The error coefficient of a linear code is defined as the number of minimum-weight codewords. In an additive white Gaussian noise channel, optimal linear codes with the smallest error coefficients achieve the best possible asymptotic frame error rate (AFER) among all optimal linear codes under maximum likelihood decoding. Such codes are referred to as AFER-optimal linear codes. The Griesmer bound is essential for determining the optimality of linear codes. However, establishing tight lower bounds on the error coefficients of Griesmer optimal linear codes is challenging, and the linear programming bound often performs inadequately. In this paper, we propose several iterative lower bounds for the error coefficients of Griesmer optimal linear codes. Specifically, for binary linear codes, our bounds are tight in most cases when the dimension does not exceed 5. To evaluate the performance of our bounds when they are not tight, we also determine the parameters of the remaining 5-dimensional AFER-optimal linear codes. Our final comparison demonstrates that even when our bounds are not tight, they remain very close to the actual values, with a gap of less than or equal to 2.

In this work, we present a low-depth flagged syndrome extraction strategy for Calderbank-Shor-Steane (CSS) codes of distance 3. We demonstrate that if one stabilizer generator of a distance-3 CSS code measured using the flagged circuit has and only has two distinct qubit supports with certain stabilizers of opposite types, then the number of stabilizers required for the second round of measurements can be reduced. The number of these stabilizers depends on the weight of the measured generator. This novel strategy utilizes past syndrome information and elements from the stabilizer group, enabling the implementation of a flag-FTEC protocol for distance-3 CSS codes with lower-depth syndrome extraction circuits compared to previously flag fault-tolerant protocol if the total weight of these stabilizers is less than that of stabilizer generators. Based on our strategy, we also improve the flag-FTEC protocol for cyclic CSS codes of distance 3, which requires fewer stabilizer measurements. We utilize the$[[{14,2,3}]]$CSS code,$[[{15,1,3}]]$quantum Reed-Muller code and$[[{15,7,3}]]$cyclic CSS code to demonstrate how the strategy operates. Furthermore, we also provide a low-depth flagged syndrome extraction strategy for a$[[{19,1,5}]]$CSS-type code.

The revelations about massive surveillance have created significant interest in algorithm substitution attack (ASA), where an honest implementation of a cryptographic primitive is replaced by a subverted one which can help “big brother" to break cryptographic security while generating output indistinguishable from the honest output. The current known ASAs on public-key cryptography are either dedicated for a type of concrete constructions with specific internal, or restrictive when applying to the real-word cryptographic standards (Ateniese et al., ACM CCS’15; Russell et al., ACM CCS’17; Chen et al., ASIACRYPT’20). In this paper, we first present a practical undetectable substitution for a general randomized algorithm with certain structure such that the randomness can be revealed to the big brother. Then, instantiating this randomized algorithm, we present a series of ASAs on core primitives in public-key cryptography including public-key encryption, key encapsulation mechanism, key exchange, and digital signature. In particular, our ASAs are universal in the sense that they do not rely on the internal description of the underlying cryptographic algorithm. Moreover, our ASAs are also practical since they can affect not only the widely deployed cryptographic standards, but also the ongoing NIST post-quantum standards.