Practical Algebraic Attack on DAGS

TL;DR

This paper enhances an algebraic attack on the DAGS cryptographic scheme by optimizing the ratio of equations to variables, enabling private key recovery in seconds and breaking updated parameters with feasible computational effort.

Contribution

It introduces a hybrid algebraic attack that improves efficiency by adjusting the equation-variable ratio and demonstrates the vulnerability of DAGS' latest parameters.

Findings

The attack can recover private keys in a few seconds.

Updated DAGS parameters with 128-bit security are breakable with 2^83 operations.

Increasing the ratio of equations to variables improves algebraic attack performance.

Abstract

DAGS scheme is a key encapsulation mechanism (KEM) based on quasi-dyadic alternant codes that was submitted to NIST standardization process for a quantum resistant public key algorithm. Recently an algebraic attack was devised by Barelli and Couvreur (Asiacrypt 2018) that efficiently recovers the private key. It shows that DAGS can be totally cryptanalysed by solving a system of bilinear polynomial equations. However, some sets of DAGS parameters were not broken in practice. In this paper we improve the algebraic attack by showing that the original approach was not optimal in terms of the ratio of the number of equations to the number of variables. Contrary to the common belief that reducing at any cost the number of variables in a polynomial system is always beneficial, we actually observed that, provided that the ratio is increased and up to a threshold, the solving can be heavily improved by adding variables to the polynomial system. This enables us to recover the private keys in a few seconds. Furthermore, our experimentations also show that the maximum degree reached during the computation of the Gr\"obner basis is an important parameter that explains the efficiency of the attack. Finally, the authors of DAGS updated the parameters to take into account the algebraic cryptanalysis of Barelli and Couvreur. In the present article, we propose a hybrid approach that performs an exhaustive search on some variables and computes a Gr\"obner basis on the polynomial system involving the remaining variables. We then show that the updated set of parameters corresponding to 128-bit security can be broken with 2^83 operations.

Tables

Table 1. Table 1: Running times of the algebraic attack to break DAGS scheme. The computations are performed with Magma V2.23-1 on an Intel Xeon processor clocked at 2.60GHz with 128Gb. We reproduced the computations from  [ 8 ] on our machine. The columns “Gröbner” correspond to the Gröbner basis computation part, the columns “Linear algebra” to the linear algebra steps of the attack.

Parameters	Security	[8]			The present article
		Gröbner	Linear	Total	Gröbner	Linear	Total
			algebra			algebra
DAGS-1	$128$	$552$s	$8$s	$560$s	$3.6$s	$6.4$s	$10$s
DAGS-3	$192$	–	–	–	$70$s	$16$s	$86$s
DAGS-5	$256$	$6$s	$20$s	$26$s	$0.5$s	$15.5$s	$16$s

Table 2. Table 2: DAGS-1, DAGS-3 and DAGS-5 correspond to the initial parameters (v1). When the algebraic attack [ 8 ] appeared the authors updated to DAGS-1.1, DAGS-3.1 and DAGS-5.1 (v2).

Name	Security	$q$	$m$	$2^{\gamma }$	$n_0$	$k_0$	$r_0$
DAGS-1	$128$	$2^5$	$2$	$2^4$	$52$	$26$	$13$
DAGS-3	$192$	$2^6$	$2$	$2^5$	$38$	$16$	$11$
DAGS-5	$256$	$2^6$	$2$	$2^6$	$33$	$11$	$11$
DAGS-1.1	$128$	$2^6$	$2$	$2^4$	$52$	$26$	$13$
DAGS-3.1	$192$	$2^8$	$2$	$2^5$	$38$	$16$	$11$
DAGS-5.1	$256$	$2^8$	$2$	$2^5$	$50$	$28$	$11$

Table 3. Table 3: Computation time for the Gröbner basis of ( 10 ) without shortening 𝒟 𝒟 \mathscr{D} ( I = ∅ 𝐼 I=\emptyset ). The columns “ dim 𝒟 dimension 𝒟 \dim\mathscr{D} ” and “ c 𝑐 c ” correspond to the dimension of 𝒟 𝒟 \mathscr{D} and the value of c = q 2 γ − 1 𝑐 𝑞 superscript 2 𝛾 1 c=\frac{q}{2^{\gamma-1}} . The columns n U subscript 𝑛 𝑈 n_{U} and n V = n B + n T subscript 𝑛 𝑉 subscript 𝑛 𝐵 subscript 𝑛 𝑇 n_{V}=n_{B}+n_{T} give the number of variables 𝑼 𝑼 \boldsymbol{U} and 𝑩 ∪ 𝑻 𝑩 𝑻 \boldsymbol{B}\cup\boldsymbol{T} respectively. The column “Var.” is equal to the total number of variables n U + n V subscript 𝑛 𝑈 subscript 𝑛 𝑉 n_{U}+n_{V} while the column “Eq.” indicates the number of equations in ( 10 ). “Ratio” is equal to the ratio of the number of equations to the number of variables. “Gröb.” gives the number of CPU clock cycles as given by the ClockCycles() function in Magma on Intel ® Xeon ® 2.60GHz processor. “Deg.” gives the degree where linear equations are produced. The column “Mat. size” is the size of the biggest matrix obtained during the computations.

Param.	$dim𝒟$	$c$	$n_U$	$n_V$	Var.	Eq.	Ratio	Gröb.	Deg.	Mat. size
DAGS-1	22	4	88	31	119	550	4.6	$2^{44}$	3	314,384	$\times$	401,540
DAGS-3	12	4	48	28	76	252	3.3	$2^{44}$	4	725,895	$\times$	671,071
DAGS-5	9	2	18	27	45	189	4.2	$2^{33}$	3	100,154	$\times$	8,019

Table 4. Table 4: Computation time for the Gröbner basis in ( 10 ) with the shortening of 𝒟 𝒟 \mathscr{D} . The column “Gröb.” gives the number of CPU clock cycles as given by the ClockCycles() function in Magma on Intel ® Xeon ® 2.60GHz processor.

Param.	$dim{𝒮}_I\left(𝒟\right)$	Var.	Eq.	Ratio	Gröb.	Time	Mem. (GB)	Deg.	Mat. size
DAGS-1	2	39	50	1.28	$2^{39}$	$276$s	$2.21$	4	76,392	$\times$	62,518
	3	43	75	1.74	$2^{38}$	$163$s	$1.11$	4	97,908	$\times$	87,238
	4	47	100	2.13	$2^{33}$	$4$s	$0.12$	3	11,487	$\times$	9,471
	5	51	125	2.45	$2^{34}$	$6$s	$0.24$	3	11,389	$\times$	13,805
DAGS-3	2	36	42	1.17	–	–	$⩾139$	$⩾6$	–
	3	40	63	1.58	$2^{39}$	$321$s	$1.24$	4	85,981	$\times$	101,482
	4	44	84	1.91	$2^{37}$	$70$s	$1.11$	4	103,973	$\times$	97,980
	5	48	105	2.19	$2^{38}$	$140$s	$1.48$	4	170,256	$\times$	161,067
DAGS-5	2	31	42	1.35	$2^{31}$	$0.4$s	$0.12$	3	6,663	$\times$	4,313
	3	33	63	1.91	$2^{31}$	$0.4$s	$0.13$	3	4,137	$\times$	4,066
	4	35	84	2.40	$2^{31}$	$0.5$s	$0.15$	3	5,843	$\times$	4,799
	5	37	105	2.84	$2^{31}$	$0.4$s	$0.19$	3	6,009	$\times$	4,839

Table 5. Table 5: Updated parameters. Columns are the same as Table  3

Param.	$dim𝒟$	$c$	$n_U$	$n_V$	Var.	Eq.	Ratio
DAGS-1.1	18	8	144	35	179	450	2.5
DAGS-3.1	0	16	–	–	–	0	0
DAGS-3.1 dual	6	16	96	34	130	90	0.7
DAGS-5.1	12	16	192	40	232	252	1.1

Table 6. Table 6: Experimental complexity of Gröbner basis computations with c = 8 𝑐 8 c=8 specializations on 𝑼 𝑼 \boldsymbol{U} for DAGS1.1. The system after specialization contains “Var” remaining variables. The column “Linear” (resp. “Bilinear”) gives the number of linear (resp. bilinear) equations in the system. “False” contains the complexity of the Gröbner basis computation for a wrong specialization, “True” for a correct one. The last column gives the global complexity of the attack if we have to test all possible values of the variables in 𝔽 q = 𝔽 2 6 subscript 𝔽 𝑞 subscript 𝔽 superscript 2 6 \mathbb{F}_{q}=\mathbb{F}_{2^{6}} , that is 2 6 × 8 × 2^{6\times 8}\times False + True.

$dim{𝒮}_I\left(𝒟\right)$	Var	Linear	Bilinear	False	True	Total
2	$43$	$25$	$25$	$2^{35}$	$2^{36}$	$2^{83}$
3	$51$	$25$	$50$	$2^{35}$	$2^{36}$	$2^{83}$
4	$59$	$25$	$75$	$2^{38}$	$2^{39}$	$2^{86}$
5	$67$	$25$	$100$	$2^{40}$	$2^{40}$	$2^{88}$

Equations

$$\vec{\mathbf{a}}\otimes \text{mathds}{1}_n=(a_1,\dots ,a_1,a_2,\dots ,a_2,\dots ,a_n,\dots ,a_n).$$

$${\mathcal{P}}_{I}\left(\mathscr{C}\right)\triangleq\Big{\{}\vec{\boldsymbol{u}}\in\mathbb{F}^{n-\left|I\right|}~{}\mid~{}\exists\vec{\boldsymbol{c}}\in\mathscr{C},\;\;\vec{\boldsymbol{u}}=(c_{i})_{i\in\llbracket 1,n\rrbracket\setminus I}\Big{\}}.$$

$${\mathcal{S}}_{I}\left(\mathscr{C}\right)\triangleq{\mathcal{P}}_{I}\left(\Big{\{}\vec{\boldsymbol{c}}\in\mathscr{C}~{}\mid~{}\forall i\in I,\;\;c_{i}=0\Big{\}}\right).$$

$$\mathsf{GRS}_{t}(\vec{\boldsymbol{x}},\vec{\boldsymbol{y}})\triangleq\Big{\{}\big{(}y_{1}f(x_{1}),\dots,y_{n}f(x_{n})\big{)}~{}\mid~{}f\in\mathbb{F}_{<t}[z]\Big{\}}$$

$${\left(y_j^{\perp }\right)}^{-1}=y_j\prod _{\ell =1,\ell \ne j}^n(x_{\ell }-x_j).$$

$${\mathcal{A}}_t(\vec{\mathbf{x}},\vec{\mathbf{y}})\triangleq {\mathsf{GRS}}_{n-t}(\vec{\mathbf{x}},{\vec{\mathbf{y}}}^{\perp })\cap {\mathbb{K}}^n={\mathsf{GRS}}_t^{\perp }(\vec{\mathbf{x}},\vec{\mathbf{y}})\cap {\mathbb{K}}^n.$$

$$\mathsf{GRS}_{k}\big{(}\zeta(\vec{\boldsymbol{x}}),\vec{\boldsymbol{y}}\big{)}=\mathsf{GRS}_{k}(\vec{\boldsymbol{x}},\vec{\boldsymbol{y}}).$$

$$\forall i\in [[1,n]],x_{\sigma (i)}\triangleq \zeta (x_i).$$

$$\forall (\sigma ,\vec{\mathbf{c}})\in \mathbb{G}\times \mathcal{C},{\vec{\mathbf{c}}}^{\sigma }\in \mathcal{C}.$$

$${\sigma }_b(\vec{\mathbf{x}})=\vec{\mathbf{x}}+b\otimes \text{mathds}{1}_{2^{\gamma }{n}_0}=\vec{\mathbf{\tau }}\otimes \text{mathds}{1}_{2^{\gamma }}+\text{mathds}{1}_{n_0}\otimes {\sigma }_b(\vec{\mathbf{g}}).$$

$${\mathsf{GRS}}_r(\vec{\mathbf{x}},\vec{\mathbf{y}})\star {\mathsf{GRS}}_t(\vec{\mathbf{x}},\vec{\mathbf{z}})={\mathsf{GRS}}_{r+t-1}(\vec{\mathbf{x}},\vec{\mathbf{y}}\star \vec{\mathbf{z}}).$$

$$\left({\mathsf{GRS}}_{n-r}(\vec{\mathbf{x}},{\vec{\mathbf{y}}}^{\perp })\cap {\mathbb{K}}^n\right)\star \left({\mathsf{GRS}}_t(\vec{\mathbf{x}},\text{mathds}{1}_n)\cap {\mathbb{K}}^n\right)\subseteq {\mathsf{GRS}}_{n-r+t-1}(\vec{\mathbf{x}},{\vec{\mathbf{y}}}^{\perp })\cap {\mathbb{K}}^n$$

$${\mathcal{A}}_{r+t-1}(\vec{\mathbf{x}},\vec{\mathbf{y}})\star \left({\mathsf{RS}}_t(\vec{\mathbf{x}})\cap {\mathbb{K}}^n\right)\subseteq {\mathcal{A}}_r(\vec{\mathbf{x}},\vec{\mathbf{y}}).$$

$$T_{{\mathbb{F}}_{q^m}/{\mathbb{F}}_q}(\alpha \vec{\mathbf{x}})=\sum _{i=0}^{m-1}{\alpha }_i{T}_{{\mathbb{F}}_{q^m}/{\mathbb{F}}_q}({\omega }_i\vec{\mathbf{x}}).$$

$${\mathcal{A}}_{r+t-1}(\vec{\mathbf{x}},\vec{\mathbf{y}}\otimes \text{mathds}{1}_{2^{\gamma }})\star \left({\mathsf{RS}}_t(\vec{\mathbf{x}})\cap {\mathbb{F}}_q^n\right)\subseteq {\mathcal{A}}_r(\vec{\mathbf{x}},\vec{\mathbf{y}}\otimes \text{mathds}{1}_{2^{\gamma }}).$$

$$\mathscr{A}^{\mathbb{G}}_{r}\triangleq\Big{\{}(c_{1},\dots,c_{n})\in\mathscr{A}_{r}~{}\mid~{}\forall(i,j)\in\llbracket 0,n_{0}-1\rrbracket\times\llbracket 1,2^{\gamma}\rrbracket,\;\;c_{i2^{\gamma}+j}=c_{i2^{\gamma}+1}\Big{\}}.$$

$$\left\{\begin{array}[]{rcl}\mathscr{D}&\subsetneq&\mathscr{A}^{\mathbb{G}}_{r},\\ \dim\mathscr{D}&=&k_{0}-c~{}~{}\text{ where }c\triangleq\frac{mq^{m-1}}{2^{\gamma}}=\frac{q}{2^{\gamma-1}},\\ \mathscr{D}\star\mathscr{N}&\subseteq&\mathscr{A}_{r}.\end{array}\right.$$

$$\vec{\mathbf{x}}=({\omega }^q-\omega {)}^{-1}\left({\omega }^q{T}_{{\mathbb{F}}_{q^2}/{\mathbb{F}}_q}(\vec{\mathbf{x}})-T_{{\mathbb{F}}_{q^2}/{\mathbb{F}}_q}(\omega \vec{\mathbf{x}})\right).$$

$$\big{(}\boldsymbol{K}\boldsymbol{G}_{\mathsf{inv}}\big{)}\star\boldsymbol{H}_{\mathsf{pub}}\cdot\boldsymbol{V}^{T}=\vec{\boldsymbol{0}}.$$

$${\mathcal{S}}_I\left(\mathcal{D}\right)\star {\mathcal{P}}_I\left(\mathcal{N}\right)\subseteq {\mathcal{S}}_I\left({\mathcal{A}}_r\right).$$

$$\left(\begin{array}{cc}{\mathbf{I}}_d& \mathbf{U}\end{array}\right){\mathcal{S}}_I\left({\mathbf{G}}_{\mathsf{inv}}\right)\star {\mathcal{P}}_I\left({\mathbf{H}}_{\mathsf{pub}}\right)\cdot {\mathcal{P}}_I{\left(\mathbf{V}\right)}^T=\vec{0}$$

$$\mathcal{E}\star \mathcal{N}\subset {{\mathcal{A}}_r}^{\perp }$$

$$\{\begin{array}{ll}{n}_U=\left(k_0-c-a_0\right)c& \text{ variables in }\mathbf{U}\\ n_T=n_0-k_0+c-1& \text{ variables }{T}_{k_0-c+1},\dots ,T_{n_0-1}\\ n_B=\gamma -2& \text{ variables }{B}_3,\dots ,B_{\gamma }\\ \left(k_0-c-a_0\right)(n_0-k_0-1)& \text{ quadratic equations}\end{array}$$

$$T_i=P_i(\mathbf{U}[i],T_{n_0-k_0+1},\dots ,T_{n_0-1},\mathbf{B}),i\in [[1,k_0-c-a_0]]$$

Full text

1 Introduction

The design of a quantum-safe public key encryption scheme is becoming an important issue with the recent process initiated by NIST to standardize one or more quantum-resistant public-key cryptographic algorithms. One of the oldest cryptosystem that is not affected by the apparition of a large-scale quantum computer is the McEliece public key encryption scheme [26]. It is a code-based cryptosystem that uses the family of binary Goppa codes. The main advantage of this cryptosystem is its very fast encryption/decryption functions, and the fact that up to the present, nobody has succeeded to cryptanalyse it.

But in the eyes of those who are concerned with applications requiring very compact schemes, these positive aspects of the McEliece cryptosystem may not make up for its large keys. For instance the classic McEliece [10] submitted to NIST uses at least 1MB public keys for 256 bits of security. A well-known approach for getting smaller keys consists in replacing binary Goppa codes by even more structured linear codes. A famous method started in [23] and further developed in [9, 27, 6, 3] relies on codes displaying symmetries like cyclicity and dyadicity while having very efficient decoding algorithms. Unlike the McEliece cryptosystem which currently remains unbroken, the schemes [9, 27] are subject to efficient ciphertext-only attacks [20] that recover the secret algebraic structure. The attack developed in [20] formulates the general problem of recovering the algebraic structure of an alternant code as solving a system of polynomial equations. But it involves very high degree polynomial equations with too many variables. Finding solutions to this kind of algebraic system is currently out of reach of the best known algorithms. However this approach turns out to be extremely fruitful when dealing with polynomial systems that come from the quasi-cyclic [9] and quasi-dyadic [27] cryptosystems because the symmetries permit to reduce to a manageably small number of variables.

The apparition of the algebraic attack in [20] generated a series of new algebraic attacks [17, 19, 21] but since the original McEliece cryptosystem does not seem to be affected by this approach, it still raises the question of whether it represents a real threat.

Recently a new algebraic attack [8] was mounted against DAGS [3] scheme. DAGS is a key encapsulation mechanism (KEM) based on quasi-dyadic alternant codes defined over quadratic extension. It was submitted to the standardisation process launched by NIST. The attack relies on the component-wise product of codes in order to build a system of bilinear multivariate equations. The use of the component-wise product of codes in cryptography is not new. It first appeared in [29] and has proved in several occasions [24, 25, 14, 28] to be a powerful cryptanalytic tool against algebraic codes like Generalised Reed-Solomon codes. It even enabled to mount for the first time a polynomial-time attack in [15, 16] against a special family of non-binary Goppa codes [11] displaying no symmetries.

1.0.1 Our contribution.

In this paper we improve the algebraic attack of [8] by showing that the original approach was not optimal in terms of the ratio of the number of equations to the number of variables. Contrary to the common belief that reducing at any cost the number of variables in a polynomial system is always beneficial, we actually observed that, provided that the ratio is increased and up to a threshold, the solving can be heavily improved by adding variables to the polynomial system. This enables us to recover the private keys in a few seconds. In Table 1 we report the average running times of our attack and that of [8] performed on the same machine. For DAGS-1 and DAGS-5, the linear algebra part of the attack is the dominant cost.

Furthermore, our experimentations show that the maximum degree reached during the computation of the Gröbner basis is an important parameter that explains the efficiency of the attack. We observed that the maximum degree never exceeds $4$.

Subsequently to the attack [8], the authors of DAGS updated the parameters. We propose a hybrid approach that performs an exhaustive search on some variables and computes a Gröbner basis on the polynomial system involving the remaining variables. We then show that one set of parameters does not have the claimed level of security. Indeed the parameters corresponding to 128-bit security can be broken with $2^{83}$ operations.

1.0.2 Organisation of the paper.

Section 2 introduces the useful notation and important notions to describe the DAGS scheme. Section 3 recalls the important properties about the component-wise product of GRS and alternant codes. In Section 4 we describe the algebraic attack, and in Section 5 the practical running times we obtained with our experimentations. Lastly, Section 6 explains the hybrid approach.

2 Preliminaries

Notation.

$\mathbb{F}_{q}$ is the field with $q$ elements. In this paper, $q$ is a power of $2$. For any $m$ and $n$ in $\mathbb{Z}$, $\llbracket m,n\rrbracket$ is the set of integers $i$ such that $m\leqslant i\leqslant n$. The cardinality of set $A$ is $\left|A\right|$. Vectors and matrices are denoted by boldface letters as $\vec{\boldsymbol{a}}=(a_{1},\dots,a_{n})$ and $\boldsymbol{A}=(a_{i,j})$. The Symmetric group on $n$ letters is denoted by $\mathfrak{S}_{n}$ and for any $\vec{\boldsymbol{v}}=(v_{1},\dots,v_{n})$ and $\sigma$ in $\mathfrak{S}_{n}$ we define $\vec{\boldsymbol{v}}^{\sigma}\triangleq\left(v_{\sigma(1)},\dots,v_{\sigma(n)}\right)$. The identity matrix of size $n$ is written as $\boldsymbol{I}_{n}$. The transpose of a vector $\vec{\boldsymbol{a}}$ and a matrix $\boldsymbol{A}$ is denoted by $\vec{\boldsymbol{a}}^{T}$ and $\boldsymbol{A}^{T}$. The $i$-th row of a matrix $\boldsymbol{A}=(a_{i,j})$ is $\boldsymbol{A}[i]$. We recall that the Kronecker product $\vec{\boldsymbol{a}}\otimes\vec{\boldsymbol{b}}$ of two vectors $\vec{\boldsymbol{a}}=(a_{1},\dots,a_{n})$ and $\vec{\boldsymbol{b}}$ is equal to $(a_{1}\vec{\boldsymbol{b}},\dots,a_{n}\vec{\boldsymbol{b}})$. In particular, we denote by $\mathds{1}_{n}$ the all–one vector $\mathds{1}_{n}\triangleq(1,\dots,1)\in\mathbb{F}_{q}^{n}$ and we have $\mathds{1}_{n}\otimes\vec{\boldsymbol{a}}=(\vec{\boldsymbol{a}},\dots,\vec{\boldsymbol{a}})$ and

[TABLE]

Any $k$-dimensional vector subspace $\mathscr{C}$ of $\mathbb{F}^{n}$ where $\mathbb{F}$ is field is called a linear code $\mathscr{C}$ of length $n$ and dimension $k<n$ over $\mathbb{F}$. A matrix whose rows form a basis of $\mathscr{C}$ is called a generator matrix. The orthogonal or dual of $\mathscr{C}\subset\mathbb{F}^{n}$ is the linear space ${\mathscr{C}}^{\bot}$ containing all vectors $\vec{\boldsymbol{z}}$ from $\mathbb{F}^{n}$ such that for all $\vec{\boldsymbol{c}}\in\mathscr{C}$, we have $\left\langle\vec{\boldsymbol{c}},\vec{\boldsymbol{z}}\right\rangle\triangleq\sum_{i=1}^{n}c_{i}z_{i}=0$. We always have $\dim{\mathscr{C}}^{\bot}=n-\dim\mathscr{C}$, and any generator matrix of ${\mathscr{C}}^{\bot}$ is called a parity check matrix of $U$. The punctured code ${\mathcal{P}}_{I}\left(\mathscr{C}\right)$ of $\mathscr{C}$ over a set $I\subset\llbracket 1,n\rrbracket$ is defined as

[TABLE]

The shortened ${\mathcal{S}}_{I}\left(\mathscr{C}\right)$ code of $\mathscr{C}$ over a set $I\subset\llbracket 1,n\rrbracket$ is then defined as

[TABLE]

We extend naturally the notation ${\mathcal{P}}_{I}\left(\cdot{}\right)$ to vectors and matrices.

Algebraic codes.

A generalized Reed-Solomon code $\mathsf{GRS}_{t}(\vec{\boldsymbol{x}},\vec{\boldsymbol{y}})$ of dimension $t$ and length $n$ where $\vec{\boldsymbol{x}}$ is an $n$-tuple of distinct elements from a finite field $\mathbb{F}$ and $\vec{\boldsymbol{y}}$ is an $n$-tuple of non-zero elements from $\mathbb{F}$ is the linear code defined by

[TABLE]

where $\mathbb{F}_{<t}[z]$ is the set of univariate polynomials $f$ with coefficients in $\mathbb{F}$ such that $\deg f<t$. The dimension of $\mathsf{GRS}_{t}(\vec{\boldsymbol{x}},\vec{\boldsymbol{y}})$ is clearly $t$. By convention $\mathsf{GRS}_{t}(\vec{\boldsymbol{x}},\mathds{1}_{n})$ where $\mathds{1}_{n}$ is the all-one vector of length $n$ is simply a Reed-Solomon code denoted by $\mathsf{RS}_{t}(\vec{\boldsymbol{x}})$.

The code ${\mathsf{GRS}_{t}}^{\bot}(\vec{\boldsymbol{x}},\vec{\boldsymbol{y}})$ is equal to $\mathsf{GRS}_{n-t}(\vec{\boldsymbol{x}},{\vec{\boldsymbol{y}}}^{\bot})$ where ${\vec{\boldsymbol{y}}}^{\bot}=({y}^{\bot}_{1},\dots,{y}^{\bot}_{n})$ is the $n$-tuple such that for all $j$ in $\llbracket 1,n\rrbracket$ it holds that

[TABLE]

An alternant code $\mathscr{A}_{t}(\vec{\boldsymbol{x}},\vec{\boldsymbol{y}})$ of degree $t\geqslant 1$ over a field $\mathbb{K}\subsetneq\mathbb{F}$ and length $n$ where $\vec{\boldsymbol{x}}$ is an $n$-tuple of distinct elements from $\mathbb{F}^{n}$ and $\vec{\boldsymbol{y}}$ is an $n$-tuple of non-zero elements from $\mathbb{F}^{n}$ is the linear code

[TABLE]

The dimension of an alternant code satisfies the bound $\dim\mathscr{A}_{t}(\vec{\boldsymbol{x}},\vec{\boldsymbol{y}})\geqslant n-mt$ where $m$ is the degree of the field extension of $\mathbb{F}/\mathbb{K}$.

Remark 1

Note that one has always the inclusions $\mathsf{GRS}_{r}(\vec{\boldsymbol{x}},\vec{\boldsymbol{y}})\subseteq\mathsf{GRS}_{t+r}(\vec{\boldsymbol{x}},\vec{\boldsymbol{y}})$ and $\mathscr{A}_{t+r}(\vec{\boldsymbol{x}},\vec{\boldsymbol{y}})\subseteq\mathscr{A}_{r}(\vec{\boldsymbol{x}},\vec{\boldsymbol{y}})$ for any $r\geqslant 1$ and $t\geqslant 1$.

Proposition 1

Let $\mathsf{GRS}_{k}(\vec{\boldsymbol{x}},\vec{\boldsymbol{y}})$ be a generalized Reed-Solomon code of dimension $k$ where $\vec{\boldsymbol{x}}$ is an $n$-tuple of distinct elements from $\mathbb{F}_{q^{m}}$ and $\vec{\boldsymbol{y}}$ is an $n$-tuple of non-zero elements from $\mathbb{F}_{q^{m}}$. For any affine map $\zeta:\mathbb{F}_{q^{m}}\rightarrow\mathbb{F}_{q^{m}}$ defined as $\zeta(z)\triangleq az+b$ where $a$ in $\mathbb{F}_{q^{m}}\setminus\{0\}$ and $b$ in $\mathbb{F}_{q^{m}}$ it holds that

[TABLE]

Remark 2

A consequence of Proposition 1 is that it is possible to choose arbitrary values for two different coordinates $x_{i}$ and $x_{j}$ ($i\neq j$) provided that they are different. For instance we may always assume that $x_{1}=0$ and $x_{2}=1$.

Another very important result from this proposition is that when an affine map $\zeta(z)=az+b$ leaves globally invariant $\vec{\boldsymbol{x}}$ then it induces a permutation $\sigma$ of $\mathfrak{S}_{n}$ thanks to the identification:

[TABLE]

We call $\sigma$ the permutation induced by the affine map $\zeta$. For the ease of notation we shall systematically identify $\sigma$ and $\zeta$.

Dyadic codes.

A code $\mathscr{C}\subset\mathbb{F}^{n}$ is quasi-dyadic of order $2^{\gamma}$ where $\gamma$ is a non-negative integer if there exists $\mathbb{G}\subseteq\mathfrak{S}_{n}$ that is isomorphic to $\mathbb{F}_{2}^{\gamma}$ such that

[TABLE]

A construction of quasi-dyadic GRS and alternant codes is given in [18]. It considers $\gamma$ elements $b_{1},\dots,b_{\gamma}$ in $\mathbb{F}_{q^{m}}$ that are linearly independent over $\mathbb{F}_{2}$. The vector space $\oplus_{i=1}^{\gamma}\mathbb{F}_{2}\cdot b_{i}$ generated over $\mathbb{F}_{2}$ is then equal to a group $\mathbb{G}$. Next, it takes an $n_{0}$-tuple $\vec{\boldsymbol{\tau}}=(\tau_{1}\dots,\tau_{n_{0}})$ from $\mathbb{F}_{q^{m}}^{n_{0}}$ such that the cosets $\tau_{i}+\mathbb{G}$ are pairwise disjoint, and finally it picks an $n_{0}$-tuple $\vec{\boldsymbol{y}}=(y_{1},\dots,y_{n_{0}})$ composed of nonzero elements from $\mathbb{F}_{q^{m}}$. We now consider $\vec{\boldsymbol{z}}\triangleq\vec{\boldsymbol{y}}\otimes\mathds{1}_{2^{\gamma}}$ and $\vec{\boldsymbol{x}}\triangleq\vec{\boldsymbol{\tau}}\otimes\mathds{1}_{2^{\gamma}}+\mathds{1}_{n_{0}}\otimes\vec{\boldsymbol{g}}$ where $\vec{\boldsymbol{g}}\triangleq(g)_{g\in\mathbb{G}}$. The action of $\mathbb{G}$ can then be described more explicitly: for any $b$ in $\mathbb{G}$ we associate the translation defined for any $z$ in $\mathbb{F}_{q^{m}}$ by $\sigma_{b}(z)\triangleq z+b$. It is clear that $\sigma_{b}$ leaves globally invariant $\vec{\boldsymbol{x}}$ because we have $\sigma_{b}(\mathbb{G})=b+\mathbb{G}=\mathbb{G}$ and furthermore the following holds

[TABLE]

Proposition 2 ([18])

Let $\mathbb{K}$ be a subfield of $\mathbb{F}_{q^{m}}$, $n_{0}$, $\gamma$, $\mathbb{G}$, $\vec{\boldsymbol{y}}$ and $\vec{\boldsymbol{\tau}}$ defined as above and $n\triangleq 2^{\gamma}n_{0}$, $\vec{\boldsymbol{g}}\triangleq(g)_{g\in\mathbb{G}}$, $\vec{\boldsymbol{z}}\triangleq\vec{\boldsymbol{y}}\otimes\mathds{1}_{2^{\gamma}}$ and $\vec{\boldsymbol{x}}\triangleq\vec{\boldsymbol{\tau}}\otimes\mathds{1}_{2^{\gamma}}+\mathds{1}_{n_{0}}\otimes\vec{\boldsymbol{g}}$. The codes $\mathsf{GRS}_{r}(\vec{\boldsymbol{x}},\vec{\boldsymbol{z}})\subset\mathbb{F}_{q^{m}}^{n}$ and $\mathscr{A}_{t}(\vec{\boldsymbol{x}},\vec{\boldsymbol{z}})\subset\mathbb{K}^{n}$ are quasi-dyadic of order $2^{\gamma}$.

Example 1

Let us take $n_{0}=2$ and $\gamma=2$ then $\vec{\boldsymbol{g}}=(0,b_{1},b_{2},b_{1}+b_{2})$ and $\vec{\boldsymbol{x}}=(\tau_{1},\tau_{1}+b_{1},\tau_{1}+b_{2},\tau_{1}+b_{1}+b_{2})||(\tau_{2},\tau_{2}+b_{1},\tau_{2}+b_{2},\tau_{2}+b_{1}+b_{2})$. The group $\mathbb{G}$ is then equal to $\{0,b_{1},b_{2},b_{1}+b_{2}\}$. We have $\sigma_{b_{1}}(\vec{\boldsymbol{g}})=(b_{1},0,b_{2}+b_{1},b_{2})$ and the permutation that corresponds to $b_{1}$ is $(12)(34)(56)(78)$ in the canonical cycle notation. ∎

DAGS scheme.

The public key encryption scheme DAGS [1, 2] submitted to the NIST call for post quantum cryptographic proposals is a McEliece-like scheme with a conversion to a KEM. It relies on quasi-dyadic alternant codes $\mathscr{A}_{r}={\mathsf{GRS}}^{\bot}_{r}(\vec{\boldsymbol{x}},\vec{\boldsymbol{z}})\cap\mathbb{F}_{q}^{n}$ with $q=2^{s}$ with ${\mathsf{GRS}}^{\bot}_{r}(\vec{\boldsymbol{x}},\vec{\boldsymbol{z}})\subset\mathbb{F}_{q^{2}}^{n}$ ($m=2$). The public code $\mathscr{A}_{r}$ is quasi-dyadic of order $2^{\gamma}$ where $\gamma\geqslant 1$. The parameters are chosen such that $r=2^{\gamma}r_{0}$ and $n=2^{\gamma}n_{0}$, and the dimension is $k=2^{\gamma}k_{0}$ with $k_{0}\triangleq n_{0}-2r_{0}$.

Keeping up with the notation of Proposition 2 the vectors $\vec{\boldsymbol{x}}$ and $\vec{\boldsymbol{z}}$ can be written as $\vec{\boldsymbol{x}}\triangleq\vec{\boldsymbol{\tau}}\otimes\mathds{1}_{2^{\gamma}}+\mathds{1}_{n_{0}}\otimes\vec{\boldsymbol{g}}$ and $\vec{\boldsymbol{z}}\triangleq\vec{\boldsymbol{y}}\otimes\mathds{1}_{2^{\gamma}}$ with $\vec{\boldsymbol{g}}=(g)_{g\in\mathbb{G}}$ where $\mathbb{G}=\oplus_{i=1}^{\gamma}\mathbb{F}_{2}b_{i}$ is the vector space generated over $\mathbb{F}_{2}$ by $\gamma$ elements $\vec{\boldsymbol{b}}=(b_{1},\dots,b_{\gamma})$ that are linearly independent over $\mathbb{F}_{2}$. The quantities $\vec{\boldsymbol{b}}$ and $\vec{\boldsymbol{y}}$ are randomly drawn from $\mathbb{F}_{q^{2}}^{n_{0}}$ such that the cosets $\tau_{i}+\mathbb{G}$ are pairwise disjoint and $\vec{\boldsymbol{y}}$ is composed of nonzero elements in $\mathbb{F}_{q^{2}}$.

The public key is then an $(n-k)\times n$ parity check matrix $\boldsymbol{H}_{\mathsf{pub}}$ of $\mathscr{A}_{r}$. The quantities $(\vec{\boldsymbol{b}},\vec{\boldsymbol{\tau}},\vec{\boldsymbol{y}})$ have to be kept secret since they permit to decrypt any ciphertext. Table 2 gathers the parameters of the scheme.

3 Component-wise Product of Codes

An important property about GRS codes is that whenever $\vec{\boldsymbol{a}}$ belongs to $\mathsf{GRS}_{r}(\vec{\boldsymbol{x}},\vec{\boldsymbol{y}})$ and $\vec{\boldsymbol{b}}$ belongs to $\mathsf{GRS}_{t}(\vec{\boldsymbol{x}},\vec{\boldsymbol{z}})$, the component wise product $\vec{\boldsymbol{a}}\star\vec{\boldsymbol{b}}\triangleq(a_{1}b_{1},\dots,a_{n}b_{n})$ belongs to $\mathsf{GRS}_{t+r-1}(\vec{\boldsymbol{x}},\vec{\boldsymbol{y}}\star\vec{\boldsymbol{z}})$. Furthermore, if one defines the component wise product $\mathscr{A}\star\mathscr{B}$ of two linear codes $\mathscr{A}\subset\mathbb{F}^{n}$ and $\mathscr{B}\subset\mathbb{F}^{n}$ as the linear code spanned by all the products $\vec{\boldsymbol{a}}\star\vec{\boldsymbol{b}}$ with $\vec{\boldsymbol{a}}$ in $\mathscr{A}$ and $\vec{\boldsymbol{b}}$ in $\mathscr{B}$ the inclusion is then an equality

[TABLE]

In the case of alternant codes over a subfield $\mathbb{K}\subseteq\mathbb{F}$, one only gets in general the inclusion

[TABLE]

which leads to the following result.

Proposition 3 ([8])

For any integer $r\geqslant 1$ and $t\geqslant 1$ the alternant codes $\mathscr{A}_{r+t-1}(\vec{\boldsymbol{x}},\vec{\boldsymbol{y}})$ and $\mathscr{A}_{r}(\vec{\boldsymbol{x}},\vec{\boldsymbol{y}})$ over $\mathbb{K}\subsetneq\mathbb{F}$ where $\vec{\boldsymbol{x}}$ is an $n$-tuple of distinct elements from a finite field $\mathbb{F}$ and $\vec{\boldsymbol{y}}$ is an $n$-tuple of non-zero elements from $\mathbb{F}$ satisfy the inclusion

[TABLE]

The previous result is really interesting when $\mathsf{RS}_{t}(\vec{\boldsymbol{x}})\cap\mathbb{K}^{n}$ is not the (trivial) code generated by $\mathds{1}_{n}$. This happens for instance for $\mathbb{F}=\mathbb{F}_{q^{m}}$ and $\mathbb{K}=\mathbb{F}_{q}$ when $t=q^{m-1}+1$ because $\mathsf{RS}_{t}(\vec{\boldsymbol{x}})\cap\mathbb{F}_{q}^{n}$ then always contains at least $\mathds{1}_{n}$ and $\operatorname{T}_{\mathbb{F}_{q^{m}}/\mathbb{F}_{q}}(\vec{\boldsymbol{x}})\triangleq\left(\operatorname{T}_{\mathbb{F}_{q^{m}}/\mathbb{F}_{q}}(x_{1}),\dots,\operatorname{T}_{\mathbb{F}_{q^{m}}/\mathbb{F}_{q}}(x_{n})\right)$. Actually one can observe that $\operatorname{T}_{\mathbb{F}_{q^{m}}/\mathbb{F}_{q}}(\alpha\vec{\boldsymbol{x}})$ also always belongs to $\mathsf{RS}_{t}(\vec{\boldsymbol{x}})\cap\mathbb{F}_{q}^{n}$ for all $\alpha$ in $\mathbb{F}_{q^{m}}$. Hence if $\{1,\omega_{1},\dots,\omega_{m-1}\}$ form an $\mathbb{F}_{q}$-basis of $\mathbb{F}_{q^{m}}$ then $\alpha$ can be written as $\alpha_{0}+\alpha_{1}\omega_{1}+\cdots{}+\alpha_{m-1}\omega_{m-1}$ with $\alpha_{0},\dots,\alpha_{m-1}$ in $\mathbb{F}_{q}$, and consequently with the convention that $\omega_{0}\triangleq 1$ one has that

[TABLE]

This implies that $\dim_{\mathbb{F}_{q}}\mathsf{RS}_{t}(\vec{\boldsymbol{x}})\cap\mathbb{F}_{q}^{n}\geqslant m+1$ when $t=q^{m-1}+1$. Another interesting case is when $t=\frac{q^{m}-1}{q-1}+1$ then $\operatorname{N}_{\mathbb{F}_{q^{m}}/\mathbb{F}_{q}}(\vec{\boldsymbol{x}})\triangleq\left(\operatorname{N}_{\mathbb{F}_{q^{m}}/\mathbb{F}_{q}}(x_{1}),\dots,\operatorname{N}_{\mathbb{F}_{q^{m}}/\mathbb{F}_{q}}(x_{n})\right)$ belongs to $\mathsf{RS}_{t}(\vec{\boldsymbol{x}})\cap\mathbb{F}_{q}^{n}$, and one would get that $\dim_{\mathbb{F}_{q}}\mathsf{RS}_{t}(\vec{\boldsymbol{x}})\cap\mathbb{F}_{q}^{n}\geqslant m+2$.

4 Algebraic Cryptanalysis

We present the ciphertext-only attack of [8] that recovers the private key of DAGS scheme. We refer to Section 2 for the notation. The public key is a parity-check matrix $\boldsymbol{H}_{\mathsf{pub}}$ of a quasi-dyadic alternant code $\mathscr{A}_{r}$. The attack recovers the secret values $\vec{\boldsymbol{b}}=(b_{1},\dots,b_{\gamma})$, $\vec{\boldsymbol{\tau}}=(\tau_{1},\dots,\tau_{n_{0}})$ and $\vec{\boldsymbol{y}}=(y_{1},\dots,y_{n_{0}})$. The idea is to exploit the fact that

[TABLE]

where $\vec{\boldsymbol{x}}=\vec{\boldsymbol{\tau}}\otimes\mathds{1}_{2^{\gamma}}+\mathds{1}_{n_{0}}\otimes\vec{\boldsymbol{g}}$ with $\vec{\boldsymbol{g}}=(g)_{g\in\mathbb{G}}$ and $\mathbb{G}=\oplus_{i=1}^{\gamma}\mathbb{F}_{2}b_{i}$. Because the secret vector $\vec{\boldsymbol{y}}$ is not anymore involved in the definition of $\mathsf{RS}_{t}(\vec{\boldsymbol{x}})$ an attacker gains a real advantage if she manages to identify the codewords that are contained in $\mathsf{RS}_{t}(\vec{\boldsymbol{x}})\cap\mathbb{F}_{q}^{n}$, especially when $t\geqslant q+2$ (see [8] for more details). The attack of [8] introduces the invariant code $\mathscr{A}^{\mathbb{G}}_{r}$ with respect to $\mathbb{G}$ of $\mathscr{A}_{r}$ which is defined as

[TABLE]

The dimension of $\mathscr{A}^{\mathbb{G}}_{r}$ is equal to $k_{0}$ (see [7, 8]). The cryptanalysis relies then on finding two vector spaces $\mathscr{D}$ and $\mathscr{N}$ such that the constraints given in (8) hold

[TABLE]

Let us recall that $\mathscr{A}_{r}$ and $\mathscr{A}^{\mathbb{G}}_{r}$ are known, especially it is simple to compute a generator matrix $\boldsymbol{G}_{\mathsf{inv}}$ of $\mathscr{A}^{\mathbb{G}}_{r}$. Since $\mathscr{D}\subsetneq\mathscr{A}^{\mathbb{G}}_{r}$ and $\dim\mathscr{D}=k_{0}-c$ there exists a $(k_{0}-c)\times k_{0}$ matrix $\boldsymbol{K}$ such that $\boldsymbol{K}\boldsymbol{G}_{\mathsf{inv}}$ generates $\mathscr{D}$. On the other hand $\mathscr{N}$ necessarily satisfies the inclusion111It was observed experimentally in [8] that actually the inclusion is most of the time an equality. \mathscr{N}\subseteq{\Big{(}\mathscr{D}\star{\mathscr{A}}^{\bot}_{r}\Big{)}}^{\bot} and consequently \big{(}\boldsymbol{K}\boldsymbol{G}_{\mathsf{inv}}\big{)}\star\boldsymbol{H}_{\mathsf{pub}} is a parity check matrix of $\mathscr{N}$. We are now able to state (without proof) an important result justifying the interest of this approach.

Theorem 4.1 ([8])

Let us assume that $\left|\mathbb{G}\right|\leqslant q$. Let $\mathscr{D}$ be the invariant code of $\mathscr{A}_{r+q}(\vec{\boldsymbol{x}},\vec{\boldsymbol{z}})$ and let $\mathscr{N}$ be the vector space generated over $\mathbb{F}_{q}$ by $\mathds{1}_{n}$, $\operatorname{T}_{\mathbb{F}_{q^{2}}/\mathbb{F}_{q}}(\vec{\boldsymbol{x}})$ $\operatorname{T}_{\mathbb{F}_{q^{2}}/\mathbb{F}_{q}}(\omega\vec{\boldsymbol{x}})$ and $\operatorname{N}_{\mathbb{F}_{q^{2}}/\mathbb{F}_{q}}(\vec{\boldsymbol{x}})$ where $\{1,\omega\}$ is an $\mathbb{F}_{q}$-basis of $\mathbb{F}_{q^{2}}$. Then $\mathscr{D}$ and $\mathscr{N}$ are solution to (8).

Remark 3

Considering now the vector space generated by $\mathscr{N}$ over $\mathbb{F}_{q^{2}}$ one can see that $\vec{\boldsymbol{x}}$ is also solution to (8) using this simple identity

[TABLE]

The algebraic attack of [8] recovers $\mathscr{D}$ and $\mathscr{N}$ satisfying (8) by introducing two sets of variables $\boldsymbol{V}=(V_{1},\dots,V_{n})$ and $\boldsymbol{K}=(K_{i,j})$ with $i\in\llbracket 1,k_{0}-c\rrbracket$ and $j\in\llbracket 1,k_{0}\rrbracket$ that satisfy the multivariate quadratic system

[TABLE]

The number of variables of this system can be very high which is a hurdle to solving it efficiently in practice. However this algebraic system does not take into account three observations that enable us to significantly reduce the number of variables.

• •

We know by Theorem 4.1 that $\operatorname{T}_{\mathbb{F}_{q^{2}}/\mathbb{F}_{q}}(\vec{\boldsymbol{x}})$ (and $\vec{\boldsymbol{x}}$) are solution to (8) which means that we may assume that $\boldsymbol{V}$ has a “quasi-dyadic” structure. We define two sets of variables $\boldsymbol{T}=(T_{1},\dots,T_{n_{0}})$ and $\boldsymbol{B}=(B_{1},\dots,B_{\gamma})$ so that we can write $\boldsymbol{V}=\boldsymbol{T}\otimes\mathds{1}_{2^{\gamma}}+\mathds{1}_{n_{0}}\otimes\left(\mathbb{F}_{2}\cdot{}{\boldsymbol{B}}\right)$ where $\mathbb{F}_{2}\cdot{}{\boldsymbol{B}}\triangleq\oplus_{i=1}^{\gamma}\mathbb{F}_{2}B_{i}$ is the vector formed by all the elements in the $\mathbb{F}_{2}$-vector space generated by $\boldsymbol{B}$. More precisely, $\mathbb{F}_{2}\cdot{}{(B_{1})}=(0,B_{1})$ and by induction, $\mathbb{F}_{2}\cdot{}{(B_{1},\dots,B_{i})}=\mathbb{F}_{2}\cdot{}{(B_{1},\dots,B_{i-1})}||\left(B_{i}\otimes\mathds{1}_{2^{\gamma}}+\mathbb{F}_{2}\cdot{}{(B_{1},\dots,B_{i-1})}\right)$. For instance,

$\mathbb{F}_{2}\cdot{}{(B_{1},B_{2},B_{3})}=(0,B_{1},B_{2},B_{1}+B_{2},B_{3},B_{1}+B_{3},B_{2}+B_{3},B_{1}+B_{2}+B_{3})$.

• •

Thanks to the shortening of $\mathscr{D}$ and the puncturing of $\mathscr{N}$ we are able to even more reduce the number of unknowns because for any $I\subset\llbracket 1,n\rrbracket$ it holds

[TABLE]

• •

Lastly, if the first $(k_{0}-c)$ columns of $\boldsymbol{K}$ form an invertible matrix $\boldsymbol{S}$, we can then multiply the polynomial system by $\boldsymbol{S}^{-1}$ without altering the solution set. Therefore we may assume that the first columns of $\boldsymbol{K}$ forms the identity matrix, i.e. $\boldsymbol{K}=\begin{pmatrix}\boldsymbol{I}_{d}&\boldsymbol{U}\end{pmatrix}$. Of course this observation also applies when considering the polynomial system defined in (9).

The algebraic attack harnesses (9) by first picking a set $I\subset\llbracket 1,n\rrbracket$ of cardinality $2^{\gamma}a_{0}$ such that $I$ is the union of $a_{0}$ disjoint dyadic blocks. The different steps are described below:

Recover ${\mathcal{S}}_{I}\left(\mathscr{D}\right)$ and ${\mathcal{P}}_{I}\left(\mathscr{N}\right)$ by solving the quadratic system

[TABLE]

where $d\triangleq\dim{\mathcal{S}}_{I}\left(\mathscr{D}\right)=k_{0}-c-a_{0}$ and $\boldsymbol{V}=\boldsymbol{T}\otimes\mathds{1}_{2^{\gamma}}+\mathds{1}_{n_{0}}\otimes\left(\mathbb{F}_{2}\cdot{}{\boldsymbol{B}}\right)$. 2. 2.

Reconstruct ${\mathcal{P}}_{I}\left(\vec{\boldsymbol{x}}\right)$ from ${\mathcal{S}}_{I}\left(\mathscr{D}\right)$ and ${\mathcal{P}}_{I}\left(\mathscr{N}\right)$. 3. 3.

Recover ${\mathcal{P}}_{I}\left(\vec{\boldsymbol{y}}\right)$ then $\vec{\boldsymbol{x}}$ and $\vec{\boldsymbol{y}}$ using linear algebra.

Remark 4

Because of the particular form of the generator matrix of ${\mathcal{S}}_{I}\left(\mathscr{D}\right)$ in (10), the system may have only a trivial solution. In other words, the polynomial system will provide ${\mathcal{S}}_{I}\left(\mathscr{D}\right)$ if it admits a generator matrix such that its first $d$ columns form an invertible matrix, which holds with probability $\prod_{i=1}^{d}\left(1-q^{-i}\right)$.

Remark 5

The attack searches for a code $\mathscr{D}\subset\mathscr{A}_{r}^{\mathbb{G}}$ of dimension $k_{0}-c$. When $c\geqslant k_{0}$, like DAGS-3.1 where $k_{0}=c=16$, this code does not exist. But it is possible to use ${\mathscr{A}_{r}}^{\bot}$ instead of $\mathscr{A}_{r}$ to search for a code $\mathscr{E}\subset({\mathscr{A}_{r}}^{\bot})^{\mathbb{G}}$ of dimension $n_{0}-k_{0}-c$ such that

[TABLE]

We will not present this version here because it does not give practical improvements.

The authors in [8] addressed Steps 2 and 3 by showing that it relies only on linear algebra with matrices of size at most $n$ and can be done in $O(n^{3})$ operations. In this paper, we are mainly interested in Step 1 and the computation of a Gröbner basis of (10).

Solving (10) using Gröbner bases.

Using Prop. 1 and the fact that an affine map preserves the quasi-dyadic structure, we can assume that $b_{1}=1$ and $\tau_{n_{0}}=0$. Moreover, any vector in the code ${\mathcal{P}}_{I}\left(\mathscr{N}\right)$ is a solution to the system, in particular $\operatorname{T}_{\mathbb{F}_{q^{2}}/\mathbb{F}_{q}}(b_{2})^{-1}\operatorname{T}_{\mathbb{F}_{q^{2}}/\mathbb{F}_{q}}({\mathcal{P}}_{I}\left(\vec{\boldsymbol{x}}\right))$, so we know that a solution with $B_{2}=1$ exists.

Remark 6

Note that $\operatorname{T}_{\mathbb{F}_{q^{2}}/\mathbb{F}_{q}}(b_{2})$ is not invertible if $b_{2}\in\mathbb{F}_{q}$, which arises with probability $\frac{1}{q}$, but in this case a solution with $B_{2}=0,B_{3}=1$ exists in the system and we may specialize one more variable.

The following theorem identifies in (10) the number of equations and variables.

Theorem 4.2

If $\boldsymbol{G}_{\mathsf{inv}}$ and $\boldsymbol{H}_{\mathsf{pub}}$ are in systematic form and $I=\llbracket 1,a_{0}2^{\gamma}\rrbracket$ then the polynomial system (10) with $T_{n_{0}}=0,B_{1}=0,B_{2}=1$ contains

[TABLE]

that are bilinear in the variables $\boldsymbol{U}$ and the variables in $\boldsymbol{V}$, as well as $k_{0}-c-a_{0}$ equations of the form

[TABLE]

where $P_{i}$ is a bilinear polynomial in the variables $\boldsymbol{U}$ and $\boldsymbol{V}$.

Proof

The hypothesis that $\boldsymbol{V}=\boldsymbol{T}\otimes\mathds{1}_{2^{\gamma}}+\mathds{1}_{n_{0}}\otimes\left(\mathbb{F}_{2}\cdot{}{\boldsymbol{B}}\right)$ reduces the number of variables, the number of solutions of the system (it restricts to quasi-dyadic solutions), but it also reduces the number of equations in the system by a factor $2^{\gamma}$. Indeed, if we consider two rows $\vec{\boldsymbol{c}}$ and $\vec{\boldsymbol{c}}^{\sigma}$ from $\boldsymbol{H}_{\mathsf{pub}}$ in the same quasi-dyadic block, where $\sigma\in\mathbb{G}$, then for any row $\vec{\boldsymbol{u}}=\vec{\boldsymbol{u}}^{\sigma}$ from the invariant matrix $\begin{pmatrix}\boldsymbol{I}_{d}&\boldsymbol{U}\end{pmatrix}{\mathcal{S}}_{I}\left(\boldsymbol{G}_{\mathsf{inv}}\right)$, the component-wise product with $\vec{\boldsymbol{c}}^{\sigma}$ satisfies $\vec{\boldsymbol{u}}\star\vec{\boldsymbol{c}}^{\sigma}=(\vec{\boldsymbol{u}}\star\vec{\boldsymbol{c}})^{\sigma}$ and the resulting equations are $(\vec{\boldsymbol{u}}\star\vec{\boldsymbol{c}})^{\sigma}\cdot{\boldsymbol{V}}^{T}=(\vec{\boldsymbol{u}}\star\vec{\boldsymbol{c}}\cdot{\boldsymbol{V}}^{T})^{\sigma}=\vec{\boldsymbol{u}}\star\vec{\boldsymbol{c}}\cdot{\boldsymbol{V}}^{T}$ as $\boldsymbol{V}=\boldsymbol{V}^{\sigma}+\sigma\mathds{1}_{n}$ and $\vec{\boldsymbol{u}}\star\vec{\boldsymbol{c}}\cdot\mathds{1}_{n}=0$.

The $i$-th row of $\begin{pmatrix}\boldsymbol{I}_{d}&\boldsymbol{U}\end{pmatrix}\boldsymbol{G}_{\mathsf{inv}}$ contributes to $n_{0}-k_{0}$ equations that contain the variables in the $i$-row $\boldsymbol{U}[i]$ of $\boldsymbol{U}$, $\boldsymbol{B}$ and $T_{i},T_{k_{0}-c+1},\dots,T_{n_{0}-1}$. Moreover, by using the fact that the matrices are in systematic form, the component-wise product of this row by the $i$-th row of $\boldsymbol{H}_{\mathsf{pub}}$ (the row in the $i$-th block as we take only one row every $2^{\gamma}$ rows) gives a particular equation that expresses $T_{i}$ in terms of $T_{n_{0}-k_{0}+1},\dots,T_{n_{0}-1}$, $\boldsymbol{B}$ and $\boldsymbol{U}[i]$. ∎

5 Experimental Results

This section is devoted to the experimental results we obtained for computing a Gröbner basis. We consider two approaches for solving (10). The first one consists in solving the system without resorting to the shortening of codes ($I=\emptyset$). The second one treats the cases where we solve the system by shortening on $I$ with different cardinalities.

We report the tests we have done using Magma [13] on a machine with a Intel® Xeon® 2.60GHz processor. We indicate in the tables the number of clock cycles of the CPU, given by Magma using the ClockCycles() function, as well as the time taken on our machine.

Solving (10) without shortening.

The polynomial systems for the original DAGS parameters (DAGS-1, DAGS-3 and DAGS-5) are so overdetermined that it is possible to compute directly a Gröbner basis of (10) without shortening ($a_{0}=0$ i.e $I=\emptyset$). Table 3 gives the number of variables and equations for the DAGS parameters. One can see that there are at least 3 times as many equations as variables for the original parameters.

Moreover, the complexity of computing Gröbner bases is related to the highest degree of the polynomials reached during the computation. A precise analysis has been done for generic overdetermined homogeneous systems (called “semi-regular” systems) in [4, 5] and for the particular case of generic bilinear systems in [22]. For generic overdetermined systems, this degree decreases when the number of polynomials increases. For DAGS-1, DAGS-3 and DAGS-5, the highest degree is small (3 or 4). Linear equations then appear at that degree which explains why we are able to solve the systems, even if the number of variables is quite large (up to 119 variables for DAGS-1).

Solving (10) with shortening.

Shortening (10) on the $i$-th dyadic block consists exactly in selecting a subset of the system that does not contain variables from $\boldsymbol{U}[i]$. If we are able to shorten the system without increasing the degree where linear equations appear, then the Gröbner basis computation is faster because the matrices are smaller.

For each set of parameters and for different dimensions of ${\mathcal{S}}_{I}\left(\mathscr{D}\right)$, we ran 100 tests. The results are shown in Table 4. For these tests we always assumed that $b_{2}\notin\mathbb{F}_{q}$ (see Remark 6 for more details). We recall that when $b_{2}\in\mathbb{F}_{q}$ we may specialize one more variable, that is to say we take $B_{1}=0$, $B_{2}=0$ and $B_{3}=1$, and we are able to solve the system. In Table 4 we can see that the best results are obtained with $\dim{\mathcal{S}}_{I}\left(\mathscr{D}\right)=4$ for DAGS-1, even if the number of variables is not the lowest. This can be explained for DAGS-1 by the fact that highest degree is $3$ while when $\dim{\mathcal{S}}_{I}\left(\mathscr{D}\right)=2$ or $3$, the highest degree is $4$.

The figures obtained for DAGS-3 show that the highest degree is $4$ for any value of $\dim{\mathcal{S}}_{I}\left(\mathscr{D}\right)\geqslant 3$. But when $\dim{\mathcal{S}}_{I}\left(\mathscr{D}\right)=4$ more linear equations are produced because the ratio of the number of equations to the number of variables is larger. With a $\dim{\mathcal{S}}_{I}\left(\mathscr{D}\right)=2$, as Barelli and Couvreur [8] used in their attack, the ratio is small ($1.17$), and the maximal degree reached during the Gröbner basis computation is too large ($\geqslant 6$) to get a reasonable complexity. We had to stop because of a lack of memory and there was no linear equation at this degree.

For DAGS-5 the value of $\dim{\mathcal{S}}_{I}\left(\mathscr{D}\right)$ has less influence on the performances because the system always has linear equations in degree $3$.

Updated DAGS parameters.

After the publication of the attack in [8], the authors of DAGS proposed new parameters on their website [2]. They are given in Table 2. The computation of the Gröbner basis is no longer possible with this new set of parameters. For DAGS-1.1, the number of variables is so high that the computation involves a matrix in degree $4$ with about two millions of rows, and we could not perform the computation. For DAGS-3.1, as $c=k_{0}$, the code $\mathscr{D}$ does not exist. Even by considering the dual of the public code as suggested by Remark 5, it was not feasible to solve the system. This is due to the fact the system is underdetermined: the ratio is $0.7$ as shown in Table 3. As for DAGS-5.1, the system has too many variables and the ratio is too low.

However, as the systems are bilinear, a simple approach consisting in specializing a set of variables permits to get linear equations. For instance, with the new parameters for DAGS-1.1, and according to Theorem 4.2, the algebraic system contains $k_{0}-c=\dim\mathscr{D}=18$ sets of $n_{0}-k_{0}-1=25$ equations bilinear in $c=8$ variables $\boldsymbol{U}$ and $n_{0}-k_{0}+c+\gamma-3=35$ variables $\boldsymbol{V}$. If we specialize the $\boldsymbol{U}$ variables in a set of equations, we get $25$ linear equations in $35$ variables $\boldsymbol{V}$. As $q=2^{6}$ for DAGS-1.1, specializing $16$ variables $\boldsymbol{U}$ gives a set of $50$ linear equations in $35$ variables that can be solved in at most $35^{3}<2^{15.39}$ finite field operations, and breaking DAGS-1.1 requires to test all values of the $16$ variables $\boldsymbol{U}$ in $\mathbb{F}_{q}$, hence $2^{96}$ specializations, leading to an attack with $2^{111.39}$ operations, below the $128$-bit security claim. This new set of parameters for DAGS-1.1 clearly does not take into account this point.

The next section will show how to cryptanalyze efficiently the DAGS-1.1 parameters.

6 Hybrid Approach on DAGS v2

We will show in this section that a hybrid approach mixing exhaustive search and Gröbner basis provides an estimated work factor of $2^{83}$ for DAGS-1.1.

As the algebraic system is still highly overdetermined with a ratio of 2.5 between the number of variables and the number of equations, we can afford to reduce the number of variables by shortening $\mathscr{D}$ over $a_{0}$ dyadic blocks while keeping a ratio large enough. For instance if $a_{0}=k_{0}-c-2$ we have $\dim{\mathcal{S}}_{I}\left(\mathscr{D}\right)=2$ and a system of $50$ bilinear equations in $51$ variables. On the other hand, specializing some variables as in the hybrid approach from [12] permits to increase the ratio. For each value of the variables we compute a Gröbner basis of the specialized system. When the Gröbner basis is $\langle 1\rangle$, it means that the system has no solution, and it permits to “cut branches” of the exhaustive search. Experimentally, computations are quite fast for the wrong guesses, because the Gröbner basis computation stops immediately when 1 is found in the ideal.

Moreover, if we specialize an entire row of $c$ variables $\boldsymbol{U}$, as the equations are bilinear in $\boldsymbol{U}$ and $\boldsymbol{V}$, then we get $n_{0}-k_{0}-a_{0}$ linear equations in $\boldsymbol{V}$, which reduces the number of variables. Table 6 gives the complexity of the Gröbner basis computation for DAGS1.1, for $c=8$ variables $\boldsymbol{U}$ specialized and different values of $\dim{\mathcal{S}}_{I}\left(\mathscr{D}\right)$.

Acknowledgements

This work has been supported by the French ANR projects MANTA (ANR-15-CE39-0013) and CBCRYPT (ANR-17-CE39-0007). The authors are extremely grateful to Élise Barelli for kindly giving her Magma code and for helpful discussions.