Goppa-Like Elliptic Codes

• Goppa-like elliptic codes are algebraic-geometry codes defined on genus-1 curves, using evaluation of Riemann–Roch spaces and the Weierstrass semigroup to establish code structure.
• They exhibit near-MDS performance with parameters derived from explicit semigroup and divisor analyses, closely linking classical AG coding theory with Reed–Solomon-like behavior.
• Their explicit construction, including quasi-cyclic structures and self-duality criteria, informs both accurate performance estimates and cryptographic security assessments.

Goppa-like elliptic codes are algebraic-geometry codes attached to elliptic curves, hence to smooth projective curves of genus $g=1$. In the literature, the expression is used in two closely related ways: as the genus-$1$ specialization of classical geometric Goppa evaluation codes, and, in a more specific cryptographic usage, as subfield subcodes of dual AG codes on elliptic curves whose finite divisors mimic the classical $G_0-P_\infty$ pattern. Both viewpoints are governed by the same elliptic function-field data—Riemann–Roch spaces, evaluation at rational places, the Weierstrass semigroup at the point at infinity, and explicit rational bases for elliptic divisors (Melo, 2012, Kuninets et al., 6 Aug 2025, Khalfaoui et al., 2023).

1. Terminological scope and relation to classical Goppa codes

The broad AG viewpoint starts from a smooth projective curve $X$ over a finite field, a divisor $G$, and an evaluation divisor $D=P_1+\cdots+P_n$ supported on rational points disjoint from $\operatorname{Supp}(G)$. In that setting, the code is the image of the evaluation map on the Riemann–Roch space $\mathcal L(G)$. When $X$ is elliptic, this becomes the elliptic specialization of geometric Goppa coding theory. The dissertation literature on elementary methods makes this specialization explicit by identifying “Goppa-like elliptic codes” with genus-$1$ AG Goppa codes and with evaluation codes derived from the van Lint–Pellikaan–Høhold order/semigroup formalism (Melo, 2012).

A narrower definition appears in work on subfield-subcode constructions. There, one fixes a curve $1$0 over $1$1, an effective divisor $1$2, and a rational function $1$3, forms the AG code

$1$4

and defines the associated Goppa-like AG code by

$1$5

For $1$6, this recovers classical Goppa codes exactly; for $1$7 elliptic, it yields the elliptic instance of the same construction (Khalfaoui et al., 2023). Recent elliptic work further specializes this pattern to divisors of the form $1$8 or, more generally, $1$9, defining elliptic Goppa-like codes as

$G_0-P_\infty$0

and

$G_0-P_\infty$1

(Kuninets et al., 6 Aug 2025).

This terminological variation is substantive rather than contradictory. The first usage emphasizes the genus-$G_0-P_\infty$2 specialization of AG code theory; the second emphasizes the classical-Goppa-like placement of elliptic subfield subcodes inside code-based cryptography. A plausible implication is that “Goppa-like elliptic code” is best treated as an umbrella term whose precise meaning depends on whether the context is function-field coding theory or cryptographic code design.

2. Elliptic specialization of the classical AG construction

Let $G_0-P_\infty$3 be a function field of genus $G_0-P_\infty$4, $G_0-P_\infty$5 a sum of pairwise distinct rational places, and $G_0-P_\infty$6 a divisor with $G_0-P_\infty$7. The associated geometric Goppa code is

$G_0-P_\infty$8

Its parameters satisfy

$G_0-P_\infty$9

If $X$0, then $X$1 and Riemann–Roch gives

$X$2

The dual code is the differential code $X$3, with

$X$4

and, in the same degree range,

$X$5

(Melo, 2012).

For an elliptic curve $X$6 with distinguished rational point $X$7, one takes $X$8, chooses distinct rational points $X$9, sets $G$0, and lets $G$1 with $G$2. Because $G$3, Riemann–Roch simplifies to

$G$4

for all $G$5, while $G$6 because $G$7. Hence

$G$8

has parameters

$G$9

Its dual $D=P_1+\cdots+P_n$0 has

$D=P_1+\cdots+P_n$1

(Melo, 2012).

This places elliptic AG codes between Reed–Solomon codes and higher-genus AG codes. Reed–Solomon codes, arising from genus $D=P_1+\cdots+P_n$2, meet the MDS equality $D=P_1+\cdots+P_n$3; elliptic AG codes satisfy $D=P_1+\cdots+P_n$4, so the genus-$D=P_1+\cdots+P_n$5 loss is exactly one unit in the Singleton-type relation. That “almost MDS” behavior is one reason elliptic constructions recur in both classical AG coding and code-based cryptography (Melo, 2012).

3. Semigroup and order-domain formulation

The elementary approach replaces much of the divisor formalism by a weight function $D=P_1+\cdots+P_n$6 on an $D=P_1+\cdots+P_n$7-algebra $D=P_1+\cdots+P_n$8, satisfying the order axioms and, in the multiplicative case, the weight identity $D=P_1+\cdots+P_n$9. The set

$\operatorname{Supp}(G)$0

is then a numerical semigroup. In this framework, the finite number of gaps of $\operatorname{Supp}(G)$1 plays the role of the genus, and the conductor $\operatorname{Supp}(G)$2 satisfies

$\operatorname{Supp}(G)$3

(Melo, 2012).

For elliptic curves, the relevant semigroup is the Weierstrass semigroup at the point at infinity $\operatorname{Supp}(G)$4: $\operatorname{Supp}(G)$5 In genus $\operatorname{Supp}(G)$6, there is exactly one gap, namely $\operatorname{Supp}(G)$7, and

$\operatorname{Supp}(G)$8

Equivalently, the semigroup is generated by $\operatorname{Supp}(G)$9 and $\mathcal L(G)$0, is symmetric, and has conductor $\mathcal L(G)$1. The standard coordinate functions on a Weierstrass model realize this numerically: $\mathcal L(G)$2 with pole orders $\mathcal L(G)$3 at $\mathcal L(G)$4 (Melo, 2012).

Let $\mathcal L(G)$5 be evaluation at rational points, and let $\mathcal L(G)$6 be the span of the first $\mathcal L(G)$7 basis elements ordered by increasing $\mathcal L(G)$8-value. The resulting evaluation code $\mathcal L(G)$9 satisfies

$X$0

whenever $X$1. In the elliptic case, taking $X$2 and identifying $X$3, one recovers exactly the classical space $X$4 and therefore the elliptic AG code $X$5. The semigroup inequality $X$6 becomes $X$7 when $X$8, reproducing the AG bound $X$9 by purely semigroup-theoretic means (Melo, 2012).

The importance of this reformulation is conceptual and algorithmic. It shows that genus-$1$0 AG behavior can be derived from linear algebra and numerical semigroups alone, and it embeds elliptic Goppa-like codes into the broader order-domain tradition.

4. Explicit Riemann–Roch bases and divisor models on elliptic curves

A major recent development is the explicit computation of bases of $1$1 for arbitrary elliptic divisors. For a non-infinite point $1$2 and $1$3, a basis of $1$4 is

$1$5

where the polynomial $1$6 is chosen so that $1$7 cancels the unwanted pole at the conjugate point $1$8. The coefficients of $1$9 are obtained by Taylor expansion around $1$00, using implicit differentiation of the elliptic Weierstrass equation; Algorithm 1 in the paper formalizes this in characteristic $1$01 and in characteristic $1$02 (Kuninets et al., 6 Aug 2025).

For a general effective divisor

$1$03

the basis becomes

$1$04

where the $1$05 are the single-point functions above and the $1$06 are “double-point functions” with simple poles at consecutive points $1$07. The count is exact: $1$08 This gives an explicit, implementable basis for any effective elliptic divisor, not merely one-point divisors at $1$09 (Kuninets et al., 6 Aug 2025).

Within this basis-theoretic framework, the elliptic Goppa-like construction takes two principal forms. The one-point form uses a function $1$10, its zero divisor $1$11, and the finite divisor

$1$12

yielding

$1$13

The more general form replaces $1$14 by an arbitrary effective divisor $1$15 and defines

$1$16

The explicit basis of $1$17 transfers directly to $1$18 by dividing basis elements by $1$19, so generator and parity-check matrices become fully constructive (Kuninets et al., 6 Aug 2025).

This explicit-basis viewpoint eliminates the historical restriction to monomial bases at infinity. It also clarifies that finite divisors of the form $1$20 are not merely analogies to classical Goppa divisors on $1$21, but genuine elliptic divisor classes with computable rational-function realizations.

5. Duality, self-duality, and symmetric elliptic families

Self-duality on elliptic function fields admits a precise divisor-theoretic criterion. Over a field $1$22 of characteristic different from $1$23, let

$1$24

so that $1$25 is elliptic. Choose an even integer $1$26, rational places $1$27 of $1$28 that split in $1$29, and define the evaluation divisor

$1$30

Let $1$31 satisfy $1$32, and define

$1$33

Then $1$34 and $1$35 for all $1$36, and the dual divisor becomes

$1$37

If $1$38 is a divisor of degree $1$39, the code $1$40 is self-dual if and only if

$1$41

for some $1$42 such that $1$43 for every $1$44. Under these hypotheses, the resulting self-dual elliptic code has length $1$45, dimension $1$46, and minimum distance at least $1$47 (Patanker et al., 2019).

The same elliptic setting also supports quasi-cyclic constructions. If $1$48 has order $1$49, and both $1$50 and $1$51 are built from $1$52-orbits, then $1$53 is $1$54-quasi-cyclic. The corresponding quasi-cyclic Goppa-like elliptic codes arise when $1$55 is likewise $1$56-invariant, in which case

$1$57

inherits the quasi-cyclic symmetry (Kuninets et al., 6 Aug 2025).

These symmetric families serve two distinct agendas. In pure coding-theoretic terms, they provide compact structural descriptions and explicit orbit-adapted bases. In cryptographic terms, they create public-key compression opportunities. The associated risk is not uniform: recent elliptic work states that no efficient structural attack is currently known against the quasi-cyclic subfield subcodes of dual elliptic codes, but also concludes that one-point Goppa-like elliptic codes with simple $1$58 are structurally risky because Schur-square distinguishers likely apply (Kuninets et al., 6 Aug 2025).

6. Cryptographic use, Schur-square distinguishers, and the Goppa morphism

The cryptographic analysis of Goppa-like elliptic codes proceeds along two complementary lines. The first is combinatorial-algebraic and studies the square of the dual. The second is geometric and studies the image of elliptic level structures inside a Grassmannian.

For Goppa-like AG codes $1$59, the relevant object is

$1$60

equivalently the square of the trace code attached to the ambient AG code. On $1$61 curves, and therefore in particular on elliptic $1$62 models, the dimension of this square admits explicit upper bounds substantially below the random expectation $1$63. In the one-point setting, Theorem 4.7 gives

$1$64

under the stated degree condition on $1$65 and $1$66. For elliptic examples over $1$67 built from

$1$68

the paper reports equality between the measured value of $1$69 and this theoretical upper bound for $1$70, indicating sharpness in random-looking elliptic instances (Khalfaoui et al., 2023).

The same paper identifies the high-rate regime in which elliptic Goppa-like codes are distinguishable by this Schur-square method. Reported examples include rate $1$71 for $1$72, rate $1$73 for $1$74, and rate $1$75 for $1$76. Its conclusion is that, for elliptic curves, only very high rate codes are distinguishable by this method, whereas higher-genus Hermitian families can evade the same distinguisher entirely (Khalfaoui et al., 2023).

The geometric line of analysis packages elliptic Goppa-like codes as level structures

$1$77

with $1$78, and maps them to $1$79 via the Goppa morphism. For genus $1$80, the moduli stack of elliptic level structures has dimension $1$81, and the extended Goppa morphism is an immersion for $1$82. The corresponding dimension gap is

$1$83

The “dangerous” degrees are those in

$1$84

and for large $1$85 this is approximately $1$86. The paper’s explicit conclusion is that, from a cryptographic point of view, Goppa codes produced by level structures in that interval are distinguishable from random linear codes and should be avoided (Castañeda, 2024).

Taken together, these results sharply qualify the cryptographic status of Goppa-like elliptic codes. They remain mathematically natural, explicitly constructible, and close to MDS in classical parameter terms, but their algebraic regularity is visible to both Schur-product methods and moduli-theoretic dimension arguments. A plausible implication is that elliptic constructions are best regarded as highly structured AG families rather than as random-like code ensembles; this aligns them with the broader experience on symmetric alternant and Goppa cryptosystems, where structural compression has repeatedly created attack surfaces (Faugère et al., 2014).