Ouroboros: a simple, secure and efficient key exchange protocol based - PowerPoint PPT Presentation

Ouroboros: a simple, secure and efficient key exchange protocol based on coding theory Jean-Christophe Deneuville < jean-christophe.deneuville@xlim.fr > June the 26 th , 2017 PQCrypto ’17 Utrecht Joint work with: P. Gaborit G. Z´ emor University of Limoges University of Bordeaux

Motivations [ME78]

Motivations [ME78] [Nie86]

Motivations RS 80’s BCH [ME78] [Nie86] ↓ Goppa 00’s RM

Motivations Key Sizes RS 80’s BCH [ME78] [Nie86] ↓ Goppa 00’s RM Security reduction to a standard problem (random codes)

Motivations Key Sizes RS 80’s BCH Other variations [ME78] [Nie86] ↓ Goppa Most of them broken 00’s RM Security proof

Motivations Key Sizes Rank [Gab91] Metric RS 80’s BCH Other variations [ME78] [Nie86] ↓ Goppa Most of them broken 00’s RM Security proof

Motivations Key Sizes Rank [Gab91] Metric RS 80’s BCH Other variations [ME78] [Nie86] ↓ Goppa Most of them broken 00’s RM Security proof [Ale03]

Motivations Group [Gab05] action Key Sizes Rank [Gab91] Metric RS 80’s BCH Other variations [ME78] [Nie86] ↓ Goppa Most of them broken 00’s RM Security proof [Ale03]

Motivations Group [Gab05] action Key Sizes Rank [Gab91] [Ove07] Metric Attacks RS 80’s BCH Other variations [ME78] [Nie86] ↓ Goppa Most of them broken 00’s RM Security proof [Ale03]

Motivations Group [Gab05] action [BBC08] QC-LDPC Key Sizes Rank [Gab91] [Ove07] Metric Attacks RS 80’s BCH Other variations [ME78] [Nie86] ↓ Goppa Most of them broken 00’s RM Security proof [Ale03]

Motivations [MB09] dyadic [BCGO09] alternant Group [Gab05] action [BBC08] QC-LDPC Key Sizes Rank [Gab91] [Ove07] Metric Attacks RS 80’s BCH Other variations [ME78] [Nie86] ↓ Goppa Most of them broken 00’s RM Security proof [Ale03]

Motivations [MB09] dyadic [BCGO09] alternant Group [Gab05] action [BBC08] QC-LDPC Key Sizes [GMRZ13] Rank [Gab91] QC-LRPC [Ove07] Metric Ntru-like Attacks RS 80’s BCH Other variations [ME78] [Nie86] ↓ Goppa Most of them broken 00’s RM Security proof [Ale03]

Motivations [MB09] dyadic [BCGO09] alternant Group [Gab05] Ntru-like action [BBC08] [MTSB13] QC-LDPC QC-MDPC Key Sizes [GMRZ13] Rank [Gab91] QC-LRPC [Ove07] Metric Ntru-like Attacks RS 80’s BCH Other variations [ME78] [Nie86] ↓ Goppa Most of them broken 00’s RM Security proof [Ale03]

Motivations [MB09] dyadic [BCGO09] alternant Group [Gab05] Ntru-like action [BBC08] [MTSB13] QC-LDPC QC-MDPC Key Sizes [GMRZ13] Rank [Gab91] QC-LRPC [Ove07] Metric Ntru-like Attacks RS 80’s BCH Other variations [ME78] [Nie86] ↓ Goppa Most of them broken 00’s RM HQC Security proof [Ale03] [ABDGZ16] RQC

Motivations [MB09] dyadic [BCGO09] alternant Group [Gab05] Ntru-like action [BBC08] [MTSB13] QC-LDPC QC-MDPC Key Sizes [GMRZ13] Rank [Gab91] QC-LRPC [Ove07] Metric Ntru-like Attacks RS 80’s BCH Other variations [ME78] [Nie86] ↓ Bottom Line Goppa Most of them broken 00’s RM HQC Security proof [Ale03] [ABDGZ16] RQC

Motivations [MB09] dyadic [BCGO09] alternant Group [Gab05] Ntru-like action [BBC08] [MTSB13] QC-LDPC QC-MDPC Key Sizes [GMRZ13] Rank [Gab91] QC-LRPC [Ove07] Metric Ntru-like Attacks RS 80’s BCH Other variations [ME78] [Nie86] ↓ Bottom Line Goppa Most of them broken 00’s RM y c n HQC e i c i Security proof f [Ale03] [ABDGZ16] f E k RQC c a L

Motivations [MB09] dyadic [BCGO09] alternant Group [Gab05] Ntru-like action f [BBC08] [MTSB13] o o QC-LDPC QC-MDPC r P Key Sizes a [GMRZ13] k Rank [Gab91] c QC-LRPC a [Ove07] Metric L Ntru-like Attacks RS 80’s BCH Other variations [ME78] [Nie86] ↓ Bottom Line Goppa Most of them broken 00’s RM y c n HQC e i c i Security proof f [Ale03] [ABDGZ16] f E k RQC c a L

Motivations [MB09] dyadic [BCGO09] alternant Group [Gab05] Ntru-like action f o [BBC08] [MTSB13] o r QC-LDPC QC-MDPC P Key Sizes [GMRZ13] Rank [Gab91] QC-LRPC [Ove07] Metric Ntru-like Attacks RS 80’s BCH Other variations [ME78] [Nie86] ↓ Bottom Line Goppa Most of them broken 00’s RM y c n HQC e i c i f Security proof [Ale03] [ABDGZ16] f E RQC

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion Outline Reminders on HQC 1 Presentation of the Ouroboros protocol 2 Security 3 Parameters 4 June the 26th, 2017 J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange 3 / 21

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion HQC Encryption Scheme [ABD + 16] Encryption scheme in H amming metric, using Q uasi- C yclic Codes Notation: Secret data - Public data - One-time Randomness G is the generator matrix of some public code C . Alice Bob $ seed h ← { 0 , 1 } λ , h ← F n seed h 2 $ ← S n seed h , s x , y w ( F 2 ), s ← x + hy − − − − − − − − − → $ $ ← S n ← S n r 1 , r 2 w ( F 2 ), ǫ cw ( F 2 ) v ← r 1 + hr 2 , ρ ← µ G + sr 2 + ǫ v , ρ ← − − − − − − − µ ← C . Decode ( ρ − vy ) June the 26th, 2017 J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange 4 / 21

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion HQC Encryption Scheme [ABD + 16] Encryption scheme in H amming metric, using Q uasi- C yclic Codes Notation: Secret data - Public data - One-time Randomness G is the generator matrix of some public code C . Alice Bob $ seed h ← { 0 , 1 } λ , h ← F n seed h 2 $ ← S n seed h , s x , y w ( F 2 ), s ← x + hy − − − − − − − − − → $ $ ← S n ← S n r 1 , r 2 w ( F 2 ), ǫ cw ( F 2 ) v ← r 1 + hr 2 , ρ ← µ G + sr 2 + ǫ v , ρ ← − − − − − − − µ ← C . Decode ( ρ − vy ) June the 26th, 2017 J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange 4 / 21

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion HQC Encryption Scheme [ABD + 16] Encryption scheme in H amming metric, using Q uasi- C yclic Codes Notation: Secret data - Public data - One-time Randomness G is the generator matrix of some public code C . Alice Bob $ seed h ← { 0 , 1 } λ , h ← F n seed h 2 $ ← S n seed h , s x , y w ( F 2 ), s ← x + hy − − − − − − − − − → $ $ ← S n ← S n r 1 , r 2 w ( F 2 ), ǫ cw ( F 2 ) v ← r 1 + hr 2 , ρ ← µ G + sr 2 + ǫ v , ρ ← − − − − − − − µ ← C . Decode ( ρ − vy ) June the 26th, 2017 J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange 4 / 21

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion HQC Encryption Scheme [ABD + 16] Encryption scheme in H amming metric, using Q uasi- C yclic Codes Notation: Secret data - Public data - One-time Randomness G is the generator matrix of some public code C . Alice Bob $ seed h ← { 0 , 1 } λ , h ← F n seed h 2 $ ← S n seed h , s x , y w ( F 2 ), s ← x + hy − − − − − − − − − → $ $ ← S n ← S n r 1 , r 2 w ( F 2 ), ǫ cw ( F 2 ) v ← r 1 + hr 2 , ρ ← µ G + sr 2 + ǫ v , ρ ← − − − − − − − µ ← C . Decode ( ρ − vy ) June the 26th, 2017 J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange 4 / 21

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion Correctness Correctness Property Decrypt (sk , Encrypt (pk , µ , θ )) = µ C .Decode correctly decodes ρ − v · y whenever the error term is not too big ω ( s · r 2 − v · y + ǫ ) ≤ δ ω (( x + h · y ) · r 2 − ( r 1 + h · r 2 ) · y + ǫ ) ≤ δ ω ( x · r 2 − r 1 · y + ǫ ) ≤ δ Error distribution analysis → Decryption failure probability better understood June the 26th, 2017 J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange 5 / 21

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion Correctness Correctness Property Decrypt (sk , Encrypt (pk , µ , θ )) = µ C .Decode correctly decodes ρ − v · y whenever the error term is not too big ω ( s · r 2 − v · y + ǫ ) ≤ δ ω (( x + h · y ) · r 2 − ( r 1 + h · r 2 ) · y + ǫ ) ≤ δ ω ( x · r 2 − r 1 · y + ǫ ) ≤ δ Error distribution analysis → Decryption failure probability better understood June the 26th, 2017 J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange 5 / 21

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion Correctness Correctness Property Decrypt (sk , Encrypt (pk , µ , θ )) = µ C .Decode correctly decodes ρ − v · y whenever the error term is not too big ω ( s · r 2 − v · y + ǫ ) ≤ δ ω (( x + h · y ) · r 2 − ( r 1 + h · r 2 ) · y + ǫ ) ≤ δ ω ( x · r 2 − r 1 · y + ǫ ) ≤ δ Error distribution analysis → Decryption failure probability better understood June the 26th, 2017 J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange 5 / 21