Paper 2026/2769

Projective Jet Geometry and Hold-Out Rank of Binary Goppa Codes

Abstract

We develop a projective-geometric and algebraic framework for the higher-order polynomial relations among the public generator-matrix columns of a binary Goppa code, the relations exploited by the recent structural distinguishers and key-recovery methods for Classic McEliece. The alternant representation realizes the public columns as rational points on a hidden curve parametrized over $\F_{2^m}$; higher-order vanishing conditions become fat-point conditions, pulled back along the hidden parametrization. Our first contribution is an exact characterization of a codimension-$t$ ambient space containing all products of $d$ code polynomials: the products satisfy $(\pi^dh)'\equiv0\pmod{g^2}$ for the support polynomial $\pi$ and the Goppa polynomial $g$, and the space of degree-$\le dD$ polynomials with this property has dimension $dD+1-t$ once $dD\ge2t-1$. Equality with the actual product space is proved in a local regime, verified computationally on every instance tested, and stated as a conjecture. Our second contribution is a Frobenius-descent theorem: a binary form vanishes on the hidden curve if and only if it vanishes on the union of its $m$ Frobenius conjugates, with the $\F_2$-dimension of such forms equal to the $K$-dimension of the ideal of the union; from it we derive Hilbert-function bounds, including a multilinear version attained on all but one of the twenty-seven keys with $t\ge5$ tested (and missed by one on that key), and the local structure of the pulled-back forms at the roots of $g$. We then analyze the universal dependencies among Hasse-jet conditions in the multilinear setting of the attacks: a closed formula for the rank at a single column, and an explicit family of $\binom{k}{2s-d-2}$ relations between the conditions at any two columns. At a held-out column we prove an exact codimension formula for the Goppa subcode generated by the gradients of the vanishing forms. Finally, running our experimental pipeline (the jet system of the attacks, without the key-recovery steps) on six independently generated keys of a Classic-McEliece-shaped code shows that the kernel dimension is comparable to that of a random control, while every kernel form exhibits the predicted hidden-curve vanishing, the gradients span the predicted subcode, and the first-order normal data of the kernel is nearly independent of the key. Together these results explain the main components of the nuisance space of the recent attacks and isolate the conjectures that remain for an exact description of the kernel.