Polynomial Time Key-Recovery Attack on High Rate Random Alternant Codes

A long standing open question is whether the distinguisher of high rate alternant codes or Goppa codes from Faugère, Gauthier-Uma na, Otmani, Perret, and Tillich in 2011 can be turned into an algorithm recovering the algebraic structure of such codes from the mere knowledge of an arbitrary generator matrix of it. This would allow to break the McEliece scheme as soon as the code rate is large enough and would break all instances of the CFS signature scheme. We give for the first time a positive answer for this problem when the code is a generic alternant code and when the code field size
$q$
is small:
$q \in \{2,3\}$
and for all regimes of other parameters for which the aforementioned distinguisher works. This breakthrough has been obtained by two different ingredients: (i) a way of using code shortening and the component-wise product of codes to derive from the original alternant code a sequence of alternant codes of decreasing degree up to getting an alternant code of degree 3 (with a multiplier and support related to those of the original alternant code); (ii) an original Gröbner basis approach which takes into account the non standard constraints on the multiplier and support of an alternant code which recovers in polynomial time the relevant algebraic structure of an alternant code of degree 3 from the mere knowledge of a basis for it.