Weighted Lifted Codes: Local Correctabilities and Application to Robust Private Information Retrieval

TL;DR

This paper introduces weighted lifted Reed-Muller codes that enhance local decoding and privacy in PIR protocols, overcoming limitations of traditional codes by improving code dimension and collusion resistance.

Contribution

It proposes weighted Reed-Muller codes and their lifting process, achieving better asymptotic parameters and practical PIR protocol robustness against collusions.

Findings

Weighted codes enable PIR protocols with optimal complexity.

Weighted lifting improves code dimension and asymptotic performance.

Codes resist collusions of a small number of servers.

Abstract

Low degree Reed-Muller codes are known to satisfy local decoding properties which find applications in private information retrieval (PIR) protocols, for instance. However, their practical instantiation encounters a first barrier due to their poor information rate in the low degree regime. This lead the community to design codes with similar local properties but larger dimension, namely the lifted Reed-Solomon codes. However, a second practical barrier appears when one requires that the PIR protocol resists collusions of servers. In this paper, we propose a solution to this problem by considering \emph{weighted} Reed-Muller codes. We prove that such codes allow us to build PIR protocols with optimal computation complexity and resisting to a small number of colluding servers. In order to improve the dimension of the codes, we then introduce an analogue of the lifting process for weigthed degrees. With a careful analysis of their degree sets, we notably show that the weighted lifting of Reed-Solomon codes produces families of codes with remarkable asymptotic parameters.

Equations

$$P(X_1,\dots ,X_m)=\sum _{\mathbf{i}=(i_1,\dots ,i_m)\in I}{p}_{\mathbf{i}}{X}^{i_1}\dots X^{i_m}\in {\mathbb{F}}_q[X_1,\dots ,X_m],$$

$${\mathrm{wdeg}}_{\omega }(P):=\max \left\{\sum _{j=1}^m{\omega }_j{i}_j\mid \mathbf{i}=(i_1,\dots ,i_m)\in I\text{ and }{p}_{\mathbf{i}}\ne 0\right\}.$$

$$\begin{array}[]{rclc}\operatorname{ev}_{\mathbb{F}_{q}^{m}}:&\mathbb{F}_{q}[X_{1},\dots,X_{m}]&\to&\mathbb{F}_{q}^{q^{m}}\\ &P(x_{1},\dots,x_{m})&\mapsto&(P(x_{1},\dots,x_{m}),{\bm{x}}=(x_{1},\dots,x_{m})\in\mathbb{F}_{q}^{m})\end{array}$$

$${\mathrm{WRM}}_q^{\omega }(d)=\{{\mathrm{ev}}_{{\mathbb{F}}_q^m}(P),P\in {\mathbb{F}}_q[X_1,\dots ,X_m],{\mathrm{wdeg}}_{\omega }(P)\le d\}.$$

$${\Phi }_{\eta }=\{L_{\varphi }:t\mapsto (t,\varphi (t))\mid \varphi \in {\mathbb{F}}_q[T]\text{ and }\mathrm{deg}\varphi \le \eta \},$$

$${\mathrm{RS}}_q(d):=\{{\mathrm{ev}}_{{\mathbb{F}}_q}(f),f\in {\mathbb{F}}_q[T],\mathrm{deg}(f)\le d\},$$

$$p\ge 1-\mathbb{P}(|A_{\mathbf{x}}\cap E|\ge w+1)\ge 1-\frac{\mathbb{E}(|A_{\mathbf{x}}\cap E|)}{w+1}.$$

$$\mathbb{E}(|A_{\mathbf{x}}\cap E|)=\sum _{\mathbf{a}\in E}\mathbb{P}(\mathbf{a}\in A_{\mathbf{x}})\le \delta q^2\cdot \frac{q-1}{q^2-1}\le \delta q.$$

$$p\ge 1-\frac{4\delta q}{q-\lfloor \gamma q\rfloor }\ge 1-\frac{2\delta }{1-\gamma }.$$

$$D_i=\mathsf{Recover}(i,\mathbf{q},\mathbf{a}).$$

$$\mathrm{I}(\mathsf{Query}(i{)}_{|T};i)=0,$$

$${\mathrm{Lift}}^{\eta }({\mathrm{RS}}_q(d)):=\{{\mathrm{ev}}_{{\mathbb{F}}_q^2}(f)\mid f\in {\mathbb{F}}_q[X,Y],\forall L\in {\Phi }_{\eta },{\mathrm{ev}}_{{\mathbb{F}}_q}(f\circ L)\in {\mathrm{RS}}_q(d)\}.$$

$$\{(0,0),(0,1),(1,0),(2,0)\}.$$

$$(f\circ L)(t)=(a{t}^2+bt+c{)}^2=a^2{t}^4+b^2{t}^2+c^2=b^2{t}^2+a^{2}t+c.$$

$${\mathrm{ev}}_{{\mathbb{F}}_4^2}(f)\in {\mathrm{Lift}}^2({\mathrm{RS}}_4(2))\setminus {\mathrm{WRM}}_4^2(2).$$

$$\mathrm{Deg}(f):=\{(i,j)\in {\mathbb{N}}^2,f_{i,j}\ne 0\}.$$

$$\mathrm{Deg}({\mathrm{Lift}}^{\eta }({\mathrm{RS}}_q(d)))\subseteq [0,d{]}^2.$$

$$Q_{i,j}(X,Y):=\sum _{(a,b)\in ({\mathbb{F}}_q^{\times }{)}^2}\frac{1}{a^i{b}^j}f(aX,bY).$$

$$Q_{i,j}(X,Y)$$

$$=\sum _{(d,e)\in \mathrm{Deg}(f)}{f}_{d,e}\sum _{(a,b)\in ({\mathbb{F}}_q^{\times }{)}^2}{a}^{d-i}{b}^{e-j}{X}^d{Y}^e$$

$$\displaystyle=\sum_{(d,e)\in\operatorname{Deg}(f)}f_{d,e}\cdot\underbrace{\Big{(}\sum_{a\in\mathbb{F}_{q}^{\times}}a^{d-i}\Big{)}}_{=0\text{ if }d=i,\,-1\text{ otherwise}}\cdot\underbrace{\Big{(}\sum_{b\in\mathbb{F}_{q}^{\times}}b^{e-j}\Big{)}}_{=0\text{ if }e=j,\,-1\text{ otherwise}}\cdot\;X^{d}Y^{e}$$

$$=f_{i,j}\cdot (-1{)}^2\cdot X^i{Y}^j.$$

$$S:=\{f\in {\mathbb{F}}_q[X,Y],\mathrm{Deg}(f)\subseteq [0,q-1{]}^2,{\mathrm{ev}}_{{\mathbb{F}}_q^2}(f)\in {\mathrm{Lift}}^{\eta }({\mathrm{RS}}_q(d))\}.$$

$$f\circ m_{a,b}\circ L(T)=\sum _{i,j}{f}_{i,j}{a}^i{T}^i{b}^j\varphi (T{)}^j.$$

$$Q(aT)=\sum _{i,j}{f}_{i,j}{a}^i{T}^i{b}^j\varphi (T{)}^j=f\circ m_{a,b}\circ L(T).$$

$$\left(\genfrac{}{}{0ex}{}{a}{b}\right)=\prod _{i\ge 0}\left(\genfrac{}{}{0ex}{}{a^{(i)}}{b^{(i)}}\right)\mathrm{mod}p.$$

$${\Phi }_{\eta }^j=\mathrm{Span}\{T^{\alpha }\mid \alpha \in \Delta (j,\eta )\},$$

$$\Delta(j,\eta)\coloneqq\Big{\{}{\left\langle{\bm{w}},{\bm{k}}\right\rangle}\mid{\bm{k}}\in\mathbb{N}^{\eta}\text{ such that }\forall m\leq\eta,\>k_{m}\leq_{p}j-\sum_{\ell=1}^{m-1}k_{\ell}\Big{\}}\,.$$

$$\varphi (T{)}^j$$

$$=\sum _{k_1+\cdots +k_{\eta }\le j}\left(\genfrac{}{}{0ex}{}{j}{k_1,\dots ,k_{\eta }}\right){\lambda }_{\mathbf{k}}{x}^{k_1+2k_2+\cdots +\eta k_{\eta }},$$

$$\left(\genfrac{}{}{0ex}{}{j}{\mathbf{k}}\right):=\left(\genfrac{}{}{0ex}{}{j}{k_1,\dots ,k_{\eta }}\right)=\frac{j!}{k_1!k_2!\dots k_{\eta }!(j-{\sum }_{m=1}^{\eta }{k}_m)!}.$$

$$c_{\alpha }=\sum _{\mathbf{k}\in K_{\alpha }}\left(\genfrac{}{}{0ex}{}{j}{\mathbf{k}}\right){\lambda }_{\mathbf{k}},$$

Full text

However, a second practical barrier appears when one requires that the PIR protocol resists collusions of servers. In this paper, we propose a solution to this problem by considering weighted Reed-Muller codes. We prove that such codes allow us to build PIR protocols with optimal computation complexity and resisting to a small number of colluding servers.

In order to improve the dimension of the codes, we then introduce an analogue of the lifting process for weigthed degrees. With a careful analysis of their degree sets, we notably show that the weighted lifting of Reed-Solomon codes produces families of codes with remarkable asymptotic parameters.

1 Introduction

1.1 Weighted Reed-Muller codes

Weighted Reed-Muller codes were introduced by Sørensen in 1992, as a generalisation of Reed-Muller codes in the context of weighted polynomial rings [Sør92]. Formally, given a finite field $\mathbb{F}_{q}$, a weight $\omega=(\omega_{1},\dots,\omega_{m})\in(\mathbb{N}^{*})^{m}$ and a polynomial

[TABLE]

the weighted degree of $P$ with respect to $\omega$ is

[TABLE]

In particular, if $\omega=(1,\dots,1)$, then we get the usual notion of total degree for multivariate polynomials.

In order to build codes from subspaces of polynomials, we consider the evaluation map

[TABLE]

Then, a weighted Reed-Muller code is defined as the image by $\operatorname{ev}_{\mathbb{F}_{q}^{m}}$ of a subspace of polynomials whose weighted degree is bounded by some integer $d$.

Definition 1.1** (Weighted Reed-Muller code).**

Let $m\geq 1$, $\omega\in(\mathbb{N}^{*})^{m}$ and $d\in\mathbb{N}$. The weighted (affine) Reed-Muller code of order $m$, degree $d$ and weight $\omega$ is:

[TABLE]

Note that weighted Reed-Muller codes are generalised Goppa codes on the weighted projective space $\mathbb{P}(1,\omega_{1},\dots,\omega_{m})$ with evaluation points outside the line at infinity $X_{0}=0$.

The dimension of weighted Reed-Muller codes, as well as bounds on the minimum distance, are given by Sørensen in his seminal paper [Sør92]. Notice that these parameters are also analysed in a recent work [ACG*+*17] by Aubry, Castryck, Ghorpade, Lachaud, O’Sullivan, and Ram, who also describe minimum weight codewords with geometric techniques. Geil and Thomsen [GT13] finally proved that weighted Reed-Muller codes are efficiently decodable up to half their minimum distance, notably using an embedding of weighted Reed-Muller codes into Reed-Solomon codes.

1.2 Technical overview and organisation

In this work, we will only focus on the case where $m=2$ and $\omega$ is of the form $\omega=(1,\eta)$ where $\eta\geq 1$. This setting seems very restrictive, but it is the most promising in terms of parameters (see for instance [Sør92, GT13]) and it also finds a practical application in private information retrieval protocols. For simplicity, we will use the shorter notation $\operatorname{WRM}_{q}^{\eta}(d)$ for $\operatorname{WRM}_{q}^{(1,\eta)}(d)$.

Our first observation is that, when $d\leq q-1$, the evaluation map $\operatorname{ev}_{\mathbb{F}_{q}^{2}}$ is injective. This has two major consequences: (i) the code and its parameters are easier to describe and (ii) puncturing the code on “lines of weighted degree $\eta$” leads to highly-sound local correction. More precisely, in Section 2 we prove the following result.

Theorem 1.2** (informal).**

Let $\eta\geq 1$, $q$ be a prime power and $\gamma\in(0,1)$. For a fixed $\delta\in(0,1)$ small enough, the family of weighted Reed-Muller codes $\operatorname{WRM}^{\eta}_{q}(\lfloor\gamma q\rfloor)$ are $(q-1,\delta,\varepsilon)$-locally correctable, where $\varepsilon=O_{\gamma}(\delta)$.

This result is obtained thanks to the following fact. Let $\phi(T)\in\mathbb{F}_{q}[T]$ be a univariate polynomial of (non-weighted) degree bounded by $\eta$, and let $L=((t,\phi(t)),t\in\mathbb{F}_{q})\subset\mathbb{F}_{q}^{2}$. Then for every ${\bm{c}}=\operatorname{ev}_{\mathbb{F}_{q}^{2}}(f(X,Y))\in\operatorname{WRM}_{q}^{\eta}(d)$, the restriction ${\bm{c}}_{|L}$ of the vector ${\bm{c}}$ to the coordinates indexed by elements of $L$ is a codeword of a Reed-Solomon code of degree $d$. Hence, if the codeword ${\bm{c}}$ is corrupted with a constant fraction of errors, picking $\phi$ at random and correcting ${\bm{c}}_{|L}$ succeeds with constant probability. As a consequence, it allows us to retrieve some symbols of the corrupted codeword in sublinear query complexity.

However, results described above do not improve the related “local decoding on curves” technique, described for instance by Yekhanin in his survey [Yek12]. Fortunately, local correctabilities of weighted Reed-Muller codes can be applied to private information retrieval protocols in order to resist collusion of servers. In particular, we prove that any weighted Reed-Muller code $\operatorname{WRM}^{\eta}_{q}(d)$ induces a private information retrieval protocol for databases of $\simeq q^{2}/2\eta$ entries, requiring a minimal computation complexity for the $q$ servers, and remaining private against any collusion of $\eta$ servers. We refer the reader to Section 3 for more details.

One should notice that the maximal number of entries in the database is directly given by the dimension of $\operatorname{WRM}^{\eta}_{q}(d)$. Unfortunately, the information rate of such codes remains bounded by $1/2\eta$ as long as $d\leq q-1$, a constraint which is necessary in our context. Therefore, following the seminal paper of Guo, Kopparty and Sudan [GKS13] and subsequent works [Guo16, Lav18b], we initiate the study of a weighted lifting of Reed-Solomon codes in order to produce codes with the same local properties as weighted Reed-Muller codes, but with a much larger dimension.

Definitions and essential properties of weighted lifted codes are given in Section 4. Similarly to the constructions of lifted (affine [GKS13] and projective [Lav18b]) Reed-Solomon codes and lifted Hermitian codes [Guo16], we also prove that for fixed $\eta$ and $q\to\infty$, weighted lifts of Reed-Solomon codes are locally correctable with (i) a non-zero asymptotic information rate in the context of errors with constant relative weight, or (ii) an information rate arbitrary close to $1$ when errors have smaller weight.

These two results are the main technical outcomes of the paper, and we present them in Section 5. They are obtained after a precise analysis of so-called degree sets of weighted Reed-Muller and lifted codes, which represent the sets of exponents of monomials spanning the codes. We finally provide numerical computations of dimensions of weighted lifted codes, which illustrate the improvement of weighted lifted codes over weighted Reed-Muller codes, and their practical useability in private information retrieval.

2 Local correction of weighted Reed-Muller codes

2.1 Restricting Reed-Muller codes to weighted lines

The local decoding properties of Reed-Muller codes come from the restriction of their codewords on a line being Reed-Solomon codewords. Expecting similar properties on weighted Reed-Muller codes, we have to find what will play the part of the lines in $\mathbb{P}(1,1,\eta)$.

Definition 2.1** ($\eta$-line on $\mathbb{P}(1,1,\eta)$).**

Let $\eta\geq 1$. We call a (non-vertical) $\eta$-line on $\mathbb{P}(1,1,\eta)$ the set of zeroes of the polynomial $P(X_{0},X_{1},X_{2})=X_{2}-\phi(X_{0},X_{1})$ where $\phi\in\mathbb{F}_{q}[X_{0},X_{1}]$ is homogeneous of degree $\eta$.

Since we evaluate polynomials only at points outside the line $X_{0}=0$, we shall define an $\eta$-line on the affine plane $\mathbb{A}^{2}$, viewed as the domain $X_{0}\neq 0$, as the intersection of an $\eta$-line on $\mathbb{P}(1,1,\eta)$ and $X_{0}\neq 0$.

Definition 2.2** (affine $\eta$-line).**

Let $\eta\geq 1$. We call a (non-vertical) $\eta$-line on $\mathbb{A}^{2}$ the set of zeroes of a bivariate polynomial $P(X,Y)=Y-\phi(X)$, where $\phi\in\mathbb{F}_{q}[X]$ and $\deg\phi\leq\eta$.

Let us remark that if $P=Y-\phi(X)$ defines an $\eta$-line, then $\operatorname{wdeg}_{\eta}(P)\leq\eta$. The converse is not true, since we removed from the definition collections of “vertical lines” defined by $\phi(X)=0$, $\deg\phi\leq\eta$.

An $\eta$-line can be parametrized by $t\mapsto(t,\phi(t))$. We thus define

[TABLE]

the set of embeddings of $\eta$-lines into the affine plane $\mathbb{A}^{2}=\overline{\mathbb{F}_{q}}^{2}$. These embeddings are very useful when trying to characterise restrictions of weighted Reed-Muller codes to $\eta$-lines.

Proposition 2.3**.**

Any polynomial $f\in\mathbb{F}_{q}[X,Y]$ whose evaluation over $\mathbb{F}_{q}^{2}$ lies in $\operatorname{WRM}^{\eta}_{q}(d)$ satisfies $\operatorname{ev}_{\mathbb{F}_{q}}(f\circ L)\in\operatorname{RS}_{q}(d)$ for any $L\in\Phi_{\eta}$.

Proof.

It is sufficient to check the result on monomials. Let $f=X^{i}Y^{j}$ where $i+\eta j\leq d$. For every $\phi\in\Phi_{\eta}$, the univariate polynomial $(f\circ L_{\phi})(T)=T^{i}\phi(T)^{j}$ has degree less than $d$. ∎

2.2 Local correction

Local decoding was introduced by Katz and Trevisan [KT00] in order to characterise codes allowing to (probabistically) retrieve a message coordinate with a sublinear number of queries in the code length $n$. The difficulty comes from the fact that the retrieval must succeed with non-negligeable probability for every codeword which is corrupted by any possible error whose weight is bounded by a linear function in $n$. Local correction is very similar to local decoding, the only difference being that one requires that any coordinate of the codeword can be retrieved.

Before giving a formal definition of this notion, let us introduce some notation. We denote the Hamming distance between two vectors ${\bm{x}},{\bm{y}}$ by $d_{H}({\bm{x}},{\bm{y}})$. The weight of ${\bm{x}}$ is ${\rm wt}({\bm{x}})\coloneqq d_{H}({\bm{x}},{\bm{0}})$. An erasure is a symbol of a word that one knows to be erroneous. Finally, we denote111take care that this notation (with $\leq d$ instead of $<k$) is not the most currently used, but remains very convenient for our work the full-length Reed-Solomon code by

[TABLE]

and we recall that $\operatorname{RS}_{q}(d)$ can correct efficiently $1$ erasure and up to $\lfloor\frac{n-d}{2}\rfloor$ errors.

Definition 2.4** (locally correctable code).**

Let $1\leq\ell\leq k\leq n$, and $\delta,\varepsilon>0$. A code $\mathcal{C}\subseteq\mathbb{F}_{q}^{n}$ is said $(\ell,\delta,\varepsilon)$-locally correctable if there exists a probabilitic algorithm ${\rm Dec}:[1,n]\to\mathbb{F}_{q}$ such that the following holds. For every $1\leq i\leq n$ and for every ${\bm{y}}\in\mathbb{F}_{q}^{n}$ such that $d_{H}({\bm{y}},{\bm{c}})\leq\delta n$ for some ${\bm{c}}\in\mathcal{C}$, we have:

• –

the probability222taken over the internal randomness of the decoder ${\rm Dec}$ that ${\rm Dec}(i)$ outputs $c_{i}$ is larger than $1-\varepsilon$;

• –

${\rm Dec}(i)$ reads at most $\ell$ coordinates of ${\bm{y}}$.

Similarly to the case of classical Reed-Muller codes and codes derived from those, weighted Reed-Muller codes can be locally corrected using their restrictions to “lines”. For simplicity, we see a vector ${\bm{y}}\in\mathbb{F}_{q}^{q^{2}}$ as a map $\mathbb{F}_{q}^{2}\to\mathbb{F}_{q}$, using the bijection between $[1,q^{2}]$ and $\mathbb{F}_{q}^{2}$ given by the evaluation map. Similarly, ${\bm{a}}\in\mathbb{F}_{q}^{q}$ is seen as a map $\mathbb{F}_{q}\to\mathbb{F}_{q}$. One obtains the local correction procedure described in Algorithm 1.

According to Katz and Trevisan’s terminology [KT00], Algorithm 1 is not perfectly smooth, in the sense that the coordinate $y_{\bm{x}}$ is never queried. nevertheless, it can be made smooth following techniques described in [Lav18a, Chapter $2$].

Theorem 2.5**.**

Let $\eta\geq 1$, $q$ be a prime power, and $\gamma\in(0,1)$ such that $q-\lfloor\gamma q\rfloor$ is even. For every $\delta\leq\frac{1-\gamma}{4}$, the weighted Reed-Muller code $\operatorname{WRM}^{\eta}_{q}(\lfloor\gamma q\rfloor)$ is $(q-1,\delta,\varepsilon)$-locally correctable where $\varepsilon\leq\frac{2}{1-\gamma}\delta$.

Proof.

Let ${\bm{y}}={\bm{c}}+{\bm{e}}:\mathbb{F}_{q}^{2}\to\mathbb{F}_{q}$ be a corrupted codeword, where ${\bm{c}}\in\operatorname{WRM}_{q}^{\eta}(d)$ and ${\rm wt}({\bm{e}})\leq\delta q^{2}$. We define $E=\{{\bm{x}}\in\mathbb{F}_{q}^{2}\mid e_{\bm{x}}\neq 0\}$ the support of ${\bm{e}}$. The random variable representing the set of queries addressed by the local decoder is denoted by $A_{\bm{x}}$. It is clear that the algorithm succeeds if $|A_{\bm{x}}\cap E|\leq w$, where $w=\frac{q-\lfloor\gamma q\rfloor}{2}-1$, since a Reed-Solomon of dimension $\lfloor\gamma q\rfloor+1$ can decode up to $1$ erasure and $w$ errors. Using Markov’s inequality, the probability $p$ of success of Algorithm 1 satisfies:

[TABLE]

Moreover, for every ${\bm{a}}\in\mathbb{F}_{q}^{2}$, we have $\mathbb{P}({\bm{a}}\in A_{\bm{x}})\leq\frac{q-1}{q^{2}-1}$. Hence,

[TABLE]

Finally we get

[TABLE]

∎

Remark 2.6**.**

If $\eta\geq 2$, it is possible to get a sharper bound for the probability $p$ of success of Algorithm 1. Using Chebyshev’s inequality (quite similarly to [Lav18a, Proposition 2.36]), one can indeed prove that p\geq 1-{\cal O}\big{(}\frac{\delta(1-\delta)}{q}\big{)}.

3 Application to private information retrieval

Private information retrieval (PIR) protocols are cryptographic protocols ensuring that a user can retrieve an entry $D_{i}$ of a remote database $D=(D_{1},\dots,D_{k})$, without revealing any information on the index $i\in[1,k]$ to the holder of the database. Additionally, it is also required that the communication cost (number of bits exchanged during the retrieval process) is sublinear in the size of the database.

Since its introduction by Chor, Goldreich, Kushilevitz and Sudan in 1995 [CGKS95], various kinds of PIR schemes have been designed according to the system constraints. In earliest PIR schemes, one assumes that the database is replicated over $\ell$ non-communicating honest-but-curious servers $S_{1},\dots,S_{\ell}$. In this context the seminal result of Katz and Trevisan [KT00] — which relates PIR protocols to the existence of so-called smooth locally decodable codes — induced many new constructions of PIR schemes, notably in [BIKR02, Yek08, Efr12, DG16]. These constructions eventually achieved $O(\exp(\sqrt{\log k\log\log k}))$ bits of communication for a $k$-entry database replicated on $\ell=2$ servers.

Motivated by the use of storage codes in distributed storage systems, a large amount of recent works focused on the case where the database is encoded on the servers. In this context, entries of the database are usually very large (e.g. movies), so that we can assume that the download communication cost prevails over the upload one. Several works aimed at minimizing this cost depending on the storage system: Shah, Rashmi and Ramchandran [SRR14] considered the replication code as the storage code; Tajeddine, Gnilke and El Rouayheb [TGR18] MDS codes; Kumar, Rosnes and Graell i Amat [KRGiA17] arbitrary codes.

It is worth noticing that, following e.g. Beimel and Stahl [BS02], a few works also considered the more restrictive setting of colluding servers (i.e. servers communicating with each other so as to collect information about the required item), byzantine servers (i.e. servers able to produce wrong answers to user’s queries) or unresponsive servers (servers unable to give ananswer to user’s queries).

Finally, one should emphasise that families of PIR schemes referenced above mostly focus on decreasing the communication cost during the retrieval process. This is done at the expense of other crucial parameters, such as the computation complexity of the recovery, or the servers’ storage overhead.

In this section, we show how the local properties of weighted Reed-Muller codes $\operatorname{WRM}^{\eta}_{q}(d)$ lead to very natural PIR protocols resisting to any set of $b$ byzantine, $u$ unresponsive and $t$ colluding servers — provided that $2b+u+t\leq q-d-1$ — with moderate communication complexity but optimal computation complexity.

3.1 Definitions

Definition 3.1** (private information retrieval).**

Let $D\in\mathbb{F}_{q}^{k}$ be a remote database distributed on $\ell$ servers $S_{1},\dots,S_{\ell}$, in such a way333Notice that we make no other assumption on the way (replication, encoding, etc.) the database is stored on the servers. We only require that the encoding map $D\mapsto({\bm{c}}^{(1)},\dots,{\bm{c}}^{(\ell)})$ is injective. that we assume that each server $S_{j}$ stores a vector ${\bm{c}}^{(j)}\in\mathbb{F}_{q}^{m}$. A private information retrieval (PIR) protocol for $D$ is a tuple of algorithms $(\mathsf{Query},\mathsf{Answer},\mathsf{Recover})$ such that:

$\mathsf{Query}$ is a probabilistic algorithm taking as input a coordinate $i\in[1,k]$, and providing a random tuple of queries $\mathsf{Query}(i)=(q_{1},\dots,q_{\ell})\in\mathcal{Q}^{\ell}$ for some finite set $\mathcal{Q}$; 2. 2.

$\mathsf{Answer}$ is a deterministic algorithm taking as input a server index $j\in[1,\ell]$, a query $q_{j}\in\mathcal{Q}$ and the vector ${\bm{c}}^{(j)}$ stored by server $S_{j}$, and outputs an answer $a_{j}\in\mathcal{A}$, where $\mathcal{A}$ is a finite set; 3. 3.

$\mathsf{Recover}$ is a deterministic algorithm taking as input a coordinate $i\in[1,k]$, a tuple of queries ${\bm{q}}=(q_{1},\dots,q_{\ell})\in\mathcal{Q}^{\ell}$ and a tuple of answers ${\bm{a}}=(a_{1},\dots,a_{\ell})\in\mathcal{A}^{\ell}$, and which outputs a symbol $r\in\mathbb{F}_{q}$ satisfying the following requirement. If ${\bm{q}}=\mathsf{Query}(i)$ and ${\bm{a}}=(\mathsf{Answer}(j,q_{j},{\bm{c}}^{(j)}))_{1\leq j\leq\ell}$, then:

[TABLE]

We also say that a PIR protocol

• –

is $t$-private (or resists to any collusion of $t$ servers) if for every $T\subset[1,\ell]$, $|T|=t$, we have

[TABLE]

where ${\rm I}(\cdot\;;\,\cdot)$ denotes the mutual information between random variables;

• –

is robust against $b$ byzantine and $u$ unresponsive servers if (1) holds when up to $b$ symbols of ${\bm{a}}=(\mathsf{Answer}(j,q_{j},{\bm{c}}^{(j)}))_{1\leq j\leq\ell}\in\mathcal{A}^{\ell}$ differ from the expected ones, and up to $u$ symbols of ${\bm{a}}$ are missing.

Let us now define some of the most studied parameters of PIR protocols.

Definition 3.2**.**

Let $(\mathsf{Query},\mathsf{Answer},\mathsf{Recover})$ be a PIR protocol. We define:

• –

its communication complexity as $C_{\rm comm}\coloneqq\ell(\log(|\mathcal{Q}|)+\log(|\mathcal{A}|))$;

• –

its server computation complexity, denoted $C^{s}_{\rm comp}$ as the maximal number of operations over $\mathbb{F}_{q}$ necessary to compute $\mathsf{Answer}(j,q_{j},{\bm{c}}^{(j)})$;

• –

its storage rate as the ratio $\frac{k}{\ell m}$.

We finally say that a PIR protocol is computationally optimal for the servers if $C^{s}_{\rm comp}\leq 1$.

3.2 The PIR protocol

We present in this section a PIR protocol based on weighted Reed-Muller codes. The protocol relies on a well-suited splitting of the encoded database over the servers, as it was originally done by Augot, Levy-dit-Vehel and Shikfa in [ALS14]

Protocol 3.3**.**

Let $\mathcal{C}=\operatorname{WRM}_{q}^{\eta}(d)$, and denote its dimension by $k$. Recall that a codeword ${\bm{c}}\in\mathcal{C}$ can be seen as a map $\mathbb{F}_{q}^{2}\to\mathbb{F}_{q}$. Let us also consider $q$ servers $(S_{t})_{t\in\mathbb{F}_{q}}$ indexed by elements of $\mathbb{F}_{q}$.

Initialisation. The database $D\in\mathbb{F}_{q}^{k}$ is encoded into a codeword ${\bm{c}}\in\mathcal{C}$. For every $t\in\mathbb{F}_{q}$, the server $S_{t}$ receives the part ${\bm{c}}_{|\{t\}\times\mathbb{F}_{q}}$ of the codeword ${\bm{c}}$. Notice that ${\bm{c}}_{|\{t\}\times\mathbb{F}_{q}}$ consists in $q$ symbols over $\mathbb{F}_{q}$.

Queries. Assume one wants to retrieve $D_{i}$, for $1\leq i\leq k$. One can always assume that the encoding map is systematic, hence $D_{i}=c_{\bm{x}}$ for some ${\bm{x}}=(x_{1},x_{2})\in\mathbb{F}_{q}^{2}$. To define a vector of queries:

• –

Pick at random an $\eta$-line $L\in\Phi_{\eta}$ such that $L(t_{0})={\bm{x}}$ for some $t_{0}\in\mathbb{F}_{q}$.

• –

The server $S_{t_{0}}$ receives a random element $y_{t_{0}}\in\mathbb{F}_{q}$.

• –

Server $S_{t},t\neq t_{0}$ receives $y_{t}\in\mathbb{F}_{q}$ such that $(t,y_{t})=L(t)$.

Answers. Upon receipt of $y_{t}\in\mathbb{F}_{q}$, every server $S_{t}$ reads the entry $c_{(t,y_{t})}\in\mathbb{F}_{q}$ and sends it back to the user.

Recovery. The user collects ${\bm{c}}^{\prime}=(c_{(t,y_{t})})_{t\in\mathbb{F}_{q}}$ and runs an error-and-erasure correcting algorithm for $\operatorname{RS}_{q}(d)$ with input ${\bm{c}}^{\prime}$. Then, the user returns the corrected symbol $c^{\prime}_{(t_{0},y_{t_{0}})}$.

Theorem 3.4**.**

Let $q$ be a prime power, $\eta\geq 1$ , and $b,u\geq 0$. Set $d=q-u-2b-2$. Then, Protocol 3.3 equipped with $\operatorname{WRM}^{\eta}_{q}(d)$ is $\eta$-private and robust against $b$ byzantine and $u$ unresponsive servers. Moreover, it is computationally optimal for the servers, its storage rate approaches $1/{2\eta}$ when $q\to\infty$, and its communication complexity is $2q\log q$.

Proof.

The correctness of the PIR scheme, under $b$ byzantine and $u$ unresponsive servers, comes from Proposition 2.3 and from the fact that $\operatorname{RS}_{q}(d)$ corrects $b$ errors and $u+1$ erasures if $d\geq q-u-2b-2$. Moreover, the scheme is $\eta$-private since any subset of $\eta$ points of an $\eta$-line gives no information about the other points. Finally, the parameters of the scheme can be easily checked. ∎

4 Towards higher information rate: the lifting process

4.1 Definitions

In previous sections, we have proved that weighted Reed-Muller codes admit local properties that can be used in practical applications such as private information retrieval. However, such constuctions are moderately efficient in terms of storage, since the information rate of $\operatorname{WRM}^{\eta}_{q}(d)$ is bounded by $1/2\eta$ if $d\leq q-2$.

In this section, we show how to construct codes with the same local properties as weighted Reed-Muller codes, but admitting a much larger dimension. As a practical consequence, these new codes can replace weighted Reed-Muller codes in Protocol 3.3, leading to storage-efficient PIR schemes.

Techniques involved in the construction of these codes directly follow the lifting process initiated by Guo, Kopparty and Sudan [GKS13]. More precisely, the authors introduce so-called lifted Reed-Solomon codes as codes containing (classical) Reed-Muller codes, and satisfying that the restriction of any codeword to any affine line lies in a Reed-Solomon. The purpose of this section is to extend this notion to $\eta$-lines.

We thus naturally introduce the $\eta$-lifting of a Reed-Solomon code as follows.

Definition 4.1** ($\eta$-lifting of a Reed-Solomon code).**

Let $q$ be a prime power and $0\leq d\leq q-1$. The $\eta$-lifting of the Reed-Solomon code $\operatorname{RS}_{q}(d)$ is the code of length $n=q^{2}$ defined as follows:

[TABLE]

Notice that if $d=q-1$, the $\eta$-lifted code $\operatorname{Lift}^{\eta}(\operatorname{RS}_{q}(q-1))$ is the trivial full space $\mathbb{F}_{q}^{q^{2}}$. Hence, from now on we assume $d\leq q-2$.

It is clear that $\operatorname{WRM}^{\eta}_{q}(d)\subseteq\operatorname{Lift}^{\eta}(\operatorname{RS}_{q}(d))$ since the constraints that define $\eta$-lifted codes are satisfied by each codeword of a comparable weighted Reed-Muller code. But quite surprisingly, the code $\operatorname{Lift}^{\eta}(\operatorname{RS}_{q}(d))$ is sometimes much larger than $\operatorname{WRM}^{\eta}_{q}(d)$. Let us highlight this claim with an example.

Example 4.2**.**

Let $q=4$, $\eta=2$ and $d=2$. The associated weighted Reed-Muller code is generated by the evaluation vectors of monomials $X^{i}Y^{j}$, where $(i,j)$ lies in

[TABLE]

Let us now consider the monomial $f(X,Y)=Y^{2}\in\mathbb{F}_{4}[X,Y]$ and an $\eta$-line $L(T)=(T,aT^{2}+bT+c)\in\Phi_{2}$, where $a,b,c\in\mathbb{F}_{4}$. We see that for every $t\in\mathbb{F}_{4}$, we have:

[TABLE]

Hence, $\operatorname{ev}_{\mathbb{F}_{4}}(f\circ L)\in\operatorname{RS}_{4}(2)$ for every $L\in\Phi_{2}$. Since $\operatorname{wdeg}_{\eta}(f)=4>2$, we get

[TABLE]

Given a polynomial $f(X,Y)=\sum_{i,j}f_{i,j}X^{i}Y^{j}\in\mathbb{F}_{q}[X,Y]$, we define its degree set as

[TABLE]

By extension, the degree set $\operatorname{Deg}(S)$ of a subset $S\subseteq\mathbb{F}_{q}[X,Y]$ is the union of degree sets of polynomials lying in $S$. Similarly, if $\mathcal{C}=\{\operatorname{ev}_{\mathbb{F}_{q}^{2}}(f),f\in S\}$, then we set $\operatorname{Deg}(\mathcal{C})\coloneqq\operatorname{Deg}(S)$.

Remark 4.3**.**

Since $a^{q}=a$ for every $a\in\mathbb{F}_{q}$, one can consider degree sets as subsets of $[0,q-1]^{2}$. This precisely corresponds to considering polynomials modulo the ideal $I=\langle X^{q}-X,Y^{q}-Y\rangle=\ker\operatorname{ev}_{\mathbb{F}_{q}^{2}}$.

Lemma 4.4**.**

Let $f\in\mathbb{F}_{q}[X,Y]$ such that $\operatorname{Deg}(f)\subseteq[0,q-1]^{2}$, and let $(i,j)\in\operatorname{Deg}(f)$. Assume that for every $(a,b)\in\operatorname{Deg}(f)$, we have $i\geq a$ (respectively, $j\geq b$). Then, there exists an $\eta$-line $L\in\Phi_{\eta}$ such that $\deg(f\circ L)=i$ (respectively, $\deg(f\circ L)=j$).

Proof.

If $i\geq a$ for every $(a,b)\in\operatorname{Deg}(f)$, then $L(T)=(T,1)$ lies in $\Phi_{\eta}$, and the degree of $f\circ L$ is thus $i$. The proof is similar for $j$. ∎

Proposition 4.5**.**

Let $d\leq q-2$. Then,

[TABLE]

Proof.

A pair $(i,j)\in\operatorname{Deg}(\operatorname{Lift}^{\eta}(\operatorname{RS}_{q}(d)))\setminus[0,d]^{2}$ would contradict Lemma 4.4. ∎

4.2 Monomiality

We say that a linear code $\mathcal{C}$ is monomial if there exists a set $S\subset\mathbb{F}_{q}[X,Y]$ of monomials, such that $\mathcal{C}=\operatorname{Span}\{\operatorname{ev}_{\mathbb{F}_{q}^{2}}(f),f\in S\}$. Monomial codes are convenient since they admit a simple description.

Let us define monomial transformations $m_{a,b}:(x,y)\mapsto(ax,by)$, for $(a,b)\in(\mathbb{F}_{q}^{\times})^{2}$.

Lemma 4.6**.**

Let $S$ be a subspace of $\mathbb{F}_{q}[X,Y]$ such that:

1. (i)

$\operatorname{Deg}(S)\subseteq[0,q-2]^{2}$, and 2. (ii)

for every $f(X,Y)\in S$ and every $(a,b)\in(\mathbb{F}_{q}^{\times})^{2}$, the polynomial $f\circ m_{a,b}$ also lies in $S$.

Then $S$ is spanned by monomials.

Proof.

Let $f(X,Y)=\sum_{(i,j)\in D}f_{i,j}X^{i}Y^{j}\in S$ where $D=\operatorname{Deg}(f)\subseteq[0,q-2]^{2}$. It is sufficient to prove that for all $(i,j)\in D$, the monomial $X^{i}Y^{j}$ lies in $S$.

For $(i,j)\in D$, let us define

[TABLE]

Since $S$ is a vector space invariant under $\{m_{a,b}\mid(a,b)\in(\mathbb{F}_{q}^{\times})^{2}\}$, we have $Q_{i,j}\in S$. Moreover,

[TABLE]

Since $f_{i,j}\neq 0$, $X^{i}Y^{j}\in S$. ∎

Proposition 4.7**.**

Let $d\leq q-1$. The linear code $\operatorname{Lift}^{\eta}(\operatorname{RS}_{q}(d))$ is monomial.

Proof.

The code $\operatorname{Lift}^{\eta}(\operatorname{RS}_{q}(q-1))$ is the full space $\mathbb{F}_{q}^{q^{2}}$; hence it is trivially a monomial code. For $d\leq q-2$, let us define

[TABLE]

Proposition 4.5 ensures that $\operatorname{Deg}(S)\subseteq[0,d]^{2}$. Let $f=\sum_{i,j}f_{i,j}X^{i}Y^{j}\in S$. For every $(a,b)\in(\mathbb{F}_{q}^{\times})^{2}$ and every $L(T)=(T,\phi(T))\in\Phi_{\eta}$ we have

[TABLE]

Let us now define $Q(T)\coloneqq f(T,b\phi(a^{-1}T))$. One can easily check that $(T,b\phi(a^{-1}T)))\in\Phi_{\eta}$. Since $\operatorname{ev}_{\mathbb{F}_{q}^{2}}(f)\in\operatorname{Lift}^{\eta}(\operatorname{RS}_{q}(d))$, we also know that $\operatorname{ev}_{\mathbb{F}_{q}}(Q)\in\operatorname{RS}_{q}(d)$. Moreover, $\operatorname{RS}_{q}(d)$ is invariant under affine transformations, hence $\operatorname{ev}_{\mathbb{F}_{q}}(Q(aT))\in\operatorname{RS}_{q}(d)$. Let us now remark that

[TABLE]

Consequently, $f\circ m_{a,b}\in S$. Therefore we can use Lemma 4.6, and our result follows immediately. ∎

4.3 The degree set of $\eta$-lifted Reed-Solomon codes

Previous discussions ensure that, given a tuple $(\eta,d,q)$, the code $\mathcal{C}(q,d,\eta)\coloneqq\operatorname{Lift}^{\eta}(\operatorname{RS}_{q}(d))$ is fully determined by its degree set $D(q,d,\eta)\coloneqq\operatorname{Deg}(\mathcal{C}(q,d,\eta))\subseteq[0,d]^{2}$. Let us now seek for characterisations of $D(q,d,\eta)$.

For this purpose, we need to introduce some notation:

• –

${\left\langle\cdot,\cdot\right\rangle}$ denotes the inner product between vectors, or tuples.

• –

We set ${\bm{w}}\coloneqq(1,2,\dots,\eta)\in\mathbb{N}^{\eta}$.

• –

Given $\alpha\in\mathbb{N}$ and a prime number $p$, we denote by $\alpha^{(r)}$ the $r^{\rm th}$ digit in the representation of $\alpha$ in base $p$, i.e. $\alpha=\sum_{r\geq 0}\alpha^{(r)}p^{r}$.

• –

For $\alpha,\beta\in\mathbb{N}$, we write $\alpha\leq_{p}\beta$ if and only if $\alpha^{(r)}\leq\beta^{(r)}$ for every $r\geq 0$.

• –

For ${\bm{k}}\in\mathbb{N}^{\eta}$ and $r\in\mathbb{N}$, we also write {\bm{k}}^{(r)}=\big{(}k_{1}^{(r)},\dots,k_{\eta}^{(r)}\big{)}\in\mathbb{N}^{\eta}.

We will also make use of Lucas theorem [Luc78] which gives the reduction of binomial coefficients modulo primes.

Theorem 4.8** (Lucas theorem [Luc78]).**

Let $a,b\in\mathbb{N}$ and $p$ be a prime number. Recall that $a=\sum_{i\geq 0}a^{(i)}p^{i}$ is the representation of $a$ in base $p$. Then,

[TABLE]

In particular, in any field of characteristic $p$, the binomial coefficient $\binom{a}{b}$ is non-zero if and only if $b\leq_{p}a$.

In the next lemma, we characterise univariate polynomials arising from the restriction of $Y^{j}$ to $\eta$-lines.

Lemma 4.9**.**

Let $j\geq 0$ and $\eta\geq 1$ and let us define $\Phi_{\eta}^{j}\coloneqq\{\phi(T)^{j}\mid\phi(T)\in\mathbb{F}_{q}[T],\deg\phi\leq\eta\}\subseteq\mathbb{F}_{q}[T]$. We have:

[TABLE]

where

[TABLE]

Proof.

Given a polynomial $\phi(T)=\sum_{m=0}^{\eta}a_{m}T^{m}\in\mathbb{F}_{q}[T]$, the well-known multinomial theorem entails that:

[TABLE]

where $\lambda_{\bm{k}}\coloneqq a_{0}^{j-|{\bm{k}}|}\times\prod_{\ell=1}^{\eta}a_{\ell}^{k_{\ell}}\in\mathbb{F}_{q}$ is a coefficient which only depends on $a_{0},\dots,a_{\eta}$ and ${\bm{k}}$, and where

[TABLE]

The coefficient of the term $T^{\alpha}$ in $\phi(T)^{j}$ is therefore:

[TABLE]

where $K_{\alpha}\coloneqq\{{\bm{k}}\in\mathbb{N}^{\eta}\mid|{\bm{k}}|\leq j\text{ and }{\left\langle{\bm{w}},{\bm{k}}\right\rangle}=\alpha\}$. We claim that $c_{\alpha}=0$ for every $\phi\in\Phi_{\eta}$ if and only if $\binom{j}{{\bm{k}}}=0$ for every ${\bm{k}}\in K_{\alpha}$. Indeed, $c_{\alpha}\in\mathbb{F}_{q}$ can be seen as the evaluation of an homogeneous polynomial $C_{\alpha}\in\mathbb{F}_{q}[A_{0},\dots,A_{\eta}]$ of degree $j$ at the point $(a_{0},\dots,a_{\eta})\in\mathbb{F}_{q}^{\eta+1}$ corresponding to $\phi$. Since $j\leq q-1$, the polynomial $C_{\alpha}$ vanishes over $\mathbb{F}_{q}^{\eta+1}$ if and only if it is the zero polynomial, which proves our claim.

Now, notice that

[TABLE]

Hence, using Lucas theorem [Luc78] on every binomial coefficient in the above product, we see that $\binom{j}{{\bm{k}}}=0$ if and only if there exists $m\in[1,\eta]$ such that $k_{m}\not\leq_{p}j-\sum_{\ell=1}^{m-1}k_{\ell}$.

In other words, the monomial $T^{\alpha}$ appears as a term of $\phi(T)^{j}$ if and only if there exists ${\bm{k}}\in\mathbb{N}^{\eta}$ such that $\alpha={\left\langle{\bm{w}},{\bm{k}}\right\rangle}=\sum_{\ell=1}^{\eta}\ell k_{\ell}$ and

[TABLE]

∎

Let us now give some properties on the set $\Delta(j,\eta)\subseteq\mathbb{N}$ defined in Lemma 4.9.

Lemma 4.10**.**

We have $\Delta(j,\eta)\subseteq[0,j\eta]$. Moreover, an integer $\alpha$ belongs to $\Delta(j,\eta)$ if and only if

[TABLE]

Proof.

By definition, an integer $\alpha$ belongs to $\Delta(j,\eta)$ if and only if there exists ${\bm{k}}\in\mathbb{N}^{\eta}$ such that $\alpha=\sum_{\ell=1}^{\eta}\ell k_{\ell}$ and for all $m\leq\eta$, we have

[TABLE]

We first prove by induction on $m$ that, if $\alpha\in\Delta(j,\eta)$, then for all $m\leq\eta$ and for all $r\geq 0$,

[TABLE]

Notice that it would prove the desired result for $m=\eta$. Moreover, the case $m=1$ is a direct consequence of (3).

Let us fix $2\leq m\leq\eta$ such that $\sum_{\ell=1}^{m-1}k_{\ell}^{(r)}\leq j^{(r)}$ for every $r\geq 0$. Then $\sum_{\ell=1}^{m-1}k_{\ell}^{(r)}\leq p-1$ and the uniqueness of the representation of the integer $\sum_{\ell=1}^{m-1}k_{\ell}$ in base $p$ ensures that

[TABLE]

Using (3), we get $k_{m}^{(r)}\leq j^{(r)}-\sum_{\ell=1}^{m-1}k_{\ell}^{(r)}$, which implies that $\sum_{\ell=1}^{m}k_{\ell}^{(r)}\leq j^{(r)}$.

Conversely, assume that (2) holds, and let $1\leq m\leq\eta$. We shall prove that (3) is satisfied. For every $r\geq 0$, we have

[TABLE]

Equation (2) implies that $k_{m}^{(r)}\leq j^{(r)}-\sum_{\ell=1}^{m-1}k_{\ell}^{(r)}$. Moreover, $\sum_{\ell=1}^{m-1}k_{\ell}^{(r)}\leq j^{(r)}$, hence as we have seen in (4),

[TABLE]

This leads us to $k_{m}^{(r)}\leq\left(j-\sum_{\ell=1}^{m-1}k_{\ell}\right)^{(r)}$. Therefore, $k_{m}\leq_{p}j-\sum_{\ell=1}^{m-1}k_{\ell}$. ∎

As an easy corollary of Lemma 4.9 and Lemma 4.10, we see that

[TABLE]

Hence, $\operatorname{ev}_{\mathbb{F}_{q}^{2}}(X^{i}Y^{j})$ lies in $\operatorname{Lift}^{\eta}\operatorname{RS}_{q}(d)$ if, for all $u\in\Delta(j,\eta)$, every monomial $T^{i+u}$ evaluates to a codeword of $\operatorname{RS}_{q}(d)$. Notice here that $i+u$ might be larger than $q$, therefore this is equivalent to say that $T^{i+u}\mod(T^{q}-T)$ is polynomial of degree bounded by $d$.

This remark leads us to introduce a relation of equivalence between integers. We write $a\,\equiv^{\star}_{q}\,b$ if and only if $T^{a}=T^{b}\mod(T^{q}-T)$. In other words, $a\,\equiv^{\star}_{q}\,b$ if and only if $(a,b)=(0,0)$, or $a>0,b>0$ and $(q-1)\mid(a-b)$. Finally, we denote444notation $\mod\!^{*}q$ is used in [GKS13], but we find it quite unconvenient by ${\rm Red}^{\star}_{q}(a)$ the only integer in $[0,q-1]$ such that ${\rm Red}^{\star}_{q}(a)\,\equiv^{\star}_{q}\,a$.

From Lemma 4.9 and Lemma 4.10, and following the previous discussion, we deduce a characterisation of elements of $D(q,d,\eta)$.

Proposition 4.11**.**

Let $d\leq q-2$. A pair $(i,j)\in[0,d]^{2}$ belongs to $D(q,d,\eta)$ if and only if for every ${\bm{k}}\in\mathbb{N}^{\eta}$ such that for all $r\geq 0,|{\bm{k}}^{(r)}|\leq j^{(r)}$, we have

[TABLE]

5 Analyses of sequences of degree sets

For a generic tuple $(\eta,q,d)$, it seems difficult to give an explicit description of the degree set of $\operatorname{Lift}^{\eta}\operatorname{RS}_{q}(d)$. Our approach is to analyse sequences of degree sets $D(q,d,\eta)$ with varying parameters $q=p^{e}$, $d$, and $\eta$, in order to produce good asymptotic families of codes.

We will illustrate our analyses with graphical representations of degree sets. Our convention is the following. Assume one wants to represent a degree set $D\subseteq[q-1]^{2}$. If $(i,j)\in D$, then a black (or sometimes grey) unit square is represented at coordinate $(i,j)$; otherwise, a white unit square is plotted. Such an illustration is proposed in Example 5.1.

Example 5.1**.**

The degree set $D$ of $\operatorname{Lift}^{2}(\operatorname{RS}_{8}(5))$, namely

[TABLE]

is represented in Figure 2.

Let us now provide generic relations between $\eta$-lifted codes of varying parameters.

5.1 Increasing and decreasing sequences of $\eta$-lifted codes

5.1.1 Sequence $(D(q,d,\eta))_{\eta\geq 1}$, with $(q,d)$ fixed and varying $\eta$

Lemma 5.2**.**

Let us fix a prime power $q$ and $d\leq q-1$. The sequence of codes $(\operatorname{Lift}^{\eta}\operatorname{RS}_{q}(d))_{\eta\geq 1}$ is decreasing with respect to the inclusion of codes.

Proof.

It is enough to notice that an $\eta$-line is also an $(\eta+1)$-line, therefore every codeword of $\operatorname{Lift}^{\eta+1}\operatorname{RS}_{q}(d)$ fulfills the constraints defining $\operatorname{Lift}^{\eta}\operatorname{RS}_{q}(d)$. ∎

In Figure 3, we plot a sequence of degree sets which illustrates this result on $\mathbb{F}_{16}$.

5.1.2 Sequence $(D(q,d,\eta))_{0\leq d\leq q-2}$ with $(q,\eta)$ fixed and varying $d$

Lemma 5.3**.**

Let us fix a prime power $q$ and $\eta\geq 1$. The sequence $(\operatorname{Lift}^{\eta}\operatorname{RS}_{q}(d))_{d\geq 0}$ is increasing.

Proof.

It is a straightforward consequence of the embedding of $\operatorname{RS}_{q}(d)$ into $\operatorname{RS}_{q}(d+1)$. ∎

In Figure 4, we plot a sequence of degree sets which illutrates this result on $\mathbb{F}_{16}$ with $\eta=2$.

5.1.3 Sequence $(D(q,q-\alpha,\eta))_{q}$ with fixed $(\alpha,\eta)$, and varying $q$

Let us fix a prime number $p$, and let us consider a sequence of degree sets $(D(p^{e},p^{e}-\alpha,\eta))_{e\geq 1}$ with fixed $(\alpha,\eta)$, and varying $e$. Figure 5 represents such a sequence. In this figure, one can notice that $D(p^{e},p^{e}-\alpha,\eta)$ is a subpattern (highlighted in grey) of the larger degree sets $D(p^{e+1},p^{e+1}-\alpha,\eta)$.

This remark seems trivial at first, but it has a meaningful consequence in terms of codes. Indeed, it shows that the corresponding $\eta$-lifted codes are (up to isomophism) subcodes to each other when the field size $q=p^{e}$ grows. This property is formalized in the following lemma.

Lemma 5.4**.**

Let $\eta<q=p^{e}$ and $2\leq\alpha\leq p^{e}$. If $(p^{e}-i,j)\in D(p^{e},p^{e}-\alpha,\eta)$, then

[TABLE]

Proof.

Let $(p^{e}-i,j)\in D(p^{e},p^{e}-\alpha,\eta)$, and consider ${\bm{k}}\in\mathbb{N}$ such that $|{\bm{k}}^{(r)}|\leq j^{(r)}$ for every $r\geq 0$. Using Proposition 4.11, we know that ${\rm Red}^{\star}_{p^{e}}((p^{e}-i)+{\left\langle{\bm{w}},{\bm{k}}\right\rangle})\leq p^{e}-\alpha$, and we want to prove that ${\rm Red}^{\star}_{p^{e+1}}(p^{e+1}-i)\leq p^{e+1}-\alpha$.

Notice that there exists $(Q_{0},Q_{1},R)\in\mathbb{N}^{3}$ satisfying:

[TABLE]

with $Q_{0}\leq p-1$ and $R\leq p^{e}-\alpha$. Since ${\left\langle{\bm{w}},{\bm{k}}\right\rangle}\leq\eta|{\bm{k}}|\leq\eta j\leq\eta(p^{e}-1)$, one can also check that $Q_{1}p+Q_{0}\leq\eta+1$.

The case $R=0$ must be handled at first. Notice that this implies that $(p^{e}-i)+{\left\langle{\bm{w}},{\bm{k}}\right\rangle}=0$, meaning that $(p^{e}-i,j)=(0,0)$. Then one can check that $(p^{e+1}-p^{e},0)\in D(p^{e+1},p^{e+1}-\alpha,\eta)$ since $\alpha\leq p^{e}$. Hence, from now on, we assume that $R\geq 1$, and we distinguish two cases.

First, assume that $Q_{0}\geq 1$. Then we have

[TABLE]

where

[TABLE]

We see that $p^{e+1}-i+{\left\langle{\bm{w}},{\bm{k}}\right\rangle}\,\equiv^{\star}_{p^{e+1}}\,R^{\prime}$, hence it is sufficient to prove that $1\leq R^{\prime}\leq p^{e+1}-\alpha$. Using $R\leq p^{e}-\alpha$ and $Q_{0}\leq p-1$, we get $R^{\prime}\leq p^{e+1}-\alpha$. Now, notice that $Q_{1}\leq\frac{\eta+1-Q_{0}}{p}\leq\lfloor\frac{p^{e}-1}{p}\rfloor=p^{e-1}-1$. Hence,

[TABLE]

Now, assume that $Q_{0}=0$. We thus have

[TABLE]

where

[TABLE]

Once again, let us prove that $1\leq R^{\prime}\leq p^{e+1}-\alpha$. It is straightforward to check that $R^{\prime}\leq p^{e+1}-\alpha$. Moreover, $Q_{1}\leq\frac{\eta+1}{p}\leq p^{e-1}$, leading to

[TABLE]

∎

5.2 On the asymptotic information rate of $\operatorname{Lift}^{\eta}(\operatorname{RS}_{q}(d))$ when $q\to\infty$

In this section, we consider sequences of codes $\operatorname{Lift}^{\eta}\operatorname{RS}_{q}(d)$ where $q\geq 2$ varies exponentially (i.e. $q=p^{e}$ with increasing $e$), and where we see $d$ as a function of $q$ such that $d(q)\leq q-2$. Recall that $q$ represents simultaneously the size of the finite field and the square root of the code length. Throughout the section, we will write $q=p^{e}$.

To our opinion, two cases are of interest: $d=q-\alpha$ where $\alpha\geq 2$ is a fixed integer, and $d=\lfloor\gamma q\rfloor$ where $\gamma\in(0,1)$. In the first case ($d=q-\alpha$) we prove that we obtain $\eta$-lifted codes whose information rate grows to $1$ when $q\to\infty$. In the second case ($d=\lfloor\gamma q\rfloor$) we prove that the sequence of $\eta$-lifted codes admits an asymptotic information rate $R_{\gamma}>0$ when $q\to\infty$, meaning that this sequence of codes is asymptotically good and is locally correctable from a constant fraction of errors. In order to prove these results, we look for tight enough lower bounds on the dimension of $\eta$-lifted codes.

5.2.1 A lower bound for $|D(q,q-\alpha,\eta)|$.

We first highlight that, for a fixed $\alpha\geq 2$, the degree set $D(q,q-\alpha,\eta)$ of $\operatorname{Lift}^{\eta}\operatorname{RS}_{q}(q-\alpha)$ contains many copies of the degree set of $\operatorname{WRM}^{\eta}_{p^{\varepsilon}}(p^{\varepsilon}-\alpha-\eta)$, for $\varepsilon\leq e$. In terms of codes, it informally means that weighted Reed-Muller codes defined over several fields $\mathbb{F}_{p^{\varepsilon}}$ for $\varepsilon\leq e$, can be embedded in many different manners into $\eta$-lifted codes. This is formalized in the following proposition.

Proposition 5.5**.**

Let $0\leq\varepsilon\leq e$, $\alpha\in[0,p^{\varepsilon}-1]$ and $(i,j)\in\operatorname{Deg}(\operatorname{WRM}^{\eta}_{p^{\varepsilon}}(p^{\varepsilon}-\alpha-\eta))$. Then, for every $0\leq a,b\leq p^{e-\varepsilon}-1$, we have

[TABLE]

Proof.

Assume that $(i,j)\in\operatorname{Deg}(\operatorname{WRM}^{\eta}_{p^{\varepsilon}}(p^{\varepsilon}-\alpha-\eta))$. Then $i+\eta j\leq p^{\varepsilon}-\alpha-\eta$. We use the characterisation of Proposition 4.11 to prove our result.

Take ${\bm{k}}\in\mathbb{N}^{\eta}$ such that for all $r\geq 0$, $\sum_{\ell=1}^{\eta}k_{\ell}^{(r)}\leq(j+bp^{\varepsilon})^{(r)}$. Then

[TABLE]

Our purpose is to bound ${\rm Red}^{\star}_{p^{e}}(i+ap^{\varepsilon}+{\left\langle{\bm{w}},{\bm{k}}\right\rangle})$. We see that

[TABLE]

where $R_{1}\coloneqq i+\sum_{\ell=0}^{\eta}\ell\sum_{r=0}^{\varepsilon-1}k_{\ell}^{(r)}p^{r}$ and $R_{2}\coloneqq a+\sum_{\ell=0}^{\eta}\ell\sum_{r=\varepsilon}^{e-1}k_{\ell}^{(r)}p^{r-\varepsilon}$.

One can check that $R_{1}\leq i+\eta j\leq p^{\varepsilon}-\alpha-\eta$. It remains to deal with $R_{2}$. Let us write $R_{2}=\sum_{r=0}^{e-\varepsilon-1}R_{2}^{(r)}p^{r}+R_{2}^{\prime}p^{e-\varepsilon}$ with $R_{2}^{\prime}\leq\eta$. Then

[TABLE]

Therefore,

[TABLE]

which proves that $(i+ap^{\varepsilon},j+bp^{\varepsilon})$ belongs to $D(p^{e},p^{e}-\alpha,\eta)$. ∎

Notice that $\operatorname{WRM}^{\eta}_{p^{\varepsilon}}(p^{\varepsilon}-\alpha-\eta)=\{{\bm{0}}\}$ if $\alpha\geq p^{\varepsilon}$. Therefore let us set $e_{\alpha}=\lfloor\log_{p}\alpha\rfloor$ and define

[TABLE]

as the degree set of weighted Reed-Muller codes over $\mathbb{F}_{p^{e}}$, translated by $(ap^{\varepsilon},bp^{\varepsilon})$. Proposition 5.5 ensures that:

[TABLE]

Equation (5) helps us to obtain a first lower bound on the dimension of lifted codes. It is clear that $\mathcal{W}(\varepsilon,a,b)\cap\mathcal{W}(\varepsilon,a^{\prime},b^{\prime})=\varnothing$ if $(a^{\prime},b^{\prime})\neq(a,b)$. Unfortunately, the union given in (5) is not disjoint, as illustrated in Figure 6. The main reason is that $\mathcal{W}(\varepsilon,a,b)$ contains a certain number of degree sets of the form $\mathcal{W}(\varepsilon^{\prime},a^{\prime},b^{\prime})$, for $\varepsilon^{\prime}<\varepsilon$. We compute this precise number in Lemma 5.6.

For $m\geq 0$, we set

[TABLE]

One can check that $T_{m}$ is a positive integer which counts the number of pairs of non-negative integers $(u,v)$ such that $u+\eta v\leq p^{m}-1$.

Lemma 5.6**.**

Fix $e_{\alpha}+1\leq\varepsilon_{1}\leq\varepsilon_{2}\leq e$. Then, for all $0\leq a_{2},b_{2}<p^{e-\varepsilon_{2}}$, we have:

[TABLE]

Proof.

We first notice that ${\cal W}(\varepsilon_{1},a_{1},b_{1})\subseteq{\cal W}(\varepsilon_{2},a_{2},b_{2})$ if and only if

[TABLE]

Moreover, for $u,v\geq 0$, we see that ${\cal W}(\varepsilon_{1},u,v)\subseteq{\cal W}(\varepsilon_{2},0,0)$ if and only if for every $i,j\geq 0$, we have

[TABLE]

which is equivalent to $(u+\eta v)p^{\varepsilon_{1}}\leq p^{\varepsilon_{2}}-p^{\varepsilon_{1}}$. It remains to notice that $T_{\varepsilon_{2}-\varepsilon_{1}}$ counts the number of non-negative integers $u,v$ such that

[TABLE]

∎

For any $m\in\mathbb{N}$, we set

[TABLE]

Let us also define $N_{0}\coloneqq 1$, and

[TABLE]

as the number of triangles $\mathcal{W}(e-m,a,b)$ that are not included in any $\mathcal{W}(e-m^{\prime},a^{\prime},b^{\prime})$ with $m^{\prime}\leq m$. Notice that, equivalently, we have

[TABLE]

Example 5.7**.**

As displayed in Figure 6, for $p=3$ and $\eta=2$, the first terms of the sequence $(N_{m})$ are 1, 5, 36, 264.

The following theorem can be proven by a simple counting argument.

Theorem 5.8**.**

Fix $\alpha\geq 2$, $\eta\geq 1$ and a prime power $q=p^{e}$. Let $(W_{m}(\alpha))_{m\leq e}$ and $(N_{m})_{m\leq e}$ be the sequences defined above. Then, the dimension $|D(q,q-\alpha,\eta)|$ of $\operatorname{Lift}^{\eta}\operatorname{RS}_{q}(q-\alpha)$ is lower bounded by

[TABLE]

where $e_{\alpha}=\lfloor\log_{p}\alpha\rfloor$.

5.2.2 Asymptotical behaviour of the sequences $(T_{m})$, $(W_{m}(\alpha))$ and $(N_{m})$

Let us sum up the asymptotics of the sequences introduced in the previous paragraph.

Lemma 5.9**.**

When $m\rightarrow+\infty$,

$T_{m}\sim\frac{p^{2m}}{2\eta}$, 2. 2.

$W_{m}(\alpha)\sim T_{m}$* for any $\alpha\geq 2$.*

The following technical lemma will be useful in the proof of Theorem 5.11.

Lemma 5.10**.**

Let $(N_{m})$ be the sequence defined in (8). Then

[TABLE]

Proof.

Let us first prove that the series $\sum_{\ell\geq 0}\frac{N_{\ell}}{p^{2\ell}}$ is convergent. Fix $\delta>0$.

By Lemma 5.9, $T_{m}\sim\frac{p^{2m}}{2\eta}$. Hence there exists $L\in\mathbb{N}$ such that for any $\ell\geq L$, $p^{2\ell}\leq(2\eta+\delta)T_{\ell}$. Therefore, using (8), we get

[TABLE]

since $m-\ell\geq L\iff\ell\leq m-L$.

Notice that all the terms of the first sum are non-negative. Hence by (9), we have $\sum_{\ell=0}^{m-L}N_{\ell}T_{m-\ell}\leq p^{2m}$, leading to

[TABLE]

It remains to notice that the right handside sum is finite, and each summand $N_{\ell}/p^{2\ell}$ is trivially bounded by $1$. Therefore $\sum_{\ell\geq 0}N_{\ell}/p^{2\ell}$ is convergent.

Denote by $S$ its limit. We know there exists $M\in\mathbb{N}$ such that, for any $m\geq M$ it holds that

[TABLE]

As a consequence, $\sum_{\ell=M+1}^{m}N_{\ell}/p^{2\ell}\leq 2\delta$ and since $\sum_{\ell=0}^{M}N_{\ell}/p^{2\ell}\leq S$, we get

[TABLE]

which concludes the proof. ∎

5.2.3 Asymptotics of the rate of $\operatorname{Lift}^{\eta}\operatorname{RS}_{q}(q-\alpha)$ when $q\to\infty$ and $\alpha$ is fixed

Theorem 5.11**.**

Let $\alpha\geq 2$, $\eta\geq 1$ and $p$ be a prime number. Define $e_{\alpha}=\lfloor\log_{p}\alpha\rfloor$, and consider the sequence of codes $\mathcal{C}_{e}=\operatorname{Lift}^{\eta}\operatorname{RS}_{p^{e}}(p^{e}-\alpha)$, for $e\geq e_{\alpha}$. Then, the information rate $R_{e}$ of $\mathcal{C}_{e}$ approaches $1$ when $e\to\infty$.

Proof.

By Lemma 5.9, $W_{m}(\alpha)\sim_{m\rightarrow+\infty}T_{m}$. Fix $\delta>0$ and let $M\geq e_{\alpha}$ such that for every $m\geq M$, $W_{m}(\alpha)\geq(1-\delta)T_{m}$.

Using Theorem 5.8, we thus get

[TABLE]

Then, by Lemma 5.10, both terms $\sum_{\varepsilon=e-M+1}^{e}N_{\varepsilon}/p^{2e}$ and $\sum_{\varepsilon=e-M+1}^{e-e_{\alpha}-1}N_{\varepsilon}/p^{2e}$ vanish when $e\to\infty$. Hence we get

[TABLE]

∎

Example 5.12**.**

Let us give some numerical computations of the dimension and information rate of $\operatorname{Lift}^{\eta}\operatorname{RS}_{p^{e}}(p^{e}-\alpha)$ illustrating Theorem 5.11.

[TABLE]

In Figure 7, we also represent the degree sets of $\operatorname{Lift}^{2}\operatorname{RS}_{2^{e}}(2^{e}-\alpha)$ for $\alpha=3$ and $e\in\{7,8,9,10\}$.

5.2.4 Asymptotics of the rate of $\operatorname{Lift}^{\eta}\operatorname{RS}_{q}(\lfloor\gamma q\rfloor)$ when $q\to\infty$ and $\gamma$ is fixed

Theorem 5.13**.**

Let $c\geq 1$, $\eta\geq 1$ and $p$ be a prime number. Define $\gamma=1-p^{-c}$, and consider the sequence of codes $\mathcal{C}_{e}=\operatorname{Lift}^{\eta}\operatorname{RS}_{p^{e}}(\gamma p^{e})$, for $e\geq c+1$. Then, the information rate $R_{e}$ of $\mathcal{C}_{e}$ satisfies:

[TABLE]

Proof.

By Proposition 5.5,

[TABLE]

Moreover, using (7), for every fixed $\varepsilon\leq c-1$ we have

[TABLE]

Then

[TABLE]

∎

Example 5.14**.**

Let us give some numerical computations, illustrating the tightness of the bound given in Theorem 5.13.

[TABLE]

In Figure 8, we also represent the degree sets $D(2^{e},2^{e}-2^{e-c},\eta)$ for $p=2$, $\eta=2$, $c=4$ and $e\in\{5,6,7,8\}$.

Acknowledgements

Part of this work was done while the first author was affiliated to LIX, École Polytechnique, Inria & CNRS UMR 7161, University Paris-Saclay, Palaiseau, France. The first author is now funded by the French Direction Générale de l’Armement, through the Pôle d’excellence cyber. This work was also funded in part by the grant ANR-15-CE39-0013-01 “Manta” from the French National Research Agency, which gave the authors the opportunity to work together.