Table Of Content

Improved code-based identification scheme Pierre-Louis Cayrel Pascal Véron CASED IMATH Mornewegstrasse, 32 Université de Toulon et du Var. 64293 Darmstadt B.P.20132, F-83957 La Garde Cedex, Germany France [email protected] [email protected] 0 1 0 2 n Abstract—Werevisitthe3-passcode-basedidentificationscheme is a three-pass interaction between the prover and the verifier. a proposed by Stern at Crypto’93, and give a new 5-pass protocol Stern’ scheme has two major drawbacks : J for which the probability of the cheater is ≈1/2 (instead of 2/3 1) many rounds are required because the cheater suc- intheoriginal Stern’sproposal).Furthermore, weproposetouse 8 quasi-cyclic construction in order todramatically reduce the size cess probability is 2/3 instead of 1/2 for Fiat-Shamir’s 1 ofthe public key. factorization-based protocol [8], hence typically 27 The proposed scheme is zero-knowledge and relies on an NP- rounds are needed so that this probability be less than R] cSoymndprleotmeepDroebcloedmingcopmroinbglemfro).mTackoidnigngintthoeaocrcyou(nnatmaerlyectehnetsqt-uadryy 2−16, of a generalization of Stern’s information-set-decoding algorithm 2) the public key is very large, typically 66 Kbits. C fordecodinglinearcodesoverarbitraryfinitefieldsFq,wesuggest ThefirstissuewasaddressedbyGaboritandGiraultin[10] . parameters so that the public key be 34Kbits while those of s and the second one was partially adressed by Véron [20]. In c Stern’s scheme is about 66Kbits. This provides a very practical [ identification (and possibly signature) scheme which is mostly this paper, we focus on the first drawback. Using q-ary codes attractive for light-weight cryptography. insteadofbinaryones,wedefinea5passidentificationscheme 1 for which the probability of a cheater is bounded by 1/2. We I. INTRODUCTION v then propose to use quasi-cyclic construction to address the 7 Cryptosystembasedonnumber-theory(problemsoffactori- second drawback. 1 sation and discrete logarithm) is more and more widely used 0 in the real world. After Shor’s algorithm which describes a Organisation of the paper 3 quantum algorithm tosolve inpolynomial timethe twoprevi- In Section II, we give basics facts about code-based cryp- 1. ous problems, there is a strong need for public key schemes tography,wedescribetheoriginalStern’sschemeandpropose 0 whicharenotbasedonsuchproblems.Firstlybecauseitwould in Section III a new identification scheme which permits to 0 beunreasonabletoconsideronlyonetypeofhardproblem.At reducethenumberofroundsinvolvedduringtheidentification 1 thetime,nearlyallpublickeycryptographicproductsarebased process. In Section IV, we describe the properties of our : onintegerfactorizationordiscretelogarithm.Secondly,evenif v proposal and study its security. The Section V concludes our i theabovementioned problemsremainhard, practicalprogress contribution. X in factorization and discrete logarithm computation leads to r choose larger and larger keys. II. CODE-BASEDCRYPTOGRAPHY a The Shor’s algorithm doesn’t threaten the so-called post- In this section we recall basic facts about code-based cryp- quantum cryptosystems as lattice-based, code-based, and tography. We refer to [4], for a general introduction to these multivariate-based cryptosystems. problems. In this paper, we consider a particular type of alternative cryptography, based on error-correcting code theory. Code- A. Definitions based cryptography was initiated a long time ago with the Linear codes are k-dimensional subspaces of an n- celebrated McEliece encryption algorithm. Publickeyidentification(ID)protocolsallowapartyholding dimensional vector space over a finite field Fq, where k and n are positive integers with k < n, and q is a prime power. a secret key to prove its identity to any other entity holding Theerror-correctingcapabilityofsuchacodeisthemaximum the corresponding public key. The minimum security of such number t of errors that the code is able to decode. In short, protocolsshouldbethatapassiveobserverwhoseestheinter- linearcodeswiththeseparametersaredenoted(n,k,t)-codes. action should not then be able to perform his own interaction and successfully impersonate the prover. At Crypto’93, Stern proposed a new scheme, which is still Definition II.1 (Hamming weight) The(Hamming)weightof today the reference in this area [18]. The Stern’s scheme is avectorx isthenumber of non-zero entries. Weusewt(x)to a multiple round zero-knowledge protocol, where each round represent the Hamming weight of x. Definition II.2 (Generator and Parity Check Matrix) Let B. SD identification schemes C be a linear code over Fq. A generator matrix G of C is a Stern’s scheme is the first practical zero-knowledge matrix whose rows form a basis of C: identification scheme based on the Syndrome Decoding C ={xG:x∈Fk}. problem[18].Theschemeusesabinary(n−k)×nmatrixH q common toallusers. If H ischosen randomly, itwillprovide A parity check matrix H of C is defined by a parity check matrix for a code with asymptotically good minimum distance given by the (binary) Gilbert-Varshamov C ={x∈Fnq :HxT =0} (GV) bound. The private key for a user will thus be a word and generates the dual space of C. s of low weight wt(s)= ω (with H2(ω)≈1−k/n), which sums up to the syndrome HsT = y, the public key. By Stern’s 3-pass zero-knowledge protocol, the secret key holder Wedescribeherethemainhardproblemsonwhicharebased can prove his knowledge of s using two blending factors: the code-based cryptosystems. a permutation and a random vector. However, a dishonest Letnandrbetwointegerssuchthatn≥r,Binary(n,r)(resp. prover not knowing s can cheat the verifier in the protocol q−ary(n,r)) be the set of binary (resp. q-ary) matriceswith withprobability 2/3. Thus, the protocol has to be run several n columns and r rows of rank r. Moreover, let us denote by x←R A, the fact that x is randomly selected in the set A. times to detect cheating provers. The security of the scheme reliesonthedifficultyofthegeneraldecodingproblem,thatis on the difficulty of determining the preimage s of y=HsT. Definition II.3 (binary Syndrome Decoding (SD) problem) As mentioned in [3], the SD problem, stated in terms of generator matrix is also NP-complete since one can go from Input : H ←R Binary(n,r), y ←R Fr2 and an integer the parity-check to the generator matrix (or vice-versa) in ω>0. polynomialtime.In[20],theauthorusesageneratormatrixof Ouput: A word s∈Fn2 such that wt(s)≤ω, HsT =y. arandom linear binary as the public key and defines thisway a dual version of Stern’s scheme in order to obtain, among This problem was proven to be NP-complete in 1978 [3], but other things, an improvement of the transmission rate. only for binary codes. Figure 1 sums up the performances of the two 3-pass SD Definition II.4 (q-ary Syndrome Decoding (qSD) problem) identification schemes for a probability of cheating bounded by 10−6. The computation complexity is the number of bits Input : H ←R q−ary(n,r), y ←R Fr and an integer operation involved by the protocol and the communication q ω>0. complexity the number of exchanged bits. Ouput: A word s∈Fn such that wt(s)≤ω, HsT =y. q SD G-SD In 1994, A. Barg proved that this result holds for codes over Rounds 35 35 all finite fields [1, in russian]. Public data (bits) 66048 66816 Computation complexity 222.13 222.5 The problems which cryptographic applications rely upon Communication complexity 40133 34160 can have different numbers of solutions. For example, public key encryption schemes usually have exactly one solution, Fig.1. Performances ofSDschemes while digital signatures often have more than one possible solution. For code-based cryptosystems, the uniqueness of C. Attacks solutions can be expressed by the Gilbert-Varshamov (GV) bound : For SD identification schemes, since the matrix used is a random one, the cryptanalyst is faced to the problem of decoding a random binary linear code. There are two main Definition II.5 (q-ary Gilbert-Varshamov bound) families of algorithms to solve this problem : Information Set Let Hq(x) be the q-ary entropy function, given by : Decoding(ISD)and(Generalized)BirthdayAlgorithm(GBA). Hq(x)=xlo˙gq(q−1)−xlo˙gqx−(1−x)lo˙gq(1−x). TheInformation-Set-DecodingAttackseemstohavethelowest complexity. Suppose 0 ≤ δ ≤ (q−1)/q. Then there exists an infinite Onetriestorecover the k information symbols as follows: sequence of (n,k,d) q-ary linear codes with d/n = δ and thefirststepistopickk of thencoordinates randomlyinthe rate R=k/n satisfying the inequality : hope that all of them are errors free. Try then to recover the messagebysolvingak×k linear system(binaryoroverFq). R≥1−Hq(δ) ∀n. In [15], the author presents a generalization of Stern’s information-set-decoding algorithm from [17] for decoding linear codes over arbitrary finite fields F and analyzes the q complexity.Wewillchooseourparameterswithregardstothe Algorithm 2 Identification Scheme complexity of this attack. Private key, sk: s∈Fn such that HsT =y and wt(s)= q ω. III. ANEWIDENTIFICATIONSCHEME Public key, pk: H a (n−k×n) random matrix of rank ofIsnizweh⌈altogfo2l(lqo)w⌉s,=wNe .coWnseidreerpraenseenltemeaecnht eolfemFnqenatsonf Fbqlocass nFnq−−kkaonvderωFq∈,Nhacollisionresistancehashfunction, y∈ N bits.Wefirstintroduceaspecialtransformationthatwewill ⊲Prover:generatesavectoru∈Fnq,avectorγ ∈Fnq∗ and use in our protocol. apermutationΣover{1,...,n}atrandomandcomputes the commitments : γDe=fin(itγi1o,n..I.II,.γ1n)Le∈t ΣFnqbesucahptehramtu∀tai,tiγoin6=of0{.1W,.e.d.,enfin}eatnhde 21:: SSeett cc12 ←←hh(cid:0)(ΠΣγ,,γΣ,(Hu)u,TΠ(cid:1)γ,Σ(s)) transformation Π as : γ,Σ 3: Sends the commitments {c1,c2} to the Verifier. Πγ,Σ : Fnq −→ Fnq ⊲ Verifier: chooses a random α ∈ Fq and sends it to the v 7→ (γ v ,...,γ v ) Prover. Σ(1) Σ(1) Σ(n) Σ(n) ⊲ Prover: sends Πγ,Σ(u+αs)=β ∈Fnq to the Verifier. ⊲ Verifier: sends a challenge b∈{0,1} to the Prover. Notice that ∀α∈Fq, ∀v∈Fnq, ⊲ Prover: answers the challenge 4: if b=0 then reveals Σ and γ. Πγ,Σ(αv)=αΠγ,Σ(v) and wt(Πγ,Σ(v))=wt(v). 5: else if b=1 then reveals Πγ,Σ(s). A. Key generation 6: end if Letr=n−k,theschemeusesarandom(r×n)q-arymatrix ⊲ Verifier: checks commitment correctness H common to all users. It can be considered as the parity 7: if b =0 then checks if c1 = h(Σ,γ,HΠ−γ,1Σ(β)T −αy) check matrix of a random linear (n,k) q-ary code. Without is correct loss of generality, we can assume that H is given under the 8: else if b = 1 then checks if c2 = h(β − form H =(Ir|M) where M is a random r×r matrix, since αΠγ,Σ(s),Πγ,Σ(s)) is correct and if wt(Πγ,Σ(s))=ω. it is well known that a Gaussian elimination doesn’t change 9: end if the code generated by H. Let κ be the security parameter, algorithm 1 describes the key generation process. with wt(z) = ω. Which gives β − β′ = (α− α′)z and Algorithm 1 Key generation(1κ) HΠ−1(β−β′)T =(α−α′)y.WethendeduceHΠ−1(z)T = γ,Σ γ,Σ ⊲ Choose n,k,ω and q such that WFISD(n,r,ω,q)≥2κ y and wt(Π−γ,1Σ(z))=wt(z)=ω. ⊲ Randomly pick a (r×n) q-ary matrix H. Hence the success probability of a cheater is bounded by ⊲ Randomly pick s∈Fn with wt(s)=ω. q+1. q 2q ⊲ Compute y such that HsT =y. C. Signature ⊲ Output : pk =(H,y,ω) and sk = s. By using the so-called Fiat-Shamir paradigm [8], it is theoretically possible to convert this protocol into a signature B. Identification scheme, even if it is practically questionable, since the signature is large. The secret key holder can prove his knowledge of s using twoblendingfactors:thetransformationabovementionnedand IV. PROPERTIESANDSECURITYOFTHESCHEME a random vector. However, a dishonest prover not knowing s A. Zero-knowledge can cheat the verifier in the protocol with probability ≈ 1/2. Thus,theprotocolhastoberunseveraltimestodetectcheating Let I = (H,y,ω) be the public data shared by the prover provers. The security of the scheme relies on the difficulty and the verifier and let P(I,s) be the following predicate : of the general decoding problem, that is on the difficulty of P(I,s)= “s isavector which satisfiesHsT =y,wt(s)= determining the preimage s of y=HsT. ω” then : This protocol is repeated δ times. A cheater has, once c 1 and c2 sent, to be able to answer to 2q possible questions. If Proposition IV.1 The protocol is an interactive proof of heisonly abletoanswer toq+2questions thenheisableto knowledge for P(I,s). find a solution to the problem. Indeed, let us denote by z the value sent when b = 1, for c and c fixed, this means that Due to the limited size of this paper we don’t detail this 1 2 there exist α and α′ distinct and β and β′ such that : proposition here. HΠ−1(β)T −αy=HΠ−1(β′)T −α′y γ,Σ γ,Σ Theorem IV.1 The protocol is a zero-knowledge interactive ′ ′ β−αz =β −αz proof for P(I,s) in the random oracle model. Wewilldetailthistheoreminalongerversionofthisarticle. same level of security and a probability of cheating of 2−16. However, notice that because of the randomness of u and α We considered that all seeds used are of length 128. only random values are exchanged during the protocol. B. Security and Parameters SD G-SD Our scheme Rounds 27 27 16 Like binaries SD identification schemes, security of our Publicdata(bits) 123200 124250 33792 schemereliesonthreepropertiesofrandomlinearq-arycodes: Communication(bits) 37872 31572 30848 1) Randomlinearcodessatisfytheq-aryGilbert-Varshamov Computation 222.7 223.1 212.1mult+ lower bound [11]; (bits. op) (bits. op) 211.3add 2) For large n almost all linear codes lie over the Gilbert- (bytes op.) Varshamov bound [16]; 3) Solving the q-ary syndrome decoding problem for ran- Fig.2. SDschemesvs.q-arySDscheme dom codes is NP-complete [1]. To obtain a security level of 2128 suggested parameters are Now taking into account the bounds on the workfactor of the Information Set Decoding algorithm over Fq given in [14] q=256,n=208,k=104,wt(s)=78 (and which generalizes the bounds given in [9]) we have to set up parameters in order to obtain a practical scheme which gives a scheme with the following properties : with a security level greater or equal than 280. We have then to choose the number of rounds in order to minimize the Rounds : 16 probability of success of a cheater. Public data (bits) : 88192 Communication (bits) : 46224 Since we deal with random codes, we have to select Computation (bytes op.) : 212.9mult. and 211.5add. parameters with respect to the Gilbert-Varshamov bound (see Definition II.5), i.e. choose a weight ω with respect to this Notice that in [18], Stern has proposed two 5 pass variant bound. Moreoverasusualwewillnowsupposek=r=n/2. of his scheme : one to minimize the computing load and the Let N be the number of bits needed to encode an element other one to lower the number of rounds. However, for these of Fq, ℓh the output size of the hash function h, ℓΣ (resp. twovariants,thesizeofthepublicdataandthecommunication ℓγ) the size of the seed used to generate the permutation Σ complexityaregreater thantheoneofour scheme .Aprecise (resp.thevectorγ) and δ the number of rounds. We have the comparison for the computation complexity willbe made ina following properties for our scheme : longer version of this paper. C. Reducing public key size Size of the public data in bits : 1) Quasi-cyclic construction: In [10], the authors propose k×k×N +nN(we use the systematic form of H) a variation of the Stern identification scheme by using double circulant codes. The circulant structure of the public matrix Total number of bits exchanged : makes the computation very easy without having to generate δ(2ℓh+N+nN +1+(ℓΣ+ℓγ+nN)/2) thewholebinarymatrix, indeed thewholeschemeonly needs veryfewmemorystorage.Theyproposeaschemewithapublic Computation complexity over F : q key of size 347 bits and a private key of size 694 bits. Wecanusethisconstructioninourcontextbyreplacingthe δ(k+n+2wt(s) multiplications+k+wt(s) additions) random q-ary matrix H by a random q-ary double circulant To obtain a precise complexity on the workfactor of matrix. ISD algorithms over Fq we’ve used the code developped 2) Quasi-dyadic construction: We can also imagine a con- by C. Peters which estimates (using a Markov chain struction based on quasi-dyadic codes as proposed in [13]. implementation)thenumberofiterationsofthebestalgorithm Recentlyseveralnewstructuralattacksappearedin[19]and for an attack using all possible known tricks [15]. ISD [7] that extract the private key of some parameters of the algorithmsdependonasetofparametersandthiscodeallows variants presented in [2] and [13]. But in our context we deal to test which ones can minimize the complexity of the attack. withrandomcodesandwearethreatenbythiskindofattacks. Furthermorein[6] theauthors describe asecureimplemen- We suggest to use for our scheme : tation of the Stern scheme using quasi-circulant codes. Our proposal inherits of the good properties of the original Stern q=256,n=128,k=64,wt(s)=49. schemefacetoleakageofinformationasSPAandDPAattacks. The complexity of an attack using ISD algorithms is then at The parameters using quasi-cyclic or quasi-dyadic randoms least287.ForthesamesecuritylevelinSDschemes,weneed codes are q =256,n=128,k =64,wt(s)=49 this gives a to take n = 700,k = 350,wt(s) = 75. Table 2 sums up the publickeyof512bitsandaprivatekeyof1024bitsforalmost characteristics of our scheme and those of SD schemes for a the same complexity for an ISD attack. 3) Embeddingthesecretinthematrix: Infactitispossible [12] C. Aguilar Melchor, P.-L. Cayrel, and P. Gaborit. A new to still decrease the sizes obtained in the previous subsection. efficientthresholdringsignatureschemebasedoncodingtheory. In Post-quantum cryptography, second international workshop, The idea (from [10]) consists in embedding the secret key x PQCrypto 2008, volume 5299 of Lecture Notes in Computer inthepublicmatrix.Toachievethat,weconsiderthesecretas Science, pages1–16.editors :J.BuchmannandJ.Ding. a word of the dual code of the code generated by the public [13] R. Misoczki and P. S. L. M. Barreto. Compact mceliece keys matrixH.Thismeans thatwewilluseanull syndrom, which fromgoppacodes. InSelectedAreasinCryptography–SAC’09, does not change the zero-knowledge property. We will detail Proceedings, Calgary, Canada, 2009. [14] R. Niebuhr and P. L. Cayrel. Generalizing information set this improvement in a longer version of this paper. decoding and the (generalized) birthday attack to q-ary codes. Inpreprint, 2009. V. CONCLUSION [15] C.Peters. Information-set decoding forlinear codes overfq. In We have defined an identification scheme which among all Cryptology ePrintArchive,Report2009/589, 2009. theschemesbasedontheSDproblemhasthebestparameters [16] J. N. Pierce. Limit distributions of the minimum distance of random linear codes. In IEEE Trans. Inf. theory, volume 13, forthesizeofthepublicdataaswellasforthecommunication pages595–599, 1967. complexity. Moreover, we have proposed a variant so as to [17] J. Stern. A method for finding codewords of small weight. In reduce the size of the public data. Proc.ofCodingTheoryandApplications,pages106–113,1989. The improvement proposed here to the Stern scheme can [18] J. Stern. A new identification scheme based on syndrome be applied to all the Stern-based identification and signature decoding. LectureNotesinComputerSciencevol.773Springer 1993:13–21, 1993. schemes (as identity-based identification and signature [5] or [19] V. Gauthier Umana and G. Leander. Practical key threshold ring signature [12] for example). recovery attacks on two McEliece variants. 2009. Webelieve that thistype of scheme isarealisticalternative http://eprint.iacr.org/2009/509.pdf. to the usual number theory identification schemes in the [20] P. Véron. Improved identification schemes based on error- correcting codes. Appl. Algebra Eng. Commun. Comput., case of constrained environments such as smart cards and of 8(1):57–69, 1996. applications such as Pay-TV or vending machines. ACKNOWLEDGMENT The authors want to thank Robert Niebuhr and Philippe Gaboritfortheircommentsduringthepreparationofthispaper and Christiane Peters for comments on her code. REFERENCES [1] S. Barg. Some new np-complete coding problems. Probl. PeredachiInf.,30:23–28,1994. [2] T.P.Berger, P.-L.Cayrel, P.Gaborit, andA.Otmani. Reducing key length ofthe McEliece cryptosystem. InProgress inCryp- tology – Africacrypt’2009, Lecture Notes in Computer Science, pages77–97.Springer, 2009. [3] E.Berlekamp,R.McEliece,andH.vanTilborg. Ontheinherent intractability ofcertain coding problems. IEEETransactions on Information Theory,24(3):384–386, 1978. [4] D. J. Bernstein, J. Buchmann, and E. Dahmen. Post-Quantum Cryptography. Springer, 2008. [5] P.-L. Cayrel, P. Gaborit, and M. Girault. Identity-based identification and signature schemes using correcting codes. In International Workshop on Coding and Cryptography, WCC 2007,pages69–78.editors:Augot,D.,Sendrier,N.,andTillich, J.-P. [6] P.L.Cayrel,P.Gaborit,andE.Prouff. Secureimplementationof the stern authentication and signature schemes for low-resource devices. CARDIS,2008. [7] J.-C.Faugère, A.Otmani, L.Perret, andJ.-P.Tillich. Algebraic cryptanalysis ofMcEliece variants withcompact keys. 2009. [8] A. Fiat and A. Shamir. How to prove yourself practical solutions to identification and signature problems. Springer LNCS 263:186–194, 1987. [9] M. Finiasz and N. Sendrier. Security bounds for the design of code-basedcryptosystems. IntoappearinAdvancesinCryptol- ogy–Asiacrypt’2009, 2009. http://eprint.iacr.org/2009/414.pdf. [10] P.GaboritandM.Girault.Lightweightcode-basedauthentication andsignature. InIEEEInternationalSymposiumonInformation Theory–ISIT’2007,pages 191–195,Nice,France, 2007.IEEE. [11] F. J. MacWilliams and N. J. A. Sloane. The theory of error correcting codes. InNorth-Holland, 1977.