Ouroboros: a simple, secure and efficient key exchange protocol based - - PowerPoint PPT Presentation

▶
ouroboros a simple secure and efficient key exchange
SMART_READER_LITE
LIVE PREVIEW

Ouroboros: a simple, secure and efficient key exchange protocol based - - PowerPoint PPT Presentation

Feb 29, 2024 693 likes •1.54k views

Ouroboros: a simple, secure and efficient key exchange protocol based on coding theory Jean-Christophe Deneuville < jean-christophe.deneuville@xlim.fr > June the 26 th , 2017 PQCrypto 17 Utrecht Joint work with: P. Gaborit G. Z

slide-1
SLIDE 1

Ouroboros: a simple, secure and efficient key exchange protocol based

  • n coding theory

Jean-Christophe Deneuville

<jean-christophe.deneuville@xlim.fr>

June the 26th, 2017 PQCrypto’17 Utrecht Joint work with:

  • P. Gaborit
  • G. Z´

emor University of Limoges University of Bordeaux

slide-2
SLIDE 2

Motivations

[ME78]

slide-3
SLIDE 3

Motivations

[ME78] [Nie86]

slide-4
SLIDE 4

Motivations

[ME78] 80’s ↓ 00’s [Nie86] RS BCH Goppa RM

slide-5
SLIDE 5

Motivations

[ME78] Key Sizes 80’s ↓ 00’s [Nie86] Security reduction to a standard problem (random codes) RS BCH Goppa RM

slide-6
SLIDE 6

Motivations

[ME78] Key Sizes 80’s ↓ 00’s [Nie86] Other variations Most of them broken Security proof RS BCH Goppa RM

slide-7
SLIDE 7

Motivations

[ME78] Key Sizes 80’s ↓ 00’s [Nie86] Other variations Most of them broken [Gab91] Security proof Rank Metric RS BCH Goppa RM

slide-8
SLIDE 8

Motivations

[ME78] Key Sizes 80’s ↓ 00’s [Nie86] Other variations Most of them broken [Ale03] [Gab91] Security proof Rank Metric RS BCH Goppa RM

slide-9
SLIDE 9

Motivations

[ME78] Key Sizes 80’s ↓ 00’s [Nie86] Other variations Most of them broken [Ale03] [Gab05] [Gab91] Security proof Rank Metric Group action RS BCH Goppa RM

slide-10
SLIDE 10

Motivations

[ME78] Key Sizes 80’s ↓ 00’s [Nie86] Other variations Most of them broken [Ale03] [Gab05] [Gab91] [Ove07] Attacks Security proof Rank Metric Group action RS BCH Goppa RM

slide-11
SLIDE 11

Motivations

[ME78] Key Sizes 80’s ↓ 00’s [Nie86] Other variations Most of them broken [Ale03] [Gab05] [Gab91] [Ove07] Attacks Security proof Rank Metric Group action [BBC08] QC-LDPC RS BCH Goppa RM

slide-12
SLIDE 12

Motivations

[ME78] Key Sizes 80’s ↓ 00’s [Nie86] Other variations Most of them broken [Ale03] [Gab05] [Gab91] [Ove07] Attacks Security proof Rank Metric Group action [MB09] dyadic [BCGO09] alternant [BBC08] QC-LDPC RS BCH Goppa RM

slide-13
SLIDE 13

Motivations

[ME78] Key Sizes 80’s ↓ 00’s [Nie86] Other variations Most of them broken [Ale03] [Gab05] [Gab91] [Ove07] Attacks Security proof Rank Metric Group action [MB09] dyadic [BCGO09] alternant [BBC08] QC-LDPC [GMRZ13] QC-LRPC Ntru-like RS BCH Goppa RM

slide-14
SLIDE 14

Motivations

[ME78] Key Sizes 80’s ↓ 00’s [Nie86] Other variations Most of them broken [Ale03] [Gab05] [Gab91] [Ove07] Attacks Security proof Rank Metric Group action [MB09] dyadic [BCGO09] alternant [BBC08] QC-LDPC Ntru-like [MTSB13] QC-MDPC [GMRZ13] QC-LRPC Ntru-like RS BCH Goppa RM

slide-15
SLIDE 15

Motivations

[ME78] Key Sizes 80’s ↓ 00’s [Nie86] Other variations Most of them broken [Ale03] [Gab05] [Gab91] [ABDGZ16] HQC RQC [Ove07] Attacks Security proof Rank Metric Group action [MB09] dyadic [BCGO09] alternant [BBC08] QC-LDPC Ntru-like [MTSB13] QC-MDPC [GMRZ13] QC-LRPC Ntru-like RS BCH Goppa RM

slide-16
SLIDE 16

Motivations

[ME78] Key Sizes 80’s ↓ 00’s [Nie86] Other variations Most of them broken [Ale03] [Gab05] [Gab91] [ABDGZ16] HQC RQC [Ove07] Attacks Bottom Line Security proof Rank Metric Group action [MB09] dyadic [BCGO09] alternant [BBC08] QC-LDPC Ntru-like [MTSB13] QC-MDPC [GMRZ13] QC-LRPC Ntru-like RS BCH Goppa RM

slide-17
SLIDE 17

Motivations

[ME78] Key Sizes 80’s ↓ 00’s [Nie86] Other variations Most of them broken [Ale03] [Gab05] [Gab91] [ABDGZ16] HQC RQC [Ove07] Attacks Bottom Line L a c k E f f i c i e n c y Security proof Rank Metric Group action [MB09] dyadic [BCGO09] alternant [BBC08] QC-LDPC Ntru-like [MTSB13] QC-MDPC [GMRZ13] QC-LRPC Ntru-like RS BCH Goppa RM

slide-18
SLIDE 18

Motivations

[ME78] Key Sizes 80’s ↓ 00’s [Nie86] Other variations Most of them broken [Ale03] [Gab05] [Gab91] [ABDGZ16] HQC RQC [Ove07] Attacks Bottom Line L a c k a P r

  • f

L a c k E f f i c i e n c y Security proof Rank Metric Group action [MB09] dyadic [BCGO09] alternant [BBC08] QC-LDPC Ntru-like [MTSB13] QC-MDPC [GMRZ13] QC-LRPC Ntru-like RS BCH Goppa RM

slide-19
SLIDE 19

Motivations

[ME78] Key Sizes 80’s ↓ 00’s [Nie86] Other variations Most of them broken [Ale03] [Gab05] [Gab91] [ABDGZ16] HQC RQC [Ove07] Attacks Bottom Line P r

  • f

E f f i c i e n c y Security proof Rank Metric Group action [MB09] dyadic [BCGO09] alternant [BBC08] QC-LDPC Ntru-like [MTSB13] QC-MDPC [GMRZ13] QC-LRPC Ntru-like RS BCH Goppa RM

slide-20
SLIDE 20

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Outline

1

Reminders on HQC

2

Presentation of the Ouroboros protocol

3

Security

4

Parameters

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 3 / 21

slide-21
SLIDE 21

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

HQC Encryption Scheme [ABD+16]

Encryption scheme in Hamming metric, using Quasi-Cyclic Codes Notation: Secret data - Public data - One-time Randomness G is the generator matrix of some public code C.

Alice Bob seedh

$

← {0, 1}λ, h

seedh

← Fn

2

x, y

$

← Sn

w(F2), s ← x + hy

µ ← C.Decode (ρ − vy)

seedh,s

− − − − − − − − − →

v,ρ

← − − − − − − − r1, r2

$

← Sn

w(F2), ǫ $

← Sn

cw(F2)

v ← r1 + hr2, ρ ← µG + sr2 + ǫ

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 4 / 21

slide-22
SLIDE 22

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

HQC Encryption Scheme [ABD+16]

Encryption scheme in Hamming metric, using Quasi-Cyclic Codes Notation: Secret data - Public data - One-time Randomness G is the generator matrix of some public code C.

Alice Bob seedh

$

← {0, 1}λ, h

seedh

← Fn

2

x, y

$

← Sn

w(F2), s ← x + hy

µ ← C.Decode (ρ − vy)

seedh,s

− − − − − − − − − →

v,ρ

← − − − − − − − r1, r2

$

← Sn

w(F2), ǫ $

← Sn

cw(F2)

v ← r1 + hr2, ρ ← µG + sr2 + ǫ

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 4 / 21

slide-23
SLIDE 23

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

HQC Encryption Scheme [ABD+16]

Encryption scheme in Hamming metric, using Quasi-Cyclic Codes Notation: Secret data - Public data - One-time Randomness G is the generator matrix of some public code C.

Alice Bob seedh

$

← {0, 1}λ, h

seedh

← Fn

2

x, y

$

← Sn

w(F2), s ← x + hy

µ ← C.Decode (ρ − vy)

seedh,s

− − − − − − − − − →

v,ρ

← − − − − − − − r1, r2

$

← Sn

w(F2), ǫ $

← Sn

cw(F2)

v ← r1 + hr2, ρ ← µG + sr2 + ǫ

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 4 / 21

slide-24
SLIDE 24

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

HQC Encryption Scheme [ABD+16]

Encryption scheme in Hamming metric, using Quasi-Cyclic Codes Notation: Secret data - Public data - One-time Randomness G is the generator matrix of some public code C.

Alice Bob seedh

$

← {0, 1}λ, h

seedh

← Fn

2

x, y

$

← Sn

w(F2), s ← x + hy

µ ← C.Decode (ρ − vy)

seedh,s

− − − − − − − − − →

v,ρ

← − − − − − − − r1, r2

$

← Sn

w(F2), ǫ $

← Sn

cw(F2)

v ← r1 + hr2, ρ ← µG + sr2 + ǫ

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 4 / 21

slide-25
SLIDE 25

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Correctness

Correctness Property Decrypt (sk, Encrypt (pk, µ, θ)) = µ C.Decode correctly decodes ρ − v · y whenever the error term is not too big ω (s · r2 − v · y + ǫ) ≤ δ ω ((x + h · y) · r2 − (r1 + h · r2) · y + ǫ) ≤ δ ω(x · r2 − r1 · y + ǫ) ≤ δ Error distribution analysis → Decryption failure probability better understood

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 5 / 21

slide-26
SLIDE 26

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Correctness

Correctness Property Decrypt (sk, Encrypt (pk, µ, θ)) = µ C.Decode correctly decodes ρ − v · y whenever the error term is not too big ω (s · r2 − v · y + ǫ) ≤ δ ω ((x + h · y) · r2 − (r1 + h · r2) · y + ǫ) ≤ δ ω(x · r2 − r1 · y + ǫ) ≤ δ Error distribution analysis → Decryption failure probability better understood

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 5 / 21

slide-27
SLIDE 27

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Correctness

Correctness Property Decrypt (sk, Encrypt (pk, µ, θ)) = µ C.Decode correctly decodes ρ − v · y whenever the error term is not too big ω (s · r2 − v · y + ǫ) ≤ δ ω ((x + h · y) · r2 − (r1 + h · r2) · y + ǫ) ≤ δ ω(x · r2 − r1 · y + ǫ) ≤ δ Error distribution analysis → Decryption failure probability better understood

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 5 / 21

slide-28
SLIDE 28

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Outline

1

Reminders on HQC

2

Presentation of the Ouroboros protocol Cyclic Error Decoding BitFlipping algorithm Description of the protocol

3

Security

4

Parameters

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 6 / 21

slide-29
SLIDE 29

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

A particular decoding

HQC requires x · r2 − r1 · y + ǫ to be “small” to correctly decode Ouroboros further exploits the shape of the error Cyclic Error Decoding (CED) Problem Let x, y, r1, r2

$

← Sn

w(F2) with w = O(√n), and e $

← Sn

cw(F2) a random error vector.

Given (x, y) ∈ (Sn

w(F2))2 and ec ← xr2 − yr1 + e such that ω(r1) = ω(r2) = w, find (r1, r2).

This is essentially a noisy SD problem x

  • −y
  • r2

r1 + e

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 7 / 21

slide-30
SLIDE 30

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

A particular decoding

HQC requires x · r2 − r1 · y + ǫ to be “small” to correctly decode Ouroboros further exploits the shape of the error Cyclic Error Decoding (CED) Problem Let x, y, r1, r2

$

← Sn

w(F2) with w = O(√n), and e $

← Sn

cw(F2) a random error vector.

Given (x, y) ∈ (Sn

w(F2))2 and ec ← xr2 − yr1 + e such that ω(r1) = ω(r2) = w, find (r1, r2).

This is essentially a noisy SD problem x

  • −y
  • r2

r1 + e

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 7 / 21

slide-31
SLIDE 31

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

A particular decoding

HQC requires x · r2 − r1 · y + ǫ to be “small” to correctly decode Ouroboros further exploits the shape of the error Cyclic Error Decoding (CED) Problem Let x, y, r1, r2

$

← Sn

w(F2) with w = O(√n), and e $

← Sn

cw(F2) a random error vector.

Given (x, y) ∈ (Sn

w(F2))2 and ec ← xr2 − yr1 + e such that ω(r1) = ω(r2) = w, find (r1, r2).

This is essentially a noisy SD problem x

  • −y
  • r2

r1 + e

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 7 / 21

slide-32
SLIDE 32

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

A particular decoding

HQC requires x · r2 − r1 · y + ǫ to be “small” to correctly decode Ouroboros further exploits the shape of the error Cyclic Error Decoding (CED) Problem Let x, y, r1, r2

$

← Sn

w(F2) with w = O(√n), and e $

← Sn

cw(F2) a random error vector.

Given (x, y) ∈ (Sn

w(F2))2 and ec ← xr2 − yr1 + e such that ω(r1) = ω(r2) = w, find (r1, r2).

This is essentially a noisy SD problem x

  • −y
  • r2

r1 + e

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 7 / 21

slide-33
SLIDE 33

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

A particular decoding

HQC requires x · r2 − r1 · y + ǫ to be “small” to correctly decode Ouroboros further exploits the shape of the error Cyclic Error Decoding (CED) Problem Let x, y, r1, r2

$

← Sn

w(F2) with w = O(√n), and e $

← Sn

cw(F2) a random error vector.

Given (x, y) ∈ (Sn

w(F2))2 and ec ← xr2 − yr1 + e such that ω(r1) = ω(r2) = w, find (r1, r2).

This is essentially a noisy SD problem x

  • −y
  • r2

r1 + e

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 7 / 21

slide-34
SLIDE 34

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Outline

1

Reminders on HQC

2

Presentation of the Ouroboros protocol Cyclic Error Decoding BitFlipping algorithm Description of the protocol

3

Security

4

Parameters

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 8 / 21

slide-35
SLIDE 35

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Hard Decision Decoding: BitFlipping

Introduced by Gallager in 1962 Iterative decoding for Low Density Parity Check codes Decoding capacity increase linearly with the code length Intuition

1

Compute the number of unsatisfied parity-check equations for each bit of the message

2

If this number is greater than some threshold, flip the bit and go to 1.

3

Stop when the syndrome is null (or after a certain number of iterations). Easy to understand Easy to implement Pretty efficient The threshold value is crucial [CS16]

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 9 / 21

slide-36
SLIDE 36

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Hard Decision Decoding: BitFlipping

Introduced by Gallager in 1962 Iterative decoding for Low Density Parity Check codes Decoding capacity increase linearly with the code length Intuition

1

Compute the number of unsatisfied parity-check equations for each bit of the message

2

If this number is greater than some threshold, flip the bit and go to 1.

3

Stop when the syndrome is null (or after a certain number of iterations). Easy to understand Easy to implement Pretty efficient The threshold value is crucial [CS16]

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 9 / 21

slide-37
SLIDE 37

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Hard Decision Decoding: BitFlipping

Introduced by Gallager in 1962 Iterative decoding for Low Density Parity Check codes Decoding capacity increase linearly with the code length Intuition

1

Compute the number of unsatisfied parity-check equations for each bit of the message

2

If this number is greater than some threshold, flip the bit and go to 1.

3

Stop when the syndrome is null (or after a certain number of iterations). Easy to understand Easy to implement Pretty efficient The threshold value is crucial [CS16]

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 9 / 21

slide-38
SLIDE 38

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Hard Decision Decoding: BitFlipping

Introduced by Gallager in 1962 Iterative decoding for Low Density Parity Check codes Decoding capacity increase linearly with the code length Intuition

1

Compute the number of unsatisfied parity-check equations for each bit of the message

2

If this number is greater than some threshold, flip the bit and go to 1.

3

Stop when the syndrome is null (or after a certain number of iterations). Easy to understand Easy to implement Pretty efficient The threshold value is crucial [CS16]

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 9 / 21

slide-39
SLIDE 39

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Hard Decision Decoding: BitFlipping

Introduced by Gallager in 1962 Iterative decoding for Low Density Parity Check codes Decoding capacity increase linearly with the code length Intuition

1

Compute the number of unsatisfied parity-check equations for each bit of the message

2

If this number is greater than some threshold, flip the bit and go to 1.

3

Stop when the syndrome is null (or after a certain number of iterations). Easy to understand Easy to implement Pretty efficient The threshold value is crucial [CS16]

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 9 / 21

slide-40
SLIDE 40

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Outline

1

Reminders on HQC

2

Presentation of the Ouroboros protocol Cyclic Error Decoding BitFlipping algorithm Description of the protocol

3

Security

4

Parameters

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 10 / 21

slide-41
SLIDE 41

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Ouroboros

Requires a hash function Hash : {0, 1}∗ − → Sn

cw(F2) [Sen05]

ǫ of HQC plays the role of the exchanged secret in Ouroboros CE-Decoder is a modified BitFlipping algorithm to solve the CED problem

Alice Bob seedh

$

← {0, 1}λ, h

seedh

← Fn

2

x, y

$

← Sn

w(F2), s ← x + hy

ec ← se − ysr = xr2 − yr1 + ǫ′ (r1, r2) ← CE-Decoder(x, y, ec, t, w, we) ǫ ← ec − xr2 + yr1 − Hash(r1, r2) ǫ

h,s

− − − − − − →

sr,se

← − − − − − − − Shared Secret r1, r2

$

← Sn

w(F2)

er ← Hash (r1, r2), ǫ

$

← Sn

we(F2)

sr ← r1 + hr2, se ← sr2 + er + ǫ ǫ

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 11 / 21

slide-42
SLIDE 42

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Ouroboros

Requires a hash function Hash : {0, 1}∗ − → Sn

cw(F2) [Sen05]

ǫ of HQC plays the role of the exchanged secret in Ouroboros CE-Decoder is a modified BitFlipping algorithm to solve the CED problem

Alice Bob seedh

$

← {0, 1}λ, h

seedh

← Fn

2

x, y

$

← Sn

w(F2), s ← x + hy

ec ← se − ysr = xr2 − yr1 + ǫ′ (r1, r2) ← CE-Decoder(x, y, ec, t, w, we) ǫ ← ec − xr2 + yr1 − Hash(r1, r2) ǫ

h,s

− − − − − − →

sr,se

← − − − − − − − Shared Secret r1, r2

$

← Sn

w(F2)

er ← Hash (r1, r2), ǫ

$

← Sn

we(F2)

sr ← r1 + hr2, se ← sr2 + er + ǫ ǫ

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 11 / 21

slide-43
SLIDE 43

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Ouroboros

Requires a hash function Hash : {0, 1}∗ − → Sn

cw(F2) [Sen05]

ǫ of HQC plays the role of the exchanged secret in Ouroboros CE-Decoder is a modified BitFlipping algorithm to solve the CED problem

Alice Bob seedh

$

← {0, 1}λ, h

seedh

← Fn

2

x, y

$

← Sn

w(F2), s ← x + hy

ec ← se − ysr = xr2 − yr1 + ǫ′ (r1, r2) ← CE-Decoder(x, y, ec, t, w, we) ǫ ← ec − xr2 + yr1 − Hash(r1, r2) ǫ

h,s

− − − − − − →

sr,se

← − − − − − − − Shared Secret r1, r2

$

← Sn

w(F2)

er ← Hash (r1, r2), ǫ

$

← Sn

we(F2)

sr ← r1 + hr2, se ← sr2 + er + ǫ ǫ

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 11 / 21

slide-44
SLIDE 44

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Ouroboros

Requires a hash function Hash : {0, 1}∗ − → Sn

cw(F2) [Sen05]

ǫ of HQC plays the role of the exchanged secret in Ouroboros CE-Decoder is a modified BitFlipping algorithm to solve the CED problem

Alice Bob seedh

$

← {0, 1}λ, h

seedh

← Fn

2

x, y

$

← Sn

w(F2), s ← x + hy

ec ← se − ysr = xr2 − yr1 + ǫ′ (r1, r2) ← CE-Decoder(x, y, ec, t, w, we) ǫ ← ec − xr2 + yr1 − Hash(r1, r2) ǫ

h,s

− − − − − − →

sr,se

← − − − − − − − Shared Secret r1, r2

$

← Sn

w(F2)

er ← Hash (r1, r2), ǫ

$

← Sn

we(F2)

sr ← r1 + hr2, se ← sr2 + er + ǫ ǫ

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 11 / 21

slide-45
SLIDE 45

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Ouroboros

Requires a hash function Hash : {0, 1}∗ − → Sn

cw(F2) [Sen05]

ǫ of HQC plays the role of the exchanged secret in Ouroboros CE-Decoder is a modified BitFlipping algorithm to solve the CED problem

Alice Bob seedh

$

← {0, 1}λ, h

seedh

← Fn

2

x, y

$

← Sn

w(F2), s ← x + hy

ec ← se − ysr = xr2 − yr1 + ǫ′ (r1, r2) ← CE-Decoder(x, y, ec, t, w, we) ǫ ← ec − xr2 + yr1 − Hash(r1, r2) ǫ

h,s

− − − − − − →

sr,se

← − − − − − − − Shared Secret r1, r2

$

← Sn

w(F2)

er ← Hash (r1, r2), ǫ

$

← Sn

we(F2)

sr ← r1 + hr2, se ← sr2 + er + ǫ ǫ

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 11 / 21

slide-46
SLIDE 46

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Ouroboros

Requires a hash function Hash : {0, 1}∗ − → Sn

cw(F2) [Sen05]

ǫ of HQC plays the role of the exchanged secret in Ouroboros CE-Decoder is a modified BitFlipping algorithm to solve the CED problem

Alice Bob seedh

$

← {0, 1}λ, h

seedh

← Fn

2

x, y

$

← Sn

w(F2), s ← x + hy

ec ← se − ysr = xr2 − yr1 + ǫ′ (r1, r2) ← CE-Decoder(x, y, ec, t, w, we) ǫ ← ec − xr2 + yr1 − Hash(r1, r2) ǫ

h,s

− − − − − − →

sr,se

← − − − − − − − Shared Secret r1, r2

$

← Sn

w(F2)

er ← Hash (r1, r2), ǫ

$

← Sn

we(F2)

sr ← r1 + hr2, se ← sr2 + er + ǫ ǫ

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 11 / 21

slide-47
SLIDE 47

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Ouroboros

Requires a hash function Hash : {0, 1}∗ − → Sn

cw(F2) [Sen05]

ǫ of HQC plays the role of the exchanged secret in Ouroboros CE-Decoder is a modified BitFlipping algorithm to solve the CED problem

Alice Bob seedh

$

← {0, 1}λ, h

seedh

← Fn

2

x, y

$

← Sn

w(F2), s ← x + hy

ec ← se − ysr = xr2 − yr1 + ǫ′ (r1, r2) ← CE-Decoder(x, y, ec, t, w, we) ǫ ← ec − xr2 + yr1 − Hash(r1, r2) ǫ

h,s

− − − − − − →

sr,se

← − − − − − − − Shared Secret r1, r2

$

← Sn

w(F2)

er ← Hash (r1, r2), ǫ

$

← Sn

we(F2)

sr ← r1 + hr2, se ← sr2 + er + ǫ ǫ

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 11 / 21

slide-48
SLIDE 48

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Outline

1

Reminders on HQC

2

Presentation of the Ouroboros protocol

3

Security Security Model and Hybrid Argument Ouroboros Security

4

Parameters

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 12 / 21

slide-49
SLIDE 49

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Security Model and Hybrid Argument

Key exchange as an encryption scheme Same as Ding et al. [Din12, DXL12], Peikert’s [Pei14], BCNS [BCNS15] and NewHope [ADPS16] Usual game: Expind−b

E,A (λ)

  • 1. param ← Setup(1λ)
  • 2. (pk, sk) ← KeyGen(param)
  • 3. (ǫ0, ǫ1) ← A(FIND : pk)
  • 4. c∗ ← Encrypt(pk, ǫb, θ)
  • 5. b′ ← A(GUESS : c∗)
  • 6. RETURN b′

Hybrid argument:

1

Construct a sequence of games transitioning from Enc(ǫ0) to Enc(ǫ1)

2

Prove they are indistinguishable one from another

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 13 / 21

slide-50
SLIDE 50

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Security Model and Hybrid Argument

Key exchange as an encryption scheme Same as Ding et al. [Din12, DXL12], Peikert’s [Pei14], BCNS [BCNS15] and NewHope [ADPS16] Usual game: Expind−b

E,A (λ)

  • 1. param ← Setup(1λ)
  • 2. (pk, sk) ← KeyGen(param)
  • 3. (ǫ0, ǫ1) ← A(FIND : pk)
  • 4. c∗ ← Encrypt(pk, ǫb, θ)
  • 5. b′ ← A(GUESS : c∗)
  • 6. RETURN b′

Hybrid argument:

1

Construct a sequence of games transitioning from Enc(ǫ0) to Enc(ǫ1)

2

Prove they are indistinguishable one from another

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 13 / 21

slide-51
SLIDE 51

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Security Model and Hybrid Argument

Key exchange as an encryption scheme Same as Ding et al. [Din12, DXL12], Peikert’s [Pei14], BCNS [BCNS15] and NewHope [ADPS16] Usual game: Expind−b

E,A (λ)

  • 1. param ← Setup(1λ)
  • 2. (pk, sk) ← KeyGen(param)
  • 3. (ǫ0, ǫ1) ← A(FIND : pk)
  • 4. c∗ ← Encrypt(pk, ǫb, θ)
  • 5. b′ ← A(GUESS : c∗)
  • 6. RETURN b′

Hybrid argument:

1

Construct a sequence of games transitioning from Enc(ǫ0) to Enc(ǫ1)

2

Prove they are indistinguishable one from another

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 13 / 21

slide-52
SLIDE 52

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Security Model and Hybrid Argument

Key exchange as an encryption scheme Same as Ding et al. [Din12, DXL12], Peikert’s [Pei14], BCNS [BCNS15] and NewHope [ADPS16] Usual game: Expind−b

E,A (λ)

  • 1. param ← Setup(1λ)
  • 2. (pk, sk) ← KeyGen(param)
  • 3. (ǫ0, ǫ1) ← A(FIND : pk)
  • 4. c∗ ← Encrypt(pk, ǫb, θ)
  • 5. b′ ← A(GUESS : c∗)
  • 6. RETURN b′

Hybrid argument:

1

Construct a sequence of games transitioning from Enc(ǫ0) to Enc(ǫ1)

2

Prove they are indistinguishable one from another

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 13 / 21

slide-53
SLIDE 53

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Outline

1

Reminders on HQC

2

Presentation of the Ouroboros protocol

3

Security Security Model and Hybrid Argument Ouroboros Security

4

Parameters

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 14 / 21

slide-54
SLIDE 54

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Security

Definition (SD Distribution) For positive integers, n, k, and w, the SD(n, k, w) Distribution chooses H

$

← F(n−k)×n and x

$

← Fn such that ω(x) = w, and outputs (H, Hx⊤). Definition (Decisional s-QCSD Problem) For positive integers n, k, w, s, a random parity check matrix H of a QC code C and y

$

← Fn, the Decisional s-Quasi-Cyclic SD Problem s-DQCSD(n, k, w) asks to decide with non-negligible advantage whether (H, y⊤) came from the s-QCSD(n, k, w) distribution or the uniform distribution over F(n−k)×n × Fn−k. Theorem Ouroboros is IND-CPA under the 2-DQCSD and 3-DQCSD assumptions. →

sketch of proof J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 15 / 21

slide-55
SLIDE 55

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Security

Definition (SD Distribution) For positive integers, n, k, and w, the SD(n, k, w) Distribution chooses H

$

← F(n−k)×n and x

$

← Fn such that ω(x) = w, and outputs (H, Hx⊤). Definition (Decisional s-QCSD Problem) For positive integers n, k, w, s, a random parity check matrix H of a QC code C and y

$

← Fn, the Decisional s-Quasi-Cyclic SD Problem s-DQCSD(n, k, w) asks to decide with non-negligible advantage whether (H, y⊤) came from the s-QCSD(n, k, w) distribution or the uniform distribution over F(n−k)×n × Fn−k. Theorem Ouroboros is IND-CPA under the 2-DQCSD and 3-DQCSD assumptions. →

sketch of proof J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 15 / 21

slide-56
SLIDE 56

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Security

Definition (SD Distribution) For positive integers, n, k, and w, the SD(n, k, w) Distribution chooses H

$

← F(n−k)×n and x

$

← Fn such that ω(x) = w, and outputs (H, Hx⊤). Definition (Decisional s-QCSD Problem) For positive integers n, k, w, s, a random parity check matrix H of a QC code C and y

$

← Fn, the Decisional s-Quasi-Cyclic SD Problem s-DQCSD(n, k, w) asks to decide with non-negligible advantage whether (H, y⊤) came from the s-QCSD(n, k, w) distribution or the uniform distribution over F(n−k)×n × Fn−k. Theorem Ouroboros is IND-CPA under the 2-DQCSD and 3-DQCSD assumptions. →

sketch of proof J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 15 / 21

slide-57
SLIDE 57

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Outline

1

Reminders on HQC

2

Presentation of the Ouroboros protocol

3

Security

4

Parameters Reduction Compliant Optimized Parameters

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 16 / 21

slide-58
SLIDE 58

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Reduction Compliant Parameters

Ouroboros Parameters Instance n w we threshold security DFR Low-I 5, 851 47 94 30 80 0.92·10−5 Low-II 5, 923 47 94 30 80 2.3 · 10−6 Medium-I 13, 691 75 150 45 128 0.96·10−5 Medium-II 14, 243 75 150 45 128 1.09·10−6 Strong-I 40, 013 147 294 85 256 4.20·10−5 Strong-II 40, 973 147 294 85 256 < 10−6

Table : Parameter sets for Ouroboros

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 17 / 21

slide-59
SLIDE 59

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Outline

1

Reminders on HQC

2

Presentation of the Ouroboros protocol

3

Security

4

Parameters Reduction Compliant Optimized Parameters

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 18 / 21

slide-60
SLIDE 60

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Optimized Parameters wrt Best Know Attacks

Ouroboros Optimized Parameters Instance n w we threshold security DFR Low-I 4, 813 41 123 27 80 2.23·10−5 Low-II 5, 003 41 123 27 80 2.60·10−6 Medium-I 10, 301 67 201 42 128 1.01·10−4 Medium-II 10, 837 67 201 42 128 < 10−7 Strong-I 32, 771 131 393 77 256 < 10−4 Strong-II 33, 997 131 393 77 256 < 10−7

Table : Optimized parameter sets for Ouroboros in Hamming metric

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 19 / 21

slide-61
SLIDE 61

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Conclusion

In this talk Ouroboros: a secure, simple, and efficient code-based key exchange protocol Efficient decoding through BitFlipping Competitive parameters Further Improvements

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 20 / 21

slide-62
SLIDE 62

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Conclusion

In this talk Ouroboros: a secure, simple, and efficient code-based key exchange protocol Efficient decoding through BitFlipping Competitive parameters Further Improvements

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 20 / 21

slide-63
SLIDE 63

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Conclusion

In this talk Ouroboros: a secure, simple, and efficient code-based key exchange protocol Efficient decoding through BitFlipping Competitive parameters Further Improvements

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 20 / 21

slide-64
SLIDE 64

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Conclusion

In this talk Ouroboros: a secure, simple, and efficient code-based key exchange protocol Efficient decoding through BitFlipping Competitive parameters Further Improvements Improve BitFlipping threshold [CS16] Switching to Rank metric drastically improves parameters! →

interlude?

Optimize implementation OpenSSL TLS integration

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 20 / 21

slide-65
SLIDE 65

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Conclusion

In this talk Ouroboros: a secure, simple, and efficient code-based key exchange protocol Efficient decoding through BitFlipping Competitive parameters Further Improvements Improve BitFlipping threshold [CS16] Switching to Rank metric drastically improves parameters! →

interlude?

Optimize implementation OpenSSL TLS integration

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 20 / 21

slide-66
SLIDE 66

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Conclusion

In this talk Ouroboros: a secure, simple, and efficient code-based key exchange protocol Efficient decoding through BitFlipping Competitive parameters Further Improvements Improve BitFlipping threshold [CS16] Switching to Rank metric drastically improves parameters! →

interlude?

Optimize implementation OpenSSL TLS integration

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 20 / 21

slide-67
SLIDE 67

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Conclusion

In this talk Ouroboros: a secure, simple, and efficient code-based key exchange protocol Efficient decoding through BitFlipping Competitive parameters Further Improvements Improve BitFlipping threshold [CS16] Switching to Rank metric drastically improves parameters! →

interlude?

Optimize implementation OpenSSL TLS integration

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 20 / 21

slide-68
SLIDE 68

Reminders on HQC Presentation of the Ouroboros protocol Security Parameters Conclusion

Conclusion

In this talk Ouroboros: a secure, simple, and efficient code-based key exchange protocol Efficient decoding through BitFlipping Competitive parameters Further Improvements Improve BitFlipping threshold [CS16] Switching to Rank metric drastically improves parameters! →

interlude?

Optimize implementation OpenSSL TLS integration

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 20 / 21

slide-69
SLIDE 69

Thanks!

Paper available @ http:/ /unil.im/ouroboros

slide-70
SLIDE 70

Thanks!

Carlos Aguilar Melchor, Olivier Blazy, Jean Christophe Deneuville, Philippe Gaborit, and Gilles Z´ emor. Efficient encryption from random quasi-cyclic codes. CoRR, abs/1612.05572, 2016. Erdem Alkim, L´ eo Ducas, Thomas P¨

  • ppelmann, and

Peter Schwabe. Post-quantum key exchange - A new hope. In Thorsten Holz and Stefan Savage, editors, 25th USENIX Security Symposium, USENIX Security 16, Austin, TX, USA, August 10-12, 2016., pages 327–343. USENIX Association, 2016. Michael Alekhnovich. More on average case vs approximation complexity. In 44th Symposium on Foundations of Computer Science (FOCS 2003), 11-14 October 2003, Cambridge, MA, USA, Proceedings, pages 298–307, 2003. Joppe W. Bos, Craig Costello, Michael Naehrig, and Douglas Stebila. Post-quantum key exchange for the TLS protocol from the ring learning with errors problem. In 2015 IEEE Symposium on Security and Privacy, pages 553–570. IEEE Computer Society Press, May 2015. Julia Chaulet and Nicolas Sendrier. Worst case qc-mdpc decoder for mceliece cryptosystem. In Information Theory (ISIT), 2016 IEEE International Symposium on, pages 1366–1370. IEEE, 2016. Jintai Ding. New cryptographic constructions using generalized learning with errors problem. Cryptology ePrint Archive, Report 2012/387, 2012. Jintai Ding, Xiang Xie, and Xiaodong Lin. A simple provably secure key exchange scheme based

  • n the learning with errors problem.

Cryptology ePrint Archive, Report 2012/688, 2012. Rafael Misoczki, Jean-Pierre Tillich, Nicolas Sendrier, and Paulo SLM Barreto. Mdpc-mceliece: New mceliece variants from moderate density parity-check codes. In Information Theory Proceedings (ISIT), 2013 IEEE International Symposium on, pages 2069–2073. IEEE, 2013. Chris Peikert. Lattice cryptography for the internet. In Michele Mosca, editor, Post-Quantum Cryptography - 6th International Workshop, PQCrypto 2014, Waterloo, ON, Canada, October 1-3,

  • 2014. Proceedings, volume 8772 of Lecture Notes in

Computer Science, pages 197–219. Springer, 2014. Nicolas Sendrier. Encoding information into constant weight words. In Information Theory, 2005. ISIT 2005. Proceedings. International Symposium on, pages 435–438. IEEE, 2005. Paper available @ http:/ /unil.im/ouroboros

slide-71
SLIDE 71

Rank Metric Interlude (1/2)

Rank metric defined over (finite) extensions of finite fields Fq a finite field with q a power of a prime. Fqm an extension of degree m of Fq. Fqm can be seen as a vector space on Fq. B = (b1, ..., bm) a basis of Fqm over Fq. Let v = (v1, . . . , vn) be a word of length n in Fqm. Any coordinate vj = m

i=1 vijbi with vij ∈ Fq.

v = (v1, ..., vn) → V =      v11 v12 . . . v1n v21 v22 . . . v2n . . . . . . ... . . . vm1 vm2 . . . vmn      Rank weight of word v has rank r = rank(v) iff the rank of V = (vij)ij is r. Equivalently rank(v) = r ⇔ vj ∈ Vr ⊂ Fn

qm with dim(Vr)=r.

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 22 / 21

slide-72
SLIDE 72

Rank Metric Interlude (1/2)

Rank metric defined over (finite) extensions of finite fields Fq a finite field with q a power of a prime. Fqm an extension of degree m of Fq. Fqm can be seen as a vector space on Fq. B = (b1, ..., bm) a basis of Fqm over Fq. Let v = (v1, . . . , vn) be a word of length n in Fqm. Any coordinate vj = m

i=1 vijbi with vij ∈ Fq.

v = (v1, ..., vn) → V =      v11 v12 . . . v1n v21 v22 . . . v2n . . . . . . ... . . . vm1 vm2 . . . vmn      Rank weight of word v has rank r = rank(v) iff the rank of V = (vij)ij is r. Equivalently rank(v) = r ⇔ vj ∈ Vr ⊂ Fn

qm with dim(Vr)=r.

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 22 / 21

slide-73
SLIDE 73

Rank Metric Interlude (1/2)

Rank metric defined over (finite) extensions of finite fields Fq a finite field with q a power of a prime. Fqm an extension of degree m of Fq. Fqm can be seen as a vector space on Fq. B = (b1, ..., bm) a basis of Fqm over Fq. Let v = (v1, . . . , vn) be a word of length n in Fqm. Any coordinate vj = m

i=1 vijbi with vij ∈ Fq.

v = (v1, ..., vn) → V =      v11 v12 . . . v1n v21 v22 . . . v2n . . . . . . ... . . . vm1 vm2 . . . vmn      Rank weight of word v has rank r = rank(v) iff the rank of V = (vij)ij is r. Equivalently rank(v) = r ⇔ vj ∈ Vr ⊂ Fn

qm with dim(Vr)=r.

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 22 / 21

slide-74
SLIDE 74

Rank Metric Interlude (2/2)

Best Known Attacks have worse complexity in rank metric (2O(n2)) than in Hamming metric (2O(n)) Consequence: worse attacks ⇒ better parameters

Ouroboros-R Parameters Instance key size (bits) n m q w security decoding failure Ouroboros-R-I 1,591 37 43 2 5 100 10−4 Ouroboros-R-II 2,809 53 53 2 5 128 10−8 Ouroboros-R-III 3, 953 59 67 2 6 192 10−7 Ouroboros-R-IV 5, 293 67 79 2 7 256 10−5 Ouroboros-R-V 5, 618 53 53 4 6 256 10−10

Parameter sets for Ouroboros-R in rank metric.

back to conclusion J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 23 / 21

slide-75
SLIDE 75

Rank Metric Interlude (2/2)

Best Known Attacks have worse complexity in rank metric (2O(n2)) than in Hamming metric (2O(n)) Consequence: worse attacks ⇒ better parameters

Ouroboros-R Parameters Instance key size (bits) n m q w security decoding failure Ouroboros-R-I 1,591 37 43 2 5 100 10−4 Ouroboros-R-II 2,809 53 53 2 5 128 10−8 Ouroboros-R-III 3, 953 59 67 2 6 192 10−7 Ouroboros-R-IV 5, 293 67 79 2 7 256 10−5 Ouroboros-R-V 5, 618 53 53 4 6 256 10−10

Parameter sets for Ouroboros-R in rank metric.

back to conclusion J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 23 / 21

slide-76
SLIDE 76

Rank Metric Interlude (2/2)

Best Known Attacks have worse complexity in rank metric (2O(n2)) than in Hamming metric (2O(n)) Consequence: worse attacks ⇒ better parameters

Ouroboros-R Parameters Instance key size (bits) n m q w security decoding failure Ouroboros-R-I 1,591 37 43 2 5 100 10−4 Ouroboros-R-II 2,809 53 53 2 5 128 10−8 Ouroboros-R-III 3, 953 59 67 2 6 192 10−7 Ouroboros-R-IV 5, 293 67 79 2 7 256 10−5 Ouroboros-R-V 5, 618 53 53 4 6 256 10−10

Parameter sets for Ouroboros-R in rank metric.

back to conclusion J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 23 / 21

slide-77
SLIDE 77

Sketch of proof

Sequence of games from Enc(ǫ0) to Enc(ǫ1) Enc(ǫ0) Encs⋆(ǫ0) Encs⋆,r⋆(ǫ0) Encs⋆,r⋆(ǫ1) Encs⋆(ǫ1) Enc(ǫ1) Advind

E,A(λ) ≤ 2 ·

  • Adv2-DQCSD(λ) + Adv3-DQCSD(λ)
  • back to security

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 24 / 21

slide-78
SLIDE 78

Sketch of proof

Sequence of games from Enc(ǫ0) to Enc(ǫ1) Enc(ǫ0) Encs⋆(ǫ0) Encs⋆,r⋆(ǫ0) Encs⋆,r⋆(ǫ1) Encs⋆(ǫ1) Enc(ǫ1) Advind

E,A(λ) ≤ 2 ·

  • Adv2-DQCSD(λ) + Adv3-DQCSD(λ)
  • back to security

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 24 / 21

slide-79
SLIDE 79

Sketch of proof

Sequence of games from Enc(ǫ0) to Enc(ǫ1) Enc(ǫ0) Encs⋆(ǫ0) Encs⋆,r⋆(ǫ0) Encs⋆,r⋆(ǫ1) Encs⋆(ǫ1) Enc(ǫ1) Advind

E,A(λ) ≤ 2 ·

  • Adv2-DQCSD(λ) + Adv3-DQCSD(λ)
  • back to security

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 24 / 21

slide-80
SLIDE 80

Sketch of proof

Sequence of games from Enc(ǫ0) to Enc(ǫ1) Enc(ǫ0) Encs⋆(ǫ0) Encs⋆,r⋆(ǫ0) Encs⋆,r⋆(ǫ1) Encs⋆(ǫ1) Enc(ǫ1) Advind

E,A(λ) ≤ 2 ·

  • Adv2-DQCSD(λ) + Adv3-DQCSD(λ)
  • back to security

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 24 / 21

slide-81
SLIDE 81

Sketch of proof

Sequence of games from Enc(ǫ0) to Enc(ǫ1) Enc(ǫ0) Encs⋆(ǫ0) Encs⋆,r⋆(ǫ0) Encs⋆,r⋆(ǫ1) Encs⋆(ǫ1) Enc(ǫ1) Advind

E,A(λ) ≤ 2 ·

  • Adv2-DQCSD(λ) + Adv3-DQCSD(λ)
  • back to security

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 24 / 21

slide-82
SLIDE 82

Sketch of proof

Sequence of games from Enc(ǫ0) to Enc(ǫ1) Enc(ǫ0) Encs⋆(ǫ0) Encs⋆,r⋆(ǫ0) Encs⋆,r⋆(ǫ1) Encs⋆(ǫ1) Enc(ǫ1) Advind

E,A(λ) ≤ 2 ·

  • Adv2-DQCSD(λ) + Adv3-DQCSD(λ)
  • back to security

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 24 / 21

slide-83
SLIDE 83

Sketch of proof

Sequence of games from Enc(ǫ0) to Enc(ǫ1) Encs⋆(ǫ0) Enc(ǫ0) Encs⋆,r⋆(ǫ0) Encs⋆,r⋆(ǫ1) Encs⋆(ǫ1) Enc(ǫ1) Advind

E,A(λ)

Advind

E,A(λ) ≤ 2 ·

  • Adv2-DQCSD(λ) + Adv3-DQCSD(λ)
  • back to security

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 24 / 21

slide-84
SLIDE 84

Sketch of proof

Sequence of games from Enc(ǫ0) to Enc(ǫ1) Encs⋆(ǫ0) Enc(ǫ0) Encs⋆,r⋆(ǫ0) Encs⋆,r⋆(ǫ1) Encs⋆(ǫ1) Enc(ǫ1) Advind

E,A(λ)

Advind

E,A(λ) ≤ 2 ·

  • Adv2-DQCSD(λ) + Adv3-DQCSD(λ)
  • back to security

J.-C. Deneuville Ouroboros: simple, secure, efficient code-based key exchange June the 26th, 2017 24 / 21