This paper presents the first decoding algorithm for Gabidulin codes over Galois rings with provable quadratic complexity. The new method consists of two steps: (1) solving a syndrome-based key equation to obtain the annihilator polynomial of the error and therefore the column space of the error, (2) solving a key equation based on the received word in order to reconstruct the error vector. This two-step approach became necessary since standard solutions as the Euclidean algorithm do not properly work over rings.
For a prime power $q$, an integer $m$ and $0\leq e\leq m-1$ we study the $e$-Galois hull dimension of Gabidulin codes $G_k(\boldsymbolα)$ of length $m$ and dimension $k$ over $\mathbb{F}_{q^m}$. Using a self-dual basis $\boldsymbolα$ of $\mathbb{F}_{q^m}$ over $\mathbb{F}_q$, we first explicitly compute the hull dimension of $G_k(\boldsymbolα)$. Then a necessary and sufficient condition of $G_k(\boldsymbolα)$ to be linear complementary dual (LCD), self-orthogonal and self-dual will be provided. We prove the existence of $e$-Galois (where $e=\frac{m}{2}$) self-dual Gabidulin codes of length $m$…
Gabidulin codes are the rank-metric analogs of Reed-Solomon codes and have a major role in practical error control for network coding. This paper presents new encoding and decoding algorithms for Gabidulin codes based on low-complexity normal bases. In addition, a new decoding algorithm is proposed based on a transform-domain approach. Together, these represent the fastest known algorithms for encoding and decoding Gabidulin codes.
In this work, we modify the decoding algorithm for subspace codes by Koetter and Kschischang to get a decoding algorithm for (generalized) twisted Gabidulin codes. The decoding algorithm we present applies to cases where the code is linear over the base field $\mathbb{F}_q$ but not linear over $\mathbb{F}_{q^n}$.
An alternative method for collaborative decoding of interleaved Reed-Solomon codes as well as Gabidulin codes for the case of high interleaving degree is proposed. As an example of application, simulation results are presented for a concatenated coding scheme using polar codes as inner codes.
We show how Gabidulin codes can be list decoded by using a parametrization approach. For this we consider a certain module in the ring of linearized polynomials and find a minimal basis for this module using the Euclidean algorithm with respect to composition of polynomials. For a given received word, our decoding algorithm computes a list of all codewords that are closest to the received word with respect to the rank metric.
We show how Gabidulin codes can be decoded via parametrization by using interpolation modules over the ring of linearized polynomials with composition. Our decoding algorithm computes a list of message words that correspond to all closest codewords to a given received word. This involves the computation of a minimal basis for the interpolation module that corresponds to the received word, followed by a search through the parametrization for valid message words. Our module-theoretic approach strengthens the link between Gabidulin decoding and Reed-Solomon decoding. Two subalgorithms are present…
We show how Gabidulin codes can be list decoded by using an iterative parametrization approach. For a given received word, our decoding algorithm processes its entries one by one, constructing four polynomials at each step. This then yields a parametrization of interpolating solutions for the data so far. From the final result a list of all codewords that are closest to the received word with respect to the rank metric is obtained.
Gabidulin codes, originally defined over finite fields, are an important class of rank metric codes with various applications. Recently, their definition was generalized to certain fields of characteristic zero and a Welch--Berlekamp like algorithm with complexity $O(n^3)$ was given. We propose a new application of Gabidulin codes over infinite fields: low-rank matrix recovery. Also, an alternative decoding approach is presented based on a Gao type key equation, reducing the complexity to at least $O(n^2)$. This method immediately connects the decoding problem to well-studied problems, which h…
An interpolation-based decoding scheme for interleaved subspace codes is presented. The scheme can be used as a (not necessarily polynomial-time) list decoder as well as a probabilistic unique decoder. Both interpretations allow to decode interleaved subspace codes beyond half the minimum subspace distance. Further, an efficient interpolation procedure for the required linearized multivariate polynomials is presented and a computationally- and memory-efficient root-finding algorithm for the probabilistic unique decoder is proposed. These two efficient algorithms can also be applied for acceler…
This paper shows how to decode errors and erasures with Gabidulin codes in sub-quadratic time in the code length, improving previous algorithms which had at least quadratic complexity. The complexity reduction is achieved by accelerating operations on linearized polynomials. In particular, we present fast algorithms for division, multi-point evaluation and interpolation of linearized polynomials and show how to efficiently compute minimal subspace polynomials.
An open question about Gabidulin codes is whether polynomial-time list decoding beyond half the minimum distance is possible or not. In this contribution, we give a lower and an upper bound on the list size, i.e., the number of codewords in a ball around the received word. The lower bound shows that if the radius of this ball is greater than the Johnson radius, this list size can be exponential and hence, no polynomial-time list decoding is possible. The upper bound on the list size uses subspace properties.
We address the problem of decoding Gabidulin codes beyond their unique error-correction radius. The complexity of this problem is of importance to assess the security of some rank-metric code-based cryptosystems. We propose an approach that introduces row or column erasures to decrease the rank of the error in order to use any proper polynomial-time Gabidulin code error-erasure decoding algorithm. This approach improves on generic rank-metric decoders by an exponential factor.
This article discusses the decoding of Gabidulin codes and shows how to extend the usual decoder to any supercode of a Gabidulin code at the cost of a significant decrease of the decoding radius. Using this decoder, we provide polynomial time attacks on the rank-metric encryption schemes RAMESSES and LIGA.
We discuss the decoding of Gabidulin and interleaved Gabidulin codes. We give the full presentation of a decoding algorithm for Gabidulin codes, which as Loidreau's seminal algorithm consists in localizing errors in the spirit of Berlekamp-Welch algorithm for Reed-Solomon codes. On the other hand, this algorithm consists in acting on codewords on the right while Loidreau's algorithm considers an action on the left. This right-hand side decoder was already introduced by the authors in a previous work for cryptanalytic applications. We give here a generalised version which applies to the case of…
A new interpolation-based decoding principle for interleaved Gabidulin codes is presented. The approach consists of two steps: First, a multi-variate linearized polynomial is constructed which interpolates the coefficients of the received word and second, the roots of this polynomial have to be found. Due to the specific structure of the interpolation polynomial, both steps (interpolation and root-finding) can be accomplished by solving a linear system of equations. This decoding principle can be applied as a list decoding algorithm (where the list size is not necessarily bounded polynomially)…
We transpose the theory of rank metric and Gabidulin codes to the case of fields of characteristic zero. The Frobenius automorphism is then replaced by any element of the Galois group. We derive some conditions on the automorphism to be able to easily transpose the results obtained by Gabidulin as well and a classical polynomial-time decoding algorithm. We also provide various definitions for the rank-metric.
Codes in the Grassmannian have recently found an application in random network coding. All the codewords in such codes are subspaces of $\F_q^n$ with a given dimension. In this paper, we consider the problem of list decoding of a certain family of codes in the Grassmannian, called lifted Gabidulin codes. For this purpose we use the Plücker embedding of the Grassmannian. We describe a way of representing a subset of the Plücker coordinates of lifted Gabidulin codes as linear block codes. The union of the parity-check equations of these block codes and the equations which arise from the descript…
We prove that Alekhnovich's algorithm can be used for row reduction of skew polynomial matrices. This yields an $O(\ell^3 n^{(ω+1)/2} \log(n))$ decoding algorithm for $\ell$-Interleaved Gabidulin codes of length $n$, where $ω$ is the matrix multiplication exponent, improving in the exponent of $n$ compared to previous results.
We generalise Gabidulin codes to the case of infinite fields, eventually with characteristic zero. For this purpose, we consider an abstract field extension and any automorphism in the Galois group. We derive some conditions on the automorphism to be able to have a proper notion of rank metric which is in coherence with linearized polynomials. Under these conditions, we generalize Gabidulin codes and provide a decoding algorithm which decode both errors and erasures. Then, we focus on codes over integer rings and how to decode them. We are then faced with the problem of the exponential growth …
Let K be a cyclic Galois extension of degree f over k and T a generator of the Galois group. For any v=(v_1,... , v_m)\in K^m such that v is linearly independent over k, and any 0< d < m the Gabidulin-like code C(v, T , d) is a maximum rank distance code in the space of f times m matrices over k of dimension fd. This construction unifies the ones available in the literature. We characterise the K-linear codes that are Gabidulin-like codes and determine their rank-metric automorphism group.
Low-rank parity-check (LRPC) are rank-metric codes over finite fields, which have been proposed by Gaborit et al. (2013) for cryptographic applications. Inspired by a recent adaption of Gabidulin codes to certain finite rings by Kamche et al. (2019), we define and study LRPC codes over Galois rings - a wide class of finite commutative rings. We give a decoding algorithm similar to Gaborit et al.'s decoder, based on simple linear-algebraic operations. We derive an upper bound on the failure probability of the decoder, which is significantly more involved than in the case of finite fields. The b…
In this paper an interpolation-based decoding algorithm to decode Gabidulin codes, transmitted through a finely restricted channel, is proposed. The algorithm is able to decode rank errors beyond half the minimum distance by one unit. Also the existing decoding algorithms for generalized twisted Gabidulin codes and additive generalized twisted Gabidulin codes are improved.
Gabidulin codes can be seen as the rank-metric equivalent of Reed-Solomon codes. It was recently proven, using subspace polynomials, that Gabidulin codes cannot be list decoded beyond the so-called Johnson radius. In another result, cyclic subspace codes were constructed by inspecting the connection between subspaces and their subspace polynomials. In this paper, these subspace codes are used to prove two bounds on the list size in decoding certain Gabidulin codes. The first bound is an existential one, showing that exponentially-sized lists exist for codes with specific parameters. The second…
We present and prove the correctness of an efficient algorithm that provides a basis for all solutions of a key equation in order to decode Gabidulin (G-) codes up to a given radius tau. This algorithm is based on a symbolic equivalent of the Euclidean Algorithm (EA) and can be applied for decoding of G-codes beyond half the minimum rank distance. If the key equation has a unique solution, our algorithm reduces to Gabidulin's decoding algorithm up to half the minimum distance. If the solution is not unique, we provide a basis for all solutions of the key equation. Our algorithm has time comple…
We transpose the theory of rank metric and Gabidulin codes to the case of fields which are not finite fields. The Frobenius automorphism is replaced by any element of the Galois group of a cyclic algebraic extension of a base field. We use our framework to define Gabidulin codes over the field of rational functions using algebraic function fields with a cyclic Galois group. This gives a linear subspace of matrices whose coefficients are rational function, such that the rank of each of this matrix is lower bounded, where the rank is comprised in term of linear combination with rational function…
In this work we will present algorithms for decoding rank metric codes. First we will look at a new decoding algorithm for Gabidulin codes using the property of Dickson matrices corresponding to linearized polynomials. We will be using a Berlekamp-Massey-like algorithm in the process. We will show the difference between our and existing algorithms. Apart from being a new algorithm, it is also interesting that it can be modified to get a decoding algorithm for general twisted Gabidulin codes.
This paper investigates the decoding of certain Gabidulin codes that were transmitted over a channel with space-symmetric errors. Space-symmetric errors are additive error matrices that have the property that their column and row spaces are equal. We show that for channels restricted to space-symmetric errors, with high probability errors of rank up to 2(n-k)/3 can be decoded with a Gabidulin code of length n and dimension k, using a weak-self orthogonal basis as code locators.
We introduce Reed-Solomon-Gabidulin codes which is, at the same time, an extension to Reed-Solomon codes on the one hand and Gabidulin codes on the other hand. We prove that our codes have good properties with respect to the minimal distance and design an efficient decoding algorithm.
We consider the decoding of rank metric codes assuming the error matrix is symmetric. We prove two results. First, for rates $<1/2$ there exists a broad family of rank metric codes for which any symmetric error pattern, even of maximal rank can be corrected. Moreover, the corresponding family of decodable codes includes Gabidulin codes of rate $<1/2$. Second, for rates $>1/2$, we propose a decoder for Gabidulin codes correcting symmetric errors of rank up to $n-k$. The two mentioned decoders are deterministic and worst case.
Gabidulin codes over fields of characteristic zero were recently constructed by Augot et al., whenever the Galois group of the underlying field extension is cyclic. In parallel, the interest in sparse generator matrices of Reed-Solomon and Gabidulin codes has increased lately, due to applications in distributed computations. In particular, a certain condition pertaining the intersection of zero entries at different rows, was shown to be necessary and sufficient for the existence of the sparsest possible generator matrix of Gabidulin codes over finite fields. In this paper we complete the pictu…
(Partial) Unit Memory ((P)UM) codes provide a powerful possibility to construct convolutional codes based on block codes in order to achieve a high decoding performance. In this contribution, a construction based on Gabidulin codes is considered. This construction requires a modified rank metric, the so-called sum rank metric. For the sum rank metric, the free rank distance, the extended row rank distance and its slope are defined analogous to the extended row distance in Hamming metric. Upper bounds for the free rank distance and the slope of (P)UM codes in the sum rank metric are derived and…
We show that decoding of $\ell$-Interleaved Gabidulin codes, as well as list-$\ell$ decoding of Mahdavifar--Vardy codes can be performed by row reducing skew polynomial matrices. Inspired by row reduction of $\F[x]$ matrices, we develop a general and flexible approach of transforming matrices over skew polynomial rings into a certain reduced form. We apply this to solve generalised shift register problems over skew polynomial rings which occur in decoding $\ell$-Interleaved Gabidulin codes. We obtain an algorithm with complexity $O(\ell μ^2)$ where $μ$ measures the size of the input problem an…
We present a new approach on low-rank matrix recovery (LRMR) based on Gabidulin Codes. Since most applications of LRMR deal with matrices over infinite fields, we use the recently introduced generalization of Gabidulin codes to fields of characterstic zero. We show that LRMR can be reduced to decoding of Gabidulin codes and discuss which field extensions can be used in the code construction.
We propose the new rank-metric code-based cryptosystem LIGA which is based on the hardness of list decoding and interleaved decoding of Gabidulin codes. LIGA is an improved variant of the Faure-Loidreau (FL) system, which was broken in a structural attack by Gaborit, Otmani, and Talé Kalachi (GOT, 2018). We keep the FL encryption and decryption algorithms, but modify the insecure key generation algorithm. Our crucial observation is that the GOT attack is equivalent to decoding an interleaved Gabidulin code. The new key generation algorithm constructs public keys for which all polynomial-time i…
This paper presents an algorithm for decoding homogeneous interleaved codes of high interleaving order in the rank metric. The new decoder is an adaption of the Hamming-metric decoder by Metzner and Kapturowski (1990) and guarantees to correct all rank errors of weight up to $d-2$ whose rank over the large base field of the code equals the number of errors, where $d$ is the minimum rank distance of the underlying code. In contrast to previously-known decoding algorithms, the new decoder works for any rank-metric code, not only Gabidulin codes. It is purely based on linear-algebraic computation…
The finite Grassmannian $\mathcal{G}_{q}(k,n)$ is defined as the set of all $k$-dimensional subspaces of the ambient space $\mathbb{F}_{q}^{n}$. Subsets of the finite Grassmannian are called constant dimension codes and have recently found an application in random network coding. In this setting codewords from $\mathcal{G}_{q}(k,n)$ are sent through a network channel and, since errors may occur during transmission, the received words can possible lie in $\mathcal{G}_{q}(k',n)$, where $k'\neq k$. In this paper, we study the balls in $\mathcal{G}_{q}(k,n)$ with center that is not necessarily in …
For any admissible value of the parameters there exist Maximum Rank distance (shortly MRD) $\mathbb{F}_{q^n}$-linear codes of $\mathbb{F}_q^{n\times n}$. It has been shown in \cite{H-TNRR} (see also \cite{ByrneRavagnani}) that, if field extensions large enough are considered, then \emph{almost all} (rectangular) rank distance codes are MRD. On the other hand, very few families of $\mathbb{F}_{q^n}$-linear codes are currently known up to equivalence. One of the possible applications of MRD-codes is for McEliece--like public key cryptosystems, as proposed by Gabidulin, Paramonov and Tretjakov in…
Wachter-Zeh in [42], and later together with Raviv [31], proved that Gabidulin codes cannot be efficiently list decoded for any radius $τ$, providing that $τ$ is large enough. Also, they proved that there are infinitely many choices of the parameters for which Gabidulin codes cannot be efficiently list decoded at all. Subsequently, in [41] these results have been extended to the family of generalized Gabidulin codes and to further family of MRD-codes. In this paper, we provide bounds on the list size of rank-metric codes containing generalized Gabidulin codes in order to determine whether or n…
University College Dublin（都柏林大学）；Inria, Laboratoire LIX, École polytechnique, Institut Polytechnique de Paris（法国国家信息与自动化研究所，École polytechnique，巴黎理工学院）
So far, there is no polynomial-time list decoding algorithm (beyond half the minimum distance) for Gabidulin codes. These codes can be seen as the rank-metric equivalent of Reed--Solomon codes. In this paper, we provide bounds on the list size of rank-metric codes in order to understand whether polynomial-time list decoding is possible or whether it works only with exponential time complexity. Three bounds on the list size are proven. The first one is a lower exponential bound for Gabidulin codes and shows that for these codes no polynomial-time list decoding beyond the Johnson radius exists. …
We speed up existing decoding algorithms for three code classes in different metrics: interleaved Gabidulin codes in the rank metric, lifted interleaved Gabidulin codes in the subspace metric, and linearized Reed-Solomon codes in the sum-rank metric. The speed-ups are achieved by new algorithms that reduce the cores of the underlying computational problems of the decoders to one common tool: computing left and right approximant bases of matrices over skew polynomial rings. To accomplish this, we describe a skew-analogue of the existing PM-Basis algorithm for matrices over ordinary polynomials.…
Subspace codes and rank-metric codes can be used to correct errors and erasures in network, with linear network coding. Subspace codes were introduced by Koetter and Kschischang to correct errors and erasures in networks where topology is unknown (the noncoherent case). In a previous work, we have developed a family of subspace codes, based upon the Koetter-Kschichang construction, which are efficiently list decodable. Using these codes, we achieved a better decoding radius than Koetter-Kschischiang codes at low rates. Herein, we introduce a new family of subspace codes based upon a different …
Linearized Reed-Solomon (LRS) codes are sum-rank metric codes that fulfill the Singleton bound with equality. In the two extreme cases of the sum-rank metric, they coincide with Reed-Solomon codes (Hamming metric) and Gabidulin codes (rank metric). List decoding in these extreme cases is well-studied, and the two code classes behave very differently in terms of list size, but nothing is known for the general case. In this paper, we derive a lower bound on the list size for LRS codes, which is, for a large class of LRS codes, exponential directly above the Johnson radius. Furthermore, we show t…
A repair of the Faure-Loidreau (FL) public-key code-based cryptosystem is proposed. The FL cryptosystem is based on the hardness of list decoding Gabidulin codes which are special rank-metric codes. We prove that the recent structural attack on the system by Gaborit et al. is equivalent to decoding an interleaved Gabidulin code. Since all known polynomial-time decoders for these codes fail for a large constructive class of error patterns, we are able to construct public keys that resist the attack. It is also shown that all other known attacks fail for our repair and parameter choices. Compare…
For many algebraic codes the main part of decoding can be reduced to a shift register synthesis problem. In this paper we present an approach for solving generalised shift register problems over skew polynomial rings which occur in error and erasure decoding of $\ell$-Interleaved Gabidulin codes. The algorithm is based on module minimisation and has time complexity $O(\ell μ^2)$ where $μ$ measures the size of the input problem.
Recently, codes in the sum-rank metric attracted attention due to several applications in e.g. multishot network coding, distributed storage and quantum-resistant cryptography. The sum-rank analogs of Reed-Solomon and Gabidulin codes are linearized Reed-Solomon codes. We show how to construct $h$-folded linearized Reed-Solomon (FLRS) codes and derive an interpolation-based decoding scheme that is capable of correcting sum-rank errors beyond the unique decoding radius. The presented decoder can be used for either list or probabilistic unique decoding and requires at most $\mathcal{O}(sn^2)$ ope…
We introduce a new family of rank metric codes: Low Rank Parity Check codes (LRPC), for which we propose an efficient probabilistic decoding algorithm. This family of codes can be seen as the equivalent of classical LDPC codes for the rank metric. We then use these codes to design cryptosystems à la McEliece: more precisely we propose two schemes for key encapsulation mechanism (KEM) and public key encryption (PKE). Unlike rank metric codes used in previous encryption algorithms -notably Gabidulin codes - LRPC codes have a very weak algebraic structure. Our cryptosystems can be seen as an equi…
Error control is significant to network coding, since when unchecked, errors greatly deteriorate the throughput gains of network coding and seriously undermine both reliability and security of data. Two families of codes, subspace and rank metric codes, have been used to provide error control for random linear network coding. In this paper, we enhance the error correction capability of these two families of codes by using a novel two-tier decoding scheme. While the decoding of subspace and rank metric codes serves a second-tier decoding, we propose to perform a first-tier decoding on the packe…
We present a construction of subspace codes along with an efficient algorithm for list decoding from both insertions and deletions, handling an information-theoretically maximum fraction of these with polynomially small rate. Our construction is based on a variant of the folded Reed-Solomon codes in the world of linearized polynomials, and the algorithm is inspired by the recent linear-algebraic approach to list decoding. Ours is the first list decoding algorithm for subspace codes that can handle deletions; even one deletion can totally distort the structure of the basis of a subspace and is …
Codes in the sum-rank metric have various applications in error control for multishot network coding, distributed storage and code-based cryptography. Linearized Reed-Solomon (LRS) codes contain Reed-Solomon and Gabidulin codes as subclasses and fulfill the Singleton-like bound in the sum-rank metric with equality. We propose the first known error-erasure decoder for LRS codes to unleash their full potential for multishot network coding. The presented syndrome-based Berlekamp-Massey-like error-erasure decoder can correct $t_F$ full errors, $t_R$ row erasures and $t_C$ column erasures up to $2t…
We study Reed--Solomon codes over arbitrary fields, inspired by several recent papers dealing with Gabidulin codes over fields of characteristic zero. Over the field of rational numbers, we derive bounds on the coefficient growth during encoding and the bit complexity of decoding, which is polynomial in the code length and in the bit width of error and codeword values. The results can be generalized to arbitrary number fields.
