Repairing the Faure-Loidreau Public-Key Cryptosystem

Abstract

A repair of the Faure-Loidreau (FL) public-key code-based cryptosystem is proposed. The FL cryptosystem is based on the hardness of list decoding Gabidulin codes which are special rank-metric codes. We prove that the recent structural attack on the system by Gaborit et al. is equivalent to decoding an interleaved Gabidulin code. Since all known polynomial-time decoders for these codes fail for a large constructive class of error patterns, we are able to construct public keys that resist the attack. It is also shown that all other known attacks fail for our repair and parameter choices. Compared to other codebased cryptosystems, we obtain significantly smaller key sizes for the same security level.Public-key cryptography is the foundation for establishing secure communication between multiple parties. Traditional public-key algorithms such as RSA are based on the hardness of factoring large numbers or the discrete logarithm problem, but can be attacked in polynomial time once a capable quantum computer exists. Code-based public-key cryptosystems are considered to be post-quantum secure, but compared to RSA their main drawback are significantly larger key sizes.The Faure-Loidreau (FL) code-based cryptosystem [1], [2] is based on the problem of reconstructing linearized polynomials and can be seen as linearized equivalent of the (broken) Augot-Finiasz cryptosystem [3]. While the Augot-Finiasz cryptosystem is closely connected to (list) decoding Reed-Solomon codes, the FL cryptosystem is connected to (list) decoding Gabidulin codes, a special class of rank-metric codes [4].In contrast to McEliece or Niederreiter-type cryptosystems, where the public key is a matrix, in the FL system, the key is only a vector, resulting in a much smaller key. At the time when the FL cryptosystem was designed, it was only conjectured that Gabidulin codes cannot be list decoded efficiently. As this was proven recently for many families of Gabidulin codes [5], [6], the FL system is a very promising post-quantum secure public-key cryptosystem.However, there are attacks on the FL cryptosystem: syndrome decoding [7], an Overbeck-like attack [8] which can be avoided by choosing the parameters in a certain way (cf. [2]) and, more severe, the recent attack by Gaborit et al.[9] which leaves no secure set of parameters of the system.In this paper, we propose a repair of the FL cryptosystem and prove that the attack from [9] cannot succeed anymore. Our fundamental observation is that the attack by Gaborit et al.[9] on the public key is equivalent to decoding the public key as an interleaved Gabidulin code to obtain the private key.

Randomized Decoding of Gabidulin Codes Beyond the Unique Decoding Radius

“…One can also observe that the derived lower bounds on the work factor give a good estimate of the actual runtime of the algorithm denoted by W Sim . The results in Table 1 show further, that for parameters proposed in [19,33], the new algorithm solves Problem 2 with a significantly lower computational complexity than the approaches based on the known algorithms.…”

“…The security of the public-key cryptosystem from [2] relied on the hardness of ML decoding of RS codes but was broken by a structural attack. More recently, some public-key cryptosystems based their security partly upon the difficulty of solving the problem Dec-Gab (Decisional-Gabidulin defined in the following) and Search-Gab (Search-Gabidulin), i.e., decoding Gabidulin codes beyond the unique decoding radius or derived instances of this problem [8,19,33].…”

Partition-balanced families of codes and asymptotic enumeration in coding theory

“…Another important distance function of coding theory is the rank metric, which measures the rank of the difference between a pair of matrices with entries from a finite field F q . Rank metric codes have seen a recent resurgence of interest both for their potential use in code based cryptography and as error-correcting codes in network communications [19,26,27,36,39,40]. They are also intriguing as mathematical objects in their own right, and several researchers have sought to describe their structural properties [1,4,7,12,13,14,20,21,25,32,35].…”

Weak Keys in the Faure–Loidreau Cryptosystem

“…In 2018, Gaborit et al showed, that the private key in the FL crytposystem can be recovered in polynomial time from the public key with high probability. In [7] it was shown, that the attack from [8] is equivalent to the problem of list decoding interleaved Gabidulin codes [9]. In other words, the private key is a noisy codeword of an interleaved Gabidulin code with error weight chosen slightly larger then the unique decoding radius.…”

“…This kind of decoding is called probabilist unique decoding. By restricting to error patterns that make the probabilistic unique decoder of an interleaved Gabidulin decoder fail, the FL cryptosystem can be repaired [7].…”