In this work we present a very efficient key recovery attack on the QC-MDPC scheme using the fact that decryption uses an iterative decoding step and this can fail with some small probability. We identify a dependence between the secret key and the failure in decoding. This can be used to build what we refer to as a distance spectrum for the secret key, which is the set of all distances between any two ones in the secret key. In a reconstruction step we then determine the secret key from the distance spectrum. The attack has been implemented and tested on a proposed instance of QC-MDPC for 80 bit security. It successfully recovers the secret key in minutes.
A slightly modified version of the attack can be applied on proposed versions of the QC-MDPC scheme that provides IND-CCA security. The attack is a bit more complex in this case, but still very much below the security level. The reason why we can break schemes with proved CCA security is that the model for these proofs typically does not include the decoding error possibility.Category / Keywords: CCA-security, key-recovery attack, post-quantum cryptography, QC-MDPC, reaction attack. Original Publication (in the same form): IACR-ASIACRYPT-2016 Date: received 6 Sep 2016, last revised 8 Sep 2016 Contact author: qian guo at eit lth se, thomas johansson@eit lth se, paul stankovski@eit lth se,fywzguoqian@gmail com Available format(s): PDF | BibTeX Citation Version: 20160908:205126 (All versions of this report) Short URL: ia.cr/2016/858 Discussion forum: Show discussion | Start new discussion