Subspace Designs based on Algebraic Function Fields

TL;DR

This paper introduces a new method for constructing subspace designs over any field using algebraic function fields, extending previous polynomial-based approaches and enabling applications like dimension expanders over all fields.

Contribution

It extends subspace design constructions to arbitrary fields by leveraging algebraic function fields, broadening their applicability and improving their utility in linear-algebraic pseudorandomness.

Findings

Constructed subspace designs over any field with slightly weaker parameters.

Applied the new designs to produce dimension expanders over all fields.

Achieved logarithmic degree and expansion for large subspaces.

Abstract

Subspace designs are a (large) collection of high-dimensional subspaces $\{H_i\}$ of $\F_q^m$ such that for any low-dimensional subspace $W$, only a small number of subspaces from the collection have non-trivial intersection with $W$; more precisely, the sum of dimensions of $W \cap H_i$ is at most some parameter $L$. The notion was put forth by Guruswami and Xing (STOC'13) with applications to list decoding variants of Reed-Solomon and algebraic-geometric codes, and later also used for explicit rank-metric codes with optimal list decoding radius. Guruswami and Kopparty (FOCS'13, Combinatorica'16) gave an explicit construction of subspace designs with near-optimal parameters. This construction was based on polynomials and has close connections to folded Reed-Solomon codes, and required large field size (specifically $q \ge m$). Forbes and Guruswami (RANDOM'15) used this construction to give explicit constant degree "dimension expanders" over large fields, and noted that subspace designs are a powerful tool in linear-algebraic pseudorandomness. Here, we construct subspace designs over any field, at the expense of a modest worsening of the bound $L$ on total intersection dimension. Our approach is based on a (non-trivial) extension of the polynomial-based construction to algebraic function fields, and instantiating the approach with cyclotomic function fields. Plugging in our new subspace designs in the construction of Forbes and Guruswami yields dimension expanders over $\F^n$ for any field $\F$, with logarithmic degree and expansion guarantee for subspaces of dimension $\Omega(n/(\log \log n))$.

Equations

$$A_1(X)f(X)+A_2(X)f(\gamma X)+\cdots +A_s(X)f({\gamma }^{s-1}X)=0$$

$$\mathcal{L}(D):=\{f\in F\setminus \{0\}:(f)+D⩾0\}\cup \{0\}.$$

$${\rm Aut}(F/\mathbb{F}_{q})=\{\tau:\;\mbox{$\tau$ is an automorphism of $F$ and $\alpha^{\tau}=\alpha$ for all $\alpha\in\mathbb{F}_{q}$}\}.$$

$${\Lambda }_{p(x)}:=\{\alpha \in K^{ac}:{\alpha }^{p(x)}=0\}.$$

$$(\lambda )=P^{\prime }+\sum _{i=1}^d\sum _{j=1}^{q^{i-1}}((q-1)(d-i)-1){\infty }_{ij},$$

$$f=p(x{)}^e\sum _{i=0}^{m-1}{a}_i(x){\lambda }^i,$$

$$(\lambda )=P^{\prime }+\sum _{i=1}^d\sum _{j=1}^{q^{i-1}}((q-1)(d-i)-1){\infty }_{ij},$$

$$x^{-m(d-i)}{t}_i^{-m}+x^{-(m-1)(d-i)}{c}_{m-1}(x)t_i^{-(m-1)}+\cdots +x^{-(d-i)}{t}_i^{-1}+c_0(x)=0.$$

$$\sum _{k=1-q}^{-1}{\alpha }_k{t}_i^{-k}+a(t_i)$$

$$f=\sum _{k=-r}^{-1}{\beta }_k{t}_i^{-k}+b(t_i)$$

$$\sum _{i=1}^s{A}_i{f}_i=0.$$

$$\sum _{j=1}^r\left(\sum _{i=1}^s{a}_{ij}{f}_i\right)y_j=0.$$

$${\nu }_{Q^{\prime }}\left(\sum _{i=1}^s{a}_{ij}{f}_i\right)=0,\text{mbox}andhence{\nu }_{Q^{\prime }}\left(\left(\sum _{i=1}^s{a}_{ij}{f}_i\right)y_j\right)={\nu }_Q(y_j)e(Q^{\prime }|Q),$$

$$\sum _{i=1}^s{A}_i{f}_i=0.$$

$$\sum _{j=0}^r\left(\sum _{i=1}^s{a}_{ij}{f}_i\right)y_j=0.$$

$$-\sum _{j=0}^{b-1}\left(\sum _{i=1}^s{a}_{ij}{f}_i\right)y_j=\left(\sum _{i=1}^s{a}_{ib}{f}_i\right)y_b.$$

$${\nu }_{Q^{\prime }}\left(\left(\sum _{i=1}^s{a}_{ib}{f}_i\right)y_b\right)$$

$${\nu }_{Q^{\prime }}\left(-\sum _{j=0}^{b-1}\left(\sum _{i=1}^s{a}_{ij}{f}_i\right)y_j\right)⩾\underset{1⩽j⩽b-1}{\min }{\nu }_{Q^{\prime }}(y_j)={\nu }_Q(y_{b-1})e(Q^{\prime }|Q).$$

$$A_1{f}_1+\dots +A_s{f}_s=0.$$

$$A_1{f}_1^{{\sigma }^i}+\dots +A_s{f}_s^{{\sigma }^i}=0.$$

$$A_1{f}_1^{{\sigma }^i}+\dots +A_s{f}_s^{{\sigma }^i}=0,\text{ for all}i\in \{0,\dots ,s-1\}.$$

$$f_1^{{\sigma }^i}+B_2{f}_2^{{\sigma }^i}\dots +B_s{f}_s^{{\sigma }^i}=0,\text{ for }i\in \{0,\dots ,s-1\}.$$

$$f_1^{{\sigma }^{i+1}}+B_2^{\sigma }{f}_2^{{\sigma }^{i+1}}\dots +B_s^{\sigma }{f}_s^{{\sigma }^{i+1}}=0,\text{ for }i\in \{0,\dots ,s-2\}.$$

$$(B_2-B_2^{\sigma })f_2^{{\sigma }^{i+1}}+\dots +(B_s-B_s^{\sigma })f_s^{{\sigma }^{i+1}}=0,\text{ for }i\in \{0,\dots ,s-2\}.$$

$$\det(M_{\sigma}(f_{2},\dots,f_{s}))\neq 0,\ ~{}~{}\text{which implies}~{}~{}\det(M_{\sigma}(f_{2}^{\sigma},\dots,f_{s}^{\sigma}))=\bigl{(}\det(M_{\sigma}(f_{2},\dots,f_{s}))\bigr{)}^{\sigma}\neq 0\ .$$

$${\mathcal{H}}_P=\{f\in \mathcal{V}:f(P^{{\sigma }^{-i}})=0\text{ for each }i\in \{0,\dots ,t-1\}\}=\mathcal{V}\cap \mathcal{L}\left(D-\sum _{i=0}^{t-1}{P}^{{\sigma }^{-i}}\right).$$

$${\dim }_{{\mathbb{F}}_q}({\mathcal{H}}_P)⩾{\dim }_{{\mathbb{F}}_q}(\mathcal{V})+{\dim }_{{\mathbb{F}}_q}\left(D-\sum _{i=0}^{t-1}{P}^{{\sigma }^{-i}}\right)-{\dim }_{{\mathbb{F}}_q}(D)⩾{\dim }_{{\mathbb{F}}_q}(\mathcal{V})-t\mathrm{deg}(P).$$

$$\det (M_{\sigma }(f_1,\dots ,f_s))=b\det (M_{\sigma }(g_1,\dots ,g_s))$$

$$0=(g(P^{{\sigma }^{-(i+j)}}){)}^{q^{ei}}=(g(P^{{\sigma }^{-(i+j)}}){)}^{{\sigma }^i}=g^{{\sigma }^i}(P^{{\sigma }^{-j}}).$$

$$\ell s=\mathrm{deg}(sD)\ge \sum _{P\in {\mathcal{F}}_r}{d}_{P}r(t-s+1)\ge \sum _{P\in {\mathcal{F}}_r}r(t-s+1)\dim (\mathcal{W}\cap {\mathcal{H}}_P).$$

Full text

Guruswami and Kopparty (FOCS’13, Combinatorica’16) gave an explicit construction of subspace designs with near-optimal parameters. This construction was based on polynomials and has close connections to folded Reed-Solomon codes, and required large field size (specifically $q\geqslant m$). Forbes and Guruswami (RANDOM’15) used this construction to give explicit constant degree “dimension expanders” over large fields, and noted that subspace designs are a powerful tool in linear-algebraic pseudorandomness.

Here, we construct subspace designs over any field, at the expense of a modest worsening of the bound $L$ on total intersection dimension. Our approach is based on a (non-trivial) extension of the polynomial-based construction to algebraic function fields, and instantiating the approach with cyclotomic function fields. Plugging in our new subspace designs in the construction of Forbes and Guruswami yields dimension expanders over $\mathbb{F}^{n}$ for any field $\mathbb{F}$, with logarithmic degree and expansion guarantee for subspaces of dimension $\Omega(n/(\log\log n))$.

Research supported in part by NSF CCF-1422045.

1. Introduction

An emerging theory of “linear-algebraic pseudorandomness” studies the linear-algebraic analogs of fundamental Boolean pseudorandom objects where the rank of subspaces plays the role of the size of subsets. A recent work [FG15] studied the interrelationships between several such algebraic objects such as subspace designs, dimension expanders, rank condensers, and rank-metric codes, and highlighted the fundamental unifying role played by subspace designs in this web of connections.

Informally, a subspace design is a collection of subspaces of a vector space $\mathbb{F}_{q}^{m}$ (throughout we denote by $\mathbb{F}_{q}$ the finite field with $q$ elements) such that any low-dimensional subspace $W$ intersects only a small number of subspaces from the collection. More precisely:

Definition 1**.**

A collection $H_{1},H_{2},\dots,H_{M}$ of $b$-dimensional subspaces of $\mathbb{F}_{q}^{m}$ form an $(s,L)$-(strong) subspace design, if for every $s$-dimensional subspace $W\subset\mathbb{F}_{q}^{m}$, $\sum_{i=1}^{M}\dim(W\cap H_{i})\leqslant L$.

In particular, this implies that at most $L$ subspaces $H_{i}$ have non-trivial intersection with $W$. A collection meeting this weaker requirement is called a weak subspace design; unless we mention otherwise, by subspace design we always mean a strong subspace design in this paper. One would like the dimension $b$ of each subspace in the subspace design to be large, typically $\Omega(m)$ or applications of interest, $L$ to be small, and the number of subspaces $M$ to be large.

Subspace designs were introduced by the first two authors in [GX13], where they used them to improve the list size and efficiency of list decoding algorithms for algebraic-geometric codes, yielding efficiently list-decodable codes with optimal redundancy over fixed alphabets and small output list size. A standard probabilistic argument shows that a random collection of subspaces forms a good subspace design with high probability. Subsequently, Guruswami and Kopparty [GK16] gave an explicit construction of subspace designs, nearly matching the parameters of random constructions, albeit over large fields.

Intriguingly, the construction in [GK16] was based on algebraic list-decodable codes (specifically folded Reed-Solomon codes). Recall that improving the list-decodability of such codes was the motivation for the formulation of subspace designs in the first place! This is yet another compelling example of the heavily intertwined nature of error-correcting codes and other pseudorandom objects. The following states one of the main trade-offs achieved by the construction in [GK16].

Theorem 1.1** (Folded Reed-Solomon based construction [GK16]).**

For every $\varepsilon\in(0,1)$, positive integers $s,m$ with $s\leqslant\varepsilon m/4$, and a prime power $q>m$, there exists an explicit111By explicit, we mean a deterministic construction that runs in time $\text{poly}(q,m,M)$ and outputs a basis for each of the subspaces in the subspace design. collection of $M=q^{\Omega(\varepsilon m/s)}$ subspaces in $\mathbb{F}_{q}^{m}$, each of dimension at least $(1-\varepsilon)m$, which form a $(s,\frac{2s}{\varepsilon})$-(strong) subspace design.

Note the requirement of the field size $q$ being larger than the ambient dimension $m$ in their construction. To construct subspace designs over small fields, they use a construction over a large extension field $\mathbb{F}_{q^{r}}$, and view $b$-dimensional subspaces of $\mathbb{F}_{q^{r}}^{m^{\prime}}$ as $br$-dimensional subspaces of $\mathbb{F}_{q}^{rm^{\prime}}$. However, this transformation need not preserve the “strongness” of the subspace design, and an $(s,L)$-subspace design over the extension field only yields an $(s,L)$-weak subspace design over $\mathbb{F}_{q}$.

The strongness property is crucial for all the applications of subspace designs in [FG15]. In particular, the strongness is what drives the construction of dimension expanders (defined below) of low degree. The weak subspace design property does not suffice for these applications.

Definition 2**.**

A collection of linear maps $A_{1},A_{2},\dots,A_{d}:\mathbb{F}^{n}\to\mathbb{F}^{n}$ is said to be a $(b,\alpha)$-dimension expander if for every subspace $V$ of $\mathbb{F}^{n}$ of dimension at most $b$, $\dim(\sum_{i=1}^{d}A_{i}(V))\geqslant(1+\alpha)\cdot\dim(V)$. The number of maps $d$ is the “degree” of the expander, and $\alpha$ is the expansion factor.

Using the subspace designs constructed in Theorem 1.1 in a black-box fashion, Forbes and Guruswami [FG15] gave explicit $(\Omega(n),\Omega(1))$-dimension expanders of $O(1)$ degree when $|\mathbb{F}|\geqslant\mathrm{poly}(n)$. Here explicit means that the maps $A_{i}$ are specified explicitly, say by the matrix representing their action with respect to some fixed basis. Extending Theorem 1.1 to smaller fields will yield constant-degree $(\Omega(n),\Omega(1))$-dimension expanders over all fields. The only known constructions of such dimension expanders over finite fields rely on monotone expanders [DW10, DS11], a rather complicated (and remarkable) form of bipartite vertex expanders whose neighborhood maps are monotone. Even the existence of constant-degree monotone expanders does not follow from standard probabilistic methods, and the only known explicit construction is a sophisticated one using the group $\text{SL}_{2}(\mathbb{R})$ by Bourgain and Yehudayoff [BY13]. (Earlier, Dvir and Shpilka [DS11] constructed monotone expanders of logarithmic degree using Cayley graphs over the cyclic group, yielding logarithmic degree $(\Omega(n),\Omega(1))$-dimension expanders.)

In light of this, it is a very interesting question to remove the field size restriction in Theorem 1.1 above, as it will yield an arguably simpler construction of constant-degree dimension expanders over every field, and which might also offer a quantitatively better trade-off between the degree and expansion factor. We note that probabilistic constructions achieve similar parameters (in fact a slightly larger sized collection with $q^{\Omega(\varepsilon m)}$ subspaces) with no restriction on the field size (one can even take $q=2$).

Our construction. The large field size in Theorem 1.1 was inherited from Reed-Solomon codes, which are defined over a field of size at least the code length. Our main contribution in this work is a construction of subspace designs based on algebraic function fields, which permits us to construct subspace designs over small fields. By instantiating this approach with a construction based on cyclotomic function fields, we are able to prove the following main result in this work:

Theorem 1.2** (Main Theorem).**

For every $\varepsilon\in(0,1)$, a prime power $q$ and positive integers $s,m$ such that $s\leq\varepsilon m/4$, there exists an explicit construction of $M=\Omega(q^{\lfloor\varepsilon m/(2s)\rfloor}/\varepsilon)$ subspaces in $\mathbb{F}_{q}^{m}$, each of dimension at least $(1-\varepsilon)m$, which form an \Bigl{(}s^{\prime},\frac{2s^{\prime}\lceil\log_{q}(m)\rceil}{\varepsilon}\Bigr{)}-strong subspace design for all $s^{\prime}\leqslant s$.

Note that we state a slightly stronger property that the bound on intersection size improves for subspaces of lower dimension $s^{\prime}\leqslant s$. This property also holds for Theorem 1.1 and in fact is important for the dimension expander construction in [FG15], and so we make it explicit.

The bound on intersection size we guarantee above is worse than the one from the random construction by a factor of $\log_{q}m$. The result of Theorem 1.1 can be viewed as a special case of Theorem 1.2 since $\log_{q}m\leqslant 1$ when $q>m$. The factor $\log_{q}m$ comes out as a trade-off of the explicit construction vs the random construction given in [GX13]. The extension field based construction using Theorem 1.1 would yield an $(s,O(s^{2}/\varepsilon))$-subspace design (since an $(s,L)$-weak subspace design is trivially an $(s,sL)$-(strong) subspace design). The bound we achieve is better for all $s=\Omega(\log_{q}m)$. In the use of subspace designs in the dimension expander construction of [FG15], $s$ governs the dimension of the subspaces which are guaranteed to expand, which we would like to be large (and ideally $\Omega(m)$). The application of subspace designs to list decoding [GX13, GWX16] employs the parameter choice $m=O(s)$ in order keep the alphabet size $q^{m}$ small. Therefore, our improvement applies to a meaningful setting of parameters that is important for the known applications of (strong) subspace designs.

Application to dimension expanders over small fields. By plugging in the subspace designs of Theorem 1.2 into the dimension expander construction of [FG15], we can get the following:

Theorem 1.3**.**

For every prime power $q$ and positive integer $n\geqslant q$, there exists an explicit construction of a \Bigl{(}b=\Omega\bigl{(}\frac{n}{\log_{q}\log_{q}n}\bigr{)},1/3\Bigr{)}-dimension expander with $O(\log_{q}n)$ degree.

For completeness, let us very quickly recap how such dimension expanders may be obtained from the subspace designs of Theorem 1.2, using the “tensor-then-condense” approach in [FG15]. We begin with linear maps $T_{1},T_{2}:\mathbb{F}^{n}\to\mathbb{F}^{2n}$, where $T_{1}(v)=(v;0)$ and $T_{2}(v)=(0;v)$ — these trivially achieve expansion factor $2$ by doubling the ambient dimension. Then we take the subspace design of Theorem 1.2 with $m=2n$, $\varepsilon=1/2$, $s=2b$, and $M=12\lceil\log_{q}m\rceil$ subspaces $H_{i}$ (if $b=\beta n/(\log_{q}\log_{q}n)$ for small enough absolute constant $\beta>0$, Theorem 1.2 guarantees these many subspaces). Let $E_{i}:\mathbb{F}^{2n}\to\mathbb{F}^{n}$ be linear maps such that $H_{i}=\mathrm{ker}(E_{i})$. The dimension expander consists of the $2M$ composed maps $E_{i}\circ T_{j}$ for $i=1,2,\dots,M$ and $j=1,2$. Briefly, the analysis of the expansion in dimension proceeds as follows. Let $V$ be a subspace of $\mathbb{F}^{n}$ with $\dim(V)=\ell\leqslant b$, and let $W=T_{1}(V)+T_{2}(V)$ be the $2\ell$-dimensional subspace of $\mathbb{F}^{2n}$ after the tensoring step. The strong subspace design property implies that the number of maps $E_{i}$ for which $\dim(E_{i}W)<4\ell/3$ — which is equivalent to $\dim(W\cap H_{i})>2\ell/3$ — is less than $12\lceil\log_{q}m\rceil=M$. So there must be an $i$ for which $\dim(E_{i}W)\geqslant 4\ell/3$, and this $E_{i}$ when composed with $T_{1}$ and $T_{2}$ will expand $V$ to a subspace of dimension at least $\frac{4}{3}\dim(V)$.

By using a method akin to the conversion of Reed-Solomon codes over extension fields to BCH codes over the base field, applied to the large field subspace designs of Theorem 1.1, Forbes and Guruswami [FG15] constructed $(\Omega(n/\log n),\Omega(1))$-dimension expanders of $O(\log n)$ degree. In contrast, our construction here guarantees expansion for dimension up to $\Omega(n/(\log\log n))$. The parameters offered by Theorem 1.3 are, however, weaker than both the construction given in [DS11], which has logarithmic degree but expands subspaces of dimension $\Omega(n)$, as well as the one in [BY13], which further gets constant degree. However, we do not go through monotone expanders which are harder to construct than vertex expanders, and our construction works fully within the linear-algebraic setting. We hope that the ideas in this work pave the way for a subspace design similar to Theorem 1.1 over small fields, and the consequent construction of constant-degree $(\Omega(n),\Omega(1))$-dimension expanders over all fields. In fact, all that is required for this is an $(s,O(s))$-subspace design with a sufficiently large constant number of subspaces, each of dimension $\Omega(m)$.

Construction approach. The generalization of the polynomials-based subspace design from [GK16] to take advantage of more general algebraic function fields is not straightforward. The natural approach would be to replace the space of low-degree polynomials by a Riemann-Roch space consisting of functions of bounded pole order $\ell$ at some place. We prove that such a construction can work, provided the degree $\ell$ is less than the degree of the field extension (and some other mild condition is met, see Lemma 3.2). However, this degree restriction is a severe one, and the dimension of the associated Riemann-Roch space will typically be too small (as the “genus” of the function field, which measures the degree minus dimension “defect,” will be large), unless the field size is large. Therefore, we don’t know an instantiation of this approach that yields a family of good subspace designs over a fixed size field.

Let us now sketch the algebraic crux of the polynomial based construction in [GK16], and the associated challenges in extending it to other function fields. The core property of a dimension $s$ subspace $W$ of polynomials underlying the construction of Theorem 1.1 is the following: If $f_{1},f_{2},\dots,f_{s}\in\mathbb{F}_{q}[X]$ of degree less than $q-1$ are linearly independent over $\mathbb{F}_{q}$ (these $s$ polynomials being a basis of the subspace $W$), then the “folded Wronskian,” which is the determinant of the matrix $M(f_{1},f_{2},\dots,f_{s})$ whose $i,j$’th entry is $f_{j}(\gamma^{i-1}X)$, is a nonzero polynomial in $\mathbb{F}_{q}[X]$. Here $\gamma$ is an arbitrary primitive element of $\mathbb{F}_{q}$. One might compare this with the classical Wronskian criterion for linear dependence over characteristic zero fields (and also holds when characteristic is bigger than the degree of the $f_{i}$’s), based on the singularity of the $s\times s$ matrix whose $i,j$’th entry is $\frac{d^{i-1}f_{j}}{dX^{i-1}}$.

One approach is to prove this claim about the folded Wronskian is via a “list size” bound from list decoding: one can prove that for any $A_{1},\dots,A_{s}\in\mathbb{F}_{q}[X]$, not all [math], the space of solutions $f\in\mathbb{F}_{q}[X]_{<(q-1)}$ to

[TABLE]

has dimension at most $s-1$. (This was the basis of the linear-algebraic list decoding algorithm for folded Reed-Solomon codes [Gur11, GW13].) Stating the contrapositive, if $f_{1},f_{2},\dots,f_{s}$ are linearly dependent over $\mathbb{F}_{q}[X]$, then the rows of the matrix $M(f_{1},f_{2},\dots,f_{s})$ are linearly independent, and therefore its determinant, the folded Wronskian, is a nonzero polynomial. On the other hand, being the determinant of an $s\times s$ matrix whose entries are degree $m$ polynomials, the folded Wronskian has degree at most $ms$. To prove the subspace design property, one then establishes that for each subspace $H_{i}$ in the collection that intersects $W=\text{span}(f_{1},\dots,f_{s})$, the determinant picks up a number of distinct roots each with $\dim(W\cap H_{i})$ multiplicity, the set of roots for different intersecting $H_{i}$ being disjoint from each other. The total intersection bound then follows because the folded Wronskian has at most $ms$ roots, counting multiplicities.

One can try to mimic the above approach for folded algebraic-geometric (AG) codes, with $f^{\sigma}$ for some suitable automorphism $\sigma$ playing the role of the shifted polynomial $f(\gamma X)$. This, however, runs into significant trouble, as the bound on number of solutions $f$ to the functional equation analogous to (1), $A_{1}f+A_{2}f^{\sigma}+\cdots+A_{s}f^{\sigma^{s-1}}=0$, is much higher. The list of solutions is either exponentially large and needs pruning via pre-coding the folded AG codes with subspace-evasive sets [GX12], or it is much bigger than $q^{s-1}$ in the constructions based on cyclotomic function fields and narrow ray class fields where the folded AG codes work directly [Gur10, GX15].

Let $F/K$ be a function field where the extension is Galois with Galois group generated by an automorphism $\sigma$. We choose the $m$-dimensional ambient space $\mathcal{V}\cong\mathbb{F}_{q}^{m}$ to be a carefully chosen subspace of a Riemann-Roch space in $F$ of degree $\ell\gg m$ (specifically, we require $\ell\geqslant m+2{\mathfrak{g}}$ where ${\mathfrak{g}}$ is the genus). We then establish that if $f_{1},f_{2},\dots,f_{s}\in\mathcal{V}$ are linearly independent over $\mathbb{F}_{q}$, a certain “automorphism Moore matrix” $M_{\sigma}(f_{1},f_{2},\dots,f_{s})$ (Definition 4) is non-singular. The determinant of this Moore matrix is thus a non-zero function in $F$, and this generalizes the folded Wronskian criterion for polynomials mentioned above.

This non-singularity result is proved in two steps. First, we show that for functions in $\mathcal{V}$, linear independence over $\mathbb{F}_{q}$ implies linear independence over $K$. Then we show that for any $f_{1},\dots,f_{s}\in F$ that are linearly independent over $K=F^{\sigma}$, the automorphism Moore matrix associated with $\sigma$ is non-singular. With our hands on the non-zero function $\Delta=\mathsf{det}(M_{\sigma}(f_{1},f_{2},\dots,f_{s}))$, we can proceed as in the folded Reed-Solomon case — the part about $\Delta$ picking up many zeroes whenever a subspace in the collection intersects $\text{span}(f_{1},\dots,f_{s})$ also generalizes. The pole order of $\Delta$, however, is now $\ell s$ instead of $ms$ in the polynomial-based construction. This is the cause for the worse bound on total intersection dimension in our Theorem 1.2.

Organization. We begin with a quick review of background on algebraic function fields in general and cyclotomic function fields in particular in Section 2. We also elaborate on the the complexity aspects of computing bases of Riemann-Roch spaces and evaluating functions at high degree places in cyclotomic function fields — this implies that our subspace designs can be constructed in polynomial time. We present and analyze our constructions of subspace designs from function fields in Section 3 — we give two criteria that enable our construction, Lemmas 3.1, 3.2, though the former is the more useful one for us. In Section 4, we instantiate our construction with specific cyclotomic function fields and derive our main consequence for subspace designs and establish Theorem 1.2. For reasons of space, several of the technical proofs appear are deferred to appendices.

2. Preliminaries on function fields

Background on function fields. Throughout this paper, $\mathbb{F}_{q}$ denotes the finite field of $q$ elements. A function field $F$ over $\mathbb{F}_{q}$ is a field extension over $\mathbb{F}_{q}$ in which there exists an element $z$ of $F$ that is transcendental over $\mathbb{F}_{q}$ such that $F/\mathbb{F}_{q}(z)$ is a finite extension. $\mathbb{F}_{q}$ is called the full constant field of $F$ if the algebraic closure of $\mathbb{F}_{q}$ in $F$ is $\mathbb{F}_{q}$ itself. In this paper, we always assume that $\mathbb{F}_{q}$ is the full constant field of $F$, denoted by $F/\mathbb{F}_{q}$.

Each discrete valuation $\nu$ from $F$ to $\mathbb{Z}\cup\{\infty\}$ defines a local ring $O=\{f\in F:\;\nu(f)\geqslant 0\}$. The maximal ideal $P$ of $O$ is called a place. We denote the valuation $\nu$ and the local ring $O$ corresponding to $P$ by $\nu_{P}$ and $O_{P}$, respectively. The residue class field $O_{P}/P$, denoted by $F_{P}$, is a finite extension of $\mathbb{F}_{q}$. The extension degree $[F_{P}:\mathbb{F}_{q}]$ is called degree of $P$, denoted by $\deg(P)$.

Let $\mathbb{P}_{F}$ denote the set of places of $F$. A divisor $D$ of $F$ is a formal sum $\sum_{P\in\mathbb{P}_{F}}m_{P}P$, where $m_{P}\in\mathbb{Z}$ are equal to [math] except for finitely many $P$. The degree of $D$ is defined to be $\deg(D)=\sum_{P\in\mathbb{P}_{F}}m_{P}\deg(P)$. We say that $D$ is positive, denoted by $D\geqslant 0$, if $m_{P}\geqslant 0$ for all $P\in\mathbb{P}_{F}$. For a nonzero function $f$, the principal devisor $(f)$ is defined to be $\sum_{P\in\mathbb{P}_{F}}\nu_{P}(f)P$. Then the degree of the principal divisor $(f)$ is [math]. The Riemann-Roch space associated with a divisor $D$, denoted by $\mathcal{L}(D)$, is defined by

[TABLE]

Then $\mathcal{L}(D)$ is a finite dimensional space over $\mathbb{F}_{q}$. By the Riemann-Roch theorem [Sti08], the dimension of $\mathcal{L}(D)$, denoted by $\dim_{\mathbb{F}_{q}}(D)$, is lower bounded by $\deg(D)-{\mathfrak{g}}+1$, i.e., $\dim_{\mathbb{F}_{q}}(D)\geqslant\deg(D)-{\mathfrak{g}}+1$, where ${\mathfrak{g}}$ is the genus of $F$. Furthermore, $\dim_{\mathbb{F}_{q}}(D)=\deg(D)-{\mathfrak{g}}+1$ if $\deg(D)\geqslant 2{\mathfrak{g}}-1$. In addition, we have the following results [Sti08, Lemma 1.4.8 and Corollary 1.4.12(b)]:

• (i)

If $\deg(D)<0$, then $\dim_{\mathbb{F}_{q}}(D)=0$;

• (ii)

For a positive divisor $G$, we have $\dim_{\mathbb{F}_{q}}(D)-\dim_{\mathbb{F}_{q}}(D-G)\leqslant\deg(G)$, i.e., $\dim_{\mathbb{F}_{q}}(D-G)\geqslant\dim_{\mathbb{F}_{q}}(D)-\deg(G)$.

Let ${\rm Aut}(F/\mathbb{F}_{q})$ denote the set of automorphisms of $F$ that fix every element of $\mathbb{F}_{q}$, i.e.,

[TABLE]

For a place $P\in\mathbb{P}_{F}$ and an automorphism $\sigma\in{\rm Aut}(F/\mathbb{F}_{q})$, we denote by $P^{\sigma}$ the set $\{f^{\sigma}:\;f\in P\}$. Then $P^{\sigma}$ is a place and moreover we have $\deg(P^{\sigma})=\deg(P)$. The place $P^{\sigma}$ is called a conjugate place of $P$. $\sigma$ also induces an automorphsim of ${\rm Aut}(\mathbb{F}_{P}/\mathbb{F}_{q})$. This implies that there exists an integer $e\geqslant 0$ such that $\alpha^{\sigma}=\alpha^{q^{e}}$ for all $\alpha\in\mathbb{F}_{P}$. $\sigma$ is called the Frobenius of $P$ if $e=1$, i.e., $\alpha^{\sigma}=\alpha^{q}$ for all $\alpha\in\mathbb{F}_{P}$. For a place $P$ and a function $f\in O_{P}$, we denote by $f(P)$ the residue class of $f$ in $F_{P}$. Thus, we have $(f(P))^{q^{e}}=(f(P))^{\sigma}=f^{\sigma}(P^{\sigma})$.

Background on cyclotomic function fields. Let $x$ be a transcendental element over $\mathbb{F}_{q}$ and denote by $K$ the rational function field $\mathbb{F}_{q}(x)$. Let $K^{ac}$ be an algebraic closure of $K$. Denote by $\mathbb{F}_{q}[x]$ the polynomial ring $\mathbb{F}_{q}[x]$. Let ${\rm End}(K^{ac})$ be the ring homomorphism from $K^{ac}$ to $K^{ac}$. We define $\rho_{x}(z)=z^{q}+xz$ for all $z\in K^{ac}$. For $i\geqslant 2$, we define $\rho_{x^{i}}(z)=\rho_{x}(\rho_{x^{i-1}}(z))$. For a polynomial ${p(x)}=\sum_{i=0}^{n}a_{i}x^{i}\in\mathbb{F}_{q}[x]$, we define $\rho_{p(x)}(z)=\sum_{i=0}^{n}a_{i}\rho_{x^{i}}(z)$. For simplicity, we denote $\rho_{p(x)}(z)$ by $z^{p(x)}$. It is easy to see that $z^{p(x)}\in\mathbb{F}_{q}[x][z]$ is a $q$-linearized polynomial in $z$ of degree $q^{d}$, where $d=\deg({p(x)})$.

For a polynomial ${p(x)}\in\mathbb{F}_{q}[x]$ of degree $d$, define the set

[TABLE]

Then $\Lambda_{p(x)}\simeq\mathbb{F}_{q}[x]/({p(x)})$ is an $\mathbb{F}_{q}[x]$-module and it has exactly $q^{d}$ elements. Furthermore, $\Lambda_{p(x)}$ is a cyclic $\mathbb{F}_{q}[x]$-module. For any generator $\lambda$ of $\Lambda_{p(x)}$, one has $\Lambda_{p(x)}=\{\lambda^{A}:\;A\in\mathbb{F}_{q}[x]/({p(x)})\}$ and $\lambda^{A}$ is a generator of $\Lambda_{p(x)}$ if and only if $\gcd(A,{p(x)})=1$. The extension $K(\lambda)=K(\Lambda_{p(x)})$ is a Galois extension over $K$ with ${\rm Gal}(K(\Lambda_{p(x)})/K)\simeq(\mathbb{F}_{q}[x]/{p(x)})^{*}$, where $(\mathbb{F}_{q}[x]/{p(x)})^{*}$ is the unit group of the ring $\mathbb{F}_{q}[x]/({p(x)})$. We use $\sigma_{A}$ to denote the automorphism of ${\rm Aut}(K(\lambda)/K)$ corresponding to $A$, i.e., $\lambda^{\sigma_{A}}=\lambda^{A}$. The size of $(\mathbb{F}_{q}[x]/{p(x)})^{*}$ is denoted by $\Phi({p(x)})$. If ${p(x)}$ is an irreducible polynomial of degree $d$ over $\mathbb{F}_{q}$, we have $\Phi({p(x)})=q^{d}-1$. In this case, the extension $K(\Lambda_{p(x)})/K$ is cyclic and ${\rm Gal}(K(\Lambda_{p(x)})/K)\simeq(\mathbb{F}_{q}[x]/{p(x)})^{*}\simeq\mathbb{F}_{q^{d}}^{*}$.

From now on in this subsection, we assume that ${p(x)}$ is a monic irreducible polynomial of degree $d$ over $\mathbb{F}_{q}$. The infinite place $\infty$ of $K$ splits into $(q^{d}-1)/(q-1)$ places of degree $1$ in $K(\Lambda_{p(x)})$, each having ramification index $q-1$. The zero place of ${p(x)}$ is totally ramified in $K(\Lambda_{p(x)})/K$. Furthermore, a monic irreducible polynomial $h(x)\neq{p(x)}$ of $\mathbb{F}_{q}[x]$ is unramified and splits into $s$ places of degree $r\deg(h)$, where $r$ is the order of $h(x)$ in the unit group $(\mathbb{F}_{q}[x]/{p(x)})^{*}$ and $s=(q^{d}-1)/r$. This implies that the zero place of $x$ in totally inert in $K(\Lambda_{p(x)})/K$ if ${p(x)}\neq x$ is a monic primitive polynomial.

Lemma 2.1**.**

[Hay74, Ros02]** Let ${p(x)}$ be a monic irreducible polynomial of degree $d$ and let $\lambda$ be a generator of $\Lambda_{p(x)}$. Then $\lambda$ is a local parameter of the unique place ${P^{\prime}}$ of $K(\Lambda_{p(x)})$ lying over ${p(x)}$, i.e., $\nu_{{P^{\prime}}}(\lambda)=1$. Furthermore, let $O_{K(\Lambda_{p(x)})}$ be the integral closure of $\mathbb{F}_{q}[x]$ in $K(\Lambda_{p(x)})$. Then $\{1,\lambda,\dots,\lambda^{m-1}\}$ is an integral basis of $O_{K(\Lambda_{p(x)})}$ over $\mathbb{F}_{q}[x]$, where $m=q^{d}-1$.

Let $\infty$ denote the pole place of $x$ in $K$. The following lemma determines the principal divisor of a generator of $\Lambda_{p(x)}$.

Lemma 2.2**.**

Let ${p(x)}$ be a monic irreducible polynomial of degree $d$ and let $\lambda$ be a generator of $\Lambda_{p(x)}$. Then the principal divisor $(\lambda)$ is equal to

[TABLE]

where $P^{\prime}$ is the unique place of $K(\Lambda_{p(x)})$ lying over the zero of ${p(x)}$ and $\{\infty_{ij}\}_{1\leqslant i\leqslant d,1\leqslant j\leqslant q^{i-1}}$ is the set of all places of $K(\Lambda_{p(x)})$ lying over $\infty$ of $\mathbb{F}_{q}(x)$.

Proof.

Let us first look at the poles of $\lambda$. Write $\lambda^{p(x)}/\lambda=\sum_{i=0}^{d}{p(x)\brack i}\lambda^{q^{i}-1}$, where ${p(x)\brack i}$ denotes the coefficient of $\lambda^{q^{i}-1}$. Then ${p(x)\brack i}$ is a polynomial in $x$ of degree $q^{i}(d-i)$. If a place $Q$ of $K(\Lambda_{p(x)})$ does not lie over $\infty$ of $K$, we claim that $\nu_{Q}(\lambda)\geqslant 0$. Otherwise, one would have $\nu_{Q}(\lambda^{q^{d}-1})<\nu_{Q}\left({p(x)\brack i}\lambda^{q^{i}-1}\right)$ for all $i\leqslant 0\leqslant d-1$. This is impossible as $\sum_{i=0}^{d}{p(x)\brack i}\lambda^{q^{i}-1}=0$.

By [Hay74, Theorem 3.2], we know that there exists a place $Q$ of $K(\Lambda_{p(x)})$ lying over $\infty$ of $K$ such that $\nu_{Q}(\lambda)=-1$ and $\nu_{Q}(\lambda^{A})=(q-1)(d-i)-1$ for any polynomial $A\in\mathbb{F}_{q}[x]$ of degree $i-1\leqslant d-1$. This implies that for a polynomial $A$ of degree $i-1\leqslant d-1$ with $\gcd(A,p(x))=1$, one has $\nu_{R}(\lambda)=(q-1)(d-1)-1$ for $R=Q^{\sigma_{B}}$, where $B$ is the unique polynomial of degree $<d$ satisfying $AB\equiv 1\bmod{p(x)}$. When $A$ runs through all polynomials in $(\mathbb{F}_{q}[x]/(p(x)))^{*}$, $\sigma_{B}$ runs through all conjugate places lying over $\infty$. This means that there are exactly $q^{i-1}$ places $R$ lying over $\infty$ with $\nu_{R}(\lambda)=(q-1)(d-i)-1$ since there are $q^{i-1}$ monic polynomials of degree $i-1$ in $(\mathbb{F}_{q}[x]/(p(x)))^{*}$. Hence, the divisor $\sum_{i=1}^{d}\sum_{j=1}^{q^{i-1}}((q-1)(d-i)-1)\infty_{ij}$ appears as part of the principal divisor $(\lambda)$. The desired result follows from the following facts: (i) $\lambda$ has no poles other than those lying $\infty$; (ii) $\lambda$ is a local parameter of $P^{\prime}$; and (iii) $\deg\left(\sum_{i=1}^{d}\sum_{j=1}^{q^{i-1}}((q-1)(d-i)-1)\infty_{ij}\right)=-d$. This completes the proof. ∎

Now we show that every element in the Riemann-Roch space $\mathcal{L}(\ell P^{\prime})$ has a unique representation of certain form.

Lemma 2.3**.**

Let ${p(x)}$ be a monic irreducible polynomial of degree $d$ and let $\lambda$ be a generator of $\Lambda_{p(x)}$. Let $P^{\prime}$ be the place of $K(\Lambda_{p(x)})$ lying over ${p(x)}$. Then every nonzero element $f$ of $\mathcal{L}(\ell P^{\prime})$ can be uniquely written as $f={p(x)}^{-e}\sum_{i=0}^{m-1}A_{i}\lambda^{i}$ for some $e\geqslant 0$, where $A_{i}$ are polynomials of $\mathbb{F}_{q}[x]$ and not all of them are divisible by ${p(x)}$. Furthermore, $\deg(A_{i})\leqslant(m-1)/(q-1)+de+d/2$ for all $0\leqslant i\leqslant m-1$.

Proof.

If $f\in\mathbb{F}_{q}$, it is clearly true. Now let $f\in\mathcal{L}(\ell P^{\prime})\setminus\mathbb{F}_{q}$. Let $\nu_{P^{\prime}}(f)=-r<0$ and put $e=\lceil\frac{r}{m}\rceil$. Then $0\leqslant\nu_{P^{\prime}}({p(x)}^{e}f)<m$. Thus, ${p(x)}^{e}f$ belongs to $O_{K(\Lambda_{p(x)})}$. By Lemma 2.1, there exists a set $\{A_{i}\}_{i=0}^{m-1}$ of $\mathbb{F}_{q}[x]$ such that ${p(x)}^{e}f=\sum_{i=0}^{m-1}A_{i}\lambda^{i}$. We claim that not all $A_{i}$ are divisible by ${p(x)}$. Otherwise we would have $\nu_{P^{\prime}}({p(x)}^{-e}\sum_{i=0}^{m-1}A_{i}\lambda^{i})\geqslant-em+m>-r$ and this is a contradiction.

Put $g={p(x)}^{e}f$. Let $\sigma$ be a generator of the Galois group ${\rm Gal}(K(\Lambda_{p(x)})/K)$. Define ${\bf g}=(g,g^{\sigma},\dots,g^{\sigma^{m-1}})$. Since $g^{\sigma^{k}}={p(x)}^{e}f^{\sigma^{k}}\in{p(x)}^{e}\mathcal{L}(\ell P^{\prime})$, we have $\nu_{\infty_{ij}}(g^{\sigma^{k}})\geqslant\nu_{\infty_{ij}}({p(x)}^{e})\geqslant-(q-1)de$ for all $0\leqslant k\leqslant m-1$ and each infinite place $\infty_{ij}$. Let $C$ be the $m\times m$ matrix with $(k,l)$ entry equal to $\sigma^{k}(\lambda^{l})$. Let $C_{i}$ be the matrix obtained from $C$ by replacing the $i^{\prime}s$ column with the column vector ${\bf g}$. Then we have $A_{i}=\det(C_{i})/\det(C)$.

Since $\nu_{\infty_{ij}}(\sigma^{k}(\lambda^{l}))\geqslant-1$, we have $\nu_{\infty_{ij}}(\det(C_{i}))\geqslant-(m-1)-(q-1)de$. As $\det(C)^{2}=\pm P$, we have $\nu_{\infty_{ij}}(\det(C))=-(q-1)d/2$. Thus, we have $\nu_{\infty_{ij}}(A_{i})=\nu_{\infty_{ij}}(\det(C_{i})/\det(C))=-(m-1)-(q-1)de+(q-1)d/2$. This implies that $\deg(A_{i})\leqslant(m-1)/(q-1)+de+d/2$. The proof is completed. ∎

We next discuss how to evaluate a function at a place of higher degree. Let $g(x)$ be an irreducible polynomial of degree $r$ and it splits completely in $K(\Lambda_{p(x)})$. By the Kummer Theorem [Sti08, Theorem III.3.7], the polynomial $\lambda^{p(x)}/x$ is factorized into $m$ product of linear factors over $\mathbb{F}_{q}[x]/(p(x))\simeq\mathbb{F}_{q^{r}}$. Let $\lambda-\alpha$ be a linear factor, then there is a place $Q$ of degree $r$ of $K(\Lambda_{p(x)})$. To evaluate a function $f(x,\lambda)\in\mathcal{L}(\ell P^{\prime})$ at $Q$, we can simple compute $f(\bar{x},\alpha)$, where $\bar{x}$ is the residue class of $x$ in $\mathbb{F}_{q}[x]/(p(x))$. It is clear that the complexity of this evaluation takes time $\text{poly}(q,m,r)$. The above analysis gives the following result.

Lemma 2.4**.**

Let ${p(x)}$ be a monic irreducible polynomial of degree $d$ and let $\lambda$ be a generator of $\Lambda_{p(x)}$. Let $P^{\prime}$ be the place of $K(\Lambda_{p(x)})$ lying over ${p(x)}$. Then for a place $Q$ of $K(\Lambda_{p(x)})$ of degree $r$ that is completely splitting over $K$, the evaluation of a function of $f(x,\lambda)\in\mathcal{L}(\ell P^{\prime})$ at $Q$ can be computed in $\text{poly}(q,m,r)$ time.

Computing bases. Our next goal is the following claim, which states that bases for the requisite bases for our construction can be efficiently computed.

Assume that $p(x)$ is a monic primitive polynomial of degree $d$ in $\mathbb{F}_{q}[x]$. Let $\lambda$ be a generator of $\Lambda_{p(x)}$. Then we have the following facts:

• •

Every nonzero function $f$ in $\mathcal{L}(D)$ has the form

[TABLE]

where $e\geqslant 0$ and $a_{i}(x)\in\mathbb{F}_{q}[x]$ and not all $a_{i}(x)$ are divisible by $p(x)$.

• •

The principal divisor $(\lambda)$ is

[TABLE]

where $\{\infty_{ij}\}_{1\leqslant i\leqslant d,1\leqslant j\leqslant q^{i-1}}$ is the set of all places lying over $\infty$ of $\mathbb{F}_{q}(x)$.

Let $f$ be a function given in (5). To show that $f$ belongs $\mathcal{L}(D)$, it is sufficient to check that $\nu_{P^{\prime}}(f)\geqslant-\ell/d$ and $\nu_{\infty_{ij}}(f)\geqslant 0$ for all places $i,j$.

Let $i_{0}$ be the smallest number in $[0,m-1]$ such that $a_{i}(x)$ is not divisible by $p(x)$. Then we have $\nu_{P^{\prime}}(f)=-em+i_{0}$. Thus, we have $-em+i_{0}\geqslant-\left\lceil\frac{2{\mathfrak{g}}+m-1}{d}\right\rceil=-m+\left\lfloor\frac{m-q+1}{d(q-1)}\right\rfloor$. This implies that either $e=0$ (in this case $f\in\mathbb{F}_{q}$) or $e=1$ and $i_{0}\geqslant\left\lfloor\frac{m-q+1}{d(q-1)}\right\rfloor$.

To consider $\nu_{\infty_{ij}}(f)$, we note that $t_{i}:=(x^{d-i}\lambda)^{-1}$ is a local parameter of $\infty_{ij}$ for all $i,j$. Assume that $0=\lambda^{p(x)}/\lambda=\lambda^{m}+c_{m-1}(x)\lambda^{m-1}+\cdots+c_{1}(x)\lambda+c_{0}(x)\in\mathbb{F}_{q}[x][\lambda]$. Then we get an equation

[TABLE]

Let the local expansion of $x$ at ${\infty_{ij}}$ be

[TABLE]

for some $\alpha_{i}\in\mathbb{F}_{q}$ and $a(x)\in\mathbb{F}_{q}[x]$. Substituting $x$ with local expansion of (8) into (7) to solve $\alpha_{k}$. Then substituting (8) into (5) get

[TABLE]

for some integer $r\geqslant 1$, $\beta_{k}\in\mathbb{F}_{q}$ and $b(x)\in\mathbb{F}_{q}[x]$. Note that $\beta_{k}$ is a linear combination of coefficients of $a_{i}(x)$.

The genus of the function field $K(\Lambda_{p(x)})$ is ${\mathfrak{g}}=\frac{1}{2}\left(d-2+\frac{q-2}{q-1}\right)(q^{d}-1)+1$. Put $D=\left\lceil\frac{2{\mathfrak{g}}+m-1}{d}\right\rceil P^{\prime}.$ Let $Q^{\prime}$ be the unique place of $K(\Lambda_{p(x)})$ lying over $x$. It is clear that $\ell=\deg(D)\geqslant 2{\mathfrak{g}}+m$. Thus, $\dim_{\mathbb{F}_{q}}(D-Q^{\prime})=\deg(D)-m-{\mathfrak{g}}+1$. Choose $\mathcal{V}\subseteq\mathcal{L}(D)$ such that $\mathcal{V}$ and $\mathcal{L}(D-Q^{\prime})$ are a direct sum of $\mathcal{L}(D)$.

In conclusion, $f$ in the form (5) belongs to $\mathcal{L}(D)$ if and only if (i) (a) $f\in\mathbb{F}_{q}$ or (b) $e=1$ and $a_{i}(x)$ is divisible by $p(x)$ for all $0\leqslant i<\left\lfloor\frac{m-q+1}{d(q-1)}\right\rfloor$; (ii) the local expansion of $f$ in (9) satisfies $\beta_{k}=0$ for all $-r\leqslant i\leqslant d(q-1)+1$. Furthermore, $f$ in the form (5) belongs to $\mathcal{L}(D-Q^{\prime})$ if and only if in addition $f$ satisfies that $a_{i}(x)$ is divisible by $x$ for all $0\leqslant i\leqslant m-1$.

To determine $f$, it is equivalent to finding $a_{i}(x)$. We can solve $a_{i}(x)$ through a homogenous equation system of about $m^{2}$ variables that are coefficients of $a_{i}(x)$. Therefore, one can find a basis of $\mathcal{V}$ in $\text{poly}(q,m)$ time. Summering the above analysis gives us Lemma 2.5

Lemma 2.5**.**

Let ${p(x)}$ be a monic primitive polynomial of degree $d$ and let $\lambda$ be a generator of $\Lambda_{p(x)}$. Let $P^{\prime},Q^{\prime}$ be the places of $K(\Lambda_{p(x)})$ lying over ${p(x)}$ and $x$, respectively. Put $D=\left\lceil\frac{2{\mathfrak{g}}+m-1}{d}\right\rceil P^{\prime}$ with $m=q^{d}-1$. Then a basis of a vector space $\mathcal{V}$ satisfying $\mathcal{V}\oplus\mathcal{L}(D-Q^{\prime})=\mathcal{L}(D)$ can be computed in $\text{poly}(q,m)$ time.

3. Construction of subspace design

3.1. Moore determinant

The main purpose of this subsection is to provide a function, namely the determinant of a “Moore” matrix, that is guaranteed to be non-zero when $s$ functions $f_{1},f_{2},\dots,f_{s}$ in a function field $F/K$ are linearly independent over $\mathbb{F}_{q}$. This will provide the necessary generalization of the fact that the folded Wronskian is non-zero when $f_{1},\dots,f_{s}\in\mathbb{F}_{q}[X]$ of degree less than $(q-1)$ are linearly independent over $\mathbb{F}_{q}$.

Lemma 3.1**.**

Let $F/K$ be a finite field extension. Suppose that $Q^{\prime}$ is a place of $F$ lying above a rational place $Q$ of $K$. Let $D$ be a positive devisor of $F$ with $Q^{\prime}\not\in{\rm supp}(D)$. If $\mathcal{V}$ is an $\mathbb{F}_{q}$-subspace of $\mathcal{L}(D)$ such that $\mathcal{V}\cap\mathcal{L}(D-Q^{\prime})=\{0\}$, then $f_{1},\ldots,f_{s}\in\mathcal{V}$ are $\mathbb{F}_{q}$-linearly independent if and only if they are linearly independent over $K$.

Proof.

The “if” part is clearly true. Now assume that $f_{1},\ldots,f_{s}\in\mathcal{V}$ are $\mathbb{F}_{q}$-linearly independent. Suppose that there exist functions $A_{1},\ldots,A_{s}\in K$ such that not all of them are equal to [math] and

[TABLE]

By the Strong Approximation Theorem [Sti08, Theorem I.6.4], we can multiply $A_{i}$ with a common nonzero function $B$ in $K$ such that the only possible pole of $A_{i}B$ is $Q$ for all $i=1,2,\dots,s$. Thus, without loss of generality, we may assume that $\nu_{P}(A_{i})\geqslant 0$ for all places $P\neq Q$ of $K$. Let $a=\max\{-\nu_{Q}(A_{i}):\;A_{i}\neq 0,\;1\leqslant i\leqslant s\}$. Then we have $A_{i}\in\mathcal{L}(aQ)\subset K$ for all $1\leqslant i\leqslant s$. Since $Q$ is a rational place, one can find an $\mathbb{F}_{q}$-basis $y_{1},\ldots,y_{r}$ of $\mathcal{L}(aQ)$ such that the pole orders $-\nu_{Q}(y_{j})$ are strictly increasing.

Thus, $A_{i}$ can be expressed as $\sum_{i=1}^{r}a_{ij}y_{j}$ for some $a_{ij}\in\mathbb{F}_{q}$. We rewrite  (10) into the following identity

[TABLE]

As $\sum_{i=1}^{s}a_{ij}f_{i}\in\mathcal{V}\subseteq\mathcal{L}(D)$, and $\mathcal{V}\cap\mathcal{L}(D-Q^{\prime})=\{0\}$, we know that either $\sum_{i=1}^{s}a_{ij}f_{i}=0$ or

[TABLE]

where $e(Q^{\prime}|Q)$ denotes the ramification index of $Q^{\prime}$ over $Q$. As the $\nu_{Q^{\prime}}(y_{j})$ for $j=1,2,\dots,s$ are distinct, this implies that $\sum_{i=1}^{s}a_{ij}f_{i}=0$ for all $1\leqslant j\leqslant r$. Therefore, $a_{ij}=0$ for all $1\leqslant i\leqslant s$ and $1\leqslant j\leqslant r$ since $f_{1},f_{2},\dots,f_{s}$ are $\mathbb{F}_{q}$-linearly independent. So $A_{1}=\cdots=A_{s}=0$. This is a contradiction and the proof is completed. ∎

The above lemma provides a sufficient condition under which $\mathbb{F}_{q}$-linear independence of a set $f_{1},\ldots,f_{s}\in\mathcal{L}(D)$ of functions is equivalent to $K$-linear independence. Now we give an alternative condition although we will mainly use Lemma 3.1 in this paper.

Lemma 3.2**.**

Let $F/K$ be a finite field extension of degree $n<+\infty$. Suppose that there exists a rational place $Q$ in $K$ such that there is only one place $Q^{\prime}$ of $F$ lying above $Q$. Let $D$ be a positive divisor of $F$ with $Q^{\prime}\not\in{\rm supp}(D)$ and $\deg(D)<n$. Then $f_{1},\ldots,f_{s}\in\mathcal{L}(D)$ are $\mathbb{F}_{q}$-linearly independent if and only if they are linearly independent over $K$.

Proof.

The “if” part is clear. Now assume that $f_{1},\ldots,f_{s}\in\mathcal{L}(D)$ are $\mathbb{F}_{q}$-linearly independent. Suppose that there would exist functions $A_{1},\ldots,A_{s}\in K$ such that not all $A_{i}$ were not zero and

[TABLE]

We are going to derive a contradiction.

As in the proof of Lemma 3.1, we may assume that $\nu_{P}(A_{i})\geqslant 0$ for all places $P\neq Q$ of $K$. Let $a=\max\{-\nu_{Q}(A_{i}):\;A_{i}\neq 0,\;1\leqslant i\leqslant s\}$. Then we have $A_{i}\in\mathcal{L}(aQ)\subset K$ for all $1\leqslant i\leqslant s$. Since $Q$ is a rational place, one can find an $\mathbb{F}_{q}$-basis $y_{1},\ldots,y_{r}$ of $\mathcal{L}(aQ)$ such that the pole orders $-\nu_{Q}(y_{j})$ are strictly increasing as $j$ increases from $1$ to $r$.

Thus, $A_{i}$ can be expressed as $\sum_{i=1}^{r}a_{ij}y_{j}$ for some $a_{ij}\in\mathbb{F}_{q}$. We rewrite  (12) into the following identity

[TABLE]

Assume that $b$ is the largest index such that $\sum_{i=1}^{s}a_{ib}f_{i}\neq 0$. Such an index must exist as not all $a_{ij}$’s are [math], and $f_{1},f_{2},\dots,f_{s}$ are linearly independent over $\mathbb{F}_{q}$. Then the above identity becomes

[TABLE]

Since $Q^{\prime}$ is the unique place lying above $Q$, we have $e(Q^{\prime}|Q)\deg(Q^{\prime})=n$. Then, the fact that $\sum_{i=1}^{s}a_{ij}f_{i}\in\mathcal{L}(D)$ implies that either $\sum_{i=1}^{s}a_{ij}f_{i}=0$ or $\nu_{Q^{\prime}}\left(\sum_{i=1}^{s}a_{ij}f_{i}\right)\leq\frac{\deg(D)}{\deg(Q^{\prime})}<e(Q^{\prime}|Q)$. Therefore, the right hand side of (14) gives

[TABLE]

while the left hand side of (14) gives

[TABLE]

This is a contradiction and the proof is completed. ∎

Remark 1*.*

The requirement of $\deg(D)<[F:K]=n$ in Lemma 3.2 makes it difficult to compute the dimension of $\mathcal{L}(D)$ as the genus ${\mathfrak{g}}$ of $F$ is usually larger than $n$. While in Lemma 3.1, there is no such a requirement. When $\deg(D-Q^{\prime})\geqslant 2{\mathfrak{g}}-1$ and $\mathcal{V}\oplus\mathcal{L}(D-Q^{\prime})=\mathcal{L}(D)$, then by the Riemann-Roch theorem we have $\dim_{\mathbb{F}_{q}}(\mathcal{V})=\dim_{\mathbb{F}_{q}}(D)-\dim_{\mathbb{F}_{q}}(D-Q^{\prime})=\deg(Q^{\prime})$.

For each element $\sigma\in{\rm Aut}(F/\mathbb{F}_{q})$, denote by $F^{\sigma}$ the fixed field by $\langle\sigma\rangle$, i.e., $F^{\sigma}=\{x\in F:\;x^{\sigma}=x\}$. By the Galois theory, if $\sigma$ has a finite order, then $F/F^{\sigma}$ is a Galois extension and ${\rm Gal}(F/F^{\sigma})=\langle\sigma\rangle$.

Definition 3**.**

(Moore Matrix) Let $F/\mathbb{F}_{q}$ be a field extension. Let $f_{1},\ldots,f_{s}$ be elements of $F$, the Moore Matrix is defined by $M(f_{1},\ldots,f_{n})=\begin{pmatrix}f_{1}&\cdots&f_{s}\\ f_{1}^{q}&\cdots&f_{n}^{q}\\ \vdots&\ddots&\vdots\\ f_{1}^{q^{s-1}}&\cdots&f_{s}^{q^{s-1}}\\ \end{pmatrix}$,

It is a well-known fact that $f_{1},\ldots,f_{s}$ are linearly independent over $\mathbb{F}_{q}$ if and only if the Moore Determinant $\det(M(f_{1},\ldots,f_{s}))$ is nonzero.

Now we generalize the above Moore matrix as follows.

Definition 4**.**

(Automorphism Moore Matrix)* Let $F/\mathbb{F}_{q}$ be a field extension. Let $\sigma$ be an automorphism in ${\rm Aut}(F/\mathbb{F}_{q})$. Let $f_{1},\ldots,f_{s}$ be elements of $F$. The $\sigma$-Moore matrix $M_{\sigma}(f_{1},\ldots,f_{s})$ is defined by $M_{\sigma}(f_{1},f_{2},\dots,f_{s})=\begin{pmatrix}f_{1}&\cdots&f_{s}\\ f_{1}^{\sigma}&\cdots&f_{s}^{\sigma}\\ \vdots&\ddots&\vdots\\ f_{1}^{\sigma^{s-1}}&\cdots&f_{s}^{\sigma^{s-1}}\\ \end{pmatrix}$.*

Remark 2*.*

If $\sigma$ is the usual Frobenius, i.e., $f^{\sigma}=f^{q}$ for all $f\in F$. Then we have that $\det(M_{\sigma}(f_{1},\ldots,f_{s}))\neq 0$ if and only if $f_{1},\ldots,f_{n}$ are linearly independent over $F^{\sigma}=\mathbb{F}_{q}$.

Our next theorem can be seen as a generalization of the result given in Remark 2.

Lemma 3.3**.**

Let $\sigma\in{\rm Aut}(F/\mathbb{F}_{q})$. Let $f_{1},\ldots,f_{s}\in F$. Then the $\sigma$-Moore determinant $\det(M_{\sigma}(f_{1},f_{2},\ldots,f_{s}))$ equals [math] if and only if $f_{1},\ldots,f_{n}$ are linearly dependent over $F^{\sigma}$.

Proof.

Let us prove the “if” part first. Assume that $f_{1},\ldots,f_{s}$ are linearly dependent over $F^{\sigma}$, then there exist functions $A_{1},\ldots,A_{s}\in F^{\sigma}$ such that $A_{1},\ldots,A_{s}\in F^{\sigma}$ are not all zero and

[TABLE]

For each $0\leqslant i\leqslant s-1$, let automorphism $\sigma^{i}$ act on both the sides of (15), then we have

[TABLE]

Note that in the above equation, we use the fact that $A_{j}^{\sigma^{i}}=A_{j}$. The equation (16) implies that $(A_{1},\ldots,A_{s})$ is a nonzero solution of $M_{\sigma}(f_{1},\ldots,f_{s}){\bf z}={\bf 0}$. Hence, we conclude that $\det(M_{\sigma}(f_{1},f_{2},\ldots,f_{s}))=0$.

Next we prove the “only if” part by induction. It is clearly true for the case where $s=1$. Now assume that it holds for $s-1$. Suppose that $\det(M_{\sigma}(f_{1},f_{2},\ldots,f_{s}))=0$ and $f_{1},f_{2},\ldots,f_{s}$ are linearly independent over $F^{\sigma}$. We will derive a contradiction.

As $\det(M_{\sigma}(f_{1},f_{2},\ldots,f_{s}))=0$, there exist $A_{1},\ldots,A_{s}\in F$ such that not all $A_{1},\ldots,A_{s}$ are equal to [math] and

[TABLE]

Without loss of generality, we may assume that $A_{1}\neq 0$. Let $B_{i}=\frac{A_{i}}{A_{1}}\in F$ and we have

[TABLE]

Let $\sigma$ acts on both the sides of (17), then

[TABLE]

By subtracting the $i$-th equation in (18) from the $(i+1)$-th equation in (17), we obtain

[TABLE]

As $f_{2},\dots,f_{s}$ are linearly independent over $F^{\sigma}$, by induction hypothesis, we have

[TABLE]

But then the linear dependence (19) implies that $B_{i}-B_{i}^{\sigma}=0$ for all $2\leqslant i\leqslant s$. Thus, $B_{i}\in F^{\sigma}$ and (17) gives a non-trivial linear dependence of $f_{1},f_{2},\ldots,f_{s}$ over $F^{\sigma}$, a contradiction. ∎

Combining Lemmas 3.1 with 3.3 gives the following.

Corollary 3.4**.**

Assume that the conditions in Lemma 3.1 are satisfied with $K=F^{\sigma}$. Then for $f_{1},f_{2},\dots,f_{s}\in\mathcal{V}\subseteq\mathcal{L}(D)$, the $\sigma$-Moore determinant $\det(M_{\sigma}(f_{1},f_{2},\dots,f_{s}))=0$ if and only if $f_{1},f_{2},\dots,f_{s}$ are linearly dependent over $\mathbb{F}_{q}$.

Combining Lemmas 3.2 with 3.3 gives the following.

Corollary 3.5**.**

Assume that the conditions in Lemma 3.2 are satisfied with $K=F^{\sigma}$. Then for $f_{1},f_{2},\dots,f_{s}\in\mathcal{L}(D)$, the $\sigma$-Moore determinant $\det(M_{\sigma}(f_{1},f_{2},\ldots,f_{s}))=0$ if and only if $f_{1},f_{2},\dots,f_{s}$ are linearly dependent over $\mathbb{F}_{q}$.

Remark 3*.*

In [GK16], the function field $F$ is the rational function $\mathbb{F}_{q}(x)$. The automorphism $\sigma\in{\rm Aut}(F/\mathbb{F}_{q})$ is given by $x\mapsto\gamma x$, where $\gamma$ is a primitive element of $\mathbb{F}_{q}^{*}$. It is clear that the order of $\sigma$ is $q-1$. The fixed field $F^{\sigma}$ is $\mathbb{F}_{q}(x^{q-1})$. Thus, the degree $[F:F^{\sigma}]$ of extension $F/F^{\sigma}$ is $q-1$. Now for $m<q-1$, we consider the Riemman-Roch space $\mathcal{L}((m-1){P_{\infty}})$, where ${P_{\infty}}$ is the unique pole of $x$. Then $\mathcal{L}((m-1){P_{\infty}})$ in fact consists of all polynomials in $\mathbb{F}_{q}[x]$ of degree at most $m-1$. It is clear that $((m-1){P_{\infty}})^{\sigma}=(m-1){P_{\infty}}$. Furthermore, the rational place $y-\gamma$ of $F^{\sigma}$ is fully inert in $F$, where $y=x^{q-1}$. This is because $x^{q-1}-\alpha$ lies over $y-\alpha$ and $x^{q-1}-\alpha$ has degree $q-1$. Thus, all conditions in Lemma 3.2 are satisfied. Therefore, by Corollary 3.5 for a set of polynomials $f_{1},f_{2},\dots,f_{s}$ in $\mathbb{F}_{q}[x]$ of degree at most $m-1$, the $\sigma$-Moore determinant $\det(M_{\sigma}(f_{1},f_{2},\ldots,f_{s}))=0$ if and only if $f_{1},f_{2},\dots,f_{s}$ are linearly dependent over $\mathbb{F}_{q}$. This is exact the result of Lemma 12 of [GK16]. Note that the Moore determinant is called a folded Wronskian determinant in [GK16].

3.2. Construction

Let $\sigma\in{\rm Aut}(F/\mathbb{F}_{q})$ be an automorphism of a finite order. Let $D$ be a divisor of $F$ such that $D^{\sigma}=D$. Assume that all the conditions in Lemma 3.1 are satisfied. Recall $\mathcal{V}\subseteq\mathcal{L}(D)$ such that $\mathcal{V}\cap\mathcal{L}(D-Q)=\{0\}$.

For each place $P\in\mathbb{P}_{F}$ such that $P\not\in{\rm supp}(D)$ and $P,P^{\sigma^{-1}},\dots,P^{\sigma^{-(t-1)}}$ are distinct, we define the subspace $\mathcal{H}_{P}$:

[TABLE]

Recall that $f(P)$ is defined to be the residue class of $f$ in the residue field $O_{P}/P$. Hence, it is clear that

[TABLE]

Let $f(P)^{\sigma}=f(P)^{q^{e}}$ for some integer $e\geqslant 0$. Thus, we have $f^{\sigma^{i}}(P^{\sigma^{i}})=f(P)^{\sigma^{i}}=f(P)^{q^{ei}}$ for all integers $i\geqslant 0$.

Define $S_{P}=\{P^{\sigma^{-i}}:\;i\in\{0,\ldots,t-1\}\}$, and denote by $\mathcal{F}_{r}$ a set of places $P$ with degree $r$ such that $S_{P}$ are disjoint and $|S_{P}|=t$.

Theorem 3.6**.**

For any integers $s,t$ with $1\leqslant s\leqslant t$, the collection $(\mathcal{H}_{P})_{P\in\mathcal{F}_{r}}$ of subspaces of $\mathcal{V}$, each of codimension at most $rt$, is an $\left(s,\frac{\ell s}{r(t-s+1)}\right)$ strong subspace design, where $\ell=\deg(D)$.

Proof.

Let $\mathcal{W}\subseteq\mathcal{V}$ be an $\mathbb{F}_{q}$-subspace of dimension $s$. Let $f_{1},\ldots,f_{s}$ be a basis for $\mathcal{W}$. Denote the dimension $\dim_{\mathbb{F}_{q}}(\mathcal{W}\cap\mathcal{H}_{P})$ by $d_{P}$. Let $\{g_{1},\dots,g_{d_{P}}\}$ be a basis of $\mathcal{W}\cap\mathcal{H}_{P}$. Extend this basis to a basis $\{g_{1},\dots,g_{d_{P}},g_{d_{P}+1},\dots,g_{s}\}$ of $\mathcal{W}$. Then it is clear that

[TABLE]

for some $b\in\mathbb{F}_{q}^{*}$.

For any $g\in\mathcal{W}\cap\mathcal{H}_{P}$ and any $i,j$ with $0\leqslant i\leqslant s-1$ and $0\leqslant j\leqslant t-s$, we have $g(P^{\sigma^{-(i+j)}})=0$, i.e.,

[TABLE]

By definition of determinants, we have $\det(M_{\sigma}(g_{1},\ldots,g_{s})(P^{-j}))=\sum_{\pi\in S_{s}}{\rm sgn}(\pi)\prod_{i=0}^{s-1}g_{\pi(i)}^{\sigma^{i}}(P^{-j})$, where $S_{s}$ is the symmetric group. By (22), $\nu_{P^{-j}}(g_{\pi(i)})\geqslant 1$ whenever $\pi(i)\in\{1,\dots,d_{P}\}$. This implies that $\nu_{P^{-j}}\left({\rm sgn}(\pi)\prod_{i=0}^{s-1}g_{\pi(i)}^{\sigma^{u}}\right)\geqslant d_{P}$ for all $\pi$. Hence, $\nu_{P^{-j}}(M_{\sigma}(g_{1},\ldots,g_{s}))\geqslant d_{P}$ for all $j\in\{0,1,\dots,t-s\}$. In conclusion, we have $M_{\sigma}(f_{1},\ldots,f_{s})\in\mathcal{L}\left(sD-\sum_{P\in\mathcal{F}_{r}}\sum_{j=0}^{t-s}d_{P}P^{-j}\right)$.

As $M_{\sigma}(f_{1},\ldots,f_{s})$ is a nonzero function, we must have

[TABLE]

The desired result follows. ∎

So far in this subsection, we made use of Lemma 3.1 and Corollary 3.4 for construction of subspace designs. We can also make use of Lemma 3.2 and Corollary 3.5 to construct subspace designs. Let $D$ be a positive divisor of $F$ such that $D^{\sigma}=D$ and $\deg(D)<[F:F^{\sigma}]$. For each place $P\in\mathbb{P}_{F}$ such that $P\not\in{\rm supp}(D)$ and $P,P^{\sigma^{-1}},\dots,P^{\sigma^{-(t-1)}}$ are distinct, we define the subspace $\mathcal{I}_{P}$:

[TABLE]

We present the following result without proof as it is very similar to the one of Theorem 3.6.

Theorem 3.7**.**

For any integers $s,t$ with $1\leqslant s\leqslant t$, the collection $(\mathcal{I}_{P})_{P\in\mathcal{F}_{r}}$ of subspaces of $\mathcal{L}(D)$, each of codimension at most $rt$, is an $\left(s,\frac{\ell s}{r(t-s+1)}\right)$ strong subspace design, where $\ell=\deg(D)$.

3.3. Picking the places indexing the subspaces

To obtain a large set $\mathcal{F}_{r}$ of places which define the subspaces in Theorems 3.6 and 3.7, we consider those places $P$ that split completely in $F/F^{\sigma}$. Thus, $P,P^{\sigma^{-1}},\dots,$ $P^{\sigma^{-(t-1)}}$ are distinct as long as $t\leqslant[F:F^{\sigma}]={\rm ord}(\sigma)$.

Lemma 3.8**.**

Let $P$ be a place of degree $r$ in $F$ with $\gcd(r,[F:F^{\sigma}])=1$. If $P$ is unramified in $F/F^{\sigma}$, then $P$ splits completely in $F/F^{\sigma}$.

Proof.

Let $R$ be the place of $F^{\sigma}$ that lies under $P$, which has inertia degree $f(P|R)$. As $r=\deg(P)=f(P|R)\deg(R)$ and $f(P|R)|[F:F^{\sigma}]$, we must have $f(P|R)=1$ and $\deg(R)=r$. Since $P$ is unramified, the desired result follows. ∎

In view of the above result, we can choose $\mathcal{F}_{r}$ as follows. Let $r$ be co-prime to $n:={\rm ord}(\sigma)$. Let $P_{1},\dots,P_{N}$ be all non-conjugate places of degree $r$ that are not ramified. Then for each $i\in\{1,2,\dots,N\}$, $P_{i},P_{i}^{\sigma},\dots,P_{i}^{\sigma^{n-1}}$ are all distinct. Thus, we can form $\lfloor n/t\rfloor$ sets $S_{P_{i}},S_{P_{i}^{\sigma^{-t}}},\dots,S_{P_{i}^{\sigma^{-t(\lfloor n/t\rfloor-1)}}}$ that are pairwise disjoint. On the other hand, by [Sti08, Corollary 5.2.10(a)] there are at least $\frac{q^{r}}{r}-(2+7{\mathfrak{g}})\frac{q^{r/2}}{r}$ places of degree $r$, where ${\mathfrak{g}}$ is the genus $F$. Hence, if $r\gg\log_{q}(2+7{\mathfrak{g}})$ and not many places of degree $r$ are ramified, we have roughly $\frac{1}{rt}q^{r}$ such sets $S_{P}$. In fact, for our examples based on cyclotomic function fields in the next section, there are no places of degree $r$ that are ramified.

4. Subspace design from cyclotomic function fields

In this section, we will present subspace design from the construction given in Section 3 by applying cyclotomic function fields. We start with the subspace design in a ambient space of smaller dimension.

The small dimension case. If $\deg(D)$ is smaller than $n=[F:F^{\sigma}]$ and $n$ is smaller than the genus ${\mathfrak{g}}(F)$ of $F$, in general it is hard to compute dimension of the Riemann-Roch space $\mathcal{L}(D)$. Therefore, we cannot use the construction given in Theorem 3.7. In this subsection, we apply Theorem 3.7 to the case where we can estimate the dimension of $\mathcal{L}(D)$.

Let $F$ be the rational function field $\mathbb{F}_{q}(x)$. Let $\sigma\in{\rm Aut}(F/\mathbb{F}_{q})$ be given by $x\mapsto\gamma x$, where $\gamma$ is a primitive element of $\mathbb{F}_{q}^{*}$. By Remark 3 and Theorem 3.7, one can obtain the subspace design given in [GK16]. Below we show that the subspace design given in [GK16] can be realized by using cyclotomic function fields.

Put $K=\mathbb{F}_{q}(x)$. Let $p_{1}(x)$ be a monic linear polynomial. For instance, we can simply take $p_{1}(x)=x$. Then the cyclotomic function field $F_{1}:=K(\Lambda_{p_{1}})$ is a cyclic extension over $K$ with ${\rm Gal}(F_{1}/K)\simeq\mathbb{F}_{q}^{*}$. In fact, $F_{1}=K(\lambda)=\mathbb{F}_{q}(\lambda)$ with $\lambda$ satisfying $\lambda^{q-1}+x=0$. Thus, $K=\mathbb{F}_{q}(\lambda^{q-1})$. Let $\gamma$ be a primitive root of $\mathbb{F}_{q}$ and let $\sigma\in{\rm Gal}(F/K)$ be defined by $\lambda^{\sigma}=\lambda^{\gamma}=\gamma\lambda$. This gives the exactly the same function fields and automorphism $\sigma$ as in Remark 1. Therefore, we conclude that this cyclotomic function field also realizes the subspace design given in [GK16].

Next we consider a monic primitive quadratic polynomial $p_{2}(x)=x^{2}+\alpha x+\beta$ with $\alpha,\beta\in\mathbb{F}_{q}$. Then the cyclotomic function field $F_{2}:=K(\Lambda_{p_{2}})$ is a cyclic extension over $K$ with ${\rm Gal}(F_{2}/K)\simeq(\mathbb{F}_{q}[x]/(p_{2})^{*}$. In fact, $F_{2}=K(\lambda)$ with $\lambda$ satisfying $\lambda^{q^{2}-1}+\lambda^{q-1}(x^{q}+x+\alpha)+x^{2}+\alpha x+\beta=0.$ (see [MXY16]). Let $\sigma$ be a generator of ${\rm Gal}(F_{2}/K)$. Then by the Galois theory, the fixed field $F_{2}^{\sigma}$ is the rational function field $K=\mathbb{F}_{q}(x)$. The genus of the function field $F_{2}$ is ${\mathfrak{g}}(F_{2})=\frac{(q-2)(q+1)}{2}$ [Hay74, MXY16].

The zero of $p_{2}(x)$ is the unique ramified place in $\mathbb{F}_{q}(x)$ and it is totally ramified. Let $P^{\prime}$ be the unique place of $F_{2}$ that lies over the zero of $p_{2}(x)$. Let $\ell$ be an even positive integer with $\ell<q^{2}-1$ and let $D=(\ell/2)P^{\prime}$. Then $\deg(D)=\ell$ and $D^{\sigma}=D$. Furthermore, we know that the the zero of $(x-\alpha)$ is fully inert in $F_{2}/K$. Thus, all the conditions in Lemma 3.2 are satisfied. By Theorem 3.7, we have the following result.

Theorem 4.1**.**

For all positive integers $s,r,t,m$ and prime powers $q$ satisfying $s\leq t\leq m=\zeta q^{2}$ for some $\zeta\in(0,1/2]$, the above construction yields a collection of $M=\Omega(\frac{q^{r}}{rt})$ spaces $\mathcal{I}_{1},\ldots,\mathcal{I}_{M}\subset\mathbb{F}_{q}^{m}$, each of codimension $rt$, which forms an $\left(s^{\prime},\frac{(1+1/(2\zeta))ms^{\prime}}{r(t-s^{\prime}+1)}\right)$ strong subspace design for all $s^{\prime}\leqslant s$.

Proof.

Choose $\ell$ such that the dimension of $\mathcal{L}((\ell/2)P^{\prime})$ is $m=\zeta q^{2}$. By the Riemman-Roch Theorem, we have $\zeta q^{2}\geqslant\deg((\ell/2)P^{\prime})-{\mathfrak{g}}(F_{2})+1$, i.e., $\ell\leq\zeta q^{2}+g-1\leq(1/2+\zeta)q^{2}$. The desired result follows from Theorem 3.7. ∎

The large dimension case. In this subsection, we will make use of Theorem 3.6 due to large genus. Let $p(x)\in\mathbb{F}_{q}[x]$ be a monic primitive polynomial of degree $d\geqslant 2$. Consider the cyclotomic function field $F:=K(\Lambda_{p(x)})$, where $K$ is the rational function field $\mathbb{F}_{q}(x)$. Then $F/K$ is a Galois extension with ${\rm Gal}(F/K)\simeq(\mathbb{F}_{q}[x]/(p(x)))^{*}$. Thus, ${\rm Gal}(F/K)$ is a cyclic group of order $q^{d}-1$. Let $\sigma$ be a generator of this group. Then by the Galois theory, the fixed field $F^{\sigma}$ is the rational function field $\mathbb{F}_{q}(x)$.

The zero of $p(x)$ is the unique ramified place in $\mathbb{F}_{q}(x)$ and it is totally ramified. Let $P^{\prime}$ be the unique place of $F$ lying over the zero of $p(x)$. Let $Q^{\prime}s$ be the unique place of $F$ that lies over the zero of $x$. Since $Q^{\prime}$ is totally inert, we have $\deg(Q^{\prime})=[F:F^{\sigma}]=q^{d}-1:=m$.

The genus of the function field $F$ is ${\mathfrak{g}}=\frac{1}{2}\left(d-2+\frac{q-2}{q-1}\right)(q^{d}-1)+1$. Put $D=\left\lceil\frac{2{\mathfrak{g}}+m-1}{d}\right\rceil P^{\prime}.$ Then $\ell=\deg(D)\geqslant 2{\mathfrak{g}}+m$ and hence, $\dim_{\mathbb{F}_{q}}(D-Q^{\prime})=\deg(D-Q^{\prime})-{\mathfrak{g}}+1$. Choose $\mathcal{V}\subseteq\mathcal{L}(D)$ such that $\mathcal{V}$ and $\mathcal{L}(D-Q^{\prime})$ are a direct sum of $\mathcal{L}(D)$. Thus, we have $\mathcal{V}\cap\mathcal{L}(D-Q^{\prime})=\{0\}$ and $\dim_{\mathbb{F}_{q}}(\mathcal{V})=\dim_{\mathbb{F}_{q}}(D)-\dim_{\mathbb{F}_{q}}(D-Q^{\prime})=q^{d}-1=m$.

Thus, all the conditions in Lemma 3.1 are satisfied. By Theorem 3.6, we have the following.

Theorem 4.2**.**

For all positive integers $s,r,t,d,m$ and prime powers $q$ satisfying $\gcd(r,m)=1$ and $s\leq t\leq m/r=(q^{d}-1)/r$, there is an explicit collection of $M=\Omega(\frac{m\cdot q^{r}}{rt})$ spaces $\mathcal{H}_{1},\ldots,\mathcal{H}_{M}\subset\mathbb{F}_{q}^{m}$, each of codimension at most $rt$, which forms an $(s^{\prime},\frac{(d-1/(q-1))ms^{\prime}}{r(t-s^{\prime}+1)})$-strong subspace design for all $s^{\prime}\leqslant s$. Furthermore, the subspace design can be constructed in $\text{poly}(q,m,r)$ time.

Proof.

The subspace design property follows from Theorem 3.6 since $\ell=\deg(D)\leqslant(d-1/(q-1))m$. The construction of the subspace design mainly involves finding a basis of $\mathcal{V}$ and evaluations of functions at places of degree $r$. We have described how to compute a basis in Lemma 2.5 and how to evaluate a function a high degree place in Lemma 2.4. The places of degree $r$ defining the subspaces in the subspace design can be computed as described in Section 3.3. We can enumerate over all degree $r$ irreducible polynomials $R\in\mathbb{F}_{q}[x]$ by brute-force in $q^{O(r)}$ time. None of these places are ramified, and by Lemma 3.8 each of these places $R$ splits completely into $m$ places of degree $r$, say $\{P^{\sigma^{i-1}}\mid 1\leqslant i\leqslant m\}$, in $F$. So we can pick $b=\lfloor\frac{m}{t}\rfloor$ of these places $P,P^{\sigma^{t}},\dots,P^{\sigma^{(b-1)t}}$, and define a particular subspace of co-dimension $rt$ associated with each of them as in (20). ∎

By setting $t\approx 2s$ and $r\approx\lfloor\frac{\varepsilon m}{2s}\rfloor$ in Theorem 4.2, we obtain the Main Theorem 1.2.