Paper 2026/2223 Original: eprint.iacr.org/2026/2223 ↗
Linear Key Recovery in the BAG-Loong Reference Implementation
Abstract
The BAG-Loong reference implementation samples its secret matrices X and Y from fixed, publicly known subspaces, although the specification calls for secret random supports. This makes the public-key relation S = HX + Y , with public H, amenable to Gaussian elimination. Expanding the relation over F2 and projecting away the support of Y leaves a linear system for X. We prove an exact recovery criterion based on its column rank. All 40 supplied known-answer-test records, covering four parameter sets, satisfy this criterion: two independent solvers recover each X exactly, and the unmodified decapsulation code reproduces the corresponding session keys. For the largest parameter set, the reduced system has 9360 equations in 728 unknowns per column; one elimination solves all 15 columns.
Metadata
- Available format(s)
PDF- Category
- Public-key cryptography
- Publication info
- Preprint.
- History
- 2026-09-26: last updated
- 2026-09-26: published
- Short URL
- https://ia.cr/2026/2223
- License
- https://creativecommons.org/licenses/by/4.0/
BibTeX
@misc{cryptoeprint:2026/2223,
author = {Zihan Liu},
title = {Linear Key Recovery in the BAG-Loong Reference Implementation},
howpublished = {Cryptology {ePrint} Archive, Paper 2026/2223},
year = {2026},
url = {https://eprint.iacr.org/2026/2223}
}