On the security of Some Compact Keys for McEliece Scheme lise - - PowerPoint PPT Presentation

▶
on the security of some compact keys for mceliece scheme
SMART_READER_LITE
LIVE PREVIEW

On the security of Some Compact Keys for McEliece Scheme lise - - PowerPoint PPT Presentation

Apr 14, 2023 392 likes •1.01k views

On the security of Some Compact Keys for McEliece Scheme lise Barelli INRIA Saclay and LIX, CNRS UMR 7161 cole Polytechnique, 91120 Palaiseau Cedex June 16, 2017 E. Barelli (INRIA Saclay and LIX) Security of Compact McEliece Scheme June

slide-1
SLIDE 1

On the security of Some Compact Keys for McEliece Scheme

Élise Barelli

INRIA Saclay and LIX, CNRS UMR 7161 École Polytechnique, 91120 Palaiseau Cedex

June 16, 2017

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 1 / 35

slide-2
SLIDE 2

1

McEliece scheme

2

Algebraic-geometry codes

3

Security of Quasi-cyclic Alternant Codes on P1 Induced permutations of Alternant Codes Invariant and Folded Codes

4

Alternant codes on cyclic cover of P1 Codes with automorphisms Security

5

Alternant codes on the Hermitian curve Invariant code and quotient curve Security analysis

6

Conclusion

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 2 / 35

slide-3
SLIDE 3

McEliece scheme

1

McEliece scheme

2

Algebraic-geometry codes

3

Security of Quasi-cyclic Alternant Codes on P1 Induced permutations of Alternant Codes Invariant and Folded Codes

4

Alternant codes on cyclic cover of P1 Codes with automorphisms Security

5

Alternant codes on the Hermitian curve Invariant code and quotient curve Security analysis

6

Conclusion

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 3 / 35

slide-4
SLIDE 4

McEliece scheme

McEliece scheme

It is the first public key cryptosystem based on error-correcting codes. Advantages: Fast encryption and decryption. Candidate for post-quantum cryptography Drawback: Large key size

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 4 / 35

slide-5
SLIDE 5

McEliece scheme

McEliece scheme

It is the first public key cryptosystem based on error-correcting codes. Advantages: Fast encryption and decryption. Candidate for post-quantum cryptography Drawback: Large key size Structural attacks → Let F be any family of linear codes. → Let G be a random looking generator matrix of a code C ∈ F. From G, can we recover the structure of the code C?

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 4 / 35

slide-6
SLIDE 6

McEliece scheme

Some propositions

Binary Goppa codes (McEliece, 1978)

→ No structural attack

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 5 / 35

slide-7
SLIDE 7

McEliece scheme

Some propositions

Binary Goppa codes (McEliece, 1978)

→ No structural attack

Generalised Reed-Solomon (GRS) (Niederreiter, 1986)

→ [Sidelnikov, Shestakov,1992]

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 5 / 35

slide-8
SLIDE 8

McEliece scheme

Some propositions

Binary Goppa codes (McEliece, 1978)

→ No structural attack

Generalised Reed-Solomon (GRS) (Niederreiter, 1986)

→ [Sidelnikov, Shestakov,1992]

Algebraic-geometry (AG) codes (Janwa, Moreno, 1996)

→ [Faure, Minder, 2009] → [Couvreur, Márquez-Corbella, Pellikaan, 2014]

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 5 / 35

slide-9
SLIDE 9

McEliece scheme

Some propositions

Binary Goppa codes (McEliece, 1978)

→ No structural attack

Generalised Reed-Solomon (GRS) (Niederreiter, 1986)

→ [Sidelnikov, Shestakov,1992]

Algebraic-geometry (AG) codes (Janwa, Moreno, 1996)

→ [Faure, Minder, 2009] → [Couvreur, Márquez-Corbella, Pellikaan, 2014]

Concatenation of AG codes (Janwa, Moreno, 1996)

→ [Sendrier,1998] (for all concatenated codes)

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 5 / 35

slide-10
SLIDE 10

McEliece scheme

Some propositions

Binary Goppa codes (McEliece, 1978)

→ No structural attack

Generalised Reed-Solomon (GRS) (Niederreiter, 1986)

→ [Sidelnikov, Shestakov,1992]

Algebraic-geometry (AG) codes (Janwa, Moreno, 1996)

→ [Faure, Minder, 2009] → [Couvreur, Márquez-Corbella, Pellikaan, 2014]

Concatenation of AG codes (Janwa, Moreno, 1996)

→ [Sendrier,1998] (for all concatenated codes)

Subfied subcodes of AG codes (Janwa, Moreno, 1996)

→ No structural attack

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 5 / 35

slide-11
SLIDE 11

McEliece scheme

Some propositions with compact keys

Quasi-cyclic alternant codes (Berger, Cayrel, Gaborit, Otmani, 2009) Quasi-dyadic alternant codes (Misoczki, Baretto, 2009) Structural attacks: → [Faugère, Otmani, Perret, Tillich, 2010] → [Faugère, Otmani, Perret, Portzamparc, Tillich, 2015] → [B., 2017]

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 6 / 35

slide-12
SLIDE 12

Algebraic-geometry codes

1

McEliece scheme

2

Algebraic-geometry codes

3

Security of Quasi-cyclic Alternant Codes on P1 Induced permutations of Alternant Codes Invariant and Folded Codes

4

Alternant codes on cyclic cover of P1 Codes with automorphisms Security

5

Alternant codes on the Hermitian curve Invariant code and quotient curve Security analysis

6

Conclusion

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 7 / 35

slide-13
SLIDE 13

Algebraic-geometry codes

Functions on a curve X

We consider an algebraic curve X ⊂ P2(Fqm), with affine equation: F(x, y) = 0. The function field over Fqm of X, denoted by Fqm(X) is the fraction field

  • f Fqm[x, y]/(F).

A divisor of X is a formal sum, with integer coefficients, of points of X. For g ∈ Fqm(X), the principal divisor of g, denoted by (g), is defined as the formal sum of zeros and poles of g, counted with multiplicity. We denote by L(G) := {g ∈ Fqm(X) | (g) ≥ −G} ∪ {0}, the Riemann-Roch space associated to a divisor G.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 8 / 35

slide-14
SLIDE 14

Algebraic-geometry codes

AG codes on X

Definition Let P = {P1, . . . , Pn} be a set of n distinct rational points of X and G be a divisor, then the AG code CL(X, P, G) is defined by: CL(X, P, G) := {EvP(f ) | f ∈ L(G)}. Fqm CL(X, P, G)

Dual

CL(X, P, G ′)

Subfield Subcode

Fq CL(X, P, G ′) ∩ Fn

q

Ar(X, P, G) := CL(X, P, G ′) ∩ Fn

q, where r = dim(CL(X, P, G)).

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 9 / 35

slide-15
SLIDE 15

Security of Quasi-cyclic Alternant Codes on P1

1

McEliece scheme

2

Algebraic-geometry codes

3

Security of Quasi-cyclic Alternant Codes on P1 Induced permutations of Alternant Codes Invariant and Folded Codes

4

Alternant codes on cyclic cover of P1 Codes with automorphisms Security

5

Alternant codes on the Hermitian curve Invariant code and quotient curve Security analysis

6

Conclusion

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 10 / 35

slide-16
SLIDE 16

Security of Quasi-cyclic Alternant Codes on P1 Induced permutations of Alternant Codes

AG codes on P1

Let P = {P1, . . . , Pn} be a set of n distinct points of P1

Fqm and G be a

divisor, then the AG code CL(P1, P, G) is defined by: CL(P1, P, G) := {EvP(f ) | f ∈ L(G)}.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 11 / 35

slide-17
SLIDE 17

Security of Quasi-cyclic Alternant Codes on P1 Induced permutations of Alternant Codes

AG codes on P1

Let P = {P1, . . . , Pn} be a set of n distinct points of P1

Fqm and G be a

divisor, then the AG code CL(P1, P, G) is defined by: CL(P1, P, G) := {EvP(f ) | f ∈ L(G)}. Proposition The AG code CL(P1, P, G) is the GRS code : GRSk(x, y) := {(y1f (x1), . . . , ynf (xn)) | f ∈ Fqm[X]<k}. where: → P := {(xi : 1)| i ∈ {1, . . . , n}}, → G := (k − 1)P∞ − (g), with g ∈ Fqm(P1) a function such that for all i ∈ {1, . . . , n}, g(xi) = yi = 0.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 11 / 35

slide-18
SLIDE 18

Security of Quasi-cyclic Alternant Codes on P1 Induced permutations of Alternant Codes

Automorphim group of P1

PGL2(Fqm) is the automorphism group of the projective line P1 defined by: PGL2(Fqm) :=

  • P1

Fqm

→ P1

Fqm

(x : y) → (ax + by : cx + dy)

  • a, b, c, d ∈ Fqm,

ad − bc = 0

  • .
  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 12 / 35

slide-19
SLIDE 19

Security of Quasi-cyclic Alternant Codes on P1 Induced permutations of Alternant Codes

Automorphim group of P1

PGL2(Fqm) is the automorphism group of the projective line P1 defined by: PGL2(Fqm) :=

  • P1

Fqm

→ P1

Fqm

(x : y) → (ax + by : cx + dy)

  • a, b, c, d ∈ Fqm,

ad − bc = 0

  • .

Remark The permutations of PGL2(Fqm) have also a matrix representation, ie: ∀σ ∈ PGL2(Fqm), we write σ := a b c d

  • , with ad − bc = 0.

Where the elements a, b, c and d are defined up to a multiplication by a nonzero scalar.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 12 / 35

slide-20
SLIDE 20

Security of Quasi-cyclic Alternant Codes on P1 Induced permutations of Alternant Codes

Support and divisor σ-invariant

Let σ be an automorphism of P1

Fqm.

For a point Q ∈ P1, we denote Orbσ(Q) := {σj(Q) | j ∈ {1..ℓ}}. We define the support: P :=

n/ℓ

  • i=1

Orbσ(Qi), (1) where the points Qi ∈ P1

Fqm are pairwise distinct with trivial stabilizer

subgroup.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 13 / 35

slide-21
SLIDE 21

Security of Quasi-cyclic Alternant Codes on P1 Induced permutations of Alternant Codes

Support and divisor σ-invariant

Let σ be an automorphism of P1

Fqm.

For a point Q ∈ P1, we denote Orbσ(Q) := {σj(Q) | j ∈ {1..ℓ}}. We define the support: P :=

n/ℓ

  • i=1

Orbσ(Qi), (1) where the points Qi ∈ P1

Fqm are pairwise distinct with trivial stabilizer

subgroup. We define the divisor: G := t

ℓ

  • j=1

σj(R), (2) with R a point of P1

Fqm, t ∈ Z and deg(G) = ℓt.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 13 / 35

slide-22
SLIDE 22

Security of Quasi-cyclic Alternant Codes on P1 Induced permutations of Alternant Codes

Permutations of Ar(P1, P, G)

The automorphism σ of P1 induces a permutation ˜ σ of C = CL(P1, P, G) defined by: ˜ σ: C − → C (f (P1), . . . , f (Pn)) − → (f (σ(P1)), . . . , f (σ(Pn)))· Then ˜ σ is also a permutation of A := C⊥ ∩ Fn

q.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 14 / 35

slide-23
SLIDE 23

Security of Quasi-cyclic Alternant Codes on P1 Induced permutations of Alternant Codes

Equivalence classes of PGL2(Fqm)

Lemma Let ρ ∈ PGL2(Fqm) be an automorphism on P1. Then σ′ := ρ ◦ σ ◦ ρ−1 induces the same permutation on C as σ.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 15 / 35

slide-24
SLIDE 24

Security of Quasi-cyclic Alternant Codes on P1 Induced permutations of Alternant Codes

Equivalence classes of PGL2(Fqm)

Lemma Let ρ ∈ PGL2(Fqm) be an automorphism on P1. Then σ′ := ρ ◦ σ ◦ ρ−1 induces the same permutation on C as σ. Three cases are possible, depending on the eigenvalues of the matrix M := Mat(σ):

1 M ∼

1 b 1

  • , with b ∈ Fqm,

2 M ∼

a 1

  • , with a ∈ Fqm or a ∈ Fq2m\Fqm.
  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 15 / 35

slide-25
SLIDE 25

Security of Quasi-cyclic Alternant Codes on P1 Invariant and Folded Codes

Invariant and folded codes: definitions

Let C be a linear code and σ ∈ Perm(C) of order ℓ. Consider: ϕ: c ∈ C →

ℓ−1

  • i=0

σi(c). The folded code of C is defined by Foldσ(C) := Im(ϕ) and the invariant code of C is defined by Cσ := ker(σ − Id).

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 16 / 35

slide-26
SLIDE 26

Security of Quasi-cyclic Alternant Codes on P1 Invariant and Folded Codes

Invariant and folded codes: definitions

Let C be a linear code and σ ∈ Perm(C) of order ℓ. Consider: ϕ: c ∈ C →

ℓ−1

  • i=0

σi(c). The folded code of C is defined by Foldσ(C) := Im(ϕ) and the invariant code of C is defined by Cσ := ker(σ − Id). Proposition The codes Foldσ(C) and Cσ are subcodes of C and: Foldσ(C) ⊆ Cσ. If Char (Fqm) ∤ ℓ then Foldσ(C) = Cσ.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 16 / 35

slide-27
SLIDE 27

Security of Quasi-cyclic Alternant Codes on P1 Invariant and Folded Codes

Invariant code of Ar(P1, P, G)

If C is a linear code over Fqm, σ-invariant then: (C ∩ Fn

q)σ = {c ∈ C | c ∈ Fn q and σ(c) = c} = Cσ ∩ Fn q.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 17 / 35

slide-28
SLIDE 28

Security of Quasi-cyclic Alternant Codes on P1 Invariant and Folded Codes

Invariant code of Ar(P1, P, G)

If C is a linear code over Fqm, σ-invariant then: (C ∩ Fn

q)σ = {c ∈ C | c ∈ Fn q and σ(c) = c} = Cσ ∩ Fn q.

Theorem Let CL(P1, P, G) ⊆ Fn

qm be a σ-invariant AG code, with σ ∈ PGL2(P1 Fqm)

  • f order ℓ and P and G defined as (1) and (2). Then the invariant code

CL(P1, P, G)σ is a GRS code of dimension k/ℓ and length n/ℓ. Corollary The invariant code Ar(P1, P, G)σ is an alternant code of order r/ℓ and length n/ℓ.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 17 / 35

slide-29
SLIDE 29

Security of Quasi-cyclic Alternant Codes on P1 Invariant and Folded Codes

Lemma Let c := EvP(f ) ∈ CL(P1, P, G) such that σ(c) = c, then f is σ-invariant, ie: f ◦ σ = f .

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 18 / 35

slide-30
SLIDE 30

Security of Quasi-cyclic Alternant Codes on P1 Invariant and Folded Codes

Lemma Let c := EvP(f ) ∈ CL(P1, P, G) such that σ(c) = c, then f is σ-invariant, ie: f ◦ σ = f . Let G := t

ℓ

  • j=1

σj(R), with R a rational point of P1

Fqm and t ∈ Z. We

denote: σj(R) := (γj : δj), for j ∈ {0, . . . , ℓ − 1}. Lemma With the previous notation, any f ∈ L(G) can be written as: f (X, Y ) = F(X, Y )

ℓ−1

  • j=0

(δjX − γjY )t , with F ∈ Fqm[X, Y ] a homogeneous polynomial of degree tℓ.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 18 / 35

slide-31
SLIDE 31

Security of Quasi-cyclic Alternant Codes on P1 Invariant and Folded Codes

Case σ trigonalizable over Fqm: σ: P1

Fqm

→ P1

Fqm

(X : Y ) → (X + bY : Y ) with b ∈ F∗

qm.

Case σ diagonalizable over Fqm: σ: P1

Fqm

→ P1

Fqm

(X : Y ) → (aX : Y ), with a ∈ Fqm. Case σ diagonalizable over Fq2m\Fqm: σ: P1

Fq2m

→ P1

Fq2m

(X : Y ) → (aX : Y ), with a ∈ Fq2m\Fqm.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 19 / 35

slide-32
SLIDE 32

Security of Quasi-cyclic Alternant Codes on P1 Invariant and Folded Codes

Case σ trigonalizable over Fqm

Proposition If F(X + bY , Y ) = F(X, Y ), then F(X, Y ) = R(X p − bp−1XY p−1, Y p) with R ∈ Fq[X, Y ] a homogeneous polynomial of degree t.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 20 / 35

slide-33
SLIDE 33

Security of Quasi-cyclic Alternant Codes on P1 Invariant and Folded Codes

Case σ trigonalizable over Fqm

Proposition If F(X + bY , Y ) = F(X, Y ), then F(X, Y ) = R(X p − bp−1XY p−1, Y p) with R ∈ Fq[X, Y ] a homogeneous polynomial of degree t. We denote σj(Pi) := (αiℓ+j : βiℓ+j), for i ∈ {0, . . . , n

ℓ − 1},

j ∈ {0, . . . , ℓ − 1}. Proposition The code CL(P1, P, G)σ is the GRS code CL(P1, ˜ P, ˜ G), with: ˜ Pi = (αp

i − bp−1αiβp−1 i

: βp

i ),

˜ G = t( ˜ R), where ˜ R =

  • (−1)p−1

p−1

  • j=0

γj :

p−1

  • j=0

δj

  • .
  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 20 / 35

slide-34
SLIDE 34

Security of Quasi-cyclic Alternant Codes on P1 Invariant and Folded Codes

Case σ diagonalizable over Fqm

Proposition If F(aX, Y ) = F(X, Y ), then F(X, Y ) = R(X ℓ, Y ℓ) with R ∈ Fqm[X, Y ] an homogeneous polynomial of degree t.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 21 / 35

slide-35
SLIDE 35

Security of Quasi-cyclic Alternant Codes on P1 Invariant and Folded Codes

Case σ diagonalizable over Fqm

Proposition If F(aX, Y ) = F(X, Y ), then F(X, Y ) = R(X ℓ, Y ℓ) with R ∈ Fqm[X, Y ] an homogeneous polynomial of degree t. Proposition The code (CL(P1, P, G))σ is the GRS code CL(P1, ˜ P, ˜ G), with ˜ Pi = (αℓ

i : βℓ i ),

˜ G = t ˜ R, where ˜ R =

  • (−1)ℓ−1

ℓ−1

  • j=0

γj :

ℓ−1

  • j=0

δj

  • .
  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 21 / 35

slide-36
SLIDE 36

Security of Quasi-cyclic Alternant Codes on P1 Invariant and Folded Codes

Case σ diagonalizable over Fq2m\Fqm

Idea We extend the code C defined on Fqm to the field Fq2m. We consider C ⊗ Fq2m := SpanFq2m(C), we have: C ⊗ Fq2m = {EvP(f ) | f ∈ LFq2m(G)}.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 22 / 35

slide-37
SLIDE 37

Security of Quasi-cyclic Alternant Codes on P1 Invariant and Folded Codes

Case σ diagonalizable over Fq2m\Fqm

Idea We extend the code C defined on Fqm to the field Fq2m. We consider C ⊗ Fq2m := SpanFq2m(C), we have: C ⊗ Fq2m = {EvP(f ) | f ∈ LFq2m(G)}. Fq2m C ⊗ Fq2m

Invσ

(C ⊗ Fq2m)σ

Fqm C

Invσ

  • Sub. Sub.
  • Cσ
  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 22 / 35

slide-38
SLIDE 38

Security of Quasi-cyclic Alternant Codes on P1 Invariant and Folded Codes

Case σ diagonalizable over Fq2m\Fqm

Idea We extend the code C defined on Fqm to the field Fq2m. We consider C ⊗ Fq2m := SpanFq2m(C), we have: C ⊗ Fq2m = {EvP(f ) | f ∈ LFq2m(G)}. Fq2m C ⊗ Fq2m

Invσ

(C ⊗ Fq2m)σ = CL(P1, ˜

P, ˜ G)Fq2m Fqm C

Invσ

  • Sub. Sub.
  • Cσ
  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 22 / 35

slide-39
SLIDE 39

Security of Quasi-cyclic Alternant Codes on P1 Invariant and Folded Codes

Case σ diagonalizable over Fq2m\Fqm

→ C ⊗ Fq2m has a basis in Fn

qm.

→ Here p ∤ ℓ then Foldσ(C) = Cσ. So (C ⊗ Fq2m)σ has also a basis in Fn

qm.

Fq2m C ⊗ Fq2m

Invσ

(C ⊗ Fq2m)σ = CL(P1, ˜

P, ˜ G)Fq2m Fqm C

Invσ

  • Sub. Sub.
  • Cσ
  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 23 / 35

slide-40
SLIDE 40

Security of Quasi-cyclic Alternant Codes on P1 Invariant and Folded Codes

Case σ diagonalizable over Fq2m\Fqm

→ C ⊗ Fq2m has a basis in Fn

qm.

→ Here p ∤ ℓ then Foldσ(C) = Cσ. So (C ⊗ Fq2m)σ has also a basis in Fn

qm.

Fq2m C ⊗ Fq2m

Invσ

(C ⊗ Fq2m)σ = CL(P1, ˜

P, ˜ G)Fq2m Fqm C

Invσ

  • Sub. Sub.
  • Cσ= CL(P1, ˜

P, ˜ G)

  • Sub. Sub.
  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 23 / 35

slide-41
SLIDE 41

Alternant codes on cyclic cover of P1

1

McEliece scheme

2

Algebraic-geometry codes

3

Security of Quasi-cyclic Alternant Codes on P1 Induced permutations of Alternant Codes Invariant and Folded Codes

4

Alternant codes on cyclic cover of P1 Codes with automorphisms Security

5

Alternant codes on the Hermitian curve Invariant code and quotient curve Security analysis

6

Conclusion

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 24 / 35

slide-42
SLIDE 42

Alternant codes on cyclic cover of P1 Codes with automorphisms

Cyclic cover of P1

We consider the curve: X : yℓ = f (x) and the automorphism: σ : X − → X (x : y) − → (x : ξy) where ξ is a ℓ-th root of unity.

Q1 σ(Q1) σ2(Q1)

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 25 / 35

slide-43
SLIDE 43

Alternant codes on cyclic cover of P1 Codes with automorphisms

Support and divisor σ-invariant

For a point Q ∈ X, we denote Orbσ(Q) := {σj(Q) | j ∈ {1..ℓ}}. We define the support: P :=

n/ℓ

  • i=1

Orbσ(Qi), (3) where the points Qi ∈ X are pairwise distinct with trivial stabilizer subgroup.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 26 / 35

slide-44
SLIDE 44

Alternant codes on cyclic cover of P1 Codes with automorphisms

Support and divisor σ-invariant

For a point Q ∈ X, we denote Orbσ(Q) := {σj(Q) | j ∈ {1..ℓ}}. We define the support: P :=

n/ℓ

  • i=1

Orbσ(Qi), (3) where the points Qi ∈ X are pairwise distinct with trivial stabilizer subgroup. We define the divisor: G := s P∞, (4) with s ∈ N∗, and P∞ the point at infinity of the curve X.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 26 / 35

slide-45
SLIDE 45

Alternant codes on cyclic cover of P1 Codes with automorphisms

Support and divisor σ-invariant

For a point Q ∈ X, we denote Orbσ(Q) := {σj(Q) | j ∈ {1..ℓ}}. We define the support: P :=

n/ℓ

  • i=1

Orbσ(Qi), (3) where the points Qi ∈ X are pairwise distinct with trivial stabilizer subgroup. We define the divisor: G := s P∞, (4) with s ∈ N∗, and P∞ the point at infinity of the curve X. σ-invariant code The automorphism σ induces a permutation on C = CL(X, P, G). The subfield subcode A := C ∩ Fn

q, is also σ-invariant.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 26 / 35

slide-46
SLIDE 46

Alternant codes on cyclic cover of P1 Security

Theorem Let C := CL(X, P, G) be an AG code, with P and G define as (3) and (4), and σ ∈ Perm(C) of

  • rder ℓ, then:

Inv(C) = CL(P1, ˜ P, ˜ G),

  • f length n

ℓ and dimension s ℓ.

Corollary The invariant code Inv(Ar(X, P, G)) is an alternant code of order r

ℓ and length n ℓ . Q1 σ(Q1) σ2(Q1) Q2 σ(Q2) σ2(Q2) G = sP∞ ˜ Q1 ˜ Q2 ˜ G = s

ℓ P∞

P1 X

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 27 / 35

slide-47
SLIDE 47

Alternant codes on the Hermitian curve

1

McEliece scheme

2

Algebraic-geometry codes

3

Security of Quasi-cyclic Alternant Codes on P1 Induced permutations of Alternant Codes Invariant and Folded Codes

4

Alternant codes on cyclic cover of P1 Codes with automorphisms Security

5

Alternant codes on the Hermitian curve Invariant code and quotient curve Security analysis

6

Conclusion

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 28 / 35

slide-48
SLIDE 48

Alternant codes on the Hermitian curve Invariant code and quotient curve

Invariant code of σ-invariant AG codes

Lemma Let c := EvP(f ) ∈ CL(X, P, G), with deg(G) < n, such that σ(c) = c, then f is σ-invariant, ie: f ◦ σ = f . X

  • σ
  • Fq(X)

X/σ Fq(X)σ

ℓ

σ ∈ Aut(X) of order ℓ. Theorem Let P be a σ-invariant set of rational points of X and G be a σ-invariant divisor of X, then: Invσ(CL(X, P, G)) = CL(X/σ, ˜ P, ˜ G) where ˜ P is a set of points of X/σ and ˜ G is a divisor of X/σ.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 29 / 35

slide-49
SLIDE 49

Alternant codes on the Hermitian curve Invariant code and quotient curve

Quotient curves of H

Let Fq2

0 be a finite field and consider the Hermitian curve, denoted by H of

equation: yq0 + y = xq0+1.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 30 / 35

slide-50
SLIDE 50

Alternant codes on the Hermitian curve Invariant code and quotient curve

Quotient curves of H

Let Fq2

0 be a finite field and consider the Hermitian curve, denoted by H of

equation: yq0 + y = xq0+1. We denote A(P∞) := {σ ∈ Aut(H) | σ(P∞) = P∞} then σ ∈ A(P∞) is described by:

  • σ(x) = ax + b,

σ(y) = aq0+1y + abq0x + c, with a ∈ F∗

q2

0, b ∈ Fq2 0 and bq0+1 = cq0 + c.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 30 / 35

slide-51
SLIDE 51

Alternant codes on the Hermitian curve Invariant code and quotient curve

Quotient curves of H

Let Fq2

0 be a finite field and consider the Hermitian curve, denoted by H of

equation: yq0 + y = xq0+1. We denote A(P∞) := {σ ∈ Aut(H) | σ(P∞) = P∞} then σ ∈ A(P∞) is described by:

  • σ(x) = ax + b,

σ(y) = aq0+1y + abq0x + c, with a ∈ F∗

q2

0, b ∈ Fq2 0 and bq0+1 = cq0 + c.

If we choose a = 1 such that aq0−1 = 1, then ord(σ) = ord(a) and the genus of the quotient curve is ([Bassa, Ma, Xing, Yeo, 2013]): g(H/σ) = q0 − 1 2 .

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 30 / 35

slide-52
SLIDE 52

Alternant codes on the Hermitian curve Security analysis

Security of the invariant code

The invariant code of an alternant AG code is an alternant AG code No specific attacks known for alternant AG codes

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 31 / 35

slide-53
SLIDE 53

Alternant codes on the Hermitian curve Security analysis

Security of the invariant code

The invariant code of an alternant AG code is an alternant AG code No specific attacks known for alternant AG codes Exhaustive search on the divisor: We say that C1 and C2 are diagonal-equivalent, and we note C1 ∼ C2, if there exist λ1, . . . , λn nonzero elements such that: C2 = {(λ1c1, . . . , λncn) | (c1, . . . , cn) ∈ C1}.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 31 / 35

slide-54
SLIDE 54

Alternant codes on the Hermitian curve Security analysis

Security of the invariant code

The invariant code of an alternant AG code is an alternant AG code No specific attacks known for alternant AG codes Exhaustive search on the divisor: We say that C1 and C2 are diagonal-equivalent, and we note C1 ∼ C2, if there exist λ1, . . . , λn nonzero elements such that: C2 = {(λ1c1, . . . , λncn) | (c1, . . . , cn) ∈ C1}. Theorem ([Munuera, Pellikaan, 1993]) If P is a set of n > 2g − 2 rational points of X, where g is the genus of X, and G and H are two divisors of the same degree 2g − 1 < t < n − 1, then: CL(X, P, G) ∼ CL(X, P, H) ⇔ G ∼ H.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 31 / 35

slide-55
SLIDE 55

Alternant codes on the Hermitian curve Security analysis

Number of non equivalent AG codes

We denote Divt(X) the group of divisors on X of degree t and P(X) the group of principal divisors on X. Then we define the quotient group Pic0(X) := Div0(X)/P(X). For a fix dimension, the number of non equivalent AG codes on X with the support P is: #AGcode(X, P) = #Pic0(X).

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 32 / 35

slide-56
SLIDE 56

Alternant codes on the Hermitian curve Security analysis

Number of non equivalent AG codes

We denote Divt(X) the group of divisors on X of degree t and P(X) the group of principal divisors on X. Then we define the quotient group Pic0(X) := Div0(X)/P(X). For a fix dimension, the number of non equivalent AG codes on X with the support P is: #AGcode(X, P) = #Pic0(X). For the curve H/σ on Fq2

0:

#Pic0(H/σ) ≈ q02g g = q0−1

2

n ≈ q3 #AGcode(H, P) ≈ ( 3 √n)

3

√n

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 32 / 35

slide-57
SLIDE 57

Alternant codes on the Hermitian curve Security analysis

Number of non equivalent alternant AG codes

We look at non equivalent alternant of AG codes (on Fq): #A(X, P) ≤ (qm(n−1) − qn−1)#Pic0(X). Examples of parameters: q0 n k ISD #Pic0(H/σ) #A(H/σ, P) Key size 11 1100 729 118 234 27634 163 Kbits 16 1950 1469 116 260 − 250 Kbits

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 33 / 35

slide-58
SLIDE 58

Conclusion

1

McEliece scheme

2

Algebraic-geometry codes

3

Security of Quasi-cyclic Alternant Codes on P1 Induced permutations of Alternant Codes Invariant and Folded Codes

4

Alternant codes on cyclic cover of P1 Codes with automorphisms Security

5

Alternant codes on the Hermitian curve Invariant code and quotient curve Security analysis

6

Conclusion

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 34 / 35

slide-59
SLIDE 59

Conclusion

Conclusion

Results:

1 Quasi-cyclic codes on P1

The invariant code of a quasi-cyclic GRS code is a GRS code. The security of alternant codes with induced permutation from the projective linear group, is reduced to the security of the invariant code which is an alternant code.

2 Codes on cyclic cover of P1

We can recover the invariant code. Thanks to the invariant code we can recover the support and the curve.

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 35 / 35

slide-60
SLIDE 60

Conclusion

Conclusion

Results:

1 Quasi-cyclic codes on P1

The invariant code of a quasi-cyclic GRS code is a GRS code. The security of alternant codes with induced permutation from the projective linear group, is reduced to the security of the invariant code which is an alternant code.

2 Codes on cyclic cover of P1

We can recover the invariant code. Thanks to the invariant code we can recover the support and the curve.

3 Codes on Hermitian curve

Automorphism σ such that the quotient curve H/σ is not P1 Maximal curve → good parameters for the code

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 35 / 35

slide-61
SLIDE 61

Conclusion

Conclusion

Results:

1 Quasi-cyclic codes on P1

The invariant code of a quasi-cyclic GRS code is a GRS code. The security of alternant codes with induced permutation from the projective linear group, is reduced to the security of the invariant code which is an alternant code.

2 Codes on cyclic cover of P1

We can recover the invariant code. Thanks to the invariant code we can recover the support and the curve.

3 Codes on Hermitian curve

Automorphism σ such that the quotient curve H/σ is not P1 Maximal curve → good parameters for the code

Perspectives:

1 Codes on cyclic cover of the Hermitian curve 2 Codes on cyclic cover of random plane curves

Thank you!

  • E. Barelli (INRIA Saclay and LIX)

Security of Compact McEliece Scheme June 16, 2017 35 / 35