3

At the time of this writing, there are 3 sources for parameters for the McEliece public-key cryptosystem out there.

The first paper is the original McEliece paper ("A Public-Key Cryptosystem based on Algebraic Coding Theory" by McEliece), which only specifies $(n,k,t)=(1024,524,50)$, which is known to be broken as of today with an effort of around $2^{60}$ in "Attacking and defending the McEliece cryptosystem" by Bernstein, Lange and Peters (2008).

The next source is the exact same paper that broke McEliece, by Bernstein, Lange and Peters. They propose $(1632,1269,33)$ (80-bit), $(2960,2288,56)$ (128-bit) and $(6624,5129,118)$ (256-bit) as $(n,k,t)$.

"Selecting Parameters for Secure McEliece-based Cryptosystems" by Niebuhr , Meziani, Bulygin, Buchmann, as of 2010, proposes new sets of parameters, based on Lenstra-Verheul-Style modelling. The authors also mention the above paper, but only for their attack. They propose $(1702,1219,45)$ (80-bits) and (computed by myself with same parameters) $(3807,2891,77)$ (128-bits).

So you may note that there's some difference between those recommended parameters. The difference between the public keys of the two 80-bit sets is 230,000 bits, so here comes my question:

Why is there this difference in the parameters and which ones should rather be used?


SEJPM
  • 45,967
  • 7
  • 99
  • 205

0 Answers0