Information-Set Decoding with Hints

Horlemann-Trautmann, Anna-Lena; Puchinger, Sven; Renner, Julian; Schamberger, Thomas; Wachter-Zeh, Antonia

doi:10.1007/978-3-030-98365-9_4

Cited by 11 publications

(6 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This probability is at least as high as the probability that k random positions of a random code form an information set. We conclude that the probability that a random block of size mñ ≥ k is an information block is, for most codes, a constant in the same order of magnitude as 1 [13]. Now, we analyze the average success probability of the Prange-like decoder and, in doing so, determine according to which probability mass function the tx should be chosen in order to obtain the maximum average success probability.…”

Section: 2mentioning

confidence: 99%

Generic Decoding in the Cover Metric

Bitzer¹,

Renner²,

Wachter-Zeh³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

In this paper, we study the hardness of decoding a random code endowed with the cover metric. As the cover metric lies in between the Hamming and rank metric, it presents itself as a promising candidate for code-based cryptography. We give a polynomial-time reduction from the classical Hamming-metric decoding problem, which proves the NP-hardness of the decoding problem in the cover metric. We then provide a generic decoder, following the information set decoding idea from Prange's algorithm in the Hamming metric. A study of its cost then shows that the complexity is exponential in the number of rows and columns, which is in contrast to the behaviour in the Hamming metric, where the complexity grows exponentially in the number of code symbols.

show abstract

Section: 2mentioning

confidence: 99%

Generic Decoding in the Cover Metric

Bitzer¹,

Renner²,

Wachter-Zeh³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

Section: Introductionmentioning

confidence: 99%

“…The idea of augmenting the syndrome decoding problem (SDP) with additional information obtained by physical attacks has been studied in [27], [28]. While in [28] the overall cost of the attack remains unfeasible practically, in [27], all the parameters set of Classic McEliece have been attacked. In the so-called "Integer Syndrome Decoding Problem" (N − SDP), introduced in [29], [27], the matrix-vector multiplication is performed over N instead of F 2 .…”

Section: Introductionmentioning

confidence: 99%

Profiled Side-Channel Attack on Cryptosystems Based on the Binary Syndrome Decoding Problem

Colombier

Drăgoi

Cayrel

et al. 2022

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

The NIST standardization process for post-quantum cryptography has been drawing the attention of researchers to the submitted candidates. One direction of research consists in implementing those candidates on embedded systems and that exposes them to physical attacks in return. The Classic McEliece cryptosystem, which is among the four finalists of round 3 in the Key Encapsulation Mechanism category, builds its security on the hardness of the syndrome decoding problem, which is a classic hard problem in code-based cryptography. This cryptosystem was recently targeted by a laser fault injection attack leading to message recovery. Regrettably, the attack setting is very restrictive and it does not tolerate any error in the faulty syndrome. Moreover, it depends on the very strong attacker model of laser fault injection, and does not apply to optimised implementations of the algorithm that make optimal usage of the machine words capacity. In this article, we propose a to change the angle and perform a message-recovery attack that relies on side-channel information only. We improve on the previously published work in several key aspects. First, we show that sidechannel information, obtained with power consumption analysis, is sufficient to obtain an integer syndrome, as required by the attack framework. This is done by leveraging classic machine learning techniques that recover the Hamming weight information very accurately. Second, we put forward a computationallyefficient method, based on a simple dot product and informationset decoding algorithms, to recover the message from the, possibly inaccurate, recovered integer syndrome. Finally, we present a masking countermeasure against the proposed attack.

show abstract

“…Second, we use and further develop more advanced techniques from information set decoding and lattices, thereby building on the work of Horlemann, Puchinger, Renner, Schamberger, Wachter-Zeh [18] for decoding with hints and the work of Dachman-Soled, Ducas, Gong, Rossi [10] for lattices with hints. Especially, our new decoding techniques might be of independent interest.…”

Section: Introductionmentioning

confidence: 99%

PI-Cut-Choo and Friends: Compact Blind Signatures via Parallel Instance Cut-and-Choose and More

Chairattana-Apirom

Hanzlik

Loss

et al. 2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

In a so-called partial key exposure attack one obtains some information about the secret key, e.g. via some side-channel leakage. This information might be a certain fraction of the secret key bits (erasure model) or some erroneous version of the secret key (error model). The goal is to recover the secret key from the leaked information. There is a common belief that, as opposed to e.g. the RSA cryptosystem, most post-quantum cryptosystems are usually resistant against partial key exposure attacks. We strongly question this belief by constructing partial key exposure attacks on code-based, multivariate, and latticebased schemes (BIKE, Rainbow and NTRU). Our attacks exploit the redundancy that modern PQ cryptosystems inherently use for efficiency reasons. The application and development of techniques from information set decoding plays a crucial role for achieving our results. On the theoretical side, we show non-trivial information leakage bounds that allow for a polynomial time key recovery attack. As an example, for all schemes the knowledge of a constant fraction of the secret key bits suffices to reconstruct the full key in polynomial time. Even if we no longer insist on polynomial time attacks, most of our attacks extend well and remain feasible up to large erasure and error rates. In the case of BIKE for example we obtain attack complexities around 60 bits when half of the secret key bits are erased, or a quarter of the secret key bits are faulty. Our results show that even highly error-prone key leakage of modern PQ cryptosystems may lead to full secret key recoveries.

show abstract

Information-Set Decoding with Hints

Cited by 11 publications

References 30 publications

Generic Decoding in the Cover Metric

Generic Decoding in the Cover Metric

Profiled Side-Channel Attack on Cryptosystems Based on the Binary Syndrome Decoding Problem

PI-Cut-Choo and Friends: Compact Blind Signatures via Parallel Instance Cut-and-Choose and More

Contact Info

Product

Resources

About