Abstract:Code-based public-key cryptosystems are promising candidates for standardization as quantum-resistant public-key cryptographic algorithms. Their security is based on the hardness of the syndrome decoding problem. Computing the syndrome in a finite field, usually F2documentclass[12pt]{minimal}usepackage{amsmath}usepackage{wasysym}usepackage{amsfonts}usepackage{amssymb}usepackage{amsbsy}usepackage{mathrsfs}usepackage{upgreek}setlength{oddsidemargin}{-69pt}egin{document}$$mathbb {F}_{2}$$end{document}, guarantees the security of the constructions. We show in this article that the problem becomes considerably easier to solve if the syndrome is computed in Ndocumentclass[12pt]{minimal}usepackage{amsmath}usepackage{wasysym}usepackage{amsfonts}usepackage{amssymb}usepackage{amsbsy}usepackage{mathrsfs}usepackage{upgreek}setlength{oddsidemargin}{-69pt}egin{document}$$mathbb {N}$$end{document} instead. By means of laser fault injection, we illustrate how to compute the matrix-vector product in Ndocumentclass[12pt]{minimal}usepackage{amsmath}usepackage{wasysym}usepackage{amsfonts}usepackage{amssymb}usepackage{amsbsy}usepackage{mathrsfs}usepackage{upgreek}setlength{oddsidemargin}{-69pt}egin{document}$$mathbb {N}$$end{document} by corrupting specific instructions, and validate it experimentally. To solve the syndrome decoding problem in Ndocumentclass[12pt]{minimal}usepackage{amsmath}usepackage{wasysym}usepackage{amsfonts}usepackage{amssymb}usepackage{amsbsy}usepackage{mathrsfs}usepackage{upgreek}setlength{oddsidemargin}{-69pt}egin{document}$$mathbb {N}$$end{document}, we propose a reduction to an integer linear programming problem. We leverage the computational efficiency of linear programming solvers to obtain real-time message recovery attacks against the code-based proposal to the NIST Post-Quantum Cryptography standardization challenge. We perform our attacks in the worst-case scenario, i.e. considering random binary codes, and retrieve the initial message within minutes on a desktop computer.Our attack targets the reference implementation of the Niederreiter cryptosystem in the NIST PQC competition finalist Classic McEliece and is practically feasible for all proposed parameters sets of this submission. For example, for the 256-bit security parameters sets, we successfully recover the message in a couple of seconds on a desktop computer Finally, we highlight the fact that the attack is still possible if only a fraction of the syndrome entries are faulty. This makes the attack feasible even though the fault injection does not have perfect repeatability and reduces the computational complexity of the attack, making it even more practical overall.

Smaller Keys for the McEliece Cryptosystem: A Convolutional Variant with GRS Codes

A new McEliece-type cryptosystem using Gabidulin-Kronecker product codes

A new approach based on quadratic forms to attack the McEliece cryptosystem

Secure and Compact: A New Variant of McEliece Cryptosystem

Revisiting Scalable Modular Multiplication over GF(2/sup M/) for Elliptic Curve Cryptography

Cryptanalysis of Two McEliece Cryptosystems Based on Quasi-Cyclic Codes

An Improved McEliece Cryptosystem Based on QC-MDPC Code with Compact Key Size

LDPC codes in the McEliece cryptosystem: attacks and countermeasures

Reducing the Key Size of McEliece Cryptosystem from Automorphism-induced Goppa Codes via Permutations.

On Decoding Schemes for the MDPC-McEliece Cryptosystem

A McEliece cryptosystem using permutation codes

MinRank Gabidulin encryption scheme on matrix codes

Distinguisher-Based Attacks on Public-Key Cryptosystems Using Reed-Solomon Codes

Mckeycutter: A High-throughput Key Generator of Classic McEliece on Hardware

Improving The Security Of The Mceliece Public-Key Cryptosystem

Two modifications for Loidreau's code-based cryptosystem

McNie: A code-based public-key cryptosystem

Compact GF(2) Systemizer and Optimized Constant-Time Hardware Sorters for Key Generation in Classic McEliece.

Message-Recovery Laser Fault Injection Attack on the Classic McEliece Cryptosystem

Quantum-safe Encryption: A New Method to Reduce Complexity and/or Improve Security Level

Highly Efficient Parallel Row-Layered Min-Sum MDPC Decoder for McEliece Cryptosystem