Distinguisher-based attacks on public-key cryptosystems using Reed–Solomon codes

• Published in: Designs, codes and cryptography Vol. 73; no. 2; pp. 641 - 666
• Main Authors: Couvreur, Alain, Gaborit, Philippe, Gauthier-Umaña, Valérie, Otmani, Ayoub, Tillich, Jean-Pierre
• Format: Journal Article Conference Proceeding
• Language: English
• Published: Boston Springer US 2014; Springer; Springer Verlag
• Subjects: Algebra; Applied sciences; Circuits; Coding and Information Theory; Computer Science; Cryptography; Cryptography and Security; Cryptology; Data Structures and Information Theory; Discrete Mathematics in Computer Science; Exact sciences and technology; Information and Communication; Information, signal and communications theory; Mathematics; Number theory; Sciences and techniques of general use; Signal and communications theory; Telecommunications and information theory; Code-based cryptography; Key-recovery; 11T71; Distinguisher; 94B40; Generalized Reed–Solomon codes; Homomorphic encryption; Reed Solomon code; McEliece encryption; Filtration; Probabilistic approach; Generalized Reed-Solomon codes; Private key; Distinguishing attack; Public key; Matrix calculus; Cryptanalysis; Secret key; Cryptography; Computer attack; Security key
• ISSN: 0925-1022; 1573-7586
• DOI: 10.1007/s10623-014-9967-z

Because of their interesting algebraic properties, several authors promote the use of generalized Reed–Solomon codes in cryptography. Niederreiter was the first to suggest an instantiation of his cryptosystem with them but Sidelnikov and Shestakov showed that this choice is insecure. Wieschebrink proposed a variant of the McEliece cryptosystem which consists in concatenating a few random columns to a generator matrix of a secretly chosen generalized Reed–Solomon code. More recently, new schemes appeared which are the homomorphic encryption scheme proposed by Bogdanov and Lee, and a variation of the McEliece cryptosystem proposed by Baldi et al. which hides the generalized Reed–Solomon code by means of matrices of very low rank. In this work, we show how to mount key-recovery attacks against these public-key encryption schemes. We use the concept of distinguisher which aims at detecting a behavior different from the one that one would expect from a random code. All the distinguishers we have built are based on the notion of component-wise product of codes. It results in a powerful tool that is able to recover the secret structure of codes when they are derived from generalized Reed–Solomon codes. Lastly, we give an alternative to Sidelnikov and Shestakov attack by building a filtration which enables to completely recover the support and the non-zero scalars defining the secret generalized Reed–Solomon code.