[Paper Review] Two attacks on rank metric code-based schemes: RankSign and an Identity-Based-Encryption scheme

Thomas Debris-Alazard, Jean–Pierre Tillich|arXiv (Cornell University)|Apr 7, 2018

Cryptography and Data Security21 references3 citations

TL;DR

This paper presents two critical algebraic attacks on rank metric code-based cryptosystems: RankSign and an Identity-Based Encryption (IBE) scheme from [GHPT17]. The attacks exploit low-weight codewords in augmented LRPC codes, breaking all proposed parameters of RankSign and undermining the security of the IBE scheme by targeting its underlying RSL problem, rendering both schemes insecure under current parameter choices.

ABSTRACT

RankSign [GRSZ14a] is a code-based signature scheme proposed to the NIST competition for quantum-safe cryptography [AGHRZ17] and, moreover, is a fundamental building block of a new Identity-Based-Encryption (IBE) [GHPT17a]. This signature scheme is based on the rank metric and enjoys remarkably small key sizes, about 10KBytes for an intended level of security of 128 bits. Unfortunately we will show that all the parameters proposed for this scheme in [AGHRZ17] can be broken by an algebraic attack that exploits the fact that the augmented LRPC codes used in this scheme have very low weight codewords. Therefore, without RankSign the IBE cannot be instantiated at this time. As a second contribution we will show that the problem is deeper than finding a new signature in rank-based cryptography, we also found an attack on the generic problem upon which its security reduction relies. However, contrarily to the RankSign scheme, it seems that the parameters of the IBE scheme could be chosen in order to avoid our attack. Finally, we have also shown that if one replaces the rank metric in the [GHPT17a] IBE scheme by the Hamming metric, then a devastating attack can be found.

Motivation & Objective

• To analyze the security of RankSign, a code-based signature scheme submitted to the NIST post-quantum cryptography standardization process.
• To investigate the security of an Identity-Based Encryption (IBE) scheme based on rank metric codes, which relies on RankSign as a foundational primitive.
• To identify structural vulnerabilities in the parameter design of rank metric schemes that lead to exploitable low-weight codewords.
• To determine whether the GPV-style IBE construction can be secured in the rank metric, and whether it remains viable in the Hamming metric.
• To evaluate the feasibility of repairing the schemes through parameter tuning or structural modifications.

Proposed method

• The attack on RankSign exploits the presence of low-weight codewords in the augmented LRPC code used in the scheme’s key generation process.
• An algebraic attack is mounted by solving a system of multivariate quadratic equations derived from the public key and the structure of the LRPC code.
• The attack leverages the fact that the parameters of RankSign enforce a specific relation between code length, dimension, and minimum distance, which results in codewords of weight 2.
• For the IBE scheme, the attack targets the RSL problem by constructing a code from public data that contains low-weight codewords, which are then found via algebraic techniques.
• The paper analyzes the complexity of generic decoding algorithms in the Hamming metric and shows they lead to a devastating polynomial-time attack on the IBE scheme when the rank metric is replaced by the Hamming metric.
• Theoretical analysis uses entropy bounds and asymptotic approximations to show that the difference in entropy between two binomial distributions is bounded by O(log n), supporting the feasibility of the attack.

Experimental results

Research questions

• RQ1 Can the RankSign signature scheme be broken via an algebraic attack exploiting low-weight codewords in its underlying LRPC code?
• RQ2 Does the security of the IBE scheme from [GHPT17] rely on a vulnerable assumption that can be directly attacked?
• RQ3 Can the GPV-style IBE construction be made secure in the rank metric, or is it fundamentally flawed under current parameter choices?
• RQ4 Is the IBE scheme secure when the rank metric is replaced by the Hamming metric, and what are the implications for code-based IBE design?
• RQ5 Can the structural vulnerabilities in these schemes be repaired by parameter adjustment alone, or does the scheme require architectural changes?

Key findings

• All proposed parameters for RankSign are broken by an algebraic attack due to the presence of weight-2 codewords in the augmented LRPC code.
• The attack on RankSign is polynomial-time and not avoidable by parameter tuning, indicating a fundamental flaw in the scheme’s design.
• The IBE scheme from [GHPT17] is also broken because its security relies on the same RSL problem, which is vulnerable to the same algebraic attack when low-weight codewords exist.
• The IBE scheme can potentially be repaired by carefully choosing parameters to avoid low-weight codewords, but this requires a redesign of the scheme’s parameter generation process.
• Replacing the rank metric with the Hamming metric in the IBE scheme leads to a devastating polynomial-time attack using generic decoding, making this approach infeasible.
• The results suggest that the GPV-style IBE construction is not viable in the Hamming metric, and alternative paradigms—such as one-time signatures with encryption—should be explored for code-based IBE.