A Distinguisher for High-Rate McEliece Cryptosystems

Abstract

The Goppa Code Distinguishing (GD) problem consists in distinguishing the matrix of a Goppa code from a random matrix. The hardness of this problem is an assumption to prove the security of code-based cryptographic primitives such as McEliece's cryptosystem. Up to now, it is widely believed that the GD problem is a hard decision problem. We present the first method allowing to distinguish alternant and Goppa codes over any field. Our technique can solve the GD problem in polynomial-time provided that the codes have sufficiently large rates. The key ingredient is an algebraic characterization of the key-recovery problem. The idea is to consider the rank of a linear system which is obtained by linearizing a particular polynomial system describing a key-recovery attack. It appears that this dimension depends on the type of code considered. Explicit formulas derived from extensive experimentations for the rank are provided for "generic" random, alternant, and Goppa codes over any field. Finally, we give theoretical explanations of these formulas in the case of random codes, alternant codes over any field of characteristic two and binary Goppa codes.

Worst case QC-MDPC decoder for McEliece cryptosystem

“…Generic decoding is NP-complete [3] and is also believed to be hard on average. Though the pseudorandomness of Goppa codes has not been studied as thoroughly as generic decoding, no efficient algorithm is known to distinguish a random matrix from a generator matrix of a Goppa code, except when the code rate is close to one [4], a case which is not a threat against the McEliece encryption scheme.…”

Recovering Short Secret Keys of RLCE in Polynomial Time

“…We recall the following result on the generic behaviour of random codes with respect to this operation. This provides a distinguisher between random codes and algebraically structured codes such as generalised Reed Solomon codes [19,8], Reed Muller codes [7], polar codes [2] some Goppa codes [12,10] or algebraic geometry codes [9]. For instance, in the case of GRS codes, we have the following result.…”

“…• If i ∈ I GRS (see (2), (8) and (12) for the definition), puncturing does not affect the dimension of the square code:…”

Cryptanalysis of a One-Time Code-Based Digital Signature Scheme

“…Historically, the first digital signature scheme based on error correcting codes is the Courtois-Finiasz-Sendrier (CFS) scheme [9], that uses high rate Goppa codes and follows a hash-and-sign approach. This scheme is known to be unpractical, since it has some security flaws (high rate Goppa codes can be distinguished from random codes [10]) and requires very large public-keys and long signature times.…”