Matrix Subcode Equivalence Problem

• The paper introduces the Matrix Subcode Equivalence Problem by examining whether a smaller rank-metric matrix code can be embedded as a subcode into a larger one using invertible matrices A and B.
• It demonstrates that the non-invertible full-rank mapping T eliminates established algebraic invariants, complicating the equivalence testing and degrading standard attack efficiencies.
• The work positions the problem between full equivalence and subspace search challenges, highlighting its NP-hardness by drawing parallels with the NP-complete Hamming Subcode Equivalence.

The Matrix Subcode Equivalence Problem concerns rank-metric matrix codes over a finite field and asks whether a given matrix code can be mapped, by a rank isometry, into another code as a subcode. In the formulation introduced for matrix spaces $C,D \subseteq F^{m\times n}$, with $\dim(C)=k$ and $\dim(D)=k'$ for $k'<k$, one seeks invertible matrices $A \in \mathrm{GL}_m(q)$ and $B \in \mathrm{GL}_n(q)$ such that $D \subseteq A C B$ (Bardet et al., 21 Jul 2025). The problem extends the rank-metric equivalence agenda developed for full matrix-code equivalence, but the subcode condition changes the algebraic structure substantially: the hidden mixing on the code side is no longer invertible, several invariants used in full equivalence disappear, and both algebraic and combinatorial attacks degrade sharply (Bardet et al., 21 Jul 2025).

1. Formal definition and ambient equivalence structure

In the rank-metric setting, an $[m\times n,k]$ matrix code $C$ is an $F$-linear subspace $\dim(C)=k$0 of dimension $\dim(C)=k$1, with rank weight $\dim(C)=k$2 and rank distance $\dim(C)=k$3 (Bardet et al., 21 Jul 2025). The Matrix Subcode Equivalence Problem, denoted

$\dim(C)=k$4

takes as input a code $\dim(C)=k$5 of dimension $\dim(C)=k$6 and a code $\dim(C)=k$7 of dimension $\dim(C)=k$8 with $\dim(C)=k$9, and asks whether there exist $\dim(D)=k'$0 and $\dim(D)=k'$1 such that

$\dim(D)=k'$2

(Bardet et al., 21 Jul 2025).

The underlying rank-isometry group is the classical one for the rank metric. A linear rank-preserving map on matrices has the form

$\dim(D)=k'$3

with $\dim(D)=k'$4, $\dim(D)=k'$5, and when $\dim(D)=k'$6 one may also have transpose-based maps (Morrison, 2013). More generally, linear matrix-equivalence maps are generated by left multiplication, right multiplication, and, in the square case, transposition; semilinear extensions further incorporate $\dim(D)=k'$7 entrywise (Morrison, 2013). The paper introducing MSE focuses on the $\dim(D)=k'$8 case (Bardet et al., 21 Jul 2025).

A generator-matrix formulation makes the hidden structure explicit. If $\dim(D)=k'$9 and $k'<k$0 generate $k'<k$1 and $k'<k$2, then

$k'<k$3

is equivalent to the existence of a matrix $k'<k$4 with $k'<k$5 such that

$k'<k$6

(Bardet et al., 21 Jul 2025). This is the defining feature of the subcode problem: the map $k'<k$7 is full-rank but non-invertible. If $k'<k$8 is a parity-check matrix of $k'<k$9, with $A \in \mathrm{GL}_m(q)$0, then the same condition yields the dual formulation

$A \in \mathrm{GL}_m(q)$1

(Bardet et al., 21 Jul 2025).

The paper also studies the inhomogeneous Matrix Code Permuted Kernel Problem. Given $A \in \mathrm{GL}_m(q)$2, it asks whether there exist invertible $A \in \mathrm{GL}_m(q)$3 and $A \in \mathrm{GL}_m(q)$4 of rank $A \in \mathrm{GL}_m(q)$5 such that

$A \in \mathrm{GL}_m(q)$6

(Bardet et al., 21 Jul 2025). In dual form, with $A \in \mathrm{GL}_m(q)$7 a parity-check matrix of $A \in \mathrm{GL}_m(q)$8 and $A \in \mathrm{GL}_m(q)$9,

$B \in \mathrm{GL}_n(q)$0

For $B \in \mathrm{GL}_n(q)$1, this reduces to MSE (Bardet et al., 21 Jul 2025).

2. Relation to matrix code equivalence and earlier equivalence theory

MSE arose in a landscape already shaped by full matrix code equivalence. In the general Matrix Code Equivalence Problem, two $B \in \mathrm{GL}_n(q)$2-dimensional matrix spaces $B \in \mathrm{GL}_n(q)$3 are equivalent if there exist invertible $B \in \mathrm{GL}_n(q)$4 and $B \in \mathrm{GL}_n(q)$5 such that

$B \in \mathrm{GL}_n(q)$6

(Couvreur et al., 1 Apr 2025). Recent signature schemes such as MEDS and ALTEQ relate their security to the hardness of this problem (Couvreur et al., 1 Apr 2025). The full-equivalence literature established both the ambient group structure and the distinction between matrix equivalence and rank-metric equivalence: matrix equivalence is strictly more general than rank-metric equivalence, and its linear isometry group is

$B \in \mathrm{GL}_n(q)$7

when $B \in \mathrm{GL}_n(q)$8, with an additional $B \in \mathrm{GL}_n(q)$9-action by transposition when $D \subseteq A C B$0 (Morrison, 2013).

For given codes, several decision problems in full equivalence admit efficient structure theory. The Matrix Codes Right Equivalence Problem and Hidden Vector Matrix Code Equivalence are in $D \subseteq A C B$1 if $D \subseteq A C B$2, and in $D \subseteq A C B$3 in general; the core tools are conductor spaces, stabilizer algebras, Jacobson radicals, and Wedderburn–Artin decompositions (Couvreur et al., 2020). That framework applies directly when the subcodes are given explicitly, but not to the existential search inherent in MSE as introduced in the subcode literature. This suggests that MSE should be distinguished from “given-subcode equivalence” problems inherited from conductor-based algorithms (Couvreur et al., 2020).

The introduction of MSE parallels the Hamming-metric notion of subcode equivalence. In the matrix setting, the loss of invertibility on the code-side mixing matrix $D \subseteq A C B$4 is decisive. The subcode condition does not merely weaken full equivalence; it removes the invertible change-of-basis symmetry on the smaller code and therefore invalidates several transfer principles and invariants that are effective in the full-code case (Bardet et al., 21 Jul 2025).

3. Hardness, reductions, and counting heuristics

The work introducing MSE places it in direct relation with Hamming-metric subcode equivalence. It states that the Matrix Subcode Equivalence problem reduces to the Hamming Subcode Equivalence problem, which is known to be NP-Complete (Bardet et al., 21 Jul 2025). In the detailed reduction, Hamming codes are embedded into diagonal matrix codes through the rank isometry

$D \subseteq A C B$5

for which $D \subseteq A C B$6 (Bardet et al., 21 Jul 2025). The corresponding proposition identifies Hamming SEP-equivalence with matrix-subcode inclusion after a rank isometry, and the synthesized conclusion is that MSE is at least as hard as Hamming SEP, hence NP-hard (Bardet et al., 21 Jul 2025).

The generator description also supports counting heuristics. Under a random-subspace heuristic, the average number of projective isometries mapping $D \subseteq A C B$7 into $D \subseteq A C B$8 is approximately

$D \subseteq A C B$9

where

$[m\times n,k]$0

and the Gaussian binomial coefficient is

$[m\times n,k]$1

(Bardet et al., 21 Jul 2025). This estimate is used for parameter selection rather than as a proof of average-case complexity.

The same work argues that $[m\times n,k]$2 is necessary to avoid large underdetermined systems and proliferation of trivial or invertible solutions. For $[m\times n,k]$3 or $[m\times n,k]$4, systems such as $[m\times n,k]$5 have at most $[m\times n,k]$6 independent linear equations in $[m\times n,k]$7 unknowns, yielding many solutions likely including invertible $[m\times n,k]$8. For $[m\times n,k]$9, the induced systems tend to be overdetermined and uniqueness can be engineered (Bardet et al., 21 Jul 2025). This criterion is central in the cryptographic instantiation, where $C$0 is used systematically (Bardet et al., 21 Jul 2025).

A plausible implication is that MSE occupies an intermediate position between full code equivalence and generic subspace-search problems: it inherits the geometric structure of rank isometries, but its search space is shaped by a non-invertible hidden embedding. The literature repeatedly identifies this non-invertibility of $C$1 as the reason both algebraic and invariant-based attacks become weaker than in the full-equivalence setting (Bardet et al., 21 Jul 2025).

4. Algorithmic approaches and why the subcode case is harder

The existing attack surface for MSE is built by adapting full matrix-code equivalence techniques to the subcode case. The common conclusion is that these adaptations perform much worse than in the code equivalence case, mirroring the Hamming metric (Bardet et al., 21 Jul 2025).

The simplest reduction guesses a $C$2-dimensional subspace of $C$3 and then solves full MCE on that guess. Its complexity is

$C$4

with $C$5; even for small $C$6, this is enormous (Bardet et al., 21 Jul 2025). The paper gives the example $C$7, which leads to $C$8 possibilities (Bardet et al., 21 Jul 2025).

The algebraic modelings center on the equation

$C$9

or on its dual quadratic form

$F$0

(Bardet et al., 21 Jul 2025). In the naive trilinear model, the unknowns are $F$1, with $F$2 variables and $F$3 affine trilinear equations (Bardet et al., 21 Jul 2025). Hybrid variants guess columns of $F$4 or rows of $F$5, producing linear subsystems, but their exponents are substantially worse than for MCE when $F$6 is small (Bardet et al., 21 Jul 2025). The dual quadratic model has only $F$7 equations in $F$8 unknowns, fewer than in full MCE, and is therefore weaker (Bardet et al., 21 Jul 2025).

A more elaborate trilinear formalism uses commutation matrices $F$9 and reshaped generators $\dim(C)=k$00. It yields equivalent formulations such as

$\dim(C)=k$01

and bilinear constraints

$\dim(C)=k$02

(Bardet et al., 21 Jul 2025). The paper then adds new trilinear equations based on right inverses: $\dim(C)=k$03 (Bardet et al., 21 Jul 2025). These improve constraints without introducing $\dim(C)=k$04 as explicit variables. Yet experimental evidence remains unfavorable: Gröbner basis computations for $\dim(C)=k$05 took about $\dim(C)=k$06 s for $\dim(C)=k$07, but more than $\dim(C)=k$08 hours for $\dim(C)=k$09, illustrating the gap between MCE and MSE (Bardet et al., 21 Jul 2025).

Leon-style combinatorial attacks were also adapted. They search for low-rank codewords in $\dim(C)=k$10 and $\dim(C)=k$11, construct collision lists, and solve linear systems derived from equal-rank pairs (Bardet et al., 21 Jul 2025). If

$\dim(C)=k$12

is the number of rank-$\dim(C)=k$13 matrices, then the expected number of rank-$\dim(C)=k$14 codewords in $\dim(C)=k$15 is $\dim(C)=k$16, and in $\dim(C)=k$17 it is $\dim(C)=k$18 (Bardet et al., 21 Jul 2025). To obtain collision probability $\dim(C)=k$19, it suffices to sample

$\dim(C)=k$20

elements from $\dim(C)=k$21 (Bardet et al., 21 Jul 2025). Because $\dim(C)=k$22 is smaller, feasible $\dim(C)=k$23 is larger than in MCE, so the attack becomes significantly more expensive (Bardet et al., 21 Jul 2025).

The reduction to Quadratic Sub Map Linear Equivalence provides another algorithmic lens. In QSMLE, one seeks $\dim(C)=k$24 and $\dim(C)=k$25 of rank $\dim(C)=k$26 such that

$\dim(C)=k$27

for tuples of quadratic polynomials $\dim(C)=k$28 (Bardet et al., 21 Jul 2025). MSE reduces to this problem by associating to code bases bilinear polynomials

$\dim(C)=k$29

and similarly for $\dim(C)=k$30, with isometry

$\dim(C)=k$31

(Bardet et al., 21 Jul 2025). The inhomogeneous QSMLE solver dominates parameter selection; the lower bound quoted for cubic linearization is

$\dim(C)=k$32

with

$\dim(C)=k$33

and an explicit expression for $\dim(C)=k$34 in terms of $\dim(C)=k$35 (Bardet et al., 21 Jul 2025). The stated conclusion is that this attack is substantially worse than MCE due to the non-invertible $\dim(C)=k$36 and the reduced number of equations (Bardet et al., 21 Jul 2025).

Several invariant-based attacks do not transfer at all. The corank walk on bilinear forms requires equal ranks across dimensions, notably $\dim(C)=k$37, and cannot be adapted because $\dim(C)=k$38 and $\dim(C)=k$39 are bounded by $\dim(C)=k$40 and $\dim(C)=k$41, respectively (Bardet et al., 21 Jul 2025). Triangle-based invariants from $\dim(C)=k$42-tensor isomorphism also fail: weak-key probabilities fall from about $\dim(C)=k$43 in MCE to about $\dim(C)=k$44 in MSE, since one needs $\dim(C)=k$45 (Bardet et al., 21 Jul 2025).

Approach	Core relation	Reported effect in MSE
Guess subcode, then solve MCE	$\dim(C)=k$46	Impractical
Algebraic modeling	$\dim(C)=k$47	Equation deficit
Dual quadratic modeling	$\dim(C)=k$48	Weaker than MCE
Leon-style collisions	Low-rank collisions in $\dim(C)=k$49	Higher feasible $\dim(C)=k$50
QSMLE reduction	$\dim(C)=k$51	Dominant for parameters
Corank walks / triangles	Tensor invariants	Do not transfer

The broader full-equivalence literature helps explain this deterioration. In general MCE, the “Highway to Hull” algorithm reduces equivalence to conjugacy and exploits one-dimensional hulls as conjugacy invariants (Couvreur et al., 1 Apr 2025). That mechanism relies on exact equivalence of full spaces and on separable characteristic-polynomial collisions. A plausible implication is that no direct hull-based analogue is currently available for the existential subcode setting without substantial additional guessing, because the hidden object is not the whole code but an unknown embedded subspace.

5. Matrix Code Permuted Kernel Problem and signature constructions

The main cryptographic application of MSE is the Matrix Code Permuted Kernel Problem, especially in its inhomogeneous form (Bardet et al., 21 Jul 2025). Its public relation is the degree-$\dim(C)=k$52 polynomial constraint

$\dim(C)=k$53

where $\dim(C)=k$54 has rank $\dim(C)=k$55, $\dim(C)=k$56 has rank $\dim(C)=k$57, and $\dim(C)=k$58 is stored in row-reduced echelon form (Bardet et al., 21 Jul 2025). The secret key is $\dim(C)=k$59, while the public key is $\dim(C)=k$60 (Bardet et al., 21 Jul 2025).

Key generation samples $\dim(C)=k$61 uniformly with the required ranks and sets

$\dim(C)=k$62

resampling if $\dim(C)=k$63 (Bardet et al., 21 Jul 2025). The public-key size is approximately

$\dim(C)=k$64

and in the NIST-I set MCPKP-Ib it is about $\dim(C)=k$65 Bytes (Bardet et al., 21 Jul 2025).

The zero-knowledge layer is implemented with MPC-in-the-Head. In the TCitH variant, Shamir sharing of degree $\dim(C)=k$66 is applied to the witness $\dim(C)=k$67, and the parties compute

$\dim(C)=k$68

With challenges $\dim(C)=k$69, they form

$\dim(C)=k$70

open $\dim(C)=k$71, and accept iff $\dim(C)=k$72 (Bardet et al., 21 Jul 2025). One repetition has false-positive probability $\dim(C)=k$73; after $\dim(C)=k$74 repetitions it becomes $\dim(C)=k$75 (Bardet et al., 21 Jul 2025). The signature-size formula is

$\dim(C)=k$76

where $\dim(C)=k$77 and $\dim(C)=k$78 (Bardet et al., 21 Jul 2025).

The VOLE-in-the-Head variant merges $\dim(C)=k$79 sharings via a morphism $\dim(C)=k$80, reducing soundness to $\dim(C)=k$81 (Bardet et al., 21 Jul 2025). Its signature-size formula is

$\dim(C)=k$82

with $\dim(C)=k$83 chosen so that $\dim(C)=k$84 (Bardet et al., 21 Jul 2025).

The representative parameter sets reported are:

Set	$\dim(C)=k$85	Public key	Attack logs
MCPKP-Ia	$\dim(C)=k$86	$\dim(C)=k$87 B	Leon $\dim(C)=k$88, QSMLE $\dim(C)=k$89
MCPKP-Ib	$\dim(C)=k$90	$\dim(C)=k$91 B	Leon $\dim(C)=k$92, QSMLE $\dim(C)=k$93
MCPKP-III	$\dim(C)=k$94	$\dim(C)=k$95 B	Leon $\dim(C)=k$96, QSMLE $\dim(C)=k$97
MCPKP-V	$\dim(C)=k$98	$\dim(C)=k$99 B	Leon $\dim(D)=k'$00, QSMLE $\dim(D)=k'$01

For NIST-I in the “Short” configuration, the reported signature sizes are about $\dim(D)=k'$02 B for VOLEitH and $\dim(D)=k'$03 B for TCitH on MCPKP-Ib (Bardet et al., 21 Jul 2025). The paper contrasts these figures with established schemes and reports that, at NIST-I, the MSE/MKPK-based construction gives a smaller combined size than SPHINCS+, while also producing much smaller public keys than MEDS, LESS, and ALTEQ (Bardet et al., 21 Jul 2025).

A notable design choice is the use of inhomogeneous MKPK rather than homogeneous MSE. The paper states that using homogeneous MSE with $\dim(D)=k'$04 would require transmitting $\dim(D)=k'$05 or verifying $\dim(D)=k'$06, inflating signatures by about $\dim(D)=k'$07 kB at level I (Bardet et al., 21 Jul 2025). This motivates the inhomogeneous formulation.

6. Structural viewpoints, special families, and related classification problems

Although MSE was introduced only recently, it fits into a broader theory of equivalence and classification for matrix codes. Earlier work on matrix equivalence provided invariants such as $\dim(D)=k'$08, minimum rank distance, rank distribution, and weight enumerators; these remain useful as pre-filters in equivalence testing, but in the subcode setting they no longer decide the problem because inclusion does not preserve full distributions (Morrison, 2013). For self-dual matrix codes, classification can be organized through double cosets of duality-preserving isometries, using

$\dim(D)=k'$09

or its square-matrix extension with transpose (Morrison, 2015). This framework is exact for self-dual full codes, but it does not directly solve MSE, since the latter is not formulated as equivalence between equal-dimensional codes and generally lacks transitivity under the ambient group action (Morrison, 2015).

A different strand studies specialized families of low-dimensional MRD codes where subcode equivalence becomes tractable through family-specific invariants. For the $\dim(D)=k'$10-dimensional $\dim(D)=k'$11-linear MRD family $\dim(D)=k'$12, practical equivalence testing reduces to matching Frobenius support patterns, checking that $\dim(D)=k'$13, computing $\dim(D)=k'$14, and verifying the relevant $\dim(D)=k'$15-orbit relation between $\dim(D)=k'$16 and $\dim(D)=k'$17, possibly up to sign and inversion (Gupta et al., 2022). This yields a “practical, computable decision procedure” for that family (Gupta et al., 2022). The existence of such family-dependent criteria suggests that subcode equivalence may admit efficient solutions on highly structured instances even when the general problem is treated as a cryptographic hardness assumption.

Geometric approaches to Hamming code equivalence supply another perspective. In the projective-geometry formulation, code equivalence is tested by isomorphism of binary incidence matrices $\dim(D)=k'$18 or shortened variants $\dim(D)=k'$19, with automorphism group computations via canonical labeling (Bouyukliev et al., 2022). The same synthesis explicitly adapts the matrix form

$\dim(D)=k'$20

to subcode equivalence, where $\dim(D)=k'$21 has full row rank, and interprets the problem as orbit-subset containment of projective multisets (Bouyukliev et al., 2022). This is a different metric setting, but it clarifies a general phenomenon also present in MSE: subcode equivalence replaces orbit equality by orbit containment, and that shift is algorithmically expensive.

The current literature therefore presents MSE as both a natural rank-metric analogue of Hamming subcode equivalence and a distinct cryptographic primitive. Its defining obstacle is the non-invertible hidden map $\dim(D)=k'$22, which weakens algebraic constraints, destroys several full-equivalence invariants, and forces parameter choices that differ markedly from those used for matrix code equivalence (Bardet et al., 21 Jul 2025). At the same time, the surrounding equivalence theory indicates that structured subclasses, stabilizer algebras, idealizers, and family-specific normal forms remain central tools for understanding when subcode equivalence is tractable and when it is intended to be hard.