A Distinguisher-Based Attack of a Homomorphic Encryption Scheme - PowerPoint PPT Presentation

A Distinguisher-Based Attack of a Homomorphic Encryption Scheme Relying on Reed-Solomon Codes erie Gauthier 1 , Ayoub Otmani 1 and Jean-Pierre Tillich 2 Val´ GREYC - Universit´ e de Caen - Ensicaen SECRET Project - INRIA Rocquencourt Code-based Cryptography Workshop, May 2012 V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencour May 2012 1 / 17

Introduction Homomorphic encryption schemes Proposed by Rivest, Adleman and Dertouzos in 1978. V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencour May 2012 2 / 17

Introduction Homomorphic encryption schemes Proposed by Rivest, Adleman and Dertouzos in 1978. Gentry proposed the first homomorphic scheme based in lattices in 2009. V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencour May 2012 2 / 17

Introduction Homomorphic encryption schemes Proposed by Rivest, Adleman and Dertouzos in 1978. Gentry proposed the first homomorphic scheme based in lattices in 2009. Challenge: find Homomorphic schemes based in coding therory. V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencour May 2012 2 / 17

Introduction Homomorphic encryption schemes Proposed by Rivest, Adleman and Dertouzos in 1978. Gentry proposed the first homomorphic scheme based in lattices in 2009. Challenge: find Homomorphic schemes based in coding therory. Two proposals ◮ On Constructing homomorphic Encryption Schemes from Coding Theory. IMACC 2011. Armkent, Augot, Perret and Sadeghi. ◮ Homomorphic encryption from codes (Accepted to STOC 2012) Bogdanov and Lee. V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencour May 2012 2 / 17

Introduction Distingushing problem Introduced in 2001 by Courtois, Finiasz, and Sendrier to formalize a security proof of the McEliece cryptosystem. V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencour May 2012 3 / 17

Introduction Distingushing problem Introduced in 2001 by Courtois, Finiasz, and Sendrier to formalize a security proof of the McEliece cryptosystem. A Distinguisher for High Rate McEliece Cryptosystems (ITW 2011). Faug` ere, Gauthier, Otmani, Perret and Tillich V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencour May 2012 3 / 17

Introduction Distingushing problem Introduced in 2001 by Courtois, Finiasz, and Sendrier to formalize a security proof of the McEliece cryptosystem. A Distinguisher for High Rate McEliece Cryptosystems (ITW 2011). Faug` ere, Gauthier, Otmani, Perret and Tillich Error-correcting pairs for a public-key cryptosystem. Preprint 2012. M´ arquez-Corbella and Pellikaan. V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencour May 2012 3 / 17

Introduction Distingushing problem Introduced in 2001 by Courtois, Finiasz, and Sendrier to formalize a security proof of the McEliece cryptosystem. A Distinguisher for High Rate McEliece Cryptosystems (ITW 2011). Faug` ere, Gauthier, Otmani, Perret and Tillich Error-correcting pairs for a public-key cryptosystem. Preprint 2012. M´ arquez-Corbella and Pellikaan. Two independent attacks ◮ Cryptanalysis of the Bogdanov-Lee Cryptosystem by Gottfried Herold ◮ When Homomorphism Becomes a Liability by Zvika Brakerski. (Cryptology ePrint Archive: Report 2012/225) V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencour May 2012 3 / 17

Bogdanov-Lee Cryptosystem Outline Introduction 1 Bogdanov-Lee Cryptosystem 2 Description of the attack 3 Conclusions and futur work 4 V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencou May 2012 4 / 17

Bogdanov-Lee Cryptosystem Outline Introduction 1 Bogdanov-Lee Cryptosystem 2 Description of the attack 3 Conclusions and futur work 4 V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencou May 2012 4 / 17

Bogdanov-Lee Cryptosystem Key generation A subset L of { 1 , . . . , n } of cardinality 3 ℓ . Generate at random n distinct x i ∈ F q . ( x i , x 2 i , . . . , x ℓ  i , 0 , . . . , 0) if i ∈ L  def G T = i i , x ℓ +1 ( x i , x 2 i , . . . , x ℓ , . . . , x k  i ) if i / ∈ L i Secret key: L , G . Public key: P def = SG where S is a random invertible over F q . V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencour May 2012 5 / 17

Bogdanov-Lee Cryptosystem Key generation - Example A subset L of { 1 , . . . , n } of cardinality 3 ℓ . Generate at random n distinct x i ∈ F q .  x 1 . . . x 3 ℓ x 3 ℓ +1 . . . x n  . . . . . .   . . .    x ℓ x ℓ x ℓ x ℓ  . . . . . .  1 3 ℓ 3 ℓ +1 n  G =  x ℓ +1 x ℓ +1  0 . . . 0 . . .   3 ℓ +1 n  . . .  . . .   . . .   x k x k 0 . . . 0 . . . 3 ℓ +1 n Secret key: L , G . Public key: P def = SG where S is a random invertible over F q . V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencour May 2012 5 / 17

Bogdanov-Lee Cryptosystem Encryption → c ∈ F n m ∈ F q − q 1 Pick z ∈ F k q uniformly at random. 2 Pick e ∈ F n � � q s.t. Proba e i = 0 ∀ i ∈ L is close to one. 3 Compute c def = zP + m 1 + e where 1 ∈ F n q is the all-ones row vector. V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencou May 2012 6 / 17

Bogdanov-Lee Cryptosystem Decryption 1 Find y def = ( y 1 , . . . , y n ) ∈ F n q that solves:  Gy T = 0   �  = 1 y i (1) i ∈ L   y i = 0 for all i / ∈ L .  2 For any solution y of (1): m = cy T V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencou May 2012 7 / 17

Bogdanov-Lee Cryptosystem Correctness of the Decryption cy T ( zP + m 1 + e ) y T = ( zP + m 1 ) y T = (since e i = 0 if i ∈ L and y i = 0 if i / ∈ L ) n zSGy T + m � = y i i =1 n (since Gy T = 0 and � = y i = 1) m i =1 V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencour May 2012 8 / 17

Description of the attack Outline Introduction 1 Bogdanov-Lee Cryptosystem 2 Description of the attack 3 Conclusions and futur work 4 V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencou May 2012 9 / 17

Description of the attack Preliminary Find y ∈ F n q s.t. Py T  = 0   �  y i = 1 (2) i ∈ L   y i = 0 for all i / ∈ L .  Remarks: Py T = 0 ⇔ SGy T = 0 then system (2) ⇔ system (1). For any y solution of (2): m = cy T . = ⇒ L is the only secret key. V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencour May 2012 10 / 17

Description of the attack Definitions Star product: a ⋆ b def = ( a 1 b 1 , . . . , a n b n ). Star product of two codes: < A ⋆ B > is the vector space spanned by all products a ⋆ b where a ∈ A and b ∈ B . Square code: < A 2 > = < A ⋆ A > Restriction of a code A , I ⊂ { 1 , . . . , n } def � � v ∈ F | I | = q | ∃ a ∈ A , v = ( a i ) i ∈ I . A I V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencour May 2012 11 / 17

Description of the attack Main result: Proposition: ◮ Choose I ⊂ { 1 , . . . , n } . def ◮ Denote J = I ∩ L and C the code generated by G .  | J | � ℓ − 1  dim( < C 2 = ⇒ I > ) = 2 k − 1 + | J | if | I | − | J | � 2 k  V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencour May 2012 12 / 17

Description of the attack Recover L : dim ( < C 2 I > ) = 2 k − 1 + | J | 1 Recover J = L ∩ I : choose i ∈ I , consider I ′ def = I \ { i } . � � ◮ If i ∈ L then dim( < C 2 I ′ > ) = 2 k − 1 + | J | − 1. ◮ If i / ∈ L then dim( < C 2 I ′ > ) = 2 k − 1 + | J | . V. Gauthier, A. Otmani and J-P. Tillich Attack of a Homomorphic Scheme ( GREYC - Universit´ e de Caen - Ensicaen, SECRET Project - INRIA Rocquencou May 2012 13 / 17