Hidden Curves and Short Duals: Cubic Jets, Dual Leaks, and the Limits of Masked-Code Encryption

What it is

Yongge Wang's ePrint 2026/2710 (received 31 October 2026, approved 4 November 2026) argues that the two compact masks for code-based encryption, RLCE and the (U|U+V) construction of UVW-KEM, do not give a compact trapdoor for any decodable hidden code. UVW-KEM is a candidate in China's NGCC program. A public-key-only key recovery of UVW-KEM was reported on 26 October 2026, and the paper explains it and generalizes it.

How it works

Jet attack on curve-based codes. For Reed-Solomon and algebraic-geometry codes the mask hides a curve, and curves are not hidden from jets. The paper defines hidden-pairing codes, of which UVW, UVW2, RLCE and the (U|U+V) Reed-Solomon constructions are instances. It lower-bounds the dependencies among order-r jets of degree-d forms at the columns of any shortening. For cubics the bounds are:

• UVW: 2k1 − k2 − kl + 2 (the reported attack gives k2 − kl + 2).
• RLCE: 2(n−k) − w − kl + 2, attained in every regime tested.
• HermitianRLCE: the same count with excess 2(n−k) − w − kl + 2 − 2g > 0, using composed forms in L(dαP).

Consequences: every UVW set is broken and no split k1:k2 escapes. RLCE's long-key regime w ≥ n−k, which resisted the square-code attack for eight years, falls at degree three.

Dual leak when there is no curve. Both masks preserve the dual of the hidden code. Every dual word h yields a public dual word of weight at most 2·wt(h), for any number of inserted columns and any U-part.

• Polar codes are short on at least one side (d·d⊥ ≤ 2n). PolarRLCE at rate ≤ 2/3 leaks dual words found in 47 to 94 bits, even with parameters that close the primal minimum-weight leak and the square code. Its original analysis examined only the Schur square.
• LDPC codes leak their sparse checks under either mask.
• UVW carries, for every hidden code, a matched-pair subspace of codimension k1.

What to do

• Treat UVW-KEM, RLCE with Reed-Solomon or algebraic-geometry hidden codes (long keys included), HermitianRLCE, polarRLCE and masked LDPC as broken or unsafe, per the paper's claims.
• Do not mask MDPC codes. The masked key is 36 MiB with 102-bit generic decoding, against BIKE's 1.5 KiB.
• Keep Classic McEliece or BIKE as the reference points. The paper offers no masked replacement.

Caveats

• This is a preprint, and the page does not mention independent verification. The 26 October report of the UVW break is cited, not detailed here.
• Higher-rate polar codes have a heavy dual but a small certified decoding radius. Using the Tal-Vardy failure bound, no polarRLCE set up to length 16384 keeps both leaked dual words and the message above 2^143. At length 32768 the cheapest passing set has a 58 MiB key, 234 times Classic McEliece.
• The cheapest configurations the author says no structural attack reaches are RM(6,13) and RM(7,13) under RLCE. Keys are 3.7 to 4.0 MiB, fifteen times Classic McEliece. They work only if a decoder at 3.4 to 3.8 times the bounded-distance radius exists, and the paper does not show one.
• The author knows of no compact masked trapdoor. It would need a decodable code with a heavy dual, a heavy primal, and neither a curve nor a subfield structure.