The selection of parameters that offer best possible performance while simultaneously guaranteeing a well-defined level of security is one of the most challenging tasks in cryptographic system design. In order to ensure that the chosen parameters offer a certain level of security an estimation of the computational complexity of the underlying hard problem is required. To date, those estimations are often performed in an ad-hoc manner. This led to a scattered landscape of available estimation scripts, with multiple scripts for the same problem with varying outputs.

Recent works on reducing the size of Error Correcting Codes have investigated the usage of rank metric instead of Hamming metric. Numerous proposals for the NIST Post-Quantum Cryptography competition, including four second round candidates, rely on these codes. In this paper, we discuss several non-trivial issues when porting these schemes into real-world systems on different platforms, such as Intel x86, Armv6 and Armv8. We provide insights on how to implement the underlying finite field and polynomial arithmetic, or the generation of errors of a given rank in constant-time, and report execution time of several rank-based cryptosystems, showing that the achieved performance is similar to those of some of the most popular lattice-based cryptosystems.

It is notably challenging to design an efficient and secure signature scheme based on error-correcting codes. An approach to build such signature schemes is to derive it from an identification protocol through the Fiat-Shamir transform. All such protocols based on codes must be run several rounds, since each run of the protocol allows a cheating probability of either 2/3 or 1/2. The resulting signature size is proportional to the number of rounds, thus making the 1/2 cheating probability version more attractive. We present a signature scheme based on double circulant codes in the rank metric, derived from an identification protocol with cheating probability of 2/3. We reduced this probability to almost 1/2 to obtain the smallest signature among code-based signature schemes based on the Fiat-Shamir paradigm, around 22 KBytes for 128 bit security level. Furthermore, among all code-based signature schemes, our proposal has the lowest value of signature plus public key size, and the smallest secret and public key sizes. We provide a security proof in the Random Oracle Model, implementation performances, and a comparison with the parameters of similar signature schemes.

We present some upper bounds on the size of nonlinear codes and their restriction to systematic codes and linear codes. These bounds are independent of other known theoretical bounds, e.g., the Griesmer bound, the Johnson bound, the Plotkin bound, and of linear programming bounds. One of the new bound is actually an improvement of a bound by Zinoviev, Litsyn, and Laihonen. Our experiments show that in the linear case our bounds provide the best value in a wide range, compared with all other closed-formula upper bounds. In the nonlinear case, we also compare our bound with the linear programming bound and with some improvements on it, show that there are cases where we beat these bounds. In particular, we obtain a new bound in Brouwer's table for A3(16,3).