Searcharxiv⌕ Search

arXiv subjects

Alain Couvreur

Publications and source records attributed to Alain Couvreur.

At least 37 records · Page 2Linked to original sources
arXiv2022

Right-hand side decoding of Gabidulin code and applications

We discuss the decoding of Gabidulin and interleaved Gabidulin codes. We give the full presentation of a decoding algorithm for Gabidulin codes, which as Loidreau's seminal algorithm consists in localizing errors in the spirit of Berlekamp-Welch algorithm for Reed-Solomon codes. On the other hand, this algorithm consists in acting on codewords on the right while Loidreau's algorithm considers an action on the left. This right-hand side decoder was already introduced by the authors in a previous work for cryptanalytic applications. We give here a generalised version which applies to the case of non-full length Gabidulin codes. Finally, we show that this algorithm turns out to provide a very clear and natural approach for the decoding of interleaved Gabidulin codes.

cs.IT↗
arXiv2022

On Codes and Learning With Errors over Function Fields

It is a long standing open problem to find search to decision reductions for structured versions of the decoding problem of linear codes. Such results in the lattice-based setting have been carried out using number fields: Polynomial-LWE, Ring-LWE, Module-LWE and so on. We propose a function field version of the LWE problem. This new framework leads to another point of view on structured codes, e.g. quasi-cyclic codes, strengthening the connection between lattice-based and code-based cryptography. In particular, we obtain the first search to decision reduction for structured codes. Following the historical constructions in lattice-based cryptography, we instantiate our construction with function fields analogues of cyclotomic fields, namely Carlitz extensions, leading to search to decision reductions on various versions of Ring-LPN, which have applications to secure multi party computation and to an authentication protocol.

cs.CR↗
arXiv2021

Decoding supercodes of Gabidulin codes and applications to cryptanalysis

This article discusses the decoding of Gabidulin codes and shows how to extend the usual decoder to any supercode of a Gabidulin code at the cost of a significant decrease of the decoding radius. Using this decoder, we provide polynomial time attacks on the rank-metric encryption schemes RAMESSES and LIGA.

cs.CR↗
arXiv2021

On the security of subspace subcodes of Reed-Solomon codes for public key encryption

This article discusses the security of McEliece-like encryption schemes using subspace subcodes of Reed-Solomon codes, i.e. subcodes of Reed-Solomon codes over $\mathbb{F}_{q^m}$ whose entries lie in a fixed collection of $\mathbb{F}_q$-subspaces of $\mathbb{F}_{q^m}$. These codes appear to be a natural generalisation of Goppa and alternant codes and provide a broader flexibility in designing code based encryption schemes. For the security analysis, we introduce a new operation on codes called the twisted product which yields a polynomial time distinguisher on such subspace subcodes as soon as the chosen $\mathbb{F}_q$-subspaces have dimension larger than $m/2$. From this distinguisher, we build an efficient attack which in particular breaks some parameters of a recent proposal due to Khathuria, Rosenthal and Weger.

cs.CR↗
arXiv2021

On the hardness of code equivalence problems in rank metric

In the recent years, the notion of rank metric in the context of coding theory has known many interesting developments in terms of applications such as space time coding, network coding or public key cryptography. These applications raised the interest of the community for theoretical properties of this type of codes, such as the hardness of decoding in rank metric. Among classical problems associated to codes for a given metric, the notion of code equivalence (to decide if two codes are isometric) has always been of the greatest interest, for its cryptographic applications or its deep connexions to the graph isomorphism problem. In this article, we discuss the hardness of the code equivalence problem in rank metric for $\mathbb{F}_{q^m}$-linear and general rank metric codes. In the $\mathbb{F}_{q^m}$-linear case, we reduce the underlying problem to another one called {\em Matrix Codes Right Equivalence Problem}. We prove the latter problem to be either in $\mathcal{P}$ or in $\mathcal{ZPP}$ depending of the ground field size. This is obtained by designing an algorithm whose principal routines are linear algebra and factoring polynomials over finite fields. It turns out that the most difficult instances involve codes with non trivial {\em stabilizer algebras}. The resolution of the latter case will involve tools related to finite dimensional algebras and Wedderburn--Artin theory. It is interesting to note that 30 years ago, an important trend in theoretical computer science consisted to design algorithms making effective major results of this theory. These algorithmic results turn out to be particularly useful in the present article. Finally, for general matrix codes, we prove that the equivalence problem (both left and right) is at least as hard as the well--studied {\em Monomial Equivalence Problem} for codes endowed with the Hamming metric.

cs.IT↗
arXiv2020

Algebraic geometry codes and some applications

This article surveys the development of the theory of algebraic geometry codes since their discovery in the late 70's. We summarize the major results on various problems such as: asymptotic parameters, improved estimates on the minimum distance, and decoding algorithms. In addition, we present various modern applications of these codes such as public-key cryptography, algebraic complexity theory, multiparty computation or distributed storage.

cs.IT↗
arXiv2020

Power Error Locating Pairs

We present a new decoding algorithm based on error locating pairs and correcting an amount of errors exceeding half the minimum distance. When applied to Reed--Solomon or algebraic geometry codes, the algorithm is a reformulation of the so--called {\em power decoding} algorithm. Asymptotically, it corrects errors up to Sudan's radius. In addition, this new framework applies to any code benefiting from an error locating pair. Similarly to Pellikaan's and Kötter's approach for unique algebraic decoding, our algorithm provides a unified point of view for decoding codes with an algebraic structure beyond the half minimum distance. It permits to get an abstract description of decoding using only codes and linear algebra and without involving the arithmetic of polynomial and rational function algebras used for the definition of the codes themselves. Such algorithms can be valuable for instance for cryptanalysis to construct a decoding algorithm of a code without having access to the hidden algebraic structure of the code.

cs.IT↗
arXiv2020

Rank-metric codes over arbitrary Galois extensions and rank analogues of Reed-Muller codes

This paper extends the study of rank-metric codes in extension fields $\mathbb{L}$ equipped with an arbitrary Galois group $G = \mathrm{Gal}(\mathbb{L}/\mathbb{K})$. We propose a framework for studying these codes as subspaces of the group algebra $\mathbb{L}[G]$, and we relate this point of view with usual notions of rank-metric codes in $\mathbb{L}^N$ or in $\mathbb{K}^{N\times N}$, where $N = [\mathbb{L} : \mathbb{K}]$. We then adapt the notion of error-correcting pairs to this context, in order to provide a non-trivial decoding algorithm for these codes. We then focus on the case where $G$ is abelian, which leads us to see codewords as elements of a multivariate skew polynomial ring. We prove that we can bound the dimension of the vector space of zeroes of these polynomials, depending of their degree. This result can be seen as an analogue of Alon-Füredi theorem -- and by means, of Schwartz-Zippel lemma -- in the rank metric. Finally, we construct the counterparts of Reed-Muller codes in the rank metric, and we give their parameters. We also show the connection between these codes and classical Reed-Muller codes in the case where $\mathbb{L}$ is a Kummer extension.

cs.IT↗
arXiv2020

Toward good families of codes from towers of surfaces

We introduce in this article a new method to estimate the minimum distance of codes from algebraic surfaces. This lower bound is generic, i.e. can be applied to any surface, and turns out to be ``liftable'' under finite morphisms, paving the way toward the construction of good codes from towers of surfaces. In the same direction, we establish a criterion for a surface with a fixed finite set of closed points $\mathcal P$ to have an infinite tower of $\ell$--étale covers in which $\mathcal P$ splits totally. We conclude by stating several open problems. In particular, we relate the existence of asymptotically good codes from general type surfaces with a very ample canonical class to the behaviour of their number of rational points with respect to their $K^2$ and coherent Euler characteristic.

math.AG↗
arXiv2019

Practical Algebraic Attack on DAGS

DAGS scheme is a key encapsulation mechanism (KEM) based on quasi-dyadic alternant codes that was submitted to NIST standardization process for a quantum resistant public key algorithm. Recently an algebraic attack was devised by Barelli and Couvreur (Asiacrypt 2018) that efficiently recovers the private key. It shows that DAGS can be totally cryptanalysed by solving a system of bilinear polynomial equations. However, some sets of DAGS parameters were not broken in practice. In this paper we improve the algebraic attack by showing that the original approach was not optimal in terms of the ratio of the number of equations to the number of variables. Contrary to the common belief that reducing at any cost the number of variables in a polynomial system is always beneficial, we actually observed that, provided that the ratio is increased and up to a threshold, the solving can be heavily improved by adding variables to the polynomial system. This enables us to recover the private keys in a few seconds. Furthermore, our experimentations also show that the maximum degree reached during the computation of the Gröbner basis is an important parameter that explains the efficiency of the attack. Finally, the authors of DAGS updated the parameters to take into account the algebraic cryptanalysis of Barelli and Couvreur. In the present article, we propose a hybrid approach that performs an exhaustive search on some variables and computes a Gröbner basis on the polynomial system involving the remaining variables. We then show that the updated set of parameters corresponding to 128-bit security can be broken with 2^83 operations.

cs.CR↗
arXiv2019

Anticanonical codes from del Pezzo surfaces with Picard rank one

We construct algebraic geometric codes from del Pezzo surfaces and focus on the ones having Picard rank one and the codes associated to the anticanonical class. We give explicit constructions of del Pezzo surfaces of degree 4, 5 and 6, compute the parameters of the associated anticanonical codes and study their isomorphisms arising from the automorphisms of the surface. We obtain codes with excellent parameters and some of them turn out to beat the best known codes listed on the database codetable.

math.AG↗
arXiv2018

On tensor products of CSS Codes

CSS codes are in one-to-one correspondance with length 3 chain complexes. The latter are naturally endowed with a tensor product $\otimes$ which induces a similar operation on the former. We investigate this operation, and in particular its behavior with regard to minimum distances. Given a CSS code $\mathcal{C}$, we give a criterion which provides a lower bound on the minimum distance of $\mathcal{C} \otimes \mathcal{D}$ for every CSS code $\mathcal D$. We apply this result to study the behaviour of iterated tensor powers of codes. Such sequences of codes are logarithmically LDPC and we prove in particular that their minimum distances tend generically to infinity. Different known results are reinterpretated in terms of tensor products. Three new families of CSS codes are defined, and their iterated tensor powers produce LDPC sequences of codes with length $n$, row weight in $O(\log n)$ and minimum distances larger than $n^{\fracα{2}}$ for any $α<1$. One family produces sequences with dimensions larger than $n^β$ for any $β<1$.

cs.IT↗
arXiv2018

An efficient structural attack on NIST submission DAGS

We present an efficient key recovery attack on code based encryption schemes using some quasi-dyadic alternant codes with extension degree 2. This attack permits to break the proposal DAGS recently submitted to NIST.

cs.CR↗
arXiv2018

Towards a function field version of Freiman's Theorem

We discuss a multiplicative counterpart of Freiman's $3k-4$ theorem in the context of a function field $F$ over an algebraically closed field $K$. Such a theorem would give a precise description of subspaces $S$, such that the space $S^2$ spanned by products of elements of $S$ satisfies $\dim S^2 \leq 3 \dim S-4$. We make a step in this direction by giving a complete characterisation of spaces $S$ such that $\dim S^2 = 2 \dim S$. We show that, up to multiplication by a constant field element, such a space $S$ is included in a function field of genus $0$ or $1$. In particular if the genus is $1$ then this space is a Riemann-Roch space.

math.NT↗
arXiv2018

Recovering short secret keys of RLCE in polynomial time

We present a key recovery attack against Y. Wang's Random Linear Code Encryption (RLCE) scheme recently submitted to the NIST call for post-quantum cryptography. This attack recovers the secret key for all the short key parameters proposed by the author.

cs.CR↗
arXiv2017

Cryptanalysis of McEliece Cryptosystem Based on Algebraic Geometry Codes and their subcodes

We give polynomial time attacks on the McEliece public key cryptosystem based either on algebraic geometry (AG) codes or on small codimensional subcodes of AG codes. These attacks consist in the blind reconstruction either of an Error Correcting Pair (ECP), or an Error Correcting Array (ECA) from the single data of an arbitrary generator matrix of a code. An ECP provides a decoding algorithm that corrects up to $\frac{d^*-1-g}{2}$ errors, where $d^*$ denotes the designed distance and $g$ denotes the genus of the corresponding curve, while with an ECA the decoding algorithm corrects up to $\frac{d^*-1}{2}$ errors. Roughly speaking, for a public code of length $n$ over $\mathbb F_q$, these attacks run in $O(n^4\log (n))$ operations in $\mathbb F_q$ for the reconstruction of an ECP and $O(n^5)$ operations for the reconstruction of an ECA. A probabilistic shortcut allows to reduce the complexities respectively to $O(n^{3+\varepsilon} \log (n))$ and $O(n^{4+\varepsilon})$. Compared to the previous known attack due to Faure and Minder, our attack is efficient on codes from curves of arbitrary genus. Furthermore, we investigate how far these methods apply to subcodes of AG codes.

cs.IT↗
arXiv2015

An upper bound on the number of rational points of arbitrary projective varieties over finite fields

We give an upper bound on the number of rational points of an arbitrary Zariski closed subset of a projective space over a finite field. This bound depends only on the dimensions and degrees of the irreducible components and holds for very general varieties, even reducible and non equidimensional. As a consequence, we prove a conjecture of Ghorpade and Lachaud on the maximal number of rational points of an equidimensional projective variety.

math.AG↗