Cryptanalysis of the McEliece Public Key Cryptosystem Based on Polar Codes

Bardet, Magali; Chaulet, Julia; Drăgoi, Vlad; Otmani, Ayoub; Tillich, Jean–Pierre

doi:10.1007/978-3-319-29360-8_9

Cited by 43 publications

(32 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Both properties turned to be essential to attack [19] the McEliece system based on polar codes [20]. It might be interesting to use the fact that the permutation group is so large in order to get better decoding performances for the successive cancellation decoder.…”

Section: Introductionmentioning

confidence: 99%

Algebraic properties of polar codes from a new polynomial formalism

Bardet

Drăgoi

Otmani

et al. 2016

2016 IEEE International Symposium on Information Theory (ISIT)

Self Cite

131

138

View full text Add to dashboard Cite

Polar codes form a very powerful family of codes with a low complexity decoding algorithm that attains many information theoretic limits in error correction and source coding. These codes are closely related to Reed-Muller codes because both can be described with the same algebraic formalism, namely they are generated by evaluations of monomials. However, finding the right set of generating monomials for a polar code which optimises the decoding performances is a nontrivial task and is channel dependent. The purpose of this paper is to reveal some universal properties of these monomials. We will namely prove that there is a way to define a nontrivial (partial) order on monomials so that the monomials generating a polar code devised for a binary-input symmetric channel always form a decreasing set. We call such codes decreasing monomial codes. The fact that polar codes are decreasing monomial codes turns out to have rather deep consequences on their structure. Indeed, we show that decreasing monomial codes have a very large permutation group by proving that it contains a group called lower triangular affine group. Furthermore, the codewords of minimum weight correspond exactly to the orbits of the minimum weight codewords that are obtained from evaluations of monomials of the generating set. In particular, it gives an efficient way of counting the number of minimum weight codewords of a decreasing monomial code and henceforth of a polar code. Index TermsPolar codes, Reed-Muller codes, capacity-achieving codes, decreasing monomial codes, lower triangular affine group, post-quantum cryptography.I. INTRODUCTION Polar codes and Reed Muller codes viewed as monomial codes. Polar codes were discovered by Arıkan [1] and form a very powerful family of codes that gave a nice constructive way of attaining many information theoretic limits in error correction and source coding. In particular, they allow to attain the capacity of any symmetric memoryless channel with a low complexity decoding algorithm (namely the successive cancellation decoder of Arıkan). These codes are closely related to Reed-Muller codes in the sense that they can both be described with the same algebraic formalism, namely as monomial codes. Monomial codes are evaluation codes where a specific set of monomials provides a generator matrix. A Reed-Muller code R(r, m) is generated by the evaluation over F m 2 of all monomials degree at most r in m variables. A polar code of length 2 m is also generated by evaluation of monomials, but not necessarily by the same monomials as a Reed-Muller code: if we want a polar code of a certain dimension for a certain channel, we are going to take a very specific set of monomials which is in general significantly different from the Reed-Muller choice. This choice will give good performances for the Arıkan successive cancellation decoder. It turns out that this decoder is very closely related to Dumer's recursive algorithm for decoding Reed-Muller codes [2] based on the (u|u + v) decomposition. Basically Dumer's de...

show abstract

Section: Introductionmentioning

confidence: 99%

Algebraic properties of polar codes from a new polynomial formalism

Bardet

Drăgoi

Otmani

et al. 2016

2016 IEEE International Symposium on Information Theory (ISIT)

Self Cite

131

138

View full text Add to dashboard Cite

show abstract

“…We recall the following result on the generic behaviour of random codes with respect to this operation. This provides a distinguisher between random codes and algebraically structured codes such as generalised Reed Solomon codes [19,8], Reed Muller codes [7], polar codes [2] some Goppa codes [12,10] or algebraic geometry codes [9]. For instance, in the case of GRS codes, we have the following result.…”

Section: Schur Product Of Codes and Square Codes Distinguishermentioning

confidence: 98%

“…• If i ∈ I GRS (see (2), (8) and (12) for the definition), puncturing does not affect the dimension of the square code:…”

Section: Identifying Pairs Of Twin Positionsmentioning

confidence: 99%

Recovering Short Secret Keys of RLCE in Polynomial Time

Couvreur¹,

Lequesne²,

Tillich³

2019

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…Within this thread of research, there are two heuristic variants [22,23] of the McEliece cryptosystem based on polar codes. e first one [23] was broken by Bardet et al [24] using the structure of the minimum weight codewords.…”

Section: Related Workmentioning

confidence: 99%

polarRLCE: A New Code-Based Cryptosystem Using Polar Codes

Liu

Wang

et al. 2019

Security and Communication Networks

View full text Add to dashboard Cite

Security challenges brought about by the upcoming 5G era should be taken seriously. Code-based cryptography leverages difficult problems in coding theory and is one of the main techniques enabling cryptographic primitives in the postquantum scenario. In this work, we propose the first efficient secure scheme based on polar codes (i.e., polarRLCE) which is inspired by the RLCE scheme, a candidate for the NIST postquantum cryptography standardization in the first round. In addition to avoiding some weaknesses of the RLCE scheme, we show that, with the proper choice of parameters, using polar codes, it is possible to design an encryption scheme to achieve the intended security level while retaining a reasonably small public key size. In addition, we also present a KEM version of the polarRLCE scheme that can attain a negligible decryption failure rate within the corresponding security parameters. It is shown that our proposal enjoys an apparent advantage to decrease the public key size, especially on the high-security level.

show abstract

Cryptanalysis of the McEliece Public Key Cryptosystem Based on Polar Codes

Cited by 43 publications

References 31 publications

Algebraic properties of polar codes from a new polynomial formalism

Algebraic properties of polar codes from a new polynomial formalism

Recovering Short Secret Keys of RLCE in Polynomial Time

polarRLCE: A New Code-Based Cryptosystem Using Polar Codes

Contact Info

Product

Resources

About