A new identification scheme based on syndrome decoding

Abstract

Laboratoire d'informatique, Ecole N u m a l e Suy&ricLu-c Abstract. Zero-knowledge proofs were introduced in 1985, in a paper by Goldwasser, Micali and Rackoff ([6]). Their practical significance was soon demonstrated in the work of Fiat and Shamir ([4]), who turned zero-knowledge proofs of quadratic residuosity into efficient means of establishing user identities. Still, as is almost always the case in public-key cryptography, the Fiat-Shamir scheme relied on arithmetic operations on larep niimhws. Tn 1989, there were two attempts to build identification protocols that only use simple operations (see [U, lo]). One appeared in the EUROCRYPT proceedings and relies on the intractability of some coding problems, the other waa presented at the CRYPTO rump session and depends on the so-called Permuted Kernel problem (PKP). Unfortunately, the first of the schemes wati uot really practical. In the prcscnt paper, we propose a new identification scheme, based on error-correcting codes, which is zero-knowledge and is of practical value. Furthermore, we describe several variants, including one which has an identity based character. The security of our scheme dependson the hardness of decoding a word of given syndrome w.r.t. some binary linear error-correcting code.

How to Achieve a McEliece-Based Digital Signature Scheme

“…The only solution available up to date was to use zero-knowledge schemes based on codes such as the SD scheme by Stern [19]. It gives excellent security but the signatures are very long.…”

A New Identification Scheme Based on the Perceptrons Problem

“…These identifications are based on number theoretical problems. More recently, new schemes appeared with the peculiarity that they are more efficient from the computational point of view and that their security is based on N P-complete problems: PKP (Permuted Kernels Problem) [10], SD (Syndrome Decoding) [12] and CLE (Constrained Linear Equations) [13]. We present a new N P-complete linear problem which comes from learning machines: the Perceptrons Problem.…”

Efficient Zero-Knowledge Authentication Based on a Linear Algebra Problem MinRank

“…MinRank also appears in attacks known on the HFE [32,8,10], TTM cryptosystem [19] and Shamir's birational signature scheme [30,6,7]. Finally, as we show in §3.3, MinRank contains the SD problem for ordinary codes that underlies the security of McEliece [22] and various identification schemes [34,40,16,20].…”

“…However the most interesting schemes are in our opinion the schemes related to coding, as the decoding problem(s) are believed intractable even since the 1970s [2]. There were many proposals [34,40,20,16,4] and the best of them is the scheme SD by Stern [34,40]. The simplest decoding problem is the problem of Syndrome Decoding (SD) and consists of finding a small weight vector in an affine subspace of a linear space.…”