Polynomial Time Key-Recovery Attack on High Rate Random Alternant Codes

Abstract

A long standing open question is whether the distinguisher of high rate alternant codes or Goppa codes from Faugère, Gauthier-Umaña, Otmani, Perret, and Tillich in 2011 can be turned into an algorithm recovering the algebraic structure of such codes from the mere knowledge of an arbitrary generator matrix of it. This would allow to break the McEliece scheme as soon as the code rate is large enough and would break all instances of the CFS signature scheme. We give for the first time a positive answer for this problem when the code isa generic alternant codeand when the code field sizeqis small:q∈ {2, 3} and forallregimes of other parameters for which the aforementioned distinguisher works. This breakthrough has been obtained by two different ingredients: (i) a way of using code shortening and the component-wise product of codes to derive from the original alternant code a sequence of alternant codes of decreasing degree up to getting an alternant code of degree 3 (with a multiplier and support related to those of the original alternant code); (ii) an original Gröbner basis approach which takes into account the non standard constraints on the multiplier and support of an alternant code which recovers in polynomial time the relevant algebraic structure of an alternant code of degree 3 from the mere knowledge of a basis for it.