Code-Based Cryptography McEliece Cryptosystem

Transcription

1 Code-Based Cryptography McEliece Cryptosystem I. Márquez-Corbella 0

2 . McEliece Cryptosystem 1. Formal Definition. Security-Reduction Proof 3. McEliece Assumptions 4. Notions of Security 5. Critical Attacks - Semantic Secure Conversions 6. Reducing the Key Size 7. Reducing the Key Size - LDPC codes 8. Reducing the Key Size - MDPC codes 9. Implementation I. Márquez-Corbella CODE-BASED CRYPTOGRAPHY

3 McEliece Assumptions The security of the McEliece Cryptosystem is based in two assumptions: 1

4 McEliece Assumptions The security of the McEliece Cryptosystem is based in two assumptions: 1

5 McEliece Assumptions The security of the McEliece Cryptosystem is based in two assumptions: Assumption : The generator matrix of a Goppa code looks random. 1

6 Syndrome Decoder Given an [n, k] q code C with parity check matrix H F (n k) n q. Let y F n q be the received word. Minimum Dist. Decoding (MDD): Find x C such that d H (y, x) is minimized. Syndrome Decoding (SD): Find e F n q with He = Hy and w H (e) is minimized. In a linear code: d H (x, y) = w H (x y) = w H (e) if y = c + e, i.e. Hy = He

7 Syndrome Decoder Given an [n, k] q code C with parity check matrix H F (n k) n q. Let y F n q be the received word. Minimum Dist. Decoding (MDD): Find x C such that d H (y, x) is minimized. Syndrome Decoding (SD): Find e F n q with He = Hy and w H (e) is minimized. In a linear code: d H (x, y) = w H (x y) = w H (e) if y = c + e, i.e. Hy = He Minimal codewords: Consider y = 0 F n q Find w C i.e. He = 0 and w H (w) is minimized.

8 The Syndrome Decoding (SD) problem 3

9 The Syndrome Decoding (SD) problem n k H Input: A matrix H F (n k) n 3 n

10 The Syndrome Decoding (SD) problem Input: n k H = s A matrix H F (n k) n A syndrome s F n k 3 n

11 The Syndrome Decoding (SD) problem e Input: n k 3 H n = s A matrix H F (n k) n A syndrome s F n k A weight w Z

12 The Syndrome Decoding (SD) problem Output (Decision): Does e F n of w H(e) w such that eh T = s exists? NP-complete n k 3 E. R. Berlekamp, R. J. McEliece and H. C. A. van Tilborg. On the Inherent Intractability of Certain Coding Problems. IEEE Trans. Inf. Theory. Vol. 4, pp , e H n = s Input: A. Barg. Complexity Issues in Coding Theory. Chapter 7, in Handbock of Coding Theory, A matrix H F (n k) n A syndrome s F n k A weight w Z

13 The Syndrome Decoding (SD) problem Output (Decision): Does e F n of w H(e) w such that eh T = s exists? (Computational): Find e F n of w H(e) w such that eh T = s NP-complete NP-difficult n k 3 E. R. Berlekamp, R. J. McEliece and H. C. A. van Tilborg. On the Inherent Intractability of Certain Coding Problems. IEEE Trans. Inf. Theory. Vol. 4, pp , e H n = s Input: A. Barg. Complexity Issues in Coding Theory. Chapter 7, in Handbock of Coding Theory, A matrix H F (n k) n A syndrome s F n k A weight w Z

14 The Bounded-Distance Decoding problem e n k H n = s A matrix H F (n k) n A syndrome s F n k A weight w Z 4

15 The Bounded-Distance Decoding problem n k e H n = s Input: A matrix H F (n k) n A syndrome s F n k A weight w d 1 4

16 The Bounded-Distance Decoding problem (Computational): Find e F n of w H(e) d 1 such that eh T = s Conjectured NP-Hard n k e H n = s Input: A matrix H F (n k) n A syndrome s F n k A weight w d 1 4

17 The Bounded-Distance Decoding problem (Computational): Find e F n of w H(e) d 1 such that eh T = s Conjectured NP-Hard n k A. Barg. Complexity Issues in Coding Theory. Chapter 7, in Handbock of Coding Theory, e H n = s Input: A matrix H F (n k) n A syndrome s F n k A weight w d 1 4

18 The Goppa Parameterized Syndrome Decoding e n k H n = s A matrix H F (n k) n A syndrome s F n k 5

19 The Goppa Parameterized Syndrome Decoding e Input: n k H = s A matrix H F (n k) n with k = n mt and n = m A syndrome s F n k n 5

20 The Goppa Parameterized Syndrome Decoding (Computational): Find e F n of w H(e) n k such that eh T = s NP-difficult e Input: n k H = s A matrix H F (n k) n with k = n mt and n = m A syndrome s F n k n 5

21 The Goppa Parameterized Syndrome Decoding (Computational): Find e F n of w H(e) n k such that eh T = s NP-difficult M. Finiasz. Nouvelles constructions utilisant des codes correcteurs d erreurs en cryptographie à clef publique. PhD thesis, INRIA - Ecole Polytechnique, 004 e Input: n k H = s A matrix H F (n k) n with k = n mt and n = m A syndrome s F n k n 5

22 Distinguisher for Goppa codes Assumption : The generator matrix of a Goppa code looks random. 6

23 Distinguisher for Goppa codes Assumption : The generator matrix of a Goppa code looks random. K Goppa = All generator matrices of a [n, k]-binary Goppa code Goppa Code Distinguishing (GCD) problem INPUT: A matrix G F k n OUTPUT: Is G K Goppa? Conjectured NP-hard 6

24 Distinguisher for Goppa codes Assumption : The generator matrix of a Goppa code looks random. K Goppa = All generator matrices of a [n, k]-binary Goppa code Goppa Code Distinguishing (GCD) problem Conjectured NP-hard INPUT: A matrix G F k n OUTPUT: Is G K Goppa? 1. There exists an efficient distinguisher for high-rate codes. J.. Faugère, V. Gauthier-Umana, A. Otmani, L. Perret and J. P. Tillich A Distinguisher for High-Rate McEliece Cryptosystems. IEEE Trans. Inf. Theory. 59(10), pp ,

25 Distinguisher for Goppa codes Assumption : The generator matrix of a Goppa code looks random. K Goppa = All generator matrices of a [n, k]-binary Goppa code Goppa Code Distinguishing (GCD) problem Conjectured NP-hard INPUT: A matrix G F k n OUTPUT: Is G K Goppa? 1. There exists an efficient distinguisher for high-rate codes. J.. Faugère, V. Gauthier-Umana, A. Otmani, L. Perret and J. P. Tillich A Distinguisher for High-Rate McEliece Cryptosystems. IEEE Trans. Inf. Theory. 59(10), pp , General case: best-known attacks are based on the support splitting algorithm and have exponential runtime. 6 P. Loidreau, N. Sendrier Weak keys in McEliece public-key cryptosystem. IEEE Trans. Inf. Theory 47(3):107âĂŞ11

26 McEliece Assumptions We have seen that: The general decoding problem of a linear code whose parameters are those of a binary Goppa code is in the average case difficult. There exists no efficient distinguisher for Goppa codes 7

27 . McEliece Cryptosystem 1. Formal Definition. Security-Reduction Proof 3. McEliece Assumptions 4. Notions of Security 5. Critical Attacks - Semantic Secure Conversions 6. Reducing the Key Size 7. Reducing the Key Size - LDPC codes 8. Reducing the Key Size - MDPC codes 9. Implementation I. Márquez-Corbella CODE-BASED CRYPTOGRAPHY