Questions tagged [mceliece]

McEliece cryptosystem is an asymmetric encryption algorithm and is a candidate for "post-quantum cryptography", as it is immune to attacks using Shor's algorithm and — more generally — measuring coset states using Fourier sampling.

Filter by
Sorted by
Tagged with
2 votes
1 answer
52 views

What is $z$ in specification of Classic Mceliece?

I have a question about $z$ in Classic Mceliece Algorithm specification. I have no idea about this $z$! In parameter set kem/mceliece348864, Field polynomial $f(z) = z^{12} + z^3 + 1$. is this $z$ in ...
user avatar
  • 21
0 votes
0 answers
31 views

How can I change the McEliece main parameters?

I use the Bouncy Castle Crypto API to implement McEliece in Java. I have also managed to encrypt and decrypt a message and it works without any problems. When I use the debugger, I see that the ...
user avatar
1 vote
0 answers
20 views

What is the security implication of non-full-rank systematic matrix in McEliece cryptosystem?

The Classic McEliece cryptosystem has the following key generation procedure: Choose a field $\mathbb{F}_{2^m}$, an irreducible polynomial $g(x)$ of degree $t$, and $n$ field elements $\alpha_1, \...
user avatar
12 votes
1 answer
651 views

Number of bit-operations required for information set decoding attacks on code-based cryptosystems?

This question is potentially relevant to NIST post-quantum cryptography standards, involving code-based cryptosystems such as McEliece, BIKE and HQC. This paper estimates the concrete number of bit ...
user avatar
11 votes
0 answers
483 views

Requirements for security against multi-target attacks, for McEliece and other code-based cryptosystems?

This question is potentially relevant to NIST post-quantum cryptography standards, involving code-based cryptosystems such as McEliece, BIKE and HQC. For these cryptosystems, it seems that an attacker ...
user avatar
0 votes
0 answers
72 views

RTL solutions to Post quantum candidates

I am looking for RTL implementations of the PQC finalists for KEM (McEliece, Kyber, Saber and NTRU) Saber provides the following repository McEliece provides some code from their website, but as far ...
user avatar
2 votes
1 answer
70 views

What is the extra defense that McEliece 6960119 and 6688128 have that 8192128 does not?

From https://csrc.nist.gov/CSRC/media/Projects/post-quantum-cryptography/documents/round-3/official-comments/Classic-McEliece-round3-official-comment.pdf The 8192128 parameter set is bigger, but the ...
user avatar
1 vote
1 answer
139 views

What is the security strength of McEliece variants?

Please help me understand the security strength of McEliece variants prepared for Round 3. I looked at the specifications - https://classic.mceliece.org/nist/mceliece-20201010.pdf - it doesn't have ...
user avatar
  • 123
1 vote
1 answer
146 views

why Niederreiter cryptosystem is not a candidate in NIST PQC competition?

Seemingly, Niederreiter cryptosystem is faster than McEliece, and it can also be used to implement digital signature. Why isn't this scheme appear in NIST post quantum competition?
user avatar
2 votes
1 answer
152 views

How can the Stern's algorithm be used to attack McEliece?

I'm reading about the attacks of the McEliece cryptosystem. I needed to work out a lot of things because most descriptions I have found so far on the internet seems to be quite hand-wavy about the ...
user avatar
  • 280
2 votes
2 answers
270 views

Code used for McEliece cryptosystem

In the McEliece cryptosystem, is choice of the code known to the attacker? And if a structural attack succeeded and the attacker found the generator matrix of the code, how did the attacker decode the ...
user avatar
  • 113
3 votes
1 answer
137 views

How is QKD (Quantum Key Distribution) advantageous over McEliece/AES?

I don't understand the popularity of the idea of QKD (often coupled with OTP). From what I can tell, a quantum-safe key exchange algorithm like McEliece has just as much security while operating over ...
user avatar
  • 124
4 votes
1 answer
255 views

Is McEliece secure with non-binary Goppa codes?

A binary Goppa code with codewords of length $n$ bits that can fix $t$ errors with a polynomial over $GF(2^m)$ can encode $k = n - mt$ bits long data. That is one needs to add $mt$ check bits to fix $...
user avatar
  • 280
7 votes
1 answer
285 views

Why doesn't “Classic McEliece” need scrambling?

The original McEliece scheme uses two random matrices S and P to scramble the generator matrix and uses $\mathsf S·\mathsf G·\mathsf P$ as the public key. The Niederreiter variant also does about the ...
user avatar
  • 201
1 vote
1 answer
179 views

McEliece cryptosystem

There is something intriguing me about this cryptosystem. That is : Let $(S, G, P)$ be the secret key: $S$ : invertible matrix $G$ : generator matrix for some linear code $C$ $P$ : permutation ...
user avatar
  • 111
2 votes
1 answer
264 views

Why has the McEliece cryptosystem not gained much acceptance, but now is a candidate for post-quantum cryptography?

I understand that the McEliece cryptosystem is an asymmetric encryption algorithm developed in 1978 by Robert McEliece, almost around the same time RSA came about. Why has the McEliece cryptosystem ...
user avatar
  • 2,109
1 vote
0 answers
44 views

Why in the Rao-Nam private key version of McEliece scheme, P matrix is multiplied after adding error vector?

The private key version of McEliece known as Rao-Nam scheme, the encryption is done as c = (mSG + e)P. What is the need for applying permutation matrix on the error vector?
user avatar
  • 81
0 votes
1 answer
189 views

How can we prove that the scrambled G matrix in McEliece cryptosystem preserves the minimum distance properties of G matrix?

In McEliece cryptosystem, G matrix is scrambled using S and P so that scrambled G matrix is G' = SGP. Here G is the generator matrix of a linear code and after scrambling it is converted into another ...
user avatar
  • 81
1 vote
1 answer
282 views

Can the McEliece cryptosystem be used as an additively homomorphic encryption scheme?

Since the McEliece cryptosystem is linear, if matrix G is kept constant for different plaintexts, it can be used for linearly combining the corresponding ciphertexts. In that case, what are the ...
user avatar
  • 81
1 vote
1 answer
237 views

Code families in McEliece cryptosytem

What are the families of codes frequently used in McEliece cryptosystem or its variants? I know that binary Goppa codes were used in the original system but many codes with efficient decoding ...
user avatar
  • 111
1 vote
1 answer
139 views

McEliece parameter tuple (n, k, t) through BouncyCastles (m, t, poly) [closed]

I am using BouncyCastles Java API and want to use McEliece encryption. After browsing through various paper for finding good parameters (e.g. How to choose McEliece's parameters?) I am now having the ...
user avatar
  • 111
3 votes
1 answer
109 views

What are the properties of error vector used in symmetric McEliece cryptosystem?

In the symmetric version of McEliece cryptosystem, we are adding intentional error vector during encryption. During decryption, first, we cancel the effect of error vector and then multiply the ...
user avatar
1 vote
1 answer
149 views

key size of public key in McEliece

The length of public-key matrix in McEliece cryptosystem is $n \times k$. Then the key size is $\frac{n \times k}{8}$ bytes. But I find that the key size is $\frac{(n-k) \times k}{8}$ bytes. why ?
user avatar
  • 23
1 vote
1 answer
122 views

McEliece variants that support signatures

Besides the Niederreiter cryptosystem, are there any other variants that support digital signatures? Can any of them sign arbitrary signatures unlike the Niederreiter cryptosystem? What are the key ...
user avatar
  • 3,407
6 votes
1 answer
330 views

How is McEliece chosen plaintext secure?

Suppose a challenger creates a McEliece encryption system where there is a public key consisting of a matrix $G$ representing some linear code, and a number $t$ for the number of errors. Then the ...
user avatar
2 votes
1 answer
207 views

Efficiency of McEliece cryptography (ciphertext expansion)

Most of the sources say McEliece has never gained acceptance because of its large size of private and public keys. However I have never heard about the size (or length) of its ciphertext. ("...
user avatar
  • 165
3 votes
0 answers
315 views

How to choose McEliece's parameters?

At the time of this writing, there are 3 sources for parameters for the McEliece public-key cryptosystem out there. The first paper is the original McEliece paper ("A Public-Key Cryptosystem based on ...
user avatar
  • 44.7k
4 votes
1 answer
454 views

Implementing the Mceliece Encryption - making the Generator Matrix

I am working on an implementation of the Mceliece Encryption system (MCE) and the Niederreiter encryption system. I have been through the basics of finite fields, polynomial arithmetic and some coding ...
user avatar
  • 53
5 votes
1 answer
304 views

McEliece and cryptanalysis

What is the computational time to break McEliece on a quantum computer? I've seen that polynomial time algorithms exist, but for special conditions. What about the general case?
user avatar
  • 2,717
4 votes
2 answers
387 views

Basic attacks on McEliece; finding S and P

Take a McEliece cryptosystem with public generator matrix $G' = S G P$ where $G$ is a generator of a secret code with known fast decoding (not necessarily a Goppa code over $\mathbb{F}_2$), $S$ is ...
user avatar
7 votes
1 answer
2k views

McEliece information set decoding attack vulnerability

Wikipedia states that McEliece is open to "information set decoding attack". What is an "information set decoding attack" and how serious is the vulnerability? (is it just a matter of choosing proper ...
user avatar
  • 277
3 votes
2 answers
1k views

McEliece key size

There's a lot of references about McEliece key size being the barrier for proper usage of the algorithm, exactly (or roughly) how large are the keys?
user avatar
  • 277
11 votes
1 answer
232 views

Is the Couvreur et al. polynomial time attack on McEliece practical?

There's a new e-print out on arXiv titled "A Polynomial Time Attack against Algebraic Geometry Code Based Public Key Cryptosystems" by Alain Couvreur, Irene Márquez-Corbella and Ruud Pellikaan: "We ...
user avatar
  • 121
4 votes
1 answer
219 views

What is the impact of the Goppa code distinguisher on the CFS and McEliece?

What is the impact of the distinguisher for the high-rate Goppa codes (as published in "A Distinguisher for High Rate McEliece Cryptosystems") on the CFS signature scheme and the McEliece/Niederreiter ...
user avatar
  • 41
2 votes
1 answer
435 views

McEliece Public Key Encryption

The definition of Public Key Encryption(PKE) say that: A PKE scheme is a triple of probabilistic polynomial time algorithm (PPT) (Gen,Enc,Dec). The definition of PPT say: In complexity theory, ...
user avatar
  • 2,581
1 vote
1 answer
148 views

Is there any restriction in using lossless compression algorithms for huge key sizes?

I'm studying McEliece and Multivariate Public Key cryptographic systems. The main problem here is the huge key size. Is there any restriction in using lossless compression algorithms to fix this ...
user avatar
  • 2,581
0 votes
1 answer
157 views

Sematically Secure McEliece

I am read the Lemma 2 (pp13) in the paper "Kazukuni Kobara and Hideki Imai: Semantically Secure McEliece Public-Key Cryptosystems –Conversions for McEliece PKC– (PKC 2001)". Related to the question "...
user avatar
  • 2,581
2 votes
0 answers
139 views

PKC McEliece + $S$ + $P$ [closed]

I am trying implement the McEliece crytosystem in SAGE. My question is How I will be able to choose the appropriate matrix $S$ and $P$?. I ask this because when I trying obtain the vector $\hat{m}=mS$ ...
user avatar
  • 2,581
12 votes
1 answer
605 views

Efficient decoding of irreducible binary Goppa codes and the role of matrix P in McEliece cryptosystem

If we assume that the support for an irreducible binary Goppa code $\gamma_1, ..., \gamma_n$ is publicly known, when is it possible to efficiently decode the code? I know it's possible if one knows ...
user avatar
  • 121
3 votes
1 answer
208 views

McEliece for streaming data

Under the assumption that there exists a real-world implementation of the McEliece scheme, could it be applied to streaming data as is? By that I mean in 'block cipher mode'? I've read that McEliece ...
user avatar
  • 31
11 votes
4 answers
1k views

Is key size the only barrier to the adoption of the McEliece cryptosystem, or is it considered broken/potentially vulnerable?

A recent paper showed that the McEliece cryptosystem is not, unlike RSA and other cryptosystems, weakened as drastically by quantum computing because strong Fourier sampling cannot solve the hidden ...
user avatar