Conversion schemes for public key cryptosystems

1. An encryption method for securing against key recovery attacks or adaptive chosen ciphertext attacks, comprising:

receiving a message value to be communicated to a recipient over a communication network;

applying an error vector derivation function to a random value and a message value to produce an error vector, wherein applying the error vector derivation function to the random value and the message value comprises:

applying a pseudorandom function to the random value and the message value to produce a pseudorandom function output,

applying a filter to the pseudorandom function output to produce a filtered pseudorandom function output, the filtered pseudorandom function output comprising t integers, and

generating the error vector based on the filtered pseudorandom function output, the error vector having a Hamming weight equal to t;

generating a plaintext value based on the random value, the message value, and the error vector;

performing an encryption function using one or more processors executing computer instructions to operate on the error vector and the plaintext value, the encryption function generating a first ciphertext component;

providing the first ciphertext component to an interface for transmission in a communication system; and

sending, by the interface, a transmission comprising the first ciphertext over the communication network to secure against key recovery attacks or adaptive chosen ciphertext attacks.

2. The method of claim 1 , wherein applying the error vector derivation function to the random value and the message value comprises applying the error vector derivation function to a concatenation of the random value and the message value.

3. The method of claim 1 , wherein applying the error vector derivation function to the random value and the message value comprises applying the error vector derivation function to an output of a hash function applied to the random value and the message value.

4. The method of claim 1 , wherein respective positions of the nonzero elements of the error vector are indicated by the filtered pseudorandom function output.

5. The method of claim 1 , wherein generating the plaintext value comprises:

applying a pseudorandom function to the error vector to produce a pseudorandom function output; and

applying an exclusive-or function to the pseudorandom function output and a combination of the random value and the message value.

6. The method of claim 5 , wherein the pseudorandom function comprises a cryptographic hash function or a stream cipher.

7. The method of claim 1 , wherein generating the plaintext value comprises generating a string comprising the plaintext value and a second ciphertext component, and the method comprises providing the second ciphertext component for transmission in the communication system.

8. The method of claim 1 , wherein the encryption function comprises a McEliece encryption function.

9. The method of claim 1 , wherein using the error vector and the plaintext value in the encryption function comprises adding the error vector to the product of the plaintext value and a public key matrix.

10. A computing system for securing against key recovery attacks or adaptive chosen ciphertext attacks, comprising:

data processing apparatus; and

memory device storing instructions that are operable when executed by the data processing apparatus to perform operations comprising:

receiving a message value to be communicated to a recipient over a communication network;

applying an error vector derivation function to a random value and the message value to produce an error vector, wherein applying the error vector derivation function to the random value and the message value comprises:

applying a pseudorandom function to the random value and the message value to produce a pseudorandom function output,

applying a filter to the pseudorandom function output to produce a filtered pseudorandom function output, the filtered pseudorandom function output comprising t integers, and

generating the error vector based on the filtered pseudorandom function output, the error vector having a Hamming weight equal to t;

generating a plaintext value based on the random value, the message value, and the error vector;

performing an encryption function using one or more processors executing the instructions to operate on the error vector and the plaintext value, the encryption function generating a first ciphertext component;

providing the first ciphertext component to an interface for transmission in a communication system; and

sending, by the interface, a transmission comprising the first ciphertext over the communication network to secure against key recovery attacks or adaptive chosen ciphertext attacks.

11. The computing system of claim 10 , wherein applying the error vector derivation function to the random value and the message value comprises applying the error vector derivation function to a concatenation of the random value and the message value.

12. The computing system of claim 10 , wherein applying the error vector derivation function to the random value and the message value comprises applying the error vector derivation function to an output of a hash function applied to the random value and the message value.

13. The computing system of claim 10 , wherein respective positions of the nonzero elements of the error vector are indicated by the filtered pseudorandom function output.

14. The computing system of claim 10 , wherein generating the plaintext value comprises:

applying a pseudorandom function to the error vector to produce a pseudorandom function output; and

applying an exclusive-or function to the pseudorandom function output and a concatenation of the random value and the message value.

15. The computing system of claim 14 , wherein the pseudorandom function comprises a cryptographic hash function or a stream cipher.

16. The computing system of claim 10 , wherein generating the plaintext value comprises generating a string comprising the plaintext value and a second ciphertext component, and the method comprises providing the second ciphertext component for transmission in the communication system.

17. The computing system of claim 10 , wherein the encryption function comprises a McEliece encryption function.

18. The computing system of claim 10 , wherein using the error vector and the plaintext value in the encryption function comprises adding the error vector to the product of the plaintext value and a public key matrix.

19. A decryption method for securing against key recovery attacks or adaptive chosen ciphertext attacks, comprising:

obtaining a first ciphertext component transmitted between nodes in a communication system;

by operation of one or more processors, applying a decryption function to the first ciphertext component to produce a first decryption function output and a second decryption function output;

generating a check string based on the first decryption function output and the second decryption function output;

applying an error vector derivation function to the check string to produce an error vector check value, wherein applying the error vector derivation function to the check string comprises:

applying a pseudorandom function to the check string to produce a pseudorandom function output,

applying a filter to the pseudorandom function output to produce a filtered pseudorandom function output, the filtered pseudorandom function output comprising t integers, and

generating the error vector check value based on the filtered pseudorandom function output, the error vector check value having a Hamming weight equal to t;

comparing the second decryption function output with the error vector check value; and

generating a message value based on the check string in response to a determination that the second decryption function output is equal to the error vector check value for securing against key recovery attacks or adaptive chosen ciphertext attacks.

20. The method of claim 19 , wherein the decryption function comprises a McEliece decryption function.

21. The method of claim 19 , wherein generating the check string comprises:

applying a pseudorandom function to the second decryption function output to produce a pseudorandom function output; and

applying an exclusive-or function to the pseudorandom function output and a value comprising the first decryption function output.

22. The method of claim 19 , wherein respective positions of the nonzero elements of the error vector check value are indicated by the filtered pseudorandom function output.

23. A computing system for securing against key recovery attacks or adaptive chosen ciphertext attacks, comprising:

data processing apparatus; and

memory storing instructions that are operable when executed by the data processing apparatus to perform operations comprising:

obtaining a first ciphertext component transmitted between nodes in a communication system;

applying a decryption function to the first ciphertext component to produce a first decryption function output and a second decryption function output;

generating a check string based on the first decryption function output and the second decryption function output;

applying an error vector derivation function to the check string to produce an error vector check value, wherein applying the error vector derivation function to the check string comprises:

applying a pseudorandom function to the check string to produce a pseudorandom function output;

applying a filter to the pseudorandom function output to produce a filtered pseudorandom function output, the filtered pseudorandom function output comprising t integers, and

generating the error vector check value based on the filtered pseudorandom function output, the error vector check value having a Hamming weight equal to t;

comparing the second decryption function output with the error vector check value; and

generating a message value based on the check string in response to a determination that the second decryption function output is equal to the error vector check value for securing against key recovery attacks or adaptive chosen ciphertext attacks.

24. The computing system of claim 23 , wherein the decryption function comprises a McEliece decryption function.

25. The computing system of claim 23 , wherein generating the check string comprises:

applying a pseudorandom function to the second decryption function output to produce a pseudorandom function output; and

applying an exclusive-or function to the pseudorandom function output and a value comprising the first decryption function output.

26. The computing system of claim 23 , wherein respective positions of the nonzero elements of the error vector check value are indicated by the filtered pseudorandom function output.