Cryptanalysis of a System Based on Twisted Reed-Solomon Codes

TL;DR

This paper presents an efficient key-recovery attack on a McEliece cryptosystem variant using twisted Reed-Solomon codes, demonstrating that the scheme is insecure under practical parameters and highlighting the need for careful analysis of subfield subcodes.

Contribution

It introduces a novel attack exploiting subfield subcode structure, breaking the cryptosystem and challenging the assumed security of twisted Reed-Solomon code-based cryptography.

Findings

The attack always succeeds for practical parameters.

Private keys can be recovered within minutes.

The scheme's security claims are invalidated by the attack.

Abstract

Twisted Reed-Solomon (TRS) codes are a family of codes that contains a large number of maximum distance separable codes that are non-equivalent to Reed--Solomon codes. TRS codes were recently proposed as an alternative to Goppa codes for the McEliece code-based cryptosystem, resulting in a potential reduction of key sizes. The use of TRS codes in the McEliece cryptosystem has been motivated by the fact that a large subfamily of TRS codes is resilient to a direct use of known algebraic key-recovery methods. In this paper, an efficient key-recovery attack on the TRS variant that was used in the McEliece cryptosystem is presented. The algorithm exploits a new approach based on recovering the structure of a well-chosen subfield subcode of the public code. It is proved that the attack always succeeds and breaks the system for all practical parameters in $O(n^4)$ field operations. A software implementation of the algorithm retrieves a valid private key from the public key within a few minutes, for parameters claiming a security level of 128 bits. The success of the attack also indicates that, contrary to common beliefs, subfield subcodes of the public code need to be precisely analyzed when proposing a McEliece-type code-based cryptosystem. Finally, the paper discusses an attempt to repair the scheme and a modification of the attack aiming at Gabidulin-Paramonov-Tretjakov cryptosystems based on twisted Gabidulin codes.

Tables

Table 1. Table 1: Parameters proposed in  [ BBPR18 ] for a claimed security ≥ 100 absent 100 \geq 100 bits.

$q_0$	$n$	$k$	$\ell$	$𝒕$	$𝒉$
$256$	$255$	$117$	$1$	$\left(57\right)$	$\left(88\right)$

Table 2. Table 2: List of functions used in Algorithm  1 .

Function	Description
$\mathrm{𝚂𝚞𝚋𝚏𝚒𝚎𝚕𝚍𝚂𝚞𝚋𝚌𝚘𝚍𝚎}$	maps a generator matrix of ${𝒞}_{\mathrm{pub}}$ to a generator matrix of the subfield subcode of ${𝒞}_{\mathrm{pub}}$
$\mathrm{𝚂𝚚𝚞𝚊𝚛𝚎}$	maps a generator matrix of ${𝒞}_{\mathrm{sub}}$ to a generator matrix of the code ${𝒞}_{\mathrm{sub}}^{\left(\star 2\right)}$
$\mathrm{𝙸𝚗𝚝𝚎𝚛𝚙𝚘𝚕𝚊𝚝𝚎}$	maps vectors $(𝒂,𝒃)\in {\left({𝔽}_q^n\right)}^2$ to $P\left(X\right)$ of degree such that $P\left(a_i\right)=b_i$ for $i=1,\dots ,n$
$\mathrm{𝙶𝚎𝚗𝚂𝚞𝚋}$	maps a vector $𝒂=(a_1,\dots ,a_n)\in {𝔽}_{q_0}^n$ to a matrix $𝑨\in {𝔽}_{q_0}^{\left(k-\ell \right)\times n}$ whose rows are $(a_1^j,\dots ,a_n^j)$ for each $j\in ℐ=\{0,\dots ,k-1\}\setminus \{h_1,\dots ,h_{\ell }\}$.
$\mathrm{𝚂𝚒𝚍𝚎𝚕𝚂𝚑𝚎𝚜𝚝}$	implements a Sidelnikov–Shestakov attack, which takes a generator matrix $𝑮$ of a RS code as input, and returns a vector of locators ${𝜶}^{\prime }$ describing the code
$\mathrm{𝙶𝚃𝚁𝚂}$	maps the vectors $\widehat{𝜶}$ and $\widehat{𝜼}$ to the generator matrix ${𝑮}_{\widehat{𝜶},𝒕,𝒉,\widehat{𝜼}}$ of the corresponding TRS code

Table 3. Table 3: Experimental results obtained by averaging several runtimes of Algorithm  1 on an Intel(R) Core(TM) i7-7600U CPU @ 2.80GHz. The first row refers to parameters proposed by the designers of the system. Remaining security levels were computed according to formulae given in  [ BBPR18 ] .

$q_0$	$n$	$k$	$\ell$	$w_{\text{H}}\left(𝒆\right)$	Claimed security level	Runtime of Algorithm 1
$2^8$	$255$	$117$	$1$	$83$	$128$ bits∗	133 seconds
$2^8$	$255$	$117$	$2$	$83$	$128$ bits∗	$141$ seconds
$2^9$	$511$	$200$	$3$	$192$	$196$ bits∗	$2260$ seconds
$2^9$	$511$	$170$	$3$	$217$	$256$ bits∗	$1532$ seconds

Equations

$${\mathcal{C}}^{(\star 2)}:={\mathrm{Span}}_{{\mathbb{F}}_q}(\{\mathbf{a}\star \mathbf{b}:\mathbf{a},\mathbf{b}\in \mathcal{C}\}).$$

$$\begin{array}[]{rclc}\operatorname{ev}_{\boldsymbol{\alpha}}:&\mathbb{F}_{q}[X]&\rightarrow&\mathbb{F}_{q}^{n}\\ &f&\mapsto&(f(\alpha_{1}),f(\alpha_{2}),\dots,f(\alpha_{n})).\end{array}$$

$$\mathcal{I}+\mathcal{J}:=\{a+b:a\in \mathcal{I},\text{leavevmode}b\in \mathcal{J}\}\subseteq \mathbb{N}.$$

$${\mathrm{RS}}_{k,n}[\mathbf{\alpha }]:=\left\{{\mathrm{ev}}_{\mathbf{\alpha }}(f):f\in {\mathbb{F}}_q[X],\mathrm{deg}f\le k-1\right\}\subseteq {\mathbb{F}}_q^n.$$

$${\mathcal{P}}_{k,n}[\mathbf{t},\mathbf{h},\mathbf{\eta }]:=\left\{\sum _{i=0}^{k-1}{f}_i{X}^i+\sum _{j=1}^{\ell }{\eta }_j{f}_{h_j}{X}^{k-1+t_j}:f_i\in {\mathbb{F}}_q\right\}\subseteq {\mathbb{F}}_q[X].$$

$${\mathrm{TRS}}_{k,n}[\mathbf{\alpha },\mathbf{t},\mathbf{h},\mathbf{\eta }]:=\left\{{\mathrm{ev}}_{\mathbf{\alpha }}(f):f\in {\mathcal{P}}_{k,n}[\mathbf{t},\mathbf{h},\mathbf{\eta }]\right\}.$$

$${\mathbf{G}}_{\mathbf{\alpha },\mathbf{t},\mathbf{h},\mathbf{\eta }}:=\left(\begin{array}{c}1\\ {\mathbf{\alpha }}^1\\ ⋮\\ {\mathbf{\alpha }}^{h_1-1}\\ {\mathbf{\alpha }}^{h_1}+{\eta }_1{\mathbf{\alpha }}^{k-1+t_1}\\ {\mathbf{\alpha }}^{h_1+1}\\ ⋮\\ {\mathbf{\alpha }}^{h_{\ell }-1}\\ {\mathbf{\alpha }}^{h_{\ell }}+{\eta }_{\ell }{\mathbf{\alpha }}^{k-1+t_{\ell }}\\ {\mathbf{\alpha }}^{h_{\ell }+1}\\ ⋮\\ {\mathbf{\alpha }}^{k-1}\end{array}\right),$$

$${\mathrm{TRS}}_{k,n}[\mathbf{\alpha },\mathbf{t},\mathbf{h},\mathbf{\eta }]={\mathrm{TRS}}_{k,n}[\hat{\mathbf{\alpha }},\mathbf{t},\mathbf{h},\hat{\mathbf{\eta }}],$$

$$f(aX)=\sum _{i=0}^{k-1}(f_i{a}^i)X^i+\sum _{j=1}^{\ell }({\hat{\eta }}_j{a}^{k-1+t_j-h_j})(f_{h_j}{a}^{h_j})X^{k-1+t_j}=g(X),$$

$$\frac{n+1}{k-\sqrt{n}}<\ell+2<\min\Big{\{}k+3;\frac{2n}{k};\sqrt{n}-2\Big{\}}\,.$$

$$\mathbf{y}:=\mathbf{m}{\mathbf{G}}_{\mathrm{pub}}+\mathbf{e}\in {\mathbb{F}}_q^n.$$

$${\mathrm{RS}}_{k,n}[\mathbf{\alpha }]={\mathrm{RS}}_{k,n}[{\mathbf{\alpha }}^{\prime }].$$

$$\mathrm{TRS}_{k,n}[\boldsymbol{\alpha},\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]\cap\mathbb{F}_{q_{0}}^{n}=\operatorname{Span}_{\mathbb{F}_{q_{0}}}\big{(}\{\operatorname{ev}_{\boldsymbol{\alpha}}(X^{i}),i\in\mathcal{I}\}\big{)}\,.$$

$$({\mathcal{C}}_{\mathrm{sub}}{)}^{(\star 2)}={\mathrm{RS}}_{2k-1,n}[\mathbf{\alpha }].$$

$$({\mathcal{C}}_{\mathrm{sub}}{)}^{(\star 2)}$$

$$\displaystyle=\operatorname{Span}_{\mathbb{F}_{q_{0}}}\big{(}\{\operatorname{ev}_{\boldsymbol{\alpha}}(X^{i})\,:\,i\in\mathcal{I}+\mathcal{I}\}\big{)}\,.$$

$$\{0,\dots ,r-1\}\cup \{r+\ell ,\dots ,k+r-2\}\cup \{k+r+\ell -1,\dots ,2k-2\}.$$

$$\mathcal{A}_{b}:=\operatorname{Span}_{\mathbb{F}_{q_{0}}}\big{(}\{\operatorname{ev}_{\boldsymbol{\alpha}^{\prime}-b\boldsymbol{1}}(X^{i}):i\in\mathcal{I}\}\big{)}.$$

$${\hat{\eta }}_j={\eta }_j{a}^{-(k-1+t_j-h_j)}=\frac{{\hat{p}}_{k-1+t_j}}{\widehat{p_{h_j}}}.$$

$$\hat{P}(X):=P(a^{-1}X)=\sum _{i=0}^{k-1}{u}_i{a}^{-i}{X}^i+\sum _{j=1}^{\ell }{\eta }_j{u}_{h_j}{a}^{-(k-1+t_j)}{X}^{k-1+t_j}.$$

$$\mathcal{G}_{k,n-t}[\boldsymbol{\alpha}]=\operatorname{Span}_{\mathbb{F}_{q}}\big{\{}\operatorname{ev}_{\boldsymbol{\alpha}}(X^{[i]}),\;i=0,\dots,k-1\big{\}},$$

$$\mathcal{G}_{n-t,k}[\boldsymbol{\alpha},\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]=\Big{\{}\operatorname{ev}_{\boldsymbol{\alpha}}(f)\,:\,f\in\Big{\{}\sum_{i=0}^{k-1}f_{i}X^{[i]}+\sum_{j=1}^{\ell}\eta_{j}f_{h_{j}}X^{[k-1+t_{j}]}:f_{i}\in\mathbb{F}_{q}\Big{\}}\Big{\}},$$

$${\Lambda }_f(\mathcal{A}):=\mathcal{A}+{\mathcal{A}}^{[1]}+\cdots +{\mathcal{A}}^{[f]}.$$

$$\hat{\boldsymbol{S}}\hat{\boldsymbol{G}}=\big{(}\boldsymbol{G}_{\mathrm{pub}}\hat{\boldsymbol{P}}^{-1}\big{)}_{[t+1:n]},$$

Full text

In this paper, an efficient key-recovery attack on the TRS variant that was used in the McEliece cryptosystem is presented. The algorithm exploits a new approach based on recovering the structure of a well-chosen subfield subcode of the public code. It is proved that the attack always succeeds and breaks the system for all practical parameters in $O(n^{4})$ field operations. A software implementation of the algorithm retrieves a valid private key from the public key within a few minutes, for parameters claiming a security level of $128$ bits. The success of the attack also indicates that, contrary to common beliefs, subfield subcodes of the public code need to be precisely analyzed when proposing a McEliece-type code-based cryptosystem. Finally, the paper discusses an attempt to repair the scheme and a modification of the attack aiming at Gabidulin–Paramonov–Tretjakov cryptosystems based on twisted Gabidulin codes.

1 Introduction

In the last years, cryptosystems relying on the hardness of decoding in a generic code have gained a lot of attention due to their potential resistance against quantum computer attacks. The first code-based cryptosystem was proposed by McEliece already in 1978 [McE78]. Its hardness is based on the assumption that a random generator matrix of a random binary Goppa code is hard to distinguish from the generator matrix of a random code. To this day, the principle behind the McEliece system still plays a significant role in the design of code-based cryptography. In particular, four out of the six code-based proposals in round 2 of the National Institute of Standards and Technology (NIST) post-quantum cryptography standardization process are based on McEliece’s principle.

Compared to other post-quantum-secure public-key encryption schemes, e.g. some lattice-based cryptosystems, the main drawback of the McEliece cryptosystem lies in the size of its public key. To overcome this drawback, other families of codes have been proposed to replace Goppa codes, but most of them can be subjected to algebraic attacks. For instance, generalized Reed–Solomon (GRS) codes were proposed in 1986 by Niederreiter [Nie86], but Sidelnikov and Shestakov mounted a very efficient attack to recover an alternative secret key [SS92]. Wieschebrink proved that also random subcodes of GRS codes — proposed in [BL05] — cannot be used due to their vulnerability to the code squaring attack [Wie10]. Further instances and cryptanalyses of algebraic code-based schemes can be found in [Sid94, MS07, BCGO09, FOP*+*16, JM96, CCP17]. One should emphasize that many recent attacks are largely based on previously known methods. For example, some instances of the RLCE scheme [Wan16] were broken by Couvreur, Lequesne and Tillich by a sophisticated analysis of the squares of puncturings and shortenings of the public code [CLT19].

One recent alternative class of codes for the McEliece cryptosystem emerged from twisted Reed–Solomon (TRS) codes [BPR17]. In particular, Beelen et al. analyzed the structural properties of a very specific subfamily of TRS codes [BBPR18]. They proved that this subfamily is disjoint from the class of GRS codes; thus the attack by Sidelnikov and Shestakov [SS92] cannot be applied to their system. Further, they showed that shortenings of these codes up to two positions have maximal Schur square dimension [Puc18], meaning that the proposed system is impervious to a direct application of the attack presented by Couvreur et al. in [CGGU*+*14]. Additionally, the authors gave evidence that their system is not vulnerable to straight-forward applications of methods introduced by Wieschebrink in [Wie06, Wie10].

The intention of the authors of [BBPR18] was to exploit the optimal error-correction capability of TRS codes to reduce the length of the public code, and accordingly the size of the public key. In [BBPR18], an explicit subfamily of TRS codes was proposed, providing a reduction of the public key up to a factor of $7.4$ compared to binary Goppa codes, for a claimed security level of $128$ bits.

In this paper, we present an efficient key-recovery attack on this cryptosystem based on TRS codes. As analyzed by the authors of [BBPR18], the direct application of previously known structural attacks does not work. Instead, we recover the structure of a well-chosen subfield subcode $\mathcal{S}$ of the public TRS code $\mathcal{T}$. We give a characterization of the structure of this subfield subcode, as a subspace of low codimension contained in a classical Reed–Solomon code $\mathcal{R}$. We then prove that the Wieschebrink squaring method always succeeds when applied to the subfield subcode $\mathcal{S}$, and this enables us to retrieve an algebraic description of $\mathcal{R}$. By analyzing equivalent representations of TRS codes, we finally deduce an algebraic description of the public code $\mathcal{T}$. The application of the squaring method to the subfield subcode is a non-trivial modification of Wieschebrink’s attack.

To the best of our knowledge, our attack is the first of its kind to exploit structural weaknesses of subfield subcodes of the public code. On the contrary, the restriction to a subfield is usually considered as an operation that breaks the structure of an algebraic code and therefore makes it suitable for cryptography as attested by the attack-resilience of Goppa codes despite being subfield subcodes of Reed–Solomon codes. Our approach of attacking the subfield subcode instead of the original code might also be applicable to other classes of codes used in code-based cryptography.

We show that for all practical parameters proposed by the designers, our algorithm recovers a valid private key from the public key in $O(n^{4})$ operations over the underlying field, where $n$ denotes the code length. The attack is implemented in the computer-algebra system SageMath [The19] and is made public. Although the implementation is not optimized, it determines a valid private key in approximately two minutes for the parameters proposed in [BBPR18].

The paper is structured as follows. In Section 2, we introduce the notation, and state the definition as well as important structural properties of TRS codes. In Section 3, we present the key generation, encryption and decryption algorithm and the parameters proposed in [BBPR18]. In Section 4, we derive a structural attack on the scheme and we precisely analyze its complexity. Additionally, in Section 5, we discuss a potential fix of the cryptosystem, as well as an extension of the attack to the rank metric setting [PRW18]. Conclusions are given in Section 6.

2 Preliminaries

2.1 Notation

Let $\mathbb{F}_{q}$ denote the finite field of order $q$, where $q$ is a prime power. Vectors in $\mathbb{F}_{q}^{n}$ are row vectors, and we use $\mathbb{F}_{q}^{m\times n}$ to represent the set of $m\times n$ matrices over $\mathbb{F}_{q}$. For $i\in\{1,\dots,m\}$ and $j\in\{1,\dots,n\}$, the $(i,j)$-th entry of $\boldsymbol{A}\in\mathbb{F}_{q}^{m\times n}$ is denoted by $A_{i,j}$. The set of invertible matrices of size $m$ over $\mathbb{F}_{q}$ is denoted by $\operatorname{GL}_{m}(\mathbb{F}_{q})$.

Let us fix a finite field extension $\mathbb{F}/\mathbb{F}_{q}$. The $\mathbb{F}$-vector space generated by a subset $S\subset\mathbb{F}_{q}^{n}$ is denoted by $\operatorname{Span}_{\mathbb{F}}(S)$. By convention, we also represent the $\mathbb{F}$-vector space spanned by the rows of $\boldsymbol{A}\in\mathbb{F}_{q}^{m\times n}$ by $\operatorname{Span}_{\mathbb{F}}(\boldsymbol{A})$.

A linear code $\mathcal{C}\subseteq\mathbb{F}_{q}^{n}$ with parameters $[n,k,d]$ is an $\mathbb{F}_{q}$-vector space of $\mathbb{F}_{q}^{n}$ of dimension $k$, where $d$ is the minimum Hamming weight $w_{\text{H}}(\boldsymbol{c})\coloneqq|\{i\in\{1,\dots,n\},c_{i}\neq 0\}|$ of a non-zero codeword $\boldsymbol{c}\in\mathcal{C}$. A generator matrix of $\mathcal{C}$ is a matrix $\boldsymbol{G}\in\mathbb{F}_{q}^{k\times n}$ such that $\mathcal{C}=\operatorname{Span}_{\mathbb{F}_{q}}(\boldsymbol{G}).$

Given $\boldsymbol{a}\in\mathbb{F}_{q}^{n}$ and $\boldsymbol{b}\in\mathbb{F}_{q}^{n}$, their componentwise product is defined as $\boldsymbol{a}\star\boldsymbol{b}:=(a_{1}b_{1},\ldots,a_{n}b_{n})\in\mathbb{F}_{q}^{n}$. Further, we define the Schur-square (or Hadamard-square) of a linear code $\mathcal{C}\subseteq\mathbb{F}_{q}^{n}$ as

[TABLE]

Let $\mathbb{F}_{q}[X]$ denote the set of univariate polynomials over $\mathbb{F}_{q}$. For a fixed evaluation vector $\boldsymbol{\alpha}=(\alpha_{1},\ldots,\alpha_{n})\in\mathbb{F}_{q}^{n}$, we define the evaluation map

[TABLE]

Finally, if $\mathcal{I},\mathcal{J}\subset\mathbb{N}$ are two finite subsets of integers, then we define their sumset

[TABLE]

2.2 Twisted Reed–Solomon codes

Before introducing TRS codes, let us first recall the definition of (classical) Reed–Solomon codes.

Definition 1** (Reed–Solomon code).**

Let the entries of $\boldsymbol{\alpha}=(\alpha_{1},\dots,\alpha_{n})\in\mathbb{F}_{q}^{n}$ be pairwise distinct, and fix $1\leq k\leq n$. The Reed–Solomon (RS) code of length $n$ and dimension $k$ is defined by

[TABLE]

The entries of $\boldsymbol{\alpha}$ are called locators of the Reed–Solomon code $\mathrm{RS}_{k,n}[\boldsymbol{\alpha}]$.

RS codes are maximum distance separable (MDS) codes, i.e., they reach the Singleton bound $d\leq n-k+1$. They also admit the use of efficient decoding algorithms for an error of weight up to the unique decoding radius $\lfloor\frac{n-k}{2}\rfloor$.

TRS codes were recently constructed as a generalization of RS codes [BPR17]. Let us first define a specific subspace of polynomials. Let $\ell\geq 1$, and $n\geq k\geq 1$. Given a vector $\boldsymbol{h}\in\{0,\dots,k-1\}^{\ell}$ of pairwise distinct increasing hooks, a vector $\boldsymbol{t}\in\{1,\dots,n-k\}^{\ell}$ of pairwise distinct twists, and a vector of field coefficients $\boldsymbol{\eta}\in(\mathbb{F}_{q}\setminus\{0\})^{\ell}$, the set of $[\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]$-twisted polynomials is

[TABLE]

Definition 2** (Twisted Reed–Solomon code, [BPR17]).**

Let the entries of $\boldsymbol{\alpha}=(\alpha_{1},\dots,\alpha_{n})\in\mathbb{F}_{q}^{n}$ be pairwise distinct, and fix $1\leq k\leq n$. Let $\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}$ be defined as above. The $[\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]$-twisted Reed–Solomon (TRS) code of length $n$, dimension $k$ and locators $\boldsymbol{\alpha}$ is defined by

[TABLE]

According to Definition 2, a generator matrix of $\mathrm{TRS}_{k,n}[\boldsymbol{\alpha},\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]$ is given by

[TABLE]

where $\boldsymbol{\alpha}^{i}:=(\alpha_{1}^{i},\dots,\alpha_{n}^{i})$ for $i=1,\dots,k-1$.

In [BBPR18], the authors show that the construction of TRS codes according to Definition 2 does not necessarily lead to MDS codes. However, they provide a method to obtain a subfamily of MDS TRS codes, cf. Theorem 1.

Theorem 1** (Explicit MDS TRS codes [BBPR18]).**

Let $q_{0}$ be a prime power, and $1=s_{0}<\ldots<s_{\ell}\in\mathbb{Z}_{>0}$ be non-negative integers such that $\mathbb{F}_{q_{0}^{s_{0}}}\subset\mathbb{F}_{q_{0}^{s_{1}}}\subset\ldots\subset\mathbb{F}_{q_{0}^{s_{\ell}}}=\mathbb{F}_{q}$ is a chain of subfields. Fix $k<n\leq q_{0}$ and the entries of $\boldsymbol{\alpha}=(\alpha_{1},\ldots,\alpha_{n})\in\mathbb{F}_{q_{0}}^{n}$ as pairwise distinct locators. Finally, let $\boldsymbol{t}$, $\boldsymbol{h}$ and $\boldsymbol{\eta}$ be chosen as in Definition 2, such that $\eta_{i}\in\mathbb{F}_{q_{0}^{s_{i}\vphantom{-1}}}\setminus\mathbb{F}_{q_{0}^{s_{i}-1}}$ for $i=1,\ldots,\ell$. Then $\mathrm{TRS}_{k,n}[\boldsymbol{\alpha},\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]$ is MDS.

A decoding algorithm for TRS codes is also proposed in [BBPR18]. Given a corrupted codeword $\boldsymbol{r}=\boldsymbol{c}+\boldsymbol{e}\in\mathbb{F}_{q}^{n}$, where $\boldsymbol{c}\in\mathrm{TRS}_{k,n}[\boldsymbol{\alpha},\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]$, the strategy is to guess $\ell$ elements $g_{1},\ldots,g_{\ell}\in\mathbb{F}_{q}$ and then to decode $\boldsymbol{r}-\operatorname{ev}_{\boldsymbol{\alpha}}(\sum_{i=1}^{\ell}g_{i}\eta_{i}X^{t_{i}+k-1})$ in the Reed–Solomon code $\mathrm{RS}_{k,n}[\boldsymbol{\alpha}]$. This approach succeeds if $g_{i}=f_{h_{i}}$ and thus admits a worst case complexity in $O(q^{\ell}n\log^{2}n\log\log n)$. Notice that for the explicit family presented in Theorem 1, we have $q=\Omega(q_{0}^{2^{\ell}})$, hence this decoding algorithm is only practical for a tiny number of twists.

The following lemma shows that TRS codes are invariant under specific transformations of their parameters. This property is a key element for the cryptanalysis of the system, and could be of independent interest.

Lemma 2**.**

Let $\boldsymbol{\alpha}$, $\boldsymbol{t}$, $\boldsymbol{h}$ and $\boldsymbol{\eta}$ be defined as in Definition 2. Then for any $a\in\mathbb{F}_{q}\setminus\{0\}$,

[TABLE]

where $\hat{\boldsymbol{\alpha}}=a\boldsymbol{\alpha}$ and $\hat{\boldsymbol{\eta}}=(\hat{\eta}_{1},\ldots,\hat{\eta}_{\ell})$ with $\hat{\eta}_{i}=\eta_{i}a^{-(k-1+t_{i}-h_{i})}$, $1\leq i\leq\ell$.

Proof.

Let $\operatorname{ev}_{\hat{\boldsymbol{\alpha}}}(f)\in\mathrm{TRS}_{k,n}[\hat{\boldsymbol{\alpha}},\boldsymbol{t},\boldsymbol{h},\hat{\boldsymbol{\eta}}]$, where $f(X)=\sum_{i=0}^{k-1}f_{i}X^{i}+\sum_{j=1}^{\ell}\hat{\eta}_{j}f_{h_{j}}X^{k-1+t_{j}}$. We have

[TABLE]

where $g(X)\in\mathcal{P}_{k,n}[\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]$. Hence by definition $\operatorname{ev}_{\hat{\boldsymbol{\alpha}}}(f)\in\mathrm{TRS}_{k,n}[\boldsymbol{\alpha},\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]$, and it follows that $\mathrm{TRS}_{k,n}[\hat{\boldsymbol{\alpha}},\boldsymbol{t},\boldsymbol{h},\hat{\boldsymbol{\eta}}]\subseteq\mathrm{TRS}_{k,n}[\boldsymbol{\alpha},\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]$. The proof on the converse inclusion is similar since $a$ is non-zero.  ∎∎

3 The variant of the McEliece cryptosystem using TRS codes

3.1 Definition of the cryptosystem

Setup.

Fix a prime power $q_{0}$, and integers $k<n\leq q_{0}-1$ with $2\sqrt{n}+6<k\leq\frac{n}{2}-2$. Also fix $\ell\in\mathbb{Z}_{>0}$ satisfying

[TABLE]

Further, set $q_{i}:=q_{i-1}^{2}=q_{0}^{2^{i}}$ for $i=1,\ldots,\ell$, such that $\mathbb{F}_{q_{0}}\subset\mathbb{F}_{q_{1}}\subset\ldots\subset\mathbb{F}_{q_{\ell}}=\mathbb{F}_{q}$ is a chain of subfields. Finally, set $t_{i}=(i+1)(r-2)-k+2$ and $h_{i}=r-1+i$ for $i=1,\ldots,\ell$, where $r:=\lceil\frac{n+1}{\ell+2}\rceil+2$.

Integers $q_{0}$, $n$, $k$, $\ell$, and tuples $\boldsymbol{t}$, $\boldsymbol{h}$ satisfying the above conditions are referred to as valid parameters of the cryptosystem [BBPR18]. They are public parameters.

Key generation.

Given valid parameters $q_{0}$, $n$, $k$, $\ell$, $\boldsymbol{t}$ and $\boldsymbol{h}$, a pair of public/private keys is generated as follows.

Choose $\boldsymbol{\alpha}\in\mathbb{F}_{q_{0}}^{n}$ at random such that the entries of $\boldsymbol{\alpha}$ are pairwise distinct. 2. 2.

Choose $\boldsymbol{\eta}\in\mathbb{F}_{q}^{\ell}$ at random such that $\eta_{i}\in\mathbb{F}_{q_{i}}\setminus\mathbb{F}_{q_{i-1}}$ for $i=1,\dots,\ell$. 3. 3.

Choose $\boldsymbol{S}\in\operatorname{GL}_{k}(\mathbb{F}_{q})$ at random. 4. 4.

Output the public key $\boldsymbol{G}_{\mathrm{pub}}=\boldsymbol{S}\boldsymbol{G}_{\boldsymbol{\alpha},\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}}\in\mathbb{F}_{q}^{k\times n}$, where $\boldsymbol{G}_{\boldsymbol{\alpha},\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}}$ is the generator matrix of $\mathrm{TRS}_{k,n}[\boldsymbol{\alpha},\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]$ described in Section 2.2.

The private key consists of $(\boldsymbol{S},\boldsymbol{\alpha},\boldsymbol{\eta})$ and the public key is $\boldsymbol{G}_{\mathrm{pub}}$.

Encryption.

Given a plaintext $\boldsymbol{m}\in\mathbb{F}_{q}^{k}$ and the public key $\boldsymbol{G}_{\mathrm{pub}}$, the ciphertext is generated as follows.

Choose $\boldsymbol{e}\in\mathbb{F}_{q}^{n}$ at random with Hamming weight $w_{\text{H}}(\boldsymbol{e})=\lfloor\frac{n-k}{2}\rfloor$. 2. 2.

Output the ciphertext

[TABLE]

Decryption.

Given a ciphertext $\boldsymbol{y}\in\mathbb{F}_{q}^{n}$ and the private key $(\boldsymbol{S},\boldsymbol{\alpha},\boldsymbol{\eta})$, the decryption algorithm can be described as follows.

Decode $\boldsymbol{y}$ to $\tilde{\boldsymbol{m}}=\boldsymbol{m}\boldsymbol{S}\in\mathbb{F}_{q}^{k}$ using the decoding algorithm of $\mathrm{TRS}_{k,n}[\boldsymbol{\alpha},\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]$ given in [BBPR18]. 2. 2.

Output the plaintext $\boldsymbol{m}=\tilde{\boldsymbol{m}}\boldsymbol{S}^{-1}$.

Proposed Parameters.

The designers of the system proposed the parameters listed in Table 1 [BBPR18]. Recall that the public code is defined over the field $\mathbb{F}_{q}=\mathbb{F}_{q_{0}^{2^{\ell}}}$.

There are two main reasons for choosing a small number of twists. On the one hand, the complexity of the decoding algorithm proposed in [BBPR18] is in $O(q_{0}^{\ell 2^{\ell}}n\log^{2}n\log\log n)$ and thus increases doubly exponentially with the number of twists. On the other hand, the number of elements in the largest field $\mathbb{F}_{q}$ also scales exponentially with the number of twists, which impacts the key sizes.

3.2 Resistance to some known key-recovery algebraic attacks

As mentioned in Section 1, Beelen et al. showed that some existing attacks cannot be directly mounted on their system [BBPR18]. Let us recall these attacks and explain why they are ineffective.

Sidelnikov–Shestakov attack.

In [SS92], Sidelnikov and Shestakov presented an attack on a variant of the McEliece cryptosystem using GRS codes. The attack uses two key facts: first, for MDS codes it is easy to find minimal-weight codewords with a given support, by running a simple Gaussian elimination; second, the ratio between two minimial-weight codewords of a GRS code, whose supports differ in only two coordinates, gives a rational function of degree one. Using these properties, the recovery of an alternate public key (i.e. an algebraic description of the public code as a GRS code) reduces to solving linear systems of equations involving the coefficients of the rational functions and the parameters of the GRS code. Formally, the result of Sidelnikov and Shestakov [SS92] can be summarized as follows.

Theorem 3** (Sidelnikov–Shestakov [SS92]).**

Let $\mathrm{RS}_{k,n}[\boldsymbol{\alpha}]$ be a Reed–Solomon code with locators $\boldsymbol{\alpha}=(\alpha_{1},\ldots,\alpha_{n})\in\mathbb{F}_{q_{0}}^{n}$. Given any generator matrix of $\mathrm{RS}_{k,n}[\boldsymbol{\alpha}]$, there exists an algorithm which determines in time $O(n^{4})$ a vector $\boldsymbol{\alpha}^{\prime}\in\mathbb{F}_{q_{0}}^{n}$ such that

[TABLE]

In particular, it holds that $\boldsymbol{\alpha}^{\prime}=a\boldsymbol{\alpha}+b\boldsymbol{1}:=(a\alpha_{1}+b,\dots,a\alpha_{n}+b)$ with $a\in\mathbb{F}_{q_{0}}\setminus\{0\}$ and $b\in\mathbb{F}_{q_{0}}$.

However for TRS codes, the ratio of two minimal-weight codewords with close support is a high degree rational function involving many coefficients. This property prevents a direct use of Sidelnikov–Shestakov’s attack.

Wieschebrink attack.

In order to attack a variant of McEliece cryptosystem using random subcodes of GRS codes, Wieschebrink considered the following structural properties. Let $\mathcal{C}$ be a random subcode of dimension $k-m$ of a GRS code of dimension $k$, with $m$ small compared to $k$. With high probability, the Schur square $\mathcal{C}^{(\star 2)}$ is a GRS code of dimension $\min\{n,2k-1\}$. If $k<n/2$, a Sidelnikov–Shestakov attack can be applied to recover the secret parameters. Otherwise, one can shorten the public code to fulfill the latter condition, since a shortened RS code is again a RS code.

As proved by the designers of the cryptosystem, Wieschebrink’s idea cannot be directly applied to TRS codes, due to a smart choice of parameters: the Schur square of the public code has dimension $n$, and shortening techniques seem unappropriate since the family of TRS codes is not stable under this operation. We will see in the following section that restricting TRS codes to subfields however leaks the algebraic structure of the public code.

4 An efficient key-recovery attack using subfield subcodes

This section presents an efficient key-recovery algorithm for the cryptosystem with the parameters proposed in [BBPR18]. The algorithm first determines a linear transformation of the secret locators $\boldsymbol{\alpha}$ by exploiting structural properties of the subfield subcode of the public code. Then, the algorithm finds the coefficients of the twist monomials by Lagrange interpolation. The algorithm finally outputs $(\hat{\boldsymbol{S}},\hat{\boldsymbol{\alpha}},\hat{\boldsymbol{\eta}})$ such that $\hat{\boldsymbol{S}}\boldsymbol{G}_{\hat{\boldsymbol{\alpha}},\boldsymbol{t},\boldsymbol{h},\hat{\boldsymbol{\eta}}}=\boldsymbol{G}_{\mathrm{pub}}$. As shown in Lemma 2, $(\hat{\boldsymbol{S}},\hat{\boldsymbol{\alpha}},\hat{\boldsymbol{\eta}})$ is a valid private key that can be used in the decryption algorithm (see Section 3.1).

4.1 Key-recovery algorithm

4.1.1 First step: recovery of an affine transformation of the secret locators

Let us consider the $\mathbb{F}_{q_{0}}$-subfield subcode of the code $\mathcal{C}_{\rm pub}$ spanned by the public generator matrix $\boldsymbol{G}_{\mathrm{pub}}$. We first state a technical lemma.

Lemma 4**.**

Let the entries of $\boldsymbol{\alpha}=(\alpha_{1},\dots,\alpha_{n})\in\mathbb{F}_{q_{0}}^{n}$ be pairwise distinct. Further, let $P\in\mathbb{F}_{q}[X]$ where $\mathbb{F}_{q}$ is an extension of $\mathbb{F}_{q_{0}}$, such that $\deg(P)<n$. Then, $\operatorname{ev}_{\boldsymbol{\alpha}}(P)\in\mathbb{F}_{q_{0}}^{n}$ if and only if $P\in\mathbb{F}_{q_{0}}[X]$.

Proof.

Let $\boldsymbol{c}=\operatorname{ev}_{\boldsymbol{\alpha}}(P)$ and assume that $\boldsymbol{c}\in\mathbb{F}_{q_{0}}^{n}$. Since $\boldsymbol{\alpha}\in\mathbb{F}_{q_{0}}^{n}$ and $n\leq q_{0}$, there exists a polynomial $Q\in\mathbb{F}_{q_{0}}[X]$ of degree $\leq n$ such that $\boldsymbol{c}=\operatorname{ev}_{\boldsymbol{\alpha}}(Q)$. Moreover, $\operatorname{ev}_{\boldsymbol{\alpha}}$ is injective over the $\mathbb{F}_{q}$-subspace of polynomials of degree $<q_{0}$, hence $P=Q$. The converse is straightforward.  ∎∎

Let us now define $\mathcal{I}:=\{0,1,\ldots,k-1\}\setminus\{h_{1},\ldots,h_{\ell}\}$ as the set of exponents of monomials which do not support twists111Since the parameters $k$ and $h_{1},\ldots,h_{\ell}$ are public, an attacker knows the set $\mathcal{I}$.. For valid parameters, $\mathcal{I}=\{0,1,\dots,r-1\}\cup\{r+\ell,\ldots,k-1\}$ since $h_{i}=r-1+i$ for each $1\leq i\leq\ell$. We can now prove the following characterization of subfield subcodes of TRS codes with valid parameters.

Proposition 5**.**

Let $\mathrm{TRS}_{k,n}[\boldsymbol{\alpha},\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]$ be chosen with valid parameters, as described in Section 3. Define $\mathcal{I}=\{0,1,\ldots,k-1\}\setminus\{h_{1},\ldots,h_{\ell}\}$ as above. Then,

[TABLE]

Proof.

Let us denote \mathcal{S}=\operatorname{Span}_{\mathbb{F}_{q_{0}}}\big{(}\{\operatorname{ev}_{\boldsymbol{\alpha}}(X^{i}),i\in\mathcal{I}\}\big{)} and $\mathcal{C}_{\mathrm{pub}}=\mathrm{TRS}_{k,n}[\boldsymbol{\alpha},\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]$. First, it is clear that $\mathcal{S}\subseteq\mathcal{C}_{\mathrm{pub}}\cap\mathbb{F}_{q_{0}}^{n}$. Indeed, for $i\in\mathcal{I}$ we have $\operatorname{ev}_{\boldsymbol{\alpha}}(X^{i})\in\mathcal{C}_{\mathrm{pub}}$, and since $\boldsymbol{\alpha}$ is a vector over $\mathbb{F}_{q_{0}}$, it yields that $\operatorname{ev}_{\boldsymbol{\alpha}}(X^{i})\in\mathbb{F}_{q_{0}}^{n}$.

Conversely, let $\boldsymbol{c}=\operatorname{ev}_{\boldsymbol{\alpha}}(f)\in\mathcal{C}_{\mathrm{pub}}\cap\mathbb{F}_{q_{0}}^{n}$, where $f\in\mathcal{P}_{k,n}[\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]$. Lemma 4 ensures that $f\in\mathbb{F}_{q_{0}}[X]$, since $\deg(f)<n$ for valid parameters. It remains to notice that $\mathbb{F}_{q_{0}}[X]\cap\mathcal{P}_{k,n}[\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]=\operatorname{Span}_{\mathbb{F}_{q_{0}}}(\{X^{i},i\in\mathcal{I}\})$.  ∎∎

We observe by Proposition 5 that the subfield subcode $\mathcal{C}_{\mathrm{sub}}:=\mathrm{TRS}_{k,n}[\boldsymbol{\alpha},\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]\cap\mathbb{F}_{q_{0}}^{n}$ is a proper non-MDS subcode of the RS code $\mathrm{RS}_{k,n}[\boldsymbol{\alpha}]$. Thus, one cannot directly use a Sidelnikov–Shestakov attack [SS92] on $\mathcal{C}_{\mathrm{sub}}$. In 2006, Wieschebrink mounted an attack on cryptosystems based on random subcodes of RS codes [Wie10]. The author’s idea is that, with very high probability over the chosen subcode $\mathcal{C}^{\prime}$, the square code $\mathcal{C}^{\prime(\star 2)}$ is a RS code. A Sidelnikov–Shestakov attack can then be used on $\mathcal{C}^{\prime(\star 2)}$ to recover the private parameters.

In the following, we prove that for most valid parameters defined in [BBPR18], and for all practical ones, the square code $\mathcal{C}_{\mathrm{sub}}^{(\star 2)}$ is a RS code subject to a Sidelnikov–Shestakov attack.

Proposition 6**.**

Let $q_{0}$, $n$, $k$, $\ell$, $\boldsymbol{t}$ and $\boldsymbol{h}$ be valid parameters, and assume that $\ell\leq\frac{1}{2}(\sqrt{n}-3)$. Let $\mathcal{C}_{\mathrm{sub}}=\mathrm{TRS}_{k,n}[\boldsymbol{\alpha},\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]\cap\mathbb{F}_{q_{0}}^{n}$. Then,

[TABLE]

Proof.

We use the notation and the results of Proposition 5. This yields

[TABLE]

As a consequence, the theorem holds if $\mathcal{I}+\mathcal{I}=\{0,\ldots,2k-2\}$.

Notice that for valid parameters, we have $2k-1\leq n-3$ and $\mathcal{I}=\mathcal{I}_{1}\cup\mathcal{I}_{2}$, where $\mathcal{I}_{1}=\{0,\dots,r-1\}$, $\mathcal{I}_{2}=\{r+\ell,\dots,k-1\}$ and $r=\lceil\frac{n+1}{\ell+2}\rceil+2$. We have $\{0\}+\mathcal{I}=\{0,\dots,r-1\}$, $\mathcal{I}_{1}+\mathcal{I}_{2}=\{r+\ell,\dots,k+r-2\}$ and $\{k-1\}+\mathcal{I}_{2}=\{k+r+\ell-1,\dots,2k-2\}$, hence it is clear that $\mathcal{I}+\mathcal{I}$ contains the subset

[TABLE]

Moreover one can easily check that if $\ell\leq r-1$, then $\{r,\dots,r+\ell-1\}\subseteq\mathcal{I}_{1}+\mathcal{I}_{1}$. The condition $\ell\leq r-1$ is always satisfied with valid parameters since $\ell<\sqrt{n}-3$ and $r>\sqrt{n}$. Finally, the assumption $\ell\leq\frac{1}{2}(\sqrt{n}-3)$ leads us to $\ell\leq\frac{k-r-1}{2}$ using constraints on valid parameters. This easily yields $\{k+r-1,\dots,k+r+\ell-2\}\subseteq\mathcal{I}_{2}+\mathcal{I}_{2}$.

 ∎∎

Remark 7**.**

In practice, the assumption $\ell\leq\frac{1}{2}(\sqrt{n}-3)$ is not restrictive, since the decryption algorithm is effective only if $\ell\ll\log n$.

For valid parameters, we have $2k-1\leq n-3$, hence we can apply a Sidelnikov–Shestakov attack to the code $\mathcal{C}_{\mathrm{sub}}^{(\star 2)}\subseteq\mathbb{F}_{q_{0}}^{n}$. This algorithm outputs a vector of locators $\boldsymbol{\alpha}^{\prime}\in\mathbb{F}_{q_{0}}$ which is an affine transformation of the secret locators $\boldsymbol{\alpha}$ (see Theorem 3). Formally, $\boldsymbol{\alpha}^{\prime}=a\boldsymbol{\alpha}+b\boldsymbol{1}$ for some $a\in\mathbb{F}_{q_{0}}\setminus\{0\}$ and $b\in\mathbb{F}_{q_{0}}$, where $\boldsymbol{1}\coloneqq(1,\dots,1)\in\mathbb{F}_{q_{0}}^{n}$.

4.1.2 Second step: from an affine to a linear transformation of the secret locators

Lemma 2 only ensures that $\mathrm{TRS}_{k,n}[\boldsymbol{\alpha},\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]=\mathrm{TRS}_{k,n}[\hat{\boldsymbol{\alpha}},\boldsymbol{t},\boldsymbol{h},\hat{\boldsymbol{\eta}}]$ if $\hat{\boldsymbol{\alpha}}=a\boldsymbol{\alpha}$ for a non-zero $a\in\mathbb{F}_{q_{0}}$. Therefore, given $\boldsymbol{\alpha}^{\prime}=a\boldsymbol{\alpha}+b\boldsymbol{1}$, the search of a valid $b\in\mathbb{F}_{q_{0}}$ such that $\boldsymbol{\alpha}^{\prime}-b\boldsymbol{1}=a\boldsymbol{\alpha}$ remains. Since $q_{0}$ is rather small, this search can be proceeded exhaustively as follows. Given $\boldsymbol{\alpha}^{\prime}$ and $b\in\mathbb{F}_{q_{0}}$, one first computes the code

[TABLE]

If $\mathcal{A}_{b}\subseteq\mathcal{C}_{\mathrm{pub}}$ holds, then we have found a valid $b$ and hence a valid $\hat{\boldsymbol{\alpha}}=\boldsymbol{\alpha}^{\prime}-b\boldsymbol{1}$. Notice that each individual test $\mathcal{A}_{b}\subseteq\mathcal{C}_{\mathrm{pub}}$ can be performed in time $O(n^{3})$.

4.1.3 Third step: recovery of a valid pair $(\hat{\boldsymbol{\alpha}},\hat{\boldsymbol{\eta}})$

The previous steps provide a tuple $\hat{\boldsymbol{\alpha}}\in\mathbb{F}_{q_{0}}^{n}$ which can be used as a vector of locators for the public TRS code. In order to determine a vector $\hat{\boldsymbol{\eta}}\in\mathbb{F}_{q}^{n}$ such that $\mathrm{TRS}_{k,n}[\boldsymbol{\alpha},\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]=\mathrm{TRS}_{k,n}[\hat{\boldsymbol{\alpha}},\boldsymbol{t},\boldsymbol{h},\hat{\boldsymbol{\eta}}]$, we use the following result.

Lemma 8**.**

Let $1\leq\ell$, and $P(X)=\sum_{i=0}^{k-1}u_{i}X^{i}+\sum_{j=1}^{\ell}\eta_{j}u_{h_{j}}X^{k-1+t_{j}}\in\mathcal{P}_{k,n}[\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]$ such that $u_{h_{j}}\neq 0$. Denote by $\hat{p}_{h_{j}}$ and $\hat{p}_{k-1+t_{j}}$ the coefficients of the monomials $X^{h_{j}}$ and $X^{k-1+t_{j}}$ in $\hat{P}(X)=P(a^{-1}X)$. Then, we have

[TABLE]

Proof.

This is clear from the following simple computation

[TABLE]

∎∎

Hence, a vector of coefficients $\hat{\boldsymbol{\eta}}$ such that $\mathrm{TRS}_{k,n}[\boldsymbol{\alpha},\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]=\mathrm{TRS}_{k,n}[\hat{\boldsymbol{\alpha}},\boldsymbol{t},\boldsymbol{h},\hat{\boldsymbol{\eta}}]$ can be computed as follows. Pick at random a codeword $\boldsymbol{c}=\operatorname{ev}_{\boldsymbol{\alpha}}(P)\in\mathcal{C}_{\mathrm{pub}}=\mathrm{TRS}_{k,n}[\boldsymbol{\alpha},\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]$. Then, interpolate $\boldsymbol{c}=\operatorname{ev}_{\hat{\boldsymbol{\alpha}}}(\hat{P})$ as a polynomial evaluated over the vector of locators $\hat{\boldsymbol{\alpha}}$. Notice that we have $\hat{P}(X)=P(a^{-1}X)$, thus for every non-zero coefficient $u_{h_{j}}$ of $P$, we obtain the coefficient $\hat{\eta}_{j}$ due to Lemma 8.

It remains to be observed that, if a codeword $\boldsymbol{c}$ is picked uniformly at random in $\mathcal{C}_{\mathrm{pub}}$, the probability that $u_{j}=0$ is roughly $1/q$. Since $\ell\ll q$, a random $\boldsymbol{c}$ leads to the recovery of the whole vector $\hat{\boldsymbol{\eta}}$ with high probability. Note that this procedure can be derandomized by iteratively taking each row the public matrix $\boldsymbol{G}_{\mathrm{pub}}$.

4.1.4 Final step: recovery of an alternative private key $(\hat{\boldsymbol{S}},\hat{\boldsymbol{\alpha}},\hat{\boldsymbol{\eta}})$

After determining $\hat{\boldsymbol{\alpha}}$ and $\hat{\boldsymbol{\eta}}$, one can easily compute a matrix $\hat{\boldsymbol{S}}$ such that $\hat{\boldsymbol{S}}\boldsymbol{G}_{\hat{\boldsymbol{\alpha}},\boldsymbol{t},\boldsymbol{h},\hat{\boldsymbol{\eta}}}=\boldsymbol{G}_{\mathrm{pub}}$. Then, $(\hat{\boldsymbol{S}},\hat{\boldsymbol{\alpha}},\hat{\boldsymbol{\eta}})$ can be used in the proposed decryption algorithm as a valid (alternative) private key to retrieve any secret plaintext $\boldsymbol{m}$.

4.2 Analysis of the attack

A summary of the attack is given in Algorithm 1. Let us explain the notation we use there. Given a matrix $\boldsymbol{A}\in\mathbb{F}_{q}^{k\times n}$, its transpose is represented by $\boldsymbol{A}^{\top}$, and $\boldsymbol{A}^{\bot}$ is a matrix whose rows form a basis of the right kernel of $\boldsymbol{A}$. The reduced row echelon form of $\boldsymbol{A}$ is denoted by ${\tt rref}(\boldsymbol{A})$. Moreover, if $\boldsymbol{A}\in\mathbb{F}_{q}^{k\times n}$ and $\boldsymbol{B}\in\mathbb{F}_{q}^{k\times n}$ have the same rowspace, then $\boldsymbol{D}=\boldsymbol{A}\backslash\boldsymbol{B}$ denotes any solution to $\boldsymbol{D}\boldsymbol{A}=\boldsymbol{B}$. Finally, in Table 2 we describe functions involved in Algorithm 1.

Theorem 9**.**

Given any generator matrix $\boldsymbol{G}_{\mathrm{pub}}$ of a TRS code $\mathcal{C}_{\mathrm{pub}}=\mathrm{TRS}_{k,n}[\boldsymbol{\alpha},\boldsymbol{t},\boldsymbol{h},\boldsymbol{\eta}]\subseteq\mathbb{F}_{q}^{n}$, Algorithm 1 retrieves a tuple $(\hat{\boldsymbol{S}},\hat{\boldsymbol{\alpha}},\hat{\boldsymbol{\eta}})$ such that the matrix $\hat{\boldsymbol{S}}\boldsymbol{G}_{\hat{\boldsymbol{\alpha}},\boldsymbol{t},\boldsymbol{h},\hat{\boldsymbol{\eta}}}$ generates $\mathcal{C}_{\mathrm{pub}}$ in $O(\max\{q_{0},2^{\ell},n\}\cdot n^{3})$ operations over $\mathbb{F}_{q}$.

Proof.

The correctness of Algorithm 1 was proved in Section 4.1. Let us now provide details about the complexity of Algorithm 1.

• •

Line 2: The computation of $\boldsymbol{G}_{\mathrm{sub}}\in\mathbb{F}_{q_{0}}^{(k-\ell)\times n}$ requires $O(n^{2}(k+n))\subseteq O(n^{3})$ operations in $\mathbb{F}_{q}$ and $O(n^{2}(2^{\ell}(n-k)+n))\subseteq O(2^{\ell}n^{3})$ operations in $\mathbb{F}_{q_{0}}$.

• •

Line 3: The computation of $\boldsymbol{G}_{\text{sq}}\in\mathbb{F}_{q_{0}}^{(2k-1)\times n}$ can be performed in time $O(n^{4})$. Informally, one needs to find a basis of the space generated by the set $\{\boldsymbol{g}_{i,j}:=({\boldsymbol{G}_{\mathrm{sub}}})_{i}\star({\boldsymbol{G}_{\mathrm{sub}}})_{j},1\leq i,j\leq\dim\mathcal{C}_{\mathrm{sub}}\}$. This basis can be built iteratively; updating the basis with a new element costs $O(n^{3})$ operations in $\mathbb{F}_{q_{0}}$ and must be done $O(n)$ times, and rejecting candidates costs $O(n^{2})$ operations in $\mathbb{F}_{q_{0}}$ and must be done $O(n^{2})$ times.

• •

Line 4: Applying the ${\tt SidelShest}$ function on $\boldsymbol{G}_{\text{sq}}\in\mathbb{F}_{q_{0}}^{(2k-1)\times n}$ requires $O((2k-2)^{4}+(2k-2)n)\subseteq O(n^{4})$ operations in $\mathbb{F}_{q_{0}}$ [SS92].

• •

Line 7 to Line 11: The computation of $\hat{\boldsymbol{\alpha}}\in\mathbb{F}_{q_{0}}^{n}$ requires $O(n)$ operations in $\mathbb{F}_{q_{0}}$; building $\boldsymbol{G}^{\prime}\in\mathbb{F}_{q_{0}}^{(k-\ell)\times n}$ needs $O((k-\ell)n)$ operations in $\mathbb{F}_{q_{0}}$; matrix multiplication $\boldsymbol{G}^{\prime}(\boldsymbol{G}_{\mathrm{sub}}^{\bot})^{\top}$ needs $O((k-\ell)(n-k+\ell)n)\subseteq O(n^{3})$ operations in $\mathbb{F}_{q_{0}}$ ($\boldsymbol{G}_{\mathrm{sub}}^{\bot}$ was already computed in Line 2). In the worst case, the previous sequences of computations have to be performed $q_{0}$ times. Hence these steps require $O(q_{0}n^{3})$ operations in $\mathbb{F}_{q_{0}}$.

• •

Line 15 to Line 22: In the worst case, $\ell\cdot k$ interpolations have to be performed, requiring $O(\ell kn^{2})\subseteq O(\ell n^{3})$ operations in $\mathbb{F}_{q}$.

• •

Line 25: Computation of $\hat{\boldsymbol{G}}_{\text{TRS}}\in\mathbb{F}_{q}^{k\times n}$ needs $O(kn)\subseteq O(n^{2})$ operations in $\mathbb{F}_{q}$.

• •

Line 26: Computation of $\hat{\boldsymbol{S}}\in\mathbb{F}_{q}^{k\times k}$ by a reduction to row echelon form of the matrix $\begin{pmatrix}\hat{\boldsymbol{G}}_{\text{TRS}}^{\top}&\boldsymbol{G}_{\mathrm{pub}}^{\top}\end{pmatrix}\in\mathbb{F}_{q}^{n\times 2k}$ needs $O(n^{2}(2k))\subseteq O(n^{3})$ operations in $\mathbb{F}_{q}$.  ∎

∎

In practice, $\ell$ and $q_{0}=q^{1/2^{\ell}}$ must be chosen to be small (for instance, $\ell=1$ and $q_{0}=n+1=2^{8}$ were proposed in [BBPR18]) in order to obtain an efficient decryption algorithm and keys of moderate size. Hence, for practical parameters Algorithm 1 has a complexity in $O(n^{4})$ and thus recovers a valid private key in polynomial time.

Our attack is implemented in the computer algebra system SageMath v8.7 [The19] and is available at https://bitbucket.org/julianrenner/trs_attack. Although the implementation is not optimized, it recovers a valid private key within a few minutes for the proposed parameters, see Table 3.

5 Discussion and open questions

5.1 Repairing the cryptosystem?

After a notification of this attack, the authors of [BBPR18] described a possible fix of the system, in which a modified version of the generator matrix is made public. The idea is to multiply the generator matrix $\boldsymbol{G}_{\mathrm{pub}}$ from the right by a diagonal matrix with non-zero entries $\boldsymbol{y}=(y_{1},\dots,y_{n})\in(\mathbb{F}_{q}\setminus\{0\})^{n}$, such that the $\mathbb{F}_{q_{0}}$-subfield subcode of the vector space spanned by the rows of $\boldsymbol{G}_{\mathrm{pub}}$ is not contained in a RS code. This clearly prevents a direct application of our attack.

Nevertheless, we would like to point out that this possible repair might not fix the inherent weaknesses of the cryptosystem. In fact, the subfield subcode of a GRS code $\boldsymbol{y}\star\mathrm{RS}_{k,n}[\boldsymbol{\alpha}]$ is a so-called alternant code ${\rm Alt}_{k^{\prime},n}[\boldsymbol{\alpha},\boldsymbol{y}]\subseteq\mathbb{F}_{q_{0}}^{n}$, which also admits an algebraic description. As a consequence, it seems very plausible that the security of the proposed repaired cryptosystem can be reduced to the security of a McEliece-like cryptosystem using the subfield subcode ${\rm Alt}_{k^{\prime},n}[\boldsymbol{\alpha},\boldsymbol{y}]$.

One can then notice that the parameters proposed by the authors of [BBPR18] are far below those considered as secure for alternant codes. For instance, BIG QUAKE [BBB*+*17] and Classic McEliece [Dan17] (both are unbroken candidates for the NIST standardization call on post-quantum cryptography) use alternant codes with a length and dimension of several thousands, while in the proposed parameters for the TRS codes, we have $n=255$ and $k=117$ with a field size $q_{0}=2^{8}$. Algebraic attacks as developed in [FOPT10, FOP*+*16] should then be considered as a potential threat. One should also mention the recent attack on the cryptosystem DAGS [BBB*+*18] based on alternant codes, performed by Barelli and Couvreur [BC18]. Informally, the authors of [BC18] manage to derive an alternant code with much smaller parameters from the public code, allowing the last step of the key recovery algorithm — which is exponential in the involved parameters — to remain feasible due to the small size of the derived alternant code.

Finally and most crucially, one can question the possible benefit to consider codes whose security might not be better than those based on alternant codes (for which cryptosystems have been designed and studied), but which suffer from larger key sizes and much less efficient decoding algorithms.

5.2 On the rank metric version of the cryptosystem

In [PRW18] a modified version of the previous system was proposed, based on a subfamily of twisted Gabidulin codes. The idea is to consider a variant of the GPT cryptosystem [GPT91], where twisted Gabidulin codes are used instead of (subcodes of) Gabidulin codes. Although we do not claim to have a proper attack on the system, let us show some potential weaknesses that could be analyzed in a future work.

The GPT cryptosystem can be viewed as an analogue of the McEliece cryptosystem, using rank metric codes instead of Hamming metric codes. We refer to [Ove07] for more details about rank metric codes and variants of the GPT cryptosystem. Let us give a short overview of the latter.

Let $\mathbb{F}_{p}\subset\mathbb{F}_{q}$ and $\Gamma\subseteq\{\mathcal{C}\subseteq\mathbb{F}_{q}^{n-t},\dim\mathcal{C}=k\}$ be a family of rank metric codes. The GPT cryptosystem works as follows:

• •

Key generation: Alice generates a secret generator matrix $\boldsymbol{G}\in\mathbb{F}_{q}^{n-t}$ for a code $\mathcal{C}$ randomly chosen in $\Gamma$. Then she computes a public key $\boldsymbol{G}_{\mathrm{pub}}=\boldsymbol{S}[\boldsymbol{X}|\boldsymbol{G}]\boldsymbol{P}$, where the matrices $\boldsymbol{S}\in\operatorname{GL}_{k}(\mathbb{F}_{q})$, $\boldsymbol{X}\in\mathbb{F}_{q}^{k\times t}$ of rank $s\leq t$, and $\boldsymbol{P}\in\operatorname{GL}_{n}(\mathbb{F}_{p})$ are chosen uniformly at random and kept secret.

• •

Encryption: given a plaintext $\boldsymbol{m}\in\mathbb{F}_{q}^{k}$, Bob computes the ciphertext $\boldsymbol{y}=\boldsymbol{m}\boldsymbol{G}_{\mathrm{pub}}+\boldsymbol{e}$, where $\boldsymbol{e}\in\mathbb{F}_{q}^{n}$ is a random error with small rank over $\mathbb{F}_{p}$ (the rank of the error is such that $\boldsymbol{e}$ can be decoded in $\mathcal{C}$).

• •

Decryption: Alice decodes the last $n-t$ coordinates of $\boldsymbol{y}\boldsymbol{P}^{-1}$ in the code $\mathcal{C}$ and retrieves $\boldsymbol{m}$.

In most variants of the GPT cryptosystem, $\Gamma$ is a (sub-)family of Gabidulin codes [Gab85]

[TABLE]

where $\boldsymbol{\alpha}\in\mathbb{F}_{q}^{n-t}$ are $\mathbb{F}_{p}$-linearly independent, and $X^{[i]}:=X^{p^{i}}$. Polynomials with monomials only of the form $X^{[i]}$ are called $p$-polynomials, or linearized polynomials. In [PRW18], the authors proposed to define $\Gamma$ as the subfamily of twisted Gabidulin codes

[TABLE]

where $\eta_{i}$ are chosen in the chain of subfields $\mathbb{F}_{q_{0}}\subset\mathbb{F}_{q_{1}}\subset\ldots\subset\mathbb{F}_{q_{\ell}}=\mathbb{F}_{q}$, and $(\alpha_{1},\dots,\alpha_{n-t})\in\mathbb{F}_{q_{0}}^{n-t}$ are $\mathbb{F}_{p}$-linearly independent, similar to the case of TRS codes.

Our claim is that the code $\mathcal{C}_{\rm pub}$ generated by $\boldsymbol{G}_{\mathrm{pub}}$ also admits structured subfield subcodes which could be used to attack the system. Indeed, one can prove that the last $n-t$ coordinates of $(\mathcal{C}_{\rm pub}\cap\mathbb{F}_{q_{0}}^{n})\boldsymbol{P}^{-1}$ form a subcode of the Gabidulin code $\mathcal{G}_{k,n-t}[\boldsymbol{\alpha}]\subseteq\mathbb{F}_{q_{0}}^{n-t}$ of rather small codimension. Applying variants of Overbeck’s attacks — e.g. in [Ove05] — might lead to the recovery of a linear transformation of $\boldsymbol{\alpha}$ and thus a structural attack on the public key close to the one presented in this paper.

For a code $\mathcal{A}\subseteq\mathbb{F}_{q}^{n}$ and $f\geq 0$, let $\mathcal{A}^{[1]}\coloneqq\{(a_{1}^{[f]},\dots,a_{n}^{[f]}),\boldsymbol{a}\in\mathcal{A}\}$, and

[TABLE]

In fact, we observe in simulations that for $f=n-k-t-1$, if $\Lambda_{f}(\mathcal{C}_{\rm pub}\cap\mathbb{F}_{q_{0}}^{n})$ has dimension $n-1$, then one recovers an $\mathbb{F}_{p}$-linear transformation $\hat{\boldsymbol{\alpha}}$ of $\boldsymbol{\alpha}$, as well as a full-rank matrix $\hat{\boldsymbol{P}}\in\mathbb{F}_{p}^{n\times n}$, by applying [Ove07, Algorithm 3.5.1] to a generator matrix of $\mathcal{C}_{\rm pub}\cap\mathbb{F}_{q_{0}}^{n}$. Then, the coefficients $\hat{\boldsymbol{\eta}}$ are determined by interpolation of the last $n-t$ positions of the rows of $\boldsymbol{G}_{\mathrm{pub}}\hat{\boldsymbol{P}}^{-1}$ with $p$-polynomials of $p$-degree smaller than $n$, similar to Section 4.1.3. Finally, one chooses $\hat{\boldsymbol{S}}$ such that

[TABLE]

where subscript $[t+1:n]$ refers to the last $n-t$ positions of $\boldsymbol{G}_{\mathrm{pub}}\hat{\boldsymbol{P}}^{-1}$ and $\hat{\boldsymbol{G}}$ is a generator matrix of $\mathcal{G}_{n-t,k}[\hat{\boldsymbol{\alpha}},\boldsymbol{t},\boldsymbol{h},\hat{\boldsymbol{\eta}}]$. Clearly, ($\hat{\boldsymbol{S}},\hat{\boldsymbol{\alpha}},\hat{\boldsymbol{\eta}},\hat{\boldsymbol{P}})$ is then a valid private key.

Further simulations show that if $\boldsymbol{X}$ has full $\mathbb{F}_{q}$-rank and $t$ is small, then the code $\Lambda_{f}(\mathcal{C}_{\rm pub}\cap\mathbb{F}_{q_{0}}^{n})$ has a dimension $n-1$ with high probability. However, if $t$ is large or if $\boldsymbol{X}$ has $\mathbb{F}_{q}$-rank smaller than $t$, then $\Lambda_{f}(\mathcal{C}_{\rm pub}\cap\mathbb{F}_{q_{0}}^{n})$ has dimension smaller than $n-2$ and this straightforward approach fails.

Since a precise analysis of the potential weakness of system proposed in [PRW18] is out of the scope of this paper, we leave it as an open problem for future research.

6 Conclusion

This paper presents an efficient key-recovery attack on the McEliece cryptosystem based on a subfamily of TRS codes. The attack does not contradict the structural properties presented in [BBPR18], but recovers the structure of a subfield subcode of the public TRS code, which enables us to determine a description of the supercode. This attack retrieves a valid private key from the public key for all practical parameters in $O(n^{4})$ field operations. This is formally proved, and confirmed by experimental results: one retrieves a valid private key for a claimed security level of $128$ bits within a few minutes. In addition, the security of the system after an attempt to repair it is discussed, as well as potential ways to adapt our attack to the rank metric variant of the considered system.

The subfield subcode approach presented in this paper is unique, in the sense that a widespread idea considers the restriction of codes to subfields as a way to break their structure. However, our cryptanalysis proves that subfield subcodes — as well as punctured codes and shortened codes — must also be taken into account when trying to assert the security of McEliece-like cryptosystems.

Acknowledgements

This work was done while the second author was visiting the Institut de Recherche Mathématique de Rennes (IRMAR), Université de Rennes 1, France.

The first author is funded by the French Direction Générale l’Armement, through the Pôle d’excellence cyber.

This project has received funding from the European Research Council (ERC) under the European Union’s Horizon 2020 research and innovation programme (grant agreement No 801434).

We would like to thank Antonia Wachter-Zeh (TUM) for fruitful discussions and Oliver De Candido (TUM) for his comments that helped to improve the manuscript. We would further like to thank the authors of the proposed cryptosystem [BBPR18] for validating our attack and pointing out a possible repair of the system with respect to our attack.