QC-MDPC: A Timing Attack and a CCA2 KEM

Abstract

In 2013, Misoczki, Tillich, Sendrier and Barreto proposed a variant of the McEliece cryptosystem based on quasi-cyclic moderate-density parity-check (QC-MDPC) codes. This proposal uses an iterative bit-flipping algorithm in its decryption procedure. Such algorithms fail with a small probability.

At Asiacrypt 2016, Guo, Johansson and Stankovski (GJS) exploited these failures to perform a key recovery attack. They introduced the notion of the distance spectrum of a sparse vector and showed that the knowledge of the spectrum is enough to find the vector. By observing many failing plaintexts they recovered the distance spectrum of the QC-MDPC secret key.

In this work, we explore the underlying causes of this attack, ways in which it can be improved, and how it can be mitigated.

We prove that correlations between the spectrum of the key and the spectrum of the error induce a bias on the distribution of the syndrome weight. Hence, the syndrome weight is the fundamental quantity from which secret information leaks. Assuming a side-channel allows the observation of the syndrome weight, we are able to perform a key-recovery attack, which has the advantage of exploiting all known plaintexts, not only those leading to a decryption failure. Based on this study, we derive a timing attack. It performs well on most decoding algorithms, even on the recent variants where the decryption failure rate is low, a case which is more challenging to the GJS attack. To our knowledge, this is the first timing attack on a QC-MDPC scheme.

Finally, we show how to construct a new KEM, called ParQ that can reduce the decryption failure rate to a level negligible in the security parameter, without altering the QC-MDPC parameters. This is done through repeated encryption. We formally prove the IND-CCA2 security of ParQ, in a model that considers decoding failures. This KEM offers smaller key sizes and is suitable for purposes where the public key is used statically.

N. Sendrier—Supported in part by the Commission of the European Communities through the Horizon 2020 program under project number 645622 (PQCRYPTO).

Appendices

A Security Definitions and Games

These standard definitions, used in the security proof for ParQ, have been replicated from [15] for the sake of completeness.

The IND-CCA2 and OW-CPA games take place between two parties, the challenger $\mathcal {C}$, and the attacker or adversary, $\mathcal {A}$.

Game 1

(IND-CCA2 Challenge).

• 1. $\mathcal {C}$ obtains $(pk,sk) \leftarrow \mathsf {ParQ{.}KeyGen}(1^\lambda )$, and sends pk to $\mathcal {A}$. $\mathcal {C}$ runs $\mathsf {ParQ{.}Enc}(s)$ with a uniformly random s, obtaining $K_0, C$. $\mathcal {C}$ then generates a uniformly random $K_1 \in \{0,1\}^\lambda$, and a uniformly random bit $b \in \{0,1\}$. $\mathcal {C}$ then sends C and $K_b$ to $\mathcal {A}$.

• 2. $\mathcal {A}$ may freely send decapsulation queries C to $\mathcal {C}$. $\mathcal {C}$ responds by sending $\mathsf {ParQ{.}Dec}(C)$ to $\mathcal {A}$. The only exception is that $\mathcal {A}$ may not send the challenge encapsulation C as a decapsulation query.

• 3. Eventually, $\mathcal {A}$ must return a bit $b'$ as a guess for the bit b. $\mathcal {A}$ is said to have won the IND-CCA2 game if $b' = b$.

We write $\mathcal {A}$’s ability to win Game 1 as $1/2 + \epsilon$. We call $\epsilon$ the adversary’s advantage in breaking IND-CCA2 security.

Game 2

(OW-CPA Challenge).

• 1. $\mathcal {C}$ generates $(pk,sk) \leftarrow \mathsf {QCMDPC{.}KeyGen}(1^\lambda )$. They select a uniformly random $x \xleftarrow {\$} \{ 0,1\}^k$ and $e \xleftarrow {\$} \{0,1\}^n$, with e having weight t. They then compute $c^* \leftarrow \mathsf {QCMDPC{.}Enc}(pk,x,e)$ and sends $c^*$ and pk to $\mathcal {A}$.

• 2. $\mathcal {A}$ performs some computation on $c^*$ and pk. Eventually they must produce an $x'$. $\mathcal {A}$ is said to have won the OW-CPA game if $x' = x$.

B Choosing the Bit-Flipping Thresholds

In standard literature, rules for threshold computation are heuristic and are not available for all parameter sets. To convince that our experiments were fair we describe the rules we used for fixed and variable threshold. We denote $d=w/2$ the column weight.

Monitoring Strategy: For a given set of parameters, we run the bit-flipping algorithm on many random instances and we choose at each iteration the threshold which minimizes the error weight at the end of all flips¹. This is possible in a simulation because we know the initial error pattern and we can monitor its evolution. We will refer to this as the “monitoring strategy” and use it as a tool to define the thresholds.

Fixed Thresholds: For a given set of parameters, we run a simulation using the monitoring strategy and we keep track of the threshold values used at the first iteration. The maximum of those values is kept as the fixed threshold, say $b_0$, for the first iteration. We run a second simulation, for which the first threshold is fixed to $b_0$ and the monitoring strategy is used for the following iterations. We keep track of the threshold values used at the second iteration. The maximum of those values is kept as the fixed threshold, say $b_1$, for the second iteration. We repeat this until we reach the maximal expected number of iterations.

Variable thresholds: For a given set of parameters, the goal here is to establish a rule $b_i(\sigma )$, $i\ge 0$, giving the i-th iteration threshold as a function of the syndrome weight $\sigma$. Assuming all $b_\ell$ for $\ell <i$ are known, we run a simulation using the functions $b_0,\ldots {},b_{i-1}$ for the first i iterations and using the monitoring strategy after that. We keep track of the pairs $(\sigma ,b)$ of syndrome weights and threshold values used at the i-th iteration. For each syndrome weight $\sigma$, we define $f_i(\sigma )$ as the average of all thresholds observed. Next, using the least square method, we find the quadratic² function $g_i(\sigma )$ which best approximates all the $(\sigma ,f_i(\sigma ))$ where each $(\sigma ,f_i(\sigma ))$ is weighted by the number of occurrences of the syndrome weight $\sigma$. The threshold function for the i-th iteration will be $\lceil g_i(\sigma )\rceil$. We add the condition that $b_i$ is increasing with $\sigma$ and we get $b_i:\sigma \rightarrow \max \left( b_i^{\mathrm {min}},\lceil g_i(\sigma )\rceil \right)$ where $b_i^{\mathrm {min}}$ is the minimal value of $\lceil g_i(\sigma )\rceil$ over the observed range for $\sigma$, and is never smaller than d/2.

Results and Comments. We give below the threshold rules we used for our simulations deduced from the above-mentioned process. Note that we do not claim, nor observed, that those rules are giving any kind of improvement in speed or failure rate.

Fixed Thresholds. For 80-bit security parameters, $(k,w,t)=(4801,90,84)$, we have $(b_i)_{i\ge 0} =(30,28,26,25,23,\ldots {})$. The dots meaning that the last value is repeated as much as necessary. We remark that, for the same parameters, QcBits [13] uses thresholds that are exactly one unit lower for the first 4 iterations. This probably reflects the fact that our strategy is rather conservative.

For 128-bit security, $(k,w,t)=(10163,142,134)$, we get $(b_i)_{i\ge 0} = (46, 43, 41,$ $40, 39, 37, 36,\ldots {})$. Finally for 256-bit security, $(k,w,t)=(32771,274,264)$ we obtain $(b_i)_{i\ge 0} =(83,80,77,74,72,\ldots {})$.

Variable Thresholds.

$$\begin{aligned} \begin{array}{l} (k,w,t)= \\ (4801,90,84) \end{array} \Rightarrow \left\{ \begin{array}{l} b_0(\sigma )=\lceil 11.1+0.00919\,\sigma \rceil \\ b_1(\sigma )=\max (24, \lceil 38.7 - 0.0242 \sigma + 1.004\,10^{-5} \sigma ^2\rceil ) \\ b_i(\sigma )=\max (24, \lceil 34.9 - 0.0195 \sigma + 0.836\,10^{-5} \sigma ^2\rceil ), i\ge 2, \end{array} \right. \end{aligned}$$

$$\begin{aligned} \begin{array}{l} (k,w,t)= \\ (10163,142,134) \end{array} \Rightarrow \left\{ \begin{array}{l} b_0(\sigma )=\lceil 15.5 + 0.00665\, \sigma \rceil \\ b_1(\sigma )=\lceil 51.7 - 0.0128\, \sigma + 0.257\,10^{-5}\sigma ^2\rceil \\ b_i(\sigma )=\max (37, \lceil 40.1 - 0.00395\, \sigma + 9.50\,10^{-7}\sigma ^2\rceil , i\ge 2 \end{array} \right. \end{aligned}$$

$$\begin{aligned} \begin{array}{l} (k,w,t)= \\ (32771,274,264) \end{array} \Rightarrow \left\{ \begin{array}{l} b_0(\sigma )=\lceil 22.9 + 0.00402\, \sigma \rceil \\ b_1(\sigma )=\lceil 18.2 + 0.00431\, \sigma \rceil \\ b_2(\sigma )=\max (71, \lceil 315.8 - 0.0422\, \sigma + 0.182\,10^{-5} \sigma ^2\rceil ) \\ b_i(\sigma )=\max (69, \lceil 62.5 + 0.000648\, \sigma \rceil ), i\ge 3. \end{array} \right. \end{aligned}$$