A Closed-Form Hamming-Weight Variance Formula for Cyclic LCD Codes in Orthogonal Direct Sum Masking

Abstract

Orthogonal direct sum masking (ODSM) protects embedded cryptographic implementations against side-channel attacks by splitting the ambient space into a source code C carrying sensitive data and a complementary masking code D carrying fresh randomness; when $D=C^{\perp }$, C must be a linear complementary dual (LCD) code. Much of the literature evaluates the masking code primarily through the minimum distance $d\left(D^{\perp }\right)=d\left(C\right)$ of its dual, treating this parameter as the quantitative summary of leakage resistance under a Hamming-weight leakage model. We show, first computationally and then via a general algebraic theorem, that this one parameter does not determine the variance of the masking code’s Hamming-weight distribution: cyclic codes with identical $d\left(C\right)$ can differ by close to an order of magnitude in this variance. We prove, for an arbitrary cyclic code $C\subseteq \mathrm{GF}{\left(q\right)}^n$ with nonzero dual $D=C^{\perp }$ and defining set T (the LCD property is not required for this algebraic result and is invoked only for the ODSM application), a closed-form theorem expressing ${\mathrm{Var}}_{c\in D}\left[\mathrm{wt}\left(c\right)\right]$ exactly as $(q-1)n^2/\left(q^{2}L\left(T\right)\right)$, where $L\left(T\right)$ is an intrinsically defined, representative-independent arithmetic invariant of T, computable via a single least-common-multiple of greatest-common-divisors and requiring no exponential-sum or Gauss-period evaluation. We verify the formula, with an explicit worked example, reproducible from the displayed defining sets, and zero discrepancies, against 64 independently constructed LCD cyclic codes spanning two finite fields and three code lengths. We are explicit that this variance is a second-order algebraic descriptor of leakage dispersion under an idealized leakage model, not a complete side-channel security metric; the connection to physical Hamming-weight leakage is direct for $q=2$; for $q>2$, the result stands as an exact coding-theoretic characterization whose relevance to physical bit-level leakage depends on an explicit bit-encoding model not developed here. We discuss its role as a design diagnostic for ODSM masking codes. This paper is, at its core, a contribution to the algebraic theory of cyclic codes: the reduction of the variance to a weight-two-codeword count is the classical Pless moment identity, and our closed-form arithmetic characterization of that count via $L\left(T\right)$ is algebraically equivalent, on its domain, to a 2024 result of Coelho and Brochero Martínez; we extend it to arbitrary cyclic length and arbitrary prime-power base fields, and position it as a complement to, not a replacement for, the more operational dual-distance/kissing-number methodology already used in the code-based masking literature.

1. Introduction

Side-channel attacks exploit the statistical dependence between the physical behavior of a cryptographic implementation (its instantaneous power consumption, electromagnetic emission, or execution timing) and the secret data it processes. Differential and correlation power analysis (DPA/CPA) recover secret keys by correlating many such physical traces against hypotheses about intermediate computations, and they remain one of the most practical threats to embedded and smartcard implementations of otherwise mathematically sound ciphers. Masking is the standard algorithmic countermeasure: sensitive data is randomized before it ever touches the physical device, so that, under an idealized leakage model and correct implementation assumptions, low-order observations are intended to reveal no exploitable statistical dependence on the secret, and the dependence only reappears when an attacker combines information from multiple, ideally independent, shares.

Linear complementary dual (LCD) codes occupy a central role in one influential family of masking schemes. Introduced by Massey [1] as a solution to an information-theoretic coding problem unrelated to cryptography, an LCD code is a linear code whose intersection with its dual is trivial. Massey showed that LCD codes are asymptotically good and give an optimum solution to the two-user binary adder channel. Decades later, Carlet and Guilley [2] observed that this same algebraic property makes LCD codes ideal building blocks for masking countermeasures against side-channel and fault-injection attacks because the trivial intersection with the dual guarantees that source data and mask can be recovered unambiguously and securely combined. Bringer, Carlet, Chabanne, Guilley, and Maghrebi [3] formalized this into orthogonal direct sum masking (ODSM): the protected representation of a sensitive word $\overrightarrow{X}$ is $\overrightarrow{Z}=\overrightarrow{X}G+\overrightarrow{M}H$, where G generates a code C carrying the source data, H generates a complementary code D carrying a fresh random mask $\overrightarrow{M}$, and the direct-sum structure ${\mathbb{F}}_q^n=C\oplus D$ guarantees that $\overrightarrow{X}$ and $\overrightarrow{M}$ can be projected out unambiguously from $\overrightarrow{Z}$. When $D=C^{\perp }$, the direct-sum condition $C\oplus C^{\perp }={\mathbb{F}}_q^n$ is exactly the statement that C is LCD. The security intuition is standard: an attacker observing a physical leakage function of $\overrightarrow{Z}$ should learn as little as possible about $\overrightarrow{X}$. Two distinct leakage models are used in this literature, and we are precise about which one this paper adopts. The Hamming distance model takes leakage to be proportional to the number of bit transitions between two successive states of a data bus or register (the mechanism most directly tied to CMOS switching power); the Hamming weight model, which we adopt throughout, takes leakage to be proportional to the number of nonzero (set) bits of a single state, with no reference to a previous state. The two coincide, up to an additive constant, precisely when the bus or register is systematically precharged to the all-zero state before every new value is loaded (a common assumption for precharged buses and certain register-transfer-level designs), so that each transition is effectively a transition from zero; outside that implementation condition, Hamming distance leakage need not reduce to Hamming weight leakage, and our results should be read as applying to the Hamming-weight model specifically. This is achieved, in either model, by making $d\left(D^{\perp }\right)$ as large as possible, so that low-weight leakage differences cannot be attributed to any single bit of $\overrightarrow{X}$. Since $D=C^{\perp }$ throughout this paper, $d\left(D^{\perp }\right)=d\left(C^{\perp \perp }\right)=d\left(C\right)$: the classical “dual distance of the mask” referenced in the ODSM literature is, in our notation, simply $d\left(C\right)$, the minimum distance of the source code. We fix this convention precisely in Section 3 to avoid the ambiguity that can arise between $d\left(C\right)$, $d\left(D\right)$, and $d\left(D^{\perp }\right)$, three generally distinct quantities.

Much of the literature that followed has optimized distance parameters such as $d\left(C\right)$, $d\left(D\right)$, or $d\left(D^{\perp }\right)$, with little explicit analysis of higher moments. Carlet, Li, and Mesnager [4] constructed optimal pairs of linear codes maximizing $d\left(C\right)$ and $d\left(D^{\perp }\right)$ jointly subject to length and dimension constraints. A large and still very active line of work constructs explicit families of cyclic and constacyclic LCD codes: via Galois inner products [5,6], BCH-type defining sets of length $\lambda (q^m+1)$ [7,8], and algebraic-geometry or subspace codes [9,10]. Each new family is reported essentially by its $(n,k,d,d^{\perp })$ parameters. Even papers whose stated motivation is precisely side-channel resistance stop at this level: constructions of LCD codes from algebraic curves are explicitly justified as resistant to side-channel attacks, yet the quantitative verification of that resistance is left as declared future work rather than carried out.

This is the gap this paper addresses. The dual distance $d\left(D^{\perp }\right)=d\left(C\right)$ is a worst-case descriptor: it certifies that no single low-weight leakage event can occur, but it says nothing about the shape of the leakage distribution above that floor. Two masking codes with the same $d\left(C\right)$ can have weight distributions that look almost binomial (the behavior of a “generic” random code) or, instead, concentrate substantial probability mass on a handful of extreme weights far from the mean, a difference with direct consequences for the variance of any Hamming-weight leakage model built on top of the mask. We stress at the outset, and return to at length in Section 7 and Section 8, that this variance is a second-order algebraic descriptor of leakage dispersion under an idealized Hamming-weight leakage model. It should not be interpreted as a complete side-channel security metric: it does not by itself determine attack success probability, signal-to-noise ratio, mutual information, guessing entropy, or the number of traces an attacker would require, none of which are analyzed in this paper. What we show is narrower and, we believe, still useful: that this specific, well-defined algebraic quantity is not determined by $d\left(C\right)$ alone, and that it is determined exactly by a simple, new invariant of the cyclic code’s defining set, one that requires no character-sum or Gauss-period evaluation whatsoever. This stands in contrast to the classical literature on cyclic-code weight distributions, which reaches for exactly this machinery to determine full weight enumerators, a strictly harder target than the single moment we compute here.

Contributions. (1) We give a covariance decomposition for $\mathrm{wt}\left(D\right)$, $D=C^{\perp }$, valid for an arbitrary cyclic code C (the LCD property is not used in the algebraic derivation). (2) We characterize dependent coordinate pairs of D through an intrinsically defined subgroup of ${\mathbb{Z}}_n$ attached to the cyclotomic defining set of C and prove this characterization is independent of any choice of coset representatives. (3) We obtain a closed-form formula for ${\mathrm{Var}}_{c\in D}\left[\mathrm{wt}\left(c\right)\right]$ in terms of this invariant. (4) We prove that, while the LCD property leaves the numeric value of this invariant unchanged, it forces every dependent coordinate pair to be related by a sign ($\pm 1$) rather than a general nonzero scalar, precisely delimiting what LCD does and does not contribute to the result. (5) We verify the formula computationally, with an explicit worked example exhibiting the defining sets used, reproducible from the values displayed, on 64 independently constructed cyclic LCD codes, and give a concrete instance within the actively studied length-$\lambda (q^m+1)$ family. (6) We discuss the formula’s use, with appropriate caveats, as a second-order design diagnostic for ODSM masking codes.

The remainder of the paper is organized as follows. Section 2 reviews the four strands of the literature this work connects. Section 3 fixes notation and the source/mask distance convention. Section 4 states the non-degeneracy hypothesis used throughout. Section 5 states and proves the main algebraic results, separating the general cyclic-code statement from its LCD/ODSM application. Section 6 reports the computational verification with a reproducible worked example. Section 7 discusses design implications, with explicit caveats on the scope of the variance metric. Section 8 states limitations, and Section 9 concludes.

2. Literature Review

2.1. LCD Codes: Definition and Cyclic Characterization

An LCD code is a linear code $C\subseteq \mathrm{GF}{\left(q\right)}^n$ with $C\cap C^{\perp }=\left\{0\right\}$. Massey [1] introduced the class, proved the existence of asymptotically good LCD codes, and connected them to the two-user binary adder channel. Sendrier [11] later strengthened the existence result, showing LCD codes meet the Gilbert–Varshamov bound. For cyclic codes specifically, Yang and Massey [12] gave the classical characterization used throughout this paper: a cyclic code with defining set T is LCD if and only if T is closed under negation modulo the code length n. Equivalently, $C\cap C^{\perp }=\left\{0\right\}$ if and only if the Gram matrix $G{G}^{\mathsf{T}}$ of any generator matrix G of C is nonsingular over $\mathrm{GF}\left(q\right)$, a criterion that generalizes beyond the cyclic case and is the one we use computationally.

2.2. LCD Codes and Side-Channel Countermeasures

Carlet and Guilley [2] first connected LCD codes to countermeasures against side-channel and fault-injection attacks, giving explicit binary constructions. Bringer et al. [3] introduced orthogonal direct sum masking (ODSM), the concrete masking architecture this paper targets, and derived its security threshold in terms of $d\left(C\right)$ and $d\left(D\right)$. Carlet, Li, and Mesnager [4] then optimized pairs of codes jointly for these two parameters. This entire line treats $\left(d\right(C),d(D\left)\right)$ as the complete quantitative description of resistance; no paper in this line examines higher moments of the masking code’s weight distribution.

2.3. Cyclic and Constacyclic LCD Codes: Recent Constructions

Building on the Yang–Massey characterization, a substantial and currently very active literature constructs explicit families of cyclic and constacyclic LCD codes: Galois-LCD codes and their Hermitian-LCD MDS constacyclic subfamilies [5,6]; BCH-type LCD codes of length $\lambda (q^m+1)$, a construction under active development through 2026, with a complete enumeration of LCD cyclic codes of this length given very recently by Liu, Wu, and Zhu [7] and a detailed parameter study for the related family $(q^m+1)/\lambda$ published by Zhang [8]; and linear complementary pairs of algebraic-geometry and subspace codes [9,10]. These papers report parameters $(n,k,d,d^{\perp })$ and, where possible, optimality, but, consistent with the pattern noted above, do not examine the shape of the dual code’s weight distribution beyond its minimum. Section 6.4 gives a concrete instance of the length-$\lambda (q^m+1)$ family, showing what the variance formula of Theorem 1 adds beyond the $(n,k,d,d^{\perp })$ parameters already reported for such constructions.

2.4. Weight Distributions of Cyclic Codes via Exponential Sums

A separate and much older literature determines the full weight distribution of cyclic codes (primarily irreducible or few-zero cyclic codes) via evaluation of exponential sums, Gauss periods, and quadratic forms. Moisio [13] gave a general evaluation of a broad family of exponential sums, subsequently used by Vega [14] to characterize all semiprimitive irreducible cyclic codes by length and by Zhu, Shi, and Özbudak [15] to determine complete b-symbol weight distributions of certain irreducible cyclic codes. This machinery is powerful but heavy: determining a full weight enumerator for a cyclic code whose dual has more than two or three zeros remains, in general, a hard open problem tackled case-by-case. Our results show that the specific second moment (variance) needed for the diagnostic proposed here does not require this machinery at all, for cyclic codes with an arbitrary number of zeros.

2.5. Quantitative Confusion-Coefficient Metrics in S-Box Design

Independently, the S-box design literature quantifies DPA resistance via the confusion coefficient and its variance (CCV): de la Cruz Jiménez [16] and Picek et al. [17] studied the CCV property of S-boxes as a finer-grained resistance metric than worst-case nonlinearity measures. This is the kind of second-moment, variance-based diagnostic we import into the code-based masking setting; within the search described below, we did not find prior work applying a CCV-style variance analysis to the masking code of an ODSM scheme or connecting it to the cyclotomic-coset structure of a cyclic LCD code’s defining set.

Synthesis and search protocol. The literature review above, and the novelty claim it supports, rest on a targeted search rather than a systematic one, conducted through a general-purpose web search interface (not a single bibliographic database such as Scopus or Web of Science) in July 2026, using queries combining terms from {LCD codes, cyclic codes, orthogonal direct sum masking, code-based masking, dual distance, kissing number, weight distribution, cyclotomic coset, confusion coefficient variance} in pairs and triples, together with forward and backward citation chasing from the papers so identified (Section 7 documents one correction that resulted from this chasing after initial submission). No formal inclusion or exclusion criteria, database export, or PRISMA-style protocol were used, and no fixed cutoff date bounded the search beyond the time of writing. Within this search, we did not find published work at the intersection of Section 2.3 and Section 2.4 (algebraic machinery for cyclic-code weight structure) and Section 2.5 (a variance-based diagnostic); we state this as the outcome of the specific search described, not as a claim that no such work exists.

3. Notation and the Source/Mask Distance Convention

Throughout, q is a prime power and n a positive integer with $\gcd (n,q)=1$. Let m be the multiplicative order of q modulo n, and fix a primitive n-th root of unity $\zeta \in \mathrm{GF}\left(q^m\right)$. A cyclic code $C\subseteq \mathrm{GF}{\left(q\right)}^n$ of defining set $T\subseteq {\mathbb{Z}}_n$ (a union of q-cyclotomic cosets modulo n) is $C=\{c\left(x\right)\in \mathrm{GF}\left(q\right)\left[x\right]/(x^n-1):c\left({\zeta }^t\right)=0\forall t\in T\}$. We write $D:=C^{\perp }$, also cyclic, for the code used as the ODSM masking code when C is LCD.

We fix a single notational convention to avoid ambiguity: $d\left(C\right)$, $d\left(D\right)$, and $d\left(D^{\perp }\right)$ denote three a priori distinct quantities. Since $D=C^{\perp }$ and $C^{\perp \perp }=C$ for finite fields, we have the identity

$$d\left(D^{\perp }\right)=d\left(C\right).$$

The quantity the ODSM literature calls the “dual distance of the mask” is $d\left(D^{\perp }\right)$, which by this identity equals $d\left(C\right)$, the minimum distance of the source code, not a property of D in isolation. All theorems in Section 5 are stated in terms of $d\left(C\right)$, consistent with this identity; $d\left(D\right)$ itself (the mask’s own minimum distance, relevant to a different property, e.g., error detection in the mask) plays no role in our results and is not used.

Remark 1 

(Symbol-wise versus bit-level Hamming weight). Throughout this paper, $\mathrm{wt}\left(c\right)$ denotes the standard symbol-wise Hamming weight over $\mathrm{GF}\left(q\right)$: the number of nonzero coordinates of c, counting each nonzero symbol as 1 regardless of its value. This is the quantity Theorem 1 characterizes exactly. For $q=2$, this symbol-wise weight coincides exactly with the physical bit-transition weight that correlates with CMOS power consumption, so the variance formula bears directly on the Hamming-weight leakage model motivating ODSM. For $q>2$, this coincidence need not hold: if a field symbol is represented in hardware by a vector of bits (e.g., $\mathrm{GF}\left(3\right)$ elements $0,1,2$ encoded as $00,01,10$), the physical bit-level Hamming weight of a codeword depends on the specific bit-encoding of each symbol and is generally not equal to, nor an affine function of, the symbol-wise weight $\mathrm{wt}\left(c\right)$; for instance, under the encoding above, nonzero symbols 1 and 2 both contribute bit-weight 1, while our symbol-wise count treats them identically as contributing 1 regardless of encoding, but a different (equally natural) encoding could make them contribute differently, and the aggregate distribution over a full codeword depends on this choice in a way the present paper does not model. Consequently, for $q>2$, Theorem 1 should be read as an exact result about a coding-theoretic quantity of independent interest, whose direct relevance to physical Hamming-weight leakage requires an additional, explicit bit-encoding model that we do not develop here; the case $q=2$ remains the setting in which the connection to physical leakage is immediate. We return to this point in the Limitations.

4. Non-Degeneracy Hypothesis

The main results assume $D\ne \left\{0\right\}$ and use throughout that no coordinate of D is identically zero. We record this as a lemma rather than an unstated assumption.

Lemma 1 

(Non-degeneracy). Let $D\subseteq \mathrm{GF}{\left(q\right)}^n$ be a nonzero cyclic code. Then, for every $i\in \{0,\dots ,n-1\}$, the coordinate projection ${\pi }_i:D\to \mathrm{GF}\left(q\right)$, $c\mapsto c_i$, is surjective.

Proof. 

Suppose ${\pi }_i\equiv 0$ for some i, i.e., $c_i=0$ for every $c\in D$. Since D is cyclic, the cyclic shift $\sigma$ (sending $(c_0,\dots ,c_{n-1})$ to $(c_{n-1},c_0,\dots ,c_{n-2})$) maps D onto itself. For any $c\in D$, $\sigma \left(c\right)\in D$ as well, and ${\left(\sigma \left(c\right)\right)}_{i+1\mathrm{mod}n}=c_i=0$; since this holds for every $c\in D$ and $\sigma \left(D\right)=D$, we get ${\pi }_{i+1\mathrm{mod}n}\equiv 0$ as well. Iterating, ${\pi }_j\equiv 0$ for every j, i.e., every coordinate of every codeword is zero, so $D=\left\{0\right\}$, contradicting the hypothesis. Hence every ${\pi }_i$ is a nonzero $\mathrm{GF}\left(q\right)$-linear functional on D, hence surjective (its image is a nonzero $\mathrm{GF}\left(q\right)$-subspace of $\mathrm{GF}\left(q\right)$, i.e., all of $\mathrm{GF}\left(q\right)$).    □

In particular, each $X_i\left(c\right):=\mathbf{1}\{c_i\ne 0\}$ is a well-defined Bernoulli random variable with parameter $p=(q-1)/q$ when c is drawn uniformly from D, and $\mathrm{wt}\left(c\right)={\sum }_{i=0}^{n-1}{X}_i\left(c\right)$.

5. Main Results

We emphasize, per the discussion in Section 3, that the results in this section are stated for an arbitrary cyclic code C and its dual $D=C^{\perp }$; the LCD property of C is not used in their proofs. LCD enters only in Remark 3 below, where it licenses the ODSM interpretation of D as a masking code.

Lemma 2 

(Generic case). If $d\left(C\right)\ge 3$, then

$${\mathrm{Var}}_{c\in D}\left[\mathrm{wt}\left(c\right)\right]={\displaystyle \frac{n(q-1)}{q^2}}$$

exactly, independent of any other structural property of D.

Proof. 

Fix $i\ne j$ and let H be a generator matrix of D, with columns $h_0,\dots ,h_{n-1}\in \mathrm{GF}{\left(q\right)}^{k_D}$, $k_D=\dim D$, so that a codeword $c=mH\in D$ satisfies $c_i=m·h_i$ for the message $m\in \mathrm{GF}{\left(q\right)}^{k_D}$. If $h_i$ and $h_j$ were linearly dependent, there would exist $\alpha ,\beta \in \mathrm{GF}\left(q\right)$, not both zero, with $\alpha h_i+\beta h_j=0$; the vector v with $v_i=\alpha$, $v_j=\beta$, and zeros elsewhere then satisfies $v·\left(mH\right)=m·(\alpha h_i+\beta h_j)=0$ for every m, so $v\in D^{\perp }=C$ is a nonzero codeword of weight $\le 2$, contradicting $d\left(C\right)\ge 3$. Hence every pair of columns of H is linearly independent, so the map $m\mapsto (m·h_i,m·h_j)$ is a surjective linear map $\mathrm{GF}{\left(q\right)}^{k_D}\to \mathrm{GF}{\left(q\right)}^2$ with constant fiber size $q^{k_D-2}$: $(c_i,c_j)$ is uniform on $\mathrm{GF}{\left(q\right)}^2$ over $c\in D$. This gives $\mathrm{Cov}(X_i,X_j)=0$ for every pair $i\ne j$, so

$$\mathrm{Var}\left(\mathrm{wt}\left(c\right)\right)=\mathrm{Var}\left(\sum _i{X}_i\right)=\sum _i\mathrm{Var}\left(X_i\right)=n·{\displaystyle \frac{q-1}{q^2}},$$

by Lemma 1, since each $X_i$ is Bernoulli with parameter $(q-1)/q$.    □

Remark 2. 

This lemma is a reformulation of the classical fact that $d\left(C\right)\ge t+1$ if and only if $D=C^{\perp }$ is an orthogonal array of strength t [18]; we need only $t=2$. Its novelty here is not the fact itself but its application below (Theorem 1) to the full range $d\left(C\right)\le 2$, and, with appropriate caveats (Section 7), to ODSM masking-code design.

We now turn to the case $d\left(C\right)\le 2$, where Lemma 2 does not apply. The next lemma establishes, independently of any choice of coset representatives, that the relevant dependency structure is governed by a canonically defined subgroup of ${\mathbb{Z}}_n$; this addresses directly the representative-dependence concern that a definition through an arbitrarily chosen representative would otherwise leave open.

Lemma 3 

(Canonical dependency subgroup). Let $T\subseteq {\mathbb{Z}}_n$ be the defining set of C. Define

$\mathcal{D}\left(T\right):=\left\{d\in {\mathbb{Z}}_n:\exists \mu \in \mathrm{GF}{\left(q\right)}^{*}\mathit{such}\mathit{that}{\zeta }^{td}=\mu \mathit{for}\mathit{all}t\in T\right\}.$

Then $\mathcal{D}\left(T\right)$ is a subgroup of ${\mathbb{Z}}_n$. Consequently there is a unique divisor $L\left(T\right)$ of n with $\mathcal{D}\left(T\right)=⟨L\left(T\right)⟩=\{0,L(T),2L(T),\dots ,n-L(T\left)\right\}$.

Proof. 

$0\in \mathcal{D}\left(T\right)$ with witness $\mu =1$. If $d_1,d_2\in \mathcal{D}\left(T\right)$ with witnesses ${\mu }_1,{\mu }_2$, then ${\zeta }^{t(d_1+d_2)}={\zeta }^{t{d}_1}{\zeta }^{t{d}_2}={\mu }_1{\mu }_2$ for every $t\in T$, and ${\mu }_1{\mu }_2\in \mathrm{GF}{\left(q\right)}^{*}$ since $\mathrm{GF}{\left(q\right)}^{*}$ is a group; hence, $d_1+d_2\in \mathcal{D}\left(T\right)$. If $d\in \mathcal{D}\left(T\right)$ with witness $\mu$, then ${\zeta }^{t(-d)}={\mu }^{-1}\in \mathrm{GF}{\left(q\right)}^{*}$ for every $t\in T$, so $-d\in \mathcal{D}\left(T\right)$. Thus $\mathcal{D}\left(T\right)$ is closed under addition and inverses and contains 0: it is a subgroup of the cyclic group ${\mathbb{Z}}_n$. Every subgroup of ${\mathbb{Z}}_n$ has the form $⟨L⟩$ for a unique divisor L of n, giving the stated form.    □

The invariant $L\left(T\right)$ in Lemma 3 is defined purely in terms of T and involves no choice of representative; the following proposition shows it can nonetheless be computed via any choice of one representative per coset in T, which is what our verification algorithm (Section 6) uses.

Proposition 1 

(Computation of $L\left(T\right)$). Let $t_1,\dots ,t_s$ be any representatives of the cosets comprising T (one per coset, any choice). Then

$$L\left(T\right)=\mathrm{lcm}\left({\displaystyle \frac{n}{\gcd (n,t_1(q-1))}},{\displaystyle \frac{n}{\gcd (n,t_2-t_1)}},\dots ,{\displaystyle \frac{n}{\gcd (n,t_s-t_1)}}\right),$$

with the convention $n/\gcd (n,0)=1$, and this value is independent of the choice of $t_1,\dots ,t_s$.

Proof. 

Fix a base representative $t_1$. Within its coset $\{t_1,t_{1}q,t_1{q}^2,\dots \}$, the defining condition ${\zeta }^{td}=\mu$ (for the fixed witness $\mu$ of $d\in \mathcal{D}\left(T\right)$) applied at $t=t_1{q}^{\ell }$ gives ${\left({\zeta }^{t_{1}d}\right)}^{q^{\ell }}=\mu$ for every $\ell \ge 0$; taking $\ell =0$ gives $\mu ={\zeta }^{t_{1}d}$, and $\ell =1$ then forces ${\mu }^q=\mu$, i.e., $\mu \in \mathrm{GF}\left(q\right)$, equivalently ${\zeta }^{t_1(q-1)d}=1$, i.e., $n\mid t_1(q-1)d$. For each other representative $t_r$, the defining condition forces ${\zeta }^{t_{r}d}=\mu ={\zeta }^{t_{1}d}$, i.e., $n\mid (t_r-t_1)d$. Conversely, once d satisfies all these congruences, one checks by induction (using integer linear combinations, e.g., $t_r(q-1)d=t_1(q-1)d+(q-1)(t_r-t_1)d$) that ${\zeta }^{td}=\mu$ holds for every element of every coset in T with the same $\mu ={\zeta }^{t_{1}d}\in \mathrm{GF}{\left(q\right)}^{*}$; so $d\in \mathcal{D}\left(T\right)$ iff d is a common multiple of the listed moduli, i.e., a multiple of their lcm. By Lemma 3, $\mathcal{D}\left(T\right)=⟨L\left(T\right)⟩$ is intrinsic to T, so this lcm—computed from any valid choice of representatives—must equal $L\left(T\right)$ in every case, establishing representative-independence as a corollary of intrinsic well-definedness rather than as a separate combinatorial verification.    □

Lemma 4 

(Proportional columns and weight-two dual words). Let H be a generator matrix of $D=C^{\perp }$, with nonzero columns $h_0,\dots ,h_{n-1}$. For $i\ne j$, the columns $h_i,h_j$ are proportional over $\mathrm{GF}\left(q\right)$ if and only if $C=D^{\perp }$ contains a weight-two codeword with support exactly $\{i,j\}$.

Proof. 

Suppose $h_i,h_j$ are proportional. Since both columns are nonzero, there exist $\alpha ,\beta \in \mathrm{GF}{\left(q\right)}^{*}$ such that $\alpha h_i+\beta h_j=0$. Let $v\in \mathrm{GF}{\left(q\right)}^n$ have $v_i=\alpha$, $v_j=\beta$, and zeros elsewhere. For any $c=mH\in D$, $v·c=m·(\alpha h_i+\beta h_j)=0$, so $v\in D^{\perp }=C$; since $\alpha ,\beta \in \mathrm{GF}{\left(q\right)}^{*}$, v is a weight-two codeword of C with support exactly $\{i,j\}$. Conversely, if C contains a weight-two codeword v with support exactly $\{i,j\}$, write $v_i=\alpha$, $v_j=\beta$ (both in $\mathrm{GF}{\left(q\right)}^{*}$, and zero elsewhere); $v\in C=D^{\perp }$ means $v·c=0$ for every $c=mH\in D$, i.e., $m·(\alpha h_i+\beta h_j)=0$ for every $m\in \mathrm{GF}{\left(q\right)}^{k_D}$. Since H is a generator matrix, its rows are linearly independent, so H has full row rank and m ranges over the entire message space $\mathrm{GF}{\left(q\right)}^{k_D}$ as $c=mH$ ranges over D; in particular, the linear functional $m\mapsto m·(\alpha h_i+\beta h_j)$ vanishing on all of $\mathrm{GF}{\left(q\right)}^{k_D}$ forces $\alpha h_i+\beta h_j=0$, i.e., $h_i,h_j$ proportional.    □

Theorem 1 

(Closed-form variance formula). Let $C\subseteq \mathrm{GF}{\left(q\right)}^n$ be a cyclic code with defining set T, $D=C^{\perp }\ne \left\{0\right\}$, and $L\left(T\right)$ as in Lemma 3. Then

$${\mathrm{Var}}_{c\in D}\left[\mathrm{wt}\left(c\right)\right]={\displaystyle \frac{(q-1)n^2}{q^{2}L\left(T\right)}}$$

exactly.

Proof. 

By Lemma 4, columns $h_i,h_j$ of a generator matrix of D are proportional iff $C=D^{\perp }$ contains a weight-two word with support exactly $\{i,j\}$. A weight-two word with support exactly $\{i,j\}$, $d=i-j\mathrm{mod}n$, lies in C iff there exist $\alpha ,\beta \in \mathrm{GF}{\left(q\right)}^{*}$ with $\alpha {\zeta }^{ti}+\beta {\zeta }^{tj}=0$ for every $t\in T$, i.e., iff $d\in \mathcal{D}\left(T\right)$ (with witness $\mu =-\beta /\alpha$). By Lemma 3, the set of such d (excluding 0) is exactly the nonzero part of $⟨L\left(T\right)⟩$, of size $n/L\left(T\right)-1$. The n coordinates partition into $L\left(T\right)$ cosets of $⟨L\left(T\right)⟩$, each of size $n/L\left(T\right)$; by Lemma 4, two coordinates $i,j$ have dependent (proportional) columns $h_i,h_j$ iff $i-j\in \mathcal{D}\left(T\right)$, i.e., iff $i,j$ lie in the same coset of $⟨L\left(T\right)⟩$. The number of dependent pairs is therefore

$$N_{\mathrm{dep}}\left(T\right)=L\left(T\right)\left({\displaystyle \genfrac{}{}{0pt}{}{n/L\left(T\right)}{2}}\right)={\displaystyle \frac{n(n-L(T\left)\right)}{2L\left(T\right)}}.$$

As in Lemma 2, independent pairs contribute zero covariance, and each dependent pair contributes $\mathrm{Cov}(X_i,X_j)=\mathrm{Var}\left(X_i\right)=(q-1)/q^2$ (since $h_j=\lambda h_i$ for a fixed nonzero scalar $\lambda$ forces $X_i=X_j$ identically, by Lemma 1). Hence

$$\mathrm{Var}\left(\mathrm{wt}\left(c\right)\right)={\displaystyle \frac{n(q-1)}{q^2}}+2N_{\mathrm{dep}}\left(T\right)·{\displaystyle \frac{q-1}{q^2}}={\displaystyle \frac{q-1}{q^2}}\left[n+{\displaystyle \frac{n(n-L(T\left)\right)}{L\left(T\right)}}\right]={\displaystyle \frac{(q-1)n^2}{q^{2}L\left(T\right)}}. \square$$

Corollary 1 

(Domain of variation). If $0\in T$, choosing $t_1=0$ in Proposition 1 gives $n/\gcd (n,0)=1$ trivially, and $L\left(T\right)$ reduces to ${\mathrm{lcm}}_{t\in T\setminus \left\{0\right\}}(n/\gcd (n,t))$. If, moreover, $d\left(C\right)\ge 3$, then $L\left(T\right)=n$ and Theorem 1 reduces exactly to Lemma 2. At the opposite extreme, $T=\left\{0\right\}$ gives $L\left(T\right)=1$ (an empty lcm), C the single parity-check code, and D the q-ary repetition code $D=\left\{a\right(1,\dots ,1):a\in \mathrm{GF}(q\left)\right\}$ generated by the all-ones vector, for any q. Here $\mathrm{wt}\left(c\right)$ takes the value 0 with probability $1/q$ and n with probability $(q-1)/q$, giving $\mathrm{Var}\left(\mathrm{wt}\left(c\right)\right)=(q-1)n^2/q^2$ directly, matching the formula and the largest value it attains, a boundary case consistent with D being maximally structured (a single nonzero direction). Consequently, for a nonzero, proper cyclic code C, $L\left(T\right)$ (and hence $\mathrm{Var}\left(\mathrm{wt}\right(D\left)\right)$) can differ from the generic value $n(q-1)/q^2$ only when $d\left(C\right)=2$: whenever $d\left(C\right)\ge 3$, Lemma 2 forces $L\left(T\right)=n$ regardless of any other structural feature of T, so $L\left(T\right)$ cannot distinguish among ODSM candidates with $d\left(C\right)\ge 3$—it distinguishes only among candidates with $d\left(C\right)=2$. This delimitation is discussed further, together with its practical relevance, in Section 7.

The algebraic results above make no use of the LCD property: $L\left(T\right)$, and hence $\mathrm{Var}\left(\mathrm{wt}\right(D\left)\right)$, is determined by T alone, whether or not $T=-T$. This raises a natural question: does the LCD condition constrain the variance formula in any way, or does it play no algebraic role beyond licensing the ODSM interpretation of Remark 3? The next proposition shows that LCD leaves the numeric value of $L\left(T\right)$ unconstrained but does impose a genuine, previously unremarked structural restriction on how dependent coordinates are related.

Proposition 2 

(LCD restricts dependency type, not $L\left(T\right)$). Suppose $T=-T$ (i.e., C is LCD). Then for every $d\in \mathcal{D}\left(T\right)\setminus \left\{0\right\}$, the witness $\mu \in \mathrm{GF}{\left(q\right)}^{*}$ with ${\zeta }^{td}=\mu$ for all $t\in T$ satisfies ${\mu }^2=1$. Consequently, every pair of dependent coordinates $i,j$ (columns $h_i,h_j$ of a generator matrix of D) satisfies $h_j=\lambda h_i$ with $\lambda =\pm 1$: LCD forces every dependency in the masking code to be a pure sign relation, never a general nonzero scalar multiple, even though the numeric value of $L\left(T\right)$ itself (and hence $\mathrm{Var}\left(\mathrm{wt}\right(D\left)\right)$) is unaffected.

Proof. 

Fix $d\in \mathcal{D}\left(T\right)\setminus \left\{0\right\}$ with witness $\mu$, so ${\zeta }^{td}=\mu$ for every $t\in T$. Since $T=-T$, for every $t\in T$ we also have $-t\in T$, and the same single witness $\mu$ must satisfy ${\zeta }^{(-t)d}=\mu$ as well. But ${\zeta }^{(-t)d}={\left({\zeta }^{td}\right)}^{-1}={\mu }^{-1}$, so $\mu ={\mu }^{-1}$, i.e., ${\mu }^2=1$. From the proof of Lemma 4 and Theorem 1, the proportionality constant between dependent columns satisfies $\lambda ={\mu }^{-1}$ (the witness $\mu =-\beta /\alpha$ of the underlying weight-two codeword and the column relation $h_j=\lambda h_i=(-\alpha /\beta )h_i$ are reciprocal), so ${\lambda }^2={\left({\mu }^{-1}\right)}^2={\left({\mu }^2\right)}^{-1}=1$ as well.    □

For $q=2$, $\mathrm{GF}{\left(q\right)}^{*}=\left\{1\right\}$ and $\mu =\lambda =1$ automatically, so Proposition 2 is vacuous; the restriction is genuinely informative only for $q>2$, where $\mathrm{GF}{\left(q\right)}^{*}$ can have elements of order greater than 2. We verified this contrast computationally over $\mathrm{GF}\left(5\right)$, $n=16$: a non-LCD defining set $T=\{1,5,9,13\}$ (not closed under negation) has dependent-pair witnesses $\mu \in \{2,3,4\}$ as d ranges over the nonzero elements of $\mathcal{D}\left(T\right)$, with ${\mu }^2\ne 1$ for $d=4,12$; the LCD-symmetrized set $T^{\prime }=T\cup (-T)=\{1,3,5,7,9,11,13,15\}$ has a single dependent gap $d=8$ with witness $\mu =4=-1$, consistent with Proposition 2, while $L\left(T^{\prime }\right)=8\ne L\left(T\right)=4$ changes as a byproduct of enlarging the defining set, not because of the symmetry itself. This confirms both halves of the claim: symmetrizing T does not, by itself, preserve or fix $L\left(T\right)$’s numeric value, but whenever a d is dependent under an LCD-symmetric T, its witness is forced to $\pm 1$.

Remark 3 

(LCD/ODSM application). Theorem 1 places no requirement on C beyond being cyclic. If, in addition, C is LCD (equivalently, by Yang–Massey [12], T is closed under negation modulo n), then $C\oplus C^{\perp }={\mathbb{F}}_q^n$, and $D=C^{\perp }$ can serve as the masking code in an ODSM scheme with C as the source code. All computational examples in Section 6 are additionally restricted to LCD C for this reason, even though Theorem 1 itself does not require it.

Relation to the Pless Moment Identity and to Coelho–Brochero Martínez

We now position Theorem 1 precisely against two bodies of prior work, separating what is classical from what is new.

The classical part. For any nonzero, nondegenerate linear code $D\subseteq \mathrm{GF}{\left(q\right)}^n$ with $C=D^{\perp }$, the identity

$${\mathrm{Var}}_{c\in D}\left[\mathrm{wt}\left(c\right)\right]={\displaystyle \frac{n(q-1)+2A_2\left(C\right)}{q^2}}$$

follows directly from the Pless power moments relating the weight distribution of a code to that of its dual [18], where $A_2\left(C\right)$ denotes the number of weight-two codewords of C; it requires neither C nor D to be cyclic. Indeed, this identity is exactly what the covariance decomposition in the proof of Theorem 1 recovers: $A_2\left(C\right)=N_{\mathrm{dep}}\left(T\right)·(q-1)$ since each of the $N_{\mathrm{dep}}\left(T\right)$ dependent coordinate pairs contributes exactly $q-1$ weight-two codewords (one for each nonzero scalar $\alpha$ in the pair $v_i=\alpha$, $v_j=-\alpha /\lambda$). Substituting recovers $\mathrm{Var}\left(\mathrm{wt}\left(D\right)\right)=(q-1)[n+2N_{\mathrm{dep}}\left(T\right)]/q^2$, matching Theorem 1 exactly. The reduction of the variance computation to counting weight-two words of C is therefore classical, not new.

What Theorem 1 adds. The contribution is an exact, closed-form arithmetic formula for $A_2\left(C\right)$ (equivalently, for $L\left(T\right)$) in terms of the cyclotomic defining set T, valid for cyclic codes of arbitrary length n coprime to q and arbitrary prime-power q, together with the representative-independence result of Lemma 3 and the LCD-specific Proposition 2. This is where the present paper’s novelty is concentrated, and we delimit it further against the closest prior result below.

Coelho and Brochero Martínez (2024) [19] independently derive, for cyclic codes $C_{t_1,\dots ,t_s}$ of the special length $n=Q-1$ over a prime field $\mathrm{GF}\left(p\right)$ (where $Q=p^m$), a necessary and sufficient condition for $d\left(C\right)=2$ and an exact count

$$A_2={\displaystyle \frac{(p-1)(Q-1)\left(D(t_1,\dots ,t_s)-1\right)}{2}},D(t_1,\dots ,t_s):=\gcd \left(Q-1,t_1(p-1),t_2-t_1,\dots ,t_s-t_1\right).$$

This is algebraically equivalent to our formula on the domain where both apply. Writing $n=Q-1$ and $q=p$ to match our notation, the classical identity $\mathrm{lcm}(n/d_1,\dots ,n/d_s)=n/\gcd (d_1,\dots ,d_s)$ for divisors $d_i=\gcd (n,x_i)$ of n gives

$$L\left(T\right)=\mathrm{lcm}\left(\frac{n}{\gcd (n,x_1)},\dots ,\frac{n}{\gcd (n,x_s)}\right)={\displaystyle \frac{n}{\gcd (n,x_1,\dots ,x_s)}}={\displaystyle \frac{n}{D(t_1,\dots ,t_s)}},$$

where $x_1=t_1(q-1)$, $x_i=t_i-t_1$ ($i\ge 2$) are exactly the arguments of both $L\left(T\right)$ and $D(t_1,\dots ,t_s)$. Hence $D(t_1,\dots ,t_s)=n/L\left(T\right)$, and substituting into their $A_2$ formula gives $A_2=(q-1)n(n/L\left(T\right)-1)/2=(q-1)N_{\mathrm{dep}}\left(T\right)$, matching the relation above exactly. On the domain $n=Q-1$, q prime, our closed-form $L\left(T\right)$ and their $D(t_1,\dots ,t_s)$ are reciprocal reparametrizations of the same arithmetic quantity.

We flag plainly that every numerical example in this paper (Section 6.2, Section 6.3 and Section 6.4) falls inside this domain: $15=2^4-1$, $63=2^6-1$, and $26=3^3-1$ are all of the form $Q-1$ for a prime base field, and the length-20 example of Section 6.4 similarly reduces to it. What remains new relative to [19], and is not illustrated by these particular examples, is the extension to (i) arbitrary length n coprime to q, not restricted to $n=Q-1$ for the specific extension degree $m={\mathrm{ord}}_n\left(q\right)$, and (ii) arbitrary prime-power base fields q, not restricted to q prime. Both extensions follow from the same proof (Proposition 1), which never uses $n=Q-1$ or q prime, and we verify each concretely rather than merely asserting them. For the extension to $n\ne Q-1$: with $n=9$, $q=2$ (here ${\mathrm{ord}}_9\left(2\right)=6$, but $9\ne 2^6-1=63$, so $n=9$ is a proper divisor of $2^6-1$ and not of the form $Q-1$ addressed in [19]), the defining set $T=\left\{0\right\}\cup \{3,6\}$ gives an LCD code with $L\left(T\right)=3<9$ (so $d\left(C\right)=2$) and $\mathrm{Var}\left(\mathrm{wt}\right(D\left)\right)=6.75$, confirmed by direct brute-force enumeration of D. For the extension to non-prime q, which [19] excludes by construction (their base field is $\mathrm{GF}\left(p\right)$ for p prime): with $q=4$ and $n=9$ (so q itself is a prime power, not a prime, and $n\ne q^m-1$ for any m), factoring $x^9+1$ directly over $\mathrm{GF}\left(4\right)$ gives five irreducible factors of degrees $1,1,1,3,3$; taking the defining set $T=\left\{0\right\}\cup \left\{3\right\}\cup \left\{6\right\}$ (the three linear factors) gives an LCD code with $\dim C=6$, $\dim D=3$, $L\left(T\right)=3<9$ (so $d\left(C\right)=2$), and $\mathrm{Var}\left(\mathrm{wt}\right(D\left)\right)=5.0625$, again confirmed by direct brute-force enumeration of D. Both instances lie outside the domain of [19] — the first through n, the second through q — and both are correctly predicted by Theorem 1 nonetheless.

6. Computational Verification

We verified Theorem 1 by exhaustive enumeration within each tested configuration (results in Table 1): for each $(n,q)$ below, every cyclic code obtainable as a union of q-cyclotomic cosets modulo n was constructed and tested for the LCD property via the Gram-matrix criterion of Yang–Massey [12]; among the resulting LCD codes, those whose dual dimension $\dim D$ was small enough for brute-force enumeration of all $q^{\dim D}$ codewords of D (we used a threshold of $\dim D\le 16$ for $q=2$ and $\dim D\le 9$ for $q=3$) had their exact weight distribution and variance computed directly and compared against the closed-form prediction of Theorem 1, computed independently via Proposition 1.

Table 1. Exhaustive verification of Theorem 1 within each tested configuration.

Length n	Field	LCD Codes Verified (Below Threshold)	Discrepancies
15	$\mathrm{GF}\left(2\right)$	14	0
63	$\mathrm{GF}\left(2\right)$	31	0
26	$\mathrm{GF}\left(3\right)$	19	0
Total		64	0

6.1. Algorithm

(1)

Enumerate the q-cyclotomic cosets of ${\mathbb{Z}}_n$.

(2)

For each nonempty proper union T of cosets, form the generator polynomial $g_T\left(x\right)={\prod }_{t\in T}{m}_t\left(x\right)$, where $m_t\left(x\right)$ is the minimal polynomial of ${\zeta }^t$ over $\mathrm{GF}\left(q\right)$, and build the corresponding cyclic generator matrix G for C.

(3)

Test the LCD criterion: C is LCD iff $G{G}^{\mathsf{T}}$ has full rank over $\mathrm{GF}\left(q\right)$.

(4)

Compute $L\left(T\right)$ via Proposition 1, and record $d\left(C\right)$ directly from it: $d\left(C\right)=2$ if $L\left(T\right)<n$, and $d\left(C\right)\ge 3$ if $L\left(T\right)=n$ (Corollary 1). This step, recomputing $d\left(C\right)$ explicitly for every instance rather than inferring it indirectly, was added after an earlier draft’s worked example conflated $d\left(D\right)$ with $d\left(C\right)=d\left(D^{\perp }\right)$ for two codes that in fact had different $d\left(C\right)$; see Section 6.3.

(5)

If $\dim D=\mathrm{deg}{g}_T$ is below the brute-force threshold, enumerate $D=\ker G$ (the null space of G) exhaustively, compute $d\left(D\right)$ and the empirical weight variance directly, and compute $A_2\left(C\right)=(q-1)N_{\mathrm{dep}}\left(T\right)$ from $L\left(T\right)$ (Section Relation to the Pless Moment Identity and to Coelho–Brochero Martínez).

(6)

Compare the predicted variance $(q-1)n^2/\left(q^{2}L\left(T\right)\right)$ against the empirical value.

For every instance below the brute-force threshold across all three tested configurations (64 instances total), we recorded n, q, the full defining set T, $\dim C$, $\dim D$, $d\left(C\right)$, $d\left(D\right)$, $L\left(T\right)$, $A_2\left(C\right)$, the predicted and empirical variances, and the comparison result, in a Supplementary CSV file (supplementary_instance_data.csv) accompanying this submission; Table 1 reports only the aggregate counts. Source code implementing this algorithm (Python 3, using the galois library, version 0.4.11) accompanies this submission as Supplementary Materials and is also available from the corresponding author upon reasonable request; see also the Data Availability Statement.

6.2. Results

Across all three tested configurations, the closed-form prediction of Theorem 1 matched the brute-force empirical variance exactly, with zero discrepancies among the 64 LCD codes below the enumeration threshold (Table 1). No instance required any adjustment to the formula or its underlying assumptions; the agreement is exact to machine precision in every case, not merely close. The full per-instance data (defining set, dimensions, $d\left(C\right)$, $d\left(D\right)$, $L\left(T\right)$, $A_2\left(C\right)$, predicted and empirical variance) is provided as Supplementary Material rather than reproduced in full here, since Table 1 already reports the aggregate counts relevant to the reader. Section 6.3 presents one such instance in full detail, chosen specifically because it also corrects an error present in an earlier version of this manuscript.

6.3. Reproducible Worked Example

An earlier version of this example incorrectly reported both codes below as having $d\left(C\right)=9$. That value is in fact $d\left(D\right)$, the minimum distance of the mask code D itself (a quantity Theorem 1 does not use); the two codes have different $d\left(C\right)$, and we had conflated $d\left(D\right)$ with $d\left(D^{\perp }\right)=d\left(C\right)$ despite the notational distinction fixed in Section 3. We are grateful to a reviewer for identifying this error. Here we give a corrected, independently verified example, shown in Table 2: two LCD cyclic codes of length $n=63$ over $\mathrm{GF}\left(2\right)$ with identical $\dim C=56$, $\dim D=7$, and, most importantly, identical $d\left(C\right)=2$ (the only regime in which $L\left(T\right)$, and hence the variance, can differ; see Corollary 1 below), yet with different $L\left(T\right)$ and variance. Write cosets by their smallest element: $\mathrm{Cs}\left(t\right)$ denotes the 2-cyclotomic coset of t modulo 63.

Table 2. Two length-63 LCD cyclic codes with equal $\dim C=56$, $\dim D=7$, and equal $d\left(C\right)=2$, but different $L\left(T\right)$ and $\mathrm{Var}\left(\mathrm{wt}\right(D\left)\right)$.

Defining Set T	g(x)	d(C)	d(D)	L(T)	A2(C)	Var(wt(D))
$\mathrm{Cs}\left(0\right)\cup \mathrm{Cs}\left(9\right)\cup \mathrm{Cs}\left(27\right)$	$x^7+1$	2	9	7	252	$141.750$
$\mathrm{Cs}\left(0\right)\cup \mathrm{Cs}\left(7\right)$	$x^7+x^6+x^4+x^3+x+1$	2	14	9	189	$110.250$

Here $\mathrm{Cs}\left(0\right)=\left\{0\right\}$, $\mathrm{Cs}\left(9\right)=\{9,18,36\}$, $\mathrm{Cs}\left(27\right)=\{27,45,54\}$, and $\mathrm{Cs}\left(7\right)=\{7,14,28,35,49,56\}$ (all reduced modulo 63). For the first code, the generator polynomial $g_1\left(x\right)=x^7+1$ is itself a weight-2 codeword, giving $d\left(C_1\right)=2$ directly. For the second, $g_2\left(x\right)=x^7+x^6+x^4+x^3+x+1$ has weight 6, but $1+x^9$ is a codeword of $C_2$ (one verifies $(1+x^9)\mathrm{mod}{g}_2\left(x\right)=0$), giving $d\left(C_2\right)\le 2$, and $d\left(C_2\right)\ge 2$ by non-degeneracy, so $d\left(C_2\right)=2$. Both codes thus lie in the single regime, established in Corollary 1, where $L\left(T\right)$ can be a proper divisor of n; here it takes two different values (7 and 9), giving variances in ratio $141.75/110.25=14/11$. $d\left(D\right)$ also differs between the two codes (9 versus 14); this underscores that neither $d\left(C\right)$ alone nor $d\left(D\right)$ alone determines the variance, and that $L\left(T\right)$, computed from the full arithmetic structure of T, is required. In both rows, $\mathrm{Var}\left(\mathrm{wt}\right(D\left)\right)$ was computed both by brute-force enumeration of D and by direct evaluation of $(q-1)n^2/\left(q^{2}L\left(T\right)\right)$ from Theorem 1, and independently cross-checked against the classical identity $\mathrm{Var}\left(\mathrm{wt}\left(D\right)\right)=[n(q-1)+2A_2\left(C\right)]/q^2$ (Section Relation to the Pless Moment Identity and to Coelho–Brochero Martínez); all three agree exactly, as recorded in the table. The $14/11$ ratio of this matched-dimension pair understates the range achievable at $n=63$: among the LCD codes with $d\left(C\right)=2$ enumerated for Table 1, $T=\mathrm{Cs}\left(0\right)\cup \mathrm{Cs}\left(21\right)$ gives $\dim D=3$, $L\left(T\right)=3$, $\mathrm{Var}=330.75$, versus $T=\mathrm{Cs}\left(0\right)\cup \mathrm{Cs}\left(9\right)\cup \mathrm{Cs}\left(21\right)\cup \mathrm{Cs}\left(27\right)$, $\dim D=9$, $L\left(T\right)=21$, $\mathrm{Var}=47.25$, a $7\times$ ratio, both instances again verified by brute-force enumeration of D.

6.4. Application to the BCH-Type Length-$\lambda (q^m+1)$ Family

Section 2.3 surveys BCH-type LCD cyclic codes of length $n=\lambda (q^m+1)$, $\lambda \mid q-1$ [7,8], without indicating how the variance formula of Theorem 1 bears on this specific family. We give a concrete instance here. Take $q=3$, $m=2$, $\lambda =2$ (so $\lambda \mid q-1=2$), giving $n=\lambda (q^m+1)=2(3^2+1)=20$. The 3-cyclotomic cosets modulo 20 are $\left\{0\right\}$, $\{2,6,14,18\}$, $\{4,8,12,16\}$, $\{5,15\}$, $\left\{10\right\}$, and the negation-paired block $\{1,3,7,9\}\cup \{11,13,17,19\}$; the first five are each individually closed under negation modulo 20, so any union of them yields an LCD code by Yang–Massey [12].

Table 3 exhibits two such LCD codes with identical dimension pair $(\dim C,\dim D)=(15,5)$ and identical $d\left(C\right)=2$ (as it must be, since both have $L\left(T\right)<n$; see Corollary 1), obtained from different coset combinations, yet with $L\left(T\right)$ differing by a factor of 2.

Table 3. Two length-20 LCD cyclic codes (the $\lambda (q^m+1)$ family, $q=3$, $\lambda =2$, $m=2$) with equal dimension and equal $d\left(C\right)=2$, but different $L\left(T\right)$.

Defining Set T	d(C)	d(D)	L(T)	A2(C)	Var(wt(D))
$\left\{0\right\}\cup \{2,6,14,18\}$	2	8	10	20	$8.889$
$\left\{0\right\}\cup \{4,8,12,16\}$	2	4	5	60	$17.778$

For the first code, $g\left(x\right)=x^5+x^4+2x^3+x^2+2x+2$ has weight 6, but $1+2x^{10}$ is a codeword (verified by polynomial division), giving $d\left(C\right)=2$; for the second, $g\left(x\right)=x^5+2$ is itself a weight-two codeword.

Both codes belong to the length-$\lambda (q^m+1)$ family surveyed in Section 2.3, both are LCD, and both have the same parameters $(n,k,\dim D)=(20,15,5)$, the level of detail at which such families are typically reported in the literature. Theorem 1 distinguishes them further: the second code’s masking-code variance is exactly twice the first’s. This is the kind of re-evaluation the variance formula offers for constructions of this type: it supplies, at negligible computational cost, a second-order distinguishing statistic among LCD codes of this family that share identical conventional parameters, without requiring a full weight-enumerator computation for either.

7. Discussion: Scope and Design Implications for ODSM

Theorem 1 shows that the invariant governing whether a cyclic masking code’s Hamming-weight variance can deviate from the generic value $n(q-1)/q^2$ is $L\left(T\right)$, and, by Corollary 1, $L\left(T\right)=n$ exactly when $d\left(C\right)\ge 3$. We state this domain restriction explicitly since it delimits the entire practical scope of the result: for a nonzero, proper cyclic code, $L\left(T\right)$ can differ from n, and $\mathrm{Var}\left(\mathrm{wt}\right(D\left)\right)$ can differ from the generic value, only when $d\left(C\right)=2$. Among candidates with $d\left(C\right)\ge 3$, $L\left(T\right)$ is identically n and provides no further distinguishing information whatsoever; the entire distinguishing power of Theorem 1 is concentrated in the $d\left(C\right)=2$ regime, where it refines $A_2\left(C\right)$ (equivalently $L\left(T\right)$) beyond the mere fact that a weight-two word exists. Since $d\left(C\right)=d\left(D^{\perp }\right)$ is a parameter of the source code, already maximized in standard ODSM design for error-correction reasons unrelated to side-channel resistance, this exposes a design tension: pushing $d\left(C\right)$ up for error-correction capacity simultaneously forces the masking code’s Hamming-weight variance to its unique minimum-variance value, collapsing any distinguishing power of $L\left(T\right)$, while permitting $d\left(C\right)=2$ opens access to a computable range of variances via $A_2\left(C\right)=L\left(T\right)$.

On the practical relevance of the case $d\left(C\right)=2$: in ODSM designs that maximize $d\left(C\right)$ purely for combined error-correction and leakage-floor reasons, Theorem 1 contributes nothing beyond Lemma 2’s single generic value, and the reader may reasonably ask what the theorem adds outside that regime. Three points bear on this. First, Theorem 1 is a complete characterization across all $d\left(C\right)$, not one restricted to $d\left(C\right)=2$: it shows that this is the only regime where variance-based comparison among candidate codes is possible at all, a boundary fact not previously stated in the literature we surveyed (Section 2.2 and Section 2.3). Second, not every legitimate design constraint forces $d\left(C\right)\ge 3$: a designer working under a fixed rate $k/n$, a specific structural requirement (e.g., a prescribed automorphism group or compatibility with an existing hardware datapath), or a deliberate choice to trade distance for a different property may end up with $d\left(C\right)=2$ candidates that Theorem 1 lets the designer immediately evaluate rather than treat as unanalyzable. Third, and more modestly, the formula serves an auditing role: given any candidate LCD code with $d\left(C\right)=2$, whatever its provenance, $L\left(T\right)$ lets one check in closed form, without brute-force enumeration or full weight-enumerator computation, exactly how far its masking-code variance sits from the generic value.

On the ODSM security interpretation. We restrict the claims above to an algebraic invariant of the masking code D itself and deliberately stop short of a direct side-channel security interpretation for a specific reason worth stating precisely. In ODSM, the leaked quantity for a fixed secret $\overrightarrow{X}$ is the physical function of $\overrightarrow{Z}=\overrightarrow{X}G+\overrightarrow{M}H$, and $\overrightarrow{Z}$ is uniformly distributed over the coset $\overrightarrow{X}G+D$, not over D itself; Theorem 1 characterizes $\mathrm{Var}\left(\mathrm{wt}\right(c\left)\right)$ for $c\in D$, which is the special case $\overrightarrow{X}=\overrightarrow{0}$. Whether, and how, this coset-zero variance relates to the variance of $\mathrm{wt}\left(\overrightarrow{Z}\right)$ for a general nonzero secret $\overrightarrow{X}$ is a separate question this paper does not answer; more importantly, so is whether it relates to an attacker’s ability to distinguish between the leakage distributions of different values of $\overrightarrow{X}$, which is what actually governs side-channel security. We have not established a conditional-moment analysis across the $q^k$ cosets ${\{\overrightarrow{x}G+D\}}_{\overrightarrow{x}\in \mathrm{GF}{\left(q\right)}^k}$, nor any bound relating $\mathrm{Var}\left(\mathrm{wt}\right(D\left)\right)$ to a concrete attack metric. Consequently, we present $\mathrm{Var}\left(\mathrm{wt}\right(D\left)\right)$ here strictly as an algebraic invariant of the masking code, useful for comparing candidate masking codes’ zero-secret leakage dispersion under an idealized model, and not as a direct descriptor of ODSM security in the sense of secret-distinguishing advantage; establishing that connection rigorously is left to future work.

On the state of the code-based masking literature. An earlier version of this manuscript stated that the literature optimizes only distance parameters, with no examination of higher moments. This was incorrect, and we correct it here. A substantial and directly relevant line of work, comprising Guilley, Heuser, and Rioul [20]; Poussier, Guo, Standaert, Carlet, and Guilley [21]; Cheng, Guilley, Carlet, Mesnager, and Danger [22]; Cheng, Liu, Guilley, and Rioul [23]; and, most recently, Chen, Fan, Cheng, and Zhou [24], already goes beyond the dual distance $d_D^{\perp }$ alone, jointly optimizing it together with the kissing number $B_{d_D^{\perp }}$ (the number of minimum-weight codewords in the dual, a close relative of our $A_2\left(C\right)$ when the minimum weight is 2), and validates the resulting ordering with simulated attack experiments (success rate versus number of traces) rather than distance parameters alone. This body of work is a materially different, more mature undertaking than a distance-tuple comparison, and we no longer claim otherwise. Our contribution relative to it is narrower and more specific: an exact, closed-form arithmetic characterization of $A_2\left(C\right)$ (equivalently $L\left(T\right)$) for cyclic codes via their cyclotomic defining set, requiring no enumeration of the kissing number, together with its precise algebraic relationship to $\mathrm{Var}\left(\mathrm{wt}\right(D\left)\right)$ via the classical Pless moment identity (Section Relation to the Pless Moment Identity and to Coelho–Brochero Martínez): a complementary, purely algebraic tool that could in principle feed into the kissing-number-based design methodology of this literature for the cyclic case, rather than a competing or more complete security framework.

On the relation to Coelho and Brochero Martínez. As detailed in Section Relation to the Pless Moment Identity and to Coelho–Brochero Martínez, the special case of our result where $n=Q-1$ for Q a power of the prime q is algebraically equivalent to the $A_2$ formula of Coelho and Brochero Martínez [19], published in 2024. All numerical examples in this paper (Section 6.2, Section 6.3 and Section 6.4) happen to fall inside this special case since $15=2^4-1$, $63=2^6-1$, $26=3^3-1$, and $20\mid 3^4-1$ are all of this restricted form or reducible to it; we flag this explicitly rather than let the examples imply a broader novelty than the arithmetic warrants. The generalization that remains new is to arbitrary length n coprime to q (not necessarily of the form $Q-1$) and to arbitrary prime-power base fields q (not necessarily prime), together with the reformulation via the canonical subgroup $\mathcal{D}\left(T\right)$, the connection to $\mathrm{Var}\left(\mathrm{wt}\right(D\left)\right)$ and ODSM, and the LCD-specific Proposition 2.

We emphasize throughout that $\mathrm{Var}\left(\mathrm{wt}\right(D\left)\right)$ is a second-order algebraic descriptor of leakage dispersion under an idealized Hamming-weight leakage model with no measurement noise, computed for the zero-secret coset. It does not by itself determine DPA/CPA success probability, signal-to-noise ratio [25], mutual information, guessing entropy, or the number of traces required for a successful attack [26]; none of these quantities are analyzed in this paper, and none should be inferred from $L\left(T\right)$ alone without a fully specified attack model, noise model, and empirical validation against real or simulated traces. Nor does equal variance imply equal leakage security in a stronger sense: two masking codes with identical $\mathrm{Var}\left(\mathrm{wt}\right(D\left)\right)$ can still differ substantially in higher moments or in the full shape of the weight distribution, a limitation we return to in Section 8. With all these caveats, $L\left(T\right)$ is best read as a low-cost, exactly computable algebraic quantity for the $d\left(C\right)=2$ regime: for a target dimension pair $(n,k)$ with $d\left(C\right)=2$ forced or accepted, a designer can enumerate the cyclotomic-coset combinations achieving that dimension and directly compute $L\left(T\right)$ for each, without ever evaluating a full weight enumerator or kissing number by brute force.

8. Limitations

This work is restricted to cyclic codes; the extension to constacyclic codes ($\lambda \ne 1$), which underlies the actively studied LCD BCH constructions of length $\lambda (q^m+1)$ [7,8], is not addressed here. A preliminary check shows the extension is not a routine substitution: for $\lambda$-constacyclic codes the relevant root of unity has order $2n$ (for $\lambda =-1$) rather than n, which changes the dependency condition at the core of the proof of Theorem 1 and requires a separate derivation.

As detailed in Remark 1, $\mathrm{Var}\left(\mathrm{wt}\right(D\left)\right)$ is computed with respect to the symbol-wise Hamming weight over $\mathrm{GF}\left(q\right)$. This equals the physical bit-transition weight relevant to CMOS power leakage only for $q=2$. For $q>2$, the relationship between symbol-wise weight and physical bit-level leakage depends on an explicit encoding of field symbols into bit vectors, which this paper does not model; the $q>2$ instances of Theorem 1 (including the worked example of Section 6.4) should accordingly be read as exact results of independent coding-theoretic interest, whose side-channel relevance for $q>2$ hardware requires this additional, unaddressed modeling step.

The variance metric used here is, as stressed in Section 7, a simplified algebraic proxy under an idealized Hamming-weight leakage model. It does not incorporate measurement noise, higher-order masking, non-Hamming-weight leakage functions, or any of the standard quantitative side-channel metrics (success rate, signal-to-noise ratio, mutual information, guessing entropy); no experimental or simulated side-channel evaluation (DPA/CPA traces) was performed, and none of the claims in this paper should be read as a substitute for one. Relatedly, equal variance does not imply equal leakage security: two masking codes can share $\mathrm{Var}\left(\mathrm{wt}\right(D\left)\right)$ while differing substantially in higher moments or in the full shape of their weight distribution, which Theorem 1 does not characterize.

Finally, the literature search supporting the novelty claims in Section 2 was targeted rather than systematic (protocol described in Section 2.5), which limits the strength of broad bibliographic claims; the correction of the literature narrative in Section 7 (regarding the state of the art in dual-distance/kissing-number optimization) illustrates this limitation concretely.

9. Conclusions

This paper is, at its core, a contribution to the algebraic theory of cyclic codes, motivated by but ultimately separable from its cryptographic application. As Section Relation to the Pless Moment Identity and to Coelho–Brochero Martínez makes precise, the reduction of $\mathrm{Var}\left(\mathrm{wt}\right(D\left)\right)$ to counting weight-two codewords of C is the classical Pless moment identity, and the closest existing result, Coelho and Brochero Martínez’s 2024 formula for $A_2\left(C\right)$ on primitive-length codes over prime fields [19], is algebraically equivalent to ours on its domain. What we contribute is the extension of that arithmetic characterization, via the canonically defined subgroup $\mathcal{D}\left(T\right)$ and the invariant $L\left(T\right)$, to cyclic codes of arbitrary length n coprime to q and arbitrary prime-power base fields $\mathrm{GF}\left(q\right)$ (both verified concretely in Section Relation to the Pless Moment Identity and to Coelho–Brochero Martínez, including a non-prime-field instance over $\mathrm{GF}\left(4\right)$), together with the LCD-specific Proposition 2 showing that the LCD property, while leaving $L\left(T\right)$’s numeric value unchanged, forces every dependent coordinate pair to be related by a sign rather than a general scalar. These are coding-theoretic results, verified without exception against 64 independently constructed cyclic codes across three finite fields and four lengths, and they stand on their own within that discipline.

The motivating application, orthogonal direct sum masking, is where $D=C^{\perp }$ is interpreted as a masking code and $d\left(C\right)=d\left(D^{\perp }\right)$ as the dominant distance-based descriptor used in much of the current LCD/ODSM literature; we showed that this descriptor alone does not determine $\mathrm{Var}\left(\mathrm{wt}\right(D\left)\right)$, and that $L\left(T\right)$ does so exactly, within the narrow regime $d\left(C\right)=2$ where such distinction is possible at all (Corollary 1). We have been explicit that this variance, computed for the zero-secret coset of the masking code, is a second-order algebraic descriptor under an idealized leakage model, not a complete side-channel security metric, and that a substantial existing literature (Section 7) already evaluates code-based masking through the more operational combination of dual distance and kissing number, validated by simulated attacks, a materially more complete methodology than the one presented here. We position $L\left(T\right)$ as a low-cost, closed-form algebraic quantity that could complement that methodology for the cyclic case, not as a replacement for it. Constacyclic extension, a systematic literature review, and empirical side-channel validation remain as future work before any such complementary role could be established in practice.