Some Notes on Code-Based Cryptography Löndahl, Carl
Total Page:16
File Type:pdf, Size:1020Kb
Some Notes on Code-Based Cryptography Löndahl, Carl 2015 Link to publication Citation for published version (APA): Löndahl, C. (2015). Some Notes on Code-Based Cryptography. Total number of authors: 1 General rights Unless other specific re-use rights are stated the following general rights apply: Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal Read more about Creative commons licenses: https://creativecommons.org/licenses/ Take down policy If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. LUND UNIVERSITY PO Box 117 221 00 Lund +46 46-222 00 00 Some Notes on Code-Based Cryptography Carl Löndahl Doctoral Dissertation Information Theory Lund, December 2014 Carl Löndahl Department of Electrical and Information Technology Information Theory Lund University P.O. Box 118, 221 00 Lund, Sweden Series of licentiate and doctoral dissertations ISSN 1654-790X; No. 67 ISBN 978-91-7623-119-7 c 2014 Carl Löndahl Typeset in Palatino and Helvetica using LATEX 2#. Printed in Sweden by Tryckeriet i E-huset, Lund University, Lund. No part of this dissertation may be reproduced or transmitted in any form or by any means, electronically or mechanical, including photocopy, recording, or any information storage and retrieval system, without written permission from the author. Abstract his thesis presents new cryptanalytic results in several areas of coding- based cryptography. In addition, we also investigate the possibility of using convolutional codes in code-based public-key cryptography. TThe first algorithm that we present is an information-set decoding algo- rithm, aiming towards the problem of decoding random linear codes. We apply the generalized birthday technique to information-set decoding, im- proving the computational complexity over previous approaches. Next, we present a new version of the McEliece public-key cryptosystem based on convolutional codes. The original construction uses Goppa codes, which is an algebraic code family admitting a well-defined code structure. In the two constructions proposed, large parts of randomly generated par- ity checks are used. By increasing the entropy of the generator matrix, this presumably makes structured attacks more difficult. Following this, we analyze a McEliece variant based on quasi-cylic MDPC codes. We show that when the underlying code construction has an even di- mension, the system is susceptible to, what we call, a squaring attack. Our results show that the new squaring attack allows for great complexity im- provements over previous attacks on this particular McEliece construction. Then, we introduce two new techniques for finding low-weight polynomial multiples. Firstly, we propose a general technique based on a reduction to the minimum-distance problem in coding, which increases the multiplicity of the low-weight codeword by extending the code. We use this algorithm to break some of the instances used by the TCHo cryptosystem. Secondly, we propose an algorithm for finding weight-4 polynomials. By using the generalized birthday technique in conjunction with increasing the multiplicity of the low-weight polynomial multiple, we obtain a much better complexity than previously known algorithms. Lastly, two new algorithms for the learning parities with noise (LPN) prob- lem are proposed. The first one is a general algorithm, applicable to any instance of LPN. The algorithm performs favorably compared to previously 1 known algorithms, breaking the 80-bit security of the widely used p512, 8 q instance. The second one focuses on LPN instances over a polynomial ring, when the generator polynomial is reducible. Using the algorithm, we break an 80-bit security instance of the Lapin cryptosystem. Contents Contents v Preface ix Acknowledgments xi 1 Introduction 1 1.1 Outline . 4 1.2 Notation . 5 1.3 Probability Theory and Combinatorics . 7 1.4 Information Theory . 10 1.5 Hypothesis Testing . 14 1.5.1 The Walsh Transform . 17 1.6 Algorithms and Complexity Theory . 18 1.7 The Birthday Paradox and Collision Search . 21 1.7.1 Searching for collisions in vectorspaces . 24 1.8 Cryptography and Cryptanalysis . 28 1.8.1 One-Way Functions . 29 1.8.2 Symmetric Cryptography . 30 1.8.3 Public-Key Cryptography . 31 1.8.4 Attack Models and Settings . 32 1.8.5 Distinguishing Attacks . 35 1.9 Summary . 36 2 Linear Codes 37 2.1 General . 38 2.2 Channel Error Models . 40 2.3 Types of Decoding . 41 2.4 Random-Coding Bounds and Covering Codes . 43 2.5 Computational Problems in Coding . 45 2.6 Efficiently Decodable Families . 47 2.6.1 Convolutional codes . 47 2.6.2 Cyclic codes . 49 2.6.3 Hamming Codes . 49 2.6.4 LDPC and MDPC Codes . 50 2.7 Summary . 51 3 Information-Set Decoding 53 3.1 Plain ISD and Lee-Brickell’s Algorithm . 53 3.2 Stern’s Algorithm . 56 3.3 A New Algorithm . 60 3.3.1 Explaining the Ideas Behind the Algorithm . 62 3.3.2 Complexity Analysis . 63 3.3.3 Parameters and Security . 66 3.4 Summary . 68 4 Code-based cryptography 69 4.1 McEliece Cryptosystem . 69 4.1.1 The Original McEliece Construction . 71 4.2 Attacks in Code-Based Cryptography . 72 4.3 New Variants of McEliece Cryptosystem . 72 4.3.1 McEliece Based on Convolutional Codes . 73 4.3.2 McEliece Based on MDPC codes . 80 4.4 The TCHo cipher . 82 4.4.1 Proposed parameters . 84 4.5 Summary . 84 5 A Squaring Attack on QC-MDPC-based McEliece 85 5.1 A Key-Recovery Attack . 86 5.1.1 Polynomial Square Roots . 87 5.1.2 The Attack . 90 5.2 A Message-Recovery Attack . 93 5.3 Analysis . 95 5.4 Results . 98 5.5 Summary . 101 6 Searching for Low-Weight Polynomial Multiples 103 6.1 The Low-Weight Polynomial Multiple Problem . 104 6.1.1 Time–Memory Trade-off Approach . 105 6.1.2 Finding Minimum-Weight Codewords in a Linear Code . 106 6.2 A New Algorithm Solving LWPM . 107 6.2.1 Complexity Analysis . 110 6.2.2 Simulation Results . 113 6.2.3 The Attack . 114 6.3 A New Algorithm for Finding a Weight-4 Multiple . 115 6.3.1 Complexity analysis . 117 6.3.2 Simulation results . 118 6.4 Attacks on QC-MDPC McEliece in relation to LWPM . 118 6.5 Summary . 121 7 Learning Parity With Noise 123 7.1 The LPN Problem . 125 7.2 The BKW Algorithm . 126 7.2.1 LF1 and LF2 variants . 128 7.3 A New Algorithm . 130 7.3.1 A Toy Example . 134 7.4 Algorithm Description . 137 7.4.1 Gaussian Elimination . 137 7.4.2 Merging columns . 138 7.4.3 Partial Secret Guessing . 139 7.4.4 Covering-Coding Method . 140 7.4.5 Subspace Hypothesis Testing . 141 7.5 Analysis . 144 7.6 Results . 146 7.6.1 Lapin with an Irreducible Polynomial . 148 7.7 More on the Covering-Coding Method . 148 7.8 Summary . 149 8 LPN over a Polynomial Ring 151 8.1 The Ring-LPN Problem . 152 8.1.1 Formal Definition . 153 8.2 A New Algorithm for Ring-LPN with Reducible Polynomial . 154 8.2.1 A Low-Weight Code from the CRT Map . 154 8.2.2 Using Low-Weight Relations to Build a Distinguisher . 155 8.2.3 Recovering the Secret Polynomial . 157 8.3 Lapin Authentication Protocol . 160 8.4 The Improved Version for the Proposed Instance of Lapin . 161 8.5 Complexity Analysis . 162 8.6 Results . 163 8.7 Summary . 164 9 Concluding Remarks 167 References 169 Preface his thesis contains results from research performed by the author at the Department of Electrical and Information Technology at Lund Univer- sity. Parts of the material have been presented at international confer- Tences. Publications and reports have appeared as follows. ‚ T. Johansson, C. Löndahl, »An Improvement to Stern’s Algorithm,« Internal report, September 2011. ‚ C. Löndahl, T. Johansson, »A new version of McEliece PKC based on convo- lutional codes,« in T. W. Chim and T. H. Yuen, editors, Information and Commu- nications Security, volume 7618 of Lecture Notes in Computer Science, pp 461–470. Springer-Verlag, 2012. ‚ T. Johansson, C. Löndahl, »A new algorithm for finding low-weight polyno- mial multiples and its application to TCHo,« in L. Budaghyan, T. Helleseth, M. G. Parker, editors, Workshop on Coding and Cryptography. Preproceedings, 2013. ‚ C. Löndahl, T. Johansson, »Improved Algorithms for Finding Low-Weight Polynomial Multiples in F2rxs and Some Cryptographic Applications,« in De- sign, Codes and Cryptography, volume 73 issue 2, pp 625–640. Kluwer Academic Publishers, 2013. ‚ C. Löndahl, T. Johansson, M. Koochak Shooshtari, M. Ahmadian-Attari, M. Reza Aref, »Squaring Attacks on McEliece Public-Key Cryptosystems Us- ing Quasi-Cyclic Codes of Even Dimension,« submitted to Design, Codes and Cryptography. ‚ Q. Guo, T. Johansson, C. Löndahl, »Solving LPN using Covering Codes:,« in T. W. Chim and T. H. Yuen, editors, Asiacrypt 2014, Taiwan, China, volume 8873 of Lecture Notes in Computer Science, pages 1–20. Springer-Verlag, 2014. ix ‚ Q. Guo, T. Johansson, C. Löndahl, »A New Algorithm for Solving Ring-LPN with a Reducible Polynomial,«, submitted to IEEE Transactions on Information Theory.