On the applicability of the Fujisaki–Okamoto transformation to the BIKE KEM

Nir Drucker; Shay Gueron; Dusan Kostic; Edoardo Persichetti

doi:10.1080/23799927.2021.1930176

On the applicability of the Fujisaki–Okamoto transformation to the BIKE KEM

Nir Drucker, Shay Gueron, Dusan Kostic, Edoardo Persichetti

Department of Mathematics

Research output: Contribution to journal › Article › peer-review

Abstract

The QC-MDPC code-based KEM BIKE is one of the Round-3 candidates of the NIST PQC standardization project. Its Round-2 specification document described variants claiming to have IND-CCA security. The security proof used the Fujisaki–Okamoto transformation and a decoder targeting a Decoding Failure Rate (DFR) of (Formula presented.) (for Level-1 security). However, several aspects needed to be amended in order for the IND-CCA proof to hold. The main issue is that using a decoder with DFR of (Formula presented.) does not necessarily imply that the underlying PKE is δ-correct with (Formula presented.), as required. In this paper, we handle the necessary aspects to ensure the security claim is correct. In particular, we close the gap in the proof by defining the notion of message-agnostic PKE. We show that the PKEs underlying the BIKE versions are message-agnostic. This implies that BIKE with a decoder that has a sufficiently low DFR is also an IND-CCA KEM.

Original language	English
Pages (from-to)	364-374
Number of pages	11
Journal	International Journal of Computer Mathematics: Computer Systems Theory
Volume	6
Issue number	4
DOIs	https://doi.org/10.1080/23799927.2021.1930176
State	Published - 2021

Bibliographical note

Funding Information:
This research was supported by: NSF-BSF (United States-Israel Binational Science Foundation) [grant number 2018640]; NSF Grant CNS (Division of Computer and Network Systems) [grant number 1906360]; The Israel Science Foundation [grant number 3380/19]. The BIU Center for Research in Applied Cryptography and Cyber Security, and the Center for Cyber Law and Policy at the University of Haifa, both in conjunction with the Israel National Cyber Bureau in the Prime Minister's Office.

Publisher Copyright:
© 2021 Informa UK Limited, trading as Taylor & Francis Group.

Keywords

BIKE
Fujisaki–Okamoto
NIST
QC-MDPC codes
post-quantum cryptography

ASJC Scopus subject areas

Computational Theory and Mathematics
Computational Mathematics

Access to Document

10.1080/23799927.2021.1930176

Cite this

@article{51452c45a1724d12bf791fc2eee63ac6,

title = "On the applicability of the Fujisaki–Okamoto transformation to the BIKE KEM",

abstract = "The QC-MDPC code-based KEM BIKE is one of the Round-3 candidates of the NIST PQC standardization project. Its Round-2 specification document described variants claiming to have IND-CCA security. The security proof used the Fujisaki–Okamoto transformation and a decoder targeting a Decoding Failure Rate (DFR) of (Formula presented.) (for Level-1 security). However, several aspects needed to be amended in order for the IND-CCA proof to hold. The main issue is that using a decoder with DFR of (Formula presented.) does not necessarily imply that the underlying PKE is δ-correct with (Formula presented.), as required. In this paper, we handle the necessary aspects to ensure the security claim is correct. In particular, we close the gap in the proof by defining the notion of message-agnostic PKE. We show that the PKEs underlying the BIKE versions are message-agnostic. This implies that BIKE with a decoder that has a sufficiently low DFR is also an IND-CCA KEM.",

keywords = "BIKE, Fujisaki–Okamoto, NIST, QC-MDPC codes, post-quantum cryptography",

author = "Nir Drucker and Shay Gueron and Dusan Kostic and Edoardo Persichetti",

note = "Funding Information: This research was supported by: NSF-BSF (United States-Israel Binational Science Foundation) [grant number 2018640]; NSF Grant CNS (Division of Computer and Network Systems) [grant number 1906360]; The Israel Science Foundation [grant number 3380/19]. The BIU Center for Research in Applied Cryptography and Cyber Security, and the Center for Cyber Law and Policy at the University of Haifa, both in conjunction with the Israel National Cyber Bureau in the Prime Minister's Office. Publisher Copyright: {\textcopyright} 2021 Informa UK Limited, trading as Taylor & Francis Group.",

year = "2021",

doi = "10.1080/23799927.2021.1930176",

language = "English",

volume = "6",

pages = "364--374",

journal = "International Journal of Computer Mathematics: Computer Systems Theory",

issn = "2379-9927",

publisher = "Taylor and Francis Ltd.",

number = "4",

}

TY - JOUR

T1 - On the applicability of the Fujisaki–Okamoto transformation to the BIKE KEM

AU - Drucker, Nir

AU - Gueron, Shay

AU - Kostic, Dusan

AU - Persichetti, Edoardo

N1 - Funding Information: This research was supported by: NSF-BSF (United States-Israel Binational Science Foundation) [grant number 2018640]; NSF Grant CNS (Division of Computer and Network Systems) [grant number 1906360]; The Israel Science Foundation [grant number 3380/19]. The BIU Center for Research in Applied Cryptography and Cyber Security, and the Center for Cyber Law and Policy at the University of Haifa, both in conjunction with the Israel National Cyber Bureau in the Prime Minister's Office. Publisher Copyright: © 2021 Informa UK Limited, trading as Taylor & Francis Group.

PY - 2021

Y1 - 2021

N2 - The QC-MDPC code-based KEM BIKE is one of the Round-3 candidates of the NIST PQC standardization project. Its Round-2 specification document described variants claiming to have IND-CCA security. The security proof used the Fujisaki–Okamoto transformation and a decoder targeting a Decoding Failure Rate (DFR) of (Formula presented.) (for Level-1 security). However, several aspects needed to be amended in order for the IND-CCA proof to hold. The main issue is that using a decoder with DFR of (Formula presented.) does not necessarily imply that the underlying PKE is δ-correct with (Formula presented.), as required. In this paper, we handle the necessary aspects to ensure the security claim is correct. In particular, we close the gap in the proof by defining the notion of message-agnostic PKE. We show that the PKEs underlying the BIKE versions are message-agnostic. This implies that BIKE with a decoder that has a sufficiently low DFR is also an IND-CCA KEM.

AB - The QC-MDPC code-based KEM BIKE is one of the Round-3 candidates of the NIST PQC standardization project. Its Round-2 specification document described variants claiming to have IND-CCA security. The security proof used the Fujisaki–Okamoto transformation and a decoder targeting a Decoding Failure Rate (DFR) of (Formula presented.) (for Level-1 security). However, several aspects needed to be amended in order for the IND-CCA proof to hold. The main issue is that using a decoder with DFR of (Formula presented.) does not necessarily imply that the underlying PKE is δ-correct with (Formula presented.), as required. In this paper, we handle the necessary aspects to ensure the security claim is correct. In particular, we close the gap in the proof by defining the notion of message-agnostic PKE. We show that the PKEs underlying the BIKE versions are message-agnostic. This implies that BIKE with a decoder that has a sufficiently low DFR is also an IND-CCA KEM.

KW - BIKE

KW - Fujisaki–Okamoto

KW - NIST

KW - QC-MDPC codes

KW - post-quantum cryptography

UR - http://www.scopus.com/inward/record.url?scp=85106999047&partnerID=8YFLogxK

U2 - 10.1080/23799927.2021.1930176

DO - 10.1080/23799927.2021.1930176

M3 - Article

AN - SCOPUS:85106999047

SN - 2379-9927

VL - 6

SP - 364

EP - 374

JO - International Journal of Computer Mathematics: Computer Systems Theory

JF - International Journal of Computer Mathematics: Computer Systems Theory

IS - 4

ER -

On the applicability of the Fujisaki–Okamoto transformation to the BIKE KEM

Abstract

Bibliographical note

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this