*})^{n}$ at
the steps $E$ and $F$ respectively) by using the inverses of the involved
matrices. That is, the whole map can be efficiently inverted if we know the
private key.

##  3 Malleability of the private key

In this section we show how different private keys may correspond to the same
public key. This fact will be used to assume that the private key has a
special form.

From now on, we assume that $n=2$ and $m=3$, as in the version submitted to
the NIST.

Take $\alpha\in\mathbb{F}_{q^{2}}^{*}$. The multiplication by $\alpha$ defines
a map from $\mathbb{F}_{q^{2}}$ to itself that is $\mathbb{F}_{q}$-linear. So
there exists a matrix $H(\alpha)$ such that the corresponding linear map makes
the following diagram commute.

${\mathbb{F}_{q}^{2}}$${\mathbb{F}_{q}^{2}}$${\mathbb{F}_{q^{2}}}$${\mathbb{F}_{q^{2}}}$$\scriptstyle{\cong}$$\scriptstyle{\cdot\alpha}$$\scriptstyle{{\cong}}$$\scriptstyle{H(\alpha)}$

Analogously, for any $\lambda\in\mathbb{F}_{q^{3}}^{*}$ there exist a matrix
$G(\lambda)$ whose corresponding linear map makes the following diagram
commute

${\mathbb{F}_{q}^{3}}$${\mathbb{F}_{q}^{3}}$${\mathbb{F}_{q^{3}}}$${\mathbb{F}_{q^{3}}}$$\scriptstyle{\cong}$$\scriptstyle{\cdot\lambda}$$\scriptstyle{{\cong}}$$\scriptstyle{G(\lambda)}$

Clearly, $H(\alpha)^{-1}=H(\alpha^{-1})$ and
$G(\lambda)^{-1}=G(\lambda^{-1})$.

######  Lemma 1.

Let $\alpha,\beta,\gamma\in\mathbb{F}_{q^{2}}^{*}$ such that
$\alpha^{E_{21}}\gamma^{E_{23}}=\delta\in\mathbb{F}_{q}^{*}$. Then the private
keys

  * 1.

$(L_{11},L_{12},L_{13},L_{21},L_{22},L_{31},L_{32})$

  * 2.

$(H(\alpha)L_{11},H(\beta)L_{12},H(\gamma)L_{13},L_{21}\left(\begin{array}[]{cc}H(\alpha^{E_{11}}\beta^{E_{12}})^{-1}&\left.\begin{array}[]{c}0\\\
0\end{array}\right.\\\
\left.\begin{array}[]{cc}0&0\end{array}\right.&\delta^{-1}\end{array}\right),\\\
,L_{22}\left(\begin{array}[]{cc}\delta^{-1}&\left.\begin{array}[]{cc}0&0\end{array}\right.\\\
\left.\begin{array}[]{c}0\\\
0\end{array}\right.&H(\beta^{E_{23}}\gamma^{E_{33}})^{-1}\end{array}\right),L_{31},L_{32})$

correspond to the same public key.

###### Proof.

Is a direct consequence of the commutativity of the previous diagrams, and the
fact that

$(x_{1},x_{2},x_{3})^{E}=(y_{1},y_{2},y_{3})\Longrightarrow(\alpha x_{1},\beta
x_{2},\gamma
x_{3})^{E}=(\alpha^{E_{11}}\beta^{E_{12}}y_{1},\alpha^{E_{21}}\gamma^{E_{23}}y_{2},\beta^{E_{32}}\gamma^{E_{33}}y_{3})$

∎

Analogously, we also have

######  Lemma 2.

Let $\lambda,\mu\in\mathbb{F}_{q^{3}}^{*}$. Then the private keys

  * 1.

$(L_{11},L_{12},L_{13},L_{21},L_{22},L_{31},L_{32})$

  * 2.

$(L_{11},L_{12},L_{13},G(\lambda)L_{21},G(\mu)L_{22},L_{31}G(\lambda^{F_{11}}\mu^{F_{12}})^{-1},L_{32}G(\lambda^{F_{21}}\mu^{F_{22}})^{-1})$

produce the same public key.

We can use these facts to assume that the private key has a specific form

######  Lemma 3.

Every valid public key corresponds to a private key that satisfies the
following form:

  * 1.

$L_{11}=\left(\begin{array}[]{cc}*&1\\\ {*}&0\end{array}\right)$

  * 2.

$L_{12}=\left(\begin{array}[]{cc}{*}&1\\\ {*}&0\end{array}\right)$

  * 3.

$L_{13}=\left(\begin{array}[]{cc}*&a\\\ {*}&b\end{array}\right)$ with either
$(a+bT)^{E_{23}}=1+cT$ for some $c\in\mathbb{F}_{q}$ or $(a+bT)^{E_{23}}=T$

  * 4.

$L_{21}=\left(\begin{array}[]{ccc}*&*&1\\\ {*}&*&0\\\
{*}&*&0\end{array}\right)$

  * 5.

$L_{22}=\left(\begin{array}[]{ccc}1&*&*\\\ 0&*&*\\\ 0&*&*\end{array}\right)$

where the $*$ symbols represent arbitrary elements of $\mathbb{F}_{q}$.

###### Proof.

If it comes from a secret key
$(L_{11},L_{12},L_{13},L_{21},L_{22},L_{31},L_{32})$, we choose
$\alpha,\beta\in\mathbb{F}_{q^{2}}^{*}$ as follows:

  * 1.

$\alpha$ is the multiplicative inverse of the element of $\mathbb{F}_{q^{2}}$
corresponding (via the isomorphism) to the second column of $L_{11}$.

  * 2.

$\beta$ is the multiplicative inverse of the element of $\mathbb{F}_{q^{2}}$
corresponding to the second column of $L_{12}$.

This way, $H(\alpha)L_{11}=\left(\begin{array}[]{cc}*&1\\\
{*}&0\end{array}\right)$ and $H(\beta)L_{12}=\left(\begin{array}[]{cc}*&1\\\
{*}&0\end{array}\right)$.

Let $\tau$ be the element of $\mathbb{F}_{q^{2}}$ corresponding to the second
column of $L_{13}$. Assume that
$\alpha^{-E_{21}}\tau^{E_{23}}=\delta+\varepsilon T$ with $\delta\neq 0$.
Choose $\gamma\in\mathbb{F}_{q^{2}}^{*}$ such that
$\alpha^{E_{21}}\gamma^{E_{23}}=\delta^{-1}$ (this can be done easily by
raising $\delta^{-1}\alpha^{-E_{21}}$ to the inverse of $E_{23}$ modulo
$q^{2}-1$). If $H(\gamma)L_{13}=\left(\begin{array}[]{cc}*&a\\\
{*}&b\end{array}\right)$, then

$(a+bT)^{E_{23}}=\gamma^{E_{23}}\tau^{E_{23}}=\delta^{-1}\alpha^{-E_{21}}\tau^{E_{23}}=\delta^{-1}(\delta+\varepsilon
T)=1+cT$

for some $c\in\mathbb{F}_{q}$.

If $\delta=0$ we can do a similar computation using $\varepsilon$ instead of
$\delta$, to get that $(a+bT)^{E_{23}}=T$.

Applying Lemma 1 with $\alpha,\beta,\gamma\in\mathbb{F}_{q^{2}}^{*}$, we can
construct a private key with $L_{11},L_{12},L_{13}$ as in the statement.

Now choose $\lambda,\mu$ to be the inverse multiplicatives of the elements of
$\mathbb{F}_{q^{3}}$ corresponding to the third column of $L_{21}$ and the
first column of $L_{22}$ respectively.

Applying Lemma 2 to this new private key we obtain one where $L_{21},L_{22}$
are also as claimed. ∎

##  4 Recovering information about the special private key from the public key

In this section we assume that the private key has the form obtained in the
previous section. We show how to compute the unknown coefficients of $L_{1}$
from the coefficients in the public key. Moreover, we can also compute six
coefficients from $L_{3}$.

Let’s start by fixing some notation. Let $l_{11},l_{12}$ be the elements of
$\mathbb{F}_{q^{2}}$ that correspond to the columns of $L_{11}$. As we have
shown in the previous section, we can assume that $l_{12}=1$. Analogously,
$l_{21},l_{22}$ and $l_{31},l_{32}$ are the elements of $\mathbb{F}_{q^{2}}$
that correspond to the columns of $L_{12}$ and $L_{13}$, respectively. As
before, we can assume that $l_{22}=1$ and $l_{32}=a+bT$ where
$(a+bT)^{E_{23}}$ is either $1+cT$ or $T$.

Define

  * 1.

$f_{1}+f_{2}T:={l_{11}}^{E_{21}}{l_{31}}^{E_{23}}$

  * 2.

$g_{1}+g_{2}T:={l_{11}}^{E_{21}}{l_{32}}^{E_{23}}$

  * 3.

$h_{1}+h_{2}T:={l_{12}}^{E_{21}}{l_{31}}^{E_{23}}={l_{31}}^{E_{23}}$

where $f_{1},f_{2},g_{1},g_{2},h_{1},h_{2}\in\mathbb{F}_{q}$.

######  Lemma 4.

Let $(\eta_{1},\eta_{2},\eta_{3})$, $(\eta_{4},\eta_{5},\eta_{6})$ be the
first column of $L_{31}$ and $L_{32}$ respectively.

If we write the encryption map as a polynomial in $x_{1},\ldots,x_{6}$, and
$(a+bT)^{E_{23}}=1+cT$, the terms that only involve the variables $x_{1}$ and
$x_{6}$ in the $i$’th component are

  * 1.

$\eta_{i}c^{F_{12}}(x_{1}^{E_{21}}x_{6}^{E_{23}})^{F_{11}+F_{12}}$ for
$i=1,2,3$

  * 2.

$\eta_{i}c^{F_{22}}(x_{1}^{E_{21}}x_{6}^{E_{23}})^{F_{21}+F_{22}}$ for
$i=4,5,6$.

If $(a+bT)^{E_{23}}=T$ there are no terms that only involve these variables.

Similarly, the terms that only involve the variables $x_{1},x_{5}$ are

  * 1.

$\eta_{i}f_{1}^{F_{11}}f_{2}^{F_{12}}(x_{1}^{E_{21}}x_{5}^{E_{23}})^{F_{11}+F_{12}}$
for $i=1,2,3$

  * 2.

$\eta_{i}f_{1}^{F_{11}}f_{2}^{F_{12}}(x_{1}^{E_{21}}x_{5}^{E_{23}})^{F_{21}+F_{22}}$
for $i=4,5,6$

Analogous formulas hold for the terms involving $x_{2},x_{6}$ and
$x_{2},x_{5}$, using $g_{1},g_{2}$ and $h_{1},h_{2}$ instead of $f_{1},f_{2}$
respectively.

###### Proof.

We proof the case for $x_{1},x_{5}$, and the rest are done similarly.

Let’s start with the vector $(x_{1},x_{2},x_{3},x_{4},x_{5},x_{6})$ and apply
the steps of the encription map. After the first linear map $L_{1}$, we get a
vector formed by stacking the three vectors
$L_{11}\left(\begin{array}[]{c}x_{1}\\\ x_{2}\end{array}\right)$,
$L_{12}\left(\begin{array}[]{c}x_{3}\\\ x_{4}\end{array}\right)$ and
$L_{13}\left(\begin{array}[]{c}x_{5}\\\ x_{6}\end{array}\right)$. The elements
of $\mathbb{F}_{q^{2}}$ that correspond to these vectors are
$x_{1}l_{11}+x_{2}l_{12}$, $x_{3}l_{21}+x_{4}l_{22}$ and
$x_{5}l_{31}+x_{6}l_{32}$ respectively.

After applying the exponential maps that corresponds to $E$,we have the
vectors corresponding to

  * 1.

$(x_{1}l_{11}+x_{2}l_{12})^{E_{11}}(x_{3}l_{21}+x_{4}l_{22})^{E_{12}}$

  * 2.

$(x_{1}l_{11}+x_{2}l_{12})^{E_{21}}(x_{5}l_{31}+x_{6}l_{32})^{E_{23}}$

  * 3.

$(x_{3}l_{21}+x_{4}l_{22})^{E_{32}}(x_{5}l_{31}+x_{6}l_{32})^{E_{33}}$

In the expansion of those expressions, there all terms involve variables that
are not $x_{1}$ or $x_{5}$ except the in the second one, where there is the
term $x_{1}^{E_{21}}x_{5}^{E_{23}}{l_{11}}^{E_{21}}{l_{31}}^{E_{23}}$. That
is, the vector in $\mathbb{F}_{q}^{6}$ that we get at this stage is

$\left(\begin{array}[]{c}\bullet\bullet\bullet\\\ \bullet\bullet\bullet\\\
\bullet\bullet\bullet+f_{1}x_{1}^{E_{21}}x_{5}^{E_{23}}\\\
\bullet\bullet\bullet+f_{2}x_{1}^{E_{21}}x_{5}^{E_{23}}\\\
\bullet\bullet\bullet\\\ \bullet\bullet\bullet\end{array}\right)$

where the $\bullet\bullet\bullet$ symbols represent sums of terms that don’t
involve only the variables $x_{1}$ and $x_{5}$.

After applying $L_{2}$, we get

$\left(\begin{array}[]{c}\bullet\bullet\bullet+f_{1}x_{1}^{E_{21}}x_{5}^{E_{23}}\\\
\bullet\bullet\bullet\\\ \bullet\bullet\bullet\\\
\bullet\bullet\bullet+f_{2}x_{1}^{E_{21}}x_{5}^{E_{23}}\\\
\bullet\bullet\bullet\\\ \bullet\bullet\bullet\end{array}\right).$

Expressed as a vector in $\mathbb{F}_{q^{3}}^{2}$, this is

$\left(\begin{array}[]{c}\bullet\bullet\bullet+f_{1}x_{1}^{E_{21}}x_{5}^{E_{23}}\\\
\bullet\bullet\bullet+f_{2}x_{1}^{E_{21}}x_{5}^{E_{23}}\\\
\end{array}\right),$

where again,the $\bullet\bullet\bullet$ symbols represent a sum of terms that
don’t involve only $x_{1}$ and $x_{5}$, but this time with coefficients in
$\mathbb{F}_{q^{3}}$, but notice that the coefficients that only involve
$x_{1}$ and $x_{5}$ are actually elements of $\mathbb{F}_{q}$.

Now, applying the exponentiation corresponding to $F$, we get the vector in
$\mathbb{F}_{q^{3}}^{2}$

$\left(\begin{array}[]{c}\bullet\bullet\bullet+f_{1}^{F_{11}}f_{2}^{F_{12}}(x_{1}^{E_{21}}x_{5}^{E_{23}})^{F_{11}+F_{12}}\\\
\bullet\bullet\bullet+f_{1}^{F_{21}}f_{2}^{F_{22}}(x_{1}^{E_{21}}x_{5}^{E_{23}})^{F_{21}+F_{22}}\\\
\end{array}\right),$

which corresponds to the vector in $\mathbb{F}_{q}^{6}$

$\left(\begin{array}[]{c}\bullet\bullet\bullet+f_{1}^{F_{11}}f_{2}^{F_{12}}(x_{1}^{E_{21}}x_{5}^{E_{23}})^{F_{11}+F_{12}}\\\
\bullet\bullet\bullet\\\ \bullet\bullet\bullet\\\
\bullet\bullet\bullet+f_{1}^{F_{21}}f_{2}^{F_{22}}(x_{1}^{E_{21}}x_{5}^{E_{23}})^{F_{21}+F_{22}}\\\
\bullet\bullet\bullet\\\ \bullet\bullet\bullet\end{array}\right).$

Now, applying $L_{3}$ we get:

$\left(\begin{array}[]{c}\bullet\bullet\bullet+f_{1}^{F_{11}}f_{2}^{F_{12}}(x_{1}^{E_{21}}x_{5}^{E_{23}})^{F_{11}+F_{12}}\eta_{1}\\\
\bullet\bullet\bullet+f_{1}^{F_{11}}f_{2}^{F_{12}}(x_{1}^{E_{21}}x_{5}^{E_{23}})^{F_{11}+F_{12}}\eta_{2}\\\
\bullet\bullet\bullet+f_{1}^{F_{11}}f_{2}^{F_{12}}(x_{1}^{E_{21}}x_{5}^{E_{23}})^{F_{11}+F_{12}}\eta_{3}\\\
\bullet\bullet\bullet+f_{1}^{F_{21}}f_{2}^{F_{22}}(x_{1}^{E_{21}}x_{5}^{E_{23}})^{F_{21}+F_{22}}\eta_{4}\\\
\bullet\bullet\bullet+f_{1}^{F_{21}}f_{2}^{F_{22}}(x_{1}^{E_{21}}x_{5}^{E_{23}})^{F_{21}+F_{22}}\eta_{5}\\\
\bullet\bullet\bullet+f_{1}^{F_{21}}f_{2}^{F_{22}}(x_{1}^{E_{21}}x_{5}^{E_{23}})^{F_{21}+F_{22}}\eta_{6}\\\
\end{array}\right).$

∎

##  5 Recovering the coefficients of $L_{1}$

Now we see how to recover the coefficients of $L_{1}$ from the public key.

Assume $c\neq 0$ (otherwise, we can detect the case because there are no terms
involving only $x_{1},x_{6}$ in the public key; we can apply a linear change
of variables to fall into this case).

From the previous section, we know the following column vectors

$\left(\begin{array}[]{c}c^{F_{12}}\eta_{1}\\\ c^{F_{12}}\eta_{2}\\\
c^{F_{12}}\eta_{3}\\\ c^{F_{22}}\eta_{4}\\\ c^{F_{22}}\eta_{5}\\\
c^{F_{22}}\eta_{6}\end{array}\right),\left(\begin{array}[]{c}f_{1}^{F_{11}}f_{2}^{F_{12}}\eta_{1}\\\
f_{1}^{F_{11}}f_{2}^{F_{12}}\eta_{2}\\\
f_{1}^{F_{11}}f_{2}^{F_{12}}\eta_{3}\\\
f_{1}^{F_{21}}f_{2}^{F_{22}}\eta_{4}\\\
f_{1}^{F_{21}}f_{2}^{F_{22}}\eta_{5}\\\
f_{1}^{F_{21}}f_{2}^{F_{22}}\eta_{6}\end{array}\right),\left(\begin{array}[]{c}g_{1}^{F_{11}}g_{2}^{F_{12}}\eta_{1}\\\
g_{1}^{F_{11}}g_{2}^{F_{12}}\eta_{2}\\\
g_{1}^{F_{11}}g_{2}^{F_{12}}\eta_{3}\\\
g_{1}^{F_{21}}g_{2}^{F_{22}}\eta_{4}\\\
g_{1}^{F_{21}}g_{2}^{F_{22}}\eta_{5}\\\
g_{1}^{F_{21}}g_{2}^{F_{22}}\eta_{6}\end{array}\right),\left(\begin{array}[]{c}h_{1}^{F_{11}}h_{2}^{F_{12}}\eta_{1}\\\
h_{1}^{F_{11}}h_{2}^{F_{12}}\eta_{2}\\\
h_{1}^{F_{11}}h_{2}^{F_{12}}\eta_{3}\\\
h_{1}^{F_{21}}h_{2}^{F_{22}}\eta_{4}\\\
h_{1}^{F_{21}}h_{2}^{F_{22}}\eta_{5}\\\
h_{1}^{F_{21}}h_{2}^{F_{22}}\eta_{6}\end{array}\right).$

Taking quotients between them we an eliminate the $\eta_{i}$, and hence we can
know the values of $f_{1}^{F_{11}}\left(\frac{f_{2}}{c}\right)^{F_{12}}$ and
$f_{1}^{F_{21}}\left(\frac{f_{2}}{c}\right)^{F_{22}}$.

Since the exponentiation map is invertible, these two values allow us to
recover $f_{1}$ and $\frac{f_{2}}{c}$. Analogously, we can also recover
$g_{1}$, $\frac{g_{2}}{c}$, $h_{1}$ and $\frac{h_{2}}{c}$.

Let’s denote $f_{2}^{\prime}:=\frac{f_{2}}{c}$,
$g_{2}^{\prime}:=\frac{g_{2}}{c}$ and $h_{2}^{\prime}:=\frac{h_{2}}{c}$.

Now we have the equations

$\begin{array}[]{rcccl}f_{1}+cf_{2}^{\prime}T&=&f_{1}+f_{2}T&=&{l_{11}}^{E_{21}}{l_{31}}^{E_{23}}\\\
g_{1}+cg_{2}^{\prime}T&=&g_{1}+g_{2}T&=&{l_{11}}^{E_{21}}(1+cT)\\\
h_{1}+ch_{2}^{\prime}T&=&h_{1}+h_{2}T&=&{l_{31}}^{E_{23}}\end{array}$

So
$(f_{1}+cf_{2}^{\prime}T)(1+cT)=(g_{1}+cg_{2}^{\prime}T)(h_{1}+ch_{2}^{\prime}T)$.
In this expression the only unknown is $c$. This is an equation in
$\mathbb{F}_{q^{2}}$ that translates into two cuadratic equations in
$\mathbb{F}_{q}$ on $c$, that must have at least one common nonzero solution.
Note that one of them has no constant term, so one of its solution is zero.
That is, we can determine $c$ completely.

With the value of $c$, we also get $f_{2}$, $g_{2}$ and $h_{2}$. So we have
${l_{31}}^{E_{23}}=h_{1}+h_{2}T$. Raising to the inverse of $E_{23}$ modulo
${q^{2}}-1$, we recover $l_{31}$. We can also compute
${l_{11}}^{E_{21}}=\frac{f_{1}+f_{2}T}{h_{1}+h_{2}T}$ and hence ${l_{11}}$.
Moreover, from $1+cT$ we can recover $a,b$ such that $(a+bT)^{E_{23}}=1+cT$,
and hence, we have completely recovered the matrices $L_{11}$ and $L_{13}$.

Since we have $c$ and $c^{F_{12}}\eta_{i}$, we can also compute $\eta_{i}$.

Sumarizing, we have proved the following:

######  Theorem 1.

Given a valid public key, there exists a corresponding private key of the
form:

$L_{11}=\left(\begin{array}[]{cc}*&1\\\
{*}&0\end{array}\right),L_{12}=\left(\begin{array}[]{cc}?&1\\\
?&0\end{array}\right),L_{13}=\left(\begin{array}[]{cc}*&*\\\
{*}&*\end{array}\right),$ $L_{21}=\left(\begin{array}[]{ccc}?&?&1\\\ ?&?&0\\\
?&?&0\end{array}\right),L_{22}=\left(\begin{array}[]{ccc}1&?&?\\\ 0&?&?\\\
0&?&?\end{array}\right)$ $L_{31}=\left(\begin{array}[]{ccc}*&?&?\\\ {*}&?&?\\\
{*}&?&?\end{array}\right),L_{32}=\left(\begin{array}[]{ccc}*&?&?\\\ {*}&?&?\\\
{*}&?&?\end{array}\right)$

where the coefficients marked as $*$ can be efficiently computed from the
public key.

Notice that, if we could find the two missing coefficients of $L_{12}$, we
would be able to precompose the map with the inverse of $L_{1}$, and then with
the inverse of $E$, leaving us with a map consisting only on a known matrix
exponentiation map composed on both sides with two (partially) unknown linear
maps.

##  6 Recovering $L_{2}$ and $L_{3}$

With the previous steps, we would only need to find two missing coefficients
of $L_{12}$ to reduce the problem to attacking a weaker variant of the scheme,
with the following structure in the case $3,2$:

${\mathbb{F}_{q}^{6}}$${\mathbb{F}_{q}^{6}}$${\mathbb{F}_{q}^{6}}$${\mathbb{F}_{q}^{6}}$${\mathbb{F}_{q^{3}}^{2}}$${\mathbb{F}_{q^{2}}^{n}}$$\scriptstyle{L_{2}}$$\scriptstyle{\cong}$$\scriptstyle{{F}}$$\scriptstyle{\cong}$$\scriptstyle{L_{3}}$

In this section, we see how to recover the entries of $L_{3}$ (and then,
trivially we get $L_{2}$ assuming only that we know the total composition map,
and the entries of $F$.

Now, denote by $\zeta_{1},\zeta_{2},\zeta_{3}$ the columns of $L_{21}$,
interpreted as elements of $\mathbb{F}_{q^{3}}$, and by
$\zeta_{4},\zeta_{5},\zeta_{6}$ the columns of $L_{22}$. Analogously, the
columns of $L_{31}^{-1}$ and $L_{32}^{-1}$ will be denoted as
$\vartheta_{1},\vartheta_{2},\vartheta_{3}$ and
$\vartheta_{4},\vartheta_{5},\vartheta_{6}$ respectively. Note that, by the
same kind of arguments used in Section 3, we can assume that
$\vartheta_{3}=\vartheta_{6}=1$.

If we apply $L_{2}$ to the vector $(1,0,0,1,0,0)$ we get a column vector of
the form

$\left(\begin{array}[]{c}\zeta_{1}\\\ \zeta 4\end{array}\right)$

where $\zeta_{1}$ and $\zeta_{4}$ are considered now as a vector with three
coordinates.

Its image by $F$ is

$\left(\begin{array}[]{c}\zeta_{1}^{F_{11}}\zeta_{4}^{F_{12}}\\\
\zeta_{1}^{F_{21}}\zeta 4^{F_{22}}\end{array}\right)$

And the final aplication of $L_{3}$ gives a vector
$(z^{14}_{1},\ldots,z^{14}_{6})$, that is known (since it is just the result
of the full map to the starting vector). Applying the inverse of $L_{3}$, we
get that

$\begin{array}[]{rcl}\zeta_{1}^{F_{11}}\zeta_{4}^{F_{12}}&=&z^{14}_{1}\vartheta_{1}+z^{14}_{2}\vartheta_{2}+z^{14}_{3}\\\
\zeta_{1}^{F_{21}}\zeta_{4}^{F_{22}}&=&z^{14}_{4}\vartheta_{4}+z^{14}_{5}\vartheta_{5}+z^{14}_{6}\end{array}$

Analogously, if we start with the vectors $(1,0,0,0,1,0)$,
$(1,0,0,0,0,1)$,$(0,1,0,1,0,0)$, $(0,1,0,0,1,0)$, $(0,0,1,1,0,0)$,
$(0,0,1,0,1,0)$ and $(0,0,1,0,0,1)$ and apply the same reasoning, we get the
equations:

$\begin{array}[]{rcl}\zeta_{1}^{F_{11}}\zeta_{5}^{F_{12}}&=&z^{15}_{1}\vartheta_{1}+z^{15}_{2}\vartheta_{2}+z^{15}_{3}\\\
\zeta_{1}^{F_{21}}\zeta_{5}^{F_{22}}&=&z^{15}_{4}\vartheta_{4}+z^{15}_{5}\vartheta_{5}+z^{15}_{6}\\\
\zeta_{1}^{F_{11}}\zeta_{6}^{F_{12}}&=&z^{16}_{1}\vartheta_{1}+z^{16}_{2}\vartheta_{2}+z^{16}_{3}\\\
\zeta_{1}^{F_{21}}\zeta_{6}^{F_{22}}&=&z^{16}_{4}\vartheta_{4}+z^{16}_{5}\vartheta_{5}+z^{16}_{6}\\\
\zeta_{2}^{F_{11}}\zeta_{4}^{F_{12}}&=&z^{24}_{1}\vartheta_{1}+z^{24}_{2}\vartheta_{2}+z^{24}_{3}\\\
\zeta_{2}^{F_{21}}\zeta_{4}^{F_{22}}&=&z^{24}_{4}\vartheta_{4}+z^{24}_{5}\vartheta_{5}+z^{24}_{6}\\\
\zeta_{2}^{F_{11}}\zeta_{5}^{F_{12}}&=&z^{25}_{1}\vartheta_{1}+z^{25}_{2}\vartheta_{2}+z^{25}_{3}\\\
\zeta_{2}^{F_{21}}\zeta_{5}^{F_{22}}&=&z^{25}_{4}\vartheta_{4}+z^{25}_{5}\vartheta_{5}+z^{25}_{6}\\\
\zeta_{2}^{F_{11}}\zeta_{6}^{F_{12}}&=&z^{26}_{1}\vartheta_{1}+z^{26}_{2}\vartheta_{2}+z^{26}_{3}\\\
\zeta_{2}^{F_{21}}\zeta_{6}^{F_{22}}&=&z^{26}_{4}\vartheta_{4}+z^{26}_{5}\vartheta_{5}+z^{26}_{6}\\\
\zeta_{3}^{F_{11}}\zeta_{4}^{F_{12}}&=&z^{34}_{1}\vartheta_{1}+z^{34}_{2}\vartheta_{2}+z^{34}_{3}\\\
\zeta_{3}^{F_{21}}\zeta_{4}^{F_{22}}&=&z^{34}_{4}\vartheta_{4}+z^{34}_{5}\vartheta_{5}+z^{34}_{6}\\\
\zeta_{3}^{F_{11}}\zeta_{5}^{F_{12}}&=&z^{35}_{1}\vartheta_{1}+z^{35}_{2}\vartheta_{2}+z^{35}_{3}\\\
\zeta_{3}^{F_{21}}\zeta_{5}^{F_{22}}&=&z^{35}_{4}\vartheta_{4}+z^{35}_{5}\vartheta_{5}+z^{35}_{6}\\\
\zeta_{3}^{F_{11}}\zeta_{6}^{F_{12}}&=&z^{36}_{1}\vartheta_{1}+z^{36}_{2}\vartheta_{2}+z^{36}_{3}\\\
\zeta_{3}^{F_{21}}\zeta_{6}^{F_{22}}&=&z^{36}_{4}\vartheta_{4}+z^{36}_{5}\vartheta_{5}+z^{36}_{6}\\\
\end{array}$

where the $z^{(ij)}_{k}$ are known values of $\mathbb{F}_{q}$, and the
$\zeta_{i}$ and $\vartheta_{j}$ are unknown elements of $\mathbb{F}_{q^{3}}$.
The same system of equations could be obtained by following track of the
coefficients in the polynomial expression, instead of evaluating in particular
values (both results would be equivalent).

What we need to do now is to solve this system of equations, for which we know
that some solution exists. Moreover, we know that
$(\zeta_{1},\zeta_{2},\zeta_{3})$ are $\mathbb{F}_{q}$-lineally independent,
and so are $(\zeta_{4},\zeta_{5},\zeta_{6})$,
$(\vartheta_{1},\vartheta_{2},\vartheta_{3})$ and
$(\vartheta_{4},\vartheta_{5},\vartheta_{6})$. In particular, none of those
elements is zero.

Doing some basic elimination of the $\zeta_{i}$ variables, we get some simpler
subsystems of equations, for example,

$\begin{array}[]{c}(z^{14}_{1}\vartheta_{1}+z^{14}_{2}\vartheta_{2}+z^{14}_{3})(z^{25}_{1}\vartheta_{1}+z^{25}_{2}\vartheta_{2}+z^{25}_{3})=(z^{15}_{1}\vartheta_{1}+z^{15}_{2}\vartheta_{2}+z^{15}_{3})(z^{24}_{1}\vartheta_{1}+z^{24}_{2}\vartheta_{2}+z^{24}_{3})\\\
(z^{14}_{1}\vartheta_{1}+z^{14}_{2}\vartheta_{2}+z^{14}_{3})(z^{26}_{1}\vartheta_{1}+z^{26}_{2}\vartheta_{2}+z^{26}_{3})=(z^{16}_{1}\vartheta_{1}+z^{16}_{2}\vartheta_{2}+z^{16}_{3})(z^{24}_{1}\vartheta_{1}+z^{24}_{2}\vartheta_{2}+z^{24}_{3})\end{array}$

which is a system of two cuadratic equations in the variables
$\vartheta_{1},\vartheta_{2}$. It can be easily solved by taking a resultant
(which is a degree $4$ polynomial in just one variable) and then factoring it
over $\mathbb{F}_{q^{3}}$. We will get at least one solution (since we know
that one solution must exist) and at most four possible ones.

Note that there are more possible systems of two cuadratic equations on the
same variables, so the whole system is overdetermined. We can use that to
discard some of the four possible solutions.

Analogously, we can solve for $\vartheta_{4},\vartheta_{5}$. Then, solving for
$\zeta_{1},\ldots\zeta_{6}$ can be done just by applying the inverse of $F$.

Once we get all the values $\vartheta_{i}$ and $\zeta_{j}$, we have
effectively recovered the private key.

##  7 Conclusion

We have presented a structural attack to the DME cryptosystem with parameters
$(3,2,q)$, that is able to recover the full private key from the public key
and two extra elements of $\mathbb{F}_{q}$ that deppend on the private key. An
exhaustive search gives an upper bound of $q^{2}$ to the security level. In
particular, for the DME $(3,2,2^{48})$ version submitted to the NIST, this
bound gives at most 96 bits of security, far less than the required $256$
bits.

The attack only uses a very small fraction of the information contained in the
public key. So we suspect that a deeper analysis could provide a better method
than the exhaustive search for the full recovery of the private key.

Further research would be needed to determine if other choices of parameters
are vulnerable to similar attacks.

## References

  * [1] https://csrc.nist.gov/Projects/post-quantum-cryptography/Round-1-Submissions (accessed: Feb. 25, 2020)
  * [2] https://csrc.nist.gov/CSRC/media/Projects/Post-Quantum-Cryptography/documents/round-1/official-comments/DME-official-comment.pdf (accessed: Feb. 25, 2020)
  * [3] https://groups.google.com/a/list.nist.gov/forum/#!searchin/pqc-forum/dme|sort:date/pqc-forum/pR-O1CjHBtY/dkPKlJWrBwAJ (accessed: Feb. 25, 2020)
  * [4] https://docs.google.com/viewer?a=v&pid=forums&srcid=MDMyODM2NjQwOTk0MTgyNTI4NzgBMTI1OTE5ODU2NjgwODA3MTI1MzQBZGtQS2xKV3JCd0FKATAuMgFsaXN0Lm5pc3QuZ292AXYy&authuser=0 (accessed: Feb. 25, 2020)


# Differential Chaos Shift Keying-based Wireless Power Transfer

###### Abstract

In this work, we investigate differential chaos shift keying (DCSK), a
communication-based waveform, in the context of wireless power transfer (WPT).
Particularly, we present a DCSK-based WPT architecture, that employs an analog
correlator at the receiver in order to boost the energy harvesting (EH)
performance. By taking into account the nonlinearities of the EH process, we
derive closed-form analytical expressions for the peak-to-average-power-ratio
of the received signal as well as the harvested power. Nontrivial design
insights are provided, where it is shown how the parameters of the transmitted
waveform affects the EH performance. Furthermore, it is demonstrated that the
employment of a correlator at the receiver achieves significant EH gains in
DCSK-based WPT systems.

Index Terms—  Differential chaos shift keying, wireless power transfer,
nonlinear energy harvesting.

##  1 Introduction

According to Ericsson, the wireless traffic is expected to increase more than
five times between $2019$ and $2025$ [1]. For applications such as massive
machine-type communications, where a large number of devices are deployed,
powering or charging becomes critical as well as costly. Hence, low-powered
and self-sustainable next generation wireless communication networks is an
important and relevant topic of research. In this context, based on the
advances made in recent years, wireless power transfer (WPT) can be considered
as a suitable candidate, where the devices are wirelessly powered by
harvesting energy from ambient/dedicated radio-frequency (RF) signals [2].
This is achieved by employing a rectifying antenna (rectenna) at the receiver
that converts the received RF signals to direct current (DC).

The design of efficient WPT architectures fundamentally relies on accurate
mathematical models for the energy harvesting (EH) circuit. The work in [2]
proposes a realistic nonlinear model of the EH circuit, which depends on the
circuit characteristics and also enables the design of excitation waveforms
that maximize the WPT efficiency. This model has triggered interests in the
area of wireless power waveform design, with an objective of maximizing the
RF-to-DC conversion efficiency. The authors in [3] show that the nonlinearity
of the rectification process at the EH circuit causes certain waveforms, with
high peak-to-average-power-ratio (PAPR) to provide higher output DC power,
compared to conventional constant-envelop sinusoidal signals. Based on this
observation, there are some works, which investigate the effect of the
transmitted symbols and modulation techniques on WPT. By considering the
nonlinear EH model proposed in [2], the authors in [4] investigate the use of
multisine waveforms for WPT due to their high PAPR. The work in [5] proposes a
simultaneous wireless information and power transfer (SWIPT) architecture
based on the superposition of multi-carrier unmodulated and modulated
waveforms at the transmitter. Apart from the multisine waveforms, experimental
studies demonstrate that due to their high PAPR, chaotic waveforms outperform
conventional single-tone signals in terms of WPT efficiency [6].

Due to its properties such as sensitivity to initial data and aperiodicity,
chaotic waveforms have been extensively used in the past to improve the
performance of wireless communication systems. In this context, the non-
coherent modulation technique of differential chaos shift keying (DCSK) is one
of the most widely studied chaotic signal-based communication system [7]. The
majority of the related works focus on the error performance of such systems
for various scenarios. To exploit the benefits of both DCSK and WPT, there are
few works in the literature that investigate SWIPT in a chaotic framework,
e.g. [8, 9, 10]. In [8], a short-reference DCSK-based SWIPT architecture is
proposed to achieve higher data rate than the conventional system. A chaotic
multi-carrier system is investigated in a SWIPT framework via the sub-carrier
index to reduce the energy consumption [9]. In [10], adaptive link selection
for buffer-aided relaying is investigated in a DCSK-SWIPT architecture, where
two link-selection schemes based on harvested energy are proposed.

However, the above studies consider a simplified linear model for the EH, and
as a result, they are independent of the circuit characteristics as well as
the design of excitation waveforms [2]. Motivated by this, in this paper, we
present a DCSK-based WPT architecture by taking into account the
nonlinearities of the EH process. Specifically, the contribution of this work
is three fold. Firstly, we propose a novel WPT architecture, where an analog
correlator is employed at the receiver in order to boost the EH performance.
Secondly, the flexibility of the proposed architecture is demonstrated, as the
correlator can control the PAPR of the received signal at the harvester.
Finally, analytical expressions of PAPR and the harvested DC are derived for
both cases, i.e. with and without the correlator. The analytical framework
provides a convenient methodology for obtaining nontrivial insights into how
key parameters affect the performance.

##  2 A Chaotic Signal-based WPT System Architecture

###  2.1 System model

Fig. 1: Proposed architecture for DCSK-based WPT.

We consider a point-to-point WPT set-up, where the transmitter employs a DCSK
generator and the receiver consists of an analog correlator, followed by an EH
circuit, as shown in Fig. 1. Note that, DCSK signals, until now, have been
mainly considered for information transfer. However, here we focus on the WPT
aspect and ignore the information side of the signal. Furthermore, the
decoding of these signals can be found in [7, 8, 10]. We assume that the
received power is proportional to $r^{-\alpha}$, where $r$ is the transmitter-
receiver (Tx-Rx) distance and $\alpha$ denotes the path-loss exponent.
Moreover, a Rayleigh distributed flat fading channel $h$ is considered with
unit mean power, i.e. $f_{|h|}(\gamma)=2\gamma e^{-\gamma^{2}},$ $\forall$
$\gamma\geq 0.$

By considering a circuit-based nonlinear model of the harvester circuit, the
output DC current is approximated in terms of the input signal $y(t)$ as [2]

$z_{\text{DC}}=k_{2}R_{ant}\mathbb{E}\\{|y(t)|^{2}\\}+k_{4}R_{ant}^{2}\mathbb{E}\\{|y(t)|^{4}\\},$
(1)

which is a monotonically increasing function of the DC component of the
current at the rectifier output and the parameters $k_{2},k_{4},$ and
$R_{ant}$ are constants determined by the characteristics of the circuit.

###  2.2 Chaotic signals

Each DCSK symbol is represented by two consecutive chaotic signal components;
the first one serves as the reference, while the second carries the data $\pm
1$. The $l$-th transmitted DCSK symbol is characterized by a sequence of
$2\beta$, $\beta>0$, samples of the chaotic basis signal, in which the $k$-th
bit is given by [7]

$\displaystyle
s_{l,k}=\begin{cases}x_{k},&k=2(l-1)\beta+1,\dots,(2l-1)\beta,\\\
d_{l}x_{k-\beta},&k=(2l-1)\beta+1,\dots,2l\beta,\end{cases}$ (2)

where $d_{l}=\pm 1$ is the $l$-th information bit, and $x_{k}$ is the chaotic
basis signal. As $2\beta$ chaotic samples are being used to spread each
information bit, $\beta$ is defined as the spreading factor. Thus, the overall
$l$-th transmitted symbol at time $t$ is
${\bf{s}}_{l}(t)=[s_{l,1}(t),s_{l,2}(t),\cdots,s_{l,2\beta}(t)]$. Due to its
good correlation properties, we consider the Chebyshev chaotic map of degree
$\xi$, where the invariant probability density function (PDF) of $x_{k}$,
namely $f_{X}(x)$ is [7]

$\displaystyle f_{X}(x)=\begin{cases}\frac{1}{\pi\sqrt{1-x^{2}}},&|x|<1,\\\
0,&\text{otherwise}.\end{cases}$ (3)

###  2.3 Analog correlator

The proposed WPT architecture employs an analog correlator, followed by an EH
rectifier circuit. An analog correlator essentially consists of a series of
$(\psi-1)$ delay blocks, where $\psi$ is a positive integer; the rationale
behind this application is that, the signal can be effectively integrated over
a certain time interval [11]. Thus, an ideal $\psi$-bit analog correlator
provides an output signal $y(t)=h\int_{\nu=-\psi
T}^{0}{\bf{s}}_{l}(t-\nu)d\nu$ where $h$ is the channel coefficient, $T$ is
the bit period, and ${\bf{s}}_{l}(t)$ is the chaotic input signal [11]. In
what follows, for the sake of simplicity, we will consider $\psi$ equal to the
transmitted DCSK symbol length, i.e. $\psi=2\beta$. Hence, the correlator
output $y_{l}(t)$ for the $l$-th transmitted symbol ${\bf{s}}_{l}(t)$ is

$y_{l}(t)=\sqrt{P_{t}}h\sum\limits_{k=1}^{2\beta}s_{l,k}(t),$ (4)

where $P_{t}$ is the transmission power. Note that $\psi=1$ corresponds to the
conventional case without a correlator. We state the following proposition,
that refers to the effect of the analog correlator on the signal’s PAPR.

######  Proposition 1.

The signal PAPR at the harvester input is

$\displaystyle\mathrm{PAPR}=\begin{cases}2,&\text{without
correlator}\>\>(\psi=1),\\\ 4\beta,&\text{with
correlator}\>\>(\psi=2\beta).\end{cases}$ (5)

###### Proof.

See Appendix A. ∎

From Proposition 1, we observe that the correlator can control the value of
PAPR through the design parameter $\psi$. Also, since high PAPR signals are
desirable for WPT [3], the correlator can significantly enhance the EH
performance of the DCSK signals.

##  3 Chaotic Signal-based
Wireless Power Transfer

In this section, we investigate the effect of the DCSK waveform on the WPT
performance. Specifically, we evaluate $z_{\text{DC}}$ for both cases
with/without the correlator. For the sake of simplicity, we will use
$\rho_{1}=k_{2}R_{ant}P_{t}$ and $\rho_{2}=k_{4}R_{ant}^{2}P_{t}^{2}$. Hence,
from (1) and (4), the harvested DC with a correlator is

$z_{\text{C}}=\\!r^{-\alpha}\rho_{1}\mathbb{E}\left\\{\\!\left(|h|\sum\limits_{k=1}^{2\beta}s_{k}\right)^{\\!2}\right\\}+r^{-2\alpha}\rho_{2}\mathbb{E}\left\\{\\!\left(|h|\sum\limits_{k=1}^{2\beta}s_{k}\right)^{\\!4}\right\\},\quad$
(6)

and for the case without a correlator is

$z_{\text{NC}}=\\!r^{-\alpha}\rho_{1}\mathbb{E}\left\\{|h|^{2}\sum\limits_{k=1}^{2\beta}s_{k}^{2}\right\\}+r^{-2\alpha}\rho_{2}\mathbb{E}\left\\{|h|^{4}\sum\limits_{k=1}^{2\beta}s_{k}^{4}\right\\},$
(7)

where the expectation is taken over $h$ and $s_{k}$.

We now state the following two theorems, which provide closed-form expressions
for $z_{\text{C}}$ and $z_{\text{NC}}$.

######  Theorem 1.

When a correlator is employed, the harvested DC is

$\displaystyle
z_{\text{C}}=\begin{cases}r^{-\alpha}\rho_{1}+6r^{-2\alpha}\rho_{2},&\beta=1,\\\
r^{-\alpha}\rho_{1}\beta+12r^{-2\alpha}\rho_{2}\beta^{2},&\beta>1.\end{cases}$
(8)

###### Proof.

See Appendix B. ∎

Next, we consider the case of a WPT receiver without the analog correlator,
which is given by the following theorem.

######  Theorem 2.

When a correlator is not employed, the harvested DC is given by

$z_{\text{NC}}=r^{-\alpha}\rho_{1}\beta+\frac{3}{2}r^{-2\alpha}\rho_{2}\beta.$
(9)

###### Proof.

See Appendix C. ∎

From Theorems 1 and 2, we observe that $z_{\text{C}}$ and $z_{\text{NC}}$ is a
quadratic and linear function of $\beta$, respectively. Therefore, for fixed
$r$, $\rho_{1}$ and $\rho_{2}$, we have $z_{\text{C}}>z_{\text{NC}}$,
$\forall$ $\beta$. This clearly demonstrates the impact of the correlator on
the WPT performance. Also, note that if a linear EH model is used, i.e. only
the second order term of (1) is considered, both are equivalent.

Now, with a slight abuse of notation, let $r_{\rm C}$ and $r_{\rm NC}$ be the
Tx-Rx distances for $z_{\rm C}$ and $z_{\rm NC}$, respectively. We can show
that $z_{\rm C}\geq z_{\rm NC}$, even when $r_{\rm C}>r_{\rm NC}$. To achieve
this, $\beta$ needs to satisfy

$\beta>\frac{\rho_{1}\left(r_{\text{NC}}^{-\alpha}-r_{\text{C}}^{-\alpha}\right)+1.5\rho_{2}r_{\text{NC}}^{-2\alpha}}{12\rho_{2}r_{\text{C}}^{-2\alpha}},$
(10)

which can be easily derived from (8) and (9).

Next, we compare the proposed architecture with the existing multisine
waveform based EH framework [4]. We know from [4], that the achieved EH
performance when an $N$-tone multisine waveform is used, results in a
$z_{\text{DC}}$ whose linear term is independent of $N$ and the nonlinear term
is linearly dependent on $N$. Furthermore, for a given bandwidth, the number
of tones in a multisine waveform cannot be decided arbitrarily. A large $N$
implies very small inter-tone spacing, which results in low output DC voltage
at the harvester. On the other hand, a too small $N$ suggests infinitely large
inter-tone spacing, i.e. most of the signal gets filtered out by the low pass
filter at the harvester. Hence, multisine waveforms can enhance the WPT
performance only if an optimum inter-tone spacing is selected, and
experimentally it is observed that we have $N<10$ [12]. In the case of DCSK-
based waveforms, as observed from Theorem $1$, the linear and nonlinear terms
of $z_{\text{C}}$ are proportional to $\beta$ and $\beta^{2}$, respectively;
also, we usually have $\beta\gg 1$ [8]. Hence, the WPT performance of the
proposed DCSK-based WPT architecture is significantly greater than the
multisine waveform-based EH.

##  4 Numerical Results

We consider a transmission power $P_{t}=30$ dBm and path-loss exponent
$\alpha=4$. The parameters considered for the WPT model are
$k_{2}=0.0034,k_{4}=0.3829,$ and $R_{ant}=50$ $\Omega$ [4]. Recall that,
$\psi=2\beta$ and $\psi=1$ correspond to a WPT receiver with and without the
analog correlator, respectively.

Fig. 2 demonstrates the performance of the proposed DCSK-based WPT
architecture in terms of harvested DC, where we observe a significant
improvement. Although the analytical expressions for $z_{\text{DC}}$, when
$\beta>1$, are central limit theorem (CLT)-based, we observe that the
theoretical results match very closely with the simulation results. The
significant gain in WPT performance with the correlator is related to the high
PAPR, which is a function of the spreading factor $\beta$, as stated in
Proposition 1. Moreover, we note that, with/without the correlator at the
receiver, the harvested DC with Tx-Rx distance $30$ m is less compared to the
harvested DC with Tx-Rx distance $20$ m; this is intuitive due to the path-
loss factor. Finally, we also observe that $z_{\text{C}}$ with Tx-Rx distance
of $30$ m outperforms $z_{\text{NC}}$ with a smaller Tx-Rx distance of $20$ m
when we have $\beta>52$. This observation matches the lower bound proposed in
(10), which results in $\beta>52$ for the considered set of system parameters.

Fig. 2: Effect of spreading factor on $z_{\text{DC}}$; lines correspond to
analysis and markers correspond to simulation results.

##  5 Conclusion

In this work, we investigate DCSK-based WPT, by taking into account the
nonlinearities of the EH process. Specifically, we use a communication-based
waveform for the purpose of WPT and also propose a new analog correlator-aided
WPT receiver. By considering a Rayleigh fading scenario, we derive analytical
expressions of the harvested DC for both cases, i.e. with and without the
correlator. Our results show the significant gains that can be achieved by our
proposed approach. A promising extension of this work is to investigate this
design framework in the context of SWIPT.

##  6 Appendix A: Proof of Proposition 1

Without a correlator at the receiver, i.e. for $\psi=1$, the PAPR
corresponding to $l$-th transmitted symbol is

$\mathrm{PAPR}=\frac{\max\limits_{l}\left\\{\sum\limits_{k=2(l-1)\beta+1}^{2l\beta}|h_{l}|^{2}s_{l,k}^{2}\right\\}}{\mathbb{E}\left\\{\sum\limits_{k=2(l-1)\beta+1}^{2l\beta}|h_{l}|^{2}s_{l,k}^{2}\right\\}}.$
(11)

By considering a channel instance $h_{l}$ and the PDF of $x_{k}$ from (3), we
obtain
$\max\limits_{l}\left\\{\sum\limits_{k=2(l-1)\beta+1}^{2l\beta}|h_{l}|^{2}s_{l,k}^{2}\right\\}=2|h_{l}|^{2}\beta$
and

$\mathbb{E}\left\\{\sum\limits_{k=2(l-1)\beta+1}^{2l\beta}|h_{l}|^{2}s_{l,k}^{2}\right\\}=|h_{l}|^{2}\\!\\!\\!\\!\sum\limits_{k=2(l-1)\beta+1}^{2l\beta}\mathbb{E}\\{s_{l,k}^{2}\\}=|h_{l}|^{2}\beta.$
(12)

Hence, for $\psi=1$, we have $\rm
PAPR=\frac{2|h_{l}|^{2}\beta}{|h_{l}|^{2}\beta}=2$. On the other hand, for
$\psi=2\beta$, i.e. with a correlator, we have

$\mathrm{PAPR}=\frac{\max\limits_{l}\left\\{\left(\sum\limits_{k=2(l-1)\beta+1}^{2l\beta}|h_{l}|s_{l,k}\right)^{2}\right\\}}{\mathbb{E}\left\\{\left(\sum\limits_{k=2(l-1)\beta+1}^{2l\beta}|h_{l}|s_{l,k}\right)^{2}\right\\}},$
(13)

where from (3), we have
$\max\limits_{l}\left\\{\sum\limits_{k=2(l-1)\beta+1}^{2l\beta}|h_{l}|s_{l,k}\right\\}^{2}=4|h_{l}|^{2}\beta^{2}$.
Note that for chaotic sequences generated by the Chebyshev map, we have
$\mathbb{E}[s_{l,i}s_{l,j}]=0$ for $i\neq j$ [13, Eq. 55]. As such,
$\mathbb{E}\left\\{\left(\sum\limits_{k=2(l-1)\beta+1}^{2l\beta}|h_{l}|s_{l,k}\right)^{2}\right\\}=|h_{l}|^{2}\beta,$
which follows from (12). Hence, we have
$\mathrm{PAPR}=\frac{4|h_{l}|^{2}\beta^{2}}{|h_{l}|^{2}\beta}=4\beta$.

##  7 Appendix B: Proof of Theorem 1

The quantity $|h|\sum\limits_{k=1}^{2\beta}s_{k}$ in (6) can be alternatively
written as

$s=|h|\sum\limits_{k=1}^{2\beta}s_{k}=|h|\sum\limits_{k=1}^{2\beta}x_{k}=|h|(1+d)\sum\limits_{k=1}^{\beta}x_{k}.$
(14)

By assuming equally likely transmission of $d=\pm 1$ and if we consider
$a=1+d$, it results in the PDF $f_{A}(a)=\frac{1}{2},$ $a\in\\{0,2\\}$. Hence,
$s$ can be written as a product of random variables, i.e. $S=|h|AV$, where we
have $V=\sum\limits_{k=1}^{\beta}X_{k}$, i.e. the PDF $f_{V}(v)$ is the
$(\beta-1)$-fold convolution of $f_{X}(x)$ [14]. As a closed-form expression
cannot be obtained for $f_{V}(v)$ with any arbitrary $\beta$, we obtain an
analytical expression of $f_{S}(s)$ for $\beta=1$ and a well-approximated CLT-
based expression of $f_{S}(s)$ for $\beta>1$, respectively.

###  7.1 Case $\beta=1$

For $\beta=1,$ we have $s=|h|(1+d)x_{1}$. Therefore the cumulative
distribution function of $s$ conditioned on $h$ is

$\displaystyle F_{S|H}(s|h)$
$\displaystyle=\sum\limits_{i=0,2}\text{Pr}(AX<s|A=i,h)\text{Pr}(A=i)$
$\displaystyle=\frac{1}{2}\left[\frac{1}{\pi}\sin^{-1}\left(\frac{s}{2|h|}\right)+\frac{1}{2}+\mathbf{1}_{[0,\infty)}\left(\frac{s}{|h|}\right)\right].$
(15)

As a result, the pdf of $s$ conditioned on $h$ is obtained as
$f_{S}(s|h)=\frac{\partial F_{S|H}(s|h)}{\partial
s}=\frac{1}{2\pi\sqrt{4|h|^{2}-s^{2}}}$. Accordingly we obtain $f_{S}(s)$ by
unconditioning on $h$, i.e.
$f_{S}(s)=\int\limits_{\frac{s}{2}}^{\infty}\frac{\alpha
e^{-\alpha^{2}}}{\pi\sqrt{4\alpha^{2}-s^{2}}}d\alpha=\frac{e^{-\frac{s^{2}}{4}}}{4\sqrt{\pi}}.$
Based on (6), we need the PDFs corresponding to $S^{2}=Z$ and $S^{4}=P$. The
CDF of $Z$ is obtained as $F_{Z}(z)=\mathbb{P}(-\sqrt{z}\leq
S\leq\sqrt{z})=F_{S}(\sqrt{z})-F_{S}(-\sqrt{z})$, which results in the PDF
$f_{Z}(z)=\frac{\partial F_{Z}(z)}{\partial z}=\frac{1}{4\sqrt{\pi
z}}e^{-\frac{z}{4}}$. As $Z$ is non-negative in nature, the CDF of $P$ is
$F_{P}(p)=\mathbb{P}(Z^{2}\leq p)=\mathbb{P}(Z\leq\sqrt{p})=F_{Z}(\sqrt{p})$,
i.e.

$f_{P}(p)=\frac{\partial F_{P}(p)}{\partial
p}=\frac{1}{2\sqrt{p}}f_{Z}(\sqrt{p})=\frac{1}{8\sqrt{\pi}p^{3/4}}e^{-\frac{\sqrt{p}}{4}}.$
(16)

Hence, we obtain $z_{\text{C}}$ as

$z_{\text{C}}=r^{-\alpha}\rho_{1}\mathbb{E}[Z]+r^{-2\alpha}\rho_{2}\mathbb{E}[P]=r^{-\alpha}\rho_{1}+6r^{-2\alpha}\rho_{2}.$
(17)

###  7.2 Case $\beta>1$

We first perform a CLT-based characterization of
$\left\\{|h|\sum\limits_{k=1}^{2\beta}x_{k}\right\\}^{2}$ and
$\left\\{|h|\sum\limits_{k=1}^{2\beta}x_{k}\right\\}^{4},$ followed by
deriving an approximate closed-form expression of $z_{\text{C}}$. We know that
$s=|h|(1+d)\sum\limits_{k=1}^{\beta}x_{k},$ where for a sufficiently large
$\beta$, CLT states that $v=\sum\limits_{k=1}^{\beta}x_{k}$ will follow a
Gaussian distribution with mean $\mu=\beta\mathbb{E}[X]$ and variance
$\sigma^{2}=\beta\text{Var}[X]$, where $\mathbb{E}[X]=0$ and
$\text{Var}[X]=\frac{1}{2}.$ Hence, we have
$V\sim\mathcal{N}\left(0,\frac{\beta}{2}\right)$ and by following a similar
methodology as in the $\beta=1$ case, we derive the CDF of $S$

$F_{S|H}(s|h)=\frac{1}{2}\left[\frac{1}{2}\left(1+\text{erf}\left[\frac{s}{2|h|\sqrt{\beta}}\right]\right)+\mathbf{1}_{[0,\infty)}\left(\frac{s}{|h|}\right)\right].$
(18)

By differentiating (18), we obtain
$f_{S|H}(s|h)=\frac{1}{4|h|\sqrt{\pi\beta}}e^{-\frac{s^{2}}{4|h|^{2}\beta}},$
which by unconditioning on $h$ yields
$f_{S}(s)=\frac{1}{4\sqrt{\beta}}e^{-\sqrt{\frac{s^{2}}{\beta}}}$. Now we
obtain the pdf of $s^{2}(=z)$ and $s^{4}(=p)$ as
$f_{Z}(z)=\frac{1}{4\sqrt{\beta z}}e^{-\sqrt{\frac{z}{\beta}}}$ and
$f_{P}(p)=\frac{1}{8\sqrt{\beta}p^{\frac{3}{4}}}e^{-\sqrt{\frac{\sqrt{p}}{\beta}}}$
respectively. Hence

$z_{\text{C}}=r^{-\alpha}\rho_{1}\mathbb{E}[Z]+r^{-2\alpha}\rho_{2}\mathbb{E}[P]=r^{-\alpha}\rho_{1}\beta+12r^{-2\alpha}\rho_{2}\beta^{2}.$
(19)

It is interesting to observe that although we have obtained a CLT-based
analytical expression, the approximation error is always less than $5\%$
irrespective of the value of $\beta.$

##  8 Appendix C: Proof of Theorem 2

The proof follows steps similar with the analysis in Theorem 1, i.e.
separately considering the cases of $\beta=1$ and $\beta>1$.

###  8.1 Case $\beta=1$

Let $Y=X^{2}$, where $X$ follows the PDF as stated in (3). Hence, we obtain
$F_{Y}(y)=\mathbb{P}(X^{2}\leq y)=\mathbb{P}(-\sqrt{y}\leq
X\leq\sqrt{y})=F_{X}(\sqrt{y})-F_{X}(-\sqrt{y})$ and so the PDF is given by

$f_{Y}(y)=\frac{1}{2\sqrt{y}}\left[f_{X}(\sqrt{y})+f_{X}(-\sqrt{y})\right]=\frac{1}{\pi\sqrt{y(1-y)}}.$
(20)

Thus, the PDF of $\Delta=\sum\limits_{k=1}^{2\beta}x_{k}^{2}$ corresponding to
$\beta=1$ is equal to
$f_{\Delta}(\delta)=\frac{1}{2}f_{Y}\left(\frac{\delta}{2}\right)=\frac{1}{\pi\sqrt{\delta(2-\delta)}}$.
We obtain the PDF of $|h|^{2}\Delta$ as
$f_{\Delta|H}(\delta|h)=\frac{1}{|h|^{2}}f_{\Delta}\left(\frac{\delta}{|h|^{2}}\right)=\frac{1}{\pi\sqrt{\delta(2|h|^{2}-\delta)}}$,
which results in
$f_{\Delta}(\delta)=\int\limits_{0}^{\infty}\frac{e^{-\alpha}}{\pi\sqrt{\delta(2\alpha-\delta)}}d\alpha=\frac{1}{\sqrt{2\pi\delta}}e^{-\frac{\delta}{2}}.$

Next, we require the PDF of $|h|^{4}\Theta$, where
$\Theta=\sum\limits_{k=1}^{2\beta}x_{k}^{4}$ and from (20), the PDF of
$Y=X^{2}$ is $f_{Y}(y)=\frac{1}{\pi\sqrt{y(1-y)}}$. Hence, we obtain the CDF
of $G=Y^{2}$ as $F_{G}(g)=\mathbb{P}(Y^{2}\leq g)=\mathbb{P}(0\leq
Y\leq\sqrt{g})=F_{Y}(\sqrt{g})$, i.e. the PDF $f_{G}(g)$ is

$f_{G}(g)=\frac{\partial F_{G}(g)}{\partial
g}=\frac{1}{2\sqrt{g}}f_{Y}(\sqrt{g})=\frac{1}{2\pi\sqrt{g^{3/2}(1-\sqrt{g})}}.$
(21)

Therefore, the PDF of $\Theta$ is obtained by standard transformation of
random variables as
$f_{\Theta}(\theta)=\frac{1}{2^{5/4}\pi\sqrt{1-\sqrt{\frac{\theta}{2}}}\theta^{3/4}}$,
which results in the PDF of
$|h|^{4}\Theta=|h|^{4}\sum\limits_{k=1}^{2\beta}x_{k}^{4}$ as
$f_{\Theta|H}(\theta|h)=\frac{1}{|h|^{4}}f_{\Theta}\left(\frac{\theta}{|h|^{4}}\right)=\frac{1}{2\pi\sqrt{\theta^{3/2}(\sqrt{2}|h|^{2}-\sqrt{\theta})}}.$
By unconditioning on $|h|$, we obtain
$f_{\Theta}(\theta)=\frac{1}{2^{\frac{5}{4}}\sqrt{\pi}\theta^{\frac{3}{4}}}e^{-\sqrt{\frac{\theta}{2}}}$.
Hence, we obtain

$z_{\text{NC}}=r^{-\alpha}\rho_{1}\mathbb{E}[\Delta]+r^{-2\alpha}\rho_{2}\mathbb{E}[\Theta]=r^{-\alpha}\rho_{1}+\frac{3}{2}r^{-2\alpha}\rho_{2}.$
(22)

###  8.2 Case $\beta>1$

As the proof can be obtained by following a similar procedure as described in
Appendix B, i.e. we follow a CLT-based approach, the detailed derivation has
been omitted due to space limitation. Finally, by combining the two cases of
$\beta=1$ and $\beta>1$,we obtain
$z_{\text{NC}}=r^{-\alpha}\rho_{1}\beta+\frac{3}{2}r^{-2\alpha}\rho_{2}\beta,$
$\forall$ $\beta.$

## References

  * [1] Ericsson Mobility Report, June 2020,  [Online]. Available: https://www.ericsson.com/en/mobility-report/reports/june-2020.

  * [2] B. Clerckx, R. Zhang, R. Schober, D. W. K. Ng, D. I. Kim, and H. V. Poor,  “Fundamentals of wireless information and power transfer: From RF energy harvester models to signal and system designs,”  IEEE J. Sel. Areas Commun., vol. 37, no. 1, pp. 4–33, Jan. 2019\.
  * [3] D. I. Kim, J. H. Moon, and J. J. Park,  “New SWIPT using PAPR: How it works,”  IEEE Wireless Commun. Lett., vol. 5, no. 6, pp. 672–675, Dec. 2016\.
  * [4] B. Clerckx and E. Bayguzina,  “Waveform design for wireless power transfer,”  IEEE Trans. Signal Process., vol. 64, no. 23, pp. 6313–6328, Dec. 2016.
  * [5] B. Clerckx,  “Wireless information and power transfer: Nonlinearity, waveform design, and rate-energy tradeoff,”  IEEE Trans. Signal Process., vol. 66, no. 4, pp. 847–862, Feb. 2018\.
  * [6] A. Collado and A. Georgiadis,  “Improving wireless power transmission efficiency using chaotic waveforms,”  in Proc. IEEE Int. Microw. Symp. Dig., Montreal, QC, Canada, Aug. 2012, pp. 1–3.
  * [7] F. C. M. Lau, C. K. Tse, Ming Ye, and S. F. Hau,  “Coexistence of chaos-based and conventional digital communication systems of equal bit rate,”  IEEE Trans. Circuits Syst. I, Reg. Papers, vol. 51, no. 2, pp. 391–408, Apr. 2004.
  * [8] G. Kaddoum, H. Tran, L. Kong, and M. Atallah,  “Design of simultaneous wireless information and power transfer scheme for short reference DCSK communication systems,”  IEEE Trans. Commun., vol. 65, no. 1, pp. 431–443, Jan. 2017.
  * [9] G. Cheng, W. Xu, C. Chen, and L. Wang,  “SWIPT schemes for carrier index differential chaos shift keying modulation: A new look at the inactive carriers,”  IEEE Trans. Veh. Technol., vol. 68, no. 3, pp. 2557–2570, Mar. 2019\.
  * [10] M. Qian, G. Cai, Y. Fang, and G. Han,  “Design of link-selection strategies for buffer-aided DCSK-SWIPT relay system,”  IEEE Trans. Commun., vol. 68, no. 10, pp. 6023–6038, Oct. 2020\.
  * [11] V. Mangal and P. R. Kinget,  “Clockless, continuous-time analog correlator using time-encoded signal processing demonstrating asynchronous CDMA for wake-up receivers,”  IEEE J. Solid-State Circuits, vol. 55, no. 8, pp. 2069–2081, Aug. 2020.
  * [12] N. Pan, D. Belo, M. Rajabi, D. Schreurs, N. B. Carvalho, and S. Pollin,  “Bandwidth analysis of RF-DC converters under multisine excitation,”  IEEE Trans. Microw. Theory Techn., vol. 66, no. 2, pp. 791–802, Feb. 2018.
  * [13] W. M. Tam, F. C. M. Lau, C. K. Tse, and A. J. Lawrance,  “Exact analytical bit error rates for multiple access chaos-based communication systems,”  IEEE Trans. Circuits Syst., II, Exp. Briefs, vol. 51, no. 9, pp. 473–481, Sep. 2004.
  * [14] Athanasios Papoulis and S. Unnikrishna Pillai,  Probability, Random Variables, and Stochastic Processes,  McGraw-Hill Higher Education, 2002.