Two attacks on rank metric code-based Jean-Pierre Tillich schemes: - - PowerPoint PPT Presentation

▶
two attacks on rank metric code based
SMART_READER_LITE
LIVE PREVIEW

Two attacks on rank metric code-based Jean-Pierre Tillich schemes: - - PowerPoint PPT Presentation

Dec 07, 2023 405 likes •672 views

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Two attacks on rank metric code-based Jean-Pierre Tillich schemes: RankSign and an IBE scheme Generalities on Rank-Based Cryptography

slide-1
SLIDE 1

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme

Thomas Debris-Alazard and Jean-Pierre Tillich December 3, 2018 Asiacrypt 2018 - Brisbane

1 / 22

slide-2
SLIDE 2

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

Results

Results of the paper:

  • Attack on a code-based “hash-and-sign” scheme RankSign

[GRSZ14] submitted to the NIST PQC Standardization; − → Can not be thwarted by changing the parameters.

  • Attack on the first code-based Identity-Based-Encryption (IBE)

[GHPT17] in rank-metric; − → Parameters can be chosen to avoid it.

  • IBE: moving Rank → Hamming metric no go.

2 / 22

slide-3
SLIDE 3

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

1 Generalities on Rank-Based Cryptography 2 LRPC-codes in RankSign [GMRZ13] 3 Our Attack

3 / 22

slide-4
SLIDE 4

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

Rank vs Hamming in Cryptography

  • Advantages:
  • In rank metric: alphabet size qm has an impact on the metric

→Useful for security reductions

  • Smaller key sizes than Hamming.
  • Disadvantage:
  • Rank metric: security less understood (algebraic attacks)

4 / 22

slide-5
SLIDE 5

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

Code-Based Cryptography

F finite field. Syndrome Decoding Problem.

  • Given: a matrix H ∈ Fr×n with r ≤ n, a vector s ∈ Fr, an

integer w;

  • Goal: find e ∈ Fn,

He⊺ = s⊺ weight(e) = w Hamming: weight(·) = # non-zero components and usually F = F2 Rank: weight(·) = Rank metric and F = Fqm − → Probabilistic polynomial reduction (Gaborit & Zémor) to the decoding problem in Hamming metric

5 / 22

slide-6
SLIDE 6

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

Rank Metric over Fqm

  • Fqm is a Fq-space of dimension m
  • x = (x1, · · · , xn) ∈ Fn

qm, its rank is defined as:

Support of x : x1, · · · , xnFq

△

=

  • i

λixi : λi ∈ Fq

  • ⊆ Fqm

rank(x) = dimFq

  • x1, · · · , xnFq
  • 6 / 22
slide-7
SLIDE 7

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

1 Generalities on Rank-Based Cryptography 2 LRPC-codes in RankSign [GMRZ13] 3 Our Attack

7 / 22

slide-8
SLIDE 8

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

Some History...

  • Gabidulin codes: first rank-codes with a polynomial decoder

→ Strong algebraic structure... and a zillion attacks (Overbeck’05...)

  • LRPC-codes: decoder introduced in [GMRZ13]

→ Finding the underlying structure is close to solving the syndrome decoding problem.

8 / 22

slide-9
SLIDE 9

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

LRPC-codes [GMRZ13]

  • Random Code: Given some random matrix HRand ∈ F(n−k)×n

qm

{c : HRandc⊺ = 0}

  • LRPC Code: Given HLRPC = (hi,j) ∈ F(n−k)×n

qm

s.t dim

  • hi,j : i, jFq
  • = small

then, {cLRPC : HLRPCcLRPC

⊺ = 0}

When HRand = (hi,j) ∈ F(n−k)×n

qm

is random, typically when m < n(n − k): hi,j : i, jFq = Fqm.

9 / 22

slide-10
SLIDE 10

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

LRPC-codes in RankSign[GRSZ14]

LRPC-codes come in RankSign with a decoder [GRSZ14]: ∀s, it computes polynomially e s.t HLRPCe⊺ = s⊺ rank(e) = w

  • Constraint RankSign: HLRPC = (hi,j) ∈ F(n−k)×n

qm

s.t (n − k) dim

  • hi,j : i, jFq
  • = n

Problem: Rows of HLRPC gives words of low weight... → A masking is needed!

10 / 22

slide-11
SLIDE 11

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

Masking LRPC-codes in RankSign

In RankSign [GRSZ14]:

  • Increase the weight of rows: [HLRPC|R] for R random;
  • Change the code: [HLRPC|R]P for P invertible in Fq.
  • Change the basis: Q[HLRPC|R]P for Q invertible;

Hpub

△

= Q[HLRPC|R]P : public key

11 / 22

slide-12
SLIDE 12

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

1 Generalities on Rank-Based Cryptography 2 LRPC-codes in RankSign [GMRZ13] 3 Our Attack

12 / 22

slide-13
SLIDE 13

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

Idea of the Attack

To look for low weight codewords... where?

  • Suspect: C ⊥

pub △

= {mHpub : m ∈ Fqm};

  • Real Problem: Cpub

△

= {c : Hpubc⊺ = 0}.

13 / 22

slide-14
SLIDE 14

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

Low Rank Codewords in an LRPC?

HLRPC = (hi,j) ∈ F(n−k)×n

qm

with hi,j : i, jFq = F c = (cj) ∈ Fn

qm

HLRPCc⊺ = 0 ⇐ ⇒ ∀i ∈ 1, n − k,

n

  • j=1

hi,jcj = 0

14 / 22

slide-15
SLIDE 15

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

Low Rank Codewords in an LRPC?

HLRPC = (hi,j) ∈ F(n−k)×n

qm

with hi,j : i, jFq = F c = (cj) ∈ Fn

qm

HLRPCc⊺ = 0 ⇐ ⇒ ∀i ∈ 1, n − k,

n

  • j=1

hi,jcj = 0 Suppose that c1, · · · , cnFq = F ′ ∀i ∈ 1, n − k,

n

  • j=1

hi,jcj ∈ F ′ · F

△

=f ′f : f ′ ∈ F ′, f ∈ FFq This gives a linear system in Fq with

  • (n − k) dimFq(F · F ′) equations;
  • n dimFq(F ′) unknowns.

→ We would like #Unknowns > #Equations to ensure the existence

  • f solutions

14 / 22

slide-16
SLIDE 16

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

... But How to Choose F ′?

What we want: n dimFq(F ′) >(n − k) dimFq(F · F ′) What we typically have: n dimFq(F ′) =(n − k) dimFq(F · F ′) Because, dimFq(F · F ′) = dimFq(F) dimFq(F ′) (typically) (n − k) dim(F) = n (RankSign).

15 / 22

slide-17
SLIDE 17

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

The Subspace F · F ′

F

△

=x1, · · · , xdFq (F = hi,j : i, jFq) Let F ′ △ =x1, x2Fq ⊆ F. F · F ′ = x2

1, x1x2, · · · , x1xd, x2x1, x2 2, · · · , x2xdFq.

⇒ dim(F · F ′) ≤ 2d − 1 Therefore, #Unknowns − #Equations = n dimFq(F ′) − (n − k) dimFq(F · F ′) = 2n − (n − k)(2d − 1)

16 / 22

slide-18
SLIDE 18

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

The Subspace F · F ′

F

△

=x1, · · · , xdFq (F = hi,j : i, jFq) Let F ′ △ =x1, x2Fq ⊆ F. F · F ′ = x2

1, x1x2, · · · , x1xd, x2x1, x2 2, · · · , x2xdFq.

⇒ dim(F · F ′) ≤ 2d − 1 Therefore, #Unknowns − #Equations = n dimFq(F ′) − (n − k) dimFq(F · F ′) = 2n − (n − k)(2d − 1) Constraint in RankSign: n = (n − k)d which gives: #Unknowns − #Equations = 2(n − k)d − (n − k)(2d − 1) = n − k > 0

16 / 22

slide-19
SLIDE 19

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

Low Rank Codewords in RankSign

  • Fact: rank(cLRPC) = 2 such that HLRPCcLRPC⊺ = 0

⇒

  • (i)

Hpub

  • (cLRPC, 0)P⊺−1⊺ = 0

(ii) rank(cLRPC, 0)P⊺−1 = 2. Indeed, P invertible in Fq and:

Hpub = HLRPC R P Q

cLRPC P−1⊺

17 / 22

slide-20
SLIDE 20

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

Summary

We proved, whatever is the choice of parameters, there are codewords of rank 2 in the public key.

18 / 22

slide-21
SLIDE 21

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

How to Effectively Find Them?

Low-rank codewords in public keys of RankSign. How to find them? − → Gröbner basis techniques with a system of equations:

  • Bilinear;
  • Over-determined composed of (#Unknowns)2 equations;
  • With an exponential number of solutions.

The attack is effective: we find low rank codewords in 20s for 128bits

  • f security (with Magma)

19 / 22

slide-22
SLIDE 22

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

Limits of the Attack

(n − k)d = n is essential for the attack and Generally (n − k)d = n for other schemes based on LRPC codes; → LRPC codes: be careful with the choice of parameters.

20 / 22

slide-23
SLIDE 23

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

Attacks Against the Code-Based IBE [GHPT17]

One IBE in code-based cryptography: it used RankSign... The problem is deeper: even without RankSign, we also broke the parameters in the encryption part of the IBE. Still admissible parameters for the encryption part.

21 / 22

slide-24
SLIDE 24

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

Attacks Against the Code-Based IBE [GHPT17]

One IBE in code-based cryptography: it used RankSign... The problem is deeper: even without RankSign, we also broke the parameters in the encryption part of the IBE. Still admissible parameters for the encryption part. Changing Rank → Hamming metric in the IBE scheme [GHPT17]: we gave a polynomial attack against the encryption part.

21 / 22

slide-25
SLIDE 25

Two attacks on rank metric code-based schemes: RankSign and an IBE scheme Thomas Debris-Alazard and Jean-Pierre Tillich Generalities on Rank-Based Cryptography LRPC-codes in RankSign [GMRZ13] Our Attack

Thank You!

22 / 22