Secure Sampling of Constant-Weight Words -Application to BIKE - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Preprints, Working Papers, ... Year : 2022

Secure Sampling of Constant-Weight Words -Application to BIKE


The pseudo-random sampling of constant weight word, as it is currently implemented in schemes like BIKE or HQC, is prone to the leakage of information on the seed being used. This creates a vulnerability when the semantic security conversion requires a deterministic re-encryption. This observation was first made in [HLS21] about HQC, and a timing attack was presented to recover the secret key. As suggested in [HLS21] a similar attack applies to BIKE and an instance of such an attack is presented here, as well as countermeasures similar to those suggested in [HLS21] for HQC. A new approach for fixing the issue is also proposed. It is first remarked that, contrary to what is done currently, the sampling of constant weight words doesn't need to produce a uniformly distributed output. If the distribution is close to uniform in the appropriate metric, the impact on security is negligible. Also, a new variant of Fisher-Yates shuffle is proposed which is (1) very well suited for secure implementations against timing and cache attacks, and (2) produces constant weight words with a distribution close enough to uniform.
Fichier principal
Vignette du fichier
2021-1631.pdf (494.05 Ko) Télécharger le fichier
Origin Files produced by the author(s)

Dates and versions

hal-03534005 , version 1 (19-01-2022)


  • HAL Id : hal-03534005 , version 1


Nicolas Sendrier. Secure Sampling of Constant-Weight Words -Application to BIKE. 2022. ⟨hal-03534005⟩


81 View
103 Download


Gmail Mastodon Facebook X LinkedIn More