Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If we assume that the support for an irreducible binary Goppa code $\gamma_1, ..., \gamma_n$ is publicly known, when is it possible to efficiently decode the code? I know it's possible if one knows the generator polynomial $g(x)$, and also, if one can obtain a parity check matrix $H$ of the form $XYZ$, where

$ X = \left( \begin{array}{cccc} g_t & 0 & \dots & 0 \\ g_{t-1} & g_t & \dots & 0 \\ \vdots & \vdots & \ddots & \vdots \\ g_1 & g_2 & \dots & g_t \\ \end{array}\right) $

$ Y = \left( \begin{array}{cccc} 1 & 1 & \dots & 1 \\ l_1 & l_2 & \dots & l_n \\ l_1^2 & l_2^2 & \dots & l_n^2 \\ \vdots & \vdots & \ddots & \vdots \\ l_1^{t-1} & l_2^{t-1} & \dots & l_n^{t-1} \\ \end{array}\right) $

$ Z = \left( \begin{array}{cccc} \frac{1}{g(l_1)} & & & \\ & \frac{1}{g(l_2)} & & \\ & & \ddots & \\ & & & \frac{1}{g(l_n)} \\ \end{array}\right) $

as in the paper by Engelbert, Overbeck and Schmidt (1, 2), since here we are able to recover a multiple of the matrix $X$ and so a multiple of g(x) which generates the same code. My question is, is it possible to efficiently decode the code whenever one knows ANY generator matrix or ANY parity check matrix for the binary irreducible Goppa code?

Also, on p.15, Sec. 3.1 of the Engelbert et al. paper an attacker is assumed to know a generator matrix $SG'$ for the Goppa code and a corresponding systematic check matrix $H'$. The attacker is then assumed to be able to recover matrices P an M such that $M^{-1}H'P^{-1}=H$ where $H=XYZ$ is of the above form (and thus, decode the code). Why is this assumption feasible? How would an attacker know at all when $H=XYZ$? Also, why should H generate the same subspace as H'?

Finally, the section 3.1 of the paper claims that if in a McEliece system with public code generator matrix $G=SG'P$ the matrix $P$ is revealed, then it is possible to recover $g(x)$. How? The only way I can think of it is that if $c$ is a codeword in a code generated by $SG'P$ then $cP^{-1}$ is a codeword in a Goppa code generated by $SG'$ and so the syndrome $S_{cP^{-1}}(x)=\sum (cP^{-1})_i/(X-\gamma_i)$ which the attacker can calculate is congruent to zero modulo $g(x)$. Is this a way to obtain $g(x)$?

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.