A Code-Based Cryptosystem using GRS Codes Violetta Weger University - PowerPoint PPT Presentation

A Code-Based Cryptosystem using GRS Codes Violetta Weger University of Zurich Master Thesis Presentation Seminar Coding Theory and Cryptography 07 December 2016 Violetta Weger Code-based Cryptosystem using GRS Codes

Outline 1 Motivation 2 Basic Definitions 3 McEliece System 4 BBCRS Scheme 5 Distinguisher Attack 6 Proposal 7 Security 8 Complexity and Key Size 9 Conclusion Violetta Weger Code-based Cryptosystem using GRS Codes

Motivation Violetta Weger Code-based Cryptosystem using GRS Codes

Public-Key Cryptography Violetta Weger Code-based Cryptosystem using GRS Codes

Public-Key Cryptography Violetta Weger Code-based Cryptosystem using GRS Codes

Public-Key Cryptography Violetta Weger Code-based Cryptosystem using GRS Codes

Public-Key Cryptography Example: RSA Let p, q be primes. Compute n = pq and the Euler-totient function ϕ ( n ) = ( p − 1)( q − 1). Choose e < ϕ ( n ), s.t. gcd( e, n ) = 1. Public Key = ( n, e ) Private Key = ( p, q ) Encryption: Let m be the message. The cipher is computed as c = m e mod n. Decryption: Compute d and b s.t. de + bϕ ( n ) = 1 . Then by computing c d we recover the message, since c d = ( m e ) d = m 1 − bφ ( n ) = m ( m φ ( n ) ) − b ≡ m 1 − b = m. Violetta Weger Code-based Cryptosystem using GRS Codes

Code-based Cryptography Code-based cryptography is a promising candidate for post-quantum cryptography. The McEliece cryptosystem in its original version using Goppa codes is still unbroken, but has the main drawback of having large key sizes. Using GRS codes directly in the McEliece system is broken by the attack of Sidelnikov and Shestakov. Rosenthal et al. proposed a variant of the McEliece cryptosystem, denoted by the BBCRS scheme, in order to reconsider the use of GRS codes, by changing the scrambling matrices. Couvreur et al. presented a distinguisher attack on this cryptosystem. Violetta Weger Code-based Cryptosystem using GRS Codes

Basic Definitions Violetta Weger Code-based Cryptosystem using GRS Codes

Coding Theory Let F q be a finite field. Definition An [ n, k ] -linear block code over F q is a k -dimensional linear subspace C ⊆ F n q . There exists a k × n generator matrix G and a ( n − k ) × n parity check matrix H defined by the properties: { } q | Hx T = 0 uG | u ∈ F k { x ∈ F n } C = = . q Let x, y ∈ F n q . Definition The Hamming distance of x, y is defined as d H ( x, y ) = | { i ∈ { 1 , . . . , n } | x i ̸ = y i } | . Violetta Weger Code-based Cryptosystem using GRS Codes

Coding Theory Let C be an [ n, k ]-linear block code. Definition We define the minimum distance of C to be d ( C ) = min { d H ( x, y ) | x, y ∈ C, x ̸ = y } . Definition We denote by C ⊥ the dual code of C , defined as C ⊥ = { x ∈ F n } q | x · y = 0 ∀ y ∈ C . Theorem (Singleton Bound) Let C be an [ n, k ] -linear block code. Then d ( C ) ≤ n − k + 1 . Violetta Weger Code-based Cryptosystem using GRS Codes

Coding Theory Let F q be a finite field and 1 ≤ k < n ≤ q integers. Definition (Generalized Reed-Solomon Code) Let α ∈ F n q be an n -tuple of distinct elements and β ∈ F n q , be an n -tuple of nonzero elements. GRS n,k ( α, β ) = { ( β 1 p ( α 1 ) , . . . , β n p ( α n )) | p ∈ F q [ x ] , deg ( p ) < k } . We can write the generator matrix of GRS n,k ( α, β ) as  β 1 · · · β n  β 1 α 1 · · · β n α n   G =  .  . .  . .   . .  β 1 α k − 1 β n α k − 1 · · · 1 n Violetta Weger Code-based Cryptosystem using GRS Codes

Coding Theory Proposition d ( GRS n,k ( α, β )) = n − k + 1 . Proposition GRS n,k ( α, β ) ⊥ = GRS n,n − k ( α, γ ) . Where n γ i = β − 1 ∏ ( α i − α j ) − 1 . i j =1 j ̸ = i Violetta Weger Code-based Cryptosystem using GRS Codes

Coding Theory Let n = q m and F q m be a finite field. Definition (Goppa Code) Let G ∈ F q m [ x ] . Then define / S m = F q m [ x ] ⟨ G ⟩ . Let L = { α 1 , . . . , α n } ⊆ F n q m , with α i ̸ = α j ∀ i ̸ = j ∈ { 1 , . . . , n } and G ( α i ) ̸ = 0 ∀ i ∈ { 1 , . . . , n } . Then we can define the classical q -ary Goppa code as { n } � a i ∑ a ∈ F n � Γ( L, G ) = = 0 in S m . q � x − α i � i =1 Violetta Weger Code-based Cryptosystem using GRS Codes

McEliece System Violetta Weger Code-based Cryptosystem using GRS Codes

McEliece System Choose n = 2 m , t < n m and Γ a binary Goppa code of length n , dimension k ≥ n − mt , which can correct upto t errors. Γ has a generator matrix G of size k × n . Choose a k × k invertible matrix S and a n × n permutation matrix P and compute G ′ = SGP . ( G ′ , t ) Public Key = Private Key = ( S, G, P ) Violetta Weger Code-based Cryptosystem using GRS Codes

McEliece System Encryption: Let x ∈ F k 2 be the message and e ∈ F n 2 the error vector, s.t. wt( e ) ≤ t , then the cipher is computed as y = xG ′ + e. Decryption: Compute yP − 1 = xSG + eP − 1 , then xSG is a code word of Γ and since wt( eP − 1 ) ≤ t , we can apply the decoding algorithm and get xS and by multiplication with the inverse of S we get the message x . Violetta Weger Code-based Cryptosystem using GRS Codes

Niederreiter system Let F q be a finite field. Let 1 ≤ k < n ≤ q be integers. Construct a [ n, k ]-linear code C , that can correct upto t errors and has an efficient decoding algorithm. C has a parity check matrix H of size r × n , where r = n − k . Choose a r × r invertible matrix S and a n × n permutation matrix P and compute H ′ = SHP . ( H ′ , t ) Public Key = Private Key = ( S, H, P ) Violetta Weger Code-based Cryptosystem using GRS Codes

Niederreiter system Encryption: Let x ∈ F n q be the message, s.t. wt( x ) ≤ t , then the cipher is computed as y T = H ′ x T . Decryption: Compute S − 1 y T = HPx T = H ( xP T ) T . Since wt( xP T ) ≤ t , we can apply syndrome decoding to get xP T and by multiplication with the inverse of P T we get the message x . Violetta Weger Code-based Cryptosystem using GRS Codes

BBCRS Scheme Violetta Weger Code-based Cryptosystem using GRS Codes

BBCRS Scheme Rosenthal, Schipani et al. proposed a variant of the McEliece cryptosystem, in order to reconsider the use of GRS codes as secret code. Instead of the permutation matrix they use as scrambling matrix the sum T + R , where T is a sparse matrix of row weight m and R is a matrix of rank z . This thwarts the attack of Sidelnikov and Shestakov. Violetta Weger Code-based Cryptosystem using GRS Codes

BBCRS Scheme for m = 1 , z = 1 Let F q be a finite field. Let 1 ≤ k < n ≤ q be integers. Let G = k × n generator matrix of GRS code , T = n × n permutation matrix , n × n rank 1 matrix , R = α T β, R = Q = n × n invertible matrix , Q = R + T, S = k × k invertible matrix . Compute: G ′ = S − 1 GQ − 1 and t pub = t = ⌊ n − k 2 ⌋ . ( G ′ , t ) Public Key = Private Key = ( G, T, R, Q, S ) Violetta Weger Code-based Cryptosystem using GRS Codes

BBCRS Scheme for m = 1 , z = 1 Encryption: Let x ∈ F k q be the message and e ∈ F n q , s.t. wt( e ) ≤ t be the error vector. Compute the cipher as y = xG ′ + e. Decryption: Guess the value of eR . Then compute y ′ = yQ − eR = xS − 1 G + eT. Since wt( eT ) ≤ t by decoding algorithm we get xS − 1 and by multiplication with S we get the message x . Violetta Weger Code-based Cryptosystem using GRS Codes

Distinguisher Attack Violetta Weger Code-based Cryptosystem using GRS Codes

Definitions Definition (Schur Product) Let x, y ∈ F n q . The Schur product of x and y is x ⋆ y = ( x 1 y 1 , . . . , x n y n ) . Violetta Weger Code-based Cryptosystem using GRS Codes

Definitions Definition (Schur Product) Let x, y ∈ F n q . The Schur product of x and y is x ⋆ y = ( x 1 y 1 , . . . , x n y n ) . Definition (Schur Product of Codes and Square Code) Let A, B be two codes of length n . The Schur product of A and B is ⟨ A ⋆ B ⟩ = ⟨{ a ⋆ b | a ∈ A, b ∈ B }⟩ . If A = B , then we call ⟨ A ⋆ A ⟩ the square code of A and denote it by ⟨ A 2 ⟩ . Violetta Weger Code-based Cryptosystem using GRS Codes

Definitions Definition (Schur Matrix) Let G be a k × n matrix, with rows g i for 1 ≤ i ≤ k . We denote by S ( G ) the Schur matrix of G , which consists of the rows 2 ( k 2 + k ) × n . g i ⋆ g j for 1 ≤ i ≤ j ≤ k. Thus S ( G ) is of the size 1 Violetta Weger Code-based Cryptosystem using GRS Codes

Properties of Square Codes Proposition Let A be a code of length n and dimension k , then { ( k + 1 )} dim ( ⟨ A 2 ⟩ ) ≤ min n, (1) 2 Violetta Weger Code-based Cryptosystem using GRS Codes

Properties of Square Codes Proposition Let A be a code of length n and dimension k , then { ( k + 1 )} dim ( ⟨ A 2 ⟩ ) ≤ min n, (1) 2 Proposition If 2 k − 1 < n ⟨ GRS n,k ( α, β ) 2 ⟩ = GRS n, 2 k − 1 ( α, β ⋆ β ) (2) Violetta Weger Code-based Cryptosystem using GRS Codes