Structural cryptanalysis of McEliece schemes with compact keys

Abstract

A very popular trend in code-based cryptography is to decrease the public-key size by focusing on subclasses of alternant/Goppa codes which admit a very compact public matrix, typically quasi-cyclic ($\mathrm{QC}$), quasi-dyadic ($\mathrm{QD}$), or quasi-monoidic ($\mathrm{QM}$) matrices. We show that the very same reason which allows to construct a compact public-key makes the key-recovery problem intrinsically much easier. The gain on the public-key size induces an important security drop, which is as large as the compression factor $p$ on the public-key. The fundamental remark is that from the $k\times n$ public generator matrix of a compact McEliece, one can construct a $k/p \times n/p$ generator matrix which is—from an attacker point of view—as good as the initial public-key. We call this new smaller code the folded code. Any key-recovery attack can be deployed equivalently on this smaller generator matrix. To mount the key-recovery in practice, we also improve the algebraic technique of Faugère, Otmani, Perret and Tillich (FOPT). In particular, we introduce new algebraic equations allowing to include codes defined over any prime field in the scope of our attack. We describe a so-called “structural elimination” which is a new algebraic manipulation which simplifies the key-recovery system. As a proof of concept, we report successful attacks on many cryptographic parameters available in the literature. All the parameters of CFS-signatures based on $\mathrm{QD}$/$\mathrm{QM}$ codes that have been proposed can be broken by this approach. In most cases, our attack takes few seconds (the hardest case requires less than 2 h). In the encryption case, the algebraic systems are harder to solve in practice. Still, our attack succeeds against several cryptographic challenges proposed for $\mathrm{QD}$ and $\mathrm{QM}$ encryption schemes. We mention that some parameters that have been proposed in the literature remain out of reach of the methods given here. However, regardless of the key-recovery attack used against the folded code, there is an inherent weakness arising from Goppa codes with $\mathrm{QM}$ or $\mathrm{QD}$ symmetries. Indeed, the security of such schemes is not relying on the bigger compact public matrix but on the small folded code which can be efficiently broken in practice with an algebraic attack for a large set of parameters.

Appendices

Appendix 1: A toy example of folding

We build a QM binary Goppa code with parameters $n=28$, $m=5$ and $t=2^2=4$ ($\lambda =2$) built according to Theorem 2. We work in $\mathbb {F}_{2^5}=\frac{\mathbb {F}_2[\omega ]}{(\omega ^5+\omega ^2+1)}$. To build the support $\varvec{x}$ we pick

$$\begin{aligned} (x_{4i})_{0\leqslant i \leqslant 6}=(0,\omega ^{26}, \omega ^{8},\omega ^{14}, \omega ^{16}, \omega ^{11}, \omega ^{27}) \end{aligned}$$

and $\alpha _{0}=\omega ^{17},\alpha _1=1$. Then, we apply Eq. 4: for $0\leqslant j \leqslant 3$, $x_{4i+j}=x_{4i}+j_1\alpha _1+j_0\alpha _0$, with $j=2j_1+j_0$ (and $j_1,j_0\in \{0,1\}$), so that we obtain

$$\begin{aligned}&\varvec{x}= ( 0, \omega ^{17}, 1, \omega ^{30}, \omega ^{26}, \omega ^{2}, \omega ^{28}, \omega ^{5}, \omega ^{8}, \omega ^{24}, \omega ^{20}, \omega ^{15}, \omega ^{14}, \omega ^{12}, \omega ^{13}, \omega ^{23}, \omega ^{16}, \omega ^{3}, \omega ^{9},\\&\qquad \quad \omega ^{29}, \omega ^{11}, \omega ^{7},\omega ^{19}, \omega ^{22}, \omega ^{27}, \omega ^{21}, \omega ^{6}, \omega ^{25} ). \end{aligned}$$

We pick a Goppa polynomial such that the multipliers are constant over each block of size $t_2=4$ (Eq. 5 with $\gamma (z)=z$):

$$\begin{aligned} \varGamma (z)= z(z+\alpha _1)(z+\alpha _0)(z+\alpha _0+\alpha _1)+\omega ^{2}=z^4 + \omega ^{9}z^2 + \omega ^{16}z + \omega ^{2}. \end{aligned}$$

The corresponding multipliers are:

$$\begin{aligned}&\varvec{y}=( \omega ^{29}, \omega ^{29}, \omega ^{29}, \omega ^{29}, \omega ^{3}, \omega ^{3}, \omega ^{3}, \omega ^{3}, 1, 1, 1, 1, \omega ^{26}, \omega ^{26}, \omega ^{26}, \omega ^{26},\\&\qquad \quad \omega ^{14}, \omega ^{14}, \omega ^{14}, \omega ^{14}, \omega , \omega , \omega , \omega , \omega ^{5}, \omega ^{5}, \omega ^{5}, \omega ^{5}). \end{aligned}$$

Then, the code $\fancyscript{C}_2=\fancyscript{A}_{t}(\varvec{x},\varvec{y})=\fancyscript{G}(\varvec{x},\varGamma (z))$ has automorphism group

$$\begin{aligned} \mathrm{Aut}(\fancyscript{C}_2)=\{\sigma _\ell :i \mapsto i\ominus \ell ,0\leqslant \ell \leqslant 3\}. \end{aligned}$$

It admits as generator matrix $G^{(2)}$:

Now we fold the quasi-monoidic code $\fancyscript{C}_2$. The generator matrix of $\overline{\fancyscript{C}_2^{\sigma _1}}$ is deduced without knowing the private elements $\varvec{x}$ and $\varvec{y}$. One only needs to sum up the coefficients of the generator matrix corresponding to each orbit of $\sigma _1$ (that is, the subsets of the code positions of the form $\{2i,2i+1\}$):

Thanks to Theorem 3, we known that $\overline{\varvec{G}}^{(1)}$ generates a Goppa code $\fancyscript{C}_1=\fancyscript{A}_{2}(\overline{\varvec{x}}^{(1)},\overline{\varvec{y}}^{(1)})=\fancyscript{G}(\overline{\varvec{x}}^{(1)},\varGamma _1(z))$ defined by the following vectors and Goppa polynomial:

$$\begin{aligned} \overline{\varvec{x}}^{(1)}&= ( 0, \omega ^{30}, \omega ^{28}, \omega ^{2}, \omega , \omega ^{4}, \omega ^{26}, \omega ^{5}, \omega ^{19}, \omega ^{7}, \omega ^{18}, \omega ^{10}, \omega ^{17}, 1), \\ \overline{\varvec{y}}^{(1)}&= (\omega ^{29}, \omega ^{29}, \omega ^{3}, \omega ^{3}, 1, 1, \omega ^{26}, \omega ^{26}, \omega ^{14}, \omega ^{14}, \omega , \omega , \omega ^{5}, \omega ^{5}),\\ \varGamma _1(z)&= z^2 + \omega ^{30}z + \omega ^{2}. \end{aligned}$$

In our example, the order of symmetry introduced in $\fancyscript{C}_2$ was $2^2$, as $\varvec{x}$ satisfies both relations $x_{\sigma _1(i)}=x_i+\alpha _0$ and $x_{\sigma _2(i)}=x_i+\alpha _1$ (and $\varGamma (z+\alpha _1)= \varGamma (z+\alpha _0)=\varGamma (z)$). In this case, $\overline{\varvec{x}}^{(1)}$ satisfies $\overline{x}_{i\ominus 1}^{(1)}=\overline{x}_{i}^{(1)}+\alpha _1^2-\alpha _0\alpha _1$. This shows that $\overline{\fancyscript{C}_2^{\sigma _1}}$ can still be folded ! As this second symmetry is inherited from the code position permutation $\sigma _2$ of $\fancyscript{C}_2$, we denote by $\overline{\fancyscript{C}_2^{\sigma _2,\sigma _1}}$ the resulting code. Its generator matrix can be obtained either by summing the coefficients of $\overline{\varvec{G}}^{(1)}$ over the orbits $\{2i,2i+1\}$, or directly on the matrix $\varvec{G}^{(2)}$, by considering the orbits $\{4i,4i+1,4i+2,4i+3\}$:

$$\begin{aligned} \overline{\varvec{G}}^{(0)}=\left( \begin{array}{cccccccc} 1 &{} 0 &{} 1 &{} 1 &{} 1 &{} 1 &{} 0 \\ 0 &{} 1 &{} 0 &{} 1 &{} 1 &{} 1 &{} 0 \\ \end{array}\right) . \end{aligned}$$

Then, thanks to Theorem 3, we know that $\overline{\varvec{G}}^{(0)}$ is a Goppa code, $\fancyscript{C}_0=\fancyscript{A}_{1}(\overline{\varvec{x}}^{(0)},\overline{\varvec{y}}^{(0)})=\fancyscript{G}(\overline{\varvec{x}}^{(0)},\varGamma _0(z))$ with private elements:

$$\begin{aligned} \overline{\varvec{x}}^{(0)}&= (0, \omega ^{30}, \omega ^{5}, 1, \omega ^{26}, \omega ^{28}, \omega ^{17}),\\ \overline{\varvec{y}}^{(0)}&= (\omega ^{29}, \omega ^{3}, 1, \omega ^{26}, \omega ^{14}, \omega , \omega ^{5}),\\ \varGamma _0(z)&= z + \omega ^{2}. \end{aligned}$$

Appendix 2: Proof of Theorem 4

We recall that a central tool in the construction of $\mathrm{QM}$ codes is the sequence of $\mathbb {F}_p$-independent elements $\alpha _0,\ldots ,\alpha _{\lambda -1} \in \mathbb {F}_{q^m}$ (Theorem 3). They generate a group $G$ of size $p^\lambda$ whose elements are defined for $\ell \in [0,\ldots ,p^\lambda -1]$ by $g_\ell =\sum _{j=0}^{\lambda -1} \ell _j \alpha _j$, $\ell =\sum _{j=0}^{\lambda -1} \ell _j p^j$ the decomposition in base $p$ of $\ell$. The support is chosen so as to satisfy Eq. 4. An example of resolution of 4 is in [42], Algorithm $1$] and [5], Algorithm $3$] (by setting $\alpha _i=h_{a_i}^{-1}+\omega$). Then, the Goppa polynomial is derived from its roots $A$ that are picked in $G$. The case $t=p^\lambda$ corresponds to a Goppa polynomial $\varGamma (z)$ whose roots $A$ are all the elements of $G$. The fact that its roots form a group is the crucial point for proving Eq. 5, and to exhibit the structure of the automorphism group. The cases where $t\not =p^\lambda$ are those when $A$ is a sub-set of $G$ (and not a sub-group). The associated Goppa code is not stable by the expected permutations $\sigma _\ell$ (as defined in Proposition 1), so folding the code is not possible any more. So, the idea is to select a subspace of the codewords that is stable by more permutations. This is formalized by the following statement:

Lemma 1

Let $\alpha _0,\ldots ,\alpha _{\lambda -1} \in \mathbb {F}_{q^m}$ as in Theorem 2, whose linear combinations (with scalars in $\mathbb {F}_p$) form the set $G=\{g_0,\ldots ,g_{p^\lambda -1}\}$. Let $A=\{g_0,\dots ,g_{t-1}\}$ be a subset of $G$. Let $\varvec{x}$ be built thanks to the $\alpha _i$’s according to 4. As a consequence, each $g\in G$ corresponds to an offset $0 \leqslant j_g < p^\lambda$ of the indices on the support such that $x_{i \oplus j_g}=x_i+g$ for all $i,0\leqslant i \leqslant n-1$. The public code is defined by $\fancyscript{C}^{(t)}_{pub}=\fancyscript{G}\big (\varvec{x},\underset{g\in A}{\prod }(z-g)\big )$, and we define $\fancyscript{C}^{(p^\lambda )}=\fancyscript{G}\big (\varvec{x},\underset{g\in G}{\prod }(z-g)\big )$. It holds that:

$$\begin{aligned} \varvec{c}\in \fancyscript{C}^{(p^\lambda )} \iff \forall g \in G, \varvec{c}^{\sigma _{j_g}} \in \fancyscript{C}^{(t)}_{pub}. \end{aligned}$$

Proof

Let $g\in G$. Recall the relation $P_{\varvec{c}^{\sigma _{j_g}} ,\varvec{x}}(z)=P_{\varvec{c},\varvec{x}}(z-g)$, proven in the proof of Proposition 2. We have

$$\begin{aligned} \begin{array}{rcl} \varvec{c}^{\sigma _{j_g}} \in \fancyscript{C}^{(t)}_{pub} &{} \iff &{} \underset{a\in A}{\prod }(z-a) | P_{\varvec{c}^{\sigma _{j_g}} ,\varvec{x}}(z)\\ &{} \iff &{} \underset{a\in A}{\prod }(z-a) | P_{\varvec{c},\varvec{x}}(z-g)\\ &{} \iff &{} \underset{a\in A}{\prod }(z+g-a) | P_{\varvec{c},\varvec{x}}(z)\\ &{} \iff &{} \underset{a\in A-g}{\prod }(z-a) | P_{\varvec{c},\varvec{x}}(z)\\ \end{array} \end{aligned}$$

As all the elements of $G$ are pairwise distinct, the polynomials $(z-a)$ are coprime. The least common multiple of all the polynomials $\underset{a\in A-g}{\prod }(z-a)$ is $P=\prod _{g \in G} (z - g)$. So, we conclude,

$$\begin{aligned} \begin{array}{rcl} \forall g \in G,\varvec{c}^{\sigma _{j_g}} \in \fancyscript{C}^{(t)}_{pub} &{} \iff &{}\forall g \in G\underset{A\in A-g}{\prod }(z-g) | P_{\varvec{c},\varvec{x}}(z)\\ &{} \iff &{} \prod _{g \in G} (z - g) | P_{\varvec{c},\varvec{x}}(z)\\ &{} \iff &{} \varvec{c}\in \fancyscript{C}^{(p^\lambda )}. \end{array} \end{aligned}$$

The lemma permits to deduce a parity-check matrix of $\fancyscript{C}^{(p^\lambda )}$ from any parity-check matrix $\varvec{H}$ of $\fancyscript{C}^{(t)}_{pub}$. Indeed, observe that for any row $\mathbf h$ of $\varvec{H}$ and any permutation $\sigma$ of the indices:

$$\begin{aligned} \begin{array}{rcl} \varvec{c}^{\sigma }\in \fancyscript{C}^{(t)}_{pub} &{} \iff &{} \sum _{i=0}^{n-1}c_{\sigma (i)}h_{i}=0 \\ &{} \iff &{} \sum _{i=0}^{n-1}c_{i}h_{\sigma ^{-1}(i)}=0 \\ \end{array} \end{aligned}$$

To ensure that a word $\varvec{c}$ and all its permuted words $c^{\sigma _{j_g}}$ for $g\in G$ belong to $\fancyscript{C}^{(t)}_{pub}$, it suffices to permute the rows of $\varvec{H}$ according to all the $\sigma _g$’s with $g\in G$ and concatenate the obtained matrices. This is precisely what the function $\Delta _{p^\lambda }$ does for a group $G$ of size $p^\lambda$. $\square$