[Paper Review] Smaller Keys for the McEliece Cryptosystem: A Convolutional Variant with GRS Codes

Paulo César de Almeida, Miguel Beltrá+2 more|arXiv (Cornell University)|Apr 14, 2021

Coding theory and cryptography4 citations

TL;DR

This paper proposes a novel variant of the McEliece cryptosystem that uses convolutional encoding with Generalized Reed-Solomon (GRS) codes to significantly reduce public key size while maintaining security. By replacing the traditional permutation matrix with a polynomial matrix that applies weight-two masking, the scheme obscures the algebraic structure of GRS codes, resisting known structural attacks such as Schur product distinguishers, and achieves key sizes up to 10x smaller than classical McEliece for equivalent security levels.

ABSTRACT

In this paper we present a variant of the McEliece cryptosystem that possesses several interesting properties, including a reduction of the public key for a given security level. In contrast to the classical McEliece cryptosystems, where block codes are used, we propose the use of a convolutional encoder to be part of the public key. The permutation matrix is substituted by a polynomial matrix whose coefficient matrices have columns with weight zero or at least weight two. This allows the use of Generalized Reed-Solomon (GRS) codes which translates into shorter keys for a given security level. Hence, the private key is constituted by a generator matrix of a GRS code and two polynomial matrices containing large parts generated completely at random. In this setting the message is a sequence of messages instead of a single block message and the errors are added throughout the sequence. We discuss possible structural and ISD attacks to this scheme. We conclude presenting the key sizes obtained for different parameters and estimating the computational cost of encryption and decryption process.

Motivation & Objective

• To address the key size problem in code-based cryptography, particularly in the McEliece cryptosystem, which remains a major barrier to practical deployment.
• To overcome the vulnerability of GRS codes to structural attacks due to their strong algebraic properties, despite their advantage in enabling shorter keys.
• To leverage the randomness of convolutional codes to mask the structure of GRS codes, thereby improving security without sacrificing efficiency.
• To design a system where the public key is derived from a GRS code via a polynomial encoder with random components, ensuring resistance to distinguisher attacks.
• To evaluate the computational cost of encryption and decryption and compare key sizes and security levels with existing code-based cryptosystems.

Proposed method

• The scheme uses a polynomial convolutional encoder $ G'(D) = S(D) G P(D) $, where $ G $ is a generator matrix of a GRS code, and $ S(D) $, $ P(D) $ are polynomial matrices with random blocks and weight-two column masks.
• The message is transmitted as a stream of vectors over time, with errors added across the sequence, enabling convolutional encoding instead of block encoding.
• The masking via $ S(D) $ and $ P(D) $ ensures that each coefficient matrix has columns of weight zero or at least two, preventing structural distinguishers like the Schur product attack.
• The private key consists of the GRS generator matrix $ G $, and the random polynomial matrices $ S(D) $, $ P(D) $, which are used for decoding.
• Decryption involves first applying the inverse of the polynomial transformation, then decoding the GRS code using efficient algorithms such as Berlekamp-Massey.
• The system is designed so that no obvious subcodes with small support can be computed, enhancing resistance to structural and ISD-type attacks.

Experimental results

Research questions

• RQ1 Can GRS codes be securely used in the McEliece cryptosystem by masking their algebraic structure through a convolutional encoder?
• RQ2 Does the use of polynomial matrices with weight-two masking prevent distinguisher attacks based on the Schur product, such as those targeting GRS codes?
• RQ3 To what extent can public key size be reduced by combining GRS codes with convolutional encoding, compared to classical or block-code variants?
• RQ4 What is the computational cost of encryption and decryption in this new scheme, and how does it compare to existing code-based systems?
• RQ5 Can the random components in $ S(D) $ and $ P(D) $ be constructed efficiently while preserving security and avoiding low-weight codeword vulnerabilities?

Key findings

• For a 128-bit security level, the proposed scheme achieves a public key size of 114,736 bits (202×142), which is approximately 10x smaller than the classic McEliece with Goppa codes (1,086,259 bits).
• At a 256-bit security level, the public key size is 1,302,400 bits (220×148), significantly smaller than the 8,373,911 bits required by the classic McEliece with $ n=8192 $.
• The work factor against information set decoding (ISD) attacks is estimated at $ 2^{257.92} $ for the 202×142 parameter set, indicating strong resistance to ISD.
• The scheme resists known structural attacks, including Schur product distinguishers, due to the weight-two masking and random components in $ S(D) $ and $ P(D) $.
• Ciphertext sizes are larger than in standard schemes—e.g., 45,248 bits for the 202×142 parameter set—due to the convolutional nature of the encoding.
• Despite larger ciphertexts, the decryption complexity is manageable at $ ilde{O}(s n^2 + s^3 k^3) $, and the impact of the sequence length $ s $ is mitigated by smaller $ n $ and $ k $.