Matrix Code Permuted Kernel Problem

• The paper introduces MCPKP as the rank-metric analogue of PKP, offering a low-degree witness relation ideal for MPC-in-the-Head signature schemes.
• It details two equivalent formulations—generator-matrix and parity-check—that translate matrix code isometries into inhomogeneous kernel relations.
• The work rigorously analyzes cryptanalytic barriers and parameter choices, ensuring both computational hardness and efficient post-quantum signature construction in practice.

The Matrix Code Permuted Kernel Problem (MCPKP) is a rank-metric and matrix-code analogue of the classical Permuted Kernel Problem (PKP). It was introduced together with the Matrix Subcode Equivalence Problem (MSE) as a search/decision problem on matrix codes over a finite field $F=\mathbb F_q$, with the explicit cryptographic aim of supplying a low-degree witness relation for MPC-in-the-Head signature schemes (Bardet et al., 21 Jul 2025). In its parity-check form, MCPKP asks, given a parity-check matrix $\mathbf H$, a generator matrix $\mathbf G'$ of a smaller matrix code, and a target syndrome matrix $\mathbf Y$, whether there exist invertible matrices $\mathbf A\in GL_m(q)$ and $\mathbf B\in GL_n(q)$ such that

$$\mathbf G'(\mathbf A^{-\top}\otimes \mathbf B^{-1})\mathbf H^\top=\mathbf Y.$$

The problem is “permuted” in the sense that the hidden action is an isometry of the ambient matrix space, and it is “kernel” in the sense that the transformed code is constrained through a parity-check or syndrome relation rather than by direct equality of codes (Bardet et al., 21 Jul 2025).

1. Ambient model and formal problem statements

Matrix codes are $F$-linear subspaces of $F^{m\times n}$, with $m\ge n$ assumed in the defining paper. An $\mathbf H$0 matrix code is a $\mathbf H$1-dimensional subspace

$\mathbf H$2

equipped with the rank metric

$\mathbf H$3

The isometries considered are the non-transpose rank-metric isometries

$\mathbf H$4

with $\mathbf H$5 and $\mathbf H$6. Under row-wise vectorization $\mathbf H$7, such an isometry is represented by multiplication with $\mathbf H$8 (Bardet et al., 21 Jul 2025).

Three closely related equivalence/kernel problems organize the area.

Problem	Hidden relation	Canonical form
Matrix code equivalence	equality up to isometry	$\mathbf H$9
Matrix subcode equivalence	subcode up to isometry	$\mathbf G'$0
MCPKP	inhomogeneous kernel relation	$\mathbf G'$1

The Matrix Subcode Equivalence Problem is defined for matrix codes $\mathbf G'$2 of dimensions $\mathbf G'$3 and $\mathbf G'$4, with $\mathbf G'$5, and asks whether there exist $\mathbf G'$6 and $\mathbf G'$7 such that

$\mathbf G'$8

If $\mathbf G'$9 and $\mathbf Y$0 are generator matrices of $\mathbf Y$1 and $\mathbf Y$2, then this implies the existence of a rank-$\mathbf Y$3 matrix $\mathbf Y$4 such that

$\mathbf Y$5

Equivalently, if $\mathbf Y$6 is a parity-check matrix of $\mathbf Y$7, then

$\mathbf Y$8

The Matrix Code Permuted Kernel Problem is the inhomogeneous extension. Given

$\mathbf Y$9

it asks whether there exist $\mathbf A\in GL_m(q)$0, $\mathbf A\in GL_m(q)$1, and a rank-$\mathbf A\in GL_m(q)$2 matrix $\mathbf A\in GL_m(q)$3 such that

$\mathbf A\in GL_m(q)$4

In parity-check form, with $\mathbf A\in GL_m(q)$5 and $\mathbf A\in GL_m(q)$6, this becomes

$\mathbf A\in GL_m(q)$7

The homogeneous case $\mathbf A\in GL_m(q)$8 reduces MCPKP to MSE (Bardet et al., 21 Jul 2025).

2. Position within the broader PKP and equivalence landscape

MCPKP is explicitly presented as the matrix/rank-metric analogue of the classical Hamming-metric PKP. In the classical PKP, one is given $\mathbf A\in GL_m(q)$9 and $\mathbf B\in GL_n(q)$0, and seeks a permutation matrix $\mathbf B\in GL_n(q)$1 such that

$\mathbf B\in GL_n(q)$2

The inhomogeneous generalization replaces the zero syndrome by a target matrix $\mathbf B\in GL_n(q)$3, asking for $\mathbf B\in GL_n(q)$4 (Sanna, 2024). A more attack-oriented formulation writes PKP as: given $\mathbf B\in GL_n(q)$5 and $\mathbf B\in GL_n(q)$6, find $\mathbf B\in GL_n(q)$7 such that

$\mathbf B\in GL_n(q)$8

which the coding-theoretic literature interprets as finding a permutation of $\mathbf B\in GL_n(q)$9 that lies in the kernel of a parity-check matrix (Santini et al., 2022).

The bridge from the Hamming setting to the matrix setting runs through subcode equivalence. The defining MCPKP paper proves that MSE is at least as hard as the Hamming Subcode Equivalence Problem by embedding Hamming vectors as diagonal matrices via

$$\mathbf G'(\mathbf A^{-\top}\otimes \mathbf B^{-1})\mathbf H^\top=\mathbf Y.$$0

which preserves weight in the form

$$\mathbf G'(\mathbf A^{-\top}\otimes \mathbf B^{-1})\mathbf H^\top=\mathbf Y.$$1

Under this embedding, Hamming subcode equivalence becomes matrix subcode equivalence under left/right matrix isometries (Bardet et al., 21 Jul 2025). The paper therefore uses MSE as the structural ancestor of MCPKP, but it is careful not to claim NP-completeness for MCPKP itself.

This places MCPKP adjacent to, but distinct from, two older equivalence families. First, classical generator-matrix equivalence up to permutation studies equations of the form

$$\mathbf G'(\mathbf A^{-\top}\otimes \mathbf B^{-1})\mathbf H^\top=\mathbf Y.$$2

with an invertible left action and a column permutation, and is closely tied to permutation equivalence of linear codes in Hamming metric (Tohaneanu et al., 2018). Second, the modern matrix-code equivalence problem asks, for matrix spaces $$\mathbf G'(\mathbf A^{-\top}\otimes \mathbf B^{-1})\mathbf H^\top=\mathbf Y.$$3, whether

$$\mathbf G'(\mathbf A^{-\top}\otimes \mathbf B^{-1})\mathbf H^\top=\mathbf Y.$$4

and recent work attacks this via reductions to conjugacy and hull invariants (Couvreur et al., 1 Apr 2025). MCPKP differs from both by replacing equality with subcode containment or an inhomogeneous parity-check constraint, and by introducing the noninvertible rank-$$\mathbf G'(\mathbf A^{-\top}\otimes \mathbf B^{-1})\mathbf H^\top=\mathbf Y.$$5 transfer matrix $$\mathbf G'(\mathbf A^{-\top}\otimes \mathbf B^{-1})\mathbf H^\top=\mathbf Y.$$6 in its generator formulation (Bardet et al., 21 Jul 2025).

3. Generator, parity-check, and syndrome viewpoints

The defining algebraic feature of MCPKP is the coexistence of two equivalent but operationally different descriptions.

In the generator-matrix formulation, one starts from

$$\mathbf G'(\mathbf A^{-\top}\otimes \mathbf B^{-1})\mathbf H^\top=\mathbf Y.$$7

with $$\mathbf G'(\mathbf A^{-\top}\otimes \mathbf B^{-1})\mathbf H^\top=\mathbf Y.$$8. This exhibits MCPKP as an inhomogeneous subcode-equivalence relation: $$\mathbf G'(\mathbf A^{-\top}\otimes \mathbf B^{-1})\mathbf H^\top=\mathbf Y.$$9 supplies an affine offset, while $F$0 selects a $F$1-dimensional subspace of the larger code.

In the parity-check formulation, one instead regards $F$2 as defining a kernel through a parity-check matrix $F$3, and seeks $F$4 satisfying

$F$5

This is the form used in the signature construction, because it eliminates $F$6 from the witness and produces a degree-$F$7 algebraic relation in the entries of $F$8 and $F$9 (Bardet et al., 21 Jul 2025).

The inhomogeneous term $F^{m\times n}$0 is not cosmetic. The paper argues that a homogeneous statement such as

$F^{m\times n}$1

would admit degenerate cheating strategies with noninvertible matrices, including trivial low-rank constructions. By contrast, taking $F^{m\times n}$2 of rank $F^{m\times n}$3 and choosing parameters so that the expected number of solutions is negligible unless $F^{m\times n}$4 are invertible allows the protocol to avoid proving invertibility explicitly (Bardet et al., 21 Jul 2025).

The same section of the paper gives heuristic counts for the expected number of solutions. For MSE, the average number of isometries is estimated as

$F^{m\times n}$5

For MCPKP, the average number of solution pairs $F^{m\times n}$6 is estimated as

$F^{m\times n}$7

for $F^{m\times n}$8 of rank $F^{m\times n}$9. The parameter choice $m\ge n$0 is emphasized because for $m\ge n$1 or $m\ge n$2 the induced systems are underdetermined and may admit many invertible solutions (Bardet et al., 21 Jul 2025).

A related lesson from the classical PKP literature is that solution counts depend strongly on how instances are generated. Exact formulas for random PKP/IPKP instances show that the folklore heuristic $m\ge n$3 can be asymptotically valid in some “starred” models with distinct nonzero coordinates, yet badly wrong in unstructured conditioned models, where correction terms coming from permutation symmetries can dominate (Sanna, 2024). This reinforces the role of explicit planted-instance and average-case analyses in any kernel-style signature assumption.

4. Attack models and cryptanalytic behavior

The main cryptanalytic result surrounding MCPKP is negative in a precise sense: attack techniques imported from ordinary matrix code equivalence become markedly less effective in the subcode/kernel regime. The defining paper analyzes several attack classes and repeatedly identifies the same obstruction—$m\ge n$4 has full column rank but is not invertible, so many invariants and equation systems that are decisive for matrix code equivalence do not survive (Bardet et al., 21 Jul 2025).

The most direct reduction guesses the hidden $m\ge n$5-dimensional subcode and then solves an ordinary matrix-code equivalence instance, at cost

$m\ge n$6

Because

$m\ge n$7

this is already prohibitive for the intended parameters.

The algebraic approaches fall into several families. A naive trilinear model starts from

$m\ge n$8

with $m\ge n$9 unknowns and $\mathbf H$00 affine trilinear equations. Hybrid eliminations lead to costs such as

$\mathbf H$01

or

$\mathbf H$02

depending on whether one guesses columns of $\mathbf H$03 or rows of $\mathbf H$04. The dual parity-check model

$\mathbf H$05

reduces the equation system to $\mathbf H$06 unknowns and $\mathbf H$07 quadratic equations, but the equation count is far smaller than in the code-equivalence case. A further “new algebraic modeling” supplies about $\mathbf H$08 extra independent trilinear equations via right inverses, yet experimental evidence in toy parameters still shows a dramatic slowdown as soon as one passes from $\mathbf H$09 to $\mathbf H$10 (Bardet et al., 21 Jul 2025).

Combinatorial attacks of Leon type degrade for a different reason. If $\mathbf H$11 and $\mathbf H$12 denote expected counts of rank-$\mathbf H$13 codewords in the large code and in the hidden subcode, then

$\mathbf H$14

with

$\mathbf H$15

Because the smaller code has far fewer low-rank words, list-collision attacks become badly unbalanced, and the useful balanced-collision regime of ordinary equivalence attacks disappears (Bardet et al., 21 Jul 2025).

The paper also adapts the reduction from matrix code equivalence to polynomial-map equivalence, producing a new Quadratic Sub Map Linear Equivalence problem. Its asymptotic lower bound is stated as

$\mathbf H$16

with explicit formulas for $\mathbf H$17 and $\mathbf H$18, and this QSMLE attack becomes the dominant parameter-setting criterion in the signature proposal. Invariant-based trilinear-map attacks are likewise weakened: properties preserved under full equivalence need not survive multiplication by a rank-deficient $\mathbf H$19, and weak-key probabilities analogous to those in matrix code equivalence are estimated around

$\mathbf H$20

The paper’s summary judgment is that algorithms “perform much worse than in the code equivalence case,” matching the behavior already known in Hamming-metric subcode equivalence (Bardet et al., 21 Jul 2025).

This deterioration mirrors, at a higher structural level, recent observations in classical PKP cryptanalysis. A 2022 attack improved the best known PKP solver by adding a collision-search stage based on sparse kernel equations found with information set decoding, showing that PKP hardness depends sensitively on low-support dual-code structure (Santini et al., 2022). A 2024 counting analysis then showed that even the expected number of random PKP solutions depends sharply on whether the sampled secret vector has distinct nonzero entries or admits extra permutation symmetries (Sanna, 2024). MCPKP inherits that broader methodological lesson: kernel-style assumptions require simultaneous analysis of algebraic structure, average solution counts, and planted-instance generation.

5. Use in MPC-in-the-Head signatures

MCPKP was introduced not only as a hard problem but as a proof-friendly relation for post-quantum signatures. In the proposed scheme, the public key is

$\mathbf H$21

where $\mathbf H$22, $\mathbf H$23, and $\mathbf H$24, while the secret key is

$\mathbf H$25

satisfying

$\mathbf H$26

The paper notes that inverses are dropped here only “to lighten notation,” having been absorbed into the secret variables. Key generation samples $\mathbf H$27, $\mathbf H$28, $\mathbf H$29, and $\mathbf H$30, then computes

$\mathbf H$31

restarting if $\mathbf H$32 (Bardet et al., 21 Jul 2025).

The central protocol advantage is that the witness relation has algebraic degree $\mathbf H$33 in the secret entries. The witness size is

$\mathbf H$34

bits, and the MPCitH protocol checks coordinates of

$\mathbf H$35

under degree-$\mathbf H$36 Shamir sharing, so the computed shares have degree $\mathbf H$37. This fits both Threshold-Computation-in-the-Head and VOLE-in-the-Head directly. The paper states false-positive probabilities of

$\mathbf H$38

per repetition, or

$\mathbf H$39

after $\mathbf H$40 repetitions, and emphasizes that the low polynomial degree $\mathbf H$41 is exactly what makes MCPKP attractive for compact MPC proofs (Bardet et al., 21 Jul 2025).

The concrete parameter sets are deliberately small relative to matrix-code equivalence-based proposals. For NIST level I, the paper lists:

• MCPKP-Ia: $\mathbf H$42, public key $\mathbf H$43 B, Leon $\mathbf H$44 bits, QSMLE $\mathbf H$45 bits.
• MCPKP-Ib: $\mathbf H$46, public key $\mathbf H$47 B, Leon $\mathbf H$48 bits, QSMLE $\mathbf H$49 bits.

For level III it gives $\mathbf H$50, public key $\mathbf H$51 B, and for level V $\mathbf H$52, public key $\mathbf H$53 B. The highlighted level-I VOLEitH “short” instance, MCPKP-Ib, yields a $\mathbf H$54 B signature with a $\mathbf H$55 B public key, for a total of about $\mathbf H$56 B. This is the basis of the abstract’s summary that the construction achieves a signature size of approximately $\mathbf H$57 Bytes and a public key of approximately $\mathbf H$58 Bytes (Bardet et al., 21 Jul 2025).

The comparison table in the paper is narrowly targeted but informative. Against SPHINCS+ (short) it cites $\mathbf H$59 B signature and $\mathbf H$60 B public key; against MEDS, $\mathbf H$61 B signature and $\mathbf H$62 B public key; against LESS, $\mathbf H$63 B signature and $\mathbf H$64 B public key; and against CROSS, $\mathbf H$65 B signature and $\mathbf H$66 B public key. The claim is not that MCPKP minimizes signature length alone, but that it gives an unusually small public key + signature total for an equivalence-problem-based design (Bardet et al., 21 Jul 2025).

6. Conceptual distinctions, scope, and recurrent misconceptions

Several distinctions are essential for interpreting MCPKP correctly.

First, MCPKP is not merely matrix code equivalence in disguise. In ordinary matrix code equivalence, one seeks full equality under a two-sided action, and recent algorithms exploit the fact that the hidden transformations are invertible on all relevant coordinates, sometimes via hull invariants and reductions to conjugacy (Couvreur et al., 1 Apr 2025). In MCPKP and MSE, the transfer matrix $\mathbf H$67 has rank $\mathbf H$68 but is not invertible, which is precisely why many equivalence invariants weaken or disappear (Bardet et al., 21 Jul 2025).

Second, MCPKP should not be conflated with Hamming-metric column-permutation problems of the form

$\mathbf H$69

which study equivalence of $\mathbf H$70 matrices under an invertible left action and a permutation matrix on the right. Those problems are directly tied to generator-matrix and code equivalence in the Hamming metric, and the associated kernel viewpoint comes from parity-check matrices of ordinary linear codes (Tohaneanu et al., 2018). MCPKP instead lives in the rank-metric world, with ambient space $\mathbf H$71 and hidden action $\mathbf H$72.

Third, the literature contains unrelated uses of “permuted kernel” terminology. A distinct problem in numerical linear algebra studies stochastic estimation of

$\mathbf H$73

where $\mathbf H$74 is a lattice displacement permutation and the goal is variance reduction through displacement-aware probing on $\mathbf H$75 rather than $\mathbf H$76 (Switzer et al., 2021). That setting concerns permuted diagonals of matrix inverses and graph coloring on displaced neighborhoods; it is unrelated to matrix-code isometries, subcode equivalence, or MCPKP-based signatures.

Finally, the complexity-theoretic status of MCPKP itself remains more modest than casual summaries sometimes suggest. The paper proves that MSE is at least as hard as Hamming SEP via diagonal embedding, and that MCPKP reduces to MSE after augmenting the larger code with a preimage of $\mathbf H$77. It does not prove NP-completeness for MCPKP directly (Bardet et al., 21 Jul 2025). The current state of knowledge is therefore best summarized as follows: MCPKP is a newly defined inhomogeneous kernel problem on matrix codes, structurally close to matrix subcode equivalence, supported by reductions and extensive adapted cryptanalysis, and motivated primarily by its favorable algebraic profile for MPC-in-the-Head proof systems.