View
47
Download
0
Category
Preview:
Citation preview
CodeCode--Based PKCs And Their Based PKCs And Their CodeCode--Based PKCs And Their Based PKCs And Their ApplicationsApplicationsApplicationsApplications
K k i K bK k i K bKazukuni KobaraKazukuni Kobara
RCIS/AISTRCIS/AIST
ICITS 2009ICITS 2009ICITS 2009ICITS 2009No. 1
PKCs can be divided intoPKCs can be divided intoPKCs can be divided intoPKCs can be divided into
Integer Factoring Based Code BasedNumber Theoretic (Cyclic) Problem Combinatorial Problem
Integer Factoring BasedRSA[RSA78]Rabin[Ra79]
Code BasedMcEliece[Mc78]Niederreiter[Ni86][ ]
Okamoto-Uchiyama[OU98]Paillier[Pa99] S Paillier[CHGN01]
[ ]Lattice Based
NTRU[HS96]Ajt iD k[AD97]S-Paillier[CHGN01]
…Discrete Logarithm Based
AjtaiDwork[AD97]Goldreich-Goldwasser-Halevi [GGH97]g
Diffie-Hellman[DH77]ElGamal[El84]ECC[Mi85][K 87]
Ajtai[Ajt05]Regev[Reg03,Reg05]Peikert[Pei09]ECC[Mi85][Ko87]
XTR[LV00]Cramer-Shoup[CS03]
Peikert[Pei09]…
Subset Sum Basedp[ ]Kurosawa-Desmedt[KD04]…
Okamoto-Tanaka-Uchiyama[OTU00]
No. 2
Cyclic Cyclic Problem:Problem:Integer Factoring (IF)Integer Factoring (IF)
Cyclic Cyclic Problem:Problem:Integer Factoring (IF)Integer Factoring (IF)Integer Factoring (IF)Integer Factoring (IF)Integer Factoring (IF)Integer Factoring (IF)
Given a positive integer n find its prime Given a positive integer n, find its prime factor pi
Equivalent to finding r s.t. gr≡1 (mod n)for a g of GCD(g,n)=1 and g≡±1 (mod n)
Since GCD(gr/2-1,n) or GCD(gr/2+1,n) is pii
gi mod n IF This cycle can be determined in poly time
i
g mod n determined in poly time with 1D-QFT, a.k.a. Shor’s quantum algorithm.
r r ri
No. 3QFT : Quantum Fourier Transform
Cyclic Cyclic Problem:Problem:DiscreteDiscrete Log (DL)Log (DL)Cyclic Cyclic Problem:Problem:
DiscreteDiscrete Log (DL)Log (DL)DiscreteDiscrete--Log (DL) Log (DL) DiscreteDiscrete--Log (DL) Log (DL)
Given p, g and y, find r s.t. pgx r mod ≡p, g y,p: prime, g: generator of Zp*, x a member of Zp* except 1, p-1.p
Equivalent to finding a0, a1, b0 and b1 s.t. pgxgx baba mod1100 ≡
Since p mod )()()( 100101 bbaaraa ggx −−− ≡≡)( bb −
pgg
a 1-pmod)()(
01
10
aabbr
−≡a
a0
DL
xagbmod p
0
a1
This inclination can be determined in poly time
h 2 Q k Sh ’No. 4
-b
g p1
b0 b1
with 2D-QFT, a.k.a. Shor’s quantum algorithm.
Lesson to learnLesson to learnLesson to learnLesson to learn
If a problem is written in the form If a problem is written in the form of determining a cycle, o de e g a cyc e, Then it can be solved in polynomial time using a quantum computer.
No. 5
Combinatorial ProblemsCombinatorial ProblemsCombinatorial ProblemsCombinatorial Problems
A set of vectorsfindNote: Underlying security d d l h tA set of vectors
or scalarsfind depends also on how to
make the trapdoor
00010000100100100r1, r2, r3… ri, -1r1, r2, r3… ri, -1 =
public-key A ithmeticpublic key Arithmetic Unit
ConditionCondition
ciphertextciphertext
givenNo. 6
Code Based: Code Based: McElieceMcElieceCode Based: Code Based: McElieceMcEliece
PK is a kxn generator matrix ofPlaintextfind PK is a kxn generator matrix of a linear code over GF(q) , usually q=2
Plaintextfind
00010000100100100=
public-key wt() <=t
r1, r2, r3… ri, -1r1, r2, r3… ri, -1
public key
GF(q)
()
Condition
ciphertextciphertext
givenNo. 7
wt(): Hamming weight (# of non zeros)
Code Based: Code Based: NiederreiterNiederreiterCode Based: Code Based: NiederreiterNiederreiter
PK is a nx(n-k) parity check Plaintextfindmatrix of a linear code over GF(q), usually q=2
Plaintextfind
00000000000000000=
public-key All Zerowt(r) <=t1 2 3 ir1, r2, r3… ri, -1
public key
GF(q)},,,{ 21 irrrr L∈
Condition
ciphertextciphertextCondition
givenNo. 8
Lattice Based: NTRU Lattice Based: NTRU Lattice Based: NTRU Lattice Based: NTRU
find PK is a n dimensional Plaintextfind PK is a n dimensional cyclic vector over Zq , q=2048 etc.
Plaintext
00100-100100-10000=
public-key
1 2 3 ir1, r2, r3… ri, -1
},1,0,1{−∈ir dwt()}101{ =−∈mpublic key
Zqrdwt()
},,,{=
i mdwt()},1,0,1{ =∈im
ConditionciphertextciphertextCondition
givenNo. 9
Lattice Based: Lattice Based: RegevRegevLattice Based: Lattice Based: RegevRegev
find PlaintextPK is a (u+v)x(n+v) matrix
finduxv parity-with-noise Axs+E
uxn random binary matrix A
0000000000=r1, r2,…,ri, m1, …,mv, -1
All Zerot( )}10{ qA
Zq
Axs+E2 wt(r)},1,0{, qmr ii <∈
Condition0000000000000 0 00000000000000 002
q
2q
ciphertextciphertextCondition 0000000000000 00
0000000000000 0 02
2q
givenNo. 10
Subset Sum Problem: Subset Sum Problem: OTUOTU
Subset Sum Problem: Subset Sum Problem: OTUOTUOTUOTUOTUOTU
PK is a set of n positivePlaintextfind PK is a set of n positive integers
Plaintextfind
0=
public-key Zero
1 2 3 ir1, r2, r3… ri, -1
kr =∈ wt(r)}10{ public key
Zkri =∈ wt(r)},1,0{
Condition
ciphertextciphertextCondition
givenNo. 11
So far it is not knownSo far it is not knownSo far it is not knownSo far it is not known
To reduce combinatorial problems to a To reduce combinatorial problems to a cyclic problemThe best attack on combinatorial problem is:p
Grover’s algorithmG ’ l ith dGrover’s algorithm can reduce
Running time to but it is still statesexponential to its input size
No. 12
Advantages of Advantages of Combinatorial BasedCombinatorial Based
Advantages of Advantages of Combinatorial BasedCombinatorial BasedCombinatorial BasedCombinatorial BasedCombinatorial BasedCombinatorial Based
Quantum Tolerant: Quantum Tolerant: No polynomial time algorithm is known so f t tfar even on quantum computers
Arithmetic unit is small:for encryption (and signature verification)Usually xors or additions in a small Usually xors or additions in a small Field/RingTh hi hl ll li blThey are highly parallelizableNo heavy multi-precision modular exponentiation
No. 13
Advantages of CodeAdvantages of Code--BasedBased
Advantages of CodeAdvantages of Code--BasedBasedBasedBasedBasedBased
I f ti R ti iInformation Ratio, i.e.( )SizePlaintest
is better( )( )Size Ciphertext
Arithmetic unit is smaller:e c u s s a e :for encryption and signature verificationUsually xorsUsually xors
=> Suitable for low computational power or
No. 14
=> Suitable for low computational power or Ubiquitous devices
History of CodeHistory of Code--Based Based PKEsPKEs
History of CodeHistory of Code--Based Based PKEsPKEsPKEsPKEsPKEsPKEs
1978: McEliece 1977: RSA1977 Hiffie-Hellman
Code-based
1985: ECC2000: Error expansion/hold [Loi00]
Number Theoretic
1986: NiederreiterHellman 1985: ECC
Attack on Attack on small cardinality including BCH [LS01]
1991: GPT PKC [GPT91] (rank code)
hem
Attack [KI03]
GRS [SS92]Goppa code (more generally alternant code) with large cardinality
including BCH [LS01]
Att k LDPCome
of t
hn
atta
cks
Attack on sparse S [MRS00]
2001: IND-CCA2 Conv. in RO [KI02]
LDPC
Attack on
Attack on LDPC in general
whe
re s
ore
actio
n
2005: Quasi-CyclicBCH subcode 2007: QC-
2009 Q asi
2005: with GRS subcode [BL05] 2009: Quasi-
Cyclic alternant
subfield P [Ove05]
atta
cks
witi
cal l
ike
Attack
[Gab05] Q
LDPC [BC07]
2009: Quasi-Dyadic [MB09]Attack on GRS
subcode
[ ]
Attack on small
Cyclic alternant code [BCG+09] 2008: ext field
P [Gab08]
Large extension
A lo
t of
w
ere
cri Attack
on QC[OTD08]
No. 15
[Wie06] [Wie09]
Attack on small extension degrees [UL09]
Large extension degree Idea can be
applied to
How to see the historyHow to see the historyHow to see the historyHow to see the history
Green Letters: Underlying Liner CodeGreen Letters: Underlying Liner Code
: Attack
: Already Broken
N t Y t B k : Not Yet Broken (as far as I know as of Dec. 2009)( )
No. 16
History of Non PKE History of Non PKE CodeCode Based PrimitivesBased Primitives
History of Non PKE History of Non PKE CodeCode Based PrimitivesBased PrimitivesCodeCode--Based PrimitivesBased PrimitivesCodeCode--Based PrimitivesBased Primitives
1994: ZKIP (as well as Digital ZKIP: Zero Knowledge Interactive ProofOT: Oblivious Transfer( g
Signature applying Fiat-Shamir heuristic) (random code) [Ste94]
2001 Di it lPublic matrix can be compressed by generating
OT: Oblivious Transfer
2005: Hash
2001: Digital Signature (Goppa) [CFS01]
compressed by generating it from a random seed
Function (random code) [AFS05]Bleichenbacher’s
attack [Ble06] 2007: Light Weight Unlinkable-ID for [ ] g gRFID (Goppa) [SKI06][CKM+07]
2008: Bit (1,2)-OT(Goppa) [DGQ+08]
2008: String (1,2)-OT (Goppa) [KMO08]
(Goppa) [DGQ+08]
With appropriate parameter choice [FS09]
No. 17
parameter choice [FS09]
Construction of CodeConstruction of Code--Based Based Construction of CodeConstruction of Code--Based Based PKCsPKCsPKCsPKCs
No. 18
Keys for Keys for McElieceMcEliece PKEPKEKeys for Keys for McElieceMcEliece PKEPKE
Secret key Random Permutation Matrixy
Pn
Non-Singular MatrixP
GS k
Generator matrix of ECCwhich can correct up to t-error symbols
Public key
which can correct up to t error symbols
Public key
G’ G’’I
May be systematic if an appropriate IND-CC 2CCA2 conversion is applied
No. 19
Encryption of Encryption of Primitive Primitive M EliM Eli PKEPKE
Encryption of Encryption of Primitive Primitive M EliM Eli PKEPKEMcElieceMcEliece PKEPKEMcElieceMcEliece PKEPKE
C=MG’+ZZ
C=MG +Z Random vector with weight t
(0,1,0,0,1,0, ... 0,0,1,0)
MG’
CPlaintext is a k dimensional vector Ciphertext
M
MGdimensional vector over GF(2)
Ciphertext
M
G’
No. 20
Decryption of Decryption of Primitive Primitive M EliM Eli PKEPKE
Decryption of Decryption of Primitive Primitive M EliM Eli PKEPKEMcElieceMcEliece PKEPKEMcElieceMcEliece PKEPKE
1. CP-1=MSG+ZP-11P-1
C
2. Correct the t-error bits using error-C
correction algorithm and obtain MS3 M=MS S-13. M=MS S
S-1MS MMS M
No. 21
Keys for Keys for NiederreiterNiederreiterPKEPKE
Keys for Keys for NiederreiterNiederreiterPKEPKEPKEPKEPKEPKE
Secret key n-kyRandom Permutation
Non-Singular MatrixP H
S
nPermutation Matrix
Matrix
Parity check matrix of ECCwhich can correct up to t-error symbols
Public key
which can correct up to t error symbols
IPublic key IMay be systematic if an appropriate IND-CC 2
H’H’’CCA2 conversion
is applied No. 22
Encryption of Encryption of Primitive Primitive Ni d itNi d it PKEPKE
Encryption of Encryption of Primitive Primitive Ni d itNi d it PKEPKENiederreiterNiederreiter PKEPKENiederreiterNiederreiter PKEPKE
C=ZH’C=ZH
Plainstext is an n dimensional
Z C
vector of weight t Ciphertext
ZZH’C
(0,1,0,0,1,0, ... 0,0,1,0) =H’
No. 23
Decryption of Decryption of Primitive Primitive Ni d itNi d it PKEPKE
Decryption of Decryption of Primitive Primitive Ni d itNi d it PKEPKENiederreiterNiederreiter PKEPKENiederreiterNiederreiter PKEPKE
1 CS 1 ZH’S 1 ZPH SS 1 (ZP)H1. CS-1=ZH’S-1=ZPH SS-1=(ZP)HS-1
C2. Correct the t-error bits using error-correction algorithm and obtain ZP
C
correction algorithm and obtain ZP3. Z=ZP P-1
ZP Z
P-1
No. 24
UnfortunatelyUnfortunatelyUnfortunatelyUnfortunately
Due to the simple structure of a linear Due to the simple structure of a linear code, a lot of practical attacks are kknown
This is the reason why some people still think that code-based PKEs have already been broken
Ex )Ex.)Reaction attack can decrypt a given
i h t t i O(k)ciphertext in O(k).No. 25
Reaction Reaction Attack Attack on on McElieceMcEliece PKCPKC
Reaction Reaction Attack Attack on on McElieceMcEliece PKCPKCMcElieceMcEliece PKCPKCMcElieceMcEliece PKCPKC
Flip one bit of the given ciphertext Flip one bit of the given ciphertext Let the receiver decrypt itIf its reaction is normal, error is within the error correction bounderror correction bound.
1 Receiver (decryption
l )
0 1 1 0 0 0 1 0 1 0 1 1 0 1C=
oracle)
0 1 1 0 0 0 1 0 1 0 1 1 0 1C=
ReactionGiven ciphertext Reaction
CountermeasuresCountermeasuresCountermeasuresCountermeasures
Attacks Attacks Using decryption oracles Against indistinguishability or non-malleability
Can be prevented applying an “appropriate” conversion schemeappropriate conversion scheme
Naïve application sometimes does not workwork
No. 27
NaNaïïve application of ve application of OAEP is vulnerableOAEP is vulnerableNaNaïïve application of ve application of OAEP is vulnerableOAEP is vulnerableOAEP is vulnerable OAEP is vulnerable OAEP is vulnerable OAEP is vulnerable
mm Const
GRandom Plaintext
r
Gen
Ha
Number PlaintextOAEP module
ash
y1
yy2
y3
G’
Primitive
cc
PrimitiveMcEliece PKCz
Ciphertext
No. 28
Slight Modification Makes it Slight Modification Makes it Provably Secure and CompactProvably Secure and Compact
Slight Modification Makes it Slight Modification Makes it Provably Secure and CompactProvably Secure and CompactProvably Secure and CompactProvably Secure and CompactProvably Secure and CompactProvably Secure and Compact
m Constr Encryptionm Const
Gen
Random Number Plaintext
r yp
Hash
OAEP module
y1
y5 y3y4
G’
y2
G’
Conv PrimitiveMcEliece PKCz
ccCiphertext
y5y5
)) and swappingby )()((or ))()(((and ))()()()((
434131
3412
yyyLenyLenyLenyLenyLenyLenyLenyLen
≥≥+≥+ must hold
No. 29
Decryption of Decryption of ConversionConversion
Decryption of Decryption of ConversionConversionConversion Conversion Conversion Conversion
mm
Ge
Plaintext Const=?
Error messages between thisOAEP
enH
as
Error messages between this integrity check and undecodable error must be indistinguishable.
OAEP module
sh
y1
y5 y3y4
y2
indistinguishable.(Implementation must take care this!!)
y5 y3y4
G’
Conv Primitive
cch
McEliece PKCz
y5y5
Ciphertext
No. 30
In The Case of In The Case of NiederreiterNiederreiter
In The Case of In The Case of NiederreiterNiederreiterNiederreiterNiederreiterNiederreiterNiederreiter
Make the ciphertext most compact and Make the ciphertext most compact and provably secure in the RO
OAEP+ for short plaintextOAEP+ for short plaintextOAEP++ for long plaintext f b t tt kNo proof but no attackOAEPSAEP+
Insecure (since Niederreiter primitive is Insecure (since Niederreiter primitive is position-wise malleable)
SAEP SAEP No. 31
Provable Security in the Provable Security in the Standard ModelStandard Model
Provable Security in the Provable Security in the Standard ModelStandard ModelStandard ModelStandard ModelStandard ModelStandard Model
2007: IND-CPA in the standard model [NIK+07]2008: IND-CCA2 in the standard model 2008: IND CCA2 in the standard model [DQN08]
IND: Indistinguishability
No. 32
CPA: Chosen Plaintext AttackCCA2: Adaptive Chosen Ciphertext Attack
Secure Constructions Secure Constructions are Availableare Available
Secure Constructions Secure Constructions are Availableare Availableare Availableare Availableare Availableare Available
As long as the primitive As long as the primitive McEliece/Niederreiter PKC satisfies OW-CPACPAParameters meeting OW-CPA against g gmost powerful attacks ISD and GBA are estimated in [FS09]estimated in [FS09]
OW-CPA: One-Wayness against Chosen Plaintext Attack
No. 33
ISD: Information Set DecodingGBA: Generalized Birthday Attack
Parameters for PKEParameters for PKEParameters for PKEParameters for PKE
m t Binary work PK size Plaintext /Ciphertext sizem t Binary work factor
PK size (KB)
Plaintext /Ciphertext sizeMcEliece Niederreiter
11 32 286 8 72 9KB 1696/2048 bit 233/352bit11 32 286.8 72.9KB 1696/2048 bits 233/352bits12 41 2128.5 216.5KB 3604/4096 bits 327/492bits
Public-key size isPublic key size is large compared to Number Theoretic
No. 34
Number Theoretic ones.
Parameters for Digital Parameters for Digital SignatureSignature
Parameters for Digital Parameters for Digital SignatureSignatureSignatureSignatureSignatureSignature
m t Binary PK size Iteration Signature Size ywork factor
(KB) *1g
*2,*3
22 9 281.7 101,371KB 218.5 198~216.5 bits15 12 281.5 716.0KB 228.8 180~208.8 bits
14 13 280.7 360.0KB 232.5 182~214.5 bits13 14 280.0 178 0KB 236.4 182~218 4 bits13 14 2 178.0KB 2 182 218.4 bits12 15 288.2 86.0KB 240.3 180~220.3 bits
*1: affects the signing cost*2: Signature size depends on how to express the error pattern and it affects the verification speed
No. 35
verification speed.*3: Signature size can be reduced further by removing some error positions while increasing the verification cost further [CFS01]
How to Reduce PublicHow to Reduce Public--Key SizeKey Size
How to Reduce PublicHow to Reduce Public--Key SizeKey SizeKey SizeKey SizeKey SizeKey Size
Increase the error correction capabilityIncrease the error correction capabilityCapacity Approaching Codes
LDPC QC-LDPCLDPC, QC-LDPCList Decoding
corrects only a couple of more errors for corrects only a couple of more errors for practical parameters while increasing the decoding complexity
Compress the public-keyQuasi-CyclicQuasi CyclicQuasi-Dyadic
Small extension degreeSmall extension degreeLarge extension degree
No. 36
Attack on LDPC CodesAttack on LDPC CodesAttack on LDPC CodesAttack on LDPC Codes
Exploits the fact the density of the secret matrix low.
H’THT: Parity Check Matri of LDPC S=
Exploits the fact the density of the secret matrix low.
H’T Matrix of LDPC code
S=P
Thi b hidd ith S d P b t bThis may be hidden with S and P but can be recovered.
Let
H1 H2
HT: Parity Check Matrix of LDPC
code =
No. 37
code
Attack on LDPC CodesAttack on LDPC CodesAttack on LDPC CodesAttack on LDPC Codes
1. Make H’ systematic
H’TI H’’T S1=2. Multiply a low density vector h1 , and check if the density of h2 is low.
I H’’T H1 H2=H1
h2 is low.h1 h1 h2?
Since # of candidates C(n-k,w) where w is the Hamming i h f h ( d l h ibili f b i h lweight of h1 (and also the possibility of being another low
density matrix is negligible), H can be recovered.
No. 38
If one uses this direction, they must find a good code of Middle Density (we call MDPC).
List DecodingList DecodingList DecodingList Decoding
Exhaustive Search ⎟⎟⎞
⎜⎜⎛
⎟⎟⎞
⎜⎜⎛n
Exhaustive SearchCorrect any t’ more errors but with th l it ⎟⎟
⎟⎟
⎜⎜⎜⎜
⎟⎟⎠
⎞⎜⎜⎝
⎛ +
⎟⎟⎠
⎜⎜⎝
''
'tt
tO
the complexity '' '1' tt nt
ntn
⎟⎞
⎜⎛≥
⎟⎟⎠
⎞⎜⎜⎝
⎛
≥⎟⎞
⎜⎛ +−
⎟⎠
⎜⎝
⎟⎠
⎜⎝ 't
Bernstein’s List Decoding [Ber08]
''
'1 ttt
ttt⎟⎠
⎜⎝ +
≥
⎟⎟⎠
⎞⎜⎜⎝
⎛ +≥⎟
⎠⎜⎝ +t+t’ errors in the n coordinates
Bernstein’s List Decoding [Ber08]t’ more errors in poly time where
⎟⎞
⎜⎛ ⎞⎛
−−−−=
)1(2)1(2
)22('
rr
ttnnntmm rknt
nm
m
)1(2)(2
−−
=
No. 39
⎟⎟⎠
⎞⎜⎜⎝
⎛−⎟⎟⎠
⎞⎜⎜⎝
⎛ −−−
−−= 2)1(2222)1(22
mr
mr mmm
mmt )()(
==
# of extra # of extra errorerror correctable bitscorrectable bits
# of extra # of extra errorerror correctable bitscorrectable bitserrorerror--correctable bitscorrectable bitserrorerror--correctable bitscorrectable bits
Extra error correction bits Extra error correction bits
5 Recommende 3
4
Recommended parameters for PKEs Recommended
2
m2
3 parameters for Digital Signatures
1
1
2 Signatures
No. 40
r=k/n r=k/n
How to Reduce PublicHow to Reduce Public--Key SizeKey Size
How to Reduce PublicHow to Reduce Public--Key SizeKey SizeKey SizeKey SizeKey SizeKey Size
Increase the error correction capabilityIncrease the error correction capabilityCapacity Approaching Codes
LDPC QC-LDPCLDPC, QC-LDPCList Decoding
corrects only a couple of more errors for corrects only a couple of more errors for practical parameters while increasing the decoding complexity
Compress the public-keyQuasi-CyclicQuasi CyclicQuasi-Dyadic
Small extension degreeSmall extension degreeLarge extension degree
No. 41
Dyadic MatrixDyadic MatrixDyadic MatrixDyadic Matrix
⎤⎡ ⎤⎡⎤⎡⎥⎤
⎢⎡
⎥⎤
⎢⎡
⎥⎤
⎢⎡ DCBA
⎤⎡ β⎥⎥⎥
⎢⎢⎢
⎤⎡⎤⎡
⎥⎦
⎢⎣
⎥⎦
⎢⎣
BADCCDAB
⎥⎦
⎤⎢⎣
⎡β
βα=
⎥⎥
⎦⎢⎢
⎣⎥⎦
⎤⎢⎣
⎡⎥⎦
⎤⎢⎣
⎡ABBA
CDDC⎥
⎦⎢⎣ αβ
⎦⎣⎥⎦
⎢⎣
⎥⎦
⎢⎣ ABCD
No. 42
Advantage of Advantage of Dyadic MatrixDyadic MatrixAdvantage of Advantage of Dyadic MatrixDyadic MatrixDyadic MatrixDyadic MatrixDyadic MatrixDyadic Matrix
⎥⎤
⎢⎡ ⎤⎡⎤⎡ DCBA A B C D
⎥⎥
⎢⎢ ⎥
⎦
⎤⎢⎣
⎡⎥⎦
⎤⎢⎣
⎡CDAB
⎥⎥⎥
⎢⎢⎢
⎥⎤
⎢⎡
⎥⎤
⎢⎡
⎦⎣⎦⎣BADC
⎥⎦
⎢⎣
⎥⎦
⎢⎣
⎥⎦
⎢⎣ ABCD
No. 43
Dyadic Matrix and Dyadic Matrix and GoppaGoppa CodesCodes
Dyadic Matrix and Dyadic Matrix and GoppaGoppa CodesCodesGoppaGoppa CodesCodesGoppaGoppa CodesCodes
have an intersection over the extension field of GF(2)
Goppa Codes(M ll
Public-Key (More generally,
Alternant Code with large cardinality)
Dyadic Matrix can be compressed!! large cardinality)ed!!
No. 44
GoppaGoppa Codes and Codes and Cauchy MatrixCauchy Matrix
GoppaGoppa Codes and Codes and Cauchy MatrixCauchy MatrixCauchy MatrixCauchy MatrixCauchy MatrixCauchy Matrix
Binary Goppa code is the set of ally pp
1n−( ) n
n GFcccc )2(110 ∈= −L s.t.
)(mod0)(1
0Xg
LXcXS
n
i i
ie ≡
−≡∑
=
⎤⎡
If distinct are and where)()( 1
0 jit
i i LzxzXg ∏−
=−=
it can be written
111
111
0101000⎥⎤
⎢⎡⎥⎥⎥⎤
⎢⎢⎢⎡
−−− −n cLzLzLzL
0111
)( 1
111101=
⎥⎥⎥⎥
⎢⎢⎢⎢
⎥⎥⎥⎥
⎢⎢⎢⎢
−−−=−n
T cLzLzLzcH
MMOMM
L
No. 45
111 1
111101
⎥⎦
⎢⎣⎥⎥⎥
⎦⎢⎢⎢
⎣ −−−−
−−−−
n
nttt
cLzLzLz
L
To Make It Dyadic To Make It Dyadic (more generic than [MB09])(more generic than [MB09])
To Make It Dyadic To Make It Dyadic (more generic than [MB09])(more generic than [MB09])
2δ⊕
(more generic than [MB09])(more generic than [MB09])(more generic than [MB09])(more generic than [MB09])
3δ⊕ 2δ⊕can be applied
to either of a δ⊕
2δ⊕
δ⊕1δ⊕
⎥⎤
⎢⎡
⎥⎤
⎢⎡
⎥⎤
⎢⎡
⎥⎤
⎢⎡
⎥⎤
⎢⎡
⎥⎤
⎢⎡
⎥⎤
⎢⎡ 11111111
LLLLLLLL
3
1δ⊕ 1δ⊕ 1δ⊕2δ⊕numerator, a
denominator or a fraction
1δ⊕
⎥⎥⎥⎥⎥⎥
⎢⎢⎢⎢⎢⎢
⎥⎥⎥⎥⎥⎥
⎢⎢⎢⎢⎢⎢
⎤⎡⎤⎡⎥⎥⎥⎥
⎦⎢⎢⎢⎢
⎣ −−
−−
⎥⎥⎥⎥
⎦⎢⎢⎢⎢
⎣ −−
−−
⎥⎥⎥⎥⎥⎥
⎢⎢⎢⎢⎢⎢
⎤⎡⎤⎡⎥⎥⎥⎥
⎦⎢⎢⎢⎢
⎣ −−
−−
⎥⎥⎥⎥
⎦⎢⎢⎢⎢
⎣ −−
−−
7161
7060
5141
5040
3121
3020
1101
1000
1111
1111
1111
1111LzLz
LzLz
LzLz
LzLz
LzLz
LzLz
LzLz
LzLz
2δ⊕
1δ⊕⎥⎥⎥⎥⎥
⎢⎢⎢⎢⎢
⎥⎥⎥⎥⎥
⎦⎢⎢⎢⎢⎢
⎣ ⎥⎥⎥⎥
⎦
⎤
⎢⎢⎢⎢
⎣
⎡
−−
−−
⎥⎥⎥⎥
⎦
⎤
⎢⎢⎢⎢
⎣
⎡
−−
−−
⎥⎥⎥⎥⎥
⎦⎢⎢⎢⎢⎢
⎣ ⎥⎥⎥⎥
⎦
⎤
⎢⎢⎢⎢
⎣
⎡
−−
−−
⎥⎥⎥⎥
⎦
⎤
⎢⎢⎢⎢
⎣
⎡
−−
−−
7363
7262
5343
5242
3323
3222
1303
120211
11
11
11
11
11
11
11
LzLz
LzLz
LzLz
LzLz
LzLz
LzLz
LzLz
LzLz
3δ⊕
1δ⊕ ⎥⎥⎥⎥⎥⎥
⎢⎢⎢⎢⎢⎢
⎥⎥⎥⎤
⎢⎢⎢⎡
⎥⎥⎥⎤
⎢⎢⎢⎡
−−
⎥⎥⎥⎤
⎢⎢⎢⎡
−−⎥⎥⎥⎤
⎢⎢⎢⎡
⎥⎥⎥⎤
⎢⎢⎢⎡
−−
⎥⎥⎥⎤
⎢⎢⎢⎡
−−
⎥⎦⎢⎣ ⎥⎦⎢⎣⎥⎦⎢⎣⎥⎦⎢⎣ ⎥⎦⎢⎣⎥⎦⎢⎣
7464544434241404
7363534333231303
11
11
11
11
11
11
11
11LzLzLzLzLzLzLzLz
LzLzLzLzLzLzLzLz3δ⊕
1
δ⊕ ⎥⎥⎥⎥⎥
⎢⎢⎢⎢⎢
⎥⎥⎥⎥⎥⎥
⎢⎢⎢⎢⎢⎢
⎥⎥⎤
⎢⎢⎡
−−⎥⎥⎤
⎢⎢⎡
−−
⎥⎥⎦⎢
⎢⎣ −−⎥
⎥⎦⎢
⎢⎣ −−
⎥⎥⎥⎥⎥⎥
⎢⎢⎢⎢⎢⎢
⎥⎥⎤
⎢⎢⎡
−−⎥⎥⎤
⎢⎢⎡
−−
⎥⎥⎦⎢
⎢⎣ −−⎥
⎥⎦⎢
⎢⎣ −−
76665646
75655545
36261606
35251505
11111111LzLzLzLz
LzLzLzLz
LzLzLzLz
LzLzLzLz2δ⊕
1δ⊕No. 46
⎥⎥⎥
⎦⎢⎢⎢
⎣ ⎥⎥⎥
⎦⎢⎢⎢
⎣ ⎥⎥⎥
⎦⎢⎢⎢
⎣ −−⎥⎥⎥
⎦⎢⎢⎢
⎣ −−⎥⎥⎥
⎦⎢⎢⎢
⎣ ⎥⎥⎥
⎦⎢⎢⎢
⎣ −−⎥⎥⎥
⎦⎢⎢⎢
⎣ −− 7767
7666
5747
5646
3727
3626
1707
160611111111
LzLzLzLzLzLzLzLz
[MB09] generates a large full [MB09] generates a large full Dyadic block then picks upDyadic block then picks up
[MB09] generates a large full [MB09] generates a large full Dyadic block then picks upDyadic block then picks upDyadic block then picks upDyadic block then picks upDyadic block then picks upDyadic block then picks up
We propose to generate a small full Dyadic We propose to generate a small full Dyadic block and then generate other full Dyadic blocks by introducing (we call it outer Δ⊕blocks by introducing (we call it outer delta)
Whereas we call inner delta (since it
Δ⊕
δ⊕Whereas we call inner delta (since it defines the inner structure of a full Dyadic block
δ⊕
1Δ⊕ 2Δ⊕ 3Δ⊕
⎥⎦
⎤⎢⎣
⎡⎥⎦
⎤⎢⎣
⎡⎥⎦
⎤⎢⎣
⎡⎥⎦
⎤⎢⎣
⎡⎥⎦
⎤⎢⎣
⎡D diFull
D diFull
D diFull
D diFull
No. 47
⎥⎦
⎢⎣
⎥⎦
⎢⎣
⎥⎦
⎢⎣
⎥⎦
⎢⎣
⎥⎦
⎢⎣ DyadicDyadicDyadicDyadic
AdvantagesAdvantages
C t th t D di t i Can generate the txn Dyadic matrix more flexibly,
N=2m can be closer to n+tCan remove the block-wise Can remove the block-wise permutation and removal in key generationgeneration
Since they are already included by the parameter choice of Δ⊕
No. 48
RemarkRemark
Block-Wise Permutation is the same as changing Δj’s appropriately.Removal of one block is the same as Removal of one block is the same as reducing the number of blocks by one
d th h i Δ ’ i t land then changing Δj’s appropriately
1Δ⊕ 2Δ⊕ 3Δ⊕
⎥⎦
⎤⎢⎣
⎡⎥⎦
⎤⎢⎣
⎡⎥⎦
⎤⎢⎣
⎡⎥⎦
⎤⎢⎣
⎡⎥⎦
⎤⎢⎣
⎡D diFull
D diFull
D diFull
D diFull
No. 49
⎥⎦
⎢⎣
⎥⎦
⎢⎣
⎥⎦
⎢⎣
⎥⎦
⎢⎣
⎥⎦
⎢⎣ DyadicDyadicDyadicDyadic
By applying By applying t th d i tt th d i t
By applying By applying t th d i tt th d i t
Δ⊕⊕ and δto the denominatorsto the denominatorsto the denominatorsto the denominators
txn Dyadic matrix can be obtained withtxn Dyadic matrix can be obtained with101 δ⊕=zz 202 δ⊕=zz 210123 δδδ ⊕⊕=⊕= zzz
101 δ⊕=LL 202 δ⊕=LL 210223 δδδ ⊕⊕=⊕= LLL
h 10 Δ⊕=LLt jtj LL Δ⊕=× 0
where )2(,,,,, 1)/(21log2100 2
mtnt GFLz ∈ΔΔΔ −LLδδδ
are chosen at random while making all the
1)/(21log2100 2 tnt
njLtiz <≤<≤ 0forand0forthe distinct. No. 50
njLtiz ji <≤<≤ 0for and0for
Shuffle While Keeping Shuffle While Keeping Dyadic StructureDyadic Structure
Shuffle While Keeping Shuffle While Keeping Dyadic StructureDyadic StructureDyadic StructureDyadic StructureDyadic StructureDyadic Structure
With Column Block Wise Scalar With Column-Block-Wise Scalar Multiplication
[ ][ ] ⎥
⎥⎤
⎢⎢⎡
⎥⎤
⎢⎡ ⎤⎡⎤⎡⎤⎡ 1
01
FullFullFull p[ ]
[ ]⎥⎥⎥
⎦⎢⎢⎢
⎣
⎥⎦
⎢⎣
⎥⎦
⎤⎢⎣
⎡⎥⎦
⎤⎢⎣
⎡⎥⎦
⎤⎢⎣
⎡ 1
0DyadicDyadicDyadicp
pO
L
[ ]⎥⎦⎢⎣ −1bp
ntnb =}0{\)( m
i qGFp ∈where and
No. 51
GF(GF(qqmm) to GF(q)) to GF(q)GF(GF(qqmm) to GF(q)) to GF(q)
)(qGFA m∈γ theis}{ γγγ L
)()(,
qGFaqGFA
i
i
∈∈γ
)(ofbasis dual
theis},{ 1-m21mqGF
γγγ
⎥⎤
⎢⎡
⎥⎤
⎢⎡ )( 00 Atra γ
)(qi )(q
⎥⎥⎤
⎢⎢⎡
=⎥⎥⎤
⎢⎢⎡
=)()(
1
0
1
0
AtraA
γγ
⎥⎥⎥
⎢⎢⎢=
⎥⎥⎥
⎢⎢⎢=A
MM⎥⎦
⎢⎣
⎥⎦
⎢⎣ −− )( 11 Atra mm γ
No. 52 )(
12 −
++++=mqqq AAAAAtr L
GF(GF(qqmm) to GF(q)) to GF(q)GF(GF(qqmm) to GF(q)) to GF(q)
⎤⎡ ⎤⎡⎤⎡ 00 ba
⎥⎥⎤
⎢⎢⎡
⎥⎥⎤
⎢⎢⎡
⎥⎥⎤
⎢⎢⎡ 00 ba
MM
⎥⎥⎥
⎢⎢⎢
⎤⎡⎤⎡⎥⎥⎦⎢
⎢⎣⎥
⎥⎦⎢
⎢⎣=⎥
⎤⎢⎡ −− 11 mm
bbaBA
⎥⎤
⎢⎡
⎥⎤
⎢⎡ 00 ba
⎥⎥⎥
⎢⎢⎢
⎥⎥⎤
⎢⎢⎡
⎥⎥⎤
⎢⎢⎡⎥
⎦⎢⎣ 00 abAB
MM ⎥⎥⎥
⎢⎢⎢ ⎥
⎦⎢⎣ 00 ab
M⎥⎥⎥
⎦⎢⎢⎢
⎣ ⎥⎥⎦⎢
⎢⎣⎥
⎥⎦⎢
⎢⎣ −− 11 mm ab
MM
⎥⎥
⎢⎢
⎤⎡ 11 baM
⎥⎦⎢⎣ ⎦⎣⎦⎣ 11 mm
⎥⎥⎥
⎦⎢⎢⎢
⎣⎥⎦
⎤⎢⎣
⎡ −−
11
11 mm
abba
No. 53
⎥⎦⎢⎣ ⎦⎣ −− 11 mm ab
Shuffle While Keeping Shuffle While Keeping Dyadic StructureDyadic Structure
Shuffle While Keeping Shuffle While Keeping Dyadic StructureDyadic StructureDyadic StructureDyadic StructureDyadic StructureDyadic Structure
Multiplication of a Random Dyadic Matrix
F llF llF llF ll ⎤⎡ ⎤⎡⎤⎡⎤⎡⎤⎡⎤⎡ ⎤⎡⎤⎡
Multiplication of a Random Dyadic Matrix
DyadicFull
DyadicFull
DyadicFull
DyadicFull
R dR dDyadicRandom
DyadicRandom
⎥⎥⎥⎤
⎢⎢⎢⎡
⎤⎡⎤⎡⎤⎡⎤⎡
⎥⎦
⎤⎢⎣
⎡⎥⎦
⎤⎢⎣
⎡⎥⎦
⎤⎢⎣
⎡⎥⎦
⎤⎢⎣
⎡
⎥⎥⎥⎤
⎢⎢⎢⎡
⎤⎡⎤⎡
⎥⎦
⎤⎢⎣
⎡⎥⎦
⎤⎢⎣
⎡
DyadicFull
DyadicFull
DyadicFull
DyadicFull
DyadicRandom
DyadicRandom
⎥⎥⎥
⎦⎢⎢⎢
⎣⎥⎦
⎤⎢⎣
⎡⎥⎦
⎤⎢⎣
⎡⎥⎦
⎤⎢⎣
⎡⎥⎦
⎤⎢⎣
⎡⎥⎥
⎦⎢⎢
⎣⎥⎦
⎤⎢⎣
⎡⎥⎦
⎤⎢⎣
⎡
THS)(=
Note: Dyadic X Dyadic = Dyadic
⎥⎤
⎢⎡ ++
=⎥⎤
⎢⎡⎥⎤
⎢⎡ BCADBDACDCBA
Note: Dyadic X Dyadic Dyadic
No. 54
⎥⎦
⎢⎣ ++⎥
⎦⎢⎣⎥⎦
⎢⎣ ACBDADBCCDAB
Attack on Quasi Dyadic Attack on Quasi Dyadic [UL09][UL09]
Attack on Quasi Dyadic Attack on Quasi Dyadic [UL09][UL09][UL09][UL09][UL09][UL09]
Exploits the fact that each column of Exploits the fact that each column of each low of H’T is tr(f(Li)) where f() and Li
kare unknownIf one can make f(x)=const, tr(f(Li)) ( ) , ( ( i))becomes independent of Li and all the coordinates in the same block of the coordinates in the same block of the low take the same value.On the contrary, by choosing ri s.t.
]),,[,],,,[],,,([' 111100= bibiiiiiT
i hhhhhhHr LLLL
f(x) can be const with high probability. No. 55
]),,[,],,,[],,,([ 1,1,1,1,0,0, −− bibiiiiii hhhhhhHr
Attack on Quasi Dyadic Attack on Quasi Dyadic [UL09][UL09]
Attack on Quasi Dyadic Attack on Quasi Dyadic [UL09][UL09][UL09][UL09][UL09][UL09]
])[][]([' 111100= bbT hhhhhhHr LLLL ]),,[,],,,[],,,([ 1,1,1,1,0,0, −−= bibiiiiii hhhhhhHr
These constants are linear combinations f t ( t t)⎤⎡ 0r
of tr(constant)
⎥⎤
⎢⎡1
=⎥⎥⎥⎤
⎢⎢⎢⎡
M'1
0
Hrr
T m(m-1) unknown in GF(q) so the uncertainty of (p1 to
⎥⎥⎥⎥
⎢⎢⎢⎢0M
=
⎤⎡⎤⎡
⎥⎥
⎦⎢⎢
⎣ −
M
])([])1([1
ptrtrh
rm
γγββ
pm-1) is m(m-1)log2 q ⎥⎦
⎢⎣0
⎥⎥⎥⎤
⎢⎢⎢⎡
⎥⎥⎥⎤
⎢⎢⎢⎡
−
−
MM
LLL
LLL
MOMM
L
L
]),([]),1([]),([]),1([
111
100
1,11,10,1
1,01,00,0
ptrtrptrtr
hh
m
m
γγγγ
ββββ
No. 56
⎥⎥
⎦⎢⎢
⎣⎥⎥
⎦⎢⎢
⎣ −−−−−− LLL
LMM
L
MOMM
]),([]),1([ 1111,11,10,1 ptrtrh mmmmmm γγββ
Countermeasure Against Countermeasure Against The Attack on Quasi DyadicThe Attack on Quasi Dyadic
Countermeasure Against Countermeasure Against The Attack on Quasi DyadicThe Attack on Quasi DyadicThe Attack on Quasi DyadicThe Attack on Quasi DyadicThe Attack on Quasi DyadicThe Attack on Quasi Dyadic
m(m 1) unknown in GF(q) and hence m(m-1) unknown in GF(q) and hence the uncertainty of (p1 to pm-1) is m(m-1)l bit1)log2 q bitsE.g.)g )For q=2, by making m>=10, the uncertainty becomes > 90 bits and this uncertainty becomes >=90 bits and this attack can be avoided(though this attack might be improved in future) in future)
No. 57
Parameters for PKEParameters for PKEParameters for PKEParameters for PKE
m t Binary work PK size Plaintext /Ciphertext sizefactor (KB) McEliece Niederreiter
11 32 286.8 72.9KB 1696/2048 bits 233/352bits
QD (Parameters are not optimized)
12 41 2128.5 216.5KB 3604/4096 bits 327/492bits
m t n p l Binary k
PK size (KB)
Plaintext/Ciph t t Si
QD (Parameters are not optimized)
work factor
(KB) hertext SizeQD
16 64 2560 1 12 291.3 3.0KB 427/1024 bits13 64 2048 2 16 290.2 1.9KB 406/832 bits
No. 58
12 128 2400 1 8 290.7 1.3KB 716/1536 bits
Parameters for Digital Parameters for Digital SignatureSignature
Parameters for Digital Parameters for Digital SignatureSignatureSignatureSignatureSignatureSignature
m t BWF PK size (KB)
Iteration *1
Signature Size *2 *3(KB) *1 *2,*3
14 13 280.7 360.0KB 232.5 182~214.5 bits13 14 280.0 178.0KB 236.4 182~218.4 bits12 15 288.2 86.0KB 240.3 180~220.3 bits
m t n Binary PK size Iteration Signature Size QD (Parameters are not optimized)
m t n Binary work factor
PK size (KB)
Iteration *1
Signature Size *2,*3
factor15 12 26528 284.0 48.2KB 232.5 180~212.5 bits14 13 13316 283.4 22 4KB 236.4 182~218 4 bits
No. 59
14 13 13316 2 22.4KB 2 182 218.4 bits13 14 6736 282.9 10.4KB 240.3 182~222.3 bits
Suitable Applications for CodeSuitable Applications for Code--Suitable Applications for CodeSuitable Applications for Code--Based PKCsBased PKCsBased PKCsBased PKCs
No. 60
CodeCode--Based PKCs Fit With Based PKCs Fit With Heterogeneous Heterogeneous
//
CodeCode--Based PKCs Fit With Based PKCs Fit With Heterogeneous Heterogeneous
//Network/ApplicationsNetwork/ApplicationsNetwork/ApplicationsNetwork/Applications
D1D2
D3 Di
A lot of low cost and lowA lot of low cost and low computational power devices, such as RFIDs, sensors and
One side has high computational power
SCADA devicesSince•Encryption and signature verification consist•Encryption and signature verification consist mostly of xors and they are highly parallelizable.•They do not require heavy multi precision•They do not require heavy multi precision modular exponentiations
No. 61
Broadcast Broadcast AuthenticationAuthentication
Broadcast Broadcast AuthenticationAuthenticationAuthenticationAuthenticationAuthenticationAuthentication
One (powerful) sender
Applications include:
One (powerful) sender
pp•Transmission of mission critical commands and
broadcasts a message data to sensors and SCADA devices.•Issue of disaster warning
broadcasts a message
•Issue of disaster warning
D1D3D2
DiD3D2
a lot of (lightweight) receivers receive it and check its authenticity and dataand check its authenticity and data integrity.
No. 62
In emergency applications,In emergency applications,low latency is cruciallow latency is crucial
In emergency applications,In emergency applications,low latency is cruciallow latency is cruciallow latency is crucial low latency is crucial low latency is crucial low latency is crucial
A i tAgainst•Earthquake•TsunamiEspecially Tsunami•Flood•Tornado•Thunderbolt•Fire
Disaster warning…
D1 DiD1D3D2
Di
No. 63
Such warning receivers Such warning receivers may be deployedmay be deployed
Such warning receivers Such warning receivers may be deployedmay be deployedmay be deployedmay be deployedmay be deployedmay be deployed
at home, critical infrastructures, and then take appropriate actions if a warning is
h
take appropriate actions if a warning is verified.
homes
Turn off gases•Turn off gases•Unlock and open doors
Factories
(nuclear) power plants•Stop the lines
•Slow down the trains
In some cases, a few seconds are enough to mitigate
( ) p phospitals
•Slow down the trains
serious damages, and hence delay is should be minimized while maintaining adequate security level. No. 64
Comparison Among Comparison Among SolutionsSolutions
Comparison Among Comparison Among SolutionsSolutionsSolutionsSolutionsSolutionsSolutions
MACith
MAC ith
TESLA (h h
Digital Signaturewith one
master
with pair-wise
(hash-chain and delayed
Conventional (RSA,
DSA,
Code-Based
key keys auth)DSA,
ECDSA) Authenticity
d D tX*1 O O O O
and DataIntegrity
Computational O O O X OComputational Cost
O O O X O
Delay O X*2 X*3 X O
*1: Crack of one device breaks it.*2: Sender must broadcast a lot of MACs and each device must wait until his MAC is received
TESLA: Timed Efficient Stream Loss-tolerant Authentication No. 65
received.*3: Verification key is released in the next time slot.
Comparison Among Comparison Among SolutionsSolutions
Comparison Among Comparison Among SolutionsSolutionsSolutionsSolutionsSolutionsSolutions
MACith
MAC ith
TESLA (h h
Digital Signaturewith one
master
with pair-wise
(hash-chain and delayed
Conventional (RSA,
DSA,
Code-Based
key keys auth)DSA,
ECDSA) Authenticity
d D tX*1 O O O O
and DataIntegrity
Computational O O O X OComputational Cost
O O O X O
Delay O X*2 X*3 X O
*1: Crack of one device breaks it.*2: Sender must broadcast a lot of MACs and each device must wait until his MAC is received
TESLA: Timed Efficient Stream Loss-tolerant Authentication No. 66
received.*3: Verification key is released in the next time slot.
Privacy Enhanced RFIDPrivacy Enhanced RFIDPrivacy Enhanced RFIDPrivacy Enhanced RFID
a tag used for reading/writing ID (and RFID: g g g (information) via wireless communication.
RFID t i l
thi ( i l h l)
RFID system in general:item
tag
thing, animal orhuman
(wireless channel)
databasetag
readerIDUser-data
server
management of items, e.g. in supply chainApplications:No. 67
RFID (for long distance) requires RFID (for long distance) requires privacy protection mechanismprivacy protection mechanism
RFID (for long distance) requires RFID (for long distance) requires privacy protection mechanismprivacy protection mechanismprivacy protection mechanismprivacy protection mechanismprivacy protection mechanismprivacy protection mechanism
user station a.k.a. location privacy
Area-2
malicious readers
Area-1
Reader-2
Area-3
Area-4Reader-1 Reader-4
IDA IDAReader-3
hospital
Same IDs!!A user who carries a tag may
adversary
A user who carries a tag may be traced by someone else.
No. 68
Solutions Can Be Divided Solutions Can Be Divided IntoInto
Solutions Can Be Divided Solutions Can Be Divided IntoIntoIntoIntoIntoInto
Tag disabling Tag enabling Tag disabling solutions
Manually removal or
Tag enabling solutions
Randomized hash ydestructionKill command
lock [WSRE03]HB+ [JW05] and its
i tTemporally tag-disabling solutions
variantsCode-Based Unlinkable-ID [SKI06] Faraday cage
Access passwordH h l k
Unlinkable ID [SKI06] [CKM+07]
Tag enabling solutions:Hash lockBlocker tagMode switch
Tag enabling solutions:Enable RFID functionalities while providing Mode switch while providing unlinkability of IDs
No. 69
ComparisonComparisonComparisonComparison
Exhaustive search of IDs at the server
Unlinkability
Randomized hash lock
Necessary (Tag identification cost
○lock,HB+ and its variants
identification cost depends on # of tags)
variantsCode-Based U li k bl ID
Unnecessary (Tag id ifi i i
○Unlinkable-ID identification cost is
independent of # of )tags)
No. 70
CodeCode--Based UnlikableBased Unlikable--ID ID (1/3)(1/3)
CodeCode--Based UnlikableBased Unlikable--ID ID (1/3)(1/3)
n – k(WH(): Hamming weight)
Niederreiter PKE:
(1/3)(1/3)(1/3)(1/3)
'mHc =n n – kn k
mWH(m) = t
nH’ = ca ciphertext
/ /t tCode-Based Unlinkable-ID:
n1'H
n – k
n1 n2
n21 nnn +=
1 1/ /a n n t t= =
n11H
2'H n2
m =ttt +=
nr id1 2
W (r) = t W (d) = t='H
2 n221 ttt +=
(ID)(random num.)
WH(r) = t1 WH(d) = t2No. 71
CodeCode--Based Based UnlinkableUnlinkable--ID ID (2/3)(2/3)
CodeCode--Based Based UnlinkableUnlinkable--ID ID (2/3)(2/3)(2/3)(2/3)(2/3)(2/3)
× ×r id'H 'H= ⊕c × ×r id1H 2H= ⊕c
c2c1 ⊕
Pre compute this at the server and assigns it to each tag
Let each tag calculate this
No. 72
CodeCode--Based Based UnlinkableUnlinkable--IDID(3/3)(3/3)
CodeCode--Based Based UnlinkableUnlinkable--IDID(3/3)(3/3)(3/3)(3/3)(3/3)(3/3)
Q & R l Ph ReaderTag ),'( 21 cH
Query
Query & Reply Phase ),,( PHS
×r 'Hc =
QueryRNG( )
×r 1Hc1 =
c = c2c1 ⊕ ID Resolve Phase
cc c2c1
r||id := Decrypt(c)⊕
Unlinkable-ID =
This scheme p o ides nlinkabilit of IDs against passi e attack B t b make this
No. 73
This scheme provides unlinkability of IDs against passive attack. But by make this challenge-response type, this can also be secure against adaptive attack [CKM+07]
Conclusion (1/2)Conclusion (1/2)Conclusion (1/2)Conclusion (1/2)
Code based PKCs are suitable forCode-based PKCs are suitable forHeterogeneous Network/Applications, such as
Broadcast Authentication and Unlinkable-ID for light weight devices such as
RFID, sensors, SCADA devices
Since theySince theydo not require heavy multi-precision modular exponentiationexponentiationcan be executed mostly using only xors highly i ll l in parallel
No. 74
Conclusion (2/2)Conclusion (2/2)Conclusion (2/2)Conclusion (2/2)
Research themes left in this area includeResearch themes left in this area includeFurther reduction of PK sizesNew attacks (especially on QD)New primitives/applicationsp / ppImplementation and side-channel attacksProvable securityProvable securityetc.
No. 75
Thank you very much for your Thank you very much for your Thank you very much for your Thank you very much for your kind attention!!kind attention!!kind attention!!kind attention!!
No. 76
ReferencesReferencesReferencesReferences
[GPT91] E.M. Gabidulin, A.V. Paramonov, O.V. Tretjakov, “Ideals over a Non commutative Ring and Their Ideals over a Non-commutative Ring and Their Application in Cryptology,” Proc. of Eurocrypt’91, LNCS 547, pp.482-489, 1991[SS92] V Sidelnikov and S Shestakov “On insecurity of [SS92] V. Sidelnikov and S. Shestakov, On insecurity of cryptosystems based on generalized Reed-Solomon codes.”Discrete Math. Appl. 2(4), pp. 439–444, 1992[MRS00]C Monico J Rosenthal and A Shokrollahi “Using [MRS00]C. Monico, J. Rosenthal, and A. Shokrollahi, Using low density parity check codes in the McEliececryptosystem,” Proc. of IEEE ISIT’00, p. 215, 2000[Loi00] P Loidreau “Strengthening McEliece cryptosystem ” [Loi00] P. Loidreau “Strengthening McEliece cryptosystem,” Proc. of ASIACRYPT’00, pp. 585–598, 2000[PCT+02] A. Perrig, R. Canetti, J.D. Tyger and D. Song, “The TESLA Broadcast A thentication Protocol ” Cr ptoB tes TESLA Broadcast Authentication Protocol,” CryptoBytes, Vol.5, No.2, Summer/Fall, pp. 2-13[KI02] K. Kobara and H. Imai “Semantically secure McEliece
bli k t t ” IEICE T E85 A(1) 74 83 public-key cryptosystem”. IEICE Trans., E85-A(1), pp. 74–83, 2002
No. 77
ReferencesReferencesReferencesReferences
[KI03] K. Kobara and H. Imai “On the one-wayness against [ ] y gchosen-plaintext attacks on the Loidreau’s modified McEliece PKC”. IEEE Trans. on IT, 49(12), pp. 3136–3168, 2003[Ove05] R. Overbeck, “A new structural attack for GPT and variants,” Proc. of Mycrypt’05, LNCS 3517, pp. 50-63, 2005[AFS05] D. Augot, M. Finiasz, and N. Sendrier, “A family of [ ] g , , , yfast syndrome based cryp-tographic hash function,” Proc. of Mycrypt’05, LNCS 3715, pp. 64-83, 2005[Gab05] P. Gaborit, “Shorter keys for code based [ ] , ycryptography,” Proc of WCC’05, pp. 81–91, 2005[SKI06] M. Suzuki, K. Kobara, and H. Imai. “Privacy enhanced and light weight RFID system without tag enhanced and light weight RFID system without tag synchronization and exhaustive search,” Proc. of IEEE SMC’06, pp. 1250-1255, 2006[Wie06] C. Wieschebrink, “An attack on a modified [Wie06] C. Wieschebrink, An attack on a modified Niederreiter encryption scheme,” Proc. of PKC’06, LNCS 3958, pp.14–26, 2006
No. 78
ReferencesReferencesReferencesReferences
[Ble06] D. Bleichenbacher, htt // d k il /N / i t/2006http://www.derkeiler.com/Newsgroups/sci.crypt/2006-12/msg00480.html , 2006[BC07] M. Baldi and F. Chiaraluce “Cryptanalysis of a new instance of McEliece cryptosystem based on QC LDPC Codes ” instance of McEliece cryptosystem based on QC-LDPC Codes, IEEE ISIT, pp. 2591-2595, 2007[CKM+07] Y. Cui, K. Kobara, K. Matsuura, and H. Imai “Lightweight Asymmetric Privacy-Preserving Authentication Lightweight Asymmetric Privacy Preserving Authentication Protocols Secure against Active Attack” Proc. of PerSec’07, pp. 223–228, 2007[NIK+07] R. Nojima, H. Imai, K. Kobara and K. Morozov, “Semantic [ ] j , , ,Security for the McEliece Cryptosystem without Random Oracles,” Proc. Of WCC’07, pp. 257-268, 2007[DQN08] R. Dowsley, J. Müller-Quade and A. C. A. Nascimento, “A CCA2 S P bli K E ti S h B d th “A CCA2 Secure Public Key Encryption Scheme Based on the McEliece Assumptions in the Standard Model,” http://eprint.iacr.org/2008/468 ,2008
No. 79
ReferencesReferencesReferencesReferences
[AFG+08] D. Augot, M. Finiasz, Ph. Gaborit, S. Manuel, and N. S d i “SHA 3 l FSB ” SHA 3 NIST titi 2008Sendrier, “SHA-3 proposal: FSB,” SHA-3 NIST competition, 2008[Ber08] D. J. Bernstein “List decoding for binary Goppa codes,” http://cr.yp.to/codes/goppalist-20081107.pdf , 2008[DGQ 08] R D l J d G f J M Q d d A [DGQ+08] R. Dowsley, J. van de Graaf, J. M.-Quade, and A. Nascimento. “Oblivious transfer based on the McElieceassumptions.” Proc. of ICITS’08, LNCS 5155, pp. 107-117, 2008[KMO08] K Kobara K Morozov and R Overbeck “Coding Based [KMO08] K. Kobara, K. Morozov and R. Overbeck Coding-Based Oblivious Transfer” Proc. of Mathematical Methods in Computer Science, LNCS 5393, pp. 142-156, 2008[BLN+09] D J Bernstein T Lange R Niederhagen C Peters P [BLN+09] D. J. Bernstein, T. Lange, R. Niederhagen, C. Peters, P. Schwabe. “FSBday: implementing Wagner's generalized birthday attack against the SHA-3 round-1 candidate FSB.” URL: http://cr.yp.to/papers.html#fsbday , 2009
No. 80
ReferencesReferencesReferencesReferences
[OTD08] A. Otmani, J.P. Tillich, L. Dallot, [O 08] . O a , J. . c , . a o , “Cryptanalysis of Two McEliece Cryptosystems Based on Quasi-Cyclic Codes,” http://arxiv org/abs/0804 0409 2008http://arxiv.org/abs/0804.0409 2008[DQN08] R. Dowsley and J. M. Quade and A. C. A. Nascimento, “A CCA2 Secure Public Key A. Nascimento, A CCA2 Secure Public Key Encryption Scheme Based on the McElieceAssumptions in the Standard Model,” http://eprint iacr org/2008/468 2008http://eprint.iacr.org/2008/468, 2008[FS09] M. Finiasz and N. Sendrier, “Security Bounds for the Design of Code-based Bounds for the Design of Code based Cryptosystems ” Proc of Asiacrypt’09, http://eprint.iacr.org/2009/414 , 2009
No. 81
ReferencesReferencesReferencesReferences
[Wie09] C. Wieschebrink, “Cryptanalysis of the Niederreiter[ ] yp yPublic Key Scheme Based on GRS Subcodes,” http://eprint.iacr.org/2009/452, 2009[MB09] R. Misoczki and P. Barreto, “Compact McEliece[ ] pKeys from Goppa Codes,” Proc. of SAC’09, pp. 2009 [MB09a] R. Misoczki and P. Barreto, personal communication, 2009 ,[BCG+09] T. Berger, P.-L. Cayrel, P. Gaborit, and A. Otmani, “Reducing Key Length of the McEliece Cryptosystem,” Proc. of AFRICACRYPT’09, LNCS5580, pp. 77-97, 2009, , pp ,[UL09] V. G. Umana and G. Leander “Practical Key Recovery Attacks On Two McEliece Variants,” http://eprint.iacr.org/2009/509, 2009http://eprint.iacr.org/2009/509, 2009
No. 82
Recommended