McEliece and Niederreiter Cryptosystems That Resist Quantum Fourier Sampling Attacks

Transcription

1 McEliece and Niederreiter Cryptosystems That Resist Quantum Fourier Sampling Attacks Hang Dinh Indiana Uniersity South Bend joint work with Cristopher Moore Uniersity of New Mexico Alexander Russell Uniersity of Connecticut

2 Post-quantum cryptography Shor s quantum algorithms for Factoring and Discrete Logarithm break RSA, ElGamal, elliptic cure cryptography... Are there post-quantum cryptosystems? cryptosystems we can carry out with classical computers [unlike quantum cryptosystems, which require quantum facility] which will remain secure een if and when quantum computers are built.

3 Post-quantum cryptography Candidates for post-quantum cryptosystems: lattice-based code-based (the McEliece system and its relaties) hash-based multiariate secret-key cryptography Bernstein, 2009: These systems are belieed to resist quantum computers. Nobody has figured out a way to apply Shor s algorithm to any of these systems.

4 We show that some McEliece and Niederreiter cryptosystems resist the natural analog of Shor s quantum attack.

5 How Shor s algorithm works Breaking RSA priate key Breaking ElGamal, elliptic cure cryptography Integer Factorization Discrete Logarithm Hidden Subgroup Problem oer a cyclic group Z N Hidden Subgroup Problem oer an abelian group Z N Z N Quantum Fourier Sampling oer Z N Quantum Fourier Sampling oer Z N Z N

6 Hidden Subgroup Problem (HSP) HSP oer a finite group G: Input: function f : G {,, } that distinguishes the left cosets of an unknown subgroup H <G Output: H H g 2 H g 3 H g k H Notable reductions to nonabelian HSP: Unique Shortest Vector Problem HSP oer D n [Rege 04] Graph Isomorphism HSP oer S n with H 2

7 Quantum Fourier Sampling (QFS) QFS oer G to find hidden subgroup H: Uniform superposition oer G Use input function f random coset state gh uniform superposition oer coset gh Quantum Fourier transform,i, j gh ij,i, j Measure weak strong block matrix corresponding to irreducible representation ρ of G ρ ρ ρ column j

8 McEliece/Niederreiter Cryptosystems Scramble M s rows Permute M s columns

9 McEliece/Niederreiter Cryptosystems McEliece system F q = F q l l = 1 M is a generator matrix of an n, k -code oer F q. Equialent to the McEliece system using C, if dim C = n lk. Originally used classical binary Goppa codes (q=2) Niederreiter system F q F q l l 1 M is a parity check matrix of an n, k -code C oer F q. Equialent to the McEliece system using C, if k = n lk. Originally used rational Goppa codes (GRS codes)

10 Security of McEliece and Niederreiter Systems Two basic types of attacks Decoding attacks [preious talk] Attacks on priate key [this talk] Recoer S, M, P from M* Security against known classical attacks Still secure if using classical Goppa codes [EOS 07] Broken if using rational Goppa codes (Ouch!) Sidelnoko & Shestako s attack factors SMP into S and MP.

11 ~ McEliece/Niederreiter s security reduces to HSP Scrambler-Permutation Problem Gien: M and M* = SMP for some (S, P) GL k (F q ) S n Find: S and P Can this HSP be soled by strong QFS?

12 Our Answer (1) Strong QFS yields negligible information about hidden (S, P) if M is good, meaning M has column rank r k o Aut M e o n, and n /l, Minimal degree of Aut(M) is (n). Next question: the minimal number of points moed by a non-identity permutation in Aut(M) Are there matrices M satisfying the conditions aboe?

13 Our Answer (2) k n n k k n n n S M 's are distinct. }, { F {0}, F, F GL i q i q i q k l l l S

14 Conclusion The following cryptosystems resist the natural analog of Shor s QFS attack: McEliece systems using rational Goppa codes Niederreiter systems using classical Goppa codes. In general, any McEliece/Niederreiter system using linear codes with good generator/parity check matrices. Warning: This neither rules out other quantum (or classical) attacks nor iolates a natural hardness assumption.

15 Conclusion (Moral) Quantum Fourier Sampling need new ideas RSA ElGamal McEliece Niederreiter

16 Open Questions What are other linear codes that possess good generator/parity check matrices? Can these cryptosystems resist stronger quantum attacks, e.g., multiple-register QFS attacks? Hallgren et al., 2006: subgroups of order 2 require highly-entangled measurements of many coset states. Does this hold for subgroups of order > 2?

17 Questions? Thank you all for staying till the last minute!

18 Parameters In case of Niederreiter systems using a classical q-ary Goppa code C, we need q k 2 n 0.2 n and q 3 l e on Typically, n = q l, then we only need k 2 0.2nl, which implies C must hae large dimension: dim C n kl n 0.2n l 3/ 2