This paper shows how to decode errors and erasures with Gabidulin codes in sub-quadratic time in the code length, improving previous algorithms which had at least quadratic complexity. The complexity reduction is achieved by accelerating operations on linearized polynomials. In particular, we present fast algorithms for division, multi-point evaluation and interpolation of linearized polynomials and show how to efficiently compute minimal subspace polynomials.
In this work, we modify the decoding algorithm for subspace codes by Koetter and Kschischang to get a decoding algorithm for (generalized) twisted Gabidulin codes. The decoding algorithm we present applies to cases where the code is linear over the base field $\mathbb{F}_q$ but not linear over $\mathbb{F}_{q^n}$.
We show how Gabidulin codes can be decoded via parametrization by using interpolation modules over the ring of linearized polynomials with composition. Our decoding algorithm computes a list of message words that correspond to all closest codewords to a given received word. This involves the computation of a minimal basis for the interpolation module that corresponds to the received word, followed by a search through the parametrization for valid message words. Our module-theoretic approach strengthens the link between Gabidulin decoding and Reed-Solomon decoding. Two subalgorithms are present…
Gabidulin codes, originally defined over finite fields, are an important class of rank metric codes with various applications. Recently, their definition was generalized to certain fields of characteristic zero and a Welch--Berlekamp like algorithm with complexity $O(n^3)$ was given. We propose a new application of Gabidulin codes over infinite fields: low-rank matrix recovery. Also, an alternative decoding approach is presented based on a Gao type key equation, reducing the complexity to at least $O(n^2)$. This method immediately connects the decoding problem to well-studied problems, which h…
An interpolation-based decoding scheme for interleaved subspace codes is presented. The scheme can be used as a (not necessarily polynomial-time) list decoder as well as a probabilistic unique decoder. Both interpretations allow to decode interleaved subspace codes beyond half the minimum subspace distance. Further, an efficient interpolation procedure for the required linearized multivariate polynomials is presented and a computationally- and memory-efficient root-finding algorithm for the probabilistic unique decoder is proposed. These two efficient algorithms can also be applied for acceler…
This paper presents the first decoding algorithm for Gabidulin codes over Galois rings with provable quadratic complexity. The new method consists of two steps: (1) solving a syndrome-based key equation to obtain the annihilator polynomial of the error and therefore the column space of the error, (2) solving a key equation based on the received word in order to reconstruct the error vector. This two-step approach became necessary since standard solutions as the Euclidean algorithm do not properly work over rings.
We address the problem of decoding Gabidulin codes beyond their unique error-correction radius. The complexity of this problem is of importance to assess the security of some rank-metric code-based cryptosystems. We propose an approach that introduces row or column erasures to decrease the rank of the error in order to use any proper polynomial-time Gabidulin code error-erasure decoding algorithm. This approach improves on generic rank-metric decoders by an exponential factor.
This article discusses the decoding of Gabidulin codes and shows how to extend the usual decoder to any supercode of a Gabidulin code at the cost of a significant decrease of the decoding radius. Using this decoder, we provide polynomial time attacks on the rank-metric encryption schemes RAMESSES and LIGA.
We discuss the decoding of Gabidulin and interleaved Gabidulin codes. We give the full presentation of a decoding algorithm for Gabidulin codes, which as Loidreau's seminal algorithm consists in localizing errors in the spirit of Berlekamp-Welch algorithm for Reed-Solomon codes. On the other hand, this algorithm consists in acting on codewords on the right while Loidreau's algorithm considers an action on the left. This right-hand side decoder was already introduced by the authors in a previous work for cryptanalytic applications. We give here a generalised version which applies to the case of…
We prove that Alekhnovich's algorithm can be used for row reduction of skew polynomial matrices. This yields an $O(\ell^3 n^{(ω+1)/2} \log(n))$ decoding algorithm for $\ell$-Interleaved Gabidulin codes of length $n$, where $ω$ is the matrix multiplication exponent, improving in the exponent of $n$ compared to previous results.
We generalise Gabidulin codes to the case of infinite fields, eventually with characteristic zero. For this purpose, we consider an abstract field extension and any automorphism in the Galois group. We derive some conditions on the automorphism to be able to have a proper notion of rank metric which is in coherence with linearized polynomials. Under these conditions, we generalize Gabidulin codes and provide a decoding algorithm which decode both errors and erasures. Then, we focus on codes over integer rings and how to decode them. We are then faced with the problem of the exponential growth …
In this paper an interpolation-based decoding algorithm to decode Gabidulin codes, transmitted through a finely restricted channel, is proposed. The algorithm is able to decode rank errors beyond half the minimum distance by one unit. Also the existing decoding algorithms for generalized twisted Gabidulin codes and additive generalized twisted Gabidulin codes are improved.
Gabidulin codes can be seen as the rank-metric equivalent of Reed-Solomon codes. It was recently proven, using subspace polynomials, that Gabidulin codes cannot be list decoded beyond the so-called Johnson radius. In another result, cyclic subspace codes were constructed by inspecting the connection between subspaces and their subspace polynomials. In this paper, these subspace codes are used to prove two bounds on the list size in decoding certain Gabidulin codes. The first bound is an existential one, showing that exponentially-sized lists exist for codes with specific parameters. The second…
In this work we will present algorithms for decoding rank metric codes. First we will look at a new decoding algorithm for Gabidulin codes using the property of Dickson matrices corresponding to linearized polynomials. We will be using a Berlekamp-Massey-like algorithm in the process. We will show the difference between our and existing algorithms. Apart from being a new algorithm, it is also interesting that it can be modified to get a decoding algorithm for general twisted Gabidulin codes.
This paper investigates the decoding of certain Gabidulin codes that were transmitted over a channel with space-symmetric errors. Space-symmetric errors are additive error matrices that have the property that their column and row spaces are equal. We show that for channels restricted to space-symmetric errors, with high probability errors of rank up to 2(n-k)/3 can be decoded with a Gabidulin code of length n and dimension k, using a weak-self orthogonal basis as code locators.
We introduce Reed-Solomon-Gabidulin codes which is, at the same time, an extension to Reed-Solomon codes on the one hand and Gabidulin codes on the other hand. We prove that our codes have good properties with respect to the minimal distance and design an efficient decoding algorithm.
We consider the decoding of rank metric codes assuming the error matrix is symmetric. We prove two results. First, for rates $<1/2$ there exists a broad family of rank metric codes for which any symmetric error pattern, even of maximal rank can be corrected. Moreover, the corresponding family of decodable codes includes Gabidulin codes of rate $<1/2$. Second, for rates $>1/2$, we propose a decoder for Gabidulin codes correcting symmetric errors of rank up to $n-k$. The two mentioned decoders are deterministic and worst case.
We show that decoding of $\ell$-Interleaved Gabidulin codes, as well as list-$\ell$ decoding of Mahdavifar--Vardy codes can be performed by row reducing skew polynomial matrices. Inspired by row reduction of $\F[x]$ matrices, we develop a general and flexible approach of transforming matrices over skew polynomial rings into a certain reduced form. We apply this to solve generalised shift register problems over skew polynomial rings which occur in decoding $\ell$-Interleaved Gabidulin codes. We obtain an algorithm with complexity $O(\ell μ^2)$ where $μ$ measures the size of the input problem an…
We present a new approach on low-rank matrix recovery (LRMR) based on Gabidulin Codes. Since most applications of LRMR deal with matrices over infinite fields, we use the recently introduced generalization of Gabidulin codes to fields of characterstic zero. We show that LRMR can be reduced to decoding of Gabidulin codes and discuss which field extensions can be used in the code construction.
We propose the new rank-metric code-based cryptosystem LIGA which is based on the hardness of list decoding and interleaved decoding of Gabidulin codes. LIGA is an improved variant of the Faure-Loidreau (FL) system, which was broken in a structural attack by Gaborit, Otmani, and Talé Kalachi (GOT, 2018). We keep the FL encryption and decryption algorithms, but modify the insecure key generation algorithm. Our crucial observation is that the GOT attack is equivalent to decoding an interleaved Gabidulin code. The new key generation algorithm constructs public keys for which all polynomial-time i…
This paper presents an algorithm for decoding homogeneous interleaved codes of high interleaving order in the rank metric. The new decoder is an adaption of the Hamming-metric decoder by Metzner and Kapturowski (1990) and guarantees to correct all rank errors of weight up to $d-2$ whose rank over the large base field of the code equals the number of errors, where $d$ is the minimum rank distance of the underlying code. In contrast to previously-known decoding algorithms, the new decoder works for any rank-metric code, not only Gabidulin codes. It is purely based on linear-algebraic computation…
For any admissible value of the parameters there exist Maximum Rank distance (shortly MRD) $\mathbb{F}_{q^n}$-linear codes of $\mathbb{F}_q^{n\times n}$. It has been shown in \cite{H-TNRR} (see also \cite{ByrneRavagnani}) that, if field extensions large enough are considered, then \emph{almost all} (rectangular) rank distance codes are MRD. On the other hand, very few families of $\mathbb{F}_{q^n}$-linear codes are currently known up to equivalence. One of the possible applications of MRD-codes is for McEliece--like public key cryptosystems, as proposed by Gabidulin, Paramonov and Tretjakov in…
Wachter-Zeh in [42], and later together with Raviv [31], proved that Gabidulin codes cannot be efficiently list decoded for any radius $τ$, providing that $τ$ is large enough. Also, they proved that there are infinitely many choices of the parameters for which Gabidulin codes cannot be efficiently list decoded at all. Subsequently, in [41] these results have been extended to the family of generalized Gabidulin codes and to further family of MRD-codes. In this paper, we provide bounds on the list size of rank-metric codes containing generalized Gabidulin codes in order to determine whether or n…
University College Dublin（都柏林大学）；Inria, Laboratoire LIX, École polytechnique, Institut Polytechnique de Paris（法国国家信息与自动化研究所，École polytechnique，巴黎理工学院）
This paper presents a key recovery attack on the cryptosystem proposed by Lau and Tan in a talk at ACISP 2018. The Lau-Tan cryptosystem uses Gabidulin codes as the underlying decodable code. To hide the algebraic structure of Gabidulin codes, the authors chose a matrix of column rank $n$ to mix with a generator matrix of the secret Gabidulin code. The other part of the public key, however, reveals crucial information about the private key. Our analysis shows that the problem of recovering the private key can be reduced to solving a multivariate linear system over the base field, rather than so…
We speed up existing decoding algorithms for three code classes in different metrics: interleaved Gabidulin codes in the rank metric, lifted interleaved Gabidulin codes in the subspace metric, and linearized Reed-Solomon codes in the sum-rank metric. The speed-ups are achieved by new algorithms that reduce the cores of the underlying computational problems of the decoders to one common tool: computing left and right approximant bases of matrices over skew polynomial rings. To accomplish this, we describe a skew-analogue of the existing PM-Basis algorithm for matrices over ordinary polynomials.…
Linearized Reed-Solomon (LRS) codes are sum-rank metric codes that fulfill the Singleton bound with equality. In the two extreme cases of the sum-rank metric, they coincide with Reed-Solomon codes (Hamming metric) and Gabidulin codes (rank metric). List decoding in these extreme cases is well-studied, and the two code classes behave very differently in terms of list size, but nothing is known for the general case. In this paper, we derive a lower bound on the list size for LRS codes, which is, for a large class of LRS codes, exponential directly above the Johnson radius. Furthermore, we show t…
A repair of the Faure-Loidreau (FL) public-key code-based cryptosystem is proposed. The FL cryptosystem is based on the hardness of list decoding Gabidulin codes which are special rank-metric codes. We prove that the recent structural attack on the system by Gaborit et al. is equivalent to decoding an interleaved Gabidulin code. Since all known polynomial-time decoders for these codes fail for a large constructive class of error patterns, we are able to construct public keys that resist the attack. It is also shown that all other known attacks fail for our repair and parameter choices. Compare…
For many algebraic codes the main part of decoding can be reduced to a shift register synthesis problem. In this paper we present an approach for solving generalised shift register problems over skew polynomial rings which occur in error and erasure decoding of $\ell$-Interleaved Gabidulin codes. The algorithm is based on module minimisation and has time complexity $O(\ell μ^2)$ where $μ$ measures the size of the input problem.
Recently, codes in the sum-rank metric attracted attention due to several applications in e.g. multishot network coding, distributed storage and quantum-resistant cryptography. The sum-rank analogs of Reed-Solomon and Gabidulin codes are linearized Reed-Solomon codes. We show how to construct $h$-folded linearized Reed-Solomon (FLRS) codes and derive an interpolation-based decoding scheme that is capable of correcting sum-rank errors beyond the unique decoding radius. The presented decoder can be used for either list or probabilistic unique decoding and requires at most $\mathcal{O}(sn^2)$ ope…
We introduce a new family of rank metric codes: Low Rank Parity Check codes (LRPC), for which we propose an efficient probabilistic decoding algorithm. This family of codes can be seen as the equivalent of classical LDPC codes for the rank metric. We then use these codes to design cryptosystems à la McEliece: more precisely we propose two schemes for key encapsulation mechanism (KEM) and public key encryption (PKE). Unlike rank metric codes used in previous encryption algorithms -notably Gabidulin codes - LRPC codes have a very weak algebraic structure. Our cryptosystems can be seen as an equi…
Codes in the sum-rank metric have various applications in error control for multishot network coding, distributed storage and code-based cryptography. Linearized Reed-Solomon (LRS) codes contain Reed-Solomon and Gabidulin codes as subclasses and fulfill the Singleton-like bound in the sum-rank metric with equality. We propose the first known error-erasure decoder for LRS codes to unleash their full potential for multishot network coding. The presented syndrome-based Berlekamp-Massey-like error-erasure decoder can correct $t_F$ full errors, $t_R$ row erasures and $t_C$ column erasures up to $2t…
We present the first two sub-quadratic complexity decoding algorithms for one-point Hermitian codes. The first is based on a fast realisation of the Guruswami-Sudan algorithm by using state-of-the-art algorithms from computer algebra for polynomial-ring matrix minimisation. The second is a Power decoding algorithm: an extension of classical key equation decoding which gives a probabilistic decoding algorithm up to the Sudan radius. We show how the resulting key equations can be solved by the same methods from computer algebra, yielding similar asymptotic complexities.
In this paper, the performance of quadratic residue (QR) codes of lengths within 100 is given and analyzed when the hard decoding, soft decoding, and linear programming decoding algorithms are utilized. We develop a simple method to estimate the soft decoding performance, which avoids extensive simulations. Also, a simulation-based algorithm is proposed to obtain the maximum likelihood decoding performance of QR codes of lengths within 100. Moreover, four important theorems are proposed to predict the performance of the hard decoding and the maximum-likelihood decoding in which they can explor…
Skew polynomials are a class of non-commutative polynomials that have several applications in computer science, coding theory and cryptography. In particular, skew polynomials can be used to construct and decode evaluation codes in several metrics, like e.g. the Hamming, rank, sum-rank and skew metric. In this paper we propose a fast divide-and-conquer variant of the Kötter-Nielsen-Høholdt (KNH) interpolation over free modules over skew polynomial rings. The proposed KNH interpolation can be used to solve the interpolation step of interpolation-based decoding of (interleaved) Gabidulin, linear…
A Rank-Metric Approach to Error Control in Random Network Coding
随机线性网络编码中的差错控制问题是从矩阵的角度来解决的，这与Kötter和Kschischang的子空间角度密切相关。研究了一类常数维子空间码。结果表明，在这类代码可以很容易地构造秩度量码，同时保持其距离属性。此外，它表明，这种子空间码的最小距离解码可以重新制定为一个广义的解码问题的秩度量码的错误的部分信息是可用的。该部分信息可以是擦除（知道错误位置但不知道其值）和偏差（知道错误值但不知道其位置）的形式。考虑擦除和偏差（当它们发生时）严格地增加了代码的纠错能力：如果$μ$擦除和$δ$偏差发生，那么秩$t$的错误总是可以被纠正，只要$2t \leq d - 1 + μ+ δ$，其中$d$是代码的最小秩距离。针对一类重要的最大秩距离码--Gabidulin码，提出了一种有效的译码算法，该算法能够充分利用擦除和偏差。在传输长度为$M$ over $F_q$的$n$分组的网络编码应用中，解码算法的复杂度由扩展字段$F_{q^n}$中的$O(dM)$运算给出。
