[论文解读] Improvements of Algebraic Attacks for solving the Rank Decoding and MinRank problems

Magali Bardet, Maxime Bros+6 more|HAL (Le Centre pour la Communication Scientifique Directe)|Feb 14, 2020

Coding theory and cryptography参考文献 28被引用 8

一句话总结

本文针对秩度量码基后量子密码学中的核心难题——秩解码与MinRank问题，提出了代数攻击的重大改进。通过重构问题以避免昂贵的Gröbner基计算，转而求解由矩阵子式导出的线性系统，作者显著降低了攻击复杂度——在ROLLO-I-128/192/256上的比特复杂度分别降至71、87和151，相较之前工作中的117、144和197有显著降低。

ABSTRACT

Rank Decoding (RD) is the main underlying problem in rank-based cryptography. Based on this problem and quasi-cyclic versions of it, very efficient schemes have been proposed recently, such as those in the ROLLO and RQC submissions, which have reached the second round of the NIST Post-Quantum competition. Two main approaches have been studied to solve RD: combinatorial ones and algebraic ones. While the former has been studied extensively, a better understanding of the latter was recently obtained by Bardet et al. (EUROCRYPT20) where it appeared that algebraic attacks can often be more efficient than combinatorial ones for cryptographic parameters. This paper gives substantial improvements upon this attack in terms both of complexity and of the assumptions required by the cryptanalysis. We present attacks for ROLLO-I-128, 192, and 256 with bit complexity respectively in 70, 86, and 158, to be compared to 117, 144, and 197 for the aforementionned previous attack. Moreover, unlike this previous attack, ours does not need generic Gröbner basis algorithms since it only requires to solve a linear system. For a case called overdetermined, this modeling allows us to avoid Gröbner basis computations by going directly to solving a linear system. For the other case, called underdetermined, we also improve the results from the previous attack by combining the Ourivski-Johansson modeling together with a new modeling for a generic MinRank instance; the latter modeling allows us to refine the analysis of MinRank's complexity given in the paper by Verbel et al. (PQC19). Finally, since the proposed parameters of ROLLO and RQC are completely broken by our new attack, we give examples of new parameters for ROLLO and RQC that make them resistant to our attacks. These new parameters show that these systems remain attractive, with a loss of only about 50\% in terms of key size for ROLLO-I.

研究动机与目标

• 改进针对秩解码与MinRank问题的代数攻击，这些问题在秩度量码基后量子密码学中具有核心地位。
• 通过以求解线性系统替代Gröbner基计算，克服先前代数攻击中Gröbner基计算成本过高的问题。
• 通过通用性假设与实验验证，为新方法的有效性提供理论与实证支持。
• 通过展示相较之前工作的更低攻击复杂度，实现对现有NIST-PQC候选方案ROLLO与RQC的破解或削弱。
• 将该方法推广至一般MinRank问题，提升GeMSS与Rainbow等方案的已知代数攻击复杂度。

提出的方法

• 将秩解码问题重构为由误差矩阵的秩条件导出的多项式方程组。
• 识别并利用误差矩阵最大子式的零度（nullity）以生成线性方程，而非高次多项式。
• 采用子空间选择策略实现系统线性化，避免计算Gröbner基。
• 通过聚焦于结构化矩阵的最大子式为零的性质，将相同线性化技术应用于MinRank问题。
• 利用码结构与误差矩阵的特性，确保所得线性系统在通用性假设下为欠定但可解。
• 通过实验验证方法，并与现有组合与代数方法比较攻击复杂度。

实验结果

研究问题

• RQ1 能否通过避免Gröbner基而改用求解线性系统，使秩解码的代数攻击更高效？
• RQ2 为何代数攻击在秩度量密码学中的结构化MinRank实例上表现有效？其结构特性是什么？
• RQ3 当该新攻击方法应用于NIST-PQC候选方案（如ROLLO与RQC）时，其理论与实际复杂度如何？
• RQ4 与现有针对GeMSS与Rainbow等方案的最优组合与代数攻击相比，新方法表现如何？
• RQ5 该线性化方法能否推广至后量子密码学中的其他结构化代数问题？

主要发现

• 新攻击将ROLLO-I-128的比特复杂度降至71，相较之前工作的117有显著降低，大幅削弱了安全裕度。
• 对于ROLLO-I-192与ROLLO-I-256，攻击复杂度分别降至87与151比特，相较之前工作的144与197比特有明显改善。
• 对于某些参数集，该方法完全避免了Gröbner基计算，仅依赖于由矩阵子式导出的线性系统求解。
• 该方法可推广至MinRank问题，在GeMSS与Rainbow方案中实现了目前已知最优的代数攻击复杂度，与现有攻击相当或略优。
• 理论分析与实验结果均表明，在通用性假设下，该线性化策略有效，且在所测参数下表现一致。
• 提出了抵抗新攻击的新参数集，ROLLO-I的密钥尺寸仅增加约50%，保持了实用性。