QC-MDPC codes DFR and the IND-CCA security of BIKE - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Preprints, Working Papers, ... Year : 2022

QC-MDPC codes DFR and the IND-CCA security of BIKE


The aim of this document is to clarify the DFR (Decoding Failure Rate) claims made for BIKE, a third round alternate candidate KEM (Key Encapsulation Mechanism) to the NIST call for post-quantum cryptography standardization. For the most part, the material presented here is not new, it is extracted from the relevant scientific literature, in particular [Vas21]. Even though a negligible DFR is not needed for a KEM using ephemeral keys (e.g. TLS) which only requires IND-CPA security, it seems that IND-CCA security, relevant for reusable/static keys, has become a requirement. Therefore, a negligible DFR is needed both for the security reduction [FO99; HHK17] and to thwart existing attacks [GJS16]. Proving a DFR lower than 2 − where is the security parameter (e.g. = 128 or 256) is hardly possible with mere simulation. Instead a methodology based on modelization, simulation, and extrapolation with confidence estimate was devised [Vas21]. Models are backed up by theoretical results [Til18; SV19], but do not account for some combinatorial properties of the underlying error correcting code. Those combinatorial properties give rise to what is known in telecommunication as "error floors" [Ric03]. The statistical modeling predicts a fast decrease of the DFR as the block size grows, the waterfall region, whereas the combinatorial properties, weak keys[DGK19] or near-codewords[Vas21], predict a slower decrease, the error floor region. The issue here is to show that the error floor occurs in a region where the DFR is already below the security requirement. This would validate the extrapolation approach, and, as far as we can say, this appears to be the case for the QC-MDPC codes corresponding to BIKE parameters. The impact of the QC-MDPC code combinatorial properties on decoding, as reported in this document, is better and better understood. In particular, it strongly relates with the spectrum of low weight vectors, as defined in [GJS16]. At this point, none of the results we are aware of and which are presented here contradict in any way the DFR claims made for BIKE. Admittedly those claims remain heuristic in part, but could be understood as an additional assumption, just like the computational assumptions made for all similar primitives, under which the BIKE scheme is IND-CCA secure.
Fichier principal
Vignette du fichier
2021-1458.pdf (414.28 Ko) Télécharger le fichier
Origin Files produced by the author(s)

Dates and versions

hal-03534003 , version 1 (19-01-2022)


  • HAL Id : hal-03534003 , version 1


Valentin Vasseur. QC-MDPC codes DFR and the IND-CCA security of BIKE. 2022. ⟨hal-03534003⟩


92 View
120 Download


Gmail Mastodon Facebook X LinkedIn More