Key Recovery Attacks on Some Rank Metric Code-Based Signatures

Abstract

Designing secure Code-based signature schemes remains an issue today. In this paper, we focus on schemes designed with the Fiat-Shamir transformations rationale (commit and challenge strategy). We propose two generic key recovery attacks on rank metric code-based signature schemes $\mathsf{Veron}$, $\mathsf{TPL}$ and $\mathsf{RQCS}$. More specifically, we exploit the weakness that a support basis or an extended support basis of the secret key could be recovered from the signatures generated in these schemes through different techniques. Furthermore, we are able to determine a support matrix or an extended support matrix for the secret key if the number of equations over the base field is greater than the number of unknown variables in the support matrix. We show that both the design of $\mathsf{TPL}$ and $\mathsf{RQCS}$ schemes contain these weaknesses, and no reparation of parameters for these schemes is possible to resist our two attacks. Moreover, we show that we can recover a support basis for the secret key used in $\mathsf{Veron}$ and that our first attack is successful due to the choice of its proposed parameters. We implement our attacks on $\mathsf{Veron}$, $\mathsf{TPL}$ and $\mathsf{RQCS}$ signature schemes and manage to recover the secret keys within seconds.

Appendices

Appendix

A Proof of Lemma 2.

Lemma 2. Let $u_1,\ldots ,u_k$ be integers such that $0<u = \sum _{i=1}^k u_i \le \frac{m}{2}$. For $1 \le i,j \le k$, let $U_i$ be a $u_i$-dimensional subspace of $\mathbb {F}_{q^m}$ and $U_i \cap U_j = \{ 0 \}$. Let $r_0 \le m-u$, $w=\sum _{i=1}^k r_i$ and $v = r_0 + w = \sum _{i=0}^k r_i$, where each $0 \le r_i \le u_i$ for $1 \le i \le k$. The number of v-dimensional subspace that intersects each $U_i$ in an $r_i$-dimensional subspace is $\left( \prod _{i=1}^k \left[ \begin{array}{c} u_i \\ r_i \end{array} \right] _q \right) \left[ \begin{array}{c} m-u \\ r_0 \end{array} \right] _q q^{r_0(u-w)}$.

Proof

We prove the statement by following the idea of the proof of [12, Lemma 3]. For each $1 \le i \le k$, there are $\left[ \begin{array}{c} u_i \\ r_i \end{array} \right] _q$ subspaces $U'_i \subseteq U_i$ of dimension $r_i$ that can be the intersection space. Now we have to complete the subspace $\bigoplus _{i=1}^k U'_i$ to a v-dimensional vector space V, intersecting each $U_i$ only in $U'_i$. We have $\sum _{j=1}^{r_0-1} (q^m-q^{u+j})$ choices for the remaining basis vectors. For a fixed basis of $\bigoplus _{i=1}^k U'_i$, the number of bases spanning the same subspace is given by the number of $v \times v$ matrices of the form $\left[ \begin{array}{cc} I_w &{} \varvec{0} \\ A &{} B \\ \end{array}\right]$ where $A \in \mathbb {F}_q^{r_0 \times w}$ and $B \in \text {GL}_{r_0} (\mathbb {F}_q)$. This number is equal to $q^{r_0 w} \left| \text {GL}_{r_0} (\mathbb {F}_q) \right| = q^{r_0 w} \prod _{j=1}^{r_0-1} (q^{r_0} - q^j)$. Hence the final count is given by

$$\begin{aligned} \left( \prod _{i=1}^k \left[ \begin{array}{c} u_i \\ r_i \end{array} \right] _q \right) \frac{\prod _{j=1}^{r_0-1} (q^m-q^{u+j})}{q^{r_0 w} \prod _{j=1}^{r_0-1} (q^{r_0} - q^j)}&= \left( \prod _{i=1}^k \left[ \begin{array}{c} u_i \\ r_i \end{array} \right] _q \right) \frac{q^{r_0 u }}{q^{r_0w}} \left( \prod _{j=1}^{r_0-1} \frac{ q^{m-u}-q^j}{q^{r_0} - q^j} \right) \\&= \left( \prod _{i=1}^k \left[ \begin{array}{c} u_i \\ r_i \end{array} \right] _q \right) \left[ \begin{array}{c} m-u \\ r_0 \end{array} \right] _q q^{r_0(u-w)}. \end{aligned}$$

   $\square$

B Proof of Proposition 1.

Proposition 1. Let $r_x,r_y$ be integers such that $r_x + r_y \le \min \{ m,n \}$ and $\varvec{x} \in \mathcal {E}_{m,n, r_x}$. Randomly pick a vector $\varvec{y} \overset{\$}{\leftarrow }\mathcal {E}_{m,n,r_y}$ and form $\varvec{z}=\varvec{x}+\varvec{y}$. Suppose that $\mathsf{Supp}(\varvec{x}) \cap \mathsf{Supp}(\varvec{y}) = \{ 0 \}$, then the probability that $\text {rk}(\varvec{z}) = r_x + r_y$ is $\left[ \begin{array}{c} n-r_x \\ r_y \end{array} \right] _q q^{r_yr_x} \left( \left[ \begin{array}{c} n \\ r_y \end{array} \right] _q \right) ^{-1}$.

Proof

By Lemma 1, we can rewrite $\varvec{x} = (\hat{x}_1,\ldots ,\hat{x}_{r_x}) A$ and $\varvec{y} = (\hat{y}_1,\ldots ,\hat{y}_{r_y}) B$ where $\text {rk}(\hat{x}_1,\ldots ,\hat{x}_{r_x}) = r_x$ and $\text {rk}(\hat{y}_1,\ldots ,\hat{y}_{r_y}) = r_y$. Then

$$\begin{aligned} \varvec{z} = (\hat{x}_1,\ldots ,\hat{x}_{r_x}) A + (\hat{y}_1,\ldots ,\hat{y}_{r_y}) B = (\hat{x}_1,\ldots ,\hat{x}_{r_x},\hat{y}_1,\ldots ,\hat{y}_{r_y}) \left[ \begin{array}{c} A \\ B \end{array} \right] . \end{aligned}$$

Since $\mathsf{Supp}(\varvec{x}) \cap \mathsf{Supp}(\varvec{y}) = \{ 0 \}$, we have $\text {rk}(\hat{x}_1,\ldots ,\hat{x}_{r_x},\hat{y}_1,\ldots ,\hat{y}_{r_y}) = r_x + r_y$. Let $W = \left[ \begin{array}{c} A \\ B \end{array} \right]$. If $\text {rk}(W) = r_x + r_y$, then $\text {rk}(\varvec{z}) = r_x + r_y$. Hence, we need to calculate the probability that $\text {rk}(W) = r_x + r_y$. Let $\mathcal {A} \subset \mathbb {F}_{q^n}$ with $\dim (\mathcal {A}) = r_x$ and $\mathcal {B} \subset \mathbb {F}_{q^n}$ with $\dim (\mathcal {B}) = r_y$, where each of them is the vector subspace generated by the row space of A and B respectively. If $\mathcal {A} \cap \mathcal {B} = \{ 0 \}$, then each row of W is linearly independent with each other, giving us $\text {rk}(W)=r_x+r_y$. By Lemma 2, the number of $\mathcal {B}$ such that $\mathcal {A} \cap \mathcal {B} = \{0 \}$ is $\left[ \begin{array}{c} n-r_x \\ r_y \end{array} \right] _q q^{r_yr_x}$. So, the probability that $\mathcal {A} \cap \mathcal {B} = \{0 \}$ is $\left[ \begin{array}{c} n-r_x \\ r_y \end{array} \right] _q q^{r_yr_x} \left( \left[ \begin{array}{c} n \\ r_y \end{array} \right] _q \right) ^{-1}$. Therefore, the probability that $\text {rk}(\varvec{z}) = r_x + r_y$ is equal to the probability that $\text {rk}(W) = r_x+r_y$, which equals to $\left[ \begin{array}{c} n-r_x \\ r_y \end{array} \right] _q q^{r_yr_x} \left( \left[ \begin{array}{c} n \\ r_y \end{array} \right] _q \right) ^{-1}$.    $\square$

C Proof of Theorem 1.

Theorem 1. Let $r_x,r_y$ be integers such that $r_x + r_y \le \min \{ m,n \}$ and $\varvec{x} \in \mathcal {E}_{m,n, r_x}$. The probability that the vector $\varvec{z}=\varvec{x}+\varvec{y}$ has rank $\text {rk}(\varvec{z}) = r_x + r_y$ for a random $\varvec{y} \overset{\$}{\leftarrow }\mathcal {E}_{m,n,r_y}$ is $\left[ \begin{array}{c} m-r_x \\ r_y \end{array} \right] _q \left[ \begin{array}{c} n-r_x \\ r_y \end{array} \right] _q q^{2r_yr_x} \left( \left[ \begin{array}{c} m \\ r_y \end{array} \right] _q \left[ \begin{array}{c} n \\ r_y \end{array} \right] _q \right) ^{-1}$.

Proof

By Lemma 2, the number of $\varvec{y}$ such that $\mathsf{Supp}(\varvec{x}) \cap \mathsf{Supp}(\varvec{x}) = \{ 0 \}$ is $\left[ \begin{array}{c} m-r_x \\ r_y \end{array} \right] _q q^{r_yr_x}$. Thus, the probability that $\mathsf{Supp}(\varvec{x}) \cap \mathsf{Supp}(\varvec{x}) = \{ 0 \}$ is $\left[ \begin{array}{c} m-r_x \\ r_y \end{array} \right] _q q^{r_yr_x} \left( \left[ \begin{array}{c} m \\ r_y \end{array} \right] _q \right) ^{-1}$. Combining this with the result from Proposition 1, the probability that $\text {rk}(\varvec{z}) = r_x + r_y$ for a random $\varvec{y} \overset{\$}{\leftarrow }\mathcal {E}_{m,n,r_y}$ is

$$ \mathsf{Pr}[\text {rk}(\varvec{z}) = r_x + r_y] = \left[ \begin{array}{c} m-r_x \\ r_y \end{array} \right] _q \left[ \begin{array}{c} n-r_x \\ r_y \end{array} \right] _q q^{2r_yr_x} \left( \left[ \begin{array}{c} m \\ r_y \end{array} \right] _q \left[ \begin{array}{c} n \\ r_y \end{array} \right] _q \right) ^{-1}. $$

   $\square$

D Proof of Proposition 2.

Proposition 2. Let $r_x,r_y$ be integers such that $r_x + r_y \le \min \{ m,n \}$, $\varvec{x} \in \mathcal {E}_{m,n, r_x}$, $\varvec{y} \in \mathcal {E}_{m,n,r_y}$ and $\varvec{z} = \varvec{x}+\varvec{y}$ with $\text {rk}(\varvec{z}) = r_x + r_y$. Then $\mathsf{Supp}(\varvec{x}) \subset \mathsf{Supp}(\varvec{z})$.

Proof

By Lemma 1, we can rewrite $\varvec{x} = (\hat{x}_1,\ldots ,\hat{x}_{r_x}) A$ and $\varvec{y} = (\hat{y}_1,\ldots ,\hat{y}_{r_y}) B$ where $\text {rk}(\hat{x}_1,\ldots ,\hat{x}_{r_x}) = r_x$ and $\text {rk}(\hat{y}_1,\ldots ,\hat{y}_{r_y}) = r_y$. Then

$$\begin{aligned} \varvec{z} = (\hat{x}_1,\ldots ,\hat{x}_{r_x}) A + (\hat{y}_1,\ldots ,\hat{y}_{r_y}) B = (\hat{x}_1,\ldots ,\hat{x}_{r_x},\hat{y}_1,\ldots ,\hat{y}_{r_y}) \left[ \begin{array}{c} A \\ B \end{array} \right] . \end{aligned}$$

(1)

Similarly, since $\text {rk}(\varvec{z}) = r_x + r_y$, we can rewrite

$$\begin{aligned} \varvec{z} = \varvec{\hat{z}}Z = (\hat{z}_1,\ldots ,\hat{z}_{r_x+r_y})Z \end{aligned}$$

(2)

where $\text {rk}(\hat{z}) = r_x + r_y$ and $\text {rk}(Z) = r_x + r_y$. Equating (1)$=$(2), we have

$$\begin{aligned} (\hat{x}_1,\ldots ,\hat{x}_{r_x},\hat{y}_1,\ldots ,\hat{y}_{r_y}) \left[ \begin{array}{c} A \\ B \end{array} \right] = (\hat{z}_1,\ldots ,\hat{z}_{r_x+r_y}) Z, \end{aligned}$$

which implies that $\langle \hat{x}_1,\ldots ,\hat{x}_{r_x},\hat{y}_1,\ldots ,\hat{y}_{r_y} \rangle = \langle \hat{z}_1,\ldots ,\hat{z}_{r_x+r_y} \rangle$ and

   $\square$

E Proof of Proposition 3.

Proposition 3. Let $\varvec{x} \in \mathcal {E}_{m,n,r}$ and $t > r$ be an integer. There exists a vector $\varvec{y} = ( y_1,\ldots ,y_t) \in \mathcal {E}_{m,t,t}$ such that $\mathsf{Supp}(\varvec{x}) \subset \mathsf{Supp}(\varvec{y})$. We call such $\mathsf{Supp}(\varvec{y})$ an extended support of $\varvec{x}$ and $\{ y_1,\ldots ,y_t \}$ an extended support basis for $\varvec{x}$. Moreover, there exists a matrix $V \in \mathbb {F}_q^{t \times n}$ of $\text {rk}(V) = r$ satisfying $\varvec{x} = (y_1,\ldots ,y_t)V$. We call such V an extended support matrix for $\varvec{x}$.

Proof

Since $\varvec{x} \in \mathcal {E}_{m,n,r}$, by Lemma 1, there exists a vector $\varvec{\hat{x}} = (\hat{x}_1,\ldots ,\hat{x}_r) \in \mathcal {E}_{m,r,r}$ and a matrix $U \in \mathbb {F}_q^{r \times n}$ with $\text {rk}(U) = r$ such that $\varvec{x} = \varvec{\hat{x}}U$. Let $r' = t-r$, randomly pick $r'$ independent elements $w_1,\ldots ,w_{r'} \in \mathbb {F}_{q^m} \setminus \mathsf{Supp}(\varvec{x})$, such that $\text {rk}(\hat{x}_1,\ldots ,\hat{x}_r,w_1,\ldots ,w_{r'}) = t$. Then we can rewrite the vector $\varvec{x} = \varvec{\hat{x}} U = (\hat{x}_1,\ldots ,\hat{x}_r,w_1,\ldots ,w_{r'}) \left[ \begin{array}{c} U \\ \varvec{0}_{r' \times n} \end{array} \right]$. Finally, let $P \in \text {GL}_t (\mathbb {F}_q)$ and $\varvec{\hat{y}}=(\hat{x}_1,\ldots ,\hat{x}_r,w_1,\ldots ,w_{r'})$. Then there exists a vector $\varvec{y} = \varvec{\hat{y}}P$ and a matrix $V=P^{-1} \left[ \begin{array}{c} U \\ \varvec{0}_{r' \times n} \end{array} \right]$ of $\text {rk}(V) = r$ such that $\varvec{x} = \varvec{y}V$.    $\square$

F Rank Support Recovery Algorithm

Let $f=(f_1,\ldots ,f_d) \in \mathcal {E}_{m,d,d}$, $e=(e_1,\ldots ,e_r) \in \mathcal {E}_{m,r,r}$ and $\varvec{s}=(s_1,\ldots ,s_n) \in \mathbb {F}_{q^m}^n$ such that $S:=\langle s_1,\ldots ,s_n \rangle = \langle f_1 e_1,\ldots ,f_d e_r \rangle$. Given $\varvec{f}$, $\varvec{s}$ and r as input, the Rank Support Recover Algorithm will output a vector space E which satisfies $E = \langle e_1,\ldots ,e_r \rangle$. Denote $S_i := f_i^{-1}.S$ and $S_{ i,j} := S_i \cap S_j$.