1

I noticed that, when deriving a Classic McEliece public key from a private key, randomness is required, and also that this randomness is normally provided at once, during key pair generation.

I'm guessing it's not usual to ever generate additional public keys "after the fact".

I'm further guessing that if you did so, and published more than 1 public key for the same private key, and decrypted messages encrypted with these various public keys, and reported KEM decapsulation failures back to the senders, you might compromise your key or your communications in some way.

What does the threat model for this (ab)use-case actually look like?

0 Answers0