Constant-time decoding of Gabidulin codes and their generalizations with application to RQC

2026-07-22

AI Summary

This work addresses a critical gap in rank-metric cryptography: the absence of constant-time decoding implementations for Gabidulin codes, which renders schemes like RQC vulnerable to side-channel attacks. The paper presents the first constant-time decoding algorithm for augmented Gabidulin (AG) codes, achieving quadratic time complexity by introducing zero-column-extended Gabidulin codes and a constant-time q-polynomial left division technique. This approach is integrated into a new variant, RQC-Block-MS-AG, which maintains ciphertext and key sizes approximately one-quarter those of HQC while outperforming the original RQC in efficiency. Although roughly four times slower than HQC, the proposed scheme significantly improves the trade-off between security and practicality, thereby filling a key void in secure implementations of rank-metric cryptosystems.

Abstract

Gabidulin codes are a rank metric analog of Reed-Solomon codes. Although these codes are used in different very efficient rank-based cryptosystems like the RQC cryptosystem or the Loidreau cryptosystem, there was no constant-time implementation of Gabidulin codes, when having a constant-time implementation is crucial for real-life development of cryptosystems. In this paper, we propose the first constant-time decoding algorithm of Augmented Gabidulin (AG) codes, a simple variation on Gabidulin codes where one adds zero columns to Gabidulin codes, and which contains the case of Gabidulin codes. These AG codes are used in practice in the most efficient variations of the RQC cryptosystem. We prove that AG code decoding can be achieved with quadratic complexity. We further present a constant-time algorithm for the left division of $q$-polynomials along with a complete description of the AG code decoding procedure. These algorithms are integrated into the RQC-Block-MS-AG scheme, and we evaluate the performance of our implementation through benchmarks. Our results show that our implementation outperforms the original RQC, though it remains approximately four times slower than HQC. However, it achieves ciphertexts and key sizes about four times smaller, highlighting an appealing trade-off between performance and compactness.

Problem

• constant-time decoding
• Gabidulin codes
• rank metric codes
• post-quantum cryptography
• RQC cryptosystem

Innovation

• constant-time decoding
• Gabidulin codes
• rank metric codes
• q-polynomial division
• RQC cryptosystem