How SAGE helps to implement Goppa Codes and McEliece PKCSs

Transcription

1 How SAGE helps to implement and s DSI GmbH Bremen Institute of Informatics & Automation, IIA Faculty EEE & CS, Hochschule Bremen University of Applied Sciences, risse@hs-bremen.de ICIT 11, May 11 th, 2011, Amman, Jordan

2 1 2 3 The 4 5 Decoding generalized RS-Codes Agenda 6 The Algorithm 7 : Goppa-Codes in SAGE 8 SAGE does help to implement s

3 Bad news: Once quantum computers become operational, todays widely used public key cryptosystems, PKCSs like Rivest-Shamir-Adleman, RSA Diffie-Hellman (-Merkle) elliptic curve cryptography, ECC or the Buchmann-Williams key exchange are broken! [1], [12] Good news: Alternatives like Goldreich-Goldwasser-Halevi, GGH lattice based PKCSs hash based digital signature schemes or multivariate PKCSs are believed to be quantum computer resistant. [1]

4 Implement on FPGAs In order to do so, we adhere to a two-version-approach: we use a quick implementation in SAGE to test the implementation in VHDL so that we can check implementational details before hand in SAGE Experience shows that the open source computer algebra System for Algebraic and Geometric Experimentation, SAGE is a very potent tool for this task! Here, we will sketch sketch Goppa-Codes demonstrate implementation of algorithms in SAGE

5 The Three binary matrices specify a G, the k n generator matrix of a [n, k, 2t + 1]-Goppa-Code, i.e. n = 2 m, k = n mt S, a random non-singular k k scrambler matrix P, a random n n permutation matrix The triple (S, G, P) is a private key with corresponding public key Ĝ = SGP. Plain text is partitioned into bit-blocks u of length k. Each block is Goppa encoded to c = uĝ of length n. Each code word c is charged with maximal t 1-bit-errors, i.e. modified to y = c + e with error vector e. Using the private key, the receiver decodes y to yp 1 = cp 1 + ep 1 = usg + ep 1 per fast Goppa to us and per uss 1 to u.

6 are alternant generalized Reed-Solomon codes. Specifically, let F = GF 2, Φ = GF(q m ) and g(x) Φ[x] be a Goppa polynomial of degree t. Let L = {λ 1,..., λ n } GF(q m ) be the code locators with g(λ i ) 0 for i = 1, 2,..., n. Then the linear subspace C Goppa (L, g) = {(c 1,..., c n ) GF n 2 : n i=1 c i x λ i = 0 mod g(x)} is a [n, k, d] Goppa code with k n mt and canonical parity matrix H grs = ( ) λ i 1 deg g 1,n j i=1, diag( 1 j=1 g(λ 1 ), 1 g(λ 2 ),..., 1 g(λ n ) ). Selecting a base of Φ and representing each entry of H grs as a column vector in F m results in the parity matrix H Goppa of C Goppa with canonical generator matrix G Goppa = ker(h Goppa ).

7 Decoding generalized RS-Codes Information words u are encoded to code words c = ug Goppa. Received words y have syndromes s = H Goppa y which are decoded to the in the Hamming metric nearest code word by solving the key equation σ(x)s(x) = ω(x) mod x d 1 with gcd(σ, ω) = 1 and deg ω < deg σ (d 1)/2 by a variant of the extended Euclidean algorithm [9] using linear recurrences by the algorithm [9] in case of binary Goppa codes by the Patterson algorithm [2]

8 The Algorithm Berlekamp 1 -Massey 2 algorithm which computes a N-recurrence of (a syndrome) b(x). Input: polynomial b(x) F[x], 0 < N N Output: pair of polynomials ( σ N (x), ω N (x) ) over F σ 1 (x) = 0; σ o (x) = 1; ω 1 (x) = x 1 ; ω o (x) = 0; µ = 1; δ 1 = 1; for(i = 0; i < N; i + +){ δ i = coefficient of x i in σ i (x)b(x); σ i+1 (x) = σ i (x) (δ i /δ µ )x i µ σ µ (x); ω i+1 (x) = ω i (x) (δ i /δ µ )x i µ ω µ (x); if δ i 0 && 2 ord(σ i, ω i ) 1 then µ = i; } // where ord(σ, ω) = max{deg σ, 1 + deg ω} 1 Elwyn R. Berlekamp: Algebraic Coding Theory; Aegan Park Press 1984, Section James L. Massey: Shift-Register Synthesis and BCH Decoding; IEEE Trans. Inform. Theory. Vol. IT-p15, Nr. 1, 1969,

9 The Algorithm, contd. For given input b, the algorithm computes the N-recurrence (σ n, ω n ) over F with smallest recurrence order. Applied to a syndrome b the algorithm returns the error locator polynomial σ(x) and error evaluator polynomial ω(x). In case of a binary code we do not need to compute the error evaluator polynomial ω(x). We can translate the algorithm more or less literally to SAGE! Arrays in SAGE are numbered starting with index 0. For the sake of clarity, we use actual polynomials ω i and σ i instead of maintaining just two triples σ new, σ old, σ mu and ω new, ω old, ω mu of polynomials which are updated in each loop.

10 : Goppa-Codes in SAGE run the SAGE worksheet risse/papers/icit11/goppa_codes_bm.sws on any SAGE server, e.g. the official SAGE server the SAGE server at Hochschule Bremen

11 SAGE does (help to) implement s Summarizing SAGE is a very potent tool to implement e.g. McEliece PKCS. SAGE helps to develop and test e.g. an implementation in VHDL. SAGE helps to assess variants in this implementation: whether to do inversion in GF(2 m ) by table look up or by recursion [7] (a SAGE version is presented in [8]) whether to compute square roots in GF(2 m ) as well as in GF(2 m )[z]/g(z) by an algorithm [3] or by table look up whether to transform to and from normal bases in order to profit from the simple arithmetic using normal bases SAGE compares favourably with e.g. MATLABs Communication Tool Box.

12 Referenzen I [1] Daniel J. Bernstein, Johannes Buchmann, Erik Dahmen (Eds.): Post-Quantum Cryptography; Springer 2009 [2] Thomas Eisenbarth, Tim Güneysu, Stefan Heyse, Christof Paar: MicroEliece: McEliece for Embedded Devices; CHES 2009: publications/conferences/ches2009_microeliece.pdf [3] K. Huber: Note on Decoding Binary ; Electronics Letters, 32: , 1996 [4] Yuan-Xing Li, Da-Xing Li, Chuan-Kun Wu: How to Generate a Random Nonsingular Matrix in McEliece s PKCS; ICCS/ISITA 92, Singapore 1992, IEEE [5] Robert McEliece: Public Key Cryptosystem based on Algebraic Coding; DSN Progress Report 42-44, January/February 1978, jrblack/class/ csci7000/f03/papers/mceliece.pdf [6] N. J. Patterson: The Algebraic Decoding of ; IEEE Trans. on Information Theory, Vol IT-21, No 2, March

13 Referenzen II [7] Vincent Rijmen: Effcient Implementation of the Rijndael S-box; alternatively fft/crypto/rijndael-sbox.pdf or [8] [8] : SAGE, ein open source CAS vor allem auch für die diskrete Mathematik; Wismarer Frege-Reihe, ISSN , Heft 03/2010, S [9] Ron M. Roth: to Coding Theory; Cambridge University Press ronny/ [10] NN: System for Algebraic and Geometric Experimentation, SAGE [11] Arto Salomaa: Public Key Cryptography; Springer EATCS Monographs on Theoretical Computer Science Vol 23, 1990 [12] Peter W. Shor: Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer; Proc. 35 th Ann. Symposium on Foundations of Computer Science, Santa Fe, NM, Nov ,