The Weight Distribution of Quasi-quadratic Residue Codes

TL;DR

This paper investigates the properties of Quasi-quadratic Residue (QQR) codes, establishing their weight polynomial divisibility, developing an efficient computation algorithm, and connecting codeword weights to hyperelliptic curve point distributions.

Contribution

It proves the divisibility of QQR code weight polynomials, introduces an efficient algorithm for their computation, and links codeword weights to hyperelliptic curve point distributions.

Findings

Weight polynomials are divisible by (x^2 + y^2)^{d-1}.

An efficient algorithm for computing QQR weight polynomials is developed.

The distribution of hyperelliptic curve points is asymptotically normal.

Abstract

In this paper, we begin by reviewing some of the known properties of QQR codes and proved that $PSL_2(p)$ acts on the extended QQR code when $p \equiv 3 \pmod 4$. Using this discovery, we then showed their weight polynomials satisfy a strong divisibility condition, namely that they are divisible by $(x^2 + y^2)^{d-1}$, where $d$ is the corresponding minimum distance. Using this result, we were able to construct an efficient algorithm to compute weight polynomials for QQR codes and correct errors in existing results on quadratic residue codes. In the second half, we use the relation between the weight of codewords and the number of points on hyperelliptic curves to prove that the symmetrized distribution of a set of hyperelliptic curves is asymptotically normal.

Tables

Table 1. Table 1. Computational Results

$p$	$d$	$\delta$	Divisible by
3	2	0.33	${\left(x^2+y^2\right)}^3$
11	6	0.27	${\left(x^2+y^2\right)}^7$
19	8	0.21	${\left(x^2+y^2\right)}^7$
43	14	0.16	${\left(x^2+y^2\right)}^{15}$
59	18	0.15	${\left(x^2+y^2\right)}^{19}$
67	22	0.16	${\left(x^2+y^2\right)}^{23}$

Table 2. Table 2. Weight polynomials posted on [ 17 ]

$p$	$k$	$d$	Divisible by
89	45	17	${\left(x+y\right)}^{17}$
97	49	15	${\left(x+y\right)}^{15}$
103	52	19	${\left(x+y\right)}^{19}$
113	57	15	$\left(x+y\right)$
127	64	19	$\left(x+y\right)$
137	69	21	$\left(x+y\right)$
151	76	19	$\left(x+y\right)$
167	84	23	$\left(x+y\right)$

Table 3. Table 3. Weight polynomials in references

$p$	$k$	$d$	Divisible by
137	69	21	${\left(x+y\right)}^{21}$
151	76	19	${\left(x+y\right)}^{19}$
167	84	23	${\left(x+y\right)}^{23}$

Table 4. Table 4. Correction for p = 127 𝑝 127 p=127

$i$	$A_i$ in table	$A_i$ corrected
51	223367511592873280	223367511592873284
52	326460209251122496	326460209251122492
55	840260234424082176	840260234424082220
56	1080334587116677120	1080334587116677140
59	1899366974583683328	1899366974583683220
60	2152615904528174336	2152615904528174316
63	2596788489999036416	2596788489999036307

Equations

$$r_S:=\sum _{a\in S}{x}^a$$

$$Q:=\{(r_Q{r}_S)|S\subseteq {\mathbb{F}}_p\}$$

$$N:=\{(r_N{r}_S)|S\subseteq {\mathbb{F}}_p\}$$

$$y\mapsto \rho y,y=0,\cdots ,p-1$$

$$C:=\{(r_Q{r}_S,r_N{r}_S)|S\subset {\mathbb{F}}_p\}$$

$$r_Q$$

$$r_N$$

$$G:=\left[\begin{array}[]{c c c c c | c c c c c}a_{0}&a_{1}&a_{2}&\cdots&a_{p-1}&b_{0}&b_{1}&b_{2}&\cdots&b_{p-1}\\ a_{p-1}&a_{0}&a_{1}&\cdots&a_{p-2}&b_{p-1}&b_{0}&b_{1}&\cdots&b_{p-2}\\ \vdots&&\ddots&&\vdots&\vdots&&\ddots&&\vdots\\ a_{2}&a_{3}&a_{4}&\cdots&a_{1}&b_{2}&b_{3}&b_{4}&\cdots&b_{1}\\ a_{1}&a_{2}&a_{3}&\cdots&a_{0}&b_{1}&b_{2}&b_{3}&\cdots&b_{0}\end{array}\right]$$

$$G_Q[I|G_Q]=[G_Q|G_N]$$

$$d(C)=d(Q)+1$$

$$wt(c)=2p-|X_S({\mathbb{F}}_p)|$$

$$wt(c)=2p-|X_{S^c}({\mathbb{F}}_p)|$$

$$wt(c)=|X_{S^c}({\mathbb{F}}_p)|$$

$$A_C:=\sum _{i=0}^n{A}_i{x}^{n-i}{y}^i$$

$$G(x,y)$$

$$J(x,y)$$

$$S=\{\begin{array}{ll}{C}_0^{\perp }\backslash C^{\perp }& \text{ if }C\text{ is singly-even}\\ C^{\perp }& \text{ if }C\text{ is doubly-even}\end{array}$$

$$A_{C_0}(x,y)=\frac{1}{2}(A_C(x,y)+A_C(x,iy))$$

$$A_{C_0^{\perp }}(x,y)=\frac{1}{|C|}(A_C(x+y,x-y)+A_C(x+y,i(x-y)))$$

$$S_C(x,y)=A_{C_0^{\perp }}-A_{C^{\perp }}=\frac{1}{|C|}{A}_C(x+y,i(x-y))$$

$$\{e_i|i=0,\cdots ,p-1\}$$

$$\{1-e_i|i=0,\cdots ,p-1\}$$

$$\sum _{i=0}^{p-1}1-e_i$$

$$=1-(\sum _{i=0}^{p-1}{x}^i)e_0$$

$$=1-(\sum _{i=0}^{p-1}{x}_i,\sum _{i=0}^{p-1}{x}_i)$$

$$=0$$

$$\sum _{i=1}^{k}1-e_{n_i}=0$$

$$\sum _{i=1}^{k}1-\sum _{i=1}^k{e}_{n_i}=0$$

$$\alpha \cdot (1-e_i)$$

$$=p-wt(x^i{r}_Q)$$

$$=p-|Q|$$

$$=(p+1)/2$$

$$=0$$

$$(a_0,a_1,\cdots ,a_{p-1},b_0,\cdots ,b_{p-1})\in C_0^{\perp }$$

$$(a_0,a_1,\cdots ,a_{p-1},\sum _{i=0}^{p-1}{a}_i,b_0,\cdots ,b_{p-1},\sum _{i=0}^{p-1}{b}_i)\in \hat{C}$$

Full text

Nigel Boston

Department of Mathematics,

Department of Electric and Computer Engineering,

University of Wisconsin-Madison

WI 53706, United States

Jing Hao

Department of Mathematics,

University of Wisconsin-Madison

WI 53706, United States

1. Introduction

Quasi-quadratic residue codes (QQR codes) are a family of binary linear codes. They were first introduced by Bazzi and Mitter[2] as a quasi-cyclic code. Their work set foundations for the study of QQR codes. They discovered the relation between weights of a QQR code and number of points on hyperelliptic curves. Joyner[8] built upon this relation, and revealed the link between the QQR code and the famous Goppa’s Conjecture in coding theory.

We are interested in these codes mainly for two reasons: Firstly, they have close relations with hyperelliptic curves and Goppa’s Conjecture, and serve as a strong tool in studying those objects. Secondly, they are very good codes. Computational results show they have large minimum distances when $p\equiv 3\pmod{8}$.

QQR codes are similar to quadratic residue codes. They are asymptotically rate half codes (exactly rate half when $p\equiv 3\pmod{4}$). Also, as we will show, $PSL_{2}(p)$ acts as automorphisms of the extended QQR codes in a similar way as of the extended quadratic residue codes. Furthermore, when $p\equiv 7\pmod{8}$, we will show that the QQR code is equivalent to the even subcode of the corresponding quadratic residue code direct sum with itself, and therefore their weight enumerators have close relations.

We will utilize the result that $PSL_{2}(p)$ acts on these codes to prove a new discovery about their weight polynomials, i.e. they are divisible by $(x^{2}+y^{2})^{d-1}$, where $d$ is the corresponding minimum distance. The proof uses shadows of codes, a powerful tool to study weight polynomials. We also apply this idea to quadratic residue codes, and prove that their weight polynomials are divisible by $(x+y)^{d}$, with $d$ being the minimum distance.

These results impose strong conditions on the weight polynomials of quadratic residue codes and QQR codes. Combining the divisibility result and Gleason’s Theorem, we can derive an efficient algorithm to compute the weight polynomials of QQR codes. We also use these results to correct the existing computational results for the weight polynomials of quadratic residue codes that were originally posted on [17].

We also answer in the negative the question posted by Joyner[8] asking whether QQR codes satisfy Riemann hypothesis.

On the other hand, the weight of their codewords can be expressed in terms of the number of points on corresponding hyperelliptic curves over finite fields. As it is usually easier to study linear codes, this provides a way of studying point distributions of hyperelliptic curves. We will implement this idea to prove a variant of a result of Larsen[10] on asymptotic normal distribution of numbers of points on hyperelliptic curves.

2. Construction and properties

We first give constructions and introduce properties of QQR codes. We also include an introduction to quadratic residue codes, as these will be used in later sections.

Throughout the entire paper, if not stated otherwise, $p$ is a prime satisfying $\bf{p\equiv 3\pmod{4}}$.

Let $S$ be a subset of $\mathbb{F}_{p}$. We can assign to $S$ a polynomial in $\mathbb{F}_{2}[x]/(x^{p}-1)$ by

[TABLE]

Let $Q$ be the set of quadratic residues in $\mathbb{F}_{p}$ and $N$ be the quadratic non-residues in $\mathbb{F}_{p}$.

Definition 2.1** (Quadratic residue code).**

Let $p\equiv\pm 1\pmod{8}$,

[TABLE]

are the quadratic residue codes associated with $p$.

$Q$ is equivalent to $N$ since $r_{N}$ can be obtained from $r_{Q}$ via the permutation

[TABLE]

where $\rho$ is a primitive element of $\mathbb{F}_{p}$.

Notation**.**

Note that with abuse of notation, we use $Q$ to denote both the quadratic residues and the code generated by $r_{Q}$. It should be clear in the context what we are referring to. Similarly for $N$.

The generating matrices for $Q$ and $N$ are circulant matrices, and we denote them as $G_{Q}$ and $G_{N}$ respectively.

Definition 2.2** (Quasi-quadratic residue code).**

For an odd prime $p$,

[TABLE]

is called the quasi-quadratic residue code associated with $p$. $(r_{Q}r_{S},r_{N}r_{S})$ is identified with an element in $\mathbb{F}_{2}^{2p}$ in the usual way.

Notation**.**

By “the corresponding quadratic residue code” to a QQR code, we mean the quadratic residue code associated with the same $p$. Similarly for “the corresponding QQR code” to a quadratic residue code, we mean the QQR code associated with the same $p$.

If we write

[TABLE]

then the generating matrix for the QQR code can be written as

[TABLE]

This generating matrix is double circulant. Clearly $G=[G_{Q}|G_{N}]$.

We list some known properties of QQR codes below. Interested readers can check [8] for more information.

QQR codes are even weight codes. They have length $2p$ and dimension $p$. QQR codes are self-dual.

Proposition 2.3** (Gaborit[5]).**

When $p\equiv 3\pmod{8}$, $G_{Q}^{2}=G_{Q}^{-1}=G_{N}$. Equivalently, $r_{Q}^{2}=r_{Q}^{-1}=r_{N}$.

This proposition is a result of Perron’s Theorem[11] on quadratic residues.

Proposition 2.4** (Bazzi, Mitter[1]).**

When $p\equiv 3\pmod{8}$, the QQR code also has a standard double circulant form, i.e. its generating matrix can be written as $[I|G_{Q}]$.

Proof.

By Proposition 2.3, $G_{Q}$ is invertible and

[TABLE]

Therefore $[I|G_{Q}]$ is also a generating matrix for the QQR code. ∎

When Bazzi and Mitter first introduced QQR codes, their generating matrices were given in the form $[I|G_{Q}]$. They gave a proof that these codes also have generating matrices in the form $[G_{Q}|G_{N}]$ when $p\equiv 3\pmod{8}$. Most references on double circulant codes study codes whose generating matrices are in the form $[I|A]$, where $A$ is cyclic, such as Karlin’s original paper on double circulant codes[9].

Joyner defined QQR codes using $[G_{Q}|G_{N}]$ as their generating matrices, and we will also use this version in our paper. Note that when $p\equiv 7\pmod{8}$, the code generated by $[I|G_{Q}]$ is not equivalent to the code generated by $[G_{Q}|G_{N}]$, and therefore these two definitions are not the same.

From the definitions of quadratic residue code and QQR code, it is obvious that when $p\equiv 7\pmod{8}$, by only taking the first $p$ bits of a QQR code, we can obtain the corresponding quadratic residue code. Moreover, we can show a stronger connection between quadratic residue codes and QQR codes in this case.

Notation**.**

We denote $d(C)$ as the function that outputs the minimum distance of a code $C$.

Proposition 2.5**.**

When $p\equiv 7\pmod{8}$, let $C$ be the QQR code associated with $p$, and let $Q$ and $N$ be the corresponding quadratic residue codes. Then $C$ is the even subcode of $Q\oplus N$.

Moreover, their minimum distances satisfy

[TABLE]

Proof.

Since $C=\{(r_{Q}r_{S},r_{N}r_{S})|S\subseteq\mathbb{F}_{p}\}$, $Q\oplus N=\{(r_{Q}r_{S_{1}},r_{N}r_{S_{2}})|S_{1},S_{2}\subseteq\mathbb{F}_{p}\}$, we have $C\subseteq Q\oplus N$.

Also $C$ is even, and therefore $C$ is a subcode of the even subcode of $Q\oplus N$. $Q$ contains the all 1 codeword, and hence is not even. Therefore $Q\oplus N$ is also not even, and its even subcode is of codimension 1, which is $\dim(Q)+\dim(N)-1=\frac{p+1}{2}+\frac{p+1}{2}-1=p$.

Since $\dim(C)=p$, $C$ is equal to the even subcode of $Q\oplus N$.

For the last statement, as we will show in Proposition 3.16, $d(Q)$ is odd. Also, there exists a codeword $c^{\prime}$ in $C$ with weight $d+1$[3]. Therefore $d(C)\geq d+1$. On the other hand, since $d+1$ is even, $c^{\prime}\oplus 0$ is in the even subcode of $Q\oplus N$. So $d(C)=d(Q)+1$. ∎

2.1. Hyperelliptic Curves and Goppa’s Conjecture

For a code $C[n,k,d]$, $R:=\frac{k}{n}$ is the information rate. $\delta:=\frac{d}{n}$ is the relative minimum distance. $\delta$ indicates the error-correcting ability of a code. Ideally we want $R$ and $\delta$ both large, but Manin[12] proved that for a fixed field $\mathbb{F}_{q}$, there exists a function $\alpha_{q}(\delta)$ such that for a given $\delta$, there are infinitely many linear codes with rate approaching $R$ only for rates below $\alpha_{q}(\delta)$.

Gilbert[6] and Varshamov[19] showed $\alpha_{q}(\delta)\geq 1-x\log_{q}(q-1)+x\log_{q}(x)+(1-x)\log_{q}(1-x)$. When $q=2$, this is believed to be an equality by many people, known as the following conjecture.

Conjecture 1** (Goppa’s Conjecture).**

The Gilbert-Varshamov bound is tight in the binary case.

QQR codes play an important role in the study of Goppa’s Conjecture because of the following explicit relation with hyperelliptic curves.

Notation**.**

We denote by $wt(c)$ the function that outputs the weight of a codeword $c$.

Proposition 2.6** (Joyner[8]).**

Let $C$ be a QQR code associated with $p$, and $c=(r_{Q}r_{S},r_{N}r_{S})\in C$, where $S\subseteq\mathbb{F}_{p}$.

Define $f_{S}(x):=\prod_{a\in S}(x-a)$. Let $X_{S}(\mathbb{F}_{p})$ be the set of points on the hyperelliptic curve $y^{2}=f_{S}(x)$ over $\mathbb{F}_{p}$.

1. (1)

If $|S|$ is even

[TABLE] 2. (2)

If $|S|$ is odd and $p\equiv 1\pmod{4}$

[TABLE] 3. (3)

If $|S|$ is odd and $p\equiv 3\pmod{4}$

[TABLE]

Remark 1**.**

By the points on hyperelliptic curves we mean affine points, not including the points at infinity.

This relation builds a connection between Goppa’s Conjecture and hyperelliptic curves as in the following theorem. Interested readers can find more details in [8].

Theorem 2.7** (Joyner).**

Let $B(c,p)$ be the statement: For all subsets $S\subseteq\mathbb{F}_{p}$, $|X_{S}(\mathbb{F}_{p})|\leq c\cdot p$ holds. If $B(1.77,p)$ is true for infinitely many primes with $p\equiv 1\pmod{4}$, then Goppa’s Conjecture is false.

Not only do QQR codes play an important role in this connection, but they are very good codes when $p\equiv 3\pmod{8}$. Computational results so far all exceed the Gilbert-Varshamov bound. Since QQR codes are rate half codes, exceeding the Gilbert-Varshamov bound is equivalent to $\delta>0.11$. This gives Goppa’s Conjecture a serious challenge.

3. Weight Polynomials of QQR codes

In this section, we will show a new result on weight polynomials of QQR codes.

Definition 3.1**.**

The weight polynomial of a code (or a subset of it) is

[TABLE]

where $A_{i}$ denotes the number of codewords with weight $i$ in $C$, and $n$ is the length of the code.

When computing the weight polynomials of QQR codes, we found that they are divisible by $(x^{2}+y^{2})^{m}$, where $m$ is at least its minimum distance minus 1, and $m\equiv 3\pmod{4}$. See Table 1. We can also see that for these $p$’s, $\delta$ are all well above $0.11$.

The fact that $m\equiv 3\pmod{4}$ can be shown using Gleason’s theorem.

Theorem 3.2** (Gleason).**

If $C$ is self-dual code, then its weight polynomial $A_{C}$ is a polynomial in

[TABLE]

So for QQR codes, $A_{C}=\sum_{2i+8j=2p}a_{i}G(x,y)^{i}J(x,y)^{j}$. Since the degree of $A_{C}$ is $2p\equiv 6\pmod{8}$, and $8j\equiv 0\pmod{8}$, we must have $i\equiv 3\pmod{4}$ for all $i$. Therefore $m\equiv 3\pmod{4}$.

The other property of the weight polynomial is stated in the following theorem.

Theorem 3.3**.**

The weight polynomial of a QQR code is divisible by $(x^{2}+y^{2})^{d-1}$, where $d$ is its minimum distance.

Since $m$ needs to satisfy $m\equiv 3\pmod{4}$, $m$ is larger than $d-1$ sometimes.

To prove Theorem 3.3, we need to introduce shadows.

3.1. Shadows

We say a binary code is doubly-even if all its weights are divisible by $4$, or singly-even if its weights are even, but not doubly-even.

Let $C$ be a binary self-orthogonal code. Then $C$ is even. Let $C_{0}$ be the subset of doubly-even codewords of $C$. If $C$ is singly-even, then $C_{0}$ is a linear subcode of index $2$ in $C$.

Definition 3.4** (Shadow[13]).**

The shadow $S$ of a self-orthogonal binary code $C$ is

[TABLE]

We will follow the notation of [13] and denote the weight polynomial of the shadow of $C$ as $S_{C}(x,y)$. $S_{C}(x,y)$ can be computed from the weight polynomial of $C$.

Lemma 3.5**.**

$S_{C}(x,y)=\frac{1}{|C|}A_{C}(x+y,i(x-y))$, where $i^{2}=-1$.

We include the proof given in [13] here since it’s short.

Proof.

If $C$ is singly-even, this is immediate using MacWilliams identity. Assume $C$ is doubly-even. $A_{C_{0}}$ consists of the terms in $A_{C}$ whose powers of $y$ are divisible by $4$. So

[TABLE]

Using MacWilliams identity, we have

[TABLE]

So

[TABLE]

∎

Under a simple change of variable, the following lemma is immediate.

Lemma 3.6**.**

$A_{C}(x,y)=\frac{1}{|C|}S_{C}(x-iy,x+iy)$.

When $C$ is singly-even, the shadow $S$ of $C$ is $C_{0}^{\perp}\backslash C^{\perp}$, which does not contain the [math] codeword. Therefore if $S$ has minimum distance $d$, $S_{C}$ is divisible by $(xy)^{d}$. From the lemma above, we immediately have the following.

Lemma 3.7**.**

Let $C$ be singly-even, and $d$ be the minimum distance of its shadow. The weight polynomial of $C$ is divisible by $(x^{2}+y^{2})^{d}$.

Therefore, it is clear that, to prove Theorem 3.3, we just need to show the minimum distance of the shadow is at least its minimum distance minus 1.

In the next section, we will show this by proving a result about the automorphism group of extended QQR codes.

3.2. Automorphism groups

Let $C$ be the QQR code associated with $p$.

Since $(r_{Q},r_{N})\in C$, and $wt(r_{Q},r_{N})=|Q|+|N|=p-1\equiv 2\pmod{4}$, $C$ is singly-even. By definition, the shadow of $C$ is $C_{0}^{\perp}\backslash C^{\perp}$.

Let $e_{i}=x^{i}(r_{Q},r_{N})=(x^{i}r_{Q},x^{i}r_{N})$.

[TABLE]

is a basis for $C$.

Denote $\mathfrak{1}$ to be the all one codeword $(\sum_{i=0}^{p-1}x^{i},\sum_{i=0}^{p-1}x^{i})$.

All the codewords can be expressed in both vector forms and polynomial forms like $\mathfrak{1}$. We will alternate between them depending on which one is appropriate in the context.

Proposition 3.8**.**

$C_{0}$* is generated by*

[TABLE]

The proof uses the following lemma.

Lemma 3.9**.**

If each generator of a code has weight divisible by $4$, then so does every codeword.

This is a standard result that is easy to prove, and can be found in [11].

Proof.

(of Proposition 3.8):

Let $C^{\prime}$ be the code generated by $\{\mathfrak{1}-e_{i}|i=0,\cdots,p-1\}$. Since $wt(\mathfrak{1}-e_{i})=2p-wt(e_{i})=2p-(p-1)\equiv 0\pmod{4}$, by Lemma 3.9, $C^{\prime}$ is doubly-even. Therefore $C^{\prime}\subseteq C_{0}$.

Note that

[TABLE]

So $\{\mathfrak{1}-e_{i}|i=0,\cdots,p-1\}$ are linearly dependent. The rank of $C^{\prime}$ is less than or equal to $p-1$.

On the other hand, if a subset of $\{1-e_{i}|i=0,\cdots,p-1\}$ with $k\leq p-2$ elements is linearly dependent, we have

[TABLE]

So

[TABLE]

If $k$ is odd, then $\sum_{i=1}^{k}e_{n_{i}}=\mathfrak{1}$. But we already have $\sum_{0}^{p-1}e_{i}=\mathfrak{1}$. Since $\{e_{i}\}$ is a basis of $C$, there can’t be two different ways to write a vector in linear combinations of $e_{i}$’s. Contradiction.

If $k$ is even, then $\sum_{i=1}^{k}e_{n_{i}}=0$, contradictory to the $e_{i}$’s being linearly independent.

We conclude that $C^{\prime}$ has rank $p-1$. Since $C_{0}$ also has dimension $p-1$, $C^{\prime}=C_{0}$. ∎

Let $\alpha=(\sum_{i=0}^{p-1}x^{i},0)$, and $\beta=(0,\sum_{i=0}^{p-1}x^{i})$.

Proposition 3.10**.**

$C_{0}^{\perp}$* is generated by $C$ and $\alpha$(or by $C$ and $\beta$).*

Proof.

Since $C$ is self-dual, and $C_{0}\subset C$, so $C\subseteq C_{0}^{\perp}$. $\alpha$ is also in $C_{0}^{\perp}$ because

[TABLE]

So $\alpha\in C_{0}^{\perp}$. Since $\alpha$ has odd weight, $\alpha\notin C$. The code generated by $C$ and $\alpha$ has rank $p+1$, and so does $C_{0}^{\perp}$, and hence they are the same. ∎

From this proposition, we can see that $C$ is the even weight subcode of $C_{0}^{\perp}$.

Next, we will define an extended code for $C_{0}^{\perp}$ by adding two parity check columns.

Definition 3.11**.**

Let $\hat{C}$ be the extended code of $C_{0}^{\perp}$ by adding a parity check for the first $p$ bits and a parity check for the last $p$ bits, i.e. if

[TABLE]

then it extends to

[TABLE]

Notation**.**

If $c\in C$, denote $\hat{c}$ as the corresponding codeword in the extended code.

Clearly, $\{\widehat{e_{i}}|i=0,\cdots,p-1\}\cup\{\hat{\alpha}\}$(or $\{\widehat{e_{i}}|i=0,\cdots,p-1\}\cup\{\hat{\beta}\}$) constitutes a basis for $\hat{C}$.

If we use $\{\widehat{e_{i}}|i=0,\cdots,p-1\}\cup\{\hat{\alpha}\}$ as the basis, then the generating matrix for $\hat{C}$ can be written as

[TABLE]

The permutations that showed up in our results act on the left half and the right half of a codeword in the same way. For simplicity, in the following theorem and its proof, we relabel the positions in a codeword by their original positions modulo $p$, starting from [math]. By convention, we label the parity check positions by $\infty$. So starting from left, the positions in a codeword would be called position $0,\cdots,p-1,\infty,0,\cdots,p-1,\infty$.

Below is the main result on the automorphism group of $\hat{C}$.

Theorem 3.12**.**

The automorphism group of $\hat{C}$ contains $PSL_{2}(p)$ as a subgroup. Here $PSL_{2}(p)$ is generated by the three permutations

[TABLE]

where $\rho$ is a primitive element of $\mathbb{F}_{p}$.

When $p\equiv 3\pmod{8}$, we have shown that the code generated by $[G_{Q}|G_{N}]$ is the same as the code generated by $[I|G_{Q}]$. Therefore $\hat{C}$ also entails a generating matrix as following.

[TABLE]

This form has been extensively studied before, and is usually referred to as bordered double circulant codes. It has been shown that $PSL_{2}(p)$ acts on these codes using the generating matrices above in previous work, such as [5] and [16]. Our proof is an alternate to those when $p\equiv 3\pmod{8}$. When $p\equiv 7\pmod{8}$, these two codes are not equivalent, and therefore this is a new result.

The calculations presented in this proof are inspired by the proof of the theorem that the automorphism group of the extended quadratic residue code contains $PSL_{2}(p)$. One can check [11] for that. It uses the following theorem from number theory.

Theorem 3.13** (Perron).**

Let $p=4k+3$, and let $Q$ be the quadratic residues in $\mathbb{F}_{p}$, $N$ be the quadratic non-residues in $\mathbb{F}_{p}$. $a\neq 0\in\mathbb{F}_{p}$.

• •

If $a\in Q$, then $\{a+r|r\in Q\}$ contains $k$ quadratic residues and $k+1$ quadratic non-residues.

• •

If $a\in Q$, then $\{a+s|s\in N\}$ contains [math], $k$ quadratic residues and $k$ quadratic non-residues.

• •

If $a\in N$, then $\{a+r|r\in Q\}$ contains [math], $k$ quadratic residues and $k$ quadratic non-residues.

• •

If $a\in N$, then $\{a+s|s\in N\}$ contains $k+1$ quadratic residues and $k$ quadratic non-residues.

Proof.

(of Theorem 3.12)

Let $p=4k+3$.

$S$ sends position $i$ to $i+1(i=0,\cdots,p-1)$ and sends $\infty$ to $\infty$. Since $C$ is double-circulant, it’s fixed by $S$. $\hat{\alpha}$ is also fixed by $S$.

$V$ fixes $C$ since it fixes both $r_{Q}$ and $r_{N}$. The $\infty$ positions are sent to themselves. $V$ also fixes $\hat{\alpha}$.

Therefore, what’s left to show is that $T$ also fixes $\hat{C}$.

We will show that by proving the following:

• •

$\widehat{e_{0}}^{T}=\mathfrak{1}+\widehat{e_{0}}$

• •

If $i\in Q$, $\widehat{e_{i}}^{T}=\hat{\beta}+\widehat{e_{0}}+\widehat{e_{\text{-}\frac{1}{i}}}$

• •

If $i\in N$, $\widehat{e_{i}}^{T}=\hat{\alpha}+\widehat{e_{0}}+\widehat{e_{\text{-}\frac{1}{i}}}$

• •

$\widehat{e_{0}}^{T}=\mathfrak{1}+\widehat{e_{0}}$: If $y$ is a quadratic residue, then $-\frac{1}{y}$ is a quadratic non-residue, and vice versa. It follows immediately that the equality is true for all positions that are neither [math] or $\infty$. It’s easy to check the equality also follows through at [math] and $\infty$.

• •

If $i\in Q$, we will prove

[TABLE]

instead.

Focus on the left $p+1$ bits first, and consider

[TABLE]

According to Theorem 3.13, $\{i+r|r\in Q\}$ has $k+1$ quadratic non-residues, $k$ quadratic residues. Therefore $-\frac{1}{i+r}$ has $k+1$ quadratic residues, and $k$ quadratic non-residues.

$\{r-\frac{1}{i}|r\in Q\}$ contains [math], $k$ quadratic residues, and $k$ quadratic non-residues.

We want to know whether any terms in $T(\sum_{r\in Q}x^{i+r})$ would cancel with terms in $\sum_{r\in Q}x^{r-\frac{1}{i}}$. In this case, they need to have the same powers of $x$.

If $-\frac{1}{i+r}=r^{\prime}-\frac{1}{i}$, then

[TABLE]

1. (1)

If $-\frac{1}{i+r}$ is a quadratic residue, then (2) $\in N$. Therefore there does not exist $r^{\prime}\in Q$, s.t. $-\frac{1}{i+r}=r^{\prime}-\frac{1}{i}$. Since there are $2k+1$ terms in (2) with quadratic residue powers of $x$, all terms with quadratic residue powers will show up in the sum. 2. (2)

If $-\frac{1}{i+r}$ is a quadratic non-residue, then there exists $r^{\prime}\in Q$ satisfying $-\frac{1}{i+r}=r^{\prime}-\frac{1}{i}$. Since there are $k$ quadratic non-residues in both $\{i+r|r\in Q\}$ and $\{r-\frac{1}{i}|r\in Q\}$, they will cancel in pairs. None of the terms with quadratic non-residue powers of $x$ will show up in the sum.

Lastly, check the [math] and $\infty$ positions separately.

Since $T(\sum_{r\in Q}x^{i+r}|1)$ has $1$ at position [math], and so does $(\sum_{r\in Q}x^{r-\frac{1}{i}}|1)$, they will cancel in the sum.

$T(\sum_{r\in Q}x^{i+r}|1)$ has [math] at $\infty$, therefore the sum has $1$ at $\infty$.

We conclude that

[TABLE]

Now for the right $p+1$ bits, consider

[TABLE]

$\{s+i|s\in n\}$ contains [math], $k$ quadratic residues, $k$ quadratic non-residues. Therefore $\{-\frac{1}{s+i}\}$ contains $k$ residues and $k$ non-residues and $\infty$.

$\{s-\frac{1}{i}\}$ contains $k+1$ quadratic residues, $k$ quadratic non-residues.

If $-\frac{1}{i+s}=s^{\prime}-\frac{1}{i}$, then

[TABLE]

1. (1)

If $-\frac{1}{i+s}\in Q$, (4) $\in Q$, there does not exist $s^{\prime}\in N$ such that the two terms cancel. Since there are in total $2k+1$ terms in (3) with quadratic residue powers, all terms with quadratic residue powers will show up in the sum. 2. (2)

If $-\frac{1}{i+s}\in N$, there exists $s^{\prime}\in N$, such that $-\frac{1}{i+s}=s^{\prime}-\frac{1}{i}$. Since there are $k$ quadratic non-residues in both $\{i+s|s\in N\}$ and $\{s-\frac{1}{i}\}$, they will cancel in pairs. None of the terms with quadratic non-residue powers of $x$ will show up in the sum.

Just like before, we can check (3) has $1$ at position [math] and [math] at $\infty$.

We conclude that

[TABLE]

Combining these two parts, we have

[TABLE]

• •

The case of $i\in N$ can be proved in a similar fashion.

Lastly, $\hat{\alpha}^{T}=\hat{\alpha}$.

Since $T$ sends all basis elements into $\hat{C}$, $T$ fixes C. ∎

In the same way that the result on automorphism groups of extended quadratic residue codes reveals the relation between its minimum distance and that of its expurgated code, this result leads to the following theorem on the minimum distance of the QQR code.

Theorem 3.14**.**

Let $C$ be a QQR code. The minimum distance of the shadow of $C$ is at least that of $C$ less 1.

Proof.

If $d({C_{0}^{\perp}})$ is even, then since $C$ is the even weight subcode of $C_{0}^{\perp}$, we must have $d(C_{0}^{\perp})=d(C)$. Therefore $d(C_{0}^{\perp}\backslash C)>d(C)$.

Let $d({C_{0}^{\perp}})$ be odd. Let $c$ be a codeword in ${C_{0}^{\perp}}$ that achieves the minimum distance. WLOG, assume $c$ has an odd number of non-zero elements in the first $p$ bits; then $c$ has an even number of non-zero elements in the last $p$ bits. $\hat{c}$ is in the form

[TABLE]

We claim that we can find a position $y(0\leq y\leq p-1)$, such that the coordinate on position $y$ from the left $p+1$ bits is [math], and the coordinate on position $y$ from the right $p+1$ bits is also [math]. Otherwise, for each position $y$, at least one of the coordinates is $1$, and so $wt(c)\geq p$, which contradicts the fact that $c$ has minimum weight. So $c$ is in the following form:

[TABLE]

Since $PSL_{2}(p)$ acts transitively on $\hat{C}$, we can find an element in $PSL_{2}(p)$ that exchanges $y$ and $\infty$. Recall that $PSL_{2}(p)$ acts on the left half and the right half of a codeword in the same fashion. We would therefore obtain a new codeword in $\hat{C}$ in the following form:

[TABLE]

By losing the two parity checks, we obtain a new codeword in $C_{0}^{\perp}$ that has weight $d(C_{0}^{\perp})+1$. Note that this codeword also belongs to $C$, and therefore

[TABLE]

Equivalently,

[TABLE]

∎

Combining this with Lemma 3.7, we have provided a proof for Theorem 3.3.

3.3. Computation algorithms for QQR codes

Computation of the weight polynomials is always an important topic in coding theory. Researchers have come up with clever enumeration methods to reduce the computation load and speed up the process. However in general, little was known about the structure of the weight polynomials, and therefore good tests for computational results were missing.

Theorem 3.3 imposes a strong condition on the weight polynomials of QQR codes, and could serve as a test for existing and future computational results on the weight polynomials of QQR codes. On the other hand, we can also use this to derive an algorithm around this and dramatically reduce the amount of computation needed.

Since QQR codes are self-dual, by Gleason’s theorem, their weight polynomials can be written as linear combinations of $G(x,y)^{i}J(x,y)^{j}$, with $2i+8j=2p$.

Now for a QQR code $C$, let

[TABLE]

We should have

[TABLE]

We can use a recursive algorithm to recover the whole weight polynomial by knowing only a few $A_{i}$.

1. (1)

$A_{0}=1$ because of the 0 codeword. Comparing coefficients of $x^{2p}$ on both sides of (3), we have $a_{p}=1$. 2. (2)

We obtain a new equation by subtracting $a_{p}G(x,y)^{p}$ on both sides of (5)

[TABLE]

with the highest power of $x$ being $x^{2p-2}y^{2}$. 3. (3)

$A_{2}=0$ because $d>2$. Compare coefficients of $x^{2p-2}y^{2}$ on both sides of (6), and we have $a_{p-4}=-p$. 4. (4)

Repeat the steps until we have all the $a_{i}$’s.

Since $A_{C}$ is divisible by $(x^{2}+y^{2})^{d-1}$, we only need $a_{i}$ for $i\geq d-1$.

For the case of $p=59$, computing the whole weight enumerator using MAGMA using brutal force would take 190 years. Using this strategy, however, we need only a few $A_{i}$’s. Assume the minimum distance is at least 14, which is reasonable based on the result for $p=43$. This can also be confirmed computationally. Then the weight polynomial is divisible by $(x^{2}+y^{2})^{15}$. Therefore to get all the $a_{i}(i=15,\cdots,59)$, we only need $A_{j}$’s for $j=14,16,18,20,22$, which takes a few hours to compute. Note that this time is based on using existing commands in MAGMA, and could be even faster if combined with enumeration techniques.

The huge speed up is because not all coefficients are created equal. The ones we needed for our computation are those $A_{i}$’s with very small or very large $i$. These take much less time than those ones in the middle. We are avoiding, and computing using our algorithm, those coefficients in the middle that could take years to compute.

3.4. Zeta polynomials and Riemann hypothesis

In the last part of this section, we answer a question that was originally posted by Joyner in [8].

Let $d$ be the minimum distance of a code $C$ and $d^{\perp}$ the minimum distance of its dual code. Iwan Duursma introduced the zeta function $Z=Z_{C}$ associated to a linear code $C$ over a finite field $\mathbb{F}_{q}$ [4].

[TABLE]

where $P_{C}(T)$ is a polynomial of degree $n+2-d-d^{\bot}$. This is a polynomial with rational coefficients, called the zeta polynomial of the code $C$.

Given a self-dual code, it is always of interest whether its zeta polynomial satisfies the Riemann hypothesis. (In other words, its roots occur in self-reciprocal pairs). Joyner asked this question about the QQR codes for $p\equiv 3\pmod{4}$. Using SAGE to compute zeta polynomials, we found that it does not satisfy the Riemann hypothesis for $p=23$.

For $p=23$, it has 15 pairs of complex conjugate roots of absolute value $\frac{1}{\sqrt{2}}$, together with real roots 0.508887881 and 0.982534697. The last two roots cause the code to fail the Riemann hypothesis.

3.5. Quadratic residue codes

As mentioned earlier, when $p\equiv 7\pmod{8}$, QQR codes have a close relation with quadratic residue codes. In this section, we will first prove a similar divisibility property of quadratic residue codes using shadows of codes, and use their relation with QQR codes to give an alternative proof to Theorem 3.3.

We first introduce expurgated quadratic residue codes.

Definition 3.15** (Expurgated quadratic residue code).**

Let $Q$ and $N$ be the quadratic residue codes associated with $p$.

The even subcodes of $Q$ and $N$, which are denoted as $\bar{Q}$ and $\bar{N}$ respectively, are called expurgated quadratic residue codes.

We list some well-known properties of quadratic residue codes that will be used later. All can be found in [11].

Proposition 3.16** ([11]).**

Let $p\equiv\pm 1\pmod{8}$, then

1. (1)

$Q$* and $N$ both have dimension $\frac{1}{2}(p+1)$. $\bar{Q}$ and $\bar{N}$ have dimension $\frac{1}{2}(p-1)$.* 2. (2)

If $p\equiv 3\pmod{4}$, $Q^{\perp}=\bar{Q}$, $N^{\perp}=\bar{N}$. If $p\equiv 1\pmod{4}$, $Q^{\perp}=\bar{N}$, $N^{\perp}=\bar{Q}$. 3. (3)

$Q$* is generated by $\bar{Q}$ and the all one codeword, $N$ is generated by $\bar{N}$ and the all one codeword.* 4. (4)

$\bar{Q}$* and $\bar{N}$ are doubly-even.* 5. (5)

Let $d$ be the minimum distance. If $p\equiv-1\pmod{8}$, $d\equiv 3\pmod{4}$. If $p\equiv 1\pmod{8}$, then $d$ is odd.

Similar to Lemma 3.17, we can prove the following.

Lemma 3.17**.**

Let $C$ be a self-orthogonal binary code, and $l$ its maximum weight. Then the weight polynomial of its shadow is divisible by $(x+y)^{n-l}$.

Proof.

[TABLE]

So $A_{C}$ is divisible by $x^{n-l}$.

From Lemma 3.5, it’s immediate that $S_{C}$ is divisible by $(x+y)^{n-l}$. ∎

We can now prove a divisibility property on the weight polynomial of the quadratic residue code.

Theorem 3.18**.**

Let $p\equiv\pm 1\pmod{8}$ be prime, and $C$ the quadratic residue code associated with $p$, then $A_{C}$ is divisible by $(x+y)^{d}$, where $d$ is its minimum distance.

Proof.

We will only prove this for $p\equiv-1\pmod{8}$. The case for $p\equiv 1\pmod{8}$ is similar.

When $p\equiv-1\pmod{8}$, let $\bar{C}$ be the corresponding expurgated quadratic residue code. Then $\bar{C}^{\perp}=C$ and $C$ is generated by $\bar{C}$ and the all one codeword.

Since $p\equiv 1\pmod{8}$, $d\equiv 3\pmod{4}$. Let $c$ be a codeword that achieves the minimum distance, and let $c^{\prime}$ be the sum of $c$ and the all one codeword. Then $c^{\prime}$ has even weight $p-d$, and therefore is contained in $\bar{C}$. Since $C$ has odd length $p$, $\bar{C}$ does not contained the all one codeword, and therefore $c^{\prime}$ has the largest weight in $\bar{C}$.

By definition, $C$ is the shadow of $\bar{C}$. Therefore by Lemma 3.17, the weight polynomial of $\bar{C}$ is divisible by $(x+y)^{d}$. ∎

When $p\equiv 7\pmod{8}$, the QQR code $C$ is the even subcode of $Q\oplus N$. Therefore we have the following relation between their weight polynomials.

Proposition 3.19**.**

When $p\equiv 7\pmod{8}$, let $C$ be the QQR code associated with $p$, and $Q$ the corresponding quadratic residue code, then

[TABLE]

Proof.

The weight polynomial of the direct sum of two codes is the product of their respective weight polynomials, and the weight polynomial of the even weight subcode of a code is just the sum of terms in its weight polynomials with even powers of $y$.

This proposition is immediate after combining these two facts with Proposition 2.5. ∎

We now give an alternative proof to Theorem 3.3 in the case $p\equiv 7\pmod{8}$ using this relation.

Proof.

When $p\equiv 7\pmod{8}$, let $C$ be the QQR code associated with $p$, and let $Q$ and $\bar{Q}$ be the corresponding quadratic residue code and the expurgated quadratic residue code respectively.

Since $Q$ is generated by $\bar{Q}$ and the all one codeword,

[TABLE]

Note that the minimum distance of $Q$ is $d-1$, we have

[TABLE]

Change $y$ for $iy$ and $-iy$ respectively, where $i^{2}=-1$. We obtain

[TABLE]

Since $\bar{Q}$ is doubly-even, for each term in $A_{Q}$, powers of $y$ are all divisible by $4$ and powers of $x$ are $3\pmod{4}$.

Therefore

[TABLE]

Hence

[TABLE]

Lastly

[TABLE]

which is divisible by $(x^{2}+y^{2})^{d-1}$. ∎

3.6. Weight polynomials of quadratic residue codes in the literature

Previously, weight polynomials of quadratic residue codes have been computed up to $p=167$. We are referring to the online table Weight Distributions of Quadratic Residue and Quadratic Double Circulant Codes over GF(2)[17]. This table is also the source for the same entries on The On-Line Encyclopedia of Integer Sequences (OEIS)[14].

We tested these results against Theorem 3.18. The results are shown in Table 2.

The weight polynomials posted for $p=113,127,137,151,167$ are only divisible by $x+y$ and no further, and therefore errors existed in these results. We investigated each case and give the results as follows.

3.6.1. $p=137,151,167$

For $p=137,151,167$, we found that the numbers from the original references of the online table are different from the numbers posted in the online table.

In particular, for $p=137$, the numbers in the paper [15] are different from the online table.

For $p=151,167$, the numbers in [18] are different from the online table.

We tested Theorem 3.18 against the numbers in these references and confirmed they satisfy the divisibility conditions. See Table 3.

They also satisfy the following checks:

1. (1)

All the $A_{i}$’s are divisible by $p$, except for $A_{0}$ and $A_{p}$. (This should hold because quadratic residue codes are cyclic.) 2. (2)

$\sum_{0}^{p}A_{i}=2^{k}$. 3. (3)

$A(x,y)$ is divisible by $(x+y)^{d}$. 4. (4)

The corresponding weight polynomial for the extended quadratic residue codes satisfy the MacWilliams identity. (This should hold because extended quadratic residue codes are self-dual). In other words,

[TABLE]

should satisfy

[TABLE]

Since the divisibility condition and the four checks are highly non-trivial, we believe the original references are correct, and the numbers in the online tables are off possibly due to rounding using double-precision floating-point format[20].

3.6.2. Correction for $p=113$

We could not find a reference for these numbers, but were able to find the correct weight polynomial in this case.

In fact, all the numbers in the online table are correct except $A_{56}$ and $A_{57}$ should be changed from $10375431209297308$ to $10375431209297309$. The resulted weight polynomial satisfy Theorem 3.18 and the four checks we listed above.

3.6.3. Correction for $p=127$

We could not find a reference for $p=127$ either. Therefore we deduced the correct weight polynomial based on the criteria it needs to satisfy.

By Theorem 3.18, the weight polynomial $A_{Q}$ is divisible by $(x+y)^{19}$, therefore we have

[TABLE]

for some integers $c_{j}$’s. Our goal is to solve these $c_{j}$’s.

Expand Equation 7 and compare coefficients, we have

[TABLE]

Therefore if the number of correct $A_{j}$’s we know are greater than or equal to $108$, we can set up enough equations to solve all the $c_{i}$’s. Below are the $A_{j}$’s we use.

• •

Since $d=19$, we know $A_{0}=A_{108}=1$ and $A_{i}=0(i=1,\cdots,18,109,\cdots 126)$.

• •

$A_{i}=0$ when $i\equiv 1,2\pmod{4}$[11].

• •

We use $A_{19}$ to $A_{43}$ (and $A_{84}$ to $A_{108}$) from the posted result, hoping they were correct. Therefore we used 13 coefficients from the table.

Fortunately the 13 coefficients we use from the table seem correct. The weight polynomial we obtained using this approach passes the four checks we listed above. Therefore we are confident the answer is correct.

Below are the $A_{j}$’s that needed to be corrected. Since the weight polynomials for quadratic residue codes are symmetric, we only listed $A_{j}$’s for $j\leq 63$.

4. Weight Distribution and Hyperelliptic Curves

The weights of QQR codes are closely linked with numbers of points on corresponding hyperelliptic curves. This connection enables us to study the distribution of number of points on hyperelliptic curves using the weight distribution of QQR codes.

In this section, we will first show a result on the weight distribution of QQR codes, and then demonstrate how to use this result to prove a corresponding result on hyperelliptic curves.

Let $S\subseteq\mathbb{F}_{p}$, and let $c=(r_{Q}r_{S},r_{N}r_{S})$. According to Proposition 2.6, we have

• •

If $|S|$ is even, then

[TABLE]

• •

If $|S|$ is odd, then

[TABLE]

Remark 2**.**

The original statement posted in Joyner’s paper is slightly different, since his count includes points at infinity. For simplicity, we modified the statement to restrict only to affine points.

In order to link the weight distribution of the QQR codes and the point distributions of hyperelliptic curves, we also need the following results:

Proposition 4.1**.**

Let $S\subseteq\mathbb{F}_{p}$.

• •

If $|S|$ is even, then $|X_{S}(\mathbb{F}_{p})|\equiv 2\pmod{4}$.

• •

If $|S|$ is odd, then $|X_{S}(\mathbb{F}_{p})|\equiv 3\pmod{4}$.

We give a sketch of the proof as following:

Proof.

(sketch) Let $\chi=(\frac{}{p})$ be the quadratic residue character, which is 1 on the quadratic residues $Q\in\mathbb{F}_{p}$, -1 on the quadratic non-residues, and 0 on 0.

Then

[TABLE]

Since $p\equiv 3\pmod{4}$, we just need to show the following:

• •

If $|S|$ is even, $\sum_{a\in\mathbb{F}_{p}}\chi(f_{S}(a))\equiv 3\pmod{4}$.

• •

If $|S|$ is odd, $\sum_{a\in\mathbb{F}_{p}}\chi(f_{S}(a))\equiv 0\pmod{4}$.

These are proven by induction on $|S|$, as follows:

1. (1)

Consider the simplest case. If $S=\{r\}$, then

[TABLE] 2. (2)

If $|S|>1$, then take $s\in S$, and let $R=S\backslash\{s\}$. We can show that

[TABLE] 3. (3)

In particular, when $|S|=2$, by (8), we have

[TABLE] 4. (4)

Assume for $|S|<n$, the statements are true. We can show the following relation

[TABLE]

Combining with (8), we have

[TABLE]

If $|S|$ is odd, then $|R|$ is even. By assumption $\sum_{a\in\mathbb{F}_{p}}\chi(f_{R}(a))\equiv 3\pmod{4}$, and therefore

[TABLE]

Similarly, if $|S|$ is even, then $|R|$ is odd, and we have

[TABLE]

∎

In Proposition 4.1, we notice that when $|S|$ is even, a codeword $c$ is associated with a curve $y^{2}=f_{S}(x)$. When $|S|$ is odd, $c$ is associated with a curve $y^{2}=f_{S^{c}}(x)$ with $|S^{c}|$ even.

Therefore the curves that are linked with QQR codes are in the form

[TABLE]

where $|S|$ is even. We denote this set of curves as $\mathscr{C}_{p}$.

Let $B_{k}$ be the number of curves in $\mathscr{C}_{p}$ that have $k$ affine points over $\mathbb{F}_{p}$, and let $A_{k}$ be the number of codewords with weight $k$.

From Proposition 2.6, it’s clear that

[TABLE]

and from Proposition 4.1, we have the following relation between $A_{k}$ and $B_{k}$:

Proposition 4.2**.**

Let $A_{k}$ and $B_{k}$ be described as above, then

• •

If $k$ is odd, $A_{k}=0$.

• •

If $k\equiv 0\pmod{4}$, $A_{k}=B_{2p-k}$.

• •

If $k\equiv 2\pmod{4}$, $A_{k}=B_{k}$.

Therefore we have obtained an explicit relation between the weight distribution of a QQR code associated with $p$ and the point distribution of the hyperelliptic curves in the set $\mathscr{C}_{p}$.

The following diagram illustrates this interlacing pattern for $p=11$. $A_{k}$’s can be obtained from $B_{k}$’s by symmetrizing the distribution of $B_{k}$’s with respect to $k$.

{k}$${0}$${2}$${4}$${6}$${8}$${10}$${12}$${14}$${16}$${18}$${20}$${22}$${B_{k}}$${0}$${0}$${0}$${77}$${0}$${616}$${0}$${330}$${0}$${0}$${0}$${1}$${A_{k}}$${1}$${0}$${0}$${77}$${330}$${616}$${616}$${330}$${77}$${0}$${0}$${1}

Next we will show a result on the point weight distribution of QQR codes. But firstly we need to formally define the moments of QQR codes from the discrete values of $A_{k}$. These are standard definitions and can be found in [11].

Definition 4.3** (Moments).**

For a code $C$ of length $n$, let $a_{j}=A_{j}/2^{k}$, where $A_{j}$’s are the coefficients of its weight polynomial. The mean and variance of $C$ are defined by

[TABLE]

and the $r^{th}$ central moment is

[TABLE]

Definition 4.4** (Cumulative Distribution Function).**

The cumulative distribution function(c.d.f.) $A(z)$ of a code $C$ is given by

[TABLE]

The following is a classical theorem on the weight distribution of codes.

Theorem 4.5** (Sidel’nikov [11]).**

Let $C$ be a binary code, and $d^{\perp}\geq 3$ the minimum distance of its dual code $C^{\perp}$, then

[TABLE]

where $\Phi(z)$ is the c.d.f. for the normal distribution.

In other words, if $d^{\perp}$ tends to infinity for a series of codes, then its weight distribution is asymptotically normal.

In Proposition 2.5, we showed that when $p\equiv 7\pmod{8}$, the minimum distance of a QQR code is the minimum distance of its corresponding quadratic residue code plus 1. Since the minimum distances of quadratic residue codes have a well-known lower bound of $\sqrt{p}$, the minimum distance of QQR codes are bounded below by $\sqrt{p}+1$.

When $p\equiv 3\pmod{8}$, Helleseth and Voloch have proven the following bound for QQR codes.

Theorem 4.6**.**

[7]** The minimum distance $d$ of a QQR code when $p\equiv 3\pmod{8}$ is bounded by

[TABLE]

Combining these and Theorem 4.5, we have the following theorem.

Theorem 4.7**.**

The weight distribution of QQR codes are asymptotically normal.

Figure 1 shows the comparison of the c.d.f among normal distribution, the QQR code with $p=3$, and the QQR code with $p=59$. Both $p=3$ and $p=59$ are approximating the normal distribution. Their c.d.f’s are step functions by construction. $p=59$ oscillates more frequently and more closely to the normal distribution. We imagine that with $p$ bigger, the oscillation will become more frequent and closer to the normal distribution.

Since proposition 4.2 gives an explicit relation between the point distribution of hyperelliptic curves and weight distribution of QQR codes, we can get all the $A_{k}$’s by using $B_{k}$’s. Namely, set

[TABLE]

Therefore we have shown that, after symmetrizing the point distribution of hyperelliptic curves in $\mathscr{C}_{p}$, the result will converge to the normal distribution when $p\rightarrow\infty$.

A recent study by Larsen[10] showed that, more or less, for a random curve of random genus, over a random finite field $\mathbb{F}_{q}$, $T/\sqrt{q}$, is normally distributed, where $T$ is the number of points on the curve. More precisely,

• •

Fix $g$. As $q\rightarrow\infty$, $T/\sqrt{q}$ defines a measure $\mu_{g}$ on $[-2g,2g]$. e.g. for $g=1$, $\mu_{1}$ is the Sato-Tate measure.

• •

The limit of these measures $\mu_{g}$ when $g\rightarrow\infty$ is the measure given by the standard normal distribution.

Our result is a variant of Larsen’s. The main differences are:

• •

The set of curves in Larsen’s result consist of all hyperelliptic curves defined over $\mathbb{F}_{q}$ while ours is a subset of that given by the definition of $\mathscr{C}_{p}$.

• •

We showed that after being symmetrized, the distribution approaches the standard normal distribution, while Larsen’s result is on the point distribution itself.

• •

Larsen’s result uses theoretical results on hyperelliptic curves among others, while our result is simply a corollary from the study on QQR codes.

5. Conclusion

In this paper, we begin by reviewing some of the known properties of QQR codes, and proved that $PSL_{2}(p)$ acts on the extended QQR code when $p\equiv 3\pmod{4}$. Using this discovery, we then showed their weight polynomials satisfy a strong divisibility condition, namely that they are divisible by $(x^{2}+y^{2})^{d-1}$, where $d$ is the corresponding minimum distance. Using this result, we were able to construct an efficient algorithm to compute weight polynomials for QQR codes and correct errors in existing results on quadratic residue codes.

In the second half, we use the relation between the weight of codewords and the number of points on hyperelliptic curves to prove that the symmetrized distribution of a set of hyperelliptic curves is asymptotically normal.

6. Acknowledgment

The authors want to thank Prof. Iwan M Duursma for his keen observation on the relation between weight polynomials and shadows.