A Polynomial-Time Attack on the BBCRS Scheme

Abstract

Abstract. The BBCRS scheme is a variant of the McEliece public-key encryption scheme where the hiding phase is performed by taking the inverse of a matrix which is of the form T +R where T is a sparse matrix with average row/column weight equal to a very small quantity m, usually m < 2, and R is a matrix of small rank z 1. The rationale of this new transformation is the reintroduction of families of codes, like generalized Reed-Solomon codes, that are famously known for representing insecure choices. We present a key-recovery attack when z = 1 and m is chosen between 1 and 1 + R + O() where R denotes the code rate. This attack has complexity O(n 6 ) and breaks all the parameters suggested in the literature.

Variations of the McEliece Cryptosystem

“…Indeed, our simulations show that the Schur square of the public code, a central tool in most attacks, behaves like the Schur square of a random code. This contrasts the system proposed by Baldi et al [3] for which it has been shown [20] that the dimension of the Schur square is not maximal when the average row weight m is less than 1 + R.…”

An Efficient Structural Attack on NIST Submission DAGS

“…For such a field, it is reasonable to store a multiplication and inversion table. Therefore, we list in Table 5 some approximate work factors for DAGS according to (13). The second column recalls the security levels claimed in [3] for the best possible attack.…”

“…On the one hand, some proposals suggested to replace Goppa or alternant codes by more structured codes such as generalised Reed-Solomon (GRS) codes [24], their low dimensional subcodes [6], or GRS codes to which various transformations have been applied [30,2,29]. It turns out that most of these proposals have been subject to polynomial time key-recovery attacks [28,31,9,13]. In addition, proposals based on Goppa codes which are close to GRS codes, namely Goppa code with a low extension degree m have been the target of some structural attacks [17,12].…”

Recovering Short Secret Keys of RLCE in Polynomial Time

“…Berger and Loidreau [3] suggested to replace a GRS code by a random subcode of small codimension, Wieschebrink [18] proposed to join random columns in a generator matrix of a GRS code and Baldi et al [1] suggested to mask the structure of the code by right multiplying a generator matrix of a GRS code by the sum of a low rank matrix and a sparse matrix. It turns out that all of these proposals have been subject to efficient polynomial time attacks [19,8,11].…”