On the design and security of Lee metric McEliece cryptosystems
Terry Shue Chien Lau,Chik How Tan
DOI: https://doi.org/10.1007/s10623-021-01002-2
2022-01-18
Abstract:Recently, Horlemann-Trautmann and Weger (Adv Math Commun, https://doi.org/10.3934/amc.2020089, 2020) proposed a general framework for a Quaternary McEliece cryptosystem over the ring Z4$${\mathbb {Z}}_4$$, and generalized the construction over the ring Zpm$${\mathbb {Z}}_{p^m}$$ where p is a prime integer. By considering the Lee metric, the public key size for the McEliece cryptosystems can be substantially smaller than their counterparts in the Hamming metric. Furthermore, the hardness of the McEliece cryptosystems over Zpm$${\mathbb {Z}}_{p^m}$$ is based on the Lee Syndrome Decoding problem, which was shown to be NP-complete. This paper aims to analyze the design and security of the Lee metric McEliece cryptosystem over Zpm$${\mathbb {Z}}_{p^m}$$ in the Lee metric. We derive some necessary conditions for the quaternary codes used in the Lee metric McEliece cryptosystem, and show that the theoretical quaternary codes proposed in (Adv Math Commun, https://doi.org/10.3934/amc.2020089, 2020) do not exist. Furthermore, we propose a plaintext recovery attack on the Lee metric McEliece cryptosystem over Zpm$${\mathbb {Z}}_{p^m}$$, when the minimum Lee distance of the underlying codes with certain structures is greater than twice the Lee weight of the error. Our plaintext recovery attack is applicable to the cryptosystems over Zpm$${\mathbb {Z}}_{p^m}$$ when m>1$$m>1$$. We apply our plaintext recovery attack on the Quaternary McEliece cryptosystem, and manage to recover partial plaintext of length k1$$k_1$$ within O2min{k1,0.0473n}$$O \left( 2^{\min \{ k_1, 0.0473 n\}} \right) $$ operations, where n is the length of ciphertext. Hence, the proposed theoretical parameters for the Quaternary McEliece over Z4$${\mathbb {Z}}_4$$ in (Adv Math Commun, https://doi.org/10.3934/amc.2020089, 2020) do not achieve 128-bit security, as we can recover the partial plaintext within 0.591 s. This also implies that the use of quaternary codes in the McEliece cryptosystem may not reduce the public key size significantly. Furthermore, for some parameters of the Lee metric McEliece cryptosystems over Z4$${\mathbb {Z}}_4$$, our plaintext recovery attack can be more efficient than the Lee-Brickell’s and Stern’s Information Set Decoding Algorithm over Z4$${\mathbb {Z}}_4$$.