Analysis of reaction and timing attacks against cryptosystems based on sparse parity-check codes

TL;DR

This paper investigates reaction and timing attacks on cryptosystems based on sparse parity-check codes, revealing that such attacks are broadly applicable beyond QC codes and can exploit probabilistic decoding to leak information.

Contribution

It introduces a new algorithm for attacking QC codes and characterizes new side-channel leakages, expanding understanding of vulnerabilities in sparse parity-check code cryptosystems.

Findings

Attacks are effective beyond QC codes due to probabilistic decoding.

A novel algorithm improves information recovery in attacks.

Numerical simulations confirm attack effectiveness.

Abstract

In this paper we study reaction and timing attacks against cryptosystems based on sparse parity-check codes, which encompass low-density parity-check (LDPC) codes and moderate-density parity-check (MDPC) codes. We show that the feasibility of these attacks is not strictly associated to the quasi-cyclic (QC) structure of the code but is related to the intrinsically probabilistic decoding of any sparse parity-check code. So, these attacks not only work against QC codes, but can be generalized to broader classes of codes. We provide a novel algorithm that, in the case of a QC code, allows recovering a larger amount of information than that retrievable through existing attacks and we use this algorithm to characterize new side-channel information leakages. We devise a theoretical model for the decoder that describes and justifies our results. Numerical simulations are provided that confirm the effectiveness of our approach.

Tables

Table 1. TABLE I: Average values of t ′ superscript 𝑡 ′ t^{\prime} , for different values of γ 𝛾 \gamma . Code (a) and Code (b) are the same as those considered in Figures 2 and 3 .

$\gamma$	Code (a)		Code (b)
	Simulated	Theoretical	Simulated	Theoretical
0	49.59	48.98	33.63	33.64
1	49.33	48.76	33.72	33.73
2	49.07	48.55	33.80	33.80
3	48.81	48.34	33.86	33.86
4	48.55	48.15	-	-

Equations

$$\mathbf{x}=\mathbf{mG}+\mathbf{e},$$

$$\mathcal{M}\mapsto \{\mathbf{e}\in {\mathbb{F}}_2^n|\mathrm{wt}\{\mathbf{e}\}=t\},$$

$$\mathbf{x}={\mathbf{H}}^{\prime }{\mathbf{e}}^T.$$

$$C=\alpha N+C_{\mathcal{A}},$$

$$\mathbf{H}=\left[\begin{array}{c}{\mathbf{H}}_0,{\mathbf{H}}_1,\dots ,{\mathbf{H}}_{n_0-1}\end{array}\right],$$

$$\mathrm{DS}(\mathbf{a})=\left\{\min \{\pm (i-j)\mathrm{mod}p\}|i,j\in \varphi (\mathbf{a}),i\ne j\right\}.$$

$$\mathbf{s}={\mathbf{h}}_{i_0}+{\mathbf{h}}_{i_1}+\sum _{j\in \varphi (\mathbf{e})\setminus \{i_0,i_1\}}{\mathbf{h}}_j.$$

$$\left|{\mathbf{h}}_i\cap {\mathbf{h}}_j\right|=\left|{\mathbf{h}}_{p\lfloor i/p\rfloor +[i+z\mathrm{mod}p]}\cap {\mathbf{h}}_{p\lfloor j/p\rfloor +[j+z\mathrm{mod}p]}\right|,\forall z.$$

$$\left|{\mathbf{h}}_i\cap {\mathbf{h}}_j\right|=\left|{\mathbf{h}}_{p{i}_p+[i^{\prime }+z\mathrm{mod}p]}\cap {\mathbf{h}}_{p{i}_p+[j^{\prime }+z\mathrm{mod}p]}\right|,\forall z.$$

$$\left|{\mathbf{h}}_{p{i}_p+i^{\prime }}\cap {\mathbf{h}}_{p{i}_p+j^{\prime }}\right|=\{\begin{array}{ll}\left|{\mathbf{h}}_{p{i}_p}\cap {\mathbf{h}}_{p{i}_p+p-(i^{\prime }-j^{\prime })}\right|& \text{if j′<i′}\\ \left|{\mathbf{h}}_{p{i}_p}\cap {\mathbf{h}}_{p{i}_p+j^{\prime }-i^{\prime })}\right|& \text{if j′>i′}\end{array},$$

$$\varphi ({\mathbf{h}}_j)=\{c_l^{(j)}|c_l^{(j)}=c_l^{(p{i}_p)}+j^{\prime }\mathrm{mod}p,l\in [0,\dots ,v-1],c_l^{(p{i}_p)}\in \varphi ({\mathbf{h}}_{p{i}_p})\}.$$

$$c^{\prime }=c+d\mathrm{mod}p,d\in \{j^{\prime },p-j^{\prime }\}.$$

$$\left|\varphi ({\mathbf{h}}_{p{i}_p})\cap \varphi ({\mathbf{h}}_p{i}_p+j^{\prime })\right|=\gamma \leftrightarrow d\in \mathrm{DS}({\mathbf{H}}_{i_p}),{\mu }_d=\gamma ,$$

$$j\in {\mathcal{P}}_0\text{iff}{h}_{j,i_0}=1\wedge h_{j,i_1}=1;$$

$$j\in {\mathcal{P}}_1\text{iff}(h_{j,i_0}=1\wedge h_{j,i_1}=0)\vee (h_{j,i_0}=0\wedge h_{j,i_1}=1);$$

$$j\in {\mathcal{P}}_2\text{iff}{h}_{j,i_0}=0\wedge h_{j,i_1}=0.$$

$${\mathcal{V}}_i=\{\begin{array}{ll}\left\{l\in [0;n-1]\setminus \{i_0,i_1\}|\exists j\in {\mathcal{P}}_i\text{s.t.}{h}_{j,l}=1\right\}& \text{if i=0,1}\\ \left\{l\in [0;n-1]\setminus \{i_0,i_1\}|\nexists j\in {\mathcal{P}}_0\cup {\mathcal{P}}_1\text{s.t.}{h}_{j,l}=1\right\}& \text{if i=2}\end{array}.$$

$$\{\begin{array}{l}|{\mathcal{V}}_0|\le \gamma (w-2),\\ |{\mathcal{V}}_1|\le (2v-2\gamma )(w-1),\\ |{\mathcal{V}}_2|\ge n-2+\gamma w-2v(w-1).\end{array}$$

$$\{\begin{array}{l}|{\mathcal{V}}_0|=\gamma (w-2),\\ |{\mathcal{V}}_1|=(2v-2\gamma )(w-1),\\ |{\mathcal{V}}_2|=n-2+\gamma w-2v(w-1).\end{array}$$

$$P_{\{t^{(0)},t^{(1)},t^{(2)}\}}=\frac{\left(\genfrac{}{}{0ex}{}{|{\mathcal{V}}_0|}{t^{(0)}}\right)\left(\genfrac{}{}{0ex}{}{|{\mathcal{V}}_1|)}{t^{(1)}}\right)\left(\genfrac{}{}{0ex}{}{|{\mathcal{V}}_2|}{t^{(2)}}\right)}{\left(\genfrac{}{}{0ex}{}{n-2}{t-2}\right)}.$$

$$\begin{array}{c}{p}_{0,u}^{(0)}=\sum _{\begin{array}{c}l=1\\ \text{l odd}\end{array}}^{\min \{w-3,t-2\}}\frac{\left(\genfrac{}{}{0ex}{}{w-3}{l}\right)\left(\genfrac{}{}{0ex}{}{n-w}{t-l-2}\right)}{\left(\genfrac{}{}{0ex}{}{n-3}{t-2}\right)},\\ p_{0,u}^{(1)}=\sum _{\begin{array}{c}l=0\\ \text{l even}\end{array}}^{\min \{w-2,t-2\}}\frac{\left(\genfrac{}{}{0ex}{}{w-2}{l}\right)\left(\genfrac{}{}{0ex}{}{n-w-1}{t-l-2}\right)}{\left(\genfrac{}{}{0ex}{}{n-3}{t-2}\right)},\\ p_{1,u}^{(0)}=\sum _{\begin{array}{c}l=0\\ \text{l even}\end{array}}^{\min \{w-3,t-3\}}\frac{\left(\genfrac{}{}{0ex}{}{w-3}{l}\right)\left(\genfrac{}{}{0ex}{}{n-w}{t-l-3}\right)}{\left(\genfrac{}{}{0ex}{}{n-3}{t-3}\right)},\\ p_{1,u}^{(1)}=\sum _{\begin{array}{c}l=1\\ \text{l odd}\end{array}}^{\min \{w-2,t-3\}}\frac{\left(\genfrac{}{}{0ex}{}{w-2}{l}\right)\left(\genfrac{}{}{0ex}{}{n-w-1}{t-l-3}\right)}{\left(\genfrac{}{}{0ex}{}{n-3}{t-3}\right)},\\ p_{0,u}^{(2)}=\sum _{\begin{array}{c}l=1\\ \text{l odd}\end{array}}^{\min \{w-1,t-2\}}\frac{\left(\genfrac{}{}{0ex}{}{w-1}{l}\right)\left(\genfrac{}{}{0ex}{}{n-w-2}{t-l-2}\right)}{\left(\genfrac{}{}{0ex}{}{n-3}{t-2}\right)},\\ p_{1,u}^{(2)}=\sum _{\begin{array}{c}l=0\\ \text{l even}\end{array}}^{\min \{w-1,t-3\}}\frac{\left(\genfrac{}{}{0ex}{}{w-1}{l}\right)\left(\genfrac{}{}{0ex}{}{n-w-2}{t-l-3}\right)}{\left(\genfrac{}{}{0ex}{}{n-3}{t-3}\right)}.\end{array}$$

$$p_{\mathcal{E},u}^{(0)}=\sum _{\begin{array}{c}l=1\\ \text{l odd}\end{array}}^{\min \{w-2,t-2\}}\frac{\left(\genfrac{}{}{0ex}{}{w-2}{l}\right)\left(\genfrac{}{}{0ex}{}{n-w}{t-2-l}\right)}{\left(\genfrac{}{}{0ex}{}{n-2}{t-2}\right)},$$

$$p_{\mathcal{E},u}^{(1)}=\sum _{\begin{array}{c}l=0\\ \text{l even}\end{array}}^{\min \{w-1,t-2\}}\frac{\left(\genfrac{}{}{0ex}{}{w-1}{l}\right)\left(\genfrac{}{}{0ex}{}{n-w-1}{t-2-l}\right)}{\left(\genfrac{}{}{0ex}{}{n-2}{t-2}\right)}.$$

$$P_{d,\mathrm{flip}}^{(0)}=P\{{\sigma }_j^{(2)}=b-1|e_j=d\}{p}_{d,u}^{(0)}+\sum _{l=b}^{v-1}P\{{\sigma }_j^{(2)}=l|e_j=d\},$$

$$P_{d,\mathrm{flip}}^{(1)}=P\{{\sigma }_j^{(2)}=b-1|e_j=d\}{p}_{d,u}^{(1)}+\sum _{l=b}^{v-1}P\{{\sigma }_j^{(2)}=l|e_j=d\}.$$

$$P_{d,\mathrm{flip}}^{(2)}=\sum _{l=b}^v\left(\genfrac{}{}{0ex}{}{v}{l}\right){\left(p_{d,u}^{(2)}\right)}^l{\left(1-p_{d,u}^{(2)}\right)}^{v-l}.$$

$$P_{d,\mathrm{flip}}^{(0)}=P\{{\sigma }_j^{(2)}=b-1|e_j=d\}{p}_{d,u}^{(0)}+P\{{\sigma }_j^{(2)}\ge b|e_j=d\}.$$

$$P\{{\sigma }_j^{(2)}=z|e_j=d\}=(\genfrac{}{}{0ex}{}{v-1}{z}){\left(p_{d,u}^{(2)}\right)}^z{\left(1-p_{d,u}^{(2)}\right)}^{v-1-z},$$

$$P_{d,\mathrm{flip}}^{(0)}=P\{{\sigma }_j^{(2)}=b-1|e_j=d\}{p}_{d,u}^{(0)}+\sum _{l=b}^{v-1}P\{{\sigma }_j^{(2)}=l|e_j=d\}.$$

$$P_{d,\mathrm{flip}}^{(1)}=P\{{\sigma }_j^{(2)}=b-1|e_j=d\}{p}_{d,u}^{(1)}+\sum _{l=b}^{v-1}P\{{\sigma }_j^{(2)}=l|e_j=d\}.$$

Full text

I Introduction

The code-based cryptosystems introduced by McEliece [18] and Niederreiter [20] are among the oldest and most studied post-quantum public-key cryptosystems. They are commonly built upon a family of error correcting codes, for which an efficient decoding algorithm is known. The security of these systems is based on the hardness of the so called Syndrome Decoding Problem (SDP), i.e., the problem of decoding a random linear code, which has been proven to be NP-hard [7]. The best SDP solvers are known as Information Set Decoding (ISD) algorithms and were introduced in 1962 by Prange [23]; improved through the years (see [17, 26, 6], for some well known variants), these algorithms are characterized by exponential complexity, even when considering adversaries equipped with quantum computers [8]. Because of their well studied and assessed security, code-based cryptosystems are nowadays considered among the most promising candidates for the post-quantum world [9].

In the above schemes, and others of the same type, the private key is the representation of a code, whose parameters are chosen in such a way to guarantee decoding of a given amount of errors, which are intentionally introduced in the plaintext during encryption. The public key is obtained through linear transformations of the secret key, with the aim of masking the structure of the secret code. In the original McEliece proposal, Goppa codes were used: on the one hand, this choice leads to a well assessed security (the original proposal is still substantially unbroken); on the other hand, the corresponding public keys do not allow for any compact representation, and thus have very large sizes.

A well-known way to address the latter issue is that of adding some geometrical structure to the code, in order to guarantee that the public key admits a compact representation. The use of quasi-cyclic (QC) codes with a sparse parity-check matrix naturally fits this framework: the sparsity of the parity-check matrix allows for efficient decoding techniques, while the quasi-cyclic structure guarantees compactness in the public key. In such a context, the additional geometrical structure can be added without exposing the secret code: Quasi-Cyclic Low-Density Parity-Check (QC-LDPC) and Quasi-Cyclic Moderate-Density Parity-Check (QC-MDPC) code-based cryptosystems have been extensively studied in recent years [2, 19, 5, 4, 1] and currently achieve relatively very small public keys. However, differently from the bounded-distance decoders used for algebraic codes (like the mentioned Goppa codes), the iterative decoders used for sparse parity-check codes are not characterized by a deterministic decoding radius and, thus, decoding might fail with some probability, or Decoding Failure Rate (DFR).

Such a feature is crucial, since it has been shown how this probabilistic nature of the decoder actually exposes the system to cryptanalysis techniques based on the observation of the decryption phase. State-of-the-art attacks of this kind are commonly called reaction attacks, when based on decoding failures events [15, 12, 13, 22], or side-channel attacks, when based on information such as the duration of the decoding phase (in this case we speak properly of timing attacks) or other quantities [11, 10, 21]. All these previous techniques exploit the QC structure of the code and aim at recovering some characteristics of the secret key by performing a statistical analysis on a sufficiently large amount of collected data. The rationale is that many quantities that are typical of the decryption procedure depend on a statistical relation between some properties of the secret key and the error vector that is used during encryption. Thus, after observing a sufficiently large number of decryption instances, an adversary can exploit the gathered information to reconstruct the secret key, or an equivalent version of it. The reconstruction phase is commonly very efficient, unless some specific choices in the system design are made [24, 25] which, however, may have some significant drawbacks in terms of public key size. All the aforementioned attack techniques are instead prevented if the DFR has negligible values [27] and the algorithm is implemented with constant time. Nevertheless, at their current state, these solutions are far from being practical and efficient, and the use of ephemeral keys (which means that each key-pair is refreshed after just one decryption) is necessary to make these systems secure [1, 5].

In this paper we study reaction and timing attacks, and we show that information leakage in the decoding phase can actually be related to the number of overlapping ones between columns of the secret parity-check matrix. Furthermore, we show that all attacks of this kind can be analyzed as a unique procedure, which can be applied to recover information about the secret key, regardless of the code structure. Such an algorithm, when applied on a QC code, permits to recover an amount of information greater than that retrievable through previously published attacks. Moreover, we provide an approximate model that allows predicting the behaviour of the decoder in the first iteration with good accuracy. This model justifies the phenomenon that is at the basis of all the aforementioned attacks and can be even used to conjecture new attacks. Our results are confirmed by numerical simulations and enforce the employment of constant time decoders, with constant power consumption and negligible DFR, in order to allow for the use of long-lasting keys in these systems.

The paper is organized as follows: Section II describes the notation used throughout the manuscript and provides some basic notions about cryptosystems based on sparse parity-check codes. In Section III we summarize state-of-the-art reaction and timing attacks, and present a general algorithm that can be used to attack any sparse parity-check code. An approximate model for the analysis of the first iteration of the BF decoder is presented in Section IV. In Section V we describe some additional sources of information leakage, that can be used by an opponent to mount a complete cryptanalysis of the system. Finally, in Section VI we draw some conclusive remarks.

II Preliminaries

We represent matrices and vectors through bold capital and small letters, respectively. Given a matrix $\mathbf{A}$, we denote as $\mathbf{a}_{i}$ its $i$-th column and as $a_{i,j}$ its element in position $(i,j)$. Given a vector $\mathbf{b}$, its $i$-th entry is referred to as $b_{i}$; its support is denoted as $\phi(\mathbf{b})$ and is defined as the set containing the positions of its non-null entries. The vector $\mathbf{0}_{n}$ corresponds to the all-zero $n$-tuple; the function returning the Hamming weight of its input is denoted as $\mathrm{wt}\{\cdot\}$.

II-A LDPC and MDPC code-based cryptosystems

The schemes we consider are built upon a code $\mathcal{C}$ described by a sparse parity-check matrix $\mathbf{H}\in\mathbb{F}_{2}^{r\times n}$, where $n$ is the code blocklength. We here focus on the case of regular matrices, in which all the rows and all the columns have constant weights respectively equal to $w\ll n$ and $v\ll r$. The code $\mathcal{C}$ is then $(v,w)$-regular, and is commonly called Low-Density Parity-Check (LDPC) code if $w=O(\log{n})$, or Moderate-Density Parity-Check (MDPC) code, if $w=O(\sqrt{n})$. Regardless of such a distinction, these two families of codes actually have similar properties: they can be decoded with the same decoding algorithms and are thus exposed in the same way to the attacks we consider. So, from now on we will not distinguish between these two families, and just refer to $(v,w)$-regular codes.

In the McEliece framework, the public key is a generator matrix $\mathbf{G}$ for $\mathcal{C}$; a ciphertext is obtained as

[TABLE]

where $\mathbf{m}\in\mathbb{F}_{2}^{k}$ is the plaintext and $\mathbf{e}$ is a randomly generated $n$-tuple with weight $t$. Decryption starts with the computation of the syndrome $\mathbf{s}=\mathbf{H}\mathbf{x}^{T}=\mathbf{H}\mathbf{e}^{T}$, where T denotes transposition. Then, an efficient syndrome decoding algorithm is applied on $\mathbf{s}$, in order to recover $\mathbf{e}$.

In the Niederreiter formulation, the public key is a parity-check matrix $\mathbf{H}^{\prime}=\mathbf{S}\mathbf{H}$ for $\mathcal{C}$, where $\mathbf{S}$ is a dense non singular matrix. The plaintext $\mathbf{m}$ is converted into an $n$-tuple $\mathbf{e}$ with weight $t$ by means of an invertible mapping

[TABLE]

where $\mathcal{M}$ is the space of all possible plaintexts $\mathbf{m}$. The ciphertext is then computed as

[TABLE]

Decryption starts with the computation of $\mathbf{s}=\mathbf{S}^{-1}\mathbf{x}$; then, an efficient syndrome decoding algorithm is applied on $\mathbf{s}$, in order to recover $\mathbf{e}$, from which the plaintext $\mathbf{m}$ is reconstructed by inverting (2).

Regardless of the particular system formulation we are considering (McEliece or Niederreiter), the decryption phase relies on a syndrome decoding algorithm, applied on the syndrome of a weight-$t$ error vector. Since, in the attacks we consider, information is leaked during the decoding phase, we will not distinguish between the McEliece and the Niederreiter formulation in the following.

The decoding algorithm must show a good trade-off between complexity and DFR; for this reason, a common approach is that of relying on the so-called Bit Flipping (BF) decoders, whose principle has been introduced by Gallager [14]. The description of a basic BF decoding procedure is given in Algorithm 1.

The decoder goes through a maximum number of iterations $i_{\texttt{max}}$, and at each iteration it exploits a likelihood criterion to estimate the error vector $\mathbf{e}$. Outputs of the decoder are the estimate of the error vector $\mathbf{e}^{\prime}$ and a boolean value $\bot$ reporting events of decoding failure. When $\bot=0$, we have $\mathbf{e}^{\prime}=\mathbf{e}$, and decoding was successful; if $\bot=1$, then $\mathbf{e}^{\prime}\neq\mathbf{e}$ and we have encountered a decoding failure. So, clearly, the DFR can be expressed as the probability that $\bot=1$, noted as $P\{\bot=1\}$. The likelihood criterion is based on a threshold $b$ (line 11 of the algorithm), which, in principle, might also vary during the iterations (for instance, some possibilities are discussed in [19]); all the simulations results we show in this paper are referred to the simple case in which the threshold is kept constant throughout all the decoding procedure. In particular, in the simulations we have run, the values of $i_{\texttt{max}}$ and $b$ have been chosen empirically. Our analysis is general and can be easily extended to other decoders than those considered here. Indeed, many different decoders have been analyzed in the literature (for instance, see [10] and [21]), and, as for the outcome of reaction and timing attacks, there is no meaningful difference between them. This strongly hints that such attacks are possible because of the probabilistic nature of the decoder, and are only slightly affected by the particular choice of the decoder and its settings. However, the analysis we provide in Section IV, which describes the decoder behaviour in the first iteration, takes into account the effect of the threshold value.

We point out that Algorithm 1 is commonly called an out-of-place decoder, as the syndrome $\mathbf{s}$ is updated after the set $\Psi$ is computed. A different procedure is the one of in-place decoders, in which the syndrome is updated every time a bit is estimated as error affected (i.e., after the $\it if$ instruction in line 11). In this paper we only focus on out-of-place decoders. The reason is that the attacks we consider seem to be emphasized when in-place decoders are used[10, 21]. However, even if a careful analysis is needed, it is very likely that our results can be extended also to in-place decoders.

III A general framework for reaction and timing attacks

In this section we describe a family of attacks based on statistical analyses, namely statistical attacks. This family includes reaction attacks, in which data is collected through the observation of Bob’s reactions, and side-channel attacks. A statistical attack of the types here considered can be described as follows.

Let us consider a public-key cryptosystem with private and public keys $K_{S}$ and $K_{P}$, respectively, and security parameter $\lambda$ (i.e., the best attack on the system has complexity $>2^{\lambda}$). We denote as Decrypt$(K_{S},\mathbf{x})$ a decryption algorithm that, given a ciphertext $\mathbf{x}$ and $K_{S}$ as inputs, returns either the plaintext $\mathbf{m}$ or a decryption failure. We define $\mathcal{D}(K_{S},\mathbf{x})$ as an oracle that, queried with a ciphertext $\mathbf{x}$, runs Decrypt$(K_{S},\mathbf{x})$ and returns some metrics that describe the execution of the decryption algorithm. More details about the oracle’s replies are provided next. An adversary, which is given $K_{P}$, queries the oracle with $N$ ciphertexts $\{\mathbf{x}^{(i)}\left|i=1,\cdots,N\right.\}$; we denote as $y^{(i)}$ the oracle’s reply to the $i$-th query $\mathbf{x}^{(i)}$. The adversary then runs an algorithm $\mathcal{A}(K_{P},\{\mathbf{x}^{(0)},y^{(0)}\},\cdots,\{\mathbf{x}^{(N-1)},y^{(N-1)}\})$ that takes as inputs $K_{P}$ and the pairs of oracle queries and replies, and returns $K^{\prime}_{S}$. The algorithm $\mathcal{A}$ models the procedure that performs a statistical analysis of the gathered data and reconstructs the secret key, or an equivalent version of it. The time complexity of this whole procedure can be approximated as

[TABLE]

where $\alpha$ corresponds to the average number of operations performed for each query and $C_{\mathcal{A}}$ is the complexity of executing the algorithm $\mathcal{A}$. The adversary is then challenged with a randomly generated ciphertext $\mathbf{x}^{*}$, corresponding to a plaintext $\mathbf{m}^{*}$. We consider the attack successful if $C<2^{\lambda}$ and the probability of $\mathbf{m}=$ Decrypt$(K^{\prime}_{S},\mathbf{x}^{*})$ being equal to $\mathbf{m}^{*}$ is not negligible (i.e., larger than $2^{-\lambda}$).

We point out that this formulation is general, since it does not distinguish between the McEliece and Niederreiter cases. In the same way the private and public keys might be generic. For example, this model describes also reaction attacks against LEDA cryptosystems  [5], in which the secret key consists of $\mathbf{H}$ and an additional sparse matrix $\mathbf{Q}$.

The above model allows for taking into account many kinds of attacks, depending on the oracle’s reply. For instance, when considering attacks based on decryption failures, the oracle’s reply is a boolean value which is true in case of a failure and false otherwise. When considering timing attacks based on the number of iterations, then the oracle’s reply corresponds to the number of iterations run by the decoding algorithm.

In this paper we focus on systems with security against a Chosen Ciphertext Attack (CCA), that is, the case in which a proper conversion (like the one of  [16]) is applied to the McEliece/Niederreiter cryptosystem, in order to achieve CCA security. In our attack model, this corresponds to assuming that the oracle queries are all randomly generated, i.e., the error vectors used during encryption can be seen as randomly picked elements from the ensemble of all $n$-uples with weight $t$. Opposed to the CCA case, in the Chosen Plaintext Attack (CPA) case the opponent is free to choose the error vectors used during encryption: from the adversary standpoint, the CPA assumption is clearly more optimistic than that of CCA, and leads to improvements in the attack [15, 21]. Obviously, all results we discuss in this paper can be extended to the CPA case.

One final remark is about the schemes we consider: as shown in [24, 25], the complexity of algorithm $\mathcal{A}$ can be increased with proper choices in the structure of the secret key. Basically, in these cases the adversary can gather information about the secret key, but cannot efficiently use this information to reconstruct the secret key, or to obtain an equivalent version of it. In this paper we do not consider such approaches and we assume that the algorithm $\mathcal{A}$ always runs in a feasible time, as it occurs in [15, 12].

III-A State-of-the-art statistical attacks

Modern statistical attacks [15, 10, 12, 13, 21] are specific to the sole case of QC codes having the structure originally proposed in [3], which are defined through a secret parity-check matrix in the form

[TABLE]

where each $\mathbf{H}_{i}$ is a circulant matrix of weight $v$ and $n_{0}$ is a small integer. Thus, the corresponding code is a $(v,n_{0}v)$-regular code.

All existing statistical attacks are focused on guessing the existence (or absence) of some cyclic distances between symbols $1$ in $\mathbf{H}$. In particular, an adversary aims at recovering the following quantities, which were introduced in [15].

Distance spectrum: * Given a vector $\mathbf{a}$, with support $\phi(\mathbf{a})$ and length $p$, its distance spectrum is defined as*

[TABLE]

**Multiplicity: * We say that a distance $d\in\mathrm{DS}(\mathbf{a})$ has multiplicity $\mu_{d}$ if there are $\mu_{d}$ distinct pairs in $\phi(\mathbf{a})$ which produce the same distance $d$.

---

  

Basically, the distance spectrum is the set of all distances with multiplicity larger than [math]. It can be easily shown that all the rows of a circulant matrix are characterized by the same distance spectrum; thus, given a circulant matrix $\mathbf{M}$, we denote the distance spectrum of any of its rows (say, the first one) as $\mathrm{DS}(\mathbf{M})$.

Statistical attacks proposed in the literature aim at estimating the distance spectrum of the circulant blocks in the secret $\mathbf{H}$, and are based on the observation that some quantities that are typical of the decryption procedure depend on the number of common distances between the error vector and the rows of the parity-check matrix. In particular, the generic procedure of a statistical attack on a cryptosystem whose secret key is in the form (5) is described in Algorithm 2; we have called the algorithm Ex-GJS in order to emphasize the fact that it is an extended version of the original GJS attack [15], which was only focused on a single circulant block in $\mathbf{H}$. Our algorithm, which is inspired by that of [12], is a generalization of the procedure in [15], in which all the circulant blocks in $\mathbf{H}$ are taken into account. We present this algorithm in order to show the maximum amount of information that state-of-the-art statistical attacks allow to recover.

The error vector used for the $i$-th query is expressed as $\mathbf{e}^{(i)}=[\mathbf{e}^{(i)}_{0},\ldots,\mathbf{e}^{(i)}_{n_{0}-1}]$, where each $\mathbf{e}^{(i)}_{j}$ has length $p$. The estimates $\mathbf{a}^{(0)},\ldots,\mathbf{a}^{(n_{0}-1)}$ and $\mathbf{b}^{(0)},\ldots,\mathbf{b}^{(n_{0}-1)}$ are then used by the adversary to guess the distance spectra of the blocks in the secret key. Indeed, let us define $\mathcal{E}^{(d,j)}(n,t)$ as the ensemble of all error vectors having length $n$, weight $t$ and such that they exhibit a distance $d$ in the distance spectrum of the $j$-th length-$p$ block. Then, depending on the meaning of the oracle’s reply, the ratios $a^{(j)}_{d}/b^{(j)}_{d}$ correspond to the estimate of the average value of some quantity, when the error vector belongs to $\mathcal{E}^{(d,j)}(n,t)$. For instance, when considering attacks based on decryption failures, the oracle’s reply is either [math] or $1$, depending on whether the decryption was successful or failed. In such a case, the ratio $a^{(j)}_{d}/b^{(j)}_{d}$ corresponds to the empirical measurement of the DFR, conditioned to the event that the error vector belongs to $\mathcal{E}^{(j,d)}(n,t)$. In general, statistical attacks are successful because many quantities that are typical of the decoding procedure depend on the multiplicity of the distances in $\mathrm{DS}(\mathbf{H}_{j})$. In the next section we generalize this procedure, by considering different ensembles for the error vectors; then, in Section IV, we provide a theoretical explanation for such a phenomenon.

III-B Exploiting decryption failures on generic codes

In this section we generalize the Ex-GJS procedure, and describe an algorithm which can be used to recover information about any regular code. In particular, our analysis shows that events of decoding failure i) do not strictly depend on the QC structure of the adopted code, and ii) permit to retrieve a quantity that is more general than distance spectra.

We first show that, for generic regular codes, there is a connection between the syndrome weight and the DFR. This statement is validated by numerical simulations on $(v,w)$-regular codes, obtained through Gallager construction [14], in which $\frac{v}{w}=\frac{r}{n}$. In particular, we have considered two codes with length $n=5000$, redundancy $r=2500$ and different pairs $(v,w)$, decoded through Algorithm 1; their DFR (i.e., the probability of Algorithm 1 returning $\bot=1$) vs. syndrome weight is shown in Fig. 1. We notice from Fig. 1 that there is a strong dependence between the initial syndrome weight and the DFR and that different pairs $(v,w)$ can lead to two different trends in the DFR evolution. Section IV is devoted to the explanation of this phenomenon.

Let us now define $\mathcal{E}(n,t,i_{0},i_{1})$ as the ensemble of all vectors having length $n$, weight $t$ and whose support contains elements $i_{0}$ and $i_{1}$. Let $\mathbf{s}$ be the syndrome of an error vector $\mathbf{e}\in\mathcal{E}(n,t,i_{0},i_{1})$: we have

[TABLE]

The syndrome weight has a probability distribution that depends on the interplay between $\mathbf{h}_{i_{0}}$ and $\mathbf{h}_{i_{1}}$: basically, when these two columns overlap in a small (large) number of ones, then the average syndrome weight gets larger (lower). Moreover, motivated by the empirical evidence of Fig. 1, one can expect that the DFR experienced over error vectors belonging to different ensembles $\mathcal{E}(n,t,i_{0},i_{1})$ depends on the number of overlapping ones between columns $\mathbf{h}_{i_{0}}$ and $\mathbf{h}_{i_{1}}$. Then, a statistical attack against a generic regular code can be mounted, as described in Algorithm 3, which we denote as General Statistical Attack (GSA). The output of the algorithm is represented by the matrices $\mathbf{A}$ and $\mathbf{B}$, which are used by the adversary to estimate the average value of the oracle’s replies, as a function of the pair $(i_{0},i_{1})$. Notice that in Algorithm 3 the oracle’s reply is denoted as $y^{(i)}$ and does not need to be better specified. We will indeed show in Section V that the same procedure can be used to exploit other information sources than the success (or failure) of decryption.

We now focus on the case of $y^{(i)}$ being [math] or $1$, depending on whether decryption was successful or not. Then, each ratio $a_{j,l}/b_{j,l}$ is the empirical estimate of the probability of encountering a decryption failure, when the error vector contains both $j$ and $l$ in its support.

One might expect that the ratios $a_{j,l}/b_{j,l}$ are distributed on the basis of the number of overlapping ones between columns $j$ and $l$ in $\mathbf{H}$. We have verified this intuition by means of numerical simulations; the results we have obtained are shown in Fig. 2, for the case of error vectors belonging to ensembles $\mathcal{E}(n,t,0,j)$, with $j\in[1,\ldots,n-1]$. The figure clearly shows that the ratios $a_{j,l}/b_{j,l}$ can be used to guess the number of overlapping ones between any pair of columns in $\mathbf{H}$.

These empirical results confirm the conjecture that the DFR corresponding to error vectors in $\mathcal{E}(n,t,i_{0},i_{1})$ depends on the number of overlapping ones between the columns $i_{0}$ and $i_{1}$. Moreover, these results show that the same idea of [15], with some generalization, can be applied to whichever kind of code.

We now show that even when QC codes are considered, our algorithm recovers more information than that which can be obtained through the Ex-GJS procedure. For such a purpose, let us consider a parity-check matrix in the form (5), and let $\gamma_{i,j}$ be the number of overlapping ones between columns $i$ and $j$. Now, because of the QC structure, we have

[TABLE]

We now consider two columns that belong to the same circulant block in $\mathbf{H}$, i.e. $i=pi_{p}+i^{\prime}$, $j=pi_{p}+j^{\prime}$, where $0\leq i_{p}\leq n_{0}-1$; then, (8) can be rewritten as

[TABLE]

With some simple computations, we finally obtain

[TABLE]

which holds for all indices $i^{\prime},j^{\prime}\in[0,\ldots,p-1],i^{\prime}\neq j^{\prime}$. Similar considerations can be carried out if the two columns do not belong to the same circulant block. So, (10) shows that the whole information about overlapping ones between columns in $\mathbf{H}$ is actually represented by a subset of all the possible values of $\gamma_{i,j}$. This means that the execution of Algorithm 3 can be sped up by taking the QC structure into account.

In particular, the values of $\gamma_{i,j}$ can be used to obtain the distance spectra of the blocks in $\mathbf{H}$ in a straightforward way. Let us refer to Equation (10), and look at two columns $\mathbf{h}_{pi_{p}}$ and $\mathbf{h}_{j}$, with $j=pi_{p}+j^{\prime}$, where $j^{\prime}\in[0,1,\ldots,p-1]$. We denote the support of $\mathbf{h}_{pi_{p}}$ as $\phi(\mathbf{h}_{pi_{p}})=\{c^{(pi_{p})}_{0},\cdots,c^{(pi_{p})}_{v-1}\}$. The support of $\mathbf{h}_{j}$ can be expressed as

[TABLE]

Then, we have $\left|\phi(\mathbf{h}_{pi_{p}})\cap\phi(\mathbf{h}_{j})\right|=\gamma_{pi_{p},j}$; this means that there are $\gamma_{pi_{p},j}$ pairs $\{c,c^{\prime}\}\in\phi(\mathbf{h}_{pi_{p}})\times\phi(\mathbf{h}_{j})$ such that

[TABLE]

It is easy to see that (12) corresponds to the definition of the distance spectrum of the blocks in $\mathbf{H}$; then, (12) can be turned into the following rule

[TABLE]

with $d=\min\{\pm j^{\prime}\hskip 2.84526pt\mathrm{mod}\hskip 2.84526ptp\}$.

This proves that the procedure described by Algorithm 3 allows obtaining at least the same amount of information recovered through the Ex-GJS algorithm, which is specific to the QC case and guarantees a complete cryptanalysis of the system [15]. In other words, our analysis confirms that Algorithm 3 is applicable and successful in at least all the scenarios in which the attack from [15] works. Moreover, our procedure allows for recovering a larger amount of information about the secret key, and thus defines a broader perimeter of information retrieval, which encompasses existing and future attacks.

IV An approximated model for reaction attacks

The main result of this section is summarized in the following proposition, for which we provide theoretical justifications and empirical evidences.

Proposition 1

Let $\mathbf{H}$ be the parity-check matrix of a $(v,w)$-regular code, which is decoded through Algorithm 1 with decoding threshold $b$. Let $(i_{0},i_{1})$ and $(i^{*}_{0},i^{*}_{1})$ be two distinct pairs of indexes, and consider error vectors $\mathbf{e}\in\mathcal{E}(n,t,i_{0},i_{1})$ and $\mathbf{e}^{*}\in\mathcal{E}(n,t,i^{*}_{0},i^{*}_{1})$. Let $\epsilon$ and $\epsilon^{*}$ be the probabilities that $\mathbf{e}$ and $\mathbf{e}^{*}$ result in a decoding failure, respectively. Let $\mathbf{e}^{\prime}_{[1]}$ be the error vector estimate after the first iteration; we define $\mathbf{e}^{\prime}=\mathbf{e}+\mathbf{e}^{\prime}_{[1]}$ and $t^{\prime}=\mathrm{wt}\{\mathbf{e}^{\prime}\}$. Then, $\epsilon>\epsilon^{*}$ if and only if $E\left[t^{\prime}\right]>E\left[t^{\prime*}\right]$, where $E\left[\hskip 2.84526pt\cdot\hskip 2.84526pt\right]$ denotes the expected value.

Essentially, the above proposition implies that increments (reductions) of the DFR are due to the fact that, depending on the particular matrix $\mathbf{H}$, some error patterns tend to produce, on average, a larger (lower) amount of residual errors, after the first decoder iteration. First of all, this statement is actually supported by empirical evidences: we have run numerical simulations on the same codes as those in Fig.s 1 and 2, and have evaluated the number of residual errors after the first iteration. The results are shown in Fig. 3; as we can see, accordingly with Proposition 1, the trend of the DFR and the one of $t^{\prime}$ are the same for the analyzed codes.

We now derive a statistical model which approximates how the BF decoder described in Algorithm 1 evolves during the first iteration; through this model we can predict the values of $t^{\prime}$ and, thus, also justify the different trends of the DFR observed in Fig.s 1 and 2. We choose two distinct integers $i_{0},i_{1}$ and consider the case of an error vector randomly drawn from the ensemble $\mathcal{E}(n,t,i_{0},i_{1})$, that is, we take columns $i_{0}$ and $i_{1}$ of $\mathbf{H}$ as a reference, assuming that $e_{i_{0}}=e_{i_{1}}=1$. We also suppose that the columns $i_{0}$ and $i_{1}$ of $\mathbf{H}$ overlap in $\gamma$ positions, and aim at expressing the average value of $t^{\prime}$ as a function of the code parameters, the decoding threshold $b$ and the value of $\gamma$.

Let us first partition the sets of parity-check equations and variable nodes as follows.

Definition 1

Given an $r\times n$ parity-check matrix $\mathbf{H}$, the set $\{0,1,\cdots,r-1\}$ can be partitioned into three subsets, defined as follows:

1. i)

$\mathcal{P}_{0}$: the set of parity-check equations that involve both bits $i_{0}$ and $i_{1}$, that is

[TABLE] 2. ii)

$\mathcal{P}_{1}$: the set of parity-check equations that involve either bit $i_{0}$ or bit $i_{1}$, that is

[TABLE] 3. iii)

$\mathcal{P}_{2}$: the set of parity-check equations that do not involve bits $i_{0}$ and $i_{1}$, that is

[TABLE]

Definition 2

Let $\mathcal{V}_{i}$, with $i\in\{0,1,2\}$, be the set defined as

[TABLE]

The cardinality of each set $\mathcal{V}_{i}$ depends on the particular matrix $\mathbf{H}$. However, when considering a regular code, we can derive some general properties, as stated in the following lemma.

Lemma 1

Given a $(v,w)$-regular code, the following bounds on the size of the sets $\mathcal{V}_{i}$, with $i\in\{0,1,2\}$, as defined in Definition 14, hold

[TABLE]

Proof:

The first bound in (15) follows from the fact that $|\mathcal{P}_{0}|=\gamma$. Any parity-check equation in $\mathcal{P}_{0}$ involves $w$ bits, including $i_{0}$ and $i_{1}$. So, all the parity-check equations in $\mathcal{P}_{0}$ involve, at most, $\gamma(w-2)$ bits other than $i_{0}$ and $i_{1}$. The second bound in (15) can be derived with similar arguments, considering that $|\mathcal{P}_{1}|=2(v-\gamma)$, and either $i_{0}$ or $i_{1}$ participates to the parity-check equations in $\mathcal{P}_{1}$. The third bound is simply obtained by considering the remaining $r+\gamma-2v$ parity-check equations, when the other two bounds in (15) hold with equality sign. ∎

From now on, in order to make our analysis as general as possible, i.e., independent of the particular $\mathbf{H}$, we make the following assumption.

Assumption 1

Let $\mathbf{H}$ be the $r\times n$ parity-check matrix of a $(v,w)$-regular code. We assume that each variable node other than $i_{0}$ and $i_{1}$ either participates in just one parity-check equation from $\mathcal{P}_{0}$ or $\mathcal{P}_{1}$ and $v-1$ equations in $\mathcal{P}_{2}$, or participates in $v$ parity-check equations in $\mathcal{P}_{2}$. This means that

[TABLE]

The previous assumption is justified by the fact that, due to the sparsity of $\mathbf{H}$, we have $r\gg v$; it then follows that $|P_{0}|\ll|P_{2}|$ and $|P_{1}|\ll|P_{2}|$. Clearly, this assumption becomes more realistic as the matrix $\mathbf{H}$ gets sparser.

We additionally define $t^{(i)}=\left|\phi(\mathbf{e})\cap\mathcal{V}_{i}\right|$; clearly, we have $t^{(0)}+t^{(1)}+t^{(2)}=t-2$. The probability of having a specific configuration of $t^{(0)}$, $t^{(1)}$ and $t^{(2)}$ is equal to

[TABLE]

In analogous way, we define $t^{(i)^{\prime}}$ as the number of nodes that are in $\mathcal{V}^{(i)}$ and are simultaneously set in $\mathbf{e}+\mathbf{e}^{\prime}_{[1]}$. In other words, $t^{(i)^{\prime}}$ corresponds to the number of errors that, after the first iteration, affect bits in $\mathcal{V}_{i}$.

The definitions of the sets $\mathcal{V}_{i}$ are useful to analyze how the value of $\gamma$ influences the decoder choices. We focus on a generic $j$-th bit, with $j\neq i_{0},i_{1}$, and consider the value of $\sigma_{j}$, as defined in Algorithm 1. Because of Assumption 16, we have that

if $j\in\mathcal{V}_{0}$ (resp. $\mathcal{V}_{1}$), the $j$-th bit participates in one parity-check equation from $\mathcal{P}_{0}$ (resp. $\mathcal{V}_{1}$) and $v-1$ parity-check equations in $\mathcal{P}_{2}$; 2. 2.

if $j\in\mathcal{V}_{2}$, the $j$-th bit participates in $v$ parity-check equations in $\mathcal{P}_{2}$; 3. 3.

if $j\in\{i_{0},i_{1}\}$, then it participates in $\gamma$ parity-check equations from $\mathcal{P}_{0}$ and $v-\gamma$ parity-check equations from $\mathcal{P}_{1}$.

Let $p^{(i)}_{d,u}$, with $i=\{0,1,2\}$, be the probability that a parity-check equation involving the $j$-th bit (with $j\neq i_{0},i_{1}$) and contained in $\mathcal{P}_{i}$ is unsatisfied, in the case of $e_{j}=d$, with $d\in\{0,1\}$; the value of such a probability is expressed by Lemma 18.

Lemma 2

Let us consider a $(v,w)$-regular code with blocklength $n$ and an error vector $\mathbf{e}$ with weight $t$. Then, the probabilities $p^{(i)}_{d,u}$, with $i\in\{0,1,2\}$ and $d\in\{0,1\}$, can be calculated as

[TABLE]

Proof:

Let us first consider $i=0$ and $d=0$. Let us also consider the $j$-th bit, different from $i_{0}$ and $i_{1}$. Any parity check equation in $\mathcal{P}_{0}$ overlaps with the error vector in two positions, as it involves both bits $i_{0}$ and $i_{1}$; since we are looking at an error-free bit, then the parity-check equation will be unsatisfied only if the remaining $t-2$ errors intercept an odd number of ones, among the remaining $w-3$ ones. Simple combinatorial arguments lead to the first expression of (18). All the other expressions can be derived with similar arguments. ∎

We also define $p^{(i)}_{\mathcal{E},u}$, with $i\in\{0,1\}$, as the probability that a parity-check equation involving a bit $\in\{i_{0},i_{1}\}$, and contained in $\mathcal{P}_{i}$, is unsatisfied; the value of such a probability is derived in Lemma 20.

Lemma 3

Let us consider a $(v,w)$-regular code with blocklength $n$ and an error vector $\mathbf{e}$ with weight $t$. Then, the probabilities $p^{(i)}_{\mathcal{E},u}$, with $i\in\{0,1\}$, can be calculated as

[TABLE]

[TABLE]

Proof:

The proof can be carried on with the same arguments of the proof of Lemma 18. ∎

We now consider the following assumption.

Assumption 2

Let $\mathbf{H}$ be the parity-check matrix of a $(v,w)$-regular code. We assume that the parity-check equations in which the $j$-th bit is involved are statistically independent; thus, $\sigma_{j}$, defined as in Algorithm 1, can be described in the first decoding iteration as the sum of independent Bernoulli random variables, each one having its own probability of being set, which corresponds either to $p^{(i)}_{d,u}$ or $p^{(d)}_{\mathcal{E},u}$, where $i\in\{0,1,2\}$ and $d\in\{0,1\}$.

We now define $P^{(i)}_{d,\mathrm{flip}}$ as the probability that the decoder flips the $j$-th bit, in the case that $j\neq i_{0},i_{1}$ and $j\in\mathcal{V}_{i}$, when $e_{j}=d$. In analogous way, $P_{\mathcal{E},\mathrm{flip}}$ denotes the probability that, when $j\in\{i_{0},i_{1}\}$, the decoder flips the $j$-th bit. The above probabilities are computed in Lemmas 23, 30, respectively.

Lemma 4

Let us consider a $(v,w)$-regular code with blocklength $n$ and an error vector $\mathbf{e}$ with weight $t$; let $b$ denote the decoding threshold employed in the first iteration. Then, under Assumptions 16 and 2, the probabilities $P^{(i)}_{d,\mathrm{flip}}$, with $i\in\{0,1,2\}$ and $d\in\{0,1\}$, can be computed as follows

[TABLE]

[TABLE]

[TABLE]

Proof:

When $j\in\mathcal{V}_{0}$, the $j$-th bit is involved in one parity-check equation in $\mathcal{P}_{0}$ and $v-1$ equations in $\mathcal{P}_{2}$. The probability that the decoder in the first iteration flips the $j$-th bit can be computed as

[TABLE]

In particular, we have

[TABLE]

so that

[TABLE]

Similarly, if $j\in\mathcal{V}_{1}$, then it is involved in one parity-check equation in $\mathcal{P}_{1}$ and $v-1$ equations in $\mathcal{P}_{2}$; thus, we have

[TABLE]

Finally, if $j\in\mathcal{V}_{2}$, then it is involved in $v$ parity-check equations in $\mathcal{V}_{2}$; using a similar reasoning as in the previous cases, we can write

[TABLE]

This proves the lemma. ∎

Lemma 5

Let us consider a $(v,w)$-regular code with blocklength $n$ and an error vector $\mathbf{e}$ with weight $t$; let $b$ denote the decoding threshold employed in the first iteration. Then, under Assumptions 16 and 2, the probability $P_{\mathcal{E},\mathrm{flip}}$ can be computed as follows

[TABLE]

where

[TABLE]

Proof:

Eq. (30) derives from the fact that bits $i_{0}$ and $i_{1}$ participate in $\gamma$ parity-check equations in $\mathcal{P}_{0}$; furthermore, both $i_{0}$ and $i_{1}$ participate in $v-\gamma$ equations in $\mathcal{P}_{1}$ each. Then, (29) expresses the probability that the number of unsatisfied parity-check equations for bit $i_{0}$ or $i_{1}$ is not smaller than the threshold $b$. ∎

In order to estimate the average number of bits flipped after one iteration, we have to consider all the possible configurations of the error vector $\mathbf{e}$. As for the bits which are not in $\mathcal{E}$ the average value of $t^{(i)^{\prime}}$ can be computed as

[TABLE]

and the average number of errors in all bits $\mathcal{V}=\bigcup_{i=0}^{2}\mathcal{V}_{i}$ can be estimated as

[TABLE]

where $t^{(2)}=t-2-(t^{(0)}+t^{(1)})$ and $E_{\{t^{(0)},t^{(1)},t^{(2)}\}}=E\left[t^{(0)^{\prime}}\right]+E\left[t^{(1)^{\prime}}\right]+E\left[t^{(2)^{\prime}}\right]$.

Similarly, the average number of residual errors due to the bits in $\mathcal{E}$ can be derived as

[TABLE]

We can finally obtain the average value of $t^{\prime}$ over all bits in $\{0,1,\ldots,n-1\}$ as

[TABLE]

A comparison between the simulated average values of $t^{\prime}$ and the theoretical ones is shown in Table I for the two codes already considered in Figures 2 and 3, as a function of $\gamma$. As we can see, this model allows for a close prediction of the average value of $t^{\prime}$ starting from the number of overlapping ones $\gamma$. This also allows an accurate modeling of the behaviour of the number of errors (increasing or decreasing) as a function of $\gamma$.

V Other sources of information leakage

In this section we show some additional information leaks that might be exploited by an adversary to gather information about the structure of the secret $\mathbf{H}$.

The results in the previous section show how, on average, the number of residual errors after the first iteration can be associated to the number of overlapping ones between columns of $\mathbf{H}$. Then, if the opponent has access to $\mathbf{e}^{\prime}_{[1]}$ (i.e., to the positions that have been flipped in the first iteration), he can succeed in recovering the values of $\gamma_{i,j}$. Indeed, once $\mathbf{e}^{\prime}_{[1]}$ is known, the opponent can compute the number of residual errors for each query as $\mathbf{e}+\mathbf{e}^{\prime}_{[1]}$. Basically, this statistical attack can be modeled through Algorithm 3, by assuming that the oracle’s answer $y^{(i)}$ is $t^{\prime}$, that is, to the weight of $\mathbf{e}+\mathbf{e}^{\prime}_{[1]}$. The results in the previous section clearly show that this procedure allows for the cryptanalysis of the system.

We point out that, in a practical scenario, the locations of the bits that have been flipped by the decoder can be estimated through some power analysis attack, as in [11]. This information might be masked through proper implementation strategies; for instance, random permutations might be applied to the order of processing bits in the decoder. This solution, which was proposed by the authors of [11] as a countermeasure to the attack they introduced in the same paper, is however likely not to be strong enough for guaranteeing prevention of other kinds of information leaks.

For instance, let us suppose that the oracle’s reply in Algorithm 3 is the weight of $\mathbf{e}^{\prime}_{[1]}$, i.e., to the number of flips performed in the first iteration. In a real case scenario, estimating this quantity might not be too hard. Indeed, each flip requires the update of the error vector (one operation) and the update of the syndrome ($v$ operations). Thus, we might expect that the duration of the first iteration, and/or its power consumption, linearly increases with the weight of $\mathbf{e}^{\prime}_{[1]}$. It can be shown that also this quantity depends on the number of intersections between columns.

Indeed, let us recall the notation adopted in the previous section, and define as $N_{\mathcal{V},\mathrm{flip}}^{(i)}$ the average number of flips performed among nodes in $\mathcal{V}_{i}$. We can write

[TABLE]

so that the average number of flips in $\mathcal{V}$ is

[TABLE]

where $t^{(2)}=t-2-(t^{(0)}+t^{(1)})$.

The average number of flips for the bits in $\mathcal{E}$ is equal to $N_{\mathcal{E},\mathrm{flip}}=2P_{\mathcal{E},\mathrm{flip}}$. So, combining the effect of the above equations, we have

[TABLE]

The probabilities in (36) depend on the value of $\gamma$; so, statistical attacks based on this quantity are expected to be successful. We have verified this intuition by means of numerical simulations, and the results are shown at the end of this section.

Another quantity that might leak information about the secret key is represented by the evolution of the syndrome weight during iterations. Authors in [10] have shown that the weight of the initial syndrome $\mathbf{s}=\mathbf{H}\mathbf{e}^{T}$ reveals information about the secret key; making a little step forward, we show that this consideration is indeed general and holds also for the first iteration. We model this attack by assuming that an adversary runs Algorithm 3 and the oracle replies with the syndrome weight after the first iteration, i.e. the weight of $\mathbf{s}^{\prime}=\mathbf{H}(\mathbf{e}+\mathbf{e}^{\prime}_{[1]})^{T}$. In general, we expect $t^{\prime}\ll n$. On the other hand, large values of $t^{\prime}$ are associated to large weights of $\mathbf{s}^{\prime}$ as well. Since we have verified in the previous sections that error vectors drawn from ensembles $\mathcal{E}(n,t,i_{0},i_{1})$ are associated to different values of $t^{\prime}$, it follows that also the syndrome weight depends on the number of intersections between columns of $\mathbf{H}$.

We have verified all these ideas by means of numerical simulations. In particular, we have considered QC codes, described by $\mathbf{H}$ in the form (5), in the case of $n_{0}=2$, $p=4801$ and $v=45$.

We have chosen $t=84$ and $b=28$, and applied Algorithm 3 with $N=10^{8}$, considering that the oracle replies with: i) the average number of errors after the first iteration in Figure 4(a), ii) the average weight of the syndrome vector after the first iteration in Figure 4(b). This empirical evidence confirms our conjectures, and proves that these data, when leaked, might lead to a complete cryptanalysis of the system.

VI Conclusions

In this paper we have provided a deep analysis of statistical attacks against LDPC and MDPC code-based cryptosystems. We have considered a simple BF decoder, and have shown that its probabilistic nature might yield a substantial information leakage. We have shown that a general model for statistical attacks can be defined, and that many quantities, when observed by the opponent, might be exploited to recover information about the secret key. Our analysis confirms that, in order to safely use long-lasting keys in McEliece cryptosystem variants based on sparse parity-check matrix codes, a constant time and power implementation is necessary, along with a negligible DFR.