Worst case QC-MDPC decoder for McEliece cryptosystem

Abstract

Abstract-QC-MDPC-McEliece is a recent variant of theMcEliece encryption scheme which enjoys relatively small key sizes as well as a security reduction to hard problems of coding theory. Furthermore, it remains secure against a quantum adversary and is very well suited to low cost implementations on embedded devices.Decoding MDPC codes is achieved with the (iterative) bit flipping algorithm, as for LDPC codes. Variable time decoders might leak some information on the code structure (that is on the sparse parity check equations) and must be avoided. A constant time decoder is easy to emulate, but its running time depends on the worst case rather than on the average case. So far implementations were focused on minimizing the average cost. We show that the tuning of the algorithm is not the same to reduce the maximal number of iterations as for reducing the average cost. This provides some indications on how to engineer the QC-MDPC-McEliece scheme to resist a timing side-channel attack.

LEDAkem: A Post-quantum Key Encapsulation Mechanism Based on QC-LDPC Codes

“…Since both the parity-check matrix and the error vector are sparse, the probability of wt s (l) being significantly different from w (l) s is negligible. So, (14) allows predicting the average syndrome weight starting from t ′ l . In order to predict how t ′ l varies during iterations, let us consider the i-th codeword bit and the corresponding correlation value ρ (l) i at the l-th iteration.…”

MDPC decoding algorithms and their impact on the McEliece cryptosystem

“…However, in cryptography, We The probabilistic decoding algorithm used in the cryptosystem is known as the modified bit flipping algorithm. During the last few years this probabilistic aspect was very intensively examined by community [1], [7]. The results of this research increased error-correcting capability for the tested systems for security 2 80 .…”

“…An random (n, r, w)-MDPC code is easily generated by selecting a random parity-check matrix H ∈ F r×n 2 of row weight w. We only have to check that the rightmost r × r block is full rank. If not, wecan swap a few columns to get 1 Indistinguishability under chosen-plaintext attack a full rank matrix. The general definition of MDPC codes can be found in [9].…”

CAKE: Code-Based Algorithm for Key Encapsulation

“…The parameters suggested in Table 2 consider the security attacks discussed in Section 6. In addition, the block size r is chosen so that state-of-the-art bit flipping decoding (see [34]; or [16] for a comprehensive assessment) has a failure rate not exceeding 10 −7 (validated through exhaustive simulation). The last column shows the public and private key size which are both n bits long.…”

“…This approach led to key sizes that are just a few thousand bits long, and approximated the distinguishing problem to the decoding problem. These features attracted great attention from the community (see [26,53,54,16], just to mention a few) including a mention in the preliminary European recommendations for post-quantum cryptography [31].…”