Key Recovery Attack on McNie Based on Low Rank Parity Check Codes and Its Reparation

Abstract

Recently, Galvez et al. submitted McNie, a new public key encryption scheme to NIST as a candidate for the standard of post-quantum cryptography. They claimed that their parameters achieve 128-bit security with small key size by using Quasi-Cyclic Low Rank Parity Check codes (QC-LRPC) and block circulant matrices as the public key and secret key for the encryption. However, McNie based on QC-LRPC has several limitations in its design. In addition, Gaborit suggested an attack against the McNie encryption, which reduces the security levels of Galvez et al.’s proposals. Moreover, McNie based on LRPC codes has decryption failure. We propose a key recovery attack which recovers the secret key of their encryption of the claimed security level for all the proposed parameters. Even Galvez et al. revised their parameters against Gaborit’s attack, we are still able to recover the secret key for the revised parameters by our key recovery attack. We propose a new McNie encryption based on Gabidulin codes with appropriate choices of secret key. Our McNie based on Gabidulin codes has error free decryption.