Hull Attack in Code Cryptanalysis

• Hull attack is a cryptanalytic method that exploits the quadratic hull of a linear code to expose hidden generalized Reed–Solomon structure in alternant-based cryptosystems.
• It leverages tangent-space analysis to recover the secret field structure, enabling polynomial-time key-recovery in high-rate settings.
• The attack's algorithm combines quadratic relation extraction, stabilizer computation, and classical support-recovery to break masked McEliece schemes.

Searching arXiv for recent and related papers on the quadratic-hull/tangent-space attack against alternant-based McEliece schemes. Hull attack denotes a key-recovery approach against certain code-based cryptosystems in which the attacker exploits the quadratic hull of a linear code to recover hidden algebraic structure. In the setting of generic alternant codes used in McEliece-type schemes, the attack described in "The Tangent Space Attack" identifies the concealed generalized Reed–Solomon (GRS) structure by studying the intersection of all quadrics passing through the columns of a public generator or parity-check matrix, and then extracting a common stabilizer of tangent spaces to the resulting variety (Lemoine, 15 May 2025). Under a high-rate regime, this yields a polynomial-time recovery of the underlying GRS code and therefore an efficient key-recovery attack against alternant-based McEliece instantiations (Lemoine, 15 May 2025).

1. Definition and geometric formalism

For a finite field $\mathbb{F}$, let $C \subset \mathbb{F}^n$ be an $r$-dimensional linear code, and let a generator matrix $G \in \mathbb{F}^{r \times n}$ be viewed column-wise as an ordered set of points $x_1,\dots,x_n \in \mathbb{F}^r$ in the affine setting, or as points in $\mathbf{P}^{r-1}(\mathbb{F})$ in the projective setting (Lemoine, 15 May 2025). A quadric is the zero-locus of a homogeneous polynomial of total degree $2$, and with $R=\mathbb{F}[X_0,\dots,X_{r-1}]$, the evaluation map

$$\operatorname{ev}_G: R_2 \to \mathbb{F}^n,\qquad f \mapsto (f(x_1),\dots,f(x_n))$$

has kernel

$I_2(G)=\ker(\operatorname{ev}_G),$

the space of all quadratic forms vanishing on the column set (Lemoine, 15 May 2025).

The attack distinguishes two related objects. The algebraic quadratic hull is the ideal generated by these degree-$C \subset \mathbb{F}^n$0 relations, written $C \subset \mathbb{F}^n$1, while the geometric quadratic hull is the affine variety

$C \subset \mathbb{F}^n$2

cut out by those quadrics (Lemoine, 15 May 2025). Up to projective equivalence these hulls depend only on the code and not on the particular choice of generator matrix (Lemoine, 15 May 2025). The paper further notes that Hilbert’s Nullstellensatz allows one to move between ideal-theoretic and variety-theoretic viewpoints, but that over a finite field the two must be distinguished (Lemoine, 15 May 2025).

The central idea of hull attack is that these quadratic relations are not merely invariants of the public code: they can encode the hidden algebraic geometry of the secret family from which the code originates. This is especially significant for code families whose quadratic hull is much smaller or more structured than that of a random code of the same parameters (Lemoine, 15 May 2025).

2. Rational normal curves, squares, and the hidden GRS structure

For a generalized Reed–Solomon code $C \subset \mathbb{F}^n$3 with support $C \subset \mathbb{F}^n$4 and multiplier $C \subset \mathbb{F}^n$5, one may choose a truncated Vandermonde generator

$C \subset \mathbb{F}^n$6

If $C \subset \mathbb{F}^n$7, then $C \subset \mathbb{F}^n$8 is spanned by the $C \subset \mathbb{F}^n$9 minors of the $r$0 Hankel matrix

$r$1

and therefore defines the rational normal curve $r$2; equivalently, the quadratic hull $r$3 is exactly the affine cone over that curve (Lemoine, 15 May 2025).

This characterization explains why GRS codes have very small Schur squares. Specifically,

$r$4

so that

$r$5

(Lemoine, 15 May 2025). The attack leverages precisely this atypical abundance of quadratic relations.

A plausible implication is that the hull attack is best viewed as a geometric refinement of square-code distinguishers: rather than using only the dimension defect of $r$6, it exploits the full variety cut out by the degree-$r$7 relations. That interpretation is consistent with the paper’s emphasis on the rational normal curve as the geometric carrier of the hidden GRS structure (Lemoine, 15 May 2025).

3. Alternant codes, trace descriptions, and Weil restriction

An alternant code of degree $r$8 over $r$9 is defined by

$G \in \mathbb{F}^{r \times n}$0

(Lemoine, 15 May 2025). By Delsarte’s theorem, its dual is the trace code of a GRS code:

$G \in \mathbb{F}^{r \times n}$1

(Lemoine, 15 May 2025). This trace description is essential because it allows the attacker to compare an $G \in \mathbb{F}^{r \times n}$2-linear public code of dimension $G \in \mathbb{F}^{r \times n}$3 with an $G \in \mathbb{F}^{r \times n}$4-linear secret code of dimension $G \in \mathbb{F}^{r \times n}$5.

The comparison is mediated by affine Weil restriction. If

$G \in \mathbb{F}^{r \times n}$6

writes each coordinate in a chosen $G \in \mathbb{F}^{r \times n}$7-basis $G \in \mathbb{F}^{r \times n}$8, then the induced map on polynomials

$G \in \mathbb{F}^{r \times n}$9

splits each $x_1,\dots,x_n \in \mathbb{F}^r$0 into its $x_1,\dots,x_n \in \mathbb{F}^r$1 coordinate functions (Lemoine, 15 May 2025). One then obtains

$x_1,\dots,x_n \in \mathbb{F}^r$2

and under a square-distinguishability, high-rate regime this inclusion becomes an equality (Lemoine, 15 May 2025). In that case the alternant code is called Weil-proper, and one has

$x_1,\dots,x_n \in \mathbb{F}^r$3

up to the secret $x_1,\dots,x_n \in \mathbb{F}^r$4-linear change of basis $x_1,\dots,x_n \in \mathbb{F}^r$5 used in the McEliece public key (Lemoine, 15 May 2025).

This equality is the geometric hinge of hull attack. It means that the public quadratic hull is not an arbitrary variety in $x_1,\dots,x_n \in \mathbb{F}^r$6, but the Weil restriction of the affine cone over the rational normal curve, transported by an unknown linear transformation (Lemoine, 15 May 2025).

4. Tangent-space recovery of the secret field structure

The attack assumes that $x_1,\dots,x_n \in \mathbb{F}^r$7 is a generic alternant code of extension degree $x_1,\dots,x_n \in \mathbb{F}^r$8 and dimension $x_1,\dots,x_n \in \mathbb{F}^r$9 whose rate is high enough that

$\mathbf{P}^{r-1}(\mathbb{F})$0

equivalently that the right-hand side of the Faugère–Gauthier–Otmani–Perret–Tillich bound meets $\mathbf{P}^{r-1}(\mathbb{F})$1 exactly (Lemoine, 15 May 2025). The paper gives the equivalent parameter condition

$\mathbf{P}^{r-1}(\mathbb{F})$2

(Lemoine, 15 May 2025). The public parity-check matrix has the form

$\mathbf{P}^{r-1}(\mathbb{F})$3

with secret $\mathbf{P}^{r-1}(\mathbb{F})$4 (Lemoine, 15 May 2025).

Under these hypotheses, the quadratic hull

$\mathbf{P}^{r-1}(\mathbb{F})$5

is, up to $\mathbf{P}^{r-1}(\mathbb{F})$6, the Weil restriction of the affine cone over the rational normal curve (Lemoine, 15 May 2025). Its tangent spaces $\mathbf{P}^{r-1}(\mathbb{F})$7, for $\mathbf{P}^{r-1}(\mathbb{F})$8 ranging over the $\mathbf{P}^{r-1}(\mathbb{F})$9 column-points of $2$0, are all stabilized by the same linear operator

$2$1

where $2$2 is the companion matrix of $2$3, the scalar-multiplication map in $2$4 (Lemoine, 15 May 2025).

Two structural statements drive the method. First, if $2$5, then for every $2$6 the tangent space satisfies

$2$7

and is therefore $2$8-invariant; after conjugation by the secret basis change, each $2$9 is $R=\mathbb{F}[X_0,\dots,X_{r-1}]$0-invariant (Lemoine, 15 May 2025). Second, the only matrices stabilizing every $R=\mathbb{F}[X_0,\dots,X_{r-1}]$1-Weil-restriction subspace are polynomials in $R=\mathbb{F}[X_0,\dots,X_{r-1}]$2, so intersecting all stabilizers of the tangent spaces recovers the one-dimensional $R=\mathbb{F}[X_0,\dots,X_{r-1}]$3-algebra $R=\mathbb{F}[X_0,\dots,X_{r-1}]$4 (Lemoine, 15 May 2025).

In effect, the hull attack does not directly recover the support and multiplier. It first reconstructs the hidden field action encoded by the public alternant representation. This suggests that tangent-space analysis acts as an algebra extractor: the geometry reveals the ambient extension-field structure before the classical support-recovery phase begins.

5. Algorithmic workflow and complexity

The key-recovery algorithm consists of five explicit steps (Lemoine, 15 May 2025).

Step	Operation	Cost or output
1	Compute a basis of $R=\mathbb{F}[X_0,\dots,X_{r-1}]$5 by finding all quadratic relations among the columns of $R=\mathbb{F}[X_0,\dots,X_{r-1}]$6	Kernel of the star-product map or direct null-space computation
2	Sample column-points of $R=\mathbb{F}[X_0,\dots,X_{r-1}]$7, compute tangent spaces $R=\mathbb{F}[X_0,\dots,X_{r-1}]$8, and solve equations expressing $R=\mathbb{F}[X_0,\dots,X_{r-1}]$9	Recovers a basis $$\operatorname{ev}_G: R_2 \to \mathbb{F}^n,\qquad f \mapsto (f(x_1),\dots,f(x_n))$$0 of the algebra $$\operatorname{ev}_G: R_2 \to \mathbb{F}^n,\qquad f \mapsto (f(x_1),\dots,f(x_n))$$1
3	Find a generator $$\operatorname{ev}_G: R_2 \to \mathbb{F}^n,\qquad f \mapsto (f(x_1),\dots,f(x_n))$$2 of degree $$\operatorname{ev}_G: R_2 \to \mathbb{F}^n,\qquad f \mapsto (f(x_1),\dots,f(x_n))$$3, compute its minimal polynomial, and solve a similarity problem	Obtain $$\operatorname{ev}_G: R_2 \to \mathbb{F}^n,\qquad f \mapsto (f(x_1),\dots,f(x_n))$$4 with $$\operatorname{ev}_G: R_2 \to \mathbb{F}^n,\qquad f \mapsto (f(x_1),\dots,f(x_n))$$5
4	Recover $$\operatorname{ev}_G: R_2 \to \mathbb{F}^n,\qquad f \mapsto (f(x_1),\dots,f(x_n))$$6	$$\operatorname{ev}_G: R_2 \to \mathbb{F}^n,\qquad f \mapsto (f(x_1),\dots,f(x_n))$$7 is an $$\operatorname{ev}_G: R_2 \to \mathbb{F}^n,\qquad f \mapsto (f(x_1),\dots,f(x_n))$$8-generator matrix of a GRS code conjugate to $$\operatorname{ev}_G: R_2 \to \mathbb{F}^n,\qquad f \mapsto (f(x_1),\dots,f(x_n))$$9
5	Run the classical Sidelnikov–Shestakov attack on the recovered GRS code	Recover $I_2(G)=\ker(\operatorname{ev}_G),$0, hence $I_2(G)=\ker(\operatorname{ev}_G),$1

In Step 2, the paper specifies random sampling of about

$I_2(G)=\ker(\operatorname{ev}_G),$2

points among the column-points of $I_2(G)=\ker(\operatorname{ev}_G),$3 (Lemoine, 15 May 2025). For each sampled point one computes the tangent space as the right-kernel of the Jacobian of the $I_2(G)=\ker(\operatorname{ev}_G),$4 generators at that point, and accumulates the linear equations defining stabilizers (Lemoine, 15 May 2025).

The complexity analysis is polynomial-time throughout. Each null-space or kernel step on matrices of size $I_2(G)=\ker(\operatorname{ev}_G),$5 costs $I_2(G)=\ker(\operatorname{ev}_G),$6, and Step 1 plus Step 2 therefore runs in $I_2(G)=\ker(\operatorname{ev}_G),$7 field operations (Lemoine, 15 May 2025). In Step 3, computing the minimal polynomial has cost $I_2(G)=\ker(\operatorname{ev}_G),$8 (Lemoine, 15 May 2025). Assuming $I_2(G)=\ker(\operatorname{ev}_G),$9, described as the usual McEliece regime, the entire key-recovery runs in

$C \subset \mathbb{F}^n$00

operations in $C \subset \mathbb{F}^n$01 (Lemoine, 15 May 2025).

The final phase uses the classical Sidelnikov–Shestakov attack on the recovered GRS code in $C \subset \mathbb{F}^n$02, after which tracing back through Frobenius conjugacy yields the original support and multiplier (Lemoine, 15 May 2025). This places hull attack in direct continuity with earlier algebraic attacks on GRS-masked McEliece systems, while extending the vulnerable class to high-rate alternant instances through the intermediary of quadratic geometry (Lemoine, 15 May 2025).

6. Scope, extensions, and limitations

The same strategy is stated to apply to one-point algebraic-geometry codes $C \subset \mathbb{F}^n$03 of degree $C \subset \mathbb{F}^n$04 with $C \subset \mathbb{F}^n$05, or more generally in a square-distinguishable regime (Lemoine, 15 May 2025). In that case, the quadratic hull of the $C \subset \mathbb{F}^n$06-generator $C \subset \mathbb{F}^n$07 is the embedded curve $C \subset \mathbb{F}^n$08, and under analogous Weil-properness heuristics the hull of its trace-subcode yields the Weil restriction of $C \subset \mathbb{F}^n$09 (Lemoine, 15 May 2025). The tangent-space step again recovers the field-automorphism matrix, after which one obtains an $C \subset \mathbb{F}^n$10-generator of the underlying AG code, from which length-$C \subset \mathbb{F}^n$11 decoding follows by known AG-decoding algorithms (Lemoine, 15 May 2025).

For classical Goppa codes, the situation is mixed. Binary Goppa codes $C \subset \mathbb{F}^n$12 of degree $C \subset \mathbb{F}^n$13 often satisfy the FGOPT bound when $C \subset \mathbb{F}^n$14, so one again has Weil-properness, and in that subregime the attack recovers the hidden support and Goppa-polynomial roots, up to Frobenius conjugacy, in $C \subset \mathbb{F}^n$15 (Lemoine, 15 May 2025). However, when $C \subset \mathbb{F}^n$16, the quadratic hull of Goppa codes collapses to a trivial $C \subset \mathbb{F}^n$17-dimensional variety because field-equation terms appear, and it no longer exhibits the rich $C \subset \mathbb{F}^n$18-structure needed by the tangent-space method (Lemoine, 15 May 2025). The paper reports that the tangent-space distinguisher then fails empirically, and that the attack does not extend to full Goppa parameters; in particular, binary Goppa codes of practical interest remain, so far, unbroken by this method (Lemoine, 15 May 2025).

A common misconception would be to treat hull attack as a universal break of code-based cryptography. The available result is narrower: it targets high-rate alternant-based McEliece schemes under explicit structural and distinguishability assumptions, extends heuristically to certain AG codes, and only partially affects Goppa codes (Lemoine, 15 May 2025).

7. Research significance and open problems

The significance of hull attack lies in its relocation of code-based cryptanalysis from purely combinatorial or rank-based invariants toward explicit algebraic geometry. The quadratic hull is the intersection of all quadrics through the public column set, but in the vulnerable regimes it also serves as a proxy for the hidden rational normal curve or its Weil restriction (Lemoine, 15 May 2025). This establishes a direct link between the public linear-algebraic representation of a code and the secret algebraic variety defining the private structure.

The paper leaves three open questions. First, whether the hull approach can be refined to cover the remaining high-rate Goppa cases, in particular by exploiting additional higher-degree syzygies or non-quadratic hulls (Lemoine, 15 May 2025). Second, which other code families admit a structured quadratic hull vulnerable to tangent-space attacks (Lemoine, 15 May 2025). Third, to what extent the heuristic square-distinguishability assumption can be replaced by a provable criterion on code parameters (Lemoine, 15 May 2025).

These questions indicate that hull attack is both a concrete cryptanalytic method and a broader research program. A plausible implication is that future attacks may generalize from quadratic hulls to higher-degree defining equations whenever the public code inherits a sufficiently rigid embedded variety from a secret algebraic construction. In that sense, hull attack marks the emergence of tangent-space and stabilizer computations as tools for extracting hidden extension-field structure from public code representations (Lemoine, 15 May 2025).