Error Amplification in Code-based Cryptography

Abstract

Code-based cryptography is one of the main techniques enabling cryptographic primitives in a post-quantum scenario. In particular, the MDPC scheme is a basic scheme from which many other schemes have been derived. These schemes rely on iterative decoding in the decryption process and thus have a certain small probability p of having a decryption (decoding) error.In this paper we show a very fundamental and important property of code-based encryption schemes. Given one initial error pattern that fails to decode, the time needed to generate another message that fails to decode is strictly much less than 1/p. We show this by developing a method for fast generation of undecodable error patterns (error pattern chaining), which additionally proves that a measure of closeness in ciphertext space can be exploited through its strong linkage to the difficulty of decoding these messages. Furthermore, if side-channel information is also available (time to decode), then the initial error pattern no longer needs to be given since one can be easily generated in this case.These observations are fundamentally important because they show that a, say, 128- bit encryption scheme is not inherently safe from reaction attacks even if it employs a decoder with a failure rate of 2−128. In fact, unless explicit protective measures are taken, having a failure rate at all – of any magnitude – can pose a security problem because of the error amplification effect of our method.A key-recovery reaction attack was recently shown on the MDPC scheme as well as similar schemes, taking advantage of decoding errors in order to recover the secret key. It was also shown that knowing the number of iterations in the iterative decoding step, which could be received in a timing attack, would also enable and enhance such an attack. In this paper we apply our error pattern chaining method to show how to improve the performance of such reaction attacks in the CPA case. We show that after identifying a single decoding error (or a decoding step taking more time than expected in a timing attack), we can adaptively create new error patterns that have a much higher decoding error probability than for a random error. This leads to a significant improvement of the attack based on decoding errors in the CPA case and it also gives the strongest known attack on MDPC-like schemes, both with and without using side-channel information.

Complexity of statistical attacks on QC‐LDPC code‐based cryptosystems

“…success or failure), the required time for decoding, the power consumption of some particular step, etc. (see [14,15,[17][18][19]25] for some concrete possibilities). The adversary first collects all the oracle replies, and then performs a statistical analysis on them, with the aim of guessing some information about the secret key.…”

“…Such a probabilistic nature of decoding has been shown to leak some information about the secret key. The first-ever published attack of this kind, which is due to Guo et al [14], exploits events of decoding failure to recover the secret key; after that, the same attack procedure has been extended, in order to consider different schemes and other kinds of information leakage [15][16][17][18][19]. Essentially, all these attacks can be divided into two common phases.…”

Analysis of Reaction and Timing Attacks Against Cryptosystems Based on Sparse Parity-Check Codes

“…In this paper we focus on systems with security against a Chosen Ciphertext Attack (CCA), that is, the case in which a proper conversion (like the one of [16]) is applied to the McEliece/Niederreiter cryptosystem, in order to achieve CCA security. In our attack model, this corresponds to assuming that the oracle queries are all randomly generated, i.e., the error vectors used during encryption can be seen as randomly picked elements from the ensemble of all n-uples with weight t. Opposed to the CCA case, in the Chosen Plaintext Attack (CPA) case the opponent is free to choose the error vectors used during encryption: from the adversary standpoint, the CPA assumption is clearly more optimistic than that of CCA, and leads to improvements in the attack [15], [21]. Obviously, all results we discuss in this paper can be extended to the CPA case.…”

“…Such a feature is crucial, since it has been shown how this probabilistic nature of the decoder actually exposes the system to cryptanalysis techniques based on the observation of the decryption phase. State-of-the-art attacks of this kind are commonly called reaction attacks, when based on decoding failures events [12], [13], [15], [22], or side-channel attacks, when based on information such as the duration of the decoding phase (in this case we speak properly of timing attacks) or other quantities [10], [11], [21]. All these previous techniques exploit the QC structure of the code and aim at recovering some characteristics of the secret key by performing a statistical analysis on a sufficiently large amount of collected data.…”

“…Our analysis is general and can be easily extended to other decoders than those considered here. Indeed, many different decoders have been analyzed in the literature (for instance, see [10] and [21]), and, as for the outcome of reaction and timing attacks, there is no meaningful difference between them. This strongly hints that such attacks are possible because of the probabilistic nature of the decoder, and are only slightly affected by the particular choice of the decoder and its settings.…”