McEliece Cryptosystem Research Articles

Leveraging HLS to Design a Versatile & High-Performance Classic McEliece Accelerator

By harnessing fundamental quantum properties, a large-scale quantum computer could undermine currently deployed public-key algorithms. The post-quantum, code-based cryptosystem Classic McEliece (CM) addresses this security concern. However, its large public key size (up to 1.3MB) poses various hardware implementation challenges. In this paper, we focus on the high memory bandwidth requirements of the CM encoding function, in the context of heterogeneous CPU-FPGA devices. More concretely, we target the acceleration of public-key loading and processing from any globally-shared or accelerator-private memory system. We present a novel and constant-time accelerator eEnc that exploits the elevated parallelization potential of FPGA devices to yield high-performance results. Our accelerator implements the encoding and the random error vector generation functions, which comprise the main computational load of Encapsulation. Two accelerator design variants are introduced, providing different hardware tradeoffs. Regarding intra-accelerator data communication, and unlike other state-of-the-art (SOTA) works, we combine a streaming protocol with task-level parallelization to remove the need to store the public key in accelerator-private memories. Our proposed design shows new record execution times over its SOTA counterparts, ranging on average from 3.5 × up to 7.7 × across the five security level parameter sets. Our end-to-end implementation in a Zynq SoC shows an average speedup of 2.2 × compared to a 64-bit vectorized CM software-baseline. The elevated logic resource consumption, characteristic of HLS designs, can be readily adjusted with a performance tradeoff.

A smart surveillance system utilizing modified federated machine learning: Gossip‐verifiable and quantum‐safe approach

SummaryEdge computing has the capability to process data closer to its point of origin, leading to the development of critical autonomous infrastructures with frequently communicating peers. The proposed work aims to evaluate the effectiveness of security and privacy mechanisms tailored for distributed systems, particularly focusing on scenarios where the nodes are closed‐circuit television (CCTV) systems. Ensuring public safety, object tracking in surveillance systems is a vital responsibility. The workflow has been specifically crafted and simulated for the purpose of weapon detection within public CCTV systems, utilizing sample edge devices. The system's primary objective is to detect any unauthorized use of weapons in public spaces while concurrently ensuring the integrity of video footage for use in criminal investigations. The outcomes of prior research on distributed machine learning (DML) techniques are compared with modified federated machine learning (FML) techniques, specifically designed for being Gossip verifiable and Quantum Safe. The conventional federated averaging algorithm is modified by incorporating the secret sharing principle, coupled with code‐based McEliece cryptosystem. This adaptation is designed to fortify the system against quantum threats. The Gossip data dissemination protocol, executed via custom blockchain atop the distributed network, serves to authenticate and validate the learning model propagated among the peers in the network. It provides additional layer of integrity to the system. Potential threats to the proposed model are analyzed and the efficiency of the work is assessed using formal proofs. The outcomes of the proposed work demonstrate that the trustworthiness and consistency are meticulously preserved for both the model and data within the DML framework on the Edge computing platform.

Evaluation and comparison of lattice-based digital signature of the "Digital Signature Schemes" PQC NIST competition

Over the past decade, post-quantum cryptography has reached a tipping point; institutional bodies and stakeholders have initiated standardization and deployment, and various projects have achieved a reasonably high level of progress and even deployment and implementation. In July 2022, at the end of Round 3 of the NIST's PQC competition, 3 candidates were proposed for the NIST standardization for post-quantum digital signatures scheme: one signature scheme based on MLWE (Crystals-Dilithium), one signature based on NTRU (Falcon), and one signature based on hash (Sphincs+). Although the performance profiles and “black-box” security of these schemes are well understood, resistance to side-channel attacks remains a weak point for all of them. After that, the NIST announced that the PQC standardization process is continuing with a fourth round, with the following KEMs still under consideration: BIKE, Classic McEliece, HQC, and SIKE. However, there are no candidates of digital signature schemes left for consideration. As such, the NIST has issued a call for additional digital signature proposals to be considered in the PQC standardization process. Acceptance of documents ended on June 1, 2023. As a result, 40 candidates were selected for the role of DS standard, namely: 6 DS algorithms based on codes, one DS algorithm based on isogenies, 7 DS algorithms based on lattice operations, 7 candidates for the role of DS algorithm based on the MPC method -in-the-Head and 10 algorithms based on multivariate transformations, 4 DS schemes were selected based on symmetric cryptographic transformations, and 5 more candidates based on other types of cryptographic transformations. The NIST is primarily interested in additional general purpose signature schemes that are not based on structured lattices. For certain applications, such as certificate transparency, the NIST may also be interested in signature schemes that have short signatures and fast verification. The NIST is open to receiving additional materials based on structured lattices, but intends to diversify post-quantum signature standards. Therefore, any structured array-based signature proposal would need to significantly outperform CRYSTALS-Dilithium and FALCON in relevant applications and/or provide significant additional security properties to be considered for standardization. Thus, the purpose of this paper is to analyze, evaluate, and compare digital signature algorithms based on lattice cryptography, an additional PQC NIST competition, and compare them with already standardized lattice-based DS mechanisms, such as CRYSTALS-Dilithium and FALCON.

Structural analysis of code-based algorithms of the NIST post-quantum call

Abstract Code-based cryptography is currently the second most promising post-quantum mathematical tool for quantum-resistant algorithms. Since in 2022 the first post-quantum standard Key Encapsulation Mechanism, Kyber (a latticed-based algorithm), was selected to be established as standard, and after that the National Institute of Standards and Technology post-quantum standardization call focused in code-based cryptosystems. Three of the four candidates that remain in the fourth round are code-based algorithms. In fact, the only non-code-based algorithm (SIKE) is now considered vulnerable. Due to this landscape, it is crucial to update previous results about these algorithms and their functioning. The Fujisaki-Okamoto transformation is a key part of the study of post-quantum algorithms and in this work we focus our analysis on Classic McEliece, BIKE and HQC proposals, and how they apply this transformation to obtain IND-CCA semantic security. Since after security the most important parameter in the evaluation of the algorithms is performance, we have compared the performance of the code-based algorithms of the NIST call considering the same architecture for all of them.

Integer syndrome decoding in the presence of noise

Code-based cryptography received attention after the NIST started the post-quantum cryptography standardization process in 2016. A central NP-hard problem is the binary syndrome decoding problem, on which the security of many code-based cryptosystems lies. The best known methods to solve this problem all stem from the information-set decoding strategy, first introduced by Prange in 1962. A recent line of work considers augmented versions of this strategy, with hints typically provided by side-channel information. In this work, we consider the integer syndrome decoding problem, where the integer syndrome is available but might be noisy. We study how the performance of the decoder is affected by the noise. First we identify the noise model as being close to a centered in zero binomial distribution. Second we model the probability of success of the ISD-score decoder in presence of a binomial noise. Third, we demonstrate that with high probability our algorithm finds the solution as long as the noise parameter d is linear in t (the Hamming weight of the solution) and t is sub-linear in the code-length. We provide experimental results on cryptographic parameters for the BIKE and Classic McEliece cryptosystems, which are both candidates for the fourth round of the NIST standardization process.

Encryption Method Based on Codes

This paper proposes an improvement of the McEliece asymmetric cryptosystem based on code-based cryptography by replacing the permutation matrix with a modulo operation and using a finite field GF(q) . This approach increases the complexity of the decryption process for potential attackers, providing a high level of cryptographic security without changing the length of the key. The article provides a diagram of the improved operation of the cryptosystem and describes examples of application. An analysis of the number of possible combinations of matrices has been carried out for different implementation options of code (7,4) based on different numerical systems. It has been shown that achieving cryptographic security comparable to the original McEliece cryptosystem requires the use of q≥5.

Understanding binary-Goppa decoding

This paper reviews, from bottom to top, a polynomial-time algorithm to correct t errors in classical binary Goppa codes defined by squarefree degree- t polynomials. The proof is factored through a proof of a simple Reed–Solomon decoder, and the algorithm is simpler than Patterson's algorithm. All algorithm layers are expressed as Sage scripts backed by test scripts. All theorems are formally verified. The paper also covers the use of decoding inside the Classic McEliece cryptosystem, including reliable recognition of valid inputs.

Efficient ASIC Architecture for Low Latency Classic McEliece Decoding

Post-quantum cryptography addresses the increasing threat that quantum computing poses to modern communication systems. Among the available “quantum-resistant” systems, the Classic McEliece key encapsulation mechanism (KEM) is positioned as a conservative choice with strong security guarantees. Building upon the code-based Niederreiter cryptosystem, this KEM enables high performance encapsulation and decapsulation and is thus ideally suited for applications such as the acceleration of server workloads. However, until now, no ASIC architecture is available for low latency computation of Classic McEliece operations. Therefore, the present work targets the design, implementation and optimization of a tailored ASIC architecture for low latency Classic McEliece decoding. An efficient ASIC design is proposed, which was implemented and manufactured in a 22 nm FDSOI CMOS technology node. We also introduce a novel inversionless architecture for the computation of error-locator polynomials as well as a systolic array for combined syndrome computation and polynomial evaluation. With these approaches, the associated optimized architecture improves the latency of computing error-locator polynomials by 47% and the overall decoding latency by 27% compared to a state-of-the-art reference, while requiring only 25% of the area.

ADMM and Reproducing Sum-Product Decoding Algorithm Applied to QC-MDPC Code-Based McEliece Cryptosystems

ADMM and Reproducing Sum-Product Decoding Algorithm Applied to QC-MDPC Code-Based McEliece Cryptosystems

Secure and Compact: A New Variant of McEliece Cryptosystem

Secure and Compact: A New Variant of McEliece Cryptosystem

Efficient Reconstruction in Key Recovery Attack on the QC-MDPC McEliece Cryptosystems

Efficient Reconstruction in Key Recovery Attack on the QC-MDPC McEliece Cryptosystems

PKC-SPE: A Variant of McEliece Cryptosystem based on Systematic Polar Encoding

PKC-SPE: A Variant of McEliece Cryptosystem based on Systematic Polar Encoding

Acceleration of a Classic McEliece Postquantum Cryptosystem With Cache Processing

Acceleration of a Classic McEliece Postquantum Cryptosystem With Cache Processing

Analysis and comparison of the security of electronic signatures based on new quantum-resistant problems

Due to the development of quantum computers and quantum methods and algorithms, in order to ensure the security of information after the development of cryptographically relevant quantum computers, NIST conducted the NIST PQC competition. As a result of conducting three rounds of NIST PQC, NIST selected 4 candidates for standardization and four candidates for the fourth round (key encapsulation mechanisms BIKE, Classic McEliece, HQC, and SIKE (which the developers considered unreliable)). Due to the fact that selected algorithms are based on the use of lattices and to add diversity to this list through the use of general-purpose signatures, the process of standardizing additional digital signatures for quantum-resistant cryptography has been initiated.
 The following types of signatures are considered for the first round of this standardization process: code-based signatures, isogeny signatures, multivariate signatures, symmetric signatures, MPC-in-the-head, and NIST-defined "other" signatures. These "other" digital signatures are mostly based on new and promising post-quantum (quantum-resistant) problems.
 The purpose of the work is to analyze and compare candidates for quantum-resistant digital signatures, based on new and promising quantum-resistant problems, resistant to classical and quantum attacks and side-channel attacks. The paper provides comparison of four digital signatures classified by NIST as "other", namely: ALTEQ, eMLE-Sig 2.0, KAZ-SIGN, Xifrat1-Sign.I. For this purpose, the paper presents the basic principles of each of these digital signatures, their main parameters and available at the time of consideration attack vectors. The paper also provides unconditional criteria necessary for comparison. Digital signatures were compared according to such unconditional criteria as: possible lengths of the public key, possible lengths of the personal (secret) key, length of the result of cryptographic algorithm; and conclusions are made regarding the completeness of given comparison and the possibility of further research is highlighted.

Low-Complexity Parallel Min-Sum Medium-Density Parity-Check Decoder for McEliece Cryptosystem

Low-Complexity Parallel Min-Sum Medium-Density Parity-Check Decoder for McEliece Cryptosystem

Security analysis of the Classic McEliece, HQC and BIKE schemes in low memory

With the advancement of NIST PQC standardization, three of the four candidates in Round 4 are code-based schemes, namely Classic McEliece, HQC and BIKE. Currently, one of the most important tasks is to further analyze their security levels for the suggested parameter sets. At PKC 2022, Esser and Bellini restated the major information set decoding (ISD) algorithms by using nearest neighbor technique and then applied these ISD algorithms to estimate the bit security of Classic McEliece, HQC and BIKE under the suggested parameter sets. However, all major ISD algorithms consume a large amount of memory, which in turn affects their time complexities. In this paper, we theoretically reestimate the security levels of the parameter sets suggested by these three schemes in low memory by applying K-list sum algorithms to ISD framework. Compared with Esser–Bellini’s algorithms, our results achieve the best gains for Classic McEliece, HQC, and BIKE, with reductions in security levels of 11.09, 12.64, and 12.19 bits, respectively.

Chosen-ciphertext secure code-based threshold public key encryptions with short ciphertext

Threshold public-key encryption (threshold PKE) has various useful applications. A lot of threshold PKE schemes are proposed based on RSA, Diffie–Hellman and lattice, but to the best of our knowledge, code-based threshold PKEs have not been proposed. In this paper, we provide three IND-CCA secure code-based threshold PKE schemes. The first scheme is the concrete instantiation of Dodis–Katz conversion (Dodis and Katz, TCC’05) that converts an IND-CCA secure PKE into an IND-CCA secure threshold PKE using parallel encryption and a signature scheme. This approach provides non-interactive threshold decryption, but ciphertexts are large (about 16 kilobytes for 128-bit security) due to long code-based signatures even in the state-of-the-art one. The second scheme is a new parallel encryption-based construction without signature schemes. Unlike the Dodis–Katz conversion, our parallel encryption converts an OW-CPA secure PKE into an OW-CPA secure threshold PKE. To enhance security, we use Cong et al.’s conversion (Cong et al., ASIACRYPT’21). Thanks to eliminating signatures, its ciphertext is 512 bytes, which is only 3% of the first scheme. The decryption process needs an MPC for computing hash functions, but decryption of OW-CPA secure PKE can be done locally. The third scheme is an MPC-based threshold PKE scheme from code-based assumption. We take the same approach Cong et al. took to construct efficient lattice-based threshold PKEs. We build an MPC for the decryption algorithm of OW-CPA secure Classic McEliece PKE. This scheme has the shortest ciphertext among the three schemes at just 192 bytes. Compared to the regular CCA secure Classic McEliece PKE, the additional ciphertext length is only 100 bytes. The cons are heavy distributed computation in the decryption process.

A Decoder for a Lightweight McEliece Cryptosystem Based on Concatenated Codes

Large-scale quantum computers threaten the security of today's public-key cryptography. The McEliece cryptosystem is one of the most promising candidates for post-quantum cryptography. However, the McEliece system has the drawback of large key sizes for the public key. Similar to other public-key cryptosystems, the McEliece system has a comparably high computational complexity. Embedded devices often lack the required computational resources to compute those systems with sufficiently low latency. Hence, those systems require hardware acceleration. Lately, a generalized concatenated code construction was proposed together with a restrictive channel model, which allows for much smaller public keys for comparable security levels. In this work, we propose a hardware decoder suitable for a McEliece system based on these generalized concatenated codes. The results show that those systems are suitable for resource-constrained embedded devices.

Sparsity-Aware Medium-Density Parity-Check Decoder for McEliece Cryptosystems

McEliece cryptosystem based on medium-density parity-check (MDPC) codes is one of the finalists for the post-quantum cryptography standard. Although decoder design for low-density parity-check (LDPC) codes used for digital communications is well-investigated, the design of MDPC decoders faces many new challenges due to the different structure in the parity-check matrix. Even though the parity-check matrices of MDPC codes have relatively higher density, they are still very sparse. Previous decoder designs did not explore such sparsity and derive the columns of the parity check matrix one after the other by cyclic shifting. This paper proposes a low-complexity MDPC decoder design by exploiting the sparsity of the parity-check matrix. The processing corresponding to zero segments of each parity check matrix column is skipped to substantially reduce the latency. Moreover, the columns are processed in a novel non-consecutive order to significantly reduce the number of memory writes for deriving all the columns and accordingly the power consumption. For an example MDPC code considered for the standard, the proposed design can reduce both the decoding latency and the number of memory writes by 70% with 35% area saving.

Skew differential Goppa codes and their application to Mceliece cryptosystem

A class of linear codes that extends classical Goppa codes to a non-commutative context is defined. An efficient decoding algorithm, based on the solution of a non-commutative key equation, is designed. We show how the parameters of these codes, when the alphabet is a finite field, may be adjusted to propose a McEliece-type cryptosystem.