Binary Goppa Codes Research Articles

A class of binary Goppa codes and induced new codes

A class of binary Goppa codes and induced new codes

An Efficient Implementation Scheme for Lattice Reduction in the List-Decoding Algorithm for the Binary Goppa Codes

An Efficient Implementation Scheme for Lattice Reduction in the List-Decoding Algorithm for the Binary Goppa Codes

The Number of Extended Irreducible Binary Goppa Codes

The Number of Extended Irreducible Binary Goppa Codes

Breaking Goppa-based McEliece with hints

We consider the McEliece cryptosystem with a binary Goppa code C⊂F2n specified by an irreducible Goppa polynomial g(x)∈F2m[X] and Goppa points (α1,…,αn)∈F2mn. Since g(x) together with the αi's allow for efficient decoding, these parameters form McEliece secret keys. Such a Goppa code C is an (n−tm)-dimensional subspace of F2n, and therefore C has co-dimension tm. For typical McEliece instantiations we have tm≈n4.We show that given more than tm elements of the Goppa points allows to recover the Goppa polynomial g(x) and the remaining entries in polynomial time. Hence, in case tm≈n4, roughly a fourth of a McEliece secret key is sufficient to recover the full key efficiently.Let us give an illustrative numerical example. For ClassicMcEliece with (n,t,m)=(3488,64,12) on input 64⋅12+1=769 Goppa points, we recover the remaining 3488−769=2719 Goppa points in F212 and the degree-64 Goppa polynomial g(x)∈F212[x] in 60 secs.Our results also extend to the case of erroneous Goppa points, but in this case our algorithms are no longer polynomial time.

Enumeration of Extended Irreducible Binary Goppa Codes

The family of Goppa codes is one of the most interesting subclasses of linear codes. As the McEliece cryptosystem often chooses a random Goppa code as its key, knowledge of the number of inequivalent Goppa codes for fixed parameters may facilitate in the evaluation of the security of such a cryptosystem. In this paper we present a new approach to give an upper bound on the number of inequivalent extended irreducible binary Goppa codes. To be more specific, let <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$n&gt;3$ </tex-math></inline-formula> be an odd prime number and <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$q=2^{n}$ </tex-math></inline-formula> ; let <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$r\geq 3$ </tex-math></inline-formula> be a positive integer satisfying <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\gcd (r,n)=1$ </tex-math></inline-formula> and <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\gcd \big (r,q(q^{2}-1)\big)=1$ </tex-math></inline-formula> . We obtain an upper bound for the number of inequivalent extended irreducible binary Goppa codes of length <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$q+1$ </tex-math></inline-formula> and degree <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$r$ </tex-math></inline-formula> .

Group Signature with Verifier-Local Revocation Based on Coding Theory

Group signature with verifier-local revocation (VLR-GS) is a special variant of revocable group signature that not only allows a user to anonymously sign messages but also only requires the verifiers to possess some up-to-date revocation information. To date, a number of VLR-GS schemes have been proposed under bilinear groups and lattices, while they have not yet been instantiated based on coding theory. In this paper, we present a code-based VLR-GS scheme in the random oracle model, which is the first construction to the best of our knowledge. Concretely, our VLR-GS scheme does not rely on the traditional paradigm which utilizes an encryption scheme as a building block and achieves logarithmic-size group signature. To obtain the scheme, we first introduce a new code-based Stern-like interactive zero-knowledge protocol with member revocation mechanism based on syndrome decoding problem. Moreover, we employ the binary Goppa code embedded for our scheme with efficiency and security analysis.

Post-Quantum Network Security:McEliece and Niederreiter Cryptosystems Analysis and Education Issues

The paper is aimed at analyzing of the classical McEliece and Niederreiter cryptosystems as well as theQuasi-Cyclic MDPC McEliece cipher in a context of the post-quantum network security. Theoretical foundations ofthe aforesaid cryptographic schemes are considered. The characteristics of the given cryptosystems and otherasymmetric encryption schemes are analyzed. The cipher metrics, which are considered in the paper, includecryptographic strength, performance, public key size and length of ciphertext. The binary Goppa codes are describedin the context of their role for the cryptanalytic resistance of the classic McEliece and Niederreiter schemes. Thecrucial advantages and drawbacks of the aforementioned cryptosystems are analyzed. The prospects for applicationof these ciphers to the network security protocols are outlined. The investigations, which are aimed at finding waysto reduce the public key sizes and improve the energy efficiency of the given ciphers, are briefly described. A neweducational module “Introduction to Post-Quantum Cryptography” is presented

Reliable Architectures for Composite-Field-Oriented Constructions of McEliece Post-Quantum Cryptography on FPGA

Code-based cryptography based on binary Goppa codes is a promising solution for thwarting attacks based on quantum computers. The McEliece cryptosystem is a code-based public-key cryptosystem which is believed to be resistant against quantum attacks. In fact, it is successfully advanced to the second round of the post-quantum cryptography standardization competition early 2019. Due to its very large key size, different variants of binary Goppa codes have been proposed. Nevertheless, research has shown that such codes can be thwarted through the injection of faults, causing erroneous outputs. In this work, we present countermeasures for the implementation of different composite field arithmetic units used in the McEliece cryptosystem. The proposed architectures use overhead-aware and tailored signatures. We apply these error detection signatures to the McEliece cryptosystem and perform field-programmable gate array (FPGA) implementations to show the feasibility of adopting the proposed schemes. We benchmark the overhead and performance degradation of the proposed approaches and show their suitability for constrained embedded systems.

ON DECODING ALGORITHMS FOR GENERALIZED REED — SOLOMON CODES WITH ERRORS AND ERASURES

The article is devoted to the decoding algorithms for generalized Reed Solomon codes with errorsand erasures. These algorithms are based on Gao algorithm, Sugiyama algorithm, Berlekamp Massey algorithm (Peterson Gorenstein Zierler algorithm). The first of these algorithms belongs to syndrome-free decoding algorithms, the others to syndrome decoding algorithms. The relevance of these algorithms is that they are applicable for decoding Goppa codes, which are the basis of some promising post-quantum cryptosystems. These algorithms are applicable for Goppa codes over an arbitrary field, as opposed to the well-known Patterson decoding algorithm for binary Goppa codes.

Implementation of key predistribution scheme in WSN based on binary Goppa codes and Reed Solomon codes with enhanced connectivity and resiliency

Establishing secure transmissions of messages among the resource limited sensor nodes in wireless sensor network (WSN) is a critical issue and requires secret keys to be established among the communicating nodes. Key predistribution is the most commonly used technique and whereby secret keys are preloaded to the sensor nodes before their deployment into a hostile region. A WSN can be structured or unstructured, and sensor nodes may be deployed in an ad-hoc manner or pre-planned manner into the target field. As sensor nodes are low-cost electronic devices equipped with data processing, limited storage, communication and computation power, connectivity, and resiliency are the major focus in designing key predistribution scheme (KPS) for WSNs. Furthermore, we also expect the KPS to be scalable, enabling insertion of a set of new nodes in WSN at any point of time without altering the key setup of the already existing nodes. Combinatorial design is a widely used mathematical tool for the KPS. However, most of the KPS developed by using combinatorial design are not scalable. In this article, rather than using combinatorial techniques, we employ a code-based approach and design a new method for key predistribution by building a communication model and a connectivity model. We exploit the Reed Solomon code to establish our communication model, integrate the binary Goppa code to derive our connectivity model, and skillfully blend these two models to construct our code-based KPS. A C implementation of our KPS confirms the significant performance gain over the existing similar works. Additionally, nodes in our KPS are all self-dependent for communication and do not rely on cluster heads. Furthermore, we have control over the choice of the parameters in the underlying codes which makes our KPS flexible. To be specific, prior knowledge of additional node deployment increases the scalability of our connectivity model. By suitably choosing the parameters of the Goppa code at prior, we can accommodate extra nodes. More interestingly, our communication model is scalable without any previous knowledge of deployment.

The number of extended irreducible binary Goppa codes of degree (2ℓ)m and length 2n+1

The number of extended irreducible binary Goppa codes of degree (2ℓ)m and length 2n+1

Codes in Dihedral Group Algebra

Robert McEliece developed an asymmetric encryption algorithm based on the use of binary Goppa codes in 1978 and no effective key attacks has been described yet. Variants of this cryptosystem are known due to the use of different codes types, but most of them were proven to be less secure. Code cryptosystems are considered an alternate to number-theoretical ones in connection with the development of quantum computing. So, the new classes of error-correcting codes are required for building new resistant code cryptosystems. Non-commutative codes, which simply are ideals of finite non-commutative group algebras, are an option. The Artin–Wedderburn theorem implies that a group algebra is isomorphic to a finite direct sum of matrix algebras, when the order of the group and the field characteristics are relatively prime. This theorem is important to study the structure of a non-commutative code, but it gives no information about summands and the isomorphism. In case of a dihedral group these summands and the isomorphism were found by F. E. Brochero Martinez. The purpose of the paper is to study codes in dihedral group algebras as and when the order of a group and a field characteristics are relatively prime. Using the result of F. E. Brochero Martinez, we consider a structure of all dihedral codes in this case and the codes induced by cyclic subgroup codes.

Counting extended irreducible binary Goppa codes of degree 2p and length 2^n+1

Let $n$ and $p$ be odd primes such that $p\neq n$ and $p\nmid(2^n \pm 1)$. An upper bound on the number of inequivalent extended irreducible binary Goppa codes of degree $2p$ and length $2^{n}+1$ is produced.

Counting extended irreducible binary Goppa codes of degree 2p and length 2^n+1

Let $n$ and $p$ be odd primes such that $p\neq n$ and $p\nmid(2^n \pm 1)$. An upper bound on the number of inequivalent extended irreducible binary Goppa codes of degree $2p$ and length $2^{n}+1$ is produced.

Enumeration of extended irreducible binary Goppa codes of degree $2^{m}$ and length $2^{n}+1$

Let $n$ be an odd prime and $m>1$ be a positive integer. We produce an upper bound on the number of inequivalent extended irreducible binary Goppa codes of degree $2^{m}$ and length $2^{n}+1$. Some examples are given to illustrate our results.

Error-correcting pairs for a public-key cryptosystem

Code-based Cryptography (CBC) is a powerful and promising alternative for quantum resistant cryptography. Indeed, together with lattice-based cryptography, multivariate cryptography and hash-based cryptography are the principal available techniques for post-quantum cryptography. CBC was first introduced by McEliece where he designed one of the most efficient Public-Key encryption schemes with exceptionally strong security guarantees and other desirable properties that still resist to attacks based on Quantum Fourier Transform and Amplitude Amplification.The original proposal, which remains unbroken, was based on binary Goppa codes. Later, several families of codes have been proposed in order to reduce the key size. Some of these alternatives have already been broken.One of the main requirements of a code-based cryptosystem is having high performance t-bounded decoding algorithms which is achieved in the case the code has a t-error-correcting pair (ECP). Indeed, those McEliece schemes that use GRS codes, BCH, Goppa and algebraic geometry codes are in fact using an error-correcting pair as a secret key. That is, the security of these Public-Key Cryptosystems is not only based on the inherent intractability of bounded distance decoding but also on the assumption that it is difficult to retrieve efficiently an error-correcting pair.In this paper, the class of codes with a t-ECP is proposed for the McEliece cryptosystem. Moreover, we study the hardness of distinguishing arbitrary codes from those having a t-error correcting pair.

Semantically Secure Symmetric Encryption with Error Correction for Distributed Storage

A distributed storage system (DSS) is a fundamental building block in many distributed applications. It applies linear network coding to achieve an optimal tradeoff between storage and repair bandwidth when node failures occur. Additively homomorphic encryption is compatible with linear network coding. The homomorphic property ensures that a linear combination of ciphertext messages decrypts to the same linear combination of the corresponding plaintext messages. In this paper, we construct a linearly homomorphic symmetric encryption scheme that is designed for a DSS. Our proposal provides simultaneous encryption and error correction by applying linear error correcting codes. We show its IND-CPA security for a limited number of messages based on binary Goppa codes and the following assumption: when dividing a scrambled generator matrix G^ into two parts G1^ and G2^, it is infeasible to distinguish G2^ from random and to find a statistical connection between G1^ and G2^. Our infeasibility assumptions are closely related to those underlying the McEliece public key cryptosystem but are considerably weaker. We believe that the proposed problem has independent cryptographic interest.

Constructions of Asymmetric Quantum Alternant Codes

Asymmetric quantum error-correcting codes (AQCs) have been proposed to deal with the significant asymmetry in many quantum channels, which may have more flexbility than general quantum error-correcting codes (QECs). In this paper, we construct AQCs based on Alternant codes. Firstly, we propose a new subclass of Alternant codes and combine them with BCH codes to construct AQCs. Then we construct AQCs based on series of nested pairs of subclasses of Alternant codes such as nested Goppa codes. As an illustrative example, we get three [[55, 6, 19/4]], [[55, 10, 19/3]], [[55, 15, 19/2]] AQCs from the well known [55, 16, 19] binary Goppa code. At last, we get asymptotically good binary expansions of quantum GRS codes, which are quantum generalizations of Retter’s classical results.

Optimized and Scalable Co-Processor for McEliece with Binary Goppa Codes

Asymmetric cryptographic primitives are essential to enable secure communications in public networks or public mediums. Such primitives can be deployed as software libraries or hardware co-processors, the latter being more commonly employed in systems on chip (SoC) scenarios, embedded devices, or application-specific servers. Unfortunately, the most commonly available solutions, based on RSA or elliptic curve cryptography (ECC), are highly processing intensive due to the underlying extended-precision modular arithmetic. Consequently, they are not available on highly constrained platforms. Aiming to tackle this issue, we here investigate an alternative asymmetric encryption scheme that relies on lightweight arithmetic: McEliece. This scheme is especially appealing because, being based on error correction codes, it displays a simpler arithmetic and leads to better performance when compared to RSA or ECC. To evaluate the implementation of this scheme in hardware, we propose and analyze a flexible architecture whose security level and time versus area usage characteristics can be reconfigured as desired. The proposed architecture is suitable to all usual security levels, ranging from 80 to 256 bits. It is also very efficient, being able to perform data decryption with binary Goppa codes in 56µs with 3,402 slices on a Xilinx Spartan-3AN FPGA, whereas the best-known result in the literature for the same FPGA is 115µs with 7,331 slices. Alternatively, the architecture can operate with quasi-dyadic Goppa (QD-Goppa) codes, which involves smaller keys than traditional binary Goppa codes. In the latter case, for an 80-bit security level, the decryption operation can take from 1.1ms with 1,129 slices to 68µs with 8,268 sices. By choosing a more hardware-friendly decoding algorithm, focusing hardware resources on most bottleneck operations and sharing hardware resource for two different algorithms, better results than the those in the literature were obtained.

Implementing QC-MDPC McEliece Encryption

With respect to performance, asymmetric code-based cryptography based on binary Goppa codes has been reported as a highly interesting alternative to RSA and ECC. A major drawback is still the large keys in the range between 50 and 100KB that prevented real-world applications of code-based cryptosystems so far. A recent proposal by Misoczki et al. showed that quasi-cyclic moderate-density parity-check (QC-MDPC) codes can be used in McEliece encryption, reducing the public key to just 0.6KB to achieve an 80-bit security level. In this article, we provide optimized decoding techniques for MDPC codes and survey several efficient implementations of the QC-MDPC McEliece cryptosystem. This includes high-speed and lightweight architectures for reconfigurable hardware, efficient coding styles for ARM’s Cortex-M4 microcontroller, and novel high-performance software implementations that fully employ vector instructions. Finally, we conclude that McEliece encryption in combination with QC-MDPC codes not only enables high-performance implementations but also allows for lightweight designs on a wide range of different platforms.