A New Version of McEliece PKC Based on Convolutional Codes

Polynomial Time Attack on Wild McEliece over Quadratic Extensions

“…Several proposals which suggested to replace binary Goppa codes with alternative families did not meet a similar fate. They all focus on a specific class of codes equipped with a decoding algorithm: generalized Reed-Solomon codes (GRS for short) [Nie86] or large subcodes of them [BL05], Reed-Muller codes [Sid94], algebraic geometry codes [JM96], LDPC and MDPC codes [BBC08,MTSB13] or convolutional codes [LJ12,GSJB14]. Most of them were successfully cryptanalyzed [SS92, Wie10, MS07, FM08, OTD10, CGG + 14, LT13,CMCP14b,COTG15].…”

An Efficient Attack of a McEliece Cryptosystem Variant Based on Convolutional Codes

“…The proposal with convolutional codes made in [LJ12] falls into this thread of research. What makes this new scheme interesting is the fact that its secret generator matrix contains large parts which are generated completely at random and has no algebraic structure as in other schemes such as generalized Reed-Solomon codes, algebraic geometry codes, Goppa codes or Reed-Muller codes.…”

“…In [LJ12] two schemes are given. The first one simply considers as the secret key the generator matrix of a time varying tail-biting convolutional code.…”

“…Afterwards several code families have been suggested to replace the Goppa codes in this scheme: generalized Reed-Solomon codes (GRS) [Nie86] or subcodes of them [BL05], Reed-Muller codes [Sid94], algebraic geometry codes [JM96], LDPC codes [BBC08], MDPC codes [MTSB12] or more recently convolutional codes [LJ12]. Some of these schemes allow to reduce the public key size compared to the original McEliece cryptosystem while keeping the same level of security against generic decoding algorithms.…”

“…Deciphering an encrypted message can then be done because for the concrete parameters example provided in [LJ12], algorithms for decoding general linear codes can be used in this case to decode the Goppa code successfully. This attack works successfully on the parameters proposed in [LJ12] and needs only a few hours of computation. It should be possible to change the parameters of the scheme to avoid this kind of attack.…”