No abstract

International audienceThe McEliece cryptosystem is one of the oldest public-key cryptosystem ever designated. It is also the first public-key cryptosystem based on linear error-correcting codes. The main advantage of the McEliece cryptosystem is to have a very fast encryption and decryption functions but suffers from a major drawback. It requires a very large public key which makes it very difficult to use in many practical situations. In this paper we propose a new general way to reduce the public key size through quasi-cyclic codes. Our construction introduces a new method of hiding the structure of the secret generator matrix by first choosing a subfield subcode of a quasi-cyclic code that is defined over a large alphabet and then by randomly shortening the chosen subcode. The security of our variant is related to the hardness of decoding a random quasi-cyclic code. We introduce a new decisional problem that is associated to the decoding of an arbitrary quasi-cyclic code. We prove that it is an NP-complete problem. Starting from subfield subcodes of quasi-cyclic generalized Reed-Solomon codes, we propose a system with several size of parameters from 6,000 to 11,000 bits with a security ranging from 2 80 to 2 107 . Implementations of our proposal show that we can encrypt at a speed of 120 Mbits/s (or one octet for 120 cycles). Hence our new proposal represents the most competitive public-key cryptosystem

No abstract

Abstract. In this paper we propose two new generic attacks on the Rank Syndrome Decoding (RSD) problem Let C be a random [n, k] rank code over GF (q m ) and let y = x + e be a received word such that x ∈ C and the Rank(e) = r. The first attack is combinatorial and permits to recover an error e of rank weight r in min. This attack dramatically improves on previous attack by introducing the length n of the code in the exponent of the complexity, which was not the case in previous generic attacks. which can be considered The second attack is based on a algebraic attacks: based on the theory of q-polynomials introduced by Ore we propose a new algebraic setting for the RSD problem that permits to consider equations and unknowns in the extension field GF (q m ) rather than in GF (q) as it is usually the case. We consider two approaches to solve the problem in this new setting. Linearization technics show that if n ≥ (k + 1)(r + 1) − 1 the RSD problem can be solved in polynomial time, more generally we prove that if ⌈ (r+1)(k+1)−(n+1) r ⌉ ≤ k, the problem can be solved with an average complexity O(rWe also consider solving with Gröbner bases for which which we discuss theoretical complexity, we also consider consider hybrid solving with Gröbner bases on practical parameters. As an example of application we use our new attacks on all proposed recent cryptosystems which reparation the GPT cryptosystem, we break all examples of published proposed parameters, some parameters are broken in less than 1 s in certain cases.