---
title: Matrix Code Permuted Kernel Problem
url: https://www.emergentmind.com/topics/matrix-code-permuted-kernel-problem
type: topic
---

# Matrix Code Permuted Kernel Problem

The **Matrix Code Permuted Kernel Problem** (MCPKP) is a rank-metric and matrix-code analogue of the classical Permuted Kernel Problem (PKP). It was introduced together with the **Matrix Subcode Equivalence Problem** (MSE) as a search/decision problem on matrix codes over a finite field \(F=\mathbb F_q\), with the explicit cryptographic aim of supplying a low-degree witness relation for MPC-in-the-Head signature schemes [2507.15377]. In its parity-check form, MCPKP asks, given a parity-check matrix \(\mathbf H\), a generator matrix \(\mathbf G'\) of a smaller matrix code, and a target syndrome matrix \(\mathbf Y\), whether there exist invertible matrices \(\mathbf A\in GL_m(q)\) and \(\mathbf B\in GL_n(q)\) such that
\[
\mathbf G'(\mathbf A^{-\top}\otimes \mathbf B^{-1})\mathbf H^\top=\mathbf Y.
\]
The problem is “permuted” in the sense that the hidden action is an isometry of the ambient matrix space, and it is “kernel” in the sense that the transformed code is constrained through a parity-check or syndrome relation rather than by direct equality of codes [2507.15377].

## 1. Ambient model and formal problem statements

Matrix codes are \(F\)-linear subspaces of \(F^{m\times n}\), with \(m\ge n\) assumed in the defining paper. An \([m\times n,k]\) matrix code is a \(k\)-dimensional subspace
\[
C\subseteq F^{m\times n},
\]
equipped with the rank metric
\[
w_R(\mathbf M)=\operatorname{rank}(\mathbf M), \qquad d(\mathbf A,\mathbf B)=\operatorname{rank}(\mathbf A-\mathbf B).
\]
The isometries considered are the non-transpose rank-metric isometries
\[
\mathbf M\mapsto \mathbf A\mathbf M\mathbf B,
\]
with \(\mathbf A\in GL_m(q)\) and \(\mathbf B\in GL_n(q)\). Under row-wise vectorization \(\operatorname{Vec}_{row}:F^{m\times n}\to F^{mn}\), such an isometry is represented by multiplication with \(\mathbf A^\top\otimes \mathbf B\) [2507.15377].

Three closely related equivalence/kernel problems organize the area.

| Problem | Hidden relation | Canonical form |
|---|---|---|
| Matrix code equivalence | equality up to isometry | \(D=\mathbf A C \mathbf B\) |
| Matrix subcode equivalence | subcode up to isometry | \(D\subset \mathbf A C \mathbf B\) |
| MCPKP | inhomogeneous kernel relation | \(\mathbf G'(\mathbf A^{-\top}\otimes \mathbf B^{-1})\mathbf H^\top=\mathbf Y\) |

The **Matrix Subcode Equivalence Problem** is defined for matrix codes \(C,D\subset F^{m\times n}\) of dimensions \(k\) and \(k'\), with \(k'<k\), and asks whether there exist \(\mathbf A\in GL_m(q)\) and \(\mathbf B\in GL_n(q)\) such that
\[
D\subset \mathbf A C \mathbf B.
\]
If \(\mathbf G\in F^{k\times mn}\) and \(\mathbf G'\in F^{k'\times mn}\) are generator matrices of \(C\) and \(D\), then this implies the existence of a rank-\(k'\) matrix \(\mathbf T\in F^{k\times k'}\) such that
\[
\mathbf G'=\mathbf T^\top \mathbf G(\mathbf A^\top\otimes \mathbf B).
\]
Equivalently, if \(\mathbf H\) is a parity-check matrix of \(\mathbf G\), then
\[
\mathbf G'(\mathbf A^\top\otimes \mathbf B)^{-1}\mathbf H^\top=0.
\]

The **Matrix Code Permuted Kernel Problem** is the inhomogeneous extension. Given
\[
\mathbf G\in F^{k\times mn},\qquad \mathbf G'\in F^{k'\times mn},\qquad \mathbf G''\in F^{k'\times mn},
\]
it asks whether there exist \(\mathbf A\in GL_m(q)\), \(\mathbf B\in GL_n(q)\), and a rank-\(k'\) matrix \(\mathbf T\in F^{k\times k'}\) such that
\[
(\mathbf T^\top \mathbf G+\mathbf G'')(\mathbf A^\top\otimes \mathbf B)=\mathbf G'.
\]
In parity-check form, with \(\mathbf H\in F^{(mn-k)\times mn}\) and \(\mathbf Y\in F^{k'\times (mn-k)}\), this becomes
\[
\mathbf G'(\mathbf A^{-\top}\otimes \mathbf B^{-1})\mathbf H^\top=\mathbf Y.
\]
The homogeneous case \(\mathbf Y=0\) reduces MCPKP to MSE [2507.15377].

## 2. Position within the broader PKP and equivalence landscape

MCPKP is explicitly presented as the matrix/rank-metric analogue of the classical Hamming-metric PKP. In the classical PKP, one is given \(\mathbf A\in\mathbb F_q^{\ell\times m}\) and \(\mathbf b\in\mathbb F_q^m\), and seeks a permutation matrix \(\mathbf \Pi\) such that
\[
\mathbf A(\mathbf \Pi \mathbf b)=0.
\]
The inhomogeneous generalization replaces the zero syndrome by a target matrix \(\mathbf C\), asking for \(\mathbf A\mathbf \Pi \mathbf B=\mathbf C\) [2406.00453]. A more attack-oriented formulation writes PKP as: given \(A\in\mathbb F_q^{m\times n}\) and \(c\in\mathbb F_q^n\), find \(\pi\in S_n\) such that
\[
\pi(c)A^\top=0,
\]
which the coding-theoretic literature interprets as finding a permutation of \(c\) that lies in the kernel of a parity-check matrix [2206.14547].

The bridge from the Hamming setting to the matrix setting runs through subcode equivalence. The defining MCPKP paper proves that **MSE is at least as hard as the Hamming Subcode Equivalence Problem** by embedding Hamming vectors as diagonal matrices via
\[
\psi:\mathbb F_q^n\to \mathbb F_q^{n\times n},\qquad \mathbf x\mapsto \operatorname{Diag}(x_1,\dots,x_n),
\]
which preserves weight in the form
\[
\operatorname{rank}(\psi(\mathbf x))=w_H(\mathbf x).
\]
Under this embedding, Hamming subcode equivalence becomes matrix subcode equivalence under left/right matrix isometries [2507.15377]. The paper therefore uses MSE as the structural ancestor of MCPKP, but it is careful not to claim NP-completeness for MCPKP itself.

This places MCPKP adjacent to, but distinct from, two older equivalence families. First, classical generator-matrix equivalence up to permutation studies equations of the form
\[
XA=BY,\qquad A=SBP,
\]
with an invertible left action and a column permutation, and is closely tied to permutation equivalence of linear codes in Hamming metric [1805.08343]. Second, the modern matrix-code equivalence problem asks, for matrix spaces \(\mathcal C,\mathcal D\subset \mathbb F_q^{m\times n}\), whether
\[
\mathcal D=P\mathcal C Q^{-1},
\]
and recent work attacks this via reductions to conjugacy and hull invariants [2504.01230]. MCPKP differs from both by replacing equality with subcode containment or an inhomogeneous parity-check constraint, and by introducing the noninvertible rank-\(k'\) transfer matrix \(\mathbf T\) in its generator formulation [2507.15377].

## 3. Generator, parity-check, and syndrome viewpoints

The defining algebraic feature of MCPKP is the coexistence of two equivalent but operationally different descriptions.

In the **generator-matrix formulation**, one starts from
\[
(\mathbf T^\top \mathbf G+\mathbf G'')(\mathbf A^\top\otimes \mathbf B)=\mathbf G',
\]
with \(\operatorname{rank}(\mathbf T)=k'\). This exhibits MCPKP as an inhomogeneous subcode-equivalence relation: \(\mathbf G''\) supplies an affine offset, while \(\mathbf T^\top\mathbf G\) selects a \(k'\)-dimensional subspace of the larger code.

In the **parity-check formulation**, one instead regards \(\mathbf G\) as defining a kernel through a parity-check matrix \(\mathbf H\), and seeks \(\mathbf A,\mathbf B\) satisfying
\[
\mathbf G'(\mathbf A^{-\top}\otimes \mathbf B^{-1})\mathbf H^\top=\mathbf Y.
\]
This is the form used in the signature construction, because it eliminates \(\mathbf T\) from the witness and produces a degree-\(2\) algebraic relation in the entries of \(\mathbf A\) and \(\mathbf B\) [2507.15377].

The inhomogeneous term \(\mathbf Y\) is not cosmetic. The paper argues that a homogeneous statement such as
\[
\mathbf G'(\mathbf A^\top\otimes \mathbf B)\mathbf H^\top=0
\]
would admit degenerate cheating strategies with noninvertible matrices, including trivial low-rank constructions. By contrast, taking \(\mathbf Y\) of rank \(k'\) and choosing parameters so that the expected number of solutions is negligible unless \(\mathbf A,\mathbf B\) are invertible allows the protocol to avoid proving invertibility explicitly [2507.15377].

The same section of the paper gives heuristic counts for the expected number of solutions. For MSE, the average number of isometries is estimated as
\[
|\mathsf{PGL}_m(q)|\cdot |\mathsf{PGL}_n(q)|\cdot \frac{\binom{k}{k'}_q}{\binom{mn}{k'}_q}.
\]
For MCPKP, the average number of solution pairs \((\mathbf A,\mathbf B)\) is estimated as
\[
\frac{q^{m^2+n^2}}{(q-1)^2}\cdot \frac{\binom{k}{k'}_q}{\sum_{i=1}^{k'} \binom{mn}{i}_q},
\]
for \(\mathbf Y\) of rank \(k'\). The parameter choice \(k'\ge 3\) is emphasized because for \(k'=1\) or \(k'=2\) the induced systems are underdetermined and may admit many invertible solutions [2507.15377].

A related lesson from the classical PKP literature is that solution counts depend strongly on how instances are generated. Exact formulas for random PKP/IPKP instances show that the folklore heuristic \(m!/q^\ell\) can be asymptotically valid in some “starred” models with distinct nonzero coordinates, yet badly wrong in unstructured conditioned models, where correction terms coming from permutation symmetries can dominate [2406.00453]. This reinforces the role of explicit planted-instance and average-case analyses in any kernel-style signature assumption.

## 4. Attack models and cryptanalytic behavior

The main cryptanalytic result surrounding MCPKP is negative in a precise sense: attack techniques imported from ordinary matrix code equivalence become markedly less effective in the subcode/kernel regime. The defining paper analyzes several attack classes and repeatedly identifies the same obstruction—\(\mathbf T\) has full column rank but is not invertible, so many invariants and equation systems that are decisive for matrix code equivalence do not survive [2507.15377].

The most direct reduction guesses the hidden \(k'\)-dimensional subcode and then solves an ordinary matrix-code equivalence instance, at cost
\[
\binom{k}{k'}_q \cdot \mathsf C_{MCE(q,m,n,k')}.
\]
Because
\[
\binom{k}{k'}_q \approx q^{k'(k-k')},
\]
this is already prohibitive for the intended parameters.

The algebraic approaches fall into several families. A naive trilinear model starts from
\[
\mathbf G'=\mathbf T^\top \mathbf G(\mathbf A^\top\otimes \mathbf B),
\]
with \(k'k+m^2+n^2\) unknowns and \(k'mn\) affine trilinear equations. Hybrid eliminations lead to costs such as
\[
\mathcal O\!\left(q^{m\left\lceil \frac{n^2+kk'}{k'n}\right\rceil}(n^2+kk')^\omega\right)
\]
or
\[
\mathcal O\!\left(q^{k\left\lceil \frac{n^2+m^2}{mn}\right\rceil}(n^2+m^2)^\omega\right),
\]
depending on whether one guesses columns of \(\mathbf A^\top\) or rows of \(\mathbf T^\top\). The dual parity-check model
\[
\mathbf G'(\mathbf A^{-\top}\otimes \mathbf B^{-1})\mathbf H^\top=0
\]
reduces the equation system to \(m^2+n^2\) unknowns and \(k'(mn-k)\) quadratic equations, but the equation count is far smaller than in the code-equivalence case. A further “new algebraic modeling” supplies about \(n^2+m^2-1\) extra independent trilinear equations via right inverses, yet experimental evidence in toy parameters still shows a dramatic slowdown as soon as one passes from \(k'=k\) to \(k'=k-1\) [2507.15377].

Combinatorial attacks of Leon type degrade for a different reason. If \(C(r)\) and \(C'(r)\) denote expected counts of rank-\(r\) codewords in the large code and in the hidden subcode, then
\[
C(r)=\frac{M_{m,n}(r)}{q^{mn-k}},\qquad C'(r)=\frac{M_{m,n}(r)}{q^{mn-k'}},
\]
with
\[
M_{m,n}(r)=\prod_{i=0}^{r-1}\frac{(q^m-q^i)(q^n-q^i)}{q^r-q^i}.
\]
Because the smaller code has far fewer low-rank words, list-collision attacks become badly unbalanced, and the useful balanced-collision regime of ordinary equivalence attacks disappears [2507.15377].

The paper also adapts the reduction from matrix code equivalence to polynomial-map equivalence, producing a new **Quadratic Sub Map Linear Equivalence** problem. Its asymptotic lower bound is stated as
\[
\mathsf C_{inhQSMLE}=\mathcal O\left(\left(\binom{v+2}{3}-v_-\right)^\omega\right),
\]
with explicit formulas for \(v\) and \(v_-\), and this QSMLE attack becomes the dominant parameter-setting criterion in the signature proposal. Invariant-based trilinear-map attacks are likewise weakened: properties preserved under full equivalence need not survive multiplication by a rank-deficient \(\mathbf T\), and weak-key probabilities analogous to those in matrix code equivalence are estimated around
\[
\frac{1}{q^{k-k'+1}}.
\]
The paper’s summary judgment is that algorithms “perform much worse than in the code equivalence case,” matching the behavior already known in Hamming-metric subcode equivalence [2507.15377].

This deterioration mirrors, at a higher structural level, recent observations in classical PKP cryptanalysis. A 2022 attack improved the best known PKP solver by adding a collision-search stage based on sparse kernel equations found with information set decoding, showing that PKP hardness depends sensitively on low-support dual-code structure [2206.14547]. A 2024 counting analysis then showed that even the expected number of random PKP solutions depends sharply on whether the sampled secret vector has distinct nonzero entries or admits extra permutation symmetries [2406.00453]. MCPKP inherits that broader methodological lesson: kernel-style assumptions require simultaneous analysis of algebraic structure, average solution counts, and planted-instance generation.

## 5. Use in MPC-in-the-Head signatures

MCPKP was introduced not only as a hard problem but as a proof-friendly relation for post-quantum signatures. In the proposed scheme, the public key is
\[
(\mathbf H,\mathbf G',\mathbf Y),
\]
where \(\mathbf H\in F^{(mn-k)\times mn}\), \(\mathbf G'\in F^{k'\times mn}\), and \(\mathbf Y\in F^{k'\times (mn-k)}\), while the secret key is
\[
(\mathbf A,\mathbf B)\in GL_m(q)\times GL_n(q)
\]
satisfying
\[
\mathbf G'(\mathbf A^\top\otimes \mathbf B)\mathbf H^\top=\mathbf Y.
\]
The paper notes that inverses are dropped here only “to lighten notation,” having been absorbed into the secret variables. Key generation samples \(\mathbf H\), \(\mathbf G'\), \(\mathbf A\), and \(\mathbf B\), then computes
\[
\mathbf Y:=\operatorname{RowReducedEchelonForm}\big(\mathbf G'(\mathbf A^\top\otimes \mathbf B)\mathbf H^\top\big),
\]
restarting if \(\operatorname{Rank}(\mathbf Y)<k'\) [2507.15377].

The central protocol advantage is that the witness relation has algebraic degree \(2\) in the secret entries. The witness size is
\[
(m^2+n^2)\log_2(q)
\]
bits, and the MPCitH protocol checks coordinates of
\[
[\widetilde{\mathbf G'}]_i=\mathbf G'\big([{\mathbf A}_i]^\top\otimes [{\mathbf B}_i]\big)\mathbf H^\top-\mathbf Y
\]
under degree-\(1\) Shamir sharing, so the computed shares have degree \(2\). This fits both **Threshold-Computation-in-the-Head** and **VOLE-in-the-Head** directly. The paper states false-positive probabilities of
\[
\frac1q
\]
per repetition, or
\[
\frac{1}{q^\rho}
\]
after \(\rho\) repetitions, and emphasizes that the low polynomial degree \(d=2\) is exactly what makes MCPKP attractive for compact MPC proofs [2507.15377].

The concrete parameter sets are deliberately small relative to matrix-code equivalence-based proposals. For NIST level I, the paper lists:

- **MCPKP-Ia**: \(q=64, m=n=12, k=32, k'=3\), public key \(268\) B, Leon \(230\) bits, QSMLE \(156\) bits.
- **MCPKP-Ib**: \(q=128, m=n=11, k=30, k'=3\), public key \(255\) B, Leon \(237\) bits, QSMLE \(160\) bits.

For level III it gives \(q=64, m=n=18, k=50, k'=3\), public key \(641\) B, and for level V \(q=64, m=n=22, k=67, k'=3\), public key \(963\) B. The highlighted level-I VOLEitH “short” instance, MCPKP-Ib, yields a **\(4\,788\) B** signature with a **\(255\) B** public key, for a total of about **\(5\,043\) B**. This is the basis of the abstract’s summary that the construction achieves a signature size of approximately \(4\,800\) Bytes and a public key of approximately \(275\) Bytes [2507.15377].

The comparison table in the paper is narrowly targeted but informative. Against **SPHINCS+ (short)** it cites \(7\,856\) B signature and \(32\) B public key; against **MEDS**, \(5\,200\) B signature and \(21\,595\) B public key; against **LESS**, \(2\,481\) B signature and \(13\,939\) B public key; and against **CROSS**, \(8\,960\) B signature and \(54\) B public key. The claim is not that MCPKP minimizes signature length alone, but that it gives an unusually small **public key + signature** total for an equivalence-problem-based design [2507.15377].

## 6. Conceptual distinctions, scope, and recurrent misconceptions

Several distinctions are essential for interpreting MCPKP correctly.

First, MCPKP is **not** merely matrix code equivalence in disguise. In ordinary matrix code equivalence, one seeks full equality under a two-sided action, and recent algorithms exploit the fact that the hidden transformations are invertible on all relevant coordinates, sometimes via hull invariants and reductions to conjugacy [2504.01230]. In MCPKP and MSE, the transfer matrix \(\mathbf T\) has rank \(k'\) but is not invertible, which is precisely why many equivalence invariants weaken or disappear [2507.15377].

Second, MCPKP should not be conflated with Hamming-metric column-permutation problems of the form
\[
XA=BY \qquad\text{or}\qquad A=SBP,
\]
which study equivalence of \(k\times n\) matrices under an invertible left action and a permutation matrix on the right. Those problems are directly tied to generator-matrix and code equivalence in the Hamming metric, and the associated kernel viewpoint comes from parity-check matrices of ordinary linear codes [1805.08343]. MCPKP instead lives in the rank-metric world, with ambient space \(F^{m\times n}\) and hidden action \(\mathbf M\mapsto \mathbf A\mathbf M\mathbf B\).

Third, the literature contains unrelated uses of “permuted kernel” terminology. A distinct problem in numerical linear algebra studies stochastic estimation of
\[
\operatorname{tr}(P A^{-1}),
\]
where \(P\) is a lattice displacement permutation and the goal is variance reduction through displacement-aware probing on \(PA^k\) rather than \(A^k\) [2106.01275]. That setting concerns permuted diagonals of matrix inverses and graph coloring on displaced neighborhoods; it is unrelated to matrix-code isometries, subcode equivalence, or MCPKP-based signatures.

Finally, the complexity-theoretic status of MCPKP itself remains more modest than casual summaries sometimes suggest. The paper proves that **MSE** is at least as hard as Hamming SEP via diagonal embedding, and that **MCPKP reduces to MSE** after augmenting the larger code with a preimage of \(\mathbf Y\). It does **not** prove NP-completeness for MCPKP directly [2507.15377]. The current state of knowledge is therefore best summarized as follows: MCPKP is a newly defined inhomogeneous kernel problem on matrix codes, structurally close to matrix subcode equivalence, supported by reductions and extensive adapted cryptanalysis, and motivated primarily by its favorable algebraic profile for MPC-in-the-Head proof systems.

Source: https://www.emergentmind.com/topics/matrix-code-permuted-kernel-problem