A New Analysis of the McEliece Cryptosystem Based on QC-LDPC Codes

Abstract

Abstract. We improve our proposal of a new variant of the McEliece cryptosystem based on QC-LDPC codes. The original McEliece cryptosystem, based on Goppa codes, is still unbroken up to now, but has two major drawbacks: long key and low transmission rate. Our variant is based on QC-LDPC codes and is able to overcome such drawbacks, while avoiding the known attacks. Recently, however, a new attack has been discovered that can recover the private key with limited complexity. We show that such attack can be avoided by changing the form of some constituent matrices, without altering the remaining system parameters. We also propose another variant that exhibits an overall increased security level. We analyze the complexity of the encryption and decryption stages by adopting efficient algorithms for processing large circulant matrices. The Toom-Cook algorithm and the short Winograd convolution are considered, that give a significant speed-up in the cryptosystem operations.

Algebraic Cryptanalysis of McEliece Variants with Compact Keys

“…The complexity of computing G lex from G deg with FGLM is polynomial in the size of V , i.e. O (#V ) 3 . In our case, the size of V is very small (< 10).…”

“…After more than thirty years now, it still belongs to the very few public key cryptosystems which remain unbroken. Following McEliece's pioneering work, several different public key cryptosystems based on the intractability of decoding a linear code have been proposed [28,20,31,23,7,6,4,3,5,27]. The original McEliece cryptosystem relies on Goppa codes whereas its variants suggested to use different codes.…”

Overview of the Mceliece Cryptosystem and its Security

“…The binary Goppa code C with Goppa polynomial g and support L is defined as a set of binary vectors c ∈ GF (2) n (indexed by elements of L), for which…”

Polynomial Time Attack on Wild McEliece over Quadratic Extensions

“…Several proposals which suggested to replace binary Goppa codes with alternative families did not meet a similar fate. They all focus on a specific class of codes equipped with a decoding algorithm: generalized Reed-Solomon codes (GRS for short) [Nie86] or large subcodes of them [BL05], Reed-Muller codes [Sid94], algebraic geometry codes [JM96], LDPC and MDPC codes [BBC08,MTSB13] or convolutional codes [LJ12,GSJB14]. Most of them were successfully cryptanalyzed [SS92, Wie10, MS07, FM08, OTD10, CGG + 14, LT13,CMCP14b,COTG15].…”

“…Each time a description of the underlying code suitable for decoding is efficiently obtained. But some of them remain unbroken, namely those relying on MDPC codes [MTSB13] and their cousins [BBC08], the original binary Goppa codes of [McE78] and their non-binary variants as proposed in [BLP10,BLP11].…”