RankSign: An Efficient Signature Algorithm Based on the Rank Metric

Abstract

We propose a new approach to code-based signatures that makes use in particular of rank metric codes. When the classical approach consists in finding the unique preimage of a syndrome through a decoding algorithm, we propose to introduce the notion of mixed decoding of erasures and errors for building signature schemes. In that case the difficult problem becomes, as is the case in lattice-based cryptography, finding a preimage of weight above the Gilbert-Varshamov bound (case where many solutions occur) rather than finding a unique preimage of weight below the Gilbert-Varshamov bound. The paper describes RankSign: a new signature algorithm for the rank metric based on a new mixed algorithm for decoding erasures and errors for the recently introduced Low Rank Parity Check (LRPC) codes. We explain how it is possible (depending on choices of parameters) to obtain a full decoding algorithm which is able to find a preimage of reasonable rank weight for any random syndrome with a very strong probability. We study the semantic security of our signature algorithm and show how it is possible to reduce the unforgeability to direct attacks on the public matrix, so that no information leaks through signatures. Finally, we give several examples of parameters for our scheme, some of which with public key of size 11, 520 bits and signature of size 1728 bits. Moreover the scheme can be very fast for small base fields.

A New Algorithm for Solving the Rank Syndrome Decoding Problem

“…• Parameters from LRPC cryptosystem [12] n k m w claimed security complexity of our attack 50 32 50 3 2 81 2 75 112 80 112 4 2 259 2 247…”

On the Hardness of the Decoding and the Minimum Distance Problems for Rank Codes

“…In practice it means that it is possible to obtain secure practical parameters for random instances in rank metric of only a few thousand bits related to a hard problem, when at least a hundred thousand bits are needed for Hamming distance or for lattices. Such random instances for rank metric are used for instance, for zero-knowledge authentication in [17], and weakly structured instances are used for the recent LRPC cryptosystem [14] (similar to the NTRU cryptosystem [26] for lattices and the recent MDPC cryptosystem for codes) or for signature [16]. Of course with (Hamming) codes and lattices it is possible to decrease the size of parameters to a few thousand bits with additional structure [4,22], but then the reduction properties to hard problems are lost because they are reduced to decoding problems for special classes of codes whose complexity is not known..…”

An improved Durandal signature scheme

“…However, these improvements ended in failure [12,13]. In 2014, Gaborit et al [14] proposed the RankSign scheme using the rank metric [15] and the LRPC code [16]. This signature scheme also uses the hash-and-sign method and the difference with the CFS scheme is that the RankSign scheme can invert a random syndrome.…”