  We present a new distinguisher for alternant and Goppa codes, whose
complexity is subexponential in the error-correcting capability, hence better
than that of generic decoding algorithms. Moreover it does not suffer from the
strong regime limitations of the previous distinguishers or structure recovery
algorithms: in particular, it applies to the codes used in the Classic McEliece
candidate for postquantum cryptography standardization. The invariants that
allow us to distinguish are graded Betti numbers of the homogeneous coordinate
ring of a shortening of the dual code.
  Since its introduction in 1978, this is the first time an analysis of the
McEliece cryptosystem breaks the exponential barrier.
