Ramesses : a Rank Metric Encryption Scheme with Short Keys Julien - PowerPoint PPT Presentation

Ramesses : a Rank Metric Encryption Scheme with Short Keys Julien Lavauzelle , Pierre Loidreau, Ba-Duc Pham IRMAR, Université de Rennes 1 Groupe de travail cryptographie à base de codes 25/11/2019

Introduction Goal: design a new public-key encryption scheme ◮ based on the problem of decoding Gabidulin codes beyond their unique decoding radius , ◮ features very compact keys and short ciphertexts, ◮ admits efficient encryption and decryption algorithms. 1/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Outline 1. Past efforts Augot-Finiasz PKE Faure-Loidreau PKE 2. RAMESSES: new PKE based on rank metric Background The scheme Correctness Security 1/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Outline 1. Past efforts Augot-Finiasz PKE Faure-Loidreau PKE 2. RAMESSES: new PKE based on rank metric Background The scheme Correctness Security 1/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Codes in Hamming metric Linear code C ⊆ F n q , with Hamming metric: d ( a , b ) := |{ i ∈ [ 1 , n ] , a i � = b i }| . Let x = ( x 1 , . . . , x n ) ∈ F n q be pairwise distinct. The Reed-Solomon code of dimension k and evaluation vector x is RS k ( x ) := { ev x ( P ) := ( P ( x 1 ) , . . . , P ( x n )) | P ( X ) ∈ F q [ X ] < k } . 2/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Codes in Hamming metric Linear code C ⊆ F n q , with Hamming metric: d ( a , b ) := |{ i ∈ [ 1 , n ] , a i � = b i }| . Let x = ( x 1 , . . . , x n ) ∈ F n q be pairwise distinct. The Reed-Solomon code of dimension k and evaluation vector x is RS k ( x ) := { ev x ( P ) := ( P ( x 1 ) , . . . , P ( x n )) | P ( X ) ∈ F q [ X ] < k } . Decoding w errors in RS k ( x ) : unique decoding interpolation list dec. w = wt( e ) n √ 0 n − k n − k n − nk 2 easy hard V. Guruswami, A. Vardy, Maximum-likelihood decoding of Reed-Solomon codes is NP-hard, IEEE TIT, 2005. 2/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Augot-Finiasz cryptosystem D. Augot, M. Finiasz, A Public Key Encryption Scheme Based on the Polynomial Reconstruction Problem, EUROCRYPT, 2003. Public parameters: – x ∈ F n q pairwise distinct, locators of RS k ( x ) √ w ′ ≤ n − k − w – n , k , n − nk < w < n − k and . 2 3/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Augot-Finiasz cryptosystem D. Augot, M. Finiasz, A Public Key Encryption Scheme Based on the Polynomial Reconstruction Problem, EUROCRYPT, 2003. Public parameters: – x ∈ F n q pairwise distinct, locators of RS k ( x ) √ w ′ ≤ n − k − w – n , k , n − nk < w < n − k and . 2 KeyGen: � P ∈ F q [ X ] < k − 1 – private key: e ∈ F n q , wt( e ) = w – public key: noisy codeword k pub = ev x ( P + X k − 1 ) + e 3/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Augot-Finiasz cryptosystem Encrypt: plaintext is M ∈ F q [ X ] < k − 1 1. pick α ∈ F q and e ′ ∈ F n q , wt( e ′ ) = w ′ 2. ciphertext y = ev x ( M ) + α k pub + e ′ 4/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Augot-Finiasz cryptosystem Encrypt: plaintext is M ∈ F q [ X ] < k − 1 1. pick α ∈ F q and e ′ ∈ F n q , wt( e ′ ) = w ′ 2. ciphertext y = ev x ( M ) + α k pub + e ′ Decrypt: ciphertext is y ∈ F n q 1. puncture y at supp( e ) := { i ∈ [ 1 , n ] , e i � = 0 } → get y ′ ∈ F n − w q 2. decode w ′ errors from y ′ → get ev x ′ ( M ) + α ev x ′ ( P + X k − 1 ) ∈ F n − w q 3. interpolation + α X k − 1 → recover ( M + α P ) � �� � degree ≤ k − 2 → recover α → recover M 4/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Coron’s attack (1) J.-S. Coron, Cryptanalysis of a Public-Key Encryption Scheme Based on the Polynomial Reconstruction Problem, PKC, 2004. retrieve M from y = ev x ( M ) + α k pub + e ′ . Ciphertext attack: 5/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Coron’s attack (1) J.-S. Coron, Cryptanalysis of a Public-Key Encryption Scheme Based on the Polynomial Reconstruction Problem, PKC, 2004. retrieve M from y = ev x ( M ) + α k pub + e ′ . Ciphertext attack: Let V e ′ ( X ) = � i ∈ supp( e ′ ) ( X − x i ) . V e ′ ( x i )( y i − α k pub , i ) = V e ′ ( x i ) M ( x i ) , ∀ i = 1 , . . . , n 5/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Coron’s attack (1) J.-S. Coron, Cryptanalysis of a Public-Key Encryption Scheme Based on the Polynomial Reconstruction Problem, PKC, 2004. retrieve M from y = ev x ( M ) + α k pub + e ′ . Ciphertext attack: Let V e ′ ( X ) = � i ∈ supp( e ′ ) ( X − x i ) . V e ′ ( x i )( y i − α k pub , i ) = V e ′ ( x i ) M ( x i ) , ∀ i = 1 , . . . , n Consider the system: � V ( x i )( y i − λ k pub , i ) = A ( x i ) , ∀ i = 1 , . . . , n ( S λ ) deg V ≤ w ′ , deg A ≤ k − 1 + w ′ For all λ , ( S λ ) has n equations and u = k + 2 w ′ + 1 unkwowns (overdetermined). ◮ if λ � = α : non trivial solution with proba ≪ 1. ◮ if λ = α : ( V = V e ′ , A = V e ′ M ) is a solution. 5/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Coron’s attack (2) Goal: retrieve α Sketch of Coron’s attack: ◮ If ( S 0 ) has no non-zero solution: ◮ Find a full-rank sub-system ( S ′ λ ) of u equations (and u unknowns). λ ) is a polynomial of degree ≤ w ′ + 1) ◮ Solve det( S ′ ( λ �→ det( S ′ λ ) = 0 ◮ Get λ = α among the solutions. ◮ Otherwise: let ( V , A ) be a solution of ( S 0 ) . ◮ One can prove ( ≃ Berlekamp-Welch) that A V = M + α ( P + X k − 1 ) ∈ F q [ X ] . ◮ Find α as the leading coefficient of A V . 6/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Outline 1. Past efforts Augot-Finiasz PKE Faure-Loidreau PKE 2. RAMESSES: new PKE based on rank metric Background The scheme Correctness Security 6/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Rank metric codes Field extension F q / F 2 , say q = 2 m g = ( g 1 , . . . , g m ) ∈ F m q an ordered basis of F q / F 2 Extension map F n F m × n Ext g : → q 2 x → X = ( x i , j ) where x j = � n i = 1 g i x i , j ∈ F 2 m . By definition, Ext g ( gX ) = X . The rank distance is defined as: d ( x − y ) = rk( x − y ) := rk F 2 (Ext g ( x − y )) 7/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Gabidulin codes Let θ : x �→ x 2 the F 2 -linear Frobenius automorphism. If P ∈ F q [ X ] , then P ( θ ) ∈ End F 2 ( F q ) and dim(ker P ( θ )) ≤ deg P . 8/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Gabidulin codes Let θ : x �→ x 2 the F 2 -linear Frobenius automorphism. If P ∈ F q [ X ] , then P ( θ ) ∈ End F 2 ( F q ) and dim(ker P ( θ )) ≤ deg P . Let g = ( g 1 , . . . , g n ) ∈ F n q be F 2 -linearly independent. The Gabidulin code of dimension k and evaluation vector g is Gab k ( g ) := { P ( g ) := ( P ( θ )( g 1 ) , . . . , P ( θ )( g n )) | P ( X ) ∈ F q [ X ] < k } 8/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Gabidulin codes Let θ : x �→ x 2 the F 2 -linear Frobenius automorphism. If P ∈ F q [ X ] , then P ( θ ) ∈ End F 2 ( F q ) and dim(ker P ( θ )) ≤ deg P . Let g = ( g 1 , . . . , g n ) ∈ F n q be F 2 -linearly independent. The Gabidulin code of dimension k and evaluation vector g is Gab k ( g ) := { P ( g ) := ( P ( θ )( g 1 ) , . . . , P ( θ )( g n )) | P ( X ) ∈ F q [ X ] < k } Decoding errors of rank w in Gab k ( g ) : unique decoding interpolation w = rk( e ) n 0 n − k n − k 2 easy hard (worst case) N. Raviv, A. Wachter-Zeh, Some Gabidulin Codes Cannot Be List Decoded Efficiently at any Radius, IEEE TIT, 2016. 8/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Translation of Augot-Finiasz PKE into rank metric (1) Public parameters: – g ∈ F n q linearly independent over F 2 , < w < n − k and w ′ ≤ n − k − w n − k – k , . 2 2 9/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Translation of Augot-Finiasz PKE into rank metric (1) Public parameters: – g ∈ F n q linearly independent over F 2 , < w < n − k and w ′ ≤ n − k − w n − k – k , . 2 2 KeyGen: � P ∈ F q [ X ] < k − 1 – private key: e ∈ F n q , rk( e ) = w – public key: noisy codeword k pub = ( P + X k − 1 )( g ) + e 9/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Translation of Augot-Finiasz PKE into rank metric (2) Encrypt: plaintext is M ∈ F q [ X ] < k − 1 1. pick α ∈ F q and e ′ ∈ F n q , rk( e ′ ) = w ′ 2. ciphertext y = M ( g ) + α k pub + e ′ 10/28 J. Lavauzelle – RAMESSES – GT code-based crypto

Translation of Augot-Finiasz PKE into rank metric (2) Encrypt: plaintext is M ∈ F q [ X ] < k − 1 1. pick α ∈ F q and e ′ ∈ F n q , rk( e ′ ) = w ′ 2. ciphertext y = M ( g ) + α k pub + e ′ Decrypt: ciphertext is y ∈ F n q 1. “puncture” y at supp( e ) := � n i = 1 F 2 e i → get y ′ ∈ F n − w q 2. decode w ′ errors from y ′ → get M ( g ′ ) + α ( P + X k − 1 )( g ′ ) ∈ F n − w q 3. interpolation + α X k − 1 , then α , then M → recover ( M + α P ) � �� � degree ≤ k − 2 10/28 J. Lavauzelle – RAMESSES – GT code-based crypto