Tout d'abord, je tiens à remercier l'ensemble des membres du jury pour avoir accordé du temps à mes travaux. Plus particulièrement, je remercie Marc et Alain pour avoir accepté d'en rédiger un rapport ainsi que pour les corrections qu'ils m'ont suggérées. En dehors de leur participation au jury, je les remercie pour leurs nombreux conseils et explications.

Mes prochains remerciements vont à mes deux directeurs de thèse, Philippe et Hugues, qui ont permis à cette thèse de voir le jour. Malgré des moments difficiles, dus à la distance ou encore à la Covid-19, ils ont réussi à garder ces années motivantes pour moi. Je remercie Philippe, qui m'accompagne depuis mes projets de master et qui a suffisamment cru en moi pour poursuivre cette aventure. Je le remercie également pour nos discussions intéressantes et nos parties sur la borne d'arcade. Je remercie Hugues d'avoir accepté de co-encadrer cette thèse et pour ses précieux conseils et idées. J'exprime mes plus chaleureux remerciements à Jade, sans qui cette thèse aurait eu beaucoup moins de saveur. Je la remercie pour nos discussions, tant professionnelles que personnelles. Je ne saurais énumérer tous les moments où nous avons improvisé une visio pour faire de longs calculs (pas toujours intéressant). Je suis persuadé que ses futurs étudiants seront plus que satisfaits de son encadrement.

Je souhaite également remercier tous les membres du projet Barracuda, qui m'ont offert de nombreuses opportunités de partager mon travail. Au même titre, je remercie les habitués du groupe de travail Code-Crypto, qui m'ont permis de rencontrer de nombreuses personnes travaillant sur les mêmes sujets que moi. Cela s'est révélé très bénéfique, surtout en début de thèse.

Je remercie tous les membres de Laboratoire de Mathématiques de Besançon, tant l'équipe de théorie des nombres que le personnel administratif ou encore l'équipe informatique, pour m'avoir offert un cadre de travail accueillant. Ils ont toujours su répondre efficacement à mes demandes et interrogations. Je pense aussi à mes collègues doctorants, avec qui j'ai pu échanger de nombreuses fois lors de séminaires.

Je tiens à remercier tout particulièrement deux doctorants qui ont commencé cette aventure en même temps que moi, Audrey et Charles. Leur présence à mes côtés durant ces trois années a été une réelle motivation pour moi. Avoir l'opportunité de donner mes premiers enseignements ou encore premières présentations en même temps qu'eux était très encourageant et bien moins stressant. Ces années auraient étés moins amusantes sans vous.

Un grand merci à mes amis qui m'ont soutenu et accompagné durant ces trois années (et pas seulement). Ils ont toujours été là, dans les bons moments comme dans les plus difficiles. Bien que de nombreux changements aient eu lieu au cours de ces trois dernières années, nous n'avons jamais perdu contact et j'espère que ce ne sera jamais le cas.

Mes plus profonds remerciements vont à ma famille, en particulier mes parents et mon frère. Ils m'ont toujours apporté leur soutien, si bien moral que financier, pendant mon cursus scolaire, surtout dans les moments les plus difficiles. Ils n'ont jamais perdu confiance en moi, bien qu'ils n'aient sûrement pas la moindre idée de ce que j'ai fait durant ces trois longues années ! Je remercie également Julien, pour ses conseils sur la langue anglaise, ainsi que pour son hospitalité dans des moments creux de la SNCF ! Enfin, merci à Clémence pour sa présence et son soutien, depuis plus d'un an maintenant. Merci d'être là pour m'écouter me plaindre de mes petits problèmes de doctorant.

Introduction Context

From public key to post-quantum cryptography

In the area of cryptography, public key cryptography (or asymmetric cryptography) concerns schemes using a pair of keys: the public key which is known to anyone and the secret key, only known by the recipient of the message. The family of public key encryption schemes was introduced by Diffie and Hellman [START_REF] Diffie | New directions in cryptography[END_REF]. Before this, most of the systems used in cryptography were part of the socalled secret key cryptography (or symmetric cryptography), which uses the same key to encrypt and decrypt the message. In such systems, both parties have to agree on a secure way to share the key, which is no more the case while considering a pair of keys.

The first public key cryptosystem was introduced by Rivest, Shamir and Adleman [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF], and is known as the RSA cryptosystem. It is still widely used for secure data transmission, and its security mainly relies on the hardness of factorizing large integers into primes (in the sense that factorizing efficiently would broke the scheme). Since then, several other schemes have been proposed, whose security rely on other assumptions coming from number theory as well, such as the discrete logarithm problem. However, the recent threat of quantum computers leads to expand the area of cryptography: in fact, these number theoretical problems could be broken in polynomial time on a quantum computer, using Shor's algorithm [START_REF] Shor | Algorithms for quantum computation: discrete logarithms and factoring[END_REF]. Post-quantum cryptography is the domain which regroups new cryptosystems, based on new assumptions that resist to quantum attacks. In this thesis, we are interested in code-based cryptography, which uses error-correcting codes. In this case, the security is based on the problem of decoding a random linear code, for which no quantum algorithm is known yet, reason why it is a good candidate in post-quantum cryptography.

Code-based cryptography

In 1978, McEliece [START_REF] Mceliece | A public-key cryptosystem based on algebraic coding theory[END_REF] introduced the first public key encryption scheme based on linear codes. The main idea is to use a random code from a well-chosen family to generate the pair of keys. As the structure of the code is hidden (the secret key), it is a hard task to decipher a message for anyone who does not know a specific decoding algorithm for the chosen family of codes. The encryption of a plain message is done by using a basis of the code (i.e. a generator matrix), then some errors are introduced at random locations. The generator matrix (which is the public key) needs to be random to keep secret the structure of the code. The secret key is a part of the hidden structure of the code that allows to build an efficient decoding algorithm. The decryption step thus consists in applying the decoding algorithm to remove the errors, recovering a codeword in the public code. The initial message can then be derived from it using the public key.

For an attacker that does not know the secret key of the scheme, there are two solutions to recover the message. First, one could try to decode the cipher text as a noisy codeword of a random code. This problem, called message recovery attack, is related to the so-called generic decoding problem: Problem 1. (Decisional) Generic Decoding Problem: Let C ∈ F n be a linear code over a finite field F, t ≤ n a positive integer and y ∈ F n . Decide whether there exists a codeword c ∈ C whose Hamming distance to y is less than or equal to t. This problem is supposed to be difficult in average, and was proven to be NP-complete in [START_REF] Berlekamp | On the inherent intractability of certain coding problems[END_REF]. The second method consists in recovering the secret key from the public data. From this, it is possible to build a decoding algorithm that can decipher any message. In the literature, any such attack is usually called key recovery attack.

Improving the original proposal

In its initial proposal, McEliece [START_REF] Mceliece | A public-key cryptosystem based on algebraic coding theory[END_REF] proposed to use classical binary Goppa codes, which is a subfamily of alternant codes. Up to now, all known attacks against it have exponential complexity in the parameters, hence the scheme is still considered secure. Adding to the fact that encryption and decryption are very fast, the McEliece's cryptosystem is at the center of modern cryptography, and one of the last code-based candidates for standardization of post-quantum cryptographic schemes to the NIST competition since the third round. However, it suffers a major drawback: the key sizes are too huge to be efficient. For more than forty years, several directions have been investigated to mitigate this problem. Among them, we distinguish two different angles: either replacing the family of classical Goppa codes with another one or using more structured codes (i.e. equipped with the action of some automorphism group), with the hope to keep the same advantages.

In 1986, Niederreiter [START_REF] Niederreiter | Knapsack-type cryptosystems and algebraic coding theory[END_REF] suggested to use Generalized Reed-Solomon codes (GRS), but they are proved to be weak because of the structural attack of Sidelnikov and Shestakov [START_REF] Michilovich | On the insecurity of cryptosystem based on generalized Reed-Solomon codes[END_REF]. As any GRS code can be seen as an algebraic geometry (AG) code on P 1 , Janwa and Moreno [START_REF] Janwa | McEliece public key cryptosystems using algebraicgeometric codes[END_REF] then proposed to use AG codes from curves of arbitrary genus. More precisely, their paper includes three proposals: one based on AG codes, one on concatenated AG codes and a last one using subfield subcodes of AG codes (SSAG in short). For the version with concatenated codes, Sendrier found an effective attack in [START_REF] Sendrier | On the structure of a randomly permuted concatened code[END_REF]. For AG codes on curves with genus ≤ 2, an attack was found by Faure and Minder in [START_REF] Faure | Cryptanalysis of the McEliece cryptosystem over hyperelliptic curves[END_REF][START_REF] Minder | Cryptography based on error correcting codes[END_REF][START_REF] Faure | Etudes de systèmes cryptographiques construits à l'aide de codes correcteurs[END_REF]. Finally, the scheme based on AG codes has been completely broken by Couvreur, Márquez-Corbella and Pellikaan [START_REF] Couvreur | Cryptanalysis of mceliece cryptosystem based on algebraic geometry codes and their subcodes[END_REF], who proposed a filtration-based attack on AG codes for any genus, enabling decoding just by handling the public key and without knowledge on the geometric structure of the code. However, the authors underlined that subfield subcode of AG codes are resistant to this filtration attack. For this reason, we are led to consider the last proposition, that is schemes using SSAG codes, for which no efficient attack is known yet.

The other direction consists in using quasi-cyclic (QC) or quasi-dyadic (QD) codes. This additional structure allows to describe a given generator matrix with only a few rows, hence reducing key sizes. The case of QC codes has been proposed in [START_REF] Gaborit | Shorter keys for code based cryptography[END_REF], where quasi-cyclic subcodes of BCH codes are suggested. Unfortunately, this family cannot be used as it does not have enough possible keys. This first paper was followed by many others, which proposed to use alternant or classical Goppa codes with different automorphism group like QC alternant codes [START_REF] Thierry | Reducing key length of the McEliece cryptosystem[END_REF] and QD Goppa codes [START_REF] Misoczki | Compact McEliece keys from Goppa codes. Selected Areas in Cryptography[END_REF][START_REF] Paulo | Monoidic codes in cryptography[END_REF]. Notice that all these codes can be seen as subfield subcodes of AG codes on the projective line. However, since 2010, a new version of key recovery attack appeared, referred to as algebraic attack. This method consists in recovering the secret structure of an alternant code by solving a system of polynomial equations. In the generic case of alternant codes, this technique does not have polynomial complexity and cannot be used to recover the hidden structure in practice. However, in the case of QC alternant codes, the corresponding system of equations can be simplified, which leads to an attack. In particular, the authors in [FOP + 16] showed that the security of such schemes reduces to the security of a smaller code, the folded code, which ican be computed from the public data. This strategy was improved in [START_REF] Barelli | On the security of some compact keys for McEliece scheme[END_REF], where it is proven that the initial key recovery problem on the original QC alternant code can be reduced to a smaller code that can be derived from the public one: the invariant code. In this last paper, Barelli improves the approach of [FOP + 16] and consider the case of automorphisms arising from a non-affine homography. In her thesis [START_REF] Barelli | On the security of short McEliece keys from algebraic and algebraic geometry codes with automorphisms[END_REF], she also initiated the study of QC SSAG codes from a Kummer cover of P 1 , showing that it has the same security as the scheme using alternant or Goppa codes.

Proximity tests to linear codes

Since their introduction in [START_REF] Lund | Algebraic methods for interactive proof systems[END_REF], arithmetization techniques for constructing short proof systems have been fruitfully applied to probabilistically checkable proofs (PCPs [BFLS91, AS92, ALM + 98]). Roughly speaking, in a probabilistic proof system for a binary relation R, the arithmetization process transforms any instance-witness pair (x, w) into a word that belongs to some error-correcting code C if (x, w) ∈ R, or is very far from C otherwise. Since the work of Kilian [Kil92] and Micali [START_REF] Micali | Computationally-sound proofs[END_REF], a lot of efforts have been put into making PCPs efficient enough to obtain practical sublinear noninteractive arguments for delegating computation. In search of reducing the work required to generate proofs, Interactive Oracle Proofs (IOPs, [START_REF] Ben-Sasson | Interactive Oracle Proofs[END_REF]) have been introduced as a common generalization of PCPs and Interactive Proofs (IPs). At some point, aforementioned sublinear arguments require a proximity test to a Reed-Solomon code. As a solution, one can use an IOP of Proximity (IOPPs, [BCG + 17]) for RS codes. An IOPP for an error-correcting code consists in an interaction between a prover and a verifier, in which the prover seeks to convince that some word, given as oracle input to the verifier, is indeed a codeword. In this case, the verifier accepts the proof; otherwise he rejects it with high probability.

The Fast Reed-Solomon Interactive Oracle Proof of Proximity (FRI) protocol, introduced in [START_REF] Ben-Sasson | Fast Reed-Solomon interactive oracle proofs of proximity[END_REF] and improved in [BKS18, BGKS20, BCI + 20], is an IOPP for testing proximity to a RS code. As for its properties, it admits linear prover time, logarithmic verifier time and logarithmic query complexity. Being highly efficient, it is a crucial tool in systems deployed in the real life. The main drawback of considering RS codes for IOPP is that they must have an alphabet size larger than their length, meaning that practical IOP-based succinct arguments are designed over large fields. Moreover, the protocol FRI requires the set of evaluation points to have a specific structure: concretely, the evaluation set must be invariant under the action of a large group of order a power of two.

Considering AG codes instead of RS codes is not only natural, but could also weaken these limitations. In 2020, Bordage and Nardi [START_REF] Bordage | Interactive oracle proofs of proximity to algebraic geometry codes[END_REF] gave a clear criterion for constructing AG codebased IOPPs with linear proof length and sublinear query complexity, as well as a concrete instance for codes defined on Kummer type curves.

Contributions Analysis of the McEliece scheme using quasi-cyclic SSAG codes

This contribution is a joint work with my supervisors and Elise Barelli, which has not been published yet.

In Chapter 3, we study the security of the secret key of McEliece schemes based on structured SSAG codes with a non-trivial permutation group, i.e. codes endowed with a group action arising from the underlying geometry of the curve from which the code is defined. We improve the technique initiated by Barelli in the Chapter 5 of her thesis [START_REF] Barelli | On the security of short McEliece keys from algebraic and algebraic geometry codes with automorphisms[END_REF], in which she shows that the security of the scheme reduces to the security of the invariant code. More precisely, she proposed a security reduction for quasi-cyclic SSAG codes constructed on Kummer-type curves, whose invariant subcode turns out to be an alternant code, i.e. a subfield subcode of an AG code on P 1 . To do so, she makes use of the fact that the quotient curve has a trivial divisor class group to recover the secret structure of the public code from the knowledge of the invariant one. Since the support and multiplier of alternant codes are weak to algebraic attacks [START_REF] Faugere | Algebraic cryptanalysis of McEliece variants with compact keys[END_REF], there is no advantage to consider structured SSAG codes whose invariant subcode is defined over P 1 in McEliece's like cryptosystems, compared with the case of classical Goppa codes. In this thesis, we improve this method, which can consequently be applied to a more general framework.

The invariant code. Consider the following setting: given a Galois cover π : Y → X of smooth and irreducible projective curves over F q m , we consider an SSAG code C := SSAG q (Y, Q, G), invariant under the action of some permutation σ induced by an automorphism of Y, as public code in a McEliece scheme. If we denote by X := Y/⟨σ⟩ the corresponding quotient curve, it turns out (as it was already noticed in [Bar18a, Corollary 5.3]) that the invariant code C σ of C is also an SSAG code, defined over the quotient curve X . More precisely, C σ = SSAG q X , P, G , for some support P ∈ X (F q m ) and divisor G ∈ Div(X ), which are explicitly described in terms of Q, G and the ramification in the cover Y → X . To obtain an effective security reduction, we make the following assumptions on the quotient curve X :

• X has a unique point at infinity P ∞ , which totally ramifies in Y → X ;

• X admits a canonical divisor which is equivalent to (2g(X ) -2)P ∞ .

Clearly, these hypotheses are satisfied by the projective line, thus in the case treated in [Bar18a, Chapter 5]. Our assumptions might sound restrictive, but there is actually a fairly large class of curves satisfying both of them, namely the class of C a,b curves (introduced in [START_REF] Miura | Algebraic geometric codes on certain place curves[END_REF]).

Security reduction. The geometric structure of the invariant code can be exploited to recover the secret elements of the public code. Roughly speaking, under some technical assumptions, the knowledge of the triple (X , P, G) can be used to find (Y, Q, G). Following the idea of [Bar18a, Chapter 5], the crucial step is to find a defining equation of the initial curve Y. If the cover Y → X corresponds to an extension L/K of algebraic function fields, this can be done by finding the minimal polynomial of some element y ∈ L such that L = K(y). More precisely, the idea is to build a linear system whose solution, ideally unique, is the evaluation vector y := (y(Q)) Q∈Q . Once y it is found, we know all the data of the secret support Q, which can then be used to recover the desired equation of Y using an appropriate interpolation method. The secret divisor G is then recovered by taking the pullback of the invariant one, i.e G = π * G. In our setting, the quotient curve might have positive genus, hence there is no reason for its divisor class group to be trivial. Consequently, we cannot hope to describe Riemann-Roch spaces on Y in terms of invariant data (as done by Barelli in her prior work). Thankfully, we show that this is not mandatory to build our linear system, as it is enough to consider a sufficiently large and explicit divisor D ∈ Div(X ) such that

π * L X (D) • y ∈ L Y (G ⊥ ),
where G ⊥ ∈ Div(Y) is the divisor associated to the dual code of the public SSAG.

Concrete instances.

As illustrative examples, we consider the frameworks where Y → X is a Kummer cover or an elementary abelian p-cover (in Sections 3.3.2 and 3.3.3 respectively).

The first case corresponds to curves Y with equation of the form y ℓ = f , where f is a rational function that lies in the quotient curve and ℓ is an integer prime to the characteristic and such that ℓ | q m -1. Therefore, the action of the automorphism σ acting on the public SSAG code is uniquely determined by the choice of a primitive ℓ-th root of unity ξ, i.e. σ(y) = ξ • y.

Consequently, the evaluation vector y satisfies a geometric progression on each orbit or size ℓ. Taking this into account to add more equations to our system, it is reasonable to find a unique solution.

In the second case, the curve Y has a defining equation of the form y p u -y = f , where f ∈ F q m (X ), u ≥ 1 and p := char(F q m ). Assuming that F p u ⊆ F q m , the automorphism σ is here characterized by the choice of some element β ∈ F p u , i.e σ(y) = y + β. This time, this action is traduced in terms of arithmetic progression in the vector y.

In both cases, under some technical assumptions on the function f , all our computations realized on Magma end up with a unique solution to our linear systems, which is the desired vector y.

Behaviour of the square of the dual of Goppa-like AG codes

This work is the result of a collaboration with Jade Nardi and Sabira El Khalfaoui. A preprint is available on arxiv [START_REF] Khalfaoui | Goppa-like ag codes from c a,b curves and their behaviour under squaring their dual[END_REF].

Since classical Goppa codes remain good candidates for post-quantum code-based cryptography, it is interesting to study specific AG codes on any genus curves, whose algebraic structure mimic theirs. Several attempts have been proposed in that direction, starting with Janwa and Moreno [START_REF] Janwa | McEliece public key cryptosystems using algebraicgeometric codes[END_REF], who introduced Goppa codes on smooth and irreducible projective curves. Later on, Couvreur [START_REF] Couvreur | Codes and the Cartier operator[END_REF] defined Cartier codes as specific subcode of SSAG codes. In Chapter 4 of this thesis, we introduce the family of Goppa-like AG codes and study the behaviour of the square of their dual, hence generalizing the distinguisher found in [START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF] in the case of alternant and classical Goppa codes.

Goppa-like AG codes. Let D be an effective divisor on a curve X over F q m . Take a rational function g / ∈ L(D) and a set of evaluation points P ∈ X (F q m ) such that P ∩ Supp(D) = ∅ and P ∩ Supp((g)) = ∅. We define the Goppa-like AG code associated to the AG code C = C L (X , P, D +(g)) as the subfield subcode of its dual, i.e.

Γ(P, D, g)

:= C ⊥ | Fq .
The terminology Goppa-like is justified by the fact that our construction coincides with classical Goppa codes while considering codes over P 1 , in which case the rational function g plays the role of the Goppa polynomial. Compared with the family of Goppa codes introduced in [START_REF] Janwa | McEliece public key cryptosystems using algebraicgeometric codes[END_REF], the addition of the function g defines a multiplicator for the AG code which is algebraically related to the evaluation set. Moreover, it facilitates the use of SSAG codes as public keys for McEliece cryptosystems: in fact, given an error correcting capability t, we can fix a divisor D ∈ Div(X ) such that deg(D) ≥ 2t + 2g(X ) + 1. Then, we obtain a family of codes in which public keys can be picked by running a set of functions g outside L(D). Our codes can also be compared with Cartier codes [START_REF] Couvreur | Codes and the Cartier operator[END_REF] in the following way: given the same support P and divisor D + (g), the Cartier code Car q (P, D + (g)) is a subfield subcode of Γ(P, D, g). Moreover, we also provide a sufficient condition in terms of degree of the divisor for the two constructions to be equal.

Distinguisher attack in Goppa-like case. In [START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF], the authors benefited from the trace structure of the dual of a subfield subcode to display a distinguisher for alternants and classical Goppa codes. Roughly speaking, a distinguisher for a linear code consists in distinguishing a generator matrix of the code from a random matrix. In the case of [START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF], it is obtained by using the wellknown behaviour of GRS codes with respect to the Schur product. In fact, the dimension of the square of an r-dimensional GRS code is smaller than expected from a random code, i.e. dim F q m GRS r (x, y) = 2r -1, when r < n 2 .

instead of the expected quadratic upper bound r+1 2 . As generalization of GRS codes, it is natural to observe that AG codes behave similarly under the square operation, the only difference being a non-trivial contribution due to the genus of the curve. Combining this specific structure with results on the product of Riemann-Roch spaces, we obtain the following bound on the dimension of the square of the dual of Goppa-like AG codes: Proposition 4.9. With above notation, assume s := deg(D) ≥ g(X ), and set k := dim F q m C and e := min m 2 , log q k 2 s .

Then dim Fq (Γ(P, D, g) ⊥ ) ⋆2 ≤ mk + 1 2 -m 2 k(k -1)(2e + 1) -2s q e+1 -1 q -1 .

Weighted Euclidean division and one-point Goppa-like codes from C a,b curves. In the case of Goppa-like AG codes on C a,b curves associated with the one-point divisor D := sP ∞ (where P ∞ is the unique point at infinity), we can improve the bound given in Proposition 4.10. In fact, such codes can be seen as the evaluation of bivariate polynomials, coming from the specific structure of the Riemann-Roch space L(sP ∞ ), i.e.

L(sP ∞ ) = Span x i y j | 0 ≤ i, 0 ≤ j ≤ a -1 and ai + bj ≤ s .

By defining a weighted degree on bivariate polynomials belonging to the ring S = ∪ s≥0 L(sP ∞ ), we then manage to perform division algorithms via Gröbner basis. As expected in the univariate case, the remainder has a weighted degree generally smaller than the divisor's. Under some additional conditions on the divisor D = sP ∞ + (g), we then prove Theorem 4.22. Let s ′ > s and take a rational function g ∈ L(s ′ P ∞ ) with deg a,b (g) = s ′ . Suppose that s ≥ (s ′ -s)q + 2g a,b -1 and set k := dim F q m C L (X , P, sP ∞ + (g)) and e * := min m 2 , log q k 2 s ′ (q -1) 2 + 1 .

Then dim Fq (Γ(P, sP ∞ , g) ⊥ ) ⋆2 ≤ mk + 1 2 -m 2 (k 2 (2e * + 1) + k -2s ′ (q e * -q e * -1 + 1)).

Efficiency of the distinguisher. Our results generalize the ones of [START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF] in the sense that our bounds coincide with theirs in the genus zero case. Consequently (and without much a surprise), we are also only able to distinguish high rate Goppa-like AG codes. As for efficiency, several computations realized on Magma tend to show that the bound given in Theorem 4.24 is sharp whenever the code seems random. More precisely, it is likely to be the case whenever the function g has simple zeroes. Compared with the case of classical Goppa codes, the Goppa polynomial is usually assumed to be square-free, which is the reason why the bound for classical Goppa codes given in [START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF] is sharp. However, as already noticed by Mora and Tillich, it seems complicated to turn this distinguisher into an efficient structural attack.

Two examples: Elliptic and Hermitian codes. In Section 4.4, we analyze our distinguisher both in the case of codes from an elliptic curve and the Hermitian curve (which belong to the family of C a,b curves). The first case being close to classical Goppa codes (i.e. the genus of such curves is one), our maximal distinguishable rates are roughly the same. Considering Hermitian codes, we show that the high genus imposed by the choice of the curve makes the distinguisher ineffective. In fact, the upper bound on the dimension given in Theorem 4.24 is always bigger than the maximal possible length of the code. Adding the fact that such codes can be encoded efficiently [START_REF] Beelen | Fast decoding of AG codes over C a,b curves[END_REF], it is encouraging to consider the family of one-point Goppa-like AG codes from the Hermitian curve as public keys in a McEliece cryptosystem. Some computations to compare this family of codes with classical Goppa codes can be found at the end of Chapter 4.

IOP of Proximity to AG codes along the Hermitian tower

This contribution is the result of a collaboration with Sarah Bordage, Jade Nardi and Hugues Randriambololona [START_REF] Bordage | Interactive oracle proofs of proximity to algebraic geometry codes[END_REF].

In [START_REF] Bordage | Interactive oracle proofs of proximity to algebraic geometry codes[END_REF], Bordage and Nardi proposed to replace Reed-Solomon codes with AG codes while testing proximity to linear codes in IOP of Proximity. The initial idea was to remove the limitations imposed by RS codes by considering more structured codes. Hence, they provide a generic criterion for constructing AG code-based IOPP, by defining in a general framework sequences of AG codes compatible with proximity testing, which are called foldable codes. In the Chapter 5 of this thesis, we give an explicit family of foldable AG codes defined on the Hermitian tower, and study the properties of the IOPP derived from it.

Foldable AG codes. Let X be a curve defined over some finite field F, equipped with a finite solvable group G ⊆ Aut(X ). By solvability of G, there exists a sequence of normal subgroups

{Id} := G 0 ▷ G 1 ▷ • • • ▷ G r := G such that each quotient Γ i := G i /G i-1 is cyclic. We thus obtain a sequence of curves X := X r → X r-1 → • • • → X 0 := X /G,
such that each X i-1 arises as the quotient of X i by Γ i . A proximity text to some AG code C := C L (X , P, G) consists in deciding whether some function f : P → F belongs to C or not. To do so, we construct a sequence of AG codes (C i ) r i=0 with decreasing length such that C i = C L (X i , P i , G i ) is defined over X i and C r := C. Be choosing carefully the structure of each code, the first proximity test can be turned into a membership test of a function f ′ : P 0 → F in the smallest code C 0 . Roughly speaking, P is chosen globally G-invariant and each P i-1 is obtained as the projection of P i to the quotient curve X i-1 . The tricky part is to define a suitable sequence of divisors (G i ) r i=0 such that each Riemann-Roch space L Xi (G i ) can be explicitly described in terms of Riemann-Roch spaces in the quotient curve X i-1 . Such conditions are examined in Section 5.1.2 while defining compatible divisors. If we manage to construct such a sequence of codes, the initial code C is said to be foldable.

The case of the Hermitian tower. Consider the infinite tower of function fields (F i ) i≥0 over F q 2 such that F 0 = F q 2 (x 0 ) and F i = F i-1 (x i ), recursively defined by

x q i + x i = x q+1 i-1 , for all i ≥ 1.
It corresponds to an infinite sequence of curves

• • • → X i → X i-1 → • • • → X 0 = P 1 ,
called the Hermitian tower. Contrary to the case of Kummer foldable codes (see. [START_REF] Bordage | Interactive oracle proofs of proximity to algebraic geometry codes[END_REF]), we have no hope to use Maharaj's theorem [Mah04, Theorem 2.2] to obtain a suitable decomposition of Riemann-Roch spaces, as it requires the order of the automorphism group to be prime with the characteristic of the field, which is obviously not the case in our setting. To overcome this difficulty, we can consider one-point divisors, supported by the unique point at infinity

P (i)
∞ ∈ X i (F q 2 ). Doing so, we can obtain a desired decomposition by hand, using the fact that the basis of L Xi (mP

(i) ∞ ) is well-known, i.e. L Xi (mP (i) ∞ ) = Span   x a0 0 • • • x ai i | 0 ≤ a 0 , 0 ≤ a j ≤ q -1 and i j=0 a j q i-j (q + 1) j ≤ m   .
Due to the Weierstrass gap theory, we also need to increase the degree of our divisors at each step (with respect to the sequence of genera in the tower), in order to guarantee the existence of balancing functions (which are needed to prove the soundness of our IOPP). At the end, we propose the following sequence of foldable AG codes:

C i := C L (X i , P i , d i P (i) ∞ ), for i ≥ 1; (1)
where

P i ⊆ X i (F q 2 )\ P (i) ∞
is a set of length at most q i+2 , and the integers d i 's are recursively defined by d i-1 = ⌊ di q ⌋ + 2g(X i-1 ).

AG-IOPP system with foldable Hermitian codes. In Section 5.4, we define an IOPP to test proximity of some function f (imax) :

P imax → F q 2 to the AG code C L (X imax , P imax , d imax P (imax) ∞
). It corresponds to a i max -round interactive proof in which the initial proximity test is reduced to a proximity test of some function f (0) , defined as a fold of f (imax) , to the smallest AG code defined on X 0 . Its main properties are summarized in the following informal theorem:

Theorem (Informal, see [START_REF] Bordage | Interactive oracle proofs of proximity to algebraic geometry codes[END_REF]Theorem 45]). Let C imax be an AG code as in Equation (1), with length n at most equal to q imax+2 . Then the IOPP system described in Section 5.4.1 has perfect completeness, small soundness error for every proximity parameter δ, and the following properties:

rounds complexity r(n) < log(n) proof length ℓ(n) < n query complexity q(n) ≤ tq log(n) + 1 prover complexity t p (n) = O n • M F q 2 (q) log(q) verifier complexity t v (n) = O log(n) • M F q 2 (q) log(q) ,
where M F q 2 (d) denotes the cost of multiplying two degree-d univariate polynomials over F q 2 .

Résumé Contexte De cryptographie à clé publique à cryptographie post-quantique

Dans le domaine de la cryptographie, la cryptographie à clé publique (ou cryptographie asymétrique) regroupe les schémas utilisant une paire de clés : la clé publique connue de tous et la clé secrète, seulement connue du destinataire des messages chiffrés. La famille de schémas de chiffrement à clé publique a été présentée pour la première fois par Diffie et Hellman [START_REF] Diffie | New directions in cryptography[END_REF]. Avant cela, la plupart des schémas cryptographiques provenaient de la cryptographie à clé secrète (ou cryptographie symétrique), qui utilise la même clé pour chiffrer et déchiffrer le message. Dans de tels systèmes, les deux participants doivent au préalable se mettre d'accord sur un moyen sûr et efficace d'échanger la clé, ce qui n'est plus nécessaire en cryptographie à clé publique.

Le premier schéma en cryptographie asymétrique fût proposé par Rivest, Shamir et Adelman [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF] : c'est le schéma de chiffrement RSA. Il est encore aujourd'hui largement utilisé pour la transmission de données sécurisées, et sa sécurité est principalement fondée sur la difficulté de factoriser de grands entiers en produit de nombres premiers (dans le sens où une factorisation efficace casserait le schéma). Depuis, plusieurs autres schémas ont été proposés, dont la sécurité repose sur d'autres problèmes issus de la théorie des nombres, comme le problème du logarithme discret. Cependant, la menace grandissante des ordinateurs quantiques impose une diversification de la cryptographie : en effet, ces problèmes de théorie des nombres pourraient être cassés en temps polynomial sur un ordinateur quantique à l'aide de l'algorithme de Shor [START_REF] Shor | Algorithms for quantum computation: discrete logarithms and factoring[END_REF]. La cryptographie post-quantique est le domaine qui regroupe les nouveaux systèmes de chiffrement, dont la sécurité s'appuie sur de nouvelles hypothèses, différentes de celles issues de théories des nombres, et qui résistent aux algorithmes quantiques. Dans cette thèse, on s'intéresse à la cryptographie à base de codes, qui utilise des codes correcteurs d'erreurs. Dans ce cas, la principale hypothèse de sécurité est le problème du décodage d'un code linéaire aléatoire, pour lequel aucun algorithme quantique n'est connu à ce jour. Pour cette raison, la cryptographie à base de codes est un bon candidat en cryptographie post-quantique.

Cryptographie à base de codes correcteurs d'erreurs

En 1978, McEliece propose le premier système de chiffrement à clé publique à base de codes linéaires. L'idée principale est d'utiliser un code aléatoire issu d'une famille bien choisie pour générer la paire de clés. La structure du code étant cachée (c'est la clé secrète), il est difficile de déchiffrer un message pour quiconque ne connaît pas un algorithme de décodage efficace pour la famille de codes choisie. Le chiffrement d'un message est réalisé en utilisant une base du code (c.-à-d. une matrice génératrice), et des erreurs sont ajoutées à des positions aléatoires. Pour garder secrète la structure du code, la matrice génératrice doit sembler aléatoire : c'est la clé publique. La clé secrète est un algorithme de décodage efficace, qui peut être obtenu à partir de la structure secrète du code. L'étape de déchiffrement consiste à récupérer d'abord un mot de code en appliquant l'algorithme de décodage au message crypté pour retirer les erreurs. Le message initial peut ensuite être retrouvé à partir du mot de code à partir de la clé publique.

Pour un attaquant qui ne connaît pas la clé secrète du schéma, il existe deux solutions pour retrouver le message. D'abord, il peut tenter de déchiffrer le message crypté en tant que mot bruité dans un code linéaire aléatoire. Ce problème, appelé attaque sur le message, est lié au problème de décodage.

Problème 1 (Problème de décodage (version Décisionnel)). Soit C ∈ F n un code linéaire sur un corps fini F, t ≤ n un entier positif et y ∈ F n . Décider s'il existe un mot de code c ∈ C dont la distance de Hamming à y est inférieure ou égal à t.

Ce problème est connu pour être difficile en moyenne, et a été prouvé NP-complet dans [START_REF] Berlekamp | On the inherent intractability of certain coding problems[END_REF]. La seconde méthode concerne la récupération de la clé secrète à partir de la seule clé publique. Ceci fait, il est possible de construire un algorithme de décodage qui peut déchiffrer n'importe quel message. Dans la littérature, ce type d'attaque est appelé attaque sur la clé.

Améliorer la proposition initiale

Dans son schéma de 1978, McEliece [McE78] propose d'utiliser la famille de code de Goppa binaires classiques, qui est une sous-famille des codes alternants. Jusqu'à aujourd'hui, toutes les attaques contre ce schéma ont une complexité exponentielle en les paramètres du code publique, donc le cryptosystème est encore considéré sécurisé. Additionné au fait que le chiffrement et le déchiffrement sont très rapides, le cryptosystème de McEliece est au centre de la cryptographie moderne, et l'un des derniers candidats à base de codes correcteurs pour la compétition lancée par le NIST en vue d'une standardisation de la cryptographie post-quantique. Cependant, il possède un défaut majeur : les tailles de clés sont trop grosses pour que le schéma soit efficace. Depuis plus de quarante ans, des recherches ont été menées dans différentes directions pour essayer de corriger ce problème. Parmi elles, on distingue deux tendances : remplacer la famille de codes de Goppa classiques par une autre famille et utiliser des codes plus structurés, avec l'espoir de garder les mêmes avantages.

En 1986, Niederreiter [START_REF] Niederreiter | Knapsack-type cryptosystems and algebraic coding theory[END_REF] suggéra d'utiliser les codes de Reed-Solomon généralisés (GRS), mais ils sont la cible d'une attaque structurelle par Sidelnikov et Shestakov [START_REF] Michilovich | On the insecurity of cryptosystem based on generalized Reed-Solomon codes[END_REF]. Comme tout code GRS peut être vu comme un code de géométrie algébrique (AG) sur P 1 , Janwa et Moreno [START_REF] Janwa | McEliece public key cryptosystems using algebraicgeometric codes[END_REF] ont proposé d'utiliser les codes AG construits sur des courbes de genre quelconque. Plus précisément, leur papier contient trois propositions : une sur les codes AG, une sur les codes AG concaténés et une dernière utilisant des sous-codes sur un sous-corps de codes AG (appelés plus simplement des codes SSAG). Pour la version avec les codes concaténés, Sendrier a trouvé une attaque efficace dans [START_REF] Sendrier | On the structure of a randomly permuted concatened code[END_REF]. Les codes AG sur des courbes de genre ≤ 2 sont la cible d'une attaque de Faure et Minder [START_REF] Faure | Cryptanalysis of the McEliece cryptosystem over hyperelliptic curves[END_REF][START_REF] Minder | Cryptography based on error correcting codes[END_REF][START_REF] Faure | Etudes de systèmes cryptographiques construits à l'aide de codes correcteurs[END_REF]. Plus tard, Couvreur, Márquez-Corbella et Pellikaan [START_REF] Couvreur | Cryptanalysis of mceliece cryptosystem based on algebraic geometry codes and their subcodes[END_REF] ont complètement cassé le schéma à partir de codes AG, en proposant une attaque par filtration qui, en genre quelconque, permet de décoder un message avec la seule connaissance de la clé publique. Cependant, les auteurs ont souligné le fait que les sous-codes sur un sous-corps de codes AG sont résistants à cette attaque par filtration. Pour cette raison, nous sommes amenés à considérer la dernière proposition, c'est-à-dire les schémas utilisant les codes SSAG, pour lesquels aucune attaque efficace n'est connue pour le moment.

L'autre piste consiste à utiliser des codes quasi cycliques (QC) ou quasi dyadiques (QD). Cette structure additionnelle permet de décrire les matrices génératrices avec seulement quelques lignes, réduisant ainsi la tailles des clés. Le cas des codes quasi cycliques a d'abord été proposé dans [START_REF] Gaborit | Shorter keys for code based cryptography[END_REF], ou des sous-codes de codes BCH sont suggérés. Malheureusement, cette famille de codes n'est pas satisfaisante, car elle possède trop peu de clés possibles. Cet article a été suivi par de nombreux autres, qui proposent d'utiliser les codes alternants ou de Goppa classiques avec différents groupes d'automorphismes, comme les codes alternants quasi cycliques [START_REF] Thierry | Reducing key length of the McEliece cryptosystem[END_REF] ou encore les codes de Goppa quasi dyadiques [START_REF] Misoczki | Compact McEliece keys from Goppa codes. Selected Areas in Cryptography[END_REF][START_REF] Paulo | Monoidic codes in cryptography[END_REF]. On remarque au passage que tous ces codes peuvent être vu comme des sous-codes sur un sous-corps de codes AG définis sur la droite projective. Cependant, depuis 2010, une nouvelle version d'attaque sur la clé est apparue, appelée attaque algébrique. Cette méthode consiste à retrouver la structure secrète d'un code alternant en résolvant un système d'équations polynomiales. Dans le cas général des codes alternants, cette technique n'a pas une complexité polynomiale et ne peut donc pas être utilisée pour retrouver la structure cachée en pratique. Cependant, dans le cas de codes alternants quasi-cycliques, le système d'équations correspond peut être simplifié, ce qui donne une attaque. En particulier, les auteurs de [FOP + 16] ont montré que la sécurité de ces schémas de chiffrement se réduit à la sécurité d'un code plus petit, le code replié, qui peut facilement être obtenu à partir des données publiques. Cette stratégie a été améliorée dans [START_REF] Barelli | On the security of some compact keys for McEliece scheme[END_REF], ou il est montré que le problème de récupération de clé initial associé à un code alternant quasi cyclique peut se réduire au même problème sur un code plus petit que l'on peut déduire du code public : le code invariant. Dans ce dernier papier, Barelli améliore l'approche de [FOP + 16] et considère le cas d'automorphismes provenant d'une homographie non affine. De plus, dans sa thèse [START_REF] Barelli | On the security of short McEliece keys from algebraic and algebraic geometry codes with automorphisms[END_REF], elle étudie la sécurité du schéma de McEliece utilisant des codes SSAG quasi cycliques construit sur un revêtement de Kummer de P 1 , montrant ainsi que ce cryptosystème possède la même sécurité que celui utilisant des codes de Goppa ou alternants.

Test de proximité à des codes linéaires

Introduit dans [START_REF] Lund | Algebraic methods for interactive proof systems[END_REF], les techniques d'arithmétisation pour construire des systèmes de preuves courtes ont depuis été appliquées aux preuves vérifiables probabilistiquement (PCPs [BFLS91, AS92, ALM + 98]). Sans entrer dans les détails, dans un système de preuve probabiliste pour une relation binaire R donnée, le processus d'arithmétisation transforme un couple exemple-témoin (x, w) en un mot qui appartient à un certain code correcteur d'erreurs C si (x, w) ∈ R, ou est très loin de C sinon. Depuis les travaux de Kilian [Kil92] et Micali [START_REF] Micali | Computationally-sound proofs[END_REF], beaucoup d'efforts ont étés déployés pour rendre les systèmes PCPs suffisamment efficaces pour obtenir des arguments non interactifs sous-linéaires pour déléguer les calculs. Dans l'optique de réduire les efforts requis pour générer des preuves, la notion de Preuves par Oracle Interactif (IOPs [START_REF] Ben-Sasson | Interactive Oracle Proofs[END_REF]) est créée comme une généralisation commune des protocoles PCPs et des Preuves Intéractives (IPs). À un moment, les arguments sous-linéaires mentionnés plus haut nécessitent un test de proximité à un code de Reed-Solomon. Comme solution, on peut utiliser un IOP de Proximité (IOPPs [BCG + 17]) pour les RS codes. Un IOPP pour un code correcteur consiste en une interaction entre un prouveur et un vérifieur, dans laquelle le prouver cherche à convaincre qu'un mot, donné en entrée au vérifieur, appartient bien au code. Dans ce cas, le vérifieur accepte la preuve; dans le cas contraire, il la rejette avec grande probabilité.

Le protocole FRI, d'abord proposé dans [START_REF] Ben-Sasson | Fast Reed-Solomon interactive oracle proofs of proximity[END_REF] puis amélioré dans [BKS18, BGKS20, BCI + 20], est un IOPP pour tester la proximité à un code de Reed-Solomon. En ce qui concerne son efficacité, il nécessite un temps linéaire pour le prouver, logarithmique pour le vérifieur et une complexité de requêtes logarithmique également. Étant très efficace, c'est un outil important déployé dans de nombreux systèmes de nos jours. Le principal point faible de considérer les codes RS pour des tests de proximité est que la taille de l'alphabet doit être plus grosse que la longueur du code. Par conséquent, les IOP concrets à base de codes RS sont construits sur des corps très gros.

De plus, le protocole FRI demande que l'ensemble d'évaluation du RS code correspondant ait une structure spéciale : concrètement, il doit être invariant sous l'action d'un grand groupe d'ordre une puissance de deux.

Le fait de considérer les codes AG au lieu des codes RS est non seulement naturel, mais pourrait aussi nous affranchir de ses restrictions. En 2020, Bordage et Nardi donnent un critère précis pour construire des systèmes IOPP à base de codes AG ayant des preuves en temps linéaire et une complexité de requêtes sous-linéaire. À titre d'exemple, elles proposent également un système concret pour des codes AG construit sur des courbes de Kummer.

Contributions Analyse du schéma de McEliece utilisant des codes SSAG quasi-cycliques

Ces travaux, encore non publiés, sont le fruit d'une collaboration avec Elise Barelli et mes deux directeurs de thèse.

Dans le Chapitre 3, nous étudions la sécurité de la clé secrète du schéma de McEliece à base de codes SSAG structurés avec un groupe de permutation non trivial, c'est-à-dire équipés d'une action de groupe issue de la géométrie de la courbe à partir de laquelle le code est construit. Nous améliorons la technique du Chapitre 5 de la thèse d' Élise Barelli [Bar18a], dans laquelle elle montre que la sécurité de la clé secrète se réduit à celle du code invariant. Plus précisément, elle propose une réduction de sécurité pour les codes SSAG quasi cycliques construits sur des courbes de Kummer, dont le sous-code invariant est un code alternant, c'est-à-dire le sous-code sur un sous-corps d'un code AG sur P 1 . Pour ce faire, elle utilise entre autre le fait que la courbe quotient possède un groupe de classe trivial pour retrouver la structure du code public à partir de celle du code invariant. Comme le support et le multiplicateur d'un code alternant sont fragiles aux attaques algébriques, il n'y a aucun avantage à considérer cette famille de codes plutôt que celle des codes de Goppa classiques. Dans cette thèse, nous améliorons cette technique de sorte qu'elle puisse être appliquée dans un contexte plus général.

Le code invariant. Considérons la situation suivante : étant donné un revêtement Galoisien de courbes projectives lisses et irréductibles π : Y → X sur F q m , on considère le code C = SSAG q (Y, Q, G), invariant sous l'action d'une permutation σ induite par un automorphisme de la courbe Y, comme code public dans un schéma de McEliece. Si X := Y/⟨σ⟩ désigne la courbe quotient, le code invariant C σ de C est aussi un code SSAG (voir [Bar18a, Corollaire 5.3]), définit sur la courbe X . Plus précisément, on a C σ = SSAG q X , P, G , pour un certain support P ⊆ X (F q m ) et diviseur G ∈ Div(X ) qui sont décrits explicitement en termes de Q, G et de la ramification dans le revêtement Y → X . Pour que notre réduction de sécurité fonctionne, il nous faut rajouter deux hypothèses sur la courbe quotient X :

1. X possède un unique point à l'infini P ∞ , qui est totalement ramifié dans Y → X ; 2. Il existe un diviseur canonique sur X qui est équivalent à (2g(X ) -2)P ∞ .

Ces hypothèses sont clairement vérifiées pour la droite projective, c'est-à-dire dans le cas traité dans [Bar18a, Chapitre 5]. Elles pourraient sembler restrictives de premier abord, mais il existe en fait une classe assez grosse et bien connue de courbes qui les vérifie : les courbes C a,b [START_REF] Miura | Algebraic geometric codes on certain place curves[END_REF].

Réduction de sécurité. La structure géométrique du code invariant peut être exploitée pour récupérer les éléments secrets du code public. Globalement, sous certaines hypothèses techniques, le triplet (X , P, G) peut être utilisé pour retrouver (Y, Q, G). En effet, en reprenant l'idée de [Bar18a, Chapitre 5], l'étape clé est de retrouver une équation de la courbe initiale Y. Si le revêtement Y → X correspond à l'extension de corps de fonctions L/K, cela peut être réalisé en trouvant le polynôme minimal d'un élément y ∈ L primitif sur K. plus précisément, l'idée est de construire un système d'équations linéaires dont le vecteur d'évaluation y := (y(Q)) Q∈Q est solution (idéalement unique). Une fois y retrouvé, on peut utiliser le support secret Q désormais connu pour récupérer une équation de Y en utilisant la méthode d'interpolation appropriée. Le diviseur G est quant à lui reconstruit comme le tiré en arrière du diviseur invariant, i.e. G = π * G. Dans notre contexte, la courbe quotient peut avoir un genre strictement positif, donc il n'y a pas de raison que son groupe de classes soit trivial. Par suite, on a peu d'espoir d'être en mesure d'exprimer les espaces de Riemann-Roch sur Y en termes de données connues sur la courbe invariante (comme le faisait Barelli). Fort heureusement, nous montrons que cela n'est pas nécessaire, puisque pour construire notre système d'équation, il nous suffit de considérer un diviseur suffisamment gros et explicite D ∈ Div(X ) tel que

π * L X (D) • y ∈ L Y (G ⊥ ),
où G ⊥ ∈ Div(Y) est le diviseur du code dual du SSAG public.

Exemples concrets. En tant qu'applications, on s'intéresse aux cas ou Y → X est un revêtement du Kummer ou un revêtement élémentaire p-abélien (dans les Sections 3.3.2 et 3.3.3 respectivement).

Le cas des revêtements de Kummer correspond à des courbes dont l'équation est de la forme y ℓ = f , ou f est une fonction rationnelle sur la courbe quotient, et ℓ est un entier positif premier à la caractéristique tel que ℓ | q m -1. Ainsi, l'action de l'automorphisme σ agissant sur le code SSAG public est entièrement déterminée par le choix d'une racine primitive ℓ-ième de l'unité ξ, i.e.

σ(y) = ξ • y.
Par conséquent, le vecteur d'évaluation y recherché vérifie une condition de progression géométrique sur chacune de ses orbites de taille ℓ. En utilisant cette remarque pour rajouter des équations à notre système, il est raisonnable d'espérer obtenir une solution unique.

Dans le cas d'un revêtement p-abélien, la courbe Y est définie par une équation de la forme y p u -y = f , où f ∈ F q m (X ), u ≥ 1 et p est la caractéristique de F q m . En supposant de plus que F p u ⊆ F q m , l'automorphisme σ est dans ce cas caractérisé par le choix d'un élément β ∈ F p u , i.e. σ(y) = y + β.

Cette fois, l'action ci-dessus est traduite en termes de progression arithmétique sur le vecteur d'évaluation y.

Dans les deux cas, sous l'ajout de certaines hypothèses techniques sur la fonction rationnelle f , plusieurs tests réalisés sur Magma semblent indiquer que l'on se retrouve toujours avec une solution unique, qui est le vecteur recherché.

Comportement du carré du dual des codes AG Goppa-like

Cette contribution est le résultat d'une collaboration avec Jade Nardi et Sabira El Khalfaoui. Un préprint est disponible sur arxiv [START_REF] Khalfaoui | Goppa-like ag codes from c a,b curves and their behaviour under squaring their dual[END_REF].

Comme les codes de Goppa classiques restent de bons candidats à la cryptographie post-quantique à base de codes correcteurs, il est intéressant d'étudier des codes AG spécifiques, construit sur des courbes de genre quelconque, dont la structure copie la leur. Plusieurs tentatives ont étés réalisées dans cette direction, à commencer par Janwa et Moreno [START_REF] Janwa | McEliece public key cryptosystems using algebraicgeometric codes[END_REF], qui ont défini des codes de Goppa sur des courbes projectives lisses et irréductibles. Plus tard, Couvreur [START_REF] Couvreur | Codes and the Cartier operator[END_REF] propose l'étude de certains sous-codes de codes SSAG : les codes de Cartier. Dans le Chapitre 4 de cette thèse, nous définissons la famille des codes AG dits Goppa-like, et étudions le comportement du carré de leur dual, généralisant ainsi le distingueur de [START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF] pour les codes alternants et les codes de Goppa classiques.

Codes AG Goppa-like. Soit D un diviseur effectif sur une courbe X définit sur le corps fini F q m . Fixons une fonction g / ∈ L(D) et un ensemble de points d'évaluation P ∈ X (F q m ) tels que P ∩ Supp(D) = ∅ et P ∩ Supp((g)) = ∅. On définit le code Goppa-like associé au code AG C = C L (X , P, D + (g)) comme le sous-code sur F q de son dual, c'est-à-dire

Γ(P, D, g) := C ⊥ | Fq .
La terminologie Goppa-like est justifiée par le fait que notre construction coïncide avec celle des codes de Goppa classiques dans le cas de codes construit sur P 1 , auquel cas le fonction g joue le rôle du polynôme de Goppa. Comparé aux codes de Goppa proposés dans [START_REF] Janwa | McEliece public key cryptosystems using algebraicgeometric codes[END_REF], l'ajout de la fonction g permet de définir un multiplicateur pour le code AG qui est algébriquement lié à l'ensemble d'évaluation. De plus, ce multiplicateur facilite l'utilisation des ces codes dans le contexte d'un schéma de McEliece : en effet, étant donné un taux de correction d'erreurs t, on peut commencer par choisir un diviseur D ∈ Div(X ) tel que deg(D) ≥ 2t + 2g(X ) + 1. On obtient alors une famille de codes dans laquelle on peut sélectionner nos clés publiques en choisissant la fonction g dans un ensemble n'appartenant pas à L(D). Il est également possible de comparer nos codes aux codes de Cartier [START_REF] Couvreur | Codes and the Cartier operator[END_REF] de la manière suivante : étant fixé un support P et un diviseur D + (g), le code de Cartier Car q (P, D + (g)) se trouve être un sous-code de Γ(P, D, g). Nous donnons aussi une condition nécessaire sur le degré du diviseur pour que les deux constructions rendent le même code.

Attaque par distingueur dans le cas Goppa-like. Dans [START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF], les auteurs bénéficient de la structure particulière de la trace du dual d'un sous-code sur un sous-corps pour établir un distingueur pour les codes alternants et les codes de Goppa classiques. En quelques mots, un distingueur pour un code linéaire permet de décider si une de ses matrices génératrices semble aléatoire ou non. Dans le cas de [START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF], le distingueur est obtenu à partir du comportement bien connu des codes GRS vis-à-vis du produit de Schur. En effet, la dimension du carré d'un code GRS de dimension r est bien plus petite que celle attendue pour un code aléatoire, i.e.

dim F q m GRS r (x, y) = 2r -1, si r < n 2
au lieu de la borne supérieur quadratique r+1 2 attendue. En tant que généralisation des codes GRS, il n'est pas étonnant de constater que les carrés codes de géométries algébriques réagissent de la même manière, la seule différence notable étant l'apparition d'une contribution non triviale liée au genre de la courbe. En associant cette propriété avec des résultats sur le produit d'espaces de Riemann-Roch, nous obtenons la borne suivante sur la dimension du carré du dual d'un code AG Goppa-like: Proposition 4.9. Avec les notations précédentes, supposons que s = deg(D) ≥ g(X ), et posons

k := dim F q m C et e := min m 2 , log q k 2 s . Alors dim Fq (Γ(P, D, g) ⊥ ) ⋆2 ≤ mk + 1 2 - m 2 k(k -1)(2e + 1) -2s q e+1 -1 q -1 .
Division euclidienne à poids et codes AG Goppa-like à un point sur les courbes C a,b .

Dans le cas particulier des codes AG Goppa-like construit sur une courbe C a,b associé au diviseur à un point D = sP ∞ (P ∞ étant l'unique point à l'infini), nous parvenons à améliorer la borne donnée dans la Proposition 4.10. En effet, de tels codes peuvent être vus comme l'évaluation de polynômes bivariés, dû à la structure particulière de l'espace de Riemann-Roch L(sP ∞ ), i.e.

L(sP

∞ ) = Span x i y j | 0 ≤ i, 0 ≤ j ≤ a -1 and ai + bj ≤ s .
En définissant un degré à poids sur chaque polynôme bivarié de l'anneau S = ∪ s≥0 L(sP ∞ ), nous introduisons une notion de division euclidienne généralisée via des bases de Gröbner. Comme attendu dans le cas univarié, le reste de nos divisions a généralement un degré plus petit que celui du diviseur. Sous des conditions techniques supplémentaires sur le degré du diviseur D = sP ∞ + (g), nous démontrons alors :

Theorem 4.22. Soient s ′ > s deux entiers et g ∈ L(s ′ P ∞ ) de degré à poids deg a,b (g) = s ′ une fonction rationnelle. Supposons que s ≥ (s ′ -s)q + 2g a,b -1 et posons k := dim F q m C L (X , P, sP ∞ + (g)) et e * := min m 2 , log q k 2 s ′ (q -1) 2 + 1 . Alors dim Fq (Γ(P, sP ∞ , g) ⊥ ) ⋆2 ≤ mk + 1 2 - m 2 (k 2 (2e * + 1) + k -2s ′ (q e *
-q e * -1 + 1)).

Efficacité du distingueur. Nos résultats généralisent ceux de [START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF]

IOP de Proximité aux codes AG construit sur la tour Hermitienne

Ces travaux ont été menés en collaboration avec Sarah Bordage, Jade Nardi and Hugues Randriambololona [START_REF] Bordage | Interactive oracle proofs of proximity to algebraic geometry codes[END_REF].

Dans [START_REF] Bordage | Interactive oracle proofs of proximity to algebraic geometry codes[END_REF], Bordage et Nardi ont proposé de remplacer les codes de Reed-Solomon dans les IOPs de Proximité aux codes linéaires. L'idée initiale était de pallier aux limitations imposées par les codes RS en considérant des codes plus structurés. Elles proposent alors un critère général pour construire des IOPPs à base de codes AG, en donnant un contexte global pour qu'une famille de codes AG soit compatible avec les tests de proximité : on parle alors de codes repliables. Dans le Chapitre 5 de cette thèse, nous donnons une famille explicite de codes AG repliables définie sur la tour Hermitienne, et étudions les propriétés du système IOPP qui en découle.

Codes AG repliables. Soit X une courbe définie sur un corps fini F et G ⊆ Aut(X ) un groupe d'automorphisme résoluble. Il existe une suite de sous-groupes distingués {Id}

:= G 0 ▷ G 1 ▷ • • • ▷ G r := G tel que tous les quotients Γ i := G i /G i-1 sont cycliques. Cela correspond à une suite de revêtements de courbes X := X r → X r-1 → • • • → X 0 := X /G,
ou chaque X i-1 est le quotient de X i par le Γ i . Un test de proximité à un code AG C := C L (X , P, G) consiste à déterminer si une fonction f : P → F appartient à C ou non. Pour ce faire, l'idée est de construire une suite de codes AG (C i ) r i=0 de longueur décroissante telle que C i = C C (X i , P i , G i ) est défini sur la i-ème courbe X i et C r := C. En choisissant efficacement la structure de chacun des codes, le premier test de proximité peut se réduire à un test d'appartenance d'une nouvelle fonction f ′ : P 0 → F au plus petit code C 0 . Plus précisément, P est choisi globalement G-invariant et chaque P i-1 est obtenu comme la projection de P i sur la courbe X i-1 . Le point clé est de construire une suite de diviseurs (G i ) r i=0 de sorte que l'espace de Riemann-Roch L Xi (G i ) puisse être décrit de manière explicite à l'aide d'espaces de Riemann-Roch sur la courbe quotient X i-1 . De telles conditions donneront lieu à la notion de diviseurs compatibles en Section 5.1.2. S'il est possible de construire une telle suite de codes, le code initial C est dit repliable.

Le cas de la tour Hermitienne. Considérons la tour infinie de corps de fonctions (F i ) i≥0 sur F q 2 tel que F 0 = F q 2 (x 0 ) est le corps de fonction rationnel et F i = F i-1 (x i ), où

x q i + x i = x q+1 i-1 , pour tout i ≥ 1.
Cette tour correspond à une suite infinie de courbes

• • • → X i → X i-1 → • • • → X 0 = P 1 ,
appelée la tour Hermitienne. Contrairement au cas des codes repliables sur des courbes de type Kummer (cf. [START_REF] Bordage | Interactive oracle proofs of proximity to algebraic geometry codes[END_REF]), nous n'avons ici aucune chance de pouvoir utiliser le théorème de Maharaj [Mah04, Theorem 2.2] pour obtenir la décomposition d'espaces de Riemann-Roch recherchée, puisque l'une des hypothèses demande à ce que l'ordre de l'automorphisme agissant sur le code soit premier à la caractéristique, ce qui n'est bien sûr pas le cas ici. Pour palier à ce problème, nous pouvons de nouveau considérer des codes à un point, supporté par un multiple de l'unique point à l'infini

P (i)
∞ ∈ X i (F q 2 ). Ce faisant, nous pouvons exploiter la structure spécifique des espaces L Xi (mP

(i) ∞ ), i.e. L Xi (mP (i) ∞ ) = Vect   x a0 0 • • • x ai i | 0 ≤ a 0 , 0 ≤ a j ≤ q -1 et i j=0 a j q i-j (q + 1) j ≤ m   ,
pour obtenir à la main la décomposition que l'on recherche. Prenant en compte la théorie des sauts de Weierstrass dans notre construction, nous demandons aussi à ce que le degré de nos diviseurs soit augmenté à chaque étape (d'un facteur dépendant du genre des courbes successives) afin de garantir l'existence de fonctions balances (qui sont primordiales pour démontrer la soundness du système IOPP correspondant). À termes, nous proposons la suite de codes AG repliables suivante :

C i := C L (X i , P i , d i P (i) ∞ ), pour i ≥ 1; (2) où P i ⊆ X i (F q 2 )\ P (i) ∞
est un ensemble de points rationnels de longueur au plus q i+2 , et la suite d'entiers d i 's sont définis de manière récursive par d i-1 = ⌊ di q ⌋ + 2g(X i-1 ).

Système AG-IOPP avec des codes Hermitiens repliables. Dans la section 5.4, nous définissons un système IOPP pour tester la proximité d'une fonction f (imax) :

P imax → F q 2 au code AG C L (X imax , P imax , d imax P (imax) ∞
). Il s'agit d'une preuve interactive en i max -tours dans laquelle le test de proximité initial est réduit à un test de proximité d'une fonction f (0) , définie comme un replié de f (imax) , au plus petit code définit sur X 0 . Ses principales propriétés sont résumées dans le théorème (informel) qui suit : Theorem (Informel, voir [BNLR22, Théorème 45]). Soit C imax un code AG comme dans l'équation (1), de longueur n ≤ q imax+2 . Alors le système IOPP décrit dans la Section 5.4.1 est parfaitement complet, a une petite erreur de soundness pour tout paramètre de proximité δ, et les propriétés suivantes : complexité des tours

r(n) < log(n) longueur de preuve ℓ(n) < n complexité des requêtes q(n) ≤ tq log(n) + 1 complexité du prouver t p (n) = O n • M F q 2 (q) log(q) complexité du vérifieur t v (n) = O log(n) • M F q 2 (q) log(q) ,
où M F q 2 (d) désigne le coût de multiplication de deux polynômes univariés de degré d sur F q 2 .

Chapter 1

Algebraic geometry codes

Coding theory

Let F q be the finite field with q elements, where q is a power of some prime number p. For the upcoming bases in coding theory and without further precision, we refer to [START_REF] Macwilliams | The theory of error-correcting codes[END_REF].

Linear codes

Definition 1.1 (Linear Code). Let k ≤ n be two non-negative integers. A linear [n, k] q code over F q is a subspace C ⊆ F n q of dimension k. The integers n and k are respectively the length and the dimension of C, and any vector of C is called a codeword. The rate of C is the ratio R := k n . A generator matrix M of C is a k × n matrix over F q whose rows are a basis of C as a vector space. In particular, we have

C = xM | x ∈ F k q . A parity check matrix H of C is a (n -k) × n matrix over F q such that ∀c ∈ C, c ∈ C ⇐⇒ Hc T = 0.
Generator matrices of codes are not unique, and it is the same for parity check ones. However, it is often convenient to have a generator matrix with the specific form

M = (I k | A),
where A is a k × (n -k) matrix over F q and I k is the identity matrix of size k. In this situation, M is said to be systematic. A linear code does not always have a systematic generator matrix but if so, this matrix is unique and the code is said to be systematic. Definition 1.2 (Dual code). Let C be a linear code over F q . Its dual code, denoted by C ⊥ , consists in all vectors which are orthogonal to all codewords of C. More precisely,

C ⊥ := {y ∈ F n q | yc T = 0 for all c ∈ C}.
It is easy to see that any parity check matrix of C is a generator matrix of its dual C ⊥ . As a consequence, C ⊥ has same length n and dimension n -dim Fq (C).

Definition 1.3 (Hamming distance). The Hamming distance between two vectors x, y ∈ F n q , denoted by d H (x, y), is defined by

d H (x, y) := | {i ∈ {1, • • • , n} | x i ̸ = y i } |, where x = (x 1 , • • • , x n ) and y = (y 1 , • • • , y n ).
The Hamming weight of a vector x ∈ F n q is defined by its distance to the zero vector, i.e. its number of non-zero components:

w H (x) := d H (x, 0) = | {i ∈ {1, • • • , n} | x i ̸ = 0} |.
Since we will only deal with the Hamming metric, we simply talk about the distance between two codewords or the weight of a codeword. The minimum distance of a linear code C can also be seen as the minimum weight of its non-zero codewords, that is to say

d = min {w H (x) | x ∈ C\ {0}} .
Later on, any linear code C over F q will be described in terms of its length, dimension and minimum distance. For this reason, such a code will be referred to as an [n, k, d] q code (or just [n, k] q code). The following famous theorem makes the link between these parameters.

Theorem 1.5 (Singleton bound). If C is an [n, k, d] q code, then n -k ≥ d -1.
Codes with k + d = n + 1 are in a sense optimal, and thus are called MDS codes (maximal distance separable codes). The easiest example is the case of Reed-Solomon codes:

Example 1.6. Let r be a positive integer and choose a generator β of F * q , i.e. such that F * q = β, β 2 , . . . , β q-1 . The Reed-Solomon code of length n = q -1 and dimension r over F q is defined by

RS r := (f (β), f (β 2 ), • • • , f (β q-1 )) | f ∈ F q [T ] and deg(f ) < r .
It is easily checked that RS r is MDS, i.e. n = k + d -1.

Punctured code and subfield subcode

In this section, we describe several ways to construct new codes from existing ones.

Definition 1.7 (Puncturing). Let C ⊆ F n q be a linear code and I ⊆ {1, • • • , n} a set of coordinates. The punctured code of C at I is defined by

Punct I (C) := (c i ) i∈{1,••• ,n}\I | c = (c 1 , • • • , c n ) ∈ C .
This is a code of length n -|I|.

Proposition 1.8. Let C ⊆ F n q be a [n, k, d] q linear code and

I ⊆ {1, • • • , n}. Then Punct I (C) is an [n -|I|, k ′ , d ′ ] q code with k -|I| ≤ k ′ ≤ k and d -|I| ≤ d ′ ≤ d.
From now on, let m ≥ 1 be a positive integer and consider the finite extension F q m of F q . Below, we describe two ways to construct new codes from existing ones: considering a linear code over F q m , it may happen that some of its codewords lie in F n q , leading to the following definition: Definition 1.9 (Subfield subcode). Let C ⊆ F n q m be a linear code over F q m . Its subfield subcode over F q , denoted by C| Fq , is the subcode over F q consisting in all codewords of C which lie in F n q , i.e.

C| Fq := C ∩ F n q .
Usually, it is an hard task to find the exact parameters of a subfield subcode. A first estimation is given by the following theorem:

Theorem 1.10. Let C be linear [n, k, d] q m code. Then C| Fq in an [n, k ′ , d ′ ] q code with k ′ ≥ n -m(n -k) and d ′ ≥ d.
Another construction that permits to build a code over F q starting from a code C over F q m uses the trace operator.

Definition 1.11 (Trace code). Given an extension F q m /F q of finite field, the trace operator

Tr F q m /Fq : F q m → F q is defined for all x ∈ F q m by Tr F q m /Fq (x) := m-1 i=0 x q i .

CODING THEORY

This definition naturally extends to vectors x ∈ F n q m , so that the trace acts component-wise:

Tr F q m /Fq (x) = Tr F q m /Fq (x 1 ) , • • • , Tr F q m /Fq (x n ) ,
and thus to codes C over F q m :

Tr F q m /Fq (C) = Tr F q m /Fq (c) | c ∈ C .
The code Tr F q m /Fq (C) is called the trace code of C.

Given a linear code C over F q m , we have a trivial upper bound on the dimension of its trace code over F q , i.e.

dim Fq Tr F q m /Fq (C) ≤ m • dim F q m (C).
We conclude this section by stating Delsarte's theorem, which makes the link between subfield subcode and trace code.

Theorem 1.12 ([Del75, Theorem 2]). Let C ⊆ F n q m be any linear code, then

(C ∩ F n q ) ⊥ = Tr F q m /Fq C ⊥ .
Remark 1.13. When there is no ambiguity on the fields (which will be the case in Section 1.1.4 and the whole Chapter 4), we may write Tr(•) instead of Tr F q m /Fq (•).

Permutation group and invariant code

Let S n be the group of permutations of {1, • • • , n}.

Definition 1.14 (Permutation group). Let C be a linear code of length n over F q and σ ∈ S n a permutation acting on

C via c σ = c σ(1) , • • • , c σ(n) , for every codeword c ∈ C. We say that C is σ-invariant if C σ = C
, in which case we say that σ is a permutation of C. The permutation group of C is defined as the subset of all such permutations, i.e.

Perm(C) := {σ ∈ S n | C σ = C} .
Definition 1.15 (Invariant code). Given a linear code C ⊆ F n q together with a permutation subgroup Σ ⊆ Perm(C), we define the invariant code of C under Σ as the subcode

C Σ := {c ∈ C | c σ = c, ∀σ ∈ Σ} ⊆ C.
Defined this way, the invariant code has repeated entries (i.e. the coordinates of its codewords are constant on each orbit under the action of Σ), so we usually use another one: the punctured invariant code, denoted by C Σ . More precisely, all the orbits of Σ on {1, . . . , n} have same cardinality |Σ|, and

C
Σ is obtained from C Σ by keeping only the first entry in each of them.

Example 1.16. With above notation, assume that ℓ | n = length(C) and that Σ = ⟨σ ℓ ⟩ is cyclic of order ℓ, generated by the ℓ-quasi-cyclic shift σ ℓ (which is cyclic on each of the n ℓ blocks of length ℓ of {1, . . . , n}). Considering the set of indices I ℓ := {1, ..., n}\{1, ℓ + 1, . . . , n -ℓ + 1}, the punctured invariant code is in this case defined by

C Σ := Punct I ℓ C Σ = Punct I ℓ (ker((σ ℓ -id)| C )),
where σ ℓ : F n q → F n q is induced by σ ℓ and id is the identity map. In particular, the code C Σ has length n ℓ .

Notice that by definition, it is possible to construct a generator matrix of the (punctured) invariant code from the knowledge of a generator matrix of C and the induced permutation. Throughout this thesis, we always work with the punctured invariant code C Σ , and simply write C Σ . Hence, when talking about the invariant code, we always implicitly assume it is the punctured one, meaning that is has smaller length.

Schur product of codes

In the discussion below, to make it more readable, we shall write Tr(•) instead of Tr F q m /Fq (•) when considering the Trace operator.

Definition 1.17 (Schur product of codes). Let C and D be two linear codes over F q m with same length n. We define their Schur product by

C ⋆ D := ⟨c ⋆ d | c ∈ C, d ∈ D⟩ F q m ,
where c ⋆ d stands for the component-wise product of vectors.

If C = D, we call C ⋆2 := C ⋆ C the square code of C.
It is clear that if C and D have respective dimension k 1 and k 2 , an obvious bound on the dimension of their Schur product is k 1 k 2 . However, this bound is not relevant when C ∩ D ̸ = {0}. In particular, for any [n, k] q m code C, we have

dim F q m C ⋆2 ≤ min n, k + 1 2 . (1.1)
For a random linear code C (i.e. its generators matrices cannot be distinguished from random matrices) whose square does not fill the full space, the dimension of its square is k+1 2 with high probability (see. [START_REF] Cascudo | Squares of random linear codes[END_REF]).

In this thesis (see Chapter 4), we focus on square code considerations to construct a distinguisher, i.e. a way to decide if a given matrix generates a structured code or is a random matrix. In particular, we will make good use of the following result, which describes the structure of the Schur product of two trace codes: Proposition 1.18 ([MT21, Proposition 12]). Let C and D be two linear codes with same length n over F q m . Then

Tr(C) ⋆ Tr(D) ⊆ m-1 i=0 Tr C ⋆ D q i ,
where

D q i := (d q i 1 , . . . , d q i n ) | d ∈ D .
Considering square codes, this result can be improved:

Proposition 1.19 ([MT21, Proposition 15]). Let C be a linear code over F q m . Then

Tr(C) ⋆2 ⊆ ⌊ m 2 ⌋ i=0 Tr C ⋆ C q i . Moreover, if m is even, dim Fq Tr C ⋆ C q m 2 ≤ m 2 (dim F q m C) 2 .
An estimation on the dimension of the square of the trace of a linear code can be derived from the above proposition.

Corollary 1.20 ([MT21, Corollary 16]

). Let C be any F q m -linear code. Then

dim Fq Tr(C) ⋆2 ≤ m • dim F q m C ⋆2 + m 2 (dim F q m C) 2 . Furthermore, if dim Fq Tr(C) = m • dim F q m (C), then dim Fq Tr(C) ⋆2 - dim Fq Tr(C) + 1 2 ≤ m • dim F q m C ⋆2 - dim F q m C + 1 2 .
The above corollary implies that if the dimension of a square code is smaller than the one expected for a random code, namely

dim F q m (C ⋆2 ) < dim F q m C + 1 2 ,
then this property is retained for the trace code, i.e.

dim Fq Tr(C) ⋆2 < dim Fq Tr(C) + 1 2 .
As we will see in Chapter 4, this fact is especially true for Reed-Solomon codes, and more importantly for algebraic geometry codes.

Tools of algebraic geometry

In this section, we introduce some required tools in algebraic geometry, both in the case of curves and function fields. Our main references are [Mor93, Chapter 1] for curves and [START_REF] Stichtenoth | Algebraic function fields and codes[END_REF] for the function field point of view.

As we are only interested in the finite field case, we define our objects over some finite field F q and we denote by F q its algebraic closure.

Algebraic curves over finite field

Let A n and P n be the n-dimensional affine and projective spaces over F q respectively. As usual, any point P in P n is an equivalence class of (n + 1)-tuples, denoted by P = [x 1 : • • • : x n+1 ], with x i ∈ F q not all zero, under the relation:

[x 1 : • • • : x n+1 ] ≡ [y 1 : • • • : y n+1 ] ⇐⇒ ∃λ ∈ F * q such that ∀i ∈ {1, • • • , n}, x i = λy i . Definition 1.21 (Projective set). A polynomial F ∈ F q [X 1 , • • • , X n+1 ] is homogeneous of degree d if for any (x 1 , • • • , x n+1 ) ∈ F n+1 q
and any λ ∈ F * q , we have

F (λx 1 , • • • , λx n+1 ) = λ d F (x 1 , • • • , x n+1 ). Given a subset S ⊆ F q [X 1 , • • • , X n+1
] of homogeneous polynomials, we define its zero set by

Z(S) = {P ∈ P n | F (P ) = 0 , ∀F ∈ S}. A subset Y ⊆ P n is called a projective algebraic set (or just projective set) if Y = Z(S)
for some set of homogeneous polynomials S. A projective set Y is said to be irreducible if it is non-empty and if it cannot be written as the union of two distinct algebraic subsets

Y = Y 1 ∪ Y 2 , such that Y 1 ̸ ⊆ Y 2 and Y 2 ̸ ⊆ Y 1 .
To define the notion of projective varieties and curves, we first need to introduce a topology on projective sets. Definition 1.22 (Zarisky topology). The Zarisky topology on the projective space P n is defined by taking the open sets as the complement of projective sets.

Definition 1.23 (Projective variety). A projective variety is an irreducible closed subset of P n , under the Zarisky topology. An open subset of a projective variety is referred to as a quasi-projective variety.

Later on, both projective or quasi-projective varieties will be called varieties. Given a variety Y, we define its homogeneous ideal, denoted by I(Y), as the ideal

I(Y) = {F ∈ F q [X 1 , • • • , X n+1 ] homogeneous | F (P ) = 0, ∀P ∈ Y}. Let F, G ∈ F q [X 1 , • • • , X n+1 ] be two homogeneous polynomials with same degree such that G / ∈ I(Y).
Then the fraction

F G ∈ F q (X 1 , • • • , X n+1 ) is called a rational function on Y. The elements F G and F ′ G ′ define the same rational function if the polynomial F G ′ -F ′ G is identically zero on Y.
Definition 1.24 (Function field of a variety). The function field F q (Y) of a variety Y is the field of rational functions on Y, and the dimension of the variety Y is defined as the transcendence degree of F q (Y) over F q .

We now have all the tools in hand to define the notion of projective curves.

Definition 1.25 (Projective curve). A projective curve (or just curve) over the finite field F q , denoted by X /F q (or X when there is no ambiguity on the base field), is a variety of dimension one over F q , i.e. a variety whose function field F q (X ) has transcendence degree one over F q .

Example 1.26. In the affine plane over F q , we consider the variety X defined by the homogeneous polynomial Y 3 -X 3 -Z 3 . Setting x : X/Z and y := Y /Z, the function field F q (X ) of X consists in all elements of the form P Q , with P, Q ∈ F q [x, y]. Since y 3 = x 3 + 1, the transcendence degree of F q (X ) over F q is one, hence X is a projective curve.

In Definition 1.24, we saw that to any curve X /F q , we can associate its function field. The theory of function fields will be studied in the next subsection. From now on, we only consider projective plane curves, i.e. curves X ⊆ P 2 . This case is easier to understand and actually sufficient for the results presented in this thesis. It also helps in precising our definition of smoothness.

Definition 1.27 (Smooth curves). Let X be a projective plane curve defined by some homogeneous polynomial F ∈ F q [X, Y, Z]. A point P ∈ X is said to be non singular if at least one of the partial derivatives ∂F ∂X , ∂F ∂Y or ∂F ∂Z is not zero at P . The curve is smooth if all its points are non singular. Example 1.28. Consider the projective plane curve of Example 1.26, defined by the homogeneous polynomial F (X, Y, Z) = Y 3 -X 3 -Z 3 over F q . The partial derivatives of F are -3X 2 , 3Y 2 and -3Z 2 , hence the curve is smooth whenever the characteristic of F q is not 3. Definition 1.29 (Local ring of a point). Let X be a curve and P ∈ X . A rational function f ∈ F q (X ) is regular at P if it can be written of the form f = H G , with G non zero at P . The set of all regular functions at P forms a ring O P , called the local ring at P . The terminology "local ring" makes sense since O P is in fact a local ring, whose unique maximal ideal m P ⊆ O P consists in all functions f ∈ O P such that f (P ) = 0.

In the next section, we will show that there exists a correspondence between smooth irreducible projective curves and algebraic function fields in one variable. In particular, this permits to transfer the notions from one language to the other. To conclude this section, we define two important objects which are specific to curves defined over finite fields.

Definition 1.30 (Rational points). Let X ⊆ P n F q be a curve defined over F q , i.e. its defining homogeneous polynomials have coefficients in F q . By definition, the points on X have coordinates in the algebraic closure F q , but some of them may lie in F q itself. These are called F q -rational points (or simply rational points). The set of all rational points of X is denoted by X (F q ). Later, we will see that the set of rational points of a curve is always finite, and that we can estimate its cardinality. It will be a crucial tool to define the family of algebraic geometry codes.

Example 1.31. The Klein curve K 3 over F 4 is defined by the homogeneous equation

X 3 Y + Y 3 Z + Z 3 X = 0. If we write F 4 = {0, 1, α, α + 1}, then K 3 (F 4 ) = {[0 : 0 : 1], [α : α + 1 : 1], [α + 1, α : 1], [1 : 0 : 0], [0 : 1 : 0]},
i.e. K 3 has 5 F 4 -rational points.

Definition 1.32. A closed point of a projective plane curve X over F q is an orbit under the Frobenius automorphism Frob q : [x : y : z] → [x q : y q : z q ]. Its degree is the cardinality of the orbit.

Algebraic function fields

For this section and without further details, we refer to [START_REF] Stichtenoth | Algebraic function fields and codes[END_REF]. Below, we start by giving the one to one correspondence between smooth irreducible projective plane curves and function fields in one variable, which motivates the study of function field theory. Thanks to this, we then give an algebraic point of view of the notions presented in Section 1.2.1. Throughout this thesis, we will use either one or the other depending on the situation.

As in the previous section, we define objects over some finite field F q even if it works for any arbitrary field.

Definition 1.33 (Algebraic function field). An algebraic function field (or just function field ) K/F q of one variable over F q is a field extension K ⊇ F q which is a finite algebraic extension of F q (x), where x ∈ K is transcendental over F q .

Example 1.34. The simplest example of function field is the rational function field : an extension K/F q is said to be rational if K = F q (x) for some x ∈ K which is transcendental over F q . In this case, each element z ∈ F q (x) admits a unique representation

z = a • i p i (x) ni ,
where 0 ̸ = a ∈ F q , the polynomials p i (x) ∈ F q [x] are monic, pairwise distinct and irreducible and n i ∈ Z.

From Definition 1.24, we know that the field of rational functions F q (X ) of a projective curve X is a function field in one variable. The converse is also true, as it is stated in the following theorem.

Theorem 1.35 ([Liu02, Proposition 7.3.13 and Remark 7.3.14]). There is an anti-equivalence between the following two categories:

• smooth, irreducible, projective curves over F q , with non-constant morphisms of curves over F q ,

• function fields over F q , with field morphisms over F q , which to a curve X associates its function field K = F q (X ).

The above theorem states that we can either deal with curves or function fields. Depending on the situation, we might prefer one to the other. In accordance with [Sti09, Section 1.4 ff.], when speaking about a function field K over F q , we always implicitly assume that the field of constants of K is equal to F q , i.e. F q is algebraically closed in K. Alternatively, it means that all our curves will be geometrically irreducible.

Example 1.36. In Example 1.34, we defined the rational function field F q (x) over F q . The curve associated to it according to Theorem 1.35 is the projective line

P 1 over F q . Definition 1.37 (Valuation ring). A valuation ring of K/F q is a ring O ⊆ K such that 1. F q ⊊ O ⊊ K, and 2. for any x ∈ K, we have x ∈ O or x -1 ∈ O. Proposition 1.38. Let O be a valuation ring of K/F q . Then 1. O is a local ring, i.e. it has a unique maximal ideal P := O\O × . 2. Let 0 ̸ = x ∈ K. Then x ∈ P ⇐⇒ x -1 / ∈ O.
3. The maximal ideal P of O is principal.

Proof. See [START_REF] Stichtenoth | Algebraic function fields and codes[END_REF], Proposition 1.1.5 and Theorem 1.1.6.

We now define the notion of places of a function field, which play the role of closed points in the case of projective curves over F q .

Definition 1.39 (Place). A place P of a function field K/F q is the maximum ideal of some valuation ring O of K. From Proposition 1.38 2, O is uniquely determined by P , thus we write

O P := O = x ∈ K | x -1 / ∈ P .
Since P is principal, there exists t ∈ O P such that P = tO P . Such an element is called a local parameter at P (or a prime element at P ). The set of all places of K is denoted P K .

Remark 1.40. Let X be a smooth projective curve over F q and F q (X ) its function field. There is a one-to-one correspondence between the set of places P Fq(X ) and the set of closed points of X . Thus, every place P ∈ P Fq(X ) coincides with the local ring O p of some point p ∈ X . Hence, there is no ambiguity in the notation between local ring of a point and valuation ring of a place.

Proposition 1.41 ([Sti09, Theorem 1.1.6, (b)]). Let P ∈ P K and t ∈ K be a local parameter at P . Then any 0 ̸ = x ∈ K has a unique representation of the form x = t n u, with n ∈ Z and u ∈ O × P . Let us fix a place P ∈ P K , t a local parameter at P and x ∈ O P \ {0} an element such that x = t n u. Moreover, we denote by ν P (x) := n the valuation of x at P (which does not depend on the choice of t). Setting ν P (0) = ∞, the function ν P : K → Z ∪ {∞} is a discrete valuation of K/F q , i.e. it satisfies the following properties:

1. ν P (x) = ∞ ⇐⇒ x = 0.
2. For all x, y ∈ K, ν P (xy) = ν P (x) + ν P (y).

3. For all x, y ∈ K, ν P (x + y) ≥ min {ν P (x), ν P (y)}, with equality if ν P (x) ̸ = ν P (y).

4. There exists z ∈ K such that ν P (z) = 1.

5. For all a ∈ F * q , ν P (a) = 0.

Let x ∈ K and P ∈ P K . If ν P (x) > 0, we say that P is a zero of x, and a pole of x if ν P (x) < 0.

Definition 1.42 (Residue field and degree). Let P ∈ P K .

1. The field F P := O P /P is called the residue class field of P . Given x ∈ O P , its class in the quotient group F P is denoted by x(P ).

2. The degree of P is defined by deg(P ) := [F P : K]. A degree one place is referred to as a rational place.

The degree of a place is always finite (see [START_REF] Stichtenoth | Algebraic function fields and codes[END_REF], Proposition 1.1.15). Again, there is a one-toone correspondence between rational points on a curve X and degree one places in its function field F q (X ).

Example 1.43. [Sti09, Section 1.2] The rational function field F q (x) over F q has exactly q + 1 places of degree one. According to Example 1.34, they corresponds to the set P 1 (F q ) of rational points on the projective line, given by

P 1 (F q ) = {[α : 1] | α ∈ F q } ∪ {P ∞ } , where P ∞ is the unique pole of x.
In what follows, we consider a finite extension L/K, where K is a function field over F q . We then recall that there exists a link between places in K and those in L: this is the ramification theory.

Definition 1.44. Let L/K be a finite extension of function fields over F q , and Q ∈ P L , P ∈ P K two places. We say that Q lie over P (or that Q is an extension of P ) if P ⊆ Q, in which case we write Q|P . In particular, P = Q ∩ K. The finite integer e(Q|P ) is called the ramification index of Q|P . Moreover, the (also finite) integer f (Q|P ) := [F Q : F P ] is called the inertia degree of Q over P . A place P is said to be totally ramified in L/K if there is only one place Q above P and e(Q|P ) = [L : K]. Likewise, we say that P totally splits in L/K if P admits [L : K] extensions in L, each with ramification index equals to one.

In this thesis, we will several times consider the following situation: let L/F q be a function field and Aut(L) be the group of F q -automorphisms of L. For any finite subgroup G ⊆ Aut(L), we denote by L G the fixed field of L by G, i.e

L G = {x ∈ L | σ(x) = x , ∀σ ∈ G} .
In this case, the function field extension L/L G is Galois with Galois group G, and the ramification in the extension behaves with respect to the action of the Galois group G: Proposition 1.46 ([Sti09, Lemma 3.5.2]). Let L/F q be a function field and σ ∈ Aut(L). Let also Q ∈ L and P ∈ L ⟨σ⟩ be such that Q|P . Then σ(Q) := {σ(x) | x ∈ Q} is a place of L, and:

1. σ(Q)|P . 2. e(σ(Q)|P ) = e(Q|P ).
Remark 1.47. If X is a smooth irreducible projective curve over F q with function field F and G ⊆ Aut(F ), then the curve associated to the fixed field F G is called the quotient curve of X by G, denoted by X /G (notice that we make the analogy between automorphisms of the curve and those of its function field, see Theorem 1.35).

TOOLS OF ALGEBRAIC GEOMETRY

Example 1.48. [Sti09, Annex A.13] Suppose that n | q -1 and let L = F q (x, y) be a function field defined by the equation

y n = p(x),
where p ∈ F q [x] is a square-free polynomial of degree d prime to n. Then L/F q (x) is cyclic of order n and its Galois group is given by

Gal(L/F q (x)) = {σ : y → ξy | ξ ∈ µ * n (F q )} .
Such an extension is called a Kummer extension. Remark that if Y is the smooth projective curve associated to L, then the one associated to its fixed field L Gal(K/Fq(x)) = F q (x) is the projective line P 1 over F q .

Divisors and Riemann-Roch spaces

In this section, we choose to present the results from the algebraic point of view, meaning that we deal with function fields and places rather than curves and points. Further details can be found in [Sti09, Sections 1.4 and 1.5].

From now on, fix a function field K over F q . As discussed above and following [Sti09, Section 1.4 ff.], we assume that F q is algebraically closed in K. Keep in mind that the remaining of Section 1.2 can be applied by replacing K with its associated geometrically irreducible curve X . The group Div(K) is endowed with a partial order in the following way:

P ∈P K n P P ≥ P ∈P K m P P ⇐⇒ ∀Q ∈ P K , n P ≥ m P .
If 0 denotes the zero divisor in Div(K) (i.e all ν P (0) = 0), then we say that the divisor D is effective if D ≥ 0. It is well-known that any non zero function x ∈ K has only finitely many poles and zeros in P K (see for example [Sti09, Corollary 1.3.4]). Hence, the following definition makes sense.

Definition 1.50 (Principal divisors). Let 0 ̸ = x ∈ K and denote by Z(x) (resp. N (x)) the set of zeros (resp. poles) of x in P K . We define

(x) K 0 := P ∈Z(x) ν P (x)P , the zero divisor of x, (x) K ∞ := P ∈N (x)
(-ν P (x))P , the pole divisor of x and

(x) K = (x) K 0 -(x) K ∞ the principal divisor of x.
The subset of Div(K) generated by the principal divisors of K forms a subgroup, denoted by Princ(K). Given two functions x, y ∈ K, we have

(xy) K = (x) K + (y) K .
Whenever it is clear from the context, we just write (x) instead of (x) K to talk about the principal divisor of x ∈ K (the same holds for (x) 0 and (x) ∞ ). Note that (x) 0 ≥ 0, (x) ∞ ≥ 0 and

(x) = P ∈P K ν P (x)P.
The non zero elements lying in F q are characterized by

x ∈ F q ⇐⇒ (x) = 0.
Example 1.51. Let F q (x) be the rational function field over F q and f ∈ F q [x] a polynomial which splits in F q . Denote by {α 1 , ..., α s } its roots in F q and by m i their multiplicity. The divisor of f is then given by

(f ) Fq(x) = s i=1 m i P i -deg(f )P ∞ ,
where P i a degree one place in K, associated to the point [α i : 1] in the projective line (see Example 1.43 for a description of P 1 (F q )). The place P ∞ is the unique pole of x.

Theorem 1.52 ([Sti09, Theorem 1.4.11]). All principal divisors of K have degree zero. More precisely, for any x ∈ K, we have We say that two divisors D 1 and D 2 are equivalent, and we write

deg((x) 0 ) = deg((x) ∞ ) = [K : F q (x)].
D 1 ∼ D 2 , if [D 1 ] = [D 2 ], i.e. D 2 = D 1 + (x) for some x ∈ K.
Remark 1.54. As any principal divisor has degree zero, two equivalent divisors have same degree. Let Div 0 (K) be the subgroup of Div(K) made of all degree zero divisors, and Cl 0 (K) := Div 0 (K)/ Princ(K) the group of divisor class of degree zero. (which makes sense thanks to Theorem 1.52).

Proposition 1.55 ([Sti09, Proposition 5.1.3]). Cl 0 (K) is a finite group, and its order h(K) := # Cl 0 (K) is called the class number of K.

For any r ≥ 1, the number of divisor classes in Cl(K) of degree r does not depend on r, and is equal to h(K). In Proposition 1.70, we give an estimation of this integer.

In the case of a finite extension of function fields L/K, we can define a specific divisor in L, which keeps track of all the ramification in the extension.

Definition 1.56. Let L/K be a finite extension of function fields. The divisor Diff(L/K) =

P ∈P K Q|P d(Q|P ) • Q. (1.2) is called the different of L/K, where d(Q|P ) is the different exponent of Q over P (see [Sti09, Definition 3.4.3]).
Our next subject of interest will play a fundamental role in the thesis, being key to define the so-called Algebraic Geometry (AG) codes, which will be done in Section 1.3. Definition 1.57 (Riemann-Roch space). For a divisor D ∈ Div(K), we define its Riemann-Roch space as the F q -vector space

L K (D) := {x ∈ K * | (x) ≥ -D} ∪ {0} . Its dimension ℓ(D) := dim Fq L K (D) is called the dimension of the divisor D.
Without ambiguity on the function field, we simply write L(D) instead of L K (D).

Remark 1.58 [START_REF] Stichtenoth | Algebraic function fields and codes[END_REF], Lemma 1.4.6). The Riemann-Roch spaces of two equivalent divisors are isomorphic as F q -vector spaces.

Example 1.59. Let us consider the pole P ∞ of x in the rational function field F q (x). Then for any integer k > 0, the space L(kP ∞ ) has dimension k + 1, and

L(kP ∞ ) = 1, x, • • • , x k Fq .
These spaces are usually used to build Reed-Solomon codes.

TOOLS OF ALGEBRAIC GEOMETRY

The computation of the dimension ℓ(D) of a divisor is very important for us as it gives information on the parameters of AG codes. However, this is usually a difficult task and we are often only able to give a lower bound on it. A first one is given by the following lemma: Lemma 1.60 ([Sti09, Proposition 1.4.9]). For any D ∈ Div(K), we have

ℓ(D) ≤ max {0, deg(D) + 1} .
In particular, if deg(D) < 0, then ℓ(G) = 0.

To better handle the dimension of Riemann-Roch spaces, we need to introduce first the notion of differential forms.

Differentials and the Riemann-Roch theorem

The main purpose of this section is to present the Riemann-Roch theorem, which is a powerful tool that gives an explicit formula for the dimension of any divisor. Details for this section can be found in [Sti09, Sections 1.5 and 4.1].

Let K be a function field over F q . A derivation of K is a F q -linear map δ : K → K satisfying the product rule δ(xy) = xδ(y) + yδ(x), ∀x, y ∈ K.

We denote by Der(K) the K-vector space of derivations over K. If we are given a separating element x ∈ K (i.e. such that K/F q (x) is finite and algebraic), then there exists a unique derivation δ x ∈ Der(K) such that δ x (x) = 1.

Lemma 1.61 ([Sti09, Lemma 4.1.6]). Der(K) is a one-dimensional K-vector space. In particular, for every η ∈ Der(K), we have η = η(x)δ x .

The last step before defining differentials is to consider the set

Z := {(u, x) ∈ K × K | x is separating} ,
on which we define an equivalence relation ∼ by

(u, x) ∼ (v, y) ⇐⇒ v = uδ y (x).
Definition 1.62. For a couple (u, x) ∈ Z, its class under the relation ∼ is denoted by udx, and is called a differential form (or just differential ) of K. We simply write dx for the class of (1, x), and the set of all differentials of K is denoted by Ω K .

The main properties of differentials are put together in the following proposition:

Proposition 1.63 ([Sti09, Propositions 4.1.8 and 1.5.13]). With notation as above, we have:

1. x ∈ K is a separating element ⇐⇒ dx ̸ = 0.
2. Every differential ω ∈ Ω K can be uniquely written in the form ω = hdx, with h ∈ K. In particular, dim K Ω K = 1.

3. If 0 ̸ = ω ∈ Ω K and if t P is a prime element at the place P ∈ P K , then there exists u ∈ K such that ω = udt P .

Definition 1.64. Let ω ∈ Ω K and P ∈ P K . We define the valuation of ω at P by

ν P (ω) := ν P (u), if ω = udt P .
As we associated a divisor to any function x ∈ K, we can associate to a differential ω ∈ Ω K the divisor (ω) K (or just (ω) if it is clear from the context), defined by

(ω) K = P ∈P K ν P (ω)P.
Such a divisor is called a canonical divisor, and it does not depend on the choice of the prime elements t P 's. If ω = hdx with h ∈ K (see Proposition 1.63, 2 ), then we have

(ω) K = (h) K + (dx) K , where (dx) K = -2(x) K ∞ + Diff(K/F q m (x)). (1.3)
Remark 1.65. Since dim K Ω K = 1, we easily see that canonical divisors on K are equivalent.

Definition 1.66. The genus g(K) (or just g) of K is defined as the dimension of any canonical divisor, i.e. g(K) := ℓ(W ), for a canonical divisor W = (ω) K ∈ Div(K).

We are now ready to present the Riemann-Roch theorem.

Theorem 1.67 (Riemann-Roch, [Sti09, Theorem 1.5.15]). Let ω ∈ Ω K and W := (ω) K its divisor. Then for any D ∈ Div(K), we have

ℓ(A) = deg(A) + 1 -g(K) + ℓ(W -A).
This result can be precised in the case of canonical divisors:

Corollary 1.68 ([Sti09, Corollary 1.5.16]). For any canonical divisor W ∈ Div(K), we have

deg(W ) = 2g(K) -2.
Theorem 1.69 ([Sti09, Theorem 1.5.17]).

If D ∈ Div(K) is a divisor such that deg(D) ≥ 2g(K)-1, then ℓ(D) = deg(D) + 1 -g(K).
The genus of a function field is a powerful tool that can be used to estimate the class number or the number of rational points: Proposition 1.70 ([TVN07, Proposition 3.1.22]). Let K be a function field over a finite field F.

Then ( |F| -1) 2g(K) ≤ h(K) ≤ ( |F| + 1) 2g(K) . (1.4)
This implies in particular that any rational function field has only one divisor class, since it has genus zero.

Theorem 1.71 (Hasse-Weil Bound). Let K be a function field over F q and X the corresponding curve with respect to Theorem 1.35. Then the number X (F q ) of rational points on X is bounded by

|X (F q )| ≤ q + 1 + 2g(K) √ q.
A proof of this famous theorem can be found in [Sti09, Theorem 5.2.3]. Usually, the genus of a function field is hard to compute. In the case of an extension L/K, we have a formula that links g(L) and g(K).

Theorem 1.72 (Hurwitz Genus Formula, [Sti09, Theorem 3.4.13]). Let L/K be a finite extension of function fields over F q m . Then

2g(L) -2 = [L : K] • (2g(K) -2) + deg (Diff(L/K)) ,
where the different Diff(L/K) is defined in Definition 1.56.

We finish this section by giving an overview of a well-known class of curves, namely C a,b curves.

C a,b curves

As a complement to the upcoming discussion, we refer the reader to [START_REF] Miura | Algebraic geometric codes on certain place curves[END_REF].

Definition 1.73. Let a, b be coprime integers. A C a,b curve over F q is a curve having an irreducible, affine and non singular plane model with equation

f a,b (x, y) = α 0a y a + α b0 x b + α ij x i y j = 0, (1.5)
where f a,b ∈ F q [X, Y ] and the sum is taken over all couples (i, j) ∈ {0, • • • , b} × {0, • • • , a} such that ai + bj < ab.

AG CODES AND THEIR SUBFIELD SUBCODES

Let X a,b be such a curve, defined over F q . Its genus is given by

g a,b := g(X a,b ) = (a -1)(b -1) 2 .
The common point of all these curves is their behaviour with respect to the points at infinity. In fact, the condition imposed on the leading monomial of f a,b implies that C a,b curves have only one point at infinity, say P ∞ . More importantly, we know a nice basis of the Riemann-Roch space associated to any multiple of this point, i.e. for any non negative integer s, we have:

L(sP ∞ ) = Span x i y j | 0 ≤ i, 0 ≤ j ≤ a -1 and ai + bj ≤ s .
(1.6) This particularity will be used several times throughout this thesis. One could think that Equation (1.5) is kinda restrictive, but the class of C a,b is quite general: for example, any Kummer type curve (see Example 1.48) is a particular case of C a,b curve. It is also the case for the so-called Artin-Schreier curves.

AG codes and their subfield subcodes

In this section, we define algebraic geometry (AG) codes and their subfield subcodes (SSAG). Without specific mention, we refer to [START_REF] Michael | Algebraic geometric codes. Number n0. 139[END_REF] and [START_REF] Stichtenoth | Algebraic function fields and codes[END_REF].

Algebraic Geometry codes

We consider a finite extension F q m of F q , and we construct codes over F q m , before considering subfield subcodes over F q .

In what follows, X denotes an irreducible and smooth projective curve over F q m and K its function field. The genus of X is the one of its function field, i.e. g(X ) := g(K). Let P = {P 1 , • • • , P n } be a set of n distinct rational points on X and G ∈ Div(X ) be a divisor of degree less than n such that Supp(G) ∩ P = ∅. We consider the evaluation map

ev P : L(G) -→ F n q m f -→ (f (P 1 ), • • • , f (P n )).
(1.7) Definition 1.74 (AG code). With previous notation, the algebraic geometry (AG) code on X associated to the support P and the divisor G is defined by

C L (X , P, G) := {ev P (f ) | f ∈ L(G)} ⊆ F n q m . Let k := ℓ(G) and {f 1 , • • • , f k } be a basis of L(G). Then the matrix M =    f 1 (P 1 ) • • • f 1 (P n ) . . . . . . . . . f k (P 1 ) • • • f k (P n )    ∈ F n q m (1.8) is a generator matrix of C L (X , P, G).
Using the Riemann-Roch theorem (see. Theorem 1.67), we can estimate the dimension and the minimum distance of AG codes.

Theorem 1.75 ([Sti09, Corollary 2.2.3]). If n > deg(G), C L (X , P, G) is an [n, k, d] q m code, with k = ℓ(G) ≥ deg(G) + 1 -g(X ) and d ≥ n -deg(G). Moreover, if deg(G) ≥ 2g(X ) -1, then k = deg(G) + 1 -g(X ). The Goppa designed distance for the AG code C L (X , P, G) is defined by d * := n -deg(G).

Duality

In the previous section, we defined AG codes associated to a support P and a divisor G. Actually, there exists another kind of AG codes that can be constructed from the same support and divisor, using differential forms introduced in Section 1.2.4.

Definition 1.76 (Special divisor). Let G ∈ Div(X ). We associate to G the subspace Ω K (G) ⊆ Ω K of differential forms defined by

Ω K (G) := ω ∈ Ω * K | (ω) K ≥ G ∪ {0}
. This space is a vector space over F q m , whose dimension i(G)

:= dim F q m Ω K (G) is called the index of speciality of G. We say that G is non-special if i(G) = 0; otherwise G is called special.
Remark 1.77. Notice that the definition of the space Ω K (G) is similar to the one of Riemann-Roch spaces, which is not surprising as these objects play similar roles in terms of AG codes.

Theorem 1.78 ([Sti09, Theorem 1.5.14]). Let G ∈ Div(X ) be any divisor and W = (ω) be a canonical divisor. Then the map

L(W -G) → Ω K (G) f -→ f ω is an isomorphism of F q m -vector spaces. In particular, i(G) = ℓ(G) -deg(G) + g(K) -1.
Definition 1.79 (Residue). Let ω ∈ Ω K , P a degree one place in K = F q m (X ) and t P a local parameter at P such that ω = f dt P , with f ∈ K. The expansion of f into a Laurent series in t P has the form

f = ∞ i=-r a i t i P , with r ∈ Z.
The residue Res ω (P ) of ω at P is then defined by

Res ω (P ) := a -1 .

The above definition does not depend on the choice of the local parameter t P . We now have all the tools to define the other kind of AG codes, namely Ω-AG codes. As in Section 1.3.1, P = {P 1 , • • • , P n } denotes a set of n distinct rational points on X and G ∈ Div(X ) a divisor of degree less than n such that Supp(G) ∩ P = ∅. The residue map is defined by

Res P : Ω K -→ F n q m ω -→ (Res ω (P 1 ), • • • , Res ω (P n )).
Definition 1.80 (Ω-AG codes). With above notation, the Ω-AG code (or differential code) on X associated with the support P and the divisor G is defined by

C Ω (X , P, G) := {Res P (ω) | ω ∈ Ω(G -D P )} ,
where D P = P ∈P P .

Again, the Riemann-Roch theorem allows us to estimate the parameters of Ω-AG codes:

Theorem 1.81 ([Sti09, Theorem 2.2.7]). C Ω (X , P, G) is an [n, k, d] q m code, with k = i(G -D P ) ≥ n -deg(G) + g(X ) -1 and d ≥ deg(G) + 2 -2g(X ). In addition, if deg(G) ≥ 2g(X ) -1, then k = n -deg(G) + g(X ) -1.
The link between both constructions of AG codes is given by the following theorem:

Theorem 1.82. The codes C L (X , P, G) and C Ω (X , P, G) are dual to each other, i.e.

C L (X , P, G) ⊥ = C Ω (X , P, G).
A proof of this statement can be found in [Sti09, Theorem 2.2.8], and mainly relies on the residue formula ([Sti09, Corollary 4.3.3]).

The next and final result of this section shows that any Ω-AG code C Ω (X , P, G) can be represented as a code C L (X , P, H) for some explicit divisor H ∈ Div(X ) (up to diagonal equivalence). This can be helpful to deal with dual of AG codes without having to rely on differentials.

Proposition 1.83 ([Sti09, Proposition 2.2.10]). Let C L (X , P, G) be an AG code defined on a curve X . Then C L (X , P, G) ⊥ = C L (X , P, G ⊥ ) • Z ω ,
with G ⊥ = D P -G + W , where W := (ω) K is the divisor of some differential ω ∈ Ω K such that for all P ∈ P, ν P (ω) = -1, and Z ω is the diagonal matrix those coefficients are the Res ω (P ), P ∈ P.

The divisor G ⊥ is referred to as the dual divisor of G. In [Sti09, Lemma 2.2.9], it is also proven that there exists a differential ω ∈ Ω K such that Z ω is the identity matrix. Note that the dual divisor is not well-defined, as it depends on the choice of the differential. Throughout this thesis, while using this notation, there will be no ambiguity, as a suitable choice of a differential will be made.

Subfield subcode of AG codes and their parameters

We keep the notation of Section 1.3.1. Here, we define subfield subcode of AG codes (SSAG in short), which will be used a lot in this thesis as they are good candidates to replace classical Goppa codes in the McEliece cryptosystem [START_REF] Mceliece | A public-key cryptosystem based on algebraic coding theory[END_REF]. We also recall known results about their parameters.

Definition 1.84 (SSAG codes). Let C L (X , P, G) be an AG code over F q m as in Definition 1.74. We define its subfield subcode over F q , denoted by SSAG q (X , P, G), as follows:

SSAG q (X , P, G) := C L (X , P, G) | Fq = C L (X , P, G) ∩ F n q .
For SSAG codes, there is an obvious upper bound on the dimension, which is

dim Fq SSAG q (X , P, G) ≤ dim F q m C L (X , P, G) ,
coming from the fact that any basis of C L (X , P, G) over F q m remains free when restricted to the subfield F q . In general, it is hard to find the true dimension of an SSAG code, but a trivial estimate can be derived from Delsarte's theorem (Theorem 1.12):

dim Fq SSAG q (X , P, G) ≥ n -m dim F q m C Ω (X , P, G).
(1.9)

As for the minimum distance, it is at least the one of the AG code C L (X , P, G), hence bounded from below by the designed distance d * = n -deg(G). Additionally, the structure of AG codes may provide sharper bounds on the dimension of subfield subcodes of Ω-AG codes and trace codes of AG codes.

Theorem 1.85 ([Sti09, Theorem 9.1.6]). With above notation, let G 1 ∈ X be a divisor such that

G ≥ qG 1 and G ≥ G 1 .
(1.10)

Then dim Fq Tr F q m /Fq (C L (X , P, G)) ≤ m (ℓ(G) -ℓ(G 1 )) + 1 if G 1 ≥ 0, m (ℓ(G) -ℓ(G 1 )) if G 1 ̸ ≥ 0,
and

dim Fq C Ω (X , P, G)| Fq ≥ n -1 -m (ℓ(G) -ℓ(G 1 )) if G 1 ≥ 0, n -m (ℓ(G) -ℓ(G 1 )) if G 1 ̸ ≥ 0.
Remark 1.86. The biggest divisor (with respect to the degree) satisfying both conditions in Equation (1.10) is given by

G q := P ∈Supp(G + ) ν P (G + ) q P + P ∈Supp(G -) ν P (G -)P, (1.11)
where

G + and G -are effective divisors such that G = G + -G -.
With further hypotheses on G and G q , [LC16, Theorem 1] gives an exact formula for the dimension of such codes. Regarding the parameters of subfield subcodes of differential codes, Wirtz [START_REF] Wirtz | On the parameters of Goppa codes[END_REF] improved the bound on their the minimum distance.

Theorem 1.87 ([Wir88, Theorem 2]). With the same notation as in Theorem 1.85, assume that

deg(G 1 ) ≥ 2g -1. Set U := {P ∈ Supp(G) | ν P (G) ≥ 0 and ν P (G) = q -1 mod q} and G U = P ∈U P . Then dim Fq C Ω (X , P, G)| Fq = dim Fq C Ω (X , P, G + G U )| Fq , hence the minimum distance of C Ω (X , P, G)| Fq satisfies d C Ω (X , P, G)| Fq ≥ deg G + deg G U -2g + 2.
The next section is dedicated to a well-known class of AG codes, namely Generalized Reed-Solomon codes.

The family of Generalized Reed-Solomon codes

In the discussion below, we recall the definitions and some properties of Generalized Reed-Solomon (GRS) codes and their subfield subcodes. In the following, the dimension of a GRS is denoted by r, and our codes are still defined over the finite field F q m . Definition 1.88. Let x = (x 1 , . . . , x n ) ∈ F n q m be a vector with pairwise distinct entries and y = (y 1 , . . . , y n ) ∈ F n q m be a vector with nonzero entries. The [n, r] q m generalized Reed-Solomon code with support x and multiplier y is defined by

GRS r (x, y) = {(y 1 f (x 1 ), . . . , y n f (x n )) | P ∈ F q m [T ], deg f < r} .
It is clear that the Reed-Solomon code RS r introduced in Example 1.6 is a particular case of GRS code: in fact, taking x β = β, β 2 , . . . , β q m -1 where β is a generator of F * q m , we have

RS r = GRS r (x β , 1),
where 1 stands for the unit vector.

It is possible to represent any GRS code as an AG code defined over the projective line: in fact, let GRS r (x, y) be a GRS code as above. On the rational function field F q m (x), denote by P i the zero of x -x i , and consider the set of degree one places P = {P 1 , . . . , P n } ∈ P F q m (x) . Using Lagrange's interpolation, we can find a polynomial h ∈ F q m [T ] such that h(P i ) = y i for all i ∈ {1, . . . , n} and deg h < n.

Then GRS r (x, y) = C L (P 1 , P, (r -1)P ∞ + (h) F q m (x) ),
where P ∞ is the pole of x. From Theorem 1.82, Proposition 1.83 and the above discussion, we know that the dual of any GRS code is also a GRS code. More precisely, we have:

Proposition 1.89. Let x, y be a support and multiplier of length n and r ≤ n. Then

GRS r (x, y) ⊥ = GRS r (x, y ⊥ ), with
y ⊥ := 1 p ′ x (x 1 )y 1 , . . . , 1 p ′ x (x n )y n ,
where p ′ x is the derivative of the polynomial p x (T ) :

= n i=1 (T -x i ) ∈ F q m [T ].
Up to the dual operation, the subfield subcode of a GRS code is referred to as an alternant code.

Definition 1.90. With above notation, we define the alternant code over F q associated with the support x and multiplier y as A r,q (x, y) := GRS r (x, y) ⊥ |F q .

The integer r is called the order of the alternant code.

From Delsarte's theorem and by duality, we also have

A ⊥ r,q (x, y) = Tr F q m /Fq (GRS r (x, y)) .
There exists a subclass of alternant codes which is particularly attractive for cryptographic purposes:

Definition 1.91. Let x ∈ F n q m be a support vector and g ∈ F q m [T ] a univariate polynomial of degree r such that g(x i ) ̸ = 0 for every i ∈ {1, . . . , n}. Then the Goppa code of order r with support x and Goppa polynomial g is defined by

Γ r (x, g) = GRS r (x, y) ⊥ | Fq ,
where for any i ∈ {1, • • • , n} , y i := 1 g(xi) . The class of binary Goppa codes was the one considered by McEliece in his first proposal [START_REF] Mceliece | A public-key cryptosystem based on algebraic coding theory[END_REF]. They are interesting because when the Goppa polynomial is square-free, there exists a polynomial time algorithm that can correct up to r errors, where r is the order of the Goppa code (a discussion about decoding AG codes can be found in the next section). In Chapter 4, we will consider a generalization of these codes, called Goppa-like AG-codes, and study their behaviour under squaring their dual.

Decoding AG codes

In order to use AG codes in a cryptographic context, we need to know efficient decoding algorithms for this family of codes. Several of them are known, we refer the reader to the survey of Couvreur and Randriambololona [START_REF] Couvreur | Algebraic geometry codes and some applications[END_REF] for more details. An algorithm for general AG codes, called the basic algorithm [SV90, JLJ + 89], can correct up to half the designed distance minus some defect proportional to the genus of the curve, i.e. up to ⌊ d * -1-g 2 ⌋. For AG codes on planes curves, the modified algorithm [START_REF] Skorobogatov | On the decoding of algebraic-geometric codes[END_REF] can correct at most ⌊ d * -1 2 -g 4 ⌋ errors. Both these algorithms run in O(n 3 ) operations in the base field. Since then, a lot of work have been spend trying to remove the term due to the genus, focusing on specific codes:

In the case of one-point codes, Feng and Rao [START_REF] Liang | Decoding algebraic-geometric codes up to the designed minimum distance[END_REF], and later Sakata and al. [SJM + 95], proposed an algorithm which corrects

⌊ d * -1 2 ⌋ in complexity O(n 7
3 ). For the case of codes on maximal curves, Pellikaan [START_REF] Pellikaan | On a decoding algorithm for codes on maximal curves[END_REF] gives an algorithm which correct up to half the designed distance in O(n 4 ) operations over the base field. This particular case is interesting in this thesis as we are sometimes dealing with the Hermitian curve, which is known to be maximal.

All the improvements of the basic algorithm since the work of Feng and Rao get rid of the algebraic geometry point of view, introducing the notion of error correcting pairs, and allow to correct up to half the designed distance. For recent improvements in this area, see [START_REF] Couvreur | Power error locating pairs[END_REF].

Independently, Sudan [START_REF] Sudan | Decoding of Reed Solomon codes beyond the error-correction bound[END_REF] showed that, at the cost of possibly returning a list of codewords instead of a single one, it was possible to correct errors on Reed-Solomon codes beyond half the designed distance. A version of the so-called list decoding algorithm, valid for general AG codes, is proposed in [START_REF] Guruswami | Improved decoding of Reed-Solomon and algebraic-geometry codes[END_REF]. Recently, a efficient version has been proposed by Beelen, Rosenkilde, and Solomatov [START_REF] Beelen | Fast decoding of AG codes over C a,b curves[END_REF].

Chapter 2

Code-based cryptography 2.1 The McEliece encryption scheme and its security

Description of the scheme

The McEliece encryption scheme [START_REF] Mceliece | A public-key cryptosystem based on algebraic coding theory[END_REF] is the first encryption scheme based on error-correcting codes. It is a public key cryptosystem whose pair of keys are constructing from a certain family F of structured codes over a finite field F, for which an efficient decoding algorithm is known. The public key is then a random looking generator matrix of some code in F, while the secret key is the corresponding decoding algorithm. For short, the McEliece scheme can be presented as follows. Encryption:

The McEliece encryption scheme

Input: A message m ∈ F k .
1. Select a random error vector e ∈ F n such that w H (e) ≤ t. Output: The plaintext m.

There exists two kinds of attacks against the McEliece cryptosystem: message recovery attack and key recovery attack. The first one essentially consists in recovering a plaintext m from the knowledge of the cypher text y and the public key. Once done, the attacker knows the plaintext but not the private key D C , meaning that in order to recover several messages, the attack must be performed several times, hence the total cost becomes the sum of the cost of the attack on each cypher text. The second kind of attack, i.e. key recovery attacks, consists in retrieving the decoding algorithm D C of C from the knowledge of one of its generator matrix. In this case, once the attack is performed, the cost of recovering any message becomes the cost of the decoding algorithm, which works in polynomial time in the parameters n and k of the code.

In both cases, given a security parameter λ for the scheme, we say that there exists an efficient attack on the scheme if there exists a polynomial time algorithm (in n and k) which can recover either a plain message from a ciphertext or the secret key in less than 2 λ binary operations. The standard value for the security parameter is λ = 128, but a more realistic one would be around 80.

The security of the McEliece encryption scheme hence relies on both the choice of the family of codes F and the hardness of solving the syndrome decoding problem (SD). The SD problem does not depend on F and is related to the security of the message itself (i.e. message recovery attack). More precisely, recovering a plaintext m from the knowledge of its cipher text and a generator matrix of the code reduces to solve an instance of the SD problem. This will be discussed in Section 2.1.2. The choice of F influences the security of the secret key, which can lead to key recovery attack. In fact, we will see in Section 2.1.3 that for some family of codes which are too structured, there exist polynomial time algorithms that recover the secret key from the public one.

Message recovery attack and Information Set Decoding (ISD)

The general idea of security behind McEliece cryptosystem's relies on the hardness of decoding a linear code, a problem which is referred to as the Worst-Case Syndrome Decoding Problem, which can be stated as follows in its searching version: Problem 2. (Search) Worst-Case Syndrome Decoding Problem: Let H be a parity check matrix of a [n, k] code C over a finite field F. Let t be an integer and s ∈ F n-k be a uniformly random vector (called the syndrome). Then the (Worst-Case) Search Syndrome Decoding problem is to find a vector e ∈ F n of Hamming weight ≤ t such that He T = 0. This problem differs from the slightly easier Average-Case Syndrome Decoding Problem, in which H is also sampled uniformly at random. The decisional version of the worst-case scenario was proven to be NP-complete in [START_REF] Berlekamp | On the inherent intractability of certain coding problems[END_REF], and is related to the generic decoding problem of a linear code in the following way: let C be a [n, k] code over F, H one of its parity check matrix and t its correction capability. Consider a noisy vector y = c + e, with c ∈ C and e ∈ F n an error vector of Hamming weight ≤ t. Decoding the cipher text y consists in finding c without a priori knowledge of any decoding algorithm, and can be realized as follows. From the knowledge of H and the cipher text, we compute the syndrome s := Hy T . Note that s := Hy T = Hc T + He T = He T , meaning that the syndrome does only depend on the error vector. If we are able to solve Problem 2 with parameters (H, s, t), then we can decipher c = ye.

To secure the scheme, we need to chose the initial parameters such that the cost of solving Problem 2 is high enough. Apart from the brute force search among all possible error vectors of weight t, all known algorithms for solving the SD problem are generalization of the so-called Information Set Decoding (ISD), introduced by Prange in [START_REF] Prange | The use of information sets in decoding cyclic codes[END_REF]. The idea is to find a set of positions of the noisy vector which does not contain any errors, and such that the corresponding submatrix of the public generator matrix is invertible. Since its introduction in 1962, a lot of improvements of the ISD as been realized. We do not enter into further details here, we refer the reader to the survey of Peters [START_REF] Peters | Information-set decoding for linear codes over F q[END_REF] or more recently to the one of [START_REF] Weger | A survey on code-based cryptography[END_REF].

Key recovery attack

The complexity of a key recovery attack highly relies on the choice of the family of codes, and thus is hard to estimate in a general case. It consists in recovering the secret key (i.e. a decoding algorithm for the chosen code) knowing only a random looking generator matrix. Usually, this problem can be reduced to the following: given a generator matrix of a [n, k] code C, can we find the inherent structure that defines it, that is to say the secret elements that allow to build an efficient decoding algorithm. For example, this problem can be easy to solve if the family of code is not large enough, in which case a brute force search among all possible codes can be realized in less binary operations than imposed by the security level.

Historically, McEliece [START_REF] Mceliece | A public-key cryptosystem based on algebraic coding theory[END_REF] proposed to use binary classical Goppa codes. For his choices of cryptographic parameters, we do not know any efficient algorithm that can recover the corresponding support and Goppa polynomial; reason why this family of codes is still considered as secure at the moment. Note that the distinguisher given in [START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF] only works for high rate codes, which is out of range of McEliece initial parameters. A recent set of parameters has been proposed to the NIST's post-quantum cryptography standardization project [BCC + 22].

The major drawback is that these parameters impose to have huge key sizes, which makes it impracticable. Since 1978, several other families have been investigated to mitigate this problem, while keeping a good security level. In particular, a few proposals use structured codes (e.g. quasicyclic or quasi-dyadic codes). However, for some families, the key recovery problem is not hard. In the case of Generalized Reed-Solomon (GRS) codes, Sidelnikov and Shestakov proposed in [START_REF] Michilovich | On the insecurity of cryptosystem based on generalized Reed-Solomon codes[END_REF] a polynomial time algorithm that recovers the secret elements of the codes, by seeking for minimum weight codewords. As a natural geometric generalization, AG codes have been proposed [START_REF] Janwa | McEliece public key cryptosystems using algebraicgeometric codes[END_REF]: for codes defined over genus ≤ 2 curves, an attack was found by Faure and Minder [START_REF] Faure | Cryptanalysis of the McEliece cryptosystem over hyperelliptic curves[END_REF]. This attack cannot be extended to any AG code as its complexity is exponential in the genus. Later, Couvreur, Marquez-Corbella and Pellikaan [START_REF] Couvreur | Cryptanalysis of mceliece cryptosystem based on algebraic geometry codes and their subcodes[END_REF] broke any McEliece scheme based on AG code for arbitrary genus. Their attack (called attack by filtration) does not recover the secret structure of the code, but allows to build directly an efficient decoding algorithm.

In this thesis, we are mainly interested in SSAG codes, as there exists no key recovery attack on them yet. In this case, the key security reduces to find the curve, support and divisor from which the code is defined. More precisely, in SSAG code-based McEliece cryptosystem, the idea is to check if the knowledge of a generator matrix of SSAG q (X , P, G) allows to find the triple (X , P, G). We will focus on two kinds of cryptosystems:

1. Quasi-cyclic SSAG-based McEliece cryptosystems (see Chapter 3), in which case we show that the key security reduces to the security of a subcode of the public code: the invariant code.

2. Systems based on one-point Goppa-like AG codes defined over a C a,b curve, which are defined in Chapter 4. In this case, we show that using square codes considerations allows to build a distinguisher on the public code. More precisely, given a random looking matrix, we are able to determine if it comes from a one-point Goppa-like code or not, which means that the secret structure is not hidden enough. This work generalizes the distinguisher proposed in [START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF] in the case of alternant and classical Goppa codes. However, we point out that it seems difficult to turn the distinguisher into an efficient structural attack.

IOP of Proximity to a linear code

In this section, we give some context in the domain of proximity test to an AG code, by recalling some definition and known properties about proofs systems. This will be useful in Chapter 5, where we define Interactive Oracle Proofs of Proximity to AG codes (AG-IOPP system). The case of proximity tests to Reed-Solomon codes, known as the FRI protocol, is detailed in Section 2.2.3.

Interactive oracle proof (IOPs)

We start by defining a specific proof system that has quite recently emerged in cryptography: Interactive Oracle Proofs (IOPs in short) (see [START_REF] Ben-Sasson | Interactive Oracle Proofs[END_REF] for further explanations). This model has demonstrated to be particularly promising for the design of proof systems in the past few years. IOPs are proof systems that naturally combines interactive proofs (IPs) and probabilistically checkable proofs (PCPs), and generalize interactive PCP protocols (which consist of a PCP followed by an IP). Hence, we start by recalling these alternative models of proof systems.

Interactive proofs (IPs). Interactive proofs were introduced by Goldwasser, Micali and Rackoff [START_REF] Goldwasser | The knowledge complexity of interactive proof systems[END_REF]: it consists in a r-round interactive proof between a probabilistic polynomial-time verifier and an all-powerful prover. During this interaction, r messages are exchanged, and the protocol ends with the response of the verifier, which either accepts or rejects the proof proposed by the prover. An IP is said to be public-coin if all the verifier's messages are chosen uniformly and independently at random (such a system is also called an Arthur-Merlin game [START_REF] Babai | Trading group theory for randomness[END_REF]). Since 1992, it is well-known that any IOP can be turned into an Arthur-Merlin game via the Fiat-Shamir transform [START_REF] Shamir | IP = PSPACE[END_REF].

Probabilistically checkable proofs (PCPs). Probabilistically checkable proofs were introduced by [ALM + 98, BFLS91, AS92]: roughly speaking, in a PCP system, a probabilistic polynomial-time verifier has oracle access to a proof string of length at most 2 u that uses at most u bits of randomness, and queries at most q locations of the proof before accepting or rejecting it.

Interactive Oracle Proofs (IOPs). An Interactive Oracle Proof (IOP) is a "multi-round PCP" in which the verifier has oracle access to the prover's messages, and may probabilistically query them (rather than having to read them in full). In more details, during each of the r rounds, the verifier sends a challenge c to the prover, which he reads in full, before replying with a message f . The verifier can then query to f as an oracle string. After the r rounds, the verifier either accepts or rejects the proof.

The efficiency in the IOP model is expressed in terms of the proof length (total number of bits in all the prover's messages), the query complexity (total number of locations queried by the verifier across all prover's messages) and the round complexity r (total number of rounds).

Proximity testing to an evaluation code

To construct a proof system for a non-deterministic binary relation R, arithmetization techniques (introduced in [LFKN90]) transform any instance-witness (x, w) into a word that belongs to a certain error-correcting code C if (x, w) ∈ R, and is very far from C otherwise. This motivates a new proof system, namely public-coin IOP of proximity (IOPP) to a linear code C.

To specify our definition, we consider a finite field F and some evaluation code C ⊆ F S with evaluation domain S of size n over the alphabet F. An IOPP (P,V) for the code C is a pair of randomized algorithms, where both P (the prover) and V (the verifier) receive as explicit input the specification of the code C ⊆ F S . We define the input size to be the integer n = |S|. Furthermore, a purported codeword f : S → F is given as explicit input to P and as an oracle to V. The two parties interact over at most r = r(n) rounds and, during this conversation, P seeks to convince V that f belongs to the code C. More precisely, at each round, V sends a message chosen uniformly and independently at random, and P answers with an oracle. Verifier's queries to the prover's message are generated by public randomness and performed after the end of the interaction with the prover. Thus, this proof system is a public-coin protocol, as defined above.

We define the Hamming relative distance between f and the code C by

∆(f, C) := min {d H (f, c) | c ∈ C} .
The output of V after interacting with P is denoted by ⟨P ↔ V⟩ ∈ {accept, reject}. Finally, the notation V f means that f is given as an oracle input to V.

Definition 2.1. A pair of randomized algorithms (P,V) is an IOPP system for the code C ⊆ F n with soundness error s : (0, 1] → [0, 1] if the following conditions hold:

1) Perfect completeness: If f ∈ C, then Pr P(C, f ) ↔ V f (C) = accept = 1,
i.e. if f is in fact a codeword of C, then the verifier accepts the proof with probability one.

2) Soundness: For any function f : S → F such that δ := ∆(f, C) > 0 and any malicious prover P * , we have

Pr P * ↔ V f (C) = accept ≤ s(δ),
i.e. if f / ∈ C, a cheating prover can only convince the verifier with low probability.

The efficiency of an IOPP system is expressed in terms of several parameters: the sum of lengths of prover's messages defines the proof length ℓ(n), expressed in number of symbols in the alphabet F. The query complexity q(n) is the total number of queries made by the verifier to both the purported codeword f and the oracle sent by the prover during the interaction. The prover complexity t p (n) is the time needed to generate prover's messages (which does not include the input f ) and the verifier complexity t v (n) is the time spent by the verifier to make his decision when queries and query-answers are given as inputs.

The FRI protocol

The IOPP construction described in the previous section has been applied in the case where C is a RS code, and is referred to as the Fast Reed-Solomon IOPP (FRI in short, see [START_REF] Ben-Sasson | Worst-case to average case reductions for the distance to a code[END_REF] for a complete presentation). As we aim to consider an IOPP for general AG codes, we explain how the FRI protocol works below.

Let k be a positive integer and ρ ∈ (0, 1) such that ρ := 2 -k . The FRI protocol allows to check proximity to a Reed-Solomon code of length n = |P|, say

RS(P, ρ) := {f : P → F | deg(f ) < ρn} ,
by testing proximity to a smaller code RS(P ′ , ρ) with |P ′ | < n = |P|. To do so, the protocol considers a family of linear maps F P → F P ′ which randomly fold any function in F P into a function in F P ′ . We present below in a simplified way three ingredients that enable the protocol to work.

1. Splitting of polynomials into even and odd part. Given an univariate polynomial f ∈ F[x] such that deg(f ) < ρn, there exists two polynomials g, h of degree both < 1 2 ρn such that

f (x) = g(x 2 ) + xh(x 2 ).
(2.1)

One may view such a decomposition as the result of the splitting of the space of polynomials of degree less than ρn into two copies of the space of polynomials of degree less than ρn/2.

2. Randomized folding. Choose P to be a multiplicative group of order 2 r generated by ω ∈ F. Then, define P ′ = ω 2 = x 2 | x ∈ P . Set π : F → F to be the map defined by π(x) = x 2 and observe that π(P) = P ′ . Moreover, |P ′ | = |P|/2. The structure of the evaluation domain allows to reduce the proximity problem by half the size at each round of iteration. Based on the decomposition (2.1), we define the folding operator Fold[•, z] : F P → F P ′ for any z ∈ F as follows:

Fold[f, z] := g(x) + zh(x).
If deg(f ) < ρn, both functions g : P ′ → F and h : P ′ → F belong to the smaller code RS(P ′ , ρ).

Then for any random challenge z ∈ F, the operator Fold[•, z] maps RS(P, ρ) into RS(P ′ , ρ).

3. Distance preservation after folding. Except with small probability over z, if ∆(f, RS(P, ρ)) ≥ δ, then ∆ (Fold[f, z], RS(P ′ , ρ)) ≥ (1 -o(1))δ.

The FRI protocol goes as follow: the verifier sends a random challenge z ∈ F and the prover answers with an oracle function f ′ : P ′ → F, which is expected to be equal to the folded function Fold[f, z] : P ′ → F. At the next round, f ′ becomes the function to be folded, and the process is repeated for r rounds. Each round reduces the problem by half (i.e. the size of the evaluation domain), eventually leading to a function f (r) evaluated over a small enough set of points. This induces a sequence of Reed-Solomon codes of strictly decreasing length, while the code rate remains unchanged (and so does the relative minimum distance). The final test consists in testing if f (r) belongs to the last RS code.

Perfect completeness of the protocol follows from 2. Prover and verifier efficiencies come from the possibility of determining any value of Fold[f, z] at any point y ∈ P ′ with exactly two values of f , namely on the set π -1 ({y}) (i.e. the square roots of y). Hence, a consistency test between f and f ′ only requires two queries to f and one to f ′ . Soundness of the protocol mainly relies on item 3. It is proved using results about distance preservation under random linear combinations. Based on that, we can deduce that if the folded function Fold[f, z] is close to C for enough values of z, then it remains true for both g and h (defined in Equation (2.1)). Details about this can be found in [BBHR18, BKS18, BGKS20, BCI + 20].

Remark 2.2. Note that 3; above holds because both polynomials g and h appearing in the decomposition (2.1) have exactly the same degree, arising from the crucial fact that the FRI protocol only considers RS codes of dimension a power of two, meaning that the considered polynomials have degree at most an odd bound.

Let us sketch what could happens when f is expected to have degree at most an even integer, say 2d. According to Equation (2.1), we have deg(g) ≤ d and deg(h) ≤ d -1. Therefore, if deg(f ) ≤ 2d, then g + zh corresponds to a polynomial of degree ≤ d. However, knowing that g + zh has degree ≤ d with high probability on z ∈ F only tells us that both g and h have degree ≤ d, which is not enough to deduce that deg(f ) ≤ 2d and not 2d + 1. Even worse, it is worth noting that words corresponding to a degree 2d + 1 polynomial are among the farthest words from the RS code of degree ≤ 2d. In the univariate case, the obstacle can be overcome by supposing not only deg(g), deg(h) ≤ d but also deg(νh) ≤ d for a degree 1 polynomial function ν, called balancing function. This implies deg(h) < d and hence deg(f ) ≤ 2d. This will be really important in order to generalize this protocol to AG codes since we will have to deal with the same issue.

Chapter 3

Structural attack against quasi-cyclic SSAG codes

After several attempts in trying to replace the family of binary Goppa codes by AG codes, the natural generalization of Reed-Solomon codes, in the McEliece encryption scheme, an attack for AG codes defined on any genus curve is now known [START_REF] Couvreur | Cryptanalysis of mceliece cryptosystem based on algebraic geometry codes and their subcodes[END_REF]. However, the scheme based on SSAG codes is still unbroken, hence considering structured (e.g. quasi-cyclic) SSAG codes in order to reduce key sizes is still promising. In the present chapter, we focus on this family of codes and make some progress in the direction of structural attacks. More precisely, we show that the security of the public quasi-cyclic SSAG code reduces to the security of its invariant code (see Definition 1.15). Since the invariant code can be derived from the public data and has smaller parameters, cautions should be made while considering such cryptosystems. This work can be seen as an extension of Chapter 5 of Barelli's PhD memoir [START_REF] Barelli | On the security of short McEliece keys from algebraic and algebraic geometry codes with automorphisms[END_REF], as her method is generalized in order to be applied in more general setting.

For the whole chapter, we consider a Galois cover π : Y → X of smooth and irreducible projective curves over the finite field F q m . This corresponds (via Theorem 1.35) to a Galois extension of function fields L/K, where L = F q m (Y) and K = F q m (X ). Note that our AG and SSAG codes will first be defined over the curve Y, while the corresponding invariant subcodes lie on the quotient curve X .

The chapter is organized as follows. In Section 3.1, we define structured AG codes and give some properties of their invariant code. Next, we present the general idea to recover the equation of a Galois cover of curves in Section 3.2. Section 3.3 is dedicated to concrete instances of our attack: after giving properties required for the quotient curve, we focus on Kummer coverings and elementary abelian p-extensions. We finish the Chapter by discussing how our attack could be generalized to a solvable Galois cover in Section 3.4.

Preliminaries

Structured AG codes

By structured codes, we mean codes with a non trivial permutation group (Definition 1.14), coming from the underlying geometry. We now explain how to obtain such codes, starting from the geometry of the curve: to fix notation, consider an AG code

C := C L (Y, Q, G)
defined on the curve Y, where Q is a set of n distinct rational points which does not intersect the support of some divisor G ∈ Div(Y) and assume as usual that deg(G) < n. Let Aut(Y/F q m ) be the automorphism group of Y over F q m , acting on the left. Thanks to Theorem 1.35, we can identify Aut(L/F q m ) with Aut(Y/F q m ), acting on L on the right: for σ ∈ Aut(L/F q m ) ≃ Aut(Y/F q m ) and f ∈ L, we set f σ := σ * f = f • σ. Now consider a finite subgroup Σ ⊆ Aut(Y/F q m ), and assume that Q and G are invariant under Σ; observe that this means precisely that Q is a union, and G a sum, of orbits under Σ. Since G is invariant, Σ also acts on the Riemann-Roch space L(G). As n > deg(G), the isomorphism

ev Q : L(G) → C
sends this action to the AG code. Each σ ∈ Σ acts by

c = (f (Q 1 ), . . . , f (Q n )) → c σ := ev Q (f σ ) = (σ * f (Q 1 ), . . . , σ * f (Q n )) = (f (σ -1 (Q 1 )), . . . , f (σ -1 (Q n )))
As Q is also Σ-invariant, the set σ -1 (Q 1 ), . . . , σ -1 (Q n ) is a permutation of Q, and the above action on C permutes the corresponding coordinates. We denote this permutation by σ, meaning that for every 1 ≤ i ≤ n, we have Q σ(i) = σ -1 (Q i ). As σ ranges in Σ, these σ form a subgroup Σ of the permutation group Perm(C), acting on the right.

It is clear that any permutation automorphism of a linear code stabilizes its subfield subcodes. Hence, given a subgroup Σ ⊆ Aut(Y/F q m ), and assuming Q and G to be invariant under Σ as above, we also get a subgroup Σ SSAG of Perm(SSAG q (Y, Q, G)), acting on the right. Note that Σ SSAG is nothing but Σ restricted to the subfield subcode. Later on we will occasionally abuse notation and write σ for σ, and Σ for Σ or Σ SSAG , whenever it is clear from the context.

Since we know how to construct AG and SSAG codes that are invariant under some automorphism subgroup, we focus on the properties of the corresponding invariant code.

The invariant code

Fix an AG code

C := C L (Y, Q, G)
as in the previous section, and let Σ ⊆ Aut(Y/F q m ) be an automorphism subgroup. In the discussion below, we show that if C is Σ-invariant, its (punctured) invariant subcode C Σ (see. Definition 1.15) is also an AG code, defined on the quotient curve Y/Σ, whose function field is the fixed field K := L Σ . We start with the following lemma:

Lemma 3.1. With above notation, assume that Q and G are invariant under an automorphism

σ ∈ Aut(Y/F q m ). If a codeword c = ev Q (f ) ∈ C L (Y, Q, G) is σ-invariant, i.e if c σ = c, then f σ = f . Proof. Write Q = {Q 1 , ..., Q n }. We have 0 = c σ -c = ev Q (f σ -f ), hence f σ -f admits at least n zeroes Q 1 , . . . , Q n . Since G is σ-invariant, f σ ∈ L(G), thus f σ -f ∈ L(G). As n > deg(G), this imposes f σ -f = 0.
Our next definition will play a crucial while considering invariant codes.

Definition 3.2. Consider an extension L/K of function fields, corresponding to a morphism of curves π : Y → X . Given a divisor G ∈ Div(L), we define its pushforward G as the largest divisor in K such that π * G ≤ G.

Remark 3.3. We warn the reader that our definition of pushforward differs from the one usually used in the literature, and denoted by π * G. We will encounter the latter terminology later, in Chapter 5.

Since our definition notion will be widely used thought this chapter, we made the choice to give it a name, which fits well as it is in some sense a "dual" operation of pullback.

The properties of pushforwards are put together in the upcoming result.

Lemma 3.4. With notation as above:

(i) L L (G) ∩ K = L K ( G). (ii) if we write G = S∈P L t S S
for integers t S almost all of which are 0, then

G = R∈P K min S|R t S e(S|R)
R.

PRELIMINARIES

(iii) we have Supp( G) ⊆ π(Supp(G)).

(iv) for G 1 , G 2 ∈ Div(L), we have

(G 1 + G 2 ) ≥ G 1 + G 2 (v) if A ∈ Div(K), then π * A = A.
Proof. (i) Given h ∈ K we have (h) L = π * (h) K , and thus we have

h ∈ L L (G) iff π * (h) K ≥ -G.
But by Definition 3.2 this means precisely (h

) K ≥ -G, i.e. h ∈ L K ( G). (ii) If G = R∈P K x R R, then π * G = R∈P K S|R
x R e(S|R)S,

and so π * G ≤ G if and only if x R ≤ t S e(S|R)
for all R ∈ P K and all S|R. Then G is maximal when all x R are maximal under this condition, which means precisely

x R = min S|R t S e(S|R)
.

The remaining results are consequences of (ii).

When L/K is a Galois extension, the above lemma can be precised when talking about invariant divisor: Proposition 3.5. Let L/K be a Galois extension of function fields, with Galois group Σ, and let G ∈ Div(L) be a Σ-invariant divisor. Then:

(i) L L (G) Σ = L K ( G)
(ii) if we write G as a sum of orbits under Σ, i.e.

G = s i=1 t i Q∈OrbΣ(Si)
Q for places S 1 , ..., S s ∈ P L nonconjugate under Σ and integers t i ∈ Z\{0}, then

G = s i=1 t i e(S i |R i ) R i , where R i = S i ∩ K ∈ P K . Proof. (i) Since L L (G) Σ = L L (G) ∩ L Σ = L L (G) ∩ K,
this is a special case of (i) in the previous Lemma.

(ii) Observing that G is Σ-invariant and that e(Q|R i ) = e(S i |R i ) for all Q ∈ Orb Σ (S i ), this is again a special case of (ii) in the previous Lemma.

Theorem 3.6. Let C := C L (Y, Q, G) be an AG code defined on a curve Y over F q m , with Q and G invariant under the action of Σ ⊆ Aut(Y/F q m ). Then its invariant code under Σ is also an AG code, defined on the quotient curve Y/Σ. In particular, we have

C Σ = C L (Y/Σ, P, G),
where G is given by Proposition 3.5, (ii) and

P = {Q ∩ L Σ , Q ∈ Q}.
Proof. Consequence of Lemma 3.1 and Proposition 3.5.

Remark 3.7. The invariant and subfield subcode operations commute: more precisely, for any linear code C ⊆ F n q m and Σ a subgroup of its permutation group, we have

(C ∩ F n q ) Σ = {c ∈ C | c ∈ F n q and σ(c) = c , ∀σ ∈ Σ} = C Σ ∩ F n q .
Corollary 3.8. With notation of Theorem 3.6, we have

SSAG q (Y, Q, G) Σ = SSAG q Y/Σ, P, G .
Proof. Consequence of Theorem 3.6 and Remark 3.7.

Finding the equation of a Galois cover

While considering a structured SSAG code SSAG q (Y, Q, G) as public key for the McEliece cryptosystem, showing that the secret structure of the public code can be recovered from the invariant code consists in assuming that the geometric structure of the invariant code is known, then use it to find the secret data. More precisely, the crucial step is to recover an equation for the curve Y. In this section, we provide the general idea to do so.

Setting

Let us consider a Galois cover π : Y -→ X between curves over F q m , with Galois group Σ. It corresponds to a Galois extension of function fields L/K, where K = F q m (X ), L = F q m (Y) and such that Σ = Gal(L/K) (i.e. X = Y/Σ is the corresponding quotient curve). In particular, there exists a primitive element y ∈ L such that L = K(y) and H(y) = 0 , where H ∈ K[T ] irreducible polynomial.

By an equation of Y over X , we mean the minimal polynomial H of such a y over K. Denote by ℓ = [L : K] = |Σ| the degree of the extension, and suppose we are given a set of r rational points on X , say P = {P 1 , ..., P r }, that totally split in the cover Y → X . For any 1 ≤ i ≤ r, we then have

π * P i = Q i,1 + ... + Q i,ℓ ,
where Q i,j |P i . In particular, it means that for all 1 ≤ i ≤ r,

Orb Σ (Q i,1 ) = {Q i,1 , ..., Q i,ℓ }.
We denote by Q = {Q i,j | 1 ≤ i ≤ r and 1 ≤ j ≤ ℓ} the set of all extensions of the P i 's in L.

Let G ∈ Div(L) be a Σ-invariant divisor such that Supp(G) ∩ Q = ∅ and deg(G) < n := ℓr. Denote by G ∈ Div(K) its pushforward (with respect to Definition 3.2), which satisfies Supp( G)∩P = ∅. The AG code C L (Y, Q, G) then admits C L (X , P, G) as its invariant subcode under the action of Σ, and likewise the SSAG-code

C := SSAG q (Y, Q, G)
admits C Σ = SSAG q X , P, G as its invariant subcode. Hence, considering C as public code in a

McEliece encryption scheme, we aim to recover its geometric structure from the knowledge of C Σ .

To do so, we make the following assumptions:

A1. We know a generator matrix M ∈ M k,n (F q m ) of the SSAG code C, where k := dim Fq C.

A2. We know the permutation subgroup Σ SSAG ⊆ Perm(C) induced by Σ.

A3. We know the underlying geometric structure of the invariant subcode C Σ , i.e. we know the quotient curve X or equivalently its function field K, the finite set of places P in K, and the invariant divisor G ∈ Div(K).

As our aim is to recover an equation of Y over X , we describe below the general principles of our method that allows to do so, at least under a further assumption that will be given later. Observe first that, as a consequence of A2 and A3, we know the degree ℓ of the cover, and for any place P i ∈ P, we know the coordinate positions of C corresponding to the ℓ extensions Q i,j of P i in Q. As justified by the following proposition, the main ingredient of our method will be to find the evaluation vector y = (y(Q i,j )) i,j of length n = ℓr, for some primitive element y ∈ L satisfying certain degree conditions. Proposition 3.9. Let y be a primitive element of L over K (i.e. L = K(y)), and

H(T ) = T ℓ + h ℓ-1 T ℓ-1 + • • • + h 1 T + h 0 ∈ K[T ]
be its minimal polynomial. For each k ∈ {0, . . . , ℓ -1}, assume that either:

• we know a priori some divisor D k ∈ Div(K), of degree deg(D k ) < r, such that h k ∈ L K (D k );

or:

• the support of (h k ) K ∞ is unknown, but we know that it has degree deg(h k ) K ∞ < r/2. Then the polynomial H(T ) is entirely determined by the evaluation vector y = (y(Q i,j )) i,j .

Proof. By Galois theory, the roots of H are y σ1 , . . . , y σ ℓ , where Σ = {σ 1 , . . . , σ ℓ }; and so for each k we have

h k = (-1) ℓ-k s ℓ-k (y σ1 , . . . , y σ ℓ )
where s ℓ-k stands for the degree ℓ -k elementary symmetric polynomial. Evaluating at Q i,j , we deduce h k (P i ) = (-1) ℓ-k s ℓ-k (y(Q i,1 ), . . . , y(Q i,ℓ )), for all i ∈ {1, . . . , r}.

(3.1)

Now it suffices to show that Equation (3.1) entirely determines h k .

In the case that

h k ∈ L K (D k ) for a known D k of degree deg(D k ) < r, let h ′ k ∈ L K (D k ) be another solution of (3.1). Then h k -h ′ k ∈ L K (D k ), but h k -h ′ k has at least r zeroes, hence h k -h ′ k = 0. If we only know that deg(h k ) K ∞ < r/2, let h ′ k be another solution of (3.1) with deg(h ′ k ) K ∞ < r/2, and set D k = (h k ) K ∞ + (h ′ k ) K ∞ , so deg(D k ) < r. Then again we have h k -h ′ k ∈ L K (D k ), but h k -h ′ k
has at least r zeroes, hence h k -h ′ k = 0. Note that finding H from y reduces to an interpolation problem: find the h k knowing their values h k (P i ). Ultimately, this boils down to solving a linear system. Proposition 3.9 asserts that the system will have a unique solution provided the cover Y over X can be defined by an equation H whose coefficients h k are small enough compared to the length n of C. However, the algorithmic complexity of writing down this linear system depends on the geometry: in case h k ∈ L K (D k ) for a known D k , we face a generalization to X of the Lagrange interpolation problem. In case we only have control on the degree of (h k ) K ∞ , we are in front of a generalized rational function reconstruction problem. The study of these interpolation problems on arbitrary curves is still an area of active research. Efficient algorithms are known for curves of genus 0, and ad hoc methods could be devised for specific instances.

Finding the evaluation vector

Now we focus on the task of finding a suitable evaluation vector y. For this we make a fourth assumption: A4. We know an effective divisor B ∈ Div(K) such that the Riemann-Roch space L L (π * B) contains a primitive element y for L over K.

Moreover we will request that this B ≥ 0 is not too large, in a sense that will appear clearer later. Remark 3.10. We observe that the assumption A4 is closely related to the conditions in Proposition 3.9. Indeed, if y ∈ L L (π * B), then also y σ ∈ L L (π * B) for each conjugate y σ , from which it follows h k = (-1) ℓ-k s ℓ-k (y σ1 , . . . , y σ ℓ ) ∈ L K ((ℓ -k)B), i.e. we can take D k = (ℓ -k)B. Conversely, if we know the D k , then we can find a B using the theory of Newton polygons. However, it might be that in some instances, we have additional information either on B or on the (h k ) K ∞ . Regarding Proposition 3.9, we also need to be able to compute Riemann-Roch spaces on X , especially those associated to the D ′ k s, reason why we keep assumption A4 and the conditions in the proposition separate, in order to allow more flexibility.

For instance, suppose we have some a priori information that allows us to know (y) L ∞ perfectly. It is then easily checked that we can take B = -(-(y) L ∞ ), and actually this will be the optimal (i.e. the smallest) choice. More precisely, while considering applications in Section 3.3, the divisor (y) L ∞ will be a multiple of the unique point at infinity in the extension, hence all the Riemann-Roch spaces on K we need to compute will be known. Notation 3.11. For the rest of the chapter, we adopt the following notation: given any set S of rational points on a curve Y with function field L, we denote by D S the divisor in Div(L) which is defined as the sum of all places in S, i.e. D S := P ∈S P. Now, we make use of the specific structure of algebraic geometry codes: first, as subfield subcode, we have

SSAG q (Y, Q, G) ⊆ C L (Y, Q, G), hence C L (Y, Q, G) ⊥ ⊆ SSAG q (Y, Q, G) ⊥ ⊗ F q m .
Then, from Proposition 1.83, there exists a differential ω ∈ Ω L such that

C L (Y, Q, G) ⊥ = C L Y, Q, G ⊥ • Z ω , (3.2)
where G ⊥ = D Q -G + (ω) L , ν Qi,j (ω) = -1 for all Q i,j ∈ Q and Z ω is the diagonal matrix of length n = ℓr whose coefficient are (Res ω (Q)) Q∈Q . For all g ∈ L L (G ⊥ ), we then have

M • Z ω • ev Q (g) T = 0, (3.3)
where M is a generator matrix of SSAG q (Y, Q, G), seen as a matrix over F q m by scalar extension.

At this step, we could be tempted to use a differential ω ∈ Ω L such that Z ω is the identity matrix (see. Theorem 1.82) as it would clearly simplify Equation (3.3), but we actually have no reason to know this differential explicitly, since L is unknown. More precisely, the trickiest part is to find some explicit differential (i.e. in terms of known data) whose valuation at any place in the unknown support Q equals -1. Among these differentials, if we manage to find one such that the divisor G ⊥ is not to complicated, we can use Equation (3.3) to find y. Lemma 3.12. With above notation, set

F := L K ( G ⊥ -B) where B ∈ Div(K) is defined in Assumption A4. Then F ⊆ L K ( G ⊥ )
and for all y ∈ L L (π * B) we have

π * F • y ⊆ L L (G ⊥ ).
Proof. The first assertion comes from the fact that B is effective. As for the second, observe that for g ∈ F and y ∈ L L (π * B) we have

(π * g • y) L = π * (g) K + (y) L ≥ π * (-( G ⊥ -B)) -π * B = -π * G ⊥ ≥ -G ⊥ .
Let g 1 , ..., g s be a basis of F over F q m . For any 1 ≤ k ≤ s, consider the evaluation vector

u k := (π * g k (Q 1,1 ), . . . , π * g k (Q 1,ℓ ), . . . , π * g k (Q r,1 ), . . . , π * g k (Q r,ℓ ))
and denote by

D k := Diag(u k )
the corresponding diagonal matrix of length n. Equation (3.3) can then be rewritten as a linear system:

Proposition 3.13. We consider the vector z ω := Res ω (Q i,j )) i,j , where ω ∈ Ω L satisfies Equation (3.3). For any y ∈ L L (π * B) with associated evaluation vector y = (y(Q i,j )) i,j , we have

     M • D 1 • (z ω ⋆ y) T = 0 . . . M • D s • (z ω ⋆ y) T = 0, (3.4)
which gives a set of ks equations of which z ω ⋆ y is solution, where k = dim Fq C.

Proof. For all k ∈ {1, . . . , s}, Lemma 3.12 gives

π * g k • y ∈ L L (G ⊥ ).
Evaluating at the places Q i,j 's yields

u k ⋆ y ∈ C L (Y, Q, G ⊥ ). Since Z ω • C L (Y, Q, G ⊥ ) ⊆ SSAG q (Y, Q, G) ⊥ , we finally get M • D k • (z ω ⋆ y) T = 0,
which gives the desired result.

Remark 3.14. Depending on the quotient curve X , it may be hard to find the exact divisor G ⊥ , especially if its support is hard to explicit. For this reason, we might in concrete instances use another divisor D ∈ Div(K) such that

• D ≤ G ⊥ ;
• G ⊥ -D has small degree and

• D can be explicitly computed from our hypotheses.

Note that Lemma 3.12 (and thus the system (3.4)) still holds by replacing G ⊥ with such a D. We point out that several computations realized on Magma [START_REF] Bosma | The Magma algebra system. I. The user language[END_REF] show that the system (3.4) usually does not have a unique solution. Thankfully, we can add other equations that are only satisfied by the vector we are searching, making use of the action of the automorphism acting on Q, leaving it invariant. We will come back at this step later in concrete instances. Moreover, depending on the context, the residue vector z ω might be known from our hypothesis and choice of differential. Otherwise, solving the system (3.4) only allows us to recover the product vector z ω ⋆ y.

Isolating the desired vector. If z ω is unknown, we have to isolate y from the product z ω ⋆ y.

To do so, we can build another linear system by changing slightly the space F defined in Lemma 3.12, so that z ω ⋆ y 2 is a solution of it.

Lemma 3.15. Let B = -(-(y 2 ) L ∞ ) and set F ′ := L K ( G ⊥ -B ′ ). Then F ′ ⊆ L K ( G ⊥ ) and π * F • y 2 ⊆ L L (G ⊥ ).
Proof. Similar to the proof of Lemma 3.12.

Repeating the same process as above (using this time a basis of the space F ′ ), we can recover z ω ⋆ y 2 . As any component of z ω is non zero, we conclude by computing

y = (z ω ⋆ y 2 ) ⋆ (z ω ⋆ y) -1 .
Finishing the attack. To complete the security reduction, we make use of Proposition 3.9 to recover a defining equation of the cover, hence finding a projection morphism π and the minimal polynomial H ∈ K[T ] of a primitive element y of L over K. From this, we can also rebuild the divisor G := π * G using Kummer's theorem or its corollary ([Sti09, Theorem 3.3.7 and Corollary 3.3.8]). Having now recovered the whole structure of the public SSAG code, this proves that under our assumptions, the security of the scheme reduces to the security of the invariant code.

Recap. Let us end up this somewhat formal section by summing up what is left to be precised in concrete instances, in preparation for the next section.

• How to chose the divisor B ? As discussed in Remark 3.10, we will only consider extensions where the divisor (y) L ∞ is perfectly known, in which case we can take B = -(-(y) L ∞ ). This is in some sense the easiest case but it still provides some interesting results.

• How can we make a smart choice for the differential ω ∈ Ω L satisfying Equation (3.3) ? The ideal candidate is a differential satisfying

∀Q i,j ∈ Q , ν Qi,j (ω) = -1, (3.5)
while having a divisor which is as simple as possible (i.e. supported by only a few points).

Since Ω L is a one dimensional vector space over L (see Proposition 1.63, 2 ), it implies a suitable choice of some function h ∈ L such that ω = hdx (where x is a separating element of L over F q m ). In concrete instances, this can be done by studying the different divisor of L/F q m (x).

• How to ensure that z ω ⋆ y is the unique solution of the System (3.4) ? In Sections 3.3.2 and 3.3.3, we focus on extensions L/K which are cyclic generated by σ, in which cases the action on the public SSAG code is uniquely determined by the image σ(y) of the primitive element y under σ. In particular, this means that each orbit of the unknown vector y has a specific structure (if σ(y) is known, the full orbit can be recovered from only one entry). Our plan is to use this additional structure to add more equations to the system we have to solve, hopping to reduce the number of solutions.

Applications

In this section, we present our attack in concrete instances of a cyclic extension of function fields, which can be either a Kummer extension or an elementary abelian p-extension, depending whether the degree of the cover is prime to the characteristic of the base field or not. First, we give sufficient conditions on the quotient curve X to make the attack possible.

About the quotient curve

Below, we define a general class of curves that satisfy two properties, needed to enable our attack whenever the quotient curve X is in this class.

Definition 3.16. We denote by B the set of pairs (X , P ∞ ), where X is a smooth and irreducible projective curve over F q m equipped with a point P ∞ ∈ X (F q m ) such that:

1. There exists a morphism X → P 1 which is totally ramified at infinity, and hence P ∞ is the unique point at infinity in X .

2. There exists a function h ∈ K := F q m (X ) such that

(h • dx) K = (2g(X ) -2) • P ∞ , (3.6)
where x is a separating element of K over

F q m .
If α is a primitive element of K over the rational function field F q m (x), then the first property ensures that the divisor (α) K ∞ is a multiple of P ∞ , which will helps in choosing the divisor B. The second will be useful to find a good differential that satisfies Equation (3.2). A fairly large class of curves that satisfy both conditions of Definition 3.16 is the class of C a,b curves (see Section 1.2.5): in fact,

• it has a unique point at infinity P ∞ , since a and b are relatively prime,

• for any canonical divisor W on a C a,b curve, W ∼ (2g a,b -2)P ∞ (see [BESP10, Proposition 4.1]).
Note also that under technical assumptions, Kummer and Artin-Schreier curves can be seen as C a,b curves. In the upcoming sections, we apply our attack in the case where L/K is a Kummer extension (Section 3.3.2) or an elementary abelian p-extension (Section 3.3.3) of a curve X which is in the class B.

Kummer covering

Setting. Let (X , P ∞ ) ∈ B be a curve satisfying both properties of Definition 3.16, K = F q m (X ) and denote by a = [K : F q m (x)]. If ∞ is the point at infinity in the rational function field, we have P ∞ |∞ and e(P ∞ |∞) = a. Given an integer ℓ (not necessarily a prime) such that gcd(ℓ, char(F q m )) = 1 and ℓ | q m -1, we consider the function fields extension L = K(y), with

y ℓ = f,
where f ∈ K is a function that satisfies the following properties: K1. P ∞ is the only pole of f , and

d := -ν P∞ (f ) is prime to ℓ. Hence, (f ) K ∞ = dP ∞ ; K2. ∀P ∈ Supp (f ) K 0 , ν P (f ) = 1.
L/K is a Kummer extension, cyclic of order ℓ = [L : K] and whose Galois group is given by

Gal(L/K) = {σ : y → ξ • y | ξ ∈ µ * ℓ (F q m )}.
We denote by Y the curve associated to L and π : Y → X the corresponding morphism. Assuming ℓ | q m -1 implies that the primitive ℓ-th roots of unity are indeed in F q m . Let us discuss the assumptions made on the function f :

• first, assuming gcd(d, ℓ) = 1 ensures that P ∞ is totally ramified in L/K, which will be mandatory later on.

• Supposing that f as only one pole, which is P ∞ , is not too much of a restriction since we can always get back to this case: in fact, if f has multiple poles, the Strong Approximation Theorem [Sti09, Theorem 1.6.5] guarantees that there exists a function α ∈ K × , with P ∞ as only pole, and such that (f α) K ∞ = (d + d ′ )P ∞ , where d ′ := -ν P∞ (α) > 0. Now, from Kummer's theory, we get the same extension by replacing the equation y ℓ = f with z ℓ = f ′ , where f ′ = f α ℓ (since α ℓ ∈ (K × ) ℓ ). If we do so, we have (f ′ ) K ∞ = (d + d ′ ℓ)P ∞ , which is prime to ℓ since d is. Hence, f ′ = f α satisfies K1. Note however that multiplying the equation by α ℓ would create new zeroes, but we can also ensure that the zeroes of α differ from those of f .

• Finally, we make the assumption K2 for 2 reasons: it allows to describe simply both the ramification in L/K and the structure of the different divisor Diff(L/K). More precisely, it implies that the divisor ( y f ) L + Diff(L/K) is only supported by the unique point at infinity in L. In Example 3.21, we show that the latter property does not hold if f has a multiple zero.

Remark 3.17. Notice that K2 exactly means that f as only simple zeroes. If K = F q m (x), then f is a univariate polynomial in x and it corresponds to suppose it is square-free, which is usually assumed while considering Kummer extensions of the rational function field.

In what follow, we describe in details the attack presented in Section 3.2 to recover the evaluation vector y = (y(Q i,j )) i,j . For our hypotheses, we take the same as in Section 3.2.1: more precisely, with notation of Proposition 3.9, we have

H(T ) = T ℓ -f ∈ K[T ]
. Moreover, we assume that K1 and K2 hold, but the function f ∈ K is unknown.

The choice of ω. We start by studying the different of L/F q m (x). First, by transitivity of the different [Sti09, Corollary 3.4.12], we have

Diff(L/F q m (x)) = π * (Diff(K/F q m (x))) + Diff(L/K).
(3.7)

Since L/K is a Kummer extension, which has been extensively studied, we know exactly which places ramify. Corollary 3.19. Let Z(f ) be the set of zeroes of f in P K . Under K1 and K2, we have

(f ) K = P ∈Z(f ) P -dP ∞ ,
and thus

Diff(L/K) = (ℓ -1)   P ∈Z(f ),Q|P Q + Q ∞   , where Q ∞ |P ∞ is the unique extension of P ∞ in L.
Proof. Proposition 3.18 gives that any place P ∈ P K \ Supp(f ) K does not ramify. Now, for any P ∈ Supp(f ) K , we have gcd(ℓ, ν P (f )) = 1 (using K1 for P ∞ and K2 for the zeroes of f ), hence any such P totally ramifies in L/K. The result follows from the definition of the different (see Definition (1.56)).

Proposition 3.20. With notation as above, (Y, Q ∞ ) ∈ B. Moreover, there exists h ∈ K such that the differential

ω 0 := h • y f • dx ∈ Ω L satisfies (ω 0 ) L = (2g(L) -2) • Q ∞ .
Proof. We have already seen that Q ∞ is the unique point at infinity in Y. It remains to prove the second point of Definition 3.16: since (X , P ∞ ) ∈ B, there exists h ∈ K such that

(h • dx) K = (2g(K) -2)P ∞ .
Next, notice that both K1 and K2 imply

(f ) L = π * (f ) K = ℓ   P ∈Z(f ),Q|P Q -dQ ∞   ,
since any place in Supp (f ) K is totally ramified. From the defining equation y ℓ = f , we then get

y f L = (ℓ -1)   dQ ∞ - P ∈Z(f ),Q|P Q   .
Using Corollary 3.19 yields

y f L + Diff(L/K) = (ℓ -1)(d + 1) • Q ∞ = deg (Diff(L/K)) • Q ∞ , (3.8)
the last equality coming from the linearity of the degree map and the fact that any principal divisor has degree zero. By definition of h and Equation (1.3), we have

(h) K = (2g(K) -2)P ∞ -(dx) K = (2g(K) -2)P ∞ + 2(x) K ∞ -Diff(K/F q m (x)).
Now we take the pullback:

(h) L = ℓ(2g(K) -2)Q ∞ + 2(x) L ∞ -π * (Diff(K/F q m (x))) .
(3.9)

Adding both Equations (3.8) and (3.9), the transitivity of the different (3.7) finally gives

(ω 0 ) L = (h) L + y f L + (dx) L = [ℓ(2g(K) -2) + deg(Diff(L/K))] Q ∞ = (2g(L) -2)Q ∞ ,
the last equality coming from Corollary 1.68.

In the following counter-example, we show in a simple case why the assumption K2 is important.

Counter-example 3.21. Let F := F 121 . Denote by K = F(x) the rational function field and consider the Kummer extension L = K(y), with

y 5 = f (x) := (x -α) 3 (x -β) and α ̸ = β ∈ F.
Let P α and P β be the zeroes of x-α and x-β in K, respectively. We easily check that (f ) K ∞ = 4P ∞ , where P ∞ is the pole of x. Remark that P α , P β and P ∞ are totally ramified, hence K1 hold but clearly K2 does not, as P α is a zero of order 3. We have

Diff(L/K) = 4(Q α + Q β + Q ∞ ),
where Q α , Q β and Q ∞ are the extensions of P α , P β and P ∞ respectively. A quick computation shows that ( y f ) L + Diff(L/K) is not only supported by Q ∞ , i.e.

y f L + Diff(L/K) = 20Q ∞ -8Q α .
With above notation, we can take h = 1 (K is the rational function field). Hence, the differential ω 0 defined in Proposition 3.20 satisfies

(ω 0 ) L = 10Q ∞ -8P α .
Consequently, the formula for ω 0 does not work here. Even worse, we can check on Magma [BCP97] that there exist no function z ∈ L such that

(zdx) L = (2g(L) -2)Q ∞ , which entails (Y, Q ∞ ) / ∈ B.
At this step, we now have access to a differential ω 0 which is rather simple since it is only supported by Q ∞ . Of course, we still need to deal with the conditions of Equation (3.5), which is the point of the upcoming discussion.

Lemma 3.22. Consider the sets R := R ∈ P F q m (x) | ∃P ∈ P such that P |R , R K := {P ∈ P K | P |R, for some R ∈ R} , and the function

ι P := R∈R (x -x(R)) ∈ F q m (x).
Setting r * := #R ≤ r, where r = n ℓ is the number of orbits in the unknown support Q, we have

(ι P ) L = π * D R K -(ℓar * ) • Q ∞ ,
where D R K is the divisor associated to R K with respect to Notation 3.11.

Proof. By definition, we have

(ι P ) F q m (x) = D R -r * ∞,
where ∞ stands for the point at infinity in F q m (x). The result follows from the definition of D R K and the fact that Q ∞ is the only extension of ∞, with e(Q ∞ |∞) = ℓa.

Notice that P ⊆ R K , the equality being attained if K/F q m (x) is Galois and if P is Galoisinvariant, which is not necessarily the case (this justify the introduction of the integer r * ).

Proposition 3.23. The differential ω :

= ι -1 P ω 0 ∈ Ω L satisfies (ω) L = (2g(L) -2 + ℓar * ) • Q ∞ -π * D R K .
Moreover, for every Q i,j ∈ Q, we have ν Qi,j (ω) = -1.

Proof. Consequence of Proposition 3.20 and Lemma 3.22. The result about the valuation of ω at each Q i,j comes from the fact that ν Qi,j (π * D R K ) = 1.

Corollary 3.24. With above notation, let A := D R K -D P ∈ Div(K). Then the dual divisor G ⊥ of G, as defined in Proposition 1.83, is given by

G ⊥ := D Q -G + (ω) L = (2g(L) -2 + ℓar * ) • Q ∞ -G -π * A.
Proof. Consequence of Proposition 3.23 and the fact that

π * A = π * D R K -D Q .
The shape of the divisor G ⊥ being now known, it remains to study its pushforward G ⊥ in order to apply Lemma 3.12.

Study of G ⊥ . To recover the evaluation vector y, we need to have as many equations as possible in the system (3.4), meaning that we want F (defined in Lemma 3.12) to be as big as possible (the same holds for F ′ (see Lemma 3.15) if it is needed). It might be hard to compute directly the divisor G ⊥ , but we show below that we still can perform the attack by considering an alternative divisor D ∈ Div(K) such that D ≤ G ⊥ and G ⊥ -D has small degree. Proposition 3.25. Following notation 3.11, we consider the divisors

D := 2g(L) -2 + ℓar * ℓ -1 •P ∞ -G-A-D Supp( G) -D Supp( G)∩Supp(A) and B := -(-(y) L ∞ ),
both lying in Div(K). Then

1. B = d ℓ • P ∞ . 2. D ≤ G ⊥ and L K (D -B) ⊆ L K ( G ⊥ ).
3. For all y ∈ L L (π * B) and g ∈ L K (D -B), we have

π * g • y ∈ L L (G ⊥ ).
4. The divisor D -B ∈ Div(K) can be computed from our hypotheses.

Proof.

1. Since (f ) K ∞ = dP ∞ , the defining equation of Y gives ℓ(y) L ∞ = π * (dP ∞ ) = ℓdQ ∞ . Thus, (y) L ∞ = dQ ∞ , and hence B = -(-(y) L ∞ ) = -( -dQ ∞ ) = - -d ℓ P ∞ = d ℓ P ∞ .
2. First, recall that L/K is a Galois extension, hence for all P ∈ P K and Q ∈ P L with Q|P , the integer e(Q|P Using Corollary 3.24, we can write

G ⊥ = (2g(L) -2 + ℓar * -ν Q∞ (G)) • Q ∞ + Q∞̸ =Q∈P L (-ν Q (G) -ν Q (π * A)) Q, since we know that Q ∞ / ∈ Supp(π * A) (but we might have Q ∞ ∈ Supp(G))
. By definition of the pushforward (cf. Definition 3.2) and its properties (cf. Lemma 3.4), we have

G ⊥ = 2g(L) -2 + ℓar * -ν Q∞ (G) ℓ P ∞ + P∞̸ =P ∈P K       min Q|P -ν Q (G) -ν Q (π * A) e(Q|P ) :=ν P ( G ⊥ )       P,
(3.10) using the fact that Q ∞ |P ∞ is totally ramified in L/K. By distinguishing cases, we can estimate the valuations ν P ( G ⊥ ) defined above for any P (at several steps of the computations, we will use the fact that for any x, y ∈ R, we have ⌊x -y⌋ ≥ ⌊x⌋ -⌊y⌋ -1):

(a) If P = P ∞ , we have

ν P∞ ( G ⊥ ) ≥ 2g(L) -2 + ℓar * ℓ -ν P∞ ( G) -1.
(b) If P ∈ Supp( G) and P / ∈ Supp(A), then

ν P ( G ⊥ ) = min Q|P -ν Q (G) e(Q|P ) ≥ - ν Q (G) e(P ) -1 = -ν P ( G) -1.
(c) If P / ∈ Supp( G) and P ∈ Supp(A), we have by definition

ν P ( G ⊥ ) = min Q|P -ν Q (π * A) e(Q|P ) = -1 = -ν P (A).
(d) In the case P ∈ Supp( G) ∪ Supp(A), we have

ν P ( G ⊥ ) = min Q|P -ν Q (G) -ν Q (π * A) e(Q|P ) ≥ -ν Q (G) e(P ) - ν Q (π * A) e(P ) -1 ≥ - ν Q (G) e(P ) -1 -ν P (A) -1 ≥ -ν P ( G) -ν P (A) -2.
(e) For any other P , we have ν P ( G ⊥ ) = 0.

Using these estimations in Equation (3.10) yields

G ⊥ ≥ 2g(L) -2 + ℓar * ℓ -1 • P ∞ -G -A -D Supp( G) -D Supp( G)∩Supp(A) := D. The inclusion L K (D -B) ⊆ L K ( G ⊥
) follows from the fact that B is an effective divisor.

3. For y ∈ L L (π * B) and g ∈ L K (D -B), we have

(π * g • y) L = π * (g) K + (y) L ≥ π * (-(D -B)) -π * B ≥ -π * D ≥ -π * G ⊥ ≥ -G ⊥ , since D ≤ G ⊥ from 2. This proves that π * g • y ∈ L L (G ⊥ ).
4. The integer ℓ is known from A2; and A3 allows us to know explicitly a, r * and both divisors G and A (in particular, we know their supports). Finally g(L) can be computed from Hurwitz' formula (see Theorem 1.72).

The above proposition implies that we can construct D explicitly and consider

F := L K (D -B) instead of L K ( G ⊥ -B) (
as done in Lemma 3.12) to build the linear system (3.4). Notice that our choice of D is not too far from the true value of G ⊥ : in fact, the imprecision arises while bounding from below the valuations ν P ( G ⊥ ), using a classic inequality of the floor function, i.e. ∀x, y ∈ R, ⌊x -y⌋ ≥ ⌊x⌋ -⌊y⌋ -1.

Obviously, we cannot compute directly the left parts since we do not know the valuations occurring in the decomposition of G and π * A (they are secret). By splitting these floor parts into two, we end up with known valuations (i.e. these of G and A). Built this way, the divisor D -G ⊥ has a small enough degree, and can be used to build our linear system.

Adding geometric progression. To increase our chances to find a unique solution, we can add other equations to our system, using the action of the automorphism acting on Q. In fact, since L/K is a Kummer extension, the automorphism σ acting on the code C := SSAG q (Y, Q, G) is completely determined by the choice of a primitive ℓ-th root unity ξ. Thus, the evaluation vector y = (y(Q i,j )) i,j satisfies a geometric progression on each orbit of size ℓ (since we assumed by construction that Q is ordered by orbits of size ℓ). Let us clarify what we mean by geometric progression: for any ξ ∈ µ * ℓ (F q m ), we consider the following block matrix:

E(ξ) =       B(ξ) 0 0 0 0 0 0 B(ξ)       ∈ M n (F q m ), where B(ξ) =          ξ -1 0 0 0 0 0 -1 -1 0 0 ξ          has size ℓ × ℓ. If ξ is the root of unity that defines σ, then E(ξ) • y T = 0.
The next lemma shows that the residue vector z ω also satisfy this geometric progression.

Lemma 3.26. With the choice of differential made in Proposition 3.23, we have

∀Q i,j ∈ Q, Res ω (Q i,j ) = h(Q i,j )y(Q i,j ) f (Q i,j ) R∈R,x(R)̸ =x(Qi,j ) (x(Q i,j ) -x(R)) . Proof. Clear since ω := h • y f • R∈R (x -x(R))
dx.

Since both f , h and x lie in K, they are invariant under the action of σ, which implies that the vector z ω satisfies the same geometric progression as y, i.e. E(ξ)

• z T ω = 0. Consequently, for any i ∈ {1, • • • , r} and (Q i,1 , • • • , Q i,ℓ ) ∈ Q, we have Res ω (Q i,j+1 ) • y(Q i,j+1 ) = ξ 2 • Res ω (Q i,j ) • y(Q i,j ),
where j ∈ {1, • • • , ℓ} mod ℓ. Adding this to our system yields

         E(ξ 2 ) • (z ω ⋆ y) T = 0 M • D 1 • (z ω ⋆ y) T = 0 . . . M • D s • (z ω ⋆ y) T = 0, (3.11)
which is a collection of n + ks equations for n unknowns. The new system (3.11) is over-constrained but we know that at least z ω ⋆ y is solution, provided that we guessed the good root of unity ξ. Since

φ(ℓ) = |µ * ℓ (F q m )| = O(n),
we can test all possible values of ξ until eventually we find the correct one, at the cost of at most a linear factor (in the length n of the code). Actually, it is difficult to give sufficient conditions for the system to have rank one, but it is very reasonable to hope it has a unique solution (up to scalar multiplication) when we picked the good root of unity, which always happened in our computing experiments. Additionally, picking a wrong ξ tends to give a system without any solution.

From now on, assume that we recovered the product vector z ω ⋆ y as well as the good root of unity ξ ∈ µ * ℓ (F q m ). Following the idea of Lemma 3.15, we build another linear system to recover z ω ⋆ y 2 , obtained by replacing E(ξ 2 ) with E(ξ 3 ) in (3.11), i.e.

         E(ξ 3 ) • (z ω ⋆ y 2 ) T = 0 M • D 1 • (z ω ⋆ y 2 ) T = 0 . . . M • D s • (z ω ⋆ y 2 ) T = 0.
(3.12)

Finally, we compute y = (z ω ⋆ y 2 ) ⋆ (z ω ⋆ y) -1 . A plane model of Y can then be found by using an appropriate interpolation method (possible thanks to Proposition, 3.9). A formal algorithm describing the attack can be found in Appendix A, and a Magma [BCP97] implementation can be found on a GitHub repository at https://github.com/Reiikar/attack QC SSAG codes.

Elementary abelian p-extension

Setting. Let (X , P ∞ ) ∈ B, K = F q m (X ), a := [K : F q m (x)] and denote by p the characteristic of F q m . Given a integer u ≥ 1 such that F p u ⊆ F q m , we consider an elementary abelian p-extension L of K with degree p u . From [GS91, Proposition 1.1], there exists y ∈ L such that L = K(y), with

y p u -y = f, f ∈ K. (3.13)
Similarly to Section 3.3.2, we need to assume that f satisfies K1, i.e.

(f ) K ∞ = dP ∞ and gcd(d, ℓ) = 1.

Remark 3.27. In this case, the hypothesis K2 is no longer required, as it does not impact the ramification in the extension: in any case, P ∞ is the only place that ramifies (see Proposition 3.29).

As we assumed F p u ⊆ F q m , the polynomial T p u -T ∈ F q m [T ] has all its roots in F q m . Hence, the extension L/K is Galois of order p u = [L : K] and

Gal(L/K) = {σ : y → y + β | β ∈ F p u }.
As usual, we denote by π : Y → X the corresponding morphism.

Remark 3.28. In the case u = 1, L/K is nothing but an Artin-Schreier extension (see [Sti09, Proposition 3.7.8]), which is cyclic of prime degree p (i.e. Gal(L/K) ≃ F p ).

In order to recover the evaluation vector y = (y(Q i,j )) i,j , we take the same hypotheses as in Section 3.2.1, and assume that L = K(y) with y as in Equation (3.13), i.e its minimal polynomial over K equals

H(T ) = T p u -T -f ∈ K[T ]. Moreover, the function f is unknown, but we know it satisfies K1.
The choice of ω. As generalization of Artin-Schreier extensions, elementary abelian p-extensions are well-studied. In particular, the following proposition gives a description of the ramification in such extensions. Proposition 3.29. With above notation, P ∞ is the only place which ramifies in L/K. It has a unique extension Q ∞ ∈ P L , i.e. it is totally ramified. Moreover, its different exponent is given by

d(Q ∞ |P ∞ ) = (p u -1)(d + 1).
Proof. Let P ∈ P K . Then from [Sti09, Proposition 3.7.10], we have:

1. either there exists z ∈ K such that ν P (f -(z p u -z)) ≥ 0, in which case we set m P := -1; 2. or else, for some z ∈ K, we have ν P (f -(z p u -z)) = -m < 0 and m ̸ ≡ 0[p]. In this case, set m P := m (uniquely determined by f and P ).

The integer m P is well-defined for any place P , and [Sti09, Proposition 3.7.10 (c) and (d)] give that P is ramified if and only if m P > 0, in which case it totally ramifies. In our setting, any P ∈ P K \ {P ∞ } has m P = -1, hence is unramified (we assumed P ∞ to be the only pole of f ). From K1, the integer m P∞ := d is prime to p, thus P ∞ is totally ramified. The formula for the different exponent is also given in [Sti09, Proposition 3.7.10 (d)].

Corollary 3.30. The different of L/K is given by

Diff(L/K) = (p u -1)(d + 1)Q ∞ .
Proof. Immediate consequence of the definition of the different (see Definition 1.56) and Proposition 3.29.

Similarly to Kummer setting, we now show that (Y, Q ∞ ) ∈ B and provide a differential satisfying condition 2 of Definition 3.16. Proposition 3.31. With notation as above, (Y, Q ∞ ) ∈ B. Moreover, there exists h ∈ K such that the differential

ω 0 := h • dx ∈ Ω L satisfies (ω 0 ) L = (2g(L) -2) • Q ∞ .
Proof. We already saw that Q ∞ is the unique point at infinity in Y. From Definition 3.16, there exists h ∈ K such that (hdx

) K = (2g(K) -2)P ∞ . Applying Equation (1.3) yields (2g(K) -2)P ∞ = (h) K -2(x) K ∞ + Diff(K/F q m (x)).
Taking the pullback, we get

(h) L = p u (2g(K) -2)Q ∞ + 2(x) L ∞ -π * (Diff(K/F q m (x))) .
Using Equation (1.3) again, this time applied to (dx) L gives (dx

) L = -2(x) L ∞ + π * (Diff(K/F q m (x))) + Diff(L/K).
Consequently, summing up the last two equalities and using Corollary 3.30 yields

(ω 0 ) L = (h) L + (dx) L = p u (2g(K) -2)Q ∞ + (p u -1)(d + 1)Q ∞ = (2g(L) -2)Q ∞ ,
the last equality coming from Corollary 1.68.

Keeping notation of Lemma 3.22, we proceed as in Section 3.3.2 to build the differential

ω := ι -1 P h • dx ∈ Ω L (3.14) such that ν Qi,j (ω) = -1 for all Q i,j ∈ Q and (ω) L = (2g(L) -2 + p u ar * ) • Q ∞ -π * D R K .
The divisors G ⊥ and G ⊥ . Setting A := D R K -D P , we deduce from the above discussion that

G ⊥ := D Q -G + (ω) L = (2g(L) -2 + p u ar * ) • Q ∞ -G -π * A.
As in the Kummer case, we build our linear system by using a divisor D ∈ Div(K) which is slightly smaller than G ⊥ : Proposition 3.32. Let

D := 2g(L) -2 + p u ar * ℓ -1 •P ∞ -G-A-D Supp( G) -D Supp( G)∩Supp(A) and B := -(-(y) L ∞ ),
both lying in Div(K). Then

1. B = d p u • P ∞ . 2. D ≤ G ⊥ and L K (D -B) ⊆ L K ( G ⊥ ).
3. For all y ∈ L L (π * B) and g ∈ L K (D -B), we have

π * g • y ∈ L L (G ⊥ ).
4. The divisor D -B ∈ Div(K) can be computed from our hypotheses.

Proof. Similar to Proposition 3.25.

Adding arithmetic progression. One of the main difference with Section 3.3.2 is of course the action of the Galois group of L/K. By assumption, the code C = SSAG q (Y, Q, G) is invariant under the action of some order p u automorphism σ : y → y + β, with β ∈ F p u . As a consequence, the vector y = (y(Q i,j )) i,j satisfies an arithmetic progression on each orbit of size p u . More precisely, consider the following block matrices:

C =       B 0 0 0 0 0 0 B       ∈ M n (F q m ), where B =          -1 1 0 0 0 0 0 1 1 0 0 -1          ∈ M p u (F q m ).
If β ∈ F p u is the element that defines the automorphism acting on C, then

C • y T = β,
where β = (β, . . . , β) T is a column vector of size n = rp u . Our choice of differential (Equation (3.13)) implies

Res ω (Q i,j ) = h(Q i,j ) R∈R,x(R)̸ =x(Qi,j ) (x(Q i,j ) -x(R)) , ∀ Q i,j ∈ Q. (3.15)
It is then clear that the residue vector does not satisfy the arithmetic progression under each orbit: in fact, from Equation (3.15), the residues of ω are equal on each given orbit (since both h and ι P lie in K). The latter property is helpful as it means that z ω is known under our hypotheses. The final linear system we have to solve is then

         C • y T = β M • D 1 • Z ω • y T = 0 . . . M • D s • Z ω • y T = 0, (3.16)
where Z ω is the diagonal matrix of length n corresponding to z ω . Again, the system (3.16) is a collection of n + ks equations with n unknowns, which has to be solved at most p u = 0(n) times, until we guessed the good value of β. Again, this would at most increase the complexity by a linear factor.

Generalization to solvable Galois cover

In this last section, we discuss how the attack presented in Section 3.2 could be generalized to any solvable Galois cover of curves. In Sections 3.3.2 and 3.3.3, we instantiate the attack in both Kummer and abelian p-extensions, which are interesting since they characterize in a sense all cyclic extensions: in fact, given an extension L/K of function fields over F q m with degree a = [L : K], then

• if gcd(a, p) = 1 and a | q m -1, then L/K is a Kummer extension of degree a (see [Sti09, Annex A.13]);

• if a = p u and F p u ⊆ F q m , then L/K is an elementary abelian p-extension of degree p u (see [GS91, Proposition 1.1]).

Let us explain how we could deal with the solvable Galois case: let (X , P ∞ ), and consider a cover π : Y → X (corresponding to an extension L/K of function fields) of curves over F q m , such that G := Gal(L/K) is solvable. By definition, there exists a sequence of normal subgroups

{Id} := G 0 ◁ G 1 ◁ • • • ◁ G s := G, (3.17)
such that any quotient G i+1 /G i in Equation (3.17) is cyclic of degree n i := m i p ri ∈ N, where m i is prime to p. For any i ∈ {0, . . . , s}, we denote by L i := L Gi the fixed field by G i . From Galois theory, the sequence (3.17) leads to a tower of function fields

K := L s ⊆ L s-1 ⊆ • • • ⊆ L 0 := L (3.18)
such that for every 0 ≤ i ≤ s -1, the extension L i /L i+1 is cyclic, with Galois group G i+1 /G i and degree n i . Equivalently, this corresponds to a tower of F q m -curves

Y := X 0 -→ X 1 -→ • • • -→ X s := X (3.19)
such that each curve X i is equipped with the action of the cyclic group G i+1 /G i , and X i+1 is the corresponding quotient curve. Now, assume that we want to show that the security of a public G-invariant SSAG code

C 0 := SSAG q (X 0 , Q 0 , G 0 )
can be reduced to the security of its invariant subcode

C s := C G 0 = SSAG q (X s , Q s , G s ) .
As both Q 0 and G 0 are assumed to be globally G-invariant, they are also invariant under the action of each subgroup G i appearing in the sequence (3.17). Consequently, there exists a sequence of invariant subcodes of C 0 , say (C i ) s i=1 such that for all 0 ≤ i ≤ s -1,

C i := C Gi+1/Gi i+1 .
As the invariant subcode of an SSAG code is still an SSAG code (Corollary 3.8), each C i is itself an SSAG code, i.e.

C i = SSAG q (X i , Q i , G i ) ,
for some (invariant) support Q i and divisor G i . Keeping the assumptions A1,A2 and A3 of Section 3.2.1, we want to show that we can recover the structure of C 0 from whose of its (full) invariant code C s . To do so, we could proceed the following way: from the knowledge of C s and since X s-1 → X s is Galois with degree n s = m s p rs , we may apply successively the attack in Kummer case with degree m i (Section 3.3.2) and abelian p-extension case with degree p ri (Section 3.3.3). Hopefully, we end up with an equation of the intermediary curve X s-1 , from which we manage to build the code C s-1 .

Repeating this process, we could ride up the sequence (3.19) until recovering the secret structure of C 0 . However, this method might work only if at each step, we can efficiently verify that our extensions satisfy conditions K1 and K2 (Kummer case) or K1 (abelian p-extension case). Actually, there is no reason for it to be true, and it is not reasonable to assume from the beginning that these conditions are true for all intermediary extensions.

As future work, it could be promising to find the largest class of cyclic covers Y → X such that (Y, Q ∞ ) ∈ B, whenever (X , P ∞ ) ∈ B. Finding a characterization of such covers would give a step further to this generalization.

Chapter 4

Goppa-like SSAG codes distinguisher

In this Chapter, in introduce a new family of codes that can be used in a McEliece cryptosystem, called Goppa-like AG codes. These codes generalize classical Goppa codes and can be constructed from any curve of genus g ≥ 0. Focusing on codes from C a,b curves, we study the behaviour of the dimension of the square of their dual to determine their resistance to distinguisher attacks similar to the one for alternant and Goppa codes developed by Mora and Tillich [START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF]. In this paper, the authors managed to get a sharp upper bound by performing Euclidean division by powers of the multiplicator g in the case of classical Goppa codes. Considering one-point Goppa-like AG codes defined on a C a,b curve, we prove that performing division algorithms via Gröbner bases enables us to obtain similar results. Even better, computations tend to show that the bound we obtain on the dimension is sharp whenever the code seems random, hence generalizing the distinguisher proposed in [START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF]. The counterpart is that our distinguisher suffers the same problem, i.e. we can only distinguish high rate codes.

The chapter is organized as follows. In Section 4.1, we give a first upper bound on the dimension of the square of the dual of an SSAG code, using an old result on Riemann-Roch spaces due to Mumford [START_REF] Mumford | Varieties defined by quadratic equations. Questions on algebraic varieties[END_REF]. Section 4.2 is dedicated to Goppa-like AG codes: after motivating their definition, we then bound from above the dimension of the square of their dual, as done in [START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF] in the case of alternant codes. In Section 4.3, we refine the bound in the case of Goppa-like codes from C a,b curves, associated to one-point divisors. Our results are then analyzed in Section 4.4, where we discuss our bound in the case of codes from elliptic curves and the Hermitian curve. In the latter case, we study the effectiveness of our codes applied to a McEliece's cryptosystem.

Throughout the whole chapter, we fix a finite field F q m of characteristic p > 0, where q is a power of p and m ≥ 1. To make the notation less cumbersome, we write Tr(•) instead of Tr F q m /Fq (•) (see Section 1.1.2 for a definition of the Trace operator).

First estimation of the dimension of the square of the trace of an SSAG code

In [START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF], the authors benefited from the fact that the square of GRS codes is abnormally small, i.e the inequality in Equation (1.1) is always strict. More precisely, if

GRS r (x, y) ⊆ F n q m is a dimensional r ≤ n+1 2 code, then dim F q m GRS r (x, y) ⋆2 = 2r -1.
This fact is then used to get a first estimation of the square of the dual of an alternant code, via Proposition 1.19. Below, we show that AG codes, as generalization of GRS ones, benefit from the same structure with respect to the Schür product. For the remaining of this section, let X be a smooth and irreducible projective curve over F q m with genus g := g(X ).

Proposition 4.1 ([Mum70, Theorem 6]). Let F, G be two divisors on X such that deg(G) ≥ 2g + 1 and deg(F ) ≥ 2g. Then L(F ) • L(G) = L(F + G),
where

L(F ) • L(G) := Span (f • g : (f, g) ∈ L(F ) × L(G)).
As a consequence, given an AG code C L (X , P, G), we have

C L (X , P, G) ⋆2 ⊆ C L (X , P, 2G), with equality if deg(G) ≥ 2g + 1. If deg(G) ≥ g, applying the Riemann-Roch theorem to the divisors G and 2G yields dim F q m C L (X , P, G) ⋆2 ≤ dim F q m C L (X , P, 2G) = 2 deg(G) + 1 -g, (4.1)
which is much smaller than the expected dimension given in Equation (1.1). As the dual of an AG code is also an AG code (see Proposition 1.83), Proposition 1.19 can also give information on the subfield subcode of the AG code C := C L (X , P, G) (using the correspondence of Delsarte's theorem 1.12), i.e

SSAG q X , P, G ⊥ ⊥ ⋆2 ⊆ ⌊ m 2 ⌋ i=0 Tr C ⋆ C q i . (4.2)
Corollary 4.2. Let C := C L (X , P, G) be a k-dimensional AG code on X associated with a degree s ≥ g divisor. Then

dim Fq SSAG q X , P, G ⊥ ⊥ ⋆2 ≤ mk + 1 2 - m 2 (k(k -1) -2s).
Proof. From Equation (4.1), we have dim

F q m (C) ⋆2 ≤ 2s + 1 -g ≤ k + s. Thus, Corollary 1.20 yields dim Fq Tr(C) ⋆2 ≤ m(k + s) + m 2 k 2 = (2k + 2s + mk 2 -k 2 ) m 2 = (k(mk + 1) -k 2 + k + 2s) m 2 = mk + 1 2 - m 2 (k(k -1) -2s).
According to the above corollary, the dimension of the square of the dual of an SSAG code is less than the expected value for random mk-dimensional codes (which is mk+1 2 ), due to the algebraic structure of AG codes. However, this bound does not fully benefit from this rich structure, notably the following property. Lemma 4.3. Let C := C L (X , P, G) be a k-dimensional AG code on X . For every i ≥ 0, we have

C ⋆ C q i ⊆ C L (X , P, (q i + 1)G)
Proof. Fix i ≥ 0 and let f 1 , f 2 ∈ L(G). Then the product f 1 f q i 2 belong to L((q i + 1)G) as

(f 1 f q i 2 ) + (q i + 1)G = ((f 1 ) + G) + q i ((f 2 ) + G) ≥ 0.
This proves the inclusion of spaces

L(G) • L(G) q i ⊆ L((q i + 1)G),
hence the inclusion of the associated codes.

Remark 4.4. The property above for i = 0 follows from Proposition 4.1. To the best of our knowledge, there is no sufficient criterion for the equality for any i ≥ 1 to hold in the literature. Given a basis {f 1 , . . . , f k } of the Riemann-Roch space L(G), the vector space L(G) • L(G) q i is spanned by the set

f u f q i v | 1 ≤ u ≤ v ≤ k .
From our experiments, it may happen that the cardinality of this family is larger than ℓ((q i + 1)G) without the equality holding, which means that these generators may be linearly dependent in L((q i + 1)G) and do not form a basis of L(G) • L(G) q i . Thanks to Lemma 4.3, it will be possible to better handle the terms Tr C ⋆ C q i in Equation (4.2). In the next section, we improve the bound of Corollary 4.2 in some specific cases.

Relation with Cartier codes. Cartier codes [START_REF] Couvreur | Codes and the Cartier operator[END_REF] are also defined as a geometric realization of Goppa codes, since well-known properties of Goppa codes naturally extend to them. For instance, Theorem 1.87 holds for Cartier code without assumption on the degree of the divisor.

The link with Goppa-like AG codes is the following: by definition, a Cartier code is a subcode of the subfield subcode of a differential code (see [Cou14, Proposition 4.3]), which actually means that for the good choice of divisor, a Cartier code is a subcode of the corresponding Goppa-like AG code. Moreover, [Cou14, Theorem 5.1] provides a sufficient condition for both constructions to be equal. More precisely, let us consider a Goppa-like AG code Γ(P, D, g) and G = D + (g). Then the Cartier code Car q (P, G) (see [START_REF] Couvreur | Codes and the Cartier operator[END_REF]Definition 4.2]) satisfies Car q (P, G) ⊆ Γ(P, D, g), and dim Fq (Γ(P, D, g)/Car q (P, G))

≤ m • i(G 1 ),
where G 1 is any divisor such that G ≥ qG 1 and G ≥ G 1 .

(1.10)

Above, i(G 1 ) stands for the index of speciality of G 1 (see [Sti09, Definition 1.6.10]). By the Riemann-Roch theorem, if deg(G 1 ) > 2g -2, then i(G 1 ) = 0. Thus, using Remark 1.86, the Cartier code Car q (P, G) coincides with the Goppa-like AG code Γ(P, D, g) whenever deg

G q > 2g -2.
Example 4.7. Let q = 3 and m = 4. We consider the elliptic curve defined over F q m by the equation

E : y 2 = x 3 + 2x + 1.
As usual, we denote by P ∞ the unique point at infinity on E. We take D as a one-point divisor supported by P ∞ , i.e D = sP ∞ . For a fixed degree s = 7, we consider two choices of function g:

1. First, let g 1 = x 4 / ∈ L(D) (since ν P∞ (g 1 ) = -8).
In this case, g has 2 zeros (say P 1 and P 2 ), which are those of x. More precisely, we have

(g 1 ) = 4(P 1 + P 2 ) -8P ∞ .
Hence, if we set G = D + (g 1 ), the divisor G q = P 1 + P 2 -P ∞ has degree 1 > 2g(E) -2 = 0, meaning that the codes Γ(P, D, g 1 ) and Car 3 (P, G) are equal over F 3 . 2. Second, take g 2 = x 4 + xy. Again, we have g 2 / ∈ L(D) since it has same valuation at P ∞ as g 1 . This time, we can verify that g 2 has 8 distincts rational zeros, say R 1 , . . . , R 8 , i.e

(g 2 ) = R 1 + • • • + R 8 -8P ∞ .
Consequently, we easily check that deg G q = -1 ≤ 2g(E) -2. Some computations realized on Magma show that the codes Γ(P, D, g 2 ) and Car 3 (P, G) are not equal in this case.

Magma results are summarized in Table 4.1.

n s = deg(D) Choice of g deg G q dim F3 (Γ(P, D, g)) dim F3 (Car 3 (P, G)) 88 7 g = x 4 1 64 64 82 7 g = x 4 + xy -1 50 54

On the dimension of the square of the dual of a Goppa-like AG code

In this section, we aim to generalize the properties found by the authors of [MT21] (Section 6), in the context of Goppa-like AG codes. To do so, we consider the AG code

C := C L (X , P, D + (g))
as in Definition 4.5. Since Γ(P, D, g) is the subfield subcode of C ⊥ , putting it into Equation (4.2) yields

Γ(P, D, g) ⊥ ⋆2 ⊆ ⌊m/2⌋ i=0 Tr C ⋆ C q i . (4.3)
Below, we discuss how to improve the upper bound given in Corollary 4.2, which is valid for all subfield subcodes of AG codes. The idea is to use the specific algebraic structure of our code inherited from the choice of its divisor. In fact, notice that C is monomially equivalent to C L (X , P, D): more precisely, if C L (X , P, D) is generated by M, then a generator matrix of C is obtained by multiplying M by the diagonal matrix whose coefficients are g -1 (P ), for P ∈ P. A direct consequence of this is the following lemma. Lemma 4.8. Suppose s = deg(D) ≥ g. Then for all i ≥ 0, we have

dim Fq Tr C ⋆ C q i ≤ m s q i + 1 + 1 -g .
Proof. From Lemma 4.3, we deduce that dim F q m C ⋆ C q i ≤ dim F q m L((q i + 1)G) = dim F q m L((q i + 1)D) = s(q i + 1) + 1 -g, the last equality coming from the Riemann-Roch theorem (since deg(q i + 1)D = (q i + 1)s ≥ 2g -1).

The result follows from the usual upper bound on the dimension of the trace of a code.

Remark 4.9. At first glance, it seems that we could have benefited from Theorem 1.85 to get a sharper bound in the previous lemma. Indeed, for every i ≥ 1, we have

(q i + 1)G q = q i-1 G + -(q i + 1)G -, writing G = G + -G -with G + , G -≥ 0.
However, in the context of Goppa-like codes, we have G = D + (g) where g / ∈ L(D), hence G -̸ = 0. Without further hypotheses on the divisor D and the function g, the degree of the divisor (q i +1)G q may be too low to bound the dimension of its Riemmann-Roch space from below via the Riemann-Roch theorem. This simple lemma yields an upper bound on the dimension of the square of the dual of Goppalike codes. . Then

dim Fq (Γ(P, D, g) ⊥ ) ⋆2 ≤ mk + 1 2 - m 2 k(k -1)(2e + 1) -2s q e+1 -1 q -1 .
Proof. For any e 0 ∈ 0, . . . , ⌊ m 2 ⌋ , Equation (4.3) above implies dim Fq (Γ(P, D, g)

⊥ ) ⋆2 ≤ ⌊m/2⌋ i=0 dim Fq Tr C ⋆ C q i ≤ e0 i=0 m(s(q i + 1) + 1 -g) + ⌊m/2⌋ i=e0+1 Tr C ⋆ C q i (by Lemma 4.8) ≤ e0 i=0 m(sq i + k) + m -1 2 -e 0 mk 2 (by the Riemann-Roch theorem) ≤ m 2 2k(e 0 + 1) + 2s q e0+1 -1 q -1 + k 2 (m -1) -2e 0 k 2 ≤ mk + 1 2 - m 2 k(k -1)(2e 0 + 1) -2s q e0+1 -1 q -1 .
Notice that at the third line, we can replace ⌊ m 2 ⌋ with m-1 2 while bounding the second part of the sum thanks to the even case in Proposition 1.19. To get the best bound, we maximize the expression m 2 k(k -1)(2e 0 + 1) -2s q e0+1 -1 q -1 with respect to e 0 . Removing the constant parts, this is equivalent to find the maximum of the function

F (e 0 ) = e 0 k 2 -s q e0+1
q -1 over 0, . . . , ⌊ m 2 ⌋ in the discrete domain of non-negative integers. We compute the discrete derivative:

∆F (e 0 ) = F (e 0 + 1) -F (e 0 ) = (e 0 + 1)k 2 -s q e0+2 q -1 -e 0 k 2 -s q e0+1 q -1 = k 2 -sq e0+1 .

This function is decreasing with e 0 , and the smallest value for which ∆F (e 0 ) ≤ 0 corresponds to its maximum. It is the smallest value of e 0 such that k 2 ≤ sq e0+1 , i.e.

e 0 = e := log q k 2 s .

Sharpness of the bound

Definition 4.5 of a Goppa-like AG code Γ(P, D, g) := C ⊥ | Fq requires very few hypotheses. Besides the conditions on the supports of D and (g), which guarantee that the code is well-defined, we only ask for the function g not to belong to the Riemann-Roch space L(D). This hypothesis is enforced to make sure that the dimension of Tr(C) ⋆2 is not abnormally small compared to the expected value given in Corollary 1.20, and thus to make Goppa-like AG codes resistant to a distinguisher based on the square of their dual. Let us discuss a bit more this assumption on g: First, if the function g lied in L(D) (or more generally if the vector of the evaluations (g(P )) P ∈P belonged to C L (X , P, D)), then the code C = C L (X , P, D + (g)) would contain the evaluation of the constant function 1 = g g , i.e. the unit vector (1, . . . , 1). In this case, the vector (1, . . . , 1) would belong to C q i for every i ∈ {0, . . . , ⌊m/2⌋} and each term in the sum on the right-hand side would contain a copy of Tr(C). This non-trivial intersection between the codes Tr C ⋆ C q i would contribute with a negative term in the above bound.

Secondly, if g belonged to L(D), then D + (g) would be effective. This would imply the inclusion L((q i + 1)D) ⊂ L((q i+1 + 1)D) for every i ≥ 0. Therefore, in the proof of Proposition 4.10, when bounding from above the dimension of the sum by the sum of the dimensions of the trace codes, we would have no chance to get a sharp bound.

Unfortunately, the condition g / ∈ L(D) does not guarantee that the bound given in Proposition 4.10 is reached. In the following proposition, we detail one situation in which we cannot hope for equality. Proposition 4.11. Using the same notation as above, set C 1 = C L X , P, D+(g) q (see Equation (1.11) for the definition of G q , given G). If dim C 1 ≥ 1, then the bound given in Proposition 4.10 is not reached.

Proof. Any non-zero codeword c ∈ C 1 ⊂ C satisfies c q ∈ C. As c lies in F n q m , we have c q m = c ∈ C q m-1 . Therefore, we have C 1 ⊆ C ∩ C q m-1 , and for every i ∈ 1, . . . , ⌊ m 2 ⌋ , we have

C q i 1 ⊆ C q i ∩ C q i-1 . Then Tr C ⋆ C q i 1 ⊆ Tr C ⋆ C q i ∩ Tr C ⋆ C q i-1 .
As a result, each pair of consecutive terms in the sum ⌊m/2⌋ i=0 Tr C ⋆ C q i has a non-trivial intersection.

However, using [Tia19, Theorem 2], equality with the upper bound only occurs if

0≤j≤⌊m/2⌋     0≤i≤⌊m/2⌋ i̸ =j Tr C ⋆ C q i     = {0} .
Remark 4.12. As noted in Remark 4.9, when picking the function g at random outside L(D), the code C 1 is likely to be reduced to zero.

As recalled in Section 4.2.1, Goppa-like AG codes coincide with Cartier code as soon as

deg D + (g) q > 2g -2.
In this case, the code C 1 has dimension at least g. This means that when the Goppa-like code is also a Cartier code, the dimension of the square of its dual is very unlikely to meet the bound given in Proposition 4.10. Remark 4.13. When considering classical Goppa codes (see. Definition 1.91) for the McEliece cryptosystem, it is common to ask for the degree r Goppa polynomial g to have only simple roots. In this case, we have (r-1)P∞+(g) q = -P ∞ and the code C 1 defined in Proposition 4.11 is always zero. The situation above thus never occurs.

One-point Goppa-like AG code on C a,b -curves

The bound given in section 4.2.2 can be improved even more by considering more structured codes, i.e. one-point Goppa-like AG codes on C a,b curves.

The point at infinity and weighted degree

Let a, b be coprime positive integers and fix a C a,b curve X a,b . As defined in Section 1.2.5, this means that X a,b have an irreducible, affine and non-singular plane model with equation

f a,b (x, y) = α 0a y a + α b0 x b + α ij x i y j = 0, (4.4)
where f a,b ∈ F q m [X, Y ] with α 0a , α b0 ̸ = 0, and the sum is taken over all couples (i, j) ∈ {0, • • • , b} × {0, • • • , a} such that ai + bj < ab. Among notable properties, recall that X a,b has a unique point at infinity. From now on, this point is denoted by P ∞ , and we write g(X a,b ) := g a,b = (a-1)(b-1) 2 the genus of X a,b .

We will consider codes obtained by evaluating functions on X a,b which are regular everywhere, except maybe at P ∞ . These functions then belong to the coordinate ring of the affine curve X a,b \ {P ∞ }, which we denote by S, i.e S = s≥0 L(sP ∞ ), (

where each Riemann-Roch space L(sP ∞ ) has an explicit basis as follows:

L(sP ∞ ) = Span x i y j | 0 ≤ i, 0 ≤ j ≤ a -1 and ai + bj ≤ s . (4.6)

In summary, any function that is regular on all X a,b except maybe at P ∞ can be seen as a bivariate polynomial in the functions x and y. Definition 4.14 (Weighted degree). Given a monomial of the form x i y j ∈ S, we define its weighted degree by deg a,b x i y j := ai + bj.

From this degree, we can define a monomial order ≺ over S ≃ F q m [x, y] as follows: given two monomial x u y v and x u ′ y v ′ , we say that

x u y v ≺ x u ′ y v ′ if deg a,b (x u y v ) < deg a,b x u ′ y v ′ or deg a,b (x u y v ) = deg a,b x u ′ y v ′ and u < u ′ . (4.7)
From the basis given in (4.6), any function f ∈ S can be written in the form

f (x, y) = c • x β y α + f ′ (x, y),
with c ̸ = 0, α ≤ a -1 and f ′ ∈ S such that any monomial x i y j of f ′ satisfies ai + bj < deg a,b x β y α and j ≤ a -1. The leading monomial of f with respect to the monomial order ≺ is thus defined by LM(f ) := x β y α . This extends the definition of weighted degree to any such function by setting It is easy to check that for any f ∈ S, its weighted degree deg a,b (f ) is equal to the biggest integer s such that f belongs to the Riemann-Roch space L(sP ∞ ). This way, any function in L(sP ∞ ) can be seen as a polynomial in x and y such that deg a,b (f ) ≤ s. Remark 4.15. For every f ∈ S, we have deg a,b (f ) = -v P∞ (f ).

The codes

For the rest of this section, fix a C a,b curve X a,b over F q m , whose defining equation is given by Equation (4.4). We now define a subclass of Goppa-like codes, associated with the one-point divisor sP ∞ . Definition 4.16. Let s ′ > s be two integers such that there exists a function g ∈ L(s ′ P ∞ ) with deg a,b (g) = s ′ . Given a set of rational points P ⊂ X a,b (F q m ) such that P ∩ Supp(g) = ∅, we define the one-point Goppa-like AG code associated to P, s and g as

Γ(P, sP ∞ , g) := C L (X a,b , P, sP ∞ + (g)) ⊥ | Fq .
This definition might sound limiting, since we restrict ourselves to specific one-point divisor. This is motivated by the fact that these codes can be encoded quickly thanks to the nice basis of L(sP ∞ ) (see [START_REF] Blache | A geometric interpretation of reduction in the Jacobians of C ab curves. In Arithmetics, geometry, and coding theory (AGCT[END_REF]), which is desirable if we aim to build a McEliece cryptosystem based on it. Moreover, this property will be key in the upcoming sections as it allows a better understanding of the square of the dual, under some additional conditions on s and s ′ .

In the next two sections, we generalize the result given in [START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF] in the case of classical Goppa codes, by defining a weighted Euclidean division on the ring S (see Equation (4.5)), whose elements are seen as bivariate polynomials.

Weighted Euclidean division

The following proposition generalizes the classical Euclidean division of univariate polynomials in the case of function in S with respect to the weighted degree deg a,b (see Definition 4.14). Before that, we need the following definition: Definition 4.17. For any function h ∈ S with leading monomial LM (h) = x β y α and α < a, we define over F q m the space

R(h) := Span (x u y v | u ≤ β + b -1 and v ≤ a -1 not both u ≥ β and v ≥ α) .
Note that the dimension of R(h) is equal to deg a,b (h). Proof. Since f ∈ S, we can see f as a bivariate polynomial in x and y (see Equation 4.5). In the polynomial ring F q m [x, y], we perform the division of f by a Gröbner basis of the ideal generated by the equation f a,b of the curve X a,b and the polynomial g with respect to the monomial order ≺ defined in Equation (4.7). The fact that f 2 lies in R(g) and the result on the dimension of R(g) both follow from [GH00, Proposition 4].

Finally, if we had deg a,b (f ) < deg a,b (f 2 ) with f = f 1 g + f 2 , this would mean that LM (f 2 ) = -LM (f 1 g) = λx u y v ,
for some λ ∈ F * q m with both u ≥ β and v ≥ α, which is not possible by definition of R (g).

We will now use the weighted Euclidean division defined above to better control the elements in Tr C ⋆ C q i for C = C L (X a,b , P, sP ∞ + (g)), where we fixed s ′ > s ≥ 0, g ∈ S with deg a,b (g) = s ′ and a set of points P ⊂ X a,b (F q m ) such that P ∩ Supp(g) = ∅.

Before diving into technical proofs, let us fix some notation that we will use in the rest of the paper. We extend the evaluation map defined in Equation (1.7) on all the ring S:

ev P : S → F n q m f → (f (P 1 ), . . . , f (P n ))
Now, ev P is an algebra homomorphism, where F n q is endowed with the product ⋆, i.e. ev P (f ) ⋆ ev P (f ′ ) = ev P (f • f ′ ) for any f, f ′ ∈ S.

For two functions f, f ′ ∈ S, we will write f ≡ P f ′ if ev P (f ) = ev P (f ′ ). We also extend the trace operator on S by defining Tr(f ) = f + f q + • • • + f q m-1 for every f ∈ S. Since the map ev P is an algebra homomorphism, we have ev P (Tr(f )) = Tr(ev P (f )). Moreover, for any function f ∈ S, we have Tr(f q ) ≡ P Tr(f ) . (4.8)

Lemma 4.19. Take i ≥ 1. Let f ∈ S such that deg a,b (f ) < s ′ (q i + 1). Then there exists f ′ ∈ R g q i -q i-1 +1 such that the vectors Tr f g q i +1 ≡ P Tr f ′ g q i +1 .

Proof. By Proposition 4.18, we can write f = f 1 g q i -q i-1 +1 + f 2 with f 2 ∈ R g q i -q i-1 +1 and deg a,b (f 2 ) ≤ deg a,b (f ). Therefore, using Equation (4.8), we get Tr f g q i +1 = Tr f 1 g q i -q i-1 +1 g q i +1 + Tr f 2 g q i +1 ≡ P Tr f q 1 g g q i +1 + Tr

f 2 g q i +1 .
By definition, the second term has the expected form. Let us examine the first term. If f 1 = 0, we are done. Otherwise, the definition of f 1 gives deg a,b (f 1 ) = deg a,b (f ) -s ′ (q i -q i-1 + 1), and

deg a,b (f q 1 g) = q deg a,b (f 1 ) + s ′ = q deg a,b (f ) -s ′ (q -1)(q i + 1).
Then deg a,b (f q 1 g) < deg a,b (f ) if and only if deg a,b (f ) < s ′ (q i + 1), which holds by definition of f . Performing a new division by replacing f with f q 1 g gives a new decomposition

f q 1 g = f ′ 1 g q i -q i-1 +1 +f ′ 2 , with f ′ 2 ∈ R g q i -q i-1 +1 and deg a,b (f ′ 2 ) ≤ deg a,b (f ).
In particular, we can decompose Tr

f q 1 g g q i +1
into a sum of traces as we did for Tr f g q i +1 . If f ′ 1 = 0, the result is proved. Otherwise, we can repeat another time the division process. As the weighted degree of the successive quotients decrease, we ultimately end up with a quotient equal to zero, which proves the result. Definition 4.20. For any 1 ≤ i ≤ ⌊ m 2 ⌋, we define

T i (s, g) := ev P Tr f g q i +1
| f ∈ R g q i -q i-1 +1 ∩ L(s(q i + 1)P ∞ )

and we set

T 0 (s, g) := ev P Tr f g 2 | f ∈ L(2sP ∞ ) .
The vector spaces T i (s, g) have been designed so that we have

Tr C ⋆ C q i ⊆ T i (s, g) (4.9)
for all i ∈ 0, . . . , m

2

. Indeed, it is straightforward for i = 0 and it follows from Lemma 4.19 for i ≥ 1, noticing that f ∈ L(sP ∞ ) • L(sP ∞ ) q i ⊆ L(s(q i + 1)P ∞ ).

We will benefit from these inclusions to improve the bound given in Proposition 4.10, provided that we can efficiently compute the dimension of the trace codes T i (s, g). This is studied in the next section.

Upper bound in Goppa-like case

In the proposition below, we study the intersection M i (s, g) := R g q i -q i-1 +1 ∩ L(s(q i + 1)P ∞ ) (4.10)

for every i ∈ {1, . . . , ⌊m/2⌋}, in order to better grasp the trace codes T i (s, g)'s introduced in Definition 4.20. First we set some notation: fix i ∈ {1, . . . , ⌊m/2⌋} and write LM (g) = x β y α with aβ + bα = s ′ . By reducing modulo the equation f a,b of X a,b , we can write the function g q i -q i-1 +1 such that its leading monomial with respect to the monomial order ≺ is LM g q i -q i-1 +1 = x βi y αi (4.11)

where α i ∈ {0, . . . , a -1} is the remainder of the Euclidean division of α(q i -q i-1 + 1) by a and

β i = β(q i -q i-1 + 1) + b α(q i -q i-1 + 1) -α i a = s ′ (q i -q i-1 + 1) -bα i a .
(4.12)

Depending on the weighted degree s ′ of g, we can compute the exact dimension of the vector space M i (s, g) defined in Equation (4.10).

Proposition 4.21. 1. If s ′ (q i -q i-1 + 1) > s(q i + 1) + a, then M i (s, g) = L(s(q i + 1)P ∞ ); 2. If s ′ (q i -q i-1 + 1) ≤ s(q i + 1) + 1 -2g a,b , then M i (s, g) = R(g q i -q i-1 +1 );

3. If there exists v * ∈ {1, . . . , α i -1} such that

s(q i + 1) + a -b(a + v * -α i ) < s ′ (q i -q i-1 + 1) ≤ s(q i + 1) + a -b(a + v * -1 -α i ),
we have

dim F q m (M i (s, g)) = a-1 v=v * s(q i + 1) -bv a + v * (β i + b) + a -v * .
4. Otherwise, there exists v * ∈ {α i + 1, . . . , a} such that

s(q i + 1) + a -b(v * -α i ) < s ′ (q i -q i-1 + 1) ≤ s(q i + 1) + a -b(v * -1 -α i ), in which case dim F q m (M i (s, g)) = a-1 v=v * s(q i + 1) -bv a + v * β i + α i b + a -v * .
Proof. Using the notation above, we can write

R g q i -q i-1 +1 := Span F q m {x u y v | u ≤ β i + b -1, v ≤ a -1 not both u ≥ β i and v ≥ α i } = Span         1, x, . . . , x βi+b-1 , • • • y αi-1 , y αi-1 x, . . . , y αi-1 x βi+b-1 , y αi , y αi x, . . . , y αi x βi-1 , • • • y a-1 , y a-1 x, . . . , y a-1 x βi-1        
Next, we define for any v ∈ {0, . . . , a -1}:

ℓ i v := max u ≥ 0 | x u y v ∈ L(s(q i + 1)P ∞ ) = s(q i + 1) -bv a , implying L(s(q i + 1)P ∞ ) = Span      1, x, . . . , x ℓ i 0 , y, yx, . . . , yx ℓ i 1 , • • • y a-1 , y a-1 x, . . . , y a-1 x ℓ i a-1      .
We thus have a description of a basis of both spaces R(g q i -q i-1 +1 ) and L(s(q i + 1)P ∞ ), leading to an exact formula for the dimension of their intersection M i (s, g) for any value of i:

dim F q m M i (s, g) = αi-1 v=0 min(β i + b, ℓ i v + 1) + a-1 v=αi min(β i , ℓ i v + 1). ( 4

.13)

It remains to compute the corresponding minima with respect to v:

(i) If 0 ≤ v ≤ α i -1
, by using (4.12), we get

β i + b ≤ ℓ i v + 1 ⇐⇒ s ′ (q i -q i-1 + 1) ≤ s(q i + 1) + a -b(a + v -α i ) := F (v).
(ii) Otherwise, α i ≤ v ≤ a -1 and

β i ≤ ℓ i v + 1 ⇐⇒ s ′ (q i -q i-1 + 1) ≤ s(q i + 1) + a -b(v -α i ) := G(v).
Note that both F and G are decreasing with v, and we easily check that F (0) = G(a). Thus, we have the following sequence of integers

F (α i -1) ≤ • • • ≤ F (0) = G(a) ≤ G(a -1) ≤ • • • ≤ G(α i ).
Depending on the value of s ′ , there are a few cases to consider:

• s ′ (q i -q i-1 + 1) > G(α i ), in which case M i (s, g) = L(s(q i + 1)P ∞ );

• s ′ (q i -q i-1 + 1) ≤ F (α i -1), and M i (s, g) = R(g q i -q i-1 +1 );

• There exists v * ∈ {1, ..., α i -1} such that F (v * ) < s ′ (q i -q i-1 + 1) ≤ F (v * -1);

• There exists v * ∈ {α i , ..., a} such that G(v * ) < s ′ (q i -q i-1 + 1) ≤ G(v * -1).

The formulas for the dimension of M i (s, g) follows from the above computations and (4.13).

Note that item 1. corresponds to the case where T i (s, g) = Tr g -(q i +1) • L(s(q i + 1)P ∞ ) , which would produce the same bound as the one given in Proposition 4.10. Instead, we focus on item 2., since in this case, we can show some inclusion relations between the T i (s, g)'s. Proposition 4.22. Keep above notation and let i * ∈ 0, . . . , ⌊ m 2 ⌋ -1 be the smallest integer such that sq i * ≥ (s ′ -s)(q i * +1 -q i * + 1) + 2g a,b -1. (4.14)

Then T i * (s, g) ⊆ T i * +1 (s, g) ⊆ • • • ⊆ T ⌊ m 2 ⌋ (s, g).
Proof. From Proposition 4.21 (2), we know that (4.14) implies

M i * +1 (s, g) = R(g q i * +1 -q i * +1-1 +1 ).
We can easily check that the function i → s(q i + 1) + 1 -2g a,b q i -q i-1 + 1 is increasing with i, hence we also have

M i (s, g) = R(g q i -q i-1 +1 ), ∀ i ∈ i * , . . . , m 2 + 1 . (4.15)
We now prove the inclusions between the T ′ i s, assuming first that i * ̸ = 0 (since the definition of T 0 is a bit different). Let i ∈ i * , . . . , ⌊ m 2 ⌋ -1 , and recall that

T i (s, g) := ev P Tr f g q i +1
| f ∈ R g q i -q i-1 +1 ∩ L(s(q i + 1)P ∞ )

Given an element ev P Tr f

g q i +1
in T i (s, g), we want to show that it belongs to T i+1 (s, g). Applying Proposition 4.18 by replacing f with f g q i+1 -q i and g by g q i+1 -q i +1 , we obtain

f g q i+1 -q i = f 1 g q i+1 -q i +1 + f 2 , (4.16)
with f 2 ∈ R(g q i+1 -q i +1 ) = M i (s, g) (using (4.15)) and deg a,b (f 2 ) ≤ deg a,b f g q i+1 -q i . Next, we write Tr f g q i +1 = Tr f g q i+1 -q i g q i+1 +1 = Tr f 1 g q i+1 -q i +1 g q i+1 +1 + Tr f 2 g q i+1 +1 ≡ P Tr f q 1 g g q i+1 +1 + Tr

f 2 g q i+1 +1 .
By assumption on f 2 , we immediately have that ev P Tr f2 g q i+1 +1 ∈ T i+1 (s, g). If f 1 = 0, we are done. Otherwise, we have from (4.16):

deg a,b (f 1 ) = deg a,b f g q i+1 -q i -deg a,b g q i+1 -q i +1 = deg a,b (f ) -s ′ . Thus deg a,b (f q 1 g) < deg a,b f g q i+1 -q i ⇐⇒ q deg a,b (f ) + (1 -q)s ′ < deg a,b (f ) + s ′ (q i+1 -q i ) ⇐⇒ deg a,b (f ) < s ′ (q i + 1),
which is true since in particular f ∈ L(s(q i + 1)P ∞ ) and s < s ′ . Since the weighted degree decreases, we can repeat the division process until eventually we obtain a quotient f 1 equal to zero (as in the proof of Lemma 4.19), which proves that T i (s, g) ⊆ T i+1 (s, g).

In the case i * = 0, we also have to prove that T 0 (s, g) ⊆ T 1 (s, g), which differs from the other cases due to the definition of T 0 . Let ev P Tr f g 2 ∈ T 0 (s, g), for some f ∈ L(2sP ∞ ). Using Proposition 4.18, this time replacing f with f g q-1 and g with g q+1 yields f g q-1 = f 1 g q + f 2 , with f 2 ∈ R(g q ) = M 1 (s, g) (using (4.15) again). Thus, we can write

Tr f g 2 = Tr f q 1 g g q+1 + Tr f 2 g q+1 , with ev P Tr f2 g q+1 ∈ T 1 (s, g). Since deg a,b (f 1 ) = deg a,b f g q-1 -deg a,b (g q ) = deg a,b (f ) -s ′ , we have deg a,b (f q 1 g) < deg a,b f g q-1 ⇐⇒ q deg a,b (f ) + (1 -q)s ′ < deg a,b (f ) + s ′ (q -1) ⇐⇒ (q -1) deg a,b (f ) < 2s ′ (q -1) ⇐⇒ deg a,b (f ) < 2s ′ ,
which holds since s < s ′ and f ∈ L(2sP ∞ ). Repeating the division process until we find a quotient equal to zero shows that T 0 (s, g) ⊆ T 1 (s, g). The other inclusions hold as in the case i * ≥ 1.

Combining the inclusions (4.9) with both the above propositions lead to a better understanding of the dimension of the square of the dual of one-point Goppa-like AG codes, namely:

:= dim F q m C L (X a,b , P, sP ∞ + (g)).
Then, for all e ∈ 0, . . . , ⌊ m 2 ⌋ , the dimension of Γ(P, sP ∞ , g) ⊥ ) ⋆2 is bounded from above by

dim Fq (Γ(P, sP ∞ , g) ⊥ ) ⋆2 ≤ m -1 2 -e mk 2 + dim Fq e i=0 T i (s, g) .
Moreover, if i * ≤ e ≤ ⌊ m 2 ⌋ is the integer satisfying equation (4.14) , we have dim Fq (Γ(P, sP ∞ , g) ⊥ ) ⋆2 ≤ m -1 2 -e mk 2 + ms ′ (q e -q e-1 + 1)

+ dim Fq i * -1 i=0 T i (s, g) -dim Fq T e (s, g) ∩ i * -1 i=0 T i (s, g) .
Proof. Starting from Equation (4.3) and using Equation (4.9), we have

dim Fq (Γ(P, sP ∞ , g) ⊥ ) ⋆2 ≤ ⌊m/2⌋ i=0 dim Fq Tr C ⋆ C q i ≤ dim Fq e i=0 T i (s, g) + ⌊m/2⌋ i=e+1 Tr C ⋆ C q i ≤ dim Fq e i=0 T i (s, g) + m -1 2 -e mk 2 ,
for all e ∈ 0, . .

T i (s, g) = dim Fq i * -1 i=0 T i (s, g) + dim Fq T e (s, g) -dim Fq T e (s, g) ∩ i * -1 i=0 T i (s, g) .
To finish the proof, we use the fact that M e (s, g) = R g q e -q e-1 +1 (see. Proposition 4.21, 2), hence we have dim Fq T e (s, g) ≤ m • dim F q m R g q e -q e-1 +1 = ms ′ (q e -q e-1 + 1).

Despite the fact that the upper bound given in Corollary 4.23 can be numerically computed with the knowledge of the degree s and the function g, it is hard to give a close formula for any parameter, since the intersections of the trace codes T i (s, g)'s are hard to manipulate. However, if we assume that i * = 0, we can sharpen the above result. Theorem 4.24. Suppose that s ≥ (s ′ -s)q+2g a,b -1 and let e * := min m 2 , log q k 2 s ′ (q-1) 2 + 1 . Then

dim Fq (Γ(P, sP ∞ , g) ⊥ ) ⋆2 ≤ mk + 1 2 - m 2 (k 2 (2e * + 1) + k -2s ′ (q e * -q e * -1 + 1)).
Proof. The condition s ≥ (s ′ -s)q + 2g a,b -1 exactly implies that i * = 0 and

T 0 (s, g) ⊆ T 1 (s, g) ⊆ • • • ⊆ T ⌊ m 2
⌋ (s, g), by Proposition 4.22. Thus, using Corollary 4.23 and the inequality dim Fq T e (s, g) ≤ m dim F q m R(g q e -q e-1 +1 ), we get dim Fq (Γ(P, sP ∞ , g) ⊥ ) ⋆2 ≤ min ms ′ (q e -q e-1 + 1) +

m -1 2 -e mk 2 ≤ min m 2 2s ′ (q e -q e-1 + 1) + k 2 (m -1) -2k 2 e ≤ min mk + 1 2 - m 2 k 2 (2e + 1) + k -2s ′ (q e -q e-1 + 1) .
the minimum being taking over e ∈ 1, . . . , ⌊ m 2 ⌋ . To get the best bound, we need to maximize the function F (e) = ek 2 -s ′ (q e -q e-1 + 1) over 1, . . . , ⌊ m 2 ⌋ . We compute the discrete derivative: ∆F (e) = F (e + 1) -F (e) = (e + 1)k 2 -s ′ (q e+1 -q e + 1) -ek 2 + s ′ (q e -q e-1 + 1) = k 2 -s ′ q e-1 (q -1) 2 . This function is decreasing with e, and the smallest value for which ∆F (e) ≤ 0 corresponds to its maximum. It is the smallest value of e such that k 2 ≤ s ′ q e-1 (q -1) 2 , i.e. e = log q k 2 s ′ (q -1) 2 + 1.

Several computational experiments showed then when the code C := C L (X a,b , P, sP ∞ + (g)) is sufficiently random, the bound given in Theorem 4.24 is sharp, leading to a distinguisher if the parameters of C are not well-chosen. We give a concrete example showing the sharpness of our bound (computations have been done using Magma [START_REF] Bosma | The Magma algebra system. I. The user language[END_REF]).

Example 4.25. Set q = 3 and m = 3. We consider the curve X over F q m = F 729 defined by

y 2 + y = x 3 + x + 2.
This elliptic curve X is a particular case of C 2,3 curve with genus g = 1. Set s ′ = s + 1 for s ≥ 0, and g ∈ F q m (X ) such that g = x β y α + g ′ , where aβ + bα = s + 1; and g ′ is sampled at random in L(sP ∞ ). For each such g, consider P g := X (F q m )\ Supp(g). Using Magma, we then compare the true dimension of the square of the dual of C g := Γ(P g , sP ∞ , g) with the upper bound given in Theorem 4.24 for s ∈ {4, . . . , 10}. Results can be found in In the last section, we discuss how to efficiently choose the parameters of a one-point Goppa-like AG code in order to resist this distinguisher.

Analysis of the distinguisher

In the previous section, we provided an (experimentally) sharp upper bound on the dimension of the square of the dual of a one-point Goppa-like AG code, which could lead to a distinguisher for the corresponding code. More precisely, let C := C L (X a,b , P, sP ∞ + (g)) be an AG code as above, with deg a,b (g) := s ′ > s ≥ 2g a,b -1. We showed that if s and s ′ are such that s ≥ (s

′ -s)q + 2g a,b -1, then dim Fq (Γ(P, sP ∞ , g) ⊥ ) ⋆2 ≤ min m 2 2s ′ (q e * -q e * -1 + 1) + k 2 (m -1 -2e * ) , n , (4.17)
where e * := log q k 2 s ′ (q -1) 2 + 1. Thus, the code is distinguishable from a random one only if the right-hand side of Equation (4.17) is smaller than the length n of the code. It is possible to study when this case occurs, by starting to bound from above the maximal possible length: since P ∩ Supp(g) = ∅, this maximum is reached when P = X a,b (F q m )\{P ∞ } and g has no rational zero, that is

n = #P = |X a,b (F q m )| -1 ≤ q m + 2g a,b √ q m ,
using the Hasse-Weil bound (Theorem 1.71). In order to protect the code against the distinguisher, the parameters have to be chosen such that

m 2 2s ′ (q e * -q e * -1 + 1) + k 2 (m -1 -2e * ) ≥ q m + 2g a,b √ q m . ( 4

.18)

Remark 4.26. As already discussed, the bound given in Theorem 4.24 looks to be sharp whenever the function g is randomly chosen. As it is an experimental consideration, we warn the reader that the condition given in Equation (4.18) might not be sufficient : more precisely, it may happens that our bound is bigger than n, but the real dimension of (Γ(P, sP ∞ , g) ⊥ ) ⋆2 is not.

In what follows, we focus on two specific classes of C a,b curves. First, we determine the maximal (with respect to the dimension) codes we can distinguish in the case where X a,b is an elliptic curve. This case is relevant since it is the closest to the case of classical Goppa codes, and we will see that our results are very similar to the one given in [START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF]. Next up, we focus on the particular case of the Hermitian curve, which also turns out to be a X a,b curve. It is well-known to be a good candidate to construct efficient codes as it is a maximal curve. Due to its high genus, we then show that any one-point Goppa-like code defined on it cannot be distinguished.

High rate distinguishable codes in the case of elliptic curves

Let X a,b be an elliptic curve, i.e. a = 2 and b = 3. For some set of parameters which produces codes of cryptographic size, we compute the maximal distinguishable value of s. To get close to the case of classical Goppa codes, we also fix s ′ = s + 1.

As it was noticed in [START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF] and as we can see in

Codes on the Hermitian curve

As the Hermitian curve is a particular case of C a,b curve, we investigate the behaviour of one-point Goppa-like AG codes constructed on it with respect to our distinguisher. In particular, we show that all these codes resist to it, since Equation (4.18) always holds in this setting, essentially because the genus of the Hermitian curve is too high with respect to the size of the field. Let us first recall some known results about the Hermitian curve (see for example [START_REF] Stichtenoth | Algebraic function fields and codes[END_REF]). Let m ≥ 1 be an even integer and denote by q 0 := q m/2 , so that F q m = F q 2 0 . The Hermitian curve H over F q 2 0 is defined by the equation H :

y q0 + y = x q0+1 .
Its genus is given by g H = q0(q0-1) 2 and it is a maximal curve, i.e. #H(F q 2 0 ) = q 3 0 + 1. Proposition 4.27. Suppose s ≥ (s ′ -s)q + 2g H -1. Then for any choice of g and P, the one-point Goppa-like code Γ(P, sP ∞ , g) resists the distinguisher given in Theorem 4.24.

Proof. As discussed at the beginning of the section, the code cannot be distinguished whenever Equation (4.18) holds. In this particular case, we know exactly the number of rational points, hence the length n of the Goppa-like code is at most q 3 0 . Since m is even, we are left to prove that B(e * ) := ms ′ (q e * -q e * -1 + 1) + m 2 -e * mk 2 ≥ q 3 0 ,

where k

:= dim F q m C L (H, P, sP ∞ + (g)) = s + 1 -g H .
-If e * < m 2 , then B(e * ) > mk 2 . Using the assumption on s and s ′ , we know that s ≥ 2g H +q -1. This yields k ≥ g H + q and thus

B(e * ) -q 3 0 > m(g 2 H + 2g H q + q 2 ) -q 3 0 > m 4 (q 4 0 -2q 3 0 + q 2 0 ) + mq(q 2 0 -q 0 + q) -q 3 0 ≥ 1 2 (q 4 0 -2q 3 0 + q 2 0 ) + 4(q 2 0 -q 0 + 2) -q 3 0 (m ≥ 2 and q ≥ 2) > q 0 2 (q 3 0 -4q 2 0 + 9q 0 -8) > 0,
since q 0 ≥ 2. Inequality (4.19) holds in this case.

-If e * = m 2 , then since q 0 = q m/2 , we have B m 2 = ms ′ (q 0 -q 0 q -1 + 1). Moreover, s ′ > s implies s ′ ≥ 2g H + q, and B m 2 -q 3 0 ≥ m(2g H + q)(q 0 -q 0 q -1 + 1) -q 3 0 ≥ 2 q 2 0 (q 0 -1) q -1 q + q 0 (q 0 -1) + q 0 (q -1) + q -q 3 0 ≥ q 3 0 2

q -1 q -1 + 2q 2 0 1 - q -1 q + 2(q 0 (q -2) + q).
Clearly, the last expression is minimal for q = 2, so we finally get

B m 2 ≥ q 2 0 + 4 > 0,
which proves (4.19) in this case and conclude the proof.

Consequently, it is still reasonable to consider the Hermitian curve to build efficient SSAG codebased cryptosystem. In Table 4.4, we provide parameters for one-point Goppa-like Hermitian codes that resist the distinguisher given in Section 4.3. They also improve key sizes compared to the subfield subcodes of 1-point Hermitian codes parameters reported in [NEK21, Tables 2 and3], which already reduced key sizes compared with binary Goppa codes. The notation are as follow:

• q 0 is such that our codes are defined over F q 2 0 and m = 2 (i.e q = q 0 ); • s is the degree of the divisor D = sP ∞ + (g);

• n and k denote the length and the dimension of our codes, respectively;

• t is the correction capability;

• Prange complexity denotes the exponent in the complexity of running the ISD algorithm (see.

[Pra62]);

• Key sizes are computed via the formula k(n -k)⌈log 2 (q)⌉, and expressed in Bytes. Chapter 5

q 0 s n k t

IOP of Proximity to AG codes on the Hermitian tower

The context of this Chapter can be found in Section 2.2. Here, we are interested in proximity tests to several families of AG codes, as they are good candidates to construct short proof systems. The main idea is to adapt the protocol FRI described in Section 2.2.3, which is an efficient IOP system to test proximity to a Reed-Solomon code. This Chapter is based on [START_REF] Bordage | Interactive oracle proofs of proximity to algebraic geometry codes[END_REF], in which IOPPs for some families of AG code are proposed and studied: the case of Kummer codes and the case of AG codes defined over the so-called Hermitian tower. As my contribution to this work concerns the second family, we focus on this case. At several points, some technical results will be given without proofs, in which cases we refer the reader to [START_REF] Bordage | Interactive oracle proofs of proximity to algebraic geometry codes[END_REF].

In 2020, Bordage and Nardi [START_REF] Bordage | Interactive oracle proofs of proximity to algebraic geometry codes[END_REF] gave a clear criterion for constructing IOPPs for AG codes with linear proof length and sublinear query complexity, as well as a concrete instantiation for AG codes defined over Kummer curves. In the case of AG code defined over a tower of Hermitian curve, we then provide a family of foldable codes compatible with their definition of proximity testing, as well as properties of the IOPP than can be derived from it.

The Chapter is organized as follows: In Section 5.1, we start by giving a definition for AG codes to be compatible with proximity testing. Then, an explicit family of foldable AG code along the Hermitian tower is given in Section 5.2. Finally, Sections 5.3 and 5.4 are dedicated respectively to the folding operator used to reduce the proximity test to a smaller code and the corresponding IOPP and its properties.

Sequence of AG codes compatible with proximity tests

In this section, we give a general definition of foldable AG codes, valid both in the case of codes along the Hermitian tower and codes over Kummer-type curve (treated in [START_REF] Bordage | Interactive oracle proofs of proximity to algebraic geometry codes[END_REF]). More precisely, this can be done by considering a sequence of curves equipped with automorphisms subgroups. As we want to keep this section quite general, let F be any finite field.

Sequence of curves

Let X be a curve defined over the finite field F and a finite solvable group G ⊆ Aut(X ). By solvability of G, there exists a sequence of subgroups

{Id} := G 0 ◁ G 1 ◁ • • • ◁ G r := G, (5.1)
such that each G i-1 is a normal subgroup of G i and the factor group Γ

i := G r+1-i /G r-i ≃ Z/p i Z is cyclic of order p i (for 1 ≤ i ≤ r).
In particular, the cardinality of G equals |G| = r i=1 p i . From Galois theory, the group Γ r = G 1 /G 0 = G 1 acts on X r := X , we then define the corresponding quotient curve X r-1 := X r /Γ r . Repeating this process for each i ∈ {1, • • • , r}, we recursively obtain a sequence of curves as follows:

X r := X and X i-1 := X i /Γ i .

We set F i := F(X i ) their corresponding function field and we denote by π i : X i → X i-1 the canonical Remark 5.3. In the literature, the divisor π i * (D) is sometimes referred to as the pushforward of the divisor D. We warn the reader that this definition differs from our notion of pushforward, as defined in Definition 3.2 with the notation D. Definition 5.4 (Compatibility). Fix i ∈ {1, • • • , r}, G i ∈ Div(F i ) and a function µ i ∈ F i which partitions L Fi (G i ) in the sense of Equation (5.3). A divisor G i-1 ∈ Div(F i-1 ) is said to be (G i , µ i )compatible if the following assertions hold:

1. for every j ∈ {0, • • • , p i -1}, G i-1 ≥ E i,j ; 2. for every j ∈ {0, • • • , p i -1}, there exists a function ν i-1,j ∈ F i-1 such that (ν i-1,j ) Fi-1 ∞ = G i-1 -E i,j .
The functions ν i-1,j are called balancing functions.

The first requirement imposed on the sequence of divisors ensures that L(E i,j ) ⊆ L(G i-1 ) and second means that for every f j ∈ L(E i,j ), the function ν i-1,j f j lies in L(G i-1 ). We now come to the definition of foldable AG code. Definition 5.5 (Foldable AG codes). Let C = C L (X , P, G) be an AG code on a curve X . We say it is foldable if the following conditions are satisfied:

1. there exists a finite solvable group G ⊆ Aut(X ) that acts freely on P. A composition series of G as in Equation ( 5.1) provides an (X , G)-sequence of curves (X i ) i ;

2. there exists e ∈ (0, 1) such that |G| > |P| e ;

3. there exists two sequences (µ

i ) i ∈ F i = F(X i ) and (G i ) i ∈ Div(X i ) such that G r = G and for every i ∈ {1, • • • , r}:
-the divisor G i is supported by Γ i -fixed points;

-the function µ i partitions L Xi (G i ) in the sense of Definition 5.2; -G i-1 is (G i , µ i )-compatible (Definition 5.4).

Remark 5.6. The second requirement in Definition 5.4 is really compelling and requires geometric knowledge about the curves X i . In fact, on a general curve, not every effective divisor is the pole locus of a function, and characterizing which divisor indeed arises this way is at the center of the Weierstrass gap theory, at least while considering one-point divisors. We will come back at discussion in concrete instances, while seeking for balancing functions ν i-1,j .

Foldable AG codes along the Hermitian tower

Preliminaries

Let F q be a finite field. In what follows, we deal with curves and AG codes defined over the field F q 2 , as the well-known Hermitian curve as to be defined over a field of square cardinality. The study of the Hermitian tower has been initiated in [START_REF] Shen | A justesen construction of binary concatanated codes that asymptotically meet the zyablov bound for low rate[END_REF]. In addition, details about the Hermitian curve can also be found in [Sti09, Section 6.4]. In the discussion below, we describe an efficient way to build a sequence of AG codes C L (X i , P i , G i ) along a tower of Hermitian curves.

Sequence of curves. We consider the sequence of function fields F = (F i ) i≥0 over F q 2 , recursively defined by F 0 = F q 2 (x 0 ) and F i = F i-1 (x i ), where

x q i + x i = x q+1 i-1 , for all i ≥ 1. ( 5.4)
According to Theorem 1.35, the tower F corresponds to a tower of curves (X i ) i≥0 such that F i = F q 2 (X i ), for any i ≥ 0. Also, we can view each curve X i embedded into an i-dimensional projective space with variables (x 0 , • • • , x n ) defined by the equations (5.4).

Remark 5.7. For i = 1, the field F 1 is nothing but the Hermitian function field H over F q 2 , those main properties are given in [START_REF] Stichtenoth | Algebraic function fields and codes[END_REF]Lemma 6.4.4].

Let g i := g(F i ) denotes the genus of the function field F i . An explicit formula for every i ≥ 0 is given by the following proposition:

Proof.

1. For this part of the proof, see also [START_REF] Böttcher | Lattices from Hermitian function fields[END_REF]Section 2]. We prove the result by induction on i ≥ 0. Let P (0) be the zero of x in the rational function field F 0 = F q 2 (x 0 ), i.e. (x 0 ) = P (0) -P (0) ∞ .

Since F 1 is the Hermitian function field (particular case of Artin-Schreier extension), it is wellknown ([Sti09, Lemma 6.4.4]) that P (0) completely splits in F 1 /F 0 . More precisely, there are exactly q elements β ∈ F q 2 such that β q + β = 0, and each of them corresponds to a place P

(1) 0,β in F 1 such that x 0 (P (1) 0,β ) = 0 and x 1 (P (1) 0,β ) = β. With such notation, we denote by P (1) := P

(1) 0,0 the unique common zero of x 0 and x 1 in F 1 . From the equation x q 1 + x 1 = x q+1 0 , the functions x 0 and x 1 have the same zeros in F 1 , and

q • ν P (1) ∞ (x 1 ) = -(q + 1) • e(P (1) ∞ |P (0) ∞ ), that is ν P (1)
∞ (x 1 ) = -(q + 1). Consequently, (x 1 ) F1 = (q + 1) P (1) -P

(1) ∞

, which proves the result for i = 1. Since any extension F i /F i-1 corresponds to the same Artin-Schreier extension, we can recursively prove that for any i ≥ 0, the functions x i , x i-1 , • • • , x 1 , x 0 have only one common zero in F i , denoted by P (i) . More precisely, this place arises as the only extension in F i of P (i-1) such that x i (P (i) ) = 0. Using this time the equation x q i + x i = x q+1 i-1 , we deduce from the formula for (x i-1 ) Fi-1 that q • ν P (i) ∞ (x i ) = -(q + 1)(q + 1) i-1 • e(P (i) ∞ |P (i-1)

∞

), hence ν P (i) ∞ (x i ) = -(q + 1) i .

2. Consequence of 1 applied to (x j ) Fj , and the fact that

e P (i) ∞ |P (j) ∞ = [F i : F j ] = q i-j .
Basis of the Riemann-Roch space associated with the divisor

d i P (i) ∞ . Given i ≥ 0, P (i)
∞ is the unique pole of all functions x 0 , • • • , x i . Since we know all their valuation at P (i) ∞ (see Lemma 5.10, 2 ), we have an explicit basis for of the Riemann-Roch space associated to the one-point divisor mP (i) ∞ . Lemma 5.11. For all i ≥ 1 and m ≥ 1, we have

L Fi (mP (i) ∞ ) = Span   x a0 0 • • • x ai i | 0 ≤
a 0 , 0 ≤ a j ≤ q -1 and i j=0 a j q i-j (q + 1) j ≤ m   .

Proof. It is clear that all functions x a0 0 , • • • , x ai i belong to L Fi (mP

(i)
∞ ). To show that they indeed form a basis, we make use of the Weierstrass gap theory at P (i) ∞ (whose Weierstrass semigroup is defined in Equation (5.8)). More precisely, we show that we have exactly dim F q 2 L Fi (mP

Construction of foldable AG codes

We aim to define a sequence of AG codes on the tower (X i ) i≥0 that is compatible with the definition of our folding operator (see Definition 5.16). More especially, for some fixed i ≥ 0, we consider the one-point AG code C L (X i , P i , G i ) , where P i ⊆ X i (F q 2 )\ P (i) ∞ and G i = d i P (i) ∞ , defined on the curve X i . To obtain a sequence of foldable codes, we need to describe the Riemann-Roch space of G i using Riemann-Roch spaces on lower curves. In the case of AG code over Kummertype curves, a decomposition as in Equation ( 5.3) is performed by using [Mah04, Theorem 2]. Unfortunately, the latter theorem only works for specific cyclic extensions whose degree is prime to the characteristic of the base field, which is not the case here since the degree of our automorphism exactly equals the characteristic. Hence, we have to find a decomposition by hand, which can be done thanks to the explicit basis of the Riemann-Roch spaces given in Lemma 5.11, and is the subject of the next proposition.

Folding operators for AG codes

In Section 5.2.2, we determined the needed properties for an AG code to be foldable (in the case of the Hermitian tower). We now construct the so-called folding operator, which ensures that at each step of the IOPP protocol, the proximity test of a given AG code can be reduced to the proximity of its folded code. We then study its properties.

To keep the framework general, we use below the same notation as in Section 5.1. Let (C i ) r i=0 = (C L (X i , P i , G i )) r i=0 be a family of foldable AG codes on a sequence of curves (X i ) i defined over some finite field F, where C r satisfies all conditions in Definition 5.5. In the context of an IOPP, we want to test proximity of a function f (r) : P r → F to the code C r . To do so, we aim to inductively reduce the problem to a smaller one, consisting of testing proximity to some smaller code C i . More precisely, our goal is to define from any function f (i) : P i → F another function f (i-1) : P i-1 → F such that the relative distance ∆(f (i-1) , C i-1 ) is roughly equal to ∆(f (i) , C i ).

The folding operator. Fix i ∈ {1, . . . , r} and consider an arbitrary function f : P i → F. For each P ∈ P i-1 , we denote by S P := π -1 i ({P }) the set of p i places in X i above P . Let I f,P (X) := pi-1 j=0 a j,P X j ∈ F[X]

be the univariate polynomial of degree less than p i which interpolates the set of points

{(µ i (Q), f (Q)) | Q ∈ S P }
(i.e. for all Q ∈ S P , we have I f,P (µ i (Q)) = f (Q)), where µ i is the function that partitions L Fi (G i ).

For any j ∈ {0, . . . , p i -1}, we then define the function

f j : P i-1 → F P → a j,P .
By assumption, we have |P i-1 | = |Pi| pi , hence the idea is to define p i functions f j such that f corresponds to the evaluation of a function in L Fi (G i ) if and only if each f j coincides with a function in L Fi-1 (E i,j ) ⊂ L Fi-1 (G i-1 ). Now, instead of testing whether f j ∈ C i-1 for all j, we reduce those claims into a single one by taking a random linear combination of f j 's, referred to as the folding of f. At this point, note that for soundness analysis, the introduction of the balancing functions ν i-1,j in the definition of compatible divisors guaranties that no f j corresponds to a function lying in L Fi-1 (G i-1 )\L Fi-1 (E i,j ). This explains why the folding operation takes it into account. Properties of the folding operator. In this paragraph, we give without proofs three key properties satisfied by our folding operator. This will, using [ABN22, Theorem 1], prove the completeness and the soundness of our AG-IOPP. The proofs of the upcoming results can be found in [BNLR22], Section 7.2.

Proposition 5.17. The folding operator defined above satisfies the following properties:

1. Locality. Let z ∈ F 2 . Then for each P ∈ P i-1 , the value of Fold[f, z](P ) can be computed with exactly p i queries to the function f , namely at the points π -1 i ({P }). 2. Completeness. Let z ∈ F 2 . If f ∈ C i , then Fold[f, z] ∈ C i-1 .

3. Distance preservation. For δ > 0, if f is δ-far from C i (i.e. ∆(f, C i ) > δ), then its folding Fold[f, z] is δ-far from C i-1 with high probability on z ∈ F 2 .

AG-IOPP on the Hermitian tower

Given a family (C i ) r i=0 = (C L (X i , P i , G i )) r i=0 of foldable AG codes over a finite field F, we informally describe the IOPP system (P,V) for testing proximity of a function f (r) : P r → F to the code C r in a general case, before studying its properties in the case of the family of codes along the Hermitian tower given in Proposition 5.15. Again, proofs and details can be found in [START_REF] Bordage | Interactive oracle proofs of proximity to algebraic geometry codes[END_REF], Section 8.

Description of the AG-IOPP system

Our IOPP system is divided into two phases, referred to as COMMIT and QUERY phase. Before any interaction, both the verifier V and the prover P agree on the sequence of foldable codes (C i ) r i=0 satisfying Definition 5.5 (that is, for all i ∈ {1, . . . , r}, they agree on: the curve X i , support P i , divisor G i , function µ i and balancing functions ν i-1,j for j ∈ {0, . . . , p i -1}).

COMMIT phase. This first phase consists in an interaction over r rounds between the prover P and the verifier V. For each round i ∈ {1, . . . , r} , the verifier samples a random challenge z (i) = (z

(i) 1 , z (i)
2 ) ∈ F 2 . As an answer, the prover gives oracle access to a function f (i-1) : P i-1 → F, which is expected to be equal to Fold f (i) , z (i) . To compute the values of f (i-1) on the set P i-1 , an honest prover exploits the fact that the folding f (i-1) of f (i) is locally computable (see Proposition 5.17, 1 ). This phase ends up with P sending a final function f (0) : P 0 → F.

The COMMIT phase is depicted in Figure 5.1. For both this figure and Figure 5.2, full lines means that the data can be seen in full, while dotted lines correspond to an oracle access.

Prover

Verifier

f (r)
(F, X r , P r , G r )

z (r) ← F 2 f (r-1)
z (r-1) ← F 2 f (r-2) . . .

z (1) ← F 2 f (0)
COMMIT Phase f (r-1) = Fold f (r) , z (r) f (r-2) = Fold f (r-1) , z (r-1)

. . .

f (0) = Fold f (1) , z (1)
Final test: f r ∈ C r During the QUERY step, the task of the verifier is to check that each consecutive pair of oracle functions f (i) , f (i-1) is consistent, i.e. that f (i-1) is indeed constructed as the folding of f (i) . More precisely, the idea is to check that the equality f (i-1) (P ) = Fold f (i) , z (i) (P ) (5.12) holds at a random point P ∈ P i-1 . Again, the local property of the folding operator ensures that each test only requires p i queries to f (i) and one to f (i-1) . This verification test is referred to as round consistency test. The set of points in which Equation (5.12) has to be checked is chosen by V in the following way: at the beginning, a random Q r ∈ P r is sampled. Then, for each round i ∈ {1, . . . , r}, V computes the next location test as Q i-1 := π i (Q i ). The set {Q 1 , . . . , Q r } is called query path. Note that the correlation between the round consistency tests allows to improve the soundness of the IOPP. For the final test, V reads f (0) : P 0 → F entirely to decide if it belongs to C L (X 0 , P 0 , G 0 ) or not. The QUERY phase of the protocol can be repeated several times before the final decision of the verifier, hence improving the soundness error. Picture 5.2 sums up this discussion.

We then provide a sufficient condition on α and i max to bound from above the rate of C 0 , as well as the following examples: In Table 5.1, we display some examples of initial level i max and initial rate R imax of C imax for which the AG-IOPP reduces to the proximity test of the RS code C 0 of rate ρ. In particular, the lower bound on 1 -ρ provides an estimation of the minimum distance of C 0 .

q i max n R imax 1 -ρ > 2 4 3

Conclusion

For the three years that ended with this manuscript, we focused on how we could use algebraic geometry codes in post-quantum cryptography. More precisely, we worked in two different directions: the first consists in studying AG code-based cryptosystems (such as McEliece's encryption scheme), by either proposing new ones or analyzing the security of existing ones. The second way to use this family of codes is when constructing new and efficient proof systems. It is now time to sum up our contributions and present some perspectives.

In the case of McEliece's encryption scheme based on structured SSAG codes, we provided a security reduction of the corresponding secret key. Currently, the technique introduced can be applied whenever the public SSAG code is quasi-cyclic, either built on a Kummer cover or an elementary abelian p-cover of curves. With some additional work, we hope that this security reduction could be generalized to a solvable Galois cover of curves, at least under some technical assumptions. Moreover, some needed hypotheses could be weakened. The consequence of this work is that cautions have to be taken while constructing McEliece's scheme based on these codes in order to guarantee a good security level.

With the desire to generalize the construction of the distinguisher for alternant and classical Goppa codes proposed in [START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF], we define a new class of SSAG codes whose structure mimics theirs: Goppa-like AG codes. After successfully adapting the techniques of [START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF] to build a distinguisher, we study different sets of parameters for Goppa-like AG codes. The specific case of one-point Goppa-like AG codes constructed on the Hermitian curve might be interesting for designing efficient SSAG-based cryptosystems for the following reasons:

• they can be encoded efficiently, as the evaluation space is well-known;

• they are resistant to our distinguisher;

• for similar parameters, they improve key sizes compared with binary Goppa codes.

The remaining work of this thesis focuses on using AG codes while designing efficient proof systems, especially in the context of proximity tests to a linear code. Recognizing the effectiveness of the Reed-Solomon-based FRI protocol, a first AG codes-based IOPP has been proposed in [START_REF] Bordage | Interactive oracle proofs of proximity to algebraic geometry codes[END_REF]. Following this work, we propose another protocol, this time relying on codes constructed on the Hermitian tower, with the aim of correcting problems imposed by the choice of Reed-Solomon codes. In fact, considering recursive towers enables us to construct an IOPP on a polylogarithmicsize alphabet. Concerning efficiency, our concrete instance reaches quasilinear prover time and polylogarithmic verification.

As a conclusion, we point out perspectives motivated by our work: both Chapters 3 and 4 provide new cryptanalysis tools in the context of McEliece's encryption schemes, that might be useful for future constructions. The use of AG codes in proximity tests being now initiated, there are probably lots of ways to improve it: a first idea could be to consider codes constructed from an optimal tower of curves (Appendix B goes in that direction). Observing that the area of codebased cryptography is constantly in progress nowadays, we hope that our contributions could lead to significant improvements in the future.

in Supp(G). This can be done by finding roots of several polynomials: indeed, from Kummer's theorem [Sti09, Theorem 3.3.7], if x(Q) denotes the x-coordinate of a point R ∈ Supp( G), then the ycoordinates of the extensions of P in Supp(G) are exactly the roots of the polynomial T ℓ -f (x(Q)) ∈ F q m [T ]. This step can be done by factorizing each polynomial using Berlekamp algorithm, whose cost is O(ℓ ω + q m ℓ 2 ) operations over F q m . In any practical cases, the length of the public code is larger that the cardinality of the base field (i.e. n > q m ) and thus this step is also negligible. As a result, the total cost of Algorithm 1 is in O((φ(ℓ) + 1)(n ω + n ω-1 sk) over F q m . Algorithm 1: Security reduction in Kummer cover Input : A generator matrix M pub of the public SSAG code, P = {P 1 , • • • , P r } and G.

The integers ℓ and d. Output: A function f ∈ K and the secret structure (Q, G). 1 x ←-(x(P 1 ), ..., x(P 1 ) ℓ-times , ..., z(P r ), ..., z(P r ))

2 z ←-(z(P 1 ), ..., z(P 1 ) ℓ-times , ..., z(P r ), ..., z(P r )) Note that Algorithm 1 can also be used in the case of an elementary abelian p-extension of F q m (x), by only changing a few lines: in fact, in the latter setup, we have to solve at most p u = # Aut(L/F q m (x)) linear systems of the form (3.16) (p u := [L : F q m (x)]), whose total cost is in O(p u (n ω + n ω-1 sk)) operations over F q m . Ramification and genus. Note that every extension F i /F i-1 is a Kummer extension of degree 2, meaning that to obtain a good decomposition for Riemann-Roch spaces (as in Equation (5.3)) along this tower, we can use the same tool as in [START_REF] Bordage | Interactive oracle proofs of proximity to algebraic geometry codes[END_REF] for the case of foldable codes over Kummer type curves, which is Maharaj's theorem [Mah04, Theorem 2.2]. To apply it efficiently, we first need to control the principal divisors of x i ∈ F i for any i ≥ 0. Thankfully, a lot of work has been done in [START_REF] Noseda | Bases for riemann-roch spaces of one-point divisors on an optimal tower of function fields[END_REF] to understand the ramification behaviour in the tower. In their paper, they also provide a genus formula which will be useful at some point, as well as an explicit basis for Riemann-Roch spaces associated to one-point divisors. For the remaining of this section, we keep their notation and recall some of their results.

From now on, any place in F i will be denoted with an exponent "(i)" to signify that it belongs to the i-th function field F i is the tower. For each α ∈ F q ∪ {∞}, we denote by P (0) α the unique zero of x 0 -α in the rational function field F 0 = F q (x 0 ), and we consider the set R = P

∞ , P

i , P

-i denote their unique extension, we have:

ν P (i) ∞ (x i ) = -1, ν P (i) 0 (x i ) =
1 , i = 0 -1 , i ≥ 1 and ν P (i) ±i

(x i ) =    0 , i = 0 1 , i = 1 -1 , i ≥ 2;
2. The place P (i-1) 1

totally splits in F i . Its two extensions P (i) 1

and P (i)

-1 satisfy x i (P (i) 1 ) = 1 and x i (P (i) -1 ) = -1.

P

(i-1) -1 totally splits in F i ; its two extensions Q ) = 1 and

ν Q (i) r (x i ) = -2 2r+2-i , r ≤ i -3 -2 i-2 , r = i -2.
The sum of the degree of such places equals 2 i-r .

It turns out that all places described in Lemma B.1 are all the places above the set R in F, and more importantly; (x i ) Fi is only supported by these places. Except for Q (0) ±i = P (0) ±i , all places considered above are distinct. Definition B.2. For any i ≥ 0 and 0 ≤ r ≤ i, we define

D (i) r := Q (i) r |P (r) -1 Q (i) r ∈ Div(F i ).
We have D 1. For any i ≥ 0 and -2 ≤ r ≤ i, we have

deg D (i) r = 2 i-r , if i ≤ 2r + 2 2 r+2 , if i ≥ 2r + 2.
Proof. For items 1 and 2 , we refer to [NOQ11, Proposition 2.5]. For 3 , note that the functions x i and (1 + x 2 i ) have the same poles, and for any P (i) ∈ Supp(x i ) Fi ∞ , we have ν

P (i) (1 + x 2 i ) = 2 • ν P (i) (x i ). Moreover, D (i) i-1 = Q (i) i + Q (i)
-i by definition, so Lemma B.1 3 . gives the result, since deg((1

+ x 2 i ) Fi 0 ) = 2[F i : F 0 ] = 2 i+1 = 2 i deg D (i) i-1 .
We conclude this preliminary section with a genus formula for each function field in the tower F.

Proposition B.5 ([NOQ11, Proposition 2.6]). For i ≥ 0, the genus g i of F i is given by

g i =    2 i+2 2 -1 2 i 2 -1 , if i ≡ 0[2] 2 i+1 2 -1 2 , if i ≡ 1[2]. = 2 i+1 -3 • 2 i 2 + 1, if i ≡ 0[2] 2 i+1 -2 i+3 2 + 1, if i ≡ 1[2].

B.2 Towards foldable AG codes

As in the case of the Hermitian tower (see Section 5.2), we want to define a sequence of foldable AG codes along the tower F. In [START_REF] Noseda | Bases for riemann-roch spaces of one-point divisors on an optimal tower of function fields[END_REF], the authors give an explicit way to split Riemann-Roch spaces associated to the one-point divisor sP (i) ∞ ∈ Div(X i ), using Riemann-Roch spaces on X i-1 . This motivates the use of these one-point divisors to define our sequence of codes.

For any fixed i ≥ 1, the group G i = Z/2 i Z acts on X i and the quotient curve X i /G i is equal to the projective line P 1 . We want to deal with an AG code on X i of the form C L (X i , P i , G i ) , where P i ⊆ X i (F q 2 )\ P (i) ∞ is a support made of distinct orbits of size 2 i and G i = d i P (i) ∞ for some d i ≥ 0. Since P (i) ∞ is totally ramified in the tower (see Lemma B.1, 1 .), the divisor G i is also G i -invariant.

Splitting of Riemann-Roch spaces. The following theorem gives the desired decomposition of the Riemann-Roch space associated to the one-point divisor G i = d i P (i) ∞ . In particular, it implies that each x i ∈ F i partitions L Fi (G i ) with respect to Definition 5.2. Theorem B.6. Let i ≥ 1 and G i = d i P (i) ∞ ∈ Div(F i ), for some d i ≥ 0. Then

L Fi (G i ) = π * i-1 L Fi-1 (E i,0 ) ⊕ x i π * i-1 L Fi-1 (E i,1 ) ,
where

E i,0 = d i 2 P (i-1)
∞ and

E i,1 = 2 i-2 D (i-1) i-2 + d i -1 2 P (i-1) ∞ - ⌊ i-3 2 ⌋ r=-2 D (i-1) r - i-3 ⌊ i-1 2 ⌋ 2 2r-i+2 D (i-1) r if i ≥ 2.
The formula for E 1,1 is a bit different, i.e.

E 1,1 = D (0) -1 + d 1 -1 2 P (0) ∞ -P (0) 0 .
Proof. Consequence of [Mah04, Theorem 2.2] applied to the Kummer extension F i /F i-1 . The structure of E i,1 follows from the formula for (x i ) Fi (see Proposition B.4, 1.) and the ramification behaviour given in Lemma B.1.

Definition 1. 4 (

 4 Minimum distance). The minimum distance of a code C, denoted by d(C) or just d, is the minimum Hamming distance between two of its codewords, namely d(C) := min {d H (x, y) | x, y ∈ C and x ̸ = y} .

  Proposition 1.45 ([Sti09, Proposition 3.1.4]). With notation as above, the following assertions are equivalent: 1. Q|P . 2. There exists an integer e := e(Q|P ) ≥ 1 such that for all x ∈ L, ν Q (x) = e(Q|P )ν P (x).

  Definition 1.49 (Divisors). The divisor group of K, denoted by Div(K), is the free abelian group generated by the places of K. The elements of Div(K) are called divisors. In other words, any divisor D ∈ Div(K) is a formal sum D = P ∈P K n P P, where n P ∈ Z are all zero but finitely many. The support of D is defined by Supp(D) := {P ∈ P K | n P ̸ = 0} . Given a place P ∈ P K , we set ν P (D) := n P . The degree of the divisor D is defined by deg(D) := P ∈Supp(D) ν P (D) deg(P ).

  Definition 1.53 (Divisor class group). The factor group Cl(K) := Div(K)/ Princ(K) is called the divisor class group of K. For any D ∈ Div(K), we denote by [D] its class in Cl(K).

  The parameters n, k, t ∈ N and a finite field F.1. Select a family F of linear codes over F with an efficient decoding algorithm D. 2. Choose a [n, k] code C ∈ F correcting t errors. Let M be a k × n generator matrix of C and denote by D C an efficient decoding algorithm for C. Output: The public key pk = (M, t) and the secret key sk = D C .

2.

  Compute y := mM + e. Output: The cypher text y. Decryption: Input: A cypher text y = c + e, where c ∈ C. 1. Compute c = D C (y). 2. Recover the initial message m from the knowledge of c = mM and M by Gaussian elimination.

Proposition 3. 18 .

 18 With the above notation, let P ∈ P K and Q ∈ P L such that Q|P . Then e(Q|P ) = ℓ gcd(ℓ, ν P (f )) and d(Q|P ) = e(Q|P ) -1. Proof. See [Sti09, Proposition 3.7.3].

  ) := e(P ) does not depend on Q [Sti09, Corollary 3.7.2]. Keeping above notation, we know by definition that A = P ∈Supp(A) P, and thus π * A = P ∈Supp(A),Q|P e(Q|P ) • Q.

Proposition 4 .

 4 10. Let C := C L (X , P, D + (g)) be an AG code as above and assume s ≥ g. Set k := dim F q m C and e := min m 2 , log q k 2 s

  deg a,b (f ) := deg a,b (LM(f )) .

Proposition 4 .

 4 18. Fix any nonzero function g ∈ S. Then for any function f ∈ S, there existf 1 , f 2 ∈ S such that f = f 1 g + f 2 with f 2 ∈ R(g).Moreover, we have deg a,b (f 2 ) ≤ deg a,b (f ).

Corollary 4 .

 4 23. With notation of Proposition 4.22, set k

  functions. Details can be found in [She93, Proposition 6].

Definition 5 .

 5 16 (Folding operator). For any z = (z 1 , z 2 ) ∈ F 2 , we define the folding of f as the function Fold[f, z] : P i-1 → F such that Fold[f, z] := 1,j f j .

Figure 5 .

 5 Figure 5.1: AG-IOPP : COMMIT phase

3y

  D ←-(ℓ -1)(d -1) -2 + ℓar * ℓ P ∞ -G -A 4 B ←-a ℓ P ∞ 5 M ←-set of primitive ℓ-th roots of unity in F q m 6 temp := 0 7 while temp = 0 do -Solve(∆ 1 (ξ)) 11 if dim(S 1 ) = 1 then 12 S 2 ←-Solve(∆ 2 (ξ)) // ξ is now known 13 if dim(S 2 ) = 1 then 14 * ← y 2 ⋆ y -1 1 18 f ←-Interpolate(x, z, y * ) 19 Q ←-{Q i,j = (x i,j : z i,j : y * i,j : 1)} 20 G ←-π * ( G) 21 return f , Q and G

  totally ramified in F i /F 0 . If P

4 .

 4 the only zeros of the function1 + x 2 i ∈ F i , and ν Q (i) ±i (1 + x 2 i ) = 2 i ; Let 0 ≤ r ≤ i,and denote by Q and ν Q (i) r (x i ) = -1. Moreover, the sum of the degree of such places equals 2 r+2 .(ii) If ⌊ i-1 2 ⌋ ≤ r ≤ i -2, then Q

  and we can extend this definition for r = -2, and -1 by setting D

Table 4 .

 4 1: Comparison of Cartier and Goppa-like constructions

Table 4 .

 4 2.In our computing experiments, we can check that g always has simple zeros, hence sP∞+(g) ∞ . This example illustrates how the bound can be sharp when we are outside the scope of Proposition 4.11.n s dim Fq C g dim Fq (C g ) ⋆2 dim Fq (C ⊥ g ) ⋆2Upper bound in Theorem 4.

	3	=

Table 4

 4 .3, we are only able to distinguish high rate codes. The smallest distinguishable rates are roughly the same as the one given in[START_REF] Mora | On the dimension and structure of the square of the dual of a Goppa code[END_REF].

	4.4. ANALYSIS OF THE DISTINGUISHER

Table 4 .

 4 3: Largest distinguishable Goppa-like AG code in elliptic case.

Table 4 . 4

 44

			Prange complexity Key size (Bytes)
	11 265 1320 898	77	153	142 108
	13 312 2188 1718 77	198	302 798
	16 354 4078 3608 56	199	847 880
	13 490 2189 1363 166	270	422 189
	16 460 4080 3398 109	313	1 158 718

: Goppa-Like Hermitian codes parameters Γ(P, sP ∞ , g) over F q 2 .

Table 5 .

 5 1: Example of parameters of foldable codes of rate R along the Hermitian tower.

	2 5	5	2 20 2 35	1/8	1/3
	2 4	4	2 24		1/3
	2 5	3 5 4	2 25 2 35 2 36	1/16	3/4 1/2 3/4
	2 6	5	2 42		2/3
		7	2 54		1/2
	2 4	3	2 20 1/32	1/2

Remerciements

Goppa-like AG codes 4.2.1 Definition, parameters and context in the literature

The codes and their parameters. Let D be an effective divisor of positive degree s on a smooth and irreducible projective curve X over F q m . Denote by K = F q m (X ) the function field of X and take a rational function g ∈ K such that g / ∈ L(D). Given a set of rational points P ⊆ X (F q m ) such that P ∩ Supp(g) = ∅ and P ∩ Supp(D) = ∅, we consider the AG code C := C L (X , P, D + (g)) = ev P (f g -1 ) | f ∈ L(D) .

From now on, we also set G := D + (g).

Definition 4.5. The Goppa-like AG code associated to C is defined as the subfield subcode of its dual code, i.e.

Γ(P, D, g)

Such a code has length n = #P. As stated in [JM96, Theorem 1], if 2g -2 < deg D < n, its dimension satisfies dim Fq Γ(P, D, g) ≥ n -m dim F q m C L (X , P, D + (g)) = n -m(deg(D) -g + 1).

As for its minimum distance, it is bounded from below by deg(D) -2g + 2. Remark 4.6. These estimations of the dimension and the minimum distance may be improved by Theorem 1.85 and 1.87. Regarding the dimension, it is worth noting that, since g / ∈ L(D), the divisor G = D + (g) is not effective. Hence, any divisor G 1 satisfying the conditions of Equation (1.10) is also non-effective, which means that dim Fq Γ(P, D, g) ≥ n -m (ℓ(G) -ℓ(G 1 )) .

Without additional conditions on the divisor D and the function g, the divisor G U for G defined in Theorem 1.87 is zero. Generally, we cannot expect for a better bound for the minimum distance.

Why the terminology Goppa-like? In [START_REF] Janwa | McEliece public key cryptosystems using algebraicgeometric codes[END_REF], Janwa and Moreno define Goppa codes on smooth and irreducible projective curves. Compared to their definition, Definition 4.5 introduces a function g which defines a multiplicator for the AG code over F q m that is algebraically related to the support P.

Introducing this function g facilitates the use of SSAG as public keys for McEliece cryptosystems. Given an error correcting capability t, we can fix a divisor D whose degree satisfies deg(D) ≥ 2t + 2g + 1. Then the family of codes in which the public key is picked can be defined by running a family of functions g outside L(D).

The terminology Goppa-like AG codes instead of simply Goppa codes is motivated by the fact that we want to emphasize the use of a different curve than the projective line P 1 , like we differentiate AG codes from Reed-Solomon codes. In our definition, the rational function g plays the role of the Goppa polynomial. As described in [Sti09, Example 9.1.8], Goppa codes are nothing but Goppa-like AG codes from the projective line X = P 1 . In fact, given r ≥ 0, recall that the Generalized Reed-Solomon (GRS) code of dimension r, support x ∈ F n q m and multiplier y ∈ (F * q m ) n is defined as (see Section 1.3.4) GRS r (x, y) = {(y 1 f (x 1 ), y 2 f (x 2 ), . . . , y n f (x n )) | f ∈ F q m [X] such that deg(f ) < r}.

Take a univariate polynomial g of degree r such that g(x i ) ̸ = 0 for every i ∈ {1, . . . , n}. Then the Goppa code of order r and support x ∈ F n q m is defined as Γ r (x, g) = GRS r (x, y) ⊥ | Fq where y = (g(x 1 ) -1 , g(x 2 ) -1 , . . . , g(x n ) -1 ). As usual, represent the F q m -points of P 1 by the couples

x 2 ], . . . , [1 :

x n ]} and D = (r -1)P ∞ . Finally, the polynomial g can be seen as a function on P 1 which lies in L(rP ∞ ) but not in L((r -1)P ∞ ). Then both constructions match: Γ r (x, g) = Γ(P, D, g).

projection modulo the action of Γ i . We obtain a sequence of curves

where for each i ∈ {0, • • • , r}, F i := F(X i ). Even if the sequence of curves depends on the choice of the normal series (5.1), the last curve X 0 is always isomorphic to X /G. From now on, such a sequence of curves is referred to as an (X , G)-sequence.

Sequence of codes

Let (X i ) i be a (X , G)-sequence as above. For any i ∈ {0, . . . , r}, we aim to define an AG code

on the curve X i associated to a divisor G i ∈ Div(F i ) and a support P i ⊆ X i (F). The upcoming discussion explains how to choose P i and G i .

Choice of the evaluation sets. For our protocol, we need, for each i ∈ {1, • • • , r}, that every point in P i-1 admits exactly p i := |Γ i | preimages under the projection π i . For this reason, we choose the first support P r ⊆ X (F) as a (disjoint) union of G-orbits of size |G|, i.e. such that G acts freely on P r . This way, we can define for every i ∈ {1, • • • , r} the set P i-1 := π i (P i ).

Choice of the divisors. Let G r ∈ Div(F r ) be a divisor that is globally Γ r -invariant. This ensures that Supp(G r ) ∩ P r = ∅. For simplicity, we will assume that G r is in fact supported by Γ r -fixed points.

Remark 5.1. As done several time in this thesis, we will later consider one-point divisors, whose support is reduced to a point which totally ramifies in the tower. Under the action of G, this means that such a point is a full orbit.

To make our protocol complete and sound, we need the sequence of divisors (G i ) r i=0 to satisfy the following properties:

• each G i is supported by Γ i -invariant points;

• each Riemann-Roch space L Fi (G i ) admits an explicit decomposition in terms of Riemann-Roch spaces on the fixed field F i-1 (see Equation (5.3));

• for any 1 ≤ i ≤ r, G i-1 needs to be compatible with the choice of G i and the structure of its Riemann-Roch space (explanation is delayed to Definition 5.4).

We know discuss these restrictions by definition what we mean by decomposition of Riemann-Roch spaces.

We say that the function µ i partitions L Fi (G i ) with respect to the action of the order

with

where given a divisor D = P ∈P F i n p P ∈ Div(F i ), we set:

Proposition 5.8 ([She93, Proposition 4]). We have g 0 = 0 and for all i ≥ 1,

Additionally, for every i ≥ 0, we can recursively prove that the number of F q 2 -rational places in X i is given by |X i (F q 2 )| = q i+2 + 1.

We end up with an infinite sequence of curves (X i ) i≥0 , called the Hermitian tower, as follows:

. . .

where Γ i stands for the automorphism acting on X i and π i : X i → X i-1 is the corresponding quotient map. This tower is a specific tower of Artin-Schreier extensions, which have been extensively studied (see [START_REF] Stichtenoth | Algebraic function fields and codes[END_REF], Section 3.7). We now recall some classical results that will be useful to design fordable AG codes along this tower.

Automorphisms and projection maps. By definition of the Hermitian tower [Sti09, Proposition 3.7.10], the Galois group of the extension F i /F i-1 is the group of automorphisms defined by (x 1 , ..., x i-1 , x i ) → (x 1 , ..., x i-1 , x i + α), where α runs in

Note that if we fix a non-zero element α ∈ S, then for every β ∈ F q , αβ also lies in S. Hence, S is an additive group which is isomorphic to F q . The corresponding projection map π i : X i → X i-1 consists in the projection onto the first i coordinates.

For every i ≥ 0, we set Π i : X i → X 0 to be the composition of the first i quotient maps, i.e.

(5.7)

The point at infinity. In what follows, let us denote by P

∞ the unique pole of the function x 0 in the rational function field F 0 , which corresponds to the point at infinity on the projective line X 0 = P 1 . The following lemma gives us the ramification behaviour of this point alongside the tower. Lemma 5.9. Let i ≥ 1. The place P (0) ∞ is totally ramified in F i , which means that the preimage

∞ is the unique place that is ramified in the tower F.

Proof. See [START_REF] Shen | A justesen construction of binary concatanated codes that asymptotically meet the zyablov bound for low rate[END_REF] or [GX12, Section 3.1] for a more recent summary. This specific behaviour of the point at infinity encourages us to define a sequence of one-point AG codes associated to it, meaning that our divisors G i ∈ Div(F i ) will be taken as multiple of the corresponding point at infinity

∞ , for any i ≥ 0, where d i > 0 which will be chosen carefully later on.

Let us now focus on the principal divisors (x j ) Fi (0 ≤ j ≤ i) and their valuation at

∞ along the tower.

Lemma 5.10. The following two assertions hold:

1. For i ≥ 0, we have (x i ) Fi = (q + 1) i P (i) -P (i)

∞

, where P (i) is the unique common zero of the functions x 0 , • • • , x i .

2. Let i ≥ 0. Then for 0 ≤ j ≤ i, the valuation of the function

∞ is given by

where the notation π i * was defined in 5.2. In other words, the function

in the sense of to Definition 5.4.

Proof. From Lemma 5.11, L Fi (G i ) contains linear combinations of monomials of the form x a0 0 • • • x ai i ; with a 0 ≥ 0, 0 ≤ a j ≤ q -1 for 0 < j ≤ i and i j=0 a j q i-j (q + 1) j ≤ m. Since the a ′ j s (for j > 0)

run in {0, • • • , q -1}, the proof follows from the fact that the function

In order to make G i-1 compatible with (G i , x i ), we need the existence of q balancing functions ν i-1,j ∈ F i-1 (for 0 ≤ j ≤ q -1) such that

The divisor (x i ) Fi being known (see Lemma 5.10, 1 ), we have

∞

, for all i, j.

Hence, we have to balance the divisors

which leads to study the Weierstrass semigroup at P (i-1) ∞

, denoted from now on by H P (i-1) ∞

(see [Sti09, Section 1.6]). The generators of this semigroup can be found by using Lemma 5.10, since

is the unique pole of the functions x 0 , • • • , x i-1 and we know their valuation at this point. More precisely, we have

(5.8) Remark 5.13. In the spirit of the FRI protocol (see Section 2.2.3), we could be tempted to choose G i-1 as E i,0 . Such a choice would be valid in the sense of Definition 5.4 if and only if there exists, for every 0 ≤ j ≤ q -1, a balancing function

However, when i increases, this condition is never satisfied, meaning that we will have to make a smarter choice for G i-1 .

To ensure that deg (G i-1 -E i,j ) is never a Weierstrass gap at

, the idea is to increase the degree d i-1 of G i-1 . Taking the Weierstrass Gap Theorem [Sti09, Theorem 1.6.8] into consideration, we can prove:

Proof. By the Weierstrass Gap Theorem [Sti09, Theorem 1.6.8], we know that

Then, for any 0 ≤ j ≤ q -1, the difference

always belongs to the Weierstrass semigroup at

, meaning that some balancing function does exist.

About the balancing functions. Since we know a N-basis of H P (i-1) ∞ (see Equation (5.8)), we are able to explicit the form of the balancing functions ν i-1,j , for any 1 ≤ i ≤ r and 0 ≤ j ≤ q -1. In particular, for a fixed i, they can be chosen as product of powers of

(5.10) then m i,j (defined in Equation (5.9)) is in fact in H P (i-1) ∞

. The corresponding choice for the balancing function is then given by

Note that finding a vector a i,j satisfying Equation (5.10) leads to study the diophantine equation

with i unknowns a k ∈ N, for which we know by construction that there exist solutions (and we only need one).

A family of foldable AG codes. Let us denote by i max the level in the tower (X i ) i≥0 such that X imax is the curve on which the code we want to test proximity is defined.

Proposition 5.15. Let P 0 ⊆ P 1 (F q 2 )\ P (0) ∞ and define P imax ⊆ X imax (F q 2 ) as the preimage of P 0 under Π imax (defined in (5.7)). For any fixed integer d imax , the AG code

is foldable in the sense of Definition 5.5.

Proof. The group G ≃ Z/p imax Z acts on the curve X imax , and its action on P imax is obviously free by definition of P imax . We have |P imax | = |P 0 |p imax , implying the existence of some e ∈ (0, 1) such that |G| > |P imax | e . Finally, the third and last condition for an AG code to be foldable (see Definition 5.5) follows from Theorem 5.14.

To make sure we get compatible divisors and as stated in Theorem 5.14, we need to increase the degree of each folded divisor by twice the genus of the curve at each step. The counterpart is that the dimension of each folded code decreases much slowly than their length. To construct a sound AG-IOPP system based on this family, we need to ensure that we do not get a last code (i.e. a Reed-Solomon code) which is trivial. To avoid this problem, we need to control the dimension of each foldable code. An efficient way to do this is to consider codes of the specific form

for some α > 1 2 . In fact, the choice

is the biggest possible, and is in fact G-invariant since it is easily proved (by induction) that every rational point on X imax , excepted for P (imax) ∞

, totally splits in the tower. In this case, the length of the code is n imax = q imax+2 . In [START_REF] Bordage | Interactive oracle proofs of proximity to algebraic geometry codes[END_REF], we provide a sufficient condition on α and i max to get a constant fixed rate when q goes to infinity, which can be done be studying the genus formula given in Proposition 5.8. The code C α will be used to control the rate of the last folded code (see Section 5.4.2).

Prover

Verifier

QUERY Phase

Round consistency tests: Sample Q r ∈ P r , and define a query path

Final test:

Figure 5.2: AG-IOPP : QUERY phase

Properties of the AG-IOPP with the Hermitian tower

Here, we study the properties of the AG IOPP system described in the previous section, in the case of the family of foldable codes along the Hermitian tower given in Section 5.2.2. All is summarized in the informal theorem below.

Theorem 5.18 ([BNLR22, Theorem 45]). Let i max ≥ 0 and consider a family of foldable AG codes

as in Proposition 5.15. The length n = #P imax of C imax is at most q imax+2 . Then the IOPP system described in Section 5.4.1 is an i max -round interactive proof with the following properties:

1. Perfect completeness: If f (imax) ∈ C imax and f (imax-1) , . . . , f (0) are honestly generated by the prover, then V accepts the proof with probability 1.

2. Soundness: Assume that f (imax) is δ-far from C imax . Then for any prover P * (possibly malicious), we have

where err(δ) is small and depends on both the error during the COMMIT phase and the ones due to the t iterations of the QUERY phase.

Moreover, we have:

where M F q 2 (d) denotes the cost of multiplying two degree-d univariate polynomials over F q 2 .

After the interaction between P and V, we end up with a proximity test of a function f (0) to an AG code C 0 := C L (X 0 , P 0 , d 0 P (0) ∞ ). As X 0 equals the projective line, the code C 0 is nothing but a Reed-Solomon code. Taking this into consideration, we can replace the final test of our AG-IOPP system with a proximity test to a RS code (i.e. a FRI protocol, see Section 2.2.3), until we get a dimension one RS code.

As already discussed at the end of section 5.2.2, we need to ensure that the RS code C 0 is not trivial, i.e. its rate is smaller than 1. In [BNLR22, Section 8.3.2], this is examined by considering the foldable code defined in Equation (5.11), that is

Appendix A

Algorithm for retrieving the equation of a cover

In this appendix, we present a formal algorithm that describes the attack proposed in Section 3.3.2, in the context of a Kummer cover of curves Y → X , where (X , P ∞ ) ∈ B (the class B is defined in Section 3.3.1). Keeping the same notation, recall that we aim to recover the evaluation vector y = y(Q i,j ) i,j . For ξ ∈ µ * ℓ (F q m ), we are led to solve linear systems of the form

In this framework, we describe in Algorithm 1 the attack of Section 3.3.2 in the context of a McEliece cryptosystem based on a quasi-cyclic SSAG code defined on Y. For simplicity, we write K = F q m (X ) = F q m (x, z), which is a degree a extension of the rational function field. Hence, any degree one place P ∈ P can be associated to the rational point in X with projective coordinates [x(P ) : z(P ) : 1]. Given Q ∈ Q such that Q|P , the representative point of Q on Y as projective coordinates [x(P ) : z(P ) : y(Q) : 1] in P 3 .

A full complexity analysis of Algorithm 1 below is hard to estimate because of the interpolation step (see the discussion below Proposition 3.9). For completeness, we still provide a complexity analysis when X = P 1 , since in this case we can use the classical Lagrange's interpolation method to recover f . Remark that this specific case coincides with the one considered in [Bar18a, Chapter 5].

Proposition A.1. Suppose K = F q m (x) is the rational function field and consider L = K(y), with

T ] is a square-free polynomial of degree d. Let n, k be the length and the dimension of the public SSAG respectively, r := n/ℓ be the number of orbits in Q and s := ℓ(D -B). If r ≥ d + 1, then Algorithm 1 finds an equation of Y, as well as the secret structure of the public code in O((φ(ℓ) + 1)(n ω + n ω-1 sk) operations over F q m , where ω is the exponent of linear algebra.

Proof. The complexity of solving a linear system with k equations and n unknowns is in O(n ω-1 k) operations over the base field, where ω is the exponent of linear algebra. Since both ∆ 1 (ξ) and ∆ 2 (ξ) consist in sk +n equations for n unknowns, the cost of line 10 is O(n ω +n ω-1 sk) operations over F q m (operations need to be done in F q m and not F q as the roots of unity might be in F q m \F q ). Since we have to seek for the correct root of unity ξ, this step might be repeated at most φ(ℓ)-times, where φ is the Euler totient function. After solving the first system, we can assume that we recovered the correct value for ξ and thus the second system only has to be resolved once, with the same complexity.

Next, we have to realize one Lagrange's interpolation at line 18 (which is the classical one in this case, since f is a one variable polynomial) in order to recover a defining equation of the Kummer cover. As we assumed r ≤ d + 1, Lagrange's interpolation finds a unique polynomial f of degree d such that a plane model of Y is given by y ℓ = f (x) in O(d 2 ) operations over F q m (which is negligible compared to the cost of solving the linear systems).

Finally, the last step we have to care about is at line 20, where we are left to compute the pullback of the invariant divisor. As for the support, we need to recover the y-coordinates of points Appendix B Foldable AG codes from a tower of modular curves

In the discussion below, we give valid setting to construct a family of foldable AG codes defined on an optimal tower of curves over a finite field F q . Let us recall what we mean by optimal towers: given a sequence of curves X = (X i ) i , we define its limit by

It is well-known from the Drinfeld-Vladut bound [GS07, Theorem 2.5] that for any such X ,

We say that the tower X is (asymptotically) optimal if the bound is attained, i.e.

λ(X ) = √ q -1.

Note that there may exists optimal tower over F q only if q is a square (in which case there always exists one). More details about optimal towers can be found in [GS07, Chapter 1]. Below, we focus on the optimal tower over a finite field of cardinality q = p 2 , where p is an odd prime, recursively defined by the equation

This tower has been proven to be optimal in [GS07, Section 4.3] and also modular [START_REF] Elkies | Explicit modular towers[END_REF], as it comes from the modular tower (X 2 n 0 ) n≥0 . Optimal towers are good candidates to design long AG codes since they asymptotically have the maximal number of rational points for a given base field, with respect to the Drinfeld-Vladut bound. Below, we keep notation as in Chapter 5.

B.1 Preliminaries

Let q = p 2 be a power of an odd prime p.

Sequence of curves and automorphisms. We consider the tower of function field F = (F i ) i≥0 over F q , recursively defined by F 0 = F q (x 0 ) and F i = F i-1 (x i ), where

For any i ≥ 0, we denote by X i the curve over F q with function field F i = F q (X i ), and by g i its genus. We obtain an infinite tower of curves as in Equation 5.6, where Γ i = Z/2Z and π i : X i → X i-1 is the projection map. We also set Π

-1 for r ∈ {0, 1} and i ≤ 4

We now have all the ingredients we need to explicit the principal divisors we will need later on.

Proposition B.4. 1. We have (x 0 ) F0 = P (0) 0

∞ and for any i ≥ 2:

2. We have

-1 -P

(1)

∞ and for any i ≥ 2:

(1

3. We have

∞ , (1 + x 2 1 ) F1 = 2D

(1) 0 -2P

(1)

∞ and for any i ≥ 2:

∞ is not the only zero of E i,1 , we cannot consider a one-point divisor of the form

∞ while satisfying G i-1 ≥ E i,1 , which is needed for G i-1 to be (G i , x i )-compatible (see Definition 5.4). To overcome this problem, we introduce a weaker version of compatibility, referred to as weak-compatibility. Keep in mind that this new definition implies slight changes to the folding operator defined in Definition 5.16. Definition B.7 (Weak compatibility). Let i ≥ 1, and take the general framework of Section 5.1.2, i.e. F i /F i-1 is cyclic of prime order p i . Let G i ∈ Div(F i ) and µ i ∈ F i be a function that partitions L Fi (G i ) with respect to Definition 5.2. A divisor G i-1 ∈ Div(F i-1 ) is said to be weak

2. For every j ∈ {0, • • • , p i -1}, there exists a weakly balancing function ν i-1,j ∈ F i-1 such that

The functions f i-1,j introduced above allows to compensate the poles of the divisor G i-1 -E i,1 without modifying its degree.

Regarding Theorem B.6, we could be tempted to chose

However, the complicated structure of E i,1 will lead to an impossibility of finding the weakly balancing function ν i-1,1 if we do so. Actually, the Weierstrass gap theory tells us that such a function does exist only if the divisor G i-1 -E i,1 has high enough degree, as explained by the following proposition:

n i P i be a divisor on a given function field F with genus g and

In particular, if r = s, we have (h) ∞ = D. From the Riemann-Roch theorem (Theorem 1.67), this implies that for every 1 ≤ i ≤ r, ℓ(D ′ +P i ) = ℓ(D ′ ) + 1. Hence, there exists a function h i ∈ L(D ′ + P i )\L(D ′ ), satisfying:

which yields the desired result.

In our situation, the above Proposition implies that weakly balancing functions do exist if for any i ≥ 1 and j ∈ {0, 1}, whenever we have

For this reason, and without changing the support of our sequence of divisors, we raise the valuation of G i-1 at P (i-1) ∞ at each step. More precisely, we set

In what follows, we first discuss about the functions f i-1,j , before getting back to the choice of the integer α i-1 that guarantees the existence of weakly balancing functions.

About the functions f i-1,j . With the choice made in Equation (B.3), we have G i-1 -E i,0 = α i-1 P (i-1) ∞ ≥ 0, meaning that we do not need to find a function f i-1,0 . However, it is clear that G i-1 -E i,1 is not effective. Thus, we have to find

As we want to apply this construction to an effective IOPP, it is desired to have an explicit formula for f i-1,1 , for every i ≥ 1. Actually, we show that the set (f i-1,1 ) i≥1 can be constructed recursively, allowing the prover to precompute it.

For every i ≥ 2, recall that Theorem B.6 gives

Written in this form, we know exactly the pole part of G i-1 -E i,1 , hence we seek for a function whose zero divisor is exactly supported by

i-2 , in order to compensate it. This requires two lemmas.

Lemma B.9. Let i ≥ 3. Then

Proof. The whole proof uses the description of several principal divisors in the tower (see Proposition B.4). For the case i = 3, we have

-1 -P

(1)

-1 -2D

(2)

The result follows.

Despite having the good divisor, the above function cannot be chosen as f i-1,1 since it would create another pole, but this time with a smaller valuation. Our blessing is that we can raise the valuation at P (i-1) ∞ by eventually taking a bigger α i-1 . As a result, finding a function whose only pole is P (i-1) ∞ together with this consideration on α i-1 will provide a valid choice for f i-1,1 . Such a function is given in the next lemma:

Proof. We proceed by induction on i ≥ 3. Using Proposition B.4, we have

(2)

-1 -2D

(2)

-2 -D

(2)

-2 + D

(2)

∞ , which gives the initiation. now let us suppose the formula holds for a given i ≥ 3. Recalling that

3), we have

This gives

which give the result for i + 1. Note that for the last equality, we need to deal with the parity of i. Details are left to the reader.

Both the above lemmas allow to construct an explicit function f i-1,1 for i ≥ 3, as well as a sufficient condition for the divisor G i-1 -E i,1 + (f i-1,1 ) Fi-1 to be effective.

In particular, if α i-1 ≥ 2 i+1 , the above divisor is effective.

Proof. We start by proving a formula for the divisor of f i-1,1 . From Lemmas B.9 and B.10, we have

At this step, we need to check in which sum D (i-1) i-4 belongs to with respect to i, in order to find the correct valuation. This leads to distinguish between the case i ≤ 5 and i ≥ 6. Finally, we have

-2D

(2)

Thus, from the formula (B.4), we have

Hence, taking α i-1 ≥ 2 i+1 is a sufficient condition, for any i ≥ 3.

Remark B.12 (Cases i = 1 and i = 2). The cases i ∈ {1, 2} have to be discussed separately, as the above formulas hold for i ≥ 3 only. Setting f 0,1 = 1+x 2 0 x0 ∈ F 0 and f 1,1 = x 0 (1 + x 1 ) 2 ∈ F 1 , we easily check that

Notice that the condition on α i-1 given in Proposition B.11 still holds in these cases.

We now have an explicit formula for the function f i-1,1 for any i ≥ 1, as well as a condition to satisfy the first requirement of Definition B.7. It remains to check whenever we can find weakly balancing functions, which is the topic of the next paragraph.

Existence of weakly balancing functions. In the previous discussion, we showed that for any i ≥ 1, with the choice of f i-1,1 made in Proposition B.11 and taking

provided that α i-1 ≥ 2 i+1 . This ensure that G i-1 satisfies 1 of Definition B.7, for all i ≥ 1. To prove the existence of weakly balancing functions, we get back to the sufficient condition (B.2), which leads to study the degree and the cardinality of the support of

Lemma B.13. For any i ≥ 1, we have

and

Proof. Let i ≥ 3. The case j = 0 is immediate. If j = 1, note first that the degree of G i-1 -E i-1,1 + (f i-1 , 1) Fi-1 does not depend on the choice of f i-1,1 . From (B.4) and Corollary B.3, we have:

For i = 1, 2, we can compute the corresponding degrees from Remark B.12, since the formula for E i,1 differs in this case. This gives

Proof. All cases j = 0 and j = 1 together with i = 1, 2 are easy. We are left to check the cases j = 1 and i ≥ 3. Note that in order to compute the support, we can get ride of the valuations, provides that they are not zero. Moreover, any place in # Supp(D (i-1) r

) as degree one, meaning that the degree of D

We can now gives a sufficient condition on α i-1 for all i ≥ 1 such that with our construction, all divisors G i-1 are weak (G i , x i )-compatible. Recall that we already imposed α i-1 ≥ 2 i+1 . Let us check if this restriction coincides with Equation (B.2).

Proposition B.15. Suppose α 0 ≥ 4, α 1 ≥ 8 and for all i ≥ 3:

Then for all i ≥ 1, the divisor G i-1 defined by Equation (B.3) are weak (G i , x i )-compatible with respect to the chosen functions f i-1,j .

Proof. From Proposition B.5, we have g 1 = 1 and g 2 = 3. Thus, Equation (B.2) applied for i ∈ {1, 2} gives α 0 ≥ 4 and α 1 ≥ 8, which is coherent. Now, let i ≥ 3. We have to check the inequality

Since i ≥ 3, an easy computation shows that the above lower bound on α i-1 is always bigger than 2 i+1 , leading to the sufficient condition on α i-1 to guarantee the existence of weakly balancing functions.

B.3 Conclusion and future work

Throughout Section B.2, we gave valid setting to build a sequence of foldable one-point AG codes along the optimal tower F recursively defined by Equation (B.1), namely the codes

, where d i-1 = di 2 +α i-1 , for a sequence of integers (α i ) i≥0 satisfying conditions of Proposition B.15. While seeking for compatible divisors, we had to weaken the condition of Definition 5.4, as it was imposed if we want to consider one-point codes at each step. Surely, it implies that while using these codes into an AG-IOPP system, the folding operator as to be modified consequently. More importantly, proofs of the key properties of the IOPP (see 5.4.2 in the case of foldable codes along the Hermitian tower) might also require some adjustments, in particular for the soundness. Furthermore, as in the Hermitian tower case, the degree of our divisor needs to be increased at each step, meaning that we also need to control the sequence of rates of the folding family, in particular the last RS code.

To conclude, a lot of work needs to be done to construct an efficient AG-IOPP system based on our family of foldable codes, which could be done in the future. We hope that this could lead to some improvements in the area of Interactive Proofs. then, it has demonstrated to have a lot of advantages, such as a fast encryption and decryption, in addition to the fact that it is a good candidate for post-quantum cryptography. The main constraint is that it imposes large keys sizes compared with other actual public-key cryptosystems. In this context, we study the security of variants of McEliece's encryption schemes based on structured subfield subcode of algebraic geometry codes (SSAG). More precisely, we show that the underlying secret structure of the public SSAG can be recovered from that of its invariant code, which has smaller parameters.

List of Figures

Initially based on the family of classical Goppa codes, the first proposal of McEliece is still considered secure today. Taking this into account, we define a new family of codes: Goppa-like AG codes. The idea is to mimic the algebraic structure of Goppa codes inherited from the choice of the multiplier while considering higher genus curves, which allows to construct longer codes. Focusing one one-point codes from C a,b curves, we study the behavior of the square of their dual to determine their resistance to distinguisher attacks. As this family can be efficiently encoded, it is a good candidate to replace classical Goppa codes.

In the context of Interactive Oracle Proofs (IOPs), we initiate the study of proximity tests to AG codes. The problem of testing proximity to a code C consists in distinguishing between the case where an input word belong to C and the case where it is far from it. Aiming to generalize the FRI protocol based on Reed-Solomon codes, we give valid setting to design an efficient IOP of Proximity to AG codes (AG-IOPP). As concrete instantiation, we focus on AG codes arising from a tower of Hermitian curves, which can be defined over polylogarithmic-size alphabet. We also give a family of foldable AG codes on this tower whose corresponding AG-IOPP achieves quasilinear prover time and polylogarithmic verification.

Classification AMS : 11T71, 14G50, 14H05, 11G20, 14Q20. Université de Bourgogne Franche-Comté 32, avenue de l'Observatoire 25000 Besançon, France