Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to main content
Springer Nature Link
Log in

A New Approach Based on Quadratic Forms to Attack the McEliece Cryptosystem

  • Conference paper
  • First Online:
Advances in Cryptology – ASIACRYPT 2023 (ASIACRYPT 2023)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 14441))

Abstract

We introduce a novel algebraic approach for attacking the McEliece cryptosystem which is currently at the 4-th round of the NIST competition. The contributions of the article are twofold. (1) We present a new distinguisher on alternant and Goppa codes working in a much broader range of parameters than [FGO+11]. (2) With this approach we also provide a polynomial–time key recovery attack on alternant codes which are distinguishable with the distinguisher [FGO+11].

These results are obtained by introducing a subspace of matrices representing quadratic forms. Those are associated with quadratic relations for the component-wise product in the dual of the Goppa (or alternant) code of the cryptosystem. It turns out that this subspace of matrices contains matrices of unusually small rank in the case of alternant or Goppa codes (2 or 3 depending on the field characteristic) revealing the secret polynomial structure of the code. MinRank solvers can then be used to recover the secret key of the scheme. We devise a dedicated algebraic modeling in characteristic 2 where the Gröbner basis techniques to solve it can be analyzed. This computation behaves differently when applied to the matrix space associated with a random code rather than with a Goppa or an alternant code. This gives a distinguisher of the latter code families, which contrarily to the one proposed in [FGO+11] working only in a tiny parameter regime is now able to work for code rates above \(\frac{2}{3}\). It applies to most of the instantiations of the McEliece cryptosystem in the literature. It coincides with the one of [FGO+11] when the latter can be applied (and is therefore of polynomial complexity in this case). However, its complexity increases significantly when [FGO+11] does not apply anymore, but stays subexponential as long as the co-dimension of the code is sublinear in the length (with an asymptotic exponent which is below those of all known key recovery or message attacks). For the concrete parameters of the McEliece NIST submission [ABC+22], its complexity is way too complex to threaten the cryptosystem, but is smaller than known key recovery attacks for most of the parameters of the submission. This subspace of quadratic forms can also be used in a different manner to give a polynomial time attack of the McEliece cryptosystem based on generic alternant codes or Goppa codes provided that these codes are distinguishable by the method of [FGO+11], and in the Goppa case we need the additional assumption that its degree is less than \(q-1\), where q is the alphabet size of the code.

This work was partly funded by the French Agence Nationale de la Recherche through the France 2023 ANR project ANR-22-PETQ-0008PQ-TLS and the ANR-21-CE390009-BARRACUDA.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution

Subscribe and save

Springer+ Basic
$34.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or eBook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 59.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 79.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Similar content being viewed by others

References

  1. Albrecht, M., et al.: Classic McEliece (merger of Classic McEliece and NTS-KEM) (2022). https://classic.mceliece.org. Fourth round finalist of the NIST post-quantum cryptography call

  2. Bardet, M.: Étude des systèmes algébriques surdéterminés. Applications aux codes correcteurs et à la cryptographie. Ph.D. thesis, Université Paris VI (2004). http://tel.archives-ouvertes.fr/tel-00449609/en/

  3. Banegas, G., et al.: DAGS: key encapsulation for dyadic GS codes (2017). https://csrc.nist.gov/CSRC/media/Projects/Post-Quantum-Cryptography/documents/round-1/submissions/DAGS.zip. First round submission to the NIST post-quantum cryptography call

  4. Bardet, M., Briaud, P., Bros, M., Gaborit, P., Tillich, J.-P.: Revisiting algebraic attacks on MinRank and on the rank decoding problem (2022). arXiv:2208.05471

  5. Bardet, M., et al.: Improvements of algebraic attacks for solving the rank decoding and MinRank problems. In: Moriai, S., Wang, H. (eds.) ASIACRYPT 2020. LNCS, vol. 12491, pp. 507–536. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-64837-4_17

    Chapter  Google Scholar 

  6. Barelli, É., Couvreur, A.: An efficient structural attack on NIST submission DAGS. In: Peyrin, T., Galbraith, S. (eds.) ASIACRYPT 2018. LNCS, vol. 11272, pp. 93–118. Springer, Cham (2018). https://doi.org/10.1007/978-3-030-03326-2_4

    Chapter  Google Scholar 

  7. Berger, T.P., Cayrel, P.-L., Gaborit, P., Otmani, A.: Reducing key length of the McEliece cryptosystem. In: Preneel, B. (ed.) AFRICACRYPT 2009. LNCS, vol. 5580, pp. 77–97. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-02384-2_6

    Chapter  Google Scholar 

  8. Bernstein, D.J.: Grover vs. McEliece. In: Sendrier, N. (ed.) PQCrypto 2010. LNCS, vol. 6061, pp. 73–80. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-12929-2_6

    Chapter  Google Scholar 

  9. Bardet, M., Faugère, J.-C., Salvy, B.: On the complexity of the F\({}_5\) Gröbner basis algorithm. J. Symbolic Comput. 70, 49–70 (2015)

    Article  MathSciNet  Google Scholar 

  10. Becker, A., Joux, A., May, A., Meurer, A.: Decoding random binary linear codes in \(2^{n/20}\): how \(1+1=0\) improves information set decoding. In: Pointcheval, D., Johansson, T. (eds.) EUROCRYPT 2012. LNCS, vol. 7237, pp. 520–536. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-29011-4_31

    Chapter  Google Scholar 

  11. Barreto, P.S.L.M., Lindner, R., Misoczki, R.: Monoidic codes in cryptography. In: Yang, B.-Y. (ed.) PQCrypto 2011. LNCS, vol. 7071, pp. 179–199. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-25405-5_12

    Chapter  Google Scholar 

  12. Bernstein, D.J., Lange, T., Peters, C.: Wild McEliece. In: Biryukov, A., Gong, G., Stinson, D.R. (eds.) SAC 2010. LNCS, vol. 6544, pp. 143–158. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-19574-7_10

    Chapter  Google Scholar 

  13. Bernstein, D.J., Lange, T., Peters, C.: Wild McEliece incognito. In: Yang, B.-Y. (ed.) PQCrypto 2011. LNCS, vol. 7071, pp. 244–254. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-25405-5_16

    Chapter  Google Scholar 

  14. Both, L., May, A.: Optimizing BJMM with nearest neighbors: full decoding in \(2^{2/21 n}\) and McEliece security. In: WCC Workshop on Coding and Cryptography (2017)

    Google Scholar 

  15. Bardet, M., Mora, R., Tillich, J.-P.: Polynomial time key-recovery attack on high rate random alternant codes. CoRR, abs/2304.14757 (2023)

    Google Scholar 

  16. Couvreur, A., et al.: Big Quake (2017). https://bigquake.inria.fr. NIST Round 1 submission for Post-Quantum Cryptography

  17. Canteaut, A., Chabaud, F.: A new algorithm for finding minimum-weight words in a linear code: application to McEliece’s cryptosystem and to narrow-sense BCH codes of length 511. IEEE Trans. Inf. Theory 44(1), 367–378 (1998)

    Article  MathSciNet  Google Scholar 

  18. Cascudo, I., Cramer, R., Mirandola, D., Zémor, G.: Squares of random linear codes. IEEE Trans. Inf. Theory 61(3), 1159–1173 (2015)

    Article  MathSciNet  Google Scholar 

  19. Courtois, N.T., Finiasz, M., Sendrier, N.: How to achieve a McEliece-based digital signature scheme. In: Boyd, C. (ed.) ASIACRYPT 2001. LNCS, vol. 2248, pp. 157–174. Springer, Heidelberg (2001). https://doi.org/10.1007/3-540-45682-1_10

    Chapter  Google Scholar 

  20. Couvreur, A., Gaborit, P., Gauthier-Umaña, V., Otmani, A., Tillich, J.-P.: Distinguisher-based attacks on public-key cryptosystems using Reed-Solomon codes. Des. Codes Cryptogr. 73(2), 641–666 (2014)

    Article  MathSciNet  Google Scholar 

  21. Couvreur, A., Mora, R., Tillich, J.-P.: A new approach based on quadratic forms to attack the McEliece cryptosystem. arXiv preprint arXiv:2306.10294 (2023)

  22. Couvreur, A., Otmani, A., Tillich, J.-P.: New identities relating wild Goppa codes. Finite Fields Appl. 29, 178–197 (2014)

    Article  MathSciNet  Google Scholar 

  23. Couvreur, A., Otmani, A., Tillich, J.-P.: Polynomial time attack on wild McEliece over quadratic extensions. IEEE Trans. Inf. Theory 63(1), 404–427 (2017)

    Article  MathSciNet  Google Scholar 

  24. Canto Torres, R., Sendrier, N.: Analysis of information set decoding for a sub-linear error weight. In: Takagi, T. (ed.) PQCrypto 2016. LNCS, vol. 9606, pp. 144–161. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-29360-8_10

    Chapter  Google Scholar 

  25. Dumer, I.: Two decoding algorithms for linear codes. Probl. Inf. Transm. 25(1), 17–23 (1989)

    Google Scholar 

  26. Faugère, J.-C.: A new efficient algorithm for computing Gröbner bases without reduction to zero: F5. In: Proceedings ISSAC 2002, pp. 75–83. ACM Press (2002)

    Google Scholar 

  27. Faugère, J.-C., Gauthier, V., Otmani, A., Perret, L., Tillich, J.-P.: A distinguisher for high rate McEliece cryptosystems. In: Proceedings of the IEEE Information Theory Workshop, ITW 2011, Paraty, Brasil, pp. 282–286 (2011)

    Google Scholar 

  28. Faugère, J.-C., Gauthier, V., Otmani, A., Perret, L., Tillich, J.-P.: A distinguisher for high rate McEliece cryptosystems. IEEE Trans. Inf. Theory 59(10), 6830–6844 (2013)

    Article  MathSciNet  Google Scholar 

  29. Faugère, J.-C., Levy-dit-Vehel, F., Perret, L.: Cryptanalysis of MinRank. In: Wagner, D. (ed.) CRYPTO 2008. LNCS, vol. 5157, pp. 280–296. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-85174-5_16

    Chapter  Google Scholar 

  30. Faugère, J.-C., Otmani, A., Perret, L., Tillich, J.-P.: Algebraic cryptanalysis of McEliece variants with compact keys. In: Gilbert, H. (ed.) EUROCRYPT 2010. LNCS, vol. 6110, pp. 279–298. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-13190-5_14

    Chapter  Google Scholar 

  31. Faugère, J.-C., Perret, L., de Portzamparc, F.: Algebraic attack against variants of McEliece with Goppa polynomial of a special form. In: Sarkar, P., Iwata, T. (eds.) ASIACRYPT 2014. LNCS, vol. 8873, pp. 21–41. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-662-45611-8_2

    Chapter  Google Scholar 

  32. Faugère, J.-C., El Din, M.S., Spaenlehauer, P.-J.: Computing loci of rank defects of linear matrices using Gröbner bases and applications to cryptology. In: International Symposium on Symbolic and Algebraic Computation, ISSAC 2010, Munich, Germany, 25–28 July 2010, pp. 257–264 (2010)

    Google Scholar 

  33. Goubin, L., Courtois, N.T.: Cryptanalysis of the TTM cryptosystem. In: Okamoto, T. (ed.) ASIACRYPT 2000. LNCS, vol. 1976, pp. 44–57. Springer, Heidelberg (2000). https://doi.org/10.1007/3-540-44448-3_4

    Chapter  Google Scholar 

  34. Ghorpade, S.R., Krattenthaler, C.: The Hilbert series of Pfaffian rings. In: Christensen, C., Sathaye, A., Sundaram, G., Bajaj, C. (eds.) Algebra, Arithmetic and Geometry with Applications, pp. 337–356. Springer, Heidelberg (2004). https://doi.org/10.1007/978-3-642-18487-1_22

    Chapter  Google Scholar 

  35. Gauthier-Umaña, V., Leander, G.: Practical key recovery attacks on two McEliece variants. IACR Cryptology ePrint Archive, Report 2009/509 (2009)

    Google Scholar 

  36. Herzog, J., Trung, N.V.: Gröbner bases and multiplicity of determinantal and Pfaffian ideals. Adv. Math. 96(1), 1–37 (1992)

    Article  MathSciNet  Google Scholar 

  37. Kipnis, A., Shamir, A.: Cryptanalysis of the HFE public key cryptosystem by relinearization. In: Wiener, M. (ed.) CRYPTO 1999. LNCS, vol. 1666, pp. 19–30. Springer, Heidelberg (1999). https://doi.org/10.1007/3-540-48405-1_2

    Chapter  Google Scholar 

  38. Kachigar, G., Tillich, J.-P.: Quantum information set decoding algorithms. In: Lange, T., Takagi, T. (eds.) PQCrypto 2017. LNCS, vol. 10346, pp. 69–89. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-59879-6_5

    Chapter  Google Scholar 

  39. Loidreau, P., Sendrier, N.: Weak keys in the McEliece public-key cryptosystem. IEEE Trans. Inf. Theory 47(3), 1207–1211 (2001)

    Article  MathSciNet  Google Scholar 

  40. Misoczki, R., Barreto, P.S.L.M.: Compact McEliece keys from Goppa codes. In: Jacobson, M.J., Rijmen, V., Safavi-Naini, R. (eds.) SAC 2009. LNCS, vol. 5867, pp. 376–392. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-05445-7_24

    Chapter  Google Scholar 

  41. McEliece, R.J.: A Public-Key System Based on Algebraic Coding Theory, pp. 114–116. Jet Propulsion Lab, 1978. DSN Progress Report 44

    Google Scholar 

  42. May, A., Meurer, A., Thomae, E.: Decoding random linear codes in \(\tilde{\cal{O}}(2^{0.054n})\). In: Lee, D.H., Wang, X. (eds.) ASIACRYPT 2011. LNCS, vol. 7073, pp. 107–124. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-25385-0_6

    Chapter  Google Scholar 

  43. May, A., Ozerov, I.: On computing nearest neighbors with applications to decoding of binary linear codes. In: Oswald, E., Fischlin, M. (eds.) EUROCRYPT 2015. LNCS, vol. 9056, pp. 203–228. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-46800-5_9

    Chapter  Google Scholar 

  44. Márquez-Corbella, I., Pellikaan, R.: Error-correcting pairs for a public-key cryptosystem. CBC 2012, Code-based Cryptography Workshop (2012). http://www.win.tue.nl/ruudp/paper/59.pdf

  45. MacWilliams, F.J., Sloane, N.J.A.: The Theory of Error-Correcting Codes. North-Holland, Amsterdam (1986)

    Google Scholar 

  46. Miller, E., Sturmfels, B.: Combinatorial Commutative Algebra. Graduate Texts in Mathematics, vol. 227. Springer, New York (2005)

    Google Scholar 

  47. Mora, R., Tillich, J.-P.: On the dimension and structure of the square of the dual of a Goppa code. In: Workshop on Coding Theory and Cryptography, WCC 2022 (2022)

    Google Scholar 

  48. Prange, E.: The use of information sets in decoding cyclic codes. IRE Trans. Inf. Theory 8(5), 5–9 (1962)

    Article  MathSciNet  Google Scholar 

  49. Rivest, R.L., Shamir, A., Adleman, L.M.: A method for obtaining digital signatures and public-key cryptosystems. Commun. ACM 21(2), 120–126 (1978)

    Article  MathSciNet  Google Scholar 

  50. Sendrier, N.: Finding the permutation between equivalent linear codes: the support splitting algorithm. IEEE Trans. Inf. Theory 46(4), 1193–1203 (2000)

    Article  MathSciNet  Google Scholar 

  51. Shor, P.W.: Algorithms for quantum computation: discrete logarithms and factoring. In: Goldwasser, S. (ed.) FOCS, pp. 124–134 (1994)

    Google Scholar 

  52. Sidelnikov, V.M., Shestakov, S.O.: On the insecurity of cryptosystems based on generalized Reed-Solomon codes. Discrete Math. Appl. 1(4), 439–444 (1992)

    Google Scholar 

  53. Stern, J.: A method for finding codewords of small weight. In: Cohen, G., Wolfmann, J. (eds.) Coding Theory 1988. LNCS, vol. 388, pp. 106–113. Springer, Heidelberg (1989). https://doi.org/10.1007/BFb0019850

    Chapter  Google Scholar 

  54. Verbel, J., Baena, J., Cabarcas, D., Perlner, R., Smith-Tone, D.: On the complexity of “superdetermined’’ minrank instances. In: Ding, J., Steinwandt, R. (eds.) PQCrypto 2019. LNCS, vol. 11505, pp. 167–186. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-25510-7_10

    Chapter  Google Scholar 

  55. Wiedemann, D.: Solving sparse linear equations over finite fields. IEEE Trans. Inf. Theory 32(1), 54–62 (1986)

    Article  MathSciNet  Google Scholar 

  56. Wimmer, M.: Algorithm923: efficient numerical computation of the Pfaffian for dense and banded skew-symmetric matrices. ACM Trans. Math. Softw. 38(4) (2012)

    Google Scholar 

Download references

Acknowledgement

The authors would like to thank the anonymous reviewers, the shepherd and Daniel J. Bernstein for their comments and their help in improving the quality of the paper.

Author information

Authors and Affiliations

  1. Inria Saclay, LIX, CNRS UMR 7161, École Polytechnique, 1 rue Honoré d’Estienne d’Orves, 91120, Palaiseau Cedex, France

    Alain Couvreur

  2. Inria Paris, 2 rue Simone Iff, 75012, Paris, France

    Rocco Mora & Jean-Pierre Tillich

Authors
  1. Alain Couvreur
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Rocco Mora
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Jean-Pierre Tillich
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Jean-Pierre Tillich .

Editor information

Editors and Affiliations

  1. Nanyang Technological University, Singapore, Singapore

    Jian Guo

  2. Monash University, Melbourne, VIC, Australia

    Ron Steinfeld

Rights and permissions

Reprints and permissions

Copyright information

© 2023 International Association for Cryptologic Research

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Couvreur, A., Mora, R., Tillich, JP. (2023). A New Approach Based on Quadratic Forms to Attack the McEliece Cryptosystem. In: Guo, J., Steinfeld, R. (eds) Advances in Cryptology – ASIACRYPT 2023. ASIACRYPT 2023. Lecture Notes in Computer Science, vol 14441. Springer, Singapore. https://doi.org/10.1007/978-981-99-8730-6_1

Download citation

  • DOI: https://doi.org/10.1007/978-981-99-8730-6_1

  • Published:

  • Publisher Name: Springer, Singapore

  • Print ISBN: 978-981-99-8729-0

  • Online ISBN: 978-981-99-8730-6

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation