On the Complexity of the Rank Syndrome Decoding Problem

Abstract

Abstract. In this paper we propose two new generic attacks on the Rank Syndrome Decoding (RSD) problem Let C be a random [n, k] rank code over GF (q m ) and let y = x + e be a received word such that x ∈ C and the Rank(e) = r. The first attack is combinatorial and permits to recover an error e of rank weight r in min. This attack dramatically improves on previous attack by introducing the length n of the code in the exponent of the complexity, which was not the case in previous generic attacks. which can be considered The second attack is based on a algebraic attacks: based on the theory of q-polynomials introduced by Ore we propose a new algebraic setting for the RSD problem that permits to consider equations and unknowns in the extension field GF (q m ) rather than in GF (q) as it is usually the case. We consider two approaches to solve the problem in this new setting. Linearization technics show that if n ≥ (k + 1)(r + 1) − 1 the RSD problem can be solved in polynomial time, more generally we prove that if ⌈ (r+1)(k+1)−(n+1) r ⌉ ≤ k, the problem can be solved with an average complexity O(rWe also consider solving with Gröbner bases for which which we discuss theoretical complexity, we also consider consider hybrid solving with Gröbner bases on practical parameters. As an example of application we use our new attacks on all proposed recent cryptosystems which reparation the GPT cryptosystem, we break all examples of published proposed parameters, some parameters are broken in less than 1 s in certain cases.

Randomized Decoding of Gabidulin Codes Beyond the Unique Decoding Radius

“…For the rank metric, some complexity results were obtained more recently in [13], emphasizing the difficulty of ML decoding. This potential hardness was also corroborated by the existing practical complexities of the generic rank metric decoding algorithms [12].…”

“…In the security evaluations, this polynomial is often neglected and only the exponential term is taken into account. Note that in the case where m > n there might be a better combinatorial bound [12]. Since we do not address this setting, we do not consider this case.…”

Polynomial-time key recovery attack on the Faure–Loidreau scheme based on Gabidulin codes

“…We have also seen that taking w > u u+1 (n − k) implies to choose t pub < 1 2 n−k u+1 which exposes further the system to general decoding attacks like [GRS16]. Hence it imposes to increase the key sizes and consequently reduces the practicability of the scheme while offering no assurance that the scheme is still secure.…”

Improved Veron Identification and Signature Schemes in the Rank Metric

“…For all the proposed parameters it holds the condition k < (r+1)(k+1)−(n+1) r , so the algebraic attack of [21] must be taken into consideration while evaluating the security. 6 Key and signature size comparison…”