Gabidulin codes are a rank metric analog of Reed-Solomon codes. They are of great importance in rank-metric cryptography, as they are employed in highly efficient rank-based schemes, such as RQC and the Loidreau cryptosystem. However, until now, there has been no constant-time implementation of these codes, even though such an implementation is crucial for real-life development of cryptosystems. In this paper, we propose the first constant-time decoding algorithm of augmented Gabidulin (AG) codes, a simple variation of Gabidulin codes, in which columns of zeros are added to the end of a Gabidulin code. AG codes are used in the most efficient variants of the RQC cryptosystem. We prove that AG codes decoding can be achieved with quadratic complexity by reducing the decoding of an AG code to the decoding of a shorter standard Gabidulin code. In addition to the description of the complete AG codes decoding procedure, we present a constant-time algorithm for the left division of $q$-polynomials that can be used in every constant-time implementation of Gabidulin code variants. These algorithms are integrated into the RQC-Block-MS-AG scheme, and we evaluate the performance of our implementation through benchmarks. Our results show that our constant-time implementation outperforms the original RQC, though it remains approximately four to five times slower than HQC. However, it achieves ciphertext and key sizes about four times smaller, highlighting an appealing trade-off between performance and compactness.

翻译：暂无翻译