Folding Alternant and Goppa Codes with Non-Trivial Automorphism Groups

The main practical limitation of the McEliece public-key encryption scheme is probably the size of its key. A famous trend to overcome this issue is to focus on subclasses of alternant/Goppa codes with a non trivial automorphism group. Such codes display then symmetries allowing compact parity-check or generator matrices. For instance, a key-reduction is obtained by taking quasi-cyclic (QC) or quasi-dyadic (QD) alternant/Goppa codes. We show that the use of such symmetric alternant/Goppa codes in cryptography introduces a fundamental weakness. It is indeed possible to reduce the key-recovery on the original symmetric public-code to the key-recovery on a (much) smaller code that has not anymore symmetries. This result is obtained thanks to a new operation on codes called folding that exploits the knowledge of the automorphism group. This operation consists in adding the coordinates of codewords which belong to the same orbit under the action of the automorphism group. The advantage is twofold: the reduction factor can be as large as the size of the orbits, and it preserves a fundamental property: folding the dual of an alternant (resp. Goppa) code provides the dual of an alternant (resp. Goppa) code. A key point is to show that all the existing constructions of alternant/Goppa codes with symmetries follow a common principal of taking codes whose support is globally invariant under the action of affine transformations (by building upon prior works of T. Berger and A. D{\"{u}}r). This enables not only to present a unified view but also to generalize the construction of QC, QD and even quasi-monoidic (QM) Goppa codes. All in all, our results can be harnessed to boost up any key-recovery attack on McEliece systems based on symmetric alternant or Goppa codes, and in particular algebraic attacks.Comment: 19 page

Constructions of Pure Asymmetric Quantum Alternant Codes Based on Subclasses of Alternant Codes

In this paper, we construct asymmetric quantum error-correcting codes(AQCs) based on subclasses of Alternant codes. Firstly, We propose a new subclass of Alternant codes which can attain the classical Gilbert-Varshamov bound to construct AQCs. It is shown that when $d_x=2$, $Z$-parts of the AQCs can attain the classical Gilbert-Varshamov bound. Then we construct AQCs based on a famous subclass of Alternant codes called Goppa codes. As an illustrative example, we get three $[[55,6,19/4]],[[55,10,19/3]],[[55,15,19/2]]$ AQCs from the well known $[55,16,19]$ binary Goppa code. At last, we get asymptotically good binary expansions of asymmetric quantum GRS codes, which are quantum generalizations of Retter's classical results. All the AQCs constructed in this paper are pure

Polynomial time attack on high rate random alternant codes

A long standing open question is whether the distinguisher of high rate alternant codes or Goppa codes \cite{FGOPT11} can be turned into an algorithm recovering the algebraic structure of such codes from the mere knowledge of an arbitrary generator matrix of it. This would allow to break the McEliece scheme as soon as the code rate is large enough and would break all instances of the CFS signature scheme. We give for the first time a positive answer for this problem when the code is {\em a generic alternant code} and when the code field size $q$ is small : $q \in \{2,3\}$ and for {\em all} regime of other parameters for which the aforementioned distinguisher works. This breakthrough has been obtained by two different ingredients : (i) a way of using code shortening and the component-wise product of codes to derive from the original alternant code a sequence of alternant codes of decreasing degree up to getting an alternant code of degree $3$ (with a multiplier and support related to those of the original alternant code); (ii) an original Gr\"obner basis approach which takes into account the non standard constraints on the multiplier and support of an alternant code which recovers in polynomial time the relevant algebraic structure of an alternant code of degree $3$ from the mere knowledge of a basis for it

Polyadic Constacyclic Codes

For any given positive integer $m$, a necessary and sufficient condition for the existence of Type I $m$-adic constacyclic codes is given. Further, for any given integer $s$, a necessary and sufficient condition for $s$ to be a multiplier of a Type I polyadic constacyclic code is given. As an application, some optimal codes from Type I polyadic constacyclic codes, including generalized Reed-Solomon codes and alternant MDS codes, are constructed.Comment: We provide complete solutions on two basic questions on polyadic constacyclic cdes, and construct some optimal codes from the polyadic constacyclic cde

On the key equation over a commutative ring

We define alternant codes over a commutative ring R and a corresponding key equation. We show that when the ring is a domain, e.g. the p-adic integers, the error–locator polynomial is the unique monic minimal polynomial (shortest linear recurrence) of the syndrome sequence and that it can be obtained by Algorithm MR of Norton. When R is a local ring, we show that the syndrome sequence may have more than one (monic) minimal polynomial, but all the minimal polynomials coincide modulo the maximal ideal of R. We characterise the minimal polynomials when R is a Hensel ring. We also apply these results to decoding alternant codes over a local ring R: it is enough to find any monic minimal polynomial over R and to find its roots in the residue field. This gives a decoding algorithm for alternant codes over a finite chain ring, which generalizes and improves a method of Interlando et. al. for BCH and Reed–Solomon codes over a Galois ring

On PGZ decoding of alternant codes

In this paper, we first review the classical Petterson–Gorenstein–Zierler decoding algorithm for the class of alternant codes, which includes Reed–Solomon, Bose–Chaudhuri–Hocquenghem and classical Goppa codes. Afterwards, we present an improvement of the method to find the number of errors and the error-locator polynomial. Finally, we illustrate the procedure with several examples. In two appendices, we sketch the main features of the computer algebra system designed and developed to support the computations.Peer ReviewedPreprin