Chapter

Advances in Cryptology – EUROCRYPT 2010

Volume 6110 of the series Lecture Notes in Computer Science pp 279-298

Algebraic Cryptanalysis of McEliece Variants with Compact Keys

  • Jean-Charles FaugèreAffiliated withSALSA Project - INRIA (Centre Paris-Rocquencourt), UPMC, Univ Paris 06 - CNRS, UMR 7606, LIP6
  • , Ayoub OtmaniAffiliated withSECRET Project - INRIA Rocquencourt, Domaine de Voluceau, B.P. 105GREYC - Université de Caen - Ensicaen, Boulevard Maréchal Juin
  • , Ludovic PerretAffiliated withSALSA Project - INRIA (Centre Paris-Rocquencourt), UPMC, Univ Paris 06 - CNRS, UMR 7606, LIP6
  • , Jean-Pierre TillichAffiliated withSECRET Project - INRIA Rocquencourt, Domaine de Voluceau, B.P. 105

Abstract

In this paper we propose a new approach to investigate the security of the McEliece cryptosystem. We recall that this cryptosystem relies on the use of error-correcting codes. Since its invention thirty years ago, no efficient attack had been devised that managed to recover the private key. We prove that the private key of the cryptosystem satisfies a system of bi-homogeneous polynomial equations. This property is due to the particular class of codes considered which are alternant codes. We have used these highly structured algebraic equations to mount an efficient key-recovery attack against two recent variants of the McEliece cryptosystems that aim at reducing public key sizes. These two compact variants of McEliece managed to propose keys with less than 20,000 bits. To do so, they proposed to use quasi-cyclic or dyadic structures. An implementation of our algebraic attack in the computer algebra system Magma allows to find the secret-key in a negligible time (less than one second) for almost all the proposed challenges. For instance, a private key designed for a 256-bit security has been found in 0.06 seconds with about 217.8 operations.