text:
\section{Introduction}

Public-key cryptography is the foundation for establishing secure communication between multiple parties.
Traditional public-key algorithms such as RSA are based on the hardness of factoring large numbers or the discrete logarithm problem, but can be attacked in polynomial time once a capable quantum computer exists. Code-based public-key cryptosystems are considered to be post-quantum secure, but compared to RSA or elliptic curve cryptography their crucial drawback is the significantly larger key size.
Recently, the \emph{National Institute of Standards and Technology} (NIST) has initiated a standardization progress for post-quantum secure public-key algorithms \cite{NIST}. The currently being evaluated Round 2 of the competition consists of 17 code-based and lattice-based public-key encryption algorithms.
The NIST competition and its systems attract a lot of attention and show the importance of designing post-quantum secure public-key encryption algorithms.

The \emph{Faure--Loidreau} (FL) code-based cryptosystem~\cite{faure2006new,LoidreauHabitilation-RankMetric_2007} is based on the problem of reconstructing linearized polynomials and can be seen as linearized equivalent of the (broken) Augot--Finiasz cryptosystem \cite{AugotFiniasz-PKC-PolyReconstruction_2003}.
While the Augot--Finiasz cryptosystem is closely connected to (list) decoding Reed--Solomon codes, the
FL cryptosystem is connected to (list) decoding Gabidulin codes, a special class of rank-metric codes~\cite{Gabidulin_TheoryOfCodes_1985}.
In contrast to McEliece-type (or Niederreiter-type) cryptosystems, where the public key is a \emph{matrix}, in the FL system, the public key is only a \emph{vector}, resulting in a much smaller key size.
At the time when the FL cryptosystem was designed, it was only \emph{conjectured} that Gabidulin codes cannot be list decoded efficiently. As this was \emph{proven} in the last years for many families of Gabidulin codes \cite{Wachterzeh_BoundsListDecodingRankMetric_IEEE-IT_2013,RavivWachterzeh_GabidulinBounds_journal,ListDec_RankMetric_2019}, the FL system could be a very promising post-quantum secure public-key cryptosystem.
However, the recent structural attack by Gaborit, Otmani and Tal\'e Kalachi \cite{Gaborit2018-FL-Attack} can recover an alternative public key in cubic time complexity.

{In this paper, a new system is presented which is based on the original FL system, and therefore relies on the proven hardness of list decoding Gabidulin codes, but makes the attack from \cite{Gaborit2018-FL-Attack} impossible.}
Our contributions are as follows. First, a new coding-theoretic interpretation of the original FL system is given and an alternative decryption algorithm is proposed. Second, we show that the public key can be seen as a corrupted codeword of an \emph{interleaved Gabidulin code}. We prove that the failure condition of the GOT attack~\cite{Gaborit2018-FL-Attack} on the public key is equivalent to the failure condition of decoding the public key as a corrupted interleaved Gabidulin codeword.
This observation enables us to design a new code-based public-key encryption scheme, as well as a corresponding key encapsulation mechanism (KEM), based on the hardness of list and interleaved decoding Gabidulin codes: \textsf{LIGA}.
In {\textsf{LIGA}}, we choose the public key in a way that the corresponding interleaved decoder is guaranteed to fail, and thus, the system is secured against the attack from~\cite{Gaborit2018-FL-Attack}.
We also prove that the public-key encryption version of {\textsf{LIGA}} is IND-CPA secure in the standard model and the KEM version is IND-CCA2 secure in the random oracle model, both under hardness assumptions on problems related to list and interleaved decoding of Gabidulin codes. We analyze possible (exponential-time) attacks on these hard problems, provide sets of parameters for {\textsf{LIGA}}, and compare them amongst others to NIST proposals (RQC, ROLLO, BIKE, McEliece).

The structure of this paper is as follows. In Section~\ref{sec:preliminaries}, the notation is introduced and definitions are given.
In Section~\ref{sec:fl_system}, the key generation of the original FL system is shown and a new coding-theoretic interpretation of the ciphertext and the public key is derived. After summarizing the attack from~\cite{Gaborit2018-FL-Attack}, we prove its equivalence to decoding the public key as an interleaved Gabidulin code.
Based on this equivalence, the new system {\textsf{LIGA}} is proposed in Section~\ref{sec:liga} and
its IND-CPA and IND-CCA2 security are proven in Section~\ref{sec:semantic}.
A security analysis of our system is given in Section~\ref{sec:sec_analysis}. In Section~\ref{sec:parameters}, example parameters for security levels $128$, $192$, and $256$ bit are proposed and compared to the NIST proposals RQC \cite{melchor2019rqc}, ROLLO \cite{melchor2019rollo}, BIKE \cite{aragon2019bike}, ClassicMcEliece \cite{bernstein2019mceliece} and Loidreau's McEliece-like system from \cite{Loidreau2017-NewRankMetricBased}. Conclusions are given in Section~\ref{sec:conclusion}.

Parts of these results have been presented at the \emph{IEEE International Symposium on Information Theory 2018} \cite{wachterzeh2018repairing}. The content of this journal paper contains various new results that were not shown in \cite{wachterzeh2018repairing}. In particular, in this paper,\\[-3ex]
\begin{itemize}
	\item we generalize {\textsf{LIGA}}'s Key Generation algorithm, i.e., the choice of the $\vec{z}_i$'s (the interleaved errors in the public key) is more flexible now (in \cite{wachterzeh2018repairing}, $\vec{z}_1 = \vec{z}_2 = \dots = \vec{z}_u$),
	\item we present a KEM/DEM version of {\textsf{LIGA}},
	\item the encryption and decryption complexity is analyzed,
	\item we show a new way to realize the decryption by error-erasure decoding,
	\item we identify formal problems in the rank metric on which the security of {\textsf{LIGA}} relies and prove the IND-CPA/CCA2 security of the KEM/DEM version under the assumption that some of these problems are hard,
	\item we analyze new exponential-time attacks on these problems,
	\item we update the choice of parameters.
\end{itemize}

It is important to note that all these results go well beyond what is known about and what has been analyzed for the original FL system.

\section{Preliminaries}\label{sec:preliminaries}
\subsection{Notations}
Let $q$ be a power of a prime and let $\ensuremath{\mathbb{F}_q}$ denote the finite field of order $q$. Then, $\ensuremath{\mathbb{F}_{q^m}}$ and $\ensuremath{\mathbb{F}_{q^{mu}}}$ denote extension fields of $\ensuremath{\mathbb{F}_q}$ of order $q^m$ and $q^{mu}$, respectively.
We use $\ensuremath{\mathbb{F}_q}^{m \times n}$ to denote the set of all $m\times n$ matrices over $\ensuremath{\mathbb{F}_q}$ and $\ensuremath{\mathbb{F}_{q^m}}^n =\ensuremath{\mathbb{F}_{q^m}}^{1 \times n}$ for the set of all row vectors of length $n$ over $\ensuremath{\mathbb{F}_{q^m}}$.
Further, we use another field extension $\mathbb{F}_{q^{mu}}$ with $u>1$.
Thus, $\ensuremath{\mathbb{F}_q} \subseteq \ensuremath{\mathbb{F}_{q^m}} \subseteq \ensuremath{\mathbb{F}_{q^{mu}}}$.

For a field $\mathbb{F}$, the vector space that is spanned by $\vec{v}_1,\hdots,\vec{v}_l \in \mathbb{F}^n$ is denoted by
\begin{equation*}
\langle\vec{v}_1,\hdots,\vec{v}_l\rangle_{\mathbb{F}} := \Bigg\{\sum_{i=1}^{l}a_i\vec{v}_i \, : \, \ a_i \in \mathbb{F} \Bigg\}.
\end{equation*}

Denote the set of integers $[a,b] = \{i: a \leq i \leq b\}$. Rows and columns of $m\times n$-matrices are indexed by $1,\dots, m$ and $1,\dots, n$, where $A_{i,j}$ is the element in the $i$-th row and $j$-th column of the matrix $\vec{A}$. Further,
\begin{equation*}
  \vec{A}_{[a,b]} :=
  \begin{pmatrix}
    A_{1,a} & \hdots & A_{1,b} \\
    \vdots & \ddots & \vdots \\
    A_{m,a} & \hdots & A_{m,b} \\
  \end{pmatrix}.
\end{equation*}
  By $\rank_q(\vec{A})$ and $\rank_{q^m}(\vec{A})$, we denote the rank of a matrix $\vec{A}$ over $\ensuremath{\mathbb{F}_q}$, respectively $\ensuremath{\mathbb{F}_{q^m}}$.
Let $(\gamma_1,\gamma_2,\dots,\gamma_{u})$ be an ordered basis of $\ensuremath{\mathbb{F}_{q^{mu}}}$ over $\ensuremath{\mathbb{F}_{q^m}}$. By utilizing the vector space isomorphism $\ensuremath{\mathbb{F}_{q^{mu}}} \cong \ensuremath{\mathbb{F}_{q^m}}^u$, we can relate each vector $\mathbf a \in \ensuremath{\mathbb{F}_{q^{mu}}}^n$ to a matrix $\mathbf A \in \ensuremath{\mathbb{F}_{q^m}}^{u \times n}$ according to
\begin{align*}
\extsmallfield_{\boldsymbol{\gamma}}:\ensuremath{\mathbb{F}_{q^m}}^{n} &\rightarrow \ensuremath{\mathbb{F}_q}^{m \times n}\label{eq:mapping_smallfield}\\
  \vec{a} = (a_1,\hdots,a_n) &\mapsto \vec{A} =
                               \begin{pmatrix}
                                 A_{1,1} & \hdots & A_{1,n} \\
                                 \vdots & \ddots & \vdots \\
                                 A_{m,1} &  \hdots & A_{m,n} \\
                               \end{pmatrix},
\end{align*}
where $\boldsymbol{\gamma} = (\gamma_1,\gamma_2,\dots,\gamma_{u})$ and
\begin{equation*}
\quad a_j = \sum_{i=1}^{m} A_{i,j} \gamma_i, \quad \forall j \in [1,n].
\end{equation*}
The trace operator of a vector $\vec{a}\in\ensuremath{\mathbb{F}_{q^{mu}}}$ to $\ensuremath{\mathbb{F}_{q^m}}$ is defined by
\begin{align*}
  \Tr:\ensuremath{\mathbb{F}_{q^{mu}}}^{n} &\rightarrow \ensuremath{\mathbb{F}_{q^m}}^{n}\\
  \vec{a} = (a_1,a_2,\hdots,a_n) &\mapsto \Bigg( \sum_{i=0}^{m-1} a_1^{q^i}, \sum_{i=0}^{m-1} a_2^{q^i},\hdots, \sum_{i=0}^{m-1} a_n^{q^i} \Bigg).
\end{align*}
A dual basis $(\gamma_1^*,\gamma_2^*,\dots,\gamma_{u}^*)$ to  $(\gamma_1,\gamma_2,\dots,\gamma_{u})$ is a basis that fulfills
\begin{equation*}
  \Tr(\gamma_i \gamma_j^{*}) =
  \begin{cases}
    1 ~\text{if $i=j$} \\
    0 ~\text{else}
  \end{cases},
\end{equation*}
where $i,j \in [1,u]$. Note that a dual basis always exists.

Denote by $\Mooremat{s}{q}{\vec{a}} \in \ensuremath{\mathbb{F}_{q^m}}^{s \times n}$ the $s \times n$ Moore matrix for a vector $\vec{a} = (a_1,a_2,\dots,a_n) \in \ensuremath{\mathbb{F}_{q^m}}^n$, i.e.,
\begin{equation*}
\Mooremat{s}{q}{\vec{a}} := \MoormatExplicit{a}{s}{n}.
\end{equation*}
If $a_1, a_2,\dots$, $a_{n}\in \ensuremath{\mathbb{F}_{q^m}}$ are linearly independent over $\ensuremath{\mathbb{F}_q}$, then $\rank_{q^m}(\Mooremat{s}{q}{\vec{a}})=\min\{s,n\}$, cf.~\cite[Lemma 3.15]{Lidl-Niederreiter:FF1996}. This definition can also be extended to matrices by
\begin{equation*}
\Mooremat{s}{q}{\vec{A}} := \MoormatExplicitMat{A}{s}{n}{l},
\end{equation*}
where $\vec{A} \in \ensuremath{\mathbb{F}_{q^m}}^{l \times n}$.

The Gaussian binomial coefficient is denoted by
\begin{equation*}
  \quadbinom{s}{r} :=
  \begin{cases}
    \dfrac{ (1-q^s)(1-q^{s-1})\cdots(1-q^{s-r+1})}{(1-q)(1-q^2)\cdots(1-q^{r})} &\text{ for $r \leq s$} \\
    0 &\text{ for $r> s$},
    \end{cases}
\end{equation*}
where $s$ and $r$ are non-negative integers.

Let $\mathcal{X}$ be a set. When $x$ is drawn uniformly at random from the set $\mathcal{X}$, we denote it by $x \xleftarrow{\$} \mathcal{X}$. Further, be $x \gets y$ we mean that we assign $y$ to $x$.

\subsection{Rank-Metric Codes and Gabidulin Codes}\label{ssec:preliminaries_rank-metric_codes}
The \textit{rank norm} $\rank_q(\vec{a})$ is the rank of the matrix representation $\vec{A}\in \ensuremath{\mathbb{F}_q}^{m \times n}$ over $\mathbb{F}_{q}$.
The rank distance between \vec{a} and \vec{b} is the rank of the difference of the two matrix representations, i.e.,
\begin{equation*}
d_{\textup{R}}(\vec{a},\vec{b}) := \rank_q(\vec{a}-\vec{b}) = \rank_q(\vec{A}-\vec{B}).
\end{equation*}
An $\codelinearRank{n,k,d}$ code \mycode{C} over $\ensuremath{\mathbb{F}_{q^m}}$ is a linear rank-metric code, i.e., it is a linear subspace of $\ensuremath{\mathbb{F}_{q^m}}^n$ of dimension $k$ and minimum rank distance
\begin{equation*}
d := \min_{\substack{{\vec{a},\vec{b}} \in \mycode{C}\\ \vec{a} \neq \vec{b}}}
\big\lbrace d_{\fontmetric{R}}(\vec{a},\vec{b}) = \rank_q(\vec{a}-\vec{b}) \big\rbrace.
\end{equation*}
For linear codes with $n \leq m$, the Singleton-like upper bound \cite{Delsarte_1978,Gabidulin_TheoryOfCodes_1985} implies that $d \leq n-k+1$.
If $d=n-k+1$, the code is called a \emph{maximum rank distance} (MRD) code.

Gabidulin codes \cite{Gabidulin_TheoryOfCodes_1985} are a special class of rank-metric codes and can be defined by their generator matrices.
\begin{definition}[Gabidulin Code \cite{Gabidulin_TheoryOfCodes_1985}]
	A linear $\Gabcode{n}{k}$ code over $\ensuremath{\mathbb{F}_{q^m}}$ of length $n \leq m$
	and dimension $k$ is defined by its $k \times n$ generator matrix
	\begin{equation*}
	\mathbf G_{\mycode{G}} = \Mooremat{k}{q}{g_1,g_2,\dots,g_n},
	\end{equation*}
	where $\vec{g}=(g_1,g_2, \dots, g_{n}) \in \ensuremath{\mathbb{F}_{q^m}}^n$ and $\rank_q(\vec{g}) = n$.
\end{definition}
In~\cite{Gabidulin_TheoryOfCodes_1985}, it is shown that Gabidulin codes are MRD codes, i.e., $d=n-k+1$.

For a short description on decoding of Gabidulin codes, denote by $\vec{C}_\mathcal{G}\in \ensuremath{\mathbb{F}_q}^{m \times n}$ the transmitted codeword (i.e., the matrix representation of $\vec{c}_\mathcal{G}\in \ensuremath{\mathbb{F}_{q^m}}^n$) of a $\Gabcode{n}{k}$ code that is corrupted by an additive error $\mathbf E \in \ensuremath{\mathbb{F}_q}^{m \times n}$. At the receiver side, only the received matrix $\mathbf R \in \ensuremath{\mathbb{F}_q}^{m \times n}$, where $\mathbf R = \vec{C}_\mathcal{G}+ \mathbf E$, is known.
The channel might provide additional side information in the form of erasures:
\begin{itemize}
	\item $\varrho$ {row erasures} (in \cite{silva_rank_metric_approach} called "deviations") and
	\item $\gamma$ {column erasures} (in \cite{silva_rank_metric_approach} called "erasures"),
\end{itemize}
such that the received matrix can be decomposed into
\begin{equation}\label{eq:decomp_errrorerasures}
\vec{R}
=\vec{C}_\mathcal{G}+ \underbrace{\vec{A}^{(R)} \vec{B}^{(R)} + \vec{A}^{(C)} \vec{B}^{(C)} + \vec{E}}_{= \,\vec{E}_\mathrm{total}},
\end{equation}
where $\vec{A}^{(R)} \in \ensuremath{\mathbb{F}_q}^{m \times \varrho}$, $\vec{B}^{(R)} \in \ensuremath{\mathbb{F}_q}^{\varrho \times n}$,
$\vec{A}^{(C)} \in \ensuremath{\mathbb{F}_q}^{m \times \gamma}$, $\vec{B}^{(C)} \in \ensuremath{\mathbb{F}_q}^{\gamma\times n}$ are full-rank matrices, respectively, and $\vec{E}^{(E)} \in \ensuremath{\mathbb{F}_q}^{m \times n}$ is a matrix of rank $t$.
The decoder knows $\vec{R}$ and additionally $\vec{A}^{(R)}$ and $\vec{B}^{(C)}$.
Further, $t$ denotes the number of errors without side information.
The rank-metric error-erasure decoding algorithms from \cite{GabidulinPilipchuck_ErrorErasureRankCodes_2008,silva_rank_metric_approach,WachterzehZeh-ListUniqueErrorErasureInterpolationInterleavedGabidulin_DCC2014}
can then reconstruct $\vec{c}_\mathcal{G} \in \Gabcode{n}{k}$ with asymptotic complexity $\mathcal O(n^2)$ operations over $\ensuremath{\mathbb{F}_{q^m}}$, or in sub-quadratic complexity using the fast operations described in \cite{PuchingerWachterzeh-ISIT2016,puchinger2018fast}, if
\begin{equation}\label{eq:errorerasurecond}
2t + \varrho + \gamma \leq d-1 = n-k
\end{equation}
is fulfilled.

\subsection{{Interleaved Rank-Metric Codes}}\label{subsec:int-rank-codes}
Interleaved Gabidulin Codes are a code class for which efficient decoders are known that are able to correct w.h.p. random errors of rank larger than $\lfloor\frac{d-1}{2}\rfloor$.
\begin{definition} [Interleaved Gabidulin Codes~\cite{Loidreau_Overbeck_Interleaved_2006}]
A linear (vertically, homogeneous) interleaved Gabidulin code $\IntGabcode{u;n,k}$ over $\ensuremath{\mathbb{F}_{q^m}}$ of length $n \leq m$, dimension $k \leq n$, and interleaving order $u$ is defined by
\begin{equation*}
\IntGabcode{u;n,k} :=
\left\lbrace
\begin{pmatrix}
\vec{c}_{\mycode{G}}^{(1)}\\
\vec{c}_{\mycode{G}}^{(2)}\\
\vdots\\
\vec{c}_{\mycode{G}}^{(u)}
\end{pmatrix}
: \vec{c}_{\mycode{G}}^{(i)} \in \Gabcode{n}{k} , \forall i \in [1,u]
\right\rbrace.
\end{equation*}
\end{definition}
As a short-term notation, we also speak about a $u$-interleaved Gabidulin code.
When considering random errors of rank weight $t$, the code $\IntGabcode{u;n,k}$ can be decoded uniquely with high probability up to
$w \leq \lfloor \frac{u}{u+1}(n-k)\rfloor$ errors
\footnote{
	{In this setting, an ``error of weight $w$'' is a matrix in $\ensuremath{\mathbb{F}_{q^{mu}}}^n$ with $\ensuremath{\mathbb{F}_q}$-rank equal to $w$.}},
 cf.~\cite{Loidreau_Overbeck_Interleaved_2006,Sidorenko2011SkewFeedback,WachterzehZeh-ListUniqueErrorErasureInterpolationInterleavedGabidulin_DCC2014}.
However, it is well-known that there are many error patterns for which the known efficient decoders fail.
In fact, we can explicitly construct a large class of such errors as shown in the following lemma.

\begin{lemma}[Interleaved Decoding~{\cite{Loidreau_Overbeck_Interleaved_2006}, \cite{Sidorenko2011SkewFeedback}, \cite[p.~64]{Wachterzeh_DecodingBlockConvolutionalRankMetric_2013}}]\label{lem:interleaved-fail}
	Let $\vec{c}_i=\vec{x}_i \cdot \vec{G}_{\mathcal{G}}$.
	All known\footnote{i.e., the algorithms in \cite{Loidreau_Overbeck_Interleaved_2006,Sidorenko2011SkewFeedback}, and \cite[p.~64]{Wachterzeh_DecodingBlockConvolutionalRankMetric_2013}.} efficient decoders for $\IntGabcode{u;n,k}$ codes fail to correct an error $\vec{z}\in \ensuremath{\mathbb{F}_{q^{mu}}}^n$ with $\vec{z} = \sum_{i=1}^{u} \vec{z}_i\gamma_i^*$ and $\rank_q(\vec{z})=w$ if
	\begin{equation*}
	\rank_{q^m}
	\begin{pmatrix}
	\Mooremat{n-w-1}{q}{\vec{g}}\\
	\Mooremat{n-k-w}{q}{\vec{c}_1+\vec{z}_1}\\
	\Mooremat{n-k-w}{q}{\vec{c}_2+\vec{z}_2}\\
	\vdots\\
	\Mooremat{n-k-w}{q}{\vec{c}_u+\vec{z}_u}\\
	\end{pmatrix}
	< n-1.
	\end{equation*}
\end{lemma}
It is widely conjectured that there cannot be a decoder that decodes the error patterns of Lemma~\ref{lem:interleaved-fail} \emph{uniquely}.
Decoding these failing error patterns has been subject to intensive research since the Loidreau--Overbeck decoder \cite{Loidreau_Overbeck_Interleaved_2006} was found in 2006. In the Hamming metric, the equivalent problem for Reed--Solomon codes has been studied since 1997 \cite{krachkovsky1997decoding} and more than a dozen papers have dealt with decoding algorithms for these codes. None of these papers was able to give a polynomial-time decoding algorithm for the cases of Lemma~\ref{lem:interleaved-fail}.
It seems that all unique decoders \emph{have to fail} for the error patterns of Lemma~\ref{lem:interleaved-fail} since for these cases, there is no unique decision, i.e., more then one interleaved codeword lies in the ball of radius $w$ around the received word.

\section{Key Generation in the  Original Faure--Loidreau System}\label{sec:fl_system}
In this section, we recall the key generation algorithm of the original FL cryptosystem, we give a coding-theoretic interpretation of the original public key, and analyze the structural attack from \cite{Gaborit2018-FL-Attack}.
\subsection{The Original Algorithm}

Let $q,m,n,k,u,w,\ensuremath{t_{\mathsf{pub}}}$ be positive integers that fulfill the restrictions given in Table~\ref{tab:parameters} and are publicly known.
In the following, we consider the three finite fields $\ensuremath{\mathbb{F}_q}$, $\ensuremath{\mathbb{F}_{q^m}}$, and $\ensuremath{\mathbb{F}_{q^{mu}}}$, which are extension fields of each other, i.e.:
\begin{equation*}
\ensuremath{\mathbb{F}_q} \subseteq \ensuremath{\mathbb{F}_{q^m}} \subseteq \ensuremath{\mathbb{F}_{q^{mu}}}.
\end{equation*}
\begin{table*}
\caption{Summary of the Parameters}
\renewcommand{\arraystretch}{1.6}
\begin{center}
\begin{tabular}{c|l|l}
Name & Use & Restriction \\
\hline
$q$ & small field size & prime power \\
$m$ & extension degree & $1 \leq m$ \\
$n$ & code length & $n \leq m$ \\
$k$ & code dimension & $k < n$ \\
$u$ & extension degree & $2 \leq u < k$ \\
$w$ & error weight in public key & $\max \left\{n-k-\frac{k-u}{u-1}, \left\lfloor\frac{n-k}{2} \right\rfloor+1 \right\} \leq w < \frac{u}{u+2} (n-k)$ \\
$\ensuremath{t_{\mathsf{pub}}}$ & error weight in ciphertext & $\ensuremath{t_{\mathsf{pub}}} = \left\lfloor \frac{n-k-w}{2} \right\rfloor$ \\
$\ensuremath{\zeta}$ & \makecell[l]{$\ensuremath{\mathbb{F}_{q^m}}$-dimension of error vector \\ in the public key }& $\ensuremath{\zeta}< \frac{w}{n-k-w}\ $  {and $\ \zeta q^{\zeta w-m} \leq \tfrac{1}{2}$}
\end{tabular}
\end{center}
\label{tab:parameters}
\end{table*}
The original FL key generation is shown in Algorithm~\ref{alg:KeyGen}.
 \begin{algorithm}
 \DontPrintSemicolon
 \KwIn{Parameters $q,m,n,k,u,w$ as in Table~\ref{tab:parameters}}
 \KwOut{Secret key $\ensuremath{\mathsf{sk}}$, public key $\ensuremath{\mathsf{pk}}$}
 $\vec{g} \xleftarrow{\$} \{ \a \in \ensuremath{\mathbb{F}_{q^m}}^n \,:\, \rank_q(\a) = n \} $\\
 $\vec{x} \xleftarrow{\$} \{ \a \in \ensuremath{\mathbb{F}_{q^{mu}}}^k \,:\, \dim (\langle a_{k-u+1},\dots, a_k \rangle_{\ensuremath{\mathbb{F}_{q^m}}} ) = u  \}$  \\
 $\vec{s} \xleftarrow{\$} \{ \a \in \ensuremath{\mathbb{F}_{q^{mu}}}^w \,:\,\rank_{q} (\a) = w \}$ \label{line:keygen_s}\\
 $\vec{P} \xleftarrow{\$} \{ \vec{A} \in \ensuremath{\mathbb{F}_q}^{n\times n} : \rank_{q}(\vec{A}) = n  \}  $  \\
 $\mathbf G_{\mycode{G}} \gets \Mooremat{k}{q}{\vec{g}}$ \\
 $\vec{z} \gets (\vec{s} \ | \ \ensuremath{\mathbf{0}}) \cdot \vec{P}^{-1}$ \\
 $\ensuremath{\mathbf{k}_{\mathsf{pub}}} \gets \vec{x} \cdot \mathbf G_{\mycode{G}} + \vec{z}$ \label{line:encrypt_keygen} \\
 $\ensuremath{t_{\mathsf{pub}}} \gets \left\lfloor \frac{n-w-k}{2} \right \rfloor$\\
 \Return{$\ensuremath{\mathsf{sk}} = (\vec{x},\vec{P}_{[w+1,n]})$, $\ensuremath{\mathsf{pk}} = (\vec{g}, \ensuremath{\mathbf{k}_{\mathsf{pub}}})$}
 \caption{Original FL Key Generation}
 \label{alg:KeyGen}
 \end{algorithm}

\subsection{Coding-Theoretic Interpretation of the Original Public Key}\label{ssec:kpub_corrupted_interleaved_codeword}
The public key $\ensuremath{\mathbf{k}_{\mathsf{pub}}}$ of the FL system is a corrupted codeword of a $u$-interleaved Gabidulin code.
To our knowledge, this connection between the public key and interleaved Gabidulin codes has not been known before.
This interpretation is central to this paper and will be used in Section~\ref{sec:repair} to define the public key of {\textsf{LIGA}} such that is not vulnerable against the attacks from \cite{Gaborit2018-FL-Attack} and described in Section~\ref{sec:eff_attack}.

\begin{theorem}\label{thm:public_key_is_corrupted_interleaved_codeword}
Fix a basis $\vec{\gamma}$ of $\ensuremath{\mathbb{F}_{q^{mu}}}$ over $\ensuremath{\mathbb{F}_{q^m}}$. Let $\vec{\gamma}^*$ be a dual basis to $\vec{\gamma}$ and write $\ensuremath{\mathbf{k}_{\mathsf{pub}}} = \sum_{i=1}^{u} \ensuremath{\mathbf{k}_{\mathsf{pub}}}^{(i)}\gamma_i^*$. Then,
\begin{equation}
\begin{pmatrix}
\ensuremath{\mathbf{k}_{\mathsf{pub}}}^{(1)}\\
\ensuremath{\mathbf{k}_{\mathsf{pub}}}^{(2)}\\
\vdots\\
\ensuremath{\mathbf{k}_{\mathsf{pub}}}^{(u)}
\end{pmatrix}
=
\begin{pmatrix}
\vec{c}_{\mycode{G}}^{(1)}\\
\vec{c}_{\mycode{G}}^{(2)}\\
\vdots\\
\vec{c}_{\mycode{G}}^{(u)}
\end{pmatrix}
+\!
\begin{pmatrix}
\vec{z}_1\\
\vec{z}_2\\
\vdots\\
\vec{z}_u
\end{pmatrix}, \label{eq:kpub_as_corrupted_interleaved_codeword}
\end{equation}
where the $\vec{c}_{\mycode{G}}^{(i)} \in \ensuremath{\mathbb{F}_{q^m}}^n$ are codewords of the Gabidulin code $\mathcal{G}(n,k)$ with generator matrix $\vec{G}_\mathcal{G}$ and the $\vec{z}_i \in \ensuremath{\mathbb{F}_{q^m}}^n$ are obtained from the vector $\vec{z} \in \ensuremath{\mathbb{F}_{q^{mu}}}^n$ by $\vec{z} = \sum_{i=1}^{u} \vec{z}_i\gamma_i^*$.
\end{theorem}

\begin{proof}
Recall the definition of the public key
\begin{equation*}
\ensuremath{\mathbf{k}_{\mathsf{pub}}} = \vec{x} \cdot \mathbf G_{\mycode{G}} + \vec{z},
\end{equation*}
where $\vec{x} \in \ensuremath{\mathbb{F}_{q^{mu}}}^k$, $\vec{G}_{\mycode{G}} \in \ensuremath{\mathbb{F}_{q^m}}^{k\times n}$ is the generator matrix of a $\Gabcode{n}{k}$ code, and $\vec{z} \in \ensuremath{\mathbb{F}_{q^{mu}}}^n$ with $\rank_q(\vec{z})=w$.
Let $\vec{x} = \sum_{i=1}^{u} \vec{x}_i\gamma_i^*$, where the $\vec{x}_i$ have coefficients in $\ensuremath{\mathbb{F}_{q^m}}$.

Then, we obtain the following representation of the public key $\ensuremath{\mathbf{k}_{\mathsf{pub}}}$ as a $u \times n$ matrix in $\ensuremath{\mathbb{F}_{q^m}}$
\begin{equation*}
\begin{pmatrix}
\ensuremath{\mathbf{k}_{\mathsf{pub}}}^{(1)}\\
\ensuremath{\mathbf{k}_{\mathsf{pub}}}^{(2)}\\
\vdots\\
\ensuremath{\mathbf{k}_{\mathsf{pub}}}^{(u)}
\end{pmatrix}
=
\begin{pmatrix}
\vec{x}_1\\
\vec{x}_2\\
\vdots\\
\vec{x}_u
\end{pmatrix}\!\cdot \vec{G}_{\mycode{G}}
+\!
\begin{pmatrix}
\vec{z}_1\\
\vec{z}_2\\
\vdots\\
\vec{z}_u
\end{pmatrix}
=
\begin{pmatrix}
\vec{x}_1\cdot \vec{G}_{\mycode{G}}\\
\vec{x}_2\cdot \vec{G}_{\mycode{G}}\\
\vdots\\
\vec{x}_u\cdot \vec{G}_{\mycode{G}}
\end{pmatrix}
+\!
\begin{pmatrix}
\vec{z}_1\\
\vec{z}_2\\
\vdots\\
\vec{z}_u
\end{pmatrix}.
\end{equation*}
Since $\vec{x}_i \cdot \vec{G}_{\mycode{G}}$ is a codeword of a $\Gabcode{n}{k}$ code, $\forall i \in [1,u]$, the matrix representation of $\ensuremath{\mathbf{k}_{\mathsf{pub}}}$ can be seen as a codeword from an $\IntGabcode{u;n,k}$ code, corrupted by an error.
\qed
\end{proof}

Note that the error $(\vec{z}_1^\top,\dots,\vec{z}_u^\top)^\top$ in \eqref{eq:kpub_as_corrupted_interleaved_codeword} has $\ensuremath{\mathbb{F}_q}$-rank at most $w$ due to the structure of $\vec{z} = (\vec{s} \mid \vec{0}) \P^{-1}$.

\subsection{Efficient Key Recovery of the Original FL Key}\label{sec:eff_attack}
{The attack by \emph{Gaborit, Otmani and Tal\'e Kalachi} (GOT) on the original FL system in~\cite{Gaborit2018-FL-Attack} (see Algorithm~\ref{alg:got_attack} below) is an efficient structural attack which computes a valid private key of the FL system in cubic time when the public key fulfills certain conditions.} We recall this attack in the following and derive an alternative, equally powerful, attack based on interleaved decoding the public key, utilizing the observation of the previous subsection. We prove that the failure conditions of both attacks are equivalent.
The interleaved decoding attack does not have any advantage in terms of cryptanalysis compared to \cite{Gaborit2018-FL-Attack}, but enables us to exactly predict for which public keys both attacks work and for which the attacks fail.

\subsubsection{GOT Attack}
The key recovery in the GOT attack (Algorithm~\ref{alg:got_attack}) succeeds under the conditions of the following theorem.
 \begin{algorithm}
 \DontPrintSemicolon
 \KwIn{Public key $(\vec{g},\ensuremath{\mathbf{k}_{\mathsf{pub}}})$}
 \KwOut{Private key $(\vec{x},\vec{P})$}
Choose $\gamma_1,\dots,\gamma_u $ to be a basis of $\ensuremath{\mathbb{F}_{q^{mu}}}$ over $\ensuremath{\mathbb{F}_{q^m}}$ \\
$\ensuremath{\mathbf{k}_{\mathsf{pub}}}^{(i)} \gets\Tr(\gamma_i \ensuremath{\mathbf{k}_{\mathsf{pub}}})$ for all $i=1,\hdots,u$ \\
$\mathbf G_{\mycode{G}} \gets \Mooremat{k}{q}{\vec{g}}$ \\
Pick at random a non-zero vector $\widetilde{\vec{h}} \in \ensuremath{\mathbb{F}_{q^m}}^n$ such that
  \begin{equation*}
    \mathcal{M}_{n-w-k,q}
    \begin{pmatrix}
        \vec{G}_{\mycode{G}}\\
        \ensuremath{\mathbf{k}_{\mathsf{pub}}}^{(1)} \\
        \vdots \\
        \ensuremath{\mathbf{k}_{\mathsf{pub}}}^{(u)} \\
      \end{pmatrix}
      \cdot
    \widetilde{\vec{h}}^{\text{T}} = \vec{0}.
    \end{equation*} \\
Choose $\vec{P} \in \ensuremath{\mathbb{F}_q}^{n\times n}$ and $\vec{h}^{\prime}\in \ensuremath{\mathbb{F}_{q^m}}^{n-w}$ such that
$    \widetilde{\vec{h}} \big(\vec{P}^{-1} \big)^{\text{T}} = (\ \vec{0} \ | \ \vec{h}^{\prime})$
\\
Choose $\vec{x}$ such that
$    \vec{x} \vec{G}_{\mycode{G}} \vec{P}^{\prime} = \ensuremath{\mathbf{k}_{\mathsf{pub}}} \vec{P}^{\prime}$,
  where $\vec{P}^{\prime}=\vec{P}_{[w+1,n]} \in \ensuremath{\mathbb{F}_q}^{n \times (n-w)}$ \\
\Return{$(\vec{x},\vec{P})$}
 \caption{GOT Attack}
 \label{alg:got_attack}
 \end{algorithm}

\begin{theorem}[GOT Attack {\cite[Thm.~1]{Gaborit2018-FL-Attack}}]\label{thm:GOT-attack-success}
	Let $\gamma_1,\dots,\gamma_u \in \ensuremath{\mathbb{F}_{q^{mu}}}$ be a basis of $\ensuremath{\mathbb{F}_{q^{mu}}}$ over $\ensuremath{\mathbb{F}_{q^m}}$ and let $\vec{z}_i = \Tr(\gamma_i \vec{z})$, for $i=1,\dots u$.

	If the matrix $\vec{Z} \in \ensuremath{\mathbb{F}_{q^m}}^{u \times n}$ with $\vec{z}_1,\dots,\vec{z}_u$ as rows, satisfies
	\begin{equation*}
	\rank_{q^m} (\Mooremat{n-k-w}{q}{\vec{Z}}) = w,
	\end{equation*}
	then $(\vec{x}, \vec{z})$ can be recovered from $(\vec{G}_{\mycode{G}},\ensuremath{\mathbf{k}_{\mathsf{pub}}})$ with $\mathcal{O}(n^3)$ operations in $\ensuremath{\mathbb{F}_{q^{mu}}}$ by using Algorithm~\ref{alg:got_attack}.
\end{theorem}

If the key is generated by Algorithm~\ref{alg:KeyGen}, the GOT attack breaks the original FL system \emph{with high probability}.

\subsubsection{Interleaved Decoding Attack}\label{subsec:int-attack}
Recall from Theorem~\ref{thm:public_key_is_corrupted_interleaved_codeword} that the public key $\ensuremath{\mathbf{k}_{\mathsf{pub}}}$ is a corrupted interleaved codeword.
Based on this observation we will derive a structural attack on the original FL system to which we refer as \emph{Interleaved Decoding Attack} in the following. We prove that interleaved decoding and the GOT attack \emph{fail} (i.e, do not provide any information) for the \emph{same public keys}.
The idea is to decode $\ensuremath{\mathbf{k}_{\mathsf{pub}}}$ in an interleaved Gabidulin code.
Since $w \leq  \frac{u}{u+1}(n-k)$, such a decoder will return $\vec{x}$ with high probability, but fail in certain cases, see Section~\ref{subsec:int-rank-codes}.

Since $\rank_{q^m}(\Mooremat{n-w-1}{q}{\vec{g}})=n-w-1$, the interleaved decoder fails if (compare Lemma~\ref{lem:interleaved-fail}):
\begin{equation}\label{eq:fail-interleaved}
\rank _{q^m} \big(\ensuremath{\tilde{\vec{Z}}} \big) := \ensuremath{\varphi}< w,
\end{equation}
where
\begin{equation}\label{eq:matrix-repair}
  \ensuremath{\tilde{\vec{Z}}} =
  \begin{pmatrix}
\Mooremat{n-k-w}{q}{\vec{z}_1}\\
\Mooremat{n-k-w}{q}{\vec{z}_2}\\
\vdots\\
\Mooremat{n-k-w}{q}{\vec{z}_u}
\end{pmatrix}.
\end{equation}

\subsubsection{Equivalence of GOT Attack and Interleaved Decoding Attack}

In the following, we prove that the failure condition of the GOT Attack is equivalent to the condition that decoding $\ensuremath{\mathbf{k}_{\mathsf{pub}}}$ in an interleaved Gabidulin code fails.
\begin{theorem}\label{thm:equiv-int-got}
	The GOT Attack from \cite{Gaborit2018-FL-Attack} fails if and only if the Interleaved Decoding Attack fails. In particular, both fail if \eqref{eq:fail-interleaved} holds.
\end{theorem}
\begin{proof}
Rewrite the matrix from Theorem~\ref{thm:GOT-attack-success} as
\begin{align}
\Mooremat{n-w-k}{q}{\vec{Z}}	=
\begin{pmatrix}
\vec{z}_1\\
\vdots\\
\vec{z}_u\\
\vec{z}_1^{q}\\
\vdots\\
\vec{z}_u^{q}\\
\vdots\\
\vec{z}_1^{q^{n-w-k-1}}\\
\vdots\\
\vec{z}_u^{q^{n-w-k-1}}\\
\end{pmatrix}
  \label{eq:thm1-rewrite}
\end{align}
and the matrix from equation \eqref{eq:matrix-repair} as
\begin{align}
\ensuremath{\tilde{\vec{Z}}}
=
\begin{pmatrix}
\vec{z}_1\\
\vdots\\
\vec{z}_1^{q^{n-w-k-1}}\\
\vec{z}_2\\
\vdots\\
\vec{z}_2^{q^{n-w-k-1}}\\
\vdots\\
\vec{z}_u\\
\vdots\\
\vec{z}_u^{q^{n-w-k-1}}\\
\end{pmatrix}.
\label{eq:lemm2-rewrite}
\end{align}
Since the matrix in~\eqref{eq:thm1-rewrite} and in~\eqref{eq:lemm2-rewrite} only differ in row permutations, they are row-space equivalent, implying that they have the same rank. Further, the rank of the matrix in~\eqref{eq:lemm2-rewrite}  cannot become larger than~$w$ (since any vector in the right kernel of this matrix has rank weight at least $n-w$ \cite[Algorithm 3.2.1]{Overbeck_Diss_InterleveadGab}).
Thus, the failures of Theorem~\ref{thm:GOT-attack-success} and Lemma~\ref{lem:interleaved-fail} are equivalent. \qed
\end{proof}

{In the next section, we will exploit the observation of Theorem~\ref{thm:equiv-int-got}, i.e., we propose a new key generation algorithm that avoids public keys that can be efficiently decoded by an interleaved decoder, thereby rendering the GOT attack useless.}

\section{The New System \textsf{LIGA}}\label{sec:liga}
In this section, we propose a public-key code-based encryption scheme $\ensuremath{\mathsf{\Pi}^{\text{PKE}}} = (\ensuremath{\mathsf{KeyGen}},\ensuremath{\mathsf{Encrypt}},\ensuremath{\mathsf{Decrypt}})$ called $\textsf{LIGA}$. The system is based on the original FL system~\cite{faure2006new}, where we keep both the original encryption and decryption algorithm, but replace the insecure key-generation algorithm. Further, we present a KEM-DEM version of $\textsf{LIGA}$ denoted by $\ensuremath{\mathsf{\Pi}^{\text{KEM}}} = (\ensuremath{\mathsf{KeyGen}},\ensuremath{\mathsf{Encaps}},\ensuremath{\mathsf{Decaps}})$.

Later, in Section~\ref{sec:semantic}, we will analyze the security of the system. We single out problems from coding theory and we prove that the encryption version is IND-CPA secure and the KEM-DEM version is IND-CCA2 secure under the assumption that the stated problems are hard. Furthermore, we study new and known attacks on these problems and show that they all run in exponential time (see~Section~\ref{sec:sec_analysis}).

\subsection{The New Key Generation Algorithm}\label{sec:repair}
We introduce a new key generation algorithm that is based on choosing $\vec{z} = \sum_{i=1}^{u} \vec{z}_i\gamma^*_i$ in a way that $\ensuremath{\varphi} < w$, where $\ensuremath{\varphi}$ is the rank of the interleaved Moore matrix of the errors $\vec{z}_i$ in the public key, see \eqref{eq:matrix-repair}. Based on the dimension of the span of the $\vec{z}_i$, we will upper bound $\ensuremath{\varphi}$ in the following Theorem~\ref{thm:rank-S_mat}. Recall that when $\ensuremath{\varphi} < w$, the GOT attack~\cite{Gaborit2018-FL-Attack} and interleaved decoding of the public key fail, see Theorem~\ref{thm:equiv-int-got}. In this case, retrieving any knowledge about the private key from the public key requires to solve Problem~\ref{pro:restr-int-search-rsd} (defined later), which basically corresponds to decoding the interleaved codeword when error patterns occur for which all known decoders fail.

\begin{theorem}\label{thm:rank-S_mat}
  Let $\dim(\langle\vec{z}_1,\hdots,\vec{z}_u \rangle_{q^m}) = \ensuremath{\zeta}$. Then
  \begin{equation}
    \label{eq:rank-S_mat}
    \ensuremath{\varphi} = \rank _{q^m} \big(\ensuremath{\tilde{\vec{Z}}} \big) \leq \min \{\ensuremath{\zeta}(n-k-w),w\}.
  \end{equation}
\end{theorem}
\begin{proof}
  The dimension of $\langle\vec{z}_1,\hdots,\vec{z}_u \rangle_{q^m}$ implies that at most $\ensuremath{\zeta}(n-k-w)$ rows of $\ensuremath{\tilde{\vec{Z}}}$ are linearly independent over $\ensuremath{\mathbb{F}_{q^m}}$, meaning that $\ensuremath{\varphi} \leq \ensuremath{\zeta}(n-k-w)$.
  The definition of $\vec{z}=(\vec{s} \ | \ \ensuremath{\mathbf{0}}) \cdot \vec{P}^{-1}$ leads to

  \begin{align}
\ensuremath{\varphi} &= \rank_{q^m}(\ensuremath{\tilde{\vec{Z}}})   \nonumber\\
         &= \rank_{q^m}
\begin{pmatrix}
           \begin{pmatrix}
    \begin{array}{c | c}
      \Mooremat{n-k-w}{q}{\vec{s}_1} & \vec{0}\\
      \vdots & \vdots\\
      \Mooremat{n-k-w}{q}{\vec{s}_u} & \vec{0}\\
    \end{array}
  \end{pmatrix}\vec{P}^{-1}
  \end{pmatrix} \nonumber\\
         &= \rank_{q^m}
    \begin{pmatrix}
    \begin{array}{c}
      \Mooremat{n-k-w}{q}{\vec{s}_1}\\
      \vdots\\
      \Mooremat{n-k-w}{q}{\vec{s}_u}\\
    \end{array}
  \end{pmatrix}\nonumber \\
         &\leq w, \nonumber
  \end{align}
where the last inequality holds since $\vec{s}_1,\hdots,\vec{s}_u$ are vectors of length $w$. \qed
\end{proof}

We propose the following modification to Line~\ref{line:keygen_s} of the \textbf{Key Generation}, depending on the parameter $\zeta$:
{\RestyleAlgo{plain}
\begin{algorithm}
\DontPrintSemicolon
{
\setcounter{AlgoLine}{2}
$\mathcal{A} \xleftarrow{\$} \left\{ \text{subspace } \mathcal{U} \subseteq \ensuremath{\mathbb{F}_{q^m}}^w \, : \, \dim \mathcal{U} = \zeta, \, \mathcal{U} \text{ has a basis of full-$\ensuremath{\mathbb{F}_q}$-rank elements} \right\}$ \\[2ex]
\setcounter{AlgoLine}{2}
\SetNlSty{textbf}{}{'}
$\begin{pmatrix}
\vec{s}_1 \\
\vdots \\
\vec{s}_u
\end{pmatrix} \xleftarrow{\$} \left\{ \begin{pmatrix}
\vec{s}_1' \\
\vdots \\
\vec{s}_u'
\end{pmatrix} \, : \, \langle\vec{s}_1',\dots,\vec{s}_u'\rangle_{\ensuremath{\mathbb{F}_{q^m}}} = \mathcal{A}, \ \rank_{q}(\vec{s}_i') = w, \, \forall \, i \right\}$ \\
}
\label{alg:s_construction}
\end{algorithm}
}

Clearly, $\dim(\langle\vec{z}_1,\hdots,\vec{z}_u \rangle_{q^m}) = \ensuremath{\zeta}$ in this case.
{To avoid that the GOT attack~\cite{Gaborit2018-FL-Attack} runs in polynomial time, Theorem~\ref{thm:rank-S_mat} implies that the parameter $\ensuremath{\zeta}$ must always be chosen such that $\ensuremath{\zeta} < \frac{w}{n-k-w}$.
In Section~\ref{sec:sec_analysis}, we will discuss several further exponential-time attacks on {\textsf{LIGA}}.
Some of these attacks have a work factor depending on $\zeta$, which must be considered in the parameter design.

Furthermore, the condition $\rank_{q}(\vec{s}_i') = w$ ensures that $\rank_{q}(\vec{z}_i)=w$, i.e., as large as possible for a given subspace $\mathcal{A}$.
This choice maximizes the work factor of generic decoding attacks on the rows of the public key (seen as a received word of an interleaved Gabidulin code), see Section~\ref{sec:sec_analysis}.

The restriction of the choice of $\mathcal{A}$ to subspaces that contain a basis of full-$\ensuremath{\mathbb{F}_q}$-rank codewords is to ensure that the set from which we sample in Line~3' is non-empty. Hence, the key generation always works.
}

Compared to the choice of $\vec{z}$ in Line~\ref{line:keygen_s} of the original Key Generation algorithm, we restrict the choice of $\vec{z}$, but we will see in Section~\ref{sec:sec_analysis} that there are still enough possibilities for $\vec{z}$ to prevent an efficient naive brute-force attack.

{Appendix~\ref{app:practical_key_generation} contains a more detailed discussion on how to realize Lines $3$ and $3'$ in practice.}

\subsection{The Public Key Encryption Version}
The new key generation algorithm $\ensuremath{\mathsf{KeyGen}}$, the encryption algorithm $\ensuremath{\mathsf{Encrypt}}$ and the decryption algorithm $\ensuremath{\mathsf{Decrypt}}$ are shown in Algorithm~\ref{alg:modKeyGen}, Algorithm~\ref{alg:Encrypt} and Algorithm~\ref{alg:Decrypt}, respectively. Compared to original key generation algorithm, the algorithm {\ensuremath{\mathsf{KeyGen}}} has one more input parameter $\ensuremath{\zeta}$ (cf.~Section~\ref{sec:repair}).
 \begin{algorithm}
 \DontPrintSemicolon
 \KwIn{Parameters $q,m,n,k,u,w,\ensuremath{\zeta}$ as in Table~\ref{tab:parameters}}
 \KwOut{Private key $\ensuremath{\mathsf{sk}}$, public key $\ensuremath{\mathsf{pk}}$}
 $\vec{g} \xleftarrow{\$} \{ \a \in \ensuremath{\mathbb{F}_{q^m}}^n \,:\, \rank_q(\a) = n \} $\\
 $\vec{x} \xleftarrow{\$} \{ \a \in \ensuremath{\mathbb{F}_{q^{mu}}}^k \,:\, \dim (\langle a_{k-u+1},\dots, a_k \rangle_{\ensuremath{\mathbb{F}_{q^m}}} ) = u  \}$  \\
{
\setcounter{AlgoLine}{2}
$\mathcal{A} \xleftarrow{\$} \left\{ \text{subspace } \mathcal{U} \subseteq \ensuremath{\mathbb{F}_{q^m}}^w \, : \, \dim \mathcal{U} = \zeta, \, \mathcal{U} \text{ has a basis of full-$\ensuremath{\mathbb{F}_q}$-rank elements} \right\}$ \\
\setcounter{AlgoLine}{2}
\SetNlSty{textbf}{}{'}
$\begin{pmatrix}
\vec{s}_1 \\
\vdots \\
\vec{s}_u
\end{pmatrix} \xleftarrow{\$} \left\{ \begin{pmatrix}
\vec{s}_1' \\
\vdots \\
\vec{s}_u'
\end{pmatrix} \, : \, \langle\vec{s}_1',\dots,\vec{s}_u'\rangle_{\ensuremath{\mathbb{F}_{q^m}}} = \mathcal{A}, \, \rank_{q}(\vec{s}_i') = w \, \forall \, i \right\}$ \\
}
\SetNlSty{textbf}{}{}
 $\vec{s} \gets \sum_{i=1}^{u}\vec{s}_i\gamma_i^{*}$ \\
 $\vec{P} \xleftarrow{\$} \{ \vec{A} \in \ensuremath{\mathbb{F}_q}^{n\times n} : \rank_{q}(\vec{A}) = n  \}  $  \\
 $\mathbf G_{\mycode{G}} \gets \Mooremat{k}{q}{\vec{g}}$ \\
 $\vec{z} \gets (\vec{s} \ | \ \ensuremath{\mathbf{0}}) \cdot \vec{P}^{-1}$ \\
 $\ensuremath{\mathbf{k}_{\mathsf{pub}}} \gets \vec{x} \cdot \mathbf G_{\mycode{G}} + \vec{z}$ \label{line:encrypt_keygen} \\
 $\ensuremath{t_{\mathsf{pub}}} \gets \left\lfloor \frac{n-w-k}{2} \right \rfloor$\\
 \Return{$\ensuremath{\mathsf{sk}} = (\vec{x},\vec{P}_{[w+1,n]})$, $\ensuremath{\mathsf{pk}} = (\vec{g}, \ensuremath{\mathbf{k}_{\mathsf{pub}}})$}
 \caption{$\ensuremath{\mathsf{KeyGen}}\,(\cdot)$}
 \label{alg:modKeyGen}
 \end{algorithm}

 \begin{algorithm}
 \KwIn{Plaintext $\vec{m} \in \ensuremath{\mathbb{F}_{q^m}}^{k-u}$, public key $\ensuremath{\mathsf{pk}} = (\vec{g},\ensuremath{\mathbf{k}_{\mathsf{pub}}})$, randomness $\theta$}
 \KwOut{Ciphertext $\vec{c}$}
 $\alpha \xleftarrow{\$} \ensuremath{\mathbb{F}_{q^{mu}}} \setminus \{0\}$ using $\theta$ \\
 $\vec{e} \xleftarrow{\$} \{ \a \in \ensuremath{\mathbb{F}_{q^m}}^n : \rank_q(\a) = \ensuremath{t_{\mathsf{pub}}} \}$ using $\theta$ \\
 $\mathbf G_{\mycode{G}} \gets \Mooremat{k}{q}{\vec{g}}$ \\
 \Return{$\vec{c} \gets (\vec{m},\vec{0}_u)\cdot\mathbf G_{\mycode{G}} + \Tr(\alpha \ensuremath{\mathbf{k}_{\mathsf{pub}}}) +\vec{e}.$\label{line:encrypt_encoding}}
 \caption{$\ensuremath{\mathsf{Encrypt}}\, (\cdot)$}
 \label{alg:Encrypt}
 \end{algorithm}

 \begin{algorithm}
 \KwIn{Ciphertext $\vec{c}\in \ensuremath{\mathbb{F}_{q^m}}^n$, private key $\ensuremath{\mathsf{sk}} = (\vec{x},\vec{P}_{[w+1,n]})$}
 \KwOut{Plaintext $\vec{m}\in \ensuremath{\mathbb{F}_{q^m}}^{k-u}$}
 $\c' \gets$ $\vec{c}\vec{P}_{[w+1,n]}$ \label{line:decrypt_cP} \\
 $\mycode{\mathcal{G}}' \gets $ Gabidulin code generated by $\vec{G}_{\mycode{G}}\vec{P}_{[w+1,n]}$ \\
 $\vec{m}^{\prime} \gets$ decode $\vec{c}'$ in $\mycode{\mathcal{G}}'$ \label{line:decrypt_decoding} \\
 $\alpha \gets \sum_{i=k-u+1}^{k}m_i^{\prime}x_i^*$ \label{line:decrypt_alpha} \\
 \Return{$\vec{m} \gets (\vec{m}^{\prime}-\Tr(\alpha\vec{x}))_{[1,k-u]}$} \label{line:decrypt_m}
 \caption{$\ensuremath{\mathsf{Decrypt}}\,(\cdot)$}
 \label{alg:Decrypt}
 \end{algorithm}

 The proposed system has no decryption failures as proven in the following theorem.
\begin{theorem}[Correctness~\cite{faure2006new}]
Algorithm~\ref{alg:Decrypt} returns the correct plaintext $\vec{m}$.
\end{theorem}

\begin{proof}
Line~\ref{line:decrypt_cP} computes
\begin{equation*}
\vec{c}\vec{P} = (\vec{m} + \Tr(\alpha\vec{x}))\vec{G}_{\mycode{G}}\vec{P} + (\Tr(\alpha \vec{s}) | \vec{0}) + \vec{e}\vec{P},
\end{equation*}
whose last $n-w$ columns are given by
\begin{equation*}
\vec{c}^{\prime} = (\vec{m} + \Tr(\alpha\vec{x}))\vec{G}^{\prime} + \vec{e}^{\prime},
\end{equation*}
where $\vec{G}^{\prime}:= \vec{G}_{\mycode{G}}\vec{P}_{[w+1,n]} \in \ensuremath{\mathbb{F}_{q^m}}^{k \times (n-w)}$ and $\vec{e}^{\prime}:= \vec{e}\vec{P}_{[w+1,n]}$. By decoding in $\mycode{\mathcal{G}}'$, we thus obtain the vector
\begin{align*}
\vec{m}' = \vec{m} + \Tr(\alpha\vec{x}).
\end{align*}
Since the last $u$ positions of the plaintext $\vec{m}$ are zero (i.e., $m_i=0$ for $i=k-u+1,\dots,k$), we get $\alpha = \sum_{i=k-u+1}^{k}m_i^{\prime}x_i^*$, where $\{x_{k-u+1}^*,\dots,x_k^*\}$ is a dual basis to $\{x_{k-u+1},\dots,x_k\}$.
As we know $\alpha$ and $\vec{x}$, we can compute the plaintext~$\vec{m}$.
\qed
\end{proof}

\begin{remark}
{Steps~1 to~3 of Algorithm~\ref{alg:Decrypt} can be interpreted as an error-erasure decoder of a Gabidulin code.
As this observation may have advantages, especially for implementations, we present this connection formally in Appendix~\ref{app:decryption_as_error-erasure_decoding}.}
\end{remark}

A SageMath v8.8~\cite{stein_sagemath} implementation of the public key encryption version of {\textsf{LIGA}} can be downloaded from \url{https://bitbucket.org/julianrenner/liga_pke}. The purpose of the source code is to clarify the shown algorithms but \emph{not} to provide a secure and efficient implementation.

\subsection{KEM/DEM Version $\ensuremath{\mathsf{\Pi}^{\text{PKE}}}$ and $\ensuremath{\mathsf{\Pi}^{\text{KEM}}}$}
In~\cite{hofheinz2017modular}, generic transformations of IND-CPA secure public key encryptions into IND-CCA2 secure KEMs are proposed. In the following, we apply one of the transformations directly to $\ensuremath{\mathsf{\Pi}^{\text{PKE}}}$ to obtain $\ensuremath{\mathsf{\Pi}^{\text{KEM}}}$. Later, in Section~\ref{ssec:semantic_security}, we will prove that $\ensuremath{\mathsf{\Pi}^{\text{PKE}}}$ fulfills the requirements such that the applied transformation is secure.

Let $\mathcal{G}$, $\mathcal{H}$ and $\mathcal{K}$ be hash functions, where $\mathcal{G}\neq\mathcal{H}$. In Algorithm~\ref{alg:Encap} and Algorithm~\ref{alg:Decap}, we show the encapsulation and decapsulation algorithms of the KEM $\ensuremath{\mathsf{\Pi}^{\text{KEM}}} = (\ensuremath{\mathsf{KeyGen}},\ensuremath{\mathsf{Encaps}},\ensuremath{\mathsf{Decaps}})$. The algorithm $\ensuremath{\mathsf{KeyGen}}$ remains Algorithm~\ref{alg:modKeyGen}.

 \begin{algorithm}
 \KwIn{Public key $\ensuremath{\mathsf{pk}} = (\vec{g},\ensuremath{\mathbf{k}_{\mathsf{pub}}})$}
 \KwOut{Ciphertext $(\vec{c},\vec{d})$, shared key $K$}
 $\vec{m} \xleftarrow{\$} \ensuremath{\mathbb{F}_{q^m}}^{k-u}$ (this will serve as shared key) \\
 $\theta \gets \mathcal{G}(\vec{m})$\\
 $\c\gets \ensuremath{\mathsf{Encrypt}}(\vec{m},\ensuremath{\mathsf{pk}},\theta)$ \\
 $K\gets \mathcal{K}(\vec{m},\c)$ \\
 $ \vec{d} \gets \mathcal{H}(\c,\vec{d}) $ \\
 \Return{$(\vec{c},\vec{d}),K$}
 \caption{$\ensuremath{\mathsf{Encaps}}\, (\cdot)$}
 \label{alg:Encap}
 \end{algorithm}

 \begin{algorithm}
 \KwIn{Ciphertext $(\vec{c},\vec{d})$, private key $\ensuremath{\mathsf{sk}} = (\vec{x},\vec{P}_{[w+1,n]})$}
 \KwOut{Shared key $K$}
 $\vec{m}' \gets \ensuremath{\mathsf{Decrypt}}(\c,\ensuremath{\mathsf{sk}})$ \\
 $\theta' \gets \mathcal{G}(\vec{m}')$ \\
 $\c' \gets \ensuremath{\mathsf{Encrypt}}(\vec{m}',\ensuremath{\mathsf{pk}},\theta)$ \\
 \eIf{$\c \neq \c'$ or $\vec{d} \neq \mathcal{H}(\vec{m}')$}
 {$K \gets \bot$}
 {$K \gets \mathcal{K}(\vec{m}',\c)$}
 \Return{$K$}
 \caption{$\ensuremath{\mathsf{Decaps}}\,(\cdot)$}
 \label{alg:Decap}
 \end{algorithm}

\subsection{Complexity}

\subsubsection{Asymptotically Fastest Methods}

It is essential for a cryptosystem that key generation, encryption, and decryption can be implemented fast.
The following results were not known when the original FL system was proposed, but have a major impact on its efficiency.

The complexity of key generation and encryption is dominated by the cost of encoding a Gabidulin code (Line~\ref{line:encrypt_keygen} of Algorithm~\ref{alg:modKeyGen} and Line~\ref{line:encrypt_encoding} of Algorithm~\ref{alg:Encrypt}).\footnote{Note that since $\vec{x}$ and $\vec{z}$ have coefficients in the large field $\ensuremath{\mathbb{F}_{q^{mu}}}$, this line can be realized as encoding $u$ messages over $\ensuremath{\mathbb{F}_{q^m}}$ with the generator matrix $\vec{G}_\mathcal{G} \in \ensuremath{\mathbb{F}_{q^m}}^{k \times n}$ and corrupting these codewords with an error (see also Section~\ref{ssec:kpub_corrupted_interleaved_codeword} below).} The asymptotically fastest-known algorithms \cite{PuchingerWachterzeh-ISIT2016,caruso2017fast,puchinger2018fast} for this require
\begin{itemize}
\item $O^\sim(n^{\min\{\frac{\omega+1}{2},1.635\}})$ operations in $\ensuremath{\mathbb{F}_{q^m}}$ {or $O^\sim(n^{\omega-2}m^2)$ operations in $\ensuremath{\mathbb{F}_q}$ in general\footnote{Which of the two algorithms is fastest depends on the relation between $n$ and $m$, as well as the used working basis of $\ensuremath{\mathbb{F}_{q^m}}$ over $\ensuremath{\mathbb{F}_q}$.}} and
\item $O^\sim(n)$ operations in $\ensuremath{\mathbb{F}_{q^m}}$ if the entries of $\vec{g}$ are a normal basis of $\ensuremath{\mathbb{F}_{q^m}}/\ensuremath{\mathbb{F}_q}$,
\end{itemize}
where $\omega$ is the matrix multiplication exponent and $O^\sim$ means that $\log$ factors are neglected.

The bottleneck of decryption is (error-erasure) decoding of a Gabidulin code (Line~\ref{line:decrypt_decoding} of Algorithm~\ref{alg:Decrypt}, see also Appendix~\ref{app:decryption_as_error-erasure_decoding} below), where the asymptotically fastest algorithm costs
\begin{equation*}
O^\sim\!\left(n^{\min\{\frac{\omega+1}{2},1.635\}}\right)
\end{equation*}
operations in $\ensuremath{\mathbb{F}_{q^m}}$ \cite{PuchingerWachterzeh-ISIT2016,puchinger2018fast}  or
\begin{equation*}
O^\sim(n^{\omega-2}m^2)
\end{equation*}
operations in $\ensuremath{\mathbb{F}_q}$ (decoder in \cite{PuchingerWachterzeh-ISIT2016} with linearized-polynomial operations in \cite{caruso2017fast}).

For small lengths $n$, the algorithms from \cite{RichterPlass_DecodingRankCodes_2004,gadouleau2008complexity,SilvaKschischang-FastEncodingDecodingGabidulin-2009,Wachterzeh_DecodingBlockConvolutionalRankMetric_2013}, which have quadratic complexity over $\ensuremath{\mathbb{F}_{q^m}}$ (or cubic complexity over $\ensuremath{\mathbb{F}_q}$), might be faster than the mentioned algorithms due to smaller hidden constants in the $O$-notation.

\subsubsection{Timing Attacks}
{In some scenarios, resistance against timing attacks is required. Due to the fact that Step~\ref{line:encrypt_encoding} of Algorithm~\ref{alg:Encrypt} can be easily implemented in constant time, the proposed encryption algorithm does not reveal any information about secret knowledge through timing attacks. The same holds for the presented decryption algorithm since there exists an efficient constant-time decoding algorithm for Gabidulin codes~\cite{bettaieb2019preventing} and all other steps of Algorithm~\ref{alg:Decrypt} can be realized in constant time as well.
}

\section{Difficult Problems \& Semantic Security of \textsf{LIGA}}\label{sec:semantic}
In this section, we introduce problems in the rank metric that are considered to be difficult. Furthermore, we prove that the public-key encryption version of {\textsf{LIGA}} is IND-CPA secure and the KEM version is IND-CCA2 secure under the assumption that there does not exist probabilistic polynomial-time algorithms that can solve them.
A detailed complexity analysis of {existing and new} algorithms solving the stated problems is given in Section~\ref{sec:sec_analysis}.

\subsection{Difficult Problems in the Rank Metric}\label{sec:problems}
{\textsf{LIGA}} is based on several difficult problems which are stated in this section.
Note that the search variants of the problems correspond exactly to retrieving information about the private key from the public key (not necessarily a valid private key as explained in the following) or the plaintext from the ciphertext. The decisional problems are equivalent to distinguishing the public key or the ciphertext from random vectors.

\begin{definition}[\textsf{ResIG-Distribution}: Restricted Interleaved Gabidulin Code Distribution]
	\label{def:ResIG-Distr}

	\noindent Input: {$q,m,n,k,w >\lfloor\frac{n-k}{2}\rfloor ,\ensuremath{\zeta} < \frac{w}{n-k-w}, u<w$.} \\
	Choose uniformly at random
	\begin{itemize}
		\item $\vec{G} \xleftarrow{\$} \mathcal{G}$, where $\mathcal{G}$ is the set of all generator matrices of $[n,k]$ Gabidulin codes over $\ensuremath{\mathbb{F}_{q^m}}$
		\item $\vec{M} \xleftarrow{\$} \{\vec{X} \in \ensuremath{\mathbb{F}_{q^m}}^{u\times k} : \rank_{q^m}(\vec{X}_{[k-u,k]}) = u\} $.
		\item {$\mathcal{A} \xleftarrow{\$} \{ \text{subspace } \mathcal{U} \subseteq \ensuremath{\mathbb{F}_{q^m}}^w \, : \, \dim \mathcal{U} = \zeta, \, \mathcal{U} \text{ has a basis of full-$\ensuremath{\mathbb{F}_q}$-rank elements} \}$}
		\item {$\vec{E}' \xleftarrow{\$} \left\{ \begin{pmatrix}
		\vec{s}_1' \\
		\vdots \\
		\vec{s}_u'
		\end{pmatrix} \in \ensuremath{\mathbb{F}_{q^m}}^{u \times w}\, : \, \langle\vec{s}_1',\dots,\vec{s}_u'\rangle_{\ensuremath{\mathbb{F}_{q^m}}} = \mathcal{A}, \, \rank_{q}(\vec{s}_i') = w \, \forall \, i \right\}$}
		\item {$\vec{Q} \xleftarrow{\$} \{ \vec{A} \in \ensuremath{\mathbb{F}_q}^{w \times n} : \rank_{q}(\vec{A}) = w  \}$}
		\item {$\vec{E} \gets \vec{E}' \vec{Q}$}
	\end{itemize}
	Output: $(\vec{G},\vec{M}\vec{G}+\vec{E})$.
\end{definition}

\begin{problem}[\textsf{ResIG-Search}: Restricted interleaved Gabidulin Code Search Problem]\label{pro:restr-int-search-rsd}
	\noindent Input: $(\vec{G},\vec{Y})$ from \textup{\textsf{ResIG-Distribution}} with input $q,m,n,k,w,\ensuremath{\zeta},u$ (Definition~\ref{def:ResIG-Distr}).\\
	Goal: Find $\vec{M}\in\ensuremath{\mathbb{F}_{q^m}}^{u\times k}$ and $\vec{E} \in \{\vec{X} \in \ensuremath{\mathbb{F}_{q^m}}^{u \times n} : \rank_{\ensuremath{\mathbb{F}_q}}(\vec{X}) \leq w\}$ s.t. $\vec{M}\vec{G}+\vec{E} = \vec{Y}$.
\end{problem}
Problem~\ref{pro:restr-int-search-rsd} (\textsf{ResIG-Search}) is equivalent to decoding a codeword of a $u$-interleaved Gabidulin code that is corrupted by an error $\vec{E}$, see also Section~\ref{ssec:attack_interleaved_decoding} and is therefore the underlying problem of the structural attacks from Section~\ref{sec:eff_attack}.

Note however that not necessarily every solution of this problem can be used directly as a valid private key since some additional structure on $\vec{E}$ is introduced in {\textsf{LIGA}} (i.e., Problem~\ref{pro:restr-int-search-rsd} is easier to solve than retrieving a valid private key of {\textsf{LIGA}}).

\begin{problem}[\textsf{ResIG-Dec}: Restricted Interleaved Gabidulin Code Decisional Problem]\label{pro:restr-int-decision-rsd}

	\noindent Input: $(\vec{G},\vec{Y}) \in \ensuremath{\mathbb{F}_{q^m}}^{k\times n} \times \ensuremath{\mathbb{F}_{q^m}}^{u\times n}$.\\
	Goal: Decide with non-negligible advantage whether $\vec{Y}$ came from \textup{\textsf{ResIG-Distribution}} with input $q,m,n,k,w,\ensuremath{\zeta},u$ (Definition~\ref{def:ResIG-Distr}) or the uniform distribution over $\ensuremath{\mathbb{F}_{q^m}}^{u\times n}$.
\end{problem}

To solve \textsf{ResIG-Dec} (Problem~\ref{pro:restr-int-decision-rsd}), we do not know a better approach than trying to solve the associated \emph{search} problem (i.e., \textsf{ResIG-Search}), which is usually done for all decoding-based problems.

\begin{definition}[\textsf{ResErr-Distribution}: Restricted Error Distribution]\label{def:res-err}\\
	\noindent Input: $q,m,n,k,w,\ensuremath{t_{\mathsf{pub}}},u,\ve{\gamma}, (\vec{G},\vec{K}) $ from \textup{\textsf{ResIG-Distribution}} (Definition~\ref{def:ResIG-Distr}).\\
	Choose uniformly at random
	\begin{itemize}
		\item $\ensuremath{\mathbf{e}} \xleftarrow{\$} \{ \vec{x} \in \ensuremath{\mathbb{F}_{q^m}}^{n}\, : \, \rank_q(\vec{x}) = \ensuremath{t_{\mathsf{pub}}}  \} $
		\item $\alpha \xleftarrow{\$} \ensuremath{\mathbb{F}_{q^{mu}}}$
		\item $\k \gets \extsmallfield_{\vec{\gamma}}^{-1}(\vec{K})$
		\item $\vec{y} \gets \Tr(\alpha \k) +\vec{e} = \Tr(\alpha \vec{m}) \vec{G} +  \Tr(\alpha \vec{z}) + \ensuremath{\mathbf{e}}$
	\end{itemize}
	Output: $\vec{y}$.
\end{definition}
\begin{problem}[\textsf{ResG-Search}: Restricted Gabidulin Code Search Problem]\label{pro:fl-search-rsd}

	\noindent Input: $q,m,n,k,w,\ensuremath{t_{\mathsf{pub}}},u,\ve{\gamma}, (\vec{G},\vec{K}) $ from \textup{\textsf{ResIG-Distribution}} (Definition~\ref{def:ResIG-Distr}), $\vec{y}$ from \textup{\textsf{ResErr-Distribution}} (Definition~\ref{def:res-err}) with input $(\vec{G},\vec{K})$.\\
	Goal: Find $\vec{m}\in\ensuremath{\mathbb{F}_{q^m}}^{k}$ and $\ensuremath{\mathbf{e}} \in \{\vec{x} \in \ensuremath{\mathbb{F}_{q^m}}^{n} : \rank_{\ensuremath{\mathbb{F}_q}}(\vec{x}) \leq \ensuremath{t_{\mathsf{pub}}}\}$ such that $\vec{m}\vec{G}+\ensuremath{\mathbf{e}} = \vec{y}$.
\end{problem}
Problem~\ref{pro:fl-search-rsd} is equivalent to decoding a codeword of a Gabidulin code that is corrupted by an error that has with high probability a rank weight of $> (n-k)/2$, see Appendix~\ref{app:probability_of_large_error_weight}.

\begin{problem}[\textsf{ResG-Dec}: Restricted Gabidulin Code Decisional Problem]\label{pro:fl-decision}\\
	\noindent Input: $q,m,n,k,w,\ensuremath{t_{\mathsf{pub}}},u,\ve{\gamma}, (\vec{G},\vec{K}) $ from \textup{\textsf{ResIG-Distribution}} (Definition~\ref{def:ResIG-Distr}), $\vec{y} \in \ensuremath{\mathbb{F}_{q^m}}^{n}$.\\
	Goal: Decide with non-negligible advantage whether $\vec{y}$ came from \textup{\textsf{ResErr-Distribution}} with input $q,m,n,k,w,\ensuremath{t_{\mathsf{pub}}},u,\ve{\gamma}, (\vec{G},\vec{K})$  or the uniform distribution over $ \ensuremath{\mathbb{F}_{q^m}}^{n}$.
\end{problem}
As before, we are not aware of a faster approach to solve \textsf{ResG-Dec} than through the solution of the associated \emph{search} problem.

{
We will see in the next subsection that {\textsf{LIGA}} is IND-CCA2 secure under the assumption that $\textsf{ResG-Dec}$ is a hard problem. As mentioned above, there is an obvious reduction of $\textsf{ResG-Dec}$ to  $\textsf{ResG-Search}$, which can again be efficiently reduced to $\textsf{ResIG-Search}$.
In fact, all relevant attacks studied in Section~\ref{sec:sec_analysis} make use of this chain of reduction and aim at solving one of the two search problems.

We are not aware of a reduction of $\textsf{ResIG-Dec}$ to $\textsf{ResIG-Search}$ or one of the other problems.
Hence, it might very well be that $\textsf{ResIG-Dec}$ is significantly easier than the other problems.
In Section~\ref{ssec:sec_analysis_IG-Dec}, we show that there is a distinguisher for $\textsf{ResIG-Dec}$ that is efficiently computable if the system parameter $\zeta$ is chosen too small.
Due to the missing reduction, it is not clear whether or not this distinguisher influences the security of the system.}

\subsection{Semantic Security}\label{ssec:semantic_security}
In this section, we prove that the public key encryption system $\ensuremath{\mathsf{\Pi}^{\text{PKE}}}$ is semantically secure against chosen plaintext attacks in the standard model under the assumption that \textsf{ResG-Dec} (Problem~\ref{pro:fl-decision}) is difficult. In addition, we show that the IND-CCA2 security of $\ensuremath{\mathsf{\Pi}^{\text{KEM}}}$ reduces tightly to the IND-CPA security of $\ensuremath{\mathsf{\Pi}^{\text{PKE}}}$ in the random oracle model.

\subsubsection{IND-CPA Security of $\ensuremath{\mathsf{\Pi}^{\text{PKE}}}$}

To show that $\ensuremath{\mathsf{\Pi}^{\text{PKE}}}$ is secure against chosen plaintext attacks, we use the definition of admissibility as in~\cite{nojima2008semantic}.
\begin{definition}[Admissibility~\cite{nojima2008semantic}]\label{def:admissible}
The public key encryption scheme $\ensuremath{\mathsf{\Pi}^{\text{PKE}}} = (\ensuremath{\mathsf{KeyGen}},\ensuremath{\mathsf{Encrypt}},\ensuremath{\mathsf{Decrypt}})$ with a message space $\mathcal{M}$ and a random space $\mathcal{R}$ is called admissible if there is a pair of deterministic polynomial-time algorithms $\ensuremath{\mathsf{Encrypt}}_1$ and $\ensuremath{\mathsf{Encrypt}}_2$ satisfying the following property:
\begin{itemize}
\item Partible: $\ensuremath{\mathsf{Encrypt}}_1$ takes as input a public key $\ensuremath{\mathsf{pk}}$ and $r \in \mathcal{R}$, and outputs a $p(\ensuremath{\lambda})$ bit-string, where $\ensuremath{\lambda}$ is the security parameter. $\enc2$ takes as input a key $\ensuremath{\mathsf{pk}}$, and $\vec{m} \in \mathcal{M}$ and outputs a $p(\ensuremath{\lambda})$ bit-string. Here $p$ is some polynomial in the security parameter $\ensuremath{\lambda}$. Then for any $\ensuremath{\mathsf{pk}}$ given by $\ensuremath{\mathsf{KeyGen}}$, $r \in \mathcal{R}$, and $\vec{m} \in \mathcal{M}$, $\ensuremath{\mathsf{Encrypt}}_1( \ensuremath{\mathsf{pk}}, r ) \oplus  \ensuremath{\mathsf{Encrypt}}_2 ( \ensuremath{\mathsf{pk}}, \vec{m}) = \ensuremath{\mathsf{Encrypt}} ( \ensuremath{\mathsf{pk}}, \vec{m}; r ) $.
\item Pseudorandomness: Let $D$ be a probabilistic algorithm and let
  \begin{align*}
    \ensuremath{\mathsf{Adv}}_{D,\ensuremath{\mathsf{Encrypt}}_1}^{ind}(\ensuremath{\lambda}) =& \Pr \Big[ D(\ensuremath{\mathsf{pk}},\ensuremath{\mathsf{Encrypt}}_1(\ensuremath{\mathsf{pk}},r)) = 1 \mid r \xleftarrow{\$} \mathcal{R}, (\ensuremath{\mathsf{sk}}, \ensuremath{\mathsf{pk}}) \gets \ensuremath{\mathsf{KeyGen}}\big(1^{\ensuremath{\lambda}}\big) \Big] \\
    & - \Pr \big[ D(\ensuremath{\mathsf{pk}},s) = 1 \mid s \xleftarrow{\$} \mathcal{U}_{p(\ensuremath{\lambda})}, (\ensuremath{\mathsf{sk}}, \ensuremath{\mathsf{pk}}) \gets \ensuremath{\mathsf{KeyGen}}\big(1^{\ensuremath{\lambda}} \big)    \big].
  \end{align*}
  We define the advantage function of the problem as follows. For any $t$,
  \begin{equation*}
\ensuremath{\mathsf{Adv}}_{\ensuremath{\mathsf{Encrypt}}_1}^{ind}(\ensuremath{\lambda},t) = \max_{D} \big\{\ensuremath{\mathsf{Adv}}_{D,\ensuremath{\mathsf{Encrypt}}_1}^{ind}(\ensuremath{\lambda}) \big\},
\end{equation*}
where the maximum is taken over all $D$ with time-complexity $t$. Then, the function $\ensuremath{\mathsf{Adv}}_{\ensuremath{\mathsf{Encrypt}}_1}^{ind}(\ensuremath{\lambda},t)$ is negligible for every polynomial bounded $t$ and every sufficiently large $\ensuremath{\lambda}$.
\end{itemize}
\end{definition}

In the following we will prove that $\ensuremath{\mathsf{\Pi}^{\text{PKE}}}$ is IND-CPA secure by showing that is fulfills the definition of admissibility.
\begin{theorem}\label{thm:cpa}
The  system $\ensuremath{\mathsf{\Pi}^{\text{PKE}}} = (\ensuremath{\mathsf{KeyGen}},\ensuremath{\mathsf{Encrypt}}, \ensuremath{\mathsf{Decrypt}})$ is an IND-CPA secure encryption scheme in the standard model under the assumption that the \textup{\textsf{ResG-Dec}} problem is difficult.
\end{theorem}
\begin{proof}
  Let
  $\ensuremath{\mathsf{Encrypt}}_1 := \Tr (\alpha \ensuremath{\mathbf{k}_{\mathsf{pub}}}) +\ensuremath{\mathbf{e}}$
and
$\ensuremath{\mathsf{Encrypt}}_2 := \vec{m} \vec{G}_\mathcal{G}$.
Then, one observes that $\ensuremath{\mathsf{Encrypt}} = \ensuremath{\mathsf{Encrypt}}_1 \oplus \ensuremath{\mathsf{Encrypt}}_2$ and thus $\ensuremath{\mathsf{\Pi}^{\text{PKE}}}$ is \emph{partible}.
Since \textup{\textsf{ResG-Dec}} (Problem~\ref{pro:fl-decision}) is assumed to be difficult, the encryption scheme fulfills \emph{pseudorandomness} and thus, the system is \emph{admissibile}. As proven in~\cite[Lemma 1]{nojima2008semantic}, if $\ensuremath{\mathsf{\Pi}^{\text{PKE}}}$ fulfills Definition~\ref{def:admissible}, then it is an IND-CPA secure encryption scheme.
\qed
\end{proof}

\subsubsection{IND-CCA2 Security of $\ensuremath{\mathsf{\Pi}^{\text{KEM}}}$}

We used a transformation proposed in~\cite{hofheinz2017modular} to transform the public key encryption scheme $\ensuremath{\mathsf{\Pi}^{\text{PKE}}}$ into the KEM $\ensuremath{\mathsf{\Pi}^{\text{KEM}}}$. In the following, we prove that $\ensuremath{\mathsf{\Pi}^{\text{KEM}}}$ is IND-CCA2 secure.

The applied transformation requires that the encryption scheme is $\gamma$-spread which is proven to be the case for $\ensuremath{\mathsf{\Pi}^{\text{PKE}}}$ in the following.
\begin{definition}[$\gamma$-spread, \cite{fujisaki12013secure,hofheinz2017modular}] For valid $(\ensuremath{\mathsf{pk}},\ensuremath{\mathsf{sk}})$, the \emph{min-entropy} of\\ $\ensuremath{\mathsf{Encrypt}}(\vec{m},\ensuremath{\mathsf{pk}})$ is defined by
  \begin{equation*}
    \gamma(\vec{m},\ensuremath{\mathsf{pk}}) := - \log_2 \max_{\c \in \hat{\mathcal{C}}} \Pr_{r\gets \mathcal{R}} [\c = \ensuremath{\mathsf{Encrypt}}(\vec{m},\ensuremath{\mathsf{pk}};r)],
  \end{equation*}
  where $\hat{\mathcal{C}}$ is the set of possible ciphertexts. A public key encryption scheme is called \emph{$\gamma$-spread} if for every valid key pair $(\ensuremath{\mathsf{pk}},\ensuremath{\mathsf{sk}})$ and every message $\vec{m}\in \mathcal{M}$, $\gamma(\vec{m},\ensuremath{\mathsf{pk}}) \geq \gamma$. It follows that for all $\c \in \hat{\mathcal{C}}$,
  \begin{equation*}
 \Pr_{r\gets \mathcal{R}} [\c = \ensuremath{\mathsf{Encrypt}}(\vec{m},\ensuremath{\mathsf{pk}};r)] \leq 2^{- \gamma}.
  \end{equation*}
\end{definition}

\begin{lemma}\label{lem:gamma-spread}
The public key encryption system $\ensuremath{\mathsf{\Pi}^{\text{PKE}}}$ is $\gamma$-spread, where $\gamma = m(\ensuremath{t_{\mathsf{pub}}}-u)+\ensuremath{t_{\mathsf{pub}}}(n-\ensuremath{t_{\mathsf{pub}}}-1)$.
\end{lemma}
\begin{proof}
  We observe that
  \begin{align*}
     \max_{\c \in \hat{\mathcal{C}}}\Pr_{r\gets \mathcal{R}} [\c = \ensuremath{\mathsf{Encrypt}}(\vec{m},\ensuremath{\mathsf{pk}};r)]
    {=}& \max_{\c \in \hat{\mathcal{C}}} \Pr_{r\gets \mathcal{R}} [\c = (\vec{m},\vec{0}_u)\mathbf G_{\mycode{G}} + \Tr(\alpha \ensuremath{\mathbf{k}_{\mathsf{pub}}}) +\vec{e}] \\
        \overset{\text{(i)}}{\leq}& \max_{\c' \in \hat{\mathcal{C}}'}q^{mu}\Pr_{r\gets \mathcal{R}} [\c' = (\vec{m},\vec{0}_u)\mathbf G_{\mycode{G}} +\vec{e}] \\
        {=}&~ q^{mu} \frac{1}{|\{\ensuremath{\mathbf{e}} \in \ensuremath{\mathbb{F}_{q^m}}^{n} : \rank_{q}(\ensuremath{\mathbf{e}}) = \ensuremath{t_{\mathsf{pub}}} \}|},
\end{align*}
where $\hat{\mathcal{C}}'$ is the set of all vectors in rank distance $\ensuremath{t_{\mathsf{pub}}}$ from $(\vec{m},\vec{0}_u)\mathbf G_{\mycode{G}}$ and $\text{(i)}$ follows from the fact that there at most $q^{mu}$ choices for  $\alpha$.
In \cite[Section~IV.B]{gabidulin2003reducible}, a constructive way of obtaining rank-$\ensuremath{t_{\mathsf{pub}}}$ matrices is given. More precisely, an injective mapping $ \varphi \, : \, \ensuremath{\mathbb{F}_q}^{t(n+m-t-1)} \to \{\vec{A} \in \ensuremath{\mathbb{F}_q}^{n \times m} \, : \, \rank \vec{A} = t\}$ is given. Hence, we have
$|\{\ensuremath{\mathbf{e}} \in \ensuremath{\mathbb{F}_{q^m}}^{n} : \rank_{q}(\ensuremath{\mathbf{e}}) = \ensuremath{t_{\mathsf{pub}}} \}| \geq q^{t(n+m-t-1)}$. It follows that
\begin{align*}
  \frac{q^{mu}}{ |\{\ensuremath{\mathbf{e}} \in \ensuremath{\mathbb{F}_{q^m}}^{n} : \rank_{q}(\ensuremath{\mathbf{e}}) = \ensuremath{t_{\mathsf{pub}}} \}|}
  &\leq \frac{q^{mu}}{ q^{\ensuremath{t_{\mathsf{pub}}}(n+m-\ensuremath{t_{\mathsf{pub}}}-1)} } \\
  &= q^{-m(\ensuremath{t_{\mathsf{pub}}}-u)-\ensuremath{t_{\mathsf{pub}}}(n-\ensuremath{t_{\mathsf{pub}}}-1)} \\
  &\leq q^{-\gamma}.
\end{align*}
\qed
\end{proof}

\begin{theorem}\label{thm:cca2}
 The KEM-DEM $\ensuremath{\mathsf{\Pi}^{\text{KEM}}} = (\ensuremath{\mathsf{KeyGen}},\ensuremath{\mathsf{Encaps}}, \ensuremath{\mathsf{Decaps}})$ is IND-CCA2 secure in the random oracle model under the assumption that the \textup{\textsf{ResG-Dec}} problem is difficult.
\end{theorem}
\begin{proof}
Assuming the \textsf{ResG-Dec} is difficult, the encryption $\ensuremath{\mathsf{\Pi}^{\text{PKE}}}$ is IND-CPA secure, see Theorem~\ref{thm:cpa}. Further, it is proven in Lemma~\ref{lem:gamma-spread} that $\ensuremath{\mathsf{\Pi}^{\text{PKE}}}$ has $\gamma$-spread encryptions. Thus, the system $\ensuremath{\mathsf{\Pi}^{\text{KEM}}}$ can be tightly reduced to $\ensuremath{\mathsf{\Pi}^{\text{KEM}}}$ in the random oracle model as shown in~\cite{hofheinz2017modular}. \qed
\end{proof}

\section{Security Analysis of {\textsf{LIGA}}}\label{sec:sec_analysis}

In this section, we analyze the security of \textsf{LIGA}. As proven in Theorem~\ref{thm:cpa} and~\ref{thm:cca2}, the encryption version is IND-CPA secure and the KEM version is IND-CCA2 secure under the assumption that \textsf{ResG-Dec} is difficult.
Since there are obvious reductions from \textsf{ResG-Dec} to \textsf{ResG-Search} and from \textsf{ResG-Dec} to \textsf{ResIG-Search}, we will study the hardness of these two search problems in this section (Section~\ref{ssec:attacks_public_key} for \textsf{ResIG-Search} and Section~\ref{ssec:attacks_ciphertext} for \textsf{ResG-Search}).
In fact, we are not aware of a more efficient method to solve \textsf{ResG-Dec} than through these two search problems.

Although no formal reduction from any of the other three studied problems to \textup{\textsf{ResIG-Dec}} is known, we study also the hardness of \textup{\textsf{ResIG-Dec}} (Section~\ref{ssec:sec_analysis_IG-Dec}).
We derive a distinguisher for the public key with exponential complexity in the system parameters, which can be avoided by proper parameter choice.

Due to the nature of the (random) encryption, there are public keys for which the probability that the work factor of some of the ciphertext attacks on \textsf{ResG-Search} (ciphertext attack) is below the designed minimal work factor is not negligible (i.e., $> 2^{-\ensuremath{\lambda}}$). We show in Section~\ref{ssec:weak_keys} that these weak keys occur with negligible probability (i.e., $\leq 2^{-\ensuremath{\lambda}}$) during the random key generation if the parameters are chosen in a suitable way.

\subsection{Exponential-Time Attacks on \textup{\textsf{ResIG-Search}}}\label{ssec:attacks_public_key}
We propose new and summarize known methods that solve \textup{\textsf{ResIG-Search}} (Problem~\ref{pro:restr-int-search-rsd}).
All studied algorithms have exponential complexity in the code parameters.

Recall that in the decryption algorithm of {\textsf{LIGA}}, the last $u$ positions of the private key $\vec{x}$ have to be a basis of $\ensuremath{\mathbb{F}_{q^{mu}}}$ over $\ensuremath{\mathbb{F}_{q^m}}$. Therefore, not every solution of Problem~\ref{pro:restr-int-search-rsd} (\textsf{ResIG-Search}) can be used as valid private key and Problem~\ref{pro:restr-int-search-rsd} is a strictly easier problem than retrieving a valid private key corresponding to a given public key.

\subsubsection{Brute-Force the Vector $\vec{z}$ Attack}\label{ssec:attack_brute-force_z}
The number of vectors $\vec{z} \in \ensuremath{\mathbb{F}_{q^{mu}}}^n$ that fulfill the conditions stated in Section~\ref{sec:repair} is equal to number of possible vectors $\vec{s} \in \ensuremath{\mathbb{F}_{q^{mu}}}^w$ times the number of full rank matrices in $\ensuremath{\mathbb{F}_{q^m}}^{w\times n}$ in reduced row Echelon form. Formally, the number of vectors $\vec{z}$ is
\begin{align*}
  \underbrace{\left|\left\{ \vec{z} \, : \, \vec{z} \text{ can occur in Alg.~\ref{alg:modKeyGen}}\right\}\right|}_{\geq 1} \cdot \underbrace{\left|\left\{ \P \, : \, \P \text{ can occur in Alg.~\ref{alg:modKeyGen}}\right\}\right|}_{\geq \qbinomialField{n}{w}{q}} \geq \qbinomialField{n}{w}{q}.
\end{align*}
Thus, brute-forcing a vector $\vec{z}$ that is a solution to \textsf{ResIG-Search} has work factor
\begin{equation*}
  \text{WF}_{\text{\vec{z}}}\geq\frac{\qbinomialField{n}{w}{q}}{\mathcal{N}} \geq \frac{q^{w(n-w)}}{\mathcal{N}},
\end{equation*}
where the latter inequality follows from a lower bound on  $q$-binomials (see~\cite[Lemma 4]{koetter2008coding}), and
\begin{equation}\label{eq:avNumberIntCodewords}
\mathcal{N} = \max \left\{|\mathcal{C}| \cdot
 \frac{\sum_{i=0}^{w-1}{\prod_{j=0}^{i-1}{(q^{mu} - q^j)}  {\displaystyle\quadbinom{n}{i}}} }{q^{mun}}
 , \
 1\right\}
\end{equation}
 is the average number of interleaved codewords in a ball of radius $w$ around a uniformly at random chosen interleaved received word.

\subsubsection{Interleaved Decoding Attack}\label{ssec:attack_interleaved_decoding}
As described in Section~\ref{sec:eff_attack}, an attacker can apply an interleaved decoder on $\ensuremath{\mathbf{k}_{\mathsf{pub}}}$ to retrieve an alternative private key. A major ingredient of {\textsf{LIGA}} is that the public key is chosen in a way that this decoding will always fail (i.e., the corresponding linear system of equations does not have a unique solution). However, it is still possible to brute-force search in the solution space of the involved system of equations. This is analyzed in the following. Notice thereby that \emph{any} interleaved codeword in radius at most $w$ is a solution to \textsf{ResIG-Search}.

Problem~\ref{pro:restr-int-search-rsd} (\textsf{ResIG-Search}) is equivalent to decoding a codeword of a $u$-interleaved Gabidulin code that is corrupted by an error $\vec{E}$. The error $\vec{E}$ fulfills
\begin{equation*}
\bigg\lfloor \frac{n-k}{2} \bigg\rfloor < \rank_{q}(\vec{E}) \leq \frac{u}{u+1} (n-k) \quad \text{and} \quad \rank_{q^m}(\vec{E}) < \frac{w}{n-k-w} < w
\end{equation*}
and thus, no known algorithm is able to correct it efficiently.

The crucial point of the interleaved decoding algorithms from \cite{Loidreau_Overbeck_Interleaved_2006,Sidorenko2011SkewFeedback} is solving a linear system of equations based on the syndromes with $w+1$ unknowns and $\ensuremath{\varphi}$ linearly independent equations which is equivalent to finding the kernel of the matrix in~\eqref{eq:matrix-repair}, cf.~\cite[Section~4.1]{Wachterzeh_DecodingBlockConvolutionalRankMetric_2013}. For $\ensuremath{\zeta} \geq \frac{w}{n-k-w}$, the dimension of the solution space is one and all solutions are valid for the remaining decoding steps. For $\ensuremath{\zeta} < \frac{w}{n-k-w}$, the dimension of the solution space is $w+1-\ensuremath{\varphi}$ but each valid solution forms only a one-dimensional subspace. An attacker can therefore search in the solution space for a valid solution which requires on average
\begin{equation*}
  \frac{(q^m)^{w+1-\ensuremath{\varphi}}}{q^m \cdot \mathcal{N}} = \frac{q^{m(w-\ensuremath{\varphi})}}{\mathcal{N}}
\end{equation*}
 trials, where $\mathcal{N}$ is the average number of interleaved codewords, see~\eqref{eq:avNumberIntCodewords}.

The size of the solution space is $w+1-\ensuremath{\varphi}$  and clearly maximized for the smallest-possible value of $\ensuremath{\varphi}$, i.e., $\ensuremath{\varphi} = n-k-w$.
In this case, the search through the solution space has work factor
 \begin{equation*}
\text{WF}_{\text{ILD}}=\frac{q^{m(w-\ensuremath{\zeta}(n-k-w))}}{\mathcal{N}}.
\end{equation*}
Since the size of the solution space is maximal for $\ensuremath{\varphi} = n-k-w$, the repair from Section~\ref{sec:repair} with the explicit parameter value $\ensuremath{\zeta}=1$ (i.e., $\dim \big( \langle \vec{z}_1 , \dots , \vec{z}_u\rangle_{\ensuremath{\mathbb{F}_{q^m}}}\big) = 1$) is the most secure choice \emph{in this sense}.
However, we keep the choice of $\ensuremath{\zeta}$ flexible as the pair-wise linear dependence of the $\vec{z}_i$ might decrease the security (we are however not aware of how this fact could be used).

Besides the syndrome-based interleaved decoding algorithms in \cite{Loidreau_Overbeck_Interleaved_2006}, \cite{Sidorenko2011SkewFeedback}, and \cite[p.~64]{Wachterzeh_DecodingBlockConvolutionalRankMetric_2013}, there is an interpolation-based decoding algorithm \cite[Section~4.3 (page 72)]{Wachterzeh_DecodingBlockConvolutionalRankMetric_2013}.
This interpolation-based algorithm can be interpreted both as a list decoder of interleaved Gabidulin codes with exponential worst-case and average list size or as a probabilistic unique decoder.
The probabilistic unique interpolation-based decoder fails if and only if the decoding algorithms in \cite{Loidreau_Overbeck_Interleaved_2006}, \cite{Sidorenko2011SkewFeedback}, \cite[p.~64]{Wachterzeh_DecodingBlockConvolutionalRankMetric_2013} fail and therefore the previous analysis applies here as well.
For the list decoder, cf. \cite[Lemma~4.5]{Wachterzeh_DecodingBlockConvolutionalRankMetric_2013}, the work factor of the resulting attack is
\begin{equation}\label{eq:WF_list_size_kpub}
\text{WF}_\text{list, public key} \leq \frac{q^{m(u-1)k}}{\mathcal{N}}.
\end{equation}
Notice that the list of size $q^{m(u-1)k}$ contains many words which are no valid codewords, but we have to go through the whole list to find all valid codewords in radius up to $w$.

\subsubsection{List Decoding of the Public Key Attack}\label{ssec:attack_list_pk}
Recall that  $\ensuremath{\mathbf{k}_{\mathsf{pub}}} = \vec{x} \cdot \mathbf G_{\mycode{G}} + \vec{z}$.
Previously, we have explained why this vector is a corrupted version of a codeword of a $u$-interleaved Gabidulin code.
At the same time, $\vec{x} \cdot \mathbf G_{\mycode{G}}$ can be seen as a short Gabidulin code over a large field $\ensuremath{\mathbb{F}_{q^{mu}}}$ and therefore, if existing, one could apply list decoding algorithms to decode $\ensuremath{\mathbf{k}_{\mathsf{pub}}}$ and obtain $\vec{x}$. The weight of the error $\vec{z}$ is larger than the unique decoding radius and therefore a unique decoder cannot be applied to reconstruct $\vec{x}$ and a list decoder for radius $w$ is required.

However, such an algorithm has not been found yet. It was even shown in \cite{Wachterzeh_BoundsListDecodingRankMetric_IEEE-IT_2013,RavivWachterzeh_GabidulinBounds_journal,ListDec_RankMetric_2019} that for most classes of Gabidulin codes such a polynomial-time list decoding algorithm cannot exist.
Note that these results were not known when the original FL cryptosystem was proposed.
These results also imply that there is no polynomial-time list decoding algorithm for arbitrary Gabidulin codes beyond the unique decoding radius (such as the Guruswami--Sudan algorithm for Reed--Solomon codes).

\subsubsection{Randomized Gabidulin Decoding Attack on the Public Key}\label{ssec:attack_rsd_pk}

The public key can be seen as the sum of a Gabidulin codeword over the field $\ensuremath{\mathbb{F}_{q^{mu}}}$ and an error of weight $w > \frac{n-k}{2}$. Alternatively, as shown in Section~\ref{ssec:kpub_corrupted_interleaved_codeword}, the public key can be seen as an interleaved Gabidulin codeword that is corrupted by an error of weight $w$ ({note that this is the reason why all the $\vec{s}_i$'s must have full $\ensuremath{\mathbb{F}_q}$-rank in Algorithm~\ref{alg:modKeyGen}}). Each row of \eqref{eq:kpub_as_corrupted_interleaved_codeword} is a codeword of a Gabidulin code over $\ensuremath{\mathbb{F}_{q^m}}$ that is corrupted by an error of rank weight $w$. Both the corrupted Gabidulin codeword over $\ensuremath{\mathbb{F}_{q^{mu}}}$ as well as over $\ensuremath{\mathbb{F}_{q^m}}$ can be decoded using the randomized decoding approach proposed in~\cite{renner2019randomized}.
Since applying the attack on each row of the unfolded public key is more efficient, we conclude that the randomized Gabidulin decoding attack on the public key has an average complexity of
\begin{equation*}
\text{WF}_{\text{RGD}} = \frac{n}{64}\cdot q^{m(n-k)-w(n+m)+w^2+\min\{2\xi(\frac{n+k}{2}-\xi),wk\} }
\end{equation*}
over $\ensuremath{\mathbb{F}_{q^m}}$.

\subsubsection{Moving to Another Close Error Attack}\label{ssec:attack_moving_to_error}
The following attack was suggested by Rosenkilde~\cite{Johan_attack}.
It tries to move the vector $\vec{z}$ (which we have chosen such that the interleaved decoder fails) to a close vector of the same or smaller rank weight $w$ for which the interleaved decoder for $\ensuremath{\mathbf{k}_{\mathsf{pub}}}$ does not fail.

The idea is to find a vector $\vec{y} \in \ensuremath{\mathbb{F}_{q^m}}^{u \times n}$ such that $\vec{z}^\prime := \vec{z} + \vec{y}$ still has rank weight $\rank_q(\vec{z}^\prime) \leq w$ and that the rank of the matrix from~\eqref{eq:matrix-repair} over $\ensuremath{\mathbb{F}_{q^m}}$ is at least $w$.
To guarantee the first condition, we want to construct $\vec{y}$ such that its extended $um \times n$ matrix over $\ensuremath{\mathbb{F}_q}$ has a row space $\mathcal{R} := \mathrm{RowSpace}_{\ensuremath{\mathbb{F}_q}}\big(\extsmallfield_{\boldsymbol{\gamma}}(\vec{y})\big)$ that is contained in the one of $\vec{z}$.
Since for the original error $\vec{z}$, the matrix \eqref{eq:matrix-repair} has rank $\varphi \leq \ensuremath{\zeta}(n-k-w)$, $\mathcal{R}$ must have at least $\ensuremath{\mathbb{F}_q}$-dimension $w-\varphi \geq w(\ensuremath{\zeta}+1)-\ensuremath{\zeta}(n-k)$.
By choosing a random $\mathcal{R}$ with this property and taking a random matrix $\vec{y}$ whose extended matrix has $\ensuremath{\mathbb{F}_q}$-row space $\mathrm{RowSpace}_{\ensuremath{\mathbb{F}_q}}\big(\extsmallfield_{\boldsymbol{\gamma}}(\vec{y})\big) = \mathcal{R}$, the second condition is fulfilled with high probability.

The complexity of the attack is hence dominated by the complexity of finding a subspace $\mathcal{R} \subseteq \ensuremath{\mathbb{F}_q}^{n}$ of dimension $w-\varphi$ that is contained in the $w$-dimensional $\ensuremath{\mathbb{F}_q}$-row space of $\vec{z}$.
Since this is unknown, we can find it in a Las-Vegas fashion by repeatedly drawing a subspace uniformly at random.
The expected number of iterations until we find a suitable row space is thus one over the probability that a random $(w-\varphi)$-dimensional subspace of $\ensuremath{\mathbb{F}_q}^n$ is contained in a given $w$-dimensional subspace, which is (cf.~\cite[Proof of Lemma~7]{etzion2011error}):
\begin{align*}
\frac{\qbinomial{w}{w-\varphi}}{\qbinomial{n}{w-\varphi}} \approx \frac{q^{\varphi(w-\varphi)}}{q^{(n-w+\varphi)(w-\varphi)}} = q^{-(n-w)(w-\varphi)} \leq q^{-(n-w)(w(\ensuremath{\zeta}+1)-\ensuremath{\zeta}(n-k))}.
\end{align*}
Hence, the attack has work factor
\begin{align*}
\text{WF}_{\text{MCE}} &= q^{(n-w)(w-\varphi)} \geq q^{(n-w)(w(\ensuremath{\zeta}+1)-\ensuremath{\zeta}(n-k))}.
\end{align*}

\subsection{Exponential-Time Attacks on \textup{\textsf{ResG-Search}}}\label{ssec:attacks_ciphertext}
Retrieving information about the plaintext from the ciphertext and the public key is equal to solving \textup{\textsf{ResG-Search}} (Problem~\ref{pro:fl-decision}). In this section, methods that solve this problem are summarized.

\subsubsection{Randomized Gabidulin Decoding Attack on the Ciphertext}\label{ssec:attack_rsd_cipher}

Each ciphertext of {\textsf{LIGA}} can be seen as a Gabidulin codeword over $\ensuremath{\mathbb{F}_{q^m}}$ plus an error:
\begin{align*}
\vec{c} &= (\vec{m},\vec{0}_u) \cdot \mathbf G_{\mycode{G}} + \Tr(\alpha \ensuremath{\mathbf{k}_{\mathsf{pub}}}) + \vec{e} \\
&= \underbrace{\left[(\vec{m},\vec{0}_u) + \Tr(\alpha \vec{x})\right] \cdot \mathbf G_{\mycode{G}}}_{\text{codeword}} + \underbrace{\Tr(\alpha\vec{z}) + \vec{e}}_{\text{error}}
\end{align*}
Denote $\tilde{w} := \rank_{\ensuremath{\mathbb{F}_q}}(\Tr(\alpha\vec{z}) + \vec{e})$.
Then we can use the decoding algorithm proposed in~\cite{renner2019randomized}, which requires on average at least
\begin{equation}
\frac{n}{64}\cdot q^{m(n-k)-\tilde{w}(n+m)+\tilde{w}^2+\min\{2\xi(\frac{n+k}{2}-\xi),\tilde{w}k\} } \label{eq:WF_RGD}
\end{equation}
operations in $\ensuremath{\mathbb{F}_{q^m}}$.

Clearly, the complexity of the algorithm strongly depends on the value $\tilde{w}$, which in turn depends on the generated keys.
{In general, $\tilde{w} = w +\ensuremath{t_{\mathsf{pub}}}$, but for some choices of $\vec{z}$, $\alpha$, and $\ensuremath{\mathbf{e}}$, the rank $\tilde{w}$ is smaller.
For this issue, see Section~\ref{ssec:weak_keys} and Appendix~\ref{app:probability_of_large_error_weight}, where we study the probability that $\tilde{w}$ is small, both for randomness in the encryption (random choice of $\alpha$ and $\ensuremath{\mathbf{e}}$) and the key generation (random choice of $\vec{z}$).
Some extremely rarely occurring keys (weak keys) thereby result in relatively high probabilities that $\tilde{w}$ is small.

However, we can choose the system parameters such that both, the probability of a weak key as well as the conditional probability that $\tilde{w}<w$ given a non-weak key is below $2^{-\ensuremath{\lambda}}$.
Hence, with overwhelming probability, a random key and ciphertext result in a ciphertext error of rank weight $\tilde{w}\geq w$ and the work factor of this attack is always at least as large as the ``Randomized Gabidulin Decoding Attack on the Public Key'' in Section~\ref{ssec:attacks_public_key}.}

\subsubsection{List Decoding of the Ciphertext Attack}\label{ssec:list_decoding_attack_ciphertext}
As described in the Randomized Gabidulin Decoding Attack on the Ciphertext above, the ciphertext of {\textsf{LIGA}} is a codeword of a Gabidulin code, corrupted by an error of rank weight $\tilde{w}$,  Hence, an attacker can try to decode the ciphertext directly.
Since $\tau$ is always greater than the unique decoding radius $\left\lfloor \frac{n-k}{2}\right\rfloor$ of the Gabidulin code, this would require the existence of an efficient (list) decoding algorithm up to radius $\tau$.
As explained previously, there is no such algorithm and bounds on the list size prove that there cannot exist a generic list decoding algorithm for all Gabidulin codes which indicates that list decoding is a hard problem.

However, to be secure, we have considered list decoding as follows for the security level of our system.
The list size $\mathcal{L}_\text{$\c$,worst}$ denotes a lower bound on the \emph{worst-case} work factor of list decoding.
For example, for a Gabidulin code with parameters $n\mid m$ and $\gcd(n,n-\tau)\geq 2$, there is a received word such that there are at least
\begin{align}\label{eq:list_size_cipher}
\mathcal{L}_\text{$\c$,worst} \geq \max\left\{
\frac{\qbinomialField{n/g}{(n-\tau)/g}{q^g}}
{q^{n (\tau/g-1)}} \, : \, g \geq 2, \, g \mid \gcd(n,n-\tau) \right\}
\end{align}
codewords in rank distance at most $\tau$ to it.

Although $\mathcal{L}_\text{$\c$,worst}$ does not imply any statement about the average list size/average work factor, it provides an estimate of the order of magnitude of the work factor of a hypothetical list decoding attack.
For our suggested parameters, we have ensured that the value of $\mathcal{L}_\text{$\c$,worst}$
is sufficiently large in the proposed sets of parameters in Section~\ref{sec:parameters}.

\subsubsection{Combinatorial Rank Syndrome Decoding (RSD) Attack}\label{ssec:attack_syndrome_decoding}
The ciphertext can be interpreted as a codeword from a code of dimension $k$ (see~\cite{faure2006new}), generated by the generator matrix
\begin{equation*}
\begin{pmatrix}
\Mooremat{k-u}{q}{\vec{g}}\\
\Tr(\gamma_1 \ensuremath{\mathbf{k}_{\mathsf{pub}}})\\
\vdots\\
\Tr(\gamma_u \ensuremath{\mathbf{k}_{\mathsf{pub}}})\\
\end{pmatrix}.
\end{equation*}
Since the structure of this code only permits decoding like a random rank-metric code, it can be decoded with the combinatorial syndrome decoding attack from~\cite{Aragon2018-DecAttack} whose complexity is in the order of
\begin{align*}
\text{WF}_{\text{CRSD}}=(n-k)^3m^3q^{\ensuremath{t_{\mathsf{pub}}} \lceil \frac{(k+1)m}{n} \rceil -m}.
\end{align*}

\subsubsection{Algebraic RSD Attack}\label{ssec:attack_algebraic_syndrome_decoding}
As described in the previous section, the \textsf{ResG-Search} problem can be solved by decoding an error of rank weight $\ensuremath{t_{\mathsf{pub}}}$ in a random $[n,k]$ code. Beside the combinatorial approach, there exist algebraic algorithms to solve the Problem.

In~\cite{B3GNRT19}, the RSD problem is expressed as a multivariate polynomial system and is solved by computing a Gröbner basis. The complexity of that attack is generally smaller than the combinatorial approach. In case there is a unique solution to the system, then the work factor of the algorithm is
\begin{equation*}
  \text{WF}_{\text{Gr}} =
\begin{cases}
  \left[ \frac{((m+n)\ensuremath{t_{\mathsf{pub}}})^{\ensuremath{t_{\mathsf{pub}}}}}{\ensuremath{t_{\mathsf{pub}}}!} \right]^\mu & \text{if $m{n-k-1 \choose \ensuremath{t_{\mathsf{pub}}} } \le {n \choose \ensuremath{t_{\mathsf{pub}}}}$} \\[8pt]
  \left[ \frac{((m+n)\ensuremath{t_{\mathsf{pub}}})^{\ensuremath{t_{\mathsf{pub}}}+1}}{(\ensuremath{t_{\mathsf{pub}}}+1)!} \right]^\mu & \text{otherwise, }
  \end{cases}
  \end{equation*}
where $\mu = 2.807$ is the linear algebra constant.

{Very recently, a new algebraic algorithm was proposed to solve the RSD problem~\cite{bardet2020algebraic}. It divides the RSD problem instances into two categories. If
\begin{equation*}
 m\binom{n-k-1}{\ensuremath{t_{\mathsf{pub}}}} \geq \binom{n}{\ensuremath{t_{\mathsf{pub}}}} -1,
\end{equation*}
we are in the overdetermined case and the proposed algorithm has work factor
\begin{equation*}
 \text{WF}_{\text{Wogr}} = m \binom{n-p-k-1}{\ensuremath{t_{\mathsf{pub}}}} \binom{n-p}{\ensuremath{t_{\mathsf{pub}}}}^{\mu-1}
\end{equation*}
in $\ensuremath{\mathbb{F}_q}$, where $p= \min \{i: i \in \{1,\hdots,n\}, m \binom{n-i-k-1}{\ensuremath{t_{\mathsf{pub}}}} \geq \binom{n-i}{\ensuremath{t_{\mathsf{pub}}}}-1\}$. Otherwise, we are in the underdetermined case in which the algorithm has work factor
\begin{equation*}
  \text{WF}_{\text{Wogr}} = \min \{ \text{WF}_{\text{Under}}, \text{WF}_{\text{Hybrid}} \}.
\end{equation*}
We have
\begin{equation*}
  \text{WF}_{\text{Hybrid}} = q^{a \ensuremath{t_{\mathsf{pub}}}} m \binom{n-k-1}{\ensuremath{t_{\mathsf{pub}}}} \binom{n-a}{\ensuremath{t_{\mathsf{pub}}}} ^{\mu-1}
\end{equation*}
with $a = \min \{i: i \in \{1,\hdots,n\}, m \binom{n-k-1}{\ensuremath{t_{\mathsf{pub}}}} \geq \binom{n-i}{\ensuremath{t_{\mathsf{pub}}}}\ - 1\}$. Further, for $0<b<\ensuremath{t_{\mathsf{pub}}}+2$ and $A_b -1 \leq B_b + C_b$,
\begin{equation*}
  \text{WF}_{\text{Under}} = \frac{B_b \binom{k+\ensuremath{t_{\mathsf{pub}}}+1}{\ensuremath{t_{\mathsf{pub}}}} + C_b(mk+1)(\ensuremath{t_{\mathsf{pub}}}+1)}{B_b+C_b}\Bigg( \sum_{j=1}^{b} \binom{n}{\ensuremath{t_{\mathsf{pub}}}} \binom{mk+1}{j} \Bigg)^2,
\end{equation*}
where $A_b:=\sum_{j=1}^{b}\binom{n}{\ensuremath{t_{\mathsf{pub}}}} \binom{mk+1}{j}$, $B_b:=\sum_{j=1}^{b} m\binom{n-k-1}{\ensuremath{t_{\mathsf{pub}}}}\binom{mk+1}{j}$ and
\begin{equation*}
  C_b := \sum_{j=1}^{b} \sum_{i=1}^{j} \bigg( (-1)^{i+1} \binom{n}{\ensuremath{t_{\mathsf{pub}}}+i} \binom{m+i-1}{i} \binom{mk+1}{j-i} \bigg).
\end{equation*}

We denote the minimum of the work factors of the two algorithms as the work factor of the algebraic RSD attack, i.e.,
\begin{equation*}
  \text{WF}_{\text{ARSD}} = \min\{ \text{WF}_{\text{Gr}}, \text{WF}_{\text{Wogr}} \}.
\end{equation*}
Note that for algebraic decoding, it is neither known how to improve the complexity by using the fact that there are multiple solutions, nor it is known how to speed up the algorithm in the quantum world.
}

\subsubsection{Linearization Attack}\label{ssec:attack_linearization}
In~\cite{faure2006new}, a message attack was proposed which succeeds for some parameters with high probability in polynomial time.
\begin{lemma}[Linearization Attack {\cite{faure2006new}}]
Let $\ensuremath{\mathbf{k}_{\mathsf{pub}}}^{(i)} = \Tr(\gamma_i \ensuremath{\mathbf{k}_{\mathsf{pub}}})$ for $i=1,\dots,u$ and
\begin{align}
\vec{M} =
\begin{pmatrix}
\Mooremat{\ensuremath{t_{\mathsf{pub}}}+1}{q}{\c} \\
-\Mooremat{\ensuremath{t_{\mathsf{pub}}}+1}{q}{\ensuremath{\mathbf{k}_{\mathsf{pub}}}^{(1)}} \\
\vdots \\
-\Mooremat{\ensuremath{t_{\mathsf{pub}}}+1}{q}{\ensuremath{\mathbf{k}_{\mathsf{pub}}}^{(u)}} \\
-\Mooremat{k+\ensuremath{t_{\mathsf{pub}}}-u}{q}{\vec{g}}
\end{pmatrix}. \label{eq:M_linearization_attack}
\end{align}
Then, the encrypted message $\vec{m}$ can be efficiently recovered if the left kernel of $\vec{M}$ has dimension $\dim(\ker(\vec{M})) = 1$.
\end{lemma}

If $(u+2)\ensuremath{t_{\mathsf{pub}}} + k > n$, then $\vec{M}$ has at least two more rows than columns and we have $\dim(\ker(\vec{M}))>1$.
If $\ensuremath{\mathbf{k}_{\mathsf{pub}}}$ is random and $(u+2)\ensuremath{t_{\mathsf{pub}}} + k \leq n$, the attack is efficient with high probability~\cite{faure2006new}.

\begin{lemma}
Let $\vec{M}$ be as in \eqref{eq:M_linearization_attack}. Then,
\begin{align*}
\rank_{q^m}(\vec{M}) \leq \min\{\varphi + k + 2\ensuremath{t_{\mathsf{pub}}} -u,n \}.
\end{align*}
\end{lemma}

\begin{proof}
We can write
\begin{align*}
\ensuremath{\mathbf{k}_{\mathsf{pub}}}^{(i)} &= \Tr(\gamma_i \ensuremath{\mathbf{k}_{\mathsf{pub}}}) \\
&= \Tr(\gamma_i \vec{x}) \cdot \Mooremat{k}{q}{\vec{g}} + \vec{z}_i,
\end{align*}
so by elementary row operations, we can transform $\vec{M}$ into
\begin{align*}
\vec{M}' = \begin{pmatrix}
\Mooremat{\ensuremath{t_{\mathsf{pub}}}+1}{q}{\c} \\
-\Mooremat{\ensuremath{t_{\mathsf{pub}}}+1}{q}{\vec{z}_1} \\
\vdots \\
-\Mooremat{\ensuremath{t_{\mathsf{pub}}}+1}{q}{\vec{z}_u} \\
-\Mooremat{k+\ensuremath{t_{\mathsf{pub}}}-u}{q}{\vec{g}}
\end{pmatrix}.
\end{align*}
Due to $w+2\ensuremath{t_{\mathsf{pub}}}<n-k$, the matrix $\Mooremat{\ensuremath{t_{\mathsf{pub}}}+1}{q}{\vec{z}_i}$ is a sub-matrix of $\Mooremat{n-k-w}{q}{\vec{z}_i}$, so
\begin{align*}
&\rank_{q^m} (\vec{M}) = \rank_{q^m} (\vec{M}') \\
&\leq \varphi + \rank_{q^m} (\Mooremat{\ensuremath{t_{\mathsf{pub}}}+1}{q}{\c}) + \rank_{q^m} (\Mooremat{k+\ensuremath{t_{\mathsf{pub}}}-u}{q}{\vec{g}}) \\
&= \varphi + k + 2\ensuremath{t_{\mathsf{pub}}} -u.
\end{align*}
Further, since the number of columns of $\vec{M}$ is equal to $n$,
\begin{equation*}
\rank_{q^m} (\vec{M}) \leq n.
\end{equation*}
\qed
\end{proof}

The linearization attack is inefficient if the rank of $\vec{M}$ is smaller than its number of rows, which implies the following, stronger version of the original statement in~\cite{faure2006new}.
\begin{theorem}\label{cor:linearization_new}
  If $\ensuremath{t_{\mathsf{pub}}} > \tfrac{n-k}{u+2}$ or $\varphi < u (\ensuremath{t_{\mathsf{pub}}}+1)$, the linearization attack in \cite{faure2006new} is inefficient and its work factor is
  \begin{align*}
    \text{WF}_{\mathrm{Lin}} = q^{m \cdot \max\{u \ensuremath{t_{\mathsf{pub}}} + u + 1 - \varphi,(u+2)\ensuremath{t_{\mathsf{pub}}} + k +1 -n\}}.
  \end{align*}
\end{theorem}
The first condition in Corollary~\ref{cor:linearization_new} is again fulfilled by the choice of $w$ in Table~\ref{tab:parameters}.
The second one reads
$\ensuremath{t_{\mathsf{pub}}} > \tfrac{\varphi}{u}+1$,
and for any valid $\varphi$, there are choices of $w$ such that $\ensuremath{t_{\mathsf{pub}}}$ fulfills this inequality for any $u>1$.

\subsubsection{Algebraic Attacks}\label{ssec:algebraic_attacks}
Faure and Loidreau \cite{faure2006new} also described two message attacks of exponential worst-case complexity. The first one is based on computing gcds of polynomials of degrees and has a work factor
\begin{equation}
\text{WF}_{\text{GCD}}=
 q^{m(u-1)}\frac{q^{\ensuremath{t_{\mathsf{pub}}}+1}-1}{q-1}. \label{eq:algebraic_attack_work_factor}
\end{equation}
Since computing the gcd of two polynomials can be implemented in quasi-linear time in the polynomials' degree,~\eqref{eq:algebraic_attack_work_factor} gives an estimate on the work factor of this attack. The second algebraic attack is based on finding Gr\"obner bases of a system of
$n_\mathrm{p} = \tbinom{n}{k+2 \ensuremath{t_{\mathsf{pub}}}-u+1}$ many polynomials of degree approximately $d_\mathrm{p} = \tfrac{q^{\ensuremath{t_{\mathsf{pub}}}+1}-1}{q-1}$.
The attack is only efficient for small code parameters, cf.~\cite[Sec.~5.3]{faure2006new}. Since the average-case complexity of Gr\"obner bases algorithms is hard to estimate, we cannot directly relate $n_\mathrm{p}$ and $d_\mathrm{p}$ to the attack's work factor. Faure and Loidreau choose the code parameters such that $n_\mathrm{p} \approx 2^{32}$ and $d_\mathrm{p} = 127$ and claim that the attack is inefficient for these values. Our example parameters in Section~\ref{sec:parameters} result in at least these values.

\subsubsection{Overbeck-like Attack}\label{ssec:attack_overbeck-like}
The key attack described in \cite[Ch.~7, Sec.~2.1]{LoidreauHabitilation-RankMetric_2007} is based on a similar principle as Overbeck uses to attack the McEliece cryptosystem based on Gabidulin codes~\cite{Overbeck-StructuralAttackGPT}.
The attack from \cite[Ch.~7, Sec.~2.1]{LoidreauHabitilation-RankMetric_2007} cannot be applied if
\begin{equation*}
w \geq n-k -\frac{k-u}{u-1}.
\end{equation*}

\subsubsection{Brute-Force Attack on the Element $\alpha$}\label{ssec:attack_brute-force-alpha}
An attacker can brute-force $\alpha \in \ensuremath{\mathbb{F}_{q^{mu}}}$, which has a complexity of
\begin{align*}
\text{WF}_{\alpha}=  q^{mu}.
\end{align*}
By knowing $\alpha$, he just needs to apply an efficient decoding algorithm on $\tilde{\vec{c}} = \vec{c} - \Tr(\alpha \ensuremath{\mathbf{k}_{\mathsf{pub}}})$ to retrieve the secret message.

\subsection{Exponential-Time Attacks on \textup{\textsf{ResIG-Dec}}}\label{ssec:sec_analysis_IG-Dec}
We have seen in Section~\ref{sec:semantic} that {\textsf{LIGA}} is IND-CCA2 secure under the assumption that \textup{\textsf{ResG-Dec}} is a hard problem.
The two previous subsections analyzed all known attacks on the \textup{\textsf{ResG-Search}} and \textup{\textsf{ResIG-Search}} problems, which are relevant since there is an obvious reduction of \textup{\textsf{ResG-Dec}} to these search problems.

In the following, we study Problem~\textup{\textsf{ResIG-Dec}} (which translates to distinguishing the public key from a random vector in $\ensuremath{\mathbb{F}_{q^{mu}}}^n$), which is different in the sense that we do not know an efficient reduction from \textup{\textsf{ResG-Dec}} (or one of the search problems) to \textup{\textsf{ResIG-Dec}}.
In other words, even if distinguishing the public key is easy, it might still be hard to distinguish the ciphertext.
Nevertheless, we study the hardness of \textup{\textsf{ResIG-Dec}} in the following and present a distinguisher, which is efficient to compute if $\zeta$ is chosen small.
The distinguisher is as follows.

Recall the choice of $\ensuremath{\mathbf{k}_{\mathsf{pub}}}$ in Algorithm~\ref{alg:modKeyGen}.
We have
\begin{align*}
\ensuremath{\mathbf{k}_{\mathsf{pub}}} = \vec{x} \cdot \mathbf G_{\mycode{G}} + \vec{z} \in \ensuremath{\mathbb{F}_{q^{mu}}}^n.
\end{align*}
Expand $\ensuremath{\mathbf{k}_{\mathsf{pub}}}$ into a $u \times n$ matrix over $\ensuremath{\mathbb{F}_{q^m}}$ and choose any $\zeta+1$ rows.
As the $\ensuremath{\mathbb{F}_{q^m}}$-expansion of the error $\vec{z}$ has $\ensuremath{\mathbb{F}_{q^m}}$-rank $\zeta$, there are at least $q^m-1$ many non-trivial $\ensuremath{\mathbb{F}_{q^m}}$-linear combinations of these $\zeta+1$ rows that are codewords of~$G_{\mycode{G}}$.
This is not true with high probability for a random $u \times n$ matrix over $\ensuremath{\mathbb{F}_{q^m}}$.

Thus, by repeatedly randomly linearly combining these $\zeta+1$ rows and checking whether the result is a codeword of $G_{\mycode{G}}$, we obtain a Monte-Carlo algorithm with an expected work factor of
\begin{align}
\text{WF}_{\ensuremath{\mathbf{k}_{\mathsf{pub}}},\mathrm{distinguisher}} = q^{m\zeta}, \notag
\end{align}
neglecting the cost of checking whether a vector in $\ensuremath{\mathbb{F}_{q^m}}^n$ is a codeword.
Hence, if $m\zeta$ is smaller than the security parameter of the system, this distinguisher is feasible to compute.

{
\subsection{{Avoiding} Weak Keys}\label{ssec:weak_keys}

As already discussed in Section~\ref{ssec:attacks_ciphertext}, the work factors of the ``Randomized Gabidulin Decoding Attack on the Ciphertext'' and the ``List Decoding of the Ciphertext Attack'' depend on the rank of the error part $\Tr(\alpha\vec{z}) + \vec{e}$ of the ciphertext (seen as codeword plus error).
Generically, this error has weight $\ensuremath{t_{\mathsf{pub}}}+\ensuremath{\mathbf{e}}$, but due to the trace operation and the addition, the rank might be smaller.

In Appendix~\ref{app:probability_of_large_error_weight}, we will analyze the probability that for a given key (i.e., $\vec{z}$ in this case) and a random encryption (random choices of $\alpha$ and $\ensuremath{\mathbf{e}}$) the rank is significantly smaller than expected (we use $<w$ as a threshold, see Section~\ref{ssec:attacks_ciphertext}).
Briefly summarized, we get the following results.

It turns out that this probability heavily depends on the minimum distance of the code $\mathcal{A}$ used to generate $\vec{z}$ in Algorithm~\ref{alg:modKeyGen}.
The smaller this minimum distance, the larger the probability that the rank is low.
More precisely, for a given $\mathcal{A}$ of minimum distance $2 \leq t \leq w-\zeta+2$
\begin{equation*}
\Pr(\rank_{\ensuremath{\mathbb{F}_q}}(\Tr(\alpha\vec{z}) + \vec{e})<w) \leq q^{-m\zeta}+64 \min\{t,\ensuremath{t_{\mathsf{pub}}}\}^2 q^{-(t+\ensuremath{t_{\mathsf{pub}}}-w+1)\left(n+\frac{t-3w-\ensuremath{t_{\mathsf{pub}}}}{2}\right)},
\end{equation*}
cf.~Theorem~\ref{thm:strong_key_ciphertext_error_weight_probability} in Appendix~\ref{app:probability_of_large_error_weight}.

Due to the above discussion, we call a key with $\Pr(\rank_{\ensuremath{\mathbb{F}_q}}(\Tr(\alpha\vec{z}) + \vec{e})<w)>2^{-\ensuremath{\lambda}}$ a \emph{weak key}.
In Appendix~\ref{app:probability_of_large_error_weight}, we derive an upper bound on the probability of choosing weak key (i.e., an $\mathcal{A}$ of too small minimum distance) in Algorithm~\ref{alg:modKeyGen}.
For $\zeta q^{\zeta w-m} \leq \tfrac{1}{2}$, this bound is roughly
\begin{equation*}
\Pr(\text{weak key}) \leq \Theta\!\left( q^{m[t-(w-\zeta+2)]} \right),
\end{equation*}
cf.~Remark~\ref{rem:asymptotic_weak_key} (see Theorem~\ref{thm:strong_key_ciphertext_error_weight_probability} for a non-asymptotic bound) in Appendix~\ref{app:probability_of_large_error_weight}, where $t$ is the smallest minimum distance for which the key is not weak.

It can be seen that the parameters of {\textsf{LIGA}} can be chosen such that there is a $t$ with $2 \leq t \leq w-\zeta+2$ such that both $\Pr(\rank_{\ensuremath{\mathbb{F}_q}}(\Tr(\alpha\vec{z}) + \vec{e})<w)$ (for any non-weak key) and $\Pr(\text{weak key})$ are smaller than $2^{-\ensuremath{\lambda}}$.
This is the case for all parameters proposed in Table~\ref{tab:parameters}.
}

\subsection{Summary of the Work Factors}

In this section, we recall the conditions on the choice of the parameters such that all known attacks are inefficient and summarize their work factors. Furthermore, we give specific parameters and compare {\textsf{LIGA}} to other code-based cryptosystems.

In the following, we choose the parameters $q$, $m$, $n$, $k$, $u$, $w$, and $\ensuremath{t_{\mathsf{pub}}}$ as in Table~\ref{tab:parameters}.
Recall that this choice of $w$ prevents the Overbeck-like attack (Section~\ref{ssec:attack_overbeck-like}) and results in an exponential work factor of the linearization attack (Section~\ref{ssec:attack_linearization}).

Furthermore, we choose $\ensuremath{\zeta}$ to be small such that the work factor of searching the exponentially-large output of the interleaved decoding attack (Section~\ref{ssec:attack_interleaved_decoding}) is large.
Note that the latter attack returns an exponentially-large output if and only if the GOT \cite{Gaborit2018-FL-Attack} attack fails, cf.~Theorem~\ref{thm:equiv-int-got}.

The resulting considered work factors are summarized in Table~\ref{tab:wf_attacks}.
In addition to these work factors, we have considered the following requirements:
\begin{itemize}
\item The work factor of the second algebraic attack in \cite{faure2006new} (cf.~Section~\ref{ssec:algebraic_attacks}) is unknown.
Hence, we choose the code parameters such that the resulting non-linear system of equations occurring in the attack consists of more than $n_\mathrm{p} \approx 2^{32}$ many polynomials of degree at least $d_\mathrm{p} = 127$. This is the same choice as in \cite{faure2006new}.
\item Since there is no efficient list decoder for Gabidulin codes, the work factor of the list decoding the public key or the ciphertext in Section~\ref{ssec:list_decoding_attack_ciphertext} is not known.
However, we do have a lower bound on the worst-case work factor for some codes, given by the maximal list size $\mathcal{L}_\text{$\c$,worst}$ in \eqref{eq:list_size_cipher}.
In all examples for which the bound holds, we chose the parameters such that $\log_2(\mathcal{L}_\text{$\c$,worst})$ is much larger than the claimed security level.
\item {The probability of generating a weak key should be negligible. Thus, we choose the parameters such that $\zeta q^{\zeta w-m} \leq \tfrac{1}{2}$ and
    \begin{align*}
      \Pr(\text{weak key}) &\leq \frac{q^{m\zeta}-1}{(q^m-1)(q^{mw}-1)}\left( \sum_{i=0}^{t-1} \qbinomialField{w}{i}{q} \prod_{j=0}^{i-1} \left(q^m-q^j\right) -1 \right) \\
                             &\leq 2^{-\ensuremath{\lambda}},
\end{align*}
where $\ensuremath{\lambda}$ is the security parameter and
\begin{align*}
t := \min\left\{ t \, : \,  q^{-m\zeta}+64 \min\{t,\ensuremath{t_{\mathsf{pub}}}\}^2 q^{-(t+\ensuremath{t_{\mathsf{pub}}}-w+1)\left(n+\frac{t-3w-\ensuremath{t_{\mathsf{pub}}}}{2}\right)} \leq 2^{-\ensuremath{\lambda}} \right\}.
\end{align*}
}

\end{itemize}

\begin{table*}
  \caption{Summary of the Discussed Attacks' Work Factor.}
  \renewcommand{\arraystretch}{1.6}
\begin{center}
  \begin{tabular}{r|l}
   Name of the attack & Work factor \\
    \hline
    Brute-force $\vec{z}$ (Sec.~\ref{ssec:attack_brute-force_z}) & $\text{WF}_{\text{ILD}}=\frac{q^{w(n-w)}}{\mathcal{N}}$\\
    Interleaved Decoding (Sec.~\ref{ssec:attack_interleaved_decoding}) & $\text{WF}_{\text{ILD}}= \frac{q^{m(w-\ensuremath{\zeta}(n-k-w))}}{\mathcal{N}}$  \\
    Randomized Decoding (Sec.~\ref{ssec:attack_rsd_pk}) & $\text{WF}_{\text{RGD}} = \frac{n}{64} q^{m(n-k)-w(n+m)+w^2+\min\{2\xi(\frac{n+k}{2}-\xi),wk\} }$ \\
    Moving to Close Error (Sec.~\ref{ssec:attack_moving_to_error}) &    $\text{WF}_{\text{MCE}} = q^{(n-w)(w(\ensuremath{\zeta}+1)-\ensuremath{\zeta}(n-k))}$ \\
    \hline
    Combinatorial RSD (Sec.~\ref{ssec:attack_syndrome_decoding}) &$ \text{WF}_{\text{CRSD}}=(n-k)^3m^3q^{\ensuremath{t_{\mathsf{pub}}} \big \lceil\frac{(k+1)m}{n} \big\rceil -m}$ \\
    Algebraic RSD (Sec.~\ref{ssec:attack_algebraic_syndrome_decoding}) & $ \text{WF}_{\text{ARSD}}$ \\
    Linearization (Sec.~\ref{ssec:attack_linearization}) & $\text{WF}_{\text{Lin}} = q^{m \cdot \max\{u \ensuremath{t_{\mathsf{pub}}} + u + 1 - \varphi,(u+2)\ensuremath{t_{\mathsf{pub}}} + k +1 -n\}}$ \\
    GCD based attack (Sec.~\ref{ssec:algebraic_attacks}) & $\text{WF}_{\text{GCD}} = q^{m(u-1)}\frac{q^{\ensuremath{t_{\mathsf{pub}}}+1}-1}{q-1}$  \\
    Brute-force $\alpha$ (Sec.~\ref{ssec:attack_brute-force-alpha}) & $\text{WF}_{\alpha}=  q^{mu}$ \\
	\hline
	Distinguisher for $\ensuremath{\mathbf{k}_{\mathsf{pub}}}$ (Sec.~\ref{ssec:sec_analysis_IG-Dec}) & $\text{WF}_{\ensuremath{\mathbf{k}_{\mathsf{pub}}},\mathrm{distinguisher}} = q^{m\zeta}$
  \end{tabular}
\end{center}
\label{tab:wf_attacks}
\end{table*}

\renewcommand{\arraystretch}{1.2}
\setlength{\tabcolsep}{10pt}
\begin{table*}[!t]
	\caption{Parameter sets for 128, 192 and 256 bit security.}
	\begin{center}
		\begin{tabular}{l||c|c|c|c|c|c|c|c|c }
			Parameter Set &$q$ & $u$ & $k$ & $n$ & $m$ & $\zeta$ & $w$ & $\ensuremath{t_{\mathsf{pub}}}$ & $R$ \\
			\hline  \hline

                  {\textsf{LIGA}}-128 & 2 & 5 & 53 & 92 & 92 & 2 & 27  & 6 & 0.52 \\

                  {\textsf{LIGA}}-192 & 2 & 5 & 69 & 120 & 120 & 2 & 35  & 8 & 0.53\\

                  {\textsf{LIGA}}-256 & 2 & 5 & 85 & 148 & 148 & 2 & 43  & 10 & 0.54 \\
                  \hline
                \end{tabular}
	\end{center}
	\label{tab:security_para}
	\vspace*{4pt}
\end{table*}

\begin{table*}[!t]
	\caption{Comparison of memory costs of $\ensuremath{\mathsf{sk}}$, $\ensuremath{\mathsf{pk}}$ and the ciphertext $\ensuremath{\mathsf{ct}}$ in Byte with IND-CCA-secure Loidreau~\cite{Bellini2019indcca} and the NIST proposals RQC~\cite{melchor2019rqc}, ROLLO~\cite{melchor2019rollo}, BIKE~\cite{aragon2019bike} and Classic McEliece~\cite{bernstein2019mceliece}. The entry 'yes' in the column DFR indicates that a scheme has a decryption failure rate larger than 0.} 	\begin{center}
		\begin{tabular}{l||c|c|c|c|c }
			System name & $\ensuremath{\mathsf{sk}}$ & $\ensuremath{\mathsf{pk}}$ & $\ensuremath{\mathsf{ct}}$ & Security & DFR \\
			\hline  \hline
                  \textsf{LIGA}-128 & 3795 & 6348 & 1058 & 128 bit & no  \\
                  RQC-I & 40 & 1834 & 3652 & 128 bit & no \\
                  ROLLO-I-128 & 40 & 696 & 696 & 128 bit & yes \\
                  Loidreau-128 & 7181 & 6720 & 464 & 128 bit & no \\
                  BIKE-2 Level 1 & 249 & 1271 & 1271 &  128 bit & yes \\
                  McEliece348864 & 6452 & 261120 & 128 & 128 bit & no \\

                  \hline
                  \textsf{LIGA}-192 & 6450 & 10800 & 1800 & 192 bit & no  \\
                  RQC-II & 40 & 2853 & 5690 & 192 bit & no \\
                  ROLLO-I-192 & 40 & 958 & 958 & 192 bit & yes \\
                  Loidreau-192 & 13548 & 11520 & 744 & 128 bit & no \\
                  BIKE-2 Level 2 & 387 & 2482 & 2482 & 192 bit & yes \\
                  McEliece460896 & 13568 & 524160 & 188 & 192 bit & no \\

                  \hline
                  \textsf{LIGA}-256 & 9805 & 16428 & 2738 & 256 bit & no  \\
                  RQC-III & 40 & 4090 & 8164 & 256 bit & no \\
                  ROLLO-I-256 & 40 & 1371 & 1371 & 256 bit & yes \\
                  Loidreau-256 & 14128 & 16128 & 1024 & 256 bit & no \\
                  BIKE-2 Level 3 & 513 & 4094 &  4094 & 256 bit & yes\\
                  McEliece6688128 & 13892 & 1044992 & 240 & 256 bit & no  \\
				\hline

		\end{tabular}
	\end{center}
	\label{tab:comparison}
\end{table*}

\section{Parameters and Key Sizes}\label{sec:parameters}
We propose parameters for security levels of $128$ bit, $192$ bit and $256$ bit in Table~\ref{tab:security_para}, where $R=\frac{k-u}{n}$ denotes the rate. The parameters are chosen in a way that we can send at least $256$ bit of information and thus the system can be used as a KEM. Further, we use a security margin of at least $20$ bit.  For all parameters, the algebraic attack based on computing gcds of polynomials is the most efficient attack.

To evaluate the performance of \textsf{LIGA}, we compare it to the IND-CCA-secure version~\cite{Bellini2019indcca} of Loidreau's system~\cite{Loidreau2017-NewRankMetricBased} and the NIST proposals RQC~\cite{melchor2019rqc}, ROLLO~\cite{melchor2019rollo}, BIKE~\cite{aragon2019bike} and Classic McEliece~\cite{bernstein2019mceliece}. We show the sizes of the private key $\ensuremath{\mathsf{sk}}$, the public key $\ensuremath{\mathsf{pk}}$ and the ciphertext $\ensuremath{\mathsf{ct}}$ in Byte in Table~\ref{tab:comparison}.

\section{Conclusion}\label{sec:conclusion}

In this paper, we presented a new rank-metric code-based cryptosystem: {\textsf{LIGA}}.
{\textsf{LIGA}} uses a new coding-theoretic interpretation of the Faure--Loidreau system.
We showed that the ciphertext is a corrupted codeword of a Gabidulin code, where to an unauthorized receiver, the error weight is too large to be correctable.
The authorized user knows the row space of a part of the error and is thus able to correct the error.
Further, we derived that a part of the public key can be seen as a corrupted codeword of an interleaved Gabidulin code and that in the original FL system, an interleaved Gabidulin decoder can efficiently recover the private key from this part of the public key with high probability.
We proved that the condition that interleaved Gabidulin decoders fail is equal to the condition that the severe attack by Gaborit, Otmani and Tal\'e Kalachi fails.

Based on the latter observation, we chose {\textsf{LIGA}}'s key generation algorithm such that interleaved Gabidulin decoders fail which in turn implies that the attack by Gaborit~\emph{et~al.} fails.

We proposed two versions of {\textsf{LIGA}} and proved that the public key encryption is IND-CPA secure and the KEM is IND-CCA2 secure under the assumption that the \textsf{ResG-Dec} problem is hard.
We extensively analyzed the security of this decisional problem by studying attacks on the \textsf{ResG-Search}, \textsf{ResIG-Search}, and \textsf{ResIG-Dec} (recall that there is a reduction of \textsf{ResG-Dec} to each of the two search problems).
All studied attacks have an exponential work factor in the proposed parameter ranges and can be avoided by parameter choice.

Finally, we presented parameters for security levels of $128$, $192$ and $256$ bit and compared them to the NIST proposals RQC, ROLLO, BIKE, Classic McEliece and a rank-metric McEliece-like system proposed by Loidreau.
It was observed that {\textsf{LIGA}} has small ciphertext sizes as well as relatively small key sizes.
Encryption and decryption correspond to encoding and decoding of Gabidulin codes, for which efficient and constant-time algorithms exist.
Further, the proposed system guarantees decryption and is not based on hiding the structure of a code.
Hence, the {\textsf{LIGA}} system should be considered as an alternative of small ciphertext and key size.

\section*{Acknowledgment}
The work of J.~Renner and A.~Wachter-Zeh was supported by the European Research Council (ERC) under the European Union's Horizon 2020 research and innovation programme (grant agreement no.~801434).

S.~Puchinger received funding from the European Union's Horizon 2020 research and innovation program under the Marie Sklodowska-Curie grant agreement no.~713683.

We would like to thank Johan Rosenkilde for proposing the ``moving to a close error'' attack.
Also, we are thankful to Michael Schelling for his observation that decryption of the FL system can be seen as error-erasure decoding.
Further, we thank Pierre Loidreau for his valuable comments on a previous version of this paper.
{We are also grateful to Alessandro Neri for fruitful discussions that helped to achieve the results in Appendix~\ref{app:probability_of_large_error_weight}.}

\bibliographystyle{splncs04}

redpajama_set_name: RedPajamaArXiv