7

The original McEliece scheme uses two random matrices S and P to scramble the generator matrix and uses $\mathsf S·\mathsf G·\mathsf P$ as the public key. The Niederreiter variant also does about the same thing.

However, in the Classic McEliece proposal (based on Niederreiter in spite of its name), they don't do any of that. They are giving lots of details as to why the two other modifications by Niederreiter (msg is the error instead of codeword, transmitting the Generator matrix in systematic form) don't reduce security, but they don't detail why the can just remove this scrambling. Why can they? (Can they?)

References:

Patriot
  • 3,162
  • 3
  • 20
  • 66
Marian
  • 201
  • 1
  • 3

1 Answers1

1

It seems to me that the answer is highly likely to be as follows. I only had a quick look, so buyer beware:

So, instead of the recovered permuted error vector $\sigma(e)$ ( $e$ is the plaintext, in Niederreiter and Classic McEliece) needing to be scrambled by the opponent to get the unpermuted error vector $e$, the recovery of the correct error vector (for the party holding the private key) is checked by hashing the recovered error vector $e'$ and comparing to the hashed value $h(e)$ included in the plaintext.

The opponent's additional work factor is now the work required to find a hash preimage of the right length (which may or may not be the right $e$).

See the talk here by Tanja Lange on the project website.

kodlu
  • 25,146
  • 2
  • 30
  • 63