Ideals over a Non-Commutative Ring and their Application in Cryptology

Gabidulin, E.M.; Paramonov, A. V.; Tretjakov, O. V.

doi:10.1007/3-540-46416-6_41

Cited by 237 publications

(190 citation statements)

References 5 publications

Supporting

Mentioning

181

Contrasting

Unclassified

Order By: Relevance

“…Currently one of the two best known attacks to decode rank distance codes is based on MinRank [11,37]. Therefore MinRank is essential to the security of Chen and GPT public key schemes [14,4,11]. MinRank also appears in attacks known on the HFE [32,8,10], TTM cryptosystem [19] and Shamir's birational signature scheme [30,6,7].…”

Section: Related Problemsmentioning

confidence: 99%

“…MinRank in fact contains SD and thus is also probably exponential. It also contains the decoding problem for rank-distance codes of Gabidulin, used in public-key authentication scheme of Chen [4] cryptanalysed in [37,11], and also used in the public-key encryption scheme GPT [14]. The MinRank problem, not always named so, has many applications in cryptanalysis of various schemes such as Shamir's birational schemes [30,6,7] cryptanalysed by Coppersmith, Stern and Vaudenay solving a MinRank with a small rank.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Efficient Zero-Knowledge Authentication Based on a Linear Algebra Problem MinRank

Courtois

2001

Advances in Cryptology — ASIACRYPT 2001

View full text Add to dashboard Cite

Abstract.A Zero-knowledge protocol provides provably secure entity authentication based on a hard computational problem. Among many schemes proposed since 1984, the most practical rely on factoring and discrete log, but still they are practical schemes based on NP-hard problems. Among them, the problem SD of decoding linear codes is in spite of some 30 years of research effort, still exponential. We study a more general problem called MinRank that generalizes SD and contains also other well known hard problems. MinRank is also used in cryptanalysis of several public key cryptosystems such as birational schemes (Crypto'93), HFE (Crypto'99), GPT cryptosystem (Eurocrypt'91), TTM (Asiacrypt'2000) and Chen's authentication scheme (1996). We propose a new Zero-knowledge scheme based on MinRank. We prove it to be Zero-knowledge by black-box simulation. An adversary able to fraud for a given MinRank instance is either able to solve it, or is able to compute a collision on a given hash function. MinRank is one of the most efficient schemes based on NP-complete problems. It can be used to prove in Zero-knowledge a solution to any problem described by multivariate equations. We also present a version with a public key shared by a few users, that allows anonymous group signatures (a.k.a. ring signatures).

show abstract

Section: Related Problemsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Efficient Zero-Knowledge Authentication Based on a Linear Algebra Problem MinRank

Courtois

2001

Advances in Cryptology — ASIACRYPT 2001

View full text Add to dashboard Cite

show abstract

“…For example, Gabidulin et al [5] tried using maximum-rank-distance codes. These schemes were shown to be insecure by Gibson [6,7].…”

Section: Remar~mentioning

confidence: 99%

Failure of the McEliece public-key cryptosystem under message-resend and related-message attack

Berson

1997

Advances in Cryptology — CRYPTO '97

View full text Add to dashboard Cite

The McEliece public-key cr3~tosystem fails to protect any message which is sent to a recipient more than once using different random error vectors. In general, it fails to protect any messages sent to a recipient which have a known linear relation to one another. Under these conditions, which are easily detectable, the cryptosystem is subject to a devastating attack which reveals plaintext with a work factor which is 1015 times better than the best general attack.Keywords: McEliece, public-key cryptosystem, randomization, error-correcting codes, error vectors, message-resend attack, related-message attack, protocol failure, eryptanalysis. IntroductionThe McEliece public-key cryptosystem was proposed nearly 20 years ago [14]. The system is simple to explain and is very fast in execution. It is based on an NP-hard problem in coding theory, and features the ability of a hidden error-correcting code to recover plaintext from ciphertexts which the sender intentionally garbles with random errors. Although it has received much attention from the cryptologic community, the system remains unbroken to this day.Despite these advantages, the McEliece public-key cryptosystem it is not widely used. Perhaps this is because it has a large public key and a low information rate. But changes in technology and economics, for example the plummeting cost of storage, keep it on the list of candidates for some applications.In this paper we analyze and exploit the failure of the McEliece public-key cryptosystem to protect plaintext when any message is sent to a recipient more than once using different random error vectors. Our message-resend attack succeeds in flk 3 time, wherefl is a small constant, and k is the message size of the underlying code. We then generalize our attack to a related-message attack, which recovers any messages sent to a recipient when a linear relation between the messages is known, again in flk 3 time.

show abstract

“…By viewing any finite extension of finite fields F/K as a linear space over K of dimension m > 1 then for any positive integer n, the ambient space F n can also be viewed as the space of m × n matrices. In [GPT91] Gabidulin, Paramonov and Tretjakov proposed the first rank-metric based encryption scheme. This scheme can be seen as an analog of the McEliece's one but based on the class of Gabidulin codes.…”

Section: Introductionmentioning

confidence: 99%

“…This transformation is a probabilistic algorithm that adds some randomness to its input G . Originally, the authors in [GPT91] proposed to use a distortion transformation that outputs (a generator matrix of) the code G + R where R is random code with a prescribed dimension t R . The presence of R has however an impact: the sender has to add an error vector whose rank weight is t pub = t − t R where t is the error correction capability of the G .…”

Section: Introductionmentioning

confidence: 99%

Polynomial-time key recovery attack on the Faure–Loidreau scheme based on Gabidulin codes

Gaborit

Otmani

Kalachi

2017

Des. Codes Cryptogr.

View full text Add to dashboard Cite

ABSTRACT. Encryption schemes based on the rank metric lead to small public key sizes of order of few thousands bytes which represents a very attractive feature compared to Hamming metric-based encryption schemes where public key sizes are of order of hundreds of thousands bytes even with additional structures like the cyclicity. The main tool for building public key encryption schemes in rank metric is the McEliece encryption setting used with the family of Gabidulin codes. Since the original scheme proposed in 1991 by Gabidulin, Paramonov and Tretjakov, many systems have been proposed based on different masking techniques for Gabidulin codes. Nevertheless, over the years most of these systems were attacked essentially by the use of an attack proposed by Overbeck.In 2005 Faure and Loidreau designed a rank-metric encryption scheme which was not in the McEliece setting. The scheme is very efficient, with small public keys of size a few kiloBytes and with security closely related to the linearized polynomial reconstruction problem which corresponds to the decoding problem of Gabidulin codes. The structure of the scheme differs considerably from the classical McEliece setting and until our work, the scheme had never been attacked. We show in this article that for a range of parameters, this scheme is also vulnerable to a polynomial-time attack that recovers the private key by applying Overbeck's attack on an appropriate public code. As an example we break in a few seconds parameters with 80-bit security claim. Our work also shows that some parameters are not affected by our attack but at the cost of a lost of efficiency for the underlying schemes.Post-quantum cryptography; Gabidulin code; Polynomial reconstruction; Faure-Loidreau scheme.

show abstract

Ideals over a Non-Commutative Ring and their Application in Cryptology

Cited by 237 publications

References 5 publications

Efficient Zero-Knowledge Authentication Based on a Linear Algebra Problem MinRank

Efficient Zero-Knowledge Authentication Based on a Linear Algebra Problem MinRank

Failure of the McEliece public-key cryptosystem under message-resend and related-message attack

Polynomial-time key recovery attack on the Faure–Loidreau scheme based on Gabidulin codes

Contact Info

Product

Resources

About