arXiv subjects

Alain Couvreur

Publications and source records attributed to Alain Couvreur.

At least 19 recordsLinked to original sources

arXiv2026

A $q$-analogue of the rational normal curve and linearized Reed-Solomon codes

The relationship between linear codes in the Hamming metric and projective algebraic varieties has led to deep interactions between coding theory and algebraic geometry, with classical examples such as Reed-Solomon codes and the rational normal curve. On the other hand, the sum-rank metric has recently gained attention due to applications in network coding, distributed storage, and post-quantum cryptography, with linearized Reed-Solomon codes emerging as optimal constructions. Despite recent advances, their structural and geometric properties are still not fully understood, and existing distinguishers remain limited. In this paper, we develop a geometric framework for linearized Reed-Solomon codes by considering a $q$-analogue of the rational normal curve. This yields a geometric characterization for certain parameter choices and reveals that the corresponding sets of points satisfy unexpectedly many $(q+1)$-degree hypersurface conditions. Our approach extends Schur-product-based techniques from the Hamming and rank-metric settings to the sum-rank metric case. Finally, we study the Hilbert function of the associated coordinate ring, providing a detailed description of its behavior and identifying its regularity, which also sheds new light on Gabidulin codes.

cs.IT↗

arXiv2026

Decoding Algorithms for Tensor Codes

Tensor codes are a generalisation of matrix codes. Such codes are defined as subspaces of order-r tensors for which the ambient space is endowed with the tensor-rank as a metric. A class of these codes was introduced by Roth, who also outlined a decoding algorithm for low tensor-rank errors that can be generalised to an algorithm with exponential complexity in the decoding radius. They may be viewed as a generalisation of the well-known Delsarte-Gabidulin-Roth maximum rank distance codes. We study a generalised class of these codes. We investigate their properties and outline decoding techniques for different metrics that leverage their tensor structure. We first consider a fibre-wise decoding approach, as each fibre of a codeword corresponds to a Gabidulin codeword. We then give a generalisation of Loidreau-Overbeck's decoding method that corrects errors with properties constrained by the dimensions of the slice spaces and fibre spaces. The metrics we consider are bounded from above by the tensor-rank metric, and therefore these algorithms also decode tensor-rank weight errors.

cs.IT↗

arXiv2026

Maximal quadrics over finite fields and minimal codewords of projective Reed-Muller codes

We study the classification of minimal codewords of projective Reed-Muller codes of order $2$. This problem is equivalent to identifying quadrics over finite fields whose set of rational points is maximal with respect to the inclusion. We prove that except one particular case over $\mathbb{F}_2$, any two absolutely irreducible quadrics whose sets of rational points are contained within one another should be equal as projective varieties. We deduce a precise characterisation of the minimal codewords of projective Reed-Muller codes of order $2$ and further give their exact number for each possible weight.

cs.IT↗

arXiv2025

Recursive decoding of binary rank Reed-Muller codes and Plotkin construction for matrix codes

In 2021, Augot, Couvreur, Lavauzelle and Neri introduced a new class of rank metric codes which can be regarded as rank metric counterparts of Reed-Muller codes. Given a finite Galois extension $\mathbb{L} / \mathbb{K}$, these codes are defined as some specific $\mathbb{L}$-subspaces of the twisted group algebra $\mathbb{L} [\textrm{G}]$. We investigate the decoding of such codes in the "binary" case, \emph{i.e.,} when $\textrm{G} = (\mathbb{Z}/2\mathbb{Z})^m$. Our approach takes its inspiration from the decoding of Hamming metric binary Reed-Muller codes using their recursive Plotkin "$(u ~|~ u+v)$" structure. If our recursive algorithm restricts to a specific subclass of rank metric Reed-Muller codes, its asymptotic complexity beats that of the recently proposed decoding algorithm for arbitrary rank metric Reed-Muller codes based on Dickson matrices. Also, this decoder is of completely different nature and leads a natural rank metric counterpart of the Plotkin construction. To illustrate this, we also propose a generic Plotkin-like construction for matrix rank metric codes with an associate decoder, which can be applied to any pair of codes equipped with an efficient decoder.

cs.IT↗

arXiv2025

MIRANDA: short signatures from a leakage-free full-domain-hash scheme

We present $\mathsf{Miranda}$, the first family of full-domain-hash signatures based on matrix codes. This signature scheme fulfils the paradigm of Gentry, Peikert and Vaikuntanathan ($\mathsf{GPV}$), which gives strong security guarantees. Our trapdoor is very simple and generic: if we propose it with matrix codes, it can actually be instantiated in many other ways since it only involves a subcode of a decodable code (or lattice) in a unique decoding regime of parameters. Though $\mathsf{Miranda}$ signing algorithm relies on a decoding task where there is exactly one solution, there are many possible signatures given a message to sign and we ensure that signatures are not leaking information on their underlying trapdoor by means of a very simple procedure involving the drawing of a small number of uniform bits. In particular $\mathsf{Miranda}$ does not use a rejection sampling procedure which makes its implementation a very simple task contrary to other $\mathsf{GPV}$-like signatures schemes such as $\mathsf{Falcon}$ or even $\mathsf{Wave}$. We instantiate $\mathsf{Miranda}$ with the famous family of Gabidulin codes represented as spaces of matrices and we study thoroughly its security (in the EUF-CMA security model). For~$128$ bits of classical security, the signature sizes are as low as~$90$ bytes and the public key sizes are in the order of~$2.6$ megabytes.

cs.CR↗

arXiv2025

Highway to Hull: An Algorithm for Solving the General Matrix Code Equivalence Problem

The matrix code equivalence problem consists, given two matrix spaces $\mathcal{C},\mathcal{D} \subset \mathbb{F}_q^{m\times n}$ of dimension $k$, in finding invertible matrices $P\in\mathrm{GL}_m(\mathbb{F}_q)$ and $Q\in\mathrm{GL}_n(\mathbb{F}_q)$ such that $\mathcal{D}=P\mathcal{C} Q^{-1}$. Recent signature schemes such as MEDS and ALTEQ relate their security to the hardness of this problem. Recent works by Narayanan, Qiao and Tang on the one hand and by Ran and Samardjiska on the other hand tackle this problem. The former is restricted to the ``cubic'' case $k = m =n$ and succeeds in $\widetilde{\mathcal{O}}(q^{\frac k 2})$ operations. The latter is an algebraic attack on the general problem whose complexity is not fully understood and which succeeds only on $\mathcal{O}(1/q)$ instances. We present a novel algorithm which solves the problem in the general case. Our approach consists in reducing the problem to the matrix code conjugacy problem, \emph{i.e.} the case $P=Q$. For the latter problem, similarly to the permutation code equivalence problem in Hamming metric, a natural invariant based on the \emph{Hull} of the code can be used. Next, the equivalence of codes can be deduced using a usual list collision argument. For $k=m=n$, our algorithm achieves the same time complexity as Narayanan \emph{et al.} but with a lower space complexity. Moreover, ours extends to a much broader range of parameters.

cs.CR↗

arXiv2025

Decoding rank metric Reed-Muller codes

In this article, we investigate the decoding of the rank metric Reed--Muller codes introduced by Augot, Couvreur, Lavauzelle and Neri in 2021. These codes are defined from Abelian Galois extensions extending the construction of Gabidulin codes over arbitrary cyclic Galois extensions. We propose a polynomial time algorithm that rests on the structure of Dickson matrices, works on any such code and corrects any error of rank up to half the minimum distance.

cs.IT↗

arXiv2024

On the structure of the Schur squares of Twisted Generalized Reed-Solomon codes and application to cryptanalysis

Twisted generalized Reed-Solomon (TGRS) codes constitute an interesting family of evaluation codes, containing a large class of maximum distance separable codes non-equivalent to generalized Reed-Solomon (GRS) ones. Moreover, the Schur squares of TGRS codes may be much larger than those of GRS codes with same dimension. Exploiting these structural differences, in 2018, Beelen, Bossert, Puchinger and Rosenkilde proposed a subfamily of Maximum Distance Separable (MDS) Twisted Reed-Solomon (TRS) codes over $\mathbb{F}_q$ with $\ell$ twists $q \approx n^{2^{\ell}}$ for McEliece encryption, claiming their resistance to both Sidelnikov Shestakov attack and Schur products--based attacks. In short, they claimed these codes to resist to classical key recovery attacks on McEliece encryption scheme instantiated with Reed-Solomon (RS) or GRS codes. In 2020, Lavauzelle and Renner presented an original attack on this system based on the computation of the subfield subcode of the public TRS code. In this paper, we show that the original claim on the resistance of TRS and TGRS codes to Schur products based--attacks is wrong. We identify a broad class of codes including TRS and TGRS ones that is distinguishable from random by computing the Schur square of some shortening of the code. Then, we focus on the case of single twist (i.e., $\ell = 1$), which is the most efficient one in terms of decryption complexity, to derive an attack. The technique is similar to the distinguisher-based attacks of RS code-based systems given by Couvreur, Gaborit, Gauthier-Uma\~na, Otmani, Tillich in 2014.

cs.IT↗

arXiv2024

Freiman's $3k-4$ Theorem for Function Fields

Freiman's $3k-4$ Theorem states that if a subset $A$ of $k$ integers has a Minkowski sum $A+A$ of size at most $3k-4$, then it must be contained in a short arithmetic progression. We prove a function field analogue that is also a generalisation: it states that if $K$ is a perfect field and if $S\supset K$ is a vector space of dimension $k$ inside an extension $F/K$ in which~$K$ is algebraically closed, and if the $K$-vector space generated by all products of pairs of elements of $S$ has dimension at most $3k-4$, then $K(S)$ is a function field of small genus, and $S$ is of small codimension inside a Riemann-Roch space of $K(S)$.

math.NT↗

arXiv2024

MinRank Gabidulin encryption scheme on matrix codes

The McEliece scheme is a generic frame which allows to use any error correcting code of which there exists an efficient decoding algorithm to design an encryption scheme by hiding the generator matrix code. Similarly, the Niederreiter frame is the dual version of the McEliece scheme, and achieves smaller ciphertexts. We propose a generalization of the McEliece frame and the Niederreiter frame to matrix codes and the MinRank problem, that we apply to Gabidulin matrix codes (Gabidulin rank codes considered as matrix codes). The masking we consider consists in starting from a rank code C, to consider a matrix version of C and to concatenate a certain number of rows and columns to the matrix codes version of the rank code C and then apply to an isometry for matric codes. The security of the schemes relies on the MinRank problem to decrypt a ciphertext, and the structural security of the scheme relies on a new problem EGMC-Indistinguishability problem that we introduce and that we study in detail. The main structural attack that we propose consists in trying to recover the masked linearity over the extension field which is lost during the masking process. Overall, starting from Gabidulin codes we obtain a very appealing tradeoff between the size of ciphertext and the size of the public key. For 128b of security we propose parameters ranging from ciphertext of size 65 B (and public keys of size 98 kB) to ciphertext of size 138B (and public key of size 41 kB). Our new approach permits to achieve better trade-off between ciphertexts and public key than the classical McEliece scheme. Our new approach permits to obtain an alternative scheme to the classic McEliece scheme, to obtain very small ciphertexts, with moreover smaller public keys than in the classic McEliece scheme. For 256 bits of security, we can obtain ciphertext as low as 119B, or public key as low as 87kB.

cs.CR↗

arXiv2023

A new approach based on quadratic forms to attack the McEliece cryptosystem

We bring in here a novel algebraic approach for attacking the McEliece cryptosystem. It consists in introducing a subspace of matrices representing quadratic forms. Those are associated with quadratic relationships for the component-wise product in the dual of the code used in the cryptosystem. Depending on the characteristic of the code field, this space of matrices consists only of symmetric matrices or skew-symmetric matrices. This matrix space is shown to contain unusually low-rank matrices (rank $2$ or $3$ depending on the characteristic) which reveal the secret polynomial structure of the code. Finding such matrices can then be used to recover the secret key of the scheme. We devise a dedicated approach in characteristic $2$ consisting in using a Gröbner basis modeling that a skew-symmetric matrix is of rank $2$. This allows to analyze the complexity of solving the corresponding algebraic system with Gröbner bases techniques. This computation behaves differently when applied to the skew-symmetric matrix space associated with a random code rather than with a Goppa or an alternant code. This gives a distinguisher of the latter code family. We give a bound on its complexity which turns out to interpolate nicely between polynomial and exponential depending on the code parameters. A distinguisher for alternant/Goppa codes was already known [FGO+11]. It is of polynomial complexity but works only in a narrow parameter regime. This new distinguisher is also polynomial for the parameter regime necessary for [FGO+11] but contrarily to the previous one is able to operate for virtually all code parameters relevant to cryptography. Moreover, we use this matrix space to find a polynomial time attack of the McEliece cryptosystem provided that the Goppa code is distinguishable by the method of [FGO+11] and its degree is less than $q-1$, where $q$ is the alphabet size of the code.

cs.CR↗

arXiv2023

An extension of Overbeck's attack with an application to cryptanalysis of Twisted Gabidulin-based schemes

In this article, we discuss the decoding of Gabidulin and related codes from a cryptographic point of view, and we observe that these codes can be decoded solely from the knowledge of a generator matrix. We then extend and revisit Gibson and Overbeck attacks on the generalized GPT encryption scheme (instantiated with the Gabidulin code) for different ranks of the distortion matrix. We apply our attack to the case of an instantiation with twisted Gabidulin codes.

cs.CR↗

arXiv2023

Correlated Pseudorandomness from the Hardness of Quasi-Abelian Decoding

Secure computation often benefits from the use of correlated randomness to achieve fast, non-cryptographic online protocols. A recent paradigm put forth by Boyle $\textit{et al.}$ (CCS 2018, Crypto 2019) showed how pseudorandom correlation generators (PCG) can be used to generate large amounts of useful forms of correlated (pseudo)randomness, using minimal interactions followed solely by local computations, yielding silent secure two-party computation protocols (protocols where the preprocessing phase requires almost no communication). An additional property called programmability allows to extend this to build N-party protocols. However, known constructions for programmable PCG's can only produce OLE's over large fields, and use rather new splittable Ring-LPN assumption. In this work, we overcome both limitations. To this end, we introduce the quasi-abelian syndrome decoding problem (QA-SD), a family of assumptions which generalises the well-established quasi-cyclic syndrome decoding assumption. Building upon QA-SD, we construct new programmable PCG's for OLE's over any field $\mathbb{F}_q$ with $q>2$. Our analysis also sheds light on the security of the ring-LPN assumption used in Boyle $\textit{et al.}$ (Crypto 2020). Using our new PCG's, we obtain the first efficient N-party silent secure computation protocols for computing general arithmetic circuit over $\mathbb{F}_q$ for any $q>2$.

cs.CR↗

arXiv2023

Improved decoding of symmetric rank metric errors

We consider the decoding of rank metric codes assuming the error matrix is symmetric. We prove two results. First, for rates $<1/2$ there exists a broad family of rank metric codes for which any symmetric error pattern, even of maximal rank can be corrected. Moreover, the corresponding family of decodable codes includes Gabidulin codes of rate $<1/2$. Second, for rates $>1/2$, we propose a decoder for Gabidulin codes correcting symmetric errors of rank up to $n-k$. The two mentioned decoders are deterministic and worst case.

cs.IT↗

arXiv2023

Codes and modular curves

These lecture notes have been written for a course at the Algebraic Coding Theory (ACT) summer school 2022 that took place in the university of Zurich. The objective of the course propose an in-depth presentation of the proof of one of the most striking results of coding theory: Tsfasman Vlăduţ Zink Theorem, which asserts that for some prime power $q$, there exist sequences of codes over $\mathbb{F}_q$ whose asymptotic parameters beat random codes.

math.NT↗

arXiv2022

A proof of the Brill-Noether method from scratch

In 1874 Brill and Noether designed a seminal geometric method for computing bases of Riemann-Roch spaces. From then, their method has led to several algorithms, some of them being implemented in computer algebra systems. The usual proofs often rely on abstract concepts of algebraic geometry and commutative algebra. In this paper we present a short self-contained and elementary proof that mostly needs Newton polygons, Hensel lifting, bivariate resultants, and Chinese remaindering.

math.AG↗

arXiv2022

Recovering or Testing Extended-Affine Equivalence

Extended Affine (EA) equivalence is the equivalence relation between two vectorial Boolean functions $F$ and $G$ such that there exist two affine permutations $A$, $B$, and an affine function $C$ satisfying $G = A \circ F \circ B + C$. While the problem has a simple formulation, it is very difficult in practice to test whether two functions are EA-equivalent. This problem has two variants: {\em EA-partitioning} deals with partitioning a set of functions into disjoint EA-equivalence classes, and \emph{EA-recovery} is about recovering the tuple $(A,B,C)$ if it exists. In this paper, we present a new algorithm that efficiently solves the EA-recovery problem for quadratic functions. Although its worst-case complexity occurs when dealing with APN functions, it supersedes, in terms of performance, all previously known algorithms for solving this problem for all quadratic functions and in any dimension, even in the case of APN functions. This approach is based on the Jacobian matrix of the functions, a tool whose study in this context can be of independent interest. The best approach for EA-partitioning in practice mainly relies on class invariants. We provide an overview of the known invariants along with a new one based on the \emph{ortho-derivative}. This new invariant is applicable to quadratic APN functions, a specific type of functions that is of great interest, and of which tens of thousands need to be sorted into distinct EA-classes. Our ortho-derivative-based invariant is very fast to compute, and it practically always distinguishes between EA-inequivalent quadratic APN functions.

cs.CR↗

arXiv2022

How arithmetic and geometry make error correcting codes better

This note completes a talk given at the conference Curves over Finite Fields: past, present and future celebrating the publication the book {\em Rational Points on Curves over Finite Fields by J.-P. Serre and organised at Centro de ciencias de Benasque in june 2021. It discusses a part of the history of algebraic geometry codes together with some of their recent applications. A particular focus is done on the "multiplicative" structure of these codes, i.e. their behaviour with respect to the component wise product. Some open questions are raised and discussed.

math.AG↗