Distinguishing Goppa codes or alternant codes from generic linear codes (Faugère et al. in Proceedings of the IEEE Information Theory Workshop—ITW 2011, Paraty, Brasil, October 2011, pp. 282–286, 2011) has been shown to be a first step before being able to attack McEliece cryptosystem based on those codes (Bardet et al. in IEEE Trans Inf Theory 70(6):4492–4511, 2024). Whereas the distinguisher of Faugère et al. (2011) is only able to distinguish Goppa codes or alternant codes of rate very close to 1, in Couvreur et al. (in: Guo and Steinfeld (eds) Advances in Cryptology—ASIACRYPT 2023—29th International Conference on the Theory and Application of Cryptology and Information Security, Guangzhou, China, December 4–8, 2023, Proceedings, Part IV, Volume 14441 of LNCS, pp. 3–38, Springer, 2023) a much more powerful (and more general) distinguisher was proposed. It is based on computing the Hilbert series <InlineEquation ID="IEq1"> <InlineMediaObject> <ImageObject Color="BlackWhite" FileRef="10623_2025_1626_Article_IEq1.gif" Format="GIF" Height="19" Rendition="HTML" Resolution="72" Type="Linedraw" Width="126" /> </InlineMediaObject> <EquationSource Format="TEX">$\{{{\,\textrm{HF}\,}}(d),\;d \in \mathbb {N}\}$</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mo stretchy="false">{</mo> <mrow> <mspace width="0.166667em" /> <mtext>HF</mtext> <mspace width="0.166667em" /> </mrow> <mo stretchy="false">(</mo> <mi>d</mi> <mo stretchy="false">)</mo> <mo>,</mo> <mspace width="0.277778em" /> <mi>d</mi> <mo>∈</mo> <mi mathvariant="double-struck">N</mi> <mo stretchy="false">}</mo> </mrow> </math></EquationSource> </InlineEquation> of a Pfaffian modeling. The distinguisher of Faugère et al. (2011) can be interpreted as computing <InlineEquation ID="IEq2"> <InlineMediaObject> <ImageObject Color="BlackWhite" FileRef="10623_2025_1626_Article_IEq2.gif" Format="GIF" Height="19" Rendition="HTML" Resolution="72" Type="Linedraw" Width="47" /> </InlineMediaObject> <EquationSource Format="TEX">${{\,\textrm{HF}\,}}(1)$</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mrow> <mspace width="0.166667em" /> <mtext>HF</mtext> <mspace width="0.166667em" /> </mrow> <mo stretchy="false">(</mo> <mn>1</mn> <mo stretchy="false">)</mo> </mrow> </math></EquationSource> </InlineEquation>. Computing <InlineEquation ID="IEq3"> <InlineMediaObject> <ImageObject Color="BlackWhite" FileRef="10623_2025_1626_Article_IEq3.gif" Format="GIF" Height="19" Rendition="HTML" Resolution="72" Type="Linedraw" Width="47" /> </InlineMediaObject> <EquationSource Format="TEX">${{\,\textrm{HF}\,}}(2)$</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mrow> <mspace width="0.166667em" /> <mtext>HF</mtext> <mspace width="0.166667em" /> </mrow> <mo stretchy="false">(</mo> <mn>2</mn> <mo stretchy="false">)</mo> </mrow> </math></EquationSource> </InlineEquation> still gives a polynomial time distinguisher for alternant or Goppa codes and is apparently able to distinguish Goppa or alternant codes in a much broader regime of rates as the one of Faugère et al. (2011). However, the scope of this distinguisher was unclear. We give here a formula for <InlineEquation ID="IEq4"> <InlineMediaObject> <ImageObject Color="BlackWhite" FileRef="10623_2025_1626_Article_IEq3.gif" Format="GIF" Height="19" Rendition="HTML" Resolution="72" Type="Linedraw" Width="47" /> </InlineMediaObject> <EquationSource Format="TEX">${{\,\textrm{HF}\,}}(2)$</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mrow> <mspace width="0.166667em" /> <mtext>HF</mtext> <mspace width="0.166667em" /> </mrow> <mo stretchy="false">(</mo> <mn>2</mn> <mo stretchy="false">)</mo> </mrow> </math></EquationSource> </InlineEquation> corresponding to generic alternant codes when the field size q satisfies <InlineEquation ID="IEq5"> <InlineMediaObject> <ImageObject Color="BlackWhite" FileRef="10623_2025_1626_Article_IEq5.gif" Format="GIF" Height="16" Rendition="HTML" Resolution="72" Type="Linedraw" Width="43" /> </InlineMediaObject> <EquationSource Format="TEX">$q \geqslant r$</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mi>q</mi> <mo>⩾</mo> <mi>r</mi> </mrow> </math></EquationSource> </InlineEquation>, where r is the degree of the alternant code. We also show that this expression for <InlineEquation ID="IEq6"> <InlineMediaObject> <ImageObject Color="BlackWhite" FileRef="10623_2025_1626_Article_IEq3.gif" Format="GIF" Height="19" Rendition="HTML" Resolution="72" Type="Linedraw" Width="47" /> </InlineMediaObject> <EquationSource Format="TEX">${{\,\textrm{HF}\,}}(2)$</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mrow> <mspace width="0.166667em" /> <mtext>HF</mtext> <mspace width="0.166667em" /> </mrow> <mo stretchy="false">(</mo> <mn>2</mn> <mo stretchy="false">)</mo> </mrow> </math></EquationSource> </InlineEquation> provides a lower bound in general. The value of <InlineEquation ID="IEq7"> <InlineMediaObject> <ImageObject Color="BlackWhite" FileRef="10623_2025_1626_Article_IEq3.gif" Format="GIF" Height="19" Rendition="HTML" Resolution="72" Type="Linedraw" Width="47" /> </InlineMediaObject> <EquationSource Format="TEX">${{\,\textrm{HF}\,}}(2)$</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mrow> <mspace width="0.166667em" /> <mtext>HF</mtext> <mspace width="0.166667em" /> </mrow> <mo stretchy="false">(</mo> <mn>2</mn> <mo stretchy="false">)</mo> </mrow> </math></EquationSource> </InlineEquation> corresponding to random linear codes is known and this yields a precise description of the new regime of rates that can be distinguished by this new method. This shows that the new distinguisher improves significantly upon the one given in Faugère et al. (2011).

Understanding the new distinguisher of alternant codes at degree 2

期刊论文
发表日期：

2025年4月19日

查看全文

Axel Lemoine,
Rocco Mora,
Jean-Pierre Tillich

摘要

Distinguishing Goppa codes or alternant codes from generic linear codes (Faugère et al. in Proceedings of the IEEE Information Theory Workshop—ITW 2011, Paraty, Brasil, October 2011, pp. 282–286, 2011) has been shown to be a first step before being able to attack McEliece cryptosystem based on those codes (Bardet et al. in IEEE Trans Inf Theory 70(6):4492–4511, 2024). Whereas the distinguisher of Faugère et al. (2011) is only able to distinguish Goppa codes or alternant codes of rate very close to 1, in Couvreur et al. (in: Guo and Steinfeld (eds) Advances in Cryptology—ASIACRYPT 2023—29th International Conference on the Theory and Application of Cryptology and Information Security, Guangzhou, China, December 4–8, 2023, Proceedings, Part IV, Volume 14441 of LNCS, pp. 3–38, Springer, 2023) a much more powerful (and more general) distinguisher was proposed. It is based on computing the Hilbert series $\{{{\,\textrm{HF}\,}}(d),\;d \in \mathbb {N}\}$ ${HF (d), d \in N}$ of a Pfaffian modeling. The distinguisher of Faugère et al. (2011) can be interpreted as computing ${{\,\textrm{HF}\,}}(1)$ $HF (1)$ . Computing ${{\,\textrm{HF}\,}}(2)$ $HF (2)$ still gives a polynomial time distinguisher for alternant or Goppa codes and is apparently able to distinguish Goppa or alternant codes in a much broader regime of rates as the one of Faugère et al. (2011). However, the scope of this distinguisher was unclear. We give here a formula for ${{\,\textrm{HF}\,}}(2)$ $HF (2)$ corresponding to generic alternant codes when the field size q satisfies $q \geqslant r$ $q ⩾ r$ , where r is the degree of the alternant code. We also show that this expression for ${{\,\textrm{HF}\,}}(2)$ $HF (2)$ provides a lower bound in general. The value of ${{\,\textrm{HF}\,}}(2)$ $HF (2)$ corresponding to random linear codes is known and this yields a precise description of the new regime of rates that can be distinguished by this new method. This shows that the new distinguisher improves significantly upon the one given in Faugère et al. (2011).