Two Attacks on Rank Metric Code-Based Schemes: RankSign and an IBE Scheme

Abstract

RankSign [GRSZ14] is a code-based signature scheme proposed to the NIST competition for quantum-safe cryptography [AGH + 17] and, moreover, is a fundamental building block of a new Identity-Based-Encryption (IBE) [GHPT17]. This signature scheme is based on the rank metric and enjoys remarkably small key sizes, about 10KBytes for an intended level of security of 128 bits. Unfortunately we will show that all the parameters proposed for this scheme in [AGH + 17] can be broken by an algebraic attack that exploits the fact that the augmented LRPC codes used in this scheme have very low weight codewords. Therefore, without RankSign the IBE cannot be instantiated at this time. As a second contribution we will show that the problem is deeper than finding a new signature in rank-based cryptography, we also found an attack on the generic problem upon which its security reduction relies. However, contrarily to the RankSign scheme, it seems that the parameters of the IBE scheme could be chosen in order to avoid our attack. Finally, we have also shown that if one replaces the rank metric in the [GHPT17] IBE scheme by the Hamming metric, then a devastating attack can be found. Introduction1.1 An efficient code-based signature scheme: RankSign and a codebased Identity-Based-Encryption schemeCode-based signature schemes. It is a long standing open problem to build an efficient and secure signature scheme based on the hardness of decoding a linear code which could compete in all respects with DSA or RSA. Such schemes could indeed give a quantum resistant signature for replacing in practice the aforementioned signature schemes that are well known to be broken by quantum computers. A first partial answer to this question was given in [CFS01]. It consisted in adapting the Niederreiter scheme [Nie86] for this purpose. This requires a linear code for which there exists an efficient decoding algorithm for a non-negligible set of inputs. This means that if H is an r × n parity-check matrix of the code, there exists for a non-negligible set of elements s in {0, 1} r an efficient way to find a word e in {0, 1} n of smallest Hamming weight such that He ⊺ = s ⊺ . The authors of [CFS01] noticed that very high rate Goppa codes are able to fulfill this task, and their scheme can indeed be considered as the first step towards a solution of the aforementioned problem. However, the poor scaling of the key size when security has to be increased prevents this scheme to be a completely satisfying answer to this issue. The rank metric. There has been some exciting progress in this area for another metric, namely the rank metric [GRSZ14]. A code-based signature scheme whose security relies on decoding codes with respect to the rank metric has been proposed there. It is called RankSign. Strictly speaking,

Improvements of Algebraic Attacks for Solving the Rank Decoding and MinRank Problems

“…This new way of building rank metric code-based cryptosystems has led to a sequence of proposals [22,24,5,6], culminating in submissions to the National Institute of Standards and Technology (NIST) post-quantum competition [2,3], whose security relies solely on the decoding problem in rank metric codes with a ring structure similar to the ones encountered right now in lattice-based cryptography. Interestingly enough, one can also build signature schemes using the rank metric; even though early attempts which relied on masking the structure of a code [25,9] have been broken [15], a promising recent approach [8] only considers random matrices without structural masking.…”

Post-Quantum and Code-Based Cryptography—Some Prospective Research Directions

“…The security of RankSign builds on the assumption that the special codes are indistinguishable from random linear rank metric codes. However, this scheme was attacked with a structural key-recovery attack in 2018 [91]. The Random Code-based Signature Scheme (RaCoSS) was submitted to NIST [92].…”

Designing a Practical Code-Based Signature Scheme from Zero-Knowledge Proofs with Trusted Setup

“…Finally, there exists a literature on schemes using a different metric, such as the rank metric [18,19] or the "restricted" metric [20]. All of these schemes typically show very good performance, yet the hardness of the underlying problems is also not fully trusted; for instance, RankSign was broken in [21], Durandal attacked in [22], and the scheme of [20] appears to be vulnerable to subset-sum solvers.…”