Enhanced Public Key Security for the McEliece Cryptosystem

TL;DR: This paper studies a variant of the McEliece cryptosystem able to ensure that the code used as the public key is no longer permutation equivalent to the secret code, thus opening the way for reconsidering the adoption of classical families of codes, like Reed–Solomon codes, that have been longly excluded from the Mceliece Cryptosystem for security reasons.

Abstract: This paper studies a variant of the McEliece cryptosystem able to ensure that the code used as the public key is no longer permutation equivalent to the secret code. This increases the security level of the public key, thus opening the way for reconsidering the adoption of classical families of codes, like Reed---Solomon codes, that have been longly excluded from the McEliece cryptosystem for security reasons. It is well known that codes of these classes are able to yield a reduction in the key size or, equivalently, an increased level of security against information set decoding; so, these are the main advantages of the proposed solution. We also describe possible vulnerabilities and attacks related to the considered system and show what design choices are best suited to avoid them.

Summary

Introduction

• A pressure ulcer (PU) is a chronic nonhealing wound that is caused by the continuous pressure of the body weight on the skin.
• The authors study revealed significant shifts in epidermal cellular composition and gene expression patterns in PU wound edges compared to AW and uninjured skin.
• The authors identified IFNγ in PU wound fluid as a major inducer of MHCII expression in keratinocytes.

Results

• Characterization of epidermal cell composition of human skin and wounds.
• Comparing AW and 8 skin keratinocytes, the authors observed increased frequencies of spinous (KC_1) and granular (KC_3) keratinocytes during wound repair.
• GO analysis revealed that genes involved in neutrophil-mediated immunity [e.g., FABP5 (28), S100A7, S100A8, and S100A9 (29)] were strongly upregulated in PU keratinocytes compared to keratinocytes from AW or uninjured skin.
• Furthermore, the authors showed that the cell-free wound fluid from PU_G1 patients, but not PU_G2 patients, significantly induced keratinocyte expression of CD74 and HLA-DRB (Figure 6D, E, and Figure S8A).
• In line with this, the authors found that MHCII+ keratinocytes were close to T cells in PU wound edges by confocal imaging (Figure 6I).

Discussion

• PU is one of the most frequent causes of death in elderly and wheelchair- or bed-bound individuals (4).
• This cellular composition shift was also reflected in the gene expression profile of PU keratinocytes, revealing their intense inflammatory response.
• In mouse skin, MHCII+ keratinocytes were shown to control homeostatic type one 16 responses to the microbiota (46).
• In rodent models, IFNγ has also been found to inhibit angiogenesis and collagen deposition, thus hampering wound repair (52, 53).

Human wound samples.

• The authors enrolled 25 healthy donors and 18 PU patients at the Karolinska University Hospital (Stockholm, Sweden) (Table S1).
• All the clinical materials were taken after the patients’ consent, and the study was approved by the Stockholm Regional Ethics Committee and conducted according to the Declaration of Helsinki’s principles.
• The local carbocain-adrenalin injection was used for anesthesia while sampling.
• Wound-edge samples and nearby intact skin were collected from patients with grade IV PU (according to the EPUAP classification system) during reconstructive surgery (16).
• The gauzes were soaked in 10 mL phosphate-buffered saline (PBS) and centrifuged for 5 minutes at 10000 rpm.

Single-cell isolation and sequencing.

• Skin and wound samples were incubated in Dulbecco’s Modified Eagle Medium (DMEM) containing 5U/ml Dispase II and 1% Penicillin-Streptomycin (ThermoFisher Scientific) at 4 ℃ overnight.
• After confirming the good quality of total RNA by Nanodrop, 1ng of total RNA per sample was used for library preparation.
• The cDNA libraries were purified by carboxylated magnetic beads, then their quality and quantity were confirmed by using the Agilent 2100 Bioanalyzer.
• Cell types were identified according to canonical and novel markers revealed by differential expression analysis.

Cell-cycle signature in keratinocytes.

• To evaluate keratinocytes' proliferation status, the authors calculated the cell cycle scores of the G1/S and G2/M phases for each cell, as previously described (62).
• This score was defined as the average log2-transformed relative expression of the highly correlated cell-cycle genes (Spearman correlation coefficient > 0.4).
• Using DESeq2 (version 1.22.2 with default parameters), the authors identified the DEGs with an adjusted p-value < 0.05, fold change 2 and expressed in more than 50% cells within each group.
• The group 1 and group 2 PUs were compared with the skin or AW separately, and the DEGs showing up in both comparisons were considered the common DEGs in PUs.
• The differential expression analysis was performed for the keratinocytes from the group 1 and group 2 PUs using the R package “DESeq2” (version 1.22.2) as described above.

Statistics.

• All data were expressed as mean ±s.d. or mean ±s.e.m. and plotted using GraphPad Prism v6.
• Statistical significance was determined by a two-tailed Student’s t-test or Mann-Whitney U Test.
• The correlation between the expressions of different genes in the same sample set was made using Spearman’s correlation test on log-transformed data.
• For all statistical tests, P values < 0.05 were considered to be statistically significant.
• P values and analysis methods are also described in each figure legend.

Data and software availability.

• The raw data and the processed matrices of raw count and RPKM of scRNA-seq analysis have been deposited in the National Center for Biotechnology Information Gene Expression Omnibus (GEO) database (accession no.
• Supplemental Experimental Procedures.
• Table S1.
• Antibodies, primers, Table S2. 25.

ACKNOWLEDGMENTS

• The authors express their gratitude to all the patients and healthy donors who took part in this study.
• The authors thank Dr. Maria Kasper (Karolinska Institutet) and Dr. Stanley Sing Hoi Cheuk (Göteborgs University) for discussion and advice.
• The authors thank Dr. Zhuang Liu, Borislav Ignatov (Karolinska Institutet), Hua Zhang, and Dr. Yonglong Dang (Uppsala University) for technical support.
• The authors thank Madeleine Stenius (Rehab Station Stockholm Academy) for clinical sample collection.
• This work was supported by Swedish Research Council (Vetenskapsradet, 2016-02051 and 2018-02557), Ragnar Söderbergs Foundation (M31/15), Hedlunds Foundation, Welander and Finsens Foundation , Åke Wibergs Foundation, Jeanssons Foundation, Swedish Psoriasis Foundation, Ming Wai Lau Centre for Reparative Medicine, Tore Nilson's Foundation, Lars Hiertas Foundation, and Karolinska Institutet.

Figure Legend

• Figure 1. Characterization of epidermal cell composition of human skin and wounds.
• G, Proportion of proliferating cells (cells in the quadrants I, II, IV of the cell cycle signature plot) in each keratinocyte cluster.
• 35 I, Comparison of gene expression between KC_2 and KC_4: the abundance of a few selected genes are shown in all the keratinocytes analyzed by scRNA-seq.
• H, Spearman’s correlation analysis between IFNG and CD74 expression detected by qRT-PCR in the above samples.

Figures

Table 5: Comparison between the binary Goppa code-based Niederreiter cryptosystem, RSA and the proposed GRS code-based cryptosystem for 128-bit security.

Figure 1: The original McEliece cryptosystem.

Table 4: Work factor (log2) of ISD attacks estimated as in [40] for GRS codes with n = 346, defined over F347, and m = 1 + r−3 n , z = 1, 2, 3, 4.

Table 3: Work factor (log2) of ISD attacks estimated as in [40] for GRS codes with n = 546, defined over F547, and m = 1 + r−3 n , z = 1, 2, 3, 4.

Table 1: Work factor (log2) of ISD attacks on GRS codes with n = 546, defined over several finite fields, for m = 1 + r−3n and z = 1.

Table 2: Work factor (log2) of ISD attacks on GRS codes with n = 346, defined over several finite fields, for m = 1 + r−3n and z = 1.

Full text

ZurichOpenRepositoryand
Archive
UniversityofZurich
UniversityLibrary
Strickhofstrasse39
CH-8057Zurich
www.zora.uzh.ch
Year:2016
EnhancedpublickeysecurityfortheMcEliececryptosystem
Baldi,Marco;Bianchi,Marco;Chiaraluce,Franco;Rosenthal,Joachim;Schipani,Davide
Abstract: ThispaperstudiesavariantoftheMcEliececryptosystemabletoensurethatthecodeused
asthepublickeyisnolongerpermutationequivalenttothesecretcode.Thisincreasesthesecuritylevel
ofthepublickey,thusopeningthewayforreconsideringtheadoptionofclassicalfamiliesofcodes,like
Reed–Solomoncodes,thathavebeenlonglyexcludedfromtheMcEliececryptosystemforsecurityreasons.
Itiswellknownthatcodesoftheseclassesareabletoyieldareductioninthekeysizeor,equivalently,
anincreasedlevelofsecurityagainstinformationsetdecoding;so,thesearethemainadvantagesofthe
proposedsolution.Wealsodescribepossiblevulnerabilitiesandattacksrelatedtotheconsideredsystem
andshowwhatdesignchoicesarebestsuitedtoavoidthem.
DOI:https://doi.org/10.1007/s00145-014-9187-8
PostedattheZurichOpenRepositoryandArchive,UniversityofZurich
ZORAURL:https://doi.org/10.5167/uzh-128304
JournalArticle
AcceptedVersion
Originallypublishedat:
Baldi,Marco;Bianchi,Marco;Chiaraluce,Franco;Rosenthal,Joachim;Schipani,Davide(2016).En-
hancedpublickeysecurityfortheMcEliececryptosystem.JournalofCryptology,29(1):1-27.
DOI:https://doi.org/10.1007/s00145-014-9187-8

Enhanced public key security for
the McEliece cryptosystem
Marco Baldi
1
, Marco Bianchi
1
, Franco Chiaraluce
1
,
Joachim Rosenthal
2
, and Davide Schipani
2
1
Universit`a Politecnica delle Marche, Ancona, Italy,
{m.baldi,m.bianchi,f.chiaraluce}@univpm.it
2
University of Zurich, Zurich, Switzerl and,
{rosenthal,davide.schipani}@math.uzh.ch
Abstract
This paper studies a variant of the McEliece cryptosystem able to
ensure that the code used as the public key is no longer permutation-
equivalent to the secret code. This increases the security level of the
public key, thus opening the way for reconsidering the adoption of clas-
sical families of codes, like Reed-Solomon codes, that have been longly
excluded from the McEliece cryptosystem for security reasons. It is well
known that codes of these classes are able to yield a reduction in the key
size or, equivalently, an increased level of security against information set
decoding; so, these are the main advantages of the proposed solution. We
also describe possible vulnerabilities and attacks related to the considered
system, and show what design choices are best suited to avoid them.
Keywords: McEliece cryptosystem, Niederreiter cryptosystem, e r r or correct-
ing codes, Reed-Solomon codes, public key security.
1 Introduction
The McEliece cryptosystem [31] is one of the most promising public-key cryp-
tosystems able to resist attacks based on quantum computers. In fact, differently
from cryptosystems exploiting integer factorization or discrete logarithms, it re -
lies on the hardness of decoding a linear block code without any visible structure
[9].
The material in this paper was presented in part at the Seventh International Workshop
on Coding and Cryptography (WCC 2011), Paris, France, April 2011. The Research was
supported in part by the Swiss National Science Foundation under grants No. 132256, 149716,
and in part by the MIUR project “ESCAPADE” (grant RBFR105NLC) under the “FIRB -
Futuro in Ricerca 2010” funding program.
1

The original McEliece cryptosy st em adopts the generator matr ix of a binary
Goppa code as the private key, and exploits a dens e transformation matrix and a
permutation matrix to disguise the secret key into the publi c one. It has resisted
cryptanalysis for more than thirty years, since no polynomial-time attack to the
system has been devised up to now; however, the increased compu ti ng power
and the availability of optimized attack pr ocedures have required to update its
original parameters [11].
The main advantage of the McEliece cr y pt osy st em consists in its fast en cr y p -
tion and decry pt ion procedures, which require a significantly lower number of
operations with respect to alternative solutions (like RSA). However, the ori g-
inal McEli ec e cryptosys te m has two main disadvantages: low e nc r yp ti on rate
and large key size, both due to the binary Goppa codes it is based on. When
adopting Goppa codes, a first improvement is obtained through the variant pro-
posed by Niederreiter [35], which uses parity-check matrices instead of generator
matrices. A further reduction in the pu bl ic key size can be obtained by replacing
binary Goppa codes with non-binary Goppa codes, and paying attention that
polynomial enumeration is prevented [13].
A significant improvement would be obtained if other families of codes could
be included in the system, allowing a more efficie nt code design and a more
compact repre se ntation of their matrices. In particular, the use of G en e r al-
ized Reed-Solomon (GRS) codes could yield significant advantages. In fact,
GRS codes are maximum distance separable codes, which ensures th ey achieve
maximum error correction capability under bounded-distance decoding. In the
McEliece system, this translates into shorte r keys for the same security level, or
a higher security level for the same key s iz e, with respect to binary Goppa codes
(having the same code rate). In fact, Goppa codes are subfield subcodes of GRS
codes and the subcoding procedure makes them less efficient than GRS c odes.
However, this also makes them secure against key recovering attacks, while
the algebraic structure of GR S codes, when exposed in the public key (also in
permuted form), makes them insecure against attacks aimed at recovering the
secret code, like the Sidelnikov-Shestakov attack [ 46 ].
Many attempts of replacing Goppa codes with other families of codes have
exposed the system to security threats [38], [48], and some recent proposals
based on Quasi-Cyclic and Quasi -D yadic codes have also been broken [47]. Low-
Density Parity-Check (LDPC) codes, in pr in cip le , could offer high design flexi-
bility and compact keys. However, also the use of LDPC codes may expose the
system to severe flaws [34, 5, 6, 36]. Nevertheless, it is still possible to exploit
Quasi-Cyclic LD PC codes to des ign a variant of the system that is immune to
any known attack [4, 2, 1, 3].
The idea in [4] is to replace the permutation matrix used in the original
McEliece cryptosystem with a denser transformation matrix. The transforma-
tion matrix used i n [4] is a sparse matrix and its de ns i ty must be chosen as a
trade-off between two opposite effects [1]: i) increasing the density of th e public
code parity-check matrix, so that it is too difficult, for an opponent, to search
for low weight codewords in its dual code and ii) limitin g the propagation of the
intentional errors, so that they are still correctable by the legitimate receiver.
2

The advantage of replacing the permutation with a more general transformation
is that the code used as the public key is no longer permutation equivalent to
the secret code. This increases th e security of the public key, as it prevents
an attacker from exploiting the permutation equivalence when trying to recover
the secret code structure.
We elaborate on this approach by introdu cin g a more effective class of trans-
formation matrices and by generalizing th eir form also to the non-binary case.
The new proposal is based on the fact that there exist some classes of dense
transformation matrices that have a limited propagation effect on the inten-
tional error vectors. The use of these matrices allows to better disguise the
private key into the p ub lic one, with a controlled error propagation effect. So,
we propose a modified cryptosystem that can restore the use of advantageous
families of codes, like GRS codes, by ensuring increased public key security.
The rest of the p aper is organized as follows. In Section 2, we describe the
proposed s ys te m, both in th e Mc Eli ec e and Nie de r r e ite r versions. Des ign iss u es
are discussed in Section 3. In Section 4, a compar is on with other variants of the
classic McEliece cryptosystem is developed. In Section 5, two kinds of attacks
are considered, namely the information set decoding attack and the attack based
on a particular kind of di s tin guis h er able to tell the p ub li c matrices from random
ones. We will show that both these attacks can be avoided, by choos ing proper
values of the parameters. In Section 6, key size and complexity are computed,
and then compared with other solutions. Finally, in Se ct ion 7, some conclusions
are drawn.
2 Description of the cryptosystem
The proposed cr yp tos ys te m takes as its basis the classi cal McEliece cryptosys-
tem, whose block scheme is reported in Fig. 1, where u denotes a cleartext
message and x its associated cipherte xt . The main components of this system
are:
• A private linear block code generator matrix G
• A public linear block code generator matrix G
′
• A secret scrambling matrix S
• A secret permutation matrix P
• A secret intentional err or vector e
In the figure, Y
−1
denotes the inverse of matrix Y.
As for the original system, the proposed cryptosystem can be implemented
in the classical McEliece form or, alt er n atively, in the Niederreiter version. In
both cases, the main element that differentiates the proposed solution from the
original cryptosystem is the replacement of the permutation matrix P with a
dense transformation matrix Q, whose design is described next.
3

Alice
e
Bob
unsecure
channel
Goppa
encoder
intentional
errors
permutation
G
' =
S
-1
G P
-1
public key
G
'
P S
G
descramblingGoppa
decoder
u x x u
private key
Figure 1: The original McEliece cryptosystem.
2.1 Matrix Q
The matrix Q is a non-singular n × n matrix having the form
Q = R + T, (1)
where R is a dense n × n matrix and T is a sparse n × n matrix. The matrices
R, T and Q have elements in F
q
, with q ≥ 2.
The matrix R is obtained starting from two sets, A and B, each containing
w matrices having size z × n, z ≤ n, defined over F
q
: A = {a
1
, a
2
, . . . , a
w
},
B = {b
1
, b
2
, . . . , b
w
}. We also define a =
P
w
i=1
a
i
. The matrices in A and B
are secret and randomly chosen; then, R is obtained as:
R =





a
1
a
2
.
.
.
a
w





T
·





b
1
b
2
.
.
.
b
w





, (2)
where
T
denotes transposition. Starting from (2), we make some simplifying
assumptions, aimed at reducing the amount of secret data th at is needed to be
stored. In fact, for the instances of the pr oposed cryptosystem, we will focus
on two distin ct cases, both with w = 2: i) a
1
= a, a
2
= 0 and ii) b
2
= 1 + b
1
,
where 0 and 1 represent, respectively, the all-zero and the all-one z ×n matrices.
In both these cases, the matrix R has rank z and there is no need to store nor
choose the matrix b
2
. For this reason, in order to simplify the notation, we
will replace b
1
with b in the following. This obviously does not prevent th e
applicability of the general form (2) of the matrix R.
Concerning the matrix T, it is obtained in the form of an n × n n on-s in gul ar
sparse matrix having elements in F
q
and average row and column weight equal
to m ≪ n, where m is not necessarily an integer value. We provide more details
on its design in Section 2.4.
4

Frequently asked questions

Q1. What are the contributions in "Enhanced public key security for the mceliece cryptosystem" ?

This paper studies a variant of the McEliece cryptosystem able to ensure that the code used as the public key is no longer permutation equivalent to the secret code. The authors also describe possible vulnerabilities and attacks related to the considered system and show what design choices are best suited to avoid them. 

Q2. What is the idea of replacing the permutation matrix used in the original McEliece?

The idea in [4] is to replace the permutation matrix used in the original McEliece cryptosystem with a denser transformation matrix. 

Q3. What other proposals have been made for increasing key security?

Other proposals for increasing key security have been made in the past, such as using a distortion matrix together with rank codes in the GPT cryptosystem [23] and exploiting the properties of subcodes in variants of the McEliece and the GPT cryptosystems [8]. 

Q4. What is the reason why an attacker could try to sum two rows of H′?

Note that an attacker could try to sum two rows of H′, hoping that one of them corresponds to a copy of the vector a1 in R and the other to a copy of the vector a2, so that the sum of the two rows might still contain the vector a. 

Q5. What is the purpose of the proposed cryptosystem?

A first concern about the proposed cryptosystem is to verify that it is actually able to provide increased key security, with respect to previous variants of the McEliece cryptosystem, in such a way as to allow the use of widespread families of codes (like GRS codes) without incurring in the attacks that have prevented their use up to now. 

Q6. What is the reason why the distinguisher is ineffective against the system the authors propose?

this distinguisher is ineffective against the system the authors propose, since:• it is not able to distinguish the public key matrix of the proposed cryptosystem from a randomly generated one, that is, their keys are resistant to this distinguisher since they are not generator matrices of alternant or GRS codes (this is due to the fact that Q is not a permutation matrix);• it does not allow to mount a DAP: the distinguisher cannot work on subspaces of the code, so it is unable to recover the subspace the attacker needs. 

Q7. How many rows and columns could have weight equal to 2?

As an example, if m = 1.4, 40% of the rows and columns in T could have weight equal to 2, while the remaining 60% of the rows and columns could have weight equal to 1. 

Q8. How can the authors estimate the complexity of the main steps of GRS syndrome decoding?

The complexityof the main steps of GRS syndrome decoding can be estimated [15] in: i) 4t(2t+ 2)M + 2t(2t+ 1)S binary operations for the the key equation solver, ii) n(t− 1)M+ntS binary operations for the Chien search, and iii) (2t2+t)M+t(2t−1)S binary operations for Forney’s formula. 

Q9. How many work factor reductions are there for the binary field?

Based on these considerations, the authors assume that, if a generalization of the algorithm in [7] to non-binary fields were found, it would result in a work factor reduction in the order of 29 or less with respect to the algorithm in [40], for the parameters the authors consider. 

Q10. What is the effect of the matrix Q on the intentional error vector e?

As the authors will see in the following, for both the McEliece and Niederreiter versions of the cryptosystem it turns out that, during decryption, the matrix Q has a multiplicative effect on the intentional error vector e. 

Q11. What is the reason why Stern’s algorithm is generalized to work over larger fields?

In [40], the algorithm is generalized to work over larger fields, and it is shown that the speedups introduced in [11] are mostly efficient on very small fields. 

Q12. What makes GRS codes secure against key recovering attacks?

this also makes them secure against key recovering attacks, while the algebraic structure of GRS codes, when exposed in the public key (also in permuted form), makes them insecure against attacks aimed at recovering the secret code, like the Sidelnikov-Shestakov attack [46]. 

Q13. What is the main element that differentiates the proposed system from the original?

In both cases, the main element that differentiates the proposed solution from the original cryptosystem is the replacement of the permutation matrix P with a dense transformation matrix Q, whose design is described next. 

Q14. What is the general attack procedure against the proposed cryptosystem?

The most general attack procedures against code-based cryptosystems, hence against their proposed solution, are those techniques that attempt information set decoding (ISD) on the public code; so the authors estimate the security level of the proposed cryptosystem against this kind of attacks. 

Q15. What is the way to find k independent columns in the public generator matrix?

One of the biggest improvements presented in [11] is a smart way to find k independent columns in the public generator matrix at each iteration without performing Gaussian reduction on all such columns.