Safety evaluation device, safety evaluation method, and safety evaluation program

Abstract

To provide a safety evaluation device that evaluates safety of code encryption more strictly.SOLUTION: A safety evaluation device 1 comprises: an input part 11 for receiving an input of a parameter set of an SD problem, and an upper limit of a space calculation amount; an initial processing part 12 for creating an aggregate of valid parameter sets, with respect to a Revisited MMT method; a space calculation amount estimation part 13 for calculating a space calculation amount required for storing input data, and a list for constituting solution candidates; a time calculation amount estimation part 14 for summing up a calculation time required for executing Gaussian elimination, and a calculation time required for constituting and merging a list, and multiplying the sum by an expectation loop frequency based on a correct answer probability, to calculate a time calculation amount; a condition determination part 15 for determining whether or not a space calculation amount exceeds the upper limit; and an output part 16 for outputting the minimum time calculation amount together with a parameter set that minimizes the time calculation amount, out of the aggregate, by excluding an element of which the space calculation amount has been determined to exceed the upper limit.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an estimator for an ISD (Information Set Decoding) algorithm for solving mathematical problems that form the basis of security for code encryption, which is a quantum-computer-resistant cryptography. [Background technology]

[0002] ISD is a general term for exponential-time probabilistic algorithms that take as input a set of parameters (the size of the SD problem and the Hamming weight of the solution) of the syndrome decoding problem (SD problem), a mathematical problem that is the basis for the security of code encryption, and output a solution to the SD problem based on combinatorial theory.Solving the SD problem is the same as finding the secret key of the code encryption from public information (decrypting the code encryption). A program that estimates the computational complexity of ISD for a specific SD problem is called an ISD estimator. By constructing a more accurate ISD estimator, the security of a code cipher can be evaluated more rigorously.

[0003] ISD includes, for example, the May-Meurer-Thomae (MMT) method proposed in Non-Patent Document 1. The MMT method is known as a practically fast ISD that is used in code encryption cryptanalysis contests. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Alexander May, Alexander Meurer, and Enrico Thomae. "Decoding Random Linear Codes in O(20.054n)". In: ASIACRYPT 2011. 2011, pp. 107-124. [Non-patent document 2] Shintaro Narisada, Shusaku Uemura, Hiroki Okada, Hiroki Furue, Yusuke Aikawa, and Kazuhide Fukushima. "Revisiting the May-Meurer-Thomae Algorithm - Solving McEliece-1409 in One Day". In: Cryptology ePrint Archive. 2024 / 393. Summary of the Invention [Problem to be solved by the invention]

[0005] However, as an improved method of the conventional MMT method, for example, Non-Patent Document 2 proposes the Revisited MMT method. With the improvement of the MMT method, a more accurate ISD estimator is desired.

[0006] An object of the present invention is to provide a security evaluation device, a security evaluation method, and a security evaluation program that can more strictly evaluate the security of a code cipher. [Means for solving the problem]

[0007] a space complexity estimation unit that calculates, for each element of the set, the space complexity required to store the input data for the Revisited MMT method and a list for configuring solution candidates; a time complexity estimation unit that calculates, for each element of the set, the time complexity by adding up the computation time required to perform Gaussian elimination used in the Revisited MMT method and the computation time required to configure and merge the list, and multiplying the sum by an expected number of loops based on the probability of a correct solution; a condition determination unit that determines whether the space complexity exceeds the upper limit; and an output unit that outputs, from the set, the parameter set with the smallest time complexity, together with the smallest time complexity, excluding elements of the set for which it is determined by the condition determination unit that the space complexity exceeds the upper limit.

[0008] The input unit may receive a lower limit of the time complexity as an input, and the output unit may output a minimum parameter value in the parameter set that does not cause the minimum time complexity to fall below the lower limit when a parameter value corresponding to a key length of a code cipher is changed.

[0009] In a safety assessment method according to the present invention, a computer receives, via an input unit, a parameter set for an SD problem and an upper limit on space complexity as input; an initial processing unit creates a set of effective parameter sets for the Revisited MMT method for solving the SD problem; a space complexity estimation unit calculates, for each element of the set, the space complexity required to store the input data for the Revisited MMT method and a list for configuring solution candidates; a time complexity estimation unit adds up, for each element of the set, the computation time required to perform Gaussian elimination used in the Revisited MMT method and the computation time required to configure and merge the lists, and multiplies this by an expected number of loops based on the probability of a correct solution to calculate the time complexity; a condition determination unit determines whether the space complexity exceeds the upper limit; and an output unit outputs, from the set, the parameter set with the smallest time complexity, together with the smallest time complexity, excluding the elements of the set for which it is determined by the condition determination unit that the space complexity exceeds the upper limit.

[0010] A safety evaluation program according to the present invention causes a computer to function as the safety evaluation device. [Effects of the Invention]

[0011] According to the present invention, the security of a code cipher can be evaluated more strictly. [Brief explanation of the drawings]

[0012] [Figure 1] 1 is a block diagram showing a functional configuration of a safety evaluation device according to an embodiment. [Figure 2] FIG. 10 is a diagram showing pseudocode of the Revisited MMT method, which is an ISD targeted by the Estimator of the embodiment. [Figure 3] FIG. 10 is a diagram illustrating pseudocode for implementing an Estimator according to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0013] An example of an embodiment of the present invention will be described below. In this embodiment, an ISD estimator for the Revisited MMT method is implemented in order to evaluate the security of the code encryption more strictly. The ISD Estimator outputs the minimum computational cost within the limited space computational cost (memory capacity) and the ISD parameters at that time.

[0014] FIG. 1 is a block diagram showing the functional configuration of a safety evaluation device 1 according to this embodiment. The safety evaluation device 1 is an information processing device (computer) such as a server or a personal computer that includes a control unit 10, a storage unit 20, and various input / output interfaces.

[0015] The control unit 10 is a part that controls the entire safety evaluation device 1, and realizes each function in this embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU.

[0016] The storage unit 20 is a storage area for various programs for causing the hardware group to function as the safety evaluation device 1, various data, and the like, and may be a ROM, RAM, flash memory, hard disk drive (HDD), or the like. Specifically, the storage unit 20 stores a safety evaluation program for causing the control unit 10 to execute each function of this embodiment, as well as input / output data for this program and temporarily saved data during execution.

[0017] The control unit 10 includes an input unit 11, an initial processing unit 12, a space complexity estimation unit 13, a time complexity estimation unit 14, a condition determination unit 15, and an output unit 16, and functions as an ISD Estimator for the Revisited MMT method by operating these functional units.

[0018] FIG. 2 is a diagram showing pseudocode (Algorithm 1) of the Revisited MMT method, which is the ISD targeted by the Estimator of this embodiment. The input of Algorithm 1 is a parameter set for the SD problem (binary matrix H and vector s, and Hamming weights w), and the output is a solution to the SD problem (a vector e of Hamming weights w that satisfies He = s). Algorithm 1 is a probabilistic algorithm with a correct answer probability of q, and the processing from lines 7 to 16 is performed with a probability of q. -1 It is expected that a solution e will be obtained by repeating this process.

[0019] wt(x) represents the Hamming weight of the binary vector x. For l1 ≦ l, the mapping

number

[0020] The executor (computer) of Algorithm 1 randomly selects one column permutation matrix P on line 7. Then, on line 8, the input matrix H is assigned P and a regular matrix

number

[0021] Next, the executor creates four initial lists ~L on line 10. (2) 1,~L (2) 2,~L (2) 3,~L (2) Next, on line 11, we construct four initial lists ~L (2) 1,~L (2) 2,~L (2) 3,~L (2) From 4, two lists ~L (1) 1,~L (1) 2. Furthermore, on line 12, two lists are constructed. (1) 1,~L (1) 2 to 1 list ~L (0) Build.

[0022] The executor executes ~L on line 13. (0) For each element of , execute lines 14 to 16. Line 14 defines ~z, and line 15 performs a conditional decision process on ~z regarding the Hamming weight of the solution. If the decision result of line 15 is true, line 16 outputs the solution and ends the process.

[0023] FIG. 3 is a diagram showing pseudocode (algorithm 2) for realizing the Estimator of this embodiment. Algorithm 2 is designed as an ISD estimator for the Revisited MMT method based on Algorithm 1.

[0024] The input of Algorithm 2 received by input unit 11 is a parameter set (n, k, w) for the SD problem and an upper limit M of the space complexity (memory amount). The output is the minimum solution time complexity (^T) of the Revisited MMT method whose space complexity is less than or equal to M for the SD problem corresponding to the given parameter set, the space complexity (^S) required to execute the Revisited MMT method when the time complexity is ^T, and the internal parameters (^l, ^l1, ^p) of the Revisited MMT method that give ^T.

[0025] In the first line, the initial processing unit 12 defines a set V of valid parameter pairs (l, l1, p) for the Revisited MMT method. In the second line, the initial processing unit 12 initializes the output value.

[0026] In the loop processing from line 3 to line 18, the control unit 10 estimates the time complexity T of the Revisited MMT method for each element of set V, and if T is smaller than the minimum time complexity ^T so far and the space complexity S is equal to or smaller than M, it updates ^T with T.

[0027] In the fourth line, the time complexity estimation unit 14 calculates the calculation time (T geThe estimation method is not limited, and a calculation formula may be set appropriately depending on a specific algorithm for executing Gaussian elimination.

[0028] In the fifth line, the space complexity estimation unit 13 estimates the memory size (S i ) is estimated using a predetermined formula based on the input parameters. In line 6, the space complexity estimator 13 calculates the four initial lists ∼L (2) 1,~L (2) 2,~L (2) 3,~L (2) The memory size (S2) required for each of 4 is estimated using a predetermined formula based on the input parameters and the current internal parameters (elements of set V selected in line 3). In line 7, the space complexity estimator 13 calculates the space complexity of the two lists ~L in Algorithm 1. (1) 1,~L (1) The memory size (S1) required for each of the above two is estimated using a predetermined formula based on S2 and the current internal parameters. In the eighth line, the space complexity estimation unit 13 calculates the space complexity (total memory amount) required for the entire execution of the algorithm 1 as S=S i It is estimated as +2S2+2S1. Note that S2 is doubled because two of the four initial lists are common.

[0029] From line 9 to line 10, the condition determination unit 15 determines whether the estimated space complexity S exceeds the upper limit M, and if so, suspends the processing for the current internal parameter and moves on to the processing of the next parameter (line 3).

[0030] In line 11, the time complexity estimation unit 14 calculates the calculation time (T search ) is estimated. Specifically, T search is the time (first term) to construct four initial lists (actually two lists because two of them are common), two lists ~L (1) 1,~L (1)Time to merge into 2 (item 2), and one list ~L (0) The sum of the time to merge (item 3)

[0031] In addition, List ~L (0) The time required to check the conditions for each candidate in (lines 13 to 16 in Algorithm 1) is very small and is ignored here. Also, in implementation, list ~L (0) Without constructing a list, each candidate (list L (0) Since we only need to make a conditional decision each time we create an element of the list, (0) The memory requirement for storing does not need to be estimated as space complexity (line 8).

[0032] In lines 12 to 15, the time complexity estimator 14 calculates the expected loop count q of Algorithm 1. -1 is calculated using the same formula as Algorithm 1. On the 16th line, the time complexity estimation unit 14 calculates the time complexity (expected calculation time) of Algorithm 1 based on the current internal parameters as T=q -1 (T ge +T search ) is estimated.

[0033] From line 17 to line 18, the control unit 10 saves the smallest time complexity (^T) in the search so far, the space complexity (^S) at that time, and the parameters (^l, ^l1, ^p) of the Revisited MMT method. On the 19th line, the output unit 16 outputs the estimation results obtained by searching all elements of the set V.

[0034] According to this embodiment, the safety evaluation device 1 can estimate the computational complexity for solving any SD problem with a realistic memory capacity (e.g., less than 1 GB) when the Revisited MMT method, which is an improved version of the MMT method, is used as the ISD using Algorithm 2. This allows us to output a smaller time complexity for a given parameter of the SD problem compared to existing ISD estimators, and also limits the space complexity, which means that we can evaluate the security of various code ciphers more strictly than existing ISD estimators.

[0035] This embodiment can be used in general products that use code encryption as a successor to the RSA encryption widely used on the Internet. When using code encryption, the key length of the code encryption, that is, the parameter n in algorithm 2, can be set to a unique value depending on the application. For example, the input unit 11 of the security evaluation device 1 may receive a lower limit of the time complexity as an input, and the output unit 16 may output the smallest parameter n in the parameter set such that the minimum time complexity does not fall below the lower limit when the parameter n corresponding to the key length of the code cipher is changed. This allows the administrator to estimate the key length of the code encryption that achieves both security and efficiency.

[0036] Furthermore, this embodiment makes it possible to evaluate, for example, the security of code encryption, which can contribute to achieving Goal 9 of the Sustainable Development Goals (SDGs) led by the United Nations: "Build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0037] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0038] The safety evaluation method using the safety evaluation device 1 is realized by software. When realized by software, the programs constituting this software are installed in an information processing device (computer). These programs may be recorded on removable media such as CD-ROMs and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a web service via a network without being downloaded. [Explanation of symbols]

[0039] 1 Safety evaluation device 10 Control Unit 11 Input section 12 Initial processing section 13 Spatial complexity estimator 14 Hourly calculation amount estimation part 15 Condition judgment section 16 Output section 20 Memory section

Claims

1. an input unit that receives a parameter set of the SD problem and an upper limit of the space complexity as input; an initial processing unit that creates a set of effective parameter sets for a Revisited MMT method for solving the SD problem; a space complexity estimation unit that calculates a space complexity required to store input data of the Revisited MMT method and a list for configuring solution candidates for each element of the set; a time complexity estimation unit that calculates the time complexity by summing up the calculation time required to perform Gaussian elimination used in the Revisited MMT method and the calculation time required to configure and merge the list for each element of the set and multiplying the sum by an expected number of loops based on a correct solution probability; a condition determination unit that determines whether the spatial complexity exceeds the upper limit; an output unit that outputs, from the set, an element for which the condition determination unit determines that the space complexity exceeds the upper limit, together with a set of parameters that minimizes the time complexity.

2. the input unit receives the lower bound of the time complexity as an input; 2. The security evaluation device according to claim 1, wherein the output unit outputs a minimum parameter value from the parameter set that does not cause the minimum time complexity to fall below the lower limit when a parameter value corresponding to a key length of a code cipher is changed.

3. The computer The input unit receives a parameter set for the SD problem and an upper limit of the space complexity as input; An initial processing unit generates a set of effective parameter sets for a revisited MMT method for solving the SD problem; A space calculation amount estimating unit calculates, for each element of the set, the space calculation amount required to store the input data of the Revisited MMT method and a list for configuring solution candidates; A time complexity estimation unit calculates, for each element of the set, the calculation time required to perform Gaussian elimination used in the Revisited MMT method and the calculation time required to construct and merge the list, and multiplies the result by the expected number of loops based on the correct answer probability to calculate the time complexity; a condition determination unit determines whether the space complexity exceeds the upper limit; a safety evaluation method in which an output unit outputs, from the set, an element for which the condition determination unit determines that the space complexity exceeds the upper limit, together with a set of parameters that minimizes the time complexity, the minimum time complexity.

4. A safety evaluation program for causing a computer to function as the safety evaluation device according to claim 1 or 2.

Images