We prove that any variant of the GPT cryptosystem which uses a right column scrambler over the extension field as advocated by the works of Gabidulin et al. with the goal to resist to Overbeck's structural attack are actually still vulnerable to that attack. We show that by applying the Frobenius operator appropriately on the public key, it is possible to build a Gabidulin code having the same dimension as the original secret Gabidulin code but with a lower length. In particular, the code obtained by this way correct less errors than the secret one but its error correction capabilities are beyond the number of errors added by a sender, and consequently an attacker is able to decrypt any ciphertext with this degraded Gabidulin code. We also considered the case where an isometric transformation is applied in conjunction with a right column scrambler which has its entries in the extension field. We proved that this protection is useless both in terms of performance and security. Consequently, our results show that all the existing techniques aiming to hide the inherent algebraic structure of Gabidulin codes have failed.
This article discusses the decoding of Gabidulin codes and shows how to extend the usual decoder to any supercode of a Gabidulin code at the cost of a significant decrease of the decoding radius. Using this decoder, we provide polynomial time attacks on the rank-metric encryption schemes RAMESSES and LIGA.
This paper presents a key recovery attack on the cryptosystem proposed by Lau and Tan in a talk at ACISP 2018. The Lau-Tan cryptosystem uses Gabidulin codes as the underlying decodable code. To hide the algebraic structure of Gabidulin codes, the authors chose a matrix of column rank $n$ to mix with a generator matrix of the secret Gabidulin code. The other part of the public key, however, reveals crucial information about the private key. Our analysis shows that the problem of recovering the private key can be reduced to solving a multivariate linear system over the base field, rather than so…
Subcodes of Lambda-Gabidulin Codes for Compact-Ciphertext Cryptography
University of Yaounde I（雅温得第一大学）；National Advanced School of Engineering of Yaoundé, University of Yaounde I（雅温得国立高等工程学院，雅温得第一大学）；The University of Bamenda（班达马大学）；Université Cheikh Anta Diop de Dakar（达喀尔谢赫安塔·迪奥普大学）；Higher Teacher Training College, University of Yaounde I（雅温得第一大学高等师资培训学院）
We propose two main contributions: first, we revisit the encryption scheme Rank Quasi-Cyclic (RQC) by introducing new efficient variations, in particular, a new class of codes, the Augmented Gabidulin codes; second, we propose new attacks against the Rank Support Learning (RSL), the Non-Homogeneous Rank Decoding (NHRSD), and the Non-Homogeneous Rank Support Learning (NHRSL) problems. RSL is primordial for all recent rank-based cryptosystems such as Durandal (Aragon et al., EUROCRYPT 2019) or LRPC with multiple syndromes (arXiv:2206.11961), moreover, NHRSD and NHRSL, together with RSL, are at t…
Low Rank Parity Check Codes: New Decoding Algorithms and Applications to Cryptography
介绍了一类新的秩度量码：低秩奇偶检验码（LRPC），并提出了一种有效的概率译码算法。这一系列的代码可以被看作是等价的经典LDPC码的秩度量。然后，我们使用这些代码来设计密码系统à la McEliece：更准确地说，我们提出了两个方案的密钥封装机制（KEM）和公钥加密（PKE）。与先前的加密算法中使用的秩度量码（特别是Gabidulin码）不同，LRPC码具有非常弱的代数结构。我们的密码系统可以被看作是一个等价的NTRU密码系统（也是最近的MDPC \cite{MTSB12}密码系统）在秩度量的上下文中。本文件是一个扩展版本的文章介绍LRPC代码，具有重要的新贡献。我们已经改进了解码器，这要归功于一种新的方法，该方法允许对更高秩权重的错误进行解码，即，当先前的解码算法仅解码高达$\frac{n-k}{2}$的错误时，高达$\frac{2}{3}(n-k)$的错误。因此，我们的代码优于经典的Gabidulin码解码器，处理的权重高达$\frac{n-k}{2}$。这是以概率解码为代价的，但是解码错误概率可以任意小。该方法还可以用来降低已有方案的译码错误率，特别适用于密码学领域。最后，我们引入理想秩码，它推广了双循环秩码，使我们能够避免已知的基于折叠的结构攻击。最后，我们提出了不同的参数大小为我们的计划，我们得到了一个公钥的3337位的密钥交换和5893位的公钥加密，都为128位的安全…
