Reed-Solomon Codes over Fields of Characteristic Zero

TL;DR

This paper investigates Reed-Solomon codes over fields of characteristic zero, providing bounds on coefficient growth and decoding complexity, with potential generalizations to other number fields.

Contribution

It extends Reed-Solomon code analysis to characteristic zero fields, deriving bounds on encoding growth and decoding complexity, inspired by recent work on Gabidulin codes.

Findings

Bounds on coefficient growth during encoding

Polynomial bit complexity of decoding

Generalization to arbitrary number fields

Abstract

We study Reed--Solomon codes over arbitrary fields, inspired by several recent papers dealing with Gabidulin codes over fields of characteristic zero. Over the field of rational numbers, we derive bounds on the coefficient growth during encoding and the bit complexity of decoding, which is polynomial in the code length and in the bit width of error and codeword values. The results can be generalized to arbitrary number fields.

Tables

Table 1. TABLE I: Upper bounds for the bit widths of generator and parity check matrix for several choices for v i subscript 𝑣 𝑖 v_{i} and v i ′ superscript subscript 𝑣 𝑖 ′ v_{i}^{\prime} .

	$\lambda \left({𝑮}_{\mathrm{GRS}}\right)$	$\lambda \left({𝑮}_{\mathrm{Cauchy}}\right)$	$\lambda \left({𝑯}_{\mathrm{GRS}}\right)$
general	$\left(k-1\right)\lambda \left(𝜶\right)+\lambda \left({𝒗}^{\prime }\right)$	$2\left(2k-1\right)\lambda \left(𝜶\right)+2\lambda \left({𝒗}^{\prime }\right)+2k-1$	$\left(n-k-1\right)\lambda \left(𝜶\right)+\lambda \left(𝒗\right)$
$v_i^{\prime }=1$, $v_i=w_i$	$\left(k-1\right)\lambda \left(𝜶\right)$	$2\left(k-1\right)\left(2\lambda \left(𝜶\right)+1\right)$	$\left(3n-k-3\right)\lambda \left(𝜶\right)+n-1$
$c_i{d}_j=1$	$\left(k-1\right)\left(3\lambda \left(𝜶\right)+1\right)$	$2\lambda \left(𝜶\right)+1$	$\left(3\left(n-k\right)-1\right)\lambda \left(𝜶\right)+n-k$
$v_i=1$, $v_i^{\prime }=w_i$	$\left(2n+k-3\right)\lambda \left(𝜶\right)+n-1$	$\left(2n-2k+1\right)\left(2\lambda \left(𝜶\right)+1\right)$	$\left(n-k-1\right)\lambda \left(𝜶\right)$

Table 2. TABLE II: Upper bounds for the bit widths of codeword 𝒄 𝒄 \textstyle c and syndrome 𝒔 𝒔 \textstyle s for several choices for v i subscript 𝑣 𝑖 v_{i} and v i ′ superscript subscript 𝑣 𝑖 ′ v_{i}^{\prime} .

general	$\lambda \left(𝒄\right)\le k\left(\lambda \left(𝒖\right)+\lambda \left(𝑮\right)+1\right)$		$\lambda \left(𝒔\right)\le \tau \left(\lambda \left(𝒆\right)+\lambda \left({𝑯}_{\mathrm{GRS}}\right)+1\right)$
	$𝑮={𝑮}_{\mathrm{GRS}}$	$𝑮={𝑮}_{\mathrm{Cauchy}}$
$c_i{d}_j=1$	$k\left(\lambda \left(𝒖\right)+3\left(k-1\right)\lambda \left(𝜶\right)+k\right)$	$k\left(\lambda \left(𝒖\right)+2\lambda \left(𝜶\right)+2\right)$	$\tau \left(\lambda \left(𝒆\right)+\left(3n-3k-1\right)\lambda \left(𝜶\right)+n-k+1\right)$
$v_i=1$, $v_i^{\prime }=w_i$	$k\left(\lambda \left(𝒖\right)+\left(2n+k-3\right)\lambda \left(𝜶\right)+n\right)$	$k\left(\lambda \left(𝒖\right)+\left(2n-2k+1\right)\left(2\lambda \left(𝜶\right)+1\right)+1\right)$	$\tau \left(\lambda \left(𝒆\right)+\left(n-k-1\right)\lambda \left(𝜶\right)+1\right)$

Equations

$${\mathchoice{\mbox{\boldmath$\displaystyle H$}}{\mbox{\boldmath$\textstyle H$}}{\mbox{\boldmath$\scriptstyle H$}}{\mbox{\boldmath$\scriptscriptstyle H$}}}_{\mathrm{GRS}}=\begin{pmatrix}1&1&\dots&1\\ \alpha_{1}&\alpha_{2}&\dots&\alpha_{n}\\ \vdots&\vdots&\dots&\vdots\\ \alpha_{1}^{n-k-1}&\alpha_{2}^{n-k-1}&\dots&\alpha_{n}^{n-k-1}\end{pmatrix}\begin{pmatrix}v_{1}&&&\\ &v_{2}&&\\ &&\ddots&\\ &&&v_{n}\end{pmatrix}.$$

$${\mathchoice{\mbox{\boldmath$\displaystyle G$}}{\mbox{\boldmath$\textstyle G$}}{\mbox{\boldmath$\scriptstyle G$}}{\mbox{\boldmath$\scriptscriptstyle G$}}}_{\mathrm{GRS}}=\begin{pmatrix}1&1&\dots&1\\ \alpha_{1}&\alpha_{2}&\dots&\alpha_{n}\\ \vdots&\vdots&\dots&\vdots\\ \alpha_{1}^{k-1}&\alpha_{2}^{k-1}&\dots&\alpha_{n}^{k-1}\end{pmatrix}\begin{pmatrix}v_{1}^{\prime}&&&\\ &v_{2}^{\prime}&&\\ &&\ddots&\\ &&&v_{n}^{\prime}\end{pmatrix}\,,$$

$$\sum _{i=1}^n{\alpha }_i^r{v}_i{v}_i^{\prime }=0\forall r=0,\dots ,n-2.$$

$$v_i{v}_i^{\prime }={\prod }_{\begin{array}{c}1\le j\le n\\ i\ne j\end{array}}({\alpha }_i-{\alpha }_j{)}^{-1}=:w_i.$$

$$v_i=\frac{w_i}{v_i^{\prime }}\text{and}{v}_i^{\prime }=\frac{w_i}{v_i}$$

$$\lambda (a):=\{\begin{array}{ll}\lfloor {\log }_2(|a|)\rfloor +1,& \text{if }a\ne 0\\ 0,& \text{if }a=0\end{array}$$

$$\lambda (a):=\max \{\lambda (b),\lambda (c)\}.$$

$$\lambda (a(x)):=\max \{\lambda (a_0),\dots ,\lambda (a_n),\lambda (b)\}.$$

$$\lambda({\mathchoice{\mbox{\boldmath$\displaystyle A$}}{\mbox{\boldmath$\textstyle A$}}{\mbox{\boldmath$\scriptstyle A$}}{\mbox{\boldmath$\scriptscriptstyle A$}}})=\max\{\lambda(a_{ij})\,:\,i=1,\ldots,k\text{ and }j=1,\ldots,n\}.$$

$$\lambda (a(x)+b(x))$$

$$=$$

$$\le$$

$$+1,\lambda (a_{m+1}),\dots ,\lambda (a_n)\}\}$$

$$\le$$

$$=$$

$$\max \{\lambda (b_0,\dots ,\lambda (b_n))\}\}+1$$

$$=$$

$$\lambda (a(x)\cdot b(x))=\underset{k\in \{0,\dots ,n+m\}}{\max }\{\lambda (\sum _{\begin{array}{c}(i,j):i+j=k\\ 0\le i\le n\\ 0\le j\le m\end{array}}{a}_i{b}_j)\}$$

$$\le$$

$$=$$

$$\cdot (\min \{n,m\}+1)|)\rfloor +1$$

$$\le$$

$$+\lfloor {\log }_2(|\max \{b_0,\dots ,b_{m)}\}|)\rfloor +1$$

$$+\lfloor {\log }_2(|(\min \{n,m\}+1)|)\rfloor +1$$

$$=$$

$$+\lambda (\min \{n,m\}+1)$$

$$=$$

$$\lambda (cd)=\lambda \left(\frac{c_1\cdot d_1}{c_2\cdot d_2}\right)\le \max \{\lambda (c_1\cdot d_1),\lambda (c_2\cdot d_2)\}$$

$$=$$

$$\le$$

$$\lfloor {\log }_2(|c_2|)\rfloor +1+\lfloor {\log }_2(|d_2|)\rfloor +1\}$$

$$\le$$

$$\lambda (c+d)=\lambda \left(\frac{c_1{d}_2+d_1{c}_2}{c_2{d}_2}\right)$$

$$=$$

$$\le$$

$$=$$

$$\le$$

$$\lambda({\mathchoice{\mbox{\boldmath$\displaystyle a$}}{\mbox{\boldmath$\textstyle a$}}{\mbox{\boldmath$\scriptstyle a$}}{\mbox{\boldmath$\scriptscriptstyle a$}}}{\mathchoice{\mbox{\boldmath$\displaystyle b$}}{\mbox{\boldmath$\textstyle b$}}{\mbox{\boldmath$\scriptstyle b$}}{\mbox{\boldmath$\scriptscriptstyle b$}}}^{\top})\leq n\cdot(\lambda({\mathchoice{\mbox{\boldmath$\displaystyle a$}}{\mbox{\boldmath$\textstyle a$}}{\mbox{\boldmath$\scriptstyle a$}}{\mbox{\boldmath$\scriptscriptstyle a$}}})+\lambda({\mathchoice{\mbox{\boldmath$\displaystyle b$}}{\mbox{\boldmath$\textstyle b$}}{\mbox{\boldmath$\scriptstyle b$}}{\mbox{\boldmath$\scriptscriptstyle b$}}})+1).$$

$$\displaystyle\lambda({\mathchoice{\mbox{\boldmath$\displaystyle a$}}{\mbox{\boldmath$\textstyle a$}}{\mbox{\boldmath$\scriptstyle a$}}{\mbox{\boldmath$\scriptscriptstyle a$}}}{\mathchoice{\mbox{\boldmath$\displaystyle b$}}{\mbox{\boldmath$\textstyle b$}}{\mbox{\boldmath$\scriptstyle b$}}{\mbox{\boldmath$\scriptscriptstyle b$}}}^{\top})$$

$$\le {\sum }_{i=1}^n\left(\lambda (a_i)+\lambda (b_i)\right)+n-1,$$

$$\lambda({\mathchoice{\mbox{\boldmath$\displaystyle A$}}{\mbox{\boldmath$\textstyle A$}}{\mbox{\boldmath$\scriptstyle A$}}{\mbox{\boldmath$\scriptscriptstyle A$}}}{\mathchoice{\mbox{\boldmath$\displaystyle B$}}{\mbox{\boldmath$\textstyle B$}}{\mbox{\boldmath$\scriptstyle B$}}{\mbox{\boldmath$\scriptscriptstyle B$}}})\leq r(\lambda({\mathchoice{\mbox{\boldmath$\displaystyle A$}}{\mbox{\boldmath$\textstyle A$}}{\mbox{\boldmath$\scriptstyle A$}}{\mbox{\boldmath$\scriptscriptstyle A$}}})+\lambda({\mathchoice{\mbox{\boldmath$\displaystyle B$}}{\mbox{\boldmath$\textstyle B$}}{\mbox{\boldmath$\scriptstyle B$}}{\mbox{\boldmath$\scriptscriptstyle B$}}})+1).$$

$$\displaystyle\lambda({\mathchoice{\mbox{\boldmath$\displaystyle c$}}{\mbox{\boldmath$\textstyle c$}}{\mbox{\boldmath$\scriptstyle c$}}{\mbox{\boldmath$\scriptscriptstyle c$}}})\leq k(\lambda({\mathchoice{\mbox{\boldmath$\displaystyle u$}}{\mbox{\boldmath$\textstyle u$}}{\mbox{\boldmath$\scriptstyle u$}}{\mbox{\boldmath$\scriptscriptstyle u$}}})+\lambda({\mathchoice{\mbox{\boldmath$\displaystyle G$}}{\mbox{\boldmath$\textstyle G$}}{\mbox{\boldmath$\scriptstyle G$}}{\mbox{\boldmath$\scriptscriptstyle G$}}})+1).$$

Full text

I Introduction

Reed–Solomon (RS) codes were introduced in 1960 [2] and have become some of the most used classes of algebraic codes. The codes are defined over finite fields and can be efficiently decoded, both up to half-the-minimum distance [3, 4] and beyond [5, 6, 7, 8, 9]. RS codes over the field of complex numbers, also called complex RS codes or analog codes, were introduced in [10] and [11], and their decoding was studied in [12]. Further decoding principles known from finite fields, as well as applications of the codes to compressed sensing, were analyzed and numerically evaluated in [13, 14, 15, 16].

In this paper, we study RS codes over arbitrary fields and their properties. The idea is inspired by several recent publications that have dealt with Gabidulin codes, the rank-metric analog of RS codes, over field of characteristic zero (in particular number fields), which were first described in [17, Section 6], [18, 19, 20, 21]. These codes have applications in space-time coding [22] and low-rank matrix recovery [23]. Among other possible applications, we believe that RS codes over number fields (in particular over $\mathbb{Q}$ and $\mathbb{Q}[\mathrm{i}]$) are suitable to replace complex RS codes in some applications, e.g., the compressed sensing scenario studied in [14, 15], since there are no numerical issues. Studying these applications goes beyond the scope of this paper and needs to be done in future work.

For decoding, we adapt a syndrome-based half-the-minimum-distance decoder known from finite fields and restrict to the field of rational numbers, which is an infinite field and an exact computation domain. In contrast to complex RS codes, we face the problem of coefficient growth (i.e., large numerators and denominators, also known as intermediate expression swell) during computations instead of numerical issues caused by floating point operations. This substantially influences the bit complexity of decoding algorithms compared to finite fields, where field elements can be represented with a fixed number of bits and field operations cost a constant number of bit operations (for a given field size). On the other hand, there are no numerical problems, in contrast to complex RS codes.

We derive bounds on the coefficient growth during encoding and decoding. This implies an upper bound on the bit complexity of decoding, which is polynomial in the code length and bit width of the error values.

The results can be extended to more classes of number fields, for instance $\mathbb{Q}[\mathrm{i}]$, or cyclotomic and Kummer extensions. The adaption is technical, which is why we restrict ourselves to $\mathbb{Q}$ here. Furthermore, it is reasonable to expect that our results can be used to analyze the runtimes of the existing decoders for Gabidulin codes over number fields [18, 19, 20] in bit operations, instead of field operations (which do not consider coefficient growth).

II Reed–Solomon Codes over Arbitrary Fields

The following is a straight-forward generalization of generalized Reed–Solomon (GRS) codes to arbitrary, possibly infinite, fields. We define the codes as in [4] by simply replacing the finite field by an arbitrary field $K$.

Definition 1**.**

Let $k$ and $n$ be integers such that $k<n$. Furthermore, choose $\alpha_{1},\dots,\alpha_{n}\in K$ to be distinct non-zero elements of the field $K$, and $v_{1},\dots,v_{n}$ to be non-zero elements from $K$. The corresponding generalized Reed–Solomon (GRS) code is defined by the linear code $\mathcal{C}_{\mathrm{GRS}}\subseteq K^{n}$ with parity check matrix

[TABLE]

The proof that RS codes are MDS is straightforward using the same arguments as in the finite field case (see, e.g., [4]).

Theorem 1**.**

Any GRS code is MDS, i.e., $d=n-k+1$.

Theorem 2**.**

The code $\mathcal{C}_{\mathrm{GRS}}$ as defined in Definition 1 has a generator matrix of the form

[TABLE]

where the $\alpha_{i}$ are the same as in Definition 1 and the $v_{i}^{\prime}$ are non-zero elements of $K$, given by the following linear system of equations:

[TABLE]

Proof:

The proof is analog to [4, Proposition 5.2]. ∎

Theorem 3**.**

Fix $\alpha_{1},\dots,\alpha_{n}\in K\setminus\{0\}$ distinct. Let $v_{i},v_{i}^{\prime}$ be non-zero such that

[TABLE]

Then, the corresponding matrices {\mathchoice{\mbox{\boldmath\displaystyle G}}{\mbox{\boldmath\textstyle G}}{\mbox{\boldmath\scriptstyle G}}{\mbox{\boldmath\scriptscriptstyle G}}}_{\mathrm{GRS}} and {\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathrm{GRS}} are generator and parity check matrix of the same code, respectively.

Proof:

If we solve the system in (1) for $v_{i}v_{i}^{\prime}$, then the solution is given by a non-zero element in the kernel of a Vandermonde matrix $V_{n,n-1}$ with $n-1$ rows. Such a vector is given by $w_{i}$ as above, since $(w_{1},\dots,w_{n})^{\top}$ is the last column of the inverse Vandermonde matrix $V_{n,n}$ (cf. [24, eq. (9),(10): Set $k=\mu=n$, note that $\sigma_{0,n-1}^{i}=1$.]). ∎

Remark 1**.**

Theorem 3 implies a method to compute the $v_{i}$ from the $v_{i}^{\prime}$ or vice-versa, i.e.,

[TABLE]

III Coefficient Growth over the Rational Numbers

In the following, we study the coefficient growth during computations over the rational numbers. The results can in principle be extended to a wider class of number fields by generalizing the following well-known notion of bit width.

Definition 2** (Generalization of [25, p. 142]).**

Let $a$ be an element of one of the sets in $\{\mathbb{Z},\mathbb{Q},\mathbb{Q}[x],\mathbb{Q}^{k\times n}\}$. We define its bit width $\lambda(a)$ as follows:

• •

$a\in\mathbb{Z}$:

[TABLE]

• •

$a=\frac{b}{c}\in\mathbb{Q}$* with $b,c\in\mathbb{Z}$, $c\neq 0$, and $\gcd(b,c)=1$:*

[TABLE]

• •

$a(x)=\sum_{i=0}^{n}\frac{a_{i}}{b}\cdot x^{i}\in\mathbb{Q}[x]$* with $a_{i}\in\mathbb{Z}$ and $b\in\mathbb{N}\setminus\{0\}$ such that $\gcd(a_{0},\ldots,a_{n},b)=1$:*

[TABLE]

• •

{\mathchoice{\mbox{\boldmath\displaystyle A}}{\mbox{\boldmath\textstyle A}}{\mbox{\boldmath\scriptstyle A}}{\mbox{\boldmath\scriptscriptstyle A}}}=(a_{ij})\in\mathbb{Q}^{k\times n}:

[TABLE]

Remark 2**.**

Note that the bit width does not necessarily cover the required memory space, e.g. for a rational number only the maximum of the bit widths of numerator and denominator is regarded, which means, that for equal bit widths of numerator and denominator the actual memory space is twice the bit width.

Theorem 4** (Coefficient Growth [25, p. 142]).**

Let $a,b$ be polynomials in $\mathbb{Z}[x]$ with coefficients $a_{i}$, $b_{j}$ for $i\in\{0,\ldots,n\coloneqq\deg(a(x))\}$ and $j\in\{0,\ldots,m\coloneqq\deg(b(x))\}$ and $c,d\in\mathbb{Q}$, then the following statements hold:

$\lambda(a(x)+b(x))\leq\max\{\lambda(a(x)),\lambda(b(x))\}+1$** 2. 2.

$\lambda(a(x)\cdot b(x))\leq\lambda(a(x))+\lambda(b(x))+\lambda(\min\{n,m\}+1)$** 3. 3.

$\lambda(cd)\leq\lambda(c)+\lambda(d)$** 4. 4.

$\lambda(\frac{c}{d})\leq\lambda(c)+\lambda(d)$** 5. 5.

$\lambda(c+d)\leq\lambda(c)+\lambda(d)+1$**

Proof:

1) For polynomials $a,b$ of degree [math], it’s trivial. For polynomials $a,b$ of arbitrary degree (w.l.o.g. we assume $n\geq m$) with coefficients $a_{i}$, $b_{j}$ for $i\in\{0,\ldots,n\}$ and $j\in\{0,\ldots,m\}$ it holds that

[TABLE]

2)

[TABLE]

3)We write $c=\frac{c_{1}}{c_{2}}$ and $d=\frac{d_{1}}{d_{2}}$ with $c_{1},c_{2},d_{1},d_{2}\in\mathbb{Z}$ with $\gcd(c_{1},c_{2})=\gcd(d_{1},d_{2})=1$. It holds:

[TABLE]

4) Let $c^{\prime}=c^{-1}$, then the claim follows by 3).

5)

[TABLE]

Theorem 4 implies the following statements about coefficient growth in a vector or matrix multiplication.

Theorem 5** (Multiplication of vector and vector).**

Let {\mathchoice{\mbox{\boldmath\displaystyle a}}{\mbox{\boldmath\textstyle a}}{\mbox{\boldmath\scriptstyle a}}{\mbox{\boldmath\scriptscriptstyle a}}},{\mathchoice{\mbox{\boldmath\displaystyle b}}{\mbox{\boldmath\textstyle b}}{\mbox{\boldmath\scriptstyle b}}{\mbox{\boldmath\scriptscriptstyle b}}}\in\mathbb{Q}^{n}. Then,

[TABLE]

Proof:

Using Theorem 4, we obtain

[TABLE]

which implies the claim. ∎

Theorem 6** (Multiplication of vector and matrix).**

Let {\mathchoice{\mbox{\boldmath\displaystyle A}}{\mbox{\boldmath\textstyle A}}{\mbox{\boldmath\scriptstyle A}}{\mbox{\boldmath\scriptscriptstyle A}}}\in\mathbb{Q}^{n\times r} and {\mathchoice{\mbox{\boldmath\displaystyle B}}{\mbox{\boldmath\textstyle B}}{\mbox{\boldmath\scriptstyle B}}{\mbox{\boldmath\scriptscriptstyle B}}}\in\mathbb{Q}^{r\times m}. Then,

[TABLE]

Proof:

The statement directly follows from Theorem 5 since any entry of the product \textstyle A$$\textstyle B is the result of the multiplication of a row of $\textstyle A$ with a column of $\textstyle B$, which are both vectors of length $r$. ∎

IV Coefficient Growth in Encoding RS Codes over the Rational Numbers

In this section we study the coefficient growth during encoding with a generator matrix $\textstyle G$, i.e., we derive a bound on the bit width of the codeword {\mathchoice{\mbox{\boldmath\displaystyle c}}{\mbox{\boldmath\textstyle c}}{\mbox{\boldmath\scriptstyle c}}{\mbox{\boldmath\scriptscriptstyle c}}}\in\mathbb{Q}^{n} obtained from an information word {\mathchoice{\mbox{\boldmath\displaystyle u}}{\mbox{\boldmath\textstyle u}}{\mbox{\boldmath\scriptstyle u}}{\mbox{\boldmath\scriptscriptstyle u}}}\in\mathbb{Q}^{k} with a given bit width. We also show how to reduce the coefficient growth compared to the standard generator matrix given in Theorem 2.

Theorem 7**.**

Let $\textstyle c$ be an RS codeword generated by encoding {\mathchoice{\mbox{\boldmath\displaystyle u}}{\mbox{\boldmath\textstyle u}}{\mbox{\boldmath\scriptstyle u}}{\mbox{\boldmath\scriptscriptstyle u}}}\in\mathbb{Q}^{k} with generator matrix {\mathchoice{\mbox{\boldmath\displaystyle G}}{\mbox{\boldmath\textstyle G}}{\mbox{\boldmath\scriptstyle G}}{\mbox{\boldmath\scriptscriptstyle G}}}\in\mathbb{Q}^{k\times n}. Then

[TABLE]

Proof:

The claim follows directly from Theorem 6. ∎

Hence, the maximal coefficient growth depends heavily on the choice of the generator matrix. We can bound \lambda({\mathchoice{\mbox{\boldmath\displaystyle G}}{\mbox{\boldmath\textstyle G}}{\mbox{\boldmath\scriptstyle G}}{\mbox{\boldmath\scriptscriptstyle G}}}) as follows.

Corollary 1**.**

Let $\textstyle G$ be a generator matrix as in Theorem 2 using {\mathchoice{\mbox{\boldmath\displaystyle\alpha}}{\mbox{\boldmath\textstyle\alpha}}{\mbox{\boldmath\scriptstyle\alpha}}{\mbox{\boldmath\scriptscriptstyle\alpha}}}=(\alpha_{1},\dots,\alpha_{n}) and {\mathchoice{\mbox{\boldmath\displaystyle v}}{\mbox{\boldmath\textstyle v}}{\mbox{\boldmath\scriptstyle v}}{\mbox{\boldmath\scriptscriptstyle v}}}^{\prime}=(v_{1}^{\prime},\dots,v_{n}^{\prime}). Then

[TABLE]

Proof:

We have

[TABLE]

which implies the claim. ∎

Remark 3**.**

For $v_{i}^{\prime}=1,\,i=1,\dots,n$ the addition of \lambda({\mathchoice{\mbox{\boldmath\displaystyle v}}{\mbox{\boldmath\textstyle v}}{\mbox{\boldmath\scriptstyle v}}{\mbox{\boldmath\scriptscriptstyle v}}}^{\prime})=1 can be omitted, since then $\alpha_{i}^{j}v_{i}^{\prime}=\alpha_{i}^{j}\,\forall i$. In this case, (2) is fulfilled with equality.

Example 1**.**

If we choose {\mathchoice{\mbox{\boldmath\displaystyle\alpha}}{\mbox{\boldmath\textstyle\alpha}}{\mbox{\boldmath\scriptstyle\alpha}}{\mbox{\boldmath\scriptscriptstyle\alpha}}}=(1,\dots,n), {\mathchoice{\mbox{\boldmath\displaystyle v}}{\mbox{\boldmath\textstyle v}}{\mbox{\boldmath\scriptstyle v}}{\mbox{\boldmath\scriptscriptstyle v}}}^{\prime}=(1,\dots,1) then \lambda({\mathchoice{\mbox{\boldmath\displaystyle G}}{\mbox{\boldmath\textstyle G}}{\mbox{\boldmath\scriptstyle G}}{\mbox{\boldmath\scriptscriptstyle G}}})=(k-1)\lambda(n), whereas the allocated memory is

[TABLE]

This example shows, that the bit width does not cover the necessary memory space.

According to [26, Theorem 1] the generator matrix of a GRS code can be brought to systematic form, where the identity matrix is followed by a Cauchy matrix, which is defined as follows.

Theorem 8** (Cauchy Generator Matrices [26, Theorem 1]).**

Let $\mathcal{C}_{\mathrm{GRS}}$ as defined in Definition 1. The code has a systematic generator matrix of the form {\mathchoice{\mbox{\boldmath\displaystyle G}}{\mbox{\boldmath\textstyle G}}{\mbox{\boldmath\scriptstyle G}}{\mbox{\boldmath\scriptscriptstyle G}}}=({\mathchoice{\mbox{\boldmath\displaystyle I}}{\mbox{\boldmath\textstyle I}}{\mbox{\boldmath\scriptstyle I}}{\mbox{\boldmath\scriptscriptstyle I}}}_{k\times k}\mid{\mathchoice{\mbox{\boldmath\displaystyle A}}{\mbox{\boldmath\textstyle A}}{\mbox{\boldmath\scriptstyle A}}{\mbox{\boldmath\scriptscriptstyle A}}}), where {\mathchoice{\mbox{\boldmath\displaystyle I}}{\mbox{\boldmath\textstyle I}}{\mbox{\boldmath\scriptstyle I}}{\mbox{\boldmath\scriptscriptstyle I}}}_{k\times k} is an identity matrix of size $k\times k$ and {\mathchoice{\mbox{\boldmath\displaystyle A}}{\mbox{\boldmath\textstyle A}}{\mbox{\boldmath\scriptstyle A}}{\mbox{\boldmath\scriptscriptstyle A}}}=\left(\frac{c_{i}d_{j}}{a_{i}-b_{j}}\right) is a Cauchy matrix with

[TABLE]

Using a generator matrix in systematic form, we obtain a generator matrix with a lower \lambda({\mathchoice{\mbox{\boldmath\displaystyle G}}{\mbox{\boldmath\textstyle G}}{\mbox{\boldmath\scriptstyle G}}{\mbox{\boldmath\scriptscriptstyle G}}}) than a generator matrix in Vandermonde form.

Corollary 2**.**

Let {\mathchoice{\mbox{\boldmath\displaystyle G}}{\mbox{\boldmath\textstyle G}}{\mbox{\boldmath\scriptstyle G}}{\mbox{\boldmath\scriptscriptstyle G}}}=({\mathchoice{\mbox{\boldmath\displaystyle I}}{\mbox{\boldmath\textstyle I}}{\mbox{\boldmath\scriptstyle I}}{\mbox{\boldmath\scriptscriptstyle I}}}_{k\times k}\mid{\mathchoice{\mbox{\boldmath\displaystyle A}}{\mbox{\boldmath\textstyle A}}{\mbox{\boldmath\scriptstyle A}}{\mbox{\boldmath\scriptscriptstyle A}}}) be a generator matrix of $\mathcal{C}_{\mathrm{GRS}}$ as defined in Theorem 8, where the $v_{i}^{\prime}$ are chosen such that $c_{i}d_{j}=1$ are zero, we get

[TABLE]

Proof:

The claim directly follows from the fact that in this case {\mathchoice{\mbox{\boldmath\displaystyle A}}{\mbox{\boldmath\textstyle A}}{\mbox{\boldmath\scriptstyle A}}{\mbox{\boldmath\scriptscriptstyle A}}}=(\tfrac{1}{\alpha_{i}-\alpha_{j+k}}) and Theorem 4. ∎

We obtain the $v_{i}^{\prime}$ for Corollary 2 as follows.

Remark 4**.**

If $v_{i}$ in {\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathrm{GRS}} have the following form

[TABLE]

and $v_{i}^{\prime}=\frac{w_{i}}{v_{i}}$ from Theorem 3. Then the Cauchy matrix inside the corresponding generator matrix {\mathchoice{\mbox{\boldmath\displaystyle G}}{\mbox{\boldmath\textstyle G}}{\mbox{\boldmath\scriptstyle G}}{\mbox{\boldmath\scriptscriptstyle G}}}_{\mathrm{GRS}} has the form

[TABLE]

i.e. $c_{i}$, $d_{j}$ from equations (5) and (6) fulfill $c_{i}d_{j}=1$.

For arbitrary $v_{i}^{\prime}$, we get a worse bound on \lambda({\mathchoice{\mbox{\boldmath\displaystyle G}}{\mbox{\boldmath\textstyle G}}{\mbox{\boldmath\scriptstyle G}}{\mbox{\boldmath\scriptscriptstyle G}}}) if the Vandermonde matrix is in systematic form.

Corollary 3**.**

If {\mathchoice{\mbox{\boldmath\displaystyle G}}{\mbox{\boldmath\textstyle G}}{\mbox{\boldmath\scriptstyle G}}{\mbox{\boldmath\scriptscriptstyle G}}}=({\mathchoice{\mbox{\boldmath\displaystyle I}}{\mbox{\boldmath\textstyle I}}{\mbox{\boldmath\scriptstyle I}}{\mbox{\boldmath\scriptscriptstyle I}}}_{k\times k}\mid{\mathchoice{\mbox{\boldmath\displaystyle A}}{\mbox{\boldmath\textstyle A}}{\mbox{\boldmath\scriptstyle A}}{\mbox{\boldmath\scriptscriptstyle A}}}) be a generator matrix of $\mathcal{C}_{\mathrm{GRS}}$ as defined in Theorem 8, where {\mathchoice{\mbox{\boldmath\displaystyle A}}{\mbox{\boldmath\textstyle A}}{\mbox{\boldmath\scriptstyle A}}{\mbox{\boldmath\scriptscriptstyle A}}}=\left(\frac{c_{i}d_{j}}{a_{i}-b_{j}}\right)\in\mathbb{Q}^{k\times(n-k)},i=1,\dots,k,j=1,\dots,n-k, then

[TABLE]

Proof:

The claim directly follows when inserting equations (3) - (6) into the definition of the bit width for matrices (see Def. 2) and the fact that $\lambda(1)=1$, whereas the argument of $\lambda$ in the statement never gets zero. Then we have

[TABLE]

By the previous statements we can regard several cases of choices for $v_{i}$ and $v_{i}^{\prime}$. The resulting upper bounds on the bit widths of the generator and parity-check matrices are summarized in Table I. More details about the formulas in the table can be found in the appendix.

All derived bounds depend on the bit width of the code locators $\alpha_{i}$. The following theorem shows how to choose such distinct $\alpha_{i}$ with minimal \lambda({\mathchoice{\mbox{\boldmath\displaystyle\alpha}}{\mbox{\boldmath\textstyle\alpha}}{\mbox{\boldmath\scriptstyle\alpha}}{\mbox{\boldmath\scriptscriptstyle\alpha}}}).

Theorem 9**.**

If $\alpha_{1},\dots,\alpha_{n}\in\mathbb{Q}\backslash\{0\}$ distinct, then $\ell=\max\limits_{i}\{\mathrm{den}(\alpha_{i}),\operatorname{num}(\alpha_{i})$, where $\operatorname{num}(\alpha_{i})$ is the numerator of $\alpha_{i}$ and $\ell$ fulfills $n\leq 4\sum_{i=1}^{\ell}\phi(i)-2$.

Remark 5**.**

Using $\alpha_{i}=i,\,i=1,\dots,n$ as evaluation points for an RS code as defined in Def. 1 leads to \lambda({\mathchoice{\mbox{\boldmath\displaystyle c}}{\mbox{\boldmath\textstyle c}}{\mbox{\boldmath\scriptstyle c}}{\mbox{\boldmath\scriptscriptstyle c}}})\in O(\log n), whereas $\alpha_{i},\,i=0,\dots,n-1$ as chosen by Theorem 9 for evaluation points will have \lambda({\mathchoice{\mbox{\boldmath\displaystyle c}}{\mbox{\boldmath\textstyle c}}{\mbox{\boldmath\scriptstyle c}}{\mbox{\boldmath\scriptscriptstyle c}}})\in O(\log\sqrt{n}). So asymptotically this only differs in a constant $\frac{1}{2}$.

Remark 6**.**

Since \lambda({\mathchoice{\mbox{\boldmath\displaystyle\alpha}}{\mbox{\boldmath\textstyle\alpha}}{\mbox{\boldmath\scriptstyle\alpha}}{\mbox{\boldmath\scriptscriptstyle\alpha}}})\in O(\log n), all the entries in Table I asymptotically belong to $O(n\log n)$, except for $c_{i}d_{j}=1$ for the Cauchy generator matrix, i.e. the case of Corollary 2, which is $O(\log n)$. So this is asymptotically the best choice.

In Figure 1 the different choices of $\textstyle\alpha$ for Vandermonde and Cauchy generator matrices are compared.

V Coefficient Growth in Decoding RS Codes over the Rational Numbers

There are many decoding algorithms for GRS codes, both for decoding up to half-the-minimum distance [27, 28, 3, 29] and beyond [5, 6, 7, 8, 9].

In the following, we formulate the bounded-minimum-distance (BMD) decoder described in [4, Chapter 6], which is based on [27, 28, 3, 30], over $\mathbb{Q}$ instead of a finite field (which is straightforward) and analyze its complexity (which is the involved part). For obtaining a good complexity, we use the variant based on the extended Euclidean algorithm (EEA), which was first suggested by [3]. For the core step of the algorithm, the EEA, we rely on an algorithm from [25], which is designed for small intermediate coefficient growth.

V-A Decoding Algorithm

The decoding algorithm in [4, Chapter 6], which is described for finite fields there, returns the codeword $\textstyle c$ given only a received word {\mathchoice{\mbox{\boldmath\displaystyle r}}{\mbox{\boldmath\textstyle r}}{\mbox{\boldmath\scriptstyle r}}{\mbox{\boldmath\scriptscriptstyle r}}}={\mathchoice{\mbox{\boldmath\displaystyle c}}{\mbox{\boldmath\textstyle c}}{\mbox{\boldmath\scriptstyle c}}{\mbox{\boldmath\scriptscriptstyle c}}}+{\mathchoice{\mbox{\boldmath\displaystyle e}}{\mbox{\boldmath\textstyle e}}{\mbox{\boldmath\scriptstyle e}}{\mbox{\boldmath\scriptscriptstyle e}}}. The algorithm finds the error positions $\mathcal{E}:=\{i\,:\,e_{i}\neq 0\}$ by solving a key equation and then computes the error values $e_{i}$ by Forney’s formula. All proofs showing the correctness of the algorithm do not make use of the finiteness of the field. Hence, the algorithm carries over directly and we only briefly recall its idea.

The key equation consists of the following polynomials.

• •

Error locator polynomial

[TABLE]

• •

Error evaluator polynomial

[TABLE]

• •

Syndrome polynomial

[TABLE]

Note that [s_{0},\dots,s_{d-2}]={\mathchoice{\mbox{\boldmath\displaystyle r}}{\mbox{\boldmath\textstyle r}}{\mbox{\boldmath\scriptstyle r}}{\mbox{\boldmath\scriptscriptstyle r}}}{\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathrm{GRS}}^{\top} is the syndrome with respect to the parity-check matrix {\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathrm{GRS}} of Definition 1.

The BMD decoder then finds the error locator and error evaluator polynomial by solving the following key equation.

Lemma 1**.**

(Key Equation, generalization of [4, Equations (6.4)–(6.6)] to $\mathbb{Q}$) Let $S(x),\Lambda(x),\Omega(x)$ be defined as above. Then,

[TABLE]

Proof:

The proof follows by exactly the same arguments as the statements in [4, Section 6.3], by replacing the finite field by $\mathbb{Q}$. ∎

The following lemma shows how to obtain the solution $\Lambda(x),\Omega(x)$ of the key equation through the extended Euclidean algorithm $\mathrm{EEA}(a,b)$ over $\mathbb{Q}[x]$, which computes for two input polynomials $a,b\in\mathbb{Q}[x]$ with $\deg a\geq\deg b$ a sequence $(r_{i},s_{i},t_{i})$ for $i=-1,0,1,2,\dots$ such that we have

[TABLE]

and $\deg r_{i}$ is strictly monotonically decreasing until $r_{i}=0$. For some integer $t_{\mathrm{stop}}\leq\deg b$, we denote by $\mathrm{EEA}(a,b,t_{\mathrm{stop}})$ the variant of the EEA that returns only the unique triple $(r_{h},s_{h},t_{h})$ for which we have

[TABLE]

Lemma 2**.**

Let \mathrm{wt}_{\mathrm{H}}({\mathchoice{\mbox{\boldmath\displaystyle e}}{\mbox{\boldmath\textstyle e}}{\mbox{\boldmath\scriptstyle e}}{\mbox{\boldmath\scriptscriptstyle e}}})\leq\lfloor\tfrac{d-1}{2}\rfloor and $S(x)$ be the corresponding syndrome polynomial. Furthermore, let $(r_{h},s_{h},t_{h})\in\mathbb{Q}[x]^{3}$ be the output of the $\mathrm{EEA}(a,b,t_{\mathrm{stop}})$ with input

[TABLE]

where $\xi\in\mathbb{Q}$ is the smallest positive integer, s.t. $b$ has integer coefficients (i.e.  it is the lcm of the denominators of coefficients of S). Then, we have

[TABLE]

where $c\in\mathbb{Q}$ is a non-zero constant.

Proof:

The proof follows from the same arguments that lead to [4, Corollary 6.5] since no step assumes the finiteness of the underlying field. The only difference besides the different field is the non-zero constant $\xi$ here, which we will use for complexity reasons below, and which simply multiplies each $r_{i}$, $i\geq 0$, in the EEA by $\xi$. 111Note that this was stated wrongly in the short version [1]. ∎

The constant $c$ in Lemma 2 can be determined as the $0^{\mathrm{th}}$ coefficient of $t_{h}$ since $\Lambda_{0}=1$ by definition.

Lemma 3** (Forney’s formula).**

Let $\Lambda^{\prime}(x)=\sum_{i>0}i\Lambda_{i}x^{i-1}$ be the formal derivative of $\Lambda(x)$. Then, we can compute the entries $e_{i}$ of the error vector $\textstyle e$ by

[TABLE]

for all $i=1,\dots,n$.

Proof:

The proof follows by the same arguments as in [4, Section 6.5]. ∎

Note that we get $e_{i}=0$ for $i\notin\mathcal{E}$, so there is no need to find $\mathcal{E}$ separately. However, this can be done to reduce the runtime of the algorithm.

V-B Complexity Estimation

For bounding the complexity of the algorithm, we need the following lemmas.

Lemma 4**.**

Let {\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathrm{GRS}} as defined in Def. 1, {\mathchoice{\mbox{\boldmath\displaystyle s}}{\mbox{\boldmath\textstyle s}}{\mbox{\boldmath\scriptstyle s}}{\mbox{\boldmath\scriptscriptstyle s}}}=({\mathchoice{\mbox{\boldmath\displaystyle c}}{\mbox{\boldmath\textstyle c}}{\mbox{\boldmath\scriptstyle c}}{\mbox{\boldmath\scriptscriptstyle c}}}+{\mathchoice{\mbox{\boldmath\displaystyle e}}{\mbox{\boldmath\textstyle e}}{\mbox{\boldmath\scriptstyle e}}{\mbox{\boldmath\scriptscriptstyle e}}}){\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathrm{GRS}}^{\top}, \tau=\mathrm{wt}_{\mathrm{H}}({\mathchoice{\mbox{\boldmath\displaystyle e}}{\mbox{\boldmath\textstyle e}}{\mbox{\boldmath\scriptstyle e}}{\mbox{\boldmath\scriptscriptstyle e}}}) and {\mathchoice{\mbox{\boldmath\displaystyle\alpha}}{\mbox{\boldmath\textstyle\alpha}}{\mbox{\boldmath\scriptstyle\alpha}}{\mbox{\boldmath\scriptscriptstyle\alpha}}},{\mathchoice{\mbox{\boldmath\displaystyle v}}{\mbox{\boldmath\textstyle v}}{\mbox{\boldmath\scriptstyle v}}{\mbox{\boldmath\scriptscriptstyle v}}} as defined in Corollary 1.

[TABLE]

Proof:

Let $\mathcal{E}=\{i_{1},\dots,i_{\tau}\}$ be error positions and {\mathchoice{\mbox{\boldmath\displaystyle e}}{\mbox{\boldmath\textstyle e}}{\mbox{\boldmath\scriptstyle e}}{\mbox{\boldmath\scriptscriptstyle e}}}_{\mathcal{E}}=[e_{i_{1}},\dots,e_{i_{\tau}}] as well as {\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathcal{E}}=[H_{i_{1}},\dots,H_{i_{\tau}}], where $H_{i_{j}}$ is the $i_{j}$-th column of {\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathrm{GRS}}. Then, we have \lambda({\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathcal{E}})\leq\lambda({\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathrm{GRS}}), {\mathchoice{\mbox{\boldmath\displaystyle r}}{\mbox{\boldmath\textstyle r}}{\mbox{\boldmath\scriptstyle r}}{\mbox{\boldmath\scriptscriptstyle r}}}{\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathrm{GRS}}={\mathchoice{\mbox{\boldmath\displaystyle e}}{\mbox{\boldmath\textstyle e}}{\mbox{\boldmath\scriptstyle e}}{\mbox{\boldmath\scriptscriptstyle e}}}{\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathrm{GRS}}={\mathchoice{\mbox{\boldmath\displaystyle e}}{\mbox{\boldmath\textstyle e}}{\mbox{\boldmath\scriptstyle e}}{\mbox{\boldmath\scriptscriptstyle e}}}_{\mathcal{E}}{\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathcal{E}}, and

[TABLE]

Using the better coefficient growth bounds for computations over $\mathbb{Z}$ (cf. Theorem 4), we obtain the following smaller bound in this case.

Lemma 5**.**

Let {\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathrm{GRS}} from Def. 1 and {\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathrm{GRS}}\in\mathbb{Z}^{(n-k)\times n} (i.e., $\alpha_{i},v_{i}\in\mathbb{Z}$), then

[TABLE]

Proof:

[TABLE]

where $\xi=\mathrm{lcm}(\mathrm{den}(e_{i_{1}}),\dots,\mathrm{den}(e_{i_{\tau}}))$. Thus, \xi{\mathchoice{\mbox{\boldmath\displaystyle e}}{\mbox{\boldmath\textstyle e}}{\mbox{\boldmath\scriptstyle e}}{\mbox{\boldmath\scriptscriptstyle e}}}\in\mathbb{Z}^{n} and

[TABLE]

Using \lambda(\xi)\leq\tau\lambda({\mathchoice{\mbox{\boldmath\displaystyle e}}{\mbox{\boldmath\textstyle e}}{\mbox{\boldmath\scriptstyle e}}{\mbox{\boldmath\scriptscriptstyle e}}}), we obtain

[TABLE]

Lemma 6**.**

Let $a,b\in\mathbb{Z}[x]$ with $d_{a}=\deg a\geq d_{b}=\deg b\geq 1$ and $\lambda(a),\lambda(b)\leq t$. Then, $\mathrm{EEA}(a,b)$ can be computed in

[TABLE]

bit operations using [25, Algorithm 6.57, page 188]. Furthermore, $\mathrm{EEA}(a,b,t_{\mathrm{stop}})$ can be computed in

[TABLE]

bit operations.

Proof:

The statement follows directly from [25, Theorem 6.58], which is formulated in terms of the $\infty$-norm of the polynomials $a$ and $b$, i.e., $||a||_{\infty},||b||_{\infty}\leq A$ for some integer $A$. This condition is equivalent to $\lambda(a),\lambda(b)\leq\log_{2}(A)$. The complexity of the EEA with stopping condition follows from the fact that we save a factor $d_{b}$ if only one specific triple $(r_{h},s_{h},t_{h})$ in the output sequence of the EEA is explicitly computed, cf. [25, page 189]. ∎

In the following, denote by $\mathrm{den}(\alpha)$ and $\mathrm{num}(\alpha)$ the (reduced) denominator and numerator of $\alpha\in\mathbb{Q}$, respectively.

Lemma 7**.**

Let $S(x)$ be the syndrome polynomial and $\xi=\mathrm{lcm}(\mathrm{den}(s_{0}),\dots,\mathrm{den}(s_{d-2}))$.

[TABLE]

Proof:

The first claim, $\xi S(x)\in\mathbb{Z}[x]$ is obviously fulfilled (in fact, $\xi$ is the smallest positive integer with this property). For the bit width, we have

[TABLE]

which implies the claim. ∎

Lemma 8**.**

For $|\mathcal{E}|=\tau$ and $\Lambda(x)=\prod_{i\in\mathcal{E}}(1-\alpha_{i}x)=\sum_{j=0}^{t}\Lambda_{j}x^{j}$ it holds that

[TABLE]

Proof:

Let $\zeta:=\prod_{i\in\mathcal{E}}\mathrm{den}(\alpha_{i})$. Then,

[TABLE]

where $a_{i}(x)\in\mathbb{Z}[x]$, $\deg a_{i}(x)=1$, and $\lambda(a_{i}(x))\leq\lambda(\alpha_{i})$. By applying Property 2 of Theorem 4 inductively, we get

[TABLE]

Due to $\zeta\in\mathbb{N}$ and \lambda(\zeta)\leq\sum_{i\in\mathcal{E}}\lambda(\alpha_{i})\leq\tau\lambda({\mathchoice{\mbox{\boldmath\displaystyle\alpha}}{\mbox{\boldmath\textstyle\alpha}}{\mbox{\boldmath\scriptstyle\alpha}}{\mbox{\boldmath\scriptscriptstyle\alpha}}}), the claim follows by $\lambda(\Lambda(x))\leq\max\{\lambda(\prod_{i\in\mathcal{E}}a_{i}(x)),\lambda(\zeta)\}$. ∎

Lemma 9**.**

For $\Omega(x)=\sum_{j\in\mathcal{E}}e_{i}v_{i}\prod_{j\in\mathcal{E}\setminus\{i\}}(1-\alpha_{j}x)$ and $|\mathcal{E}|=\tau$ it holds that

[TABLE]

Proof:

Let $\zeta:=\prod_{i\in\mathcal{E}}\mathrm{den}(\alpha_{i})$, \eta:=\prod_{i\in\mathcal{E}}\big{(}\mathrm{den}(e_{i}v_{i})\big{)} and $a_{i}(x)\coloneqq\mathrm{den}(\alpha_{i})-\mathrm{num}(\alpha_{i})x$ then

[TABLE]

Since $\zeta\eta\cdot\Omega(x)\in\mathbb{Z}[x]$ it holds that

[TABLE]

Also for the bit width of $\zeta\eta$ we have that

[TABLE]

And therefore the claim holds. ∎

Lemma 10**.**

Let $a(x)\in\mathbb{Q}[x]$ and $\alpha_{i}\in\mathbb{Q}$. Then, the evaluation of $a(x)$ at $\alpha_{i}$ can be implemented in

[TABLE]

bit operations222$O^{\sim}$ neglects logarithmic terms of its arguments.

Proof:

Applying Horner’s rule [25, p. 101] for evaluation, one gets $\deg a(x)$ multiplications and $\deg a(x)$ additions. By naive computation of the additions and the multiplications as in [31], the complexity for integers of bit width $t_{1}$ and $t_{2}$ (define: $n_{0}=\max\{t_{1},t_{2}\}$) is $O(n_{0})$, respectively $O(n_{0}\log n_{0}\log\log n_{0})$ (cf. Algorithms 2.1 in [25]). Hence,

[TABLE]

where $n=\max\{\lambda(\alpha_{i}),\lambda(a(x))\}$. ∎

Corollary 4**.**

For the computation of the $i^{\mathrm{th}}$ error value $e_{i}$, $\Lambda^{\prime}$ and $\Omega$ are evaluated at $\alpha_{i}^{-1}$ , thus $e_{i}$, can be computed in

[TABLE]

bit operations.

V-C Summary of the Algorithm

[TABLE]

Theorem 10**.**

Algorithm 1 returns the correct codeword if \mathrm{wt}_{\mathrm{H}}({\mathchoice{\mbox{\boldmath\displaystyle e}}{\mbox{\boldmath\textstyle e}}{\mbox{\boldmath\scriptstyle e}}{\mbox{\boldmath\scriptscriptstyle e}}})\leq\tfrac{n-k}{2}. Its complexity in bit operations is

[TABLE]

Proof:

Correctness follows directly by Lemmas 2 and 3 above and the computational complexity of $\textstyle s$ in Line 1. Since the latter is a usual vector-matrix-multiplication and the computation itself depends on the codeword $\textstyle c$, its complexity is bounded by

[TABLE]

The remaining part of the algorithm is independent of the codeword $\textstyle c$. The second bottleneck of the algorithm is the EEA, which can be implemented by [25, Algorithm 6.57, page 188]. The input polynomials, $a(x)=\xi\cdot x^{d-1}$ and $b(x)=\xi\cdot S(x)$ have bit width

[TABLE]

by Lemmas 7 and 4, and degrees $d_{a}=d-1$ and $d_{b}\leq d-2$. By Lemma 6, we can therefore bound the cost of Line 1 by

[TABLE]

The remaining steps of Algorithm 1 are negligible compared to this step due to Corollary 4. ∎

Remark 7**.**

The syndrome computation complexity depends on \lambda({\mathchoice{\mbox{\boldmath\displaystyle c}}{\mbox{\boldmath\textstyle c}}{\mbox{\boldmath\scriptstyle c}}{\mbox{\boldmath\scriptscriptstyle c}}}), which itself depends on the bit width of the information $\textstyle u$. We can bound \lambda({\mathchoice{\mbox{\boldmath\displaystyle c}}{\mbox{\boldmath\textstyle c}}{\mbox{\boldmath\scriptstyle c}}{\mbox{\boldmath\scriptscriptstyle c}}}) depending on \lambda({\mathchoice{\mbox{\boldmath\displaystyle u}}{\mbox{\boldmath\textstyle u}}{\mbox{\boldmath\scriptstyle u}}{\mbox{\boldmath\scriptscriptstyle u}}}) by Theorem 7.

For a special choice of $\textstyle\alpha$, the following corollary holds. We state it in terms of $n$ as we often have $d\in\Theta(n)$.

Corollary 5**.**

If the error $\textstyle e$ has bit width at most $t$, codeword $\textstyle c$ at most $t^{\prime}$ and the code locators are chosen with \lambda({\mathchoice{\mbox{\boldmath\displaystyle\alpha}}{\mbox{\boldmath\textstyle\alpha}}{\mbox{\boldmath\scriptstyle\alpha}}{\mbox{\boldmath\scriptscriptstyle\alpha}}})\in O(\log(n)) (e.g., $\alpha_{i}=i$ for $i=1,\dots,n$), then Algorithm 1 can be implemented in

[TABLE]

bit operations. In case of {\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathrm{GRS}}\in\mathbb{Z}^{(n-k)\times n} we get

[TABLE]

VI Trade-Off between Encoding and Decoding

Corollary 5 states that the complexity might be reduced by choosing the entries of {\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathrm{GRS}} in $\mathbb{Z}$. The next corollary also compares this reduction.

Corollary 6**.**

Regard the setting of Lemma 4.

• •

For the case of $v_{i}=1\,\forall i=1,\dots,n$, we have

[TABLE]

• •

For the case $c_{i}d_{j}=1$, we have

[TABLE]

• •

For the case of {\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathrm{GRS}}\in\mathbb{Z}^{(n-k)\times n} and $v_{i}=1\,\forall i=1,\dots,n$, we have

[TABLE]

• •

For the case {\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathrm{GRS}}\in\mathbb{Z}^{(n-k)\times n} and $c_{i}d_{j}=1$, we have

[TABLE]

Proof:

Insert the results from Table I into \lambda({\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathrm{GRS}}). ∎

In this case, however, we must have $v_{i}\in\mathbb{Z}$, which might yield large values of \lambda({\mathchoice{\mbox{\boldmath\displaystyle G}}{\mbox{\boldmath\textstyle G}}{\mbox{\boldmath\scriptstyle G}}{\mbox{\boldmath\scriptscriptstyle G}}}) according to Theorem 3. Note that there might be alternative generator and parity check matrix combinations with smaller overall coefficient growth. This again can increase the coefficient growth during encoding. Hence, one can find a tradeoff between decoding complexity and coefficient growth during encoding by choosing $v_{i}$.

Table II shows a part of the tradeoff by comparing the upper bounds for the bit width of syndrome and codeword, that are derived in Theorem 7 and Lemma 4 in the sections before. Since \lambda({\mathchoice{\mbox{\boldmath\displaystyle\alpha}}{\mbox{\boldmath\textstyle\alpha}}{\mbox{\boldmath\scriptstyle\alpha}}{\mbox{\boldmath\scriptscriptstyle\alpha}}})\in O(\log n), we get \lambda({\mathchoice{\mbox{\boldmath\displaystyle c}}{\mbox{\boldmath\textstyle c}}{\mbox{\boldmath\scriptstyle c}}{\mbox{\boldmath\scriptscriptstyle c}}})\in O(n^{2}\log n) for all cases except for the Cauchy generator matrix {\mathchoice{\mbox{\boldmath\displaystyle G}}{\mbox{\boldmath\textstyle G}}{\mbox{\boldmath\scriptstyle G}}{\mbox{\boldmath\scriptscriptstyle G}}}_{\mathrm{Cauchy}} in combination with $c_{i}d_{j}=1$, where we have \lambda({\mathchoice{\mbox{\boldmath\displaystyle c}}{\mbox{\boldmath\textstyle c}}{\mbox{\boldmath\scriptstyle c}}{\mbox{\boldmath\scriptscriptstyle c}}})\in O(n\log n). Hence, this choice is asymptotically the best, since the syndrome has \lambda({\mathchoice{\mbox{\boldmath\displaystyle s}}{\mbox{\boldmath\textstyle s}}{\mbox{\boldmath\scriptstyle s}}{\mbox{\boldmath\scriptscriptstyle s}}})\in O(n^{2}\log n) anyway.

VII Conclusion

In this paper we studied RS codes over arbitrary fields and analyzed the coefficient growth for encoding and decoding over the rational numbers. By deriving bounds on the intermediate coefficient growth during computations, we were able to show that decoding up to half-the-minimum distance is possible in a polynomial number of bit operations in the code length and bit width of the error values.

As also mentioned by the reviewers, we believe, that this paper is a starting point for research on RS codes over number fields and there are many open problems that need to be studied in future work. For instance, we can consider other decoding algorithms such as Berlekamp-Welch, Berlekamp-Massey or list decoding approaches. Further, the results can be extended to a wider class of number fields. Also reduction of the computation modulo a prime by decomposing the number field into prime ideals as in [21] is a possibility for further research. Another important aspect is to study possible applications in detail. Moreover, the methods can be used to determine the bit complexity of the algorithms in [19, 20] for decoding Gabidulin codes over characteristic zero.

VIII Appendix

Proofs for formulas in Table I. Case: $c_{i}d_{j}=1$, then

\lambda({\mathchoice{\mbox{\boldmath\displaystyle G}}{\mbox{\boldmath\textstyle G}}{\mbox{\boldmath\scriptstyle G}}{\mbox{\boldmath\scriptscriptstyle G}}}_{\mathrm{GRS}})\leq(k-1)(3\lambda({\mathchoice{\mbox{\boldmath\displaystyle\alpha}}{\mbox{\boldmath\textstyle\alpha}}{\mbox{\boldmath\scriptstyle\alpha}}{\mbox{\boldmath\scriptscriptstyle\alpha}}})+1)

Proof:

[TABLE]

∎

Case: $v_{i}=1,v_{i}^{\prime}=w_{i}$, then

\lambda({\mathchoice{\mbox{\boldmath\displaystyle G}}{\mbox{\boldmath\textstyle G}}{\mbox{\boldmath\scriptstyle G}}{\mbox{\boldmath\scriptscriptstyle G}}}_{\mathrm{GRS}})\leq(2n+k-3)\lambda({\mathchoice{\mbox{\boldmath\displaystyle\alpha}}{\mbox{\boldmath\textstyle\alpha}}{\mbox{\boldmath\scriptstyle\alpha}}{\mbox{\boldmath\scriptscriptstyle\alpha}}})+n-1

Proof:

[TABLE]

∎

Case: $v_{i}=1,v_{i}^{\prime}=w_{i}$, then

\lambda({\mathchoice{\mbox{\boldmath\displaystyle G}}{\mbox{\boldmath\textstyle G}}{\mbox{\boldmath\scriptstyle G}}{\mbox{\boldmath\scriptscriptstyle G}}}_{\mathrm{Cauchy}})\leq(2n-2k+1)(2\lambda({\mathchoice{\mbox{\boldmath\displaystyle\alpha}}{\mbox{\boldmath\textstyle\alpha}}{\mbox{\boldmath\scriptstyle\alpha}}{\mbox{\boldmath\scriptscriptstyle\alpha}}})+1)

Proof:

Inserting the condition into $\textstyle A$ gives

[TABLE]

[TABLE]

∎

Case: $v_{i}^{\prime}=1,v_{i}=w_{i}$, then

\lambda({\mathchoice{\mbox{\boldmath\displaystyle G}}{\mbox{\boldmath\textstyle G}}{\mbox{\boldmath\scriptstyle G}}{\mbox{\boldmath\scriptscriptstyle G}}}_{\mathrm{Cauchy}})\leq 2(k-1)(2\lambda({\mathchoice{\mbox{\boldmath\displaystyle\alpha}}{\mbox{\boldmath\textstyle\alpha}}{\mbox{\boldmath\scriptstyle\alpha}}{\mbox{\boldmath\scriptscriptstyle\alpha}}})+1)

Proof:

[TABLE]

∎

Case: $v_{i}^{\prime}=1$, $v_{i}=w_{i}$, then

\lambda({\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathrm{GRS}})\leq(3n-k-3)\lambda({\mathchoice{\mbox{\boldmath\displaystyle\alpha}}{\mbox{\boldmath\textstyle\alpha}}{\mbox{\boldmath\scriptstyle\alpha}}{\mbox{\boldmath\scriptscriptstyle\alpha}}})+n-1

Proof:

[TABLE]

∎

Case $c_{i}d_{j}=1$, then

\lambda({\mathchoice{\mbox{\boldmath\displaystyle H}}{\mbox{\boldmath\textstyle H}}{\mbox{\boldmath\scriptstyle H}}{\mbox{\boldmath\scriptscriptstyle H}}}_{\mathrm{GRS}})\leq(3n-3k-1)\lambda({\mathchoice{\mbox{\boldmath\displaystyle\alpha}}{\mbox{\boldmath\textstyle\alpha}}{\mbox{\boldmath\scriptstyle\alpha}}{\mbox{\boldmath\scriptscriptstyle\alpha}}})+n-k

Proof:

Representation of $v_{i}$, see Remark 4.

[TABLE]

∎