# Code used for McEliece cryptosystem

In the McEliece cryptosystem, is choice of the code known to the attacker? And if a structural attack succeeded and the attacker found the generator matrix of the code, how did the attacker decode the encrypted message?

• Thanks for your answer. Please excuse me for my English. You said that "the code is known (via G) ti everyone", but if G is known there is no reason to mask the code, do you agree? – Paul Aug 19 '20 at 9:35
• Hi Paul, what happens is that by the masking via permutation and matrix multiplication an equivalent code is produced, with similar properties to the original code. So the equivalent decoding problem looks like it is for a random code, and since decoding a random code is difficult, the strength resides in the multiplication and permutation, they are trapdoor information available only to the authorized decoder. – kodlu Aug 19 '20 at 9:38
• Ok, i agree. the attacker know exactly the matrix G, but He don't know S and P, is this true? – Paul Aug 19 '20 at 10:41

The code is known (via $$G$$) to everyone including the attacker, but the code coordinates are permuted on the right ($$P$$) after an invertible transformation $$S$$ applied on the left, forming a trapdoor. $$S,G$$ are secret. If the permuted generator matrix is $$\hat{G}$$ we have $$\hat{G}=SGP.$$
If the received ciphertext is $$c=c'\oplus e,$$ where $$e$$ is the noise vector added for security, and $$c'=m\hat{G},$$ the legitimate recipient can do $$\hat{c}=cP^{-1},$$ and can decode $$\hat{c}$$ to $$\hat{m}$$ using the standard decoding algorithm for the code. Finally she can compute $$m=\hat{m}S^{-1}.$$ You can check in a routine way this works.