arXiv: Constant-time decoding of Gabidulin codes and their generalizations with application to RQC

This publication from July 2026 presents a new cryptographic algorithm for constant-time decoding of Gabidulin codes, which are a type of error-correcting code used in post-quantum cryptography. The paper specifically addresses the RQC (Rank Quasi-Cyclic) cryptosystem, a candidate for securing systems against future quantum computer attacks. The key change is that this algorithm improves the efficiency and security of decoding by eliminating timing side-channel vulnerabilities, which are a common attack vector in cryptographic implementations.

Organizations in the financial services, telecommunications, and critical infrastructure sectors that are currently evaluating or deploying post-quantum cryptographic solutions, particularly those using rank-metric codes like RQC, are directly affected. This includes compliance teams overseeing data protection and system security, as well as engineering teams responsible for cryptographic implementations. Any entity subject to EU regulations such as NIS2 or the upcoming EU Cyber Resilience Act should take note, as timing-safe implementations are becoming a baseline security requirement.

Compliance teams should immediately review their cryptographic inventory to identify any systems using Gabidulin codes or RQC-based encryption. They should then coordinate with their cryptography and security engineering teams to assess whether current implementations are vulnerable to timing attacks and to plan for updating to constant-time decoding algorithms. Documentation of this assessment and the planned remediation timeline should be prepared for potential regulatory audits, particularly as EU regulators increasingly focus on quantum-safe cryptography readiness.