Code-Based Cryptography a Hands-On Introduction

Code-based Cryptography a Hands-On Introduction

Daniel Loebenberger

Ηράκλειο, September 27, 2018 Code-based Cryptography

Post-Quantum Cryptography

Various flavours: Lattice-based cryptography Hash-based cryptography Code-based cryptography Further techniques (e.g. multivariate, isogeny-based, …)

2 Code-based Cryptography

Post-Quantum Cryptography

Various flavours: Lattice-based cryptography Hash-based cryptography Code-based cryptography Further techniques (e.g. multivariate, isogeny-based, …)

2 Code-based Cryptography

Coding theory

Dating back to Claude Shannon in 1948 Goal is to protect a message sent over a noisy channel Typically, this is achieved by adding redundancy

3 Code-based Cryptography

Public key Cryptography

We need to specify three algorithms: Key Generation: Create a private and a public key Encryption of a message using the public key Decryption of a ciphertext using the private key

Security: It is not possible to decrypt a ciphertext without the private key.

4 Code-based Cryptography

Content

Linear Codes

Classic McEliece

Optimizations

Conclusion

5 Code-based Cryptography Linear Codes

Content

Linear Codes

Classic McEliece

Optimizations

Conclusion

6 Theorem d−1 A linear (n, k, d)-code can correct up to t = 2 errors.

Code-based Cryptography Linear Codes

Basic Definitions

Definition (Linear Code) A linear (n, k, d)-code C over a finite field F is a k-dimensional subspace of the vector space Fn with minimum distance d = minx6=y∈C dist(x, y), where dist is the Hamming-distance.

7 Code-based Cryptography Linear Codes

Basic Definitions

7 Code-based Cryptography Linear Codes

Basic Definitions

Definition (Generator Matrix) × The matrix G ∈ Fk n is a generator matrix for the (n, k, d)-code C if C = hGi, i.e. the rows of G span C. Definition (Encoding) For a message m ∈ Fk , define its encoding as c = mG ∈ Fn.

7 Theorem The (general) decoding problem is NP-hard.

Code-based Cryptography Linear Codes

Basic Definitions

Problem (Decoding problem) Given x ∈ Fn find c ∈ C, where dist(x, c) is minimal. If x = c + e and e is a vector of weight at most t then x is uniquely determined.

7 Code-based Cryptography Linear Codes

Basic Definitions

Problem (Decoding problem) Given x ∈ Fn find c ∈ C, where dist(x, c) is minimal. If x = c + e and e is a vector of weight at most t then x is uniquely determined. Theorem The (general) decoding problem is NP-hard.

7 1 0 1 1 1 0 0 H = 1 1 1 0 0 1 0 0 1 1 1 0 0 1

3×7 t , H ∈ F2 parity check matrix: GH = 0 m = 0 1 0 1 =⇒ c = mG = 0 1 0 1 1 1 0 cHt = 0, i.e. c ∈ C One-bit error e = 0 0 0 1 0 0 0 =⇒ x = c + e = 0 1 0 0 1 1 0 Then: xHt = cHt + eHt = eHt = 1 0 1

Code-based Cryptography Linear Codes

Encoding/Decoding: Example 1 0 0 0 1 1 0 0 1 0 0 0 1 1 G =   0 0 1 0 1 1 1 0 0 0 1 1 0 1 4×7 G ∈ F2 generator matrix for code C

8 m = 0 1 0 1 =⇒ c = mG = 0 1 0 1 1 1 0 cHt = 0, i.e. c ∈ C One-bit error e = 0 0 0 1 0 0 0 =⇒ x = c + e = 0 1 0 0 1 1 0 Then: xHt = cHt + eHt = eHt = 1 0 1

Code-based Cryptography Linear Codes

Encoding/Decoding: Example 1 0 0 0 1 1 0 1 0 1 1 1 0 0 0 1 0 0 0 1 1 G = H = 1 1 1 0 0 1 0 0 0 1 0 1 1 1     0 1 1 1 0 0 1 0 0 0 1 1 0 1

4×7 3×7 t G ∈ F2 generator matrix for code C, H ∈ F2 parity check matrix: GH = 0

8 0 1 0 1 1 1 0 cHt = 0, i.e. c ∈ C One-bit error e = 0 0 0 1 0 0 0 =⇒ x = c + e = 0 1 0 0 1 1 0 Then: xHt = cHt + eHt = eHt = 1 0 1

Code-based Cryptography Linear Codes

Encoding/Decoding: Example 1 0 0 0 1 1 0 1 0 1 1 1 0 0 0 1 0 0 0 1 1 G = H = 1 1 1 0 0 1 0 0 0 1 0 1 1 1     0 1 1 1 0 0 1 0 0 0 1 1 0 1

4×7 3×7 t G ∈ F2 generator matrix for code C, H ∈ F2 parity check matrix: GH = 0 m = 0 1 0 1 =⇒ c = mG =

8 0, i.e. c ∈ C One-bit error e = 0 0 0 1 0 0 0 =⇒ x = c + e = 0 1 0 0 1 1 0 Then: xHt = cHt + eHt = eHt = 1 0 1

Code-based Cryptography Linear Codes

Encoding/Decoding: Example 1 0 0 0 1 1 0 1 0 1 1 1 0 0 0 1 0 0 0 1 1 G = H = 1 1 1 0 0 1 0 0 0 1 0 1 1 1     0 1 1 1 0 0 1 0 0 0 1 1 0 1

4×7 3×7 t G ∈ F2 generator matrix for code C, H ∈ F2 parity check matrix: GH = 0 m = 0 1 0 1 =⇒ c = mG = 0 1 0 1 1 1 0 cHt =

8 One-bit error e = 0 0 0 1 0 0 0 =⇒ x = c + e = 0 1 0 0 1 1 0 Then: xHt = cHt + eHt = eHt = 1 0 1

Code-based Cryptography Linear Codes

Encoding/Decoding: Example 1 0 0 0 1 1 0 1 0 1 1 1 0 0 0 1 0 0 0 1 1 G = H = 1 1 1 0 0 1 0 0 0 1 0 1 1 1     0 1 1 1 0 0 1 0 0 0 1 1 0 1

4×7 3×7 t G ∈ F2 generator matrix for code C, H ∈ F2 parity check matrix: GH = 0 m = 0 1 0 1 =⇒ c = mG = 0 1 0 1 1 1 0 cHt = 0, i.e. c ∈ C

8 0 1 0 0 1 1 0 Then: xHt = cHt + eHt = eHt = 1 0 1

Code-based Cryptography Linear Codes

Encoding/Decoding: Example 1 0 0 0 1 1 0 1 0 1 1 1 0 0 0 1 0 0 0 1 1 G = H = 1 1 1 0 0 1 0 0 0 1 0 1 1 1     0 1 1 1 0 0 1 0 0 0 1 1 0 1

4×7 3×7 t G ∈ F2 generator matrix for code C, H ∈ F2 parity check matrix: GH = 0 m = 0 1 0 1 =⇒ c = mG = 0 1 0 1 1 1 0 cHt = 0, i.e. c ∈ C One-bit error e = 0 0 0 1 0 0 0 =⇒ x = c + e =

8 Then: xHt = cHt + eHt = eHt = 1 0 1 How to use this for decoding?

Code-based Cryptography Linear Codes

Encoding/Decoding: Example 1 0 0 0 1 1 0 1 0 1 1 1 0 0 0 1 0 0 0 1 1 G = H = 1 1 1 0 0 1 0 0 0 1 0 1 1 1     0 1 1 1 0 0 1 0 0 0 1 1 0 1

4×7 3×7 t G ∈ F2 generator matrix for code C, H ∈ F2 parity check matrix: GH = 0 m = 0 1 0 1 =⇒ c = mG = 0 1 0 1 1 1 0 cHt = 0, i.e. c ∈ C One-bit error e = 0 0 0 1 0 0 0 =⇒ x = c + e = 0 1 0 0 1 1 0

8 Code-based Cryptography Linear Codes

Encoding/Decoding: Example 1 0 0 0 1 1 0 1 0 1 1 1 0 0 0 1 0 0 0 1 1 G = H = 1 1 1 0 0 1 0 0 0 1 0 1 1 1     0 1 1 1 0 0 1 0 0 0 1 1 0 1

4×7 3×7 t G ∈ F2 generator matrix for code C, H ∈ F2 parity check matrix: GH = 0 m = 0 1 0 1 =⇒ c = mG = 0 1 0 1 1 1 0 cHt = 0, i.e. c ∈ C One-bit error e = 0 0 0 1 0 0 0 =⇒ x = c + e = 0 1 0 0 1 1 0 Then: xHt = cHt + eHt = eHt = 1 0 1 t t Decoding idea: run over all possible errors e, compute eH and compare to xH . 8 Code-based Cryptography Classic McEliece

Content

Linear Codes

Classic McEliece

Optimizations

Conclusion

9 However, there are certain codes with efficient decoding One example are binary Goppa codes “Disguise” such a code Use this information as a trapdoor!

Code-based Cryptography Classic McEliece

Basic idea

The general decoding problem is a hard problem

10 “Disguise” such a code Use this information as a trapdoor!

Code-based Cryptography Classic McEliece

Basic idea

The general decoding problem is a hard problem However, there are certain codes with efficient decoding One example are binary Goppa codes

10 Use this information as a trapdoor!

Code-based Cryptography Classic McEliece

Basic idea

The general decoding problem is a hard problem However, there are certain codes with efficient decoding One example are binary Goppa codes “Disguise” such a code

10 Code-based Cryptography Classic McEliece

Basic idea

The general decoding problem is a hard problem However, there are certain codes with efficient decoding One example are binary Goppa codes “Disguise” such a code Use this information as a trapdoor!

10 Heuristically, the matrix G0 behaves like a uniformly selected matrix, i.e. C0 = hG0i is hard to decode.

Code-based Cryptography Classic McEliece

Specification (I)

Key Generation

k×n Secret generator matrix G ∈ F2 of an easily decodeable (n, k, d)-code C = hGi k×k Secret random invertible matrix S ∈ F2 n×n Secret random permutation matrix P ∈ F2 Compute public G0 = SGP.

11 Code-based Cryptography Classic McEliece

Specification (I)

Key Generation

Heuristically, the matrix G0 behaves like a uniformly selected matrix, i.e. C0 = hG0i is hard to decode.

11 n Decryption of x ∈ F2 Compute y = xP−1 = (mS)G + eP−1 Decode y, obtaining (mS)G Recover m0 = mS return m = m0S−1

Both operations are comparatively efficient!

Code-based Cryptography Classic McEliece

Specification (II)

k Encryption of m ∈ F2 n Choose e ∈ F2 of weight t return x = mG0 + e

12 Both operations are comparatively efficient!

Code-based Cryptography Classic McEliece

Specification (II)

n Decryption of x ∈ F2 k Encryption of m ∈ −1 −1 F2 Compute y = xP = (mS)G + eP n Choose e ∈ F2 of weight t Decode y, obtaining (mS)G return x = mG0 + e Recover m0 = mS return m = m0S−1

12 Code-based Cryptography Classic McEliece

Specification (II)

n Decryption of x ∈ F2 k Encryption of m ∈ −1 −1 F2 Compute y = xP = (mS)G + eP n Choose e ∈ F2 of weight t Decode y, obtaining (mS)G return x = mG0 + e Recover m0 = mS return m = m0S−1

Both operations are comparatively efficient!

12 1 1 0 1 0 0 1 0 1 0 0 1 0 1 Public G0 = SGP =   1 1 0 0 1 1 0 1 1 1 1 1 1 1

0 Message m = 0 1 0 1 =⇒ c = mG = 1 0 1 1 0 1 0 One-bit error e = 0 0 0 1 0 0 0 =⇒ x = c + e = 1 0 1 0 0 1 0

Code-based Cryptography Classic McEliece

Encryption: Example 0 0 0 0 1 0 0     0 1 0 0 0 0 0 1 0 0 0 1 1 0 0 1 1 1   0 0 0 1 0 0 0 0 1 0 0 0 1 1 1 1 0 1   G =   S =   P = 0 0 0 0 0 0 1 0 0 1 0 1 1 1 1 1 0 0   0 0 0 0 0 1 0 0 0 0 1 1 0 1 1 1 1 1   0 0 1 0 0 0 0 1 0 0 0 0 0 0

13 0 Message m = 0 1 0 1 =⇒ c = mG = 1 0 1 1 0 1 0 One-bit error e = 0 0 0 1 0 0 0 =⇒ x = c + e = 1 0 1 0 0 1 0

Code-based Cryptography Classic McEliece

Encryption: Example

1 1 0 1 0 0 1 0 1 0 0 1 0 1 Public G0 = SGP =   1 1 0 0 1 1 0 1 1 1 1 1 1 1

13 Code-based Cryptography Classic McEliece

Encryption: Example

1 1 0 1 0 0 1 0 1 0 0 1 0 1 Public G0 = SGP =   1 1 0 0 1 1 0 1 1 1 1 1 1 1

0 Message m = 0 1 0 1 =⇒ c = mG = 1 0 1 1 0 1 0 One-bit error e = 0 0 0 1 0 0 0 =⇒ x = c + e = 1 0 1 0 0 1 0

13 −1 Receive x = 1 0 1 0 0 1 0 , compute y = xP = 0 0 0 0 1 1 1

0 Use decoding algorithm for G, giving message m = mS = 0 0 1 0

0 −1 m S = m = 0 1 0 1

Code-based Cryptography Classic McEliece

Decryption: Example 0 0 0 0 1 0 0     0 1 0 0 0 0 0 1 0 0 0 1 1 0 0 1 1 1   0 0 0 1 0 0 0 0 1 0 0 0 1 1 1 1 0 1   G =   S =   P = 0 0 0 0 0 0 1 0 0 1 0 1 1 1 1 1 0 0   0 0 0 0 0 1 0 0 0 0 1 1 0 1 1 1 1 1   0 0 1 0 0 0 0 1 0 0 0 0 0 0

14 −1 Receive x = 1 0 1 0 0 1 0 , compute y = xP = 0 0 0 0 1 1 1

0 Use decoding algorithm for G, giving message m = mS = 0 0 1 0

0 −1 m S = m = 0 1 0 1

Code-based Cryptography Classic McEliece

Decryption: Example 0 0 0 0 0 0 1     0 1 0 0 0 0 0 1 0 0 0 1 1 0 1 0 0 1   0 0 0 0 0 1 0 0 1 0 0 0 1 1 1 0 1 1   G =   S−1 =   P−1 = 0 0 1 0 0 0 0 0 0 1 0 1 1 1 0 1 0 1   1 0 0 0 0 0 0 0 0 0 1 1 0 1 0 1 1 0   0 0 0 0 1 0 0 0 0 0 1 0 0 0

14 0 Use decoding algorithm for G, giving message m = mS = 0 0 1 0

0 −1 m S = m = 0 1 0 1

Code-based Cryptography Classic McEliece

−1 Receive x = 1 0 1 0 0 1 0 , compute y = xP = 0 0 0 0 1 1 1

14 Code-based Cryptography Classic McEliece

−1 Receive x = 1 0 1 0 0 1 0 , compute y = xP = 0 0 0 0 1 1 1

0 Use decoding algorithm for G, giving message m = mS = 0 0 1 0

0 −1 m S = m = 0 1 0 1

14 However, the converse is not true, since C0 = hG0i is not a random code, but a disguised binary Goppa code!

Code-based Cryptography Classic McEliece

Security (classical)

McEliece Problem 0 k×n Given a McEliece public key G ∈ F2 and a ciphertext n k 0 x ∈ F2, find (the unique) m ∈ F2, s.t. dist(mG , x) = t Fact If you can solve the general decoding problem, then you can solve the McEliece problem.

15 Code-based Cryptography Classic McEliece

Security (classical)

However, the converse is not true, since C0 = hG0i is not a random code, but a disguised binary Goppa code!

15 Runtime still exponential! Wide believe: This is all of the speedup a quantum-computer provides.

Code-based Cryptography Classic McEliece

Security (post-quantum)

Grover's algorithm A quantum-computer√ can search an unordered set of size l in time O( l). Theorem One can apply Grover’s algorithm to solve the general decoding problem. This gives (roughly) a quadratic speedup.

16 Code-based Cryptography Classic McEliece

Security (post-quantum)

Runtime still exponential! Wide believe: This is all of the speedup a quantum-computer provides.

16 Approximate parameter sizes: Approximate parameter sizes: Plaintext: 677B, ciphertext: 870B Plaintext: 870B, ciphertext: 1024B Public key: 4.5MB, secret key: 13.75MB Public key: 6.4MB, secret key: 19.45MB

Expectedly, both parameter sets fulfill the NIST requirements for an IND-CCA2 KEM, category 5, i.e. a security level of 256 bit.

Code-based Cryptography Classic McEliece

Parameter Sets

From the NIST proposal by Bernstein et al., Nov 2017: kem/mceliece6960119 kem/mceliece8192128 k = 5413, n = 6960, t = 119 k = 6528, n = 8192, t = 128

17 Expectedly, both parameter sets fulfill the NIST requirements for an IND-CCA2 KEM, category 5, i.e. a security level of 256 bit.

Code-based Cryptography Classic McEliece

Parameter Sets

From the NIST proposal by Bernstein et al., Nov 2017: kem/mceliece6960119 kem/mceliece8192128 k = 5413, n = 6960, t = 119 k = 6528, n = 8192, t = 128

Approximate parameter sizes: Approximate parameter sizes: Plaintext: 677B, ciphertext: 870B Plaintext: 870B, ciphertext: 1024B Public key: 4.5MB, secret key: 13.75MB Public key: 6.4MB, secret key: 19.45MB

17 Code-based Cryptography Classic McEliece

Parameter Sets

From the NIST proposal by Bernstein et al., Nov 2017: kem/mceliece6960119 kem/mceliece8192128 k = 5413, n = 6960, t = 119 k = 6528, n = 8192, t = 128

Expectedly, both parameter sets fulfill the NIST requirements for an IND-CCA2 KEM, category 5, i.e. a security level of 256 bit.

17 Code-based Cryptography Classic McEliece

McEliece: Conclusion

The security of the McEliece cryptosystem is convincing. It comes, however, at the cost of large key-sizes.

18 Code-based Cryptography Optimizations

Content

Linear Codes

Classic McEliece

Optimizations

Conclusion

19 0 0 0 0 1 0 0 0 1 0 0 0 0 0   0 0 0 1 0 0 0 P = 0 0 0 0 0 0 1 =⇒ P = (7, 2, 6, 3, 1, 5, 4) 0 0 0 0 0 1 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0

Store the permutation P in tuple representation!

Code-based Cryptography Optimizations

Reducing the Key-Sizes Opimization possibilities not affecting security: (n−k)×n If k > n − k, rewrite using the parity check matrix H ∈ F2 1 0 0 0 1 1 0 1 0 1 1 1 0 0 0 1 0 0 0 1 1 1 1 1 0 0 1 0 G = 0 0 1 0 1 1 1 =⇒ H = 0 1 1 1 0 0 1 0 0 0 1 1 0 1

20 Code-based Cryptography Optimizations

Store the permutation P in tuple representation! 0 0 0 0 1 0 0 0 1 0 0 0 0 0   0 0 0 1 0 0 0 P = 0 0 0 0 0 0 1 =⇒ P = (7, 2, 6, 3, 1, 5, 4) 0 0 0 0 0 1 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0

20 Even more reductions possible, c.f. NIST submission on classic McEliece!

Code-based Cryptography Optimizations

Reducing the Key-Sizes: Effect

kem/mceliece6960119 kem/mceliece8192128 k = 5413, n = 6960, t = 119 k = 6528, n = 8192, t = 128

Public key: 4.5MB ⇒ 1.3MB Public key: 6.4MB ⇒ 1.6MB Secret key: 13.75MB ⇒ 4.8MB Secret key: 19.45MB ⇒ 6.7MB

21 Code-based Cryptography Optimizations

Reducing the Key-Sizes: Effect

kem/mceliece6960119 kem/mceliece8192128 k = 5413, n = 6960, t = 119 k = 6528, n = 8192, t = 128

Public key: 4.5MB ⇒ 1.3MB Public key: 6.4MB ⇒ 1.6MB Secret key: 13.75MB ⇒ 4.8MB Secret key: 19.45MB ⇒ 6.7MB

Even more reductions possible, c.f. NIST submission on classic McEliece!

21 Code-based Cryptography Optimizations

The Code-Based NIST Submissions

BIG QUAKE LEDAkem pqsigRM BIKE LEDApkc QC-MDPC KEM Classic McEliece Lepton RaCoSS DAGS LOCKER Ramstake; Edon-K (withdrawn) McNie RankSign (withdrawn) HQC NTS-KEM RLCE-KEM LAKE Ouroboros-R RQC

22 Code-based Cryptography Optimizations

The Code-Based NIST Submissions

QC-MDPC codes QC-LDPC codes Binary Goppa codes Quasi-Dyadic Gen. Srivastava codes Quasi-Cyclic codes LRPC codes BCH codes Ideal-LRPC codes Rank Metric codes Rank Quasi-Cyclic codes Punctured Reed-Muller codes Random Linear codes Quasi-cyclic Goppa codes

22 We live in exciting times :-)

Code-based Cryptography Optimizations

Security Considerations

Several good proposals Most aim on the goal of having much smaller key-sizes Security based on the problem of decoding special codes Further cryptanalysis necessary!

23 Code-based Cryptography Optimizations

Security Considerations

Several good proposals Most aim on the goal of having much smaller key-sizes Security based on the problem of decoding special codes Further cryptanalysis necessary!

We live in exciting times :-)

23 Code-based Cryptography Conclusion

Content

Linear Codes

Classic McEliece

Optimizations

Conclusion

24 Most NIST submissions try to address this issue by using special classes of codes Their decoding problem is much less analyzed

The study of this tradeoff will probably continue over the next years.

Code-based Cryptography Conclusion

Summary

McEliece is well studied and appears to be secure… …even in a post-quantum setting This comes at cost of large key-sizes

25 Code-based Cryptography Conclusion

Summary

McEliece is well studied and appears to be secure… …even in a post-quantum setting This comes at cost of large key-sizes Most NIST submissions try to address this issue by using special classes of codes Their decoding problem is much less analyzed

The study of this tradeoff will probably continue over the next years.

25 Code-based Cryptography Conclusion

Further questions?