[论文解读] An Algebraic Attack on Rank Metric Code-Based Cryptosystems

Magali Bardet, Pierre Briaud+5 more|HAL (Le Centre pour la Communication Scientifique Directe)|Oct 2, 2019

Coding theory and cryptography参考文献 43被引用 6

一句话总结

本文通过在Ourivski-Johansson多项式系统中引入源自部分结式关系的附加方程，提出了一种针对基于秩度量码的密码系统的新型代数攻击，将求解度降低至r、r+1或r+2。该方法可实现更快的Gröbner基计算，并以经典攻击方式打破了ROLLO-I-256声称的256位安全强度，优于以往的代数与组合方法。

ABSTRACT

The Rank metric decoding problem is the main problem considered in cryptography based on codes in the rank metric. Very efficient schemes based on this problem or quasi-cyclic versions of it have been proposed recently, such as those in the submissions ROLLO and RQC currently at the second round of the NIST Post-Quantum Cryptography Standardization Process. While combinatorial attacks on this problem have been extensively studied and seem now well understood, the situation is not as satisfactory for algebraic attacks, for which previous work essentially suggested that they were ineffective for cryptographic parameters. In this paper, starting from Ourivski and Johansson's algebraic modelling of the problem into a system of polynomial equations, we show how to augment this system with easily computed equations so that the augmented system is solved much faster via Groebner bases. This happens because the augmented system has solving degree $r$, $r+1$ or $r+2$ depending on the parameters, where $r$ is the rank weight, which we show by extending results from Verbel et al. (PQCrypto 2019) on systems arising from the MinRank problem; with target rank $r$, Verbel et al. lower the solving degree to $r+2$, and even less for some favorable instances that they call superdetermined. We give complexity bounds for this approach as well as practical timings of an implementation using Magma. This improves upon the previously known complexity estimates for both Groebner basis and (non-quantum) combinatorial approaches, and for example leads to an attack in 200 bits on ROLLO-I-256 whose claimed security was 256 bits.

研究动机与目标

• 解决尽管存在强大的组合攻击，但针对基于秩度量码的密码学仍缺乏有效代数攻击的问题。
• 通过扩充多项式系统，改进利用Gröbner基技术求解MinRank问题的效率。
• 证明代数攻击能够打破如ROLLO和RQC等NIST PQC候选方案，从而破坏其声称的安全级别。
• 分析扩充系统求解度，并为实际与理论评估提供复杂度界。
• 表明即使原始系统设计用于抵抗代数方法，该攻击仍具有效性。

提出的方法

• 将Ourivski-Johansson的MinRank问题代数模型通过源自部分结式关系的附加多项式方程进行扩充。
• 在算法1中采用专门的变量代换策略，固定解矩阵的第一列与第一行，并将系数矩阵的某一列设为[1,0,…,0]^T。
• 应用递归子程序Solve(S,C,R)，通过Gröbner基技术构建并求解扩充系统。
• 引入概率分析，基于子矩阵的秩性质与有限域概率，估算攻击成功率。
• 利用Verbel等人（PQCrypto 2019）关于MinRank系统的成果，根据参数将求解度限定在r、r+1或r+2。
• 在Magma中实现该攻击，以验证性能并提供实际运行时间结果。

实验结果

研究问题

• RQ1 能否通过增强多项式系统，使代数攻击对基于秩度量码的密码系统有效？
• RQ2 扩充后的MinRank系统的求解度是多少？与原始系统相比有何差异？
• RQ3 该攻击能否在低于其声称安全级别的前提下，打破如ROLLO和RQC等NIST PQC候选方案？
• RQ4 攻击的成功概率如何随参数选择（如m、n、r和q）而变化？
• RQ5 变量代换与部分结式添加在多大程度上提升了攻击效率？

主要发现

• 扩充系统具有r、r+1或r+2的求解度，与原始系统相比，显著降低了Gröbner基计算的复杂度。
• 该攻击以低于其声称256位安全强度的经典攻击复杂度打破了ROLLO-I-256，揭示了关键漏洞。
• 对于NIST PQC提交方案中的参数，算法1在最多调用Solve子程序5次的情况下，成功率大于0.8。
• 在计算复杂度方面，该攻击优于以往的代数攻击与非量子组合攻击。
• 即使在大参数下，攻击的成功概率依然很高，通常无需第二次运行算法。
• 近期改进[13]进一步将攻击简化为求解线性系统，从而消除了对Gröbner基的需求，但原始攻击在大参数下仍具有效性且内存消耗较高。