Algebraic attacks for solving the Rank Decoding and MinRank problems without Gröbner basis

Magali Bardet (1, 2) , Maxime Bros (3) , Daniel Cabarcas (4) , Philippe Gaborit (3) , Ray Perlner (5) , Daniel Smith-Tone (6, 5) , Jean-Pierre Tillich (2) , Javier Verbel (4)

1 CA - LITIS - Equipe Combinatoire et algorithmes
2 SECRET - Security, Cryptology and Transmissions
3 XLIM-MATHIS - Mathématiques & Sécurité de l'information
4 Universidad Nacional de Colombia Sede Medellín
5 NIST - National Institute of Standards and Technology [Gaithersburg]
6 University of Louisville

Rank Decoding is the main underlying problem in rank-based cryptography. Based on this problem and quasi-cyclic versions of it, very efficient schemes have been proposed recently, such as those in the ROLLO and RQC submissions, which have reached the second round of the NIST Post-Quantum Cryptography Standardization Process. Two main approaches have been studied to solve the Rank Decoding problem: combinatorial ones and algebraic ones. While the former has been studied extensively, a better understanding of the latter was recently obtained by Bardet \emph{et al.} (EUROCRYPT 2020) where it appeared that algebraic attacks can often be more efficient than combinatorial ones for cryptographic parameters. In particular, these results were based on Gr\"obner basis computations which led to complexity bounds slightly smaller than the claimed security of ROLLO and RQC cryptosystems. This paper gives substantial improvements upon this attack in terms both of complexity and of the assumptions required by the cryptanalysis. We present attacks for ROLLO-I-128, ROLLO-I-192, and ROLLO-I-256 with bit complexity respectively in 70, 86, and 158, to be compared to 117, 144, and 197 for the aforementionned previous attack. Moreover, unlike that previous attack, the new one does not rely on Gr\"obner basis computations and thus does not require any assumption concerning the behavior of the so-called solving degree. This improvement relies upon a modeling slightly different from the one used in Bardet \emph{et al.} (EUROCRYPT 2020). For a case called ``overdetermined'', this modeling allows us to avoid Gr\"obner basis computations by going directly to solving a linear system. For the other case, called ``underdetermined'', we also improve the results from the previous attack by combining the Ourivski-Johansson modeling together with a new modeling for a generic MinRank instance; the latter modeling allows us to refine the analysis of MinRank's complexity given in the paper by Verbel \emph{et al.} (PQCrypto 2019). MinRank is a problem of great interest for all multivariate-based cryptosystems, including GeMSS and Rainbow, which are at the second round of the aforementionned NIST competition. Finally, since the proposed parameters of ROLLO and RQC are completely broken by our new attack, we give examples of new parameters for ROLLO and RQC that make them resistant to our attacks. These new parameters show that these systems remain attractive, with a loss of only about 50\% in terms of key size for ROLLO-I.

Mots clés: Post-quantum cryptography; Algebraic attack; Rankmetric code-based cryptography; NIST-PQC candidates

Domaines: Cryptographie et sécurité [cs.CR]; Géométrie algébrique [math.AG]

Magali Bardet, Maxime Bros, Daniel Cabarcas, Philippe Gaborit, Ray Perlner, et al.. Algebraic attacks for solving the Rank Decoding and MinRank problems without Gröbner basis. 2020. ⟨hal-02475356v2⟩