Code-Based Cryptography Error-Correcting Codes and Cryptography

Transcription

1 Code-Based Cryptography Error-Correcting Codes and Cryptography I. Márquez-Corbella 0

2 1. Error-Correcting Codes and Cryptography 1. Introduction I - Cryptography 2. Introduction II - Coding Theory 3. Encoding (Linear Transformation) 4. Parity Checking 5. Error Correcting Capacity 6. Decoding (A Difficult Problem) 7. Reed-Solomon Codes 8. Goppa Codes 9. McEliece Cryptosystem I. Márquez-Corbella CODE-BASED CRYPTOGRAPHY

3 New codes from the GRS codes 1. Main disadvantage of GRS codes: Consider GRS k (a, b) of length n, then n q 1

4 New codes from the GRS codes 1. Main disadvantage of GRS codes: Consider GRS k (a, b) of length n, then n q 2. New codes from GRS: How to construct codes over small alphabets with the same features as GRS codes? 1

5 New codes from the GRS codes 1. Main disadvantage of GRS codes: Consider GRS k (a, b) of length n, then n q 2. New codes from GRS: How to construct codes over small alphabets with the same features as GRS codes? Construct a GRS over a large extension of F 1

6 New codes from the GRS codes 1. Main disadvantage of GRS codes: Consider GRS k (a, b) of length n, then n q 2. New codes from GRS: How to construct codes over small alphabets with the same features as GRS codes? Construct a GRS over a large extension of F C NEW = GRS F 1

7 Alternant codes a = (a 1,..., a n ) F n q m with a i a j for all i j b = (b 1,..., b n ) F n q m with b i 0 for all i. Alternant codes Alt r (a, b) = (GRS r (a, b)) F q 2

8 Alternant codes a = (a 1,..., a n ) F n q m with a i a j for all i j b = (b 1,..., b n ) F n q m with b i 0 for all i. = support = column multipliers Alternant codes Alt r (a, b) = (GRS r (a, b)) F q 2

9 Alternant codes - Parameters Proposition Alt r (a, b) is an [n, k, d] q code with k n mr and d r + 1 3

10 Decoding Alternant codes Alt r (a, b) GRS n r (a, c) 4

11 Decoding Alternant codes Alt r (a, b) GRS n r (a, c) Efficient decoding algorithms which correct up to t = d 1 2 4

12 Decoding Alternant codes Alt r (a, b) GRS n r (a, c) Efficient decoding algorithms which correct up to t = d 1 2 We have an efficient decoding algorithm for Alt r (a, b) which corrects up to d 1 2 = r 2 4

13 Goppa Codes L = (α 1,..., α n ) F q m with α i α j for all i j g(x) F q m[x] monic polynomial with deg(g) = t and g(α i ) 0, i 5

14 Goppa Codes L = (α 1,..., α n ) F q m with α i α j for all i j = support g(x) F q m[x] monic polynomial with deg(g) = t and g(α i ) 0, i = generator polynomial 5

15 Goppa Codes L = (α 1,..., α n ) F q m with α i α j for all i j g(x) F q m[x] monic polynomial with = support deg(g) = t and g(α i ) 0, i = generator polynomial Goppa Code Γ (L, g) = Alt t (a, b) = (GRS t (a, b)) F q with a = L and b i = 1 g(a i ) 5

16 Goppa Codes L = (α 1,..., α n ) F q m with α i α j for all i j g(x) F q m[x] monic polynomial with = support deg(g) = t and g(α i ) 0, i = generator polynomial Goppa Code Γ (L, g) = Alt t (a, b) = (GRS t (a, b)) F q with a = L and b i = 1 g(a i ) Proposition: Alternative definition of Goppa codes 5 c Γ (L, g) R c (X) = n j=1 c j X α j 0 mod g(x)

17 Alternative Definition of Goppa Codes n c Γ(L, g) c i p i,j = 0 for j = 1,..., t 1 i=1 with p i,j such that p i (X) = p i,0 + p i,1 X p i,t 1 X t 1 1 mod g(x) X α i 6

18 Alternative Definition of Goppa Codes c Γ(L, g) n c i p i,j = 0 for j = 1,..., t 1 i=1 with p i,j such that p i (X) = p i,0 + p i,1 X p i,t 1 X t 1 1 mod g(x) X α i Thus p 1,0 p n,0 H =..... Fq t n is a parity-check matrix for Γ(L, g) p 1,t 1 p n,t 1 6

19 Alternative Definition of Goppa Codes c Γ(L, g) n c i p i,j = 0 for j = 1,..., t 1 i=1 We claim that p i (X) g(x) g(α i) X α i g(α i ) 1 mod g(x) 1. g(x) g(α j ) has α j as zero. So g(x) g(α j ) is divisible by X α j 2. p i (X)(X α j ) = ( g(x) g(α j ) ) g(α j ) 1 = 1 g(x)g(α j ) 1 1 mod g(x) 6

20 Alternative Definition of Goppa Codes Let g(x) = g 0 + g 1 X g t X t p i (X) g(x) g(α i) X α i g(α i ) 1 mod g(x) Result from the previous slide 7

21 Alternative Definition of Goppa Codes Let g(x) = g 0 + g 1 X g t X t p i (X) t j=1 j 1 g j l=0 X l α j 1 l i g(α i ) 1 mod g(x) X j α j i X α i X j 1 + α i X j α j 1 i 7

22 Alternative Definition of Goppa Codes Let g(x) = g 0 + g 1 X g t X t p i (X) t 1 l=0 t j=l+1 g j α j 1 l i g(α i ) 1 X l mod g(x) Rearrange the terms 7

23 Alternative Definition of Goppa Codes Let g(x) = g 0 + g 1 X g t X t p i (X) t 1 l=0 t j=l+1 g j α j 1 l i g(α i ) 1 X l mod g(x) Thus we have the following expressions for p i,j : p i,0 = (g 1 + g 2 α i g t α t 1 i )g(α i ) 1 p i,1 = (g 2 + g 3 α i g t α t 2 i )g(α i ) 1... p i,t 1 = g t g(α i ) 1 7

24 Alternative Definition of Goppa Codes Let g(x) = g 0 + g 1 X g t X t t 1 t p i (X) l=0 j=l+1 g j α j 1 l i g(α i ) 1 X l mod g(x) We find that H = CAB with g t C = 0 0 g t... g 3, 0 g t g t 1 g 2 g t g t 1 g t 2 g α 1 α n g(α 1 ) 1 0 A =..... and B =... α t 1 1 αn t 1 0 g(α n ) 1 7

25 Alternative Definition of Goppa Codes Since C is invertible H = A B = 1 1 α 1 α n..... α t 1 1 αn t 1 g(α 1 ) g(α n ) 1 is another parity check matrix for Γ(L, g) 8

26 Binary Goppa Codes L = (α 1,..., α n ) F 2 m with α i α j for all i j g(x) F 2 m[x] monic separable polynomial with deg(g) = t and g(α i ) 0, i Separable = All its roots are distinct = Square Free polynomial 9

27 Binary Goppa Codes L = (α 1,..., α n ) F 2 m with α i α j for all i j = support g(x) F 2 m[x] monic separable polynomial with deg(g) = t and g(α i ) 0, i = generator polynomial Separable = All its roots are distinct = Square Free polynomial 9

28 Binary Goppa Codes L = (α 1,..., α n ) F 2 m with α i α j for all i j = support g(x) F 2 m[x] monic separable polynomial with deg(g) = t and g(α i ) 0, i = generator polynomial Proposition The binary Goppa code Γ(L, g) has minimum distance d with d 2t + 1 9

29 Binary Goppa Codes Proposition Let g be a square free Goppa polynomial with coefficients in F 2 m. Then, Γ(L, g) = Γ(L, g 2 ) Proof: 10

30 Binary Goppa Codes Proposition Let g be a square free Goppa polynomial with coefficients in F 2 m. Then, Alt r (L, 1 g(α i ) ) =Γ(L, g) = Γ(L, 1 g2 ) = Alt 2r (L, g 2 (α i ) ) Proof: 10

31 Binary Goppa Codes Proposition Let g be a square free Goppa polynomial with coefficients in F 2 m. Then, the binary Goppa code Γ(L, g) has minimum distance d with d 2t + 1 Proof: 11

32 1. Error-Correcting Codes and Cryptography 1. Introduction I - Cryptography 2. Introduction II - Coding Theory 3. Encoding (Linear Transformation) 4. Parity Checking 5. Error Correcting Capacity 6. Decoding (A Difficult Problem) 7. Reed-Solomon Codes 8. Goppa Codes 9. McEliece Cryptosystem I. Márquez-Corbella CODE-BASED CRYPTOGRAPHY