A Side-Channel Assisted Cryptanalytic Attack Against QcBits Mélissa Rossi · Mike Hamburg · Michael Hutter · Mark E. Marson
Possible path for post-quantum security ∙ Error-correcting codes Quantum computers may threaten the mathematical problems on which public key algorithms are currently based. in the near future ∙ National Institute of Standards and Technology (NIST) ∙ European Initiative PQCRYPTO and SAFECRYPTO 1 / 29 Post-Quantum Cryptography ⇒ Call for the standardization and transition to post-quantum public key algorithms
Quantum computers may threaten the mathematical problems on which public key algorithms are currently based. in the near future ∙ National Institute of Standards and Technology (NIST) ∙ European Initiative PQCRYPTO and SAFECRYPTO 1 / 29 Post-Quantum Cryptography ⇒ Call for the standardization and transition to post-quantum public key algorithms Possible path for post-quantum security ∙ Error-correcting codes
2 Data Linear expansion Codeword Noisy channel Noisy Codeword Data Decoding 2 / 29 Linear Codes for Telecommunications A binary linear code is a linear subspace of F n ✲
2 Data Linear expansion Codeword Noisy channel Noisy Codeword Data Decoding 2 / 29 Linear Codes for Telecommunications A binary linear code is a linear subspace of F n ✲ ❄ ❄
2 Data Linear expansion Codeword Noisy channel Noisy Codeword Data Decoding 2 / 29 Linear Codes for Telecommunications A binary linear code is a linear subspace of F n ✲ ❄ ❄ ✛
Public Key ! Secret Key Plaintext Ciphertext Encryption using public key Removing the errors is hard Plaintext Decoding with the secret key 3 / 29 Linear Codes for Public Key Cryptography : Mc Eliece Public key : a way to create a codeword Secret key : a way to remove the errors
3 / 29 Ciphertext Decoding with the secret key Plaintext is hard Removing the errors using public key Encryption Intentionally add random errors Codeword Linear expansion Plaintext Secret Key Public Key Linear Codes for Public Key Cryptography : Mc Eliece Public key : a way to create a codeword Secret key : a way to remove the errors ✲
3 / 29 Ciphertext Decoding with the secret key Plaintext is hard Removing the errors using public key Encryption Intentionally add random errors Codeword Linear expansion Plaintext Secret Key Public Key Linear Codes for Public Key Cryptography : Mc Eliece Public key : a way to create a codeword Secret key : a way to remove the errors ✲ ❄ ❄
3 / 29 Encryption Decoding with the secret key Public Key Secret Key Plaintext Linear expansion Plaintext Codeword is hard Intentionally add random errors Removing the errors Ciphertext using public key Linear Codes for Public Key Cryptography : Mc Eliece Public key : a way to create a codeword Secret key : a way to remove the errors ✲ ❍❍❍❍❍❍❍❍❍❍❍❍❍❍ ❄ ❄ ❥ ❍
3 / 29 using public key Decoding with the secret key Public Key Secret Key Plaintext Ciphertext Plaintext is hard Removing the errors Encryption Linear Codes for Public Key Cryptography : Mc Eliece Public key : a way to create a codeword Secret key : a way to remove the errors ❍❍❍❍❍❍❍❍❍❍❍❍❍❍ ❥ ❍
3 / 29 using public key Decoding with the secret key Public Key Secret Key Plaintext Ciphertext Plaintext is hard Removing the errors Encryption Linear Codes for Public Key Cryptography : Mc Eliece Public key : a way to create a codeword Secret key : a way to remove the errors ❍❍❍❍❍❍❍❍❍❍❍❍❍❍ ❍ ❥ ✛
QC MDPC 4 / 29 Algebraic Geometric Misoczki et al (13) Couvreur et al (14) Faugère et al (14) Bernstein et al (10) Wild Goppa Landais et al (13) Londahl et al (12) Convolutional Monico et al (00) Monico et al (00) LDPC Faure et al (08) Couvreur et al (14) Janwa et al(96) Minder et al (07) Sidelnikov (94) Reed Muller Sendrier (98) Niederreiter (86) Concatenated Sidelnikov et al (92) Niederreiter (86) Reed Solomon original proposition (78) Binary Goppa Mc Eliece Several possibilities for choosing an appropriate code structure Family of codes Proposed by Attacked by
4 / 29 Algebraic Geometric Misoczki et al (13) Couvreur et al (14) Faugère et al (14) Bernstein et al (10) Wild Goppa Landais et al (13) Londahl et al (12) Convolutional Monico et al (00) Monico et al (00) LDPC Faure et al (08) Couvreur et al (14) Janwa et al(96) Minder et al (07) Sidelnikov (94) Reed Muller Sendrier (98) Niederreiter (86) Concatenated Sidelnikov et al (92) Niederreiter (86) Reed Solomon original proposition (78) Binary Goppa Mc Eliece Several possibilities for choosing an appropriate code structure Family of codes Proposed by Attacked by QC MDPC
description of qcbits algorithm
6 / 29 Plaintext ∙ 2 sets of parameters : 80 bits and 128 bits security ∙ Protected against one type of side channel attacks : timing attacks ∙ Small key sizes ∙ Very fast Tung Chou, QcBits: Constant-Time Small-Key Code-Based Cryptography CHES 2016 Decoding with the secret key using public key Public Key Encryption Ciphertext Plaintext Secret Key QcBits : A QC MDPC McEliece implementation ❍❍❍❍❍❍❍❍❍❍❍❍❍❍ ❥ ❍ ✛
Size ( r ) Hamming weight( w ) Bits of Security 4801 90 80 9857 142 128 7 / 29 QcBits : A QC MDPC McEliece implementation Secret key : a QC MDPC matrix H Public key : a matrix P H = ( H 0 , H 1 )
7 / 29 0 0 0 1 0 0 1 1 0 1 1 0 0 0 1 0 0 0 0 0 1 1 0 0 0 0 1 0 0 0 0 0 0 1 Size ( r ) 0 0 1 1 0 1 0 0 1 0 0 1 0 0 1 0 128 142 9857 80 90 4801 Bits of Security Hamming weight( w ) 0 1 0 1 1 0 0 1 1 0 0 0 1 0 1 0 0 0 0 1 0 0 QcBits : A QC MDPC McEliece implementation Secret key : a QC MDPC matrix H Public key : a matrix P H = ( H 0 , H 1 ) H =
7 / 29 1 1 0 0 0 1 0 0 1 0 0 0 1 0 0 0 1 0 0 1 1 1 1 0 0 0 0 1 0 0 0 0 0 Size ( r ) 0 1 0 1 0 0 0 1 2 0 0 1 0 0 0 1 are circulant 0 128 142 9857 80 90 4801 Bits of Security Hamming weight( w ) 1 0 0 1 0 1 0 0 1 1 0 0 0 0 0 0 0 0 1 0 1 1 0 QcBits : A QC MDPC McEliece implementation Secret key : a QC MDPC matrix H Public key : a matrix P H = ( H 0 , H 1 ) H = Q uasi C yclic M oderate D ensity P arity C heck means : ∙ H 0 and H 1 ∈ F r · r ∙ H 0 and H 1 have sparse rows : only w 2 ones ∙ The codewords x are all the vectors in the right nullspace of H ie H · x T = 0
7 / 29 9857 P is dense P is circulant too Size ( r ) 142 128 80 90 4801 Bits of Security Hamming weight( w ) QcBits : A QC MDPC McEliece implementation Secret key : a QC MDPC matrix H Public key : a matrix P H = ( H 0 , H 1 ) P = H − 1 1 H 0
P H ∙ We want to know the secret key H ∙ We know the public key P ∙ We know some ciphertexts previously sent ∙ We have access to the power traces 8 / 29 QcBits : Our attacker model Secret key : a QC MDPC matrix H = ( H 0 , H 1 ) Public key : a matrix P = H − 1 1 H 0
9 / 29 Encryption Decoding with the secret key H Plaintext P H Plaintext Ciphertext using public key P QcBits : A QC MDPC McEliece implementation Secret key : a QC MDPC matrix H = ( H 0 , H 1 ) Public key : a matrix P = H − 1 1 H 0 ❍❍❍❍❍❍❍❍❍❍❍❍❍❍ ❥ ❍ ✛
9 / 29 Encryption Decoding with the secret key H Plaintext P H Plaintext Ciphertext using public key P QcBits : A QC MDPC McEliece implementation Secret key : a QC MDPC matrix H = ( H 0 , H 1 ) Public key : a matrix P = H − 1 1 H 0 ❍❍❍❍❍❍❍❍❍❍❍❍❍❍ ❥ ❍ ✛
Bit Flipping 2 10 / 29 Bit Flipping Algorithm 1: Bit Flipping Data: H ∈ F r · n 2 , x ∈ F n Result: Corrected codeword v 1 v ← x ; 2 S ← H · v T // Syndrome computation 3 ... 4 Computation of the error e 5 ... 6 Return the codeword v = x ⊕ e
∙ New classical key recovery attack 1. Differential Power Analysis (DPA) 2. Mathematical key recovery 11 / 29 Our contribution H = ( H 0 , H 1 )
11 / 29 . 1. Differential Power Analysis (DPA) 2. Mathematical key recovery . . . . . . ∙ New classical key recovery attack . . . . . Our contribution ∗ · · · ∗ ∗ · · · ∗ H = ∗ · · · ∗ ∗ · · · ∗
11 / 29 ∙ New classical key recovery attack . . . . . . . 0 . . . . . 2. Mathematical key recovery 1. Differential Power Analysis (DPA) 0 Our contribution ∗ ∗ ∗ ∗ ∗ · · · ∗ ∗ · · · ∗ H = ∗ · · · ∗ ∗ · · · ∗
Recommend
More recommend
