Extended Gabidulin-Kronecker Product Codes and Their Application to Cryptosystems
Zhe Sun, Terry Shue Chien Lau, Mengying Zhao, Zimeng Zhou, Fang-Wei Fu
TL;DR
This work studies Extended Gabidulin-Kronecker (EGK) codes and their application to rank-metric cryptography. It derives tight minimum distance bounds for Gabidulin-Kronecker codes in two regimes, introduces Extended GK codes with a direct-codeword decoding algorithm that achieves zero failure within the error-correcting bound, and harnesses EGK to build three compact, zero-failure RQC variants. The proposed schemes deliver substantially smaller public keys while maintaining strong security against known BRSD/NHRSD/RSL/NHRSL attacks, and include KEM versions for IND-CCA2 security. Collectively these results advance efficient, provably secure rank-metric cryptosystems and motivate exploring further code compositions and cryptographic primitives based on EGK codes.
Abstract
In this paper, we initiate the study of Extended Gabidulin codes with a Kronecker product structure and propose three enhanced variants of the Rank Quasi-Cyclic (RQC) (Melchor et.al., IEEE IT, 2018) cryptosystem. First, we establish precise bounds on the minimum rank distance of Gabidulin-Kronecker product codes under two distinct parameter regimes. Specifically, when $n_{1}=k_{1}$ and $n_{2}=m<n_{1}n_{2}$, the minimum rank distance is exactly $n_{2}-k_{2}+1$. This yields a new family of Maximum Rank Distance (MRD) codes, which are distinct from classical Gabidulin codes. For the case of $k_{1}\leq n_{1},k_{2}\leq n_{2},n_{1}n_{2}\leq m$, the minimum rank distance $d$ of Gabidulin-Kronecker product codes satisfies a tight upper and lower bound, i.e., $n_{2}-k_{2}+1 \leq d \leq (n_{1}-k_{1}+1)(n_{2}-k_{2}+1)$. Second, we introduce a new class of decodable rank-metric codes, namely Extended Gabidulin-Kronecker product (EGK) codes, which generalize the structure of Gabidulin-Kronecker product (GK) codes. We also propose a decoding algorithm that directly retrieves the codeword without recovering the error vector, thus improving efficiency. This algorithm achieves zero decoding failure probability when the error weight is within its correction capability. Third, we propose three enhanced variants of the RQC cryptosystem based on EGK codes, each offering a distinct trade-off between security and efficiency. For 128-bit security, all variants achieve significant reductions in public key size compared to the Multi-UR-AG (Bidoux et.al., IEEE IT, 2024) while ensuring zero decryption failure probability--a key security advantage over many existing rank-based schemes.