Two attacks on rank metric code-based Jean-Pierre Tillich schemes: - PowerPoint PPT Presentation

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Two attacks on rank metric code-based Jean-Pierre Tillich schemes: RankSign and an IBE scheme Generalities on Rank-Based Cryptography LRPC-codes in RankSign Thomas Debris-Alazard and Jean-Pierre Tillich [GMRZ13] Our Attack December 3, 2018 Asiacrypt 2018 - Brisbane 1 / 22

Two attacks on rank metric code-based Results schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Results of the paper: Jean-Pierre Tillich Generalities on • Attack on a code-based “hash-and-sign” scheme RankSign Rank-Based Cryptography [GRSZ14] submitted to the NIST PQC Standardization; LRPC-codes in RankSign − → Can not be thwarted by changing the parameters. [GMRZ13] Our Attack • Attack on the first code-based Identity-Based-Encryption (IBE) [GHPT17] in rank-metric; − → Parameters can be chosen to avoid it. • IBE: moving Rank → Hamming metric no go. 2 / 22

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre 1 Generalities on Rank-Based Cryptography Tillich Generalities on Rank-Based Cryptography LRPC-codes in 2 LRPC-codes in RankSign [GMRZ13] RankSign [GMRZ13] Our Attack 3 Our Attack 3 / 22

Two attacks on rank metric code-based Rank vs Hamming in schemes: RankSign and an IBE scheme Cryptography Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography • Advantages: • In rank metric: alphabet size q m has an impact on the metric LRPC-codes in RankSign [GMRZ13] → Useful for security reductions Our Attack • Smaller key sizes than Hamming. • Disadvantage: • Rank metric: security less understood (algebraic attacks) 4 / 22

Two attacks on rank metric code-based Code-Based Cryptography schemes: RankSign and an IBE scheme Thomas F finite field. Debris-Alazard and Jean-Pierre Tillich Syndrome Decoding Problem. Generalities on • Given: a matrix H ∈ F r × n with r ≤ n , a vector s ∈ F r , an Rank-Based Cryptography integer w ; LRPC-codes in RankSign � He ⊺ = s ⊺ [GMRZ13] Our Attack • Goal: find e ∈ F n , weight ( e ) = w Hamming: weight ( · ) = # non-zero components and usually F = F 2 Rank: weight ( · ) = Rank metric and F = F q m − → Probabilistic polynomial reduction (Gaborit & Zémor) to the decoding problem in Hamming metric 5 / 22

Two attacks on rank metric code-based Rank Metric over F q m schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich • F q m is a F q -space of dimension m Generalities on Rank-Based Cryptography LRPC-codes in • x = ( x 1 , · · · , x n ) ∈ F n q m , its rank is defined as: RankSign [GMRZ13] Our Attack �� � △ Support of x : � x 1 , · · · , x n � F q = λ i x i : λ i ∈ F q ⊆ F q m i � � rank ( x ) = dim F q � x 1 , · · · , x n � F q 6 / 22

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre 1 Generalities on Rank-Based Cryptography Tillich Generalities on Rank-Based Cryptography LRPC-codes in 2 LRPC-codes in RankSign [GMRZ13] RankSign [GMRZ13] Our Attack 3 Our Attack 7 / 22

Two attacks on rank metric code-based Some History... schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on • Gabidulin codes: first rank-codes with a polynomial decoder Rank-Based Cryptography → Strong algebraic structure... and a zillion attacks LRPC-codes in RankSign (Overbeck’05...) [GMRZ13] Our Attack • LRPC-codes: decoder introduced in [GMRZ13] → Finding the underlying structure is close to solving the syndrome decoding problem. 8 / 22

Two attacks on rank metric code-based LRPC-codes [GMRZ13] schemes: RankSign and an IBE scheme Thomas • Random Code: Given some random matrix H Rand ∈ F ( n − k ) × n Debris-Alazard q m and Jean-Pierre { c : H Rand c ⊺ = 0 } Tillich Generalities on • LRPC Code: Given H LRPC = ( h i , j ) ∈ F ( n − k ) × n Rank-Based s.t Cryptography q m LRPC-codes in RankSign � � dim � h i , j : i , j � F q = small [GMRZ13] Our Attack then, ⊺ = 0 } { c LRPC : H LRPC c LRPC When H Rand = ( h i , j ) ∈ F ( n − k ) × n is random, typically when q m m < n ( n − k ) : � h i , j : i , j � F q = F q m . 9 / 22

Two attacks on rank metric code-based LRPC-codes in schemes: RankSign and an IBE scheme RankSign[GRSZ14] Thomas Debris-Alazard and Jean-Pierre Tillich LRPC-codes come in RankSign with a decoder [GRSZ14]: Generalities on � H LRPC e ⊺ = s ⊺ Rank-Based Cryptography ∀ s , it computes polynomially e s.t rank ( e ) = w LRPC-codes in RankSign [GMRZ13] • Constraint RankSign: H LRPC = ( h i , j ) ∈ F ( n − k ) × n Our Attack s.t q m � � ( n − k ) dim � h i , j : i , j � F q = n Problem: Rows of H LRPC gives words of low weight... → A masking is needed! 10 / 22

Two attacks on rank metric code-based Masking LRPC-codes in schemes: RankSign and an IBE scheme RankSign Thomas Debris-Alazard and Jean-Pierre Tillich In RankSign [GRSZ14]: Generalities on Rank-Based Cryptography LRPC-codes in • Increase the weight of rows: [ H LRPC | R ] for R random; RankSign [GMRZ13] Our Attack • Change the code: [ H LRPC | R ] P for P invertible in F q . • Change the basis: Q [ H LRPC | R ] P for Q invertible; △ H pub = Q [ H LRPC | R ] P : public key 11 / 22

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre 1 Generalities on Rank-Based Cryptography Tillich Generalities on Rank-Based Cryptography LRPC-codes in 2 LRPC-codes in RankSign [GMRZ13] RankSign [GMRZ13] Our Attack 3 Our Attack 12 / 22

Two attacks on rank metric code-based Idea of the Attack schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based To look for low weight codewords... where? Cryptography LRPC-codes in RankSign △ [GMRZ13] • Suspect: C ⊥ = { mH pub : m ∈ F q m } ; pub Our Attack = { c : H pub c ⊺ = 0 } . △ • Real Problem: C pub 13 / 22

Two attacks on rank metric code-based Low Rank Codewords in an schemes: RankSign and an IBE scheme LRPC? Thomas Debris-Alazard and H LRPC = ( h i , j ) ∈ F ( n − k ) × n with � h i , j : i , j � F q = F Jean-Pierre q m Tillich c = ( c j ) ∈ F n q m Generalities on Rank-Based n Cryptography H LRPC c ⊺ = 0 ⇐ � ⇒ ∀ i ∈ � 1 , n − k � , h i , j c j = 0 LRPC-codes in RankSign j = 1 [GMRZ13] Our Attack 14 / 22

Two attacks on rank metric code-based Low Rank Codewords in an schemes: RankSign and an IBE scheme LRPC? Thomas Debris-Alazard and H LRPC = ( h i , j ) ∈ F ( n − k ) × n with � h i , j : i , j � F q = F Jean-Pierre q m Tillich c = ( c j ) ∈ F n q m Generalities on Rank-Based n Cryptography H LRPC c ⊺ = 0 ⇐ � ⇒ ∀ i ∈ � 1 , n − k � , h i , j c j = 0 LRPC-codes in RankSign j = 1 [GMRZ13] Our Attack Suppose that � c 1 , · · · , c n � F q = F ′ n h i , j c j ∈ F ′ · F △ = � f ′ f : f ′ ∈ F ′ , f ∈ F � F q � ∀ i ∈ � 1 , n − k � , j = 1 This gives a linear system in F q with • ( n − k ) dim F q ( F · F ′ ) equations; • n dim F q ( F ′ ) unknowns. → We would like # Unknowns > # Equations to ensure the existence of solutions 14 / 22

Two attacks on rank metric ... But How to Choose F ′ ? code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and What we want: Jean-Pierre Tillich n dim F q ( F ′ ) > ( n − k ) dim F q ( F · F ′ ) Generalities on Rank-Based Cryptography LRPC-codes in RankSign What we typically have: [GMRZ13] Our Attack n dim F q ( F ′ ) =( n − k ) dim F q ( F · F ′ ) Because, � dim F q ( F · F ′ ) = dim F q ( F ) dim F q ( F ′ ) (typically) ( n − k ) dim ( F ) = n (RankSign). 15 / 22

Two attacks on rank metric The Subspace F · F ′ code-based schemes: RankSign and an IBE scheme △ = � x 1 , · · · , x d � F q ( F = � h i , j : i , j � F q ) F Thomas Debris-Alazard and Let F ′ △ Jean-Pierre = � x 1 , x 2 � F q ⊆ F . Tillich F · F ′ = � x 2 1 , x 1 x 2 , · · · , x 1 x d , x 2 x 1 , x 2 2 , · · · , x 2 x d � F q . Generalities on Rank-Based Cryptography ⇒ dim ( F · F ′ ) ≤ 2 d − 1 LRPC-codes in RankSign Therefore, [GMRZ13] Our Attack # Unknowns − # Equations = n dim F q ( F ′ ) − ( n − k ) dim F q ( F · F ′ ) = 2 n − ( n − k )( 2 d − 1 ) 16 / 22

Two attacks on rank metric The Subspace F · F ′ code-based schemes: RankSign and an IBE scheme △ = � x 1 , · · · , x d � F q ( F = � h i , j : i , j � F q ) F Thomas Debris-Alazard and Let F ′ △ Jean-Pierre = � x 1 , x 2 � F q ⊆ F . Tillich F · F ′ = � x 2 1 , x 1 x 2 , · · · , x 1 x d , x 2 x 1 , x 2 2 , · · · , x 2 x d � F q . Generalities on Rank-Based Cryptography ⇒ dim ( F · F ′ ) ≤ 2 d − 1 LRPC-codes in RankSign Therefore, [GMRZ13] Our Attack # Unknowns − # Equations = n dim F q ( F ′ ) − ( n − k ) dim F q ( F · F ′ ) = 2 n − ( n − k )( 2 d − 1 ) Constraint in RankSign: n = ( n − k ) d which gives: # Unknowns − # Equations = 2 ( n − k ) d − ( n − k )( 2 d − 1 ) = n − k > 0 16 / 22