We consider the framework of the McEliece cryptosystem based on LDPC codes, which is a promising post-quantum alternative to classical public key cryptosystems. The use of LDPC codes in this context allows to achieve good security levels with very compact keys, which is an important advantage over the classical McEliece cryptosystem based on Goppa codes. However, only regular LDPC codes have been considered up to now, while some further improvement can be achieved by using irregular LDPC codes, which are known to achieve better error correction performance than regular LDPC codes. This is shown in this paper, for the first time at our knowledge. The possible use of irregular transformation matrices is also investigated, which further increases the efficiency of the system, especially in regard to the public key size.
Two variations of the McEliece cryptosystem are presented. The first one is based on a relaxation of the column permutation in the classical McEliece scrambling process. This is done in such a way that the Hamming weight of the error, added in the encryption process, can be controlled so that efficient decryption remains possible. The second variation is based on the use of spatially coupled moderate-density parity-check codes as secret codes. These codes are known for their excellent error-correction performance and allow for a relatively low key size in the cryptosystem. For both variants th…
We propose to use real-valued errors instead of classical bit flipping intentional errors in the McEliece cryptosystem based on moderate-density parity-check (MDPC) codes. This allows to exploit the error correcting capability of these codes to the utmost, by using soft-decision iterative decoding algorithms instead of hard-decision bit flipping decoders. However, soft reliability values resulting from the use of real-valued noise can also be exploited by attackers. We devise new attack procedures aimed at this, and compute the relevant work factors and security levels. We show that, for a fix…
In this paper, ensembles of quasi-cyclic moderate-density parity-check (MDPC) codes based on protographs are introduced and analyzed in the context of a McEliece-like cryptosystem. The proposed ensembles significantly improve the error correction capability of the regular MDPC code ensembles that are currently considered for post-quantum cryptosystems without increasing the public key size. The proposed ensembles are analyzed in the asymptotic setting via density evolution, both under the sum-product algorithm and a low-complexity (error-and-erasure) message passing algorithm. The asymptotic a…
A class of linear codes that extends classic Goppa codes to a non-commutative context is defined. An efficient decoding algorithm, based on the solution of a non-commutative key equation, is designed. We show how the parameters of these codes, when the alphabet is a finite field, may be adjusted to propose a McEliece-type cryptosystem.
In this paper we study recent reaction attacks against QC-LDPC and QC-MDPC code-based cryptosystems, which allow an opponent to recover the private parity-check matrix through its distance spectrum by observing a sufficiently high number of decryption failures. We consider a special class of codes, known as monomial codes, to form private keys with the desirable property of having a unique and complete distance spectrum. We verify that for these codes the problem of recovering the secret key from the distance spectrum is equivalent to that of finding cliques in a graph, and use this equivalenc…
Polar codes are novel and efficient error correcting codes with low encoding and decoding complexities. These codes have a channel dependent generator matrix which is determined by the code dimension, code length and transmission channel parameters. This paper studies a variant of the McEliece public key cryptosystem based on polar codes, called "PKC-PC". Due to the fact that the structure of polar codes' generator matrix depends on the parameters of channel, we used an efficient approach to conceal their generator matrix. Then, by the help of the characteristics of polar codes and also introd…
In this thesis, we study algebraic coding theory based McEliece-type cryptosystems over quasi-cyclic codes. The main goal of this thesis is to construct a cryptosystem that resists quantum Fourier sampling making it quantum secure. We propose a new variant of Niederreiter cryptosystem over rate $\frac{m-1}{m}$ quasi-cyclic codes which is secure against quantum Fourier sampling due to indistinguishability of the hidden subgroup. The proof of indistinguishability is achieved due to two constraints over automorphism group; small size and large minimal degree. Apart from this cryptosystem, we also…
McEliece encryption scheme which enjoys relatively small key sizes as well as a security reduction to hard problems of coding theory. Furthermore, it remains secure against a quantum adversary and is very well suited to low cost implementations on embedded devices. Decoding MDPC codes is achieved with the (iterative) bit flipping algorithm, as for LDPC codes. Variable time decoders might leak some information on the code structure (that is on the sparse parity check equations) and must be avoided. A constant time decoder is easy to emulate, but its running time depends on the worst case rather…
In this paper we present a new class of convolutional codes that admits an efficient al- gebraic decoding algorithm. We study some of its properties and show that it can decode interesting sequences of errors patterns. The second part of the paper is devoted to in- vestigate its use in a variant of the McEliece cryptosystem. In contrast to the classical McEliece cryptosystems, where block codes are used, we propose the use of a convolu- tional encoder to be part of the public key. In this setting the message is a sequence of messages instead of a single block message and the errors are added r…
The security of public-key cryptosystems is mostly based on number theoretic problems like factorization and the discrete logarithm. There exists an algorithm which solves these problems in polynomial time using a quantum computer. Hence, these cryptosystems will be broken as soon as quantum computers emerge. Code-based cryptography is an alternative which resists quantum computers since its security is based on an NP-complete problem, namely decoding of random linear codes. The McEliece cryptosystem is the most prominent scheme to realize code-based cryptography. Many codeclasses were propose…
Twisted Reed-Solomon (TRS) codes are a family of codes that contains a large number of maximum distance separable codes that are non-equivalent to Reed--Solomon codes. TRS codes were recently proposed as an alternative to Goppa codes for the McEliece code-based cryptosystem, resulting in a potential reduction of key sizes. The use of TRS codes in the McEliece cryptosystem has been motivated by the fact that a large subfamily of TRS codes is resilient to a direct use of known algebraic key-recovery methods. In this paper, an efficient key-recovery attack on the TRS variant that was used in the …
Code-based public-key cryptosystems based on QC-LDPC and QC-MDPC codes are promising post-quantum candidates to replace quantum vulnerable classical alternatives. However, a new type of attacks based on Bob's reactions have recently been introduced and appear to significantly reduce the length of the life of any keypair used in these systems. In this paper we estimate the complexity of all known reaction attacks against QC-LDPC and QC-MDPC code-based variants of the McEliece cryptosystem. We also show how the structure of the secret key and, in particular, the secret code rate affect the compl…
We give a decoding algorithm for a class of error-correcting codes, which can be used in the DHH-cryptosystem, which is a candidate for post-quantum cryptography, since it is of McEliece type. Furthermore, we implement the encryption and decryption algorithms for this cryptosystem and investigate its performance.
In this paper, we investigate twisted Gabidulin codes in the GPT code-based public-key cryptosystem. We show that Overbeck's attack is not feasible for a subfamily of twisted Gabidulin codes. The resulting key sizes are significantly lower than in the original McEliece system and also slightly smaller than in Loidreau's unbroken GPT variant.
In this paper, a code-based public-key cryptosystem based on interleaved Goppa codes is presented. The scheme is based on encrypting several ciphertexts with the same Goppa code and adding a burst error to them. Possible attacks are outlined and the key size of several choices of parameters is compared to those of known schemes for the same security level. For example, for security level 128 bits, we obtain a key size of 696 Kbits whereas the classical McEliece scheme based on Goppa codes using list decoding requires a key size of 1935 Kbits.
We give polynomial time attacks on the McEliece public key cryptosystem based either on algebraic geometry (AG) codes or on small codimensional subcodes of AG codes. These attacks consist in the blind reconstruction either of an Error Correcting Pair (ECP), or an Error Correcting Array (ECA) from the single data of an arbitrary generator matrix of a code. An ECP provides a decoding algorithm that corrects up to $\frac{d^*-1-g}{2}$ errors, where $d^*$ denotes the designed distance and $g$ denotes the genus of the corresponding curve, while with an ECA the decoding algorithm corrects up to $\fra…
We give a polynomial time attack on the McEliece public key cryptosystem based on subcodes of algebraic geometry (AG) codes. The proposed attack reposes on the distinguishability of such codes from random codes using the Schur product. Wieschebrink treated the genus zero case a few years ago but his approach cannot be extent straightforwardly to other genera. We address this problem by introducing and using a new notion, which we call the t-closure of a code.
We consider the decoding problem or the problem of finding low weight codewords for rank metric codes. We show how additional information about the codeword we want to find under the form of certain linear combinations of the entries of the codeword leads to algorithms with a better complexity. This is then used together with a folding technique for attacking a McEliece scheme based on LRPC codes. It leads to a feasible attack on one of the parameters suggested in \cite{GMRZ13}.
In this paper, we define and discuss ϕ-cyclic code, which may be regarded as a general form of the ordinary cyclic code. As applications, we explain how to extend two public key encryption schemes, one is McEliece and Niederriter's cryptosystem of which is based on error-correcting code theory. Another one is NTRU public key cryptosystem of which is based on polynomial ring theory. The main purpose of this paper is to give a more general construction of NTRU based on ideal matrices and q-ary lattice theory.
This letter presents a cryptanalysis of the modified McEliece cryptosystem recently proposed by Moufek, Guenda and Gulliver [24]. The system is based on the juxtaposition of quasi-cyclic LDPC and quasi-cyclic MDPC codes. The idea of our attack is to find an alternative permutation matrix together with an equivalent LDPC code which allow the decoding of any cipher-text with a very high probability. We also apply a recent technique to determine weak keys [4] for this scheme. The results show that the probability of weak keys is high enough that this variant can be ruled out as a possible secure …
This paper presents two public key cryptosystems based on the so-called expanded Gabidulin codes, which are constructed by expanding Gabidulin codes over the base field. Exploiting the fast decoder of Gabidulin codes, we propose an efficient algorithm to decode these new codes when the noise vector satisfies a certain condition. Additionally, these new codes have an excellent error-correcting capability because of the optimality of their parent Gabidulin codes. With different masking techniques, we give two encryption schemes by using expanded Gabidulin codes in the McEliece setting. Being con…
We present a code-based public-key cryptosystem, in which we use Reed-Solomon codes over an extension field as secret codes and disguise it by considering its shortened expanded code over the base field. Considering shortened expanded codes provides a safeguard against distinguisher attacks based on the Schur product. Moreover, without using a cyclic or a quasi-cyclic structure we obtain a key size reduction of nearly $45 \%$ compared to the classic McEliece cryptosystem proposed by Bernstein et al.
Characterizing the decoding failure rate of iteratively decoded Low- and Moderate-Density Parity Check (LDPC/MDPC) codes is paramount to build cryptosystems based on them, able to achieve indistinguishability under adaptive chosen ciphertext attacks. In this paper, we provide a statistical worst-case analysis of our proposed iterative decoder obtained through a simple modification of the classic in-place bit-flipping decoder. This worst case analysis allows both to derive the worst-case behaviour of an LDPC/MDPC code picked among the family with the same length, rate and number of parity check…
This paper presents two modifications for Loidreau's code-based cryptosystem. Loidreau's cryptosystem is a rank metric code-based cryptosystem constructed by using Gabidulin codes in the McEliece setting. Recently a polynomial-time key recovery attack was proposed to break Loidreau's cryptosystem in some cases. To prevent this attack, we propose the use of subcodes to disguise the secret codes in Modification \Rmnum{1}. In Modification \Rmnum{2}, we choose a random matrix of low column rank over $\mathbb{F}_q$ to mix with the secret matrix. According to our analysis, these two modifications ca…
Joint encryption-encoding schemes have been released to fulfill both reliability and security desires in a single step. Using Low Density Parity Check (LDPC) codes in joint encryption-encoding schemes, as an alternative to classical linear codes, would shorten the key size as well as improving error correction capability. In this article, we present a joint encryption-encoding scheme using Quasi Cyclic-Low Density Parity Check (QC-LDPC) codes based on finite geometry. We observed that our proposed scheme not only outperforms its predecessors in key size and transmission rate, but also remains …
This paper presents a new technique for disturbing the algebraic structure of linear codes in code-based cryptography. This is a new attempt to exploit Gabidulin codes in the McEliece setting and almost all the previous cryptosystems of this type have been completely or partially broken. To be specific, we introduce the so-called semilinear transformation in coding theory, which is defined through an $\mathbb{F}_q$-linear automorphism of $\mathbb{F}_{q^m}$, then apply them to construct a public key encryption scheme. Our analysis shows that this scheme can resist all the existing distinguisher…
This work presents a new code-based key encapsulation mechanism (KEM) called LEDAkem. It is built on the Niederreiter cryptosystem and relies on quasi-cyclic low-density parity-check codes as secret codes, providing high decoding speeds and compact keypairs. LEDAkem uses ephemeral keys to foil known statistical attacks, and takes advantage of a new decoding algorithm that provides faster decoding than the classical bit-flipping decoder commonly adopted in this kind of systems. The main attacks against LEDAkem are investigated, taking into account quantum speedups. Some instances of LEDAkem are…
In this paper, we study the behavior of the true dimension of the subfield subcodes of Hermitian codes. Our motivation is to use these classes of linear codes to improve the parameters of the McEliece cryptosystem, such that key size and security level. The McEliece scheme is one of the promising alternative cryptographic schemes to the current public key schemes since in the last four decades, they resisted all known quantum computing attacks. By analyzing computational data series of true dimension, we concluded that they can be estimated by the extreme value distribution function.
In this paper we study reaction and timing attacks against cryptosystems based on sparse parity-check codes, which encompass low-density parity-check (LDPC) codes and moderate-density parity-check (MDPC) codes. We show that the feasibility of these attacks is not strictly associated to the quasi-cyclic (QC) structure of the code but is related to the intrinsically probabilistic decoding of any sparse parity-check code. So, these attacks not only work against QC codes, but can be generalized to broader classes of codes. We provide a novel algorithm that, in the case of a QC code, allows recover…
The family of Goppa codes is one of the most interesting subclasses of linear codes. As the McEliece cryptosystem often chooses a random Goppa code as its key,knowledge of the number of inequivalent Goppa codes for fixed parameters may facilitate in the evaluation of the security of such a cryptosystem. In this paper we present a new approach to give an upper bound on the number of inequivalent extended irreducible binary Goppa codes. To be more specific, let $n>3$ be an odd prime number and $q=2^n$; let $r\geq3$ be a positive integer satisfying $\gcd(r,n)=1$ and $\gcd\big(r,q(q^2-1)\big)=1$. …
A new nonlinear Rao-Nam like symmetric key encryption scheme is presented in this paper. QC-LDPC lattices that are practically implementable in high dimensions due to their low complexity encoding and decoding algorithms, are used in our design. Then, a joint scheme is proposed which is capable of encrypting, encoding and data modulation simultaneously. The proposed cryptosystem withstands all variants of chosen plaintext attacks applied on Rao-Nam like cryptosystems due to its nonlinearity. The sparseness of the parity-check matrix of QC-LDPC lattices, quasi-cyclic nature of their generator a…
We introduce a new family of rank metric codes: Low Rank Parity Check codes (LRPC), for which we propose an efficient probabilistic decoding algorithm. This family of codes can be seen as the equivalent of classical LDPC codes for the rank metric. We then use these codes to design cryptosystems à la McEliece: more precisely we propose two schemes for key encapsulation mechanism (KEM) and public key encryption (PKE). Unlike rank metric codes used in previous encryption algorithms -notably Gabidulin codes - LRPC codes have a very weak algebraic structure. Our cryptosystems can be seen as an equi…
We show that with high probability, random rank 1 matrices over a finite field are in (linearly) general position, at least provided their shape k x l is not excessively unbalanced. This translates into saying that the dimension of the *-product of two [n, k] and [n, l] random codes is equal to min(n, kl), as one would have expected. Our work is inspired by a similar result of Cascudo-Cramer-Mirandola-Zemor dealing with *-squares of codes, which it complements, especially regarding applications to the analysis of McEliece-type cryptosystems. We also briefly mention the case of higher *-powers,…
Generalized Goppa codes are defined by a code locator set $\mathcal{L}$ of polynomials and a Goppa polynomial $G(x)$. When the degree of all code locator polynomials in $\mathcal{L}$ is one, generalized Goppa codes are classical Goppa codes. In this work, binary generalized Goppa codes are investigated. First, a parity-check matrix for these codes with code locators of any degree is derived. A careful selection of the code locators leads to a lower bound on the minimum Hamming distance of generalized Goppa codes which improves upon previously known bounds. A quadratic-time decoding algorithm i…
