The Tangent Space Attack
Axel Lemoine
TL;DR
The Tangent Space Attack analyzes the algebraic structure of alternant and related codes (GRS, AG, Goppa) through the quadratic hull and Weil restriction to reveal underlying private keys in the McEliece framework. By showing that the quadratic hull of a dual alternant code reflects a Weil-restricted rational normal curve and that tangent spaces stabilize under a common linear operator, the authors devise a polynomial-time attack that recovers the hidden GRS structure and thus a decoding algorithm for high-rate instances. The approach extends to generic AG codes and certain Goppa code regimes, highlighting vulnerabilities beyond binary Goppa codes under square-distinguishability assumptions and offering a general framework based on affine Weil restrictions and tangent-space analysis. The work also develops criteria for Weil-properness and classifies transformations preserving Weil restrictions, providing a practical attack toolkit with complexity dominated by $O( r n^{\omega} )$ steps and outlining several open problems, including handling binary Goppa codes and broader code families. Overall, the paper exposes fundamental algebraic weaknesses in several McEliece-code families and motivates further exploration of geometric methods in code-based cryptography research.
Abstract
We propose a new method for retrieving the algebraic structure of a generic alternant code given an arbitrary generator matrix, provided certain conditions are met. We then discuss how this challenges the security of the McEliece cryptosystem instantiated with this family of codes. The central object of our work is the quadratic hull related to a linear code, defined as the intersection of all quadrics passing through the columns of a given generator or parity-check matrix, where the columns are considered as points in the affine or projective space. The geometric properties of this object reveal important information about the internal algebraic structure of the code. This is particularly evident in the case of generalized Reed-Solomon codes, whose quadratic hull is deeply linked to a well-known algebraic variety called the rational normal curve. By utilizing the concept of Weil restriction of affine varieties, we demonstrate that the quadratic hull of a generic dual alternant code inherits many interesting features from the rational normal curve, on account of the fact that alternant codes are subfield-subcodes of generalized Reed-Solomon codes. If the rate of the generic alternant code is sufficiently high, this allows us to construct a polynomial-time algorithm for retrieving the underlying generalized Reed-Solomon code from which the alternant code is defined, which leads to an efficient key-recovery attack against the McEliece cryptosystem when instantiated with this class of codes. Finally, we discuss the generalization of this approach to Algebraic-Geometry codes and Goppa codes.