# Questions tagged [mceliece]

McEliece cryptosystem is an asymmetric encryption algorithm and is a candidate for "post-quantum cryptography", as it is immune to attacks using Shor's algorithm and — more generally — measuring coset states using Fourier sampling.

44 questions
Filter by
Sorted by
Tagged with
35 views

### Optimization of the McEliece crypto system

In the normal McEliece proposal, the public key G' = SGP is used, with S beeing non-singular, G Generator Matrix and P permutation Matrix In the White Paper on McEliece with Binary Goppa Codes by ...
29 views

### How to choose rank(A) independant columns of matrix A efficiently

Is there a better way than brute forcing (choose $k=\mathrm{rank}(A)$ first columns - test the determinant, if determinant = 0 choose new column set - there are $\binom nk$ many possibilities which is ...
75 views

### Decrypting McEliece if security assumptions fail

1. G known - how to decrypt Referring to this question: Basic attacks on McEliece; finding S and P (nobody answered) Take a McEliece cryptosystem with public generator matrix $G′=SGP$ where $G$ is a ...
31 views

### McEliece cryptosystem based on Goppa codes and Sidelnikov-Shestakov attack

Hello I am trying to understand why the Sidelnikov-Shestakov attack doesn't work for McEliece cryptosystem based on Goppa codes whereas it works when based of GRS codes. I understood how the attack ...
73 views

### What is $z$ in specification of Classic Mceliece?

I have a question about $z$ in Classic Mceliece Algorithm specification. I have no idea about this $z$! In parameter set kem/mceliece348864, Field polynomial $f(z) = z^{12} + z^3 + 1$. is this $z$ in ...
1 vote
27 views

330 views

### Why doesn't “Classic McEliece” need scrambling?

The original McEliece scheme uses two random matrices S and P to scramble the generator matrix and uses $\mathsf S·\mathsf G·\mathsf P$ as the public key. The Niederreiter variant also does about the ...
1 vote
210 views

### McEliece cryptosystem

There is something intriguing me about this cryptosystem. That is : Let $(S, G, P)$ be the secret key: $S$ : invertible matrix $G$ : generator matrix for some linear code $C$ $P$ : permutation ...
305 views

### Why has the McEliece cryptosystem not gained much acceptance, but now is a candidate for post-quantum cryptography?

I understand that the McEliece cryptosystem is an asymmetric encryption algorithm developed in 1978 by Robert McEliece, almost around the same time RSA came about. Why has the McEliece cryptosystem ...
1 vote
50 views

### Why in the Rao-Nam private key version of McEliece scheme, P matrix is multiplied after adding error vector?

The private key version of McEliece known as Rao-Nam scheme, the encryption is done as c = (mSG + e)P. What is the need for applying permutation matrix on the error vector?
207 views

### How can we prove that the scrambled G matrix in McEliece cryptosystem preserves the minimum distance properties of G matrix?

In McEliece cryptosystem, G matrix is scrambled using S and P so that scrambled G matrix is G' = SGP. Here G is the generator matrix of a linear code and after scrambling it is converted into another ...
1 vote
322 views

### Can the McEliece cryptosystem be used as an additively homomorphic encryption scheme?

Since the McEliece cryptosystem is linear, if matrix G is kept constant for different plaintexts, it can be used for linearly combining the corresponding ciphertexts. In that case, what are the ...
1 vote
252 views

### Code families in McEliece cryptosytem

What are the families of codes frequently used in McEliece cryptosystem or its variants? I know that binary Goppa codes were used in the original system but many codes with efficient decoding ...
1 vote
148 views

### McEliece parameter tuple (n, k, t) through BouncyCastles (m, t, poly) [closed]

I am using BouncyCastles Java API and want to use McEliece encryption. After browsing through various paper for finding good parameters (e.g. How to choose McEliece's parameters?) I am now having the ...
127 views

### What are the properties of error vector used in symmetric McEliece cryptosystem?

In the symmetric version of McEliece cryptosystem, we are adding intentional error vector during encryption. During decryption, first, we cancel the effect of error vector and then multiply the ...
1 vote
172 views

### key size of public key in McEliece

The length of public-key matrix in McEliece cryptosystem is $n \times k$. Then the key size is $\frac{n \times k}{8}$ bytes. But I find that the key size is $\frac{(n-k) \times k}{8}$ bytes. why ?
1 vote
132 views

### McEliece variants that support signatures

Besides the Niederreiter cryptosystem, are there any other variants that support digital signatures? Can any of them sign arbitrary signatures unlike the Niederreiter cryptosystem? What are the key ...
399 views

### How is McEliece chosen plaintext secure?

Suppose a challenger creates a McEliece encryption system where there is a public key consisting of a matrix $G$ representing some linear code, and a number $t$ for the number of errors. Then the ...
234 views

### Efficiency of McEliece cryptography (ciphertext expansion)

Most of the sources say McEliece has never gained acceptance because of its large size of private and public keys. However I have never heard about the size (or length) of its ciphertext. ("...
364 views

### How to choose McEliece's parameters?

At the time of this writing, there are 3 sources for parameters for the McEliece public-key cryptosystem out there. The first paper is the original McEliece paper ("A Public-Key Cryptosystem based on ...
518 views

### Implementing the Mceliece Encryption - making the Generator Matrix

I am working on an implementation of the Mceliece Encryption system (MCE) and the Niederreiter encryption system. I have been through the basics of finite fields, polynomial arithmetic and some coding ...
345 views

### McEliece and cryptanalysis

What is the computational time to break McEliece on a quantum computer? I've seen that polynomial time algorithms exist, but for special conditions. What about the general case?
437 views

### Basic attacks on McEliece; finding S and P

Take a McEliece cryptosystem with public generator matrix $G' = S G P$ where $G$ is a generator of a secret code with known fast decoding (not necessarily a Goppa code over $\mathbb{F}_2$), $S$ is ...
2k views

### McEliece information set decoding attack vulnerability

Wikipedia states that McEliece is open to "information set decoding attack". What is an "information set decoding attack" and how serious is the vulnerability? (is it just a matter of choosing proper ...
1k views

### McEliece key size

There's a lot of references about McEliece key size being the barrier for proper usage of the algorithm, exactly (or roughly) how large are the keys?
247 views

### Is the Couvreur et al. polynomial time attack on McEliece practical?

There's a new e-print out on arXiv titled "A Polynomial Time Attack against Algebraic Geometry Code Based Public Key Cryptosystems" by Alain Couvreur, Irene Márquez-Corbella and Ruud Pellikaan: "We ...
238 views

### What is the impact of the Goppa code distinguisher on the CFS and McEliece?

What is the impact of the distinguisher for the high-rate Goppa codes (as published in "A Distinguisher for High Rate McEliece Cryptosystems") on the CFS signature scheme and the McEliece/Niederreiter ...
450 views

### McEliece Public Key Encryption

The definition of Public Key Encryption(PKE) say that: A PKE scheme is a triple of probabilistic polynomial time algorithm (PPT) (Gen,Enc,Dec). The definition of PPT say: In complexity theory, ...
1 vote
153 views

### Is there any restriction in using lossless compression algorithms for huge key sizes?

I'm studying McEliece and Multivariate Public Key cryptographic systems. The main problem here is the huge key size. Is there any restriction in using lossless compression algorithms to fix this ...
171 views

### Sematically Secure McEliece

I am read the Lemma 2 (pp13) in the paper "Kazukuni Kobara and Hideki Imai: Semantically Secure McEliece Public-Key Cryptosystems –Conversions for McEliece PKC– (PKC 2001)". Related to the question "...
145 views

### PKC McEliece + $S$ + $P$ [closed]

I am trying implement the McEliece crytosystem in SAGE. My question is How I will be able to choose the appropriate matrix $S$ and $P$?. I ask this because when I trying obtain the vector $\hat{m}=mS$ ...
650 views

### Efficient decoding of irreducible binary Goppa codes and the role of matrix P in McEliece cryptosystem

If we assume that the support for an irreducible binary Goppa code $\gamma_1, ..., \gamma_n$ is publicly known, when is it possible to efficiently decode the code? I know it's possible if one knows ... 