Code-Based Cryptography Error-Correcting Codes and Cryptography

Code-Based Cryptography Error-Correcting Codes and Cryptography I. Márquez-Corbella 0

1. Error-Correcting Codes and Cryptography 1. Introduction I - Cryptography 2. Introduction II - Coding Theory 3. Encoding (Linear Transformation) 4. Parity Checking 5. Error Correcting Capacity 6. Decoding (A Difficult Problem) 7. Reed-Solomon Codes 8. Goppa Codes 9. McEliece Cryptosystem I. Márquez-Corbella CODE-BASED CRYPTOGRAPHY

New codes from the GRS codes 1. Main disadvantage of GRS codes: Consider GRS k (a, b) of length n, then n q 1

New codes from the GRS codes 1. Main disadvantage of GRS codes: Consider GRS k (a, b) of length n, then n q 2. New codes from GRS: How to construct codes over small alphabets with the same features as GRS codes? 1

Alternant codes a = (a 1,..., a n ) F n q m with a i a j for all i j b = (b 1,..., b n ) F n q m with b i 0 for all i. Alternant codes Alt r (a, b) = (GRS r (a, b)) F q 2

Alternant codes a = (a 1,..., a n ) F n q m with a i a j for all i j b = (b 1,..., b n ) F n q m with b i 0 for all i. = support = column multipliers Alternant codes Alt r (a, b) = (GRS r (a, b)) F q 2

Alternant codes - Parameters Proposition Alt r (a, b) is an [n, k, d] q code with k n mr and d r + 1 3

Decoding Alternant codes Alt r (a, b) GRS n r (a, c) 4

Decoding Alternant codes Alt r (a, b) GRS n r (a, c) Efficient decoding algorithms which correct up to t = d 1 2 4

Decoding Alternant codes Alt r (a, b) GRS n r (a, c) Efficient decoding algorithms which correct up to t = d 1 2 We have an efficient decoding algorithm for Alt r (a, b) which corrects up to d 1 2 = r 2 4

Goppa Codes L = (α 1,..., α n ) F q m with α i α j for all i j g(x) F q m[x] monic polynomial with deg(g) = t and g(α i ) 0, i 5

Goppa Codes L = (α 1,..., α n ) F q m with α i α j for all i j = support g(x) F q m[x] monic polynomial with deg(g) = t and g(α i ) 0, i = generator polynomial 5

Goppa Codes L = (α 1,..., α n ) F q m with α i α j for all i j g(x) F q m[x] monic polynomial with = support deg(g) = t and g(α i ) 0, i = generator polynomial Goppa Code Γ (L, g) = Alt t (a, b) = (GRS t (a, b)) F q with a = L and b i = 1 g(a i ) 5

Alternative Definition of Goppa Codes n c Γ(L, g) c i p i,j = 0 for j = 1,..., t 1 i=1 with p i,j such that p i (X) = p i,0 + p i,1 X +... + p i,t 1 X t 1 1 mod g(x) X α i 6

Alternative Definition of Goppa Codes c Γ(L, g) n c i p i,j = 0 for j = 1,..., t 1 i=1 with p i,j such that p i (X) = p i,0 + p i,1 X +... + p i,t 1 X t 1 1 mod g(x) X α i Thus p 1,0 p n,0 H =..... Fq t n is a parity-check matrix for Γ(L, g) p 1,t 1 p n,t 1 6

Alternative Definition of Goppa Codes c Γ(L, g) n c i p i,j = 0 for j = 1,..., t 1 i=1 We claim that p i (X) g(x) g(α i) X α i g(α i ) 1 mod g(x) 1. g(x) g(α j ) has α j as zero. So g(x) g(α j ) is divisible by X α j 2. p i (X)(X α j ) = ( g(x) g(α j ) ) g(α j ) 1 = 1 g(x)g(α j ) 1 1 mod g(x) 6

Alternative Definition of Goppa Codes Let g(x) = g 0 + g 1 X +... + g t X t p i (X) g(x) g(α i) X α i g(α i ) 1 mod g(x) Result from the previous slide 7

Alternative Definition of Goppa Codes Let g(x) = g 0 + g 1 X +... + g t X t p i (X) t j=1 j 1 g j l=0 X l α j 1 l i g(α i ) 1 mod g(x) X j α j i X α i X j 1 + α i X j 2 +... + α j 1 i 7

Alternative Definition of Goppa Codes Let g(x) = g 0 + g 1 X +... + g t X t p i (X) t 1 l=0 t j=l+1 g j α j 1 l i g(α i ) 1 X l mod g(x) Rearrange the terms 7

Alternative Definition of Goppa Codes Let g(x) = g 0 + g 1 X +... + g t X t p i (X) t 1 l=0 t j=l+1 g j α j 1 l i g(α i ) 1 X l mod g(x) Thus we have the following expressions for p i,j : p i,0 = (g 1 + g 2 α i +... + g t α t 1 i )g(α i ) 1 p i,1 = (g 2 + g 3 α i +... + g t α t 2 i )g(α i ) 1... p i,t 1 = g t g(α i ) 1 7

Alternative Definition of Goppa Codes Let g(x) = g 0 + g 1 X +... + g t X t t 1 t p i (X) l=0 j=l+1 g j α j 1 l i g(α i ) 1 X l mod g(x) We find that H = CAB with 0 0 0 g t....... C = 0 0 g t... g 3, 0 g t g t 1 g 2 g t g t 1 g t 2 g 1 1 1 α 1 α n g(α 1 ) 1 0 A =..... and B =... α t 1 1 αn t 1 0 g(α n ) 1 7

Alternative Definition of Goppa Codes Since C is invertible H = A B = 1 1 α 1 α n..... α t 1 1 αn t 1 g(α 1 ) 1 0... 0 g(α n ) 1 is another parity check matrix for Γ(L, g) 8

Binary Goppa Codes L = (α 1,..., α n ) F 2 m with α i α j for all i j g(x) F 2 m[x] monic separable polynomial with deg(g) = t and g(α i ) 0, i Separable = All its roots are distinct = Square Free polynomial 9

Binary Goppa Codes L = (α 1,..., α n ) F 2 m with α i α j for all i j = support g(x) F 2 m[x] monic separable polynomial with deg(g) = t and g(α i ) 0, i = generator polynomial Separable = All its roots are distinct = Square Free polynomial 9

Binary Goppa Codes L = (α 1,..., α n ) F 2 m with α i α j for all i j = support g(x) F 2 m[x] monic separable polynomial with deg(g) = t and g(α i ) 0, i = generator polynomial Proposition The binary Goppa code Γ(L, g) has minimum distance d with d 2t + 1 9

Binary Goppa Codes Proposition Let g be a square free Goppa polynomial with coefficients in F 2 m. Then, Γ(L, g) = Γ(L, g 2 ) Proof: 10

Binary Goppa Codes Proposition Let g be a square free Goppa polynomial with coefficients in F 2 m. Then, Alt r (L, 1 g(α i ) ) =Γ(L, g) = Γ(L, 1 g2 ) = Alt 2r (L, g 2 (α i ) ) Proof: 10

Binary Goppa Codes Proposition Let g be a square free Goppa polynomial with coefficients in F 2 m. Then, the binary Goppa code Γ(L, g) has minimum distance d with d 2t + 1 Proof: 11