Improvements of Algebraic Attacks for solving the Rank Decoding and MinRank problems
Uloženo v:
| Název: | Improvements of Algebraic Attacks for solving the Rank Decoding and MinRank problems |
|---|---|
| Autoři: | Bardet, Magali, Bros, Maxime, Cabarcas, Daniel, Gaborit, Philippe, Perlner, Ray, Smith-Tone, Daniel, Tillich, Jean-Pierre, Verbel, Javier |
| Přispěvatelé: | Equipe Combinatoire et algorithmes (CA - LITIS), Laboratoire d'Informatique, de Traitement de l'Information et des Systèmes (LITIS), Université Le Havre Normandie (ULH), Normandie Université (NU)-Normandie Université (NU)-Université de Rouen Normandie (UNIROUEN), Normandie Université (NU)-Institut national des sciences appliquées Rouen Normandie (INSA Rouen Normandie), Normandie Université (NU)-Institut National des Sciences Appliquées (INSA)-Institut National des Sciences Appliquées (INSA)-Université Le Havre Normandie (ULH), Normandie Université (NU)-Institut National des Sciences Appliquées (INSA)-Institut National des Sciences Appliquées (INSA), Security, Cryptology and Transmissions (SECRET), Inria de Paris, Institut National de Recherche en Informatique et en Automatique (Inria)-Institut National de Recherche en Informatique et en Automatique (Inria), Mathématiques & Sécurité de l'information (XLIM-MATHIS), XLIM (XLIM), Université de Limoges (UNILIM)-Centre National de la Recherche Scientifique (CNRS)-Université de Limoges (UNILIM)-Centre National de la Recherche Scientifique (CNRS), Universidad Nacional de Colombia Sede Medellín, National Institute of Standards and Technology Gaithersburg (NIST), University of Louisville, This work has been supported by the French ANR projects CBCRYPT (ANR-17-CE39-0007) and the MOUSTIC project with the support from the European Regional Development Fund (ERDF) and the Regional Council of Normandie.Javier Verbel was supported for this work by Colciencias scholarship 757 forPhD studies and the University of Louisville facilities., ANR-17-CE39-0007,CBCRYPT,Cryptographie basée sur les codes(2017) |
| Zdroj: | https://hal.archives-ouvertes.fr/hal-02475356 ; 2020. |
| Informace o vydavateli: | HAL CCSD |
| Rok vydání: | 2020 |
| Sbírka: | Archive ouverte HAL (Hyper Article en Ligne, CCSD - Centre pour la Communication Scientifique Directe) |
| Témata: | Post-quantum cryptography, Algebraic attack, Rankmetric code-based cryptography, NIST-PQC candidates, [INFO.INFO-CR]Computer Science [cs]/Cryptography and Security [cs.CR], [MATH.MATH-AG]Mathematics [math]/Algebraic Geometry [math.AG] |
| Popis: | Rank Decoding (RD) is the main underlying problem in rank-based cryptography. Based on this problem and quasi-cyclic versions of it, very efficient schemes have been proposed recently, such as those in the ROLLO and RQC submissions, which have reached the second round of the NIST Post-Quantum competition. Two main approaches have been studied to solve RD: combinatorial ones and algebraic ones. While the former has been studied extensively, a better understanding of the latter was recently obtained by Bardet et al. (EUROCRYPT20) where it appeared that algebraic attacks can often be more efficient than combinatorial ones for cryptographic parameters. This paper gives substantial improvements upon this attack in terms both of complexity and of the assumptions required by the cryptanalysis. We present attacks for ROLLO-I-128, 192, and 256 with bit complexity respectively in 70, 86, and 158, to be compared to 117, 144, and 197 for the aforementionned previous attack. Moreover, unlike this previous attack, ours does not need generic Gr\"obner basis algorithms since it only requires to solve a linear system. For a case called overdetermined, this modeling allows us to avoid Gr\"obner basis computations by going directly to solving a linear system. For the other case, called underdetermined, we also improve the results from the previous attack by combining the Ourivski-Johansson modeling together with a new modeling for a generic MinRank instance; the latter modeling allows us to refine the analysis of MinRank's complexity given in the paper by Verbel et al. (PQC19). Finally, since the proposed parameters of ROLLO and RQC are completely broken by our new attack, we give examples of new parameters for ROLLO and RQC that make them resistant to our attacks. These new parameters show that these systems remain attractive, with a loss of only about 50\% in terms of key size for ROLLO-I. |
| Druh dokumentu: | report |
| Jazyk: | English |
| Relation: | hal-02475356; https://hal.archives-ouvertes.fr/hal-02475356; https://hal.archives-ouvertes.fr/hal-02475356v3/document; https://hal.archives-ouvertes.fr/hal-02475356v3/file/article.pdf |
| Dostupnost: | https://hal.archives-ouvertes.fr/hal-02475356 https://hal.archives-ouvertes.fr/hal-02475356v3/document https://hal.archives-ouvertes.fr/hal-02475356v3/file/article.pdf |
| Rights: | info:eu-repo/semantics/OpenAccess |
| Přístupové číslo: | edsbas.88071DEC |
| Databáze: | BASE |
Nájsť tento článok vo Web of Science | Abstrakt: | Rank Decoding (RD) is the main underlying problem in rank-based cryptography. Based on this problem and quasi-cyclic versions of it, very efficient schemes have been proposed recently, such as those in the ROLLO and RQC submissions, which have reached the second round of the NIST Post-Quantum competition. Two main approaches have been studied to solve RD: combinatorial ones and algebraic ones. While the former has been studied extensively, a better understanding of the latter was recently obtained by Bardet et al. (EUROCRYPT20) where it appeared that algebraic attacks can often be more efficient than combinatorial ones for cryptographic parameters. This paper gives substantial improvements upon this attack in terms both of complexity and of the assumptions required by the cryptanalysis. We present attacks for ROLLO-I-128, 192, and 256 with bit complexity respectively in 70, 86, and 158, to be compared to 117, 144, and 197 for the aforementionned previous attack. Moreover, unlike this previous attack, ours does not need generic Gr\"obner basis algorithms since it only requires to solve a linear system. For a case called overdetermined, this modeling allows us to avoid Gr\"obner basis computations by going directly to solving a linear system. For the other case, called underdetermined, we also improve the results from the previous attack by combining the Ourivski-Johansson modeling together with a new modeling for a generic MinRank instance; the latter modeling allows us to refine the analysis of MinRank's complexity given in the paper by Verbel et al. (PQC19). Finally, since the proposed parameters of ROLLO and RQC are completely broken by our new attack, we give examples of new parameters for ROLLO and RQC that make them resistant to our attacks. These new parameters show that these systems remain attractive, with a loss of only about 50\% in terms of key size for ROLLO-I. |
|---|