CryptoRecords.info
Goppa-KR

Goppa-code key recovery

Recover equivalent hidden support and Goppa polynomial from the public code. This is distinct from decoding a single ciphertext.

Classical · conditional concrete estimates

Fix parameter set, source version, solver assumptions and memory-cost model

2 results · 2 papers
ClassicalConditional estimatesSpecified Classic McEliece parameter setsConcrete bit-operation estimates
Results
Compare historyJSONCSV
#PUBLICATION / AUTHORSDATETIME BOUNDSPACE BOUNDEVIDENCE
—Bit Operation Cost of ``Holdout'' Key-Recovery Attacks Against Classic McElieceMarkku-Juhani O. SaarinenePrint 2026/1786SourceBibTeX / details15 Sept 20262126.77–2145.22 conditional bit operations across parameter sets251.33–259.10 bitsPreprintSource checked
—Extending Distinguishing to Key Recovery for Subfield Subcodes of GRS codesKirill VedenevePrint 2026/1747SourceBibTeX / details7 Oct 2026289.9–298.6 conditional bit operations across Classic McEliece sets—PreprintSource checked
1–2 of 2 entriesIncludes relevant non-record results. Dates refer to the specific bound.
Comparison definition & assumptions
Regime
Fix parameter set, source version, solver assumptions and memory-cost model
Computation
Classical
Rigor
Conditional estimates
Instances
Specified Classic McEliece parameter sets
Cost scale
Concrete bit-operation estimates
Parameter
parameter set
Description
Recent structural key-recovery cost claims.
Comparison rules
Entries here are deliberately unranked cost vectors. The 2026 sources impose rank/solver or locator-uniqueness assumptions and charge memory differently. Do not present their arithmetic estimates as unconditional breaks. The August2026 Apon critique targets an earlier Vedenev revision; Vedenev’s October revision disputes its applicability.
Tags
Goppa codes, key recovery, conditional, concrete cost, version sensitive