Cryptanalysis of a One-Time Code-Based Digital Signature Scheme

TL;DR

This paper demonstrates a practical key recovery attack on a recent one-time code-based digital signature scheme, exploiting signature sparsity and statistical analysis to significantly reduce the security level.

Contribution

It introduces a novel attack method that recovers secret keys from a single intercepted signature, challenging the claimed security of the scheme.

Findings

Successful key recovery with low complexity

Attack exploits signature sparsity and statistical analysis

Security level claims are significantly undermined

Abstract

We consider a one-time digital signature scheme recently proposed by Persichetti and show that a successful key recovery attack can be mounted with limited complexity. The attack we propose exploits a single signature intercepted by the attacker, and relies on a statistical analysis performed over such a signature, followed by information set decoding. We assess the attack complexity and show that a full recovery of the secret key can be performed with a work factor that is far below the claimed security level. The efficiency of the attack is motivated by the sparsity of the signature, which leads to a significant information leakage about the secret key.

Tables

Table 1. TABLE I: Effectiveness of the key recovery attack instances proposed in [ 17 ] , for Lee-Brickell ISD with j = 2 𝑗 2 j=2 .

$p$	$w^{\left(e\right)}$	$w^{\left(y\right)}$	$w^{\left(c\right)}$	$b$	$P\left\{\mathrm{wt}\left\{{𝐞}^{\ast }\left(x\right)\right\}=0\right\}$	$C_{\text{ISD}}$
$3072$	$85$	$85$	$7$	$5$	$2^{-3.37}$	$2^{35.10}$
$4801$	$90$	$100$	$10$	$7$	$2^{-1.15}$	$2^{37.58}$
$6272$	$125$	$125$	$10$	$7$	$2^{-1.84}$	$2^{38.37}$
$9857$	$150$	$200$	$15$	$9$	$2^{-0.23}$	$2^{42.54}$

Table 2. TABLE II: Effectiveness of the key recovery attack on some system instances with p = 4801 𝑝 4801 p=4801 , for Lee-Brickell ISD with j = 2 𝑗 2 j=2 .

$w^{\left(e\right)}$	$w^{\left(y\right)}$	$w^{\left(c\right)}$	$b$	$P\left\{\mathrm{wt}\left\{{𝐞}^{\ast }\left(x\right)\right\}=0\right\}$	$C_{\text{ISD}}$
$90$	$300$	$8$	$6$	$2^{-4.01}$	$2^{37.05}$
$100$	$400$	$6$	$4$	$2^{-12.16}$	$2^{38.95}$
$90$	$1000$	$10$	$7$	$2^{-13.10}$	$2^{39.18}$
$90$	$100$	$20$	$12$	$2^{-0.46}$	$2^{38.56}$
$180$	$100$	$10$	$7$	$2^{-16.60}$	$2^{54.98}$

Equations

$$\mathbf{a}=[a_{0,0},a_{0,1},\cdots ,a_{0,p-1},a_{1,0},a_{1,1},\cdots ,a_{1,p-1}],$$

$$\mathbf{H}{\mathbf{e}}^T={\mathbf{s}}_e.$$

$${\text{synd}}_h\{\mathbf{z}(x)\}=c(x){\text{synd}}_h\{\mathbf{e}(x)\}+{\text{synd}}_h\{\mathbf{y}(x)\},$$

$$w^{(c)}{w}^{(e)}+w^{(y)}\le d^{(\text{GV})}.$$

$$c(x)=\sum _{v\in \Im \{c(x)\}}{x}^v,$$

$$z_i^{(v)}(x)$$

$$=x^{-v}{y}_i(x)+e_i(x)+\sum _{\begin{array}{c}l\in \Im \{c(x)\}\\ l\ne v\end{array}}{x}^{-v+l}{e}_i(x)$$

$$=y^{(v)}(x)+e_i(x)+\sum _{\begin{array}{c}l\in \Im \{c(x)\}\\ l\ne v\end{array}}{e}_i^{(v-l)}(x).$$

$${\hat{d}}_i(x)=\sum _{j=0}^p{\hat{d}}_{i,j}{x}^j=\sum _{v\in \Im \{c(x)\}}{\hat{z}}_i^{(v)}(x),$$

$$e_{i,j}^{\prime }=\{\begin{array}{ll}0& \text{if d^i,j<b,}\\ 1& \text{if d^i,j≥b,}\end{array}$$

$$s^{\ast }(x)$$

$$={\text{synd}}_h\{\mathbf{e}(x)\}+{\text{synd}}_h\{{\mathbf{e}}^{\prime }(x)\}$$

$$=\left[e_0(x)+e_0^{\prime }(x)\right]+h(x)\left[e_1(x)+e_1^{\prime }(x)\right]$$

$$={\text{synd}}_h\{{\mathbf{e}}^{\ast }(x)\},$$

$$P\left\{w_0^{(e)},w_0^{(y)}\right\}=\frac{\left(\genfrac{}{}{0ex}{}{p}{w_0^{(e)}}\right)\left(\genfrac{}{}{0ex}{}{p}{w^{(e)}-w_0^{(e)}}\right)}{\left(\genfrac{}{}{0ex}{}{2p}{w^{(e)}}\right)}\frac{\left(\genfrac{}{}{0ex}{}{p}{w_0^{(y)}}\right)\left(\genfrac{}{}{0ex}{}{p}{w^{(y)}-w_0^{(y)}}\right)}{\left(\genfrac{}{}{0ex}{}{2p}{w^{(y)}}\right)}.$$

$${\tilde{e}}_i^{(v)}(x)=\sum _{\begin{array}{c}l\in \Im \{c(x)\}\\ l\ne v\end{array}}{e}_i^{(v-l)}(x),$$

$${\rho }_i=\sum _{\begin{array}{c}j=0\\ j\text{even}\end{array}}^{w^{(c)}-1}\left(\genfrac{}{}{0ex}{}{w^{(c)}-1}{j}\right){\left(\frac{w_i^{(e)}}{p}\right)}^j{\left(1-\frac{w_i^{(e)}}{p}\right)}^{w^{(c)}-1-j},$$

$${\rho }_i^{\text{null}}=\left(1-{\rho }_i\right)\frac{w_i^{(y)}}{p}+{\rho }_i\left(1-\frac{w_i^{(y)}}{p}\right).$$

$${\rho }_i^{\text{set}}=\sum _{j=b}^{w^{(c)}}\left(\genfrac{}{}{0ex}{}{w^{(c)}}{j}\right){\left({\rho }_i^{\text{null}}\right)}^j{\left(1-{\rho }_i^{\text{null}}\right)}^{w^{(c)}-j}.$$

$${\rho }_i^{\neg \text{set}}=\sum _{j=b}^{w^{(c)}}\left(\genfrac{}{}{0ex}{}{w^{(c)}}{j}\right){\left(1-{\rho }_i^{\text{null}}\right)}^j{\left({\rho }_i^{\text{null}}\right)}^{w^{(c)}-j}.$$

$$\mathrm{wt}\{e_i^{\ast }(x)\}=w_i^{(e)}+u_i^{\neg \text{set}}-u_i^{\text{set}}.$$

$$P_i^{\text{set}}(u_i^{\text{set}})=$$

$$P_i^{\neg \text{set}}(u_i^{\neg \text{set}})=$$

$${\left(1-{\rho }_i^{\neg \text{set}}\right)}^{p-w_i^{(e)}-u_i^{\neg \text{set}}}.$$

$$P_i\left\{w_i^{(e^{\ast })}\right\}=\sum _{u_i^{\text{set}}=\max [0,w_i^{(e)}-w_i^{(e^{\ast })}]}^{w^{(e)}}{P}_i^{\text{set}}(u_i^{\text{set}})P_i^{\neg \text{set}}(u^{\neg \text{set}}),$$

$$P\left\{\mathrm{wt}({\mathbf{e}}^{\ast })=\delta \right\}=\sum _{w_0^{(e)}=0}^{w^{(e)}}$$

$$\cdot \sum _{{\delta }_0=0}^{\delta }{P}_0\{{\delta }_0\}{P}_1\{\delta -{\delta }_0\}.$$

$$C_{\text{iter}}=p^3+\sum _{l=0}^j\left(\genfrac{}{}{0ex}{}{p}{l}\right).$$

$$P_{\text{iter}}=\sum _{\delta =1}^{\bar{w}}P\{\mathrm{wt}({\mathbf{e}}^{\ast })=\delta \}\sum _{l=0}^{\min \{\delta ,j\}}\frac{\left(\genfrac{}{}{0ex}{}{\delta }{l}\right)\left(\genfrac{}{}{0ex}{}{2p-\delta }{p-l}\right)}{\left(\genfrac{}{}{0ex}{}{2p}{p}\right)},$$

$$C_{\text{ISD}}=\frac{C_{\text{iter}}}{P_{\text{iter}}}.$$

Full text

I Introduction

Code-based cryptosystems, introduced by McEliece in 1978 [1], rely on the hardness of the Syndrome Decoding Problem (SDP), which has been proven to be NP-complete for general random codes [2]. The best SDP solvers for general codes, known as Information Set Decoding (ISD) algorithms, were first introduced by Prange in 1962 [3] and significantly improved over years (see [4, 5] and references therein). However, all current ISD algorithms are characterized by an exponential complexity, even when implemented on quantum computers [6]. Since SDP is one of the oldest and most studied hard problems, and no polynomial time solver is currently known, code-based cryptosystems are among the most promising solutions for post-quantum cryptography [7].

However, designing a secure and efficient digital signature scheme based on coding theory is still an open problem. The main difficulty is represented by the fact that, typically, in these systems the plaintext and ciphertext domains do not coincide. Therefore, applying decryption on a general string, for example obtained through a hash function, may result in a failure unless special solutions are adopted. Proposals trying to address this issue have been proven not to be either efficient or secure (or both, in the worst cases). A clear evidence of the hardness of finding efficient digital signature schemes based on codes is represented by the fact that no proposal of this type is surviving within the National Institute of Standards and Technology (NIST) competition for the standardization of post-quantum primitives [8].

Historically, the first digital signature scheme based on error correcting codes is the Courtois-Finiasz-Sendrier (CFS) scheme [9], that uses high rate Goppa codes and follows a hash-and-sign approach. This scheme is known to be unpractical, since it has some security flaws (high rate Goppa codes can be distinguished from random codes [10]) and requires very large public-keys and long signature times.

In particular, some schemes might suffer from statistical attacks, i.e., procedures that can break the system through the observation of a sufficiently large number of signatures. In such a case, the attacked systems are reduced to few-signatures schemes or, in the most conservative assumption, to one-time schemes (each key-pair is refreshed after just one signature). For instance, the BBC+ scheme proposed in [11], which is based on low-density generator matrix (LDGM) codes, has been cryptanalized in [12] with a procedure that allows forging valid signatures after the observation of thousands of signatures, which limits the life of its keypairs [13]. Another recent proposal is Wave [14], based on generalized $(U;U+V)$ codes. A cryptanalysis procedure of Wave based on the statistical analysis of hundreds of signatures has been proposed in [15]. However, such a procedure has been disproved in [16], since it is referred to a degraded version of the scheme.

In this paper, we consider a one-time signature scheme that was recently proposed by Persichetti [17]. Such a scheme is obtained as a modification of Stern’s identification protocol [18], and relies on Quasi-Cyclic (QC) codes, which allow for both compact keys and low computational complexity. However, as we show afterwards, this scheme suffers from an attack which leads to a full recovery of the secret key and whose complexity is far below the claimed security level. Our attack is based on a statistical analysis performed on a single signature, combined with an ISD algorithm.

Another attack against the same scheme has been independently developed in [19]. The attack in [19] is based on Bit Flipping (BF) decoding, which has the advantage of being vary fast compared to other decoders. However, the success probability of BF decoding cannot be predicted analytically. Moreover, in case of a decoding failure, it is not possible to perform further randomized attempts of decoding through BF. Differently from [19], our attack exploits ISD, which permits us to obtain a closed-form formula for the average number of iterations and the relevant complexity needed for a successful attack, which depend only on the system parameters. So, while the feasibility of the attack in [19] can only be assessed through numerical simulations, we do not rely on simulations: through an theoretical approach, we show that the security of the scheme is reduced to the complexity of an SDP instance, which is far below any reasonable security level. In particular, our analysis shows how the security of the system is related to the hardness of solving an SDP instance in which the weight of the searched vector is particularly low. Through this approach, we can make general statements about the effectiveness of the attack on modified parameters sets, showing that meaningful security levels cannot be achieved even resorting to extreme choices for the parameters set.

The paper is organized as follows. In Section II we introduce the notation used. In Section III we describe the scheme and its design strategy. In Section IV we describe our attack procedure and derive estimates of its complexity. Finally, in Section V we report some conclusions.

II Notation

We denote as $\mathcal{R}$ the polynomial ring $\mathbb{F}_{2}[x]/(x^{p}+1)$, where $p$ is an integer and $x$ is a symbolic variable. We use bold letters to denote vectors over $\mathcal{R}^{2}$, in the form $\mathbf{a}(x)=[a_{0}(x),a_{1}(x)]$, with $a_{i}(x)\in\mathcal{R}$. Each $\mathbf{a}(x)\in\mathcal{R}^{2}$ can be unambiguously represented as a vector $\mathbf{a}\in\mathbb{F}_{2}^{2p}$ in the form

[TABLE]

where $a_{i,j}$ is the $j$-th coefficient of the $i$-th polynomial, $a_{i}(x)$, in $\mathbf{a}(x)$. Let $\mathbb{F}_{2}$ be the binary field. Given a vector $\mathbf{a}$ over $\mathbb{F}_{2}$, we denote as $\hat{\mathbf{a}}$ the vector obtained by lifting its entries over the integer domain $\mathbb{Z}$; the same notation is used for vectors of polynomials. Operations involving lifted vectors are performed in the integer domain (i.e., $1+1=2$). Given a polynomial $a(x)$, we define its Hamming weight, $\mathrm{wt}\{a(x)\}$, as the number of its non-null coefficients. For a vector of polynomials $\mathbf{a}(x)$, the Hamming weight corresponds to the sum of the Hamming weights of its elements. The support of a polynomial $a(x)$, denoted as $\Im\{a(x)\}$, is the set containing the indexes of the non-null coefficients of $a(x)$. Clearly, the Hamming weight of a polynomial corresponds to the cardinality of its support.

We denote as $\mathcal{D}_{n,w}$ the uniform distribution of all binary $n$-uples with weight $w$. Then, the expression \mathbf{a}\xleftarrow[]{\}\mathcal{D}{n,w}$means that$\mathbf{a}$is randomly picked among all the elements in$\mathcal{D}{n,w}$. Since the distribution is uniform, each vector of weight$w$is picked with probability$1/\binom{n}{w}$. In the following, we consider only the case of$n=2p$. With some abuse of notation, the expression$\mathbf{a}(x)\xleftarrow[]{$}\mathcal{D}_{n,w}$means that$\mathbf{a}(x)$is randomly picked among all pairs of polynomials having vectors of coefficients in$\mathcal{R}^{2}$, each with Hamming weight$w$.

III System description

The one-time digital signature scheme we are considering is built upon a public polynomial $h(x)$, that is fixed by the protocol. We denote as $\texttt{synd}_{h}:\mathcal{R}^{2}\rightarrow\mathcal{R}$ the function that takes as input a vector $\mathbf{a}(x)=[a_{0}(x),a_{1}(x)]$ and outputs $a_{0}(x)+a_{1}(x)h(x)$. The scheme additionally requires a hash function $\mathcal{H}_{\delta}(b)$ that takes as input $b$ and outputs a weight-$\delta$ polynomial. Parameters of the scheme are the integers $p$, $w^{(e)}$, $w^{(y)}$, $w^{(c)}$ (with $w^{(e)},w^{(y)},w^{(c)}\ll p$).

The key generation is shown in Algorithm 1; the signing key (i.e., secret key) is a vector $\mathbf{e}(x)=[e_{0}(x),e_{1}(x)]$, such that $\mathrm{wt}\{\mathbf{e}(x)\}=w^{(e)}$. The verification key (i.e., public key) is obtained through the application of $\texttt{synd}_{h}$ on the secret key. The signature generation and verification are shown, respectively, in Algorithms 2 and 3. The signature verification algorithm returns a boolean variable $\bot$ that is false when the signature is valid and true otherwise.

III-A Security analysis

The security of the scheme is based on the hardness of the SDP that, in the binary case, is defined as follows.

**Syndrome Decoding Problem **

*Given $\mathbf{H}\in\mathbb{F}_{2}^{r\times n}$, $\mathbf{s}\in\mathbb{F}_{2}^{r}$ and $w\in\mathbb{N}$, find $\mathbf{e}\in\mathbb{F}_{2}^{n}$ such that $\mathrm{wt}\{\mathbf{e}\}\leq w$ and $\mathbf{H}\mathbf{e}^{T}=\mathbf{s}$.

The SDP is a well-known problem in coding theory, and has been proven to be NP-complete [2]; in particular, the solution of the SDP can be unique only when $w$ does not exceed the Gilbert-Varshamov (GV) distance $d^{(\texttt{GV})}$, that is defined as the greatest integer such that $\sum_{j=0}^{d^{(\texttt{GV})}-2}\binom{n-1}{j}<2^{n-k}$. When $w\leq d^{(\texttt{GV})}$, the best solvers for SDP are ISD algorithms, whose complexity crucially depends on $w$ and on the code rate.

The security of the scheme is based on the fact that the inversion of $\texttt{synd}_{h}$ requires the solution of an SDP instance. Let $\mathbf{H}$ be the $p\times 2p$ QC matrix obtained by concatenating the identity with the circulant matrix having $h(x)$ as first column. Let $\mathbf{e}$ and $\mathbf{s}_{e}$ denote, respectively, the vectors associated to the secret and the public key: then, the following relation holds

[TABLE]

An opponent trying to recover the secret key $\mathbf{e}$ must solve an SDP instance; thus, the weight of $\mathbf{e}$ cannot be smaller than some security threshold value. In the verification procedure, a crucial aspect is represented by the weight of $\mathbf{z}(x)$, which has maximum value equal to $w^{(c)}w^{(e)}+w^{(y)}$. Indeed, the authenticity of the signature is guaranteed if there is only one vector $\mathbf{z}(x)$ such that

[TABLE]

since this proves that $\mathbf{z}(x)$ has been computed through the signing key. Then, a necessary condition for such a vector to be unique is

[TABLE]

Obviously, the system is fully broken also if the opponent can perform ISD on $\texttt{synd}_{h}\{\mathbf{y}(x)\}=c(x)s_{e}(x)+s_{z}(x)$: then, even $w^{(y)}$ cannot be lower than some security threshold value.

Finally, we must take into account that $\mathbf{z}(x)$ is obtained through linear operations involving sparse polynomials, one of them being $c(x)$, which is part of the signature, and is hence public. In [17], the possibility of attacks exploiting such facts has been considered; for this reason, the scheme has been proposed only for the one-time signature case. However, as we show next, the analysis of a single signature, combined with an ISD algorithm, is enough to recover the secret key.

IV An efficient key recovery attack

We remember that the signature is composed by the pair $\{c(x),\mathbf{z}(x)\}$, with $\mathbf{z}(x)=c(x)\mathbf{e}(x)+\mathbf{y}(x)$. Let us write

[TABLE]

where $\Im\{c(x)\}$ contains $w^{(c)}\ll p$ distinct integers.

An opponent can compute the polynomials $z_{i}^{(v)}(x)=x^{-v}z_{i}(x)$, for $i=0,1$ and for all $v\in\Im\{c(x)\}$; we have

[TABLE]

The opponent can then lift all such polynomials in the integers domain, and compute the sum

[TABLE]

for $i=0,1$. We expect high coefficients in $\hat{d}_{i}(x)$ to be associated to ones in $e_{i}(x)$. In fact, all polynomials $z_{i}^{(v)}(x)$ are obtained as the sum of $e_{i}(x)$ with other sparse polynomials that depend on the shift $x^{-v}$. Hence, if an entry belongs to the support of a large number of polynomials $z_{i}^{(v)}(x)$, then it also belongs to the support of $e_{i}(x)$ with high probability.

The opponent can exploit this fact to estimate the coefficients of $\mathbf{e}(x)$. In particular, let $\mathbf{e}^{\prime}(x)=[e_{0}^{\prime}(x),e_{1}^{\prime}(x)]\in\mathcal{R}^{2}$ be a vector with coefficients

[TABLE]

where $b$ is an integer $\leq w^{(c)}$. The vector $\mathbf{e}^{\prime}(x)$ represents an estimate of $\mathbf{e}(x)$, whose accuracy depends on the choice of $b$.

The opponent can then compute

[TABLE]

where $\mathbf{e}^{*}(x)=\mathbf{e}(x)+\mathbf{e}^{\prime}(x)$. If $s^{*}(x)=0$, then $\mathbf{e}^{\prime}(x)=\mathbf{e}(x)$, otherwise ISD can be used to obtain $\mathbf{e}^{*}(x)$ from $s^{*}(x)$, and then the secret key can be recovered as $\mathbf{e}(x)=\mathbf{e}^{\prime}(x)+\mathbf{e}^{*}(x)$.

The complexity of the whole attack crucially depends on the weight of $\mathbf{e}^{*}(x)$, which is related to the accuracy of the estimate $\mathbf{e}^{\prime}(x)$. As shown in the next section, for the system we consider it is always possible to choose $b$ such that the weight of $\mathbf{e}^{*}(x)$ has a high probability of being very small.

IV-A Attack complexity

Let us denote as $w^{(e)}_{i}$ and $w^{(y)}_{i}$ the weights of $e_{i}(x)$ and $y_{i}(x)$, respectively. A specific weights partition is uniquely determined by $w^{(e)}_{0}$ and $w^{(y)}_{0}$, as $w_{1}^{(e)}=w^{(e)}-w^{(e)}_{0}$ and $w_{1}^{(y)}=w^{(y)}-w^{(y)}_{0}$. The probability to have this partition is

[TABLE]

Recall (IV), and let us define

[TABLE]

from which $z^{(v)}_{i}(x)=e_{i}(x)+y^{(v)}_{i}(x)+\tilde{e}_{i}(x)$. Let $\rho_{i}^{\texttt{null}}$ be the probability that a particular coefficient in the sum $\tilde{e}_{i}(x)+y_{i}^{(v)}(x)$ is null. We can assume that each $e_{i}^{(v-l)}(x)$ is a random polynomial with weight $w_{i}^{(e)}$, and define

[TABLE]

such that $\rho_{i}^{\texttt{null}}$ can be estimated as

[TABLE]

Each null coefficient in $\tilde{e}^{(v)}_{i}(x)+y^{(v)}_{i}(x)$ results in a match between $e_{i}(x)$ and $z^{(v)}_{i}(x)$; thus, the probability that a set coefficient in $e_{i}(x)$ is also set in $e^{\prime}_{i}(x)$ can be estimated as

[TABLE]

Similarly, the probability that a null coefficient in $e_{i}(x)$ is set in $e^{\prime}_{i}(x)$ can be obtained as

[TABLE]

Let us denote as $u_{i}^{\texttt{set}}$ and as $u_{i}^{\neg\texttt{set}}$ the number of coefficients that are correctly and incorrectly set in $e^{\prime}_{i}(x)$; then, we have

[TABLE]

Let us define

[TABLE]

The probability that $e^{*}_{i}(x)$ has weight $w^{(e^{*})}_{i}$ results in

[TABLE]

where $u^{\neg\texttt{set}}=w^{(e^{*})}_{i}+u_{i}^{\texttt{set}}-w^{(e)}_{i}$. Let $\delta=\delta_{0}+\delta_{1}$, then

[TABLE]

Through the probability distribution of $\mathrm{wt}\{\mathbf{e}^{*}(x)\}$, we can estimate the effectiveness and the complexity of our cryptanalysis. The first part of the attack consists in the computation of $s^{*}(x)$: since it only involves a limited number of shifts, multiplications and sums, we can neglect the complexity of this step. If $s^{*}(x)=0$, then the opponent has already fully recovered the secret key. In all the other cases, the opponent applies ISD on $s^{*}(x)$, in order to determine the vector $\mathbf{e}^{*}(x)$, whose weight is unknown and is distributed according to Eq. (IV-A). For the sake of simplicity we consider the Lee-Brickell ISD algorithm [20], which takes as input an integer $j$ and, at each iteration, picks an information set and tests all patterns having a maximum of $j$ ones in the selected positions: an iteration is successful if the selected information set contains a maximum of $j$ errors. In particular, the complexity of each iteration can be estimated as

[TABLE]

Let $P_{\texttt{iter}}$ denote the probability of success for a single iteration. Then, we have

[TABLE]

where $\bar{w}$ is a sufficiently large integer. The average complexity of ISD can then be estimated as

[TABLE]

As we show next, for all instances proposed in [17] we can determine a value of $b$ for which $\mathrm{wt}\{\mathbf{e}^{*}(x)\}=0$ holds with high probability or applying ISD on $s^{*}(x)$ has extremely low complexity. In particular, these statements are motivated by the fact that, with overwhelming probability, $\mathbf{e}^{*}(x)$ has an extremely low weight, such that finding it through an ISD algorithm requires just a small number of iterations.

IV-B Results

In Fig. 1 we report the distribution of the weights of $\mathbf{e}^{*}(x)$ for two instances proposed in [17]. The empirical distributions have been obtained through numerical simulations on $10,000$ pairs of verification keys and signatures, and have been compared with the theoretical ones expressed by (IV-A), showing everywhere an excellent agreement. As we can see, the weight of $\mathbf{e}^{*}(x)$ assumes very low values with high probability. This is a clear evidence of the system weakness against the attack.

In Table I we have considered the applicability of the attack on the instances proposed in [17]; as we can see, all the instances can be completely broken. Indeed, $P\{\mathrm{wt}\{\mathbf{e}^{*}(x)\}=0\}$ always has high values: thus, with non-negligible probability, the secret key can be fully recovered without invoking ISD. When $\mathrm{wt}\{\mathbf{e}^{*}(x)\}>0$, it is highly probable that $\mathbf{e}^{*}(x)$ has an extremely low weight: this results in $P_{\texttt{iter}}$ having very high values, only slightly influenced by the choice of $\bar{w}$ (i.e., choosing $\bar{w}=40$ is already enough to guarantee $P_{\texttt{iter}}\approx 1$). This means that the application of ISD normally requires a very limited number of operations.

We can also show that changing the system parameters is not enough to significantly raise the security level of the scheme. In order to give an evidence of this fact, we have considered the case of $p=4801$, for which $d^{(\texttt{GV})}=1058$, and tested different values of $w^{(e)}$, $w^{(y)}$ and $w^{(c)}$. The results are reported in Table II. As we can see, there are no significant changes in the security of the system. In particular, the last three instances in the table have been designed with a maximum weight of $\mathbf{z}^{*}(x)$ that is close to $2d^{(\texttt{GV})}$. This choice is clearly extreme since, as explained in Section III, this way the uniqueness of the signature is no longer achievable. One might think to apply some modifications to the protocol, to take into account also this possibility in the signature verification algorithm. However, our results should discourage the attempt.

V Conclusion

We have discussed a serious weakness of a recently proposed one-time digital signature scheme. Our analysis shows that the secret key can be fully recovered with very low complexity, and that changes in the system parameters are not able to restore meaningful security levels. We point out that, with a few modifications, our attack procedure can be applied to structures different from the QC one. This is because it exploits the sparsity of the signature. As this is an inherent feature of the considered scheme, restoring its security might require deep and structural changes.