QC-MDPC: A Timing Attack and a CCA2 KEM PQCrypto April 9, 2018 - PowerPoint PPT Presentation

QC-MDPC: A Timing Attack and a CCA2 KEM PQCrypto – April 9, 2018 Edward Eaton 1 , Matthieu Lequesne 2,3 , Alex Parent 1 and Nicolas Sendrier 3 1 - ISARA Corporation, Waterloo, Canada 2 - Sorbonne Université Paris, France 3 - Inria Paris, France – team Secret

Context

Public Key Cryptography ... 1011010001101 RSA [1977]

Public Key Cryptography + + [1994] ... 1011010001101 /////////// RSA [1977] ??? 2

Post-Quantum Cryptography Post-Quantum Cryptography Isogenies Lattice Codes Hash Multivariate McEliece MDPC Goppa [2013] [1978] QC-MDPC [2013] 3

Post-Quantum Cryptography Post-Quantum Cryptography Isogenies Lattice Codes Hash Multivariate McEliece MDPC Goppa [2013] [1978] QC-MDPC [2013] Code-based cryptosystem (à la McEliece) 3

Post-Quantum Cryptography Post-Quantum Cryptography Isogenies Lattice Codes Hash Multivariate McEliece MDPC Goppa [2013] [1978] QC-MDPC [2013] Code-based cryptosystem (à la McEliece) Goal: achieve relatively short keys 3

Post-Quantum Cryptography Post-Quantum Cryptography Isogenies Lattice Codes Hash Multivariate McEliece MDPC Goppa [2013] [1978] QC-MDPC [2013] Code-based cryptosystem (à la McEliece) Goal: achieve relatively short keys Idea: use (quasi)-cyclic structure. 3

Post-Quantum Cryptography Post-Quantum Cryptography Isogenies Lattice Codes Hash Multivariate McEliece MDPC Goppa [2013] [1978] QC-MDPC [2013] Code-based cryptosystem (à la McEliece) Goal: achieve relatively short keys Idea: use (quasi)-cyclic structure. 3

Post-Quantum Cryptography Post-Quantum Cryptography Isogenies Lattice Codes Hash Multivariate McEliece MDPC Goppa [2013] [1978] QC-MDPC [2013] Code-based cryptosystem (à la McEliece) Goal: achieve relatively short keys Idea: use (quasi)-cyclic structure. 3

QC-MDPC McEliece

QC-MDPC scheme k , d , t ∈ N parameters √ ( k prime, d odd, 2 d ∼ t ∼ 2 k ) R = F 2 [ X ] / ( X k − 1 )

QC-MDPC scheme k , d , t ∈ N parameters √ ( k prime, d odd, 2 d ∼ t ∼ 2 k ) R = F 2 [ X ] / ( X k − 1 ) private key � �� � ( h 0 , h 1 ) ← R | h 0 | = | h 1 | = d

QC-MDPC scheme k , d , t ∈ N parameters √ ( k prime, d odd, 2 d ∼ t ∼ 2 k ) R = F 2 [ X ] / ( X k − 1 ) public key � �� � q = h 1 · h − 1 private key 0 � �� � ( h 0 , h 1 ) ← R | h 0 | = | h 1 | = d

QC-MDPC scheme k , d , t ∈ N parameters √ ( k prime, d odd, 2 d ∼ t ∼ 2 k ) R = F 2 [ X ] / ( X k − 1 ) public key � �� � q = h 1 · h − 1 private key 0 � �� � ( h 0 , h 1 ) ← R | h 0 | = | h 1 | = d ( e 0 , e 1 ) ← R | e 0 | + | e 1 | = t

QC-MDPC scheme k , d , t ∈ N parameters √ ( k prime, d odd, 2 d ∼ t ∼ 2 k ) R = F 2 [ X ] / ( X k − 1 ) public key � �� � q = h 1 · h − 1 private key 0 � �� � ( h 0 , h 1 ) ← R | h 0 | = | h 1 | = d ( e 0 , e 1 ) ← R | e 0 | + | e 1 | = t c = e 0 + e 1 · q

QC-MDPC scheme k , d , t ∈ N parameters √ ( k prime, d odd, 2 d ∼ t ∼ 2 k ) R = F 2 [ X ] / ( X k − 1 ) public key � �� � q = h 1 · h − 1 private key 0 � �� � ( h 0 , h 1 ) ← R | h 0 | = | h 1 | = d ( e 0 , e 1 ) ← R | e 0 | + | e 1 | = t c = e 0 + e 1 · q c · h 0 = e 0 h 0 + e 1 h 1 ( e 0 , e 1 ) = Decode ( h 0 , h 1 , e 0 h 0 + e 1 h 1 )

QC-MDPC scheme k , d , t ∈ N parameters √ ( k prime, d odd, 2 d ∼ t ∼ 2 k ) R = F 2 [ X ] / ( X k − 1 ) public key � �� � q = h 1 · h − 1 private key 0 � �� � ( h 0 , h 1 ) ← R | h 0 | = | h 1 | = d ( e 0 , e 1 ) ← R | e 0 | + | e 1 | = t c = e 0 + e 1 · q c · h 0 = e 0 h 0 + e 1 h 1 ( e 0 , e 1 ) = Decode ( h 0 , h 1 , e 0 h 0 + e 1 h 1 ) Shared secret: ( e 0 , e 1 ) .

QC-MDPC scheme k , d , t ∈ N parameters √ ( k prime, d odd, 2 d ∼ t ∼ 2 k ) R = F 2 [ X ] / ( X k − 1 ) public key � �� � q = h 1 · h − 1 private key 0 � �� � ( h 0 , h 1 ) ← R | h 0 | = | h 1 | = d ( e 0 , e 1 ) ← R | e 0 | + | e 1 | = t c = e 0 + e 1 · q c · h 0 = e 0 h 0 + e 1 h 1 ( e 0 , e 1 ) = Decode ( h 0 , h 1 , e 0 h 0 + e 1 h 1 ) Shared secret: ( e 0 , e 1 ) . 5

QC-MDPC McEliece: Bit Flip Decoding ( e 0 , e 1 ) = Decode ( h 0 , h 1 , e 0 h 0 + e 1 h 1 ) � �� � s 6

QC-MDPC McEliece: Bit Flip Decoding ( e 0 , e 1 ) = Decode ( h 0 , h 1 , e 0 h 0 + e 1 h 1 ) � �� � s Find a sparse solution ( e 0 , e 1 ) such that:         e 0         h 0 h 1               � �       · = s                             e 1         6

QC-MDPC McEliece: Bit Flip Syndrome Decoding Input: H the parity-check matrix of the code C , s the syndrome Output: An error e of small weight such that He ⊺ = s e ← 0; s ′ ← s − He ⊺ while s ′ � = 0 do for j = 1 , . . . , n do if σ j = � s ′ , h j � ≥ threshold then Flip( e j ) s ′ ← s − He ⊺ return e 7

QC-MDPC McEliece: Bit Flip Syndrome Decoding Input: H the parity-check matrix of the code C , s the syndrome Output: An error e of small weight such that He ⊺ = s e ← 0; s ′ ← s − He ⊺ while s ′ � = 0 do for j = 1 , . . . , n do if σ j = � s ′ , h j � ≥ threshold then Flip( e j ) s ′ ← s − He ⊺ return e - While loop: variable number of iterations. 7

QC-MDPC McEliece: Bit Flip Syndrome Decoding Input: H the parity-check matrix of the code C , s the syndrome Output: An error e of small weight such that He ⊺ = s e ← 0; s ′ ← s − He ⊺ while s ′ � = 0 do for j = 1 , . . . , n do if σ j = � s ′ , h j � ≥ threshold then Flip( e j ) s ′ ← s − He ⊺ return e - While loop: variable number of iterations. - Decoding algorithm fails with a small probability (DFR). 7

QC-MDPC McEliece: Bit Flip Syndrome Decoding Input: H the parity-check matrix of the code C , s the syndrome Output: An error e of small weight such that He ⊺ = s e ← 0; s ′ ← s − He ⊺ while s ′ � = 0 do for j = 1 , . . . , n do if σ j = � s ′ , h j � ≥ threshold then Flip( e j ) s ′ ← s − He ⊺ return e - While loop: variable number of iterations. - Decoding algorithm fails with a small probability (DFR). - Thresholds? 7

The GJS Attack

The GJS Attack [GJS] Guo, Johansson, Stankovski, Asiacrypt 2016 Observation [GJS] When two non-zero bits appear at a distance δ both in the secret key and in the error vector, a decoding failure is less likely to occur. 9

Example: δ = 1     1 1 0 0 1 1 0 0 0 0   0 1 1 0 0 1 1 0 0   1          0 0 1 1 0 0 1 1 0  0         0 0 0 1 1 0 0 1 1 0           H = s = 1 0 0 0 1 1 0 0 1 1           0 1 1 0 0 0 1 1 0 0          1  0 1 1 0 0 0 1 1 0           0 0 0 1 1 0 0 0 1 1     1 1 0 0 1 1 0 0 0 1 � � e = 1 1 0 0 0 0 0 0 0 10

Example: δ = 1     1 1 0 0 1 1 0 0 0 0   0 1 1 0 0 1 1 0 0   1          0 0 1 1 0 0 1 1 0  0         0 0 0 1 1 0 0 1 1 0           H = s = 1 0 0 0 1 1 0 0 1 1           0 1 1 0 0 0 1 1 0 0          1  0 1 1 0 0 0 1 1 0           0 0 0 1 1 0 0 0 1 1     1 1 0 0 1 1 0 0 0 1 � � e = 1 1 0 0 0 0 0 0 0 10

Example: δ = 1     1 1 0 0 1 1 0 0 0 0   0 1 1 0 0 1 1 0 0   1          0 0 1 1 0 0 1 1 0  0         0 0 0 1 1 0 0 1 1 0           H = s = 1 0 0 0 1 1 0 0 1 1           0 1 1 0 0 0 1 1 0 0          1  0 1 1 0 0 0 1 1 0           0 0 0 1 1 0 0 0 1 1     1 1 0 0 1 1 0 0 0 1 � � e = 1 1 0 0 0 0 0 0 0 10

The GJS Attack [GJS] Guo, Johansson, Stankovski, Asiacrypt 2016 Observation [GJS] When two non-zero bits appear at a distance δ both in the secret key and in the error vector, a decoding failure is less likely to occur. ⇒ By observing the DFR for different error paterns we can recover information on the key. 11

The Distance Spectrum [GJS] Definition (Distance Spectrum) h = 1001000001 12

The Distance Spectrum [GJS] Definition (Distance Spectrum) h = 1001000001 ∆( h ) ⊇ { 1 } 12

The Distance Spectrum [GJS] Definition (Distance Spectrum) h = 1001000001 ∆( h ) ⊇ { 1 , 3 } 12