Cryptanalysis of a variant of the McEliece encryption scheme Julien - PowerPoint PPT Presentation

Cryptanalysis of a variant of the McEliece encryption scheme Julien Lavauzelle IRMAR, Université de Rennes 1 Journées Nationales de Calcul Formel 2020 03/03/2020

Outline 1. McEliece cryptosystem and variants 2. Attack on the Reed–Solomon variant 3. Attack on the twisted Reed–Solomon variant 0/20 J. Lavauzelle – Cryptanalysis of a variant of the McEliece encryption scheme – JNCF 2020

McEliece cryptosystem McEliece cryptosystem (1978): a public-key encryption scheme. 1/20 J. Lavauzelle – Cryptanalysis of a variant of the McEliece encryption scheme – JNCF 2020

McEliece cryptosystem McEliece cryptosystem (1978): a public-key encryption scheme. Summary: ◮ private key: an efficient decoding algorithm for a code C , ◮ public key: a random description of the code (masks the decoding algorithm), ◮ encryption: encode the message and add an error, ◮ decryption: decode the error and retrieve the message. 1/20 J. Lavauzelle – Cryptanalysis of a variant of the McEliece encryption scheme – JNCF 2020

McEliece cryptosystem McEliece cryptosystem (1978): a public-key encryption scheme. Summary: ◮ private key: an efficient decoding algorithm for a code C , ◮ public key: a random description of the code (masks the decoding algorithm), ◮ encryption: encode the message and add an error, ◮ decryption: decode the error and retrieve the message. Security relies on two problems: 1. hardness of decoding random codes 2. hardness of recognizing the structure of a code ( ≃ find an efficient decoding algorithm from a random description of a code) 1/20 J. Lavauzelle – Cryptanalysis of a variant of the McEliece encryption scheme – JNCF 2020

General statement of the problem Let F be a k -dimensional subspace of F q [ x ] / ( x q − x ) . Input.   y 1 f 1 ( x 1 ) . . . . . . y n f 1 ( x n ) . .  ∈ F k × n G =   . .  . . q y 1 f k ( x 1 ) . . . . . . y n f k ( x n )  f 1 ( x ) , . . . , f k ( x ) is a basis of F ,  where: ( x 1 , . . . , x n ) are pairwise distinct in F q ,  ( y 1 , . . . , y n ) are non-zero elements of F q . 2/20 J. Lavauzelle – Cryptanalysis of a variant of the McEliece encryption scheme – JNCF 2020

General statement of the problem Let F be a k -dimensional subspace of F q [ x ] / ( x q − x ) . Input.   y 1 f 1 ( x 1 ) . . . . . . y n f 1 ( x n ) . .  ∈ F k × n G =   . .  . . q y 1 f k ( x 1 ) . . . . . . y n f k ( x n )  f 1 ( x ) , . . . , f k ( x ) is a basis of F ,  where: ( x 1 , . . . , x n ) are pairwise distinct in F q ,  ( y 1 , . . . , y n ) are non-zero elements of F q . Output. A basis g 1 ( x ) , . . . , g k ( x ) of F , pairwise distinct elements x ′ 1 , . . . , x ′ n ∈ n ∈ F × F q and non-zero elements y ′ 1 , . . . , y ′ q such that  y ′ 1 g 1 ( x ′ y ′ n g 1 ( x ′  1 ) . . . . . . n ) . .   G = . .  .  . . y ′ 1 g k ( x ′ y ′ n g k ( x ′ 1 ) n ) . . . . . . 2/20 J. Lavauzelle – Cryptanalysis of a variant of the McEliece encryption scheme – JNCF 2020

Instances of the problem A Public-Key Cryptosystem Based on Algebraic Coding Theory . McEliece. Jet Propulsion Laboratory DSN Progress Report. 1978 . Original McEliece cryptosystem: binary Goppa codes, q = 2 m . – x = ( x 1 , . . . , x n ) ∈ F n q pairwise distinct, – π ( x ) the derivative of ∏ n i = 1 ( x − x i ) ∈ F q [ x ] , – an irreducible Γ ( x ) ∈ F q [ x ] , � Γ ( x 1 ) � π ( x 1 ) , . . . , Γ ( x 1 ) ∈ ( F × q ) n . – y = π ( x 1 ) � � F x , Γ , r = f ( x ) ∈ F q [ x ] | deg ( f ) < r and y i f ( x i ) ∈ F 2 , ∀ i = 1, . . . , n . 3/20 J. Lavauzelle – Cryptanalysis of a variant of the McEliece encryption scheme – JNCF 2020

Instances of the problem A Public-Key Cryptosystem Based on Algebraic Coding Theory . McEliece. Jet Propulsion Laboratory DSN Progress Report. 1978 . Original McEliece cryptosystem: binary Goppa codes, q = 2 m . – x = ( x 1 , . . . , x n ) ∈ F n q pairwise distinct, – π ( x ) the derivative of ∏ n i = 1 ( x − x i ) ∈ F q [ x ] , – an irreducible Γ ( x ) ∈ F q [ x ] , � Γ ( x 1 ) � π ( x 1 ) , . . . , Γ ( x 1 ) ∈ ( F × q ) n . – y = π ( x 1 ) � � F x , Γ , r = f ( x ) ∈ F q [ x ] | deg ( f ) < r and y i f ( x i ) ∈ F 2 , ∀ i = 1, . . . , n . ◮ Still considered as secure (NIST competition). ◮ Main drawback : large key sizes. 3/20 J. Lavauzelle – Cryptanalysis of a variant of the McEliece encryption scheme – JNCF 2020

Intances of the problem In order to reduce key sizes : ◮ Niederreiter (1986): generalized Reed–Solomon codes – x = ( x 1 , . . . , x n ) ∈ F n q pairwise distinct – y = ( y 1 , . . . , y n ) ∈ ( F × q ) n � � F = f ( x ) ∈ F q [ x ] | deg ( f ) < k 4/20 J. Lavauzelle – Cryptanalysis of a variant of the McEliece encryption scheme – JNCF 2020

Intances of the problem In order to reduce key sizes : ◮ Niederreiter (1986): generalized Reed–Solomon codes – x = ( x 1 , . . . , x n ) ∈ F n q pairwise distinct – y = ( y 1 , . . . , y n ) ∈ ( F × q ) n � � F = f ( x ) ∈ F q [ x ] | deg ( f ) < k However, broken by Sidelnikov and Shestakov in 1992 (Part II). On Insecurity of Cryptosystems Based on Generalized Reed-Solomon Codes . Sidelnikov, Shestakov. Discrete Math. Appl.. 1992 . 4/20 J. Lavauzelle – Cryptanalysis of a variant of the McEliece encryption scheme – JNCF 2020

Intances of the problem In order to reduce key sizes : ◮ Niederreiter (1986): generalized Reed–Solomon codes – x = ( x 1 , . . . , x n ) ∈ F n q pairwise distinct – y = ( y 1 , . . . , y n ) ∈ ( F × q ) n � � F = f ( x ) ∈ F q [ x ] | deg ( f ) < k However, broken by Sidelnikov and Shestakov in 1992 (Part II). ◮ A lot of propositions to replace Goppa codes → Reed–Muller codes, AG codes, QC-MDPC codes, etc. On Insecurity of Cryptosystems Based on Generalized Reed-Solomon Codes . Sidelnikov, Shestakov. Discrete Math. Appl.. 1992 . 4/20 J. Lavauzelle – Cryptanalysis of a variant of the McEliece encryption scheme – JNCF 2020

Intances of the problem In order to reduce key sizes : ◮ Niederreiter (1986): generalized Reed–Solomon codes – x = ( x 1 , . . . , x n ) ∈ F n q pairwise distinct – y = ( y 1 , . . . , y n ) ∈ ( F × q ) n � � F = f ( x ) ∈ F q [ x ] | deg ( f ) < k However, broken by Sidelnikov and Shestakov in 1992 (Part II). ◮ A lot of propositions to replace Goppa codes → Reed–Muller codes, AG codes, QC-MDPC codes, etc. ◮ In 2018: Beelen, Bossert, Puchinger and Rosenkilde proposed twisted Reed–Solomon codes . → claimed key size reduction by a factor 7 → also broken (Part III) On Insecurity of Cryptosystems Based on Generalized Reed-Solomon Codes . Sidelnikov, Shestakov. Discrete Math. Appl.. 1992 . Cryptanalysis of a System Based on Twisted Reed–Solomon Codes . L. , Renner. Designs, Codes and Cryptograhy. 2020 . 4/20 J. Lavauzelle – Cryptanalysis of a variant of the McEliece encryption scheme – JNCF 2020

Outline 1. McEliece cryptosystem and variants 2. Attack on the Reed–Solomon variant 3. Attack on the twisted Reed–Solomon variant 4/20 J. Lavauzelle – Cryptanalysis of a variant of the McEliece encryption scheme – JNCF 2020

The problem � � Let F = f ( x ) ∈ F q [ x ] | deg ( f ) < k . Input. A matrix   y 1 f 1 ( x 1 ) . . . . . . y n f 1 ( x n ) . .  ∈ F k × n G =   . . , where  . . q y 1 f k ( x 1 ) . . . . . . y n f k ( x n ) – f 1 ( x ) , . . . , f k ( x ) is a basis of F , q are pairwise distinct, and ( y 1 , . . . , y n ) ∈ ( F × – ( x 1 , . . . , x n ) ∈ F n q ) n . Output. A basis g 1 ( x ) , . . . , g k ( x ) of F , pairwise distinct elements n ) ∈ ( F × q ) n such that ( x ′ 1 , . . . , x ′ n ) ∈ F n q and non-zero elements ( y ′ 1 , . . . , y ′  y ′ 1 g 1 ( x ′ y ′ n g 1 ( x ′  1 ) . . . . . . n ) . .   G = . .  .  . . y ′ 1 g k ( x ′ y ′ n g k ( x ′ 1 ) n ) . . . . . . 5/20 J. Lavauzelle – Cryptanalysis of a variant of the McEliece encryption scheme – JNCF 2020

The problem Remark. One can write G as:   1 1 . . . . . . 1 1 x 1 x 2 . . . . . . x n − 1 x n     x 2 x 2 x 2 x 2 . . . . . .   S · · Diag ( y 1 , . . . , y n ) n − 1 n 1 2   . .   . . . .   x k − 1 x k − 1 x k − 1 x k − 1 . . . . . . n 1 2 n − 1 where S ∈ F k × k is invertible. q 6/20 J. Lavauzelle – Cryptanalysis of a variant of the McEliece encryption scheme – JNCF 2020

Structural properties Notation. – 1 = ( 1, . . . , 1 ) ∈ F n q � � F = f ( x ) ∈ F q [ x ] | deg ( f ) < k – a ⋆ b = ( a 1 b 1 , . . . , a n b n ) – λ a = ( λ a 1 , . . . , λ a n ) 7/20 J. Lavauzelle – Cryptanalysis of a variant of the McEliece encryption scheme – JNCF 2020

Structural properties Notation. – 1 = ( 1, . . . , 1 ) ∈ F n q � � F = f ( x ) ∈ F q [ x ] | deg ( f ) < k – a ⋆ b = ( a 1 b 1 , . . . , a n b n ) – λ a = ( λ a 1 , . . . , λ a n ) Definition. Generalized Reed–Solomon code: � ⊆ F n � GRS k ( x , y ) : = y ⋆ ev x ( f ) : = ( y 1 f ( x 1 ) , . . . , y n f ( x n )) | f ( x ) ∈ F q 7/20 J. Lavauzelle – Cryptanalysis of a variant of the McEliece encryption scheme – JNCF 2020