Paper 2026/2710

Hidden Curves and Short Duals: Cubic Jets, Dual Leaks, and the Limits of Masked-Code Encryption

Abstract

Masked-code encryption hides an efficiently decodable code behind a transformation meant to make it look random. We study the two masks proposed as compact alternatives to Goppa codes---Wang's RLCE (insert $w$ random columns, mix coordinate pairs) and the $(U\,|\,U{+}V)$ construction of UVW-KEM---over every decodable hidden code they have been or could be applied to, and find that none yields a compact trapdoor. For Reed--Solomon and algebraic-geometry codes the mask hides a \emph{curve}, and curves are not hidden from jets. On 26 October 2026 a public-key-only key recovery of UVW-KEM, a candidate in China's NGCC program, was reported: an order-two cubic jet count on a shortened public code separates it from random. We explain it and show it is not specific to UVW. We define \emph{hidden-pairing codes}, of which UVW, UVW2, RLCE and the $(U\,|\,U{+}V)$ Reed--Solomon constructions are instances, and bound from below the dependencies among the order-$r$ jets of degree-$d$ forms at the columns of any shortening: for cubics $2k_1-k_2-k_l+2$ for UVW (the reported $k_2-k_l+2$) and $2(n{-}k)-w-k_l+2$ for RLCE, attained in every regime tested, with the pairing and the secret ratios in closed form. Every UVW set is broken and no split $k_1{:}k_2$ escapes; RLCE's long-key regime $w\ge n-k$, which resisted the square-code attack for eight years, falls at degree three; and with the composed forms in $L(d\alpha P)$ the count breaks HermitianRLCE, with excess $2(n{-}k)-w-k_l+2-2g>0$. A forcing law, a master count whose degree-two row is the square-code attack, and a redundancy law make the \emph{jet degree} an invariant of masked codes. The natural escape is a hidden code without a curve. It fails differently: both masks \emph{preserve the dual} of the hidden code---every dual word $\vv h$ yields a public dual word of weight at most $2\wt(\vv h)$, for every number of inserted columns and every $U$-part. Polar codes are short on at least one side ($d\cdot d^\perp\le2n$); polarRLCE at rate $\le2/3$, even with parameters that close the primal minimum-weight leak and the square code, leaks dual words found in $47$--$94$ bits, and its original analysis, which examined only the Schur square, misses both sides. LDPC codes leak their sparse checks under either mask; MDPC codes are better left unmasked (a $36$\,MiB masked key with $102$-bit generic decoding against BIKE's $1.5$\,KiB); and UVW carries, for every hidden code, a matched-pair subspace of codimension $k_1$. At higher rates the polar dual is heavy but the certified decoding radius is small: with the failure probability bounded by the Tal--Vardy construction, no polarRLCE parameter set up to length $16384$ keeps both the leaked dual words and the message above $2^{143}$, and at length $32768$ the cheapest that does has a $58$\,MiB key, $234$ times Classic McEliece. Resisting the dual leak forces the information set to contain a Reed-Muller code; $\mathrm{RM}(6,13)$ and $\mathrm{RM}(7,13)$ under RLCE are the cheapest configurations here that no structural attack reaches, at $3.7$--$4.0$\,MiB keys, fifteen times Classic McEliece, and only if a decoder at $3.4$--$3.8$ times the bounded-distance radius exists. A compact masked trapdoor would need a decodable code with a heavy dual, a heavy primal, and neither a curve nor a subfield structure; we know of none.