On the design and security of Lee metric McEliece cryptosystems

Recently, Horlemann-Trautmann and Weger (Adv Math Commun, https://​doi.​org/​10.​3934/​amc.​2020089, 2020) proposed a general framework for a Quaternary McEliece cryptosystem over the ring \({\mathbb {Z}}_4\), and generalized the construction over the ring \({\mathbb {Z}}_{p^m}\) where p is a prime integer. By considering the Lee metric, the public key size for the McEliece cryptosystems can be substantially smaller than their counterparts in the Hamming metric. Furthermore, the hardness of the McEliece cryptosystems over \({\mathbb {Z}}_{p^m}\) is based on the Lee Syndrome Decoding problem, which was shown to be NP-complete. This paper aims to analyze the design and security of the Lee metric McEliece cryptosystem over \({\mathbb {Z}}_{p^m}\) in the Lee metric. We derive some necessary conditions for the quaternary codes used in the Lee metric McEliece cryptosystem, and show that the theoretical quaternary codes proposed in (Adv Math Commun, https://​doi.​org/​10.​3934/​amc.​2020089, 2020) do not exist. Furthermore, we propose a plaintext recovery attack on the Lee metric McEliece cryptosystem over \({\mathbb {Z}}_{p^m}\), when the minimum Lee distance of the underlying codes with certain structures is greater than twice the Lee weight of the error. Our plaintext recovery attack is applicable to the cryptosystems over \({\mathbb {Z}}_{p^m}\) when \(m>1\). We apply our plaintext recovery attack on the Quaternary McEliece cryptosystem, and manage to recover partial plaintext of length \(k_1\) within \(O \left( 2^{\min \{ k_1, 0.0473 n\}} \right) \) operations, where n is the length of ciphertext. Hence, the proposed theoretical parameters for the Quaternary McEliece over \({\mathbb {Z}}_4\) in (Adv Math Commun, https://​doi.​org/​10.​3934/​amc.​2020089, 2020) do not achieve 128-bit security, as we can recover the partial plaintext within 0.591 s. This also implies that the use of quaternary codes in the McEliece cryptosystem may not reduce the public key size significantly. Furthermore, for some parameters of the Lee metric McEliece cryptosystems over \({\mathbb {Z}}_4\), our plaintext recovery attack can be more efficient than the Lee-Brickell’s and Stern’s Information Set Decoding Algorithm over \({\mathbb {Z}}_4\).